parse.y revision 171172
1171172Smlaier/* $OpenBSD: parse.y,v 1.517 2007/02/03 23:26:40 dhartmei Exp $ */ 2126353Smlaier 3126353Smlaier/* 4126353Smlaier * Copyright (c) 2001 Markus Friedl. All rights reserved. 5126353Smlaier * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 6130617Smlaier * Copyright (c) 2001 Theo de Raadt. All rights reserved. 7130617Smlaier * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 8126353Smlaier * 9126353Smlaier * Redistribution and use in source and binary forms, with or without 10126353Smlaier * modification, are permitted provided that the following conditions 11126353Smlaier * are met: 12126353Smlaier * 1. Redistributions of source code must retain the above copyright 13126353Smlaier * notice, this list of conditions and the following disclaimer. 14126353Smlaier * 2. Redistributions in binary form must reproduce the above copyright 15126353Smlaier * notice, this list of conditions and the following disclaimer in the 16126353Smlaier * documentation and/or other materials provided with the distribution. 17126353Smlaier * 18126353Smlaier * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19126353Smlaier * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20126353Smlaier * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21126353Smlaier * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22126353Smlaier * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23126353Smlaier * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24126353Smlaier * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25126353Smlaier * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26126353Smlaier * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27126353Smlaier * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28126353Smlaier */ 29126353Smlaier%{ 30127082Sobrien#include <sys/cdefs.h> 31127082Sobrien__FBSDID("$FreeBSD: head/contrib/pf/pfctl/parse.y 171172 2007-07-03 12:30:03Z mlaier $"); 32127082Sobrien 33126353Smlaier#include <sys/types.h> 34126353Smlaier#include <sys/socket.h> 35126353Smlaier#include <net/if.h> 36126353Smlaier#include <netinet/in.h> 37126353Smlaier#include <netinet/in_systm.h> 38126353Smlaier#include <netinet/ip.h> 39126353Smlaier#include <netinet/ip_icmp.h> 40126353Smlaier#include <netinet/icmp6.h> 41126353Smlaier#include <net/pfvar.h> 42126353Smlaier#include <arpa/inet.h> 43126353Smlaier#include <altq/altq.h> 44126353Smlaier#include <altq/altq_cbq.h> 45126353Smlaier#include <altq/altq_priq.h> 46126353Smlaier#include <altq/altq_hfsc.h> 47126353Smlaier 48126353Smlaier#include <stdio.h> 49126353Smlaier#include <stdlib.h> 50126353Smlaier#include <netdb.h> 51126353Smlaier#include <stdarg.h> 52126353Smlaier#include <errno.h> 53126353Smlaier#include <string.h> 54126353Smlaier#include <ctype.h> 55145840Smlaier#include <math.h> 56126353Smlaier#include <err.h> 57127024Smlaier#include <limits.h> 58126353Smlaier#include <pwd.h> 59126353Smlaier#include <grp.h> 60126353Smlaier#include <md5.h> 61126353Smlaier 62126353Smlaier#include "pfctl_parser.h" 63126353Smlaier#include "pfctl.h" 64126353Smlaier 65127024Smlaier#ifdef __FreeBSD__ 66126361Smlaier#define HTONL(x) (x) = htonl((__uint32_t)(x)) 67126361Smlaier#endif 68126361Smlaier 69126353Smlaierstatic struct pfctl *pf = NULL; 70126353Smlaierstatic FILE *fin = NULL; 71126353Smlaierstatic int debug = 0; 72126353Smlaierstatic int lineno = 1; 73126353Smlaierstatic int errors = 0; 74126353Smlaierstatic int rulestate = 0; 75126353Smlaierstatic u_int16_t returnicmpdefault = 76126353Smlaier (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 77126353Smlaierstatic u_int16_t returnicmp6default = 78126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 79126353Smlaierstatic int blockpolicy = PFRULE_DROP; 80126353Smlaierstatic int require_order = 1; 81130617Smlaierstatic int default_statelock; 82126353Smlaier 83126353Smlaierenum { 84126353Smlaier PFCTL_STATE_NONE, 85126353Smlaier PFCTL_STATE_OPTION, 86126353Smlaier PFCTL_STATE_SCRUB, 87126353Smlaier PFCTL_STATE_QUEUE, 88126353Smlaier PFCTL_STATE_NAT, 89126353Smlaier PFCTL_STATE_FILTER 90126353Smlaier}; 91126353Smlaier 92126353Smlaierstruct node_proto { 93126353Smlaier u_int8_t proto; 94126353Smlaier struct node_proto *next; 95126353Smlaier struct node_proto *tail; 96126353Smlaier}; 97126353Smlaier 98126353Smlaierstruct node_port { 99126353Smlaier u_int16_t port[2]; 100126353Smlaier u_int8_t op; 101126353Smlaier struct node_port *next; 102126353Smlaier struct node_port *tail; 103126353Smlaier}; 104126353Smlaier 105126353Smlaierstruct node_uid { 106126353Smlaier uid_t uid[2]; 107126353Smlaier u_int8_t op; 108126353Smlaier struct node_uid *next; 109126353Smlaier struct node_uid *tail; 110126353Smlaier}; 111126353Smlaier 112126353Smlaierstruct node_gid { 113126353Smlaier gid_t gid[2]; 114126353Smlaier u_int8_t op; 115126353Smlaier struct node_gid *next; 116126353Smlaier struct node_gid *tail; 117126353Smlaier}; 118126353Smlaier 119126353Smlaierstruct node_icmp { 120126353Smlaier u_int8_t code; 121126353Smlaier u_int8_t type; 122126353Smlaier u_int8_t proto; 123126353Smlaier struct node_icmp *next; 124126353Smlaier struct node_icmp *tail; 125126353Smlaier}; 126126353Smlaier 127130617Smlaierenum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 128145840Smlaier PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 129145840Smlaier PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 130145840Smlaier PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 131145840Smlaier PF_STATE_OPT_TIMEOUT }; 132130617Smlaier 133130617Smlaierenum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 134130617Smlaier 135126353Smlaierstruct node_state_opt { 136126353Smlaier int type; 137126353Smlaier union { 138126353Smlaier u_int32_t max_states; 139130617Smlaier u_int32_t max_src_states; 140145840Smlaier u_int32_t max_src_conn; 141145840Smlaier struct { 142145840Smlaier u_int32_t limit; 143145840Smlaier u_int32_t seconds; 144145840Smlaier } max_src_conn_rate; 145145840Smlaier struct { 146145840Smlaier u_int8_t flush; 147145840Smlaier char tblname[PF_TABLE_NAME_SIZE]; 148145840Smlaier } overload; 149130617Smlaier u_int32_t max_src_nodes; 150130617Smlaier u_int8_t src_track; 151130617Smlaier u_int32_t statelock; 152126353Smlaier struct { 153126353Smlaier int number; 154126353Smlaier u_int32_t seconds; 155126353Smlaier } timeout; 156126353Smlaier } data; 157126353Smlaier struct node_state_opt *next; 158126353Smlaier struct node_state_opt *tail; 159126353Smlaier}; 160126353Smlaier 161126353Smlaierstruct peer { 162126353Smlaier struct node_host *host; 163126353Smlaier struct node_port *port; 164126353Smlaier}; 165126353Smlaier 166126353Smlaierstruct node_queue { 167126353Smlaier char queue[PF_QNAME_SIZE]; 168126353Smlaier char parent[PF_QNAME_SIZE]; 169126353Smlaier char ifname[IFNAMSIZ]; 170126353Smlaier int scheduler; 171126353Smlaier struct node_queue *next; 172126353Smlaier struct node_queue *tail; 173126353Smlaier} *queues = NULL; 174126353Smlaier 175126353Smlaierstruct node_qassign { 176126353Smlaier char *qname; 177126353Smlaier char *pqname; 178126353Smlaier}; 179126353Smlaier 180126353Smlaierstruct filter_opts { 181126353Smlaier int marker; 182126353Smlaier#define FOM_FLAGS 0x01 183126353Smlaier#define FOM_ICMP 0x02 184126353Smlaier#define FOM_TOS 0x04 185126353Smlaier#define FOM_KEEP 0x08 186130617Smlaier#define FOM_SRCTRACK 0x10 187126353Smlaier struct node_uid *uid; 188126353Smlaier struct node_gid *gid; 189126353Smlaier struct { 190126353Smlaier u_int8_t b1; 191126353Smlaier u_int8_t b2; 192126353Smlaier u_int16_t w; 193126353Smlaier u_int16_t w2; 194126353Smlaier } flags; 195126353Smlaier struct node_icmp *icmpspec; 196126353Smlaier u_int32_t tos; 197145840Smlaier u_int32_t prob; 198126353Smlaier struct { 199126353Smlaier int action; 200126353Smlaier struct node_state_opt *options; 201126353Smlaier } keep; 202126353Smlaier int fragment; 203126353Smlaier int allowopts; 204126353Smlaier char *label; 205126353Smlaier struct node_qassign queues; 206126353Smlaier char *tag; 207126353Smlaier char *match_tag; 208126353Smlaier u_int8_t match_tag_not; 209171172Smlaier int rtableid; 210126353Smlaier} filter_opts; 211126353Smlaier 212126353Smlaierstruct antispoof_opts { 213126353Smlaier char *label; 214171172Smlaier int rtableid; 215126353Smlaier} antispoof_opts; 216126353Smlaier 217126353Smlaierstruct scrub_opts { 218126353Smlaier int marker; 219126353Smlaier#define SOM_MINTTL 0x01 220126353Smlaier#define SOM_MAXMSS 0x02 221126353Smlaier#define SOM_FRAGCACHE 0x04 222126353Smlaier int nodf; 223126353Smlaier int minttl; 224126353Smlaier int maxmss; 225126353Smlaier int fragcache; 226126353Smlaier int randomid; 227126353Smlaier int reassemble_tcp; 228171172Smlaier int rtableid; 229126353Smlaier} scrub_opts; 230126353Smlaier 231126353Smlaierstruct queue_opts { 232126353Smlaier int marker; 233126353Smlaier#define QOM_BWSPEC 0x01 234126353Smlaier#define QOM_SCHEDULER 0x02 235126353Smlaier#define QOM_PRIORITY 0x04 236126353Smlaier#define QOM_TBRSIZE 0x08 237126353Smlaier#define QOM_QLIMIT 0x10 238126353Smlaier struct node_queue_bw queue_bwspec; 239126353Smlaier struct node_queue_opt scheduler; 240126353Smlaier int priority; 241126353Smlaier int tbrsize; 242126353Smlaier int qlimit; 243126353Smlaier} queue_opts; 244126353Smlaier 245126353Smlaierstruct table_opts { 246126353Smlaier int flags; 247126353Smlaier int init_addr; 248126353Smlaier struct node_tinithead init_nodes; 249126353Smlaier} table_opts; 250126353Smlaier 251130617Smlaierstruct pool_opts { 252130617Smlaier int marker; 253130617Smlaier#define POM_TYPE 0x01 254130617Smlaier#define POM_STICKYADDRESS 0x02 255130617Smlaier u_int8_t opts; 256130617Smlaier int type; 257130617Smlaier int staticport; 258130617Smlaier struct pf_poolhashkey *key; 259130617Smlaier 260130617Smlaier} pool_opts; 261130617Smlaier 262130617Smlaier 263126353Smlaierstruct node_hfsc_opts hfsc_opts; 264126353Smlaier 265126353Smlaierint yyerror(const char *, ...); 266126353Smlaierint disallow_table(struct node_host *, const char *); 267171172Smlaierint disallow_urpf_failed(struct node_host *, const char *); 268130617Smlaierint disallow_alias(struct node_host *, const char *); 269171172Smlaierint rule_consistent(struct pf_rule *, int); 270171172Smlaierint filter_consistent(struct pf_rule *, int); 271126353Smlaierint nat_consistent(struct pf_rule *); 272126353Smlaierint rdr_consistent(struct pf_rule *); 273126353Smlaierint process_tabledef(char *, struct table_opts *); 274126353Smlaierint yyparse(void); 275130617Smlaiervoid expand_label_str(char *, size_t, const char *, const char *); 276130617Smlaiervoid expand_label_if(const char *, char *, size_t, const char *); 277130617Smlaiervoid expand_label_addr(const char *, char *, size_t, u_int8_t, 278130617Smlaier struct node_host *); 279130617Smlaiervoid expand_label_port(const char *, char *, size_t, struct node_port *); 280130617Smlaiervoid expand_label_proto(const char *, char *, size_t, u_int8_t); 281130617Smlaiervoid expand_label_nr(const char *, char *, size_t); 282130617Smlaiervoid expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 283126353Smlaier struct node_port *, struct node_host *, struct node_port *, 284126353Smlaier u_int8_t); 285126353Smlaiervoid expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 286126353Smlaier struct node_proto *, struct node_os*, struct node_host *, 287126353Smlaier struct node_port *, struct node_host *, struct node_port *, 288145840Smlaier struct node_uid *, struct node_gid *, struct node_icmp *, 289145840Smlaier const char *); 290126353Smlaierint expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 291126353Smlaier struct node_queue_bw bwspec, struct node_queue_opt *); 292126353Smlaierint expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 293126353Smlaier struct node_queue_bw, struct node_queue_opt *); 294145840Smlaierint expand_skip_interface(struct node_if *); 295126353Smlaier 296126353Smlaierint check_rulestate(int); 297126353Smlaierint kw_cmp(const void *, const void *); 298126353Smlaierint lookup(char *); 299126353Smlaierint lgetc(FILE *); 300126353Smlaierint lungetc(int); 301126353Smlaierint findeol(void); 302126353Smlaierint yylex(void); 303126353Smlaierint atoul(char *, u_long *); 304126353Smlaierint getservice(char *); 305126353Smlaierint rule_label(struct pf_rule *, char *); 306126353Smlaier 307126353SmlaierTAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 308126353Smlaierstruct sym { 309126353Smlaier TAILQ_ENTRY(sym) entries; 310126353Smlaier int used; 311126353Smlaier int persist; 312126353Smlaier char *nam; 313126353Smlaier char *val; 314126353Smlaier}; 315126353Smlaier 316126353Smlaier 317126353Smlaierint symset(const char *, const char *, int); 318126353Smlaierchar *symget(const char *); 319126353Smlaier 320171172Smlaiervoid mv_rules(struct pf_ruleset *, struct pf_ruleset *); 321126353Smlaiervoid decide_address_family(struct node_host *, sa_family_t *); 322126353Smlaiervoid remove_invalid_hosts(struct node_host **, sa_family_t *); 323126353Smlaierint invalid_redirect(struct node_host *, sa_family_t); 324126353Smlaieru_int16_t parseicmpspec(char *, sa_family_t); 325126353Smlaier 326130617SmlaierTAILQ_HEAD(loadanchorshead, loadanchors) 327130617Smlaier loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 328130617Smlaier 329126353Smlaierstruct loadanchors { 330126353Smlaier TAILQ_ENTRY(loadanchors) entries; 331126353Smlaier char *anchorname; 332126353Smlaier char *filename; 333126353Smlaier}; 334126353Smlaier 335126353Smlaiertypedef struct { 336126353Smlaier union { 337126353Smlaier u_int32_t number; 338126353Smlaier int i; 339126353Smlaier char *string; 340171172Smlaier int rtableid; 341126353Smlaier struct { 342126353Smlaier u_int8_t b1; 343126353Smlaier u_int8_t b2; 344126353Smlaier u_int16_t w; 345126353Smlaier u_int16_t w2; 346126353Smlaier } b; 347126353Smlaier struct range { 348126353Smlaier int a; 349126353Smlaier int b; 350126353Smlaier int t; 351126353Smlaier } range; 352126353Smlaier struct node_if *interface; 353126353Smlaier struct node_proto *proto; 354126353Smlaier struct node_icmp *icmp; 355126353Smlaier struct node_host *host; 356126353Smlaier struct node_os *os; 357126353Smlaier struct node_port *port; 358126353Smlaier struct node_uid *uid; 359126353Smlaier struct node_gid *gid; 360126353Smlaier struct node_state_opt *state_opt; 361126353Smlaier struct peer peer; 362126353Smlaier struct { 363126353Smlaier struct peer src, dst; 364126353Smlaier struct node_os *src_os; 365126353Smlaier } fromto; 366126353Smlaier struct { 367126353Smlaier struct node_host *host; 368126353Smlaier u_int8_t rt; 369126353Smlaier u_int8_t pool_opts; 370126353Smlaier sa_family_t af; 371126353Smlaier struct pf_poolhashkey *key; 372126353Smlaier } route; 373126353Smlaier struct redirection { 374126353Smlaier struct node_host *host; 375126353Smlaier struct range rport; 376126353Smlaier } *redirection; 377126353Smlaier struct { 378126353Smlaier int action; 379126353Smlaier struct node_state_opt *options; 380126353Smlaier } keep_state; 381126353Smlaier struct { 382126353Smlaier u_int8_t log; 383171172Smlaier u_int8_t logif; 384126353Smlaier u_int8_t quick; 385126353Smlaier } logquick; 386145840Smlaier struct { 387145840Smlaier int neg; 388145840Smlaier char *name; 389145840Smlaier } tagged; 390130617Smlaier struct pf_poolhashkey *hashkey; 391126353Smlaier struct node_queue *queue; 392126353Smlaier struct node_queue_opt queue_options; 393126353Smlaier struct node_queue_bw queue_bwspec; 394126353Smlaier struct node_qassign qassign; 395126353Smlaier struct filter_opts filter_opts; 396126353Smlaier struct antispoof_opts antispoof_opts; 397126353Smlaier struct queue_opts queue_opts; 398126353Smlaier struct scrub_opts scrub_opts; 399126353Smlaier struct table_opts table_opts; 400130617Smlaier struct pool_opts pool_opts; 401126353Smlaier struct node_hfsc_opts hfsc_opts; 402126353Smlaier } v; 403126353Smlaier int lineno; 404126353Smlaier} YYSTYPE; 405126353Smlaier 406130617Smlaier#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 407130617Smlaier (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 408130617Smlaier !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 409130617Smlaier 410126353Smlaier%} 411126353Smlaier 412171172Smlaier%token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 413126353Smlaier%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 414126353Smlaier%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 415126353Smlaier%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 416171172Smlaier%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 417126353Smlaier%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 418126353Smlaier%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 419145840Smlaier%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 420126353Smlaier%token ANTISPOOF FOR 421145840Smlaier%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 422126353Smlaier%token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 423171172Smlaier%token QUEUE PRIORITY QLIMIT RTABLE 424171172Smlaier%token LOAD RULESET_OPTIMIZATION 425130617Smlaier%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 426145840Smlaier%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH 427171172Smlaier%token TAGGED TAG IFBOUND FLOATING STATEPOLICY ROUTE 428126353Smlaier%token <v.string> STRING 429126353Smlaier%token <v.i> PORTBINARY 430126353Smlaier%type <v.interface> interface if_list if_item_not if_item 431126353Smlaier%type <v.number> number icmptype icmp6type uid gid 432171172Smlaier%type <v.number> tos not yesno 433171172Smlaier%type <v.i> no dir af fragcache optimizer 434171172Smlaier%type <v.i> sourcetrack flush unaryop statelock 435171172Smlaier%type <v.b> action nataction natpass scrubaction 436145840Smlaier%type <v.b> flags flag blockspec 437126353Smlaier%type <v.range> port rport 438126353Smlaier%type <v.hashkey> hashkey 439126353Smlaier%type <v.proto> proto proto_list proto_item 440126353Smlaier%type <v.icmp> icmpspec 441126353Smlaier%type <v.icmp> icmp_list icmp_item 442126353Smlaier%type <v.icmp> icmp6_list icmp6_item 443126353Smlaier%type <v.fromto> fromto 444126353Smlaier%type <v.peer> ipportspec from to 445126353Smlaier%type <v.host> ipspec xhost host dynaddr host_list 446126353Smlaier%type <v.host> redir_host_list redirspec 447126353Smlaier%type <v.host> route_host route_host_list routespec 448126353Smlaier%type <v.os> os xos os_list 449126353Smlaier%type <v.port> portspec port_list port_item 450126353Smlaier%type <v.uid> uids uid_list uid_item 451126353Smlaier%type <v.gid> gids gid_list gid_item 452126353Smlaier%type <v.route> route 453126353Smlaier%type <v.redirection> redirection redirpool 454171172Smlaier%type <v.string> label string tag anchorname 455126353Smlaier%type <v.keep_state> keep 456126353Smlaier%type <v.state_opt> state_opt_spec state_opt_list state_opt_item 457171172Smlaier%type <v.logquick> logquick quick log logopts logopt 458145840Smlaier%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 459126353Smlaier%type <v.qassign> qname 460126353Smlaier%type <v.queue> qassign qassign_list qassign_item 461126353Smlaier%type <v.queue_options> scheduler 462126353Smlaier%type <v.number> cbqflags_list cbqflags_item 463126353Smlaier%type <v.number> priqflags_list priqflags_item 464126353Smlaier%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 465126353Smlaier%type <v.queue_bwspec> bandwidth 466126353Smlaier%type <v.filter_opts> filter_opts filter_opt filter_opts_l 467126353Smlaier%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 468126353Smlaier%type <v.queue_opts> queue_opts queue_opt queue_opts_l 469126353Smlaier%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 470126353Smlaier%type <v.table_opts> table_opts table_opt table_opts_l 471130617Smlaier%type <v.pool_opts> pool_opts pool_opt pool_opts_l 472145840Smlaier%type <v.tagged> tagged 473171172Smlaier%type <v.rtableid> rtable 474126353Smlaier%% 475126353Smlaier 476126353Smlaierruleset : /* empty */ 477126353Smlaier | ruleset '\n' 478126353Smlaier | ruleset option '\n' 479126353Smlaier | ruleset scrubrule '\n' 480126353Smlaier | ruleset natrule '\n' 481126353Smlaier | ruleset binatrule '\n' 482126353Smlaier | ruleset pfrule '\n' 483126353Smlaier | ruleset anchorrule '\n' 484126353Smlaier | ruleset loadrule '\n' 485126353Smlaier | ruleset altqif '\n' 486126353Smlaier | ruleset queuespec '\n' 487126353Smlaier | ruleset varset '\n' 488126353Smlaier | ruleset antispoof '\n' 489126353Smlaier | ruleset tabledef '\n' 490171172Smlaier | '{' fakeanchor '}' '\n'; 491126353Smlaier | ruleset error '\n' { errors++; } 492126353Smlaier ; 493126353Smlaier 494171172Smlaier/* 495171172Smlaier * apply to previouslys specified rule: must be careful to note 496171172Smlaier * what that is: pf or nat or binat or rdr 497171172Smlaier */ 498171172Smlaierfakeanchor : fakeanchor '\n' 499171172Smlaier | fakeanchor anchorrule '\n' 500171172Smlaier | fakeanchor binatrule '\n' 501171172Smlaier | fakeanchor natrule '\n' 502171172Smlaier | fakeanchor pfrule '\n' 503171172Smlaier | fakeanchor error '\n' 504171172Smlaier ; 505171172Smlaier 506171172Smlaieroptimizer : string { 507171172Smlaier if (!strcmp($1, "none")) 508171172Smlaier $$ = 0; 509171172Smlaier else if (!strcmp($1, "basic")) 510171172Smlaier $$ = PF_OPTIMIZE_BASIC; 511171172Smlaier else if (!strcmp($1, "profile")) 512171172Smlaier $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 513171172Smlaier else { 514171172Smlaier yyerror("unknown ruleset-optimization %s", $$); 515171172Smlaier YYERROR; 516171172Smlaier } 517171172Smlaier } 518171172Smlaier ; 519171172Smlaier 520126353Smlaieroption : SET OPTIMIZATION STRING { 521130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 522130617Smlaier free($3); 523126353Smlaier YYERROR; 524130617Smlaier } 525126353Smlaier if (pfctl_set_optimization(pf, $3) != 0) { 526126353Smlaier yyerror("unknown optimization %s", $3); 527130617Smlaier free($3); 528126353Smlaier YYERROR; 529126353Smlaier } 530171172Smlaier free($3); 531126353Smlaier } 532171172Smlaier | SET RULESET_OPTIMIZATION optimizer { 533171172Smlaier if (!(pf->opts & PF_OPT_OPTIMIZE)) { 534171172Smlaier pf->opts |= PF_OPT_OPTIMIZE; 535171172Smlaier pf->optimize = $3; 536171172Smlaier } 537171172Smlaier } 538126353Smlaier | SET TIMEOUT timeout_spec 539126353Smlaier | SET TIMEOUT '{' timeout_list '}' 540126353Smlaier | SET LIMIT limit_spec 541126353Smlaier | SET LIMIT '{' limit_list '}' 542126353Smlaier | SET LOGINTERFACE STRING { 543130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 544130617Smlaier free($3); 545126353Smlaier YYERROR; 546130617Smlaier } 547126353Smlaier if (pfctl_set_logif(pf, $3) != 0) { 548126353Smlaier yyerror("error setting loginterface %s", $3); 549130617Smlaier free($3); 550126353Smlaier YYERROR; 551126353Smlaier } 552130617Smlaier free($3); 553126353Smlaier } 554130617Smlaier | SET HOSTID number { 555130617Smlaier if ($3 == 0) { 556130617Smlaier yyerror("hostid must be non-zero"); 557130617Smlaier YYERROR; 558130617Smlaier } 559130617Smlaier if (pfctl_set_hostid(pf, $3) != 0) { 560145840Smlaier yyerror("error setting hostid %08x", $3); 561130617Smlaier YYERROR; 562130617Smlaier } 563130617Smlaier } 564126353Smlaier | SET BLOCKPOLICY DROP { 565126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 566126353Smlaier printf("set block-policy drop\n"); 567126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 568126353Smlaier YYERROR; 569126353Smlaier blockpolicy = PFRULE_DROP; 570126353Smlaier } 571126353Smlaier | SET BLOCKPOLICY RETURN { 572126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 573126353Smlaier printf("set block-policy return\n"); 574126353Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) 575126353Smlaier YYERROR; 576126353Smlaier blockpolicy = PFRULE_RETURN; 577126353Smlaier } 578126353Smlaier | SET REQUIREORDER yesno { 579126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 580126353Smlaier printf("set require-order %s\n", 581126353Smlaier $3 == 1 ? "yes" : "no"); 582126353Smlaier require_order = $3; 583126353Smlaier } 584126353Smlaier | SET FINGERPRINTS STRING { 585126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 586171172Smlaier printf("set fingerprints \"%s\"\n", $3); 587130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 588130617Smlaier free($3); 589126353Smlaier YYERROR; 590130617Smlaier } 591171172Smlaier if (!pf->anchor->name[0]) { 592145840Smlaier if (pfctl_file_fingerprints(pf->dev, 593145840Smlaier pf->opts, $3)) { 594145840Smlaier yyerror("error loading " 595145840Smlaier "fingerprints %s", $3); 596145840Smlaier free($3); 597145840Smlaier YYERROR; 598145840Smlaier } 599126353Smlaier } 600130617Smlaier free($3); 601126353Smlaier } 602130617Smlaier | SET STATEPOLICY statelock { 603130617Smlaier if (pf->opts & PF_OPT_VERBOSE) 604130617Smlaier switch ($3) { 605130617Smlaier case 0: 606130617Smlaier printf("set state-policy floating\n"); 607130617Smlaier break; 608130617Smlaier case PFRULE_IFBOUND: 609130617Smlaier printf("set state-policy if-bound\n"); 610130617Smlaier break; 611130617Smlaier } 612130617Smlaier default_statelock = $3; 613130617Smlaier } 614130617Smlaier | SET DEBUG STRING { 615130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 616130617Smlaier free($3); 617130617Smlaier YYERROR; 618130617Smlaier } 619130617Smlaier if (pfctl_set_debug(pf, $3) != 0) { 620130617Smlaier yyerror("error setting debuglevel %s", $3); 621130617Smlaier free($3); 622130617Smlaier YYERROR; 623130617Smlaier } 624130617Smlaier free($3); 625130617Smlaier } 626145840Smlaier | SET SKIP interface { 627145840Smlaier if (expand_skip_interface($3) != 0) { 628145840Smlaier yyerror("error setting skip interface(s)"); 629145840Smlaier YYERROR; 630145840Smlaier } 631145840Smlaier } 632126353Smlaier ; 633126353Smlaier 634126353Smlaierstring : string STRING { 635126353Smlaier if (asprintf(&$$, "%s %s", $1, $2) == -1) 636126353Smlaier err(1, "string: asprintf"); 637126353Smlaier free($1); 638126353Smlaier free($2); 639126353Smlaier } 640126353Smlaier | STRING 641126353Smlaier ; 642126353Smlaier 643126353Smlaiervarset : STRING '=' string { 644126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 645126353Smlaier printf("%s = \"%s\"\n", $1, $3); 646126353Smlaier if (symset($1, $3, 0) == -1) 647126353Smlaier err(1, "cannot store variable %s", $1); 648130617Smlaier free($1); 649130617Smlaier free($3); 650126353Smlaier } 651126353Smlaier ; 652126353Smlaier 653171172Smlaieranchorname : STRING { $$ = $1; } 654171172Smlaier | /* empty */ { $$ = NULL; } 655171172Smlaier ; 656171172Smlaier 657171172Smlaieroptnl : optnl '\n' 658171172Smlaier | 659171172Smlaier ; 660171172Smlaier 661171172Smlaierpfa_anchorlist : pfrule optnl 662171172Smlaier | anchorrule optnl 663171172Smlaier | pfa_anchorlist pfrule optnl 664171172Smlaier | pfa_anchorlist anchorrule optnl 665171172Smlaier ; 666171172Smlaier 667171172Smlaierpfa_anchor : '{' 668171172Smlaier { 669171172Smlaier char ta[PF_ANCHOR_NAME_SIZE]; 670171172Smlaier struct pf_ruleset *rs; 671171172Smlaier 672171172Smlaier /* steping into a brace anchor */ 673171172Smlaier pf->asd++; 674171172Smlaier pf->bn++; 675171172Smlaier pf->brace = 1; 676171172Smlaier 677171172Smlaier /* create a holding ruleset in the root */ 678171172Smlaier snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 679171172Smlaier rs = pf_find_or_create_ruleset(ta); 680171172Smlaier if (rs == NULL) 681171172Smlaier err(1, "pfa_anchor: pf_find_or_create_ruleset"); 682171172Smlaier pf->astack[pf->asd] = rs->anchor; 683171172Smlaier pf->anchor = rs->anchor; 684171172Smlaier } '\n' pfa_anchorlist '}' 685171172Smlaier { 686171172Smlaier pf->alast = pf->anchor; 687171172Smlaier pf->asd--; 688171172Smlaier pf->anchor = pf->astack[pf->asd]; 689171172Smlaier } 690171172Smlaier | /* empty */ 691171172Smlaier ; 692171172Smlaier 693171172Smlaieranchorrule : ANCHOR anchorname dir quick interface af proto fromto 694171172Smlaier filter_opts pfa_anchor 695171172Smlaier { 696126353Smlaier struct pf_rule r; 697126353Smlaier 698130617Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) { 699171172Smlaier if ($2) 700171172Smlaier free($2); 701171172Smlaier YYERROR; 702171172Smlaier } 703171172Smlaier 704171172Smlaier if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 705130617Smlaier free($2); 706171172Smlaier yyerror("anchor names beginning with '_' " 707171172Smlaier "are reserved for internal use"); 708126353Smlaier YYERROR; 709130617Smlaier } 710126353Smlaier 711145840Smlaier memset(&r, 0, sizeof(r)); 712171172Smlaier if (pf->astack[pf->asd + 1]) { 713171172Smlaier /* move inline rules into relative location */ 714171172Smlaier pf_anchor_setup(&r, 715171172Smlaier &pf->astack[pf->asd]->ruleset, 716171172Smlaier $2 ? $2 : pf->alast->name); 717171172Smlaier 718171172Smlaier if (r.anchor == NULL) 719171172Smlaier err(1, "anchorrule: unable to " 720171172Smlaier "create ruleset"); 721171172Smlaier 722171172Smlaier if (pf->alast != r.anchor) { 723171172Smlaier if (r.anchor->match) { 724171172Smlaier yyerror("inline anchor '%s' " 725171172Smlaier "already exists", 726171172Smlaier r.anchor->name); 727171172Smlaier YYERROR; 728171172Smlaier } 729171172Smlaier mv_rules(&pf->alast->ruleset, 730171172Smlaier &r.anchor->ruleset); 731171172Smlaier } 732171172Smlaier pf_remove_if_empty_ruleset(&pf->alast->ruleset); 733171172Smlaier pf->alast = r.anchor; 734171172Smlaier } else { 735171172Smlaier if (!$2) { 736171172Smlaier yyerror("anchors without explicit " 737171172Smlaier "rules must specify a name"); 738171172Smlaier YYERROR; 739171172Smlaier } 740171172Smlaier } 741126353Smlaier r.direction = $3; 742171172Smlaier r.quick = $4.quick; 743171172Smlaier r.af = $6; 744171172Smlaier r.prob = $9.prob; 745171172Smlaier r.rtableid = $9.rtableid; 746126353Smlaier 747171172Smlaier if ($9.match_tag) 748171172Smlaier if (strlcpy(r.match_tagname, $9.match_tag, 749130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 750130617Smlaier yyerror("tag too long, max %u chars", 751130617Smlaier PF_TAG_NAME_SIZE - 1); 752130617Smlaier YYERROR; 753130617Smlaier } 754171172Smlaier r.match_tag_not = $9.match_tag_not; 755130617Smlaier 756171172Smlaier decide_address_family($8.src.host, &r.af); 757171172Smlaier decide_address_family($8.dst.host, &r.af); 758126353Smlaier 759171172Smlaier expand_rule(&r, $5, NULL, $7, $8.src_os, 760171172Smlaier $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 761171172Smlaier 0, 0, 0, pf->astack[pf->asd + 1] ? 762171172Smlaier pf->alast->name : $2); 763145840Smlaier free($2); 764171172Smlaier pf->astack[pf->asd + 1] = NULL; 765126353Smlaier } 766171172Smlaier | NATANCHOR string interface af proto fromto rtable { 767126353Smlaier struct pf_rule r; 768126353Smlaier 769130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 770130617Smlaier free($2); 771126353Smlaier YYERROR; 772130617Smlaier } 773126353Smlaier 774145840Smlaier memset(&r, 0, sizeof(r)); 775126353Smlaier r.action = PF_NAT; 776126353Smlaier r.af = $4; 777171172Smlaier r.rtableid = $7; 778126353Smlaier 779126353Smlaier decide_address_family($6.src.host, &r.af); 780126353Smlaier decide_address_family($6.dst.host, &r.af); 781126353Smlaier 782126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 783126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 784145840Smlaier 0, 0, 0, $2); 785145840Smlaier free($2); 786126353Smlaier } 787171172Smlaier | RDRANCHOR string interface af proto fromto rtable { 788126353Smlaier struct pf_rule r; 789126353Smlaier 790130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 791130617Smlaier free($2); 792126353Smlaier YYERROR; 793130617Smlaier } 794126353Smlaier 795145840Smlaier memset(&r, 0, sizeof(r)); 796126353Smlaier r.action = PF_RDR; 797126353Smlaier r.af = $4; 798171172Smlaier r.rtableid = $7; 799126353Smlaier 800126353Smlaier decide_address_family($6.src.host, &r.af); 801126353Smlaier decide_address_family($6.dst.host, &r.af); 802126353Smlaier 803126353Smlaier if ($6.src.port != NULL) { 804126353Smlaier yyerror("source port parameter not supported" 805126353Smlaier " in rdr-anchor"); 806126353Smlaier YYERROR; 807126353Smlaier } 808126353Smlaier if ($6.dst.port != NULL) { 809126353Smlaier if ($6.dst.port->next != NULL) { 810126353Smlaier yyerror("destination port list " 811126353Smlaier "expansion not supported in " 812126353Smlaier "rdr-anchor"); 813126353Smlaier YYERROR; 814126353Smlaier } else if ($6.dst.port->op != PF_OP_EQ) { 815126353Smlaier yyerror("destination port operators" 816126353Smlaier " not supported in rdr-anchor"); 817126353Smlaier YYERROR; 818126353Smlaier } 819126353Smlaier r.dst.port[0] = $6.dst.port->port[0]; 820126353Smlaier r.dst.port[1] = $6.dst.port->port[1]; 821126353Smlaier r.dst.port_op = $6.dst.port->op; 822126353Smlaier } 823126353Smlaier 824126353Smlaier expand_rule(&r, $3, NULL, $5, $6.src_os, 825126353Smlaier $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 826145840Smlaier 0, 0, 0, $2); 827145840Smlaier free($2); 828126353Smlaier } 829171172Smlaier | BINATANCHOR string interface af proto fromto rtable { 830126353Smlaier struct pf_rule r; 831126353Smlaier 832130617Smlaier if (check_rulestate(PFCTL_STATE_NAT)) { 833130617Smlaier free($2); 834126353Smlaier YYERROR; 835130617Smlaier } 836126353Smlaier 837145840Smlaier memset(&r, 0, sizeof(r)); 838126353Smlaier r.action = PF_BINAT; 839126353Smlaier r.af = $4; 840171172Smlaier r.rtableid = $7; 841126353Smlaier if ($5 != NULL) { 842126353Smlaier if ($5->next != NULL) { 843126353Smlaier yyerror("proto list expansion" 844126353Smlaier " not supported in binat-anchor"); 845126353Smlaier YYERROR; 846126353Smlaier } 847126353Smlaier r.proto = $5->proto; 848126353Smlaier free($5); 849126353Smlaier } 850126353Smlaier 851126353Smlaier if ($6.src.host != NULL || $6.src.port != NULL || 852126353Smlaier $6.dst.host != NULL || $6.dst.port != NULL) { 853126353Smlaier yyerror("fromto parameter not supported" 854126353Smlaier " in binat-anchor"); 855126353Smlaier YYERROR; 856126353Smlaier } 857126353Smlaier 858126353Smlaier decide_address_family($6.src.host, &r.af); 859126353Smlaier decide_address_family($6.dst.host, &r.af); 860126353Smlaier 861145840Smlaier pfctl_add_rule(pf, &r, $2); 862145840Smlaier free($2); 863126353Smlaier } 864126353Smlaier ; 865126353Smlaier 866126353Smlaierloadrule : LOAD ANCHOR string FROM string { 867126353Smlaier struct loadanchors *loadanchor; 868126353Smlaier 869171172Smlaier if (strlen(pf->anchor->name) + 1 + 870171172Smlaier strlen($3) >= MAXPATHLEN) { 871126353Smlaier yyerror("anchorname %s too long, max %u\n", 872145840Smlaier $3, MAXPATHLEN - 1); 873145840Smlaier free($3); 874126353Smlaier YYERROR; 875126353Smlaier } 876126353Smlaier loadanchor = calloc(1, sizeof(struct loadanchors)); 877126353Smlaier if (loadanchor == NULL) 878126353Smlaier err(1, "loadrule: calloc"); 879171172Smlaier if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 880171172Smlaier NULL) 881171172Smlaier err(1, "loadrule: malloc"); 882171172Smlaier if (pf->anchor->name[0]) 883171172Smlaier snprintf(loadanchor->anchorname, MAXPATHLEN, 884171172Smlaier "%s/%s", pf->anchor->name, $3); 885171172Smlaier else 886171172Smlaier strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 887126353Smlaier if ((loadanchor->filename = strdup($5)) == NULL) 888126353Smlaier err(1, "loadrule: strdup"); 889126353Smlaier 890126353Smlaier TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 891126353Smlaier entries); 892126353Smlaier 893145840Smlaier free($3); 894126353Smlaier free($5); 895126353Smlaier }; 896126353Smlaier 897145840Smlaierscrubaction : no SCRUB { 898145840Smlaier $$.b2 = $$.w = 0; 899145840Smlaier if ($1) 900145840Smlaier $$.b1 = PF_NOSCRUB; 901145840Smlaier else 902145840Smlaier $$.b1 = PF_SCRUB; 903145840Smlaier } 904145840Smlaier ; 905145840Smlaier 906145840Smlaierscrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 907126353Smlaier { 908126353Smlaier struct pf_rule r; 909126353Smlaier 910126353Smlaier if (check_rulestate(PFCTL_STATE_SCRUB)) 911126353Smlaier YYERROR; 912126353Smlaier 913126353Smlaier memset(&r, 0, sizeof(r)); 914126353Smlaier 915145840Smlaier r.action = $1.b1; 916126353Smlaier r.direction = $2; 917126353Smlaier 918126353Smlaier r.log = $3.log; 919171172Smlaier r.logif = $3.logif; 920126353Smlaier if ($3.quick) { 921126353Smlaier yyerror("scrub rules do not support 'quick'"); 922126353Smlaier YYERROR; 923126353Smlaier } 924126353Smlaier 925126353Smlaier r.af = $5; 926126353Smlaier if ($8.nodf) 927126353Smlaier r.rule_flag |= PFRULE_NODF; 928126353Smlaier if ($8.randomid) 929126353Smlaier r.rule_flag |= PFRULE_RANDOMID; 930126353Smlaier if ($8.reassemble_tcp) { 931126353Smlaier if (r.direction != PF_INOUT) { 932126353Smlaier yyerror("reassemble tcp rules can not " 933126353Smlaier "specify direction"); 934126353Smlaier YYERROR; 935126353Smlaier } 936126353Smlaier r.rule_flag |= PFRULE_REASSEMBLE_TCP; 937126353Smlaier } 938126353Smlaier if ($8.minttl) 939126353Smlaier r.min_ttl = $8.minttl; 940126353Smlaier if ($8.maxmss) 941126353Smlaier r.max_mss = $8.maxmss; 942126353Smlaier if ($8.fragcache) 943126353Smlaier r.rule_flag |= $8.fragcache; 944171172Smlaier r.rtableid = $8.rtableid; 945126353Smlaier 946126353Smlaier expand_rule(&r, $4, NULL, $6, $7.src_os, 947126353Smlaier $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 948145840Smlaier NULL, NULL, NULL, ""); 949126353Smlaier } 950126353Smlaier ; 951126353Smlaier 952126353Smlaierscrub_opts : { 953171172Smlaier bzero(&scrub_opts, sizeof scrub_opts); 954171172Smlaier scrub_opts.rtableid = -1; 955171172Smlaier } 956130617Smlaier scrub_opts_l 957126353Smlaier { $$ = scrub_opts; } 958126353Smlaier | /* empty */ { 959126353Smlaier bzero(&scrub_opts, sizeof scrub_opts); 960171172Smlaier scrub_opts.rtableid = -1; 961126353Smlaier $$ = scrub_opts; 962126353Smlaier } 963126353Smlaier ; 964126353Smlaier 965126353Smlaierscrub_opts_l : scrub_opts_l scrub_opt 966126353Smlaier | scrub_opt 967126353Smlaier ; 968126353Smlaier 969126353Smlaierscrub_opt : NODF { 970126353Smlaier if (scrub_opts.nodf) { 971126353Smlaier yyerror("no-df cannot be respecified"); 972126353Smlaier YYERROR; 973126353Smlaier } 974126353Smlaier scrub_opts.nodf = 1; 975126353Smlaier } 976126353Smlaier | MINTTL number { 977126353Smlaier if (scrub_opts.marker & SOM_MINTTL) { 978126353Smlaier yyerror("min-ttl cannot be respecified"); 979126353Smlaier YYERROR; 980126353Smlaier } 981126353Smlaier if ($2 > 255) { 982126353Smlaier yyerror("illegal min-ttl value %d", $2); 983126353Smlaier YYERROR; 984126353Smlaier } 985126353Smlaier scrub_opts.marker |= SOM_MINTTL; 986126353Smlaier scrub_opts.minttl = $2; 987126353Smlaier } 988126353Smlaier | MAXMSS number { 989126353Smlaier if (scrub_opts.marker & SOM_MAXMSS) { 990126353Smlaier yyerror("max-mss cannot be respecified"); 991126353Smlaier YYERROR; 992126353Smlaier } 993126353Smlaier if ($2 > 65535) { 994126353Smlaier yyerror("illegal max-mss value %d", $2); 995126353Smlaier YYERROR; 996126353Smlaier } 997126353Smlaier scrub_opts.marker |= SOM_MAXMSS; 998126353Smlaier scrub_opts.maxmss = $2; 999126353Smlaier } 1000126353Smlaier | fragcache { 1001126353Smlaier if (scrub_opts.marker & SOM_FRAGCACHE) { 1002126353Smlaier yyerror("fragcache cannot be respecified"); 1003126353Smlaier YYERROR; 1004126353Smlaier } 1005126353Smlaier scrub_opts.marker |= SOM_FRAGCACHE; 1006126353Smlaier scrub_opts.fragcache = $1; 1007126353Smlaier } 1008126353Smlaier | REASSEMBLE STRING { 1009130617Smlaier if (strcasecmp($2, "tcp") != 0) { 1010145840Smlaier yyerror("scrub reassemble supports only tcp, " 1011145840Smlaier "not '%s'", $2); 1012130617Smlaier free($2); 1013126353Smlaier YYERROR; 1014130617Smlaier } 1015130617Smlaier free($2); 1016126353Smlaier if (scrub_opts.reassemble_tcp) { 1017126353Smlaier yyerror("reassemble tcp cannot be respecified"); 1018126353Smlaier YYERROR; 1019126353Smlaier } 1020126353Smlaier scrub_opts.reassemble_tcp = 1; 1021126353Smlaier } 1022126353Smlaier | RANDOMID { 1023126353Smlaier if (scrub_opts.randomid) { 1024126353Smlaier yyerror("random-id cannot be respecified"); 1025126353Smlaier YYERROR; 1026126353Smlaier } 1027126353Smlaier scrub_opts.randomid = 1; 1028126353Smlaier } 1029171172Smlaier | RTABLE number { 1030171172Smlaier#ifdef __FreeBSD__ 1031171172Smlaier yyerror("rtable id not supported in FreeBSD, yet"); 1032171172Smlaier YYERROR; 1033171172Smlaier#else 1034171172Smlaier if ($2 > RT_TABLEID_MAX || $2 < 0) { 1035171172Smlaier yyerror("invalid rtable id"); 1036171172Smlaier YYERROR; 1037171172Smlaier } 1038171172Smlaier scrub_opts.rtableid = $2; 1039171172Smlaier#endif 1040171172Smlaier } 1041126353Smlaier ; 1042126353Smlaier 1043126353Smlaierfragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 1044126353Smlaier | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 1045126353Smlaier | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 1046126353Smlaier ; 1047126353Smlaier 1048126353Smlaierantispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1049126353Smlaier struct pf_rule r; 1050145840Smlaier struct node_host *h = NULL, *hh; 1051126353Smlaier struct node_if *i, *j; 1052126353Smlaier 1053126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 1054126353Smlaier YYERROR; 1055126353Smlaier 1056126353Smlaier for (i = $3; i; i = i->next) { 1057126353Smlaier bzero(&r, sizeof(r)); 1058126353Smlaier 1059126353Smlaier r.action = PF_DROP; 1060126353Smlaier r.direction = PF_IN; 1061126353Smlaier r.log = $2.log; 1062171172Smlaier r.logif = $2.logif; 1063126353Smlaier r.quick = $2.quick; 1064126353Smlaier r.af = $4; 1065126353Smlaier if (rule_label(&r, $5.label)) 1066126353Smlaier YYERROR; 1067171172Smlaier r.rtableid = $5.rtableid; 1068126353Smlaier j = calloc(1, sizeof(struct node_if)); 1069126353Smlaier if (j == NULL) 1070126353Smlaier err(1, "antispoof: calloc"); 1071126353Smlaier if (strlcpy(j->ifname, i->ifname, 1072126353Smlaier sizeof(j->ifname)) >= sizeof(j->ifname)) { 1073126353Smlaier free(j); 1074126353Smlaier yyerror("interface name too long"); 1075126353Smlaier YYERROR; 1076126353Smlaier } 1077126353Smlaier j->not = 1; 1078145840Smlaier if (i->dynamic) { 1079145840Smlaier h = calloc(1, sizeof(*h)); 1080145840Smlaier if (h == NULL) 1081145840Smlaier err(1, "address: calloc"); 1082145840Smlaier h->addr.type = PF_ADDR_DYNIFTL; 1083145840Smlaier set_ipmask(h, 128); 1084145840Smlaier if (strlcpy(h->addr.v.ifname, i->ifname, 1085145840Smlaier sizeof(h->addr.v.ifname)) >= 1086145840Smlaier sizeof(h->addr.v.ifname)) { 1087145840Smlaier free(h); 1088145840Smlaier yyerror( 1089145840Smlaier "interface name too long"); 1090145840Smlaier YYERROR; 1091145840Smlaier } 1092145840Smlaier hh = malloc(sizeof(*hh)); 1093145840Smlaier if (hh == NULL) 1094145840Smlaier err(1, "address: malloc"); 1095145840Smlaier bcopy(h, hh, sizeof(*hh)); 1096145840Smlaier h->addr.iflags = PFI_AFLAG_NETWORK; 1097145840Smlaier } else { 1098145840Smlaier h = ifa_lookup(j->ifname, 1099145840Smlaier PFI_AFLAG_NETWORK); 1100145840Smlaier hh = NULL; 1101145840Smlaier } 1102126353Smlaier 1103130617Smlaier if (h != NULL) 1104130617Smlaier expand_rule(&r, j, NULL, NULL, NULL, h, 1105145840Smlaier NULL, NULL, NULL, NULL, NULL, 1106145840Smlaier NULL, ""); 1107126353Smlaier 1108126353Smlaier if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1109126353Smlaier bzero(&r, sizeof(r)); 1110126353Smlaier 1111126353Smlaier r.action = PF_DROP; 1112126353Smlaier r.direction = PF_IN; 1113126353Smlaier r.log = $2.log; 1114126353Smlaier r.quick = $2.quick; 1115126353Smlaier r.af = $4; 1116126353Smlaier if (rule_label(&r, $5.label)) 1117126353Smlaier YYERROR; 1118171172Smlaier r.rtableid = $5.rtableid; 1119145840Smlaier if (hh != NULL) 1120145840Smlaier h = hh; 1121145840Smlaier else 1122145840Smlaier h = ifa_lookup(i->ifname, 0); 1123130617Smlaier if (h != NULL) 1124130617Smlaier expand_rule(&r, NULL, NULL, 1125130617Smlaier NULL, NULL, h, NULL, NULL, 1126145840Smlaier NULL, NULL, NULL, NULL, ""); 1127145840Smlaier } else 1128145840Smlaier free(hh); 1129126353Smlaier } 1130126353Smlaier free($5.label); 1131126353Smlaier } 1132126353Smlaier ; 1133126353Smlaier 1134145840Smlaierantispoof_ifspc : FOR antispoof_if { $$ = $2; } 1135126353Smlaier | FOR '{' antispoof_iflst '}' { $$ = $3; } 1136126353Smlaier ; 1137126353Smlaier 1138145840Smlaierantispoof_iflst : antispoof_if { $$ = $1; } 1139145840Smlaier | antispoof_iflst comma antispoof_if { 1140126353Smlaier $1->tail->next = $3; 1141126353Smlaier $1->tail = $3; 1142126353Smlaier $$ = $1; 1143126353Smlaier } 1144126353Smlaier ; 1145126353Smlaier 1146145840Smlaierantispoof_if : if_item { $$ = $1; } 1147145840Smlaier | '(' if_item ')' { 1148145840Smlaier $2->dynamic = 1; 1149145840Smlaier $$ = $2; 1150145840Smlaier } 1151145840Smlaier ; 1152145840Smlaier 1153171172Smlaierantispoof_opts : { 1154171172Smlaier bzero(&antispoof_opts, sizeof antispoof_opts); 1155171172Smlaier antispoof_opts.rtableid = -1; 1156171172Smlaier } 1157130617Smlaier antispoof_opts_l 1158126353Smlaier { $$ = antispoof_opts; } 1159126353Smlaier | /* empty */ { 1160126353Smlaier bzero(&antispoof_opts, sizeof antispoof_opts); 1161171172Smlaier antispoof_opts.rtableid = -1; 1162126353Smlaier $$ = antispoof_opts; 1163126353Smlaier } 1164126353Smlaier ; 1165126353Smlaier 1166126353Smlaierantispoof_opts_l : antispoof_opts_l antispoof_opt 1167126353Smlaier | antispoof_opt 1168126353Smlaier ; 1169126353Smlaier 1170126353Smlaierantispoof_opt : label { 1171126353Smlaier if (antispoof_opts.label) { 1172126353Smlaier yyerror("label cannot be redefined"); 1173126353Smlaier YYERROR; 1174126353Smlaier } 1175126353Smlaier antispoof_opts.label = $1; 1176126353Smlaier } 1177171172Smlaier | RTABLE number { 1178171172Smlaier#ifdef __FreeBSD__ 1179171172Smlaier yyerror("rtable id not supported in FreeBSD, yet"); 1180171172Smlaier YYERROR; 1181171172Smlaier#else 1182171172Smlaier if ($2 > RT_TABLEID_MAX || $2 < 0) { 1183171172Smlaier yyerror("invalid rtable id"); 1184171172Smlaier YYERROR; 1185171172Smlaier } 1186171172Smlaier antispoof_opts.rtableid = $2; 1187171172Smlaier#endif 1188171172Smlaier } 1189126353Smlaier ; 1190126353Smlaier 1191126353Smlaiernot : '!' { $$ = 1; } 1192126353Smlaier | /* empty */ { $$ = 0; } 1193130617Smlaier ; 1194126353Smlaier 1195126353Smlaiertabledef : TABLE '<' STRING '>' table_opts { 1196126353Smlaier struct node_host *h, *nh; 1197126353Smlaier struct node_tinit *ti, *nti; 1198126353Smlaier 1199126353Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1200126353Smlaier yyerror("table name too long, max %d chars", 1201126353Smlaier PF_TABLE_NAME_SIZE - 1); 1202130617Smlaier free($3); 1203126353Smlaier YYERROR; 1204126353Smlaier } 1205126353Smlaier if (pf->loadopt & PFCTL_FLAG_TABLE) 1206130617Smlaier if (process_tabledef($3, &$5)) { 1207130617Smlaier free($3); 1208126353Smlaier YYERROR; 1209130617Smlaier } 1210130617Smlaier free($3); 1211126353Smlaier for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1212126353Smlaier ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1213126353Smlaier if (ti->file) 1214126353Smlaier free(ti->file); 1215126353Smlaier for (h = ti->host; h != NULL; h = nh) { 1216126353Smlaier nh = h->next; 1217126353Smlaier free(h); 1218126353Smlaier } 1219126353Smlaier nti = SIMPLEQ_NEXT(ti, entries); 1220130617Smlaier free(ti); 1221126353Smlaier } 1222126353Smlaier } 1223126353Smlaier ; 1224126353Smlaier 1225126353Smlaiertable_opts : { 1226126353Smlaier bzero(&table_opts, sizeof table_opts); 1227126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 1228126353Smlaier } 1229130617Smlaier table_opts_l 1230126353Smlaier { $$ = table_opts; } 1231126353Smlaier | /* empty */ 1232126353Smlaier { 1233126353Smlaier bzero(&table_opts, sizeof table_opts); 1234126353Smlaier SIMPLEQ_INIT(&table_opts.init_nodes); 1235126353Smlaier $$ = table_opts; 1236126353Smlaier } 1237126353Smlaier ; 1238126353Smlaier 1239126353Smlaiertable_opts_l : table_opts_l table_opt 1240126353Smlaier | table_opt 1241126353Smlaier ; 1242126353Smlaier 1243126353Smlaiertable_opt : STRING { 1244126353Smlaier if (!strcmp($1, "const")) 1245126353Smlaier table_opts.flags |= PFR_TFLAG_CONST; 1246126353Smlaier else if (!strcmp($1, "persist")) 1247126353Smlaier table_opts.flags |= PFR_TFLAG_PERSIST; 1248130617Smlaier else { 1249145840Smlaier yyerror("invalid table option '%s'", $1); 1250130617Smlaier free($1); 1251126353Smlaier YYERROR; 1252130617Smlaier } 1253130617Smlaier free($1); 1254126353Smlaier } 1255126353Smlaier | '{' '}' { table_opts.init_addr = 1; } 1256126353Smlaier | '{' host_list '}' { 1257126353Smlaier struct node_host *n; 1258126353Smlaier struct node_tinit *ti; 1259126353Smlaier 1260126353Smlaier for (n = $2; n != NULL; n = n->next) { 1261130617Smlaier switch (n->addr.type) { 1262126353Smlaier case PF_ADDR_ADDRMASK: 1263126353Smlaier continue; /* ok */ 1264126353Smlaier case PF_ADDR_DYNIFTL: 1265126353Smlaier yyerror("dynamic addresses are not " 1266126353Smlaier "permitted inside tables"); 1267126353Smlaier break; 1268126353Smlaier case PF_ADDR_TABLE: 1269126353Smlaier yyerror("tables cannot contain tables"); 1270126353Smlaier break; 1271126353Smlaier case PF_ADDR_NOROUTE: 1272126353Smlaier yyerror("\"no-route\" is not permitted " 1273126353Smlaier "inside tables"); 1274126353Smlaier break; 1275171172Smlaier case PF_ADDR_URPFFAILED: 1276171172Smlaier yyerror("\"urpf-failed\" is not " 1277171172Smlaier "permitted inside tables"); 1278171172Smlaier break; 1279126353Smlaier default: 1280126353Smlaier yyerror("unknown address type %d", 1281126353Smlaier n->addr.type); 1282126353Smlaier } 1283126353Smlaier YYERROR; 1284126353Smlaier } 1285126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 1286126353Smlaier err(1, "table_opt: calloc"); 1287126353Smlaier ti->host = $2; 1288126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1289126353Smlaier entries); 1290126353Smlaier table_opts.init_addr = 1; 1291126353Smlaier } 1292126353Smlaier | FILENAME STRING { 1293126353Smlaier struct node_tinit *ti; 1294126353Smlaier 1295126353Smlaier if (!(ti = calloc(1, sizeof(*ti)))) 1296126353Smlaier err(1, "table_opt: calloc"); 1297126353Smlaier ti->file = $2; 1298126353Smlaier SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1299126353Smlaier entries); 1300126353Smlaier table_opts.init_addr = 1; 1301126353Smlaier } 1302126353Smlaier ; 1303126353Smlaier 1304126353Smlaieraltqif : ALTQ interface queue_opts QUEUE qassign { 1305126353Smlaier struct pf_altq a; 1306126353Smlaier 1307126353Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) 1308126353Smlaier YYERROR; 1309126353Smlaier 1310126353Smlaier memset(&a, 0, sizeof(a)); 1311126353Smlaier if ($3.scheduler.qtype == ALTQT_NONE) { 1312126353Smlaier yyerror("no scheduler specified!"); 1313126353Smlaier YYERROR; 1314126353Smlaier } 1315126353Smlaier a.scheduler = $3.scheduler.qtype; 1316126353Smlaier a.qlimit = $3.qlimit; 1317126353Smlaier a.tbrsize = $3.tbrsize; 1318126353Smlaier if ($5 == NULL) { 1319126353Smlaier yyerror("no child queues specified"); 1320126353Smlaier YYERROR; 1321126353Smlaier } 1322126353Smlaier if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1323126353Smlaier &$3.scheduler)) 1324126353Smlaier YYERROR; 1325126353Smlaier } 1326126353Smlaier ; 1327126353Smlaier 1328126353Smlaierqueuespec : QUEUE STRING interface queue_opts qassign { 1329126353Smlaier struct pf_altq a; 1330126353Smlaier 1331130617Smlaier if (check_rulestate(PFCTL_STATE_QUEUE)) { 1332130617Smlaier free($2); 1333126353Smlaier YYERROR; 1334130617Smlaier } 1335126353Smlaier 1336126353Smlaier memset(&a, 0, sizeof(a)); 1337126353Smlaier 1338126353Smlaier if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1339126353Smlaier sizeof(a.qname)) { 1340126353Smlaier yyerror("queue name too long (max " 1341126353Smlaier "%d chars)", PF_QNAME_SIZE-1); 1342130617Smlaier free($2); 1343126353Smlaier YYERROR; 1344126353Smlaier } 1345130617Smlaier free($2); 1346126353Smlaier if ($4.tbrsize) { 1347126353Smlaier yyerror("cannot specify tbrsize for queue"); 1348126353Smlaier YYERROR; 1349126353Smlaier } 1350126353Smlaier if ($4.priority > 255) { 1351126353Smlaier yyerror("priority out of range: max 255"); 1352126353Smlaier YYERROR; 1353126353Smlaier } 1354126353Smlaier a.priority = $4.priority; 1355126353Smlaier a.qlimit = $4.qlimit; 1356126353Smlaier a.scheduler = $4.scheduler.qtype; 1357126353Smlaier if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1358126353Smlaier &$4.scheduler)) { 1359126353Smlaier yyerror("errors in queue definition"); 1360126353Smlaier YYERROR; 1361126353Smlaier } 1362126353Smlaier } 1363126353Smlaier ; 1364126353Smlaier 1365126353Smlaierqueue_opts : { 1366126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1367126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1368126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1369126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1370126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1371126353Smlaier } 1372130617Smlaier queue_opts_l 1373126353Smlaier { $$ = queue_opts; } 1374126353Smlaier | /* empty */ { 1375126353Smlaier bzero(&queue_opts, sizeof queue_opts); 1376126353Smlaier queue_opts.priority = DEFAULT_PRIORITY; 1377126353Smlaier queue_opts.qlimit = DEFAULT_QLIMIT; 1378126353Smlaier queue_opts.scheduler.qtype = ALTQT_NONE; 1379126353Smlaier queue_opts.queue_bwspec.bw_percent = 100; 1380126353Smlaier $$ = queue_opts; 1381126353Smlaier } 1382126353Smlaier ; 1383126353Smlaier 1384126353Smlaierqueue_opts_l : queue_opts_l queue_opt 1385126353Smlaier | queue_opt 1386126353Smlaier ; 1387126353Smlaier 1388126353Smlaierqueue_opt : BANDWIDTH bandwidth { 1389126353Smlaier if (queue_opts.marker & QOM_BWSPEC) { 1390126353Smlaier yyerror("bandwidth cannot be respecified"); 1391126353Smlaier YYERROR; 1392126353Smlaier } 1393126353Smlaier queue_opts.marker |= QOM_BWSPEC; 1394126353Smlaier queue_opts.queue_bwspec = $2; 1395126353Smlaier } 1396126353Smlaier | PRIORITY number { 1397126353Smlaier if (queue_opts.marker & QOM_PRIORITY) { 1398126353Smlaier yyerror("priority cannot be respecified"); 1399126353Smlaier YYERROR; 1400126353Smlaier } 1401126353Smlaier if ($2 > 255) { 1402126353Smlaier yyerror("priority out of range: max 255"); 1403126353Smlaier YYERROR; 1404126353Smlaier } 1405126353Smlaier queue_opts.marker |= QOM_PRIORITY; 1406126353Smlaier queue_opts.priority = $2; 1407126353Smlaier } 1408126353Smlaier | QLIMIT number { 1409126353Smlaier if (queue_opts.marker & QOM_QLIMIT) { 1410126353Smlaier yyerror("qlimit cannot be respecified"); 1411126353Smlaier YYERROR; 1412126353Smlaier } 1413126353Smlaier if ($2 > 65535) { 1414126353Smlaier yyerror("qlimit out of range: max 65535"); 1415126353Smlaier YYERROR; 1416126353Smlaier } 1417126353Smlaier queue_opts.marker |= QOM_QLIMIT; 1418126353Smlaier queue_opts.qlimit = $2; 1419126353Smlaier } 1420126353Smlaier | scheduler { 1421126353Smlaier if (queue_opts.marker & QOM_SCHEDULER) { 1422126353Smlaier yyerror("scheduler cannot be respecified"); 1423126353Smlaier YYERROR; 1424126353Smlaier } 1425126353Smlaier queue_opts.marker |= QOM_SCHEDULER; 1426126353Smlaier queue_opts.scheduler = $1; 1427126353Smlaier } 1428126353Smlaier | TBRSIZE number { 1429126353Smlaier if (queue_opts.marker & QOM_TBRSIZE) { 1430126353Smlaier yyerror("tbrsize cannot be respecified"); 1431126353Smlaier YYERROR; 1432126353Smlaier } 1433126353Smlaier if ($2 > 65535) { 1434126353Smlaier yyerror("tbrsize too big: max 65535"); 1435126353Smlaier YYERROR; 1436126353Smlaier } 1437126353Smlaier queue_opts.marker |= QOM_TBRSIZE; 1438126353Smlaier queue_opts.tbrsize = $2; 1439126353Smlaier } 1440126353Smlaier ; 1441126353Smlaier 1442126353Smlaierbandwidth : STRING { 1443126353Smlaier double bps; 1444126353Smlaier char *cp; 1445126353Smlaier 1446126353Smlaier $$.bw_percent = 0; 1447126353Smlaier 1448126353Smlaier bps = strtod($1, &cp); 1449126353Smlaier if (cp != NULL) { 1450126353Smlaier if (!strcmp(cp, "b")) 1451126353Smlaier ; /* nothing */ 1452126353Smlaier else if (!strcmp(cp, "Kb")) 1453126353Smlaier bps *= 1000; 1454126353Smlaier else if (!strcmp(cp, "Mb")) 1455126353Smlaier bps *= 1000 * 1000; 1456126353Smlaier else if (!strcmp(cp, "Gb")) 1457126353Smlaier bps *= 1000 * 1000 * 1000; 1458126353Smlaier else if (!strcmp(cp, "%")) { 1459126353Smlaier if (bps < 0 || bps > 100) { 1460126353Smlaier yyerror("bandwidth spec " 1461126353Smlaier "out of range"); 1462130617Smlaier free($1); 1463126353Smlaier YYERROR; 1464126353Smlaier } 1465126353Smlaier $$.bw_percent = bps; 1466126353Smlaier bps = 0; 1467126353Smlaier } else { 1468126353Smlaier yyerror("unknown unit %s", cp); 1469130617Smlaier free($1); 1470126353Smlaier YYERROR; 1471126353Smlaier } 1472126353Smlaier } 1473130617Smlaier free($1); 1474126353Smlaier $$.bw_absolute = (u_int32_t)bps; 1475126353Smlaier } 1476130617Smlaier ; 1477126353Smlaier 1478126353Smlaierscheduler : CBQ { 1479126353Smlaier $$.qtype = ALTQT_CBQ; 1480126353Smlaier $$.data.cbq_opts.flags = 0; 1481126353Smlaier } 1482126353Smlaier | CBQ '(' cbqflags_list ')' { 1483126353Smlaier $$.qtype = ALTQT_CBQ; 1484126353Smlaier $$.data.cbq_opts.flags = $3; 1485126353Smlaier } 1486126353Smlaier | PRIQ { 1487126353Smlaier $$.qtype = ALTQT_PRIQ; 1488126353Smlaier $$.data.priq_opts.flags = 0; 1489126353Smlaier } 1490126353Smlaier | PRIQ '(' priqflags_list ')' { 1491126353Smlaier $$.qtype = ALTQT_PRIQ; 1492126353Smlaier $$.data.priq_opts.flags = $3; 1493126353Smlaier } 1494126353Smlaier | HFSC { 1495126353Smlaier $$.qtype = ALTQT_HFSC; 1496126353Smlaier bzero(&$$.data.hfsc_opts, 1497126353Smlaier sizeof(struct node_hfsc_opts)); 1498126353Smlaier } 1499126353Smlaier | HFSC '(' hfsc_opts ')' { 1500126353Smlaier $$.qtype = ALTQT_HFSC; 1501126353Smlaier $$.data.hfsc_opts = $3; 1502126353Smlaier } 1503126353Smlaier ; 1504126353Smlaier 1505126353Smlaiercbqflags_list : cbqflags_item { $$ |= $1; } 1506126353Smlaier | cbqflags_list comma cbqflags_item { $$ |= $3; } 1507126353Smlaier ; 1508126353Smlaier 1509126353Smlaiercbqflags_item : STRING { 1510126353Smlaier if (!strcmp($1, "default")) 1511126353Smlaier $$ = CBQCLF_DEFCLASS; 1512126353Smlaier else if (!strcmp($1, "borrow")) 1513126353Smlaier $$ = CBQCLF_BORROW; 1514126353Smlaier else if (!strcmp($1, "red")) 1515126353Smlaier $$ = CBQCLF_RED; 1516126353Smlaier else if (!strcmp($1, "ecn")) 1517126353Smlaier $$ = CBQCLF_RED|CBQCLF_ECN; 1518126353Smlaier else if (!strcmp($1, "rio")) 1519126353Smlaier $$ = CBQCLF_RIO; 1520126353Smlaier else { 1521126353Smlaier yyerror("unknown cbq flag \"%s\"", $1); 1522130617Smlaier free($1); 1523126353Smlaier YYERROR; 1524126353Smlaier } 1525130617Smlaier free($1); 1526126353Smlaier } 1527126353Smlaier ; 1528126353Smlaier 1529126353Smlaierpriqflags_list : priqflags_item { $$ |= $1; } 1530126353Smlaier | priqflags_list comma priqflags_item { $$ |= $3; } 1531126353Smlaier ; 1532126353Smlaier 1533126353Smlaierpriqflags_item : STRING { 1534126353Smlaier if (!strcmp($1, "default")) 1535126353Smlaier $$ = PRCF_DEFAULTCLASS; 1536126353Smlaier else if (!strcmp($1, "red")) 1537126353Smlaier $$ = PRCF_RED; 1538126353Smlaier else if (!strcmp($1, "ecn")) 1539126353Smlaier $$ = PRCF_RED|PRCF_ECN; 1540126353Smlaier else if (!strcmp($1, "rio")) 1541126353Smlaier $$ = PRCF_RIO; 1542126353Smlaier else { 1543126353Smlaier yyerror("unknown priq flag \"%s\"", $1); 1544130617Smlaier free($1); 1545126353Smlaier YYERROR; 1546126353Smlaier } 1547130617Smlaier free($1); 1548126353Smlaier } 1549126353Smlaier ; 1550126353Smlaier 1551126353Smlaierhfsc_opts : { 1552126353Smlaier bzero(&hfsc_opts, 1553126353Smlaier sizeof(struct node_hfsc_opts)); 1554126353Smlaier } 1555130617Smlaier hfscopts_list { 1556126353Smlaier $$ = hfsc_opts; 1557126353Smlaier } 1558126353Smlaier ; 1559126353Smlaier 1560126353Smlaierhfscopts_list : hfscopts_item 1561126353Smlaier | hfscopts_list comma hfscopts_item 1562126353Smlaier ; 1563126353Smlaier 1564126353Smlaierhfscopts_item : LINKSHARE bandwidth { 1565126353Smlaier if (hfsc_opts.linkshare.used) { 1566126353Smlaier yyerror("linkshare already specified"); 1567126353Smlaier YYERROR; 1568126353Smlaier } 1569126353Smlaier hfsc_opts.linkshare.m2 = $2; 1570126353Smlaier hfsc_opts.linkshare.used = 1; 1571126353Smlaier } 1572145840Smlaier | LINKSHARE '(' bandwidth comma number comma bandwidth ')' 1573145840Smlaier { 1574126353Smlaier if (hfsc_opts.linkshare.used) { 1575126353Smlaier yyerror("linkshare already specified"); 1576126353Smlaier YYERROR; 1577126353Smlaier } 1578126353Smlaier hfsc_opts.linkshare.m1 = $3; 1579145840Smlaier hfsc_opts.linkshare.d = $5; 1580145840Smlaier hfsc_opts.linkshare.m2 = $7; 1581126353Smlaier hfsc_opts.linkshare.used = 1; 1582126353Smlaier } 1583126353Smlaier | REALTIME bandwidth { 1584126353Smlaier if (hfsc_opts.realtime.used) { 1585126353Smlaier yyerror("realtime already specified"); 1586126353Smlaier YYERROR; 1587126353Smlaier } 1588126353Smlaier hfsc_opts.realtime.m2 = $2; 1589126353Smlaier hfsc_opts.realtime.used = 1; 1590126353Smlaier } 1591145840Smlaier | REALTIME '(' bandwidth comma number comma bandwidth ')' 1592145840Smlaier { 1593126353Smlaier if (hfsc_opts.realtime.used) { 1594126353Smlaier yyerror("realtime already specified"); 1595126353Smlaier YYERROR; 1596126353Smlaier } 1597126353Smlaier hfsc_opts.realtime.m1 = $3; 1598145840Smlaier hfsc_opts.realtime.d = $5; 1599145840Smlaier hfsc_opts.realtime.m2 = $7; 1600126353Smlaier hfsc_opts.realtime.used = 1; 1601126353Smlaier } 1602126353Smlaier | UPPERLIMIT bandwidth { 1603126353Smlaier if (hfsc_opts.upperlimit.used) { 1604126353Smlaier yyerror("upperlimit already specified"); 1605126353Smlaier YYERROR; 1606126353Smlaier } 1607126353Smlaier hfsc_opts.upperlimit.m2 = $2; 1608126353Smlaier hfsc_opts.upperlimit.used = 1; 1609126353Smlaier } 1610145840Smlaier | UPPERLIMIT '(' bandwidth comma number comma bandwidth ')' 1611145840Smlaier { 1612126353Smlaier if (hfsc_opts.upperlimit.used) { 1613126353Smlaier yyerror("upperlimit already specified"); 1614126353Smlaier YYERROR; 1615126353Smlaier } 1616126353Smlaier hfsc_opts.upperlimit.m1 = $3; 1617145840Smlaier hfsc_opts.upperlimit.d = $5; 1618145840Smlaier hfsc_opts.upperlimit.m2 = $7; 1619126353Smlaier hfsc_opts.upperlimit.used = 1; 1620126353Smlaier } 1621126353Smlaier | STRING { 1622126353Smlaier if (!strcmp($1, "default")) 1623126353Smlaier hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1624126353Smlaier else if (!strcmp($1, "red")) 1625126353Smlaier hfsc_opts.flags |= HFCF_RED; 1626126353Smlaier else if (!strcmp($1, "ecn")) 1627126353Smlaier hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1628126353Smlaier else if (!strcmp($1, "rio")) 1629126353Smlaier hfsc_opts.flags |= HFCF_RIO; 1630126353Smlaier else { 1631126353Smlaier yyerror("unknown hfsc flag \"%s\"", $1); 1632130617Smlaier free($1); 1633126353Smlaier YYERROR; 1634126353Smlaier } 1635130617Smlaier free($1); 1636126353Smlaier } 1637126353Smlaier ; 1638126353Smlaier 1639126353Smlaierqassign : /* empty */ { $$ = NULL; } 1640126353Smlaier | qassign_item { $$ = $1; } 1641126353Smlaier | '{' qassign_list '}' { $$ = $2; } 1642126353Smlaier ; 1643126353Smlaier 1644126353Smlaierqassign_list : qassign_item { $$ = $1; } 1645126353Smlaier | qassign_list comma qassign_item { 1646126353Smlaier $1->tail->next = $3; 1647126353Smlaier $1->tail = $3; 1648126353Smlaier $$ = $1; 1649126353Smlaier } 1650126353Smlaier ; 1651126353Smlaier 1652126353Smlaierqassign_item : STRING { 1653126353Smlaier $$ = calloc(1, sizeof(struct node_queue)); 1654126353Smlaier if ($$ == NULL) 1655126353Smlaier err(1, "qassign_item: calloc"); 1656126353Smlaier if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1657126353Smlaier sizeof($$->queue)) { 1658126353Smlaier yyerror("queue name '%s' too long (max " 1659126353Smlaier "%d chars)", $1, sizeof($$->queue)-1); 1660130617Smlaier free($1); 1661130617Smlaier free($$); 1662126353Smlaier YYERROR; 1663126353Smlaier } 1664130617Smlaier free($1); 1665126353Smlaier $$->next = NULL; 1666126353Smlaier $$->tail = $$; 1667126353Smlaier } 1668126353Smlaier ; 1669126353Smlaier 1670126353Smlaierpfrule : action dir logquick interface route af proto fromto 1671130617Smlaier filter_opts 1672126353Smlaier { 1673126353Smlaier struct pf_rule r; 1674126353Smlaier struct node_state_opt *o; 1675126353Smlaier struct node_proto *proto; 1676130617Smlaier int srctrack = 0; 1677130617Smlaier int statelock = 0; 1678171172Smlaier int adaptive = 0; 1679126353Smlaier 1680126353Smlaier if (check_rulestate(PFCTL_STATE_FILTER)) 1681126353Smlaier YYERROR; 1682126353Smlaier 1683126353Smlaier memset(&r, 0, sizeof(r)); 1684126353Smlaier 1685126353Smlaier r.action = $1.b1; 1686126353Smlaier switch ($1.b2) { 1687126353Smlaier case PFRULE_RETURNRST: 1688126353Smlaier r.rule_flag |= PFRULE_RETURNRST; 1689126353Smlaier r.return_ttl = $1.w; 1690126353Smlaier break; 1691126353Smlaier case PFRULE_RETURNICMP: 1692126353Smlaier r.rule_flag |= PFRULE_RETURNICMP; 1693126353Smlaier r.return_icmp = $1.w; 1694126353Smlaier r.return_icmp6 = $1.w2; 1695126353Smlaier break; 1696126353Smlaier case PFRULE_RETURN: 1697126353Smlaier r.rule_flag |= PFRULE_RETURN; 1698126353Smlaier r.return_icmp = $1.w; 1699126353Smlaier r.return_icmp6 = $1.w2; 1700126353Smlaier break; 1701126353Smlaier } 1702126353Smlaier r.direction = $2; 1703126353Smlaier r.log = $3.log; 1704171172Smlaier r.logif = $3.logif; 1705126353Smlaier r.quick = $3.quick; 1706145840Smlaier r.prob = $9.prob; 1707171172Smlaier r.rtableid = $9.rtableid; 1708126353Smlaier 1709126353Smlaier r.af = $6; 1710126353Smlaier if ($9.tag) 1711126353Smlaier if (strlcpy(r.tagname, $9.tag, 1712130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1713126353Smlaier yyerror("tag too long, max %u chars", 1714126353Smlaier PF_TAG_NAME_SIZE - 1); 1715126353Smlaier YYERROR; 1716126353Smlaier } 1717126353Smlaier if ($9.match_tag) 1718126353Smlaier if (strlcpy(r.match_tagname, $9.match_tag, 1719130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1720126353Smlaier yyerror("tag too long, max %u chars", 1721126353Smlaier PF_TAG_NAME_SIZE - 1); 1722126353Smlaier YYERROR; 1723126353Smlaier } 1724126353Smlaier r.match_tag_not = $9.match_tag_not; 1725171172Smlaier if (rule_label(&r, $9.label)) 1726171172Smlaier YYERROR; 1727171172Smlaier free($9.label); 1728126353Smlaier r.flags = $9.flags.b1; 1729126353Smlaier r.flagset = $9.flags.b2; 1730171172Smlaier if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 1731171172Smlaier yyerror("flags always false"); 1732126353Smlaier YYERROR; 1733171172Smlaier } 1734126353Smlaier if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1735126353Smlaier for (proto = $7; proto != NULL && 1736126353Smlaier proto->proto != IPPROTO_TCP; 1737126353Smlaier proto = proto->next) 1738126353Smlaier ; /* nothing */ 1739126353Smlaier if (proto == NULL && $7 != NULL) { 1740126353Smlaier if ($9.flags.b1 || $9.flags.b2) 1741126353Smlaier yyerror( 1742126353Smlaier "flags only apply to tcp"); 1743126353Smlaier if ($8.src_os) 1744126353Smlaier yyerror( 1745126353Smlaier "OS fingerprinting only " 1746126353Smlaier "apply to tcp"); 1747126353Smlaier YYERROR; 1748126353Smlaier } 1749126353Smlaier#if 0 1750126353Smlaier if (($9.flags.b1 & parse_flags("S")) == 0 && 1751126353Smlaier $8.src_os) { 1752126353Smlaier yyerror("OS fingerprinting requires " 1753130617Smlaier "the SYN TCP flag (flags S/SA)"); 1754126353Smlaier YYERROR; 1755126353Smlaier } 1756126353Smlaier#endif 1757126353Smlaier } 1758126353Smlaier 1759126353Smlaier r.tos = $9.tos; 1760126353Smlaier r.keep_state = $9.keep.action; 1761171172Smlaier 1762171172Smlaier /* 'keep state' by default on pass rules. */ 1763171172Smlaier if (!r.keep_state && !r.action && 1764171172Smlaier !($9.marker & FOM_KEEP)) 1765171172Smlaier r.keep_state = PF_STATE_NORMAL; 1766171172Smlaier 1767126353Smlaier o = $9.keep.options; 1768126353Smlaier while (o) { 1769126353Smlaier struct node_state_opt *p = o; 1770126353Smlaier 1771126353Smlaier switch (o->type) { 1772126353Smlaier case PF_STATE_OPT_MAX: 1773126353Smlaier if (r.max_states) { 1774126353Smlaier yyerror("state option 'max' " 1775126353Smlaier "multiple definitions"); 1776126353Smlaier YYERROR; 1777126353Smlaier } 1778126353Smlaier r.max_states = o->data.max_states; 1779126353Smlaier break; 1780130617Smlaier case PF_STATE_OPT_NOSYNC: 1781130617Smlaier if (r.rule_flag & PFRULE_NOSYNC) { 1782130617Smlaier yyerror("state option 'sync' " 1783130617Smlaier "multiple definitions"); 1784130617Smlaier YYERROR; 1785130617Smlaier } 1786130617Smlaier r.rule_flag |= PFRULE_NOSYNC; 1787130617Smlaier break; 1788130617Smlaier case PF_STATE_OPT_SRCTRACK: 1789130617Smlaier if (srctrack) { 1790130617Smlaier yyerror("state option " 1791130617Smlaier "'source-track' " 1792130617Smlaier "multiple definitions"); 1793130617Smlaier YYERROR; 1794130617Smlaier } 1795130617Smlaier srctrack = o->data.src_track; 1796145840Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1797130617Smlaier break; 1798130617Smlaier case PF_STATE_OPT_MAX_SRC_STATES: 1799130617Smlaier if (r.max_src_states) { 1800130617Smlaier yyerror("state option " 1801130617Smlaier "'max-src-states' " 1802130617Smlaier "multiple definitions"); 1803130617Smlaier YYERROR; 1804130617Smlaier } 1805145840Smlaier if (o->data.max_src_states == 0) { 1806130617Smlaier yyerror("'max-src-states' must " 1807130617Smlaier "be > 0"); 1808130617Smlaier YYERROR; 1809130617Smlaier } 1810130617Smlaier r.max_src_states = 1811130617Smlaier o->data.max_src_states; 1812130617Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1813130617Smlaier break; 1814145840Smlaier case PF_STATE_OPT_OVERLOAD: 1815145840Smlaier if (r.overload_tblname[0]) { 1816145840Smlaier yyerror("multiple 'overload' " 1817145840Smlaier "table definitions"); 1818145840Smlaier YYERROR; 1819145840Smlaier } 1820145840Smlaier if (strlcpy(r.overload_tblname, 1821145840Smlaier o->data.overload.tblname, 1822145840Smlaier PF_TABLE_NAME_SIZE) >= 1823145840Smlaier PF_TABLE_NAME_SIZE) { 1824145840Smlaier yyerror("state option: " 1825145840Smlaier "strlcpy"); 1826145840Smlaier YYERROR; 1827145840Smlaier } 1828145840Smlaier r.flush = o->data.overload.flush; 1829145840Smlaier break; 1830145840Smlaier case PF_STATE_OPT_MAX_SRC_CONN: 1831145840Smlaier if (r.max_src_conn) { 1832145840Smlaier yyerror("state option " 1833145840Smlaier "'max-src-conn' " 1834145840Smlaier "multiple definitions"); 1835145840Smlaier YYERROR; 1836145840Smlaier } 1837145840Smlaier if (o->data.max_src_conn == 0) { 1838145840Smlaier yyerror("'max-src-conn' " 1839145840Smlaier "must be > 0"); 1840145840Smlaier YYERROR; 1841145840Smlaier } 1842145840Smlaier r.max_src_conn = 1843145840Smlaier o->data.max_src_conn; 1844145840Smlaier r.rule_flag |= PFRULE_SRCTRACK | 1845145840Smlaier PFRULE_RULESRCTRACK; 1846145840Smlaier break; 1847145840Smlaier case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1848145840Smlaier if (r.max_src_conn_rate.limit) { 1849145840Smlaier yyerror("state option " 1850145840Smlaier "'max-src-conn-rate' " 1851145840Smlaier "multiple definitions"); 1852145840Smlaier YYERROR; 1853145840Smlaier } 1854145840Smlaier if (!o->data.max_src_conn_rate.limit || 1855145840Smlaier !o->data.max_src_conn_rate.seconds) { 1856145840Smlaier yyerror("'max-src-conn-rate' " 1857145840Smlaier "values must be > 0"); 1858145840Smlaier YYERROR; 1859145840Smlaier } 1860145840Smlaier if (o->data.max_src_conn_rate.limit > 1861145840Smlaier PF_THRESHOLD_MAX) { 1862145840Smlaier yyerror("'max-src-conn-rate' " 1863171172Smlaier "maximum rate must be < %u", 1864171172Smlaier PF_THRESHOLD_MAX); 1865145840Smlaier YYERROR; 1866145840Smlaier } 1867145840Smlaier r.max_src_conn_rate.limit = 1868145840Smlaier o->data.max_src_conn_rate.limit; 1869145840Smlaier r.max_src_conn_rate.seconds = 1870145840Smlaier o->data.max_src_conn_rate.seconds; 1871145840Smlaier r.rule_flag |= PFRULE_SRCTRACK | 1872145840Smlaier PFRULE_RULESRCTRACK; 1873145840Smlaier break; 1874130617Smlaier case PF_STATE_OPT_MAX_SRC_NODES: 1875130617Smlaier if (r.max_src_nodes) { 1876130617Smlaier yyerror("state option " 1877130617Smlaier "'max-src-nodes' " 1878130617Smlaier "multiple definitions"); 1879130617Smlaier YYERROR; 1880130617Smlaier } 1881130617Smlaier if (o->data.max_src_nodes == 0) { 1882130617Smlaier yyerror("'max-src-nodes' must " 1883130617Smlaier "be > 0"); 1884130617Smlaier YYERROR; 1885130617Smlaier } 1886130617Smlaier r.max_src_nodes = 1887130617Smlaier o->data.max_src_nodes; 1888130617Smlaier r.rule_flag |= PFRULE_SRCTRACK | 1889130617Smlaier PFRULE_RULESRCTRACK; 1890130617Smlaier break; 1891130617Smlaier case PF_STATE_OPT_STATELOCK: 1892130617Smlaier if (statelock) { 1893130617Smlaier yyerror("state locking option: " 1894130617Smlaier "multiple definitions"); 1895130617Smlaier YYERROR; 1896130617Smlaier } 1897130617Smlaier statelock = 1; 1898130617Smlaier r.rule_flag |= o->data.statelock; 1899130617Smlaier break; 1900126353Smlaier case PF_STATE_OPT_TIMEOUT: 1901171172Smlaier if (o->data.timeout.number == 1902171172Smlaier PFTM_ADAPTIVE_START || 1903171172Smlaier o->data.timeout.number == 1904171172Smlaier PFTM_ADAPTIVE_END) 1905171172Smlaier adaptive = 1; 1906126353Smlaier if (r.timeout[o->data.timeout.number]) { 1907126353Smlaier yyerror("state timeout %s " 1908126353Smlaier "multiple definitions", 1909126353Smlaier pf_timeouts[o->data. 1910126353Smlaier timeout.number].name); 1911126353Smlaier YYERROR; 1912126353Smlaier } 1913126353Smlaier r.timeout[o->data.timeout.number] = 1914126353Smlaier o->data.timeout.seconds; 1915126353Smlaier } 1916126353Smlaier o = o->next; 1917126353Smlaier free(p); 1918126353Smlaier } 1919171172Smlaier 1920171172Smlaier /* 'flags S/SA' by default on stateful rules */ 1921171172Smlaier if (!r.action && !r.flags && !r.flagset && 1922171172Smlaier !$9.fragment && !($9.marker & FOM_FLAGS) && 1923171172Smlaier r.keep_state) { 1924171172Smlaier r.flags = parse_flags("S"); 1925171172Smlaier r.flagset = parse_flags("SA"); 1926171172Smlaier } 1927171172Smlaier if (!adaptive && r.max_states) { 1928171172Smlaier r.timeout[PFTM_ADAPTIVE_START] = 1929171172Smlaier (r.max_states / 10) * 6; 1930171172Smlaier r.timeout[PFTM_ADAPTIVE_END] = 1931171172Smlaier (r.max_states / 10) * 12; 1932171172Smlaier } 1933145840Smlaier if (r.rule_flag & PFRULE_SRCTRACK) { 1934130617Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 1935130617Smlaier r.max_src_nodes) { 1936130617Smlaier yyerror("'max-src-nodes' is " 1937130617Smlaier "incompatible with " 1938130617Smlaier "'source-track global'"); 1939130617Smlaier YYERROR; 1940130617Smlaier } 1941145840Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 1942145840Smlaier r.max_src_conn) { 1943145840Smlaier yyerror("'max-src-conn' is " 1944145840Smlaier "incompatible with " 1945145840Smlaier "'source-track global'"); 1946145840Smlaier YYERROR; 1947145840Smlaier } 1948145840Smlaier if (srctrack == PF_SRCTRACK_GLOBAL && 1949145840Smlaier r.max_src_conn_rate.seconds) { 1950145840Smlaier yyerror("'max-src-conn-rate' is " 1951145840Smlaier "incompatible with " 1952145840Smlaier "'source-track global'"); 1953145840Smlaier YYERROR; 1954145840Smlaier } 1955145840Smlaier if (r.timeout[PFTM_SRC_NODE] < 1956145840Smlaier r.max_src_conn_rate.seconds) 1957145840Smlaier r.timeout[PFTM_SRC_NODE] = 1958145840Smlaier r.max_src_conn_rate.seconds; 1959130617Smlaier r.rule_flag |= PFRULE_SRCTRACK; 1960130617Smlaier if (srctrack == PF_SRCTRACK_RULE) 1961130617Smlaier r.rule_flag |= PFRULE_RULESRCTRACK; 1962130617Smlaier } 1963130617Smlaier if (r.keep_state && !statelock) 1964130617Smlaier r.rule_flag |= default_statelock; 1965126353Smlaier 1966126353Smlaier if ($9.fragment) 1967126353Smlaier r.rule_flag |= PFRULE_FRAGMENT; 1968126353Smlaier r.allow_opts = $9.allowopts; 1969126353Smlaier 1970126353Smlaier decide_address_family($8.src.host, &r.af); 1971126353Smlaier decide_address_family($8.dst.host, &r.af); 1972126353Smlaier 1973126353Smlaier if ($5.rt) { 1974126353Smlaier if (!r.direction) { 1975126353Smlaier yyerror("direction must be explicit " 1976126353Smlaier "with rules that specify routing"); 1977126353Smlaier YYERROR; 1978126353Smlaier } 1979126353Smlaier r.rt = $5.rt; 1980126353Smlaier r.rpool.opts = $5.pool_opts; 1981126353Smlaier if ($5.key != NULL) 1982126353Smlaier memcpy(&r.rpool.key, $5.key, 1983126353Smlaier sizeof(struct pf_poolhashkey)); 1984126353Smlaier } 1985126353Smlaier if (r.rt && r.rt != PF_FASTROUTE) { 1986126353Smlaier decide_address_family($5.host, &r.af); 1987126353Smlaier remove_invalid_hosts(&$5.host, &r.af); 1988126353Smlaier if ($5.host == NULL) { 1989126353Smlaier yyerror("no routing address with " 1990126353Smlaier "matching address family found."); 1991126353Smlaier YYERROR; 1992126353Smlaier } 1993130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1994130617Smlaier PF_POOL_NONE && ($5.host->next != NULL || 1995130617Smlaier $5.host->addr.type == PF_ADDR_TABLE || 1996130617Smlaier DYNIF_MULTIADDR($5.host->addr))) 1997130617Smlaier r.rpool.opts |= PF_POOL_ROUNDROBIN; 1998130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1999130617Smlaier PF_POOL_ROUNDROBIN && 2000130617Smlaier disallow_table($5.host, "tables are only " 2001130617Smlaier "supported in round-robin routing pools")) 2002130617Smlaier YYERROR; 2003130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2004130617Smlaier PF_POOL_ROUNDROBIN && 2005130617Smlaier disallow_alias($5.host, "interface (%s) " 2006130617Smlaier "is only supported in round-robin " 2007130617Smlaier "routing pools")) 2008130617Smlaier YYERROR; 2009126353Smlaier if ($5.host->next != NULL) { 2010130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2011126353Smlaier PF_POOL_ROUNDROBIN) { 2012126353Smlaier yyerror("r.rpool.opts must " 2013126353Smlaier "be PF_POOL_ROUNDROBIN"); 2014126353Smlaier YYERROR; 2015126353Smlaier } 2016126353Smlaier } 2017126353Smlaier } 2018126353Smlaier if ($9.queues.qname != NULL) { 2019126353Smlaier if (strlcpy(r.qname, $9.queues.qname, 2020126353Smlaier sizeof(r.qname)) >= sizeof(r.qname)) { 2021126353Smlaier yyerror("rule qname too long (max " 2022126353Smlaier "%d chars)", sizeof(r.qname)-1); 2023126353Smlaier YYERROR; 2024126353Smlaier } 2025126353Smlaier free($9.queues.qname); 2026126353Smlaier } 2027126353Smlaier if ($9.queues.pqname != NULL) { 2028126353Smlaier if (strlcpy(r.pqname, $9.queues.pqname, 2029126353Smlaier sizeof(r.pqname)) >= sizeof(r.pqname)) { 2030126353Smlaier yyerror("rule pqname too long (max " 2031126353Smlaier "%d chars)", sizeof(r.pqname)-1); 2032126353Smlaier YYERROR; 2033126353Smlaier } 2034126353Smlaier free($9.queues.pqname); 2035126353Smlaier } 2036126353Smlaier 2037126353Smlaier expand_rule(&r, $4, $5.host, $7, $8.src_os, 2038126353Smlaier $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 2039145840Smlaier $9.uid, $9.gid, $9.icmpspec, ""); 2040126353Smlaier } 2041126353Smlaier ; 2042126353Smlaier 2043171172Smlaierfilter_opts : { 2044171172Smlaier bzero(&filter_opts, sizeof filter_opts); 2045171172Smlaier filter_opts.rtableid = -1; 2046171172Smlaier } 2047130617Smlaier filter_opts_l 2048126353Smlaier { $$ = filter_opts; } 2049126353Smlaier | /* empty */ { 2050126353Smlaier bzero(&filter_opts, sizeof filter_opts); 2051171172Smlaier filter_opts.rtableid = -1; 2052126353Smlaier $$ = filter_opts; 2053126353Smlaier } 2054126353Smlaier ; 2055126353Smlaier 2056126353Smlaierfilter_opts_l : filter_opts_l filter_opt 2057126353Smlaier | filter_opt 2058126353Smlaier ; 2059126353Smlaier 2060126353Smlaierfilter_opt : USER uids { 2061126353Smlaier if (filter_opts.uid) 2062126353Smlaier $2->tail->next = filter_opts.uid; 2063126353Smlaier filter_opts.uid = $2; 2064126353Smlaier } 2065126353Smlaier | GROUP gids { 2066126353Smlaier if (filter_opts.gid) 2067126353Smlaier $2->tail->next = filter_opts.gid; 2068126353Smlaier filter_opts.gid = $2; 2069126353Smlaier } 2070126353Smlaier | flags { 2071126353Smlaier if (filter_opts.marker & FOM_FLAGS) { 2072126353Smlaier yyerror("flags cannot be redefined"); 2073126353Smlaier YYERROR; 2074126353Smlaier } 2075126353Smlaier filter_opts.marker |= FOM_FLAGS; 2076126353Smlaier filter_opts.flags.b1 |= $1.b1; 2077126353Smlaier filter_opts.flags.b2 |= $1.b2; 2078126353Smlaier filter_opts.flags.w |= $1.w; 2079126353Smlaier filter_opts.flags.w2 |= $1.w2; 2080126353Smlaier } 2081126353Smlaier | icmpspec { 2082126353Smlaier if (filter_opts.marker & FOM_ICMP) { 2083126353Smlaier yyerror("icmp-type cannot be redefined"); 2084126353Smlaier YYERROR; 2085126353Smlaier } 2086126353Smlaier filter_opts.marker |= FOM_ICMP; 2087126353Smlaier filter_opts.icmpspec = $1; 2088126353Smlaier } 2089126353Smlaier | tos { 2090126353Smlaier if (filter_opts.marker & FOM_TOS) { 2091126353Smlaier yyerror("tos cannot be redefined"); 2092126353Smlaier YYERROR; 2093126353Smlaier } 2094126353Smlaier filter_opts.marker |= FOM_TOS; 2095126353Smlaier filter_opts.tos = $1; 2096126353Smlaier } 2097126353Smlaier | keep { 2098126353Smlaier if (filter_opts.marker & FOM_KEEP) { 2099126353Smlaier yyerror("modulate or keep cannot be redefined"); 2100126353Smlaier YYERROR; 2101126353Smlaier } 2102126353Smlaier filter_opts.marker |= FOM_KEEP; 2103126353Smlaier filter_opts.keep.action = $1.action; 2104126353Smlaier filter_opts.keep.options = $1.options; 2105126353Smlaier } 2106126353Smlaier | FRAGMENT { 2107126353Smlaier filter_opts.fragment = 1; 2108126353Smlaier } 2109126353Smlaier | ALLOWOPTS { 2110126353Smlaier filter_opts.allowopts = 1; 2111126353Smlaier } 2112126353Smlaier | label { 2113126353Smlaier if (filter_opts.label) { 2114126353Smlaier yyerror("label cannot be redefined"); 2115126353Smlaier YYERROR; 2116126353Smlaier } 2117126353Smlaier filter_opts.label = $1; 2118126353Smlaier } 2119126353Smlaier | qname { 2120126353Smlaier if (filter_opts.queues.qname) { 2121126353Smlaier yyerror("queue cannot be redefined"); 2122126353Smlaier YYERROR; 2123126353Smlaier } 2124126353Smlaier filter_opts.queues = $1; 2125126353Smlaier } 2126126353Smlaier | TAG string { 2127126353Smlaier filter_opts.tag = $2; 2128126353Smlaier } 2129126353Smlaier | not TAGGED string { 2130126353Smlaier filter_opts.match_tag = $3; 2131126353Smlaier filter_opts.match_tag_not = $1; 2132126353Smlaier } 2133145840Smlaier | PROBABILITY STRING { 2134145840Smlaier char *e; 2135145840Smlaier double p = strtod($2, &e); 2136145840Smlaier 2137145840Smlaier if (*e == '%') { 2138145840Smlaier p *= 0.01; 2139145840Smlaier e++; 2140145840Smlaier } 2141145840Smlaier if (*e) { 2142145840Smlaier yyerror("invalid probability: %s", $2); 2143145840Smlaier free($2); 2144145840Smlaier YYERROR; 2145145840Smlaier } 2146145840Smlaier p = floor(p * (UINT_MAX+1.0) + 0.5); 2147145840Smlaier if (p < 1.0 || p >= (UINT_MAX+1.0)) { 2148145840Smlaier yyerror("invalid probability: %s", $2); 2149145840Smlaier free($2); 2150145840Smlaier YYERROR; 2151145840Smlaier } 2152145840Smlaier filter_opts.prob = (u_int32_t)p; 2153145840Smlaier free($2); 2154145840Smlaier } 2155171172Smlaier | RTABLE number { 2156171172Smlaier#ifdef __FreeBSD__ 2157171172Smlaier yyerror("rtable id not supported in FreeBSD, yet"); 2158171172Smlaier YYERROR; 2159171172Smlaier#else 2160171172Smlaier if ($2 > RT_TABLEID_MAX || $2 < 0) { 2161171172Smlaier yyerror("invalid rtable id"); 2162171172Smlaier YYERROR; 2163171172Smlaier } 2164171172Smlaier filter_opts.rtableid = $2; 2165171172Smlaier#endif 2166171172Smlaier } 2167126353Smlaier ; 2168126353Smlaier 2169126353Smlaieraction : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2170126353Smlaier | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2171126353Smlaier ; 2172126353Smlaier 2173126353Smlaierblockspec : /* empty */ { 2174126353Smlaier $$.b2 = blockpolicy; 2175126353Smlaier $$.w = returnicmpdefault; 2176126353Smlaier $$.w2 = returnicmp6default; 2177126353Smlaier } 2178126353Smlaier | DROP { 2179126353Smlaier $$.b2 = PFRULE_DROP; 2180126353Smlaier $$.w = 0; 2181126353Smlaier $$.w2 = 0; 2182126353Smlaier } 2183126353Smlaier | RETURNRST { 2184126353Smlaier $$.b2 = PFRULE_RETURNRST; 2185126353Smlaier $$.w = 0; 2186126353Smlaier $$.w2 = 0; 2187126353Smlaier } 2188126353Smlaier | RETURNRST '(' TTL number ')' { 2189126353Smlaier if ($4 > 255) { 2190126353Smlaier yyerror("illegal ttl value %d", $4); 2191126353Smlaier YYERROR; 2192126353Smlaier } 2193126353Smlaier $$.b2 = PFRULE_RETURNRST; 2194126353Smlaier $$.w = $4; 2195126353Smlaier $$.w2 = 0; 2196126353Smlaier } 2197126353Smlaier | RETURNICMP { 2198126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2199126353Smlaier $$.w = returnicmpdefault; 2200126353Smlaier $$.w2 = returnicmp6default; 2201126353Smlaier } 2202126353Smlaier | RETURNICMP6 { 2203126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2204126353Smlaier $$.w = returnicmpdefault; 2205126353Smlaier $$.w2 = returnicmp6default; 2206126353Smlaier } 2207126353Smlaier | RETURNICMP '(' STRING ')' { 2208126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2209130617Smlaier if (!($$.w = parseicmpspec($3, AF_INET))) { 2210130617Smlaier free($3); 2211126353Smlaier YYERROR; 2212130617Smlaier } 2213130617Smlaier free($3); 2214126353Smlaier $$.w2 = returnicmp6default; 2215126353Smlaier } 2216126353Smlaier | RETURNICMP6 '(' STRING ')' { 2217126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2218126353Smlaier $$.w = returnicmpdefault; 2219130617Smlaier if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 2220130617Smlaier free($3); 2221126353Smlaier YYERROR; 2222130617Smlaier } 2223130617Smlaier free($3); 2224126353Smlaier } 2225126353Smlaier | RETURNICMP '(' STRING comma STRING ')' { 2226126353Smlaier $$.b2 = PFRULE_RETURNICMP; 2227130617Smlaier if (!($$.w = parseicmpspec($3, AF_INET)) || 2228130617Smlaier !($$.w2 = parseicmpspec($5, AF_INET6))) { 2229130617Smlaier free($3); 2230130617Smlaier free($5); 2231126353Smlaier YYERROR; 2232130617Smlaier } 2233130617Smlaier free($3); 2234130617Smlaier free($5); 2235126353Smlaier } 2236126353Smlaier | RETURN { 2237126353Smlaier $$.b2 = PFRULE_RETURN; 2238126353Smlaier $$.w = returnicmpdefault; 2239126353Smlaier $$.w2 = returnicmp6default; 2240126353Smlaier } 2241126353Smlaier ; 2242126353Smlaier 2243126353Smlaierdir : /* empty */ { $$ = 0; } 2244126353Smlaier | IN { $$ = PF_IN; } 2245126353Smlaier | OUT { $$ = PF_OUT; } 2246126353Smlaier ; 2247126353Smlaier 2248171172Smlaierquick : /* empty */ { $$.quick = 0; } 2249171172Smlaier | QUICK { $$.quick = 1; } 2250126353Smlaier ; 2251126353Smlaier 2252171172Smlaierlogquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2253171172Smlaier | log { $$ = $1; $$.quick = 0; } 2254171172Smlaier | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2255171172Smlaier | log QUICK { $$ = $1; $$.quick = 1; } 2256171172Smlaier | QUICK log { $$ = $2; $$.quick = 1; } 2257126353Smlaier ; 2258126353Smlaier 2259171172Smlaierlog : LOG { $$.log = PF_LOG; $$.logif = 0; } 2260171172Smlaier | LOG '(' logopts ')' { 2261171172Smlaier $$.log = PF_LOG | $3.log; 2262171172Smlaier $$.logif = $3.logif; 2263171172Smlaier } 2264171172Smlaier ; 2265171172Smlaier 2266171172Smlaierlogopts : logopt { $$ = $1; } 2267171172Smlaier | logopts comma logopt { 2268171172Smlaier $$.log = $1.log | $3.log; 2269171172Smlaier $$.logif = $3.logif; 2270171172Smlaier if ($$.logif == 0) 2271171172Smlaier $$.logif = $1.logif; 2272171172Smlaier } 2273171172Smlaier ; 2274171172Smlaier 2275171172Smlaierlogopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2276171172Smlaier | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2277171172Smlaier | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2278171172Smlaier | TO string { 2279171172Smlaier const char *errstr; 2280171172Smlaier u_int i; 2281171172Smlaier 2282171172Smlaier $$.log = 0; 2283171172Smlaier if (strncmp($2, "pflog", 5)) { 2284171172Smlaier yyerror("%s: should be a pflog interface", $2); 2285171172Smlaier free($2); 2286171172Smlaier YYERROR; 2287171172Smlaier } 2288171172Smlaier i = strtonum($2 + 5, 0, 255, &errstr); 2289171172Smlaier if (errstr) { 2290171172Smlaier yyerror("%s: %s", $2, errstr); 2291171172Smlaier free($2); 2292171172Smlaier YYERROR; 2293171172Smlaier } 2294171172Smlaier free($2); 2295171172Smlaier $$.logif = i; 2296171172Smlaier } 2297171172Smlaier ; 2298171172Smlaier 2299126353Smlaierinterface : /* empty */ { $$ = NULL; } 2300126353Smlaier | ON if_item_not { $$ = $2; } 2301126353Smlaier | ON '{' if_list '}' { $$ = $3; } 2302126353Smlaier ; 2303126353Smlaier 2304126353Smlaierif_list : if_item_not { $$ = $1; } 2305126353Smlaier | if_list comma if_item_not { 2306126353Smlaier $1->tail->next = $3; 2307126353Smlaier $1->tail = $3; 2308126353Smlaier $$ = $1; 2309126353Smlaier } 2310126353Smlaier ; 2311126353Smlaier 2312126353Smlaierif_item_not : not if_item { $$ = $2; $$->not = $1; } 2313126353Smlaier ; 2314126353Smlaier 2315126353Smlaierif_item : STRING { 2316126353Smlaier struct node_host *n; 2317126353Smlaier 2318126353Smlaier $$ = calloc(1, sizeof(struct node_if)); 2319126353Smlaier if ($$ == NULL) 2320126353Smlaier err(1, "if_item: calloc"); 2321126353Smlaier if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2322126353Smlaier sizeof($$->ifname)) { 2323130617Smlaier free($1); 2324126353Smlaier free($$); 2325126353Smlaier yyerror("interface name too long"); 2326126353Smlaier YYERROR; 2327126353Smlaier } 2328145840Smlaier 2329171172Smlaier if ((n = ifa_exists($1)) != NULL) 2330145840Smlaier $$->ifa_flags = n->ifa_flags; 2331145840Smlaier 2332130617Smlaier free($1); 2333126353Smlaier $$->not = 0; 2334126353Smlaier $$->next = NULL; 2335126353Smlaier $$->tail = $$; 2336126353Smlaier } 2337126353Smlaier ; 2338126353Smlaier 2339126353Smlaieraf : /* empty */ { $$ = 0; } 2340126353Smlaier | INET { $$ = AF_INET; } 2341126353Smlaier | INET6 { $$ = AF_INET6; } 2342130617Smlaier ; 2343126353Smlaier 2344126353Smlaierproto : /* empty */ { $$ = NULL; } 2345126353Smlaier | PROTO proto_item { $$ = $2; } 2346126353Smlaier | PROTO '{' proto_list '}' { $$ = $3; } 2347126353Smlaier ; 2348126353Smlaier 2349126353Smlaierproto_list : proto_item { $$ = $1; } 2350126353Smlaier | proto_list comma proto_item { 2351126353Smlaier $1->tail->next = $3; 2352126353Smlaier $1->tail = $3; 2353126353Smlaier $$ = $1; 2354126353Smlaier } 2355126353Smlaier ; 2356126353Smlaier 2357126353Smlaierproto_item : STRING { 2358126353Smlaier u_int8_t pr; 2359126353Smlaier u_long ulval; 2360126353Smlaier 2361126353Smlaier if (atoul($1, &ulval) == 0) { 2362126353Smlaier if (ulval > 255) { 2363126353Smlaier yyerror("protocol outside range"); 2364130617Smlaier free($1); 2365126353Smlaier YYERROR; 2366126353Smlaier } 2367126353Smlaier pr = (u_int8_t)ulval; 2368126353Smlaier } else { 2369126353Smlaier struct protoent *p; 2370126353Smlaier 2371126353Smlaier p = getprotobyname($1); 2372126353Smlaier if (p == NULL) { 2373126353Smlaier yyerror("unknown protocol %s", $1); 2374130617Smlaier free($1); 2375126353Smlaier YYERROR; 2376126353Smlaier } 2377126353Smlaier pr = p->p_proto; 2378126353Smlaier } 2379130617Smlaier free($1); 2380126353Smlaier if (pr == 0) { 2381126353Smlaier yyerror("proto 0 cannot be used"); 2382126353Smlaier YYERROR; 2383126353Smlaier } 2384126353Smlaier $$ = calloc(1, sizeof(struct node_proto)); 2385126353Smlaier if ($$ == NULL) 2386126353Smlaier err(1, "proto_item: calloc"); 2387126353Smlaier $$->proto = pr; 2388126353Smlaier $$->next = NULL; 2389126353Smlaier $$->tail = $$; 2390126353Smlaier } 2391126353Smlaier ; 2392126353Smlaier 2393126353Smlaierfromto : ALL { 2394126353Smlaier $$.src.host = NULL; 2395126353Smlaier $$.src.port = NULL; 2396126353Smlaier $$.dst.host = NULL; 2397126353Smlaier $$.dst.port = NULL; 2398126353Smlaier $$.src_os = NULL; 2399126353Smlaier } 2400126353Smlaier | from os to { 2401126353Smlaier $$.src = $1; 2402126353Smlaier $$.src_os = $2; 2403126353Smlaier $$.dst = $3; 2404126353Smlaier } 2405126353Smlaier ; 2406126353Smlaier 2407126353Smlaieros : /* empty */ { $$ = NULL; } 2408126353Smlaier | OS xos { $$ = $2; } 2409126353Smlaier | OS '{' os_list '}' { $$ = $3; } 2410126353Smlaier ; 2411126353Smlaier 2412126353Smlaierxos : STRING { 2413126353Smlaier $$ = calloc(1, sizeof(struct node_os)); 2414126353Smlaier if ($$ == NULL) 2415126353Smlaier err(1, "os: calloc"); 2416126353Smlaier $$->os = $1; 2417126353Smlaier $$->tail = $$; 2418126353Smlaier } 2419126353Smlaier ; 2420126353Smlaier 2421126353Smlaieros_list : xos { $$ = $1; } 2422126353Smlaier | os_list comma xos { 2423126353Smlaier $1->tail->next = $3; 2424126353Smlaier $1->tail = $3; 2425126353Smlaier $$ = $1; 2426126353Smlaier } 2427126353Smlaier ; 2428126353Smlaier 2429126353Smlaierfrom : /* empty */ { 2430126353Smlaier $$.host = NULL; 2431126353Smlaier $$.port = NULL; 2432126353Smlaier } 2433126353Smlaier | FROM ipportspec { 2434126353Smlaier $$ = $2; 2435126353Smlaier } 2436126353Smlaier ; 2437126353Smlaier 2438126353Smlaierto : /* empty */ { 2439126353Smlaier $$.host = NULL; 2440126353Smlaier $$.port = NULL; 2441126353Smlaier } 2442126353Smlaier | TO ipportspec { 2443171172Smlaier if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2444171172Smlaier "not permitted in a destination address")) 2445171172Smlaier YYERROR; 2446126353Smlaier $$ = $2; 2447126353Smlaier } 2448126353Smlaier ; 2449126353Smlaier 2450126353Smlaieripportspec : ipspec { 2451126353Smlaier $$.host = $1; 2452126353Smlaier $$.port = NULL; 2453126353Smlaier } 2454126353Smlaier | ipspec PORT portspec { 2455126353Smlaier $$.host = $1; 2456126353Smlaier $$.port = $3; 2457126353Smlaier } 2458126353Smlaier | PORT portspec { 2459126353Smlaier $$.host = NULL; 2460126353Smlaier $$.port = $2; 2461126353Smlaier } 2462126353Smlaier ; 2463126353Smlaier 2464126353Smlaieripspec : ANY { $$ = NULL; } 2465126353Smlaier | xhost { $$ = $1; } 2466126353Smlaier | '{' host_list '}' { $$ = $2; } 2467126353Smlaier ; 2468126353Smlaier 2469171172Smlaierhost_list : ipspec { $$ = $1; } 2470171172Smlaier | host_list comma ipspec { 2471126353Smlaier if ($3 == NULL) 2472126353Smlaier $$ = $1; 2473126353Smlaier else if ($1 == NULL) 2474126353Smlaier $$ = $3; 2475126353Smlaier else { 2476126353Smlaier $1->tail->next = $3; 2477126353Smlaier $1->tail = $3->tail; 2478126353Smlaier $$ = $1; 2479126353Smlaier } 2480126353Smlaier } 2481126353Smlaier ; 2482126353Smlaier 2483126353Smlaierxhost : not host { 2484126353Smlaier struct node_host *n; 2485126353Smlaier 2486126353Smlaier for (n = $2; n != NULL; n = n->next) 2487126353Smlaier n->not = $1; 2488126353Smlaier $$ = $2; 2489126353Smlaier } 2490171172Smlaier | not NOROUTE { 2491126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2492126353Smlaier if ($$ == NULL) 2493126353Smlaier err(1, "xhost: calloc"); 2494126353Smlaier $$->addr.type = PF_ADDR_NOROUTE; 2495126353Smlaier $$->next = NULL; 2496171172Smlaier $$->not = $1; 2497126353Smlaier $$->tail = $$; 2498126353Smlaier } 2499171172Smlaier | not URPFFAILED { 2500171172Smlaier $$ = calloc(1, sizeof(struct node_host)); 2501171172Smlaier if ($$ == NULL) 2502171172Smlaier err(1, "xhost: calloc"); 2503171172Smlaier $$->addr.type = PF_ADDR_URPFFAILED; 2504171172Smlaier $$->next = NULL; 2505171172Smlaier $$->not = $1; 2506171172Smlaier $$->tail = $$; 2507171172Smlaier } 2508126353Smlaier ; 2509126353Smlaier 2510126353Smlaierhost : STRING { 2511126353Smlaier if (($$ = host($1)) == NULL) { 2512126353Smlaier /* error. "any" is handled elsewhere */ 2513130617Smlaier free($1); 2514126353Smlaier yyerror("could not parse host specification"); 2515126353Smlaier YYERROR; 2516126353Smlaier } 2517130617Smlaier free($1); 2518126353Smlaier 2519126353Smlaier } 2520126353Smlaier | STRING '/' number { 2521126353Smlaier char *buf; 2522126353Smlaier 2523126353Smlaier if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2524126353Smlaier err(1, "host: asprintf"); 2525130617Smlaier free($1); 2526126353Smlaier if (($$ = host(buf)) == NULL) { 2527126353Smlaier /* error. "any" is handled elsewhere */ 2528126353Smlaier free(buf); 2529126353Smlaier yyerror("could not parse host specification"); 2530126353Smlaier YYERROR; 2531126353Smlaier } 2532126353Smlaier free(buf); 2533126353Smlaier } 2534126353Smlaier | dynaddr 2535126353Smlaier | dynaddr '/' number { 2536126353Smlaier struct node_host *n; 2537126353Smlaier 2538126353Smlaier $$ = $1; 2539126353Smlaier for (n = $1; n != NULL; n = n->next) 2540126353Smlaier set_ipmask(n, $3); 2541126353Smlaier } 2542126353Smlaier | '<' STRING '>' { 2543126353Smlaier if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2544130617Smlaier yyerror("table name '%s' too long", $2); 2545130617Smlaier free($2); 2546126353Smlaier YYERROR; 2547126353Smlaier } 2548126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2549126353Smlaier if ($$ == NULL) 2550126353Smlaier err(1, "host: calloc"); 2551126353Smlaier $$->addr.type = PF_ADDR_TABLE; 2552126353Smlaier if (strlcpy($$->addr.v.tblname, $2, 2553126353Smlaier sizeof($$->addr.v.tblname)) >= 2554126353Smlaier sizeof($$->addr.v.tblname)) 2555126353Smlaier errx(1, "host: strlcpy"); 2556130617Smlaier free($2); 2557126353Smlaier $$->next = NULL; 2558126353Smlaier $$->tail = $$; 2559126353Smlaier } 2560145840Smlaier | ROUTE STRING { 2561145840Smlaier $$ = calloc(1, sizeof(struct node_host)); 2562145840Smlaier if ($$ == NULL) { 2563145840Smlaier free($2); 2564145840Smlaier err(1, "host: calloc"); 2565145840Smlaier } 2566145840Smlaier $$->addr.type = PF_ADDR_RTLABEL; 2567145840Smlaier if (strlcpy($$->addr.v.rtlabelname, $2, 2568145840Smlaier sizeof($$->addr.v.rtlabelname)) >= 2569145840Smlaier sizeof($$->addr.v.rtlabelname)) { 2570145840Smlaier yyerror("route label too long, max %u chars", 2571145840Smlaier sizeof($$->addr.v.rtlabelname) - 1); 2572145840Smlaier free($2); 2573145840Smlaier free($$); 2574145840Smlaier YYERROR; 2575145840Smlaier } 2576145840Smlaier $$->next = NULL; 2577145840Smlaier $$->tail = $$; 2578145840Smlaier free($2); 2579145840Smlaier } 2580126353Smlaier ; 2581126353Smlaier 2582126353Smlaiernumber : STRING { 2583126353Smlaier u_long ulval; 2584126353Smlaier 2585126353Smlaier if (atoul($1, &ulval) == -1) { 2586126353Smlaier yyerror("%s is not a number", $1); 2587130617Smlaier free($1); 2588126353Smlaier YYERROR; 2589126353Smlaier } else 2590126353Smlaier $$ = ulval; 2591130617Smlaier free($1); 2592126353Smlaier } 2593126353Smlaier ; 2594126353Smlaier 2595126353Smlaierdynaddr : '(' STRING ')' { 2596130617Smlaier int flags = 0; 2597130617Smlaier char *p, *op; 2598130617Smlaier 2599130617Smlaier op = $2; 2600145840Smlaier if (!isalpha(op[0])) { 2601145840Smlaier yyerror("invalid interface name '%s'", op); 2602145840Smlaier free(op); 2603145840Smlaier YYERROR; 2604145840Smlaier } 2605130617Smlaier while ((p = strrchr($2, ':')) != NULL) { 2606130617Smlaier if (!strcmp(p+1, "network")) 2607130617Smlaier flags |= PFI_AFLAG_NETWORK; 2608130617Smlaier else if (!strcmp(p+1, "broadcast")) 2609130617Smlaier flags |= PFI_AFLAG_BROADCAST; 2610130617Smlaier else if (!strcmp(p+1, "peer")) 2611130617Smlaier flags |= PFI_AFLAG_PEER; 2612130617Smlaier else if (!strcmp(p+1, "0")) 2613130617Smlaier flags |= PFI_AFLAG_NOALIAS; 2614130617Smlaier else { 2615130617Smlaier yyerror("interface %s has bad modifier", 2616130617Smlaier $2); 2617130617Smlaier free(op); 2618130617Smlaier YYERROR; 2619130617Smlaier } 2620130617Smlaier *p = '\0'; 2621130617Smlaier } 2622130617Smlaier if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2623130617Smlaier free(op); 2624130617Smlaier yyerror("illegal combination of " 2625130617Smlaier "interface modifiers"); 2626130617Smlaier YYERROR; 2627130617Smlaier } 2628126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 2629126353Smlaier if ($$ == NULL) 2630126353Smlaier err(1, "address: calloc"); 2631126353Smlaier $$->af = 0; 2632126353Smlaier set_ipmask($$, 128); 2633126353Smlaier $$->addr.type = PF_ADDR_DYNIFTL; 2634130617Smlaier $$->addr.iflags = flags; 2635126353Smlaier if (strlcpy($$->addr.v.ifname, $2, 2636126353Smlaier sizeof($$->addr.v.ifname)) >= 2637126353Smlaier sizeof($$->addr.v.ifname)) { 2638130617Smlaier free(op); 2639126353Smlaier free($$); 2640126353Smlaier yyerror("interface name too long"); 2641126353Smlaier YYERROR; 2642126353Smlaier } 2643130617Smlaier free(op); 2644126353Smlaier $$->next = NULL; 2645126353Smlaier $$->tail = $$; 2646126353Smlaier } 2647126353Smlaier ; 2648126353Smlaier 2649126353Smlaierportspec : port_item { $$ = $1; } 2650126353Smlaier | '{' port_list '}' { $$ = $2; } 2651126353Smlaier ; 2652126353Smlaier 2653126353Smlaierport_list : port_item { $$ = $1; } 2654126353Smlaier | port_list comma port_item { 2655126353Smlaier $1->tail->next = $3; 2656126353Smlaier $1->tail = $3; 2657126353Smlaier $$ = $1; 2658126353Smlaier } 2659126353Smlaier ; 2660126353Smlaier 2661126353Smlaierport_item : port { 2662126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2663126353Smlaier if ($$ == NULL) 2664126353Smlaier err(1, "port_item: calloc"); 2665126353Smlaier $$->port[0] = $1.a; 2666126353Smlaier $$->port[1] = $1.b; 2667126353Smlaier if ($1.t) 2668126353Smlaier $$->op = PF_OP_RRG; 2669126353Smlaier else 2670126353Smlaier $$->op = PF_OP_EQ; 2671126353Smlaier $$->next = NULL; 2672126353Smlaier $$->tail = $$; 2673126353Smlaier } 2674126353Smlaier | unaryop port { 2675126353Smlaier if ($2.t) { 2676126353Smlaier yyerror("':' cannot be used with an other " 2677126353Smlaier "port operator"); 2678126353Smlaier YYERROR; 2679126353Smlaier } 2680126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2681126353Smlaier if ($$ == NULL) 2682126353Smlaier err(1, "port_item: calloc"); 2683126353Smlaier $$->port[0] = $2.a; 2684126353Smlaier $$->port[1] = $2.b; 2685126353Smlaier $$->op = $1; 2686126353Smlaier $$->next = NULL; 2687126353Smlaier $$->tail = $$; 2688126353Smlaier } 2689126353Smlaier | port PORTBINARY port { 2690126353Smlaier if ($1.t || $3.t) { 2691126353Smlaier yyerror("':' cannot be used with an other " 2692126353Smlaier "port operator"); 2693126353Smlaier YYERROR; 2694126353Smlaier } 2695126353Smlaier $$ = calloc(1, sizeof(struct node_port)); 2696126353Smlaier if ($$ == NULL) 2697126353Smlaier err(1, "port_item: calloc"); 2698126353Smlaier $$->port[0] = $1.a; 2699126353Smlaier $$->port[1] = $3.a; 2700126353Smlaier $$->op = $2; 2701126353Smlaier $$->next = NULL; 2702126353Smlaier $$->tail = $$; 2703126353Smlaier } 2704126353Smlaier ; 2705126353Smlaier 2706126353Smlaierport : STRING { 2707126353Smlaier char *p = strchr($1, ':'); 2708126353Smlaier 2709126353Smlaier if (p == NULL) { 2710171172Smlaier if (($$.a = getservice($1)) == -1) { 2711171172Smlaier free($1); 2712171172Smlaier YYERROR; 2713126353Smlaier } 2714171172Smlaier $$.b = $$.t = 0; 2715126353Smlaier } else { 2716126353Smlaier int port[2]; 2717126353Smlaier 2718126353Smlaier *p++ = 0; 2719126353Smlaier if ((port[0] = getservice($1)) == -1 || 2720130617Smlaier (port[1] = getservice(p)) == -1) { 2721130617Smlaier free($1); 2722126353Smlaier YYERROR; 2723130617Smlaier } 2724126353Smlaier $$.a = port[0]; 2725126353Smlaier $$.b = port[1]; 2726126353Smlaier $$.t = PF_OP_RRG; 2727126353Smlaier } 2728130617Smlaier free($1); 2729126353Smlaier } 2730126353Smlaier ; 2731126353Smlaier 2732126353Smlaieruids : uid_item { $$ = $1; } 2733126353Smlaier | '{' uid_list '}' { $$ = $2; } 2734126353Smlaier ; 2735126353Smlaier 2736126353Smlaieruid_list : uid_item { $$ = $1; } 2737126353Smlaier | uid_list comma uid_item { 2738126353Smlaier $1->tail->next = $3; 2739126353Smlaier $1->tail = $3; 2740126353Smlaier $$ = $1; 2741126353Smlaier } 2742126353Smlaier ; 2743126353Smlaier 2744126353Smlaieruid_item : uid { 2745126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2746126353Smlaier if ($$ == NULL) 2747126353Smlaier err(1, "uid_item: calloc"); 2748126353Smlaier $$->uid[0] = $1; 2749126353Smlaier $$->uid[1] = $1; 2750126353Smlaier $$->op = PF_OP_EQ; 2751126353Smlaier $$->next = NULL; 2752126353Smlaier $$->tail = $$; 2753126353Smlaier } 2754126353Smlaier | unaryop uid { 2755126353Smlaier if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2756126353Smlaier yyerror("user unknown requires operator = or " 2757126353Smlaier "!="); 2758126353Smlaier YYERROR; 2759126353Smlaier } 2760126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2761126353Smlaier if ($$ == NULL) 2762126353Smlaier err(1, "uid_item: calloc"); 2763126353Smlaier $$->uid[0] = $2; 2764126353Smlaier $$->uid[1] = $2; 2765126353Smlaier $$->op = $1; 2766126353Smlaier $$->next = NULL; 2767126353Smlaier $$->tail = $$; 2768126353Smlaier } 2769126353Smlaier | uid PORTBINARY uid { 2770126353Smlaier if ($1 == UID_MAX || $3 == UID_MAX) { 2771126353Smlaier yyerror("user unknown requires operator = or " 2772126353Smlaier "!="); 2773126353Smlaier YYERROR; 2774126353Smlaier } 2775126353Smlaier $$ = calloc(1, sizeof(struct node_uid)); 2776126353Smlaier if ($$ == NULL) 2777126353Smlaier err(1, "uid_item: calloc"); 2778126353Smlaier $$->uid[0] = $1; 2779126353Smlaier $$->uid[1] = $3; 2780126353Smlaier $$->op = $2; 2781126353Smlaier $$->next = NULL; 2782126353Smlaier $$->tail = $$; 2783126353Smlaier } 2784126353Smlaier ; 2785126353Smlaier 2786126353Smlaieruid : STRING { 2787126353Smlaier u_long ulval; 2788126353Smlaier 2789126353Smlaier if (atoul($1, &ulval) == -1) { 2790126353Smlaier if (!strcmp($1, "unknown")) 2791126353Smlaier $$ = UID_MAX; 2792126353Smlaier else { 2793126353Smlaier struct passwd *pw; 2794126353Smlaier 2795126353Smlaier if ((pw = getpwnam($1)) == NULL) { 2796126353Smlaier yyerror("unknown user %s", $1); 2797130617Smlaier free($1); 2798126353Smlaier YYERROR; 2799126353Smlaier } 2800126353Smlaier $$ = pw->pw_uid; 2801126353Smlaier } 2802126353Smlaier } else { 2803126353Smlaier if (ulval >= UID_MAX) { 2804130617Smlaier free($1); 2805126353Smlaier yyerror("illegal uid value %lu", ulval); 2806126353Smlaier YYERROR; 2807126353Smlaier } 2808126353Smlaier $$ = ulval; 2809126353Smlaier } 2810130617Smlaier free($1); 2811126353Smlaier } 2812126353Smlaier ; 2813126353Smlaier 2814126353Smlaiergids : gid_item { $$ = $1; } 2815126353Smlaier | '{' gid_list '}' { $$ = $2; } 2816126353Smlaier ; 2817126353Smlaier 2818126353Smlaiergid_list : gid_item { $$ = $1; } 2819126353Smlaier | gid_list comma gid_item { 2820126353Smlaier $1->tail->next = $3; 2821126353Smlaier $1->tail = $3; 2822126353Smlaier $$ = $1; 2823126353Smlaier } 2824126353Smlaier ; 2825126353Smlaier 2826126353Smlaiergid_item : gid { 2827126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2828126353Smlaier if ($$ == NULL) 2829126353Smlaier err(1, "gid_item: calloc"); 2830126353Smlaier $$->gid[0] = $1; 2831126353Smlaier $$->gid[1] = $1; 2832126353Smlaier $$->op = PF_OP_EQ; 2833126353Smlaier $$->next = NULL; 2834126353Smlaier $$->tail = $$; 2835126353Smlaier } 2836126353Smlaier | unaryop gid { 2837126353Smlaier if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2838126353Smlaier yyerror("group unknown requires operator = or " 2839126353Smlaier "!="); 2840126353Smlaier YYERROR; 2841126353Smlaier } 2842126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2843126353Smlaier if ($$ == NULL) 2844126353Smlaier err(1, "gid_item: calloc"); 2845126353Smlaier $$->gid[0] = $2; 2846126353Smlaier $$->gid[1] = $2; 2847126353Smlaier $$->op = $1; 2848126353Smlaier $$->next = NULL; 2849126353Smlaier $$->tail = $$; 2850126353Smlaier } 2851126353Smlaier | gid PORTBINARY gid { 2852126353Smlaier if ($1 == GID_MAX || $3 == GID_MAX) { 2853126353Smlaier yyerror("group unknown requires operator = or " 2854126353Smlaier "!="); 2855126353Smlaier YYERROR; 2856126353Smlaier } 2857126353Smlaier $$ = calloc(1, sizeof(struct node_gid)); 2858126353Smlaier if ($$ == NULL) 2859126353Smlaier err(1, "gid_item: calloc"); 2860126353Smlaier $$->gid[0] = $1; 2861126353Smlaier $$->gid[1] = $3; 2862126353Smlaier $$->op = $2; 2863126353Smlaier $$->next = NULL; 2864126353Smlaier $$->tail = $$; 2865126353Smlaier } 2866126353Smlaier ; 2867126353Smlaier 2868126353Smlaiergid : STRING { 2869126353Smlaier u_long ulval; 2870126353Smlaier 2871126353Smlaier if (atoul($1, &ulval) == -1) { 2872126353Smlaier if (!strcmp($1, "unknown")) 2873126353Smlaier $$ = GID_MAX; 2874126353Smlaier else { 2875126353Smlaier struct group *grp; 2876126353Smlaier 2877126353Smlaier if ((grp = getgrnam($1)) == NULL) { 2878126353Smlaier yyerror("unknown group %s", $1); 2879130617Smlaier free($1); 2880126353Smlaier YYERROR; 2881126353Smlaier } 2882126353Smlaier $$ = grp->gr_gid; 2883126353Smlaier } 2884126353Smlaier } else { 2885126353Smlaier if (ulval >= GID_MAX) { 2886126353Smlaier yyerror("illegal gid value %lu", ulval); 2887130617Smlaier free($1); 2888126353Smlaier YYERROR; 2889126353Smlaier } 2890126353Smlaier $$ = ulval; 2891126353Smlaier } 2892130617Smlaier free($1); 2893126353Smlaier } 2894126353Smlaier ; 2895126353Smlaier 2896126353Smlaierflag : STRING { 2897126353Smlaier int f; 2898126353Smlaier 2899126353Smlaier if ((f = parse_flags($1)) < 0) { 2900126353Smlaier yyerror("bad flags %s", $1); 2901130617Smlaier free($1); 2902126353Smlaier YYERROR; 2903126353Smlaier } 2904130617Smlaier free($1); 2905126353Smlaier $$.b1 = f; 2906126353Smlaier } 2907126353Smlaier ; 2908126353Smlaier 2909126353Smlaierflags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2910126353Smlaier | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2911171172Smlaier | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 2912126353Smlaier ; 2913126353Smlaier 2914126353Smlaiericmpspec : ICMPTYPE icmp_item { $$ = $2; } 2915126353Smlaier | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2916126353Smlaier | ICMP6TYPE icmp6_item { $$ = $2; } 2917126353Smlaier | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2918126353Smlaier ; 2919126353Smlaier 2920126353Smlaiericmp_list : icmp_item { $$ = $1; } 2921126353Smlaier | icmp_list comma icmp_item { 2922126353Smlaier $1->tail->next = $3; 2923126353Smlaier $1->tail = $3; 2924126353Smlaier $$ = $1; 2925126353Smlaier } 2926126353Smlaier ; 2927126353Smlaier 2928126353Smlaiericmp6_list : icmp6_item { $$ = $1; } 2929126353Smlaier | icmp6_list comma icmp6_item { 2930126353Smlaier $1->tail->next = $3; 2931126353Smlaier $1->tail = $3; 2932126353Smlaier $$ = $1; 2933126353Smlaier } 2934126353Smlaier ; 2935126353Smlaier 2936126353Smlaiericmp_item : icmptype { 2937126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2938126353Smlaier if ($$ == NULL) 2939126353Smlaier err(1, "icmp_item: calloc"); 2940126353Smlaier $$->type = $1; 2941126353Smlaier $$->code = 0; 2942126353Smlaier $$->proto = IPPROTO_ICMP; 2943126353Smlaier $$->next = NULL; 2944126353Smlaier $$->tail = $$; 2945126353Smlaier } 2946126353Smlaier | icmptype CODE STRING { 2947126353Smlaier const struct icmpcodeent *p; 2948126353Smlaier u_long ulval; 2949126353Smlaier 2950126353Smlaier if (atoul($3, &ulval) == 0) { 2951126353Smlaier if (ulval > 255) { 2952130617Smlaier free($3); 2953145840Smlaier yyerror("illegal icmp-code %lu", ulval); 2954126353Smlaier YYERROR; 2955126353Smlaier } 2956126353Smlaier } else { 2957126353Smlaier if ((p = geticmpcodebyname($1-1, $3, 2958126353Smlaier AF_INET)) == NULL) { 2959126353Smlaier yyerror("unknown icmp-code %s", $3); 2960130617Smlaier free($3); 2961126353Smlaier YYERROR; 2962126353Smlaier } 2963126353Smlaier ulval = p->code; 2964126353Smlaier } 2965130617Smlaier free($3); 2966126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2967126353Smlaier if ($$ == NULL) 2968126353Smlaier err(1, "icmp_item: calloc"); 2969126353Smlaier $$->type = $1; 2970126353Smlaier $$->code = ulval + 1; 2971126353Smlaier $$->proto = IPPROTO_ICMP; 2972126353Smlaier $$->next = NULL; 2973126353Smlaier $$->tail = $$; 2974126353Smlaier } 2975126353Smlaier ; 2976126353Smlaier 2977126353Smlaiericmp6_item : icmp6type { 2978126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 2979126353Smlaier if ($$ == NULL) 2980126353Smlaier err(1, "icmp_item: calloc"); 2981126353Smlaier $$->type = $1; 2982126353Smlaier $$->code = 0; 2983126353Smlaier $$->proto = IPPROTO_ICMPV6; 2984126353Smlaier $$->next = NULL; 2985126353Smlaier $$->tail = $$; 2986126353Smlaier } 2987126353Smlaier | icmp6type CODE STRING { 2988126353Smlaier const struct icmpcodeent *p; 2989126353Smlaier u_long ulval; 2990126353Smlaier 2991126353Smlaier if (atoul($3, &ulval) == 0) { 2992126353Smlaier if (ulval > 255) { 2993145840Smlaier yyerror("illegal icmp6-code %lu", 2994126353Smlaier ulval); 2995130617Smlaier free($3); 2996126353Smlaier YYERROR; 2997126353Smlaier } 2998126353Smlaier } else { 2999126353Smlaier if ((p = geticmpcodebyname($1-1, $3, 3000126353Smlaier AF_INET6)) == NULL) { 3001126353Smlaier yyerror("unknown icmp6-code %s", $3); 3002130617Smlaier free($3); 3003126353Smlaier YYERROR; 3004126353Smlaier } 3005126353Smlaier ulval = p->code; 3006126353Smlaier } 3007130617Smlaier free($3); 3008126353Smlaier $$ = calloc(1, sizeof(struct node_icmp)); 3009126353Smlaier if ($$ == NULL) 3010126353Smlaier err(1, "icmp_item: calloc"); 3011126353Smlaier $$->type = $1; 3012126353Smlaier $$->code = ulval + 1; 3013126353Smlaier $$->proto = IPPROTO_ICMPV6; 3014126353Smlaier $$->next = NULL; 3015126353Smlaier $$->tail = $$; 3016126353Smlaier } 3017126353Smlaier ; 3018126353Smlaier 3019126353Smlaiericmptype : STRING { 3020126353Smlaier const struct icmptypeent *p; 3021126353Smlaier u_long ulval; 3022126353Smlaier 3023126353Smlaier if (atoul($1, &ulval) == 0) { 3024126353Smlaier if (ulval > 255) { 3025145840Smlaier yyerror("illegal icmp-type %lu", ulval); 3026130617Smlaier free($1); 3027126353Smlaier YYERROR; 3028126353Smlaier } 3029126353Smlaier $$ = ulval + 1; 3030126353Smlaier } else { 3031126353Smlaier if ((p = geticmptypebyname($1, AF_INET)) == 3032126353Smlaier NULL) { 3033126353Smlaier yyerror("unknown icmp-type %s", $1); 3034130617Smlaier free($1); 3035126353Smlaier YYERROR; 3036126353Smlaier } 3037126353Smlaier $$ = p->type + 1; 3038126353Smlaier } 3039130617Smlaier free($1); 3040126353Smlaier } 3041126353Smlaier ; 3042126353Smlaier 3043126353Smlaiericmp6type : STRING { 3044126353Smlaier const struct icmptypeent *p; 3045126353Smlaier u_long ulval; 3046126353Smlaier 3047126353Smlaier if (atoul($1, &ulval) == 0) { 3048126353Smlaier if (ulval > 255) { 3049171172Smlaier yyerror("illegal icmp6-type %lu", 3050171172Smlaier ulval); 3051130617Smlaier free($1); 3052126353Smlaier YYERROR; 3053126353Smlaier } 3054126353Smlaier $$ = ulval + 1; 3055126353Smlaier } else { 3056126353Smlaier if ((p = geticmptypebyname($1, AF_INET6)) == 3057126353Smlaier NULL) { 3058126353Smlaier yyerror("unknown icmp6-type %s", $1); 3059130617Smlaier free($1); 3060126353Smlaier YYERROR; 3061126353Smlaier } 3062126353Smlaier $$ = p->type + 1; 3063126353Smlaier } 3064130617Smlaier free($1); 3065126353Smlaier } 3066126353Smlaier ; 3067126353Smlaier 3068126353Smlaiertos : TOS STRING { 3069126353Smlaier if (!strcmp($2, "lowdelay")) 3070126353Smlaier $$ = IPTOS_LOWDELAY; 3071126353Smlaier else if (!strcmp($2, "throughput")) 3072126353Smlaier $$ = IPTOS_THROUGHPUT; 3073126353Smlaier else if (!strcmp($2, "reliability")) 3074126353Smlaier $$ = IPTOS_RELIABILITY; 3075126353Smlaier else if ($2[0] == '0' && $2[1] == 'x') 3076126353Smlaier $$ = strtoul($2, NULL, 16); 3077126353Smlaier else 3078126353Smlaier $$ = strtoul($2, NULL, 10); 3079126353Smlaier if (!$$ || $$ > 255) { 3080126353Smlaier yyerror("illegal tos value %s", $2); 3081130617Smlaier free($2); 3082126353Smlaier YYERROR; 3083126353Smlaier } 3084130617Smlaier free($2); 3085126353Smlaier } 3086126353Smlaier ; 3087126353Smlaier 3088130617Smlaiersourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3089130617Smlaier | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3090130617Smlaier | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3091130617Smlaier ; 3092130617Smlaier 3093130617Smlaierstatelock : IFBOUND { 3094130617Smlaier $$ = PFRULE_IFBOUND; 3095130617Smlaier } 3096130617Smlaier | FLOATING { 3097130617Smlaier $$ = 0; 3098130617Smlaier } 3099130617Smlaier ; 3100130617Smlaier 3101171172Smlaierkeep : NO STATE { 3102171172Smlaier $$.action = 0; 3103171172Smlaier $$.options = NULL; 3104171172Smlaier } 3105171172Smlaier | KEEP STATE state_opt_spec { 3106126353Smlaier $$.action = PF_STATE_NORMAL; 3107126353Smlaier $$.options = $3; 3108126353Smlaier } 3109130617Smlaier | MODULATE STATE state_opt_spec { 3110126353Smlaier $$.action = PF_STATE_MODULATE; 3111126353Smlaier $$.options = $3; 3112126353Smlaier } 3113126353Smlaier | SYNPROXY STATE state_opt_spec { 3114126353Smlaier $$.action = PF_STATE_SYNPROXY; 3115126353Smlaier $$.options = $3; 3116126353Smlaier } 3117126353Smlaier ; 3118126353Smlaier 3119145840Smlaierflush : /* empty */ { $$ = 0; } 3120145840Smlaier | FLUSH { $$ = PF_FLUSH; } 3121145840Smlaier | FLUSH GLOBAL { 3122145840Smlaier $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3123145840Smlaier } 3124145840Smlaier ; 3125145840Smlaier 3126126353Smlaierstate_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3127126353Smlaier | /* empty */ { $$ = NULL; } 3128126353Smlaier ; 3129126353Smlaier 3130126353Smlaierstate_opt_list : state_opt_item { $$ = $1; } 3131126353Smlaier | state_opt_list comma state_opt_item { 3132126353Smlaier $1->tail->next = $3; 3133126353Smlaier $1->tail = $3; 3134126353Smlaier $$ = $1; 3135126353Smlaier } 3136126353Smlaier ; 3137126353Smlaier 3138126353Smlaierstate_opt_item : MAXIMUM number { 3139126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3140126353Smlaier if ($$ == NULL) 3141126353Smlaier err(1, "state_opt_item: calloc"); 3142126353Smlaier $$->type = PF_STATE_OPT_MAX; 3143126353Smlaier $$->data.max_states = $2; 3144126353Smlaier $$->next = NULL; 3145126353Smlaier $$->tail = $$; 3146126353Smlaier } 3147130617Smlaier | NOSYNC { 3148130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3149130617Smlaier if ($$ == NULL) 3150130617Smlaier err(1, "state_opt_item: calloc"); 3151130617Smlaier $$->type = PF_STATE_OPT_NOSYNC; 3152130617Smlaier $$->next = NULL; 3153130617Smlaier $$->tail = $$; 3154130617Smlaier } 3155130617Smlaier | MAXSRCSTATES number { 3156130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3157130617Smlaier if ($$ == NULL) 3158130617Smlaier err(1, "state_opt_item: calloc"); 3159130617Smlaier $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3160130617Smlaier $$->data.max_src_states = $2; 3161130617Smlaier $$->next = NULL; 3162130617Smlaier $$->tail = $$; 3163130617Smlaier } 3164145840Smlaier | MAXSRCCONN number { 3165145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3166145840Smlaier if ($$ == NULL) 3167145840Smlaier err(1, "state_opt_item: calloc"); 3168145840Smlaier $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3169145840Smlaier $$->data.max_src_conn = $2; 3170145840Smlaier $$->next = NULL; 3171145840Smlaier $$->tail = $$; 3172145840Smlaier } 3173145840Smlaier | MAXSRCCONNRATE number '/' number { 3174145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3175145840Smlaier if ($$ == NULL) 3176145840Smlaier err(1, "state_opt_item: calloc"); 3177145840Smlaier $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3178145840Smlaier $$->data.max_src_conn_rate.limit = $2; 3179145840Smlaier $$->data.max_src_conn_rate.seconds = $4; 3180145840Smlaier $$->next = NULL; 3181145840Smlaier $$->tail = $$; 3182145840Smlaier } 3183145840Smlaier | OVERLOAD '<' STRING '>' flush { 3184145840Smlaier if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3185145840Smlaier yyerror("table name '%s' too long", $3); 3186145840Smlaier free($3); 3187145840Smlaier YYERROR; 3188145840Smlaier } 3189145840Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3190145840Smlaier if ($$ == NULL) 3191145840Smlaier err(1, "state_opt_item: calloc"); 3192145840Smlaier if (strlcpy($$->data.overload.tblname, $3, 3193145840Smlaier PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3194145840Smlaier errx(1, "state_opt_item: strlcpy"); 3195145840Smlaier free($3); 3196145840Smlaier $$->type = PF_STATE_OPT_OVERLOAD; 3197145840Smlaier $$->data.overload.flush = $5; 3198145840Smlaier $$->next = NULL; 3199145840Smlaier $$->tail = $$; 3200145840Smlaier } 3201130617Smlaier | MAXSRCNODES number { 3202130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3203130617Smlaier if ($$ == NULL) 3204130617Smlaier err(1, "state_opt_item: calloc"); 3205130617Smlaier $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3206130617Smlaier $$->data.max_src_nodes = $2; 3207130617Smlaier $$->next = NULL; 3208130617Smlaier $$->tail = $$; 3209130617Smlaier } 3210130617Smlaier | sourcetrack { 3211130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3212130617Smlaier if ($$ == NULL) 3213130617Smlaier err(1, "state_opt_item: calloc"); 3214130617Smlaier $$->type = PF_STATE_OPT_SRCTRACK; 3215130617Smlaier $$->data.src_track = $1; 3216130617Smlaier $$->next = NULL; 3217130617Smlaier $$->tail = $$; 3218130617Smlaier } 3219130617Smlaier | statelock { 3220130617Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3221130617Smlaier if ($$ == NULL) 3222130617Smlaier err(1, "state_opt_item: calloc"); 3223130617Smlaier $$->type = PF_STATE_OPT_STATELOCK; 3224130617Smlaier $$->data.statelock = $1; 3225130617Smlaier $$->next = NULL; 3226130617Smlaier $$->tail = $$; 3227130617Smlaier } 3228126353Smlaier | STRING number { 3229126353Smlaier int i; 3230126353Smlaier 3231126353Smlaier for (i = 0; pf_timeouts[i].name && 3232126353Smlaier strcmp(pf_timeouts[i].name, $1); ++i) 3233126353Smlaier ; /* nothing */ 3234126353Smlaier if (!pf_timeouts[i].name) { 3235126353Smlaier yyerror("illegal timeout name %s", $1); 3236130617Smlaier free($1); 3237126353Smlaier YYERROR; 3238126353Smlaier } 3239126353Smlaier if (strchr(pf_timeouts[i].name, '.') == NULL) { 3240126353Smlaier yyerror("illegal state timeout %s", $1); 3241130617Smlaier free($1); 3242126353Smlaier YYERROR; 3243126353Smlaier } 3244130617Smlaier free($1); 3245126353Smlaier $$ = calloc(1, sizeof(struct node_state_opt)); 3246126353Smlaier if ($$ == NULL) 3247126353Smlaier err(1, "state_opt_item: calloc"); 3248126353Smlaier $$->type = PF_STATE_OPT_TIMEOUT; 3249126353Smlaier $$->data.timeout.number = pf_timeouts[i].timeout; 3250126353Smlaier $$->data.timeout.seconds = $2; 3251126353Smlaier $$->next = NULL; 3252126353Smlaier $$->tail = $$; 3253126353Smlaier } 3254126353Smlaier ; 3255126353Smlaier 3256126353Smlaierlabel : LABEL STRING { 3257130617Smlaier $$ = $2; 3258126353Smlaier } 3259126353Smlaier ; 3260126353Smlaier 3261126353Smlaierqname : QUEUE STRING { 3262130617Smlaier $$.qname = $2; 3263126353Smlaier } 3264126353Smlaier | QUEUE '(' STRING ')' { 3265130617Smlaier $$.qname = $3; 3266126353Smlaier } 3267126353Smlaier | QUEUE '(' STRING comma STRING ')' { 3268130617Smlaier $$.qname = $3; 3269130617Smlaier $$.pqname = $5; 3270126353Smlaier } 3271126353Smlaier ; 3272126353Smlaier 3273126353Smlaierno : /* empty */ { $$ = 0; } 3274126353Smlaier | NO { $$ = 1; } 3275126353Smlaier ; 3276126353Smlaier 3277126353Smlaierrport : STRING { 3278126353Smlaier char *p = strchr($1, ':'); 3279126353Smlaier 3280126353Smlaier if (p == NULL) { 3281130617Smlaier if (($$.a = getservice($1)) == -1) { 3282130617Smlaier free($1); 3283126353Smlaier YYERROR; 3284130617Smlaier } 3285126353Smlaier $$.b = $$.t = 0; 3286126353Smlaier } else if (!strcmp(p+1, "*")) { 3287126353Smlaier *p = 0; 3288130617Smlaier if (($$.a = getservice($1)) == -1) { 3289130617Smlaier free($1); 3290126353Smlaier YYERROR; 3291130617Smlaier } 3292126353Smlaier $$.b = 0; 3293126353Smlaier $$.t = 1; 3294126353Smlaier } else { 3295126353Smlaier *p++ = 0; 3296126353Smlaier if (($$.a = getservice($1)) == -1 || 3297130617Smlaier ($$.b = getservice(p)) == -1) { 3298130617Smlaier free($1); 3299126353Smlaier YYERROR; 3300130617Smlaier } 3301126353Smlaier if ($$.a == $$.b) 3302126353Smlaier $$.b = 0; 3303126353Smlaier $$.t = 0; 3304126353Smlaier } 3305130617Smlaier free($1); 3306126353Smlaier } 3307126353Smlaier ; 3308126353Smlaier 3309126353Smlaierredirspec : host { $$ = $1; } 3310126353Smlaier | '{' redir_host_list '}' { $$ = $2; } 3311126353Smlaier ; 3312126353Smlaier 3313126353Smlaierredir_host_list : host { $$ = $1; } 3314126353Smlaier | redir_host_list comma host { 3315126353Smlaier $1->tail->next = $3; 3316126353Smlaier $1->tail = $3->tail; 3317126353Smlaier $$ = $1; 3318126353Smlaier } 3319126353Smlaier ; 3320126353Smlaier 3321126353Smlaierredirpool : /* empty */ { $$ = NULL; } 3322126353Smlaier | ARROW redirspec { 3323126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3324126353Smlaier if ($$ == NULL) 3325126353Smlaier err(1, "redirection: calloc"); 3326126353Smlaier $$->host = $2; 3327126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 3328126353Smlaier } 3329126353Smlaier | ARROW redirspec PORT rport { 3330126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3331126353Smlaier if ($$ == NULL) 3332126353Smlaier err(1, "redirection: calloc"); 3333126353Smlaier $$->host = $2; 3334126353Smlaier $$->rport = $4; 3335126353Smlaier } 3336126353Smlaier ; 3337126353Smlaier 3338126353Smlaierhashkey : /* empty */ 3339126353Smlaier { 3340126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3341126353Smlaier if ($$ == NULL) 3342126353Smlaier err(1, "hashkey: calloc"); 3343126353Smlaier $$->key32[0] = arc4random(); 3344126353Smlaier $$->key32[1] = arc4random(); 3345126353Smlaier $$->key32[2] = arc4random(); 3346126353Smlaier $$->key32[3] = arc4random(); 3347126353Smlaier } 3348126353Smlaier | string 3349126353Smlaier { 3350126353Smlaier if (!strncmp($1, "0x", 2)) { 3351126353Smlaier if (strlen($1) != 34) { 3352130617Smlaier free($1); 3353126353Smlaier yyerror("hex key must be 128 bits " 3354126353Smlaier "(32 hex digits) long"); 3355126353Smlaier YYERROR; 3356126353Smlaier } 3357126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3358126353Smlaier if ($$ == NULL) 3359126353Smlaier err(1, "hashkey: calloc"); 3360126353Smlaier 3361126353Smlaier if (sscanf($1, "0x%8x%8x%8x%8x", 3362126353Smlaier &$$->key32[0], &$$->key32[1], 3363126353Smlaier &$$->key32[2], &$$->key32[3]) != 4) { 3364126353Smlaier free($$); 3365130617Smlaier free($1); 3366126353Smlaier yyerror("invalid hex key"); 3367126353Smlaier YYERROR; 3368126353Smlaier } 3369126353Smlaier } else { 3370126353Smlaier MD5_CTX context; 3371126353Smlaier 3372126353Smlaier $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3373126353Smlaier if ($$ == NULL) 3374126353Smlaier err(1, "hashkey: calloc"); 3375126353Smlaier MD5Init(&context); 3376126353Smlaier MD5Update(&context, (unsigned char *)$1, 3377126353Smlaier strlen($1)); 3378126353Smlaier MD5Final((unsigned char *)$$, &context); 3379126353Smlaier HTONL($$->key32[0]); 3380126353Smlaier HTONL($$->key32[1]); 3381126353Smlaier HTONL($$->key32[2]); 3382126353Smlaier HTONL($$->key32[3]); 3383126353Smlaier } 3384130617Smlaier free($1); 3385126353Smlaier } 3386126353Smlaier ; 3387126353Smlaier 3388130617Smlaierpool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3389130617Smlaier pool_opts_l 3390130617Smlaier { $$ = pool_opts; } 3391130617Smlaier | /* empty */ { 3392130617Smlaier bzero(&pool_opts, sizeof pool_opts); 3393130617Smlaier $$ = pool_opts; 3394126353Smlaier } 3395130617Smlaier ; 3396130617Smlaier 3397130617Smlaierpool_opts_l : pool_opts_l pool_opt 3398130617Smlaier | pool_opt 3399130617Smlaier ; 3400130617Smlaier 3401130617Smlaierpool_opt : BITMASK { 3402130617Smlaier if (pool_opts.type) { 3403130617Smlaier yyerror("pool type cannot be redefined"); 3404130617Smlaier YYERROR; 3405130617Smlaier } 3406130617Smlaier pool_opts.type = PF_POOL_BITMASK; 3407126353Smlaier } 3408130617Smlaier | RANDOM { 3409130617Smlaier if (pool_opts.type) { 3410130617Smlaier yyerror("pool type cannot be redefined"); 3411130617Smlaier YYERROR; 3412130617Smlaier } 3413130617Smlaier pool_opts.type = PF_POOL_RANDOM; 3414126353Smlaier } 3415130617Smlaier | SOURCEHASH hashkey { 3416130617Smlaier if (pool_opts.type) { 3417130617Smlaier yyerror("pool type cannot be redefined"); 3418130617Smlaier YYERROR; 3419130617Smlaier } 3420130617Smlaier pool_opts.type = PF_POOL_SRCHASH; 3421130617Smlaier pool_opts.key = $2; 3422126353Smlaier } 3423130617Smlaier | ROUNDROBIN { 3424130617Smlaier if (pool_opts.type) { 3425130617Smlaier yyerror("pool type cannot be redefined"); 3426130617Smlaier YYERROR; 3427130617Smlaier } 3428130617Smlaier pool_opts.type = PF_POOL_ROUNDROBIN; 3429126353Smlaier } 3430130617Smlaier | STATICPORT { 3431130617Smlaier if (pool_opts.staticport) { 3432130617Smlaier yyerror("static-port cannot be redefined"); 3433130617Smlaier YYERROR; 3434130617Smlaier } 3435130617Smlaier pool_opts.staticport = 1; 3436130617Smlaier } 3437130617Smlaier | STICKYADDRESS { 3438130617Smlaier if (filter_opts.marker & POM_STICKYADDRESS) { 3439130617Smlaier yyerror("sticky-address cannot be redefined"); 3440130617Smlaier YYERROR; 3441130617Smlaier } 3442130617Smlaier pool_opts.marker |= POM_STICKYADDRESS; 3443130617Smlaier pool_opts.opts |= PF_POOL_STICKYADDR; 3444130617Smlaier } 3445126353Smlaier ; 3446126353Smlaier 3447126353Smlaierredirection : /* empty */ { $$ = NULL; } 3448126353Smlaier | ARROW host { 3449126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3450126353Smlaier if ($$ == NULL) 3451126353Smlaier err(1, "redirection: calloc"); 3452126353Smlaier $$->host = $2; 3453126353Smlaier $$->rport.a = $$->rport.b = $$->rport.t = 0; 3454126353Smlaier } 3455126353Smlaier | ARROW host PORT rport { 3456126353Smlaier $$ = calloc(1, sizeof(struct redirection)); 3457126353Smlaier if ($$ == NULL) 3458126353Smlaier err(1, "redirection: calloc"); 3459126353Smlaier $$->host = $2; 3460126353Smlaier $$->rport = $4; 3461126353Smlaier } 3462126353Smlaier ; 3463126353Smlaier 3464171172Smlaier/* ifdef __FreeBSD__ */ 3465171172Smlaiernatpass : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 3466171172Smlaier | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 3467171172Smlaier/* else 3468171172Smlaiernatpass : empty { $$.b1 = $$.b2 = 0; } 3469171172Smlaier | PASS { $$.b1 = 1; $$.b2 = 0; } 3470171172Smlaier * endif */ 3471171172Smlaier | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 3472126353Smlaier ; 3473126353Smlaier 3474126353Smlaiernataction : no NAT natpass { 3475171172Smlaier if ($1 && $3.b1) { 3476171172Smlaier yyerror("\"pass\" not valid with \"no\""); 3477171172Smlaier YYERROR; 3478171172Smlaier } 3479126353Smlaier if ($1) 3480126353Smlaier $$.b1 = PF_NONAT; 3481126353Smlaier else 3482126353Smlaier $$.b1 = PF_NAT; 3483171172Smlaier $$.b2 = $3.b1; 3484171172Smlaier $$.w = $3.b2; 3485171172Smlaier $$.w2 = $3.w2; 3486126353Smlaier } 3487126353Smlaier | no RDR natpass { 3488171172Smlaier if ($1 && $3.b1) { 3489171172Smlaier yyerror("\"pass\" not valid with \"no\""); 3490171172Smlaier YYERROR; 3491171172Smlaier } 3492126353Smlaier if ($1) 3493126353Smlaier $$.b1 = PF_NORDR; 3494126353Smlaier else 3495126353Smlaier $$.b1 = PF_RDR; 3496171172Smlaier $$.b2 = $3.b1; 3497171172Smlaier $$.w = $3.b2; 3498171172Smlaier $$.w2 = $3.w2; 3499126353Smlaier } 3500126353Smlaier ; 3501126353Smlaier 3502171172Smlaiernatrule : nataction interface af proto fromto tag tagged rtable 3503171172Smlaier redirpool pool_opts 3504126353Smlaier { 3505126353Smlaier struct pf_rule r; 3506126353Smlaier 3507126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 3508126353Smlaier YYERROR; 3509126353Smlaier 3510126353Smlaier memset(&r, 0, sizeof(r)); 3511126353Smlaier 3512126353Smlaier r.action = $1.b1; 3513126353Smlaier r.natpass = $1.b2; 3514171172Smlaier r.log = $1.w; 3515171172Smlaier r.logif = $1.w2; 3516126353Smlaier r.af = $3; 3517126353Smlaier 3518126353Smlaier if (!r.af) { 3519126353Smlaier if ($5.src.host && $5.src.host->af && 3520126353Smlaier !$5.src.host->ifindex) 3521126353Smlaier r.af = $5.src.host->af; 3522126353Smlaier else if ($5.dst.host && $5.dst.host->af && 3523126353Smlaier !$5.dst.host->ifindex) 3524126353Smlaier r.af = $5.dst.host->af; 3525126353Smlaier } 3526126353Smlaier 3527126353Smlaier if ($6 != NULL) 3528130617Smlaier if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3529126353Smlaier PF_TAG_NAME_SIZE) { 3530126353Smlaier yyerror("tag too long, max %u chars", 3531126353Smlaier PF_TAG_NAME_SIZE - 1); 3532126353Smlaier YYERROR; 3533126353Smlaier } 3534126353Smlaier 3535145840Smlaier if ($7.name) 3536145840Smlaier if (strlcpy(r.match_tagname, $7.name, 3537145840Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3538145840Smlaier yyerror("tag too long, max %u chars", 3539145840Smlaier PF_TAG_NAME_SIZE - 1); 3540145840Smlaier YYERROR; 3541145840Smlaier } 3542145840Smlaier r.match_tag_not = $7.neg; 3543171172Smlaier r.rtableid = $8; 3544145840Smlaier 3545126353Smlaier if (r.action == PF_NONAT || r.action == PF_NORDR) { 3546171172Smlaier if ($9 != NULL) { 3547126353Smlaier yyerror("translation rule with 'no' " 3548126353Smlaier "does not need '->'"); 3549126353Smlaier YYERROR; 3550126353Smlaier } 3551126353Smlaier } else { 3552171172Smlaier if ($9 == NULL || $9->host == NULL) { 3553126353Smlaier yyerror("translation rule requires '-> " 3554126353Smlaier "address'"); 3555126353Smlaier YYERROR; 3556126353Smlaier } 3557171172Smlaier if (!r.af && ! $9->host->ifindex) 3558171172Smlaier r.af = $9->host->af; 3559126353Smlaier 3560171172Smlaier remove_invalid_hosts(&$9->host, &r.af); 3561171172Smlaier if (invalid_redirect($9->host, r.af)) 3562126353Smlaier YYERROR; 3563171172Smlaier if (check_netmask($9->host, r.af)) 3564126353Smlaier YYERROR; 3565126353Smlaier 3566171172Smlaier r.rpool.proxy_port[0] = ntohs($9->rport.a); 3567126353Smlaier 3568126353Smlaier switch (r.action) { 3569126353Smlaier case PF_RDR: 3570171172Smlaier if (!$9->rport.b && $9->rport.t && 3571126353Smlaier $5.dst.port != NULL) { 3572126353Smlaier r.rpool.proxy_port[1] = 3573171172Smlaier ntohs($9->rport.a) + 3574130617Smlaier (ntohs( 3575130617Smlaier $5.dst.port->port[1]) - 3576130617Smlaier ntohs( 3577130617Smlaier $5.dst.port->port[0])); 3578126353Smlaier } else 3579126353Smlaier r.rpool.proxy_port[1] = 3580171172Smlaier ntohs($9->rport.b); 3581126353Smlaier break; 3582126353Smlaier case PF_NAT: 3583130617Smlaier r.rpool.proxy_port[1] = 3584171172Smlaier ntohs($9->rport.b); 3585126353Smlaier if (!r.rpool.proxy_port[0] && 3586126353Smlaier !r.rpool.proxy_port[1]) { 3587126353Smlaier r.rpool.proxy_port[0] = 3588126353Smlaier PF_NAT_PROXY_PORT_LOW; 3589126353Smlaier r.rpool.proxy_port[1] = 3590126353Smlaier PF_NAT_PROXY_PORT_HIGH; 3591126353Smlaier } else if (!r.rpool.proxy_port[1]) 3592126353Smlaier r.rpool.proxy_port[1] = 3593126353Smlaier r.rpool.proxy_port[0]; 3594126353Smlaier break; 3595126353Smlaier default: 3596126353Smlaier break; 3597126353Smlaier } 3598126353Smlaier 3599171172Smlaier r.rpool.opts = $10.type; 3600130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3601171172Smlaier PF_POOL_NONE && ($9->host->next != NULL || 3602171172Smlaier $9->host->addr.type == PF_ADDR_TABLE || 3603171172Smlaier DYNIF_MULTIADDR($9->host->addr))) 3604126353Smlaier r.rpool.opts = PF_POOL_ROUNDROBIN; 3605130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3606130617Smlaier PF_POOL_ROUNDROBIN && 3607171172Smlaier disallow_table($9->host, "tables are only " 3608130617Smlaier "supported in round-robin redirection " 3609130617Smlaier "pools")) 3610130617Smlaier YYERROR; 3611130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3612130617Smlaier PF_POOL_ROUNDROBIN && 3613171172Smlaier disallow_alias($9->host, "interface (%s) " 3614130617Smlaier "is only supported in round-robin " 3615130617Smlaier "redirection pools")) 3616130617Smlaier YYERROR; 3617171172Smlaier if ($9->host->next != NULL) { 3618130617Smlaier if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3619126353Smlaier PF_POOL_ROUNDROBIN) { 3620126353Smlaier yyerror("only round-robin " 3621126353Smlaier "valid for multiple " 3622126353Smlaier "redirection addresses"); 3623126353Smlaier YYERROR; 3624126353Smlaier } 3625126353Smlaier } 3626126353Smlaier } 3627126353Smlaier 3628171172Smlaier if ($10.key != NULL) 3629171172Smlaier memcpy(&r.rpool.key, $10.key, 3630126353Smlaier sizeof(struct pf_poolhashkey)); 3631126353Smlaier 3632171172Smlaier if ($10.opts) 3633171172Smlaier r.rpool.opts |= $10.opts; 3634130617Smlaier 3635171172Smlaier if ($10.staticport) { 3636126353Smlaier if (r.action != PF_NAT) { 3637126353Smlaier yyerror("the 'static-port' option is " 3638126353Smlaier "only valid with nat rules"); 3639126353Smlaier YYERROR; 3640126353Smlaier } 3641126353Smlaier if (r.rpool.proxy_port[0] != 3642126353Smlaier PF_NAT_PROXY_PORT_LOW && 3643126353Smlaier r.rpool.proxy_port[1] != 3644126353Smlaier PF_NAT_PROXY_PORT_HIGH) { 3645126353Smlaier yyerror("the 'static-port' option can't" 3646126353Smlaier " be used when specifying a port" 3647126353Smlaier " range"); 3648126353Smlaier YYERROR; 3649126353Smlaier } 3650126353Smlaier r.rpool.proxy_port[0] = 0; 3651126353Smlaier r.rpool.proxy_port[1] = 0; 3652126353Smlaier } 3653126353Smlaier 3654171172Smlaier expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 3655126353Smlaier $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3656145840Smlaier $5.dst.port, 0, 0, 0, ""); 3657171172Smlaier free($9); 3658126353Smlaier } 3659126353Smlaier ; 3660126353Smlaier 3661171172Smlaierbinatrule : no BINAT natpass interface af proto FROM host TO ipspec tag 3662171172Smlaier tagged rtable redirection 3663126353Smlaier { 3664126353Smlaier struct pf_rule binat; 3665126353Smlaier struct pf_pooladdr *pa; 3666126353Smlaier 3667126353Smlaier if (check_rulestate(PFCTL_STATE_NAT)) 3668126353Smlaier YYERROR; 3669171172Smlaier if (disallow_urpf_failed($10, "\"urpf-failed\" is not " 3670171172Smlaier "permitted as a binat destination")) 3671171172Smlaier YYERROR; 3672126353Smlaier 3673126353Smlaier memset(&binat, 0, sizeof(binat)); 3674126353Smlaier 3675171172Smlaier if ($1 && $3.b1) { 3676171172Smlaier yyerror("\"pass\" not valid with \"no\""); 3677171172Smlaier YYERROR; 3678171172Smlaier } 3679126353Smlaier if ($1) 3680126353Smlaier binat.action = PF_NOBINAT; 3681126353Smlaier else 3682126353Smlaier binat.action = PF_BINAT; 3683171172Smlaier binat.natpass = $3.b1; 3684171172Smlaier binat.log = $3.b2; 3685171172Smlaier binat.logif = $3.w2; 3686126353Smlaier binat.af = $5; 3687126353Smlaier if (!binat.af && $8 != NULL && $8->af) 3688126353Smlaier binat.af = $8->af; 3689126353Smlaier if (!binat.af && $10 != NULL && $10->af) 3690126353Smlaier binat.af = $10->af; 3691145840Smlaier 3692171172Smlaier if (!binat.af && $14 != NULL && $14->host) 3693171172Smlaier binat.af = $14->host->af; 3694126353Smlaier if (!binat.af) { 3695126353Smlaier yyerror("address family (inet/inet6) " 3696126353Smlaier "undefined"); 3697126353Smlaier YYERROR; 3698126353Smlaier } 3699126353Smlaier 3700126353Smlaier if ($4 != NULL) { 3701126353Smlaier memcpy(binat.ifname, $4->ifname, 3702126353Smlaier sizeof(binat.ifname)); 3703130617Smlaier binat.ifnot = $4->not; 3704126353Smlaier free($4); 3705126353Smlaier } 3706145840Smlaier 3707126353Smlaier if ($11 != NULL) 3708126353Smlaier if (strlcpy(binat.tagname, $11, 3709130617Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3710126353Smlaier yyerror("tag too long, max %u chars", 3711126353Smlaier PF_TAG_NAME_SIZE - 1); 3712126353Smlaier YYERROR; 3713126353Smlaier } 3714145840Smlaier if ($12.name) 3715145840Smlaier if (strlcpy(binat.match_tagname, $12.name, 3716145840Smlaier PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3717145840Smlaier yyerror("tag too long, max %u chars", 3718145840Smlaier PF_TAG_NAME_SIZE - 1); 3719145840Smlaier YYERROR; 3720145840Smlaier } 3721145840Smlaier binat.match_tag_not = $12.neg; 3722171172Smlaier binat.rtableid = $13; 3723126353Smlaier 3724126353Smlaier if ($6 != NULL) { 3725126353Smlaier binat.proto = $6->proto; 3726126353Smlaier free($6); 3727126353Smlaier } 3728126353Smlaier 3729126353Smlaier if ($8 != NULL && disallow_table($8, "invalid use of " 3730126353Smlaier "table <%s> as the source address of a binat rule")) 3731126353Smlaier YYERROR; 3732130617Smlaier if ($8 != NULL && disallow_alias($8, "invalid use of " 3733130617Smlaier "interface (%s) as the source address of a binat " 3734130617Smlaier "rule")) 3735130617Smlaier YYERROR; 3736171172Smlaier if ($14 != NULL && $14->host != NULL && disallow_table( 3737171172Smlaier $14->host, "invalid use of table <%s> as the " 3738126353Smlaier "redirect address of a binat rule")) 3739126353Smlaier YYERROR; 3740171172Smlaier if ($14 != NULL && $14->host != NULL && disallow_alias( 3741171172Smlaier $14->host, "invalid use of interface (%s) as the " 3742130617Smlaier "redirect address of a binat rule")) 3743130617Smlaier YYERROR; 3744126353Smlaier 3745126353Smlaier if ($8 != NULL) { 3746126353Smlaier if ($8->next) { 3747126353Smlaier yyerror("multiple binat ip addresses"); 3748126353Smlaier YYERROR; 3749126353Smlaier } 3750126353Smlaier if ($8->addr.type == PF_ADDR_DYNIFTL) 3751126353Smlaier $8->af = binat.af; 3752126353Smlaier if ($8->af != binat.af) { 3753126353Smlaier yyerror("binat ip versions must match"); 3754126353Smlaier YYERROR; 3755126353Smlaier } 3756126353Smlaier if (check_netmask($8, binat.af)) 3757126353Smlaier YYERROR; 3758126353Smlaier memcpy(&binat.src.addr, &$8->addr, 3759126353Smlaier sizeof(binat.src.addr)); 3760126353Smlaier free($8); 3761126353Smlaier } 3762126353Smlaier if ($10 != NULL) { 3763126353Smlaier if ($10->next) { 3764126353Smlaier yyerror("multiple binat ip addresses"); 3765126353Smlaier YYERROR; 3766126353Smlaier } 3767126353Smlaier if ($10->af != binat.af && $10->af) { 3768126353Smlaier yyerror("binat ip versions must match"); 3769126353Smlaier YYERROR; 3770126353Smlaier } 3771126353Smlaier if (check_netmask($10, binat.af)) 3772126353Smlaier YYERROR; 3773126353Smlaier memcpy(&binat.dst.addr, &$10->addr, 3774126353Smlaier sizeof(binat.dst.addr)); 3775145840Smlaier binat.dst.neg = $10->not; 3776126353Smlaier free($10); 3777126353Smlaier } 3778126353Smlaier 3779126353Smlaier if (binat.action == PF_NOBINAT) { 3780171172Smlaier if ($14 != NULL) { 3781126353Smlaier yyerror("'no binat' rule does not need" 3782126353Smlaier " '->'"); 3783126353Smlaier YYERROR; 3784126353Smlaier } 3785126353Smlaier } else { 3786171172Smlaier if ($14 == NULL || $14->host == NULL) { 3787126353Smlaier yyerror("'binat' rule requires" 3788126353Smlaier " '-> address'"); 3789126353Smlaier YYERROR; 3790126353Smlaier } 3791126353Smlaier 3792171172Smlaier remove_invalid_hosts(&$14->host, &binat.af); 3793171172Smlaier if (invalid_redirect($14->host, binat.af)) 3794126353Smlaier YYERROR; 3795171172Smlaier if ($14->host->next != NULL) { 3796126353Smlaier yyerror("binat rule must redirect to " 3797126353Smlaier "a single address"); 3798126353Smlaier YYERROR; 3799126353Smlaier } 3800171172Smlaier if (check_netmask($14->host, binat.af)) 3801126353Smlaier YYERROR; 3802126353Smlaier 3803126353Smlaier if (!PF_AZERO(&binat.src.addr.v.a.mask, 3804126353Smlaier binat.af) && 3805126353Smlaier !PF_AEQ(&binat.src.addr.v.a.mask, 3806171172Smlaier &$14->host->addr.v.a.mask, binat.af)) { 3807126353Smlaier yyerror("'binat' source mask and " 3808126353Smlaier "redirect mask must be the same"); 3809126353Smlaier YYERROR; 3810126353Smlaier } 3811126353Smlaier 3812126353Smlaier TAILQ_INIT(&binat.rpool.list); 3813126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 3814126353Smlaier if (pa == NULL) 3815126353Smlaier err(1, "binat: calloc"); 3816171172Smlaier pa->addr = $14->host->addr; 3817126353Smlaier pa->ifname[0] = 0; 3818126353Smlaier TAILQ_INSERT_TAIL(&binat.rpool.list, 3819126353Smlaier pa, entries); 3820126353Smlaier 3821171172Smlaier free($14); 3822126353Smlaier } 3823126353Smlaier 3824145840Smlaier pfctl_add_rule(pf, &binat, ""); 3825126353Smlaier } 3826126353Smlaier ; 3827126353Smlaier 3828126353Smlaiertag : /* empty */ { $$ = NULL; } 3829126353Smlaier | TAG STRING { $$ = $2; } 3830130617Smlaier ; 3831126353Smlaier 3832145840Smlaiertagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 3833145840Smlaier | not TAGGED string { $$.neg = $1; $$.name = $3; } 3834145840Smlaier ; 3835145840Smlaier 3836171172Smlaierrtable : /* empty */ { $$ = -1; } 3837171172Smlaier | RTABLE number { 3838171172Smlaier#ifdef __FreeBSD__ 3839171172Smlaier yyerror("rtable id not supported in FreeBSD, yet"); 3840171172Smlaier YYERROR; 3841171172Smlaier#else 3842171172Smlaier if ($2 > RT_TABLEID_MAX || $2 < 0) { 3843171172Smlaier yyerror("invalid rtable id"); 3844171172Smlaier YYERROR; 3845171172Smlaier } 3846171172Smlaier $$ = $2; 3847171172Smlaier#endif 3848171172Smlaier } 3849171172Smlaier ; 3850171172Smlaier 3851126353Smlaierroute_host : STRING { 3852126353Smlaier $$ = calloc(1, sizeof(struct node_host)); 3853126353Smlaier if ($$ == NULL) 3854126353Smlaier err(1, "route_host: calloc"); 3855130617Smlaier $$->ifname = $1; 3856126353Smlaier set_ipmask($$, 128); 3857126353Smlaier $$->next = NULL; 3858126353Smlaier $$->tail = $$; 3859126353Smlaier } 3860126353Smlaier | '(' STRING host ')' { 3861126353Smlaier $$ = $3; 3862130617Smlaier $$->ifname = $2; 3863126353Smlaier } 3864126353Smlaier ; 3865126353Smlaier 3866126353Smlaierroute_host_list : route_host { $$ = $1; } 3867126353Smlaier | route_host_list comma route_host { 3868126353Smlaier if ($1->af == 0) 3869126353Smlaier $1->af = $3->af; 3870126353Smlaier if ($1->af != $3->af) { 3871126353Smlaier yyerror("all pool addresses must be in the " 3872126353Smlaier "same address family"); 3873126353Smlaier YYERROR; 3874126353Smlaier } 3875126353Smlaier $1->tail->next = $3; 3876126353Smlaier $1->tail = $3->tail; 3877126353Smlaier $$ = $1; 3878126353Smlaier } 3879126353Smlaier ; 3880126353Smlaier 3881126353Smlaierroutespec : route_host { $$ = $1; } 3882126353Smlaier | '{' route_host_list '}' { $$ = $2; } 3883126353Smlaier ; 3884126353Smlaier 3885126353Smlaierroute : /* empty */ { 3886126353Smlaier $$.host = NULL; 3887126353Smlaier $$.rt = 0; 3888126353Smlaier $$.pool_opts = 0; 3889126353Smlaier } 3890126353Smlaier | FASTROUTE { 3891126353Smlaier $$.host = NULL; 3892126353Smlaier $$.rt = PF_FASTROUTE; 3893126353Smlaier $$.pool_opts = 0; 3894126353Smlaier } 3895130617Smlaier | ROUTETO routespec pool_opts { 3896126353Smlaier $$.host = $2; 3897126353Smlaier $$.rt = PF_ROUTETO; 3898130617Smlaier $$.pool_opts = $3.type | $3.opts; 3899126353Smlaier if ($3.key != NULL) 3900126353Smlaier $$.key = $3.key; 3901126353Smlaier } 3902130617Smlaier | REPLYTO routespec pool_opts { 3903126353Smlaier $$.host = $2; 3904126353Smlaier $$.rt = PF_REPLYTO; 3905130617Smlaier $$.pool_opts = $3.type | $3.opts; 3906126353Smlaier if ($3.key != NULL) 3907126353Smlaier $$.key = $3.key; 3908126353Smlaier } 3909130617Smlaier | DUPTO routespec pool_opts { 3910126353Smlaier $$.host = $2; 3911126353Smlaier $$.rt = PF_DUPTO; 3912130617Smlaier $$.pool_opts = $3.type | $3.opts; 3913126353Smlaier if ($3.key != NULL) 3914126353Smlaier $$.key = $3.key; 3915126353Smlaier } 3916126353Smlaier ; 3917126353Smlaier 3918126353Smlaiertimeout_spec : STRING number 3919126353Smlaier { 3920130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 3921130617Smlaier free($1); 3922126353Smlaier YYERROR; 3923130617Smlaier } 3924126353Smlaier if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3925126353Smlaier yyerror("unknown timeout %s", $1); 3926130617Smlaier free($1); 3927126353Smlaier YYERROR; 3928126353Smlaier } 3929130617Smlaier free($1); 3930126353Smlaier } 3931126353Smlaier ; 3932126353Smlaier 3933126353Smlaiertimeout_list : timeout_list comma timeout_spec 3934126353Smlaier | timeout_spec 3935126353Smlaier ; 3936126353Smlaier 3937126353Smlaierlimit_spec : STRING number 3938126353Smlaier { 3939130617Smlaier if (check_rulestate(PFCTL_STATE_OPTION)) { 3940130617Smlaier free($1); 3941126353Smlaier YYERROR; 3942130617Smlaier } 3943126353Smlaier if (pfctl_set_limit(pf, $1, $2) != 0) { 3944126353Smlaier yyerror("unable to set limit %s %u", $1, $2); 3945130617Smlaier free($1); 3946126353Smlaier YYERROR; 3947126353Smlaier } 3948130617Smlaier free($1); 3949126353Smlaier } 3950130617Smlaier ; 3951126353Smlaier 3952126353Smlaierlimit_list : limit_list comma limit_spec 3953126353Smlaier | limit_spec 3954126353Smlaier ; 3955126353Smlaier 3956126353Smlaiercomma : ',' 3957126353Smlaier | /* empty */ 3958126353Smlaier ; 3959126353Smlaier 3960126353Smlaieryesno : NO { $$ = 0; } 3961126353Smlaier | STRING { 3962126353Smlaier if (!strcmp($1, "yes")) 3963126353Smlaier $$ = 1; 3964130617Smlaier else { 3965145840Smlaier yyerror("invalid value '%s', expected 'yes' " 3966145840Smlaier "or 'no'", $1); 3967130617Smlaier free($1); 3968126353Smlaier YYERROR; 3969130617Smlaier } 3970130617Smlaier free($1); 3971126353Smlaier } 3972130617Smlaier ; 3973126353Smlaier 3974126353Smlaierunaryop : '=' { $$ = PF_OP_EQ; } 3975126353Smlaier | '!' '=' { $$ = PF_OP_NE; } 3976126353Smlaier | '<' '=' { $$ = PF_OP_LE; } 3977126353Smlaier | '<' { $$ = PF_OP_LT; } 3978126353Smlaier | '>' '=' { $$ = PF_OP_GE; } 3979126353Smlaier | '>' { $$ = PF_OP_GT; } 3980126353Smlaier ; 3981126353Smlaier 3982126353Smlaier%% 3983126353Smlaier 3984126353Smlaierint 3985126353Smlaieryyerror(const char *fmt, ...) 3986126353Smlaier{ 3987126353Smlaier va_list ap; 3988126353Smlaier extern char *infile; 3989126353Smlaier 3990126353Smlaier errors = 1; 3991126353Smlaier va_start(ap, fmt); 3992126353Smlaier fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3993126353Smlaier vfprintf(stderr, fmt, ap); 3994126353Smlaier fprintf(stderr, "\n"); 3995126353Smlaier va_end(ap); 3996126353Smlaier return (0); 3997126353Smlaier} 3998126353Smlaier 3999126353Smlaierint 4000126353Smlaierdisallow_table(struct node_host *h, const char *fmt) 4001126353Smlaier{ 4002126353Smlaier for (; h != NULL; h = h->next) 4003126353Smlaier if (h->addr.type == PF_ADDR_TABLE) { 4004126353Smlaier yyerror(fmt, h->addr.v.tblname); 4005126353Smlaier return (1); 4006126353Smlaier } 4007126353Smlaier return (0); 4008126353Smlaier} 4009126353Smlaier 4010126353Smlaierint 4011171172Smlaierdisallow_urpf_failed(struct node_host *h, const char *fmt) 4012171172Smlaier{ 4013171172Smlaier for (; h != NULL; h = h->next) 4014171172Smlaier if (h->addr.type == PF_ADDR_URPFFAILED) { 4015171172Smlaier yyerror(fmt); 4016171172Smlaier return (1); 4017171172Smlaier } 4018171172Smlaier return (0); 4019171172Smlaier} 4020171172Smlaier 4021171172Smlaierint 4022130617Smlaierdisallow_alias(struct node_host *h, const char *fmt) 4023130617Smlaier{ 4024130617Smlaier for (; h != NULL; h = h->next) 4025130617Smlaier if (DYNIF_MULTIADDR(h->addr)) { 4026130617Smlaier yyerror(fmt, h->addr.v.tblname); 4027130617Smlaier return (1); 4028130617Smlaier } 4029130617Smlaier return (0); 4030130617Smlaier} 4031130617Smlaier 4032130617Smlaierint 4033171172Smlaierrule_consistent(struct pf_rule *r, int anchor_call) 4034126353Smlaier{ 4035126353Smlaier int problems = 0; 4036126353Smlaier 4037126353Smlaier switch (r->action) { 4038126353Smlaier case PF_PASS: 4039126353Smlaier case PF_DROP: 4040126353Smlaier case PF_SCRUB: 4041145840Smlaier case PF_NOSCRUB: 4042171172Smlaier problems = filter_consistent(r, anchor_call); 4043126353Smlaier break; 4044126353Smlaier case PF_NAT: 4045126353Smlaier case PF_NONAT: 4046126353Smlaier problems = nat_consistent(r); 4047126353Smlaier break; 4048126353Smlaier case PF_RDR: 4049126353Smlaier case PF_NORDR: 4050126353Smlaier problems = rdr_consistent(r); 4051126353Smlaier break; 4052126353Smlaier case PF_BINAT: 4053126353Smlaier case PF_NOBINAT: 4054126353Smlaier default: 4055126353Smlaier break; 4056126353Smlaier } 4057126353Smlaier return (problems); 4058126353Smlaier} 4059126353Smlaier 4060126353Smlaierint 4061171172Smlaierfilter_consistent(struct pf_rule *r, int anchor_call) 4062126353Smlaier{ 4063126353Smlaier int problems = 0; 4064126353Smlaier 4065126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 4066126353Smlaier (r->src.port_op || r->dst.port_op)) { 4067126353Smlaier yyerror("port only applies to tcp/udp"); 4068126353Smlaier problems++; 4069126353Smlaier } 4070126353Smlaier if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 4071126353Smlaier (r->type || r->code)) { 4072126353Smlaier yyerror("icmp-type/code only applies to icmp"); 4073126353Smlaier problems++; 4074126353Smlaier } 4075126353Smlaier if (!r->af && (r->type || r->code)) { 4076126353Smlaier yyerror("must indicate address family with icmp-type/code"); 4077126353Smlaier problems++; 4078126353Smlaier } 4079145840Smlaier if (r->overload_tblname[0] && 4080145840Smlaier r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 4081145840Smlaier yyerror("'overload' requires 'max-src-conn' " 4082145840Smlaier "or 'max-src-conn-rate'"); 4083145840Smlaier problems++; 4084145840Smlaier } 4085126353Smlaier if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 4086126353Smlaier (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 4087126353Smlaier yyerror("proto %s doesn't match address family %s", 4088126353Smlaier r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 4089126353Smlaier r->af == AF_INET ? "inet" : "inet6"); 4090126353Smlaier problems++; 4091126353Smlaier } 4092126353Smlaier if (r->allow_opts && r->action != PF_PASS) { 4093126353Smlaier yyerror("allow-opts can only be specified for pass rules"); 4094126353Smlaier problems++; 4095126353Smlaier } 4096126353Smlaier if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 4097126353Smlaier r->dst.port_op || r->flagset || r->type || r->code)) { 4098126353Smlaier yyerror("fragments can be filtered only on IP header fields"); 4099126353Smlaier problems++; 4100126353Smlaier } 4101126353Smlaier if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 4102126353Smlaier yyerror("return-rst can only be applied to TCP rules"); 4103126353Smlaier problems++; 4104126353Smlaier } 4105130617Smlaier if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 4106130617Smlaier yyerror("max-src-nodes requires 'source-track rule'"); 4107130617Smlaier problems++; 4108130617Smlaier } 4109126353Smlaier if (r->action == PF_DROP && r->keep_state) { 4110126353Smlaier yyerror("keep state on block rules doesn't make sense"); 4111126353Smlaier problems++; 4112126353Smlaier } 4113126353Smlaier return (-problems); 4114126353Smlaier} 4115126353Smlaier 4116126353Smlaierint 4117126353Smlaiernat_consistent(struct pf_rule *r) 4118126353Smlaier{ 4119130617Smlaier return (0); /* yeah! */ 4120126353Smlaier} 4121126353Smlaier 4122126353Smlaierint 4123126353Smlaierrdr_consistent(struct pf_rule *r) 4124126353Smlaier{ 4125126353Smlaier int problems = 0; 4126126353Smlaier 4127126353Smlaier if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 4128126353Smlaier if (r->src.port_op) { 4129126353Smlaier yyerror("src port only applies to tcp/udp"); 4130126353Smlaier problems++; 4131126353Smlaier } 4132126353Smlaier if (r->dst.port_op) { 4133126353Smlaier yyerror("dst port only applies to tcp/udp"); 4134126353Smlaier problems++; 4135126353Smlaier } 4136126353Smlaier if (r->rpool.proxy_port[0]) { 4137126353Smlaier yyerror("rpool port only applies to tcp/udp"); 4138126353Smlaier problems++; 4139126353Smlaier } 4140126353Smlaier } 4141126353Smlaier if (r->dst.port_op && 4142126353Smlaier r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 4143126353Smlaier yyerror("invalid port operator for rdr destination port"); 4144126353Smlaier problems++; 4145126353Smlaier } 4146126353Smlaier return (-problems); 4147126353Smlaier} 4148126353Smlaier 4149126353Smlaierint 4150126353Smlaierprocess_tabledef(char *name, struct table_opts *opts) 4151126353Smlaier{ 4152126353Smlaier struct pfr_buffer ab; 4153126353Smlaier struct node_tinit *ti; 4154126353Smlaier 4155126353Smlaier bzero(&ab, sizeof(ab)); 4156126353Smlaier ab.pfrb_type = PFRB_ADDRS; 4157126353Smlaier SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4158126353Smlaier if (ti->file) 4159126353Smlaier if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 4160126353Smlaier if (errno) 4161126353Smlaier yyerror("cannot load \"%s\": %s", 4162126353Smlaier ti->file, strerror(errno)); 4163126353Smlaier else 4164126353Smlaier yyerror("file \"%s\" contains bad data", 4165126353Smlaier ti->file); 4166126353Smlaier goto _error; 4167126353Smlaier } 4168126353Smlaier if (ti->host) 4169126353Smlaier if (append_addr_host(&ab, ti->host, 0, 0)) { 4170126353Smlaier yyerror("cannot create address buffer: %s", 4171126353Smlaier strerror(errno)); 4172126353Smlaier goto _error; 4173126353Smlaier } 4174126353Smlaier } 4175126353Smlaier if (pf->opts & PF_OPT_VERBOSE) 4176126353Smlaier print_tabledef(name, opts->flags, opts->init_addr, 4177126353Smlaier &opts->init_nodes); 4178126353Smlaier if (!(pf->opts & PF_OPT_NOACTION) && 4179126353Smlaier pfctl_define_table(name, opts->flags, opts->init_addr, 4180171172Smlaier pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4181126353Smlaier yyerror("cannot define table %s: %s", name, 4182126353Smlaier pfr_strerror(errno)); 4183126353Smlaier goto _error; 4184126353Smlaier } 4185126353Smlaier pf->tdirty = 1; 4186126353Smlaier pfr_buf_clear(&ab); 4187126353Smlaier return (0); 4188126353Smlaier_error: 4189126353Smlaier pfr_buf_clear(&ab); 4190126353Smlaier return (-1); 4191126353Smlaier} 4192126353Smlaier 4193126353Smlaierstruct keywords { 4194126353Smlaier const char *k_name; 4195126353Smlaier int k_val; 4196126353Smlaier}; 4197126353Smlaier 4198126353Smlaier/* macro gore, but you should've seen the prior indentation nightmare... */ 4199126353Smlaier 4200126353Smlaier#define FREE_LIST(T,r) \ 4201126353Smlaier do { \ 4202126353Smlaier T *p, *node = r; \ 4203126353Smlaier while (node != NULL) { \ 4204126353Smlaier p = node; \ 4205126353Smlaier node = node->next; \ 4206126353Smlaier free(p); \ 4207126353Smlaier } \ 4208126353Smlaier } while (0) 4209126353Smlaier 4210126353Smlaier#define LOOP_THROUGH(T,n,r,C) \ 4211126353Smlaier do { \ 4212126353Smlaier T *n; \ 4213126353Smlaier if (r == NULL) { \ 4214126353Smlaier r = calloc(1, sizeof(T)); \ 4215126353Smlaier if (r == NULL) \ 4216126353Smlaier err(1, "LOOP: calloc"); \ 4217126353Smlaier r->next = NULL; \ 4218126353Smlaier } \ 4219126353Smlaier n = r; \ 4220126353Smlaier while (n != NULL) { \ 4221126353Smlaier do { \ 4222126353Smlaier C; \ 4223126353Smlaier } while (0); \ 4224126353Smlaier n = n->next; \ 4225126353Smlaier } \ 4226126353Smlaier } while (0) 4227126353Smlaier 4228126353Smlaiervoid 4229130617Smlaierexpand_label_str(char *label, size_t len, const char *srch, const char *repl) 4230126353Smlaier{ 4231130617Smlaier char *tmp; 4232126353Smlaier char *p, *q; 4233126353Smlaier 4234130617Smlaier if ((tmp = calloc(1, len)) == NULL) 4235130617Smlaier err(1, "expand_label_str: calloc"); 4236126353Smlaier p = q = label; 4237126353Smlaier while ((q = strstr(p, srch)) != NULL) { 4238126353Smlaier *q = '\0'; 4239130617Smlaier if ((strlcat(tmp, p, len) >= len) || 4240130617Smlaier (strlcat(tmp, repl, len) >= len)) 4241130617Smlaier errx(1, "expand_label: label too long"); 4242126353Smlaier q += strlen(srch); 4243126353Smlaier p = q; 4244126353Smlaier } 4245130617Smlaier if (strlcat(tmp, p, len) >= len) 4246130617Smlaier errx(1, "expand_label: label too long"); 4247130617Smlaier strlcpy(label, tmp, len); /* always fits */ 4248130617Smlaier free(tmp); 4249126353Smlaier} 4250126353Smlaier 4251126353Smlaiervoid 4252130617Smlaierexpand_label_if(const char *name, char *label, size_t len, const char *ifname) 4253126353Smlaier{ 4254126353Smlaier if (strstr(label, name) != NULL) { 4255126353Smlaier if (!*ifname) 4256130617Smlaier expand_label_str(label, len, name, "any"); 4257126353Smlaier else 4258130617Smlaier expand_label_str(label, len, name, ifname); 4259126353Smlaier } 4260126353Smlaier} 4261126353Smlaier 4262126353Smlaiervoid 4263130617Smlaierexpand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4264126353Smlaier struct node_host *h) 4265126353Smlaier{ 4266126353Smlaier char tmp[64], tmp_not[66]; 4267126353Smlaier 4268126353Smlaier if (strstr(label, name) != NULL) { 4269126353Smlaier switch (h->addr.type) { 4270126353Smlaier case PF_ADDR_DYNIFTL: 4271126353Smlaier snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4272126353Smlaier break; 4273126353Smlaier case PF_ADDR_TABLE: 4274126353Smlaier snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4275126353Smlaier break; 4276126353Smlaier case PF_ADDR_NOROUTE: 4277126353Smlaier snprintf(tmp, sizeof(tmp), "no-route"); 4278126353Smlaier break; 4279171172Smlaier case PF_ADDR_URPFFAILED: 4280171172Smlaier snprintf(tmp, sizeof(tmp), "urpf-failed"); 4281171172Smlaier break; 4282126353Smlaier case PF_ADDR_ADDRMASK: 4283126353Smlaier if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4284126353Smlaier PF_AZERO(&h->addr.v.a.mask, af))) 4285126353Smlaier snprintf(tmp, sizeof(tmp), "any"); 4286126353Smlaier else { 4287126353Smlaier char a[48]; 4288126353Smlaier int bits; 4289126353Smlaier 4290126353Smlaier if (inet_ntop(af, &h->addr.v.a.addr, a, 4291126353Smlaier sizeof(a)) == NULL) 4292126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 4293126353Smlaier else { 4294126353Smlaier bits = unmask(&h->addr.v.a.mask, af); 4295126353Smlaier if ((af == AF_INET && bits < 32) || 4296126353Smlaier (af == AF_INET6 && bits < 128)) 4297126353Smlaier snprintf(tmp, sizeof(tmp), 4298130617Smlaier "%s/%d", a, bits); 4299126353Smlaier else 4300126353Smlaier snprintf(tmp, sizeof(tmp), 4301126353Smlaier "%s", a); 4302126353Smlaier } 4303126353Smlaier } 4304126353Smlaier break; 4305126353Smlaier default: 4306126353Smlaier snprintf(tmp, sizeof(tmp), "?"); 4307126353Smlaier break; 4308126353Smlaier } 4309126353Smlaier 4310126353Smlaier if (h->not) { 4311126353Smlaier snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4312130617Smlaier expand_label_str(label, len, name, tmp_not); 4313126353Smlaier } else 4314130617Smlaier expand_label_str(label, len, name, tmp); 4315126353Smlaier } 4316126353Smlaier} 4317126353Smlaier 4318126353Smlaiervoid 4319130617Smlaierexpand_label_port(const char *name, char *label, size_t len, 4320130617Smlaier struct node_port *port) 4321126353Smlaier{ 4322126353Smlaier char a1[6], a2[6], op[13] = ""; 4323126353Smlaier 4324126353Smlaier if (strstr(label, name) != NULL) { 4325126353Smlaier snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4326126353Smlaier snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4327126353Smlaier if (!port->op) 4328126353Smlaier ; 4329126353Smlaier else if (port->op == PF_OP_IRG) 4330126353Smlaier snprintf(op, sizeof(op), "%s><%s", a1, a2); 4331126353Smlaier else if (port->op == PF_OP_XRG) 4332126353Smlaier snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4333126353Smlaier else if (port->op == PF_OP_EQ) 4334126353Smlaier snprintf(op, sizeof(op), "%s", a1); 4335126353Smlaier else if (port->op == PF_OP_NE) 4336126353Smlaier snprintf(op, sizeof(op), "!=%s", a1); 4337126353Smlaier else if (port->op == PF_OP_LT) 4338126353Smlaier snprintf(op, sizeof(op), "<%s", a1); 4339126353Smlaier else if (port->op == PF_OP_LE) 4340126353Smlaier snprintf(op, sizeof(op), "<=%s", a1); 4341126353Smlaier else if (port->op == PF_OP_GT) 4342126353Smlaier snprintf(op, sizeof(op), ">%s", a1); 4343126353Smlaier else if (port->op == PF_OP_GE) 4344126353Smlaier snprintf(op, sizeof(op), ">=%s", a1); 4345130617Smlaier expand_label_str(label, len, name, op); 4346126353Smlaier } 4347126353Smlaier} 4348126353Smlaier 4349126353Smlaiervoid 4350130617Smlaierexpand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4351126353Smlaier{ 4352126353Smlaier struct protoent *pe; 4353126353Smlaier char n[4]; 4354126353Smlaier 4355126353Smlaier if (strstr(label, name) != NULL) { 4356126353Smlaier pe = getprotobynumber(proto); 4357126353Smlaier if (pe != NULL) 4358130617Smlaier expand_label_str(label, len, name, pe->p_name); 4359126353Smlaier else { 4360126353Smlaier snprintf(n, sizeof(n), "%u", proto); 4361130617Smlaier expand_label_str(label, len, name, n); 4362126353Smlaier } 4363126353Smlaier } 4364126353Smlaier} 4365126353Smlaier 4366126353Smlaiervoid 4367130617Smlaierexpand_label_nr(const char *name, char *label, size_t len) 4368126353Smlaier{ 4369126353Smlaier char n[11]; 4370126353Smlaier 4371126353Smlaier if (strstr(label, name) != NULL) { 4372171172Smlaier snprintf(n, sizeof(n), "%u", pf->anchor->match); 4373130617Smlaier expand_label_str(label, len, name, n); 4374126353Smlaier } 4375126353Smlaier} 4376126353Smlaier 4377126353Smlaiervoid 4378130617Smlaierexpand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4379126353Smlaier struct node_host *src_host, struct node_port *src_port, 4380126353Smlaier struct node_host *dst_host, struct node_port *dst_port, 4381126353Smlaier u_int8_t proto) 4382126353Smlaier{ 4383130617Smlaier expand_label_if("$if", label, len, ifname); 4384130617Smlaier expand_label_addr("$srcaddr", label, len, af, src_host); 4385130617Smlaier expand_label_addr("$dstaddr", label, len, af, dst_host); 4386130617Smlaier expand_label_port("$srcport", label, len, src_port); 4387130617Smlaier expand_label_port("$dstport", label, len, dst_port); 4388130617Smlaier expand_label_proto("$proto", label, len, proto); 4389130617Smlaier expand_label_nr("$nr", label, len); 4390126353Smlaier} 4391126353Smlaier 4392126353Smlaierint 4393126353Smlaierexpand_altq(struct pf_altq *a, struct node_if *interfaces, 4394126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 4395126353Smlaier struct node_queue_opt *opts) 4396126353Smlaier{ 4397126353Smlaier struct pf_altq pa, pb; 4398126353Smlaier char qname[PF_QNAME_SIZE]; 4399126353Smlaier struct node_queue *n; 4400126353Smlaier struct node_queue_bw bw; 4401126353Smlaier int errs = 0; 4402126353Smlaier 4403126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4404126353Smlaier FREE_LIST(struct node_if, interfaces); 4405126353Smlaier FREE_LIST(struct node_queue, nqueues); 4406126353Smlaier return (0); 4407126353Smlaier } 4408126353Smlaier 4409126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4410126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 4411126353Smlaier if (strlcpy(pa.ifname, interface->ifname, 4412126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4413126353Smlaier errx(1, "expand_altq: strlcpy"); 4414126353Smlaier 4415126353Smlaier if (interface->not) { 4416126353Smlaier yyerror("altq on ! <interface> is not supported"); 4417126353Smlaier errs++; 4418126353Smlaier } else { 4419126353Smlaier if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4420126353Smlaier errs++; 4421126353Smlaier else 4422126353Smlaier if (pfctl_add_altq(pf, &pa)) 4423126353Smlaier errs++; 4424126353Smlaier 4425126353Smlaier if (pf->opts & PF_OPT_VERBOSE) { 4426126353Smlaier print_altq(&pf->paltq->altq, 0, 4427126353Smlaier &bwspec, opts); 4428126353Smlaier if (nqueues && nqueues->tail) { 4429126353Smlaier printf("queue { "); 4430126353Smlaier LOOP_THROUGH(struct node_queue, queue, 4431126353Smlaier nqueues, 4432126353Smlaier printf("%s ", 4433126353Smlaier queue->queue); 4434126353Smlaier ); 4435126353Smlaier printf("}"); 4436126353Smlaier } 4437126353Smlaier printf("\n"); 4438126353Smlaier } 4439126353Smlaier 4440126353Smlaier if (pa.scheduler == ALTQT_CBQ || 4441126353Smlaier pa.scheduler == ALTQT_HFSC) { 4442126353Smlaier /* now create a root queue */ 4443126353Smlaier memset(&pb, 0, sizeof(struct pf_altq)); 4444126353Smlaier if (strlcpy(qname, "root_", sizeof(qname)) >= 4445126353Smlaier sizeof(qname)) 4446126353Smlaier errx(1, "expand_altq: strlcpy"); 4447126353Smlaier if (strlcat(qname, interface->ifname, 4448126353Smlaier sizeof(qname)) >= sizeof(qname)) 4449126353Smlaier errx(1, "expand_altq: strlcat"); 4450126353Smlaier if (strlcpy(pb.qname, qname, 4451126353Smlaier sizeof(pb.qname)) >= sizeof(pb.qname)) 4452126353Smlaier errx(1, "expand_altq: strlcpy"); 4453126353Smlaier if (strlcpy(pb.ifname, interface->ifname, 4454126353Smlaier sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4455126353Smlaier errx(1, "expand_altq: strlcpy"); 4456126353Smlaier pb.qlimit = pa.qlimit; 4457126353Smlaier pb.scheduler = pa.scheduler; 4458126353Smlaier bw.bw_absolute = pa.ifbandwidth; 4459126353Smlaier bw.bw_percent = 0; 4460126353Smlaier if (eval_pfqueue(pf, &pb, &bw, opts)) 4461126353Smlaier errs++; 4462126353Smlaier else 4463126353Smlaier if (pfctl_add_altq(pf, &pb)) 4464126353Smlaier errs++; 4465126353Smlaier } 4466126353Smlaier 4467126353Smlaier LOOP_THROUGH(struct node_queue, queue, nqueues, 4468126353Smlaier n = calloc(1, sizeof(struct node_queue)); 4469126353Smlaier if (n == NULL) 4470126353Smlaier err(1, "expand_altq: calloc"); 4471126353Smlaier if (pa.scheduler == ALTQT_CBQ || 4472126353Smlaier pa.scheduler == ALTQT_HFSC) 4473126353Smlaier if (strlcpy(n->parent, qname, 4474126353Smlaier sizeof(n->parent)) >= 4475126353Smlaier sizeof(n->parent)) 4476126353Smlaier errx(1, "expand_altq: strlcpy"); 4477126353Smlaier if (strlcpy(n->queue, queue->queue, 4478126353Smlaier sizeof(n->queue)) >= sizeof(n->queue)) 4479126353Smlaier errx(1, "expand_altq: strlcpy"); 4480126353Smlaier if (strlcpy(n->ifname, interface->ifname, 4481126353Smlaier sizeof(n->ifname)) >= sizeof(n->ifname)) 4482126353Smlaier errx(1, "expand_altq: strlcpy"); 4483126353Smlaier n->scheduler = pa.scheduler; 4484126353Smlaier n->next = NULL; 4485126353Smlaier n->tail = n; 4486126353Smlaier if (queues == NULL) 4487126353Smlaier queues = n; 4488126353Smlaier else { 4489126353Smlaier queues->tail->next = n; 4490126353Smlaier queues->tail = n; 4491126353Smlaier } 4492126353Smlaier ); 4493126353Smlaier } 4494126353Smlaier ); 4495126353Smlaier FREE_LIST(struct node_if, interfaces); 4496126353Smlaier FREE_LIST(struct node_queue, nqueues); 4497126353Smlaier 4498126353Smlaier return (errs); 4499126353Smlaier} 4500126353Smlaier 4501126353Smlaierint 4502126353Smlaierexpand_queue(struct pf_altq *a, struct node_if *interfaces, 4503126353Smlaier struct node_queue *nqueues, struct node_queue_bw bwspec, 4504126353Smlaier struct node_queue_opt *opts) 4505126353Smlaier{ 4506126353Smlaier struct node_queue *n, *nq; 4507126353Smlaier struct pf_altq pa; 4508126353Smlaier u_int8_t found = 0; 4509126353Smlaier u_int8_t errs = 0; 4510126353Smlaier 4511126353Smlaier if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4512126353Smlaier FREE_LIST(struct node_queue, nqueues); 4513126353Smlaier return (0); 4514126353Smlaier } 4515126353Smlaier 4516126353Smlaier if (queues == NULL) { 4517126353Smlaier yyerror("queue %s has no parent", a->qname); 4518126353Smlaier FREE_LIST(struct node_queue, nqueues); 4519126353Smlaier return (1); 4520126353Smlaier } 4521126353Smlaier 4522126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4523126353Smlaier LOOP_THROUGH(struct node_queue, tqueue, queues, 4524126353Smlaier if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4525126353Smlaier (interface->ifname[0] == 0 || 4526126353Smlaier (!interface->not && !strncmp(interface->ifname, 4527126353Smlaier tqueue->ifname, IFNAMSIZ)) || 4528126353Smlaier (interface->not && strncmp(interface->ifname, 4529126353Smlaier tqueue->ifname, IFNAMSIZ)))) { 4530126353Smlaier /* found ourself in queues */ 4531126353Smlaier found++; 4532126353Smlaier 4533126353Smlaier memcpy(&pa, a, sizeof(struct pf_altq)); 4534126353Smlaier 4535126353Smlaier if (pa.scheduler != ALTQT_NONE && 4536126353Smlaier pa.scheduler != tqueue->scheduler) { 4537126353Smlaier yyerror("exactly one scheduler type " 4538126353Smlaier "per interface allowed"); 4539126353Smlaier return (1); 4540126353Smlaier } 4541126353Smlaier pa.scheduler = tqueue->scheduler; 4542126353Smlaier 4543126353Smlaier /* scheduler dependent error checking */ 4544126353Smlaier switch (pa.scheduler) { 4545126353Smlaier case ALTQT_PRIQ: 4546126353Smlaier if (nqueues != NULL) { 4547126353Smlaier yyerror("priq queues cannot " 4548126353Smlaier "have child queues"); 4549126353Smlaier return (1); 4550126353Smlaier } 4551126353Smlaier if (bwspec.bw_absolute > 0 || 4552126353Smlaier bwspec.bw_percent < 100) { 4553126353Smlaier yyerror("priq doesn't take " 4554126353Smlaier "bandwidth"); 4555126353Smlaier return (1); 4556126353Smlaier } 4557126353Smlaier break; 4558126353Smlaier default: 4559126353Smlaier break; 4560126353Smlaier } 4561126353Smlaier 4562126353Smlaier if (strlcpy(pa.ifname, tqueue->ifname, 4563126353Smlaier sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4564126353Smlaier errx(1, "expand_queue: strlcpy"); 4565126353Smlaier if (strlcpy(pa.parent, tqueue->parent, 4566126353Smlaier sizeof(pa.parent)) >= sizeof(pa.parent)) 4567126353Smlaier errx(1, "expand_queue: strlcpy"); 4568126353Smlaier 4569126353Smlaier if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4570126353Smlaier errs++; 4571126353Smlaier else 4572126353Smlaier if (pfctl_add_altq(pf, &pa)) 4573126353Smlaier errs++; 4574126353Smlaier 4575126353Smlaier for (nq = nqueues; nq != NULL; nq = nq->next) { 4576126353Smlaier if (!strcmp(a->qname, nq->queue)) { 4577126353Smlaier yyerror("queue cannot have " 4578126353Smlaier "itself as child"); 4579126353Smlaier errs++; 4580126353Smlaier continue; 4581126353Smlaier } 4582126353Smlaier n = calloc(1, 4583126353Smlaier sizeof(struct node_queue)); 4584126353Smlaier if (n == NULL) 4585126353Smlaier err(1, "expand_queue: calloc"); 4586126353Smlaier if (strlcpy(n->parent, a->qname, 4587126353Smlaier sizeof(n->parent)) >= 4588126353Smlaier sizeof(n->parent)) 4589126353Smlaier errx(1, "expand_queue strlcpy"); 4590126353Smlaier if (strlcpy(n->queue, nq->queue, 4591126353Smlaier sizeof(n->queue)) >= 4592126353Smlaier sizeof(n->queue)) 4593126353Smlaier errx(1, "expand_queue strlcpy"); 4594126353Smlaier if (strlcpy(n->ifname, tqueue->ifname, 4595126353Smlaier sizeof(n->ifname)) >= 4596126353Smlaier sizeof(n->ifname)) 4597126353Smlaier errx(1, "expand_queue strlcpy"); 4598126353Smlaier n->scheduler = tqueue->scheduler; 4599126353Smlaier n->next = NULL; 4600126353Smlaier n->tail = n; 4601126353Smlaier if (queues == NULL) 4602126353Smlaier queues = n; 4603126353Smlaier else { 4604126353Smlaier queues->tail->next = n; 4605126353Smlaier queues->tail = n; 4606126353Smlaier } 4607126353Smlaier } 4608126353Smlaier if ((pf->opts & PF_OPT_VERBOSE) && ( 4609126353Smlaier (found == 1 && interface->ifname[0] == 0) || 4610126353Smlaier (found > 0 && interface->ifname[0] != 0))) { 4611126353Smlaier print_queue(&pf->paltq->altq, 0, 4612126353Smlaier &bwspec, interface->ifname[0] != 0, 4613126353Smlaier opts); 4614126353Smlaier if (nqueues && nqueues->tail) { 4615126353Smlaier printf("{ "); 4616126353Smlaier LOOP_THROUGH(struct node_queue, 4617126353Smlaier queue, nqueues, 4618126353Smlaier printf("%s ", 4619126353Smlaier queue->queue); 4620126353Smlaier ); 4621126353Smlaier printf("}"); 4622126353Smlaier } 4623126353Smlaier printf("\n"); 4624126353Smlaier } 4625126353Smlaier } 4626126353Smlaier ); 4627126353Smlaier ); 4628126353Smlaier 4629126353Smlaier FREE_LIST(struct node_queue, nqueues); 4630126353Smlaier FREE_LIST(struct node_if, interfaces); 4631126353Smlaier 4632126353Smlaier if (!found) { 4633126353Smlaier yyerror("queue %s has no parent", a->qname); 4634126353Smlaier errs++; 4635126353Smlaier } 4636126353Smlaier 4637126353Smlaier if (errs) 4638126353Smlaier return (1); 4639126353Smlaier else 4640126353Smlaier return (0); 4641126353Smlaier} 4642126353Smlaier 4643126353Smlaiervoid 4644126353Smlaierexpand_rule(struct pf_rule *r, 4645126353Smlaier struct node_if *interfaces, struct node_host *rpool_hosts, 4646126353Smlaier struct node_proto *protos, struct node_os *src_oses, 4647126353Smlaier struct node_host *src_hosts, struct node_port *src_ports, 4648126353Smlaier struct node_host *dst_hosts, struct node_port *dst_ports, 4649145840Smlaier struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4650145840Smlaier const char *anchor_call) 4651126353Smlaier{ 4652126353Smlaier sa_family_t af = r->af; 4653126353Smlaier int added = 0, error = 0; 4654126353Smlaier char ifname[IF_NAMESIZE]; 4655126353Smlaier char label[PF_RULE_LABEL_SIZE]; 4656130617Smlaier char tagname[PF_TAG_NAME_SIZE]; 4657130617Smlaier char match_tagname[PF_TAG_NAME_SIZE]; 4658126353Smlaier struct pf_pooladdr *pa; 4659126353Smlaier struct node_host *h; 4660130617Smlaier u_int8_t flags, flagset, keep_state; 4661126353Smlaier 4662126353Smlaier if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4663126353Smlaier errx(1, "expand_rule: strlcpy"); 4664130617Smlaier if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4665130617Smlaier errx(1, "expand_rule: strlcpy"); 4666130617Smlaier if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4667130617Smlaier sizeof(match_tagname)) 4668130617Smlaier errx(1, "expand_rule: strlcpy"); 4669126353Smlaier flags = r->flags; 4670126353Smlaier flagset = r->flagset; 4671130617Smlaier keep_state = r->keep_state; 4672126353Smlaier 4673126353Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4674126353Smlaier LOOP_THROUGH(struct node_proto, proto, protos, 4675126353Smlaier LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4676126353Smlaier LOOP_THROUGH(struct node_host, src_host, src_hosts, 4677126353Smlaier LOOP_THROUGH(struct node_port, src_port, src_ports, 4678126353Smlaier LOOP_THROUGH(struct node_os, src_os, src_oses, 4679126353Smlaier LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4680126353Smlaier LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4681126353Smlaier LOOP_THROUGH(struct node_uid, uid, uids, 4682126353Smlaier LOOP_THROUGH(struct node_gid, gid, gids, 4683126353Smlaier 4684126353Smlaier r->af = af; 4685126353Smlaier /* for link-local IPv6 address, interface must match up */ 4686126353Smlaier if ((r->af && src_host->af && r->af != src_host->af) || 4687126353Smlaier (r->af && dst_host->af && r->af != dst_host->af) || 4688126353Smlaier (src_host->af && dst_host->af && 4689126353Smlaier src_host->af != dst_host->af) || 4690126353Smlaier (src_host->ifindex && dst_host->ifindex && 4691126353Smlaier src_host->ifindex != dst_host->ifindex) || 4692130617Smlaier (src_host->ifindex && *interface->ifname && 4693126353Smlaier src_host->ifindex != if_nametoindex(interface->ifname)) || 4694130617Smlaier (dst_host->ifindex && *interface->ifname && 4695126353Smlaier dst_host->ifindex != if_nametoindex(interface->ifname))) 4696126353Smlaier continue; 4697126353Smlaier if (!r->af && src_host->af) 4698126353Smlaier r->af = src_host->af; 4699126353Smlaier else if (!r->af && dst_host->af) 4700126353Smlaier r->af = dst_host->af; 4701126353Smlaier 4702130617Smlaier if (*interface->ifname) 4703145840Smlaier strlcpy(r->ifname, interface->ifname, 4704145840Smlaier sizeof(r->ifname)); 4705130617Smlaier else if (if_indextoname(src_host->ifindex, ifname)) 4706145840Smlaier strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4707126353Smlaier else if (if_indextoname(dst_host->ifindex, ifname)) 4708145840Smlaier strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4709126353Smlaier else 4710130617Smlaier memset(r->ifname, '\0', sizeof(r->ifname)); 4711126353Smlaier 4712126353Smlaier if (strlcpy(r->label, label, sizeof(r->label)) >= 4713126353Smlaier sizeof(r->label)) 4714126353Smlaier errx(1, "expand_rule: strlcpy"); 4715130617Smlaier if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4716130617Smlaier sizeof(r->tagname)) 4717130617Smlaier errx(1, "expand_rule: strlcpy"); 4718130617Smlaier if (strlcpy(r->match_tagname, match_tagname, 4719130617Smlaier sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4720130617Smlaier errx(1, "expand_rule: strlcpy"); 4721130617Smlaier expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4722130617Smlaier src_host, src_port, dst_host, dst_port, proto->proto); 4723130617Smlaier expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4724130617Smlaier src_host, src_port, dst_host, dst_port, proto->proto); 4725130617Smlaier expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4726130617Smlaier r->af, src_host, src_port, dst_host, dst_port, 4727130617Smlaier proto->proto); 4728126353Smlaier 4729126353Smlaier error += check_netmask(src_host, r->af); 4730126353Smlaier error += check_netmask(dst_host, r->af); 4731126353Smlaier 4732126353Smlaier r->ifnot = interface->not; 4733126353Smlaier r->proto = proto->proto; 4734126353Smlaier r->src.addr = src_host->addr; 4735145840Smlaier r->src.neg = src_host->not; 4736126353Smlaier r->src.port[0] = src_port->port[0]; 4737126353Smlaier r->src.port[1] = src_port->port[1]; 4738126353Smlaier r->src.port_op = src_port->op; 4739126353Smlaier r->dst.addr = dst_host->addr; 4740145840Smlaier r->dst.neg = dst_host->not; 4741126353Smlaier r->dst.port[0] = dst_port->port[0]; 4742126353Smlaier r->dst.port[1] = dst_port->port[1]; 4743126353Smlaier r->dst.port_op = dst_port->op; 4744126353Smlaier r->uid.op = uid->op; 4745126353Smlaier r->uid.uid[0] = uid->uid[0]; 4746126353Smlaier r->uid.uid[1] = uid->uid[1]; 4747126353Smlaier r->gid.op = gid->op; 4748126353Smlaier r->gid.gid[0] = gid->gid[0]; 4749126353Smlaier r->gid.gid[1] = gid->gid[1]; 4750126353Smlaier r->type = icmp_type->type; 4751126353Smlaier r->code = icmp_type->code; 4752126353Smlaier 4753130617Smlaier if ((keep_state == PF_STATE_MODULATE || 4754130617Smlaier keep_state == PF_STATE_SYNPROXY) && 4755130617Smlaier r->proto && r->proto != IPPROTO_TCP) 4756130617Smlaier r->keep_state = PF_STATE_NORMAL; 4757130617Smlaier else 4758130617Smlaier r->keep_state = keep_state; 4759130617Smlaier 4760126353Smlaier if (r->proto && r->proto != IPPROTO_TCP) { 4761126353Smlaier r->flags = 0; 4762126353Smlaier r->flagset = 0; 4763126353Smlaier } else { 4764126353Smlaier r->flags = flags; 4765126353Smlaier r->flagset = flagset; 4766126353Smlaier } 4767126353Smlaier if (icmp_type->proto && r->proto != icmp_type->proto) { 4768126353Smlaier yyerror("icmp-type mismatch"); 4769126353Smlaier error++; 4770126353Smlaier } 4771126353Smlaier 4772126353Smlaier if (src_os && src_os->os) { 4773126353Smlaier r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4774126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && 4775126353Smlaier r->os_fingerprint == PF_OSFP_NOMATCH) 4776126353Smlaier fprintf(stderr, 4777126353Smlaier "warning: unknown '%s' OS fingerprint\n", 4778126353Smlaier src_os->os); 4779126353Smlaier } else { 4780126353Smlaier r->os_fingerprint = PF_OSFP_ANY; 4781126353Smlaier } 4782126353Smlaier 4783126353Smlaier TAILQ_INIT(&r->rpool.list); 4784126353Smlaier for (h = rpool_hosts; h != NULL; h = h->next) { 4785126353Smlaier pa = calloc(1, sizeof(struct pf_pooladdr)); 4786126353Smlaier if (pa == NULL) 4787126353Smlaier err(1, "expand_rule: calloc"); 4788126353Smlaier pa->addr = h->addr; 4789126353Smlaier if (h->ifname != NULL) { 4790126353Smlaier if (strlcpy(pa->ifname, h->ifname, 4791126353Smlaier sizeof(pa->ifname)) >= 4792126353Smlaier sizeof(pa->ifname)) 4793126353Smlaier errx(1, "expand_rule: strlcpy"); 4794126353Smlaier } else 4795126353Smlaier pa->ifname[0] = 0; 4796126353Smlaier TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4797126353Smlaier } 4798126353Smlaier 4799171172Smlaier if (rule_consistent(r, anchor_call[0]) < 0 || error) 4800126353Smlaier yyerror("skipping rule due to errors"); 4801126353Smlaier else { 4802171172Smlaier r->nr = pf->astack[pf->asd]->match++; 4803145840Smlaier pfctl_add_rule(pf, r, anchor_call); 4804126353Smlaier added++; 4805126353Smlaier } 4806126353Smlaier 4807126353Smlaier )))))))))); 4808126353Smlaier 4809126353Smlaier FREE_LIST(struct node_if, interfaces); 4810126353Smlaier FREE_LIST(struct node_proto, protos); 4811126353Smlaier FREE_LIST(struct node_host, src_hosts); 4812126353Smlaier FREE_LIST(struct node_port, src_ports); 4813126353Smlaier FREE_LIST(struct node_os, src_oses); 4814126353Smlaier FREE_LIST(struct node_host, dst_hosts); 4815126353Smlaier FREE_LIST(struct node_port, dst_ports); 4816126353Smlaier FREE_LIST(struct node_uid, uids); 4817126353Smlaier FREE_LIST(struct node_gid, gids); 4818126353Smlaier FREE_LIST(struct node_icmp, icmp_types); 4819126353Smlaier FREE_LIST(struct node_host, rpool_hosts); 4820126353Smlaier 4821126353Smlaier if (!added) 4822126353Smlaier yyerror("rule expands to no valid combination"); 4823126353Smlaier} 4824126353Smlaier 4825145840Smlaierint 4826145840Smlaierexpand_skip_interface(struct node_if *interfaces) 4827145840Smlaier{ 4828145840Smlaier int errs = 0; 4829145840Smlaier 4830145840Smlaier if (!interfaces || (!interfaces->next && !interfaces->not && 4831145840Smlaier !strcmp(interfaces->ifname, "none"))) { 4832145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4833145840Smlaier printf("set skip on none\n"); 4834145840Smlaier errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4835145840Smlaier return (errs); 4836145840Smlaier } 4837145840Smlaier 4838145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4839145840Smlaier printf("set skip on {"); 4840145840Smlaier LOOP_THROUGH(struct node_if, interface, interfaces, 4841145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4842145840Smlaier printf(" %s", interface->ifname); 4843145840Smlaier if (interface->not) { 4844145840Smlaier yyerror("skip on ! <interface> is not supported"); 4845145840Smlaier errs++; 4846145840Smlaier } else 4847145840Smlaier errs += pfctl_set_interface_flags(pf, 4848145840Smlaier interface->ifname, PFI_IFLAG_SKIP, 1); 4849145840Smlaier ); 4850145840Smlaier if (pf->opts & PF_OPT_VERBOSE) 4851145840Smlaier printf(" }\n"); 4852145840Smlaier 4853145840Smlaier FREE_LIST(struct node_if, interfaces); 4854145840Smlaier 4855145840Smlaier if (errs) 4856145840Smlaier return (1); 4857145840Smlaier else 4858145840Smlaier return (0); 4859145840Smlaier} 4860145840Smlaier 4861126353Smlaier#undef FREE_LIST 4862126353Smlaier#undef LOOP_THROUGH 4863126353Smlaier 4864126353Smlaierint 4865126353Smlaiercheck_rulestate(int desired_state) 4866126353Smlaier{ 4867126353Smlaier if (require_order && (rulestate > desired_state)) { 4868126353Smlaier yyerror("Rules must be in order: options, normalization, " 4869126353Smlaier "queueing, translation, filtering"); 4870126353Smlaier return (1); 4871126353Smlaier } 4872126353Smlaier rulestate = desired_state; 4873126353Smlaier return (0); 4874126353Smlaier} 4875126353Smlaier 4876126353Smlaierint 4877126353Smlaierkw_cmp(const void *k, const void *e) 4878126353Smlaier{ 4879126353Smlaier return (strcmp(k, ((const struct keywords *)e)->k_name)); 4880126353Smlaier} 4881126353Smlaier 4882126353Smlaierint 4883126353Smlaierlookup(char *s) 4884126353Smlaier{ 4885126353Smlaier /* this has to be sorted always */ 4886126353Smlaier static const struct keywords keywords[] = { 4887126353Smlaier { "all", ALL}, 4888126353Smlaier { "allow-opts", ALLOWOPTS}, 4889126353Smlaier { "altq", ALTQ}, 4890126353Smlaier { "anchor", ANCHOR}, 4891126353Smlaier { "antispoof", ANTISPOOF}, 4892126353Smlaier { "any", ANY}, 4893126353Smlaier { "bandwidth", BANDWIDTH}, 4894126353Smlaier { "binat", BINAT}, 4895126353Smlaier { "binat-anchor", BINATANCHOR}, 4896126353Smlaier { "bitmask", BITMASK}, 4897126353Smlaier { "block", BLOCK}, 4898126353Smlaier { "block-policy", BLOCKPOLICY}, 4899126353Smlaier { "cbq", CBQ}, 4900126353Smlaier { "code", CODE}, 4901126353Smlaier { "crop", FRAGCROP}, 4902130617Smlaier { "debug", DEBUG}, 4903126353Smlaier { "drop", DROP}, 4904126353Smlaier { "drop-ovl", FRAGDROP}, 4905126353Smlaier { "dup-to", DUPTO}, 4906126353Smlaier { "fastroute", FASTROUTE}, 4907126353Smlaier { "file", FILENAME}, 4908126353Smlaier { "fingerprints", FINGERPRINTS}, 4909126353Smlaier { "flags", FLAGS}, 4910130617Smlaier { "floating", FLOATING}, 4911145840Smlaier { "flush", FLUSH}, 4912126353Smlaier { "for", FOR}, 4913126353Smlaier { "fragment", FRAGMENT}, 4914126353Smlaier { "from", FROM}, 4915130617Smlaier { "global", GLOBAL}, 4916126353Smlaier { "group", GROUP}, 4917126353Smlaier { "hfsc", HFSC}, 4918130617Smlaier { "hostid", HOSTID}, 4919126353Smlaier { "icmp-type", ICMPTYPE}, 4920126353Smlaier { "icmp6-type", ICMP6TYPE}, 4921130617Smlaier { "if-bound", IFBOUND}, 4922126353Smlaier { "in", IN}, 4923126353Smlaier { "inet", INET}, 4924126353Smlaier { "inet6", INET6}, 4925126353Smlaier { "keep", KEEP}, 4926126353Smlaier { "label", LABEL}, 4927126353Smlaier { "limit", LIMIT}, 4928126353Smlaier { "linkshare", LINKSHARE}, 4929126353Smlaier { "load", LOAD}, 4930126353Smlaier { "log", LOG}, 4931126353Smlaier { "loginterface", LOGINTERFACE}, 4932126353Smlaier { "max", MAXIMUM}, 4933126353Smlaier { "max-mss", MAXMSS}, 4934145840Smlaier { "max-src-conn", MAXSRCCONN}, 4935145840Smlaier { "max-src-conn-rate", MAXSRCCONNRATE}, 4936130617Smlaier { "max-src-nodes", MAXSRCNODES}, 4937130617Smlaier { "max-src-states", MAXSRCSTATES}, 4938126353Smlaier { "min-ttl", MINTTL}, 4939126353Smlaier { "modulate", MODULATE}, 4940126353Smlaier { "nat", NAT}, 4941126353Smlaier { "nat-anchor", NATANCHOR}, 4942126353Smlaier { "no", NO}, 4943126353Smlaier { "no-df", NODF}, 4944126353Smlaier { "no-route", NOROUTE}, 4945130617Smlaier { "no-sync", NOSYNC}, 4946126353Smlaier { "on", ON}, 4947126353Smlaier { "optimization", OPTIMIZATION}, 4948126353Smlaier { "os", OS}, 4949126353Smlaier { "out", OUT}, 4950145840Smlaier { "overload", OVERLOAD}, 4951126353Smlaier { "pass", PASS}, 4952126353Smlaier { "port", PORT}, 4953126353Smlaier { "priority", PRIORITY}, 4954126353Smlaier { "priq", PRIQ}, 4955145840Smlaier { "probability", PROBABILITY}, 4956126353Smlaier { "proto", PROTO}, 4957126353Smlaier { "qlimit", QLIMIT}, 4958126353Smlaier { "queue", QUEUE}, 4959126353Smlaier { "quick", QUICK}, 4960126353Smlaier { "random", RANDOM}, 4961126353Smlaier { "random-id", RANDOMID}, 4962126353Smlaier { "rdr", RDR}, 4963126353Smlaier { "rdr-anchor", RDRANCHOR}, 4964126353Smlaier { "realtime", REALTIME}, 4965126353Smlaier { "reassemble", REASSEMBLE}, 4966126353Smlaier { "reply-to", REPLYTO}, 4967126353Smlaier { "require-order", REQUIREORDER}, 4968126353Smlaier { "return", RETURN}, 4969126353Smlaier { "return-icmp", RETURNICMP}, 4970126353Smlaier { "return-icmp6", RETURNICMP6}, 4971126353Smlaier { "return-rst", RETURNRST}, 4972126353Smlaier { "round-robin", ROUNDROBIN}, 4973145840Smlaier { "route", ROUTE}, 4974126353Smlaier { "route-to", ROUTETO}, 4975171172Smlaier { "rtable", RTABLE}, 4976130617Smlaier { "rule", RULE}, 4977171172Smlaier { "ruleset-optimization", RULESET_OPTIMIZATION}, 4978126353Smlaier { "scrub", SCRUB}, 4979126353Smlaier { "set", SET}, 4980145840Smlaier { "skip", SKIP}, 4981126353Smlaier { "source-hash", SOURCEHASH}, 4982130617Smlaier { "source-track", SOURCETRACK}, 4983126353Smlaier { "state", STATE}, 4984130617Smlaier { "state-policy", STATEPOLICY}, 4985126353Smlaier { "static-port", STATICPORT}, 4986130617Smlaier { "sticky-address", STICKYADDRESS}, 4987126353Smlaier { "synproxy", SYNPROXY}, 4988126353Smlaier { "table", TABLE}, 4989126353Smlaier { "tag", TAG}, 4990126353Smlaier { "tagged", TAGGED}, 4991126353Smlaier { "tbrsize", TBRSIZE}, 4992126353Smlaier { "timeout", TIMEOUT}, 4993126353Smlaier { "to", TO}, 4994126353Smlaier { "tos", TOS}, 4995126353Smlaier { "ttl", TTL}, 4996126353Smlaier { "upperlimit", UPPERLIMIT}, 4997171172Smlaier { "urpf-failed", URPFFAILED}, 4998126353Smlaier { "user", USER}, 4999126353Smlaier }; 5000126353Smlaier const struct keywords *p; 5001126353Smlaier 5002126353Smlaier p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5003126353Smlaier sizeof(keywords[0]), kw_cmp); 5004126353Smlaier 5005126353Smlaier if (p) { 5006126353Smlaier if (debug > 1) 5007126353Smlaier fprintf(stderr, "%s: %d\n", s, p->k_val); 5008126353Smlaier return (p->k_val); 5009126353Smlaier } else { 5010126353Smlaier if (debug > 1) 5011126353Smlaier fprintf(stderr, "string: %s\n", s); 5012126353Smlaier return (STRING); 5013126353Smlaier } 5014126353Smlaier} 5015126353Smlaier 5016126353Smlaier#define MAXPUSHBACK 128 5017126353Smlaier 5018126353Smlaierchar *parsebuf; 5019126353Smlaierint parseindex; 5020126353Smlaierchar pushback_buffer[MAXPUSHBACK]; 5021126353Smlaierint pushback_index = 0; 5022126353Smlaier 5023126353Smlaierint 5024126353Smlaierlgetc(FILE *f) 5025126353Smlaier{ 5026126353Smlaier int c, next; 5027126353Smlaier 5028126353Smlaier if (parsebuf) { 5029126353Smlaier /* Read character from the parsebuffer instead of input. */ 5030126353Smlaier if (parseindex >= 0) { 5031126353Smlaier c = parsebuf[parseindex++]; 5032126353Smlaier if (c != '\0') 5033126353Smlaier return (c); 5034126353Smlaier parsebuf = NULL; 5035126353Smlaier } else 5036126353Smlaier parseindex++; 5037126353Smlaier } 5038126353Smlaier 5039126353Smlaier if (pushback_index) 5040126353Smlaier return (pushback_buffer[--pushback_index]); 5041126353Smlaier 5042126353Smlaier while ((c = getc(f)) == '\\') { 5043126353Smlaier next = getc(f); 5044126353Smlaier if (next != '\n') { 5045171172Smlaier c = next; 5046126353Smlaier break; 5047126353Smlaier } 5048126353Smlaier yylval.lineno = lineno; 5049126353Smlaier lineno++; 5050126353Smlaier } 5051126353Smlaier if (c == '\t' || c == ' ') { 5052126353Smlaier /* Compress blanks to a single space. */ 5053126353Smlaier do { 5054126353Smlaier c = getc(f); 5055126353Smlaier } while (c == '\t' || c == ' '); 5056126353Smlaier ungetc(c, f); 5057126353Smlaier c = ' '; 5058126353Smlaier } 5059126353Smlaier 5060126353Smlaier return (c); 5061126353Smlaier} 5062126353Smlaier 5063126353Smlaierint 5064126353Smlaierlungetc(int c) 5065126353Smlaier{ 5066126353Smlaier if (c == EOF) 5067126353Smlaier return (EOF); 5068126353Smlaier if (parsebuf) { 5069126353Smlaier parseindex--; 5070126353Smlaier if (parseindex >= 0) 5071126353Smlaier return (c); 5072126353Smlaier } 5073126353Smlaier if (pushback_index < MAXPUSHBACK-1) 5074126353Smlaier return (pushback_buffer[pushback_index++] = c); 5075126353Smlaier else 5076126353Smlaier return (EOF); 5077126353Smlaier} 5078126353Smlaier 5079126353Smlaierint 5080126353Smlaierfindeol(void) 5081126353Smlaier{ 5082126353Smlaier int c; 5083126353Smlaier 5084126353Smlaier parsebuf = NULL; 5085126353Smlaier pushback_index = 0; 5086126353Smlaier 5087126353Smlaier /* skip to either EOF or the first real EOL */ 5088126353Smlaier while (1) { 5089126353Smlaier c = lgetc(fin); 5090126353Smlaier if (c == '\n') { 5091126353Smlaier lineno++; 5092126353Smlaier break; 5093126353Smlaier } 5094126353Smlaier if (c == EOF) 5095126353Smlaier break; 5096126353Smlaier } 5097126353Smlaier return (ERROR); 5098126353Smlaier} 5099126353Smlaier 5100126353Smlaierint 5101126353Smlaieryylex(void) 5102126353Smlaier{ 5103126353Smlaier char buf[8096]; 5104126353Smlaier char *p, *val; 5105126353Smlaier int endc, c, next; 5106126353Smlaier int token; 5107126353Smlaier 5108126353Smlaiertop: 5109126353Smlaier p = buf; 5110126353Smlaier while ((c = lgetc(fin)) == ' ') 5111126353Smlaier ; /* nothing */ 5112126353Smlaier 5113126353Smlaier yylval.lineno = lineno; 5114126353Smlaier if (c == '#') 5115126353Smlaier while ((c = lgetc(fin)) != '\n' && c != EOF) 5116126353Smlaier ; /* nothing */ 5117126353Smlaier if (c == '$' && parsebuf == NULL) { 5118126353Smlaier while (1) { 5119126353Smlaier if ((c = lgetc(fin)) == EOF) 5120126353Smlaier return (0); 5121126353Smlaier 5122126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 5123126353Smlaier yyerror("string too long"); 5124126353Smlaier return (findeol()); 5125126353Smlaier } 5126126353Smlaier if (isalnum(c) || c == '_') { 5127126353Smlaier *p++ = (char)c; 5128126353Smlaier continue; 5129126353Smlaier } 5130126353Smlaier *p = '\0'; 5131126353Smlaier lungetc(c); 5132126353Smlaier break; 5133126353Smlaier } 5134126353Smlaier val = symget(buf); 5135126353Smlaier if (val == NULL) { 5136126353Smlaier yyerror("macro '%s' not defined", buf); 5137126353Smlaier return (findeol()); 5138126353Smlaier } 5139126353Smlaier parsebuf = val; 5140126353Smlaier parseindex = 0; 5141126353Smlaier goto top; 5142126353Smlaier } 5143126353Smlaier 5144126353Smlaier switch (c) { 5145126353Smlaier case '\'': 5146126353Smlaier case '"': 5147126353Smlaier endc = c; 5148126353Smlaier while (1) { 5149126353Smlaier if ((c = lgetc(fin)) == EOF) 5150126353Smlaier return (0); 5151126353Smlaier if (c == endc) { 5152126353Smlaier *p = '\0'; 5153126353Smlaier break; 5154126353Smlaier } 5155126353Smlaier if (c == '\n') { 5156126353Smlaier lineno++; 5157126353Smlaier continue; 5158126353Smlaier } 5159126353Smlaier if (p + 1 >= buf + sizeof(buf) - 1) { 5160126353Smlaier yyerror("string too long"); 5161126353Smlaier return (findeol()); 5162126353Smlaier } 5163126353Smlaier *p++ = (char)c; 5164126353Smlaier } 5165126353Smlaier yylval.v.string = strdup(buf); 5166126353Smlaier if (yylval.v.string == NULL) 5167126353Smlaier err(1, "yylex: strdup"); 5168126353Smlaier return (STRING); 5169126353Smlaier case '<': 5170126353Smlaier next = lgetc(fin); 5171126353Smlaier if (next == '>') { 5172126353Smlaier yylval.v.i = PF_OP_XRG; 5173126353Smlaier return (PORTBINARY); 5174126353Smlaier } 5175126353Smlaier lungetc(next); 5176126353Smlaier break; 5177126353Smlaier case '>': 5178126353Smlaier next = lgetc(fin); 5179126353Smlaier if (next == '<') { 5180126353Smlaier yylval.v.i = PF_OP_IRG; 5181126353Smlaier return (PORTBINARY); 5182126353Smlaier } 5183126353Smlaier lungetc(next); 5184126353Smlaier break; 5185126353Smlaier case '-': 5186126353Smlaier next = lgetc(fin); 5187126353Smlaier if (next == '>') 5188126353Smlaier return (ARROW); 5189126353Smlaier lungetc(next); 5190126353Smlaier break; 5191126353Smlaier } 5192126353Smlaier 5193126353Smlaier#define allowed_in_string(x) \ 5194126353Smlaier (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5195126353Smlaier x != '{' && x != '}' && x != '<' && x != '>' && \ 5196126353Smlaier x != '!' && x != '=' && x != '/' && x != '#' && \ 5197126353Smlaier x != ',')) 5198126353Smlaier 5199126353Smlaier if (isalnum(c) || c == ':' || c == '_') { 5200126353Smlaier do { 5201126353Smlaier *p++ = c; 5202126353Smlaier if ((unsigned)(p-buf) >= sizeof(buf)) { 5203126353Smlaier yyerror("string too long"); 5204126353Smlaier return (findeol()); 5205126353Smlaier } 5206126353Smlaier } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 5207126353Smlaier lungetc(c); 5208126353Smlaier *p = '\0'; 5209130617Smlaier if ((token = lookup(buf)) == STRING) 5210130617Smlaier if ((yylval.v.string = strdup(buf)) == NULL) 5211130617Smlaier err(1, "yylex: strdup"); 5212126353Smlaier return (token); 5213126353Smlaier } 5214126353Smlaier if (c == '\n') { 5215126353Smlaier yylval.lineno = lineno; 5216126353Smlaier lineno++; 5217126353Smlaier } 5218126353Smlaier if (c == EOF) 5219126353Smlaier return (0); 5220126353Smlaier return (c); 5221126353Smlaier} 5222126353Smlaier 5223126353Smlaierint 5224126353Smlaierparse_rules(FILE *input, struct pfctl *xpf) 5225126353Smlaier{ 5226130617Smlaier struct sym *sym, *next; 5227126353Smlaier 5228126353Smlaier fin = input; 5229126353Smlaier pf = xpf; 5230126353Smlaier lineno = 1; 5231126353Smlaier errors = 0; 5232126353Smlaier rulestate = PFCTL_STATE_NONE; 5233126353Smlaier returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5234126353Smlaier returnicmp6default = 5235126353Smlaier (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5236126353Smlaier blockpolicy = PFRULE_DROP; 5237126353Smlaier require_order = 1; 5238126353Smlaier 5239126353Smlaier yyparse(); 5240126353Smlaier 5241126353Smlaier /* Free macros and check which have not been used. */ 5242130617Smlaier for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 5243130617Smlaier next = TAILQ_NEXT(sym, entries); 5244126353Smlaier if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5245126353Smlaier fprintf(stderr, "warning: macro '%s' not " 5246126353Smlaier "used\n", sym->nam); 5247126353Smlaier free(sym->nam); 5248126353Smlaier free(sym->val); 5249126353Smlaier TAILQ_REMOVE(&symhead, sym, entries); 5250130617Smlaier free(sym); 5251126353Smlaier } 5252126353Smlaier 5253126353Smlaier return (errors ? -1 : 0); 5254126353Smlaier} 5255126353Smlaier 5256126353Smlaier/* 5257126353Smlaier * Over-designed efficiency is a French and German concept, so how about 5258126353Smlaier * we wait until they discover this ugliness and make it all fancy. 5259126353Smlaier */ 5260126353Smlaierint 5261126353Smlaiersymset(const char *nam, const char *val, int persist) 5262126353Smlaier{ 5263126353Smlaier struct sym *sym; 5264126353Smlaier 5265126353Smlaier for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5266126353Smlaier sym = TAILQ_NEXT(sym, entries)) 5267126353Smlaier ; /* nothing */ 5268126353Smlaier 5269126353Smlaier if (sym != NULL) { 5270126353Smlaier if (sym->persist == 1) 5271126353Smlaier return (0); 5272126353Smlaier else { 5273126353Smlaier free(sym->nam); 5274126353Smlaier free(sym->val); 5275126353Smlaier TAILQ_REMOVE(&symhead, sym, entries); 5276126353Smlaier free(sym); 5277126353Smlaier } 5278126353Smlaier } 5279126353Smlaier if ((sym = calloc(1, sizeof(*sym))) == NULL) 5280126353Smlaier return (-1); 5281126353Smlaier 5282126353Smlaier sym->nam = strdup(nam); 5283126353Smlaier if (sym->nam == NULL) { 5284126353Smlaier free(sym); 5285126353Smlaier return (-1); 5286126353Smlaier } 5287126353Smlaier sym->val = strdup(val); 5288126353Smlaier if (sym->val == NULL) { 5289126353Smlaier free(sym->nam); 5290126353Smlaier free(sym); 5291126353Smlaier return (-1); 5292126353Smlaier } 5293126353Smlaier sym->used = 0; 5294126353Smlaier sym->persist = persist; 5295126353Smlaier TAILQ_INSERT_TAIL(&symhead, sym, entries); 5296126353Smlaier return (0); 5297126353Smlaier} 5298126353Smlaier 5299126353Smlaierint 5300126353Smlaierpfctl_cmdline_symset(char *s) 5301126353Smlaier{ 5302126353Smlaier char *sym, *val; 5303126353Smlaier int ret; 5304126353Smlaier 5305126353Smlaier if ((val = strrchr(s, '=')) == NULL) 5306126353Smlaier return (-1); 5307126353Smlaier 5308126353Smlaier if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5309126353Smlaier err(1, "pfctl_cmdline_symset: malloc"); 5310126353Smlaier 5311126353Smlaier strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5312126353Smlaier 5313126353Smlaier ret = symset(sym, val + 1, 1); 5314126353Smlaier free(sym); 5315126353Smlaier 5316126353Smlaier return (ret); 5317126353Smlaier} 5318126353Smlaier 5319126353Smlaierchar * 5320126353Smlaiersymget(const char *nam) 5321126353Smlaier{ 5322126353Smlaier struct sym *sym; 5323126353Smlaier 5324126353Smlaier TAILQ_FOREACH(sym, &symhead, entries) 5325126353Smlaier if (strcmp(nam, sym->nam) == 0) { 5326126353Smlaier sym->used = 1; 5327126353Smlaier return (sym->val); 5328126353Smlaier } 5329126353Smlaier return (NULL); 5330126353Smlaier} 5331126353Smlaier 5332126353Smlaiervoid 5333171172Smlaiermv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5334126353Smlaier{ 5335171172Smlaier int i; 5336171172Smlaier struct pf_rule *r; 5337126353Smlaier 5338171172Smlaier for (i = 0; i < PF_RULESET_MAX; ++i) { 5339171172Smlaier while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 5340171172Smlaier != NULL) { 5341171172Smlaier TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 5342171172Smlaier TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 5343171172Smlaier dst->anchor->match++; 5344126353Smlaier } 5345171172Smlaier src->anchor->match = 0; 5346171172Smlaier while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 5347171172Smlaier != NULL) { 5348171172Smlaier TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 5349171172Smlaier TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 5350171172Smlaier r, entries); 5351171172Smlaier } 5352126353Smlaier } 5353126353Smlaier} 5354126353Smlaier 5355126353Smlaiervoid 5356171172Smlaierdecide_address_family(struct node_host *n, sa_family_t *af) 5357171172Smlaier{ 5358171172Smlaier if (*af != 0 || n == NULL) 5359171172Smlaier return; 5360171172Smlaier *af = n->af; 5361171172Smlaier while ((n = n->next) != NULL) { 5362171172Smlaier if (n->af != *af) { 5363171172Smlaier *af = 0; 5364171172Smlaier return; 5365171172Smlaier } 5366171172Smlaier } 5367171172Smlaier} 5368171172Smlaier 5369171172Smlaiervoid 5370126353Smlaierremove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5371126353Smlaier{ 5372126353Smlaier struct node_host *n = *nh, *prev = NULL; 5373126353Smlaier 5374126353Smlaier while (n != NULL) { 5375126353Smlaier if (*af && n->af && n->af != *af) { 5376126353Smlaier /* unlink and free n */ 5377126353Smlaier struct node_host *next = n->next; 5378126353Smlaier 5379126353Smlaier /* adjust tail pointer */ 5380126353Smlaier if (n == (*nh)->tail) 5381126353Smlaier (*nh)->tail = prev; 5382126353Smlaier /* adjust previous node's next pointer */ 5383126353Smlaier if (prev == NULL) 5384126353Smlaier *nh = next; 5385126353Smlaier else 5386126353Smlaier prev->next = next; 5387126353Smlaier /* free node */ 5388126353Smlaier if (n->ifname != NULL) 5389126353Smlaier free(n->ifname); 5390126353Smlaier free(n); 5391126353Smlaier n = next; 5392126353Smlaier } else { 5393126353Smlaier if (n->af && !*af) 5394126353Smlaier *af = n->af; 5395126353Smlaier prev = n; 5396126353Smlaier n = n->next; 5397126353Smlaier } 5398126353Smlaier } 5399126353Smlaier} 5400126353Smlaier 5401126353Smlaierint 5402126353Smlaierinvalid_redirect(struct node_host *nh, sa_family_t af) 5403126353Smlaier{ 5404126353Smlaier if (!af) { 5405126353Smlaier struct node_host *n; 5406126353Smlaier 5407130617Smlaier /* tables and dyniftl are ok without an address family */ 5408126353Smlaier for (n = nh; n != NULL; n = n->next) { 5409130617Smlaier if (n->addr.type != PF_ADDR_TABLE && 5410130617Smlaier n->addr.type != PF_ADDR_DYNIFTL) { 5411126353Smlaier yyerror("address family not given and " 5412126353Smlaier "translation address expands to multiple " 5413126353Smlaier "address families"); 5414126353Smlaier return (1); 5415126353Smlaier } 5416126353Smlaier } 5417126353Smlaier } 5418126353Smlaier if (nh == NULL) { 5419126353Smlaier yyerror("no translation address with matching address family " 5420126353Smlaier "found."); 5421126353Smlaier return (1); 5422126353Smlaier } 5423126353Smlaier return (0); 5424126353Smlaier} 5425126353Smlaier 5426126353Smlaierint 5427126353Smlaieratoul(char *s, u_long *ulvalp) 5428126353Smlaier{ 5429126353Smlaier u_long ulval; 5430126353Smlaier char *ep; 5431126353Smlaier 5432126353Smlaier errno = 0; 5433126353Smlaier ulval = strtoul(s, &ep, 0); 5434126353Smlaier if (s[0] == '\0' || *ep != '\0') 5435126353Smlaier return (-1); 5436126353Smlaier if (errno == ERANGE && ulval == ULONG_MAX) 5437126353Smlaier return (-1); 5438126353Smlaier *ulvalp = ulval; 5439126353Smlaier return (0); 5440126353Smlaier} 5441126353Smlaier 5442126353Smlaierint 5443126353Smlaiergetservice(char *n) 5444126353Smlaier{ 5445126353Smlaier struct servent *s; 5446126353Smlaier u_long ulval; 5447126353Smlaier 5448126353Smlaier if (atoul(n, &ulval) == 0) { 5449126353Smlaier if (ulval > 65535) { 5450145840Smlaier yyerror("illegal port value %lu", ulval); 5451126353Smlaier return (-1); 5452126353Smlaier } 5453126353Smlaier return (htons(ulval)); 5454126353Smlaier } else { 5455126353Smlaier s = getservbyname(n, "tcp"); 5456126353Smlaier if (s == NULL) 5457126353Smlaier s = getservbyname(n, "udp"); 5458126353Smlaier if (s == NULL) { 5459126353Smlaier yyerror("unknown port %s", n); 5460126353Smlaier return (-1); 5461126353Smlaier } 5462126353Smlaier return (s->s_port); 5463126353Smlaier } 5464126353Smlaier} 5465126353Smlaier 5466126353Smlaierint 5467126353Smlaierrule_label(struct pf_rule *r, char *s) 5468126353Smlaier{ 5469126353Smlaier if (s) { 5470126353Smlaier if (strlcpy(r->label, s, sizeof(r->label)) >= 5471126353Smlaier sizeof(r->label)) { 5472126353Smlaier yyerror("rule label too long (max %d chars)", 5473126353Smlaier sizeof(r->label)-1); 5474126353Smlaier return (-1); 5475126353Smlaier } 5476126353Smlaier } 5477126353Smlaier return (0); 5478126353Smlaier} 5479126353Smlaier 5480126353Smlaieru_int16_t 5481126353Smlaierparseicmpspec(char *w, sa_family_t af) 5482126353Smlaier{ 5483126353Smlaier const struct icmpcodeent *p; 5484126353Smlaier u_long ulval; 5485126353Smlaier u_int8_t icmptype; 5486126353Smlaier 5487126353Smlaier if (af == AF_INET) 5488126353Smlaier icmptype = returnicmpdefault >> 8; 5489126353Smlaier else 5490126353Smlaier icmptype = returnicmp6default >> 8; 5491126353Smlaier 5492126353Smlaier if (atoul(w, &ulval) == -1) { 5493126353Smlaier if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5494126353Smlaier yyerror("unknown icmp code %s", w); 5495126353Smlaier return (0); 5496126353Smlaier } 5497126353Smlaier ulval = p->code; 5498126353Smlaier } 5499126353Smlaier if (ulval > 255) { 5500145840Smlaier yyerror("invalid icmp code %lu", ulval); 5501126353Smlaier return (0); 5502126353Smlaier } 5503126353Smlaier return (icmptype << 8 | ulval); 5504126353Smlaier} 5505126353Smlaier 5506126353Smlaierint 5507171172Smlaierpfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5508126353Smlaier{ 5509126353Smlaier struct loadanchors *la; 5510171172Smlaier FILE *fin; 5511126353Smlaier 5512126353Smlaier TAILQ_FOREACH(la, &loadanchorshead, entries) { 5513171172Smlaier if (pf->opts & PF_OPT_VERBOSE) 5514145840Smlaier fprintf(stderr, "\nLoading anchor %s from %s\n", 5515145840Smlaier la->anchorname, la->filename); 5516171172Smlaier if ((fin = pfctl_fopen(la->filename, "r")) == NULL) { 5517171172Smlaier warn("%s", la->filename); 5518171172Smlaier continue; 5519171172Smlaier } 5520171172Smlaier if (pfctl_rules(dev, la->filename, fin, pf->opts, pf->optimize, 5521171172Smlaier la->anchorname, trans) == -1) 5522126353Smlaier return (-1); 5523126353Smlaier } 5524126353Smlaier 5525126353Smlaier return (0); 5526126353Smlaier} 5527