1145519Sdarrenr/* $FreeBSD$ */ 2145510Sdarrenr 3170268Sdarrenr/* 4255332Scy * Copyright (C) 2012 by Darren Reed. 5170268Sdarrenr * 6170268Sdarrenr * See the IPFILTER.LICENCE file for details on licencing. 7170268Sdarrenr */ 8145510Sdarrenr%{ 9145510Sdarrenr#include "ipf.h" 10145510Sdarrenr#include <sys/ioctl.h> 11145510Sdarrenr#include <syslog.h> 12145510Sdarrenr#ifdef IPFILTER_BPF 13145510Sdarrenr# include <pcap.h> 14145510Sdarrenr#endif 15145510Sdarrenr#include "netinet/ip_pool.h" 16145510Sdarrenr#include "netinet/ip_htable.h" 17145510Sdarrenr#include "netinet/ipl.h" 18145510Sdarrenr#include "ipf_l.h" 19145510Sdarrenr 20145510Sdarrenr#define YYDEBUG 1 21145510Sdarrenr#define DOALL(x) for (fr = frc; fr != NULL; fr = fr->fr_next) { x } 22145510Sdarrenr#define DOREM(x) for (; fr != NULL; fr = fr->fr_next) { x } 23145510Sdarrenr 24145510Sdarrenrextern void yyerror __P((char *)); 25145510Sdarrenrextern int yyparse __P((void)); 26145510Sdarrenrextern int yylex __P((void)); 27145510Sdarrenrextern int yydebug; 28145510Sdarrenrextern FILE *yyin; 29145510Sdarrenrextern int yylineNum; 30145510Sdarrenr 31255332Scystatic int addname __P((frentry_t **, char *)); 32255332Scystatic frentry_t *addrule __P((void)); 33255332Scystatic frentry_t *allocfr __P((void)); 34255332Scystatic void build_dstaddr_af __P((frentry_t *, void *)); 35255332Scystatic void build_srcaddr_af __P((frentry_t *, void *)); 36145510Sdarrenrstatic void dobpf __P((int, char *)); 37255332Scystatic void doipfexpr __P((char *)); 38255332Scystatic void do_tuneint __P((char *, int)); 39255332Scystatic void do_tunestr __P((char *, char *)); 40255332Scystatic void fillgroup __P((frentry_t *)); 41255332Scystatic int lookuphost __P((char *, i6addr_t *)); 42145510Sdarrenrstatic u_int makehash __P((struct alist_s *)); 43145510Sdarrenrstatic int makepool __P((struct alist_s *)); 44255332Scystatic struct alist_s *newalist __P((struct alist_s *)); 45255332Scystatic void newrule __P((void)); 46255332Scystatic void resetaddr __P((void)); 47255332Scystatic void setgroup __P((frentry_t **, char *)); 48255332Scystatic void setgrhead __P((frentry_t **, char *)); 49255332Scystatic void seticmphead __P((frentry_t **, char *)); 50255332Scystatic void setifname __P((frentry_t **, int, char *)); 51255332Scystatic void setipftype __P((void)); 52145510Sdarrenrstatic void setsyslog __P((void)); 53145510Sdarrenrstatic void unsetsyslog __P((void)); 54145510Sdarrenr 55145510Sdarrenrfrentry_t *fr = NULL, *frc = NULL, *frtop = NULL, *frold = NULL; 56145510Sdarrenr 57145510Sdarrenrstatic int ifpflag = 0; 58145510Sdarrenrstatic int nowith = 0; 59145510Sdarrenrstatic int dynamic = -1; 60145510Sdarrenrstatic int pooled = 0; 61145510Sdarrenrstatic int hashed = 0; 62145510Sdarrenrstatic int nrules = 0; 63145510Sdarrenrstatic int newlist = 0; 64145510Sdarrenrstatic int added = 0; 65145510Sdarrenrstatic int ipffd = -1; 66255332Scystatic int *yycont = NULL; 67255332Scystatic ioctlfunc_t ipfioctls[IPL_LOGSIZE]; 68145510Sdarrenrstatic addfunc_t ipfaddfunc = NULL; 69145510Sdarrenr 70145510Sdarrenr%} 71145510Sdarrenr%union { 72145510Sdarrenr char *str; 73145510Sdarrenr u_32_t num; 74145510Sdarrenr frentry_t fr; 75145510Sdarrenr frtuc_t *frt; 76145510Sdarrenr struct alist_s *alist; 77145510Sdarrenr u_short port; 78255332Scy struct in_addr ip4; 79145510Sdarrenr struct { 80145510Sdarrenr u_short p1; 81145510Sdarrenr u_short p2; 82145510Sdarrenr int pc; 83145510Sdarrenr } pc; 84255332Scy struct ipp_s { 85255332Scy int type; 86255332Scy int ifpos; 87255332Scy int f; 88255332Scy int v; 89255332Scy int lif; 90145510Sdarrenr union i6addr a; 91145510Sdarrenr union i6addr m; 92255332Scy char *name; 93145510Sdarrenr } ipp; 94161357Sguido struct { 95255332Scy i6addr_t adr; 96255332Scy int f; 97255332Scy } adr; 98255332Scy i6addr_t ip6; 99255332Scy struct { 100161357Sguido char *if1; 101161357Sguido char *if2; 102161357Sguido } ifs; 103255332Scy char gname[FR_GROUPLEN]; 104145510Sdarrenr}; 105145510Sdarrenr 106145510Sdarrenr%type <port> portnum 107145510Sdarrenr%type <num> facility priority icmpcode seclevel secname icmptype 108145510Sdarrenr%type <num> opt compare range opttype flagset optlist ipv6hdrlist ipv6hdr 109255332Scy%type <num> portc porteq ipmask maskopts 110255332Scy%type <ip4> ipv4 ipv4_16 ipv4_24 111255332Scy%type <adr> hostname 112145510Sdarrenr%type <ipp> addr ipaddr 113255332Scy%type <str> servicename name interfacename groupname 114145510Sdarrenr%type <pc> portrange portcomp 115145510Sdarrenr%type <alist> addrlist poollist 116161357Sguido%type <ifs> onname 117145510Sdarrenr 118145510Sdarrenr%token <num> YY_NUMBER YY_HEX 119145510Sdarrenr%token <str> YY_STR 120145510Sdarrenr%token YY_COMMENT 121145510Sdarrenr%token YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT 122145510Sdarrenr%token YY_RANGE_OUT YY_RANGE_IN 123145510Sdarrenr%token <ip6> YY_IPV6 124145510Sdarrenr 125255332Scy%token IPFY_SET 126161357Sguido%token IPFY_PASS IPFY_BLOCK IPFY_COUNT IPFY_CALL IPFY_NOMATCH 127145510Sdarrenr%token IPFY_RETICMP IPFY_RETRST IPFY_RETICMPASDST 128145510Sdarrenr%token IPFY_IN IPFY_OUT 129145510Sdarrenr%token IPFY_QUICK IPFY_ON IPFY_OUTVIA IPFY_INVIA 130145510Sdarrenr%token IPFY_DUPTO IPFY_TO IPFY_FROUTE IPFY_REPLY_TO IPFY_ROUTETO 131255332Scy%token IPFY_TOS IPFY_TTL IPFY_PROTO IPFY_INET IPFY_INET6 132145510Sdarrenr%token IPFY_HEAD IPFY_GROUP 133145510Sdarrenr%token IPFY_AUTH IPFY_PREAUTH 134255332Scy%token IPFY_LOG IPFY_BODY IPFY_FIRST IPFY_LEVEL IPFY_ORBLOCK IPFY_L5AS 135255332Scy%token IPFY_LOGTAG IPFY_MATCHTAG IPFY_SETTAG IPFY_SKIP IPFY_DECAPS 136145510Sdarrenr%token IPFY_FROM IPFY_ALL IPFY_ANY IPFY_BPFV4 IPFY_BPFV6 IPFY_POOL IPFY_HASH 137255332Scy%token IPFY_IPFEXPR IPFY_PPS IPFY_FAMILY IPFY_DSTLIST 138145510Sdarrenr%token IPFY_ESP IPFY_AH 139145510Sdarrenr%token IPFY_WITH IPFY_AND IPFY_NOT IPFY_NO IPFY_OPT 140145510Sdarrenr%token IPFY_TCPUDP IPFY_TCP IPFY_UDP 141145510Sdarrenr%token IPFY_FLAGS IPFY_MULTICAST 142145510Sdarrenr%token IPFY_MASK IPFY_BROADCAST IPFY_NETWORK IPFY_NETMASKED IPFY_PEER 143255332Scy%token IPFY_RPC IPFY_PORT 144255332Scy%token IPFY_NOW IPFY_COMMENT IPFY_RULETTL 145145510Sdarrenr%token IPFY_ICMP IPFY_ICMPTYPE IPFY_ICMPCODE 146145510Sdarrenr%token IPFY_IPOPTS IPFY_SHORT IPFY_NAT IPFY_BADSRC IPFY_LOWTTL IPFY_FRAG 147145510Sdarrenr%token IPFY_MBCAST IPFY_BAD IPFY_BADNAT IPFY_OOW IPFY_NEWISN IPFY_NOICMPERR 148145510Sdarrenr%token IPFY_KEEP IPFY_STATE IPFY_FRAGS IPFY_LIMIT IPFY_STRICT IPFY_AGE 149255332Scy%token IPFY_SYNC IPFY_FRAGBODY IPFY_ICMPHEAD IPFY_NOLOG IPFY_LOOSE 150255332Scy%token IPFY_MAX_SRCS IPFY_MAX_PER_SRC 151145510Sdarrenr%token IPFY_IPOPT_NOP IPFY_IPOPT_RR IPFY_IPOPT_ZSU IPFY_IPOPT_MTUP 152145510Sdarrenr%token IPFY_IPOPT_MTUR IPFY_IPOPT_ENCODE IPFY_IPOPT_TS IPFY_IPOPT_TR 153145510Sdarrenr%token IPFY_IPOPT_SEC IPFY_IPOPT_LSRR IPFY_IPOPT_ESEC IPFY_IPOPT_CIPSO 154145510Sdarrenr%token IPFY_IPOPT_SATID IPFY_IPOPT_SSRR IPFY_IPOPT_ADDEXT IPFY_IPOPT_VISA 155145510Sdarrenr%token IPFY_IPOPT_IMITD IPFY_IPOPT_EIP IPFY_IPOPT_FINN IPFY_IPOPT_DPS 156145510Sdarrenr%token IPFY_IPOPT_SDB IPFY_IPOPT_NSAPA IPFY_IPOPT_RTRALRT IPFY_IPOPT_UMP 157145510Sdarrenr%token IPFY_SECCLASS IPFY_SEC_UNC IPFY_SEC_CONF IPFY_SEC_RSV1 IPFY_SEC_RSV2 158255332Scy%token IPFY_SEC_RSV4 IPFY_SEC_SEC IPFY_SEC_TS IPFY_SEC_RSV3 IPFY_DOI 159145510Sdarrenr 160255332Scy%token IPFY_V6HDRS IPFY_IPV6OPT IPFY_IPV6OPT_DSTOPTS IPFY_IPV6OPT_HOPOPTS 161255332Scy%token IPFY_IPV6OPT_IPV6 IPFY_IPV6OPT_NONE IPFY_IPV6OPT_ROUTING IPFY_V6HDR 162153881Sguido%token IPFY_IPV6OPT_MOBILITY IPFY_IPV6OPT_ESP IPFY_IPV6OPT_FRAG 163145510Sdarrenr 164145510Sdarrenr%token IPFY_ICMPT_UNR IPFY_ICMPT_ECHO IPFY_ICMPT_ECHOR IPFY_ICMPT_SQUENCH 165145510Sdarrenr%token IPFY_ICMPT_REDIR IPFY_ICMPT_TIMEX IPFY_ICMPT_PARAMP IPFY_ICMPT_TIMEST 166145510Sdarrenr%token IPFY_ICMPT_TIMESTREP IPFY_ICMPT_INFOREQ IPFY_ICMPT_INFOREP 167145510Sdarrenr%token IPFY_ICMPT_MASKREQ IPFY_ICMPT_MASKREP IPFY_ICMPT_ROUTERAD 168145510Sdarrenr%token IPFY_ICMPT_ROUTERSOL 169145510Sdarrenr 170145510Sdarrenr%token IPFY_ICMPC_NETUNR IPFY_ICMPC_HSTUNR IPFY_ICMPC_PROUNR IPFY_ICMPC_PORUNR 171145510Sdarrenr%token IPFY_ICMPC_NEEDF IPFY_ICMPC_SRCFAIL IPFY_ICMPC_NETUNK IPFY_ICMPC_HSTUNK 172145510Sdarrenr%token IPFY_ICMPC_ISOLATE IPFY_ICMPC_NETPRO IPFY_ICMPC_HSTPRO 173145510Sdarrenr%token IPFY_ICMPC_NETTOS IPFY_ICMPC_HSTTOS IPFY_ICMPC_FLTPRO IPFY_ICMPC_HSTPRE 174145510Sdarrenr%token IPFY_ICMPC_CUTPRE 175145510Sdarrenr 176145510Sdarrenr%token IPFY_FAC_KERN IPFY_FAC_USER IPFY_FAC_MAIL IPFY_FAC_DAEMON IPFY_FAC_AUTH 177145510Sdarrenr%token IPFY_FAC_SYSLOG IPFY_FAC_LPR IPFY_FAC_NEWS IPFY_FAC_UUCP IPFY_FAC_CRON 178145510Sdarrenr%token IPFY_FAC_LOCAL0 IPFY_FAC_LOCAL1 IPFY_FAC_LOCAL2 IPFY_FAC_LOCAL3 179145510Sdarrenr%token IPFY_FAC_LOCAL4 IPFY_FAC_LOCAL5 IPFY_FAC_LOCAL6 IPFY_FAC_LOCAL7 180145510Sdarrenr%token IPFY_FAC_SECURITY IPFY_FAC_FTP IPFY_FAC_AUTHPRIV IPFY_FAC_AUDIT 181145510Sdarrenr%token IPFY_FAC_LFMT IPFY_FAC_CONSOLE 182145510Sdarrenr 183145510Sdarrenr%token IPFY_PRI_EMERG IPFY_PRI_ALERT IPFY_PRI_CRIT IPFY_PRI_ERR IPFY_PRI_WARN 184145510Sdarrenr%token IPFY_PRI_NOTICE IPFY_PRI_INFO IPFY_PRI_DEBUG 185145510Sdarrenr%% 186255332Scyfile: settings rules 187255332Scy | rules 188255332Scy ; 189255332Scy 190255332Scysettings: 191255332Scy YY_COMMENT 192255332Scy | setting 193255332Scy | settings setting 194255332Scy ; 195255332Scy 196255332Scyrules: line 197145510Sdarrenr | assign 198255332Scy | rules line 199255332Scy | rules assign 200145510Sdarrenr ; 201145510Sdarrenr 202255332Scysetting: 203255332Scy IPFY_SET YY_STR YY_NUMBER ';' { do_tuneint($2, $3); } 204255332Scy | IPFY_SET YY_STR YY_HEX ';' { do_tuneint($2, $3); } 205255332Scy | IPFY_SET YY_STR YY_STR ';' { do_tunestr($2, $3); } 206255332Scy ; 207255332Scy 208170268Sdarrenrline: rule { while ((fr = frtop) != NULL) { 209145510Sdarrenr frtop = fr->fr_next; 210145510Sdarrenr fr->fr_next = NULL; 211255332Scy if ((fr->fr_type == FR_T_IPF) && 212255332Scy (fr->fr_ip.fi_v == 0)) 213255332Scy fr->fr_mip.fi_v = 0; 214255332Scy /* XXX validate ? */ 215255332Scy (*ipfaddfunc)(ipffd, ipfioctls[IPL_LOGIPF], fr); 216145510Sdarrenr fr->fr_next = frold; 217145510Sdarrenr frold = fr; 218145510Sdarrenr } 219145510Sdarrenr resetlexer(); 220145510Sdarrenr } 221145510Sdarrenr | YY_COMMENT 222145510Sdarrenr ; 223145510Sdarrenr 224161357Sguidoxx: { newrule(); } 225145510Sdarrenr ; 226145510Sdarrenr 227145510Sdarrenrassign: YY_STR assigning YY_STR ';' { set_variable($1, $3); 228145510Sdarrenr resetlexer(); 229145510Sdarrenr free($1); 230145510Sdarrenr free($3); 231170268Sdarrenr yyvarnext = 0; 232145510Sdarrenr } 233145510Sdarrenr ; 234145510Sdarrenr 235145510Sdarrenrassigning: 236145510Sdarrenr '=' { yyvarnext = 1; } 237145510Sdarrenr ; 238145510Sdarrenr 239145510Sdarrenrrule: inrule eol 240145510Sdarrenr | outrule eol 241145510Sdarrenr ; 242145510Sdarrenr 243145510Sdarrenreol: | ';' 244145510Sdarrenr ; 245145510Sdarrenr 246145510Sdarrenrinrule: 247145510Sdarrenr rulehead markin inopts rulemain ruletail intag ruletail2 248145510Sdarrenr ; 249145510Sdarrenr 250145510Sdarrenroutrule: 251145510Sdarrenr rulehead markout outopts rulemain ruletail outtag ruletail2 252145510Sdarrenr ; 253145510Sdarrenr 254145510Sdarrenrrulehead: 255170268Sdarrenr xx collection action 256170268Sdarrenr | xx insert collection action 257145510Sdarrenr ; 258145510Sdarrenr 259145510Sdarrenrmarkin: IPFY_IN { fr->fr_flags |= FR_INQUE; } 260145510Sdarrenr ; 261145510Sdarrenr 262145510Sdarrenrmarkout: 263145510Sdarrenr IPFY_OUT { fr->fr_flags |= FR_OUTQUE; } 264145510Sdarrenr ; 265145510Sdarrenr 266145510Sdarrenrrulemain: 267145510Sdarrenr ipfrule 268145510Sdarrenr | bpfrule 269255332Scy | exprrule 270145510Sdarrenr ; 271145510Sdarrenr 272145510Sdarrenripfrule: 273255332Scy family tos ttl proto ip 274145510Sdarrenr ; 275145510Sdarrenr 276255332Scyfamily: | IPFY_FAMILY IPFY_INET { if (use_inet6 == 1) { 277255332Scy YYERROR; 278255332Scy } else { 279255332Scy frc->fr_family = AF_INET; 280255332Scy } 281255332Scy } 282255332Scy | IPFY_INET { if (use_inet6 == 1) { 283255332Scy YYERROR; 284255332Scy } else { 285255332Scy frc->fr_family = AF_INET; 286255332Scy } 287255332Scy } 288255332Scy | IPFY_FAMILY IPFY_INET6 { if (use_inet6 == -1) { 289255332Scy YYERROR; 290255332Scy } else { 291255332Scy frc->fr_family = AF_INET6; 292255332Scy } 293255332Scy } 294255332Scy | IPFY_INET6 { if (use_inet6 == -1) { 295255332Scy YYERROR; 296255332Scy } else { 297255332Scy frc->fr_family = AF_INET6; 298255332Scy } 299255332Scy } 300255332Scy ; 301255332Scy 302145510Sdarrenrbpfrule: 303145510Sdarrenr IPFY_BPFV4 '{' YY_STR '}' { dobpf(4, $3); free($3); } 304145510Sdarrenr | IPFY_BPFV6 '{' YY_STR '}' { dobpf(6, $3); free($3); } 305145510Sdarrenr ; 306145510Sdarrenr 307255332Scyexprrule: 308255332Scy IPFY_IPFEXPR '{' YY_STR '}' { doipfexpr($3); } 309255332Scy ; 310255332Scy 311145510Sdarrenrruletail: 312145510Sdarrenr with keep head group 313145510Sdarrenr ; 314145510Sdarrenr 315145510Sdarrenrruletail2: 316255332Scy pps age new rulettl comment 317145510Sdarrenr ; 318145510Sdarrenr 319145510Sdarrenrintag: settagin matchtagin 320145510Sdarrenr ; 321145510Sdarrenr 322145510Sdarrenrouttag: settagout matchtagout 323145510Sdarrenr ; 324145510Sdarrenr 325145510Sdarrenrinsert: 326145510Sdarrenr '@' YY_NUMBER { fr->fr_hits = (U_QUAD_T)$2 + 1; } 327145510Sdarrenr ; 328145510Sdarrenr 329145510Sdarrenrcollection: 330145510Sdarrenr | YY_NUMBER { fr->fr_collect = $1; } 331145510Sdarrenr ; 332145510Sdarrenr 333145510Sdarrenraction: block 334145510Sdarrenr | IPFY_PASS { fr->fr_flags |= FR_PASS; } 335161357Sguido | IPFY_NOMATCH { fr->fr_flags |= FR_NOMATCH; } 336145510Sdarrenr | log 337145510Sdarrenr | IPFY_COUNT { fr->fr_flags |= FR_ACCOUNT; } 338255332Scy | decaps { fr->fr_flags |= FR_DECAPSULATE; } 339145510Sdarrenr | auth 340145510Sdarrenr | IPFY_SKIP YY_NUMBER { fr->fr_flags |= FR_SKIP; 341145510Sdarrenr fr->fr_arg = $2; } 342145510Sdarrenr | IPFY_CALL func 343145510Sdarrenr | IPFY_CALL IPFY_NOW func { fr->fr_flags |= FR_CALLNOW; } 344145510Sdarrenr ; 345145510Sdarrenr 346145510Sdarrenrblock: blocked 347145510Sdarrenr | blocked blockreturn 348145510Sdarrenr ; 349145510Sdarrenr 350145510Sdarrenrblocked: 351145510Sdarrenr IPFY_BLOCK { fr->fr_flags = FR_BLOCK; } 352145510Sdarrenr ; 353145510Sdarrenrblockreturn: 354145510Sdarrenr IPFY_RETICMP { fr->fr_flags |= FR_RETICMP; } 355145510Sdarrenr | IPFY_RETICMP returncode { fr->fr_flags |= FR_RETICMP; } 356145510Sdarrenr | IPFY_RETICMPASDST { fr->fr_flags |= FR_FAKEICMP; } 357145510Sdarrenr | IPFY_RETICMPASDST returncode { fr->fr_flags |= FR_FAKEICMP; } 358145510Sdarrenr | IPFY_RETRST { fr->fr_flags |= FR_RETRST; } 359145510Sdarrenr ; 360145510Sdarrenr 361255332Scydecaps: IPFY_DECAPS 362255332Scy | IPFY_DECAPS IPFY_L5AS '(' YY_STR ')' 363255332Scy { fr->fr_icode = atoi($4); } 364255332Scy ; 365255332Scy 366145510Sdarrenrlog: IPFY_LOG { fr->fr_flags |= FR_LOG; } 367145510Sdarrenr | IPFY_LOG logoptions { fr->fr_flags |= FR_LOG; } 368145510Sdarrenr ; 369145510Sdarrenr 370145510Sdarrenrauth: IPFY_AUTH { fr->fr_flags |= FR_AUTH; } 371161357Sguido | IPFY_AUTH blockreturn { fr->fr_flags |= FR_AUTH;} 372145510Sdarrenr | IPFY_PREAUTH { fr->fr_flags |= FR_PREAUTH; } 373145510Sdarrenr ; 374145510Sdarrenr 375255332Scyfunc: YY_STR '/' YY_NUMBER 376255332Scy { fr->fr_func = nametokva($1, ipfioctls[IPL_LOGIPF]); 377255332Scy fr->fr_arg = $3; 378255332Scy free($1); 379255332Scy } 380145510Sdarrenr ; 381145510Sdarrenr 382145510Sdarrenrinopts: 383145510Sdarrenr | inopts inopt 384145510Sdarrenr ; 385145510Sdarrenr 386145510Sdarrenrinopt: 387145510Sdarrenr logopt 388145510Sdarrenr | quick 389145510Sdarrenr | on 390145510Sdarrenr | dup 391145510Sdarrenr | froute 392145510Sdarrenr | proute 393145510Sdarrenr | replyto 394145510Sdarrenr ; 395145510Sdarrenr 396145510Sdarrenroutopts: 397145510Sdarrenr | outopts outopt 398145510Sdarrenr ; 399145510Sdarrenr 400145510Sdarrenroutopt: 401145510Sdarrenr logopt 402145510Sdarrenr | quick 403145510Sdarrenr | on 404145510Sdarrenr | dup 405145510Sdarrenr | proute 406255332Scy | froute 407145510Sdarrenr | replyto 408145510Sdarrenr ; 409145510Sdarrenr 410145510Sdarrenrtos: | settos YY_NUMBER { DOALL(fr->fr_tos = $2; fr->fr_mtos = 0xff;) } 411145510Sdarrenr | settos YY_HEX { DOALL(fr->fr_tos = $2; fr->fr_mtos = 0xff;) } 412145510Sdarrenr | settos lstart toslist lend 413145510Sdarrenr ; 414145510Sdarrenr 415145510Sdarrenrsettos: IPFY_TOS { setipftype(); } 416145510Sdarrenr ; 417145510Sdarrenr 418145510Sdarrenrtoslist: 419145510Sdarrenr YY_NUMBER { DOALL(fr->fr_tos = $1; fr->fr_mtos = 0xff;) } 420145510Sdarrenr | YY_HEX { DOREM(fr->fr_tos = $1; fr->fr_mtos = 0xff;) } 421145510Sdarrenr | toslist lmore YY_NUMBER 422145510Sdarrenr { DOREM(fr->fr_tos = $3; fr->fr_mtos = 0xff;) } 423255332Scy | toslist lmore YY_HEX 424145510Sdarrenr { DOREM(fr->fr_tos = $3; fr->fr_mtos = 0xff;) } 425145510Sdarrenr ; 426145510Sdarrenr 427145510Sdarrenrttl: | setttl YY_NUMBER 428145510Sdarrenr { DOALL(fr->fr_ttl = $2; fr->fr_mttl = 0xff;) } 429145510Sdarrenr | setttl lstart ttllist lend 430145510Sdarrenr ; 431145510Sdarrenr 432255332Scylstart: '{' { newlist = 1; fr = frc; added = 0; } 433145510Sdarrenr ; 434145510Sdarrenr 435255332Scylend: '}' { nrules += added; } 436145510Sdarrenr ; 437145510Sdarrenr 438145510Sdarrenrlmore: lanother { if (newlist == 1) { 439145510Sdarrenr newlist = 0; 440145510Sdarrenr } 441145510Sdarrenr fr = addrule(); 442145510Sdarrenr if (yycont != NULL) 443145510Sdarrenr *yycont = 1; 444145510Sdarrenr } 445145510Sdarrenr ; 446145510Sdarrenr 447145510Sdarrenrlanother: 448145510Sdarrenr | ',' 449145510Sdarrenr ; 450145510Sdarrenr 451145510Sdarrenrsetttl: IPFY_TTL { setipftype(); } 452145510Sdarrenr ; 453145510Sdarrenr 454145510Sdarrenrttllist: 455145510Sdarrenr YY_NUMBER { DOREM(fr->fr_ttl = $1; fr->fr_mttl = 0xff;) } 456145510Sdarrenr | ttllist lmore YY_NUMBER 457145510Sdarrenr { DOREM(fr->fr_ttl = $3; fr->fr_mttl = 0xff;) } 458145510Sdarrenr ; 459145510Sdarrenr 460145510Sdarrenrproto: | protox protocol { yyresetdict(); } 461145510Sdarrenr ; 462145510Sdarrenr 463145510Sdarrenrprotox: IPFY_PROTO { setipftype(); 464145510Sdarrenr fr = frc; 465145510Sdarrenr yysetdict(NULL); } 466145510Sdarrenr ; 467145510Sdarrenr 468145510Sdarrenrip: srcdst flags icmp 469145510Sdarrenr ; 470145510Sdarrenr 471255332Scygroup: | IPFY_GROUP groupname { DOALL(setgroup(&fr, $2); \ 472255332Scy fillgroup(fr);); 473255332Scy free($2); 474255332Scy } 475145510Sdarrenr ; 476145510Sdarrenr 477255332Scyhead: | IPFY_HEAD groupname { DOALL(setgrhead(&fr, $2);); 478255332Scy free($2); 479255332Scy } 480145510Sdarrenr ; 481145510Sdarrenr 482255332Scygroupname: 483255332Scy YY_STR { $$ = $1; 484255332Scy if (strlen($$) >= FR_GROUPLEN) 485255332Scy $$[FR_GROUPLEN - 1] = '\0'; 486255332Scy } 487255332Scy | YY_NUMBER { $$ = malloc(16); 488255332Scy sprintf($$, "%d", $1); 489255332Scy } 490255332Scy ; 491255332Scy 492145510Sdarrenrsettagin: 493145510Sdarrenr | IPFY_SETTAG '(' taginlist ')' 494145510Sdarrenr ; 495145510Sdarrenr 496145510Sdarrenrtaginlist: 497145510Sdarrenr taginspec 498145510Sdarrenr | taginlist ',' taginspec 499145510Sdarrenr ; 500145510Sdarrenr 501145510Sdarrenrtaginspec: 502145510Sdarrenr logtag 503145510Sdarrenr ; 504145510Sdarrenr 505145510Sdarrenrnattag: IPFY_NAT '=' YY_STR { DOALL(strncpy(fr->fr_nattag.ipt_tag,\ 506145510Sdarrenr $3, IPFTAG_LEN);); 507145510Sdarrenr free($3); } 508145510Sdarrenr | IPFY_NAT '=' YY_NUMBER { DOALL(sprintf(fr->fr_nattag.ipt_tag,\ 509145510Sdarrenr "%d", $3 & 0xffffffff);) } 510145510Sdarrenr ; 511145510Sdarrenr 512145510Sdarrenrlogtag: IPFY_LOG '=' YY_NUMBER { DOALL(fr->fr_logtag = $3;) } 513145510Sdarrenr ; 514145510Sdarrenr 515145510Sdarrenrsettagout: 516145510Sdarrenr | IPFY_SETTAG '(' tagoutlist ')' 517145510Sdarrenr ; 518145510Sdarrenr 519145510Sdarrenrtagoutlist: 520145510Sdarrenr tagoutspec 521145510Sdarrenr | tagoutlist ',' tagoutspec 522145510Sdarrenr ; 523145510Sdarrenr 524145510Sdarrenrtagoutspec: 525145510Sdarrenr logtag 526145510Sdarrenr | nattag 527145510Sdarrenr ; 528145510Sdarrenr 529145510Sdarrenrmatchtagin: 530145510Sdarrenr | IPFY_MATCHTAG '(' tagoutlist ')' 531145510Sdarrenr ; 532145510Sdarrenr 533145510Sdarrenrmatchtagout: 534145510Sdarrenr | IPFY_MATCHTAG '(' taginlist ')' 535145510Sdarrenr ; 536145510Sdarrenr 537145510Sdarrenrpps: | IPFY_PPS YY_NUMBER { DOALL(fr->fr_pps = $2;) } 538145510Sdarrenr ; 539145510Sdarrenr 540145510Sdarrenrnew: | savegroup file restoregroup 541145510Sdarrenr ; 542145510Sdarrenr 543255332Scyrulettl: 544255332Scy | IPFY_RULETTL YY_NUMBER { DOALL(fr->fr_die = $2;) } 545255332Scy ; 546255332Scy 547255332Scycomment: 548255332Scy | IPFY_COMMENT YY_STR { DOALL(fr->fr_comment = addname(&fr, \ 549255332Scy $2);) } 550255332Scy ; 551255332Scy 552145510Sdarrenrsavegroup: 553145510Sdarrenr '{' 554145510Sdarrenr ; 555145510Sdarrenr 556145510Sdarrenrrestoregroup: 557145510Sdarrenr '}' 558145510Sdarrenr ; 559145510Sdarrenr 560145510Sdarrenrlogopt: log 561145510Sdarrenr ; 562145510Sdarrenr 563255332Scyquick: IPFY_QUICK { fr->fr_flags |= FR_QUICK; } 564145510Sdarrenr ; 565145510Sdarrenr 566255332Scyon: IPFY_ON onname { setifname(&fr, 0, $2.if1); 567255332Scy free($2.if1); 568255332Scy if ($2.if2 != NULL) { 569255332Scy setifname(&fr, 1, 570255332Scy $2.if2); 571255332Scy free($2.if2); 572255332Scy } 573255332Scy } 574161357Sguido | IPFY_ON lstart onlist lend 575255332Scy | IPFY_ON onname IPFY_INVIA vianame { setifname(&fr, 0, $2.if1); 576255332Scy free($2.if1); 577255332Scy if ($2.if2 != NULL) { 578255332Scy setifname(&fr, 1, 579255332Scy $2.if2); 580255332Scy free($2.if2); 581255332Scy } 582255332Scy } 583255332Scy | IPFY_ON onname IPFY_OUTVIA vianame { setifname(&fr, 0, $2.if1); 584255332Scy free($2.if1); 585255332Scy if ($2.if2 != NULL) { 586255332Scy setifname(&fr, 1, 587255332Scy $2.if2); 588255332Scy free($2.if2); 589255332Scy } 590255332Scy } 591145510Sdarrenr ; 592145510Sdarrenr 593255332Scyonlist: onname { DOREM(setifname(&fr, 0, $1.if1); \ 594255332Scy if ($1.if2 != NULL) \ 595255332Scy setifname(&fr, 1, $1.if2); \ 596255332Scy ) 597255332Scy free($1.if1); 598255332Scy if ($1.if2 != NULL) 599255332Scy free($1.if2); 600255332Scy } 601255332Scy | onlist lmore onname { DOREM(setifname(&fr, 0, $3.if1); \ 602255332Scy if ($3.if2 != NULL) \ 603255332Scy setifname(&fr, 1, $3.if2); \ 604255332Scy ) 605255332Scy free($3.if1); 606255332Scy if ($3.if2 != NULL) 607255332Scy free($3.if2); 608255332Scy } 609161357Sguido ; 610161357Sguido 611255332Scyonname: interfacename { $$.if1 = $1; 612255332Scy $$.if2 = NULL; 613255332Scy } 614145510Sdarrenr | interfacename ',' interfacename 615255332Scy { $$.if1 = $1; 616255332Scy $$.if2 = $3; 617255332Scy } 618145510Sdarrenr ; 619145510Sdarrenr 620145510Sdarrenrvianame: 621255332Scy name { setifname(&fr, 2, $1); 622255332Scy free($1); 623255332Scy } 624255332Scy | name ',' name { setifname(&fr, 2, $1); 625255332Scy free($1); 626255332Scy setifname(&fr, 3, $3); 627255332Scy free($3); 628255332Scy } 629145510Sdarrenr ; 630145510Sdarrenr 631145510Sdarrenrdup: IPFY_DUPTO name 632255332Scy { int idx = addname(&fr, $2); 633255332Scy fr->fr_dif.fd_name = idx; 634145510Sdarrenr free($2); 635145510Sdarrenr } 636255332Scy | IPFY_DUPTO IPFY_DSTLIST '/' name 637255332Scy { int idx = addname(&fr, $4); 638255332Scy fr->fr_dif.fd_name = idx; 639255332Scy fr->fr_dif.fd_type = FRD_DSTLIST; 640255332Scy free($4); 641255332Scy } 642145510Sdarrenr | IPFY_DUPTO name duptoseparator hostname 643255332Scy { int idx = addname(&fr, $2); 644255332Scy fr->fr_dif.fd_name = idx; 645255332Scy fr->fr_dif.fd_ptr = (void *)-1; 646255332Scy fr->fr_dif.fd_ip6 = $4.adr; 647255332Scy if (fr->fr_family == AF_UNSPEC && $4.f != AF_UNSPEC) 648255332Scy fr->fr_family = $4.f; 649145510Sdarrenr yyexpectaddr = 0; 650145510Sdarrenr free($2); 651145510Sdarrenr } 652145510Sdarrenr ; 653145510Sdarrenr 654145510Sdarrenrduptoseparator: 655145510Sdarrenr ':' { yyexpectaddr = 1; yycont = &yyexpectaddr; resetaddr(); } 656145510Sdarrenr ; 657145510Sdarrenr 658145510Sdarrenrfroute: IPFY_FROUTE { fr->fr_flags |= FR_FASTROUTE; } 659145510Sdarrenr ; 660145510Sdarrenr 661145510Sdarrenrproute: routeto name 662255332Scy { int idx = addname(&fr, $2); 663255332Scy fr->fr_tif.fd_name = idx; 664145510Sdarrenr free($2); 665145510Sdarrenr } 666255332Scy | routeto IPFY_DSTLIST '/' name 667255332Scy { int idx = addname(&fr, $4); 668255332Scy fr->fr_tif.fd_name = idx; 669255332Scy fr->fr_tif.fd_type = FRD_DSTLIST; 670255332Scy free($4); 671255332Scy } 672145510Sdarrenr | routeto name duptoseparator hostname 673255332Scy { int idx = addname(&fr, $2); 674255332Scy fr->fr_tif.fd_name = idx; 675255332Scy fr->fr_tif.fd_ptr = (void *)-1; 676255332Scy fr->fr_tif.fd_ip6 = $4.adr; 677255332Scy if (fr->fr_family == AF_UNSPEC && $4.f != AF_UNSPEC) 678255332Scy fr->fr_family = $4.f; 679145510Sdarrenr yyexpectaddr = 0; 680145510Sdarrenr free($2); 681145510Sdarrenr } 682145510Sdarrenr ; 683145510Sdarrenr 684145510Sdarrenrrouteto: 685145510Sdarrenr IPFY_TO 686145510Sdarrenr | IPFY_ROUTETO 687145510Sdarrenr ; 688145510Sdarrenr 689145510Sdarrenrreplyto: 690145510Sdarrenr IPFY_REPLY_TO name 691255332Scy { int idx = addname(&fr, $2); 692255332Scy fr->fr_rif.fd_name = idx; 693145510Sdarrenr free($2); 694145510Sdarrenr } 695255332Scy | IPFY_REPLY_TO IPFY_DSTLIST '/' name 696255332Scy { fr->fr_rif.fd_name = addname(&fr, $4); 697255332Scy fr->fr_rif.fd_type = FRD_DSTLIST; 698255332Scy free($4); 699255332Scy } 700145510Sdarrenr | IPFY_REPLY_TO name duptoseparator hostname 701255332Scy { int idx = addname(&fr, $2); 702255332Scy fr->fr_rif.fd_name = idx; 703255332Scy fr->fr_rif.fd_ptr = (void *)-1; 704255332Scy fr->fr_rif.fd_ip6 = $4.adr; 705255332Scy if (fr->fr_family == AF_UNSPEC && $4.f != AF_UNSPEC) 706255332Scy fr->fr_family = $4.f; 707145510Sdarrenr free($2); 708145510Sdarrenr } 709145510Sdarrenr ; 710145510Sdarrenr 711145510Sdarrenrlogoptions: 712145510Sdarrenr logoption 713145510Sdarrenr | logoptions logoption 714145510Sdarrenr ; 715145510Sdarrenr 716145510Sdarrenrlogoption: 717145510Sdarrenr IPFY_BODY { fr->fr_flags |= FR_LOGBODY; } 718145510Sdarrenr | IPFY_FIRST { fr->fr_flags |= FR_LOGFIRST; } 719145510Sdarrenr | IPFY_ORBLOCK { fr->fr_flags |= FR_LOGORBLOCK; } 720145510Sdarrenr | level loglevel { unsetsyslog(); } 721145510Sdarrenr ; 722145510Sdarrenr 723145510Sdarrenrreturncode: 724145510Sdarrenr starticmpcode icmpcode ')' { fr->fr_icode = $2; yyresetdict(); } 725145510Sdarrenr ; 726145510Sdarrenr 727145510Sdarrenrstarticmpcode: 728145510Sdarrenr '(' { yysetdict(icmpcodewords); } 729145510Sdarrenr ; 730145510Sdarrenr 731145510Sdarrenrsrcdst: | IPFY_ALL 732145510Sdarrenr | fromto 733145510Sdarrenr ; 734145510Sdarrenr 735145510Sdarrenrprotocol: 736255332Scy YY_NUMBER { DOALL(fr->fr_proto = $1; \ 737255332Scy fr->fr_mproto = 0xff;) 738255332Scy } 739145510Sdarrenr | YY_STR { if (!strcmp($1, "tcp-udp")) { 740255332Scy DOALL(fr->fr_flx |= FI_TCPUDP; \ 741145510Sdarrenr fr->fr_mflx |= FI_TCPUDP;) 742145510Sdarrenr } else { 743145510Sdarrenr int p = getproto($1); 744145510Sdarrenr if (p == -1) 745145510Sdarrenr yyerror("protocol unknown"); 746255332Scy DOALL(fr->fr_proto = p; \ 747145510Sdarrenr fr->fr_mproto = 0xff;) 748145510Sdarrenr } 749145510Sdarrenr free($1); 750255332Scy } 751145510Sdarrenr | YY_STR nextstring YY_STR 752145510Sdarrenr { if (!strcmp($1, "tcp") && 753145510Sdarrenr !strcmp($3, "udp")) { 754145510Sdarrenr DOREM(fr->fr_flx |= FI_TCPUDP; \ 755145510Sdarrenr fr->fr_mflx |= FI_TCPUDP;) 756255332Scy } else { 757145510Sdarrenr YYERROR; 758255332Scy } 759145510Sdarrenr free($1); 760145510Sdarrenr free($3); 761145510Sdarrenr } 762145510Sdarrenr ; 763145510Sdarrenr 764145510Sdarrenrnextstring: 765145510Sdarrenr '/' { yysetdict(NULL); } 766145510Sdarrenr ; 767145510Sdarrenr 768145510Sdarrenrfromto: from srcobject to dstobject { yyexpectaddr = 0; yycont = NULL; } 769145510Sdarrenr | to dstobject { yyexpectaddr = 0; yycont = NULL; } 770145510Sdarrenr | from srcobject { yyexpectaddr = 0; yycont = NULL; } 771145510Sdarrenr ; 772145510Sdarrenr 773145510Sdarrenrfrom: IPFY_FROM { setipftype(); 774145510Sdarrenr if (fr == NULL) 775145510Sdarrenr fr = frc; 776145510Sdarrenr yyexpectaddr = 1; 777145510Sdarrenr if (yydebug) 778145510Sdarrenr printf("set yyexpectaddr\n"); 779145510Sdarrenr yycont = &yyexpectaddr; 780145510Sdarrenr yysetdict(addrwords); 781145510Sdarrenr resetaddr(); } 782145510Sdarrenr ; 783145510Sdarrenr 784145510Sdarrenrto: IPFY_TO { if (fr == NULL) 785145510Sdarrenr fr = frc; 786145510Sdarrenr yyexpectaddr = 1; 787145510Sdarrenr if (yydebug) 788145510Sdarrenr printf("set yyexpectaddr\n"); 789145510Sdarrenr yycont = &yyexpectaddr; 790145510Sdarrenr yysetdict(addrwords); 791255332Scy resetaddr(); 792255332Scy } 793145510Sdarrenr ; 794145510Sdarrenr 795145510Sdarrenrwith: | andwith withlist 796145510Sdarrenr ; 797145510Sdarrenr 798145510Sdarrenrandwith: 799145510Sdarrenr IPFY_WITH { nowith = 0; setipftype(); } 800145510Sdarrenr | IPFY_AND { nowith = 0; setipftype(); } 801145510Sdarrenr ; 802145510Sdarrenr 803255332Scyflags: | startflags flagset 804145510Sdarrenr { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = FR_TCPFMAX;) } 805145510Sdarrenr | startflags flagset '/' flagset 806145510Sdarrenr { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) } 807145510Sdarrenr | startflags '/' flagset 808145510Sdarrenr { DOALL(fr->fr_tcpf = 0; fr->fr_tcpfm = $3;) } 809145510Sdarrenr | startflags YY_NUMBER 810145510Sdarrenr { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = FR_TCPFMAX;) } 811145510Sdarrenr | startflags '/' YY_NUMBER 812145510Sdarrenr { DOALL(fr->fr_tcpf = 0; fr->fr_tcpfm = $3;) } 813145510Sdarrenr | startflags YY_NUMBER '/' YY_NUMBER 814145510Sdarrenr { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) } 815145510Sdarrenr | startflags flagset '/' YY_NUMBER 816145510Sdarrenr { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) } 817145510Sdarrenr | startflags YY_NUMBER '/' flagset 818145510Sdarrenr { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) } 819145510Sdarrenr ; 820145510Sdarrenr 821145510Sdarrenrstartflags: 822145510Sdarrenr IPFY_FLAGS { if (frc->fr_type != FR_T_IPF) 823145510Sdarrenr yyerror("flags with non-ipf type rule"); 824145510Sdarrenr if (frc->fr_proto != IPPROTO_TCP) 825145510Sdarrenr yyerror("flags with non-TCP rule"); 826145510Sdarrenr } 827145510Sdarrenr ; 828145510Sdarrenr 829145510Sdarrenrflagset: 830145510Sdarrenr YY_STR { $$ = tcpflags($1); free($1); } 831145510Sdarrenr | YY_HEX { $$ = $1; } 832145510Sdarrenr ; 833145510Sdarrenr 834145510Sdarrenrsrcobject: 835145510Sdarrenr { yyresetdict(); } fromport 836145510Sdarrenr | srcaddr srcport 837145510Sdarrenr | '!' srcaddr srcport 838145510Sdarrenr { DOALL(fr->fr_flags |= FR_NOTSRCIP;) } 839145510Sdarrenr ; 840145510Sdarrenr 841145510Sdarrenrsrcaddr: 842255332Scy addr { build_srcaddr_af(fr, &$1); } 843145510Sdarrenr | lstart srcaddrlist lend 844145510Sdarrenr ; 845145510Sdarrenr 846145510Sdarrenrsrcaddrlist: 847255332Scy addr { build_srcaddr_af(fr, &$1); } 848145510Sdarrenr | srcaddrlist lmore addr 849255332Scy { build_srcaddr_af(fr, &$3); } 850145510Sdarrenr ; 851145510Sdarrenr 852145510Sdarrenrsrcport: 853145510Sdarrenr | portcomp 854145510Sdarrenr { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1;) } 855145510Sdarrenr | portrange 856145510Sdarrenr { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1; \ 857145510Sdarrenr fr->fr_stop = $1.p2;) } 858145510Sdarrenr | porteq lstart srcportlist lend 859145510Sdarrenr { yyresetdict(); } 860145510Sdarrenr ; 861145510Sdarrenr 862145510Sdarrenrfromport: 863145510Sdarrenr portcomp 864145510Sdarrenr { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1;) } 865145510Sdarrenr | portrange 866145510Sdarrenr { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1; \ 867145510Sdarrenr fr->fr_stop = $1.p2;) } 868145510Sdarrenr | porteq lstart srcportlist lend 869145510Sdarrenr { yyresetdict(); } 870145510Sdarrenr ; 871145510Sdarrenr 872145510Sdarrenrsrcportlist: 873145510Sdarrenr portnum { DOREM(fr->fr_scmp = FR_EQUAL; fr->fr_sport = $1;) } 874255332Scy | portnum ':' portnum 875172776Sdarrenr { DOREM(fr->fr_scmp = FR_INCRANGE; fr->fr_sport = $1; \ 876172776Sdarrenr fr->fr_stop = $3;) } 877255332Scy | portnum YY_RANGE_IN portnum 878172776Sdarrenr { DOREM(fr->fr_scmp = FR_INRANGE; fr->fr_sport = $1; \ 879172776Sdarrenr fr->fr_stop = $3;) } 880145510Sdarrenr | srcportlist lmore portnum 881145510Sdarrenr { DOREM(fr->fr_scmp = FR_EQUAL; fr->fr_sport = $3;) } 882172776Sdarrenr | srcportlist lmore portnum ':' portnum 883172776Sdarrenr { DOREM(fr->fr_scmp = FR_INCRANGE; fr->fr_sport = $3; \ 884172776Sdarrenr fr->fr_stop = $5;) } 885172776Sdarrenr | srcportlist lmore portnum YY_RANGE_IN portnum 886172776Sdarrenr { DOREM(fr->fr_scmp = FR_INRANGE; fr->fr_sport = $3; \ 887172776Sdarrenr fr->fr_stop = $5;) } 888145510Sdarrenr ; 889145510Sdarrenr 890145510Sdarrenrdstobject: 891145510Sdarrenr { yyresetdict(); } toport 892145510Sdarrenr | dstaddr dstport 893145510Sdarrenr | '!' dstaddr dstport 894145510Sdarrenr { DOALL(fr->fr_flags |= FR_NOTDSTIP;) } 895145510Sdarrenr ; 896145510Sdarrenr 897145510Sdarrenrdstaddr: 898255332Scy addr { if (($1.f != AF_UNSPEC) && (frc->fr_family != AF_UNSPEC) && 899255332Scy ($1.f != frc->fr_family)) 900255332Scy yyerror("1.src/dst address family mismatch"); 901255332Scy build_dstaddr_af(fr, &$1); 902145510Sdarrenr } 903145510Sdarrenr | lstart dstaddrlist lend 904145510Sdarrenr ; 905145510Sdarrenr 906145510Sdarrenrdstaddrlist: 907255332Scy addr { if (($1.f != AF_UNSPEC) && (frc->fr_family != AF_UNSPEC) && 908255332Scy ($1.f != frc->fr_family)) 909255332Scy yyerror("2.src/dst address family mismatch"); 910255332Scy build_dstaddr_af(fr, &$1); 911145510Sdarrenr } 912145510Sdarrenr | dstaddrlist lmore addr 913255332Scy { if (($3.f != AF_UNSPEC) && (frc->fr_family != AF_UNSPEC) && 914255332Scy ($3.f != frc->fr_family)) 915255332Scy yyerror("3.src/dst address family mismatch"); 916255332Scy build_dstaddr_af(fr, &$3); 917145510Sdarrenr } 918145510Sdarrenr ; 919145510Sdarrenr 920145510Sdarrenr 921145510Sdarrenrdstport: 922145510Sdarrenr | portcomp 923145510Sdarrenr { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1;) } 924145510Sdarrenr | portrange 925145510Sdarrenr { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1; \ 926145510Sdarrenr fr->fr_dtop = $1.p2;) } 927145510Sdarrenr | porteq lstart dstportlist lend 928145510Sdarrenr { yyresetdict(); } 929145510Sdarrenr ; 930145510Sdarrenr 931145510Sdarrenrtoport: 932145510Sdarrenr portcomp 933145510Sdarrenr { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1;) } 934145510Sdarrenr | portrange 935145510Sdarrenr { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1; \ 936145510Sdarrenr fr->fr_dtop = $1.p2;) } 937145510Sdarrenr | porteq lstart dstportlist lend 938145510Sdarrenr { yyresetdict(); } 939145510Sdarrenr ; 940145510Sdarrenr 941145510Sdarrenrdstportlist: 942145510Sdarrenr portnum { DOREM(fr->fr_dcmp = FR_EQUAL; fr->fr_dport = $1;) } 943255332Scy | portnum ':' portnum 944172776Sdarrenr { DOREM(fr->fr_dcmp = FR_INCRANGE; fr->fr_dport = $1; \ 945172776Sdarrenr fr->fr_dtop = $3;) } 946255332Scy | portnum YY_RANGE_IN portnum 947172776Sdarrenr { DOREM(fr->fr_dcmp = FR_INRANGE; fr->fr_dport = $1; \ 948172776Sdarrenr fr->fr_dtop = $3;) } 949145510Sdarrenr | dstportlist lmore portnum 950145510Sdarrenr { DOREM(fr->fr_dcmp = FR_EQUAL; fr->fr_dport = $3;) } 951172776Sdarrenr | dstportlist lmore portnum ':' portnum 952172776Sdarrenr { DOREM(fr->fr_dcmp = FR_INCRANGE; fr->fr_dport = $3; \ 953172776Sdarrenr fr->fr_dtop = $5;) } 954172776Sdarrenr | dstportlist lmore portnum YY_RANGE_IN portnum 955172776Sdarrenr { DOREM(fr->fr_dcmp = FR_INRANGE; fr->fr_dport = $3; \ 956172776Sdarrenr fr->fr_dtop = $5;) } 957145510Sdarrenr ; 958145510Sdarrenr 959145510Sdarrenraddr: pool '/' YY_NUMBER { pooled = 1; 960255332Scy yyexpectaddr = 0; 961255332Scy $$.type = FRI_LOOKUP; 962255332Scy $$.v = 0; 963255332Scy $$.ifpos = -1; 964255332Scy $$.f = AF_UNSPEC; 965145510Sdarrenr $$.a.iplookuptype = IPLT_POOL; 966170268Sdarrenr $$.a.iplookupsubtype = 0; 967145510Sdarrenr $$.a.iplookupnum = $3; } 968170268Sdarrenr | pool '/' YY_STR { pooled = 1; 969255332Scy $$.ifpos = -1; 970255332Scy $$.f = AF_UNSPEC; 971255332Scy $$.type = FRI_LOOKUP; 972170268Sdarrenr $$.a.iplookuptype = IPLT_POOL; 973170268Sdarrenr $$.a.iplookupsubtype = 1; 974255332Scy $$.a.iplookupname = addname(&fr, $3); 975170268Sdarrenr } 976255332Scy | pool '=' '(' { yyexpectaddr = 1; 977255332Scy pooled = 1; 978255332Scy } 979255332Scy poollist ')' { yyexpectaddr = 0; 980255332Scy $$.v = 0; 981255332Scy $$.ifpos = -1; 982255332Scy $$.f = AF_UNSPEC; 983255332Scy $$.type = FRI_LOOKUP; 984145510Sdarrenr $$.a.iplookuptype = IPLT_POOL; 985170268Sdarrenr $$.a.iplookupsubtype = 0; 986255332Scy $$.a.iplookupnum = makepool($5); 987255332Scy } 988145510Sdarrenr | hash '/' YY_NUMBER { hashed = 1; 989255332Scy yyexpectaddr = 0; 990255332Scy $$.v = 0; 991255332Scy $$.ifpos = -1; 992255332Scy $$.f = AF_UNSPEC; 993255332Scy $$.type = FRI_LOOKUP; 994145510Sdarrenr $$.a.iplookuptype = IPLT_HASH; 995170268Sdarrenr $$.a.iplookupsubtype = 0; 996255332Scy $$.a.iplookupnum = $3; 997255332Scy } 998255332Scy | hash '/' YY_STR { hashed = 1; 999255332Scy $$.type = FRI_LOOKUP; 1000255332Scy $$.v = 0; 1001255332Scy $$.ifpos = -1; 1002255332Scy $$.f = AF_UNSPEC; 1003170268Sdarrenr $$.a.iplookuptype = IPLT_HASH; 1004170268Sdarrenr $$.a.iplookupsubtype = 1; 1005255332Scy $$.a.iplookupname = addname(&fr, $3); 1006170268Sdarrenr } 1007255332Scy | hash '=' '(' { hashed = 1; 1008255332Scy yyexpectaddr = 1; 1009255332Scy } 1010255332Scy addrlist ')' { yyexpectaddr = 0; 1011255332Scy $$.v = 0; 1012255332Scy $$.ifpos = -1; 1013255332Scy $$.f = AF_UNSPEC; 1014255332Scy $$.type = FRI_LOOKUP; 1015145510Sdarrenr $$.a.iplookuptype = IPLT_HASH; 1016170268Sdarrenr $$.a.iplookupsubtype = 0; 1017255332Scy $$.a.iplookupnum = makehash($5); 1018255332Scy } 1019255332Scy | ipaddr { $$ = $1; 1020145510Sdarrenr yyexpectaddr = 0; } 1021145510Sdarrenr ; 1022145510Sdarrenr 1023145510Sdarrenripaddr: IPFY_ANY { bzero(&($$), sizeof($$)); 1024255332Scy $$.type = FRI_NORMAL; 1025255332Scy $$.ifpos = -1; 1026255332Scy yyexpectaddr = 0; 1027255332Scy } 1028255332Scy | hostname { $$.a = $1.adr; 1029255332Scy $$.f = $1.f; 1030255332Scy if ($1.f == AF_INET6) 1031255332Scy fill6bits(128, $$.m.i6); 1032255332Scy else if ($1.f == AF_INET) 1033255332Scy fill6bits(32, $$.m.i6); 1034255332Scy $$.v = ftov($1.f); 1035255332Scy $$.ifpos = dynamic; 1036255332Scy $$.type = FRI_NORMAL; 1037255332Scy } 1038255332Scy | hostname { yyresetdict(); } 1039255332Scy maskspace { yysetdict(maskwords); 1040255332Scy yyexpectaddr = 2; } 1041255332Scy ipmask { ntomask($1.f, $5, $$.m.i6); 1042255332Scy $$.a = $1.adr; 1043255332Scy $$.a.i6[0] &= $$.m.i6[0]; 1044255332Scy $$.a.i6[1] &= $$.m.i6[1]; 1045255332Scy $$.a.i6[2] &= $$.m.i6[2]; 1046255332Scy $$.a.i6[3] &= $$.m.i6[3]; 1047255332Scy $$.f = $1.f; 1048255332Scy $$.v = ftov($1.f); 1049255332Scy $$.type = ifpflag; 1050255332Scy $$.ifpos = dynamic; 1051255332Scy if (ifpflag != 0 && $$.v == 0) { 1052255332Scy if (frc->fr_family == AF_INET6){ 1053255332Scy $$.v = 6; 1054255332Scy $$.f = AF_INET6; 1055255332Scy } else { 1056255332Scy $$.v = 4; 1057255332Scy $$.f = AF_INET; 1058255332Scy } 1059255332Scy } 1060145510Sdarrenr yyresetdict(); 1061255332Scy yyexpectaddr = 0; 1062255332Scy } 1063255332Scy | '(' YY_STR ')' { $$.type = FRI_DYNAMIC; 1064255332Scy ifpflag = FRI_DYNAMIC; 1065255332Scy $$.ifpos = addname(&fr, $2); 1066255332Scy $$.lif = 0; 1067255332Scy } 1068255332Scy | '(' YY_STR ')' '/' 1069255332Scy { ifpflag = FRI_DYNAMIC; yysetdict(maskwords); } 1070255332Scy maskopts 1071255332Scy { $$.type = ifpflag; 1072255332Scy $$.ifpos = addname(&fr, $2); 1073255332Scy $$.lif = 0; 1074255332Scy if (frc->fr_family == AF_UNSPEC) 1075255332Scy frc->fr_family = AF_INET; 1076255332Scy if (ifpflag == FRI_DYNAMIC) { 1077255332Scy ntomask(frc->fr_family, 1078255332Scy $6, $$.m.i6); 1079255332Scy } 1080145510Sdarrenr yyresetdict(); 1081255332Scy yyexpectaddr = 0; 1082255332Scy } 1083255332Scy | '(' YY_STR ':' YY_NUMBER ')' '/' 1084255332Scy { ifpflag = FRI_DYNAMIC; yysetdict(maskwords); } 1085255332Scy maskopts 1086255332Scy { $$.type = ifpflag; 1087255332Scy $$.ifpos = addname(&fr, $2); 1088255332Scy $$.lif = $4; 1089255332Scy if (frc->fr_family == AF_UNSPEC) 1090255332Scy frc->fr_family = AF_INET; 1091255332Scy if (ifpflag == FRI_DYNAMIC) { 1092255332Scy ntomask(frc->fr_family, 1093255332Scy $8, $$.m.i6); 1094255332Scy } 1095145510Sdarrenr yyresetdict(); 1096255332Scy yyexpectaddr = 0; 1097255332Scy } 1098145510Sdarrenr ; 1099255332Scy 1100145510Sdarrenrmaskspace: 1101145510Sdarrenr '/' 1102145510Sdarrenr | IPFY_MASK 1103145510Sdarrenr ; 1104145510Sdarrenr 1105255332Scyipmask: ipv4 { $$ = count4bits($1.s_addr); } 1106255332Scy | YY_HEX { $$ = count4bits(htonl($1)); } 1107255332Scy | YY_NUMBER { $$ = $1; } 1108255332Scy | YY_IPV6 { $$ = count6bits($1.i6); } 1109255332Scy | maskopts { $$ = $1; } 1110255332Scy ; 1111255332Scy 1112255332Scymaskopts: 1113255332Scy IPFY_BROADCAST { if (ifpflag == FRI_DYNAMIC) { 1114145510Sdarrenr ifpflag = FRI_BROADCAST; 1115255332Scy } else { 1116145510Sdarrenr YYERROR; 1117255332Scy } 1118255332Scy $$ = 0; 1119145510Sdarrenr } 1120145510Sdarrenr | IPFY_NETWORK { if (ifpflag == FRI_DYNAMIC) { 1121145510Sdarrenr ifpflag = FRI_NETWORK; 1122255332Scy } else { 1123145510Sdarrenr YYERROR; 1124255332Scy } 1125255332Scy $$ = 0; 1126145510Sdarrenr } 1127145510Sdarrenr | IPFY_NETMASKED { if (ifpflag == FRI_DYNAMIC) { 1128145510Sdarrenr ifpflag = FRI_NETMASKED; 1129255332Scy } else { 1130145510Sdarrenr YYERROR; 1131255332Scy } 1132255332Scy $$ = 0; 1133145510Sdarrenr } 1134145510Sdarrenr | IPFY_PEER { if (ifpflag == FRI_DYNAMIC) { 1135145510Sdarrenr ifpflag = FRI_PEERADDR; 1136255332Scy } else { 1137145510Sdarrenr YYERROR; 1138255332Scy } 1139255332Scy $$ = 0; 1140145510Sdarrenr } 1141255332Scy | YY_NUMBER { $$ = $1; } 1142145510Sdarrenr ; 1143145510Sdarrenr 1144255332Scyhostname: 1145255332Scy ipv4 { $$.adr.in4 = $1; 1146255332Scy if (frc->fr_family == AF_INET6) 1147145510Sdarrenr YYERROR; 1148255332Scy $$.f = AF_INET; 1149255332Scy yyexpectaddr = 2; 1150145510Sdarrenr } 1151255332Scy | YY_NUMBER { if (frc->fr_family == AF_INET6) 1152145510Sdarrenr YYERROR; 1153255332Scy $$.adr.in4_addr = $1; 1154255332Scy $$.f = AF_INET; 1155255332Scy yyexpectaddr = 2; 1156145510Sdarrenr } 1157255332Scy | YY_HEX { if (frc->fr_family == AF_INET6) 1158145510Sdarrenr YYERROR; 1159255332Scy $$.adr.in4_addr = $1; 1160255332Scy $$.f = AF_INET; 1161255332Scy yyexpectaddr = 2; 1162145510Sdarrenr } 1163255332Scy | YY_STR { if (lookuphost($1, &$$.adr) == 0) 1164255332Scy $$.f = AF_INET; 1165255332Scy free($1); 1166255332Scy yyexpectaddr = 2; 1167255332Scy } 1168255332Scy | YY_IPV6 { if (frc->fr_family == AF_INET) 1169145510Sdarrenr YYERROR; 1170255332Scy $$.adr = $1; 1171255332Scy $$.f = AF_INET6; 1172255332Scy yyexpectaddr = 2; 1173145510Sdarrenr } 1174145510Sdarrenr ; 1175145510Sdarrenr 1176145510Sdarrenraddrlist: 1177145510Sdarrenr ipaddr { $$ = newalist(NULL); 1178255332Scy $$->al_family = $1.f; 1179255332Scy $$->al_i6addr = $1.a; 1180255332Scy $$->al_i6mask = $1.m; 1181255332Scy } 1182255332Scy | ipaddr ',' { yyexpectaddr = 1; } addrlist 1183255332Scy { $$ = newalist($4); 1184255332Scy $$->al_family = $1.f; 1185255332Scy $$->al_i6addr = $1.a; 1186255332Scy $$->al_i6mask = $1.m; 1187255332Scy } 1188145510Sdarrenr ; 1189145510Sdarrenr 1190145510Sdarrenrpool: IPFY_POOL { yyexpectaddr = 0; yycont = NULL; yyresetdict(); } 1191145510Sdarrenr ; 1192145510Sdarrenr 1193145510Sdarrenrhash: IPFY_HASH { yyexpectaddr = 0; yycont = NULL; yyresetdict(); } 1194145510Sdarrenr ; 1195145510Sdarrenr 1196145510Sdarrenrpoollist: 1197145510Sdarrenr ipaddr { $$ = newalist(NULL); 1198255332Scy $$->al_family = $1.f; 1199255332Scy $$->al_i6addr = $1.a; 1200255332Scy $$->al_i6mask = $1.m; 1201255332Scy } 1202145510Sdarrenr | '!' ipaddr { $$ = newalist(NULL); 1203145510Sdarrenr $$->al_not = 1; 1204255332Scy $$->al_family = $2.f; 1205255332Scy $$->al_i6addr = $2.a; 1206255332Scy $$->al_i6mask = $2.m; 1207255332Scy } 1208145510Sdarrenr | poollist ',' ipaddr 1209145510Sdarrenr { $$ = newalist($1); 1210255332Scy $$->al_family = $3.f; 1211255332Scy $$->al_i6addr = $3.a; 1212255332Scy $$->al_i6mask = $3.m; 1213255332Scy } 1214145510Sdarrenr | poollist ',' '!' ipaddr 1215145510Sdarrenr { $$ = newalist($1); 1216145510Sdarrenr $$->al_not = 1; 1217255332Scy $$->al_family = $4.f; 1218255332Scy $$->al_i6addr = $4.a; 1219255332Scy $$->al_i6mask = $4.m; 1220255332Scy } 1221145510Sdarrenr ; 1222145510Sdarrenr 1223145510Sdarrenrport: IPFY_PORT { yyexpectaddr = 0; 1224145510Sdarrenr yycont = NULL; 1225255332Scy if (frc->fr_proto != 0 && 1226255332Scy frc->fr_proto != IPPROTO_UDP && 1227255332Scy frc->fr_proto != IPPROTO_TCP) 1228255332Scy yyerror("port use incorrect"); 1229145510Sdarrenr } 1230145510Sdarrenr ; 1231145510Sdarrenr 1232145510Sdarrenrportc: port compare { $$ = $2; 1233255332Scy yysetdict(NULL); 1234255332Scy } 1235145510Sdarrenr | porteq { $$ = $1; } 1236145510Sdarrenr ; 1237145510Sdarrenr 1238145510Sdarrenrporteq: port '=' { $$ = FR_EQUAL; 1239255332Scy yysetdict(NULL); 1240255332Scy } 1241145510Sdarrenr ; 1242145510Sdarrenr 1243145510Sdarrenrportr: IPFY_PORT { yyexpectaddr = 0; 1244145510Sdarrenr yycont = NULL; 1245255332Scy yysetdict(NULL); 1246255332Scy } 1247145510Sdarrenr ; 1248145510Sdarrenr 1249145510Sdarrenrportcomp: 1250145510Sdarrenr portc portnum { $$.pc = $1; 1251145510Sdarrenr $$.p1 = $2; 1252255332Scy yyresetdict(); 1253255332Scy } 1254145510Sdarrenr ; 1255145510Sdarrenr 1256145510Sdarrenrportrange: 1257145510Sdarrenr portr portnum range portnum { $$.p1 = $2; 1258145510Sdarrenr $$.pc = $3; 1259145510Sdarrenr $$.p2 = $4; 1260255332Scy yyresetdict(); 1261255332Scy } 1262145510Sdarrenr ; 1263145510Sdarrenr 1264145510Sdarrenricmp: | itype icode 1265145510Sdarrenr ; 1266145510Sdarrenr 1267145510Sdarrenritype: seticmptype icmptype 1268145510Sdarrenr { DOALL(fr->fr_icmp = htons($2 << 8); fr->fr_icmpm = htons(0xff00);); 1269145510Sdarrenr yyresetdict(); 1270145510Sdarrenr } 1271145510Sdarrenr | seticmptype lstart typelist lend { yyresetdict(); } 1272145510Sdarrenr ; 1273145510Sdarrenr 1274145510Sdarrenrseticmptype: 1275255332Scy IPFY_ICMPTYPE { if (frc->fr_family == AF_UNSPEC) 1276255332Scy frc->fr_family = AF_INET; 1277255332Scy if (frc->fr_family == AF_INET && 1278255332Scy frc->fr_type == FR_T_IPF && 1279255332Scy frc->fr_proto != IPPROTO_ICMP) { 1280255332Scy yyerror("proto not icmp"); 1281255332Scy } 1282255332Scy if (frc->fr_family == AF_INET6 && 1283255332Scy frc->fr_type == FR_T_IPF && 1284255332Scy frc->fr_proto != IPPROTO_ICMPV6) { 1285255332Scy yyerror("proto not ipv6-icmp"); 1286255332Scy } 1287255332Scy setipftype(); 1288255332Scy DOALL(if (fr->fr_family == AF_INET) { \ 1289255332Scy fr->fr_ip.fi_v = 4; \ 1290255332Scy fr->fr_mip.fi_v = 0xf; \ 1291255332Scy } 1292255332Scy if (fr->fr_family == AF_INET6) { \ 1293255332Scy fr->fr_ip.fi_v = 6; \ 1294255332Scy fr->fr_mip.fi_v = 0xf; \ 1295255332Scy } 1296255332Scy ) 1297255332Scy yysetdict(NULL); 1298255332Scy } 1299145510Sdarrenr ; 1300145510Sdarrenr 1301145510Sdarrenricode: | seticmpcode icmpcode 1302145510Sdarrenr { DOALL(fr->fr_icmp |= htons($2); fr->fr_icmpm |= htons(0xff);); 1303145510Sdarrenr yyresetdict(); 1304145510Sdarrenr } 1305145510Sdarrenr | seticmpcode lstart codelist lend { yyresetdict(); } 1306145510Sdarrenr ; 1307145510Sdarrenr 1308145510Sdarrenrseticmpcode: 1309145510Sdarrenr IPFY_ICMPCODE { yysetdict(icmpcodewords); } 1310145510Sdarrenr ; 1311145510Sdarrenr 1312145510Sdarrenrtypelist: 1313145510Sdarrenr icmptype 1314145510Sdarrenr { DOREM(fr->fr_icmp = htons($1 << 8); fr->fr_icmpm = htons(0xff00);) } 1315145510Sdarrenr | typelist lmore icmptype 1316145510Sdarrenr { DOREM(fr->fr_icmp = htons($3 << 8); fr->fr_icmpm = htons(0xff00);) } 1317145510Sdarrenr ; 1318145510Sdarrenr 1319145510Sdarrenrcodelist: 1320145510Sdarrenr icmpcode 1321145510Sdarrenr { DOREM(fr->fr_icmp |= htons($1); fr->fr_icmpm |= htons(0xff);) } 1322145510Sdarrenr | codelist lmore icmpcode 1323161357Sguido { DOREM(fr->fr_icmp &= htons(0xff00); fr->fr_icmp |= htons($3); \ 1324161357Sguido fr->fr_icmpm |= htons(0xff);) } 1325145510Sdarrenr ; 1326145510Sdarrenr 1327145510Sdarrenrage: | IPFY_AGE YY_NUMBER { DOALL(fr->fr_age[0] = $2; \ 1328145510Sdarrenr fr->fr_age[1] = $2;) } 1329145510Sdarrenr | IPFY_AGE YY_NUMBER '/' YY_NUMBER 1330145510Sdarrenr { DOALL(fr->fr_age[0] = $2; \ 1331145510Sdarrenr fr->fr_age[1] = $4;) } 1332145510Sdarrenr ; 1333145510Sdarrenr 1334145510Sdarrenrkeep: | IPFY_KEEP keepstate keep 1335145510Sdarrenr | IPFY_KEEP keepfrag keep 1336145510Sdarrenr ; 1337145510Sdarrenr 1338145510Sdarrenrkeepstate: 1339145510Sdarrenr IPFY_STATE stateoptlist { DOALL(fr->fr_flags |= FR_KEEPSTATE;)} 1340145510Sdarrenr ; 1341145510Sdarrenr 1342145510Sdarrenrkeepfrag: 1343145510Sdarrenr IPFY_FRAGS fragoptlist { DOALL(fr->fr_flags |= FR_KEEPFRAG;) } 1344145510Sdarrenr | IPFY_FRAG fragoptlist { DOALL(fr->fr_flags |= FR_KEEPFRAG;) } 1345145510Sdarrenr ; 1346145510Sdarrenr 1347145510Sdarrenrfragoptlist: 1348145510Sdarrenr | '(' fragopts ')' 1349145510Sdarrenr ; 1350145510Sdarrenr 1351145510Sdarrenrfragopts: 1352145510Sdarrenr fragopt lanother fragopts 1353145510Sdarrenr | fragopt 1354145510Sdarrenr ; 1355145510Sdarrenr 1356145510Sdarrenrfragopt: 1357145510Sdarrenr IPFY_STRICT { DOALL(fr->fr_flags |= FR_FRSTRICT;) } 1358145510Sdarrenr ; 1359145510Sdarrenr 1360145510Sdarrenrstateoptlist: 1361145510Sdarrenr | '(' stateopts ')' 1362145510Sdarrenr ; 1363145510Sdarrenr 1364145510Sdarrenrstateopts: 1365145510Sdarrenr stateopt lanother stateopts 1366145510Sdarrenr | stateopt 1367145510Sdarrenr ; 1368145510Sdarrenr 1369145510Sdarrenrstateopt: 1370145510Sdarrenr IPFY_LIMIT YY_NUMBER { DOALL(fr->fr_statemax = $2;) } 1371145510Sdarrenr | IPFY_STRICT { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \ 1372145510Sdarrenr YYERROR; \ 1373255332Scy } else if (fr->fr_flags & FR_STLOOSE) {\ 1374255332Scy YYERROR; \ 1375255332Scy } else \ 1376145510Sdarrenr fr->fr_flags |= FR_STSTRICT;) 1377145510Sdarrenr } 1378255332Scy | IPFY_LOOSE { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \ 1379255332Scy YYERROR; \ 1380255332Scy } else if (fr->fr_flags & FR_STSTRICT){\ 1381255332Scy YYERROR; \ 1382255332Scy } else \ 1383255332Scy fr->fr_flags |= FR_STLOOSE;) 1384255332Scy } 1385145510Sdarrenr | IPFY_NEWISN { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \ 1386145510Sdarrenr YYERROR; \ 1387145510Sdarrenr } else \ 1388145510Sdarrenr fr->fr_flags |= FR_NEWISN;) 1389145510Sdarrenr } 1390145510Sdarrenr | IPFY_NOICMPERR { DOALL(fr->fr_flags |= FR_NOICMPERR;) } 1391145510Sdarrenr 1392145510Sdarrenr | IPFY_SYNC { DOALL(fr->fr_flags |= FR_STATESYNC;) } 1393161357Sguido | IPFY_AGE YY_NUMBER { DOALL(fr->fr_age[0] = $2; \ 1394161357Sguido fr->fr_age[1] = $2;) } 1395161357Sguido | IPFY_AGE YY_NUMBER '/' YY_NUMBER 1396161357Sguido { DOALL(fr->fr_age[0] = $2; \ 1397161357Sguido fr->fr_age[1] = $4;) } 1398255332Scy | IPFY_ICMPHEAD groupname 1399255332Scy { DOALL(seticmphead(&fr, $2);) 1400255332Scy free($2); 1401255332Scy } 1402255332Scy | IPFY_NOLOG 1403255332Scy { DOALL(fr->fr_nostatelog = 1;) } 1404255332Scy | IPFY_RPC 1405255332Scy { DOALL(fr->fr_rpc = 1;) } 1406255332Scy | IPFY_RPC IPFY_IN YY_STR 1407255332Scy { DOALL(fr->fr_rpc = 1;) } 1408255332Scy | IPFY_MAX_SRCS YY_NUMBER 1409255332Scy { DOALL(fr->fr_srctrack.ht_max_nodes = $2;) } 1410255332Scy | IPFY_MAX_PER_SRC YY_NUMBER 1411255332Scy { DOALL(fr->fr_srctrack.ht_max_per_node = $2; \ 1412255332Scy fr->fr_srctrack.ht_netmask = \ 1413255332Scy fr->fr_family == AF_INET ? 32: 128;) 1414255332Scy } 1415255332Scy | IPFY_MAX_PER_SRC YY_NUMBER '/' YY_NUMBER 1416255332Scy { DOALL(fr->fr_srctrack.ht_max_per_node = $2; \ 1417255332Scy fr->fr_srctrack.ht_netmask = $4;) 1418255332Scy } 1419145510Sdarrenr ; 1420145510Sdarrenr 1421145510Sdarrenrportnum: 1422255332Scy servicename { if (getport(frc, $1, 1423255332Scy &($$), NULL) == -1) 1424145510Sdarrenr yyerror("service unknown"); 1425145510Sdarrenr $$ = ntohs($$); 1426145510Sdarrenr free($1); 1427145510Sdarrenr } 1428145510Sdarrenr | YY_NUMBER { if ($1 > 65535) /* Unsigned */ 1429145510Sdarrenr yyerror("invalid port number"); 1430145510Sdarrenr else 1431145510Sdarrenr $$ = $1; 1432145510Sdarrenr } 1433145510Sdarrenr ; 1434145510Sdarrenr 1435145510Sdarrenrwithlist: 1436153881Sguido withopt { nowith = 0; } 1437153881Sguido | withlist withopt { nowith = 0; } 1438153881Sguido | withlist ',' withopt { nowith = 0; } 1439145510Sdarrenr ; 1440145510Sdarrenr 1441145510Sdarrenrwithopt: 1442145510Sdarrenr opttype { DOALL(fr->fr_flx |= $1; fr->fr_mflx |= $1;) } 1443153881Sguido | notwith opttype { DOALL(fr->fr_mflx |= $2;) } 1444145510Sdarrenr | ipopt ipopts { yyresetdict(); } 1445145510Sdarrenr | notwith ipopt ipopts { yyresetdict(); } 1446255332Scy | startv6hdr ipv6hdrs { yyresetdict(); } 1447145510Sdarrenr ; 1448145510Sdarrenr 1449145510Sdarrenripopt: IPFY_OPT { yysetdict(ipv4optwords); } 1450145510Sdarrenr ; 1451145510Sdarrenr 1452255332Scystartv6hdr: 1453255332Scy IPFY_V6HDR { if (frc->fr_family != AF_INET6) 1454145510Sdarrenr yyerror("only available with IPv6"); 1455145510Sdarrenr yysetdict(ipv6optwords); 1456145510Sdarrenr } 1457145510Sdarrenr ; 1458145510Sdarrenr 1459145510Sdarrenrnotwith: 1460145510Sdarrenr IPFY_NOT { nowith = 1; } 1461145510Sdarrenr | IPFY_NO { nowith = 1; } 1462145510Sdarrenr ; 1463145510Sdarrenr 1464145510Sdarrenropttype: 1465145510Sdarrenr IPFY_IPOPTS { $$ = FI_OPTIONS; } 1466145510Sdarrenr | IPFY_SHORT { $$ = FI_SHORT; } 1467145510Sdarrenr | IPFY_NAT { $$ = FI_NATED; } 1468145510Sdarrenr | IPFY_BAD { $$ = FI_BAD; } 1469145510Sdarrenr | IPFY_BADNAT { $$ = FI_BADNAT; } 1470145510Sdarrenr | IPFY_BADSRC { $$ = FI_BADSRC; } 1471145510Sdarrenr | IPFY_LOWTTL { $$ = FI_LOWTTL; } 1472145510Sdarrenr | IPFY_FRAG { $$ = FI_FRAG; } 1473145510Sdarrenr | IPFY_FRAGBODY { $$ = FI_FRAGBODY; } 1474145510Sdarrenr | IPFY_FRAGS { $$ = FI_FRAG; } 1475145510Sdarrenr | IPFY_MBCAST { $$ = FI_MBCAST; } 1476145510Sdarrenr | IPFY_MULTICAST { $$ = FI_MULTICAST; } 1477145510Sdarrenr | IPFY_BROADCAST { $$ = FI_BROADCAST; } 1478145510Sdarrenr | IPFY_STATE { $$ = FI_STATE; } 1479145510Sdarrenr | IPFY_OOW { $$ = FI_OOW; } 1480255332Scy | IPFY_AH { $$ = FI_AH; } 1481255332Scy | IPFY_V6HDRS { $$ = FI_V6EXTHDR; } 1482145510Sdarrenr ; 1483145510Sdarrenr 1484145510Sdarrenripopts: optlist { DOALL(fr->fr_mip.fi_optmsk |= $1; 1485255332Scy if (fr->fr_family == AF_UNSPEC) { 1486255332Scy fr->fr_family = AF_INET; 1487255332Scy fr->fr_ip.fi_v = 4; 1488255332Scy fr->fr_mip.fi_v = 0xf; 1489255332Scy } else if (fr->fr_family != AF_INET) { 1490255332Scy YYERROR; 1491255332Scy } 1492145510Sdarrenr if (!nowith) 1493145510Sdarrenr fr->fr_ip.fi_optmsk |= $1;) 1494145510Sdarrenr } 1495145510Sdarrenr ; 1496145510Sdarrenr 1497145510Sdarrenroptlist: 1498145510Sdarrenr opt { $$ |= $1; } 1499145510Sdarrenr | optlist ',' opt { $$ |= $1 | $3; } 1500145510Sdarrenr ; 1501145510Sdarrenr 1502145510Sdarrenripv6hdrs: 1503145510Sdarrenr ipv6hdrlist { DOALL(fr->fr_mip.fi_optmsk |= $1; 1504145510Sdarrenr if (!nowith) 1505145510Sdarrenr fr->fr_ip.fi_optmsk |= $1;) 1506145510Sdarrenr } 1507145510Sdarrenr ; 1508145510Sdarrenr 1509145510Sdarrenripv6hdrlist: 1510145510Sdarrenr ipv6hdr { $$ |= $1; } 1511145510Sdarrenr | ipv6hdrlist ',' ipv6hdr { $$ |= $1 | $3; } 1512145510Sdarrenr ; 1513145510Sdarrenr 1514145510Sdarrenrsecname: 1515145510Sdarrenr seclevel { $$ |= $1; } 1516145510Sdarrenr | secname ',' seclevel { $$ |= $1 | $3; } 1517145510Sdarrenr ; 1518145510Sdarrenr 1519145510Sdarrenrseclevel: 1520145510Sdarrenr IPFY_SEC_UNC { $$ = secbit(IPSO_CLASS_UNCL); } 1521145510Sdarrenr | IPFY_SEC_CONF { $$ = secbit(IPSO_CLASS_CONF); } 1522145510Sdarrenr | IPFY_SEC_RSV1 { $$ = secbit(IPSO_CLASS_RES1); } 1523145510Sdarrenr | IPFY_SEC_RSV2 { $$ = secbit(IPSO_CLASS_RES2); } 1524145510Sdarrenr | IPFY_SEC_RSV3 { $$ = secbit(IPSO_CLASS_RES3); } 1525145510Sdarrenr | IPFY_SEC_RSV4 { $$ = secbit(IPSO_CLASS_RES4); } 1526145510Sdarrenr | IPFY_SEC_SEC { $$ = secbit(IPSO_CLASS_SECR); } 1527145510Sdarrenr | IPFY_SEC_TS { $$ = secbit(IPSO_CLASS_TOPS); } 1528145510Sdarrenr ; 1529145510Sdarrenr 1530145510Sdarrenricmptype: 1531255332Scy YY_NUMBER { $$ = $1; } 1532255332Scy | YY_STR { $$ = geticmptype(frc->fr_family, $1); 1533255332Scy if ($$ == -1) 1534255332Scy yyerror("unrecognised icmp type"); 1535255332Scy } 1536145510Sdarrenr ; 1537145510Sdarrenr 1538145510Sdarrenricmpcode: 1539145510Sdarrenr YY_NUMBER { $$ = $1; } 1540145510Sdarrenr | IPFY_ICMPC_NETUNR { $$ = ICMP_UNREACH_NET; } 1541145510Sdarrenr | IPFY_ICMPC_HSTUNR { $$ = ICMP_UNREACH_HOST; } 1542145510Sdarrenr | IPFY_ICMPC_PROUNR { $$ = ICMP_UNREACH_PROTOCOL; } 1543145510Sdarrenr | IPFY_ICMPC_PORUNR { $$ = ICMP_UNREACH_PORT; } 1544145510Sdarrenr | IPFY_ICMPC_NEEDF { $$ = ICMP_UNREACH_NEEDFRAG; } 1545145510Sdarrenr | IPFY_ICMPC_SRCFAIL { $$ = ICMP_UNREACH_SRCFAIL; } 1546145510Sdarrenr | IPFY_ICMPC_NETUNK { $$ = ICMP_UNREACH_NET_UNKNOWN; } 1547145510Sdarrenr | IPFY_ICMPC_HSTUNK { $$ = ICMP_UNREACH_HOST_UNKNOWN; } 1548145510Sdarrenr | IPFY_ICMPC_ISOLATE { $$ = ICMP_UNREACH_ISOLATED; } 1549145510Sdarrenr | IPFY_ICMPC_NETPRO { $$ = ICMP_UNREACH_NET_PROHIB; } 1550145510Sdarrenr | IPFY_ICMPC_HSTPRO { $$ = ICMP_UNREACH_HOST_PROHIB; } 1551145510Sdarrenr | IPFY_ICMPC_NETTOS { $$ = ICMP_UNREACH_TOSNET; } 1552145510Sdarrenr | IPFY_ICMPC_HSTTOS { $$ = ICMP_UNREACH_TOSHOST; } 1553145510Sdarrenr | IPFY_ICMPC_FLTPRO { $$ = ICMP_UNREACH_ADMIN_PROHIBIT; } 1554145510Sdarrenr | IPFY_ICMPC_HSTPRE { $$ = 14; } 1555145510Sdarrenr | IPFY_ICMPC_CUTPRE { $$ = 15; } 1556145510Sdarrenr ; 1557145510Sdarrenr 1558145510Sdarrenropt: 1559145510Sdarrenr IPFY_IPOPT_NOP { $$ = getoptbyvalue(IPOPT_NOP); } 1560145510Sdarrenr | IPFY_IPOPT_RR { $$ = getoptbyvalue(IPOPT_RR); } 1561145510Sdarrenr | IPFY_IPOPT_ZSU { $$ = getoptbyvalue(IPOPT_ZSU); } 1562145510Sdarrenr | IPFY_IPOPT_MTUP { $$ = getoptbyvalue(IPOPT_MTUP); } 1563145510Sdarrenr | IPFY_IPOPT_MTUR { $$ = getoptbyvalue(IPOPT_MTUR); } 1564145510Sdarrenr | IPFY_IPOPT_ENCODE { $$ = getoptbyvalue(IPOPT_ENCODE); } 1565145510Sdarrenr | IPFY_IPOPT_TS { $$ = getoptbyvalue(IPOPT_TS); } 1566145510Sdarrenr | IPFY_IPOPT_TR { $$ = getoptbyvalue(IPOPT_TR); } 1567145510Sdarrenr | IPFY_IPOPT_SEC { $$ = getoptbyvalue(IPOPT_SECURITY); } 1568145510Sdarrenr | IPFY_IPOPT_LSRR { $$ = getoptbyvalue(IPOPT_LSRR); } 1569145510Sdarrenr | IPFY_IPOPT_ESEC { $$ = getoptbyvalue(IPOPT_E_SEC); } 1570255332Scy | IPFY_IPOPT_CIPSO { $$ = getoptbyvalue(IPOPT_CIPSO); } 1571255332Scy | IPFY_IPOPT_CIPSO doi { $$ = getoptbyvalue(IPOPT_CIPSO); } 1572145510Sdarrenr | IPFY_IPOPT_SATID { $$ = getoptbyvalue(IPOPT_SATID); } 1573145510Sdarrenr | IPFY_IPOPT_SSRR { $$ = getoptbyvalue(IPOPT_SSRR); } 1574145510Sdarrenr | IPFY_IPOPT_ADDEXT { $$ = getoptbyvalue(IPOPT_ADDEXT); } 1575145510Sdarrenr | IPFY_IPOPT_VISA { $$ = getoptbyvalue(IPOPT_VISA); } 1576145510Sdarrenr | IPFY_IPOPT_IMITD { $$ = getoptbyvalue(IPOPT_IMITD); } 1577145510Sdarrenr | IPFY_IPOPT_EIP { $$ = getoptbyvalue(IPOPT_EIP); } 1578145510Sdarrenr | IPFY_IPOPT_FINN { $$ = getoptbyvalue(IPOPT_FINN); } 1579145510Sdarrenr | IPFY_IPOPT_DPS { $$ = getoptbyvalue(IPOPT_DPS); } 1580145510Sdarrenr | IPFY_IPOPT_SDB { $$ = getoptbyvalue(IPOPT_SDB); } 1581145510Sdarrenr | IPFY_IPOPT_NSAPA { $$ = getoptbyvalue(IPOPT_NSAPA); } 1582145510Sdarrenr | IPFY_IPOPT_RTRALRT { $$ = getoptbyvalue(IPOPT_RTRALRT); } 1583145510Sdarrenr | IPFY_IPOPT_UMP { $$ = getoptbyvalue(IPOPT_UMP); } 1584145510Sdarrenr | setsecclass secname 1585145510Sdarrenr { DOALL(fr->fr_mip.fi_secmsk |= $2; 1586255332Scy if (fr->fr_family == AF_UNSPEC) { 1587255332Scy fr->fr_family = AF_INET; 1588255332Scy fr->fr_ip.fi_v = 4; 1589255332Scy fr->fr_mip.fi_v = 0xf; 1590255332Scy } else if (fr->fr_family != AF_INET) { 1591255332Scy YYERROR; 1592255332Scy } 1593145510Sdarrenr if (!nowith) 1594145510Sdarrenr fr->fr_ip.fi_secmsk |= $2;) 1595145510Sdarrenr $$ = 0; 1596145510Sdarrenr yyresetdict(); 1597145510Sdarrenr } 1598145510Sdarrenr ; 1599145510Sdarrenr 1600145510Sdarrenrsetsecclass: 1601255332Scy IPFY_SECCLASS { yysetdict(ipv4secwords); } 1602145510Sdarrenr ; 1603145510Sdarrenr 1604255332Scydoi: IPFY_DOI YY_NUMBER { DOALL(fr->fr_doimask = 0xffffffff; \ 1605255332Scy if (!nowith) \ 1606255332Scy fr->fr_doi = $2;) } 1607255332Scy | IPFY_DOI YY_HEX { DOALL(fr->fr_doimask = 0xffffffff; \ 1608255332Scy if (!nowith) \ 1609255332Scy fr->fr_doi = $2;) } 1610255332Scy ; 1611255332Scy 1612145510Sdarrenripv6hdr: 1613145510Sdarrenr IPFY_AH { $$ = getv6optbyvalue(IPPROTO_AH); } 1614145510Sdarrenr | IPFY_IPV6OPT_DSTOPTS { $$ = getv6optbyvalue(IPPROTO_DSTOPTS); } 1615153881Sguido | IPFY_IPV6OPT_ESP { $$ = getv6optbyvalue(IPPROTO_ESP); } 1616145510Sdarrenr | IPFY_IPV6OPT_HOPOPTS { $$ = getv6optbyvalue(IPPROTO_HOPOPTS); } 1617145510Sdarrenr | IPFY_IPV6OPT_IPV6 { $$ = getv6optbyvalue(IPPROTO_IPV6); } 1618145510Sdarrenr | IPFY_IPV6OPT_NONE { $$ = getv6optbyvalue(IPPROTO_NONE); } 1619145510Sdarrenr | IPFY_IPV6OPT_ROUTING { $$ = getv6optbyvalue(IPPROTO_ROUTING); } 1620153881Sguido | IPFY_IPV6OPT_FRAG { $$ = getv6optbyvalue(IPPROTO_FRAGMENT); } 1621153881Sguido | IPFY_IPV6OPT_MOBILITY { $$ = getv6optbyvalue(IPPROTO_MOBILITY); } 1622145510Sdarrenr ; 1623145510Sdarrenr 1624145510Sdarrenrlevel: IPFY_LEVEL { setsyslog(); } 1625145510Sdarrenr ; 1626145510Sdarrenr 1627145510Sdarrenrloglevel: 1628145510Sdarrenr priority { fr->fr_loglevel = LOG_LOCAL0|$1; } 1629145510Sdarrenr | facility '.' priority { fr->fr_loglevel = $1 | $3; } 1630145510Sdarrenr ; 1631145510Sdarrenr 1632145510Sdarrenrfacility: 1633145510Sdarrenr IPFY_FAC_KERN { $$ = LOG_KERN; } 1634145510Sdarrenr | IPFY_FAC_USER { $$ = LOG_USER; } 1635145510Sdarrenr | IPFY_FAC_MAIL { $$ = LOG_MAIL; } 1636145510Sdarrenr | IPFY_FAC_DAEMON { $$ = LOG_DAEMON; } 1637145510Sdarrenr | IPFY_FAC_AUTH { $$ = LOG_AUTH; } 1638145510Sdarrenr | IPFY_FAC_SYSLOG { $$ = LOG_SYSLOG; } 1639145510Sdarrenr | IPFY_FAC_LPR { $$ = LOG_LPR; } 1640145510Sdarrenr | IPFY_FAC_NEWS { $$ = LOG_NEWS; } 1641145510Sdarrenr | IPFY_FAC_UUCP { $$ = LOG_UUCP; } 1642145510Sdarrenr | IPFY_FAC_CRON { $$ = LOG_CRON; } 1643145510Sdarrenr | IPFY_FAC_FTP { $$ = LOG_FTP; } 1644145510Sdarrenr | IPFY_FAC_AUTHPRIV { $$ = LOG_AUTHPRIV; } 1645145510Sdarrenr | IPFY_FAC_AUDIT { $$ = LOG_AUDIT; } 1646145510Sdarrenr | IPFY_FAC_LFMT { $$ = LOG_LFMT; } 1647145510Sdarrenr | IPFY_FAC_LOCAL0 { $$ = LOG_LOCAL0; } 1648145510Sdarrenr | IPFY_FAC_LOCAL1 { $$ = LOG_LOCAL1; } 1649145510Sdarrenr | IPFY_FAC_LOCAL2 { $$ = LOG_LOCAL2; } 1650145510Sdarrenr | IPFY_FAC_LOCAL3 { $$ = LOG_LOCAL3; } 1651145510Sdarrenr | IPFY_FAC_LOCAL4 { $$ = LOG_LOCAL4; } 1652145510Sdarrenr | IPFY_FAC_LOCAL5 { $$ = LOG_LOCAL5; } 1653145510Sdarrenr | IPFY_FAC_LOCAL6 { $$ = LOG_LOCAL6; } 1654145510Sdarrenr | IPFY_FAC_LOCAL7 { $$ = LOG_LOCAL7; } 1655145510Sdarrenr | IPFY_FAC_SECURITY { $$ = LOG_SECURITY; } 1656145510Sdarrenr ; 1657145510Sdarrenr 1658145510Sdarrenrpriority: 1659145510Sdarrenr IPFY_PRI_EMERG { $$ = LOG_EMERG; } 1660145510Sdarrenr | IPFY_PRI_ALERT { $$ = LOG_ALERT; } 1661145510Sdarrenr | IPFY_PRI_CRIT { $$ = LOG_CRIT; } 1662145510Sdarrenr | IPFY_PRI_ERR { $$ = LOG_ERR; } 1663145510Sdarrenr | IPFY_PRI_WARN { $$ = LOG_WARNING; } 1664145510Sdarrenr | IPFY_PRI_NOTICE { $$ = LOG_NOTICE; } 1665145510Sdarrenr | IPFY_PRI_INFO { $$ = LOG_INFO; } 1666145510Sdarrenr | IPFY_PRI_DEBUG { $$ = LOG_DEBUG; } 1667145510Sdarrenr ; 1668145510Sdarrenr 1669145510Sdarrenrcompare: 1670145510Sdarrenr YY_CMP_EQ { $$ = FR_EQUAL; } 1671145510Sdarrenr | YY_CMP_NE { $$ = FR_NEQUAL; } 1672145510Sdarrenr | YY_CMP_LT { $$ = FR_LESST; } 1673145510Sdarrenr | YY_CMP_LE { $$ = FR_LESSTE; } 1674145510Sdarrenr | YY_CMP_GT { $$ = FR_GREATERT; } 1675145510Sdarrenr | YY_CMP_GE { $$ = FR_GREATERTE; } 1676145510Sdarrenr ; 1677145510Sdarrenr 1678145510Sdarrenrrange: YY_RANGE_IN { $$ = FR_INRANGE; } 1679145510Sdarrenr | YY_RANGE_OUT { $$ = FR_OUTRANGE; } 1680145510Sdarrenr | ':' { $$ = FR_INCRANGE; } 1681145510Sdarrenr ; 1682145510Sdarrenr 1683145510Sdarrenrservicename: 1684145510Sdarrenr YY_STR { $$ = $1; } 1685145510Sdarrenr ; 1686145510Sdarrenr 1687170268Sdarrenrinterfacename: name { $$ = $1; } 1688170268Sdarrenr | name ':' YY_NUMBER 1689145510Sdarrenr { $$ = $1; 1690145510Sdarrenr fprintf(stderr, "%d: Logical interface %s:%d unsupported, " 1691145510Sdarrenr "use the physical interface %s instead.\n", 1692145510Sdarrenr yylineNum, $1, $3, $1); 1693145510Sdarrenr } 1694145510Sdarrenr ; 1695145510Sdarrenr 1696145510Sdarrenrname: YY_STR { $$ = $1; } 1697170268Sdarrenr | '-' { $$ = strdup("-"); } 1698145510Sdarrenr ; 1699145510Sdarrenr 1700145510Sdarrenripv4_16: 1701145510Sdarrenr YY_NUMBER '.' YY_NUMBER 1702145510Sdarrenr { if ($1 > 255 || $3 > 255) { 1703145510Sdarrenr yyerror("Invalid octet string for IP address"); 1704145510Sdarrenr return 0; 1705145510Sdarrenr } 1706145510Sdarrenr $$.s_addr = ($1 << 24) | ($3 << 16); 1707145510Sdarrenr $$.s_addr = htonl($$.s_addr); 1708145510Sdarrenr } 1709145510Sdarrenr ; 1710145510Sdarrenr 1711145510Sdarrenripv4_24: 1712145510Sdarrenr ipv4_16 '.' YY_NUMBER 1713145510Sdarrenr { if ($3 > 255) { 1714145510Sdarrenr yyerror("Invalid octet string for IP address"); 1715145510Sdarrenr return 0; 1716145510Sdarrenr } 1717145510Sdarrenr $$.s_addr |= htonl($3 << 8); 1718145510Sdarrenr } 1719145510Sdarrenr ; 1720145510Sdarrenr 1721145510Sdarrenripv4: ipv4_24 '.' YY_NUMBER 1722145510Sdarrenr { if ($3 > 255) { 1723145510Sdarrenr yyerror("Invalid octet string for IP address"); 1724145510Sdarrenr return 0; 1725145510Sdarrenr } 1726145510Sdarrenr $$.s_addr |= htonl($3); 1727145510Sdarrenr } 1728145510Sdarrenr | ipv4_24 1729145510Sdarrenr | ipv4_16 1730145510Sdarrenr ; 1731145510Sdarrenr 1732145510Sdarrenr%% 1733145510Sdarrenr 1734145510Sdarrenr 1735255332Scystatic struct wordtab ipfwords[] = { 1736145510Sdarrenr { "age", IPFY_AGE }, 1737145510Sdarrenr { "ah", IPFY_AH }, 1738145510Sdarrenr { "all", IPFY_ALL }, 1739145510Sdarrenr { "and", IPFY_AND }, 1740145510Sdarrenr { "auth", IPFY_AUTH }, 1741145510Sdarrenr { "bad", IPFY_BAD }, 1742145510Sdarrenr { "bad-nat", IPFY_BADNAT }, 1743145510Sdarrenr { "bad-src", IPFY_BADSRC }, 1744145510Sdarrenr { "bcast", IPFY_BROADCAST }, 1745145510Sdarrenr { "block", IPFY_BLOCK }, 1746145510Sdarrenr { "body", IPFY_BODY }, 1747145510Sdarrenr { "bpf-v4", IPFY_BPFV4 }, 1748145510Sdarrenr#ifdef USE_INET6 1749145510Sdarrenr { "bpf-v6", IPFY_BPFV6 }, 1750145510Sdarrenr#endif 1751145510Sdarrenr { "call", IPFY_CALL }, 1752145510Sdarrenr { "code", IPFY_ICMPCODE }, 1753255332Scy { "comment", IPFY_COMMENT }, 1754145510Sdarrenr { "count", IPFY_COUNT }, 1755255332Scy { "decapsulate", IPFY_DECAPS }, 1756255332Scy { "dstlist", IPFY_DSTLIST }, 1757255332Scy { "doi", IPFY_DOI }, 1758145510Sdarrenr { "dup-to", IPFY_DUPTO }, 1759145510Sdarrenr { "eq", YY_CMP_EQ }, 1760145510Sdarrenr { "esp", IPFY_ESP }, 1761255332Scy { "exp", IPFY_IPFEXPR }, 1762255332Scy { "family", IPFY_FAMILY }, 1763145510Sdarrenr { "fastroute", IPFY_FROUTE }, 1764145510Sdarrenr { "first", IPFY_FIRST }, 1765145510Sdarrenr { "flags", IPFY_FLAGS }, 1766145510Sdarrenr { "frag", IPFY_FRAG }, 1767145510Sdarrenr { "frag-body", IPFY_FRAGBODY }, 1768145510Sdarrenr { "frags", IPFY_FRAGS }, 1769145510Sdarrenr { "from", IPFY_FROM }, 1770145510Sdarrenr { "ge", YY_CMP_GE }, 1771145510Sdarrenr { "group", IPFY_GROUP }, 1772145510Sdarrenr { "gt", YY_CMP_GT }, 1773145510Sdarrenr { "head", IPFY_HEAD }, 1774145510Sdarrenr { "icmp", IPFY_ICMP }, 1775255332Scy { "icmp-head", IPFY_ICMPHEAD }, 1776145510Sdarrenr { "icmp-type", IPFY_ICMPTYPE }, 1777145510Sdarrenr { "in", IPFY_IN }, 1778145510Sdarrenr { "in-via", IPFY_INVIA }, 1779255332Scy { "inet", IPFY_INET }, 1780255332Scy { "inet6", IPFY_INET6 }, 1781145510Sdarrenr { "ipopt", IPFY_IPOPTS }, 1782145510Sdarrenr { "ipopts", IPFY_IPOPTS }, 1783145510Sdarrenr { "keep", IPFY_KEEP }, 1784255332Scy { "l5-as", IPFY_L5AS }, 1785145510Sdarrenr { "le", YY_CMP_LE }, 1786145510Sdarrenr { "level", IPFY_LEVEL }, 1787145510Sdarrenr { "limit", IPFY_LIMIT }, 1788145510Sdarrenr { "log", IPFY_LOG }, 1789255332Scy { "loose", IPFY_LOOSE }, 1790145510Sdarrenr { "lowttl", IPFY_LOWTTL }, 1791145510Sdarrenr { "lt", YY_CMP_LT }, 1792145510Sdarrenr { "mask", IPFY_MASK }, 1793145510Sdarrenr { "match-tag", IPFY_MATCHTAG }, 1794255332Scy { "max-per-src", IPFY_MAX_PER_SRC }, 1795255332Scy { "max-srcs", IPFY_MAX_SRCS }, 1796145510Sdarrenr { "mbcast", IPFY_MBCAST }, 1797153881Sguido { "mcast", IPFY_MULTICAST }, 1798145510Sdarrenr { "multicast", IPFY_MULTICAST }, 1799145510Sdarrenr { "nat", IPFY_NAT }, 1800145510Sdarrenr { "ne", YY_CMP_NE }, 1801145510Sdarrenr { "net", IPFY_NETWORK }, 1802145510Sdarrenr { "newisn", IPFY_NEWISN }, 1803145510Sdarrenr { "no", IPFY_NO }, 1804145510Sdarrenr { "no-icmp-err", IPFY_NOICMPERR }, 1805255332Scy { "nolog", IPFY_NOLOG }, 1806161357Sguido { "nomatch", IPFY_NOMATCH }, 1807145510Sdarrenr { "now", IPFY_NOW }, 1808145510Sdarrenr { "not", IPFY_NOT }, 1809145510Sdarrenr { "oow", IPFY_OOW }, 1810145510Sdarrenr { "on", IPFY_ON }, 1811145510Sdarrenr { "opt", IPFY_OPT }, 1812145510Sdarrenr { "or-block", IPFY_ORBLOCK }, 1813145510Sdarrenr { "out", IPFY_OUT }, 1814145510Sdarrenr { "out-via", IPFY_OUTVIA }, 1815145510Sdarrenr { "pass", IPFY_PASS }, 1816145510Sdarrenr { "port", IPFY_PORT }, 1817145510Sdarrenr { "pps", IPFY_PPS }, 1818145510Sdarrenr { "preauth", IPFY_PREAUTH }, 1819145510Sdarrenr { "proto", IPFY_PROTO }, 1820145510Sdarrenr { "quick", IPFY_QUICK }, 1821145510Sdarrenr { "reply-to", IPFY_REPLY_TO }, 1822145510Sdarrenr { "return-icmp", IPFY_RETICMP }, 1823145510Sdarrenr { "return-icmp-as-dest", IPFY_RETICMPASDST }, 1824145510Sdarrenr { "return-rst", IPFY_RETRST }, 1825145510Sdarrenr { "route-to", IPFY_ROUTETO }, 1826255332Scy { "rule-ttl", IPFY_RULETTL }, 1827255332Scy { "rpc", IPFY_RPC }, 1828145510Sdarrenr { "sec-class", IPFY_SECCLASS }, 1829255332Scy { "set", IPFY_SET }, 1830145510Sdarrenr { "set-tag", IPFY_SETTAG }, 1831145510Sdarrenr { "skip", IPFY_SKIP }, 1832145510Sdarrenr { "short", IPFY_SHORT }, 1833145510Sdarrenr { "state", IPFY_STATE }, 1834145510Sdarrenr { "state-age", IPFY_AGE }, 1835145510Sdarrenr { "strict", IPFY_STRICT }, 1836145510Sdarrenr { "sync", IPFY_SYNC }, 1837145510Sdarrenr { "tcp", IPFY_TCP }, 1838145510Sdarrenr { "tcp-udp", IPFY_TCPUDP }, 1839145510Sdarrenr { "tos", IPFY_TOS }, 1840145510Sdarrenr { "to", IPFY_TO }, 1841145510Sdarrenr { "ttl", IPFY_TTL }, 1842145510Sdarrenr { "udp", IPFY_UDP }, 1843255332Scy { "v6hdr", IPFY_V6HDR }, 1844255332Scy { "v6hdrs", IPFY_V6HDRS }, 1845145510Sdarrenr { "with", IPFY_WITH }, 1846145510Sdarrenr { NULL, 0 } 1847145510Sdarrenr}; 1848145510Sdarrenr 1849255332Scystatic struct wordtab addrwords[] = { 1850145510Sdarrenr { "any", IPFY_ANY }, 1851145510Sdarrenr { "hash", IPFY_HASH }, 1852145510Sdarrenr { "pool", IPFY_POOL }, 1853145510Sdarrenr { NULL, 0 } 1854145510Sdarrenr}; 1855145510Sdarrenr 1856255332Scystatic struct wordtab maskwords[] = { 1857145510Sdarrenr { "broadcast", IPFY_BROADCAST }, 1858145510Sdarrenr { "netmasked", IPFY_NETMASKED }, 1859145510Sdarrenr { "network", IPFY_NETWORK }, 1860145510Sdarrenr { "peer", IPFY_PEER }, 1861145510Sdarrenr { NULL, 0 } 1862145510Sdarrenr}; 1863145510Sdarrenr 1864255332Scystatic struct wordtab icmpcodewords[] = { 1865145510Sdarrenr { "cutoff-preced", IPFY_ICMPC_CUTPRE }, 1866145510Sdarrenr { "filter-prohib", IPFY_ICMPC_FLTPRO }, 1867145510Sdarrenr { "isolate", IPFY_ICMPC_ISOLATE }, 1868145510Sdarrenr { "needfrag", IPFY_ICMPC_NEEDF }, 1869145510Sdarrenr { "net-prohib", IPFY_ICMPC_NETPRO }, 1870145510Sdarrenr { "net-tos", IPFY_ICMPC_NETTOS }, 1871145510Sdarrenr { "host-preced", IPFY_ICMPC_HSTPRE }, 1872145510Sdarrenr { "host-prohib", IPFY_ICMPC_HSTPRO }, 1873145510Sdarrenr { "host-tos", IPFY_ICMPC_HSTTOS }, 1874145510Sdarrenr { "host-unk", IPFY_ICMPC_HSTUNK }, 1875145510Sdarrenr { "host-unr", IPFY_ICMPC_HSTUNR }, 1876145510Sdarrenr { "net-unk", IPFY_ICMPC_NETUNK }, 1877145510Sdarrenr { "net-unr", IPFY_ICMPC_NETUNR }, 1878145510Sdarrenr { "port-unr", IPFY_ICMPC_PORUNR }, 1879145510Sdarrenr { "proto-unr", IPFY_ICMPC_PROUNR }, 1880145510Sdarrenr { "srcfail", IPFY_ICMPC_SRCFAIL }, 1881145510Sdarrenr { NULL, 0 }, 1882145510Sdarrenr}; 1883145510Sdarrenr 1884255332Scystatic struct wordtab ipv4optwords[] = { 1885145510Sdarrenr { "addext", IPFY_IPOPT_ADDEXT }, 1886145510Sdarrenr { "cipso", IPFY_IPOPT_CIPSO }, 1887145510Sdarrenr { "dps", IPFY_IPOPT_DPS }, 1888145510Sdarrenr { "e-sec", IPFY_IPOPT_ESEC }, 1889145510Sdarrenr { "eip", IPFY_IPOPT_EIP }, 1890145510Sdarrenr { "encode", IPFY_IPOPT_ENCODE }, 1891145510Sdarrenr { "finn", IPFY_IPOPT_FINN }, 1892145510Sdarrenr { "imitd", IPFY_IPOPT_IMITD }, 1893145510Sdarrenr { "lsrr", IPFY_IPOPT_LSRR }, 1894145510Sdarrenr { "mtup", IPFY_IPOPT_MTUP }, 1895145510Sdarrenr { "mtur", IPFY_IPOPT_MTUR }, 1896145510Sdarrenr { "nop", IPFY_IPOPT_NOP }, 1897145510Sdarrenr { "nsapa", IPFY_IPOPT_NSAPA }, 1898145510Sdarrenr { "rr", IPFY_IPOPT_RR }, 1899145510Sdarrenr { "rtralrt", IPFY_IPOPT_RTRALRT }, 1900145510Sdarrenr { "satid", IPFY_IPOPT_SATID }, 1901145510Sdarrenr { "sdb", IPFY_IPOPT_SDB }, 1902145510Sdarrenr { "sec", IPFY_IPOPT_SEC }, 1903145510Sdarrenr { "ssrr", IPFY_IPOPT_SSRR }, 1904145510Sdarrenr { "tr", IPFY_IPOPT_TR }, 1905145510Sdarrenr { "ts", IPFY_IPOPT_TS }, 1906145510Sdarrenr { "ump", IPFY_IPOPT_UMP }, 1907145510Sdarrenr { "visa", IPFY_IPOPT_VISA }, 1908145510Sdarrenr { "zsu", IPFY_IPOPT_ZSU }, 1909145510Sdarrenr { NULL, 0 }, 1910145510Sdarrenr}; 1911145510Sdarrenr 1912255332Scystatic struct wordtab ipv4secwords[] = { 1913145510Sdarrenr { "confid", IPFY_SEC_CONF }, 1914145510Sdarrenr { "reserv-1", IPFY_SEC_RSV1 }, 1915145510Sdarrenr { "reserv-2", IPFY_SEC_RSV2 }, 1916145510Sdarrenr { "reserv-3", IPFY_SEC_RSV3 }, 1917145510Sdarrenr { "reserv-4", IPFY_SEC_RSV4 }, 1918145510Sdarrenr { "secret", IPFY_SEC_SEC }, 1919145510Sdarrenr { "topsecret", IPFY_SEC_TS }, 1920145510Sdarrenr { "unclass", IPFY_SEC_UNC }, 1921145510Sdarrenr { NULL, 0 }, 1922145510Sdarrenr}; 1923145510Sdarrenr 1924255332Scystatic struct wordtab ipv6optwords[] = { 1925145510Sdarrenr { "dstopts", IPFY_IPV6OPT_DSTOPTS }, 1926153881Sguido { "esp", IPFY_IPV6OPT_ESP }, 1927153881Sguido { "frag", IPFY_IPV6OPT_FRAG }, 1928145510Sdarrenr { "hopopts", IPFY_IPV6OPT_HOPOPTS }, 1929145510Sdarrenr { "ipv6", IPFY_IPV6OPT_IPV6 }, 1930153881Sguido { "mobility", IPFY_IPV6OPT_MOBILITY }, 1931145510Sdarrenr { "none", IPFY_IPV6OPT_NONE }, 1932145510Sdarrenr { "routing", IPFY_IPV6OPT_ROUTING }, 1933145510Sdarrenr { NULL, 0 }, 1934145510Sdarrenr}; 1935145510Sdarrenr 1936255332Scystatic struct wordtab logwords[] = { 1937145510Sdarrenr { "kern", IPFY_FAC_KERN }, 1938145510Sdarrenr { "user", IPFY_FAC_USER }, 1939145510Sdarrenr { "mail", IPFY_FAC_MAIL }, 1940145510Sdarrenr { "daemon", IPFY_FAC_DAEMON }, 1941145510Sdarrenr { "auth", IPFY_FAC_AUTH }, 1942145510Sdarrenr { "syslog", IPFY_FAC_SYSLOG }, 1943145510Sdarrenr { "lpr", IPFY_FAC_LPR }, 1944145510Sdarrenr { "news", IPFY_FAC_NEWS }, 1945145510Sdarrenr { "uucp", IPFY_FAC_UUCP }, 1946145510Sdarrenr { "cron", IPFY_FAC_CRON }, 1947145510Sdarrenr { "ftp", IPFY_FAC_FTP }, 1948145510Sdarrenr { "authpriv", IPFY_FAC_AUTHPRIV }, 1949145510Sdarrenr { "audit", IPFY_FAC_AUDIT }, 1950145510Sdarrenr { "logalert", IPFY_FAC_LFMT }, 1951145510Sdarrenr { "console", IPFY_FAC_CONSOLE }, 1952145510Sdarrenr { "security", IPFY_FAC_SECURITY }, 1953145510Sdarrenr { "local0", IPFY_FAC_LOCAL0 }, 1954145510Sdarrenr { "local1", IPFY_FAC_LOCAL1 }, 1955145510Sdarrenr { "local2", IPFY_FAC_LOCAL2 }, 1956145510Sdarrenr { "local3", IPFY_FAC_LOCAL3 }, 1957145510Sdarrenr { "local4", IPFY_FAC_LOCAL4 }, 1958145510Sdarrenr { "local5", IPFY_FAC_LOCAL5 }, 1959145510Sdarrenr { "local6", IPFY_FAC_LOCAL6 }, 1960145510Sdarrenr { "local7", IPFY_FAC_LOCAL7 }, 1961145510Sdarrenr { "emerg", IPFY_PRI_EMERG }, 1962145510Sdarrenr { "alert", IPFY_PRI_ALERT }, 1963145510Sdarrenr { "crit", IPFY_PRI_CRIT }, 1964145510Sdarrenr { "err", IPFY_PRI_ERR }, 1965145510Sdarrenr { "warn", IPFY_PRI_WARN }, 1966145510Sdarrenr { "notice", IPFY_PRI_NOTICE }, 1967145510Sdarrenr { "info", IPFY_PRI_INFO }, 1968145510Sdarrenr { "debug", IPFY_PRI_DEBUG }, 1969145510Sdarrenr { NULL, 0 }, 1970145510Sdarrenr}; 1971145510Sdarrenr 1972145510Sdarrenr 1973145510Sdarrenr 1974145510Sdarrenr 1975145510Sdarrenrint ipf_parsefile(fd, addfunc, iocfuncs, filename) 1976145510Sdarrenrint fd; 1977145510Sdarrenraddfunc_t addfunc; 1978145510Sdarrenrioctlfunc_t *iocfuncs; 1979145510Sdarrenrchar *filename; 1980145510Sdarrenr{ 1981145510Sdarrenr FILE *fp = NULL; 1982145510Sdarrenr char *s; 1983145510Sdarrenr 1984145510Sdarrenr yylineNum = 1; 1985145510Sdarrenr yysettab(ipfwords); 1986145510Sdarrenr 1987145510Sdarrenr s = getenv("YYDEBUG"); 1988145510Sdarrenr if (s != NULL) 1989145510Sdarrenr yydebug = atoi(s); 1990145510Sdarrenr else 1991145510Sdarrenr yydebug = 0; 1992145510Sdarrenr 1993145510Sdarrenr if (strcmp(filename, "-")) { 1994145510Sdarrenr fp = fopen(filename, "r"); 1995145510Sdarrenr if (fp == NULL) { 1996145510Sdarrenr fprintf(stderr, "fopen(%s) failed: %s\n", filename, 1997145510Sdarrenr STRERROR(errno)); 1998145510Sdarrenr return -1; 1999145510Sdarrenr } 2000145510Sdarrenr } else 2001145510Sdarrenr fp = stdin; 2002145510Sdarrenr 2003145510Sdarrenr while (ipf_parsesome(fd, addfunc, iocfuncs, fp) == 1) 2004145510Sdarrenr ; 2005145510Sdarrenr if (fp != NULL) 2006145510Sdarrenr fclose(fp); 2007145510Sdarrenr return 0; 2008145510Sdarrenr} 2009145510Sdarrenr 2010145510Sdarrenr 2011145510Sdarrenrint ipf_parsesome(fd, addfunc, iocfuncs, fp) 2012145510Sdarrenrint fd; 2013145510Sdarrenraddfunc_t addfunc; 2014145510Sdarrenrioctlfunc_t *iocfuncs; 2015145510SdarrenrFILE *fp; 2016145510Sdarrenr{ 2017145510Sdarrenr char *s; 2018145510Sdarrenr int i; 2019145510Sdarrenr 2020145510Sdarrenr ipffd = fd; 2021145510Sdarrenr for (i = 0; i <= IPL_LOGMAX; i++) 2022255332Scy ipfioctls[i] = iocfuncs[i]; 2023145510Sdarrenr ipfaddfunc = addfunc; 2024145510Sdarrenr 2025145510Sdarrenr if (feof(fp)) 2026145510Sdarrenr return 0; 2027145510Sdarrenr i = fgetc(fp); 2028145510Sdarrenr if (i == EOF) 2029145510Sdarrenr return 0; 2030145510Sdarrenr if (ungetc(i, fp) == 0) 2031145510Sdarrenr return 0; 2032145510Sdarrenr if (feof(fp)) 2033145510Sdarrenr return 0; 2034145510Sdarrenr s = getenv("YYDEBUG"); 2035145510Sdarrenr if (s != NULL) 2036145510Sdarrenr yydebug = atoi(s); 2037145510Sdarrenr else 2038145510Sdarrenr yydebug = 0; 2039145510Sdarrenr 2040145510Sdarrenr yyin = fp; 2041145510Sdarrenr yyparse(); 2042145510Sdarrenr return 1; 2043145510Sdarrenr} 2044145510Sdarrenr 2045145510Sdarrenr 2046145510Sdarrenrstatic void newrule() 2047145510Sdarrenr{ 2048145510Sdarrenr frentry_t *frn; 2049145510Sdarrenr 2050255332Scy frn = allocfr(); 2051145510Sdarrenr for (fr = frtop; fr != NULL && fr->fr_next != NULL; fr = fr->fr_next) 2052145510Sdarrenr ; 2053255332Scy if (fr != NULL) { 2054145510Sdarrenr fr->fr_next = frn; 2055255332Scy frn->fr_pnext = &fr->fr_next; 2056255332Scy } 2057255332Scy if (frtop == NULL) { 2058145510Sdarrenr frtop = frn; 2059255332Scy frn->fr_pnext = &frtop; 2060255332Scy } 2061145510Sdarrenr fr = frn; 2062145510Sdarrenr frc = frn; 2063145510Sdarrenr fr->fr_loglevel = 0xffff; 2064145510Sdarrenr fr->fr_isc = (void *)-1; 2065145510Sdarrenr fr->fr_logtag = FR_NOLOGTAG; 2066145510Sdarrenr fr->fr_type = FR_T_NONE; 2067255332Scy fr->fr_flineno = yylineNum; 2068145510Sdarrenr 2069255332Scy if (use_inet6 == 1) 2070255332Scy fr->fr_family = AF_INET6; 2071255332Scy else if (use_inet6 == -1) 2072255332Scy fr->fr_family = AF_INET; 2073255332Scy 2074145510Sdarrenr nrules = 1; 2075145510Sdarrenr} 2076145510Sdarrenr 2077145510Sdarrenr 2078145510Sdarrenrstatic void setipftype() 2079145510Sdarrenr{ 2080145510Sdarrenr for (fr = frc; fr != NULL; fr = fr->fr_next) { 2081145510Sdarrenr if (fr->fr_type == FR_T_NONE) { 2082145510Sdarrenr fr->fr_type = FR_T_IPF; 2083145510Sdarrenr fr->fr_data = (void *)calloc(sizeof(fripf_t), 1); 2084145510Sdarrenr fr->fr_dsize = sizeof(fripf_t); 2085255332Scy fr->fr_family = frc->fr_family; 2086255332Scy if (fr->fr_family == AF_INET) { 2087255332Scy fr->fr_ip.fi_v = 4; 2088255332Scy } 2089255332Scy else if (fr->fr_family == AF_INET6) { 2090255332Scy fr->fr_ip.fi_v = 6; 2091255332Scy } 2092145510Sdarrenr fr->fr_mip.fi_v = 0xf; 2093145510Sdarrenr fr->fr_ipf->fri_sifpidx = -1; 2094145510Sdarrenr fr->fr_ipf->fri_difpidx = -1; 2095145510Sdarrenr } 2096145510Sdarrenr if (fr->fr_type != FR_T_IPF) { 2097145510Sdarrenr fprintf(stderr, "IPF Type not set\n"); 2098145510Sdarrenr } 2099145510Sdarrenr } 2100145510Sdarrenr} 2101145510Sdarrenr 2102145510Sdarrenr 2103145510Sdarrenrstatic frentry_t *addrule() 2104145510Sdarrenr{ 2105145510Sdarrenr frentry_t *f, *f1, *f2; 2106145510Sdarrenr int count; 2107145510Sdarrenr 2108145510Sdarrenr for (f2 = frc; f2->fr_next != NULL; f2 = f2->fr_next) 2109145510Sdarrenr ; 2110145510Sdarrenr 2111145510Sdarrenr count = nrules; 2112145510Sdarrenr f = f2; 2113145510Sdarrenr for (f1 = frc; count > 0; count--, f1 = f1->fr_next) { 2114255332Scy f->fr_next = allocfr(); 2115255332Scy if (f->fr_next == NULL) 2116255332Scy return NULL; 2117255332Scy f->fr_next->fr_pnext = &f->fr_next; 2118145510Sdarrenr added++; 2119145510Sdarrenr f = f->fr_next; 2120255332Scy *f = *f1; 2121145510Sdarrenr f->fr_next = NULL; 2122145510Sdarrenr if (f->fr_caddr != NULL) { 2123145510Sdarrenr f->fr_caddr = malloc(f->fr_dsize); 2124145510Sdarrenr bcopy(f1->fr_caddr, f->fr_caddr, f->fr_dsize); 2125145510Sdarrenr } 2126145510Sdarrenr } 2127145510Sdarrenr 2128145510Sdarrenr return f2->fr_next; 2129145510Sdarrenr} 2130145510Sdarrenr 2131145510Sdarrenr 2132255332Scystatic int 2133255332Scylookuphost(name, addrp) 2134255332Scy char *name; 2135255332Scy i6addr_t *addrp; 2136145510Sdarrenr{ 2137145510Sdarrenr int i; 2138145510Sdarrenr 2139145510Sdarrenr hashed = 0; 2140145510Sdarrenr pooled = 0; 2141145510Sdarrenr dynamic = -1; 2142145510Sdarrenr 2143145510Sdarrenr for (i = 0; i < 4; i++) { 2144255332Scy if (fr->fr_ifnames[i] == -1) 2145255332Scy continue; 2146255332Scy if (strcmp(name, fr->fr_names + fr->fr_ifnames[i]) == 0) { 2147145510Sdarrenr ifpflag = FRI_DYNAMIC; 2148255332Scy dynamic = addname(&fr, name); 2149255332Scy return 1; 2150145510Sdarrenr } 2151145510Sdarrenr } 2152145510Sdarrenr 2153255332Scy if (gethost(AF_INET, name, addrp) == -1) { 2154145510Sdarrenr fprintf(stderr, "unknown name \"%s\"\n", name); 2155255332Scy return -1; 2156145510Sdarrenr } 2157255332Scy return 0; 2158145510Sdarrenr} 2159145510Sdarrenr 2160145510Sdarrenr 2161145510Sdarrenrstatic void dobpf(v, phrase) 2162145510Sdarrenrint v; 2163145510Sdarrenrchar *phrase; 2164145510Sdarrenr{ 2165145510Sdarrenr#ifdef IPFILTER_BPF 2166145510Sdarrenr struct bpf_program bpf; 2167145510Sdarrenr struct pcap *p; 2168145510Sdarrenr#endif 2169145510Sdarrenr fakebpf_t *fb; 2170145510Sdarrenr u_32_t l; 2171145510Sdarrenr char *s; 2172145510Sdarrenr int i; 2173145510Sdarrenr 2174145510Sdarrenr for (fr = frc; fr != NULL; fr = fr->fr_next) { 2175145510Sdarrenr if (fr->fr_type != FR_T_NONE) { 2176145510Sdarrenr fprintf(stderr, "cannot mix IPF and BPF matching\n"); 2177145510Sdarrenr return; 2178145510Sdarrenr } 2179255332Scy fr->fr_family = vtof(v); 2180145510Sdarrenr fr->fr_type = FR_T_BPFOPC; 2181145510Sdarrenr 2182153881Sguido if (!strncmp(phrase, "0x", 2)) { 2183145510Sdarrenr fb = malloc(sizeof(fakebpf_t)); 2184145510Sdarrenr 2185145510Sdarrenr for (i = 0, s = strtok(phrase, " \r\n\t"); s != NULL; 2186145510Sdarrenr s = strtok(NULL, " \r\n\t"), i++) { 2187145510Sdarrenr fb = realloc(fb, (i / 4 + 1) * sizeof(*fb)); 2188145510Sdarrenr l = (u_32_t)strtol(s, NULL, 0); 2189145510Sdarrenr switch (i & 3) 2190145510Sdarrenr { 2191145510Sdarrenr case 0 : 2192145510Sdarrenr fb[i / 4].fb_c = l & 0xffff; 2193145510Sdarrenr break; 2194145510Sdarrenr case 1 : 2195145510Sdarrenr fb[i / 4].fb_t = l & 0xff; 2196145510Sdarrenr break; 2197145510Sdarrenr case 2 : 2198145510Sdarrenr fb[i / 4].fb_f = l & 0xff; 2199145510Sdarrenr break; 2200145510Sdarrenr case 3 : 2201145510Sdarrenr fb[i / 4].fb_k = l; 2202145510Sdarrenr break; 2203145510Sdarrenr } 2204145510Sdarrenr } 2205145510Sdarrenr if ((i & 3) != 0) { 2206145510Sdarrenr fprintf(stderr, 2207145510Sdarrenr "Odd number of bytes in BPF code\n"); 2208145510Sdarrenr exit(1); 2209145510Sdarrenr } 2210145510Sdarrenr i--; 2211145510Sdarrenr fr->fr_dsize = (i / 4 + 1) * sizeof(*fb); 2212145510Sdarrenr fr->fr_data = fb; 2213145510Sdarrenr return; 2214145510Sdarrenr } 2215145510Sdarrenr 2216145510Sdarrenr#ifdef IPFILTER_BPF 2217145510Sdarrenr bzero((char *)&bpf, sizeof(bpf)); 2218145510Sdarrenr p = pcap_open_dead(DLT_RAW, 1); 2219145510Sdarrenr if (!p) { 2220145510Sdarrenr fprintf(stderr, "pcap_open_dead failed\n"); 2221145510Sdarrenr return; 2222145510Sdarrenr } 2223145510Sdarrenr 2224145510Sdarrenr if (pcap_compile(p, &bpf, phrase, 1, 0xffffffff)) { 2225145510Sdarrenr pcap_perror(p, "ipf"); 2226145510Sdarrenr pcap_close(p); 2227145510Sdarrenr fprintf(stderr, "pcap parsing failed (%s)\n", phrase); 2228145510Sdarrenr return; 2229145510Sdarrenr } 2230145510Sdarrenr pcap_close(p); 2231145510Sdarrenr 2232145510Sdarrenr fr->fr_dsize = bpf.bf_len * sizeof(struct bpf_insn); 2233145510Sdarrenr fr->fr_data = malloc(fr->fr_dsize); 2234145510Sdarrenr bcopy((char *)bpf.bf_insns, fr->fr_data, fr->fr_dsize); 2235145510Sdarrenr if (!bpf_validate(fr->fr_data, bpf.bf_len)) { 2236145510Sdarrenr fprintf(stderr, "BPF validation failed\n"); 2237145510Sdarrenr return; 2238145510Sdarrenr } 2239145510Sdarrenr#endif 2240145510Sdarrenr } 2241145510Sdarrenr 2242145510Sdarrenr#ifdef IPFILTER_BPF 2243145510Sdarrenr if (opts & OPT_DEBUG) 2244145510Sdarrenr bpf_dump(&bpf, 0); 2245145510Sdarrenr#else 2246145510Sdarrenr fprintf(stderr, "BPF filter expressions not supported\n"); 2247145510Sdarrenr exit(1); 2248145510Sdarrenr#endif 2249145510Sdarrenr} 2250145510Sdarrenr 2251145510Sdarrenr 2252145510Sdarrenrstatic void resetaddr() 2253145510Sdarrenr{ 2254145510Sdarrenr hashed = 0; 2255145510Sdarrenr pooled = 0; 2256145510Sdarrenr dynamic = -1; 2257145510Sdarrenr} 2258145510Sdarrenr 2259145510Sdarrenr 2260145510Sdarrenrstatic alist_t *newalist(ptr) 2261145510Sdarrenralist_t *ptr; 2262145510Sdarrenr{ 2263145510Sdarrenr alist_t *al; 2264145510Sdarrenr 2265145510Sdarrenr al = malloc(sizeof(*al)); 2266145510Sdarrenr if (al == NULL) 2267145510Sdarrenr return NULL; 2268145510Sdarrenr al->al_not = 0; 2269145510Sdarrenr al->al_next = ptr; 2270145510Sdarrenr return al; 2271145510Sdarrenr} 2272145510Sdarrenr 2273145510Sdarrenr 2274255332Scystatic int 2275255332Scymakepool(list) 2276255332Scy alist_t *list; 2277145510Sdarrenr{ 2278145510Sdarrenr ip_pool_node_t *n, *top; 2279145510Sdarrenr ip_pool_t pool; 2280145510Sdarrenr alist_t *a; 2281145510Sdarrenr int num; 2282145510Sdarrenr 2283145510Sdarrenr if (list == NULL) 2284145510Sdarrenr return 0; 2285145510Sdarrenr top = calloc(1, sizeof(*top)); 2286145510Sdarrenr if (top == NULL) 2287145510Sdarrenr return 0; 2288255332Scy 2289145510Sdarrenr for (n = top, a = list; (n != NULL) && (a != NULL); a = a->al_next) { 2290255332Scy if (use_inet6 == 1) { 2291255332Scy#ifdef AF_INET6 2292255332Scy n->ipn_addr.adf_family = AF_INET6; 2293255332Scy n->ipn_addr.adf_addr = a->al_i6addr; 2294255332Scy n->ipn_addr.adf_len = offsetof(addrfamily_t, 2295255332Scy adf_addr) + 16; 2296255332Scy n->ipn_mask.adf_family = AF_INET6; 2297255332Scy n->ipn_mask.adf_addr = a->al_i6mask; 2298255332Scy n->ipn_mask.adf_len = offsetof(addrfamily_t, 2299255332Scy adf_addr) + 16; 2300255332Scy 2301255332Scy#endif 2302255332Scy } else { 2303255332Scy n->ipn_addr.adf_family = AF_INET; 2304255332Scy n->ipn_addr.adf_addr.in4.s_addr = a->al_1; 2305255332Scy n->ipn_addr.adf_len = offsetof(addrfamily_t, 2306255332Scy adf_addr) + 4; 2307255332Scy n->ipn_mask.adf_family = AF_INET; 2308255332Scy n->ipn_mask.adf_addr.in4.s_addr = a->al_2; 2309255332Scy n->ipn_mask.adf_len = offsetof(addrfamily_t, 2310255332Scy adf_addr) + 4; 2311255332Scy } 2312145510Sdarrenr n->ipn_info = a->al_not; 2313145510Sdarrenr if (a->al_next != NULL) { 2314145510Sdarrenr n->ipn_next = calloc(1, sizeof(*n)); 2315145510Sdarrenr n = n->ipn_next; 2316145510Sdarrenr } 2317145510Sdarrenr } 2318145510Sdarrenr 2319145510Sdarrenr bzero((char *)&pool, sizeof(pool)); 2320145510Sdarrenr pool.ipo_unit = IPL_LOGIPF; 2321145510Sdarrenr pool.ipo_list = top; 2322255332Scy num = load_pool(&pool, ipfioctls[IPL_LOGLOOKUP]); 2323145510Sdarrenr 2324145510Sdarrenr while ((n = top) != NULL) { 2325145510Sdarrenr top = n->ipn_next; 2326145510Sdarrenr free(n); 2327145510Sdarrenr } 2328145510Sdarrenr return num; 2329145510Sdarrenr} 2330145510Sdarrenr 2331145510Sdarrenr 2332145510Sdarrenrstatic u_int makehash(list) 2333145510Sdarrenralist_t *list; 2334145510Sdarrenr{ 2335145510Sdarrenr iphtent_t *n, *top; 2336145510Sdarrenr iphtable_t iph; 2337145510Sdarrenr alist_t *a; 2338145510Sdarrenr int num; 2339145510Sdarrenr 2340145510Sdarrenr if (list == NULL) 2341145510Sdarrenr return 0; 2342145510Sdarrenr top = calloc(1, sizeof(*top)); 2343145510Sdarrenr if (top == NULL) 2344145510Sdarrenr return 0; 2345255332Scy 2346145510Sdarrenr for (n = top, a = list; (n != NULL) && (a != NULL); a = a->al_next) { 2347255332Scy if (a->al_family == AF_INET6) { 2348255332Scy n->ipe_family = AF_INET6; 2349255332Scy n->ipe_addr = a->al_i6addr; 2350255332Scy n->ipe_mask = a->al_i6mask; 2351255332Scy } else { 2352255332Scy n->ipe_family = AF_INET; 2353255332Scy n->ipe_addr.in4_addr = a->al_1; 2354255332Scy n->ipe_mask.in4_addr = a->al_2; 2355255332Scy } 2356145510Sdarrenr n->ipe_value = 0; 2357145510Sdarrenr if (a->al_next != NULL) { 2358145510Sdarrenr n->ipe_next = calloc(1, sizeof(*n)); 2359145510Sdarrenr n = n->ipe_next; 2360145510Sdarrenr } 2361145510Sdarrenr } 2362145510Sdarrenr 2363145510Sdarrenr bzero((char *)&iph, sizeof(iph)); 2364145510Sdarrenr iph.iph_unit = IPL_LOGIPF; 2365145510Sdarrenr iph.iph_type = IPHASH_LOOKUP; 2366145510Sdarrenr *iph.iph_name = '\0'; 2367145510Sdarrenr 2368255332Scy if (load_hash(&iph, top, ipfioctls[IPL_LOGLOOKUP]) == 0) 2369145510Sdarrenr sscanf(iph.iph_name, "%u", &num); 2370145510Sdarrenr else 2371145510Sdarrenr num = 0; 2372145510Sdarrenr 2373145510Sdarrenr while ((n = top) != NULL) { 2374145510Sdarrenr top = n->ipe_next; 2375145510Sdarrenr free(n); 2376145510Sdarrenr } 2377145510Sdarrenr return num; 2378145510Sdarrenr} 2379145510Sdarrenr 2380145510Sdarrenr 2381255332Scyint ipf_addrule(fd, ioctlfunc, ptr) 2382145510Sdarrenrint fd; 2383145510Sdarrenrioctlfunc_t ioctlfunc; 2384145510Sdarrenrvoid *ptr; 2385145510Sdarrenr{ 2386145510Sdarrenr ioctlcmd_t add, del; 2387145510Sdarrenr frentry_t *fr; 2388145510Sdarrenr ipfobj_t obj; 2389145510Sdarrenr 2390170268Sdarrenr if (ptr == NULL) 2391255332Scy return 0; 2392170268Sdarrenr 2393145510Sdarrenr fr = ptr; 2394145510Sdarrenr add = 0; 2395145510Sdarrenr del = 0; 2396145510Sdarrenr 2397145510Sdarrenr bzero((char *)&obj, sizeof(obj)); 2398145510Sdarrenr obj.ipfo_rev = IPFILTER_VERSION; 2399255332Scy obj.ipfo_size = fr->fr_size; 2400145510Sdarrenr obj.ipfo_type = IPFOBJ_FRENTRY; 2401145510Sdarrenr obj.ipfo_ptr = ptr; 2402145510Sdarrenr 2403145510Sdarrenr if ((opts & OPT_DONOTHING) != 0) 2404145510Sdarrenr fd = -1; 2405145510Sdarrenr 2406145510Sdarrenr if (opts & OPT_ZERORULEST) { 2407145510Sdarrenr add = SIOCZRLST; 2408145510Sdarrenr } else if (opts & OPT_INACTIVE) { 2409145510Sdarrenr add = (u_int)fr->fr_hits ? SIOCINIFR : 2410145510Sdarrenr SIOCADIFR; 2411145510Sdarrenr del = SIOCRMIFR; 2412145510Sdarrenr } else { 2413145510Sdarrenr add = (u_int)fr->fr_hits ? SIOCINAFR : 2414145510Sdarrenr SIOCADAFR; 2415145510Sdarrenr del = SIOCRMAFR; 2416145510Sdarrenr } 2417145510Sdarrenr 2418161357Sguido if ((opts & OPT_OUTQUE) != 0) 2419145510Sdarrenr fr->fr_flags |= FR_OUTQUE; 2420145510Sdarrenr if (fr->fr_hits) 2421145510Sdarrenr fr->fr_hits--; 2422170268Sdarrenr if ((opts & OPT_VERBOSE) != 0) 2423145510Sdarrenr printfr(fr, ioctlfunc); 2424145510Sdarrenr 2425170268Sdarrenr if ((opts & OPT_DEBUG) != 0) { 2426145510Sdarrenr binprint(fr, sizeof(*fr)); 2427145510Sdarrenr if (fr->fr_data != NULL) 2428145510Sdarrenr binprint(fr->fr_data, fr->fr_dsize); 2429145510Sdarrenr } 2430145510Sdarrenr 2431145510Sdarrenr if ((opts & OPT_ZERORULEST) != 0) { 2432145510Sdarrenr if ((*ioctlfunc)(fd, add, (void *)&obj) == -1) { 2433145510Sdarrenr if ((opts & OPT_DONOTHING) == 0) { 2434255332Scy char msg[80]; 2435255332Scy 2436255332Scy sprintf(msg, "%d:ioctl(zero rule)", 2437255332Scy fr->fr_flineno); 2438255332Scy return ipf_perror_fd(fd, ioctlfunc, msg); 2439145510Sdarrenr } 2440145510Sdarrenr } else { 2441145510Sdarrenr#ifdef USE_QUAD_T 2442145510Sdarrenr printf("hits %qd bytes %qd ", 2443145510Sdarrenr (long long)fr->fr_hits, 2444145510Sdarrenr (long long)fr->fr_bytes); 2445145510Sdarrenr#else 2446145510Sdarrenr printf("hits %ld bytes %ld ", 2447145510Sdarrenr fr->fr_hits, fr->fr_bytes); 2448145510Sdarrenr#endif 2449145510Sdarrenr printfr(fr, ioctlfunc); 2450145510Sdarrenr } 2451145510Sdarrenr } else if ((opts & OPT_REMOVE) != 0) { 2452145510Sdarrenr if ((*ioctlfunc)(fd, del, (void *)&obj) == -1) { 2453255332Scy if ((opts & OPT_DONOTHING) == 0) { 2454255332Scy char msg[80]; 2455255332Scy 2456255332Scy sprintf(msg, "%d:ioctl(delete rule)", 2457255332Scy fr->fr_flineno); 2458255332Scy return ipf_perror_fd(fd, ioctlfunc, msg); 2459145510Sdarrenr } 2460145510Sdarrenr } 2461145510Sdarrenr } else { 2462145510Sdarrenr if ((*ioctlfunc)(fd, add, (void *)&obj) == -1) { 2463255332Scy if ((opts & OPT_DONOTHING) == 0) { 2464255332Scy char msg[80]; 2465255332Scy 2466255332Scy sprintf(msg, "%d:ioctl(add/insert rule)", 2467255332Scy fr->fr_flineno); 2468255332Scy return ipf_perror_fd(fd, ioctlfunc, msg); 2469145510Sdarrenr } 2470145510Sdarrenr } 2471145510Sdarrenr } 2472255332Scy return 0; 2473145510Sdarrenr} 2474145510Sdarrenr 2475145510Sdarrenrstatic void setsyslog() 2476145510Sdarrenr{ 2477145510Sdarrenr yysetdict(logwords); 2478145510Sdarrenr yybreakondot = 1; 2479145510Sdarrenr} 2480145510Sdarrenr 2481145510Sdarrenr 2482145510Sdarrenrstatic void unsetsyslog() 2483145510Sdarrenr{ 2484145510Sdarrenr yyresetdict(); 2485145510Sdarrenr yybreakondot = 0; 2486145510Sdarrenr} 2487145510Sdarrenr 2488145510Sdarrenr 2489145510Sdarrenrstatic void fillgroup(fr) 2490145510Sdarrenrfrentry_t *fr; 2491145510Sdarrenr{ 2492145510Sdarrenr frentry_t *f; 2493145510Sdarrenr 2494255332Scy for (f = frold; f != NULL; f = f->fr_next) { 2495255332Scy if (f->fr_grhead == -1 && fr->fr_group == -1) 2496145510Sdarrenr break; 2497255332Scy if (f->fr_grhead == -1 || fr->fr_group == -1) 2498255332Scy continue; 2499255332Scy if (strcmp(f->fr_names + f->fr_grhead, 2500255332Scy fr->fr_names + fr->fr_group) == 0) 2501255332Scy break; 2502255332Scy } 2503255332Scy 2504145510Sdarrenr if (f == NULL) 2505145510Sdarrenr return; 2506145510Sdarrenr 2507145510Sdarrenr /* 2508145510Sdarrenr * Only copy down matching fields if the rules are of the same type 2509145510Sdarrenr * and are of ipf type. The only fields that are copied are those 2510145510Sdarrenr * that impact the rule parsing itself, eg. need for knowing what the 2511145510Sdarrenr * protocol should be for rules with port comparisons in them. 2512145510Sdarrenr */ 2513145510Sdarrenr if (f->fr_type != fr->fr_type || f->fr_type != FR_T_IPF) 2514145510Sdarrenr return; 2515145510Sdarrenr 2516255332Scy if (fr->fr_family == 0 && f->fr_family != 0) 2517255332Scy fr->fr_family = f->fr_family; 2518145510Sdarrenr 2519145510Sdarrenr if (fr->fr_mproto == 0 && f->fr_mproto != 0) 2520145510Sdarrenr fr->fr_mproto = f->fr_mproto; 2521145510Sdarrenr if (fr->fr_proto == 0 && f->fr_proto != 0) 2522145510Sdarrenr fr->fr_proto = f->fr_proto; 2523145510Sdarrenr 2524145510Sdarrenr if ((fr->fr_mproto == 0) && ((fr->fr_flx & FI_TCPUDP) == 0) && 2525255332Scy ((f->fr_flx & FI_TCPUDP) != 0)) { 2526145510Sdarrenr fr->fr_flx |= FI_TCPUDP; 2527255332Scy fr->fr_mflx |= FI_TCPUDP; 2528255332Scy } 2529145510Sdarrenr} 2530255332Scy 2531255332Scy 2532255332Scystatic void doipfexpr(line) 2533255332Scychar *line; 2534255332Scy{ 2535255332Scy int *array; 2536255332Scy char *error; 2537255332Scy 2538255332Scy array = parseipfexpr(line, &error); 2539255332Scy if (array == NULL) { 2540255332Scy fprintf(stderr, "%s:", error); 2541255332Scy yyerror("error parsing ipf matching expression"); 2542255332Scy return; 2543255332Scy } 2544255332Scy 2545255332Scy fr->fr_type = FR_T_IPFEXPR; 2546255332Scy fr->fr_data = array; 2547255332Scy fr->fr_dsize = array[0] * sizeof(*array); 2548255332Scy} 2549255332Scy 2550255332Scy 2551255332Scystatic void do_tuneint(varname, value) 2552255332Scychar *varname; 2553255332Scyint value; 2554255332Scy{ 2555255332Scy char buffer[80]; 2556255332Scy 2557255332Scy strncpy(buffer, varname, 60); 2558255332Scy buffer[59] = '\0'; 2559255332Scy strcat(buffer, "="); 2560255332Scy sprintf(buffer, "%u", value); 2561255332Scy ipf_dotuning(ipffd, buffer, ioctl); 2562255332Scy} 2563255332Scy 2564255332Scy 2565255332Scystatic void do_tunestr(varname, value) 2566255332Scychar *varname, *value; 2567255332Scy{ 2568255332Scy 2569255332Scy if (!strcasecmp(value, "true")) { 2570255332Scy do_tuneint(varname, 1); 2571255332Scy } else if (!strcasecmp(value, "false")) { 2572255332Scy do_tuneint(varname, 0); 2573255332Scy } else { 2574255332Scy yyerror("did not find true/false where expected"); 2575255332Scy } 2576255332Scy} 2577255332Scy 2578255332Scy 2579255332Scystatic void setifname(frp, idx, name) 2580255332Scyfrentry_t **frp; 2581255332Scyint idx; 2582255332Scychar *name; 2583255332Scy{ 2584255332Scy int pos; 2585255332Scy 2586255332Scy pos = addname(frp, name); 2587255332Scy if (pos == -1) 2588255332Scy return; 2589255332Scy (*frp)->fr_ifnames[idx] = pos; 2590255332Scy} 2591255332Scy 2592255332Scy 2593255332Scystatic int addname(frp, name) 2594255332Scyfrentry_t **frp; 2595255332Scychar *name; 2596255332Scy{ 2597255332Scy frentry_t *f; 2598255332Scy int nlen; 2599255332Scy int pos; 2600255332Scy 2601255332Scy nlen = strlen(name) + 1; 2602255332Scy f = realloc(*frp, (*frp)->fr_size + nlen); 2603255332Scy if (*frp == frc) 2604255332Scy frc = f; 2605255332Scy *frp = f; 2606255332Scy if (f == NULL) 2607255332Scy return -1; 2608255332Scy if (f->fr_pnext != NULL) 2609255332Scy *f->fr_pnext = f; 2610255332Scy f->fr_size += nlen; 2611255332Scy pos = f->fr_namelen; 2612255332Scy f->fr_namelen += nlen; 2613255332Scy strcpy(f->fr_names + pos, name); 2614255332Scy f->fr_names[f->fr_namelen] = '\0'; 2615255332Scy return pos; 2616255332Scy} 2617255332Scy 2618255332Scy 2619255332Scystatic frentry_t *allocfr() 2620255332Scy{ 2621255332Scy frentry_t *fr; 2622255332Scy 2623255332Scy fr = calloc(1, sizeof(*fr)); 2624255332Scy if (fr != NULL) { 2625255332Scy fr->fr_size = sizeof(*fr); 2626255332Scy fr->fr_comment = -1; 2627255332Scy fr->fr_group = -1; 2628255332Scy fr->fr_grhead = -1; 2629255332Scy fr->fr_icmphead = -1; 2630255332Scy fr->fr_ifnames[0] = -1; 2631255332Scy fr->fr_ifnames[1] = -1; 2632255332Scy fr->fr_ifnames[2] = -1; 2633255332Scy fr->fr_ifnames[3] = -1; 2634255332Scy fr->fr_tif.fd_name = -1; 2635255332Scy fr->fr_rif.fd_name = -1; 2636255332Scy fr->fr_dif.fd_name = -1; 2637255332Scy } 2638255332Scy return fr; 2639255332Scy} 2640255332Scy 2641255332Scy 2642255332Scystatic void setgroup(frp, name) 2643255332Scyfrentry_t **frp; 2644255332Scychar *name; 2645255332Scy{ 2646255332Scy int pos; 2647255332Scy 2648255332Scy pos = addname(frp, name); 2649255332Scy if (pos == -1) 2650255332Scy return; 2651255332Scy (*frp)->fr_group = pos; 2652255332Scy} 2653255332Scy 2654255332Scy 2655255332Scystatic void setgrhead(frp, name) 2656255332Scyfrentry_t **frp; 2657255332Scychar *name; 2658255332Scy{ 2659255332Scy int pos; 2660255332Scy 2661255332Scy pos = addname(frp, name); 2662255332Scy if (pos == -1) 2663255332Scy return; 2664255332Scy (*frp)->fr_grhead = pos; 2665255332Scy} 2666255332Scy 2667255332Scy 2668255332Scystatic void seticmphead(frp, name) 2669255332Scyfrentry_t **frp; 2670255332Scychar *name; 2671255332Scy{ 2672255332Scy int pos; 2673255332Scy 2674255332Scy pos = addname(frp, name); 2675255332Scy if (pos == -1) 2676255332Scy return; 2677255332Scy (*frp)->fr_icmphead = pos; 2678255332Scy} 2679255332Scy 2680255332Scy 2681255332Scystatic void 2682255332Scybuild_dstaddr_af(fp, ptr) 2683255332Scy frentry_t *fp; 2684255332Scy void *ptr; 2685255332Scy{ 2686255332Scy struct ipp_s *ipp = ptr; 2687255332Scy frentry_t *f = fp; 2688255332Scy 2689255332Scy if (f->fr_family != AF_UNSPEC && ipp->f == AF_UNSPEC) { 2690255332Scy ipp->f = f->fr_family; 2691255332Scy ipp->v = f->fr_ip.fi_v; 2692255332Scy } 2693255332Scy if (ipp->f == AF_INET) 2694255332Scy ipp->v = 4; 2695255332Scy else if (ipp->f == AF_INET6) 2696255332Scy ipp->v = 6; 2697255332Scy 2698255332Scy for (; f != NULL; f = f->fr_next) { 2699255332Scy f->fr_ip.fi_dst = ipp->a; 2700255332Scy f->fr_mip.fi_dst = ipp->m; 2701255332Scy f->fr_family = ipp->f; 2702255332Scy f->fr_ip.fi_v = ipp->v; 2703255332Scy f->fr_mip.fi_v = 0xf; 2704255332Scy f->fr_datype = ipp->type; 2705255332Scy if (ipp->ifpos != -1) 2706255332Scy f->fr_ipf->fri_difpidx = ipp->ifpos; 2707255332Scy } 2708255332Scy fr = NULL; 2709255332Scy} 2710255332Scy 2711255332Scy 2712255332Scystatic void 2713255332Scybuild_srcaddr_af(fp, ptr) 2714255332Scy frentry_t *fp; 2715255332Scy void *ptr; 2716255332Scy{ 2717255332Scy struct ipp_s *ipp = ptr; 2718255332Scy frentry_t *f = fp; 2719255332Scy 2720255332Scy if (f->fr_family != AF_UNSPEC && ipp->f == AF_UNSPEC) { 2721255332Scy ipp->f = f->fr_family; 2722255332Scy ipp->v = f->fr_ip.fi_v; 2723255332Scy } 2724255332Scy if (ipp->f == AF_INET) 2725255332Scy ipp->v = 4; 2726255332Scy else if (ipp->f == AF_INET6) 2727255332Scy ipp->v = 6; 2728255332Scy 2729255332Scy for (; f != NULL; f = f->fr_next) { 2730255332Scy f->fr_ip.fi_src = ipp->a; 2731255332Scy f->fr_mip.fi_src = ipp->m; 2732255332Scy f->fr_family = ipp->f; 2733255332Scy f->fr_ip.fi_v = ipp->v; 2734255332Scy f->fr_mip.fi_v = 0xf; 2735255332Scy f->fr_satype = ipp->type; 2736255332Scy f->fr_ipf->fri_sifpidx = ipp->ifpos; 2737255332Scy } 2738255332Scy fr = NULL; 2739255332Scy} 2740