1 /* $FreeBSD$ */ 2 3 %{ 4 /* 5 * Copyright (C) 2012 by Darren Reed. 6 * 7 * See the IPFILTER.LICENCE file for details on licencing. 8 * 9 * $Id$ 10 */ 11 #include <stdio.h> 12 #include <string.h> 13 #include <sys/param.h> 14 #if defined(__SVR4) || defined(__sysv__) 15 #include <sys/stream.h> 16 #endif 17 #include <sys/types.h> 18 #include <netinet/in_systm.h> 19 #include <netinet/in.h> 20 #include "iplang_y.h" 21 #include "ipf.h" 22 23 #ifndef __P 24 # define __P(x) x 25 #endif 26 27 extern int opts; 28 29 int lineNum = 0, ipproto = 0, oldipproto = 0, next = -1, laststate = 0; 30 int *prstack = NULL, numpr = 0, state = 0, token = 0; 31 32 void yyerror(char *); 33 void push_proto(void); 34 void pop_proto(void); 35 int next_state(int, int); 36 int next_item(int); 37 int save_token(void); 38 void swallow(void); 39 int yylex(void); 40 41 struct lwordtab { 42 char *word; 43 int state; 44 int next; 45 }; 46 47 struct lwordtab words[] = { 48 { "interface", IL_INTERFACE, -1 }, 49 { "iface", IL_INTERFACE, -1 }, 50 { "name", IL_IFNAME, IL_TOKEN }, 51 { "ifname", IL_IFNAME, IL_TOKEN }, 52 { "router", IL_DEFROUTER, IL_TOKEN }, 53 { "mtu", IL_MTU, IL_NUMBER }, 54 { "eaddr", IL_EADDR, IL_TOKEN }, 55 { "v4addr", IL_V4ADDR, IL_TOKEN }, 56 { "ipv4", IL_IPV4, -1 }, 57 { "v", IL_V4V, IL_TOKEN }, 58 { "proto", IL_V4PROTO, IL_TOKEN }, 59 { "hl", IL_V4HL, IL_TOKEN }, 60 { "id", IL_V4ID, IL_TOKEN }, 61 { "ttl", IL_V4TTL, IL_TOKEN }, 62 { "tos", IL_V4TOS, IL_TOKEN }, 63 { "src", IL_V4SRC, IL_TOKEN }, 64 { "dst", IL_V4DST, IL_TOKEN }, 65 { "opt", IL_OPT, -1 }, 66 { "len", IL_LEN, IL_TOKEN }, 67 { "off", IL_OFF, IL_TOKEN }, 68 { "sum", IL_SUM, IL_TOKEN }, 69 { "tcp", IL_TCP, -1 }, 70 { "sport", IL_SPORT, IL_TOKEN }, 71 { "dport", IL_DPORT, IL_TOKEN }, 72 { "seq", IL_TCPSEQ, IL_TOKEN }, 73 { "ack", IL_TCPACK, IL_TOKEN }, 74 { "flags", IL_TCPFL, IL_TOKEN }, 75 { "urp", IL_TCPURP, IL_TOKEN }, 76 { "win", IL_TCPWIN, IL_TOKEN }, 77 { "udp", IL_UDP, -1 }, 78 { "send", IL_SEND, -1 }, 79 { "via", IL_VIA, IL_TOKEN }, 80 { "arp", IL_ARP, -1 }, 81 { "data", IL_DATA, -1 }, 82 { "value", IL_DVALUE, IL_TOKEN }, 83 { "file", IL_DFILE, IL_TOKEN }, 84 { "nop", IL_IPO_NOP, -1 }, 85 { "eol", IL_IPO_EOL, -1 }, 86 { "rr", IL_IPO_RR, -1 }, 87 { "zsu", IL_IPO_ZSU, -1 }, 88 { "mtup", IL_IPO_MTUP, -1 }, 89 { "mtur", IL_IPO_MTUR, -1 }, 90 { "encode", IL_IPO_ENCODE, -1 }, 91 { "ts", IL_IPO_TS, -1 }, 92 { "tr", IL_IPO_TR, -1 }, 93 { "sec", IL_IPO_SEC, -1 }, 94 { "secclass", IL_IPO_SECCLASS, IL_TOKEN }, 95 { "lsrr", IL_IPO_LSRR, -1 }, 96 { "esec", IL_IPO_ESEC, -1 }, 97 { "cipso", IL_IPO_CIPSO, -1 }, 98 { "satid", IL_IPO_SATID, -1 }, 99 { "ssrr", IL_IPO_SSRR, -1 }, 100 { "addext", IL_IPO_ADDEXT, -1 }, 101 { "visa", IL_IPO_VISA, -1 }, 102 { "imitd", IL_IPO_IMITD, -1 }, 103 { "eip", IL_IPO_EIP, -1 }, 104 { "finn", IL_IPO_FINN, -1 }, 105 { "mss", IL_TCPO_MSS, IL_TOKEN }, 106 { "wscale", IL_TCPO_WSCALE, IL_TOKEN }, 107 { "reserv-4", IL_IPS_RESERV4, -1 }, 108 { "topsecret", IL_IPS_TOPSECRET, -1 }, 109 { "secret", IL_IPS_SECRET, -1 }, 110 { "reserv-3", IL_IPS_RESERV3, -1 }, 111 { "confid", IL_IPS_CONFID, -1 }, 112 { "unclass", IL_IPS_UNCLASS, -1 }, 113 { "reserv-2", IL_IPS_RESERV2, -1 }, 114 { "reserv-1", IL_IPS_RESERV1, -1 }, 115 { "icmp", IL_ICMP, -1 }, 116 { "type", IL_ICMPTYPE, -1 }, 117 { "code", IL_ICMPCODE, -1 }, 118 { "echorep", IL_ICMP_ECHOREPLY, -1 }, 119 { "unreach", IL_ICMP_UNREACH, -1 }, 120 { "squench", IL_ICMP_SOURCEQUENCH, -1 }, 121 { "redir", IL_ICMP_REDIRECT, -1 }, 122 { "echo", IL_ICMP_ECHO, -1 }, 123 { "routerad", IL_ICMP_ROUTERADVERT, -1 }, 124 { "routersol", IL_ICMP_ROUTERSOLICIT, -1 }, 125 { "timex", IL_ICMP_TIMXCEED, -1 }, 126 { "paramprob", IL_ICMP_PARAMPROB, -1 }, 127 { "timest", IL_ICMP_TSTAMP, -1 }, 128 { "timestrep", IL_ICMP_TSTAMPREPLY, -1 }, 129 { "inforeq", IL_ICMP_IREQ, -1 }, 130 { "inforep", IL_ICMP_IREQREPLY, -1 }, 131 { "maskreq", IL_ICMP_MASKREQ, -1 }, 132 { "maskrep", IL_ICMP_MASKREPLY, -1 }, 133 { "net-unr", IL_ICMP_UNREACH_NET, -1 }, 134 { "host-unr", IL_ICMP_UNREACH_HOST, -1 }, 135 { "proto-unr", IL_ICMP_UNREACH_PROTOCOL, -1 }, 136 { "port-unr", IL_ICMP_UNREACH_PORT, -1 }, 137 { "needfrag", IL_ICMP_UNREACH_NEEDFRAG, -1 }, 138 { "srcfail", IL_ICMP_UNREACH_SRCFAIL, -1 }, 139 { "net-unk", IL_ICMP_UNREACH_NET_UNKNOWN, -1 }, 140 { "host-unk", IL_ICMP_UNREACH_HOST_UNKNOWN, -1 }, 141 { "isolate", IL_ICMP_UNREACH_ISOLATED, -1 }, 142 { "net-prohib", IL_ICMP_UNREACH_NET_PROHIB, -1 }, 143 { "host-prohib", IL_ICMP_UNREACH_HOST_PROHIB, -1 }, 144 { "net-tos", IL_ICMP_UNREACH_TOSNET, -1 }, 145 { "host-tos", IL_ICMP_UNREACH_TOSHOST, -1 }, 146 { "filter-prohib", IL_ICMP_UNREACH_FILTER_PROHIB, -1 }, 147 { "host-preced", IL_ICMP_UNREACH_HOST_PRECEDENCE, -1 }, 148 { "cutoff-preced", IL_ICMP_UNREACH_PRECEDENCE_CUTOFF, -1 }, 149 { "net-redir", IL_ICMP_REDIRECT_NET, -1 }, 150 { "host-redir", IL_ICMP_REDIRECT_HOST, -1 }, 151 { "tos-net-redir", IL_ICMP_REDIRECT_TOSNET, -1 }, 152 { "tos-host-redir", IL_ICMP_REDIRECT_TOSHOST, -1 }, 153 { "intrans", IL_ICMP_TIMXCEED_INTRANS, -1 }, 154 { "reass", IL_ICMP_TIMXCEED_REASS, -1 }, 155 { "optabsent", IL_ICMP_PARAMPROB_OPTABSENT, -1 }, 156 { "otime", IL_ICMP_OTIME, -1 }, 157 { "rtime", IL_ICMP_RTIME, -1 }, 158 { "ttime", IL_ICMP_TTIME, -1 }, 159 { "icmpseq", IL_ICMP_SEQ, -1 }, 160 { "icmpid", IL_ICMP_SEQ, -1 }, 161 { ".", IL_DOT, -1 }, 162 { NULL, 0, 0 } 163 }; 164 %} 165 white [ \t\r]+ 166 %% 167 {white} ; 168 \n { lineNum++; swallow(); } 169 \{ {( push_proto(); return next_item('{'); }); 170 \} {( pop_proto(); return next_item('}'); }); 171 ; {( return next_item(';'); }); 172 [0-9]+ {( return next_item(IL_NUMBER); }); 173 [0-9a-fA-F] {( return next_item(IL_HEXDIGIT); }); 174 : {( return next_item(IL_COLON); }); 175 #[^\n]* {( return next_item(IL_COMMENT); }); 176 [^( \{\}\n\t;:{}]* { return next_item(IL_TOKEN); }); 177 \"[^\"]*\" {( return next_item(IL_TOKEN); }); 178 %% 179 void yyerror(msg) 180 char *msg; 181 { 182 fprintf(stderr, "%s error at \"%s\", line %d\n", msg, yytext, 183 lineNum + 1); 184 exit(1); 185 } 186 187 188 void push_proto(void) 189 { 190 numpr++; 191 if (!prstack) 192 prstack = (int *)malloc(sizeof(int)); 193 else 194 prstack = (int *)reallocarray((char *)prstack, numpr, 195 sizeof(int)); 196 prstack[numpr - 1] = oldipproto; 197 } 198 199 200 void pop_proto(void) 201 { 202 numpr--; 203 ipproto = prstack[numpr]; 204 if (!numpr) { 205 free(prstack); 206 prstack = NULL; 207 return; 208 } 209 prstack = (int *)realloc((char *)prstack, numpr * sizeof(int)); 210 } 211 212 213 int save_token(void) 214 { 215 216 yylval.str = strdup((char *)yytext); 217 return(IL_TOKEN); 218 } 219 220 221 int next_item(int nstate) 222 { 223 struct lwordtab *wt; 224 225 if (opts & OPT_DEBUG) 226 printf("text=[%s] id=%d next=%d\n", yytext, nstate, next); 227 if (next == IL_TOKEN) { 228 next = -1; 229 return(save_token()); 230 } 231 token++; 232 233 for (wt = words; wt->word; wt++) 234 if (!strcasecmp(wt->word, (char *)yytext)) 235 return(next_state(wt->state, wt->next)); 236 if (opts & OPT_DEBUG) 237 printf("unknown keyword=[%s]\n", yytext); 238 next = -1; 239 if (nstate == IL_NUMBER) 240 yylval.num = atoi((char *)yytext); 241 token++; 242 return(nstate); 243 } 244 245 246 int next_state(int nstate, int fornext) 247 { 248 next = fornext; 249 250 switch (nstate) 251 { 252 case IL_IPV4 : 253 case IL_TCP : 254 case IL_UDP : 255 case IL_ICMP : 256 case IL_DATA : 257 case IL_INTERFACE : 258 case IL_ARP : 259 oldipproto = ipproto; 260 ipproto = nstate; 261 break; 262 case IL_SUM : 263 if (ipproto == IL_IPV4) 264 nstate = IL_V4SUM; 265 else if (ipproto == IL_TCP) 266 nstate = IL_TCPSUM; 267 else if (ipproto == IL_UDP) 268 nstate = IL_UDPSUM; 269 break; 270 case IL_OPT : 271 if (ipproto == IL_IPV4) 272 nstate = IL_V4OPT; 273 else if (ipproto == IL_TCP) 274 nstate = IL_TCPOPT; 275 break; 276 case IL_IPO_NOP : 277 if (ipproto == IL_TCP) 278 nstate = IL_TCPO_NOP; 279 break; 280 case IL_IPO_EOL : 281 if (ipproto == IL_TCP) 282 nstate = IL_TCPO_EOL; 283 break; 284 case IL_IPO_TS : 285 if (ipproto == IL_TCP) 286 nstate = IL_TCPO_TS; 287 break; 288 case IL_OFF : 289 if (ipproto == IL_IPV4) 290 nstate = IL_V4OFF; 291 else if (ipproto == IL_TCP) 292 nstate = IL_TCPOFF; 293 break; 294 case IL_LEN : 295 if (ipproto == IL_IPV4) 296 nstate = IL_V4LEN; 297 else if (ipproto == IL_UDP) 298 nstate = IL_UDPLEN; 299 break; 300 } 301 return(nstate); 302 } 303 304 305 void swallow(void) 306 { 307 int c; 308 309 c = input(); 310 311 if (c == '#') { 312 while ((c != '\n') && (c != EOF)) 313 c = input(); 314 } 315 if (c != EOF) 316 unput(c); 317 } 318