13b3a8eb9SGleb Smirnoff /* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */ 23b3a8eb9SGleb Smirnoff 33b3a8eb9SGleb Smirnoff /* 43b3a8eb9SGleb Smirnoff * Copyright (c) 2001 Markus Friedl. All rights reserved. 53b3a8eb9SGleb Smirnoff * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 63b3a8eb9SGleb Smirnoff * Copyright (c) 2001 Theo de Raadt. All rights reserved. 73b3a8eb9SGleb Smirnoff * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 83b3a8eb9SGleb Smirnoff * 93b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 103b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 113b3a8eb9SGleb Smirnoff * are met: 123b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 133b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 143b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 153b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 163b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 173b3a8eb9SGleb Smirnoff * 183b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 193b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 203b3a8eb9SGleb Smirnoff * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 213b3a8eb9SGleb Smirnoff * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 223b3a8eb9SGleb Smirnoff * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 233b3a8eb9SGleb Smirnoff * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 243b3a8eb9SGleb Smirnoff * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 253b3a8eb9SGleb Smirnoff * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 263b3a8eb9SGleb Smirnoff * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 273b3a8eb9SGleb Smirnoff * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 283b3a8eb9SGleb Smirnoff */ 293b3a8eb9SGleb Smirnoff %{ 303b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 313b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 323b3a8eb9SGleb Smirnoff 333b3a8eb9SGleb Smirnoff #include <sys/types.h> 343b3a8eb9SGleb Smirnoff #include <sys/socket.h> 353b3a8eb9SGleb Smirnoff #include <sys/stat.h> 363b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 373b3a8eb9SGleb Smirnoff #include <sys/sysctl.h> 383b3a8eb9SGleb Smirnoff #endif 393b3a8eb9SGleb Smirnoff #include <net/if.h> 403b3a8eb9SGleb Smirnoff #include <netinet/in.h> 413b3a8eb9SGleb Smirnoff #include <netinet/in_systm.h> 423b3a8eb9SGleb Smirnoff #include <netinet/ip.h> 433b3a8eb9SGleb Smirnoff #include <netinet/ip_icmp.h> 443b3a8eb9SGleb Smirnoff #include <netinet/icmp6.h> 453b3a8eb9SGleb Smirnoff #include <net/pfvar.h> 463b3a8eb9SGleb Smirnoff #include <arpa/inet.h> 47772e66a6SGleb Smirnoff #include <net/altq/altq.h> 48772e66a6SGleb Smirnoff #include <net/altq/altq_cbq.h> 49772e66a6SGleb Smirnoff #include <net/altq/altq_priq.h> 50772e66a6SGleb Smirnoff #include <net/altq/altq_hfsc.h> 51*a5b789f6SErmal Luçi #include <net/altq/altq_fairq.h> 523b3a8eb9SGleb Smirnoff 533b3a8eb9SGleb Smirnoff #include <stdio.h> 543b3a8eb9SGleb Smirnoff #include <unistd.h> 553b3a8eb9SGleb Smirnoff #include <stdlib.h> 563b3a8eb9SGleb Smirnoff #include <netdb.h> 573b3a8eb9SGleb Smirnoff #include <stdarg.h> 583b3a8eb9SGleb Smirnoff #include <errno.h> 593b3a8eb9SGleb Smirnoff #include <string.h> 603b3a8eb9SGleb Smirnoff #include <ctype.h> 613b3a8eb9SGleb Smirnoff #include <math.h> 623b3a8eb9SGleb Smirnoff #include <err.h> 633b3a8eb9SGleb Smirnoff #include <limits.h> 643b3a8eb9SGleb Smirnoff #include <pwd.h> 653b3a8eb9SGleb Smirnoff #include <grp.h> 663b3a8eb9SGleb Smirnoff #include <md5.h> 673b3a8eb9SGleb Smirnoff 683b3a8eb9SGleb Smirnoff #include "pfctl_parser.h" 693b3a8eb9SGleb Smirnoff #include "pfctl.h" 703b3a8eb9SGleb Smirnoff 713b3a8eb9SGleb Smirnoff static struct pfctl *pf = NULL; 723b3a8eb9SGleb Smirnoff static int debug = 0; 733b3a8eb9SGleb Smirnoff static int rulestate = 0; 743b3a8eb9SGleb Smirnoff static u_int16_t returnicmpdefault = 753b3a8eb9SGleb Smirnoff (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 763b3a8eb9SGleb Smirnoff static u_int16_t returnicmp6default = 773b3a8eb9SGleb Smirnoff (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 783b3a8eb9SGleb Smirnoff static int blockpolicy = PFRULE_DROP; 793b3a8eb9SGleb Smirnoff static int require_order = 1; 803b3a8eb9SGleb Smirnoff static int default_statelock; 813b3a8eb9SGleb Smirnoff 823b3a8eb9SGleb Smirnoff TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 833b3a8eb9SGleb Smirnoff static struct file { 843b3a8eb9SGleb Smirnoff TAILQ_ENTRY(file) entry; 853b3a8eb9SGleb Smirnoff FILE *stream; 863b3a8eb9SGleb Smirnoff char *name; 873b3a8eb9SGleb Smirnoff int lineno; 883b3a8eb9SGleb Smirnoff int errors; 893b3a8eb9SGleb Smirnoff } *file; 903b3a8eb9SGleb Smirnoff struct file *pushfile(const char *, int); 913b3a8eb9SGleb Smirnoff int popfile(void); 923b3a8eb9SGleb Smirnoff int check_file_secrecy(int, const char *); 933b3a8eb9SGleb Smirnoff int yyparse(void); 943b3a8eb9SGleb Smirnoff int yylex(void); 953b3a8eb9SGleb Smirnoff int yyerror(const char *, ...); 963b3a8eb9SGleb Smirnoff int kw_cmp(const void *, const void *); 973b3a8eb9SGleb Smirnoff int lookup(char *); 983b3a8eb9SGleb Smirnoff int lgetc(int); 993b3a8eb9SGleb Smirnoff int lungetc(int); 1003b3a8eb9SGleb Smirnoff int findeol(void); 1013b3a8eb9SGleb Smirnoff 1023b3a8eb9SGleb Smirnoff TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 1033b3a8eb9SGleb Smirnoff struct sym { 1043b3a8eb9SGleb Smirnoff TAILQ_ENTRY(sym) entry; 1053b3a8eb9SGleb Smirnoff int used; 1063b3a8eb9SGleb Smirnoff int persist; 1073b3a8eb9SGleb Smirnoff char *nam; 1083b3a8eb9SGleb Smirnoff char *val; 1093b3a8eb9SGleb Smirnoff }; 1103b3a8eb9SGleb Smirnoff int symset(const char *, const char *, int); 1113b3a8eb9SGleb Smirnoff char *symget(const char *); 1123b3a8eb9SGleb Smirnoff 1133b3a8eb9SGleb Smirnoff int atoul(char *, u_long *); 1143b3a8eb9SGleb Smirnoff 1153b3a8eb9SGleb Smirnoff enum { 1163b3a8eb9SGleb Smirnoff PFCTL_STATE_NONE, 1173b3a8eb9SGleb Smirnoff PFCTL_STATE_OPTION, 1183b3a8eb9SGleb Smirnoff PFCTL_STATE_SCRUB, 1193b3a8eb9SGleb Smirnoff PFCTL_STATE_QUEUE, 1203b3a8eb9SGleb Smirnoff PFCTL_STATE_NAT, 1213b3a8eb9SGleb Smirnoff PFCTL_STATE_FILTER 1223b3a8eb9SGleb Smirnoff }; 1233b3a8eb9SGleb Smirnoff 1243b3a8eb9SGleb Smirnoff struct node_proto { 1253b3a8eb9SGleb Smirnoff u_int8_t proto; 1263b3a8eb9SGleb Smirnoff struct node_proto *next; 1273b3a8eb9SGleb Smirnoff struct node_proto *tail; 1283b3a8eb9SGleb Smirnoff }; 1293b3a8eb9SGleb Smirnoff 1303b3a8eb9SGleb Smirnoff struct node_port { 1313b3a8eb9SGleb Smirnoff u_int16_t port[2]; 1323b3a8eb9SGleb Smirnoff u_int8_t op; 1333b3a8eb9SGleb Smirnoff struct node_port *next; 1343b3a8eb9SGleb Smirnoff struct node_port *tail; 1353b3a8eb9SGleb Smirnoff }; 1363b3a8eb9SGleb Smirnoff 1373b3a8eb9SGleb Smirnoff struct node_uid { 1383b3a8eb9SGleb Smirnoff uid_t uid[2]; 1393b3a8eb9SGleb Smirnoff u_int8_t op; 1403b3a8eb9SGleb Smirnoff struct node_uid *next; 1413b3a8eb9SGleb Smirnoff struct node_uid *tail; 1423b3a8eb9SGleb Smirnoff }; 1433b3a8eb9SGleb Smirnoff 1443b3a8eb9SGleb Smirnoff struct node_gid { 1453b3a8eb9SGleb Smirnoff gid_t gid[2]; 1463b3a8eb9SGleb Smirnoff u_int8_t op; 1473b3a8eb9SGleb Smirnoff struct node_gid *next; 1483b3a8eb9SGleb Smirnoff struct node_gid *tail; 1493b3a8eb9SGleb Smirnoff }; 1503b3a8eb9SGleb Smirnoff 1513b3a8eb9SGleb Smirnoff struct node_icmp { 1523b3a8eb9SGleb Smirnoff u_int8_t code; 1533b3a8eb9SGleb Smirnoff u_int8_t type; 1543b3a8eb9SGleb Smirnoff u_int8_t proto; 1553b3a8eb9SGleb Smirnoff struct node_icmp *next; 1563b3a8eb9SGleb Smirnoff struct node_icmp *tail; 1573b3a8eb9SGleb Smirnoff }; 1583b3a8eb9SGleb Smirnoff 1593b3a8eb9SGleb Smirnoff enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 1603b3a8eb9SGleb Smirnoff PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 1613b3a8eb9SGleb Smirnoff PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 1623b3a8eb9SGleb Smirnoff PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 1633b3a8eb9SGleb Smirnoff PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, }; 1643b3a8eb9SGleb Smirnoff 1653b3a8eb9SGleb Smirnoff enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 1663b3a8eb9SGleb Smirnoff 1673b3a8eb9SGleb Smirnoff struct node_state_opt { 1683b3a8eb9SGleb Smirnoff int type; 1693b3a8eb9SGleb Smirnoff union { 1703b3a8eb9SGleb Smirnoff u_int32_t max_states; 1713b3a8eb9SGleb Smirnoff u_int32_t max_src_states; 1723b3a8eb9SGleb Smirnoff u_int32_t max_src_conn; 1733b3a8eb9SGleb Smirnoff struct { 1743b3a8eb9SGleb Smirnoff u_int32_t limit; 1753b3a8eb9SGleb Smirnoff u_int32_t seconds; 1763b3a8eb9SGleb Smirnoff } max_src_conn_rate; 1773b3a8eb9SGleb Smirnoff struct { 1783b3a8eb9SGleb Smirnoff u_int8_t flush; 1793b3a8eb9SGleb Smirnoff char tblname[PF_TABLE_NAME_SIZE]; 1803b3a8eb9SGleb Smirnoff } overload; 1813b3a8eb9SGleb Smirnoff u_int32_t max_src_nodes; 1823b3a8eb9SGleb Smirnoff u_int8_t src_track; 1833b3a8eb9SGleb Smirnoff u_int32_t statelock; 1843b3a8eb9SGleb Smirnoff struct { 1853b3a8eb9SGleb Smirnoff int number; 1863b3a8eb9SGleb Smirnoff u_int32_t seconds; 1873b3a8eb9SGleb Smirnoff } timeout; 1883b3a8eb9SGleb Smirnoff } data; 1893b3a8eb9SGleb Smirnoff struct node_state_opt *next; 1903b3a8eb9SGleb Smirnoff struct node_state_opt *tail; 1913b3a8eb9SGleb Smirnoff }; 1923b3a8eb9SGleb Smirnoff 1933b3a8eb9SGleb Smirnoff struct peer { 1943b3a8eb9SGleb Smirnoff struct node_host *host; 1953b3a8eb9SGleb Smirnoff struct node_port *port; 1963b3a8eb9SGleb Smirnoff }; 1973b3a8eb9SGleb Smirnoff 1983b3a8eb9SGleb Smirnoff struct node_queue { 1993b3a8eb9SGleb Smirnoff char queue[PF_QNAME_SIZE]; 2003b3a8eb9SGleb Smirnoff char parent[PF_QNAME_SIZE]; 2013b3a8eb9SGleb Smirnoff char ifname[IFNAMSIZ]; 2023b3a8eb9SGleb Smirnoff int scheduler; 2033b3a8eb9SGleb Smirnoff struct node_queue *next; 2043b3a8eb9SGleb Smirnoff struct node_queue *tail; 2053b3a8eb9SGleb Smirnoff } *queues = NULL; 2063b3a8eb9SGleb Smirnoff 2073b3a8eb9SGleb Smirnoff struct node_qassign { 2083b3a8eb9SGleb Smirnoff char *qname; 2093b3a8eb9SGleb Smirnoff char *pqname; 2103b3a8eb9SGleb Smirnoff }; 2113b3a8eb9SGleb Smirnoff 2123b3a8eb9SGleb Smirnoff struct filter_opts { 2133b3a8eb9SGleb Smirnoff int marker; 2143b3a8eb9SGleb Smirnoff #define FOM_FLAGS 0x01 2153b3a8eb9SGleb Smirnoff #define FOM_ICMP 0x02 2163b3a8eb9SGleb Smirnoff #define FOM_TOS 0x04 2173b3a8eb9SGleb Smirnoff #define FOM_KEEP 0x08 2183b3a8eb9SGleb Smirnoff #define FOM_SRCTRACK 0x10 2193b3a8eb9SGleb Smirnoff struct node_uid *uid; 2203b3a8eb9SGleb Smirnoff struct node_gid *gid; 2213b3a8eb9SGleb Smirnoff struct { 2223b3a8eb9SGleb Smirnoff u_int8_t b1; 2233b3a8eb9SGleb Smirnoff u_int8_t b2; 2243b3a8eb9SGleb Smirnoff u_int16_t w; 2253b3a8eb9SGleb Smirnoff u_int16_t w2; 2263b3a8eb9SGleb Smirnoff } flags; 2273b3a8eb9SGleb Smirnoff struct node_icmp *icmpspec; 2283b3a8eb9SGleb Smirnoff u_int32_t tos; 2293b3a8eb9SGleb Smirnoff u_int32_t prob; 2303b3a8eb9SGleb Smirnoff struct { 2313b3a8eb9SGleb Smirnoff int action; 2323b3a8eb9SGleb Smirnoff struct node_state_opt *options; 2333b3a8eb9SGleb Smirnoff } keep; 2343b3a8eb9SGleb Smirnoff int fragment; 2353b3a8eb9SGleb Smirnoff int allowopts; 2363b3a8eb9SGleb Smirnoff char *label; 2373b3a8eb9SGleb Smirnoff struct node_qassign queues; 2383b3a8eb9SGleb Smirnoff char *tag; 2393b3a8eb9SGleb Smirnoff char *match_tag; 2403b3a8eb9SGleb Smirnoff u_int8_t match_tag_not; 2413b3a8eb9SGleb Smirnoff u_int rtableid; 2423b3a8eb9SGleb Smirnoff struct { 2433b3a8eb9SGleb Smirnoff struct node_host *addr; 2443b3a8eb9SGleb Smirnoff u_int16_t port; 2453b3a8eb9SGleb Smirnoff } divert; 2463b3a8eb9SGleb Smirnoff } filter_opts; 2473b3a8eb9SGleb Smirnoff 2483b3a8eb9SGleb Smirnoff struct antispoof_opts { 2493b3a8eb9SGleb Smirnoff char *label; 2503b3a8eb9SGleb Smirnoff u_int rtableid; 2513b3a8eb9SGleb Smirnoff } antispoof_opts; 2523b3a8eb9SGleb Smirnoff 2533b3a8eb9SGleb Smirnoff struct scrub_opts { 2543b3a8eb9SGleb Smirnoff int marker; 2553b3a8eb9SGleb Smirnoff #define SOM_MINTTL 0x01 2563b3a8eb9SGleb Smirnoff #define SOM_MAXMSS 0x02 2573b3a8eb9SGleb Smirnoff #define SOM_FRAGCACHE 0x04 2583b3a8eb9SGleb Smirnoff #define SOM_SETTOS 0x08 2593b3a8eb9SGleb Smirnoff int nodf; 2603b3a8eb9SGleb Smirnoff int minttl; 2613b3a8eb9SGleb Smirnoff int maxmss; 2623b3a8eb9SGleb Smirnoff int settos; 2633b3a8eb9SGleb Smirnoff int fragcache; 2643b3a8eb9SGleb Smirnoff int randomid; 2653b3a8eb9SGleb Smirnoff int reassemble_tcp; 2663b3a8eb9SGleb Smirnoff char *match_tag; 2673b3a8eb9SGleb Smirnoff u_int8_t match_tag_not; 2683b3a8eb9SGleb Smirnoff u_int rtableid; 2693b3a8eb9SGleb Smirnoff } scrub_opts; 2703b3a8eb9SGleb Smirnoff 2713b3a8eb9SGleb Smirnoff struct queue_opts { 2723b3a8eb9SGleb Smirnoff int marker; 2733b3a8eb9SGleb Smirnoff #define QOM_BWSPEC 0x01 2743b3a8eb9SGleb Smirnoff #define QOM_SCHEDULER 0x02 2753b3a8eb9SGleb Smirnoff #define QOM_PRIORITY 0x04 2763b3a8eb9SGleb Smirnoff #define QOM_TBRSIZE 0x08 2773b3a8eb9SGleb Smirnoff #define QOM_QLIMIT 0x10 2783b3a8eb9SGleb Smirnoff struct node_queue_bw queue_bwspec; 2793b3a8eb9SGleb Smirnoff struct node_queue_opt scheduler; 2803b3a8eb9SGleb Smirnoff int priority; 2813b3a8eb9SGleb Smirnoff int tbrsize; 2823b3a8eb9SGleb Smirnoff int qlimit; 2833b3a8eb9SGleb Smirnoff } queue_opts; 2843b3a8eb9SGleb Smirnoff 2853b3a8eb9SGleb Smirnoff struct table_opts { 2863b3a8eb9SGleb Smirnoff int flags; 2873b3a8eb9SGleb Smirnoff int init_addr; 2883b3a8eb9SGleb Smirnoff struct node_tinithead init_nodes; 2893b3a8eb9SGleb Smirnoff } table_opts; 2903b3a8eb9SGleb Smirnoff 2913b3a8eb9SGleb Smirnoff struct pool_opts { 2923b3a8eb9SGleb Smirnoff int marker; 2933b3a8eb9SGleb Smirnoff #define POM_TYPE 0x01 2943b3a8eb9SGleb Smirnoff #define POM_STICKYADDRESS 0x02 2953b3a8eb9SGleb Smirnoff u_int8_t opts; 2963b3a8eb9SGleb Smirnoff int type; 2973b3a8eb9SGleb Smirnoff int staticport; 2983b3a8eb9SGleb Smirnoff struct pf_poolhashkey *key; 2993b3a8eb9SGleb Smirnoff 3003b3a8eb9SGleb Smirnoff } pool_opts; 3013b3a8eb9SGleb Smirnoff 3023b3a8eb9SGleb Smirnoff 3033b3a8eb9SGleb Smirnoff struct node_hfsc_opts hfsc_opts; 304*a5b789f6SErmal Luçi struct node_fairq_opts fairq_opts; 3053b3a8eb9SGleb Smirnoff struct node_state_opt *keep_state_defaults = NULL; 3063b3a8eb9SGleb Smirnoff 3073b3a8eb9SGleb Smirnoff int disallow_table(struct node_host *, const char *); 3083b3a8eb9SGleb Smirnoff int disallow_urpf_failed(struct node_host *, const char *); 3093b3a8eb9SGleb Smirnoff int disallow_alias(struct node_host *, const char *); 3103b3a8eb9SGleb Smirnoff int rule_consistent(struct pf_rule *, int); 3113b3a8eb9SGleb Smirnoff int filter_consistent(struct pf_rule *, int); 3123b3a8eb9SGleb Smirnoff int nat_consistent(struct pf_rule *); 3133b3a8eb9SGleb Smirnoff int rdr_consistent(struct pf_rule *); 3143b3a8eb9SGleb Smirnoff int process_tabledef(char *, struct table_opts *); 3153b3a8eb9SGleb Smirnoff void expand_label_str(char *, size_t, const char *, const char *); 3163b3a8eb9SGleb Smirnoff void expand_label_if(const char *, char *, size_t, const char *); 3173b3a8eb9SGleb Smirnoff void expand_label_addr(const char *, char *, size_t, u_int8_t, 3183b3a8eb9SGleb Smirnoff struct node_host *); 3193b3a8eb9SGleb Smirnoff void expand_label_port(const char *, char *, size_t, 3203b3a8eb9SGleb Smirnoff struct node_port *); 3213b3a8eb9SGleb Smirnoff void expand_label_proto(const char *, char *, size_t, u_int8_t); 3223b3a8eb9SGleb Smirnoff void expand_label_nr(const char *, char *, size_t); 3233b3a8eb9SGleb Smirnoff void expand_label(char *, size_t, const char *, u_int8_t, 3243b3a8eb9SGleb Smirnoff struct node_host *, struct node_port *, struct node_host *, 3253b3a8eb9SGleb Smirnoff struct node_port *, u_int8_t); 3263b3a8eb9SGleb Smirnoff void expand_rule(struct pf_rule *, struct node_if *, 3273b3a8eb9SGleb Smirnoff struct node_host *, struct node_proto *, struct node_os *, 3283b3a8eb9SGleb Smirnoff struct node_host *, struct node_port *, struct node_host *, 3293b3a8eb9SGleb Smirnoff struct node_port *, struct node_uid *, struct node_gid *, 3303b3a8eb9SGleb Smirnoff struct node_icmp *, const char *); 3313b3a8eb9SGleb Smirnoff int expand_altq(struct pf_altq *, struct node_if *, 3323b3a8eb9SGleb Smirnoff struct node_queue *, struct node_queue_bw bwspec, 3333b3a8eb9SGleb Smirnoff struct node_queue_opt *); 3343b3a8eb9SGleb Smirnoff int expand_queue(struct pf_altq *, struct node_if *, 3353b3a8eb9SGleb Smirnoff struct node_queue *, struct node_queue_bw, 3363b3a8eb9SGleb Smirnoff struct node_queue_opt *); 3373b3a8eb9SGleb Smirnoff int expand_skip_interface(struct node_if *); 3383b3a8eb9SGleb Smirnoff 3393b3a8eb9SGleb Smirnoff int check_rulestate(int); 3403b3a8eb9SGleb Smirnoff int getservice(char *); 3413b3a8eb9SGleb Smirnoff int rule_label(struct pf_rule *, char *); 3423b3a8eb9SGleb Smirnoff int rt_tableid_max(void); 3433b3a8eb9SGleb Smirnoff 3443b3a8eb9SGleb Smirnoff void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 3453b3a8eb9SGleb Smirnoff void decide_address_family(struct node_host *, sa_family_t *); 3463b3a8eb9SGleb Smirnoff void remove_invalid_hosts(struct node_host **, sa_family_t *); 3473b3a8eb9SGleb Smirnoff int invalid_redirect(struct node_host *, sa_family_t); 3483b3a8eb9SGleb Smirnoff u_int16_t parseicmpspec(char *, sa_family_t); 3493b3a8eb9SGleb Smirnoff 3503b3a8eb9SGleb Smirnoff TAILQ_HEAD(loadanchorshead, loadanchors) 3513b3a8eb9SGleb Smirnoff loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 3523b3a8eb9SGleb Smirnoff 3533b3a8eb9SGleb Smirnoff struct loadanchors { 3543b3a8eb9SGleb Smirnoff TAILQ_ENTRY(loadanchors) entries; 3553b3a8eb9SGleb Smirnoff char *anchorname; 3563b3a8eb9SGleb Smirnoff char *filename; 3573b3a8eb9SGleb Smirnoff }; 3583b3a8eb9SGleb Smirnoff 3593b3a8eb9SGleb Smirnoff typedef struct { 3603b3a8eb9SGleb Smirnoff union { 3613b3a8eb9SGleb Smirnoff int64_t number; 3623b3a8eb9SGleb Smirnoff double probability; 3633b3a8eb9SGleb Smirnoff int i; 3643b3a8eb9SGleb Smirnoff char *string; 3653b3a8eb9SGleb Smirnoff u_int rtableid; 3663b3a8eb9SGleb Smirnoff struct { 3673b3a8eb9SGleb Smirnoff u_int8_t b1; 3683b3a8eb9SGleb Smirnoff u_int8_t b2; 3693b3a8eb9SGleb Smirnoff u_int16_t w; 3703b3a8eb9SGleb Smirnoff u_int16_t w2; 3713b3a8eb9SGleb Smirnoff } b; 3723b3a8eb9SGleb Smirnoff struct range { 3733b3a8eb9SGleb Smirnoff int a; 3743b3a8eb9SGleb Smirnoff int b; 3753b3a8eb9SGleb Smirnoff int t; 3763b3a8eb9SGleb Smirnoff } range; 3773b3a8eb9SGleb Smirnoff struct node_if *interface; 3783b3a8eb9SGleb Smirnoff struct node_proto *proto; 3793b3a8eb9SGleb Smirnoff struct node_icmp *icmp; 3803b3a8eb9SGleb Smirnoff struct node_host *host; 3813b3a8eb9SGleb Smirnoff struct node_os *os; 3823b3a8eb9SGleb Smirnoff struct node_port *port; 3833b3a8eb9SGleb Smirnoff struct node_uid *uid; 3843b3a8eb9SGleb Smirnoff struct node_gid *gid; 3853b3a8eb9SGleb Smirnoff struct node_state_opt *state_opt; 3863b3a8eb9SGleb Smirnoff struct peer peer; 3873b3a8eb9SGleb Smirnoff struct { 3883b3a8eb9SGleb Smirnoff struct peer src, dst; 3893b3a8eb9SGleb Smirnoff struct node_os *src_os; 3903b3a8eb9SGleb Smirnoff } fromto; 3913b3a8eb9SGleb Smirnoff struct { 3923b3a8eb9SGleb Smirnoff struct node_host *host; 3933b3a8eb9SGleb Smirnoff u_int8_t rt; 3943b3a8eb9SGleb Smirnoff u_int8_t pool_opts; 3953b3a8eb9SGleb Smirnoff sa_family_t af; 3963b3a8eb9SGleb Smirnoff struct pf_poolhashkey *key; 3973b3a8eb9SGleb Smirnoff } route; 3983b3a8eb9SGleb Smirnoff struct redirection { 3993b3a8eb9SGleb Smirnoff struct node_host *host; 4003b3a8eb9SGleb Smirnoff struct range rport; 4013b3a8eb9SGleb Smirnoff } *redirection; 4023b3a8eb9SGleb Smirnoff struct { 4033b3a8eb9SGleb Smirnoff int action; 4043b3a8eb9SGleb Smirnoff struct node_state_opt *options; 4053b3a8eb9SGleb Smirnoff } keep_state; 4063b3a8eb9SGleb Smirnoff struct { 4073b3a8eb9SGleb Smirnoff u_int8_t log; 4083b3a8eb9SGleb Smirnoff u_int8_t logif; 4093b3a8eb9SGleb Smirnoff u_int8_t quick; 4103b3a8eb9SGleb Smirnoff } logquick; 4113b3a8eb9SGleb Smirnoff struct { 4123b3a8eb9SGleb Smirnoff int neg; 4133b3a8eb9SGleb Smirnoff char *name; 4143b3a8eb9SGleb Smirnoff } tagged; 4153b3a8eb9SGleb Smirnoff struct pf_poolhashkey *hashkey; 4163b3a8eb9SGleb Smirnoff struct node_queue *queue; 4173b3a8eb9SGleb Smirnoff struct node_queue_opt queue_options; 4183b3a8eb9SGleb Smirnoff struct node_queue_bw queue_bwspec; 4193b3a8eb9SGleb Smirnoff struct node_qassign qassign; 4203b3a8eb9SGleb Smirnoff struct filter_opts filter_opts; 4213b3a8eb9SGleb Smirnoff struct antispoof_opts antispoof_opts; 4223b3a8eb9SGleb Smirnoff struct queue_opts queue_opts; 4233b3a8eb9SGleb Smirnoff struct scrub_opts scrub_opts; 4243b3a8eb9SGleb Smirnoff struct table_opts table_opts; 4253b3a8eb9SGleb Smirnoff struct pool_opts pool_opts; 4263b3a8eb9SGleb Smirnoff struct node_hfsc_opts hfsc_opts; 427*a5b789f6SErmal Luçi struct node_fairq_opts fairq_opts; 4283b3a8eb9SGleb Smirnoff } v; 4293b3a8eb9SGleb Smirnoff int lineno; 4303b3a8eb9SGleb Smirnoff } YYSTYPE; 4313b3a8eb9SGleb Smirnoff 4323b3a8eb9SGleb Smirnoff #define PPORT_RANGE 1 4333b3a8eb9SGleb Smirnoff #define PPORT_STAR 2 4343b3a8eb9SGleb Smirnoff int parseport(char *, struct range *r, int); 4353b3a8eb9SGleb Smirnoff 4363b3a8eb9SGleb Smirnoff #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 4373b3a8eb9SGleb Smirnoff (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 4383b3a8eb9SGleb Smirnoff !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 4393b3a8eb9SGleb Smirnoff 4403b3a8eb9SGleb Smirnoff %} 4413b3a8eb9SGleb Smirnoff 4423b3a8eb9SGleb Smirnoff %token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 4433b3a8eb9SGleb Smirnoff %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 4443b3a8eb9SGleb Smirnoff %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 4453b3a8eb9SGleb Smirnoff %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 4463b3a8eb9SGleb Smirnoff %token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 4473b3a8eb9SGleb Smirnoff %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 4483b3a8eb9SGleb Smirnoff %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 4493b3a8eb9SGleb Smirnoff %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 4503b3a8eb9SGleb Smirnoff %token ANTISPOOF FOR INCLUDE 4513b3a8eb9SGleb Smirnoff %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 452*a5b789f6SErmal Luçi %token ALTQ CBQ PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 453*a5b789f6SErmal Luçi %token QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE 4543b3a8eb9SGleb Smirnoff %token LOAD RULESET_OPTIMIZATION 4553b3a8eb9SGleb Smirnoff %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 4563b3a8eb9SGleb Smirnoff %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY 4573b3a8eb9SGleb Smirnoff %token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 4583b3a8eb9SGleb Smirnoff %token DIVERTTO DIVERTREPLY 4593b3a8eb9SGleb Smirnoff %token <v.string> STRING 4603b3a8eb9SGleb Smirnoff %token <v.number> NUMBER 4613b3a8eb9SGleb Smirnoff %token <v.i> PORTBINARY 4623b3a8eb9SGleb Smirnoff %type <v.interface> interface if_list if_item_not if_item 4633b3a8eb9SGleb Smirnoff %type <v.number> number icmptype icmp6type uid gid 4643b3a8eb9SGleb Smirnoff %type <v.number> tos not yesno 4653b3a8eb9SGleb Smirnoff %type <v.probability> probability 4663b3a8eb9SGleb Smirnoff %type <v.i> no dir af fragcache optimizer 4673b3a8eb9SGleb Smirnoff %type <v.i> sourcetrack flush unaryop statelock 4683b3a8eb9SGleb Smirnoff %type <v.b> action nataction natpasslog scrubaction 4693b3a8eb9SGleb Smirnoff %type <v.b> flags flag blockspec 4703b3a8eb9SGleb Smirnoff %type <v.range> portplain portstar portrange 4713b3a8eb9SGleb Smirnoff %type <v.hashkey> hashkey 4723b3a8eb9SGleb Smirnoff %type <v.proto> proto proto_list proto_item 4733b3a8eb9SGleb Smirnoff %type <v.number> protoval 4743b3a8eb9SGleb Smirnoff %type <v.icmp> icmpspec 4753b3a8eb9SGleb Smirnoff %type <v.icmp> icmp_list icmp_item 4763b3a8eb9SGleb Smirnoff %type <v.icmp> icmp6_list icmp6_item 4773b3a8eb9SGleb Smirnoff %type <v.number> reticmpspec reticmp6spec 4783b3a8eb9SGleb Smirnoff %type <v.fromto> fromto 4793b3a8eb9SGleb Smirnoff %type <v.peer> ipportspec from to 4803b3a8eb9SGleb Smirnoff %type <v.host> ipspec toipspec xhost host dynaddr host_list 4813b3a8eb9SGleb Smirnoff %type <v.host> redir_host_list redirspec 4823b3a8eb9SGleb Smirnoff %type <v.host> route_host route_host_list routespec 4833b3a8eb9SGleb Smirnoff %type <v.os> os xos os_list 4843b3a8eb9SGleb Smirnoff %type <v.port> portspec port_list port_item 4853b3a8eb9SGleb Smirnoff %type <v.uid> uids uid_list uid_item 4863b3a8eb9SGleb Smirnoff %type <v.gid> gids gid_list gid_item 4873b3a8eb9SGleb Smirnoff %type <v.route> route 4883b3a8eb9SGleb Smirnoff %type <v.redirection> redirection redirpool 4893b3a8eb9SGleb Smirnoff %type <v.string> label stringall tag anchorname 4903b3a8eb9SGleb Smirnoff %type <v.string> string varstring numberstring 4913b3a8eb9SGleb Smirnoff %type <v.keep_state> keep 4923b3a8eb9SGleb Smirnoff %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 4933b3a8eb9SGleb Smirnoff %type <v.logquick> logquick quick log logopts logopt 4943b3a8eb9SGleb Smirnoff %type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 4953b3a8eb9SGleb Smirnoff %type <v.qassign> qname 4963b3a8eb9SGleb Smirnoff %type <v.queue> qassign qassign_list qassign_item 4973b3a8eb9SGleb Smirnoff %type <v.queue_options> scheduler 4983b3a8eb9SGleb Smirnoff %type <v.number> cbqflags_list cbqflags_item 4993b3a8eb9SGleb Smirnoff %type <v.number> priqflags_list priqflags_item 5003b3a8eb9SGleb Smirnoff %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 501*a5b789f6SErmal Luçi %type <v.fairq_opts> fairqopts_list fairqopts_item fairq_opts 5023b3a8eb9SGleb Smirnoff %type <v.queue_bwspec> bandwidth 5033b3a8eb9SGleb Smirnoff %type <v.filter_opts> filter_opts filter_opt filter_opts_l 5043b3a8eb9SGleb Smirnoff %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 5053b3a8eb9SGleb Smirnoff %type <v.queue_opts> queue_opts queue_opt queue_opts_l 5063b3a8eb9SGleb Smirnoff %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 5073b3a8eb9SGleb Smirnoff %type <v.table_opts> table_opts table_opt table_opts_l 5083b3a8eb9SGleb Smirnoff %type <v.pool_opts> pool_opts pool_opt pool_opts_l 5093b3a8eb9SGleb Smirnoff %type <v.tagged> tagged 5103b3a8eb9SGleb Smirnoff %type <v.rtableid> rtable 5113b3a8eb9SGleb Smirnoff %% 5123b3a8eb9SGleb Smirnoff 5133b3a8eb9SGleb Smirnoff ruleset : /* empty */ 5143b3a8eb9SGleb Smirnoff | ruleset include '\n' 5153b3a8eb9SGleb Smirnoff | ruleset '\n' 5163b3a8eb9SGleb Smirnoff | ruleset option '\n' 5173b3a8eb9SGleb Smirnoff | ruleset scrubrule '\n' 5183b3a8eb9SGleb Smirnoff | ruleset natrule '\n' 5193b3a8eb9SGleb Smirnoff | ruleset binatrule '\n' 5203b3a8eb9SGleb Smirnoff | ruleset pfrule '\n' 5213b3a8eb9SGleb Smirnoff | ruleset anchorrule '\n' 5223b3a8eb9SGleb Smirnoff | ruleset loadrule '\n' 5233b3a8eb9SGleb Smirnoff | ruleset altqif '\n' 5243b3a8eb9SGleb Smirnoff | ruleset queuespec '\n' 5253b3a8eb9SGleb Smirnoff | ruleset varset '\n' 5263b3a8eb9SGleb Smirnoff | ruleset antispoof '\n' 5273b3a8eb9SGleb Smirnoff | ruleset tabledef '\n' 5283b3a8eb9SGleb Smirnoff | '{' fakeanchor '}' '\n'; 5293b3a8eb9SGleb Smirnoff | ruleset error '\n' { file->errors++; } 5303b3a8eb9SGleb Smirnoff ; 5313b3a8eb9SGleb Smirnoff 5323b3a8eb9SGleb Smirnoff include : INCLUDE STRING { 5333b3a8eb9SGleb Smirnoff struct file *nfile; 5343b3a8eb9SGleb Smirnoff 5353b3a8eb9SGleb Smirnoff if ((nfile = pushfile($2, 0)) == NULL) { 5363b3a8eb9SGleb Smirnoff yyerror("failed to include file %s", $2); 5373b3a8eb9SGleb Smirnoff free($2); 5383b3a8eb9SGleb Smirnoff YYERROR; 5393b3a8eb9SGleb Smirnoff } 5403b3a8eb9SGleb Smirnoff free($2); 5413b3a8eb9SGleb Smirnoff 5423b3a8eb9SGleb Smirnoff file = nfile; 5433b3a8eb9SGleb Smirnoff lungetc('\n'); 5443b3a8eb9SGleb Smirnoff } 5453b3a8eb9SGleb Smirnoff ; 5463b3a8eb9SGleb Smirnoff 5473b3a8eb9SGleb Smirnoff /* 5483b3a8eb9SGleb Smirnoff * apply to previouslys specified rule: must be careful to note 5493b3a8eb9SGleb Smirnoff * what that is: pf or nat or binat or rdr 5503b3a8eb9SGleb Smirnoff */ 5513b3a8eb9SGleb Smirnoff fakeanchor : fakeanchor '\n' 5523b3a8eb9SGleb Smirnoff | fakeanchor anchorrule '\n' 5533b3a8eb9SGleb Smirnoff | fakeanchor binatrule '\n' 5543b3a8eb9SGleb Smirnoff | fakeanchor natrule '\n' 5553b3a8eb9SGleb Smirnoff | fakeanchor pfrule '\n' 5563b3a8eb9SGleb Smirnoff | fakeanchor error '\n' 5573b3a8eb9SGleb Smirnoff ; 5583b3a8eb9SGleb Smirnoff 5593b3a8eb9SGleb Smirnoff optimizer : string { 5603b3a8eb9SGleb Smirnoff if (!strcmp($1, "none")) 5613b3a8eb9SGleb Smirnoff $$ = 0; 5623b3a8eb9SGleb Smirnoff else if (!strcmp($1, "basic")) 5633b3a8eb9SGleb Smirnoff $$ = PF_OPTIMIZE_BASIC; 5643b3a8eb9SGleb Smirnoff else if (!strcmp($1, "profile")) 5653b3a8eb9SGleb Smirnoff $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 5663b3a8eb9SGleb Smirnoff else { 5673b3a8eb9SGleb Smirnoff yyerror("unknown ruleset-optimization %s", $1); 5683b3a8eb9SGleb Smirnoff YYERROR; 5693b3a8eb9SGleb Smirnoff } 5703b3a8eb9SGleb Smirnoff } 5713b3a8eb9SGleb Smirnoff ; 5723b3a8eb9SGleb Smirnoff 5733b3a8eb9SGleb Smirnoff option : SET OPTIMIZATION STRING { 5743b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 5753b3a8eb9SGleb Smirnoff free($3); 5763b3a8eb9SGleb Smirnoff YYERROR; 5773b3a8eb9SGleb Smirnoff } 5783b3a8eb9SGleb Smirnoff if (pfctl_set_optimization(pf, $3) != 0) { 5793b3a8eb9SGleb Smirnoff yyerror("unknown optimization %s", $3); 5803b3a8eb9SGleb Smirnoff free($3); 5813b3a8eb9SGleb Smirnoff YYERROR; 5823b3a8eb9SGleb Smirnoff } 5833b3a8eb9SGleb Smirnoff free($3); 5843b3a8eb9SGleb Smirnoff } 5853b3a8eb9SGleb Smirnoff | SET RULESET_OPTIMIZATION optimizer { 5863b3a8eb9SGleb Smirnoff if (!(pf->opts & PF_OPT_OPTIMIZE)) { 5873b3a8eb9SGleb Smirnoff pf->opts |= PF_OPT_OPTIMIZE; 5883b3a8eb9SGleb Smirnoff pf->optimize = $3; 5893b3a8eb9SGleb Smirnoff } 5903b3a8eb9SGleb Smirnoff } 5913b3a8eb9SGleb Smirnoff | SET TIMEOUT timeout_spec 5923b3a8eb9SGleb Smirnoff | SET TIMEOUT '{' optnl timeout_list '}' 5933b3a8eb9SGleb Smirnoff | SET LIMIT limit_spec 5943b3a8eb9SGleb Smirnoff | SET LIMIT '{' optnl limit_list '}' 5953b3a8eb9SGleb Smirnoff | SET LOGINTERFACE stringall { 5963b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 5973b3a8eb9SGleb Smirnoff free($3); 5983b3a8eb9SGleb Smirnoff YYERROR; 5993b3a8eb9SGleb Smirnoff } 6003b3a8eb9SGleb Smirnoff if (pfctl_set_logif(pf, $3) != 0) { 6013b3a8eb9SGleb Smirnoff yyerror("error setting loginterface %s", $3); 6023b3a8eb9SGleb Smirnoff free($3); 6033b3a8eb9SGleb Smirnoff YYERROR; 6043b3a8eb9SGleb Smirnoff } 6053b3a8eb9SGleb Smirnoff free($3); 6063b3a8eb9SGleb Smirnoff } 6073b3a8eb9SGleb Smirnoff | SET HOSTID number { 6083b3a8eb9SGleb Smirnoff if ($3 == 0 || $3 > UINT_MAX) { 6093b3a8eb9SGleb Smirnoff yyerror("hostid must be non-zero"); 6103b3a8eb9SGleb Smirnoff YYERROR; 6113b3a8eb9SGleb Smirnoff } 6123b3a8eb9SGleb Smirnoff if (pfctl_set_hostid(pf, $3) != 0) { 6133b3a8eb9SGleb Smirnoff yyerror("error setting hostid %08x", $3); 6143b3a8eb9SGleb Smirnoff YYERROR; 6153b3a8eb9SGleb Smirnoff } 6163b3a8eb9SGleb Smirnoff } 6173b3a8eb9SGleb Smirnoff | SET BLOCKPOLICY DROP { 6183b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6193b3a8eb9SGleb Smirnoff printf("set block-policy drop\n"); 6203b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) 6213b3a8eb9SGleb Smirnoff YYERROR; 6223b3a8eb9SGleb Smirnoff blockpolicy = PFRULE_DROP; 6233b3a8eb9SGleb Smirnoff } 6243b3a8eb9SGleb Smirnoff | SET BLOCKPOLICY RETURN { 6253b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6263b3a8eb9SGleb Smirnoff printf("set block-policy return\n"); 6273b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) 6283b3a8eb9SGleb Smirnoff YYERROR; 6293b3a8eb9SGleb Smirnoff blockpolicy = PFRULE_RETURN; 6303b3a8eb9SGleb Smirnoff } 6313b3a8eb9SGleb Smirnoff | SET REQUIREORDER yesno { 6323b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6333b3a8eb9SGleb Smirnoff printf("set require-order %s\n", 6343b3a8eb9SGleb Smirnoff $3 == 1 ? "yes" : "no"); 6353b3a8eb9SGleb Smirnoff require_order = $3; 6363b3a8eb9SGleb Smirnoff } 6373b3a8eb9SGleb Smirnoff | SET FINGERPRINTS STRING { 6383b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6393b3a8eb9SGleb Smirnoff printf("set fingerprints \"%s\"\n", $3); 6403b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 6413b3a8eb9SGleb Smirnoff free($3); 6423b3a8eb9SGleb Smirnoff YYERROR; 6433b3a8eb9SGleb Smirnoff } 6443b3a8eb9SGleb Smirnoff if (!pf->anchor->name[0]) { 6453b3a8eb9SGleb Smirnoff if (pfctl_file_fingerprints(pf->dev, 6463b3a8eb9SGleb Smirnoff pf->opts, $3)) { 6473b3a8eb9SGleb Smirnoff yyerror("error loading " 6483b3a8eb9SGleb Smirnoff "fingerprints %s", $3); 6493b3a8eb9SGleb Smirnoff free($3); 6503b3a8eb9SGleb Smirnoff YYERROR; 6513b3a8eb9SGleb Smirnoff } 6523b3a8eb9SGleb Smirnoff } 6533b3a8eb9SGleb Smirnoff free($3); 6543b3a8eb9SGleb Smirnoff } 6553b3a8eb9SGleb Smirnoff | SET STATEPOLICY statelock { 6563b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6573b3a8eb9SGleb Smirnoff switch ($3) { 6583b3a8eb9SGleb Smirnoff case 0: 6593b3a8eb9SGleb Smirnoff printf("set state-policy floating\n"); 6603b3a8eb9SGleb Smirnoff break; 6613b3a8eb9SGleb Smirnoff case PFRULE_IFBOUND: 6623b3a8eb9SGleb Smirnoff printf("set state-policy if-bound\n"); 6633b3a8eb9SGleb Smirnoff break; 6643b3a8eb9SGleb Smirnoff } 6653b3a8eb9SGleb Smirnoff default_statelock = $3; 6663b3a8eb9SGleb Smirnoff } 6673b3a8eb9SGleb Smirnoff | SET DEBUG STRING { 6683b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 6693b3a8eb9SGleb Smirnoff free($3); 6703b3a8eb9SGleb Smirnoff YYERROR; 6713b3a8eb9SGleb Smirnoff } 6723b3a8eb9SGleb Smirnoff if (pfctl_set_debug(pf, $3) != 0) { 6733b3a8eb9SGleb Smirnoff yyerror("error setting debuglevel %s", $3); 6743b3a8eb9SGleb Smirnoff free($3); 6753b3a8eb9SGleb Smirnoff YYERROR; 6763b3a8eb9SGleb Smirnoff } 6773b3a8eb9SGleb Smirnoff free($3); 6783b3a8eb9SGleb Smirnoff } 6793b3a8eb9SGleb Smirnoff | SET SKIP interface { 6803b3a8eb9SGleb Smirnoff if (expand_skip_interface($3) != 0) { 6813b3a8eb9SGleb Smirnoff yyerror("error setting skip interface(s)"); 6823b3a8eb9SGleb Smirnoff YYERROR; 6833b3a8eb9SGleb Smirnoff } 6843b3a8eb9SGleb Smirnoff } 6853b3a8eb9SGleb Smirnoff | SET STATEDEFAULTS state_opt_list { 6863b3a8eb9SGleb Smirnoff if (keep_state_defaults != NULL) { 6873b3a8eb9SGleb Smirnoff yyerror("cannot redefine state-defaults"); 6883b3a8eb9SGleb Smirnoff YYERROR; 6893b3a8eb9SGleb Smirnoff } 6903b3a8eb9SGleb Smirnoff keep_state_defaults = $3; 6913b3a8eb9SGleb Smirnoff } 6923b3a8eb9SGleb Smirnoff ; 6933b3a8eb9SGleb Smirnoff 6943b3a8eb9SGleb Smirnoff stringall : STRING { $$ = $1; } 6953b3a8eb9SGleb Smirnoff | ALL { 6963b3a8eb9SGleb Smirnoff if (($$ = strdup("all")) == NULL) { 6973b3a8eb9SGleb Smirnoff err(1, "stringall: strdup"); 6983b3a8eb9SGleb Smirnoff } 6993b3a8eb9SGleb Smirnoff } 7003b3a8eb9SGleb Smirnoff ; 7013b3a8eb9SGleb Smirnoff 7023b3a8eb9SGleb Smirnoff string : STRING string { 7033b3a8eb9SGleb Smirnoff if (asprintf(&$$, "%s %s", $1, $2) == -1) 7043b3a8eb9SGleb Smirnoff err(1, "string: asprintf"); 7053b3a8eb9SGleb Smirnoff free($1); 7063b3a8eb9SGleb Smirnoff free($2); 7073b3a8eb9SGleb Smirnoff } 7083b3a8eb9SGleb Smirnoff | STRING 7093b3a8eb9SGleb Smirnoff ; 7103b3a8eb9SGleb Smirnoff 7113b3a8eb9SGleb Smirnoff varstring : numberstring varstring { 7123b3a8eb9SGleb Smirnoff if (asprintf(&$$, "%s %s", $1, $2) == -1) 7133b3a8eb9SGleb Smirnoff err(1, "string: asprintf"); 7143b3a8eb9SGleb Smirnoff free($1); 7153b3a8eb9SGleb Smirnoff free($2); 7163b3a8eb9SGleb Smirnoff } 7173b3a8eb9SGleb Smirnoff | numberstring 7183b3a8eb9SGleb Smirnoff ; 7193b3a8eb9SGleb Smirnoff 7203b3a8eb9SGleb Smirnoff numberstring : NUMBER { 7213b3a8eb9SGleb Smirnoff char *s; 7223b3a8eb9SGleb Smirnoff if (asprintf(&s, "%lld", (long long)$1) == -1) { 7233b3a8eb9SGleb Smirnoff yyerror("string: asprintf"); 7243b3a8eb9SGleb Smirnoff YYERROR; 7253b3a8eb9SGleb Smirnoff } 7263b3a8eb9SGleb Smirnoff $$ = s; 7273b3a8eb9SGleb Smirnoff } 7283b3a8eb9SGleb Smirnoff | STRING 7293b3a8eb9SGleb Smirnoff ; 7303b3a8eb9SGleb Smirnoff 7313b3a8eb9SGleb Smirnoff varset : STRING '=' varstring { 7323b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 7333b3a8eb9SGleb Smirnoff printf("%s = \"%s\"\n", $1, $3); 7343b3a8eb9SGleb Smirnoff if (symset($1, $3, 0) == -1) 7353b3a8eb9SGleb Smirnoff err(1, "cannot store variable %s", $1); 7363b3a8eb9SGleb Smirnoff free($1); 7373b3a8eb9SGleb Smirnoff free($3); 7383b3a8eb9SGleb Smirnoff } 7393b3a8eb9SGleb Smirnoff ; 7403b3a8eb9SGleb Smirnoff 7413b3a8eb9SGleb Smirnoff anchorname : STRING { $$ = $1; } 7423b3a8eb9SGleb Smirnoff | /* empty */ { $$ = NULL; } 7433b3a8eb9SGleb Smirnoff ; 7443b3a8eb9SGleb Smirnoff 7453b3a8eb9SGleb Smirnoff pfa_anchorlist : /* empty */ 7463b3a8eb9SGleb Smirnoff | pfa_anchorlist '\n' 7473b3a8eb9SGleb Smirnoff | pfa_anchorlist pfrule '\n' 7483b3a8eb9SGleb Smirnoff | pfa_anchorlist anchorrule '\n' 7493b3a8eb9SGleb Smirnoff ; 7503b3a8eb9SGleb Smirnoff 7513b3a8eb9SGleb Smirnoff pfa_anchor : '{' 7523b3a8eb9SGleb Smirnoff { 7533b3a8eb9SGleb Smirnoff char ta[PF_ANCHOR_NAME_SIZE]; 7543b3a8eb9SGleb Smirnoff struct pf_ruleset *rs; 7553b3a8eb9SGleb Smirnoff 7563b3a8eb9SGleb Smirnoff /* steping into a brace anchor */ 7573b3a8eb9SGleb Smirnoff pf->asd++; 7583b3a8eb9SGleb Smirnoff pf->bn++; 7593b3a8eb9SGleb Smirnoff pf->brace = 1; 7603b3a8eb9SGleb Smirnoff 7613b3a8eb9SGleb Smirnoff /* create a holding ruleset in the root */ 7623b3a8eb9SGleb Smirnoff snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 7633b3a8eb9SGleb Smirnoff rs = pf_find_or_create_ruleset(ta); 7643b3a8eb9SGleb Smirnoff if (rs == NULL) 7653b3a8eb9SGleb Smirnoff err(1, "pfa_anchor: pf_find_or_create_ruleset"); 7663b3a8eb9SGleb Smirnoff pf->astack[pf->asd] = rs->anchor; 7673b3a8eb9SGleb Smirnoff pf->anchor = rs->anchor; 7683b3a8eb9SGleb Smirnoff } '\n' pfa_anchorlist '}' 7693b3a8eb9SGleb Smirnoff { 7703b3a8eb9SGleb Smirnoff pf->alast = pf->anchor; 7713b3a8eb9SGleb Smirnoff pf->asd--; 7723b3a8eb9SGleb Smirnoff pf->anchor = pf->astack[pf->asd]; 7733b3a8eb9SGleb Smirnoff } 7743b3a8eb9SGleb Smirnoff | /* empty */ 7753b3a8eb9SGleb Smirnoff ; 7763b3a8eb9SGleb Smirnoff 7773b3a8eb9SGleb Smirnoff anchorrule : ANCHOR anchorname dir quick interface af proto fromto 7783b3a8eb9SGleb Smirnoff filter_opts pfa_anchor 7793b3a8eb9SGleb Smirnoff { 7803b3a8eb9SGleb Smirnoff struct pf_rule r; 7813b3a8eb9SGleb Smirnoff struct node_proto *proto; 7823b3a8eb9SGleb Smirnoff 7833b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_FILTER)) { 7843b3a8eb9SGleb Smirnoff if ($2) 7853b3a8eb9SGleb Smirnoff free($2); 7863b3a8eb9SGleb Smirnoff YYERROR; 7873b3a8eb9SGleb Smirnoff } 7883b3a8eb9SGleb Smirnoff 7893b3a8eb9SGleb Smirnoff if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 7903b3a8eb9SGleb Smirnoff free($2); 7913b3a8eb9SGleb Smirnoff yyerror("anchor names beginning with '_' " 7923b3a8eb9SGleb Smirnoff "are reserved for internal use"); 7933b3a8eb9SGleb Smirnoff YYERROR; 7943b3a8eb9SGleb Smirnoff } 7953b3a8eb9SGleb Smirnoff 7963b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 7973b3a8eb9SGleb Smirnoff if (pf->astack[pf->asd + 1]) { 7983b3a8eb9SGleb Smirnoff /* move inline rules into relative location */ 7993b3a8eb9SGleb Smirnoff pf_anchor_setup(&r, 8003b3a8eb9SGleb Smirnoff &pf->astack[pf->asd]->ruleset, 8013b3a8eb9SGleb Smirnoff $2 ? $2 : pf->alast->name); 8023b3a8eb9SGleb Smirnoff 8033b3a8eb9SGleb Smirnoff if (r.anchor == NULL) 8043b3a8eb9SGleb Smirnoff err(1, "anchorrule: unable to " 8053b3a8eb9SGleb Smirnoff "create ruleset"); 8063b3a8eb9SGleb Smirnoff 8073b3a8eb9SGleb Smirnoff if (pf->alast != r.anchor) { 8083b3a8eb9SGleb Smirnoff if (r.anchor->match) { 8093b3a8eb9SGleb Smirnoff yyerror("inline anchor '%s' " 8103b3a8eb9SGleb Smirnoff "already exists", 8113b3a8eb9SGleb Smirnoff r.anchor->name); 8123b3a8eb9SGleb Smirnoff YYERROR; 8133b3a8eb9SGleb Smirnoff } 8143b3a8eb9SGleb Smirnoff mv_rules(&pf->alast->ruleset, 8153b3a8eb9SGleb Smirnoff &r.anchor->ruleset); 8163b3a8eb9SGleb Smirnoff } 8173b3a8eb9SGleb Smirnoff pf_remove_if_empty_ruleset(&pf->alast->ruleset); 8183b3a8eb9SGleb Smirnoff pf->alast = r.anchor; 8193b3a8eb9SGleb Smirnoff } else { 8203b3a8eb9SGleb Smirnoff if (!$2) { 8213b3a8eb9SGleb Smirnoff yyerror("anchors without explicit " 8223b3a8eb9SGleb Smirnoff "rules must specify a name"); 8233b3a8eb9SGleb Smirnoff YYERROR; 8243b3a8eb9SGleb Smirnoff } 8253b3a8eb9SGleb Smirnoff } 8263b3a8eb9SGleb Smirnoff r.direction = $3; 8273b3a8eb9SGleb Smirnoff r.quick = $4.quick; 8283b3a8eb9SGleb Smirnoff r.af = $6; 8293b3a8eb9SGleb Smirnoff r.prob = $9.prob; 8303b3a8eb9SGleb Smirnoff r.rtableid = $9.rtableid; 8313b3a8eb9SGleb Smirnoff 8323b3a8eb9SGleb Smirnoff if ($9.tag) 8333b3a8eb9SGleb Smirnoff if (strlcpy(r.tagname, $9.tag, 8343b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 8353b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 8363b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 8373b3a8eb9SGleb Smirnoff YYERROR; 8383b3a8eb9SGleb Smirnoff } 8393b3a8eb9SGleb Smirnoff if ($9.match_tag) 8403b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $9.match_tag, 8413b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 8423b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 8433b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 8443b3a8eb9SGleb Smirnoff YYERROR; 8453b3a8eb9SGleb Smirnoff } 8463b3a8eb9SGleb Smirnoff r.match_tag_not = $9.match_tag_not; 8473b3a8eb9SGleb Smirnoff if (rule_label(&r, $9.label)) 8483b3a8eb9SGleb Smirnoff YYERROR; 8493b3a8eb9SGleb Smirnoff free($9.label); 8503b3a8eb9SGleb Smirnoff r.flags = $9.flags.b1; 8513b3a8eb9SGleb Smirnoff r.flagset = $9.flags.b2; 8523b3a8eb9SGleb Smirnoff if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 8533b3a8eb9SGleb Smirnoff yyerror("flags always false"); 8543b3a8eb9SGleb Smirnoff YYERROR; 8553b3a8eb9SGleb Smirnoff } 8563b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 8573b3a8eb9SGleb Smirnoff for (proto = $7; proto != NULL && 8583b3a8eb9SGleb Smirnoff proto->proto != IPPROTO_TCP; 8593b3a8eb9SGleb Smirnoff proto = proto->next) 8603b3a8eb9SGleb Smirnoff ; /* nothing */ 8613b3a8eb9SGleb Smirnoff if (proto == NULL && $7 != NULL) { 8623b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2) 8633b3a8eb9SGleb Smirnoff yyerror( 8643b3a8eb9SGleb Smirnoff "flags only apply to tcp"); 8653b3a8eb9SGleb Smirnoff if ($8.src_os) 8663b3a8eb9SGleb Smirnoff yyerror( 8673b3a8eb9SGleb Smirnoff "OS fingerprinting only " 8683b3a8eb9SGleb Smirnoff "applies to tcp"); 8693b3a8eb9SGleb Smirnoff YYERROR; 8703b3a8eb9SGleb Smirnoff } 8713b3a8eb9SGleb Smirnoff } 8723b3a8eb9SGleb Smirnoff 8733b3a8eb9SGleb Smirnoff r.tos = $9.tos; 8743b3a8eb9SGleb Smirnoff 8753b3a8eb9SGleb Smirnoff if ($9.keep.action) { 8763b3a8eb9SGleb Smirnoff yyerror("cannot specify state handling " 8773b3a8eb9SGleb Smirnoff "on anchors"); 8783b3a8eb9SGleb Smirnoff YYERROR; 8793b3a8eb9SGleb Smirnoff } 8803b3a8eb9SGleb Smirnoff 8813b3a8eb9SGleb Smirnoff if ($9.match_tag) 8823b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $9.match_tag, 8833b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 8843b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 8853b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 8863b3a8eb9SGleb Smirnoff YYERROR; 8873b3a8eb9SGleb Smirnoff } 8883b3a8eb9SGleb Smirnoff r.match_tag_not = $9.match_tag_not; 8893b3a8eb9SGleb Smirnoff 8903b3a8eb9SGleb Smirnoff decide_address_family($8.src.host, &r.af); 8913b3a8eb9SGleb Smirnoff decide_address_family($8.dst.host, &r.af); 8923b3a8eb9SGleb Smirnoff 8933b3a8eb9SGleb Smirnoff expand_rule(&r, $5, NULL, $7, $8.src_os, 8943b3a8eb9SGleb Smirnoff $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 8953b3a8eb9SGleb Smirnoff $9.uid, $9.gid, $9.icmpspec, 8963b3a8eb9SGleb Smirnoff pf->astack[pf->asd + 1] ? pf->alast->name : $2); 8973b3a8eb9SGleb Smirnoff free($2); 8983b3a8eb9SGleb Smirnoff pf->astack[pf->asd + 1] = NULL; 8993b3a8eb9SGleb Smirnoff } 9003b3a8eb9SGleb Smirnoff | NATANCHOR string interface af proto fromto rtable { 9013b3a8eb9SGleb Smirnoff struct pf_rule r; 9023b3a8eb9SGleb Smirnoff 9033b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) { 9043b3a8eb9SGleb Smirnoff free($2); 9053b3a8eb9SGleb Smirnoff YYERROR; 9063b3a8eb9SGleb Smirnoff } 9073b3a8eb9SGleb Smirnoff 9083b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 9093b3a8eb9SGleb Smirnoff r.action = PF_NAT; 9103b3a8eb9SGleb Smirnoff r.af = $4; 9113b3a8eb9SGleb Smirnoff r.rtableid = $7; 9123b3a8eb9SGleb Smirnoff 9133b3a8eb9SGleb Smirnoff decide_address_family($6.src.host, &r.af); 9143b3a8eb9SGleb Smirnoff decide_address_family($6.dst.host, &r.af); 9153b3a8eb9SGleb Smirnoff 9163b3a8eb9SGleb Smirnoff expand_rule(&r, $3, NULL, $5, $6.src_os, 9173b3a8eb9SGleb Smirnoff $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 9183b3a8eb9SGleb Smirnoff 0, 0, 0, $2); 9193b3a8eb9SGleb Smirnoff free($2); 9203b3a8eb9SGleb Smirnoff } 9213b3a8eb9SGleb Smirnoff | RDRANCHOR string interface af proto fromto rtable { 9223b3a8eb9SGleb Smirnoff struct pf_rule r; 9233b3a8eb9SGleb Smirnoff 9243b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) { 9253b3a8eb9SGleb Smirnoff free($2); 9263b3a8eb9SGleb Smirnoff YYERROR; 9273b3a8eb9SGleb Smirnoff } 9283b3a8eb9SGleb Smirnoff 9293b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 9303b3a8eb9SGleb Smirnoff r.action = PF_RDR; 9313b3a8eb9SGleb Smirnoff r.af = $4; 9323b3a8eb9SGleb Smirnoff r.rtableid = $7; 9333b3a8eb9SGleb Smirnoff 9343b3a8eb9SGleb Smirnoff decide_address_family($6.src.host, &r.af); 9353b3a8eb9SGleb Smirnoff decide_address_family($6.dst.host, &r.af); 9363b3a8eb9SGleb Smirnoff 9373b3a8eb9SGleb Smirnoff if ($6.src.port != NULL) { 9383b3a8eb9SGleb Smirnoff yyerror("source port parameter not supported" 9393b3a8eb9SGleb Smirnoff " in rdr-anchor"); 9403b3a8eb9SGleb Smirnoff YYERROR; 9413b3a8eb9SGleb Smirnoff } 9423b3a8eb9SGleb Smirnoff if ($6.dst.port != NULL) { 9433b3a8eb9SGleb Smirnoff if ($6.dst.port->next != NULL) { 9443b3a8eb9SGleb Smirnoff yyerror("destination port list " 9453b3a8eb9SGleb Smirnoff "expansion not supported in " 9463b3a8eb9SGleb Smirnoff "rdr-anchor"); 9473b3a8eb9SGleb Smirnoff YYERROR; 9483b3a8eb9SGleb Smirnoff } else if ($6.dst.port->op != PF_OP_EQ) { 9493b3a8eb9SGleb Smirnoff yyerror("destination port operators" 9503b3a8eb9SGleb Smirnoff " not supported in rdr-anchor"); 9513b3a8eb9SGleb Smirnoff YYERROR; 9523b3a8eb9SGleb Smirnoff } 9533b3a8eb9SGleb Smirnoff r.dst.port[0] = $6.dst.port->port[0]; 9543b3a8eb9SGleb Smirnoff r.dst.port[1] = $6.dst.port->port[1]; 9553b3a8eb9SGleb Smirnoff r.dst.port_op = $6.dst.port->op; 9563b3a8eb9SGleb Smirnoff } 9573b3a8eb9SGleb Smirnoff 9583b3a8eb9SGleb Smirnoff expand_rule(&r, $3, NULL, $5, $6.src_os, 9593b3a8eb9SGleb Smirnoff $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 9603b3a8eb9SGleb Smirnoff 0, 0, 0, $2); 9613b3a8eb9SGleb Smirnoff free($2); 9623b3a8eb9SGleb Smirnoff } 9633b3a8eb9SGleb Smirnoff | BINATANCHOR string interface af proto fromto rtable { 9643b3a8eb9SGleb Smirnoff struct pf_rule r; 9653b3a8eb9SGleb Smirnoff 9663b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) { 9673b3a8eb9SGleb Smirnoff free($2); 9683b3a8eb9SGleb Smirnoff YYERROR; 9693b3a8eb9SGleb Smirnoff } 9703b3a8eb9SGleb Smirnoff 9713b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 9723b3a8eb9SGleb Smirnoff r.action = PF_BINAT; 9733b3a8eb9SGleb Smirnoff r.af = $4; 9743b3a8eb9SGleb Smirnoff r.rtableid = $7; 9753b3a8eb9SGleb Smirnoff if ($5 != NULL) { 9763b3a8eb9SGleb Smirnoff if ($5->next != NULL) { 9773b3a8eb9SGleb Smirnoff yyerror("proto list expansion" 9783b3a8eb9SGleb Smirnoff " not supported in binat-anchor"); 9793b3a8eb9SGleb Smirnoff YYERROR; 9803b3a8eb9SGleb Smirnoff } 9813b3a8eb9SGleb Smirnoff r.proto = $5->proto; 9823b3a8eb9SGleb Smirnoff free($5); 9833b3a8eb9SGleb Smirnoff } 9843b3a8eb9SGleb Smirnoff 9853b3a8eb9SGleb Smirnoff if ($6.src.host != NULL || $6.src.port != NULL || 9863b3a8eb9SGleb Smirnoff $6.dst.host != NULL || $6.dst.port != NULL) { 9873b3a8eb9SGleb Smirnoff yyerror("fromto parameter not supported" 9883b3a8eb9SGleb Smirnoff " in binat-anchor"); 9893b3a8eb9SGleb Smirnoff YYERROR; 9903b3a8eb9SGleb Smirnoff } 9913b3a8eb9SGleb Smirnoff 9923b3a8eb9SGleb Smirnoff decide_address_family($6.src.host, &r.af); 9933b3a8eb9SGleb Smirnoff decide_address_family($6.dst.host, &r.af); 9943b3a8eb9SGleb Smirnoff 9953b3a8eb9SGleb Smirnoff pfctl_add_rule(pf, &r, $2); 9963b3a8eb9SGleb Smirnoff free($2); 9973b3a8eb9SGleb Smirnoff } 9983b3a8eb9SGleb Smirnoff ; 9993b3a8eb9SGleb Smirnoff 10003b3a8eb9SGleb Smirnoff loadrule : LOAD ANCHOR string FROM string { 10013b3a8eb9SGleb Smirnoff struct loadanchors *loadanchor; 10023b3a8eb9SGleb Smirnoff 10033b3a8eb9SGleb Smirnoff if (strlen(pf->anchor->name) + 1 + 10043b3a8eb9SGleb Smirnoff strlen($3) >= MAXPATHLEN) { 10053b3a8eb9SGleb Smirnoff yyerror("anchorname %s too long, max %u\n", 10063b3a8eb9SGleb Smirnoff $3, MAXPATHLEN - 1); 10073b3a8eb9SGleb Smirnoff free($3); 10083b3a8eb9SGleb Smirnoff YYERROR; 10093b3a8eb9SGleb Smirnoff } 10103b3a8eb9SGleb Smirnoff loadanchor = calloc(1, sizeof(struct loadanchors)); 10113b3a8eb9SGleb Smirnoff if (loadanchor == NULL) 10123b3a8eb9SGleb Smirnoff err(1, "loadrule: calloc"); 10133b3a8eb9SGleb Smirnoff if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 10143b3a8eb9SGleb Smirnoff NULL) 10153b3a8eb9SGleb Smirnoff err(1, "loadrule: malloc"); 10163b3a8eb9SGleb Smirnoff if (pf->anchor->name[0]) 10173b3a8eb9SGleb Smirnoff snprintf(loadanchor->anchorname, MAXPATHLEN, 10183b3a8eb9SGleb Smirnoff "%s/%s", pf->anchor->name, $3); 10193b3a8eb9SGleb Smirnoff else 10203b3a8eb9SGleb Smirnoff strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 10213b3a8eb9SGleb Smirnoff if ((loadanchor->filename = strdup($5)) == NULL) 10223b3a8eb9SGleb Smirnoff err(1, "loadrule: strdup"); 10233b3a8eb9SGleb Smirnoff 10243b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 10253b3a8eb9SGleb Smirnoff entries); 10263b3a8eb9SGleb Smirnoff 10273b3a8eb9SGleb Smirnoff free($3); 10283b3a8eb9SGleb Smirnoff free($5); 10293b3a8eb9SGleb Smirnoff }; 10303b3a8eb9SGleb Smirnoff 10313b3a8eb9SGleb Smirnoff scrubaction : no SCRUB { 10323b3a8eb9SGleb Smirnoff $$.b2 = $$.w = 0; 10333b3a8eb9SGleb Smirnoff if ($1) 10343b3a8eb9SGleb Smirnoff $$.b1 = PF_NOSCRUB; 10353b3a8eb9SGleb Smirnoff else 10363b3a8eb9SGleb Smirnoff $$.b1 = PF_SCRUB; 10373b3a8eb9SGleb Smirnoff } 10383b3a8eb9SGleb Smirnoff ; 10393b3a8eb9SGleb Smirnoff 10403b3a8eb9SGleb Smirnoff scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 10413b3a8eb9SGleb Smirnoff { 10423b3a8eb9SGleb Smirnoff struct pf_rule r; 10433b3a8eb9SGleb Smirnoff 10443b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_SCRUB)) 10453b3a8eb9SGleb Smirnoff YYERROR; 10463b3a8eb9SGleb Smirnoff 10473b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 10483b3a8eb9SGleb Smirnoff 10493b3a8eb9SGleb Smirnoff r.action = $1.b1; 10503b3a8eb9SGleb Smirnoff r.direction = $2; 10513b3a8eb9SGleb Smirnoff 10523b3a8eb9SGleb Smirnoff r.log = $3.log; 10533b3a8eb9SGleb Smirnoff r.logif = $3.logif; 10543b3a8eb9SGleb Smirnoff if ($3.quick) { 10553b3a8eb9SGleb Smirnoff yyerror("scrub rules do not support 'quick'"); 10563b3a8eb9SGleb Smirnoff YYERROR; 10573b3a8eb9SGleb Smirnoff } 10583b3a8eb9SGleb Smirnoff 10593b3a8eb9SGleb Smirnoff r.af = $5; 10603b3a8eb9SGleb Smirnoff if ($8.nodf) 10613b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_NODF; 10623b3a8eb9SGleb Smirnoff if ($8.randomid) 10633b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RANDOMID; 10643b3a8eb9SGleb Smirnoff if ($8.reassemble_tcp) { 10653b3a8eb9SGleb Smirnoff if (r.direction != PF_INOUT) { 10663b3a8eb9SGleb Smirnoff yyerror("reassemble tcp rules can not " 10673b3a8eb9SGleb Smirnoff "specify direction"); 10683b3a8eb9SGleb Smirnoff YYERROR; 10693b3a8eb9SGleb Smirnoff } 10703b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_REASSEMBLE_TCP; 10713b3a8eb9SGleb Smirnoff } 10723b3a8eb9SGleb Smirnoff if ($8.minttl) 10733b3a8eb9SGleb Smirnoff r.min_ttl = $8.minttl; 10743b3a8eb9SGleb Smirnoff if ($8.maxmss) 10753b3a8eb9SGleb Smirnoff r.max_mss = $8.maxmss; 10763b3a8eb9SGleb Smirnoff if ($8.marker & SOM_SETTOS) { 10773b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SET_TOS; 10783b3a8eb9SGleb Smirnoff r.set_tos = $8.settos; 10793b3a8eb9SGleb Smirnoff } 10803b3a8eb9SGleb Smirnoff if ($8.fragcache) 10813b3a8eb9SGleb Smirnoff r.rule_flag |= $8.fragcache; 10823b3a8eb9SGleb Smirnoff if ($8.match_tag) 10833b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $8.match_tag, 10843b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 10853b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 10863b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 10873b3a8eb9SGleb Smirnoff YYERROR; 10883b3a8eb9SGleb Smirnoff } 10893b3a8eb9SGleb Smirnoff r.match_tag_not = $8.match_tag_not; 10903b3a8eb9SGleb Smirnoff r.rtableid = $8.rtableid; 10913b3a8eb9SGleb Smirnoff 10923b3a8eb9SGleb Smirnoff expand_rule(&r, $4, NULL, $6, $7.src_os, 10933b3a8eb9SGleb Smirnoff $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 10943b3a8eb9SGleb Smirnoff NULL, NULL, NULL, ""); 10953b3a8eb9SGleb Smirnoff } 10963b3a8eb9SGleb Smirnoff ; 10973b3a8eb9SGleb Smirnoff 10983b3a8eb9SGleb Smirnoff scrub_opts : { 10993b3a8eb9SGleb Smirnoff bzero(&scrub_opts, sizeof scrub_opts); 11003b3a8eb9SGleb Smirnoff scrub_opts.rtableid = -1; 11013b3a8eb9SGleb Smirnoff } 11023b3a8eb9SGleb Smirnoff scrub_opts_l 11033b3a8eb9SGleb Smirnoff { $$ = scrub_opts; } 11043b3a8eb9SGleb Smirnoff | /* empty */ { 11053b3a8eb9SGleb Smirnoff bzero(&scrub_opts, sizeof scrub_opts); 11063b3a8eb9SGleb Smirnoff scrub_opts.rtableid = -1; 11073b3a8eb9SGleb Smirnoff $$ = scrub_opts; 11083b3a8eb9SGleb Smirnoff } 11093b3a8eb9SGleb Smirnoff ; 11103b3a8eb9SGleb Smirnoff 11113b3a8eb9SGleb Smirnoff scrub_opts_l : scrub_opts_l scrub_opt 11123b3a8eb9SGleb Smirnoff | scrub_opt 11133b3a8eb9SGleb Smirnoff ; 11143b3a8eb9SGleb Smirnoff 11153b3a8eb9SGleb Smirnoff scrub_opt : NODF { 11163b3a8eb9SGleb Smirnoff if (scrub_opts.nodf) { 11173b3a8eb9SGleb Smirnoff yyerror("no-df cannot be respecified"); 11183b3a8eb9SGleb Smirnoff YYERROR; 11193b3a8eb9SGleb Smirnoff } 11203b3a8eb9SGleb Smirnoff scrub_opts.nodf = 1; 11213b3a8eb9SGleb Smirnoff } 11223b3a8eb9SGleb Smirnoff | MINTTL NUMBER { 11233b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_MINTTL) { 11243b3a8eb9SGleb Smirnoff yyerror("min-ttl cannot be respecified"); 11253b3a8eb9SGleb Smirnoff YYERROR; 11263b3a8eb9SGleb Smirnoff } 11273b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 255) { 11283b3a8eb9SGleb Smirnoff yyerror("illegal min-ttl value %d", $2); 11293b3a8eb9SGleb Smirnoff YYERROR; 11303b3a8eb9SGleb Smirnoff } 11313b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_MINTTL; 11323b3a8eb9SGleb Smirnoff scrub_opts.minttl = $2; 11333b3a8eb9SGleb Smirnoff } 11343b3a8eb9SGleb Smirnoff | MAXMSS NUMBER { 11353b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_MAXMSS) { 11363b3a8eb9SGleb Smirnoff yyerror("max-mss cannot be respecified"); 11373b3a8eb9SGleb Smirnoff YYERROR; 11383b3a8eb9SGleb Smirnoff } 11393b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 65535) { 11403b3a8eb9SGleb Smirnoff yyerror("illegal max-mss value %d", $2); 11413b3a8eb9SGleb Smirnoff YYERROR; 11423b3a8eb9SGleb Smirnoff } 11433b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_MAXMSS; 11443b3a8eb9SGleb Smirnoff scrub_opts.maxmss = $2; 11453b3a8eb9SGleb Smirnoff } 11463b3a8eb9SGleb Smirnoff | SETTOS tos { 11473b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_SETTOS) { 11483b3a8eb9SGleb Smirnoff yyerror("set-tos cannot be respecified"); 11493b3a8eb9SGleb Smirnoff YYERROR; 11503b3a8eb9SGleb Smirnoff } 11513b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_SETTOS; 11523b3a8eb9SGleb Smirnoff scrub_opts.settos = $2; 11533b3a8eb9SGleb Smirnoff } 11543b3a8eb9SGleb Smirnoff | fragcache { 11553b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_FRAGCACHE) { 11563b3a8eb9SGleb Smirnoff yyerror("fragcache cannot be respecified"); 11573b3a8eb9SGleb Smirnoff YYERROR; 11583b3a8eb9SGleb Smirnoff } 11593b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_FRAGCACHE; 11603b3a8eb9SGleb Smirnoff scrub_opts.fragcache = $1; 11613b3a8eb9SGleb Smirnoff } 11623b3a8eb9SGleb Smirnoff | REASSEMBLE STRING { 11633b3a8eb9SGleb Smirnoff if (strcasecmp($2, "tcp") != 0) { 11643b3a8eb9SGleb Smirnoff yyerror("scrub reassemble supports only tcp, " 11653b3a8eb9SGleb Smirnoff "not '%s'", $2); 11663b3a8eb9SGleb Smirnoff free($2); 11673b3a8eb9SGleb Smirnoff YYERROR; 11683b3a8eb9SGleb Smirnoff } 11693b3a8eb9SGleb Smirnoff free($2); 11703b3a8eb9SGleb Smirnoff if (scrub_opts.reassemble_tcp) { 11713b3a8eb9SGleb Smirnoff yyerror("reassemble tcp cannot be respecified"); 11723b3a8eb9SGleb Smirnoff YYERROR; 11733b3a8eb9SGleb Smirnoff } 11743b3a8eb9SGleb Smirnoff scrub_opts.reassemble_tcp = 1; 11753b3a8eb9SGleb Smirnoff } 11763b3a8eb9SGleb Smirnoff | RANDOMID { 11773b3a8eb9SGleb Smirnoff if (scrub_opts.randomid) { 11783b3a8eb9SGleb Smirnoff yyerror("random-id cannot be respecified"); 11793b3a8eb9SGleb Smirnoff YYERROR; 11803b3a8eb9SGleb Smirnoff } 11813b3a8eb9SGleb Smirnoff scrub_opts.randomid = 1; 11823b3a8eb9SGleb Smirnoff } 11833b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 11843b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 11853b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 11863b3a8eb9SGleb Smirnoff YYERROR; 11873b3a8eb9SGleb Smirnoff } 11883b3a8eb9SGleb Smirnoff scrub_opts.rtableid = $2; 11893b3a8eb9SGleb Smirnoff } 11903b3a8eb9SGleb Smirnoff | not TAGGED string { 11913b3a8eb9SGleb Smirnoff scrub_opts.match_tag = $3; 11923b3a8eb9SGleb Smirnoff scrub_opts.match_tag_not = $1; 11933b3a8eb9SGleb Smirnoff } 11943b3a8eb9SGleb Smirnoff ; 11953b3a8eb9SGleb Smirnoff 11963b3a8eb9SGleb Smirnoff fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 11973b3a8eb9SGleb Smirnoff | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 11983b3a8eb9SGleb Smirnoff | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 11993b3a8eb9SGleb Smirnoff ; 12003b3a8eb9SGleb Smirnoff 12013b3a8eb9SGleb Smirnoff antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 12023b3a8eb9SGleb Smirnoff struct pf_rule r; 12033b3a8eb9SGleb Smirnoff struct node_host *h = NULL, *hh; 12043b3a8eb9SGleb Smirnoff struct node_if *i, *j; 12053b3a8eb9SGleb Smirnoff 12063b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_FILTER)) 12073b3a8eb9SGleb Smirnoff YYERROR; 12083b3a8eb9SGleb Smirnoff 12093b3a8eb9SGleb Smirnoff for (i = $3; i; i = i->next) { 12103b3a8eb9SGleb Smirnoff bzero(&r, sizeof(r)); 12113b3a8eb9SGleb Smirnoff 12123b3a8eb9SGleb Smirnoff r.action = PF_DROP; 12133b3a8eb9SGleb Smirnoff r.direction = PF_IN; 12143b3a8eb9SGleb Smirnoff r.log = $2.log; 12153b3a8eb9SGleb Smirnoff r.logif = $2.logif; 12163b3a8eb9SGleb Smirnoff r.quick = $2.quick; 12173b3a8eb9SGleb Smirnoff r.af = $4; 12183b3a8eb9SGleb Smirnoff if (rule_label(&r, $5.label)) 12193b3a8eb9SGleb Smirnoff YYERROR; 12203b3a8eb9SGleb Smirnoff r.rtableid = $5.rtableid; 12213b3a8eb9SGleb Smirnoff j = calloc(1, sizeof(struct node_if)); 12223b3a8eb9SGleb Smirnoff if (j == NULL) 12233b3a8eb9SGleb Smirnoff err(1, "antispoof: calloc"); 12243b3a8eb9SGleb Smirnoff if (strlcpy(j->ifname, i->ifname, 12253b3a8eb9SGleb Smirnoff sizeof(j->ifname)) >= sizeof(j->ifname)) { 12263b3a8eb9SGleb Smirnoff free(j); 12273b3a8eb9SGleb Smirnoff yyerror("interface name too long"); 12283b3a8eb9SGleb Smirnoff YYERROR; 12293b3a8eb9SGleb Smirnoff } 12303b3a8eb9SGleb Smirnoff j->not = 1; 12313b3a8eb9SGleb Smirnoff if (i->dynamic) { 12323b3a8eb9SGleb Smirnoff h = calloc(1, sizeof(*h)); 12333b3a8eb9SGleb Smirnoff if (h == NULL) 12343b3a8eb9SGleb Smirnoff err(1, "address: calloc"); 12353b3a8eb9SGleb Smirnoff h->addr.type = PF_ADDR_DYNIFTL; 12363b3a8eb9SGleb Smirnoff set_ipmask(h, 128); 12373b3a8eb9SGleb Smirnoff if (strlcpy(h->addr.v.ifname, i->ifname, 12383b3a8eb9SGleb Smirnoff sizeof(h->addr.v.ifname)) >= 12393b3a8eb9SGleb Smirnoff sizeof(h->addr.v.ifname)) { 12403b3a8eb9SGleb Smirnoff free(h); 12413b3a8eb9SGleb Smirnoff yyerror( 12423b3a8eb9SGleb Smirnoff "interface name too long"); 12433b3a8eb9SGleb Smirnoff YYERROR; 12443b3a8eb9SGleb Smirnoff } 12453b3a8eb9SGleb Smirnoff hh = malloc(sizeof(*hh)); 12463b3a8eb9SGleb Smirnoff if (hh == NULL) 12473b3a8eb9SGleb Smirnoff err(1, "address: malloc"); 12483b3a8eb9SGleb Smirnoff bcopy(h, hh, sizeof(*hh)); 12493b3a8eb9SGleb Smirnoff h->addr.iflags = PFI_AFLAG_NETWORK; 12503b3a8eb9SGleb Smirnoff } else { 12513b3a8eb9SGleb Smirnoff h = ifa_lookup(j->ifname, 12523b3a8eb9SGleb Smirnoff PFI_AFLAG_NETWORK); 12533b3a8eb9SGleb Smirnoff hh = NULL; 12543b3a8eb9SGleb Smirnoff } 12553b3a8eb9SGleb Smirnoff 12563b3a8eb9SGleb Smirnoff if (h != NULL) 12573b3a8eb9SGleb Smirnoff expand_rule(&r, j, NULL, NULL, NULL, h, 12583b3a8eb9SGleb Smirnoff NULL, NULL, NULL, NULL, NULL, 12593b3a8eb9SGleb Smirnoff NULL, ""); 12603b3a8eb9SGleb Smirnoff 12613b3a8eb9SGleb Smirnoff if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 12623b3a8eb9SGleb Smirnoff bzero(&r, sizeof(r)); 12633b3a8eb9SGleb Smirnoff 12643b3a8eb9SGleb Smirnoff r.action = PF_DROP; 12653b3a8eb9SGleb Smirnoff r.direction = PF_IN; 12663b3a8eb9SGleb Smirnoff r.log = $2.log; 12673b3a8eb9SGleb Smirnoff r.logif = $2.logif; 12683b3a8eb9SGleb Smirnoff r.quick = $2.quick; 12693b3a8eb9SGleb Smirnoff r.af = $4; 12703b3a8eb9SGleb Smirnoff if (rule_label(&r, $5.label)) 12713b3a8eb9SGleb Smirnoff YYERROR; 12723b3a8eb9SGleb Smirnoff r.rtableid = $5.rtableid; 12733b3a8eb9SGleb Smirnoff if (hh != NULL) 12743b3a8eb9SGleb Smirnoff h = hh; 12753b3a8eb9SGleb Smirnoff else 12763b3a8eb9SGleb Smirnoff h = ifa_lookup(i->ifname, 0); 12773b3a8eb9SGleb Smirnoff if (h != NULL) 12783b3a8eb9SGleb Smirnoff expand_rule(&r, NULL, NULL, 12793b3a8eb9SGleb Smirnoff NULL, NULL, h, NULL, NULL, 12803b3a8eb9SGleb Smirnoff NULL, NULL, NULL, NULL, ""); 12813b3a8eb9SGleb Smirnoff } else 12823b3a8eb9SGleb Smirnoff free(hh); 12833b3a8eb9SGleb Smirnoff } 12843b3a8eb9SGleb Smirnoff free($5.label); 12853b3a8eb9SGleb Smirnoff } 12863b3a8eb9SGleb Smirnoff ; 12873b3a8eb9SGleb Smirnoff 12883b3a8eb9SGleb Smirnoff antispoof_ifspc : FOR antispoof_if { $$ = $2; } 12893b3a8eb9SGleb Smirnoff | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 12903b3a8eb9SGleb Smirnoff ; 12913b3a8eb9SGleb Smirnoff 12923b3a8eb9SGleb Smirnoff antispoof_iflst : antispoof_if optnl { $$ = $1; } 12933b3a8eb9SGleb Smirnoff | antispoof_iflst comma antispoof_if optnl { 12943b3a8eb9SGleb Smirnoff $1->tail->next = $3; 12953b3a8eb9SGleb Smirnoff $1->tail = $3; 12963b3a8eb9SGleb Smirnoff $$ = $1; 12973b3a8eb9SGleb Smirnoff } 12983b3a8eb9SGleb Smirnoff ; 12993b3a8eb9SGleb Smirnoff 13003b3a8eb9SGleb Smirnoff antispoof_if : if_item { $$ = $1; } 13013b3a8eb9SGleb Smirnoff | '(' if_item ')' { 13023b3a8eb9SGleb Smirnoff $2->dynamic = 1; 13033b3a8eb9SGleb Smirnoff $$ = $2; 13043b3a8eb9SGleb Smirnoff } 13053b3a8eb9SGleb Smirnoff ; 13063b3a8eb9SGleb Smirnoff 13073b3a8eb9SGleb Smirnoff antispoof_opts : { 13083b3a8eb9SGleb Smirnoff bzero(&antispoof_opts, sizeof antispoof_opts); 13093b3a8eb9SGleb Smirnoff antispoof_opts.rtableid = -1; 13103b3a8eb9SGleb Smirnoff } 13113b3a8eb9SGleb Smirnoff antispoof_opts_l 13123b3a8eb9SGleb Smirnoff { $$ = antispoof_opts; } 13133b3a8eb9SGleb Smirnoff | /* empty */ { 13143b3a8eb9SGleb Smirnoff bzero(&antispoof_opts, sizeof antispoof_opts); 13153b3a8eb9SGleb Smirnoff antispoof_opts.rtableid = -1; 13163b3a8eb9SGleb Smirnoff $$ = antispoof_opts; 13173b3a8eb9SGleb Smirnoff } 13183b3a8eb9SGleb Smirnoff ; 13193b3a8eb9SGleb Smirnoff 13203b3a8eb9SGleb Smirnoff antispoof_opts_l : antispoof_opts_l antispoof_opt 13213b3a8eb9SGleb Smirnoff | antispoof_opt 13223b3a8eb9SGleb Smirnoff ; 13233b3a8eb9SGleb Smirnoff 13243b3a8eb9SGleb Smirnoff antispoof_opt : label { 13253b3a8eb9SGleb Smirnoff if (antispoof_opts.label) { 13263b3a8eb9SGleb Smirnoff yyerror("label cannot be redefined"); 13273b3a8eb9SGleb Smirnoff YYERROR; 13283b3a8eb9SGleb Smirnoff } 13293b3a8eb9SGleb Smirnoff antispoof_opts.label = $1; 13303b3a8eb9SGleb Smirnoff } 13313b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 13323b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 13333b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 13343b3a8eb9SGleb Smirnoff YYERROR; 13353b3a8eb9SGleb Smirnoff } 13363b3a8eb9SGleb Smirnoff antispoof_opts.rtableid = $2; 13373b3a8eb9SGleb Smirnoff } 13383b3a8eb9SGleb Smirnoff ; 13393b3a8eb9SGleb Smirnoff 13403b3a8eb9SGleb Smirnoff not : '!' { $$ = 1; } 13413b3a8eb9SGleb Smirnoff | /* empty */ { $$ = 0; } 13423b3a8eb9SGleb Smirnoff ; 13433b3a8eb9SGleb Smirnoff 13443b3a8eb9SGleb Smirnoff tabledef : TABLE '<' STRING '>' table_opts { 13453b3a8eb9SGleb Smirnoff struct node_host *h, *nh; 13463b3a8eb9SGleb Smirnoff struct node_tinit *ti, *nti; 13473b3a8eb9SGleb Smirnoff 13483b3a8eb9SGleb Smirnoff if (strlen($3) >= PF_TABLE_NAME_SIZE) { 13493b3a8eb9SGleb Smirnoff yyerror("table name too long, max %d chars", 13503b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE - 1); 13513b3a8eb9SGleb Smirnoff free($3); 13523b3a8eb9SGleb Smirnoff YYERROR; 13533b3a8eb9SGleb Smirnoff } 13543b3a8eb9SGleb Smirnoff if (pf->loadopt & PFCTL_FLAG_TABLE) 13553b3a8eb9SGleb Smirnoff if (process_tabledef($3, &$5)) { 13563b3a8eb9SGleb Smirnoff free($3); 13573b3a8eb9SGleb Smirnoff YYERROR; 13583b3a8eb9SGleb Smirnoff } 13593b3a8eb9SGleb Smirnoff free($3); 13603b3a8eb9SGleb Smirnoff for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 13613b3a8eb9SGleb Smirnoff ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 13623b3a8eb9SGleb Smirnoff if (ti->file) 13633b3a8eb9SGleb Smirnoff free(ti->file); 13643b3a8eb9SGleb Smirnoff for (h = ti->host; h != NULL; h = nh) { 13653b3a8eb9SGleb Smirnoff nh = h->next; 13663b3a8eb9SGleb Smirnoff free(h); 13673b3a8eb9SGleb Smirnoff } 13683b3a8eb9SGleb Smirnoff nti = SIMPLEQ_NEXT(ti, entries); 13693b3a8eb9SGleb Smirnoff free(ti); 13703b3a8eb9SGleb Smirnoff } 13713b3a8eb9SGleb Smirnoff } 13723b3a8eb9SGleb Smirnoff ; 13733b3a8eb9SGleb Smirnoff 13743b3a8eb9SGleb Smirnoff table_opts : { 13753b3a8eb9SGleb Smirnoff bzero(&table_opts, sizeof table_opts); 13763b3a8eb9SGleb Smirnoff SIMPLEQ_INIT(&table_opts.init_nodes); 13773b3a8eb9SGleb Smirnoff } 13783b3a8eb9SGleb Smirnoff table_opts_l 13793b3a8eb9SGleb Smirnoff { $$ = table_opts; } 13803b3a8eb9SGleb Smirnoff | /* empty */ 13813b3a8eb9SGleb Smirnoff { 13823b3a8eb9SGleb Smirnoff bzero(&table_opts, sizeof table_opts); 13833b3a8eb9SGleb Smirnoff SIMPLEQ_INIT(&table_opts.init_nodes); 13843b3a8eb9SGleb Smirnoff $$ = table_opts; 13853b3a8eb9SGleb Smirnoff } 13863b3a8eb9SGleb Smirnoff ; 13873b3a8eb9SGleb Smirnoff 13883b3a8eb9SGleb Smirnoff table_opts_l : table_opts_l table_opt 13893b3a8eb9SGleb Smirnoff | table_opt 13903b3a8eb9SGleb Smirnoff ; 13913b3a8eb9SGleb Smirnoff 13923b3a8eb9SGleb Smirnoff table_opt : STRING { 13933b3a8eb9SGleb Smirnoff if (!strcmp($1, "const")) 13943b3a8eb9SGleb Smirnoff table_opts.flags |= PFR_TFLAG_CONST; 13953b3a8eb9SGleb Smirnoff else if (!strcmp($1, "persist")) 13963b3a8eb9SGleb Smirnoff table_opts.flags |= PFR_TFLAG_PERSIST; 13973b3a8eb9SGleb Smirnoff else if (!strcmp($1, "counters")) 13983b3a8eb9SGleb Smirnoff table_opts.flags |= PFR_TFLAG_COUNTERS; 13993b3a8eb9SGleb Smirnoff else { 14003b3a8eb9SGleb Smirnoff yyerror("invalid table option '%s'", $1); 14013b3a8eb9SGleb Smirnoff free($1); 14023b3a8eb9SGleb Smirnoff YYERROR; 14033b3a8eb9SGleb Smirnoff } 14043b3a8eb9SGleb Smirnoff free($1); 14053b3a8eb9SGleb Smirnoff } 14063b3a8eb9SGleb Smirnoff | '{' optnl '}' { table_opts.init_addr = 1; } 14073b3a8eb9SGleb Smirnoff | '{' optnl host_list '}' { 14083b3a8eb9SGleb Smirnoff struct node_host *n; 14093b3a8eb9SGleb Smirnoff struct node_tinit *ti; 14103b3a8eb9SGleb Smirnoff 14113b3a8eb9SGleb Smirnoff for (n = $3; n != NULL; n = n->next) { 14123b3a8eb9SGleb Smirnoff switch (n->addr.type) { 14133b3a8eb9SGleb Smirnoff case PF_ADDR_ADDRMASK: 14143b3a8eb9SGleb Smirnoff continue; /* ok */ 14153b3a8eb9SGleb Smirnoff case PF_ADDR_RANGE: 14163b3a8eb9SGleb Smirnoff yyerror("address ranges are not " 14173b3a8eb9SGleb Smirnoff "permitted inside tables"); 14183b3a8eb9SGleb Smirnoff break; 14193b3a8eb9SGleb Smirnoff case PF_ADDR_DYNIFTL: 14203b3a8eb9SGleb Smirnoff yyerror("dynamic addresses are not " 14213b3a8eb9SGleb Smirnoff "permitted inside tables"); 14223b3a8eb9SGleb Smirnoff break; 14233b3a8eb9SGleb Smirnoff case PF_ADDR_TABLE: 14243b3a8eb9SGleb Smirnoff yyerror("tables cannot contain tables"); 14253b3a8eb9SGleb Smirnoff break; 14263b3a8eb9SGleb Smirnoff case PF_ADDR_NOROUTE: 14273b3a8eb9SGleb Smirnoff yyerror("\"no-route\" is not permitted " 14283b3a8eb9SGleb Smirnoff "inside tables"); 14293b3a8eb9SGleb Smirnoff break; 14303b3a8eb9SGleb Smirnoff case PF_ADDR_URPFFAILED: 14313b3a8eb9SGleb Smirnoff yyerror("\"urpf-failed\" is not " 14323b3a8eb9SGleb Smirnoff "permitted inside tables"); 14333b3a8eb9SGleb Smirnoff break; 14343b3a8eb9SGleb Smirnoff default: 14353b3a8eb9SGleb Smirnoff yyerror("unknown address type %d", 14363b3a8eb9SGleb Smirnoff n->addr.type); 14373b3a8eb9SGleb Smirnoff } 14383b3a8eb9SGleb Smirnoff YYERROR; 14393b3a8eb9SGleb Smirnoff } 14403b3a8eb9SGleb Smirnoff if (!(ti = calloc(1, sizeof(*ti)))) 14413b3a8eb9SGleb Smirnoff err(1, "table_opt: calloc"); 14423b3a8eb9SGleb Smirnoff ti->host = $3; 14433b3a8eb9SGleb Smirnoff SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 14443b3a8eb9SGleb Smirnoff entries); 14453b3a8eb9SGleb Smirnoff table_opts.init_addr = 1; 14463b3a8eb9SGleb Smirnoff } 14473b3a8eb9SGleb Smirnoff | FILENAME STRING { 14483b3a8eb9SGleb Smirnoff struct node_tinit *ti; 14493b3a8eb9SGleb Smirnoff 14503b3a8eb9SGleb Smirnoff if (!(ti = calloc(1, sizeof(*ti)))) 14513b3a8eb9SGleb Smirnoff err(1, "table_opt: calloc"); 14523b3a8eb9SGleb Smirnoff ti->file = $2; 14533b3a8eb9SGleb Smirnoff SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 14543b3a8eb9SGleb Smirnoff entries); 14553b3a8eb9SGleb Smirnoff table_opts.init_addr = 1; 14563b3a8eb9SGleb Smirnoff } 14573b3a8eb9SGleb Smirnoff ; 14583b3a8eb9SGleb Smirnoff 14593b3a8eb9SGleb Smirnoff altqif : ALTQ interface queue_opts QUEUE qassign { 14603b3a8eb9SGleb Smirnoff struct pf_altq a; 14613b3a8eb9SGleb Smirnoff 14623b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_QUEUE)) 14633b3a8eb9SGleb Smirnoff YYERROR; 14643b3a8eb9SGleb Smirnoff 14653b3a8eb9SGleb Smirnoff memset(&a, 0, sizeof(a)); 14663b3a8eb9SGleb Smirnoff if ($3.scheduler.qtype == ALTQT_NONE) { 14673b3a8eb9SGleb Smirnoff yyerror("no scheduler specified!"); 14683b3a8eb9SGleb Smirnoff YYERROR; 14693b3a8eb9SGleb Smirnoff } 14703b3a8eb9SGleb Smirnoff a.scheduler = $3.scheduler.qtype; 14713b3a8eb9SGleb Smirnoff a.qlimit = $3.qlimit; 14723b3a8eb9SGleb Smirnoff a.tbrsize = $3.tbrsize; 14733b3a8eb9SGleb Smirnoff if ($5 == NULL) { 14743b3a8eb9SGleb Smirnoff yyerror("no child queues specified"); 14753b3a8eb9SGleb Smirnoff YYERROR; 14763b3a8eb9SGleb Smirnoff } 14773b3a8eb9SGleb Smirnoff if (expand_altq(&a, $2, $5, $3.queue_bwspec, 14783b3a8eb9SGleb Smirnoff &$3.scheduler)) 14793b3a8eb9SGleb Smirnoff YYERROR; 14803b3a8eb9SGleb Smirnoff } 14813b3a8eb9SGleb Smirnoff ; 14823b3a8eb9SGleb Smirnoff 14833b3a8eb9SGleb Smirnoff queuespec : QUEUE STRING interface queue_opts qassign { 14843b3a8eb9SGleb Smirnoff struct pf_altq a; 14853b3a8eb9SGleb Smirnoff 14863b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_QUEUE)) { 14873b3a8eb9SGleb Smirnoff free($2); 14883b3a8eb9SGleb Smirnoff YYERROR; 14893b3a8eb9SGleb Smirnoff } 14903b3a8eb9SGleb Smirnoff 14913b3a8eb9SGleb Smirnoff memset(&a, 0, sizeof(a)); 14923b3a8eb9SGleb Smirnoff 14933b3a8eb9SGleb Smirnoff if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 14943b3a8eb9SGleb Smirnoff sizeof(a.qname)) { 14953b3a8eb9SGleb Smirnoff yyerror("queue name too long (max " 14963b3a8eb9SGleb Smirnoff "%d chars)", PF_QNAME_SIZE-1); 14973b3a8eb9SGleb Smirnoff free($2); 14983b3a8eb9SGleb Smirnoff YYERROR; 14993b3a8eb9SGleb Smirnoff } 15003b3a8eb9SGleb Smirnoff free($2); 15013b3a8eb9SGleb Smirnoff if ($4.tbrsize) { 15023b3a8eb9SGleb Smirnoff yyerror("cannot specify tbrsize for queue"); 15033b3a8eb9SGleb Smirnoff YYERROR; 15043b3a8eb9SGleb Smirnoff } 15053b3a8eb9SGleb Smirnoff if ($4.priority > 255) { 15063b3a8eb9SGleb Smirnoff yyerror("priority out of range: max 255"); 15073b3a8eb9SGleb Smirnoff YYERROR; 15083b3a8eb9SGleb Smirnoff } 15093b3a8eb9SGleb Smirnoff a.priority = $4.priority; 15103b3a8eb9SGleb Smirnoff a.qlimit = $4.qlimit; 15113b3a8eb9SGleb Smirnoff a.scheduler = $4.scheduler.qtype; 15123b3a8eb9SGleb Smirnoff if (expand_queue(&a, $3, $5, $4.queue_bwspec, 15133b3a8eb9SGleb Smirnoff &$4.scheduler)) { 15143b3a8eb9SGleb Smirnoff yyerror("errors in queue definition"); 15153b3a8eb9SGleb Smirnoff YYERROR; 15163b3a8eb9SGleb Smirnoff } 15173b3a8eb9SGleb Smirnoff } 15183b3a8eb9SGleb Smirnoff ; 15193b3a8eb9SGleb Smirnoff 15203b3a8eb9SGleb Smirnoff queue_opts : { 15213b3a8eb9SGleb Smirnoff bzero(&queue_opts, sizeof queue_opts); 15223b3a8eb9SGleb Smirnoff queue_opts.priority = DEFAULT_PRIORITY; 15233b3a8eb9SGleb Smirnoff queue_opts.qlimit = DEFAULT_QLIMIT; 15243b3a8eb9SGleb Smirnoff queue_opts.scheduler.qtype = ALTQT_NONE; 15253b3a8eb9SGleb Smirnoff queue_opts.queue_bwspec.bw_percent = 100; 15263b3a8eb9SGleb Smirnoff } 15273b3a8eb9SGleb Smirnoff queue_opts_l 15283b3a8eb9SGleb Smirnoff { $$ = queue_opts; } 15293b3a8eb9SGleb Smirnoff | /* empty */ { 15303b3a8eb9SGleb Smirnoff bzero(&queue_opts, sizeof queue_opts); 15313b3a8eb9SGleb Smirnoff queue_opts.priority = DEFAULT_PRIORITY; 15323b3a8eb9SGleb Smirnoff queue_opts.qlimit = DEFAULT_QLIMIT; 15333b3a8eb9SGleb Smirnoff queue_opts.scheduler.qtype = ALTQT_NONE; 15343b3a8eb9SGleb Smirnoff queue_opts.queue_bwspec.bw_percent = 100; 15353b3a8eb9SGleb Smirnoff $$ = queue_opts; 15363b3a8eb9SGleb Smirnoff } 15373b3a8eb9SGleb Smirnoff ; 15383b3a8eb9SGleb Smirnoff 15393b3a8eb9SGleb Smirnoff queue_opts_l : queue_opts_l queue_opt 15403b3a8eb9SGleb Smirnoff | queue_opt 15413b3a8eb9SGleb Smirnoff ; 15423b3a8eb9SGleb Smirnoff 15433b3a8eb9SGleb Smirnoff queue_opt : BANDWIDTH bandwidth { 15443b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_BWSPEC) { 15453b3a8eb9SGleb Smirnoff yyerror("bandwidth cannot be respecified"); 15463b3a8eb9SGleb Smirnoff YYERROR; 15473b3a8eb9SGleb Smirnoff } 15483b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_BWSPEC; 15493b3a8eb9SGleb Smirnoff queue_opts.queue_bwspec = $2; 15503b3a8eb9SGleb Smirnoff } 15513b3a8eb9SGleb Smirnoff | PRIORITY NUMBER { 15523b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_PRIORITY) { 15533b3a8eb9SGleb Smirnoff yyerror("priority cannot be respecified"); 15543b3a8eb9SGleb Smirnoff YYERROR; 15553b3a8eb9SGleb Smirnoff } 15563b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 255) { 15573b3a8eb9SGleb Smirnoff yyerror("priority out of range: max 255"); 15583b3a8eb9SGleb Smirnoff YYERROR; 15593b3a8eb9SGleb Smirnoff } 15603b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_PRIORITY; 15613b3a8eb9SGleb Smirnoff queue_opts.priority = $2; 15623b3a8eb9SGleb Smirnoff } 15633b3a8eb9SGleb Smirnoff | QLIMIT NUMBER { 15643b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_QLIMIT) { 15653b3a8eb9SGleb Smirnoff yyerror("qlimit cannot be respecified"); 15663b3a8eb9SGleb Smirnoff YYERROR; 15673b3a8eb9SGleb Smirnoff } 15683b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 65535) { 15693b3a8eb9SGleb Smirnoff yyerror("qlimit out of range: max 65535"); 15703b3a8eb9SGleb Smirnoff YYERROR; 15713b3a8eb9SGleb Smirnoff } 15723b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_QLIMIT; 15733b3a8eb9SGleb Smirnoff queue_opts.qlimit = $2; 15743b3a8eb9SGleb Smirnoff } 15753b3a8eb9SGleb Smirnoff | scheduler { 15763b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_SCHEDULER) { 15773b3a8eb9SGleb Smirnoff yyerror("scheduler cannot be respecified"); 15783b3a8eb9SGleb Smirnoff YYERROR; 15793b3a8eb9SGleb Smirnoff } 15803b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_SCHEDULER; 15813b3a8eb9SGleb Smirnoff queue_opts.scheduler = $1; 15823b3a8eb9SGleb Smirnoff } 15833b3a8eb9SGleb Smirnoff | TBRSIZE NUMBER { 15843b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_TBRSIZE) { 15853b3a8eb9SGleb Smirnoff yyerror("tbrsize cannot be respecified"); 15863b3a8eb9SGleb Smirnoff YYERROR; 15873b3a8eb9SGleb Smirnoff } 15883b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 65535) { 15893b3a8eb9SGleb Smirnoff yyerror("tbrsize too big: max 65535"); 15903b3a8eb9SGleb Smirnoff YYERROR; 15913b3a8eb9SGleb Smirnoff } 15923b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_TBRSIZE; 15933b3a8eb9SGleb Smirnoff queue_opts.tbrsize = $2; 15943b3a8eb9SGleb Smirnoff } 15953b3a8eb9SGleb Smirnoff ; 15963b3a8eb9SGleb Smirnoff 15973b3a8eb9SGleb Smirnoff bandwidth : STRING { 15983b3a8eb9SGleb Smirnoff double bps; 15993b3a8eb9SGleb Smirnoff char *cp; 16003b3a8eb9SGleb Smirnoff 16013b3a8eb9SGleb Smirnoff $$.bw_percent = 0; 16023b3a8eb9SGleb Smirnoff 16033b3a8eb9SGleb Smirnoff bps = strtod($1, &cp); 16043b3a8eb9SGleb Smirnoff if (cp != NULL) { 16053b3a8eb9SGleb Smirnoff if (!strcmp(cp, "b")) 16063b3a8eb9SGleb Smirnoff ; /* nothing */ 16073b3a8eb9SGleb Smirnoff else if (!strcmp(cp, "Kb")) 16083b3a8eb9SGleb Smirnoff bps *= 1000; 16093b3a8eb9SGleb Smirnoff else if (!strcmp(cp, "Mb")) 16103b3a8eb9SGleb Smirnoff bps *= 1000 * 1000; 16113b3a8eb9SGleb Smirnoff else if (!strcmp(cp, "Gb")) 16123b3a8eb9SGleb Smirnoff bps *= 1000 * 1000 * 1000; 16133b3a8eb9SGleb Smirnoff else if (!strcmp(cp, "%")) { 16143b3a8eb9SGleb Smirnoff if (bps < 0 || bps > 100) { 16153b3a8eb9SGleb Smirnoff yyerror("bandwidth spec " 16163b3a8eb9SGleb Smirnoff "out of range"); 16173b3a8eb9SGleb Smirnoff free($1); 16183b3a8eb9SGleb Smirnoff YYERROR; 16193b3a8eb9SGleb Smirnoff } 16203b3a8eb9SGleb Smirnoff $$.bw_percent = bps; 16213b3a8eb9SGleb Smirnoff bps = 0; 16223b3a8eb9SGleb Smirnoff } else { 16233b3a8eb9SGleb Smirnoff yyerror("unknown unit %s", cp); 16243b3a8eb9SGleb Smirnoff free($1); 16253b3a8eb9SGleb Smirnoff YYERROR; 16263b3a8eb9SGleb Smirnoff } 16273b3a8eb9SGleb Smirnoff } 16283b3a8eb9SGleb Smirnoff free($1); 16293b3a8eb9SGleb Smirnoff $$.bw_absolute = (u_int32_t)bps; 16303b3a8eb9SGleb Smirnoff } 16313b3a8eb9SGleb Smirnoff | NUMBER { 16323b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > UINT_MAX) { 16333b3a8eb9SGleb Smirnoff yyerror("bandwidth number too big"); 16343b3a8eb9SGleb Smirnoff YYERROR; 16353b3a8eb9SGleb Smirnoff } 16363b3a8eb9SGleb Smirnoff $$.bw_percent = 0; 16373b3a8eb9SGleb Smirnoff $$.bw_absolute = $1; 16383b3a8eb9SGleb Smirnoff } 16393b3a8eb9SGleb Smirnoff ; 16403b3a8eb9SGleb Smirnoff 16413b3a8eb9SGleb Smirnoff scheduler : CBQ { 16423b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_CBQ; 16433b3a8eb9SGleb Smirnoff $$.data.cbq_opts.flags = 0; 16443b3a8eb9SGleb Smirnoff } 16453b3a8eb9SGleb Smirnoff | CBQ '(' cbqflags_list ')' { 16463b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_CBQ; 16473b3a8eb9SGleb Smirnoff $$.data.cbq_opts.flags = $3; 16483b3a8eb9SGleb Smirnoff } 16493b3a8eb9SGleb Smirnoff | PRIQ { 16503b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_PRIQ; 16513b3a8eb9SGleb Smirnoff $$.data.priq_opts.flags = 0; 16523b3a8eb9SGleb Smirnoff } 16533b3a8eb9SGleb Smirnoff | PRIQ '(' priqflags_list ')' { 16543b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_PRIQ; 16553b3a8eb9SGleb Smirnoff $$.data.priq_opts.flags = $3; 16563b3a8eb9SGleb Smirnoff } 16573b3a8eb9SGleb Smirnoff | HFSC { 16583b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_HFSC; 16593b3a8eb9SGleb Smirnoff bzero(&$$.data.hfsc_opts, 16603b3a8eb9SGleb Smirnoff sizeof(struct node_hfsc_opts)); 16613b3a8eb9SGleb Smirnoff } 16623b3a8eb9SGleb Smirnoff | HFSC '(' hfsc_opts ')' { 16633b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_HFSC; 16643b3a8eb9SGleb Smirnoff $$.data.hfsc_opts = $3; 16653b3a8eb9SGleb Smirnoff } 1666*a5b789f6SErmal Luçi | FAIRQ { 1667*a5b789f6SErmal Luçi $$.qtype = ALTQT_FAIRQ; 1668*a5b789f6SErmal Luçi bzero(&$$.data.fairq_opts, 1669*a5b789f6SErmal Luçi sizeof(struct node_fairq_opts)); 1670*a5b789f6SErmal Luçi } 1671*a5b789f6SErmal Luçi | FAIRQ '(' fairq_opts ')' { 1672*a5b789f6SErmal Luçi $$.qtype = ALTQT_FAIRQ; 1673*a5b789f6SErmal Luçi $$.data.fairq_opts = $3; 1674*a5b789f6SErmal Luçi } 16753b3a8eb9SGleb Smirnoff ; 16763b3a8eb9SGleb Smirnoff 16773b3a8eb9SGleb Smirnoff cbqflags_list : cbqflags_item { $$ |= $1; } 16783b3a8eb9SGleb Smirnoff | cbqflags_list comma cbqflags_item { $$ |= $3; } 16793b3a8eb9SGleb Smirnoff ; 16803b3a8eb9SGleb Smirnoff 16813b3a8eb9SGleb Smirnoff cbqflags_item : STRING { 16823b3a8eb9SGleb Smirnoff if (!strcmp($1, "default")) 16833b3a8eb9SGleb Smirnoff $$ = CBQCLF_DEFCLASS; 16843b3a8eb9SGleb Smirnoff else if (!strcmp($1, "borrow")) 16853b3a8eb9SGleb Smirnoff $$ = CBQCLF_BORROW; 16863b3a8eb9SGleb Smirnoff else if (!strcmp($1, "red")) 16873b3a8eb9SGleb Smirnoff $$ = CBQCLF_RED; 16883b3a8eb9SGleb Smirnoff else if (!strcmp($1, "ecn")) 16893b3a8eb9SGleb Smirnoff $$ = CBQCLF_RED|CBQCLF_ECN; 16903b3a8eb9SGleb Smirnoff else if (!strcmp($1, "rio")) 16913b3a8eb9SGleb Smirnoff $$ = CBQCLF_RIO; 16923b3a8eb9SGleb Smirnoff else { 16933b3a8eb9SGleb Smirnoff yyerror("unknown cbq flag \"%s\"", $1); 16943b3a8eb9SGleb Smirnoff free($1); 16953b3a8eb9SGleb Smirnoff YYERROR; 16963b3a8eb9SGleb Smirnoff } 16973b3a8eb9SGleb Smirnoff free($1); 16983b3a8eb9SGleb Smirnoff } 16993b3a8eb9SGleb Smirnoff ; 17003b3a8eb9SGleb Smirnoff 17013b3a8eb9SGleb Smirnoff priqflags_list : priqflags_item { $$ |= $1; } 17023b3a8eb9SGleb Smirnoff | priqflags_list comma priqflags_item { $$ |= $3; } 17033b3a8eb9SGleb Smirnoff ; 17043b3a8eb9SGleb Smirnoff 17053b3a8eb9SGleb Smirnoff priqflags_item : STRING { 17063b3a8eb9SGleb Smirnoff if (!strcmp($1, "default")) 17073b3a8eb9SGleb Smirnoff $$ = PRCF_DEFAULTCLASS; 17083b3a8eb9SGleb Smirnoff else if (!strcmp($1, "red")) 17093b3a8eb9SGleb Smirnoff $$ = PRCF_RED; 17103b3a8eb9SGleb Smirnoff else if (!strcmp($1, "ecn")) 17113b3a8eb9SGleb Smirnoff $$ = PRCF_RED|PRCF_ECN; 17123b3a8eb9SGleb Smirnoff else if (!strcmp($1, "rio")) 17133b3a8eb9SGleb Smirnoff $$ = PRCF_RIO; 17143b3a8eb9SGleb Smirnoff else { 17153b3a8eb9SGleb Smirnoff yyerror("unknown priq flag \"%s\"", $1); 17163b3a8eb9SGleb Smirnoff free($1); 17173b3a8eb9SGleb Smirnoff YYERROR; 17183b3a8eb9SGleb Smirnoff } 17193b3a8eb9SGleb Smirnoff free($1); 17203b3a8eb9SGleb Smirnoff } 17213b3a8eb9SGleb Smirnoff ; 17223b3a8eb9SGleb Smirnoff 17233b3a8eb9SGleb Smirnoff hfsc_opts : { 17243b3a8eb9SGleb Smirnoff bzero(&hfsc_opts, 17253b3a8eb9SGleb Smirnoff sizeof(struct node_hfsc_opts)); 17263b3a8eb9SGleb Smirnoff } 17273b3a8eb9SGleb Smirnoff hfscopts_list { 17283b3a8eb9SGleb Smirnoff $$ = hfsc_opts; 17293b3a8eb9SGleb Smirnoff } 17303b3a8eb9SGleb Smirnoff ; 17313b3a8eb9SGleb Smirnoff 17323b3a8eb9SGleb Smirnoff hfscopts_list : hfscopts_item 17333b3a8eb9SGleb Smirnoff | hfscopts_list comma hfscopts_item 17343b3a8eb9SGleb Smirnoff ; 17353b3a8eb9SGleb Smirnoff 17363b3a8eb9SGleb Smirnoff hfscopts_item : LINKSHARE bandwidth { 17373b3a8eb9SGleb Smirnoff if (hfsc_opts.linkshare.used) { 17383b3a8eb9SGleb Smirnoff yyerror("linkshare already specified"); 17393b3a8eb9SGleb Smirnoff YYERROR; 17403b3a8eb9SGleb Smirnoff } 17413b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.m2 = $2; 17423b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.used = 1; 17433b3a8eb9SGleb Smirnoff } 17443b3a8eb9SGleb Smirnoff | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 17453b3a8eb9SGleb Smirnoff { 17463b3a8eb9SGleb Smirnoff if ($5 < 0 || $5 > INT_MAX) { 17473b3a8eb9SGleb Smirnoff yyerror("timing in curve out of range"); 17483b3a8eb9SGleb Smirnoff YYERROR; 17493b3a8eb9SGleb Smirnoff } 17503b3a8eb9SGleb Smirnoff if (hfsc_opts.linkshare.used) { 17513b3a8eb9SGleb Smirnoff yyerror("linkshare already specified"); 17523b3a8eb9SGleb Smirnoff YYERROR; 17533b3a8eb9SGleb Smirnoff } 17543b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.m1 = $3; 17553b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.d = $5; 17563b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.m2 = $7; 17573b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.used = 1; 17583b3a8eb9SGleb Smirnoff } 17593b3a8eb9SGleb Smirnoff | REALTIME bandwidth { 17603b3a8eb9SGleb Smirnoff if (hfsc_opts.realtime.used) { 17613b3a8eb9SGleb Smirnoff yyerror("realtime already specified"); 17623b3a8eb9SGleb Smirnoff YYERROR; 17633b3a8eb9SGleb Smirnoff } 17643b3a8eb9SGleb Smirnoff hfsc_opts.realtime.m2 = $2; 17653b3a8eb9SGleb Smirnoff hfsc_opts.realtime.used = 1; 17663b3a8eb9SGleb Smirnoff } 17673b3a8eb9SGleb Smirnoff | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 17683b3a8eb9SGleb Smirnoff { 17693b3a8eb9SGleb Smirnoff if ($5 < 0 || $5 > INT_MAX) { 17703b3a8eb9SGleb Smirnoff yyerror("timing in curve out of range"); 17713b3a8eb9SGleb Smirnoff YYERROR; 17723b3a8eb9SGleb Smirnoff } 17733b3a8eb9SGleb Smirnoff if (hfsc_opts.realtime.used) { 17743b3a8eb9SGleb Smirnoff yyerror("realtime already specified"); 17753b3a8eb9SGleb Smirnoff YYERROR; 17763b3a8eb9SGleb Smirnoff } 17773b3a8eb9SGleb Smirnoff hfsc_opts.realtime.m1 = $3; 17783b3a8eb9SGleb Smirnoff hfsc_opts.realtime.d = $5; 17793b3a8eb9SGleb Smirnoff hfsc_opts.realtime.m2 = $7; 17803b3a8eb9SGleb Smirnoff hfsc_opts.realtime.used = 1; 17813b3a8eb9SGleb Smirnoff } 17823b3a8eb9SGleb Smirnoff | UPPERLIMIT bandwidth { 17833b3a8eb9SGleb Smirnoff if (hfsc_opts.upperlimit.used) { 17843b3a8eb9SGleb Smirnoff yyerror("upperlimit already specified"); 17853b3a8eb9SGleb Smirnoff YYERROR; 17863b3a8eb9SGleb Smirnoff } 17873b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.m2 = $2; 17883b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.used = 1; 17893b3a8eb9SGleb Smirnoff } 17903b3a8eb9SGleb Smirnoff | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 17913b3a8eb9SGleb Smirnoff { 17923b3a8eb9SGleb Smirnoff if ($5 < 0 || $5 > INT_MAX) { 17933b3a8eb9SGleb Smirnoff yyerror("timing in curve out of range"); 17943b3a8eb9SGleb Smirnoff YYERROR; 17953b3a8eb9SGleb Smirnoff } 17963b3a8eb9SGleb Smirnoff if (hfsc_opts.upperlimit.used) { 17973b3a8eb9SGleb Smirnoff yyerror("upperlimit already specified"); 17983b3a8eb9SGleb Smirnoff YYERROR; 17993b3a8eb9SGleb Smirnoff } 18003b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.m1 = $3; 18013b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.d = $5; 18023b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.m2 = $7; 18033b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.used = 1; 18043b3a8eb9SGleb Smirnoff } 18053b3a8eb9SGleb Smirnoff | STRING { 18063b3a8eb9SGleb Smirnoff if (!strcmp($1, "default")) 18073b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_DEFAULTCLASS; 18083b3a8eb9SGleb Smirnoff else if (!strcmp($1, "red")) 18093b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_RED; 18103b3a8eb9SGleb Smirnoff else if (!strcmp($1, "ecn")) 18113b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 18123b3a8eb9SGleb Smirnoff else if (!strcmp($1, "rio")) 18133b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_RIO; 18143b3a8eb9SGleb Smirnoff else { 18153b3a8eb9SGleb Smirnoff yyerror("unknown hfsc flag \"%s\"", $1); 18163b3a8eb9SGleb Smirnoff free($1); 18173b3a8eb9SGleb Smirnoff YYERROR; 18183b3a8eb9SGleb Smirnoff } 18193b3a8eb9SGleb Smirnoff free($1); 18203b3a8eb9SGleb Smirnoff } 18213b3a8eb9SGleb Smirnoff ; 18223b3a8eb9SGleb Smirnoff 1823*a5b789f6SErmal Luçi fairq_opts : { 1824*a5b789f6SErmal Luçi bzero(&fairq_opts, 1825*a5b789f6SErmal Luçi sizeof(struct node_fairq_opts)); 1826*a5b789f6SErmal Luçi } 1827*a5b789f6SErmal Luçi fairqopts_list { 1828*a5b789f6SErmal Luçi $$ = fairq_opts; 1829*a5b789f6SErmal Luçi } 1830*a5b789f6SErmal Luçi ; 1831*a5b789f6SErmal Luçi 1832*a5b789f6SErmal Luçi fairqopts_list : fairqopts_item 1833*a5b789f6SErmal Luçi | fairqopts_list comma fairqopts_item 1834*a5b789f6SErmal Luçi ; 1835*a5b789f6SErmal Luçi 1836*a5b789f6SErmal Luçi fairqopts_item : LINKSHARE bandwidth { 1837*a5b789f6SErmal Luçi if (fairq_opts.linkshare.used) { 1838*a5b789f6SErmal Luçi yyerror("linkshare already specified"); 1839*a5b789f6SErmal Luçi YYERROR; 1840*a5b789f6SErmal Luçi } 1841*a5b789f6SErmal Luçi fairq_opts.linkshare.m2 = $2; 1842*a5b789f6SErmal Luçi fairq_opts.linkshare.used = 1; 1843*a5b789f6SErmal Luçi } 1844*a5b789f6SErmal Luçi | LINKSHARE '(' bandwidth number bandwidth ')' { 1845*a5b789f6SErmal Luçi if (fairq_opts.linkshare.used) { 1846*a5b789f6SErmal Luçi yyerror("linkshare already specified"); 1847*a5b789f6SErmal Luçi YYERROR; 1848*a5b789f6SErmal Luçi } 1849*a5b789f6SErmal Luçi fairq_opts.linkshare.m1 = $3; 1850*a5b789f6SErmal Luçi fairq_opts.linkshare.d = $4; 1851*a5b789f6SErmal Luçi fairq_opts.linkshare.m2 = $5; 1852*a5b789f6SErmal Luçi fairq_opts.linkshare.used = 1; 1853*a5b789f6SErmal Luçi } 1854*a5b789f6SErmal Luçi | HOGS bandwidth { 1855*a5b789f6SErmal Luçi fairq_opts.hogs_bw = $2; 1856*a5b789f6SErmal Luçi } 1857*a5b789f6SErmal Luçi | BUCKETS number { 1858*a5b789f6SErmal Luçi fairq_opts.nbuckets = $2; 1859*a5b789f6SErmal Luçi } 1860*a5b789f6SErmal Luçi | STRING { 1861*a5b789f6SErmal Luçi if (!strcmp($1, "default")) 1862*a5b789f6SErmal Luçi fairq_opts.flags |= FARF_DEFAULTCLASS; 1863*a5b789f6SErmal Luçi else if (!strcmp($1, "red")) 1864*a5b789f6SErmal Luçi fairq_opts.flags |= FARF_RED; 1865*a5b789f6SErmal Luçi else if (!strcmp($1, "ecn")) 1866*a5b789f6SErmal Luçi fairq_opts.flags |= FARF_RED|FARF_ECN; 1867*a5b789f6SErmal Luçi else if (!strcmp($1, "rio")) 1868*a5b789f6SErmal Luçi fairq_opts.flags |= FARF_RIO; 1869*a5b789f6SErmal Luçi else { 1870*a5b789f6SErmal Luçi yyerror("unknown fairq flag \"%s\"", $1); 1871*a5b789f6SErmal Luçi free($1); 1872*a5b789f6SErmal Luçi YYERROR; 1873*a5b789f6SErmal Luçi } 1874*a5b789f6SErmal Luçi free($1); 1875*a5b789f6SErmal Luçi } 1876*a5b789f6SErmal Luçi ; 1877*a5b789f6SErmal Luçi 18783b3a8eb9SGleb Smirnoff qassign : /* empty */ { $$ = NULL; } 18793b3a8eb9SGleb Smirnoff | qassign_item { $$ = $1; } 18803b3a8eb9SGleb Smirnoff | '{' optnl qassign_list '}' { $$ = $3; } 18813b3a8eb9SGleb Smirnoff ; 18823b3a8eb9SGleb Smirnoff 18833b3a8eb9SGleb Smirnoff qassign_list : qassign_item optnl { $$ = $1; } 18843b3a8eb9SGleb Smirnoff | qassign_list comma qassign_item optnl { 18853b3a8eb9SGleb Smirnoff $1->tail->next = $3; 18863b3a8eb9SGleb Smirnoff $1->tail = $3; 18873b3a8eb9SGleb Smirnoff $$ = $1; 18883b3a8eb9SGleb Smirnoff } 18893b3a8eb9SGleb Smirnoff ; 18903b3a8eb9SGleb Smirnoff 18913b3a8eb9SGleb Smirnoff qassign_item : STRING { 18923b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_queue)); 18933b3a8eb9SGleb Smirnoff if ($$ == NULL) 18943b3a8eb9SGleb Smirnoff err(1, "qassign_item: calloc"); 18953b3a8eb9SGleb Smirnoff if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 18963b3a8eb9SGleb Smirnoff sizeof($$->queue)) { 18973b3a8eb9SGleb Smirnoff yyerror("queue name '%s' too long (max " 18983b3a8eb9SGleb Smirnoff "%d chars)", $1, sizeof($$->queue)-1); 18993b3a8eb9SGleb Smirnoff free($1); 19003b3a8eb9SGleb Smirnoff free($$); 19013b3a8eb9SGleb Smirnoff YYERROR; 19023b3a8eb9SGleb Smirnoff } 19033b3a8eb9SGleb Smirnoff free($1); 19043b3a8eb9SGleb Smirnoff $$->next = NULL; 19053b3a8eb9SGleb Smirnoff $$->tail = $$; 19063b3a8eb9SGleb Smirnoff } 19073b3a8eb9SGleb Smirnoff ; 19083b3a8eb9SGleb Smirnoff 19093b3a8eb9SGleb Smirnoff pfrule : action dir logquick interface route af proto fromto 19103b3a8eb9SGleb Smirnoff filter_opts 19113b3a8eb9SGleb Smirnoff { 19123b3a8eb9SGleb Smirnoff struct pf_rule r; 19133b3a8eb9SGleb Smirnoff struct node_state_opt *o; 19143b3a8eb9SGleb Smirnoff struct node_proto *proto; 19153b3a8eb9SGleb Smirnoff int srctrack = 0; 19163b3a8eb9SGleb Smirnoff int statelock = 0; 19173b3a8eb9SGleb Smirnoff int adaptive = 0; 19183b3a8eb9SGleb Smirnoff int defaults = 0; 19193b3a8eb9SGleb Smirnoff 19203b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_FILTER)) 19213b3a8eb9SGleb Smirnoff YYERROR; 19223b3a8eb9SGleb Smirnoff 19233b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 19243b3a8eb9SGleb Smirnoff 19253b3a8eb9SGleb Smirnoff r.action = $1.b1; 19263b3a8eb9SGleb Smirnoff switch ($1.b2) { 19273b3a8eb9SGleb Smirnoff case PFRULE_RETURNRST: 19283b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RETURNRST; 19293b3a8eb9SGleb Smirnoff r.return_ttl = $1.w; 19303b3a8eb9SGleb Smirnoff break; 19313b3a8eb9SGleb Smirnoff case PFRULE_RETURNICMP: 19323b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RETURNICMP; 19333b3a8eb9SGleb Smirnoff r.return_icmp = $1.w; 19343b3a8eb9SGleb Smirnoff r.return_icmp6 = $1.w2; 19353b3a8eb9SGleb Smirnoff break; 19363b3a8eb9SGleb Smirnoff case PFRULE_RETURN: 19373b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RETURN; 19383b3a8eb9SGleb Smirnoff r.return_icmp = $1.w; 19393b3a8eb9SGleb Smirnoff r.return_icmp6 = $1.w2; 19403b3a8eb9SGleb Smirnoff break; 19413b3a8eb9SGleb Smirnoff } 19423b3a8eb9SGleb Smirnoff r.direction = $2; 19433b3a8eb9SGleb Smirnoff r.log = $3.log; 19443b3a8eb9SGleb Smirnoff r.logif = $3.logif; 19453b3a8eb9SGleb Smirnoff r.quick = $3.quick; 19463b3a8eb9SGleb Smirnoff r.prob = $9.prob; 19473b3a8eb9SGleb Smirnoff r.rtableid = $9.rtableid; 19483b3a8eb9SGleb Smirnoff 19493b3a8eb9SGleb Smirnoff r.af = $6; 19503b3a8eb9SGleb Smirnoff if ($9.tag) 19513b3a8eb9SGleb Smirnoff if (strlcpy(r.tagname, $9.tag, 19523b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 19533b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 19543b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 19553b3a8eb9SGleb Smirnoff YYERROR; 19563b3a8eb9SGleb Smirnoff } 19573b3a8eb9SGleb Smirnoff if ($9.match_tag) 19583b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $9.match_tag, 19593b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 19603b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 19613b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 19623b3a8eb9SGleb Smirnoff YYERROR; 19633b3a8eb9SGleb Smirnoff } 19643b3a8eb9SGleb Smirnoff r.match_tag_not = $9.match_tag_not; 19653b3a8eb9SGleb Smirnoff if (rule_label(&r, $9.label)) 19663b3a8eb9SGleb Smirnoff YYERROR; 19673b3a8eb9SGleb Smirnoff free($9.label); 19683b3a8eb9SGleb Smirnoff r.flags = $9.flags.b1; 19693b3a8eb9SGleb Smirnoff r.flagset = $9.flags.b2; 19703b3a8eb9SGleb Smirnoff if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 19713b3a8eb9SGleb Smirnoff yyerror("flags always false"); 19723b3a8eb9SGleb Smirnoff YYERROR; 19733b3a8eb9SGleb Smirnoff } 19743b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 19753b3a8eb9SGleb Smirnoff for (proto = $7; proto != NULL && 19763b3a8eb9SGleb Smirnoff proto->proto != IPPROTO_TCP; 19773b3a8eb9SGleb Smirnoff proto = proto->next) 19783b3a8eb9SGleb Smirnoff ; /* nothing */ 19793b3a8eb9SGleb Smirnoff if (proto == NULL && $7 != NULL) { 19803b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2) 19813b3a8eb9SGleb Smirnoff yyerror( 19823b3a8eb9SGleb Smirnoff "flags only apply to tcp"); 19833b3a8eb9SGleb Smirnoff if ($8.src_os) 19843b3a8eb9SGleb Smirnoff yyerror( 19853b3a8eb9SGleb Smirnoff "OS fingerprinting only " 19863b3a8eb9SGleb Smirnoff "apply to tcp"); 19873b3a8eb9SGleb Smirnoff YYERROR; 19883b3a8eb9SGleb Smirnoff } 19893b3a8eb9SGleb Smirnoff #if 0 19903b3a8eb9SGleb Smirnoff if (($9.flags.b1 & parse_flags("S")) == 0 && 19913b3a8eb9SGleb Smirnoff $8.src_os) { 19923b3a8eb9SGleb Smirnoff yyerror("OS fingerprinting requires " 19933b3a8eb9SGleb Smirnoff "the SYN TCP flag (flags S/SA)"); 19943b3a8eb9SGleb Smirnoff YYERROR; 19953b3a8eb9SGleb Smirnoff } 19963b3a8eb9SGleb Smirnoff #endif 19973b3a8eb9SGleb Smirnoff } 19983b3a8eb9SGleb Smirnoff 19993b3a8eb9SGleb Smirnoff r.tos = $9.tos; 20003b3a8eb9SGleb Smirnoff r.keep_state = $9.keep.action; 20013b3a8eb9SGleb Smirnoff o = $9.keep.options; 20023b3a8eb9SGleb Smirnoff 20033b3a8eb9SGleb Smirnoff /* 'keep state' by default on pass rules. */ 20043b3a8eb9SGleb Smirnoff if (!r.keep_state && !r.action && 20053b3a8eb9SGleb Smirnoff !($9.marker & FOM_KEEP)) { 20063b3a8eb9SGleb Smirnoff r.keep_state = PF_STATE_NORMAL; 20073b3a8eb9SGleb Smirnoff o = keep_state_defaults; 20083b3a8eb9SGleb Smirnoff defaults = 1; 20093b3a8eb9SGleb Smirnoff } 20103b3a8eb9SGleb Smirnoff 20113b3a8eb9SGleb Smirnoff while (o) { 20123b3a8eb9SGleb Smirnoff struct node_state_opt *p = o; 20133b3a8eb9SGleb Smirnoff 20143b3a8eb9SGleb Smirnoff switch (o->type) { 20153b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX: 20163b3a8eb9SGleb Smirnoff if (r.max_states) { 20173b3a8eb9SGleb Smirnoff yyerror("state option 'max' " 20183b3a8eb9SGleb Smirnoff "multiple definitions"); 20193b3a8eb9SGleb Smirnoff YYERROR; 20203b3a8eb9SGleb Smirnoff } 20213b3a8eb9SGleb Smirnoff r.max_states = o->data.max_states; 20223b3a8eb9SGleb Smirnoff break; 20233b3a8eb9SGleb Smirnoff case PF_STATE_OPT_NOSYNC: 20243b3a8eb9SGleb Smirnoff if (r.rule_flag & PFRULE_NOSYNC) { 20253b3a8eb9SGleb Smirnoff yyerror("state option 'sync' " 20263b3a8eb9SGleb Smirnoff "multiple definitions"); 20273b3a8eb9SGleb Smirnoff YYERROR; 20283b3a8eb9SGleb Smirnoff } 20293b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_NOSYNC; 20303b3a8eb9SGleb Smirnoff break; 20313b3a8eb9SGleb Smirnoff case PF_STATE_OPT_SRCTRACK: 20323b3a8eb9SGleb Smirnoff if (srctrack) { 20333b3a8eb9SGleb Smirnoff yyerror("state option " 20343b3a8eb9SGleb Smirnoff "'source-track' " 20353b3a8eb9SGleb Smirnoff "multiple definitions"); 20363b3a8eb9SGleb Smirnoff YYERROR; 20373b3a8eb9SGleb Smirnoff } 20383b3a8eb9SGleb Smirnoff srctrack = o->data.src_track; 20393b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK; 20403b3a8eb9SGleb Smirnoff break; 20413b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_STATES: 20423b3a8eb9SGleb Smirnoff if (r.max_src_states) { 20433b3a8eb9SGleb Smirnoff yyerror("state option " 20443b3a8eb9SGleb Smirnoff "'max-src-states' " 20453b3a8eb9SGleb Smirnoff "multiple definitions"); 20463b3a8eb9SGleb Smirnoff YYERROR; 20473b3a8eb9SGleb Smirnoff } 20483b3a8eb9SGleb Smirnoff if (o->data.max_src_states == 0) { 20493b3a8eb9SGleb Smirnoff yyerror("'max-src-states' must " 20503b3a8eb9SGleb Smirnoff "be > 0"); 20513b3a8eb9SGleb Smirnoff YYERROR; 20523b3a8eb9SGleb Smirnoff } 20533b3a8eb9SGleb Smirnoff r.max_src_states = 20543b3a8eb9SGleb Smirnoff o->data.max_src_states; 20553b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK; 20563b3a8eb9SGleb Smirnoff break; 20573b3a8eb9SGleb Smirnoff case PF_STATE_OPT_OVERLOAD: 20583b3a8eb9SGleb Smirnoff if (r.overload_tblname[0]) { 20593b3a8eb9SGleb Smirnoff yyerror("multiple 'overload' " 20603b3a8eb9SGleb Smirnoff "table definitions"); 20613b3a8eb9SGleb Smirnoff YYERROR; 20623b3a8eb9SGleb Smirnoff } 20633b3a8eb9SGleb Smirnoff if (strlcpy(r.overload_tblname, 20643b3a8eb9SGleb Smirnoff o->data.overload.tblname, 20653b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE) >= 20663b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE) { 20673b3a8eb9SGleb Smirnoff yyerror("state option: " 20683b3a8eb9SGleb Smirnoff "strlcpy"); 20693b3a8eb9SGleb Smirnoff YYERROR; 20703b3a8eb9SGleb Smirnoff } 20713b3a8eb9SGleb Smirnoff r.flush = o->data.overload.flush; 20723b3a8eb9SGleb Smirnoff break; 20733b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_CONN: 20743b3a8eb9SGleb Smirnoff if (r.max_src_conn) { 20753b3a8eb9SGleb Smirnoff yyerror("state option " 20763b3a8eb9SGleb Smirnoff "'max-src-conn' " 20773b3a8eb9SGleb Smirnoff "multiple definitions"); 20783b3a8eb9SGleb Smirnoff YYERROR; 20793b3a8eb9SGleb Smirnoff } 20803b3a8eb9SGleb Smirnoff if (o->data.max_src_conn == 0) { 20813b3a8eb9SGleb Smirnoff yyerror("'max-src-conn' " 20823b3a8eb9SGleb Smirnoff "must be > 0"); 20833b3a8eb9SGleb Smirnoff YYERROR; 20843b3a8eb9SGleb Smirnoff } 20853b3a8eb9SGleb Smirnoff r.max_src_conn = 20863b3a8eb9SGleb Smirnoff o->data.max_src_conn; 20873b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK | 20883b3a8eb9SGleb Smirnoff PFRULE_RULESRCTRACK; 20893b3a8eb9SGleb Smirnoff break; 20903b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_CONN_RATE: 20913b3a8eb9SGleb Smirnoff if (r.max_src_conn_rate.limit) { 20923b3a8eb9SGleb Smirnoff yyerror("state option " 20933b3a8eb9SGleb Smirnoff "'max-src-conn-rate' " 20943b3a8eb9SGleb Smirnoff "multiple definitions"); 20953b3a8eb9SGleb Smirnoff YYERROR; 20963b3a8eb9SGleb Smirnoff } 20973b3a8eb9SGleb Smirnoff if (!o->data.max_src_conn_rate.limit || 20983b3a8eb9SGleb Smirnoff !o->data.max_src_conn_rate.seconds) { 20993b3a8eb9SGleb Smirnoff yyerror("'max-src-conn-rate' " 21003b3a8eb9SGleb Smirnoff "values must be > 0"); 21013b3a8eb9SGleb Smirnoff YYERROR; 21023b3a8eb9SGleb Smirnoff } 21033b3a8eb9SGleb Smirnoff if (o->data.max_src_conn_rate.limit > 21043b3a8eb9SGleb Smirnoff PF_THRESHOLD_MAX) { 21053b3a8eb9SGleb Smirnoff yyerror("'max-src-conn-rate' " 21063b3a8eb9SGleb Smirnoff "maximum rate must be < %u", 21073b3a8eb9SGleb Smirnoff PF_THRESHOLD_MAX); 21083b3a8eb9SGleb Smirnoff YYERROR; 21093b3a8eb9SGleb Smirnoff } 21103b3a8eb9SGleb Smirnoff r.max_src_conn_rate.limit = 21113b3a8eb9SGleb Smirnoff o->data.max_src_conn_rate.limit; 21123b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds = 21133b3a8eb9SGleb Smirnoff o->data.max_src_conn_rate.seconds; 21143b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK | 21153b3a8eb9SGleb Smirnoff PFRULE_RULESRCTRACK; 21163b3a8eb9SGleb Smirnoff break; 21173b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_NODES: 21183b3a8eb9SGleb Smirnoff if (r.max_src_nodes) { 21193b3a8eb9SGleb Smirnoff yyerror("state option " 21203b3a8eb9SGleb Smirnoff "'max-src-nodes' " 21213b3a8eb9SGleb Smirnoff "multiple definitions"); 21223b3a8eb9SGleb Smirnoff YYERROR; 21233b3a8eb9SGleb Smirnoff } 21243b3a8eb9SGleb Smirnoff if (o->data.max_src_nodes == 0) { 21253b3a8eb9SGleb Smirnoff yyerror("'max-src-nodes' must " 21263b3a8eb9SGleb Smirnoff "be > 0"); 21273b3a8eb9SGleb Smirnoff YYERROR; 21283b3a8eb9SGleb Smirnoff } 21293b3a8eb9SGleb Smirnoff r.max_src_nodes = 21303b3a8eb9SGleb Smirnoff o->data.max_src_nodes; 21313b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK | 21323b3a8eb9SGleb Smirnoff PFRULE_RULESRCTRACK; 21333b3a8eb9SGleb Smirnoff break; 21343b3a8eb9SGleb Smirnoff case PF_STATE_OPT_STATELOCK: 21353b3a8eb9SGleb Smirnoff if (statelock) { 21363b3a8eb9SGleb Smirnoff yyerror("state locking option: " 21373b3a8eb9SGleb Smirnoff "multiple definitions"); 21383b3a8eb9SGleb Smirnoff YYERROR; 21393b3a8eb9SGleb Smirnoff } 21403b3a8eb9SGleb Smirnoff statelock = 1; 21413b3a8eb9SGleb Smirnoff r.rule_flag |= o->data.statelock; 21423b3a8eb9SGleb Smirnoff break; 21433b3a8eb9SGleb Smirnoff case PF_STATE_OPT_SLOPPY: 21443b3a8eb9SGleb Smirnoff if (r.rule_flag & PFRULE_STATESLOPPY) { 21453b3a8eb9SGleb Smirnoff yyerror("state sloppy option: " 21463b3a8eb9SGleb Smirnoff "multiple definitions"); 21473b3a8eb9SGleb Smirnoff YYERROR; 21483b3a8eb9SGleb Smirnoff } 21493b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_STATESLOPPY; 21503b3a8eb9SGleb Smirnoff break; 21513b3a8eb9SGleb Smirnoff case PF_STATE_OPT_TIMEOUT: 21523b3a8eb9SGleb Smirnoff if (o->data.timeout.number == 21533b3a8eb9SGleb Smirnoff PFTM_ADAPTIVE_START || 21543b3a8eb9SGleb Smirnoff o->data.timeout.number == 21553b3a8eb9SGleb Smirnoff PFTM_ADAPTIVE_END) 21563b3a8eb9SGleb Smirnoff adaptive = 1; 21573b3a8eb9SGleb Smirnoff if (r.timeout[o->data.timeout.number]) { 21583b3a8eb9SGleb Smirnoff yyerror("state timeout %s " 21593b3a8eb9SGleb Smirnoff "multiple definitions", 21603b3a8eb9SGleb Smirnoff pf_timeouts[o->data. 21613b3a8eb9SGleb Smirnoff timeout.number].name); 21623b3a8eb9SGleb Smirnoff YYERROR; 21633b3a8eb9SGleb Smirnoff } 21643b3a8eb9SGleb Smirnoff r.timeout[o->data.timeout.number] = 21653b3a8eb9SGleb Smirnoff o->data.timeout.seconds; 21663b3a8eb9SGleb Smirnoff } 21673b3a8eb9SGleb Smirnoff o = o->next; 21683b3a8eb9SGleb Smirnoff if (!defaults) 21693b3a8eb9SGleb Smirnoff free(p); 21703b3a8eb9SGleb Smirnoff } 21713b3a8eb9SGleb Smirnoff 21723b3a8eb9SGleb Smirnoff /* 'flags S/SA' by default on stateful rules */ 21733b3a8eb9SGleb Smirnoff if (!r.action && !r.flags && !r.flagset && 21743b3a8eb9SGleb Smirnoff !$9.fragment && !($9.marker & FOM_FLAGS) && 21753b3a8eb9SGleb Smirnoff r.keep_state) { 21763b3a8eb9SGleb Smirnoff r.flags = parse_flags("S"); 21773b3a8eb9SGleb Smirnoff r.flagset = parse_flags("SA"); 21783b3a8eb9SGleb Smirnoff } 21793b3a8eb9SGleb Smirnoff if (!adaptive && r.max_states) { 21803b3a8eb9SGleb Smirnoff r.timeout[PFTM_ADAPTIVE_START] = 21813b3a8eb9SGleb Smirnoff (r.max_states / 10) * 6; 21823b3a8eb9SGleb Smirnoff r.timeout[PFTM_ADAPTIVE_END] = 21833b3a8eb9SGleb Smirnoff (r.max_states / 10) * 12; 21843b3a8eb9SGleb Smirnoff } 21853b3a8eb9SGleb Smirnoff if (r.rule_flag & PFRULE_SRCTRACK) { 21863b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_GLOBAL && 21873b3a8eb9SGleb Smirnoff r.max_src_nodes) { 21883b3a8eb9SGleb Smirnoff yyerror("'max-src-nodes' is " 21893b3a8eb9SGleb Smirnoff "incompatible with " 21903b3a8eb9SGleb Smirnoff "'source-track global'"); 21913b3a8eb9SGleb Smirnoff YYERROR; 21923b3a8eb9SGleb Smirnoff } 21933b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_GLOBAL && 21943b3a8eb9SGleb Smirnoff r.max_src_conn) { 21953b3a8eb9SGleb Smirnoff yyerror("'max-src-conn' is " 21963b3a8eb9SGleb Smirnoff "incompatible with " 21973b3a8eb9SGleb Smirnoff "'source-track global'"); 21983b3a8eb9SGleb Smirnoff YYERROR; 21993b3a8eb9SGleb Smirnoff } 22003b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_GLOBAL && 22013b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds) { 22023b3a8eb9SGleb Smirnoff yyerror("'max-src-conn-rate' is " 22033b3a8eb9SGleb Smirnoff "incompatible with " 22043b3a8eb9SGleb Smirnoff "'source-track global'"); 22053b3a8eb9SGleb Smirnoff YYERROR; 22063b3a8eb9SGleb Smirnoff } 22073b3a8eb9SGleb Smirnoff if (r.timeout[PFTM_SRC_NODE] < 22083b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds) 22093b3a8eb9SGleb Smirnoff r.timeout[PFTM_SRC_NODE] = 22103b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds; 22113b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK; 22123b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_RULE) 22133b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RULESRCTRACK; 22143b3a8eb9SGleb Smirnoff } 22153b3a8eb9SGleb Smirnoff if (r.keep_state && !statelock) 22163b3a8eb9SGleb Smirnoff r.rule_flag |= default_statelock; 22173b3a8eb9SGleb Smirnoff 22183b3a8eb9SGleb Smirnoff if ($9.fragment) 22193b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_FRAGMENT; 22203b3a8eb9SGleb Smirnoff r.allow_opts = $9.allowopts; 22213b3a8eb9SGleb Smirnoff 22223b3a8eb9SGleb Smirnoff decide_address_family($8.src.host, &r.af); 22233b3a8eb9SGleb Smirnoff decide_address_family($8.dst.host, &r.af); 22243b3a8eb9SGleb Smirnoff 22253b3a8eb9SGleb Smirnoff if ($5.rt) { 22263b3a8eb9SGleb Smirnoff if (!r.direction) { 22273b3a8eb9SGleb Smirnoff yyerror("direction must be explicit " 22283b3a8eb9SGleb Smirnoff "with rules that specify routing"); 22293b3a8eb9SGleb Smirnoff YYERROR; 22303b3a8eb9SGleb Smirnoff } 22313b3a8eb9SGleb Smirnoff r.rt = $5.rt; 22323b3a8eb9SGleb Smirnoff r.rpool.opts = $5.pool_opts; 22333b3a8eb9SGleb Smirnoff if ($5.key != NULL) 22343b3a8eb9SGleb Smirnoff memcpy(&r.rpool.key, $5.key, 22353b3a8eb9SGleb Smirnoff sizeof(struct pf_poolhashkey)); 22363b3a8eb9SGleb Smirnoff } 22373b3a8eb9SGleb Smirnoff if (r.rt && r.rt != PF_FASTROUTE) { 22383b3a8eb9SGleb Smirnoff decide_address_family($5.host, &r.af); 22393b3a8eb9SGleb Smirnoff remove_invalid_hosts(&$5.host, &r.af); 22403b3a8eb9SGleb Smirnoff if ($5.host == NULL) { 22413b3a8eb9SGleb Smirnoff yyerror("no routing address with " 22423b3a8eb9SGleb Smirnoff "matching address family found."); 22433b3a8eb9SGleb Smirnoff YYERROR; 22443b3a8eb9SGleb Smirnoff } 22453b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) == 22463b3a8eb9SGleb Smirnoff PF_POOL_NONE && ($5.host->next != NULL || 22473b3a8eb9SGleb Smirnoff $5.host->addr.type == PF_ADDR_TABLE || 22483b3a8eb9SGleb Smirnoff DYNIF_MULTIADDR($5.host->addr))) 22493b3a8eb9SGleb Smirnoff r.rpool.opts |= PF_POOL_ROUNDROBIN; 22503b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 22513b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 22523b3a8eb9SGleb Smirnoff disallow_table($5.host, "tables are only " 22533b3a8eb9SGleb Smirnoff "supported in round-robin routing pools")) 22543b3a8eb9SGleb Smirnoff YYERROR; 22553b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 22563b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 22573b3a8eb9SGleb Smirnoff disallow_alias($5.host, "interface (%s) " 22583b3a8eb9SGleb Smirnoff "is only supported in round-robin " 22593b3a8eb9SGleb Smirnoff "routing pools")) 22603b3a8eb9SGleb Smirnoff YYERROR; 22613b3a8eb9SGleb Smirnoff if ($5.host->next != NULL) { 22623b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 22633b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN) { 22643b3a8eb9SGleb Smirnoff yyerror("r.rpool.opts must " 22653b3a8eb9SGleb Smirnoff "be PF_POOL_ROUNDROBIN"); 22663b3a8eb9SGleb Smirnoff YYERROR; 22673b3a8eb9SGleb Smirnoff } 22683b3a8eb9SGleb Smirnoff } 22693b3a8eb9SGleb Smirnoff } 22703b3a8eb9SGleb Smirnoff if ($9.queues.qname != NULL) { 22713b3a8eb9SGleb Smirnoff if (strlcpy(r.qname, $9.queues.qname, 22723b3a8eb9SGleb Smirnoff sizeof(r.qname)) >= sizeof(r.qname)) { 22733b3a8eb9SGleb Smirnoff yyerror("rule qname too long (max " 22743b3a8eb9SGleb Smirnoff "%d chars)", sizeof(r.qname)-1); 22753b3a8eb9SGleb Smirnoff YYERROR; 22763b3a8eb9SGleb Smirnoff } 22773b3a8eb9SGleb Smirnoff free($9.queues.qname); 22783b3a8eb9SGleb Smirnoff } 22793b3a8eb9SGleb Smirnoff if ($9.queues.pqname != NULL) { 22803b3a8eb9SGleb Smirnoff if (strlcpy(r.pqname, $9.queues.pqname, 22813b3a8eb9SGleb Smirnoff sizeof(r.pqname)) >= sizeof(r.pqname)) { 22823b3a8eb9SGleb Smirnoff yyerror("rule pqname too long (max " 22833b3a8eb9SGleb Smirnoff "%d chars)", sizeof(r.pqname)-1); 22843b3a8eb9SGleb Smirnoff YYERROR; 22853b3a8eb9SGleb Smirnoff } 22863b3a8eb9SGleb Smirnoff free($9.queues.pqname); 22873b3a8eb9SGleb Smirnoff } 22883b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 22893b3a8eb9SGleb Smirnoff r.divert.port = $9.divert.port; 22903b3a8eb9SGleb Smirnoff #else 22913b3a8eb9SGleb Smirnoff if ((r.divert.port = $9.divert.port)) { 22923b3a8eb9SGleb Smirnoff if (r.direction == PF_OUT) { 22933b3a8eb9SGleb Smirnoff if ($9.divert.addr) { 22943b3a8eb9SGleb Smirnoff yyerror("address specified " 22953b3a8eb9SGleb Smirnoff "for outgoing divert"); 22963b3a8eb9SGleb Smirnoff YYERROR; 22973b3a8eb9SGleb Smirnoff } 22983b3a8eb9SGleb Smirnoff bzero(&r.divert.addr, 22993b3a8eb9SGleb Smirnoff sizeof(r.divert.addr)); 23003b3a8eb9SGleb Smirnoff } else { 23013b3a8eb9SGleb Smirnoff if (!$9.divert.addr) { 23023b3a8eb9SGleb Smirnoff yyerror("no address specified " 23033b3a8eb9SGleb Smirnoff "for incoming divert"); 23043b3a8eb9SGleb Smirnoff YYERROR; 23053b3a8eb9SGleb Smirnoff } 23063b3a8eb9SGleb Smirnoff if ($9.divert.addr->af != r.af) { 23073b3a8eb9SGleb Smirnoff yyerror("address family " 23083b3a8eb9SGleb Smirnoff "mismatch for divert"); 23093b3a8eb9SGleb Smirnoff YYERROR; 23103b3a8eb9SGleb Smirnoff } 23113b3a8eb9SGleb Smirnoff r.divert.addr = 23123b3a8eb9SGleb Smirnoff $9.divert.addr->addr.v.a.addr; 23133b3a8eb9SGleb Smirnoff } 23143b3a8eb9SGleb Smirnoff } 23153b3a8eb9SGleb Smirnoff #endif 23163b3a8eb9SGleb Smirnoff 23173b3a8eb9SGleb Smirnoff expand_rule(&r, $4, $5.host, $7, $8.src_os, 23183b3a8eb9SGleb Smirnoff $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 23193b3a8eb9SGleb Smirnoff $9.uid, $9.gid, $9.icmpspec, ""); 23203b3a8eb9SGleb Smirnoff } 23213b3a8eb9SGleb Smirnoff ; 23223b3a8eb9SGleb Smirnoff 23233b3a8eb9SGleb Smirnoff filter_opts : { 23243b3a8eb9SGleb Smirnoff bzero(&filter_opts, sizeof filter_opts); 23253b3a8eb9SGleb Smirnoff filter_opts.rtableid = -1; 23263b3a8eb9SGleb Smirnoff } 23273b3a8eb9SGleb Smirnoff filter_opts_l 23283b3a8eb9SGleb Smirnoff { $$ = filter_opts; } 23293b3a8eb9SGleb Smirnoff | /* empty */ { 23303b3a8eb9SGleb Smirnoff bzero(&filter_opts, sizeof filter_opts); 23313b3a8eb9SGleb Smirnoff filter_opts.rtableid = -1; 23323b3a8eb9SGleb Smirnoff $$ = filter_opts; 23333b3a8eb9SGleb Smirnoff } 23343b3a8eb9SGleb Smirnoff ; 23353b3a8eb9SGleb Smirnoff 23363b3a8eb9SGleb Smirnoff filter_opts_l : filter_opts_l filter_opt 23373b3a8eb9SGleb Smirnoff | filter_opt 23383b3a8eb9SGleb Smirnoff ; 23393b3a8eb9SGleb Smirnoff 23403b3a8eb9SGleb Smirnoff filter_opt : USER uids { 23413b3a8eb9SGleb Smirnoff if (filter_opts.uid) 23423b3a8eb9SGleb Smirnoff $2->tail->next = filter_opts.uid; 23433b3a8eb9SGleb Smirnoff filter_opts.uid = $2; 23443b3a8eb9SGleb Smirnoff } 23453b3a8eb9SGleb Smirnoff | GROUP gids { 23463b3a8eb9SGleb Smirnoff if (filter_opts.gid) 23473b3a8eb9SGleb Smirnoff $2->tail->next = filter_opts.gid; 23483b3a8eb9SGleb Smirnoff filter_opts.gid = $2; 23493b3a8eb9SGleb Smirnoff } 23503b3a8eb9SGleb Smirnoff | flags { 23513b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_FLAGS) { 23523b3a8eb9SGleb Smirnoff yyerror("flags cannot be redefined"); 23533b3a8eb9SGleb Smirnoff YYERROR; 23543b3a8eb9SGleb Smirnoff } 23553b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_FLAGS; 23563b3a8eb9SGleb Smirnoff filter_opts.flags.b1 |= $1.b1; 23573b3a8eb9SGleb Smirnoff filter_opts.flags.b2 |= $1.b2; 23583b3a8eb9SGleb Smirnoff filter_opts.flags.w |= $1.w; 23593b3a8eb9SGleb Smirnoff filter_opts.flags.w2 |= $1.w2; 23603b3a8eb9SGleb Smirnoff } 23613b3a8eb9SGleb Smirnoff | icmpspec { 23623b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_ICMP) { 23633b3a8eb9SGleb Smirnoff yyerror("icmp-type cannot be redefined"); 23643b3a8eb9SGleb Smirnoff YYERROR; 23653b3a8eb9SGleb Smirnoff } 23663b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_ICMP; 23673b3a8eb9SGleb Smirnoff filter_opts.icmpspec = $1; 23683b3a8eb9SGleb Smirnoff } 23693b3a8eb9SGleb Smirnoff | TOS tos { 23703b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_TOS) { 23713b3a8eb9SGleb Smirnoff yyerror("tos cannot be redefined"); 23723b3a8eb9SGleb Smirnoff YYERROR; 23733b3a8eb9SGleb Smirnoff } 23743b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_TOS; 23753b3a8eb9SGleb Smirnoff filter_opts.tos = $2; 23763b3a8eb9SGleb Smirnoff } 23773b3a8eb9SGleb Smirnoff | keep { 23783b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_KEEP) { 23793b3a8eb9SGleb Smirnoff yyerror("modulate or keep cannot be redefined"); 23803b3a8eb9SGleb Smirnoff YYERROR; 23813b3a8eb9SGleb Smirnoff } 23823b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_KEEP; 23833b3a8eb9SGleb Smirnoff filter_opts.keep.action = $1.action; 23843b3a8eb9SGleb Smirnoff filter_opts.keep.options = $1.options; 23853b3a8eb9SGleb Smirnoff } 23863b3a8eb9SGleb Smirnoff | FRAGMENT { 23873b3a8eb9SGleb Smirnoff filter_opts.fragment = 1; 23883b3a8eb9SGleb Smirnoff } 23893b3a8eb9SGleb Smirnoff | ALLOWOPTS { 23903b3a8eb9SGleb Smirnoff filter_opts.allowopts = 1; 23913b3a8eb9SGleb Smirnoff } 23923b3a8eb9SGleb Smirnoff | label { 23933b3a8eb9SGleb Smirnoff if (filter_opts.label) { 23943b3a8eb9SGleb Smirnoff yyerror("label cannot be redefined"); 23953b3a8eb9SGleb Smirnoff YYERROR; 23963b3a8eb9SGleb Smirnoff } 23973b3a8eb9SGleb Smirnoff filter_opts.label = $1; 23983b3a8eb9SGleb Smirnoff } 23993b3a8eb9SGleb Smirnoff | qname { 24003b3a8eb9SGleb Smirnoff if (filter_opts.queues.qname) { 24013b3a8eb9SGleb Smirnoff yyerror("queue cannot be redefined"); 24023b3a8eb9SGleb Smirnoff YYERROR; 24033b3a8eb9SGleb Smirnoff } 24043b3a8eb9SGleb Smirnoff filter_opts.queues = $1; 24053b3a8eb9SGleb Smirnoff } 24063b3a8eb9SGleb Smirnoff | TAG string { 24073b3a8eb9SGleb Smirnoff filter_opts.tag = $2; 24083b3a8eb9SGleb Smirnoff } 24093b3a8eb9SGleb Smirnoff | not TAGGED string { 24103b3a8eb9SGleb Smirnoff filter_opts.match_tag = $3; 24113b3a8eb9SGleb Smirnoff filter_opts.match_tag_not = $1; 24123b3a8eb9SGleb Smirnoff } 24133b3a8eb9SGleb Smirnoff | PROBABILITY probability { 24143b3a8eb9SGleb Smirnoff double p; 24153b3a8eb9SGleb Smirnoff 24163b3a8eb9SGleb Smirnoff p = floor($2 * UINT_MAX + 0.5); 24173b3a8eb9SGleb Smirnoff if (p < 0.0 || p > UINT_MAX) { 24183b3a8eb9SGleb Smirnoff yyerror("invalid probability: %lf", p); 24193b3a8eb9SGleb Smirnoff YYERROR; 24203b3a8eb9SGleb Smirnoff } 24213b3a8eb9SGleb Smirnoff filter_opts.prob = (u_int32_t)p; 24223b3a8eb9SGleb Smirnoff if (filter_opts.prob == 0) 24233b3a8eb9SGleb Smirnoff filter_opts.prob = 1; 24243b3a8eb9SGleb Smirnoff } 24253b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 24263b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 24273b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 24283b3a8eb9SGleb Smirnoff YYERROR; 24293b3a8eb9SGleb Smirnoff } 24303b3a8eb9SGleb Smirnoff filter_opts.rtableid = $2; 24313b3a8eb9SGleb Smirnoff } 24323b3a8eb9SGleb Smirnoff | DIVERTTO portplain { 24333b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 24343b3a8eb9SGleb Smirnoff filter_opts.divert.port = $2.a; 24353b3a8eb9SGleb Smirnoff if (!filter_opts.divert.port) { 24363b3a8eb9SGleb Smirnoff yyerror("invalid divert port: %u", ntohs($2.a)); 24373b3a8eb9SGleb Smirnoff YYERROR; 24383b3a8eb9SGleb Smirnoff } 24393b3a8eb9SGleb Smirnoff #endif 24403b3a8eb9SGleb Smirnoff } 24413b3a8eb9SGleb Smirnoff | DIVERTTO STRING PORT portplain { 24423b3a8eb9SGleb Smirnoff #ifndef __FreeBSD__ 24433b3a8eb9SGleb Smirnoff if ((filter_opts.divert.addr = host($2)) == NULL) { 24443b3a8eb9SGleb Smirnoff yyerror("could not parse divert address: %s", 24453b3a8eb9SGleb Smirnoff $2); 24463b3a8eb9SGleb Smirnoff free($2); 24473b3a8eb9SGleb Smirnoff YYERROR; 24483b3a8eb9SGleb Smirnoff } 24493b3a8eb9SGleb Smirnoff #else 24503b3a8eb9SGleb Smirnoff if ($2) 24513b3a8eb9SGleb Smirnoff #endif 24523b3a8eb9SGleb Smirnoff free($2); 24533b3a8eb9SGleb Smirnoff filter_opts.divert.port = $4.a; 24543b3a8eb9SGleb Smirnoff if (!filter_opts.divert.port) { 24553b3a8eb9SGleb Smirnoff yyerror("invalid divert port: %u", ntohs($4.a)); 24563b3a8eb9SGleb Smirnoff YYERROR; 24573b3a8eb9SGleb Smirnoff } 24583b3a8eb9SGleb Smirnoff } 24593b3a8eb9SGleb Smirnoff | DIVERTREPLY { 24603b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 24613b3a8eb9SGleb Smirnoff yyerror("divert-reply has no meaning in FreeBSD pf(4)"); 24623b3a8eb9SGleb Smirnoff YYERROR; 24633b3a8eb9SGleb Smirnoff #else 24643b3a8eb9SGleb Smirnoff filter_opts.divert.port = 1; /* some random value */ 24653b3a8eb9SGleb Smirnoff #endif 24663b3a8eb9SGleb Smirnoff } 24673b3a8eb9SGleb Smirnoff ; 24683b3a8eb9SGleb Smirnoff 24693b3a8eb9SGleb Smirnoff probability : STRING { 24703b3a8eb9SGleb Smirnoff char *e; 24713b3a8eb9SGleb Smirnoff double p = strtod($1, &e); 24723b3a8eb9SGleb Smirnoff 24733b3a8eb9SGleb Smirnoff if (*e == '%') { 24743b3a8eb9SGleb Smirnoff p *= 0.01; 24753b3a8eb9SGleb Smirnoff e++; 24763b3a8eb9SGleb Smirnoff } 24773b3a8eb9SGleb Smirnoff if (*e) { 24783b3a8eb9SGleb Smirnoff yyerror("invalid probability: %s", $1); 24793b3a8eb9SGleb Smirnoff free($1); 24803b3a8eb9SGleb Smirnoff YYERROR; 24813b3a8eb9SGleb Smirnoff } 24823b3a8eb9SGleb Smirnoff free($1); 24833b3a8eb9SGleb Smirnoff $$ = p; 24843b3a8eb9SGleb Smirnoff } 24853b3a8eb9SGleb Smirnoff | NUMBER { 24863b3a8eb9SGleb Smirnoff $$ = (double)$1; 24873b3a8eb9SGleb Smirnoff } 24883b3a8eb9SGleb Smirnoff ; 24893b3a8eb9SGleb Smirnoff 24903b3a8eb9SGleb Smirnoff 24913b3a8eb9SGleb Smirnoff action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 24923b3a8eb9SGleb Smirnoff | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 24933b3a8eb9SGleb Smirnoff ; 24943b3a8eb9SGleb Smirnoff 24953b3a8eb9SGleb Smirnoff blockspec : /* empty */ { 24963b3a8eb9SGleb Smirnoff $$.b2 = blockpolicy; 24973b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 24983b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 24993b3a8eb9SGleb Smirnoff } 25003b3a8eb9SGleb Smirnoff | DROP { 25013b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_DROP; 25023b3a8eb9SGleb Smirnoff $$.w = 0; 25033b3a8eb9SGleb Smirnoff $$.w2 = 0; 25043b3a8eb9SGleb Smirnoff } 25053b3a8eb9SGleb Smirnoff | RETURNRST { 25063b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNRST; 25073b3a8eb9SGleb Smirnoff $$.w = 0; 25083b3a8eb9SGleb Smirnoff $$.w2 = 0; 25093b3a8eb9SGleb Smirnoff } 25103b3a8eb9SGleb Smirnoff | RETURNRST '(' TTL NUMBER ')' { 25113b3a8eb9SGleb Smirnoff if ($4 < 0 || $4 > 255) { 25123b3a8eb9SGleb Smirnoff yyerror("illegal ttl value %d", $4); 25133b3a8eb9SGleb Smirnoff YYERROR; 25143b3a8eb9SGleb Smirnoff } 25153b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNRST; 25163b3a8eb9SGleb Smirnoff $$.w = $4; 25173b3a8eb9SGleb Smirnoff $$.w2 = 0; 25183b3a8eb9SGleb Smirnoff } 25193b3a8eb9SGleb Smirnoff | RETURNICMP { 25203b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 25213b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 25223b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 25233b3a8eb9SGleb Smirnoff } 25243b3a8eb9SGleb Smirnoff | RETURNICMP6 { 25253b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 25263b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 25273b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 25283b3a8eb9SGleb Smirnoff } 25293b3a8eb9SGleb Smirnoff | RETURNICMP '(' reticmpspec ')' { 25303b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 25313b3a8eb9SGleb Smirnoff $$.w = $3; 25323b3a8eb9SGleb Smirnoff $$.w2 = returnicmpdefault; 25333b3a8eb9SGleb Smirnoff } 25343b3a8eb9SGleb Smirnoff | RETURNICMP6 '(' reticmp6spec ')' { 25353b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 25363b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 25373b3a8eb9SGleb Smirnoff $$.w2 = $3; 25383b3a8eb9SGleb Smirnoff } 25393b3a8eb9SGleb Smirnoff | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 25403b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 25413b3a8eb9SGleb Smirnoff $$.w = $3; 25423b3a8eb9SGleb Smirnoff $$.w2 = $5; 25433b3a8eb9SGleb Smirnoff } 25443b3a8eb9SGleb Smirnoff | RETURN { 25453b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURN; 25463b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 25473b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 25483b3a8eb9SGleb Smirnoff } 25493b3a8eb9SGleb Smirnoff ; 25503b3a8eb9SGleb Smirnoff 25513b3a8eb9SGleb Smirnoff reticmpspec : STRING { 25523b3a8eb9SGleb Smirnoff if (!($$ = parseicmpspec($1, AF_INET))) { 25533b3a8eb9SGleb Smirnoff free($1); 25543b3a8eb9SGleb Smirnoff YYERROR; 25553b3a8eb9SGleb Smirnoff } 25563b3a8eb9SGleb Smirnoff free($1); 25573b3a8eb9SGleb Smirnoff } 25583b3a8eb9SGleb Smirnoff | NUMBER { 25593b3a8eb9SGleb Smirnoff u_int8_t icmptype; 25603b3a8eb9SGleb Smirnoff 25613b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 25623b3a8eb9SGleb Smirnoff yyerror("invalid icmp code %lu", $1); 25633b3a8eb9SGleb Smirnoff YYERROR; 25643b3a8eb9SGleb Smirnoff } 25653b3a8eb9SGleb Smirnoff icmptype = returnicmpdefault >> 8; 25663b3a8eb9SGleb Smirnoff $$ = (icmptype << 8 | $1); 25673b3a8eb9SGleb Smirnoff } 25683b3a8eb9SGleb Smirnoff ; 25693b3a8eb9SGleb Smirnoff 25703b3a8eb9SGleb Smirnoff reticmp6spec : STRING { 25713b3a8eb9SGleb Smirnoff if (!($$ = parseicmpspec($1, AF_INET6))) { 25723b3a8eb9SGleb Smirnoff free($1); 25733b3a8eb9SGleb Smirnoff YYERROR; 25743b3a8eb9SGleb Smirnoff } 25753b3a8eb9SGleb Smirnoff free($1); 25763b3a8eb9SGleb Smirnoff } 25773b3a8eb9SGleb Smirnoff | NUMBER { 25783b3a8eb9SGleb Smirnoff u_int8_t icmptype; 25793b3a8eb9SGleb Smirnoff 25803b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 25813b3a8eb9SGleb Smirnoff yyerror("invalid icmp code %lu", $1); 25823b3a8eb9SGleb Smirnoff YYERROR; 25833b3a8eb9SGleb Smirnoff } 25843b3a8eb9SGleb Smirnoff icmptype = returnicmp6default >> 8; 25853b3a8eb9SGleb Smirnoff $$ = (icmptype << 8 | $1); 25863b3a8eb9SGleb Smirnoff } 25873b3a8eb9SGleb Smirnoff ; 25883b3a8eb9SGleb Smirnoff 25893b3a8eb9SGleb Smirnoff dir : /* empty */ { $$ = PF_INOUT; } 25903b3a8eb9SGleb Smirnoff | IN { $$ = PF_IN; } 25913b3a8eb9SGleb Smirnoff | OUT { $$ = PF_OUT; } 25923b3a8eb9SGleb Smirnoff ; 25933b3a8eb9SGleb Smirnoff 25943b3a8eb9SGleb Smirnoff quick : /* empty */ { $$.quick = 0; } 25953b3a8eb9SGleb Smirnoff | QUICK { $$.quick = 1; } 25963b3a8eb9SGleb Smirnoff ; 25973b3a8eb9SGleb Smirnoff 25983b3a8eb9SGleb Smirnoff logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 25993b3a8eb9SGleb Smirnoff | log { $$ = $1; $$.quick = 0; } 26003b3a8eb9SGleb Smirnoff | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 26013b3a8eb9SGleb Smirnoff | log QUICK { $$ = $1; $$.quick = 1; } 26023b3a8eb9SGleb Smirnoff | QUICK log { $$ = $2; $$.quick = 1; } 26033b3a8eb9SGleb Smirnoff ; 26043b3a8eb9SGleb Smirnoff 26053b3a8eb9SGleb Smirnoff log : LOG { $$.log = PF_LOG; $$.logif = 0; } 26063b3a8eb9SGleb Smirnoff | LOG '(' logopts ')' { 26073b3a8eb9SGleb Smirnoff $$.log = PF_LOG | $3.log; 26083b3a8eb9SGleb Smirnoff $$.logif = $3.logif; 26093b3a8eb9SGleb Smirnoff } 26103b3a8eb9SGleb Smirnoff ; 26113b3a8eb9SGleb Smirnoff 26123b3a8eb9SGleb Smirnoff logopts : logopt { $$ = $1; } 26133b3a8eb9SGleb Smirnoff | logopts comma logopt { 26143b3a8eb9SGleb Smirnoff $$.log = $1.log | $3.log; 26153b3a8eb9SGleb Smirnoff $$.logif = $3.logif; 26163b3a8eb9SGleb Smirnoff if ($$.logif == 0) 26173b3a8eb9SGleb Smirnoff $$.logif = $1.logif; 26183b3a8eb9SGleb Smirnoff } 26193b3a8eb9SGleb Smirnoff ; 26203b3a8eb9SGleb Smirnoff 26213b3a8eb9SGleb Smirnoff logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 26223b3a8eb9SGleb Smirnoff | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 26233b3a8eb9SGleb Smirnoff | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 26243b3a8eb9SGleb Smirnoff | TO string { 26253b3a8eb9SGleb Smirnoff const char *errstr; 26263b3a8eb9SGleb Smirnoff u_int i; 26273b3a8eb9SGleb Smirnoff 26283b3a8eb9SGleb Smirnoff $$.log = 0; 26293b3a8eb9SGleb Smirnoff if (strncmp($2, "pflog", 5)) { 26303b3a8eb9SGleb Smirnoff yyerror("%s: should be a pflog interface", $2); 26313b3a8eb9SGleb Smirnoff free($2); 26323b3a8eb9SGleb Smirnoff YYERROR; 26333b3a8eb9SGleb Smirnoff } 26343b3a8eb9SGleb Smirnoff i = strtonum($2 + 5, 0, 255, &errstr); 26353b3a8eb9SGleb Smirnoff if (errstr) { 26363b3a8eb9SGleb Smirnoff yyerror("%s: %s", $2, errstr); 26373b3a8eb9SGleb Smirnoff free($2); 26383b3a8eb9SGleb Smirnoff YYERROR; 26393b3a8eb9SGleb Smirnoff } 26403b3a8eb9SGleb Smirnoff free($2); 26413b3a8eb9SGleb Smirnoff $$.logif = i; 26423b3a8eb9SGleb Smirnoff } 26433b3a8eb9SGleb Smirnoff ; 26443b3a8eb9SGleb Smirnoff 26453b3a8eb9SGleb Smirnoff interface : /* empty */ { $$ = NULL; } 26463b3a8eb9SGleb Smirnoff | ON if_item_not { $$ = $2; } 26473b3a8eb9SGleb Smirnoff | ON '{' optnl if_list '}' { $$ = $4; } 26483b3a8eb9SGleb Smirnoff ; 26493b3a8eb9SGleb Smirnoff 26503b3a8eb9SGleb Smirnoff if_list : if_item_not optnl { $$ = $1; } 26513b3a8eb9SGleb Smirnoff | if_list comma if_item_not optnl { 26523b3a8eb9SGleb Smirnoff $1->tail->next = $3; 26533b3a8eb9SGleb Smirnoff $1->tail = $3; 26543b3a8eb9SGleb Smirnoff $$ = $1; 26553b3a8eb9SGleb Smirnoff } 26563b3a8eb9SGleb Smirnoff ; 26573b3a8eb9SGleb Smirnoff 26583b3a8eb9SGleb Smirnoff if_item_not : not if_item { $$ = $2; $$->not = $1; } 26593b3a8eb9SGleb Smirnoff ; 26603b3a8eb9SGleb Smirnoff 26613b3a8eb9SGleb Smirnoff if_item : STRING { 26623b3a8eb9SGleb Smirnoff struct node_host *n; 26633b3a8eb9SGleb Smirnoff 26643b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_if)); 26653b3a8eb9SGleb Smirnoff if ($$ == NULL) 26663b3a8eb9SGleb Smirnoff err(1, "if_item: calloc"); 26673b3a8eb9SGleb Smirnoff if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 26683b3a8eb9SGleb Smirnoff sizeof($$->ifname)) { 26693b3a8eb9SGleb Smirnoff free($1); 26703b3a8eb9SGleb Smirnoff free($$); 26713b3a8eb9SGleb Smirnoff yyerror("interface name too long"); 26723b3a8eb9SGleb Smirnoff YYERROR; 26733b3a8eb9SGleb Smirnoff } 26743b3a8eb9SGleb Smirnoff 26753b3a8eb9SGleb Smirnoff if ((n = ifa_exists($1)) != NULL) 26763b3a8eb9SGleb Smirnoff $$->ifa_flags = n->ifa_flags; 26773b3a8eb9SGleb Smirnoff 26783b3a8eb9SGleb Smirnoff free($1); 26793b3a8eb9SGleb Smirnoff $$->not = 0; 26803b3a8eb9SGleb Smirnoff $$->next = NULL; 26813b3a8eb9SGleb Smirnoff $$->tail = $$; 26823b3a8eb9SGleb Smirnoff } 26833b3a8eb9SGleb Smirnoff ; 26843b3a8eb9SGleb Smirnoff 26853b3a8eb9SGleb Smirnoff af : /* empty */ { $$ = 0; } 26863b3a8eb9SGleb Smirnoff | INET { $$ = AF_INET; } 26873b3a8eb9SGleb Smirnoff | INET6 { $$ = AF_INET6; } 26883b3a8eb9SGleb Smirnoff ; 26893b3a8eb9SGleb Smirnoff 26903b3a8eb9SGleb Smirnoff proto : /* empty */ { $$ = NULL; } 26913b3a8eb9SGleb Smirnoff | PROTO proto_item { $$ = $2; } 26923b3a8eb9SGleb Smirnoff | PROTO '{' optnl proto_list '}' { $$ = $4; } 26933b3a8eb9SGleb Smirnoff ; 26943b3a8eb9SGleb Smirnoff 26953b3a8eb9SGleb Smirnoff proto_list : proto_item optnl { $$ = $1; } 26963b3a8eb9SGleb Smirnoff | proto_list comma proto_item optnl { 26973b3a8eb9SGleb Smirnoff $1->tail->next = $3; 26983b3a8eb9SGleb Smirnoff $1->tail = $3; 26993b3a8eb9SGleb Smirnoff $$ = $1; 27003b3a8eb9SGleb Smirnoff } 27013b3a8eb9SGleb Smirnoff ; 27023b3a8eb9SGleb Smirnoff 27033b3a8eb9SGleb Smirnoff proto_item : protoval { 27043b3a8eb9SGleb Smirnoff u_int8_t pr; 27053b3a8eb9SGleb Smirnoff 27063b3a8eb9SGleb Smirnoff pr = (u_int8_t)$1; 27073b3a8eb9SGleb Smirnoff if (pr == 0) { 27083b3a8eb9SGleb Smirnoff yyerror("proto 0 cannot be used"); 27093b3a8eb9SGleb Smirnoff YYERROR; 27103b3a8eb9SGleb Smirnoff } 27113b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_proto)); 27123b3a8eb9SGleb Smirnoff if ($$ == NULL) 27133b3a8eb9SGleb Smirnoff err(1, "proto_item: calloc"); 27143b3a8eb9SGleb Smirnoff $$->proto = pr; 27153b3a8eb9SGleb Smirnoff $$->next = NULL; 27163b3a8eb9SGleb Smirnoff $$->tail = $$; 27173b3a8eb9SGleb Smirnoff } 27183b3a8eb9SGleb Smirnoff ; 27193b3a8eb9SGleb Smirnoff 27203b3a8eb9SGleb Smirnoff protoval : STRING { 27213b3a8eb9SGleb Smirnoff struct protoent *p; 27223b3a8eb9SGleb Smirnoff 27233b3a8eb9SGleb Smirnoff p = getprotobyname($1); 27243b3a8eb9SGleb Smirnoff if (p == NULL) { 27253b3a8eb9SGleb Smirnoff yyerror("unknown protocol %s", $1); 27263b3a8eb9SGleb Smirnoff free($1); 27273b3a8eb9SGleb Smirnoff YYERROR; 27283b3a8eb9SGleb Smirnoff } 27293b3a8eb9SGleb Smirnoff $$ = p->p_proto; 27303b3a8eb9SGleb Smirnoff free($1); 27313b3a8eb9SGleb Smirnoff } 27323b3a8eb9SGleb Smirnoff | NUMBER { 27333b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 27343b3a8eb9SGleb Smirnoff yyerror("protocol outside range"); 27353b3a8eb9SGleb Smirnoff YYERROR; 27363b3a8eb9SGleb Smirnoff } 27373b3a8eb9SGleb Smirnoff } 27383b3a8eb9SGleb Smirnoff ; 27393b3a8eb9SGleb Smirnoff 27403b3a8eb9SGleb Smirnoff fromto : ALL { 27413b3a8eb9SGleb Smirnoff $$.src.host = NULL; 27423b3a8eb9SGleb Smirnoff $$.src.port = NULL; 27433b3a8eb9SGleb Smirnoff $$.dst.host = NULL; 27443b3a8eb9SGleb Smirnoff $$.dst.port = NULL; 27453b3a8eb9SGleb Smirnoff $$.src_os = NULL; 27463b3a8eb9SGleb Smirnoff } 27473b3a8eb9SGleb Smirnoff | from os to { 27483b3a8eb9SGleb Smirnoff $$.src = $1; 27493b3a8eb9SGleb Smirnoff $$.src_os = $2; 27503b3a8eb9SGleb Smirnoff $$.dst = $3; 27513b3a8eb9SGleb Smirnoff } 27523b3a8eb9SGleb Smirnoff ; 27533b3a8eb9SGleb Smirnoff 27543b3a8eb9SGleb Smirnoff os : /* empty */ { $$ = NULL; } 27553b3a8eb9SGleb Smirnoff | OS xos { $$ = $2; } 27563b3a8eb9SGleb Smirnoff | OS '{' optnl os_list '}' { $$ = $4; } 27573b3a8eb9SGleb Smirnoff ; 27583b3a8eb9SGleb Smirnoff 27593b3a8eb9SGleb Smirnoff xos : STRING { 27603b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_os)); 27613b3a8eb9SGleb Smirnoff if ($$ == NULL) 27623b3a8eb9SGleb Smirnoff err(1, "os: calloc"); 27633b3a8eb9SGleb Smirnoff $$->os = $1; 27643b3a8eb9SGleb Smirnoff $$->tail = $$; 27653b3a8eb9SGleb Smirnoff } 27663b3a8eb9SGleb Smirnoff ; 27673b3a8eb9SGleb Smirnoff 27683b3a8eb9SGleb Smirnoff os_list : xos optnl { $$ = $1; } 27693b3a8eb9SGleb Smirnoff | os_list comma xos optnl { 27703b3a8eb9SGleb Smirnoff $1->tail->next = $3; 27713b3a8eb9SGleb Smirnoff $1->tail = $3; 27723b3a8eb9SGleb Smirnoff $$ = $1; 27733b3a8eb9SGleb Smirnoff } 27743b3a8eb9SGleb Smirnoff ; 27753b3a8eb9SGleb Smirnoff 27763b3a8eb9SGleb Smirnoff from : /* empty */ { 27773b3a8eb9SGleb Smirnoff $$.host = NULL; 27783b3a8eb9SGleb Smirnoff $$.port = NULL; 27793b3a8eb9SGleb Smirnoff } 27803b3a8eb9SGleb Smirnoff | FROM ipportspec { 27813b3a8eb9SGleb Smirnoff $$ = $2; 27823b3a8eb9SGleb Smirnoff } 27833b3a8eb9SGleb Smirnoff ; 27843b3a8eb9SGleb Smirnoff 27853b3a8eb9SGleb Smirnoff to : /* empty */ { 27863b3a8eb9SGleb Smirnoff $$.host = NULL; 27873b3a8eb9SGleb Smirnoff $$.port = NULL; 27883b3a8eb9SGleb Smirnoff } 27893b3a8eb9SGleb Smirnoff | TO ipportspec { 27903b3a8eb9SGleb Smirnoff if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 27913b3a8eb9SGleb Smirnoff "not permitted in a destination address")) 27923b3a8eb9SGleb Smirnoff YYERROR; 27933b3a8eb9SGleb Smirnoff $$ = $2; 27943b3a8eb9SGleb Smirnoff } 27953b3a8eb9SGleb Smirnoff ; 27963b3a8eb9SGleb Smirnoff 27973b3a8eb9SGleb Smirnoff ipportspec : ipspec { 27983b3a8eb9SGleb Smirnoff $$.host = $1; 27993b3a8eb9SGleb Smirnoff $$.port = NULL; 28003b3a8eb9SGleb Smirnoff } 28013b3a8eb9SGleb Smirnoff | ipspec PORT portspec { 28023b3a8eb9SGleb Smirnoff $$.host = $1; 28033b3a8eb9SGleb Smirnoff $$.port = $3; 28043b3a8eb9SGleb Smirnoff } 28053b3a8eb9SGleb Smirnoff | PORT portspec { 28063b3a8eb9SGleb Smirnoff $$.host = NULL; 28073b3a8eb9SGleb Smirnoff $$.port = $2; 28083b3a8eb9SGleb Smirnoff } 28093b3a8eb9SGleb Smirnoff ; 28103b3a8eb9SGleb Smirnoff 28113b3a8eb9SGleb Smirnoff optnl : '\n' optnl 28123b3a8eb9SGleb Smirnoff | 28133b3a8eb9SGleb Smirnoff ; 28143b3a8eb9SGleb Smirnoff 28153b3a8eb9SGleb Smirnoff ipspec : ANY { $$ = NULL; } 28163b3a8eb9SGleb Smirnoff | xhost { $$ = $1; } 28173b3a8eb9SGleb Smirnoff | '{' optnl host_list '}' { $$ = $3; } 28183b3a8eb9SGleb Smirnoff ; 28193b3a8eb9SGleb Smirnoff 28203b3a8eb9SGleb Smirnoff toipspec : TO ipspec { $$ = $2; } 28213b3a8eb9SGleb Smirnoff | /* empty */ { $$ = NULL; } 28223b3a8eb9SGleb Smirnoff ; 28233b3a8eb9SGleb Smirnoff 28243b3a8eb9SGleb Smirnoff host_list : ipspec optnl { $$ = $1; } 28253b3a8eb9SGleb Smirnoff | host_list comma ipspec optnl { 28263b3a8eb9SGleb Smirnoff if ($3 == NULL) 28273b3a8eb9SGleb Smirnoff $$ = $1; 28283b3a8eb9SGleb Smirnoff else if ($1 == NULL) 28293b3a8eb9SGleb Smirnoff $$ = $3; 28303b3a8eb9SGleb Smirnoff else { 28313b3a8eb9SGleb Smirnoff $1->tail->next = $3; 28323b3a8eb9SGleb Smirnoff $1->tail = $3->tail; 28333b3a8eb9SGleb Smirnoff $$ = $1; 28343b3a8eb9SGleb Smirnoff } 28353b3a8eb9SGleb Smirnoff } 28363b3a8eb9SGleb Smirnoff ; 28373b3a8eb9SGleb Smirnoff 28383b3a8eb9SGleb Smirnoff xhost : not host { 28393b3a8eb9SGleb Smirnoff struct node_host *n; 28403b3a8eb9SGleb Smirnoff 28413b3a8eb9SGleb Smirnoff for (n = $2; n != NULL; n = n->next) 28423b3a8eb9SGleb Smirnoff n->not = $1; 28433b3a8eb9SGleb Smirnoff $$ = $2; 28443b3a8eb9SGleb Smirnoff } 28453b3a8eb9SGleb Smirnoff | not NOROUTE { 28463b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 28473b3a8eb9SGleb Smirnoff if ($$ == NULL) 28483b3a8eb9SGleb Smirnoff err(1, "xhost: calloc"); 28493b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_NOROUTE; 28503b3a8eb9SGleb Smirnoff $$->next = NULL; 28513b3a8eb9SGleb Smirnoff $$->not = $1; 28523b3a8eb9SGleb Smirnoff $$->tail = $$; 28533b3a8eb9SGleb Smirnoff } 28543b3a8eb9SGleb Smirnoff | not URPFFAILED { 28553b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 28563b3a8eb9SGleb Smirnoff if ($$ == NULL) 28573b3a8eb9SGleb Smirnoff err(1, "xhost: calloc"); 28583b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_URPFFAILED; 28593b3a8eb9SGleb Smirnoff $$->next = NULL; 28603b3a8eb9SGleb Smirnoff $$->not = $1; 28613b3a8eb9SGleb Smirnoff $$->tail = $$; 28623b3a8eb9SGleb Smirnoff } 28633b3a8eb9SGleb Smirnoff ; 28643b3a8eb9SGleb Smirnoff 28653b3a8eb9SGleb Smirnoff host : STRING { 28663b3a8eb9SGleb Smirnoff if (($$ = host($1)) == NULL) { 28673b3a8eb9SGleb Smirnoff /* error. "any" is handled elsewhere */ 28683b3a8eb9SGleb Smirnoff free($1); 28693b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 28703b3a8eb9SGleb Smirnoff YYERROR; 28713b3a8eb9SGleb Smirnoff } 28723b3a8eb9SGleb Smirnoff free($1); 28733b3a8eb9SGleb Smirnoff 28743b3a8eb9SGleb Smirnoff } 28753b3a8eb9SGleb Smirnoff | STRING '-' STRING { 28763b3a8eb9SGleb Smirnoff struct node_host *b, *e; 28773b3a8eb9SGleb Smirnoff 28783b3a8eb9SGleb Smirnoff if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 28793b3a8eb9SGleb Smirnoff free($1); 28803b3a8eb9SGleb Smirnoff free($3); 28813b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 28823b3a8eb9SGleb Smirnoff YYERROR; 28833b3a8eb9SGleb Smirnoff } 28843b3a8eb9SGleb Smirnoff if (b->af != e->af || 28853b3a8eb9SGleb Smirnoff b->addr.type != PF_ADDR_ADDRMASK || 28863b3a8eb9SGleb Smirnoff e->addr.type != PF_ADDR_ADDRMASK || 28873b3a8eb9SGleb Smirnoff unmask(&b->addr.v.a.mask, b->af) != 28883b3a8eb9SGleb Smirnoff (b->af == AF_INET ? 32 : 128) || 28893b3a8eb9SGleb Smirnoff unmask(&e->addr.v.a.mask, e->af) != 28903b3a8eb9SGleb Smirnoff (e->af == AF_INET ? 32 : 128) || 28913b3a8eb9SGleb Smirnoff b->next != NULL || b->not || 28923b3a8eb9SGleb Smirnoff e->next != NULL || e->not) { 28933b3a8eb9SGleb Smirnoff free(b); 28943b3a8eb9SGleb Smirnoff free(e); 28953b3a8eb9SGleb Smirnoff free($1); 28963b3a8eb9SGleb Smirnoff free($3); 28973b3a8eb9SGleb Smirnoff yyerror("invalid address range"); 28983b3a8eb9SGleb Smirnoff YYERROR; 28993b3a8eb9SGleb Smirnoff } 29003b3a8eb9SGleb Smirnoff memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 29013b3a8eb9SGleb Smirnoff sizeof(b->addr.v.a.mask)); 29023b3a8eb9SGleb Smirnoff b->addr.type = PF_ADDR_RANGE; 29033b3a8eb9SGleb Smirnoff $$ = b; 29043b3a8eb9SGleb Smirnoff free(e); 29053b3a8eb9SGleb Smirnoff free($1); 29063b3a8eb9SGleb Smirnoff free($3); 29073b3a8eb9SGleb Smirnoff } 29083b3a8eb9SGleb Smirnoff | STRING '/' NUMBER { 29093b3a8eb9SGleb Smirnoff char *buf; 29103b3a8eb9SGleb Smirnoff 29113b3a8eb9SGleb Smirnoff if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1) 29123b3a8eb9SGleb Smirnoff err(1, "host: asprintf"); 29133b3a8eb9SGleb Smirnoff free($1); 29143b3a8eb9SGleb Smirnoff if (($$ = host(buf)) == NULL) { 29153b3a8eb9SGleb Smirnoff /* error. "any" is handled elsewhere */ 29163b3a8eb9SGleb Smirnoff free(buf); 29173b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 29183b3a8eb9SGleb Smirnoff YYERROR; 29193b3a8eb9SGleb Smirnoff } 29203b3a8eb9SGleb Smirnoff free(buf); 29213b3a8eb9SGleb Smirnoff } 29223b3a8eb9SGleb Smirnoff | NUMBER '/' NUMBER { 29233b3a8eb9SGleb Smirnoff char *buf; 29243b3a8eb9SGleb Smirnoff 29253b3a8eb9SGleb Smirnoff /* ie. for 10/8 parsing */ 29263b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 29273b3a8eb9SGleb Smirnoff if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1) 29283b3a8eb9SGleb Smirnoff #else 29293b3a8eb9SGleb Smirnoff if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 29303b3a8eb9SGleb Smirnoff #endif 29313b3a8eb9SGleb Smirnoff err(1, "host: asprintf"); 29323b3a8eb9SGleb Smirnoff if (($$ = host(buf)) == NULL) { 29333b3a8eb9SGleb Smirnoff /* error. "any" is handled elsewhere */ 29343b3a8eb9SGleb Smirnoff free(buf); 29353b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 29363b3a8eb9SGleb Smirnoff YYERROR; 29373b3a8eb9SGleb Smirnoff } 29383b3a8eb9SGleb Smirnoff free(buf); 29393b3a8eb9SGleb Smirnoff } 29403b3a8eb9SGleb Smirnoff | dynaddr 29413b3a8eb9SGleb Smirnoff | dynaddr '/' NUMBER { 29423b3a8eb9SGleb Smirnoff struct node_host *n; 29433b3a8eb9SGleb Smirnoff 29443b3a8eb9SGleb Smirnoff if ($3 < 0 || $3 > 128) { 29453b3a8eb9SGleb Smirnoff yyerror("bit number too big"); 29463b3a8eb9SGleb Smirnoff YYERROR; 29473b3a8eb9SGleb Smirnoff } 29483b3a8eb9SGleb Smirnoff $$ = $1; 29493b3a8eb9SGleb Smirnoff for (n = $1; n != NULL; n = n->next) 29503b3a8eb9SGleb Smirnoff set_ipmask(n, $3); 29513b3a8eb9SGleb Smirnoff } 29523b3a8eb9SGleb Smirnoff | '<' STRING '>' { 29533b3a8eb9SGleb Smirnoff if (strlen($2) >= PF_TABLE_NAME_SIZE) { 29543b3a8eb9SGleb Smirnoff yyerror("table name '%s' too long", $2); 29553b3a8eb9SGleb Smirnoff free($2); 29563b3a8eb9SGleb Smirnoff YYERROR; 29573b3a8eb9SGleb Smirnoff } 29583b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 29593b3a8eb9SGleb Smirnoff if ($$ == NULL) 29603b3a8eb9SGleb Smirnoff err(1, "host: calloc"); 29613b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_TABLE; 29623b3a8eb9SGleb Smirnoff if (strlcpy($$->addr.v.tblname, $2, 29633b3a8eb9SGleb Smirnoff sizeof($$->addr.v.tblname)) >= 29643b3a8eb9SGleb Smirnoff sizeof($$->addr.v.tblname)) 29653b3a8eb9SGleb Smirnoff errx(1, "host: strlcpy"); 29663b3a8eb9SGleb Smirnoff free($2); 29673b3a8eb9SGleb Smirnoff $$->next = NULL; 29683b3a8eb9SGleb Smirnoff $$->tail = $$; 29693b3a8eb9SGleb Smirnoff } 29703b3a8eb9SGleb Smirnoff ; 29713b3a8eb9SGleb Smirnoff 29723b3a8eb9SGleb Smirnoff number : NUMBER 29733b3a8eb9SGleb Smirnoff | STRING { 29743b3a8eb9SGleb Smirnoff u_long ulval; 29753b3a8eb9SGleb Smirnoff 29763b3a8eb9SGleb Smirnoff if (atoul($1, &ulval) == -1) { 29773b3a8eb9SGleb Smirnoff yyerror("%s is not a number", $1); 29783b3a8eb9SGleb Smirnoff free($1); 29793b3a8eb9SGleb Smirnoff YYERROR; 29803b3a8eb9SGleb Smirnoff } else 29813b3a8eb9SGleb Smirnoff $$ = ulval; 29823b3a8eb9SGleb Smirnoff free($1); 29833b3a8eb9SGleb Smirnoff } 29843b3a8eb9SGleb Smirnoff ; 29853b3a8eb9SGleb Smirnoff 29863b3a8eb9SGleb Smirnoff dynaddr : '(' STRING ')' { 29873b3a8eb9SGleb Smirnoff int flags = 0; 29883b3a8eb9SGleb Smirnoff char *p, *op; 29893b3a8eb9SGleb Smirnoff 29903b3a8eb9SGleb Smirnoff op = $2; 29913b3a8eb9SGleb Smirnoff if (!isalpha(op[0])) { 29923b3a8eb9SGleb Smirnoff yyerror("invalid interface name '%s'", op); 29933b3a8eb9SGleb Smirnoff free(op); 29943b3a8eb9SGleb Smirnoff YYERROR; 29953b3a8eb9SGleb Smirnoff } 29963b3a8eb9SGleb Smirnoff while ((p = strrchr($2, ':')) != NULL) { 29973b3a8eb9SGleb Smirnoff if (!strcmp(p+1, "network")) 29983b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_NETWORK; 29993b3a8eb9SGleb Smirnoff else if (!strcmp(p+1, "broadcast")) 30003b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_BROADCAST; 30013b3a8eb9SGleb Smirnoff else if (!strcmp(p+1, "peer")) 30023b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_PEER; 30033b3a8eb9SGleb Smirnoff else if (!strcmp(p+1, "0")) 30043b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_NOALIAS; 30053b3a8eb9SGleb Smirnoff else { 30063b3a8eb9SGleb Smirnoff yyerror("interface %s has bad modifier", 30073b3a8eb9SGleb Smirnoff $2); 30083b3a8eb9SGleb Smirnoff free(op); 30093b3a8eb9SGleb Smirnoff YYERROR; 30103b3a8eb9SGleb Smirnoff } 30113b3a8eb9SGleb Smirnoff *p = '\0'; 30123b3a8eb9SGleb Smirnoff } 30133b3a8eb9SGleb Smirnoff if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 30143b3a8eb9SGleb Smirnoff free(op); 30153b3a8eb9SGleb Smirnoff yyerror("illegal combination of " 30163b3a8eb9SGleb Smirnoff "interface modifiers"); 30173b3a8eb9SGleb Smirnoff YYERROR; 30183b3a8eb9SGleb Smirnoff } 30193b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 30203b3a8eb9SGleb Smirnoff if ($$ == NULL) 30213b3a8eb9SGleb Smirnoff err(1, "address: calloc"); 30223b3a8eb9SGleb Smirnoff $$->af = 0; 30233b3a8eb9SGleb Smirnoff set_ipmask($$, 128); 30243b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_DYNIFTL; 30253b3a8eb9SGleb Smirnoff $$->addr.iflags = flags; 30263b3a8eb9SGleb Smirnoff if (strlcpy($$->addr.v.ifname, $2, 30273b3a8eb9SGleb Smirnoff sizeof($$->addr.v.ifname)) >= 30283b3a8eb9SGleb Smirnoff sizeof($$->addr.v.ifname)) { 30293b3a8eb9SGleb Smirnoff free(op); 30303b3a8eb9SGleb Smirnoff free($$); 30313b3a8eb9SGleb Smirnoff yyerror("interface name too long"); 30323b3a8eb9SGleb Smirnoff YYERROR; 30333b3a8eb9SGleb Smirnoff } 30343b3a8eb9SGleb Smirnoff free(op); 30353b3a8eb9SGleb Smirnoff $$->next = NULL; 30363b3a8eb9SGleb Smirnoff $$->tail = $$; 30373b3a8eb9SGleb Smirnoff } 30383b3a8eb9SGleb Smirnoff ; 30393b3a8eb9SGleb Smirnoff 30403b3a8eb9SGleb Smirnoff portspec : port_item { $$ = $1; } 30413b3a8eb9SGleb Smirnoff | '{' optnl port_list '}' { $$ = $3; } 30423b3a8eb9SGleb Smirnoff ; 30433b3a8eb9SGleb Smirnoff 30443b3a8eb9SGleb Smirnoff port_list : port_item optnl { $$ = $1; } 30453b3a8eb9SGleb Smirnoff | port_list comma port_item optnl { 30463b3a8eb9SGleb Smirnoff $1->tail->next = $3; 30473b3a8eb9SGleb Smirnoff $1->tail = $3; 30483b3a8eb9SGleb Smirnoff $$ = $1; 30493b3a8eb9SGleb Smirnoff } 30503b3a8eb9SGleb Smirnoff ; 30513b3a8eb9SGleb Smirnoff 30523b3a8eb9SGleb Smirnoff port_item : portrange { 30533b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_port)); 30543b3a8eb9SGleb Smirnoff if ($$ == NULL) 30553b3a8eb9SGleb Smirnoff err(1, "port_item: calloc"); 30563b3a8eb9SGleb Smirnoff $$->port[0] = $1.a; 30573b3a8eb9SGleb Smirnoff $$->port[1] = $1.b; 30583b3a8eb9SGleb Smirnoff if ($1.t) 30593b3a8eb9SGleb Smirnoff $$->op = PF_OP_RRG; 30603b3a8eb9SGleb Smirnoff else 30613b3a8eb9SGleb Smirnoff $$->op = PF_OP_EQ; 30623b3a8eb9SGleb Smirnoff $$->next = NULL; 30633b3a8eb9SGleb Smirnoff $$->tail = $$; 30643b3a8eb9SGleb Smirnoff } 30653b3a8eb9SGleb Smirnoff | unaryop portrange { 30663b3a8eb9SGleb Smirnoff if ($2.t) { 30673b3a8eb9SGleb Smirnoff yyerror("':' cannot be used with an other " 30683b3a8eb9SGleb Smirnoff "port operator"); 30693b3a8eb9SGleb Smirnoff YYERROR; 30703b3a8eb9SGleb Smirnoff } 30713b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_port)); 30723b3a8eb9SGleb Smirnoff if ($$ == NULL) 30733b3a8eb9SGleb Smirnoff err(1, "port_item: calloc"); 30743b3a8eb9SGleb Smirnoff $$->port[0] = $2.a; 30753b3a8eb9SGleb Smirnoff $$->port[1] = $2.b; 30763b3a8eb9SGleb Smirnoff $$->op = $1; 30773b3a8eb9SGleb Smirnoff $$->next = NULL; 30783b3a8eb9SGleb Smirnoff $$->tail = $$; 30793b3a8eb9SGleb Smirnoff } 30803b3a8eb9SGleb Smirnoff | portrange PORTBINARY portrange { 30813b3a8eb9SGleb Smirnoff if ($1.t || $3.t) { 30823b3a8eb9SGleb Smirnoff yyerror("':' cannot be used with an other " 30833b3a8eb9SGleb Smirnoff "port operator"); 30843b3a8eb9SGleb Smirnoff YYERROR; 30853b3a8eb9SGleb Smirnoff } 30863b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_port)); 30873b3a8eb9SGleb Smirnoff if ($$ == NULL) 30883b3a8eb9SGleb Smirnoff err(1, "port_item: calloc"); 30893b3a8eb9SGleb Smirnoff $$->port[0] = $1.a; 30903b3a8eb9SGleb Smirnoff $$->port[1] = $3.a; 30913b3a8eb9SGleb Smirnoff $$->op = $2; 30923b3a8eb9SGleb Smirnoff $$->next = NULL; 30933b3a8eb9SGleb Smirnoff $$->tail = $$; 30943b3a8eb9SGleb Smirnoff } 30953b3a8eb9SGleb Smirnoff ; 30963b3a8eb9SGleb Smirnoff 30973b3a8eb9SGleb Smirnoff portplain : numberstring { 30983b3a8eb9SGleb Smirnoff if (parseport($1, &$$, 0) == -1) { 30993b3a8eb9SGleb Smirnoff free($1); 31003b3a8eb9SGleb Smirnoff YYERROR; 31013b3a8eb9SGleb Smirnoff } 31023b3a8eb9SGleb Smirnoff free($1); 31033b3a8eb9SGleb Smirnoff } 31043b3a8eb9SGleb Smirnoff ; 31053b3a8eb9SGleb Smirnoff 31063b3a8eb9SGleb Smirnoff portrange : numberstring { 31073b3a8eb9SGleb Smirnoff if (parseport($1, &$$, PPORT_RANGE) == -1) { 31083b3a8eb9SGleb Smirnoff free($1); 31093b3a8eb9SGleb Smirnoff YYERROR; 31103b3a8eb9SGleb Smirnoff } 31113b3a8eb9SGleb Smirnoff free($1); 31123b3a8eb9SGleb Smirnoff } 31133b3a8eb9SGleb Smirnoff ; 31143b3a8eb9SGleb Smirnoff 31153b3a8eb9SGleb Smirnoff uids : uid_item { $$ = $1; } 31163b3a8eb9SGleb Smirnoff | '{' optnl uid_list '}' { $$ = $3; } 31173b3a8eb9SGleb Smirnoff ; 31183b3a8eb9SGleb Smirnoff 31193b3a8eb9SGleb Smirnoff uid_list : uid_item optnl { $$ = $1; } 31203b3a8eb9SGleb Smirnoff | uid_list comma uid_item optnl { 31213b3a8eb9SGleb Smirnoff $1->tail->next = $3; 31223b3a8eb9SGleb Smirnoff $1->tail = $3; 31233b3a8eb9SGleb Smirnoff $$ = $1; 31243b3a8eb9SGleb Smirnoff } 31253b3a8eb9SGleb Smirnoff ; 31263b3a8eb9SGleb Smirnoff 31273b3a8eb9SGleb Smirnoff uid_item : uid { 31283b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_uid)); 31293b3a8eb9SGleb Smirnoff if ($$ == NULL) 31303b3a8eb9SGleb Smirnoff err(1, "uid_item: calloc"); 31313b3a8eb9SGleb Smirnoff $$->uid[0] = $1; 31323b3a8eb9SGleb Smirnoff $$->uid[1] = $1; 31333b3a8eb9SGleb Smirnoff $$->op = PF_OP_EQ; 31343b3a8eb9SGleb Smirnoff $$->next = NULL; 31353b3a8eb9SGleb Smirnoff $$->tail = $$; 31363b3a8eb9SGleb Smirnoff } 31373b3a8eb9SGleb Smirnoff | unaryop uid { 31383b3a8eb9SGleb Smirnoff if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 31393b3a8eb9SGleb Smirnoff yyerror("user unknown requires operator = or " 31403b3a8eb9SGleb Smirnoff "!="); 31413b3a8eb9SGleb Smirnoff YYERROR; 31423b3a8eb9SGleb Smirnoff } 31433b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_uid)); 31443b3a8eb9SGleb Smirnoff if ($$ == NULL) 31453b3a8eb9SGleb Smirnoff err(1, "uid_item: calloc"); 31463b3a8eb9SGleb Smirnoff $$->uid[0] = $2; 31473b3a8eb9SGleb Smirnoff $$->uid[1] = $2; 31483b3a8eb9SGleb Smirnoff $$->op = $1; 31493b3a8eb9SGleb Smirnoff $$->next = NULL; 31503b3a8eb9SGleb Smirnoff $$->tail = $$; 31513b3a8eb9SGleb Smirnoff } 31523b3a8eb9SGleb Smirnoff | uid PORTBINARY uid { 31533b3a8eb9SGleb Smirnoff if ($1 == UID_MAX || $3 == UID_MAX) { 31543b3a8eb9SGleb Smirnoff yyerror("user unknown requires operator = or " 31553b3a8eb9SGleb Smirnoff "!="); 31563b3a8eb9SGleb Smirnoff YYERROR; 31573b3a8eb9SGleb Smirnoff } 31583b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_uid)); 31593b3a8eb9SGleb Smirnoff if ($$ == NULL) 31603b3a8eb9SGleb Smirnoff err(1, "uid_item: calloc"); 31613b3a8eb9SGleb Smirnoff $$->uid[0] = $1; 31623b3a8eb9SGleb Smirnoff $$->uid[1] = $3; 31633b3a8eb9SGleb Smirnoff $$->op = $2; 31643b3a8eb9SGleb Smirnoff $$->next = NULL; 31653b3a8eb9SGleb Smirnoff $$->tail = $$; 31663b3a8eb9SGleb Smirnoff } 31673b3a8eb9SGleb Smirnoff ; 31683b3a8eb9SGleb Smirnoff 31693b3a8eb9SGleb Smirnoff uid : STRING { 31703b3a8eb9SGleb Smirnoff if (!strcmp($1, "unknown")) 31713b3a8eb9SGleb Smirnoff $$ = UID_MAX; 31723b3a8eb9SGleb Smirnoff else { 31733b3a8eb9SGleb Smirnoff struct passwd *pw; 31743b3a8eb9SGleb Smirnoff 31753b3a8eb9SGleb Smirnoff if ((pw = getpwnam($1)) == NULL) { 31763b3a8eb9SGleb Smirnoff yyerror("unknown user %s", $1); 31773b3a8eb9SGleb Smirnoff free($1); 31783b3a8eb9SGleb Smirnoff YYERROR; 31793b3a8eb9SGleb Smirnoff } 31803b3a8eb9SGleb Smirnoff $$ = pw->pw_uid; 31813b3a8eb9SGleb Smirnoff } 31823b3a8eb9SGleb Smirnoff free($1); 31833b3a8eb9SGleb Smirnoff } 31843b3a8eb9SGleb Smirnoff | NUMBER { 31853b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 >= UID_MAX) { 31863b3a8eb9SGleb Smirnoff yyerror("illegal uid value %lu", $1); 31873b3a8eb9SGleb Smirnoff YYERROR; 31883b3a8eb9SGleb Smirnoff } 31893b3a8eb9SGleb Smirnoff $$ = $1; 31903b3a8eb9SGleb Smirnoff } 31913b3a8eb9SGleb Smirnoff ; 31923b3a8eb9SGleb Smirnoff 31933b3a8eb9SGleb Smirnoff gids : gid_item { $$ = $1; } 31943b3a8eb9SGleb Smirnoff | '{' optnl gid_list '}' { $$ = $3; } 31953b3a8eb9SGleb Smirnoff ; 31963b3a8eb9SGleb Smirnoff 31973b3a8eb9SGleb Smirnoff gid_list : gid_item optnl { $$ = $1; } 31983b3a8eb9SGleb Smirnoff | gid_list comma gid_item optnl { 31993b3a8eb9SGleb Smirnoff $1->tail->next = $3; 32003b3a8eb9SGleb Smirnoff $1->tail = $3; 32013b3a8eb9SGleb Smirnoff $$ = $1; 32023b3a8eb9SGleb Smirnoff } 32033b3a8eb9SGleb Smirnoff ; 32043b3a8eb9SGleb Smirnoff 32053b3a8eb9SGleb Smirnoff gid_item : gid { 32063b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_gid)); 32073b3a8eb9SGleb Smirnoff if ($$ == NULL) 32083b3a8eb9SGleb Smirnoff err(1, "gid_item: calloc"); 32093b3a8eb9SGleb Smirnoff $$->gid[0] = $1; 32103b3a8eb9SGleb Smirnoff $$->gid[1] = $1; 32113b3a8eb9SGleb Smirnoff $$->op = PF_OP_EQ; 32123b3a8eb9SGleb Smirnoff $$->next = NULL; 32133b3a8eb9SGleb Smirnoff $$->tail = $$; 32143b3a8eb9SGleb Smirnoff } 32153b3a8eb9SGleb Smirnoff | unaryop gid { 32163b3a8eb9SGleb Smirnoff if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 32173b3a8eb9SGleb Smirnoff yyerror("group unknown requires operator = or " 32183b3a8eb9SGleb Smirnoff "!="); 32193b3a8eb9SGleb Smirnoff YYERROR; 32203b3a8eb9SGleb Smirnoff } 32213b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_gid)); 32223b3a8eb9SGleb Smirnoff if ($$ == NULL) 32233b3a8eb9SGleb Smirnoff err(1, "gid_item: calloc"); 32243b3a8eb9SGleb Smirnoff $$->gid[0] = $2; 32253b3a8eb9SGleb Smirnoff $$->gid[1] = $2; 32263b3a8eb9SGleb Smirnoff $$->op = $1; 32273b3a8eb9SGleb Smirnoff $$->next = NULL; 32283b3a8eb9SGleb Smirnoff $$->tail = $$; 32293b3a8eb9SGleb Smirnoff } 32303b3a8eb9SGleb Smirnoff | gid PORTBINARY gid { 32313b3a8eb9SGleb Smirnoff if ($1 == GID_MAX || $3 == GID_MAX) { 32323b3a8eb9SGleb Smirnoff yyerror("group unknown requires operator = or " 32333b3a8eb9SGleb Smirnoff "!="); 32343b3a8eb9SGleb Smirnoff YYERROR; 32353b3a8eb9SGleb Smirnoff } 32363b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_gid)); 32373b3a8eb9SGleb Smirnoff if ($$ == NULL) 32383b3a8eb9SGleb Smirnoff err(1, "gid_item: calloc"); 32393b3a8eb9SGleb Smirnoff $$->gid[0] = $1; 32403b3a8eb9SGleb Smirnoff $$->gid[1] = $3; 32413b3a8eb9SGleb Smirnoff $$->op = $2; 32423b3a8eb9SGleb Smirnoff $$->next = NULL; 32433b3a8eb9SGleb Smirnoff $$->tail = $$; 32443b3a8eb9SGleb Smirnoff } 32453b3a8eb9SGleb Smirnoff ; 32463b3a8eb9SGleb Smirnoff 32473b3a8eb9SGleb Smirnoff gid : STRING { 32483b3a8eb9SGleb Smirnoff if (!strcmp($1, "unknown")) 32493b3a8eb9SGleb Smirnoff $$ = GID_MAX; 32503b3a8eb9SGleb Smirnoff else { 32513b3a8eb9SGleb Smirnoff struct group *grp; 32523b3a8eb9SGleb Smirnoff 32533b3a8eb9SGleb Smirnoff if ((grp = getgrnam($1)) == NULL) { 32543b3a8eb9SGleb Smirnoff yyerror("unknown group %s", $1); 32553b3a8eb9SGleb Smirnoff free($1); 32563b3a8eb9SGleb Smirnoff YYERROR; 32573b3a8eb9SGleb Smirnoff } 32583b3a8eb9SGleb Smirnoff $$ = grp->gr_gid; 32593b3a8eb9SGleb Smirnoff } 32603b3a8eb9SGleb Smirnoff free($1); 32613b3a8eb9SGleb Smirnoff } 32623b3a8eb9SGleb Smirnoff | NUMBER { 32633b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 >= GID_MAX) { 32643b3a8eb9SGleb Smirnoff yyerror("illegal gid value %lu", $1); 32653b3a8eb9SGleb Smirnoff YYERROR; 32663b3a8eb9SGleb Smirnoff } 32673b3a8eb9SGleb Smirnoff $$ = $1; 32683b3a8eb9SGleb Smirnoff } 32693b3a8eb9SGleb Smirnoff ; 32703b3a8eb9SGleb Smirnoff 32713b3a8eb9SGleb Smirnoff flag : STRING { 32723b3a8eb9SGleb Smirnoff int f; 32733b3a8eb9SGleb Smirnoff 32743b3a8eb9SGleb Smirnoff if ((f = parse_flags($1)) < 0) { 32753b3a8eb9SGleb Smirnoff yyerror("bad flags %s", $1); 32763b3a8eb9SGleb Smirnoff free($1); 32773b3a8eb9SGleb Smirnoff YYERROR; 32783b3a8eb9SGleb Smirnoff } 32793b3a8eb9SGleb Smirnoff free($1); 32803b3a8eb9SGleb Smirnoff $$.b1 = f; 32813b3a8eb9SGleb Smirnoff } 32823b3a8eb9SGleb Smirnoff ; 32833b3a8eb9SGleb Smirnoff 32843b3a8eb9SGleb Smirnoff flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 32853b3a8eb9SGleb Smirnoff | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 32863b3a8eb9SGleb Smirnoff | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 32873b3a8eb9SGleb Smirnoff ; 32883b3a8eb9SGleb Smirnoff 32893b3a8eb9SGleb Smirnoff icmpspec : ICMPTYPE icmp_item { $$ = $2; } 32903b3a8eb9SGleb Smirnoff | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 32913b3a8eb9SGleb Smirnoff | ICMP6TYPE icmp6_item { $$ = $2; } 32923b3a8eb9SGleb Smirnoff | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 32933b3a8eb9SGleb Smirnoff ; 32943b3a8eb9SGleb Smirnoff 32953b3a8eb9SGleb Smirnoff icmp_list : icmp_item optnl { $$ = $1; } 32963b3a8eb9SGleb Smirnoff | icmp_list comma icmp_item optnl { 32973b3a8eb9SGleb Smirnoff $1->tail->next = $3; 32983b3a8eb9SGleb Smirnoff $1->tail = $3; 32993b3a8eb9SGleb Smirnoff $$ = $1; 33003b3a8eb9SGleb Smirnoff } 33013b3a8eb9SGleb Smirnoff ; 33023b3a8eb9SGleb Smirnoff 33033b3a8eb9SGleb Smirnoff icmp6_list : icmp6_item optnl { $$ = $1; } 33043b3a8eb9SGleb Smirnoff | icmp6_list comma icmp6_item optnl { 33053b3a8eb9SGleb Smirnoff $1->tail->next = $3; 33063b3a8eb9SGleb Smirnoff $1->tail = $3; 33073b3a8eb9SGleb Smirnoff $$ = $1; 33083b3a8eb9SGleb Smirnoff } 33093b3a8eb9SGleb Smirnoff ; 33103b3a8eb9SGleb Smirnoff 33113b3a8eb9SGleb Smirnoff icmp_item : icmptype { 33123b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 33133b3a8eb9SGleb Smirnoff if ($$ == NULL) 33143b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 33153b3a8eb9SGleb Smirnoff $$->type = $1; 33163b3a8eb9SGleb Smirnoff $$->code = 0; 33173b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMP; 33183b3a8eb9SGleb Smirnoff $$->next = NULL; 33193b3a8eb9SGleb Smirnoff $$->tail = $$; 33203b3a8eb9SGleb Smirnoff } 33213b3a8eb9SGleb Smirnoff | icmptype CODE STRING { 33223b3a8eb9SGleb Smirnoff const struct icmpcodeent *p; 33233b3a8eb9SGleb Smirnoff 33243b3a8eb9SGleb Smirnoff if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 33253b3a8eb9SGleb Smirnoff yyerror("unknown icmp-code %s", $3); 33263b3a8eb9SGleb Smirnoff free($3); 33273b3a8eb9SGleb Smirnoff YYERROR; 33283b3a8eb9SGleb Smirnoff } 33293b3a8eb9SGleb Smirnoff 33303b3a8eb9SGleb Smirnoff free($3); 33313b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 33323b3a8eb9SGleb Smirnoff if ($$ == NULL) 33333b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 33343b3a8eb9SGleb Smirnoff $$->type = $1; 33353b3a8eb9SGleb Smirnoff $$->code = p->code + 1; 33363b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMP; 33373b3a8eb9SGleb Smirnoff $$->next = NULL; 33383b3a8eb9SGleb Smirnoff $$->tail = $$; 33393b3a8eb9SGleb Smirnoff } 33403b3a8eb9SGleb Smirnoff | icmptype CODE NUMBER { 33413b3a8eb9SGleb Smirnoff if ($3 < 0 || $3 > 255) { 33423b3a8eb9SGleb Smirnoff yyerror("illegal icmp-code %lu", $3); 33433b3a8eb9SGleb Smirnoff YYERROR; 33443b3a8eb9SGleb Smirnoff } 33453b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 33463b3a8eb9SGleb Smirnoff if ($$ == NULL) 33473b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 33483b3a8eb9SGleb Smirnoff $$->type = $1; 33493b3a8eb9SGleb Smirnoff $$->code = $3 + 1; 33503b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMP; 33513b3a8eb9SGleb Smirnoff $$->next = NULL; 33523b3a8eb9SGleb Smirnoff $$->tail = $$; 33533b3a8eb9SGleb Smirnoff } 33543b3a8eb9SGleb Smirnoff ; 33553b3a8eb9SGleb Smirnoff 33563b3a8eb9SGleb Smirnoff icmp6_item : icmp6type { 33573b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 33583b3a8eb9SGleb Smirnoff if ($$ == NULL) 33593b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 33603b3a8eb9SGleb Smirnoff $$->type = $1; 33613b3a8eb9SGleb Smirnoff $$->code = 0; 33623b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMPV6; 33633b3a8eb9SGleb Smirnoff $$->next = NULL; 33643b3a8eb9SGleb Smirnoff $$->tail = $$; 33653b3a8eb9SGleb Smirnoff } 33663b3a8eb9SGleb Smirnoff | icmp6type CODE STRING { 33673b3a8eb9SGleb Smirnoff const struct icmpcodeent *p; 33683b3a8eb9SGleb Smirnoff 33693b3a8eb9SGleb Smirnoff if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 33703b3a8eb9SGleb Smirnoff yyerror("unknown icmp6-code %s", $3); 33713b3a8eb9SGleb Smirnoff free($3); 33723b3a8eb9SGleb Smirnoff YYERROR; 33733b3a8eb9SGleb Smirnoff } 33743b3a8eb9SGleb Smirnoff free($3); 33753b3a8eb9SGleb Smirnoff 33763b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 33773b3a8eb9SGleb Smirnoff if ($$ == NULL) 33783b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 33793b3a8eb9SGleb Smirnoff $$->type = $1; 33803b3a8eb9SGleb Smirnoff $$->code = p->code + 1; 33813b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMPV6; 33823b3a8eb9SGleb Smirnoff $$->next = NULL; 33833b3a8eb9SGleb Smirnoff $$->tail = $$; 33843b3a8eb9SGleb Smirnoff } 33853b3a8eb9SGleb Smirnoff | icmp6type CODE NUMBER { 33863b3a8eb9SGleb Smirnoff if ($3 < 0 || $3 > 255) { 33873b3a8eb9SGleb Smirnoff yyerror("illegal icmp-code %lu", $3); 33883b3a8eb9SGleb Smirnoff YYERROR; 33893b3a8eb9SGleb Smirnoff } 33903b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 33913b3a8eb9SGleb Smirnoff if ($$ == NULL) 33923b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 33933b3a8eb9SGleb Smirnoff $$->type = $1; 33943b3a8eb9SGleb Smirnoff $$->code = $3 + 1; 33953b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMPV6; 33963b3a8eb9SGleb Smirnoff $$->next = NULL; 33973b3a8eb9SGleb Smirnoff $$->tail = $$; 33983b3a8eb9SGleb Smirnoff } 33993b3a8eb9SGleb Smirnoff ; 34003b3a8eb9SGleb Smirnoff 34013b3a8eb9SGleb Smirnoff icmptype : STRING { 34023b3a8eb9SGleb Smirnoff const struct icmptypeent *p; 34033b3a8eb9SGleb Smirnoff 34043b3a8eb9SGleb Smirnoff if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 34053b3a8eb9SGleb Smirnoff yyerror("unknown icmp-type %s", $1); 34063b3a8eb9SGleb Smirnoff free($1); 34073b3a8eb9SGleb Smirnoff YYERROR; 34083b3a8eb9SGleb Smirnoff } 34093b3a8eb9SGleb Smirnoff $$ = p->type + 1; 34103b3a8eb9SGleb Smirnoff free($1); 34113b3a8eb9SGleb Smirnoff } 34123b3a8eb9SGleb Smirnoff | NUMBER { 34133b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 34143b3a8eb9SGleb Smirnoff yyerror("illegal icmp-type %lu", $1); 34153b3a8eb9SGleb Smirnoff YYERROR; 34163b3a8eb9SGleb Smirnoff } 34173b3a8eb9SGleb Smirnoff $$ = $1 + 1; 34183b3a8eb9SGleb Smirnoff } 34193b3a8eb9SGleb Smirnoff ; 34203b3a8eb9SGleb Smirnoff 34213b3a8eb9SGleb Smirnoff icmp6type : STRING { 34223b3a8eb9SGleb Smirnoff const struct icmptypeent *p; 34233b3a8eb9SGleb Smirnoff 34243b3a8eb9SGleb Smirnoff if ((p = geticmptypebyname($1, AF_INET6)) == 34253b3a8eb9SGleb Smirnoff NULL) { 34263b3a8eb9SGleb Smirnoff yyerror("unknown icmp6-type %s", $1); 34273b3a8eb9SGleb Smirnoff free($1); 34283b3a8eb9SGleb Smirnoff YYERROR; 34293b3a8eb9SGleb Smirnoff } 34303b3a8eb9SGleb Smirnoff $$ = p->type + 1; 34313b3a8eb9SGleb Smirnoff free($1); 34323b3a8eb9SGleb Smirnoff } 34333b3a8eb9SGleb Smirnoff | NUMBER { 34343b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 34353b3a8eb9SGleb Smirnoff yyerror("illegal icmp6-type %lu", $1); 34363b3a8eb9SGleb Smirnoff YYERROR; 34373b3a8eb9SGleb Smirnoff } 34383b3a8eb9SGleb Smirnoff $$ = $1 + 1; 34393b3a8eb9SGleb Smirnoff } 34403b3a8eb9SGleb Smirnoff ; 34413b3a8eb9SGleb Smirnoff 34423b3a8eb9SGleb Smirnoff tos : STRING { 34433b3a8eb9SGleb Smirnoff if (!strcmp($1, "lowdelay")) 34443b3a8eb9SGleb Smirnoff $$ = IPTOS_LOWDELAY; 34453b3a8eb9SGleb Smirnoff else if (!strcmp($1, "throughput")) 34463b3a8eb9SGleb Smirnoff $$ = IPTOS_THROUGHPUT; 34473b3a8eb9SGleb Smirnoff else if (!strcmp($1, "reliability")) 34483b3a8eb9SGleb Smirnoff $$ = IPTOS_RELIABILITY; 34493b3a8eb9SGleb Smirnoff else if ($1[0] == '0' && $1[1] == 'x') 34503b3a8eb9SGleb Smirnoff $$ = strtoul($1, NULL, 16); 34513b3a8eb9SGleb Smirnoff else 34523b3a8eb9SGleb Smirnoff $$ = 0; /* flag bad argument */ 34533b3a8eb9SGleb Smirnoff if (!$$ || $$ > 255) { 34543b3a8eb9SGleb Smirnoff yyerror("illegal tos value %s", $1); 34553b3a8eb9SGleb Smirnoff free($1); 34563b3a8eb9SGleb Smirnoff YYERROR; 34573b3a8eb9SGleb Smirnoff } 34583b3a8eb9SGleb Smirnoff free($1); 34593b3a8eb9SGleb Smirnoff } 34603b3a8eb9SGleb Smirnoff | NUMBER { 34613b3a8eb9SGleb Smirnoff $$ = $1; 34623b3a8eb9SGleb Smirnoff if (!$$ || $$ > 255) { 34633b3a8eb9SGleb Smirnoff yyerror("illegal tos value %s", $1); 34643b3a8eb9SGleb Smirnoff YYERROR; 34653b3a8eb9SGleb Smirnoff } 34663b3a8eb9SGleb Smirnoff } 34673b3a8eb9SGleb Smirnoff ; 34683b3a8eb9SGleb Smirnoff 34693b3a8eb9SGleb Smirnoff sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 34703b3a8eb9SGleb Smirnoff | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 34713b3a8eb9SGleb Smirnoff | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 34723b3a8eb9SGleb Smirnoff ; 34733b3a8eb9SGleb Smirnoff 34743b3a8eb9SGleb Smirnoff statelock : IFBOUND { 34753b3a8eb9SGleb Smirnoff $$ = PFRULE_IFBOUND; 34763b3a8eb9SGleb Smirnoff } 34773b3a8eb9SGleb Smirnoff | FLOATING { 34783b3a8eb9SGleb Smirnoff $$ = 0; 34793b3a8eb9SGleb Smirnoff } 34803b3a8eb9SGleb Smirnoff ; 34813b3a8eb9SGleb Smirnoff 34823b3a8eb9SGleb Smirnoff keep : NO STATE { 34833b3a8eb9SGleb Smirnoff $$.action = 0; 34843b3a8eb9SGleb Smirnoff $$.options = NULL; 34853b3a8eb9SGleb Smirnoff } 34863b3a8eb9SGleb Smirnoff | KEEP STATE state_opt_spec { 34873b3a8eb9SGleb Smirnoff $$.action = PF_STATE_NORMAL; 34883b3a8eb9SGleb Smirnoff $$.options = $3; 34893b3a8eb9SGleb Smirnoff } 34903b3a8eb9SGleb Smirnoff | MODULATE STATE state_opt_spec { 34913b3a8eb9SGleb Smirnoff $$.action = PF_STATE_MODULATE; 34923b3a8eb9SGleb Smirnoff $$.options = $3; 34933b3a8eb9SGleb Smirnoff } 34943b3a8eb9SGleb Smirnoff | SYNPROXY STATE state_opt_spec { 34953b3a8eb9SGleb Smirnoff $$.action = PF_STATE_SYNPROXY; 34963b3a8eb9SGleb Smirnoff $$.options = $3; 34973b3a8eb9SGleb Smirnoff } 34983b3a8eb9SGleb Smirnoff ; 34993b3a8eb9SGleb Smirnoff 35003b3a8eb9SGleb Smirnoff flush : /* empty */ { $$ = 0; } 35013b3a8eb9SGleb Smirnoff | FLUSH { $$ = PF_FLUSH; } 35023b3a8eb9SGleb Smirnoff | FLUSH GLOBAL { 35033b3a8eb9SGleb Smirnoff $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 35043b3a8eb9SGleb Smirnoff } 35053b3a8eb9SGleb Smirnoff ; 35063b3a8eb9SGleb Smirnoff 35073b3a8eb9SGleb Smirnoff state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 35083b3a8eb9SGleb Smirnoff | /* empty */ { $$ = NULL; } 35093b3a8eb9SGleb Smirnoff ; 35103b3a8eb9SGleb Smirnoff 35113b3a8eb9SGleb Smirnoff state_opt_list : state_opt_item { $$ = $1; } 35123b3a8eb9SGleb Smirnoff | state_opt_list comma state_opt_item { 35133b3a8eb9SGleb Smirnoff $1->tail->next = $3; 35143b3a8eb9SGleb Smirnoff $1->tail = $3; 35153b3a8eb9SGleb Smirnoff $$ = $1; 35163b3a8eb9SGleb Smirnoff } 35173b3a8eb9SGleb Smirnoff ; 35183b3a8eb9SGleb Smirnoff 35193b3a8eb9SGleb Smirnoff state_opt_item : MAXIMUM NUMBER { 35203b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 35213b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 35223b3a8eb9SGleb Smirnoff YYERROR; 35233b3a8eb9SGleb Smirnoff } 35243b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 35253b3a8eb9SGleb Smirnoff if ($$ == NULL) 35263b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 35273b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX; 35283b3a8eb9SGleb Smirnoff $$->data.max_states = $2; 35293b3a8eb9SGleb Smirnoff $$->next = NULL; 35303b3a8eb9SGleb Smirnoff $$->tail = $$; 35313b3a8eb9SGleb Smirnoff } 35323b3a8eb9SGleb Smirnoff | NOSYNC { 35333b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 35343b3a8eb9SGleb Smirnoff if ($$ == NULL) 35353b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 35363b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_NOSYNC; 35373b3a8eb9SGleb Smirnoff $$->next = NULL; 35383b3a8eb9SGleb Smirnoff $$->tail = $$; 35393b3a8eb9SGleb Smirnoff } 35403b3a8eb9SGleb Smirnoff | MAXSRCSTATES NUMBER { 35413b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 35423b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 35433b3a8eb9SGleb Smirnoff YYERROR; 35443b3a8eb9SGleb Smirnoff } 35453b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 35463b3a8eb9SGleb Smirnoff if ($$ == NULL) 35473b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 35483b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_STATES; 35493b3a8eb9SGleb Smirnoff $$->data.max_src_states = $2; 35503b3a8eb9SGleb Smirnoff $$->next = NULL; 35513b3a8eb9SGleb Smirnoff $$->tail = $$; 35523b3a8eb9SGleb Smirnoff } 35533b3a8eb9SGleb Smirnoff | MAXSRCCONN NUMBER { 35543b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 35553b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 35563b3a8eb9SGleb Smirnoff YYERROR; 35573b3a8eb9SGleb Smirnoff } 35583b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 35593b3a8eb9SGleb Smirnoff if ($$ == NULL) 35603b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 35613b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_CONN; 35623b3a8eb9SGleb Smirnoff $$->data.max_src_conn = $2; 35633b3a8eb9SGleb Smirnoff $$->next = NULL; 35643b3a8eb9SGleb Smirnoff $$->tail = $$; 35653b3a8eb9SGleb Smirnoff } 35663b3a8eb9SGleb Smirnoff | MAXSRCCONNRATE NUMBER '/' NUMBER { 35673b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX || 35683b3a8eb9SGleb Smirnoff $4 < 0 || $4 > UINT_MAX) { 35693b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 35703b3a8eb9SGleb Smirnoff YYERROR; 35713b3a8eb9SGleb Smirnoff } 35723b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 35733b3a8eb9SGleb Smirnoff if ($$ == NULL) 35743b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 35753b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 35763b3a8eb9SGleb Smirnoff $$->data.max_src_conn_rate.limit = $2; 35773b3a8eb9SGleb Smirnoff $$->data.max_src_conn_rate.seconds = $4; 35783b3a8eb9SGleb Smirnoff $$->next = NULL; 35793b3a8eb9SGleb Smirnoff $$->tail = $$; 35803b3a8eb9SGleb Smirnoff } 35813b3a8eb9SGleb Smirnoff | OVERLOAD '<' STRING '>' flush { 35823b3a8eb9SGleb Smirnoff if (strlen($3) >= PF_TABLE_NAME_SIZE) { 35833b3a8eb9SGleb Smirnoff yyerror("table name '%s' too long", $3); 35843b3a8eb9SGleb Smirnoff free($3); 35853b3a8eb9SGleb Smirnoff YYERROR; 35863b3a8eb9SGleb Smirnoff } 35873b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 35883b3a8eb9SGleb Smirnoff if ($$ == NULL) 35893b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 35903b3a8eb9SGleb Smirnoff if (strlcpy($$->data.overload.tblname, $3, 35913b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 35923b3a8eb9SGleb Smirnoff errx(1, "state_opt_item: strlcpy"); 35933b3a8eb9SGleb Smirnoff free($3); 35943b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_OVERLOAD; 35953b3a8eb9SGleb Smirnoff $$->data.overload.flush = $5; 35963b3a8eb9SGleb Smirnoff $$->next = NULL; 35973b3a8eb9SGleb Smirnoff $$->tail = $$; 35983b3a8eb9SGleb Smirnoff } 35993b3a8eb9SGleb Smirnoff | MAXSRCNODES NUMBER { 36003b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 36013b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 36023b3a8eb9SGleb Smirnoff YYERROR; 36033b3a8eb9SGleb Smirnoff } 36043b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 36053b3a8eb9SGleb Smirnoff if ($$ == NULL) 36063b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 36073b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_NODES; 36083b3a8eb9SGleb Smirnoff $$->data.max_src_nodes = $2; 36093b3a8eb9SGleb Smirnoff $$->next = NULL; 36103b3a8eb9SGleb Smirnoff $$->tail = $$; 36113b3a8eb9SGleb Smirnoff } 36123b3a8eb9SGleb Smirnoff | sourcetrack { 36133b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 36143b3a8eb9SGleb Smirnoff if ($$ == NULL) 36153b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 36163b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_SRCTRACK; 36173b3a8eb9SGleb Smirnoff $$->data.src_track = $1; 36183b3a8eb9SGleb Smirnoff $$->next = NULL; 36193b3a8eb9SGleb Smirnoff $$->tail = $$; 36203b3a8eb9SGleb Smirnoff } 36213b3a8eb9SGleb Smirnoff | statelock { 36223b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 36233b3a8eb9SGleb Smirnoff if ($$ == NULL) 36243b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 36253b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_STATELOCK; 36263b3a8eb9SGleb Smirnoff $$->data.statelock = $1; 36273b3a8eb9SGleb Smirnoff $$->next = NULL; 36283b3a8eb9SGleb Smirnoff $$->tail = $$; 36293b3a8eb9SGleb Smirnoff } 36303b3a8eb9SGleb Smirnoff | SLOPPY { 36313b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 36323b3a8eb9SGleb Smirnoff if ($$ == NULL) 36333b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 36343b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_SLOPPY; 36353b3a8eb9SGleb Smirnoff $$->next = NULL; 36363b3a8eb9SGleb Smirnoff $$->tail = $$; 36373b3a8eb9SGleb Smirnoff } 36383b3a8eb9SGleb Smirnoff | STRING NUMBER { 36393b3a8eb9SGleb Smirnoff int i; 36403b3a8eb9SGleb Smirnoff 36413b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 36423b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 36433b3a8eb9SGleb Smirnoff YYERROR; 36443b3a8eb9SGleb Smirnoff } 36453b3a8eb9SGleb Smirnoff for (i = 0; pf_timeouts[i].name && 36463b3a8eb9SGleb Smirnoff strcmp(pf_timeouts[i].name, $1); ++i) 36473b3a8eb9SGleb Smirnoff ; /* nothing */ 36483b3a8eb9SGleb Smirnoff if (!pf_timeouts[i].name) { 36493b3a8eb9SGleb Smirnoff yyerror("illegal timeout name %s", $1); 36503b3a8eb9SGleb Smirnoff free($1); 36513b3a8eb9SGleb Smirnoff YYERROR; 36523b3a8eb9SGleb Smirnoff } 36533b3a8eb9SGleb Smirnoff if (strchr(pf_timeouts[i].name, '.') == NULL) { 36543b3a8eb9SGleb Smirnoff yyerror("illegal state timeout %s", $1); 36553b3a8eb9SGleb Smirnoff free($1); 36563b3a8eb9SGleb Smirnoff YYERROR; 36573b3a8eb9SGleb Smirnoff } 36583b3a8eb9SGleb Smirnoff free($1); 36593b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 36603b3a8eb9SGleb Smirnoff if ($$ == NULL) 36613b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 36623b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_TIMEOUT; 36633b3a8eb9SGleb Smirnoff $$->data.timeout.number = pf_timeouts[i].timeout; 36643b3a8eb9SGleb Smirnoff $$->data.timeout.seconds = $2; 36653b3a8eb9SGleb Smirnoff $$->next = NULL; 36663b3a8eb9SGleb Smirnoff $$->tail = $$; 36673b3a8eb9SGleb Smirnoff } 36683b3a8eb9SGleb Smirnoff ; 36693b3a8eb9SGleb Smirnoff 36703b3a8eb9SGleb Smirnoff label : LABEL STRING { 36713b3a8eb9SGleb Smirnoff $$ = $2; 36723b3a8eb9SGleb Smirnoff } 36733b3a8eb9SGleb Smirnoff ; 36743b3a8eb9SGleb Smirnoff 36753b3a8eb9SGleb Smirnoff qname : QUEUE STRING { 36763b3a8eb9SGleb Smirnoff $$.qname = $2; 36773b3a8eb9SGleb Smirnoff $$.pqname = NULL; 36783b3a8eb9SGleb Smirnoff } 36793b3a8eb9SGleb Smirnoff | QUEUE '(' STRING ')' { 36803b3a8eb9SGleb Smirnoff $$.qname = $3; 36813b3a8eb9SGleb Smirnoff $$.pqname = NULL; 36823b3a8eb9SGleb Smirnoff } 36833b3a8eb9SGleb Smirnoff | QUEUE '(' STRING comma STRING ')' { 36843b3a8eb9SGleb Smirnoff $$.qname = $3; 36853b3a8eb9SGleb Smirnoff $$.pqname = $5; 36863b3a8eb9SGleb Smirnoff } 36873b3a8eb9SGleb Smirnoff ; 36883b3a8eb9SGleb Smirnoff 36893b3a8eb9SGleb Smirnoff no : /* empty */ { $$ = 0; } 36903b3a8eb9SGleb Smirnoff | NO { $$ = 1; } 36913b3a8eb9SGleb Smirnoff ; 36923b3a8eb9SGleb Smirnoff 36933b3a8eb9SGleb Smirnoff portstar : numberstring { 36943b3a8eb9SGleb Smirnoff if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 36953b3a8eb9SGleb Smirnoff free($1); 36963b3a8eb9SGleb Smirnoff YYERROR; 36973b3a8eb9SGleb Smirnoff } 36983b3a8eb9SGleb Smirnoff free($1); 36993b3a8eb9SGleb Smirnoff } 37003b3a8eb9SGleb Smirnoff ; 37013b3a8eb9SGleb Smirnoff 37023b3a8eb9SGleb Smirnoff redirspec : host { $$ = $1; } 37033b3a8eb9SGleb Smirnoff | '{' optnl redir_host_list '}' { $$ = $3; } 37043b3a8eb9SGleb Smirnoff ; 37053b3a8eb9SGleb Smirnoff 37063b3a8eb9SGleb Smirnoff redir_host_list : host optnl { $$ = $1; } 37073b3a8eb9SGleb Smirnoff | redir_host_list comma host optnl { 37083b3a8eb9SGleb Smirnoff $1->tail->next = $3; 37093b3a8eb9SGleb Smirnoff $1->tail = $3->tail; 37103b3a8eb9SGleb Smirnoff $$ = $1; 37113b3a8eb9SGleb Smirnoff } 37123b3a8eb9SGleb Smirnoff ; 37133b3a8eb9SGleb Smirnoff 37143b3a8eb9SGleb Smirnoff redirpool : /* empty */ { $$ = NULL; } 37153b3a8eb9SGleb Smirnoff | ARROW redirspec { 37163b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 37173b3a8eb9SGleb Smirnoff if ($$ == NULL) 37183b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 37193b3a8eb9SGleb Smirnoff $$->host = $2; 37203b3a8eb9SGleb Smirnoff $$->rport.a = $$->rport.b = $$->rport.t = 0; 37213b3a8eb9SGleb Smirnoff } 37223b3a8eb9SGleb Smirnoff | ARROW redirspec PORT portstar { 37233b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 37243b3a8eb9SGleb Smirnoff if ($$ == NULL) 37253b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 37263b3a8eb9SGleb Smirnoff $$->host = $2; 37273b3a8eb9SGleb Smirnoff $$->rport = $4; 37283b3a8eb9SGleb Smirnoff } 37293b3a8eb9SGleb Smirnoff ; 37303b3a8eb9SGleb Smirnoff 37313b3a8eb9SGleb Smirnoff hashkey : /* empty */ 37323b3a8eb9SGleb Smirnoff { 37333b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct pf_poolhashkey)); 37343b3a8eb9SGleb Smirnoff if ($$ == NULL) 37353b3a8eb9SGleb Smirnoff err(1, "hashkey: calloc"); 37363b3a8eb9SGleb Smirnoff $$->key32[0] = arc4random(); 37373b3a8eb9SGleb Smirnoff $$->key32[1] = arc4random(); 37383b3a8eb9SGleb Smirnoff $$->key32[2] = arc4random(); 37393b3a8eb9SGleb Smirnoff $$->key32[3] = arc4random(); 37403b3a8eb9SGleb Smirnoff } 37413b3a8eb9SGleb Smirnoff | string 37423b3a8eb9SGleb Smirnoff { 37433b3a8eb9SGleb Smirnoff if (!strncmp($1, "0x", 2)) { 37443b3a8eb9SGleb Smirnoff if (strlen($1) != 34) { 37453b3a8eb9SGleb Smirnoff free($1); 37463b3a8eb9SGleb Smirnoff yyerror("hex key must be 128 bits " 37473b3a8eb9SGleb Smirnoff "(32 hex digits) long"); 37483b3a8eb9SGleb Smirnoff YYERROR; 37493b3a8eb9SGleb Smirnoff } 37503b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct pf_poolhashkey)); 37513b3a8eb9SGleb Smirnoff if ($$ == NULL) 37523b3a8eb9SGleb Smirnoff err(1, "hashkey: calloc"); 37533b3a8eb9SGleb Smirnoff 37543b3a8eb9SGleb Smirnoff if (sscanf($1, "0x%8x%8x%8x%8x", 37553b3a8eb9SGleb Smirnoff &$$->key32[0], &$$->key32[1], 37563b3a8eb9SGleb Smirnoff &$$->key32[2], &$$->key32[3]) != 4) { 37573b3a8eb9SGleb Smirnoff free($$); 37583b3a8eb9SGleb Smirnoff free($1); 37593b3a8eb9SGleb Smirnoff yyerror("invalid hex key"); 37603b3a8eb9SGleb Smirnoff YYERROR; 37613b3a8eb9SGleb Smirnoff } 37623b3a8eb9SGleb Smirnoff } else { 37633b3a8eb9SGleb Smirnoff MD5_CTX context; 37643b3a8eb9SGleb Smirnoff 37653b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct pf_poolhashkey)); 37663b3a8eb9SGleb Smirnoff if ($$ == NULL) 37673b3a8eb9SGleb Smirnoff err(1, "hashkey: calloc"); 37683b3a8eb9SGleb Smirnoff MD5Init(&context); 37693b3a8eb9SGleb Smirnoff MD5Update(&context, (unsigned char *)$1, 37703b3a8eb9SGleb Smirnoff strlen($1)); 37713b3a8eb9SGleb Smirnoff MD5Final((unsigned char *)$$, &context); 37723b3a8eb9SGleb Smirnoff HTONL($$->key32[0]); 37733b3a8eb9SGleb Smirnoff HTONL($$->key32[1]); 37743b3a8eb9SGleb Smirnoff HTONL($$->key32[2]); 37753b3a8eb9SGleb Smirnoff HTONL($$->key32[3]); 37763b3a8eb9SGleb Smirnoff } 37773b3a8eb9SGleb Smirnoff free($1); 37783b3a8eb9SGleb Smirnoff } 37793b3a8eb9SGleb Smirnoff ; 37803b3a8eb9SGleb Smirnoff 37813b3a8eb9SGleb Smirnoff pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 37823b3a8eb9SGleb Smirnoff pool_opts_l 37833b3a8eb9SGleb Smirnoff { $$ = pool_opts; } 37843b3a8eb9SGleb Smirnoff | /* empty */ { 37853b3a8eb9SGleb Smirnoff bzero(&pool_opts, sizeof pool_opts); 37863b3a8eb9SGleb Smirnoff $$ = pool_opts; 37873b3a8eb9SGleb Smirnoff } 37883b3a8eb9SGleb Smirnoff ; 37893b3a8eb9SGleb Smirnoff 37903b3a8eb9SGleb Smirnoff pool_opts_l : pool_opts_l pool_opt 37913b3a8eb9SGleb Smirnoff | pool_opt 37923b3a8eb9SGleb Smirnoff ; 37933b3a8eb9SGleb Smirnoff 37943b3a8eb9SGleb Smirnoff pool_opt : BITMASK { 37953b3a8eb9SGleb Smirnoff if (pool_opts.type) { 37963b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 37973b3a8eb9SGleb Smirnoff YYERROR; 37983b3a8eb9SGleb Smirnoff } 37993b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_BITMASK; 38003b3a8eb9SGleb Smirnoff } 38013b3a8eb9SGleb Smirnoff | RANDOM { 38023b3a8eb9SGleb Smirnoff if (pool_opts.type) { 38033b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 38043b3a8eb9SGleb Smirnoff YYERROR; 38053b3a8eb9SGleb Smirnoff } 38063b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_RANDOM; 38073b3a8eb9SGleb Smirnoff } 38083b3a8eb9SGleb Smirnoff | SOURCEHASH hashkey { 38093b3a8eb9SGleb Smirnoff if (pool_opts.type) { 38103b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 38113b3a8eb9SGleb Smirnoff YYERROR; 38123b3a8eb9SGleb Smirnoff } 38133b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_SRCHASH; 38143b3a8eb9SGleb Smirnoff pool_opts.key = $2; 38153b3a8eb9SGleb Smirnoff } 38163b3a8eb9SGleb Smirnoff | ROUNDROBIN { 38173b3a8eb9SGleb Smirnoff if (pool_opts.type) { 38183b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 38193b3a8eb9SGleb Smirnoff YYERROR; 38203b3a8eb9SGleb Smirnoff } 38213b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_ROUNDROBIN; 38223b3a8eb9SGleb Smirnoff } 38233b3a8eb9SGleb Smirnoff | STATICPORT { 38243b3a8eb9SGleb Smirnoff if (pool_opts.staticport) { 38253b3a8eb9SGleb Smirnoff yyerror("static-port cannot be redefined"); 38263b3a8eb9SGleb Smirnoff YYERROR; 38273b3a8eb9SGleb Smirnoff } 38283b3a8eb9SGleb Smirnoff pool_opts.staticport = 1; 38293b3a8eb9SGleb Smirnoff } 38303b3a8eb9SGleb Smirnoff | STICKYADDRESS { 38313b3a8eb9SGleb Smirnoff if (filter_opts.marker & POM_STICKYADDRESS) { 38323b3a8eb9SGleb Smirnoff yyerror("sticky-address cannot be redefined"); 38333b3a8eb9SGleb Smirnoff YYERROR; 38343b3a8eb9SGleb Smirnoff } 38353b3a8eb9SGleb Smirnoff pool_opts.marker |= POM_STICKYADDRESS; 38363b3a8eb9SGleb Smirnoff pool_opts.opts |= PF_POOL_STICKYADDR; 38373b3a8eb9SGleb Smirnoff } 38383b3a8eb9SGleb Smirnoff ; 38393b3a8eb9SGleb Smirnoff 38403b3a8eb9SGleb Smirnoff redirection : /* empty */ { $$ = NULL; } 38413b3a8eb9SGleb Smirnoff | ARROW host { 38423b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 38433b3a8eb9SGleb Smirnoff if ($$ == NULL) 38443b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 38453b3a8eb9SGleb Smirnoff $$->host = $2; 38463b3a8eb9SGleb Smirnoff $$->rport.a = $$->rport.b = $$->rport.t = 0; 38473b3a8eb9SGleb Smirnoff } 38483b3a8eb9SGleb Smirnoff | ARROW host PORT portstar { 38493b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 38503b3a8eb9SGleb Smirnoff if ($$ == NULL) 38513b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 38523b3a8eb9SGleb Smirnoff $$->host = $2; 38533b3a8eb9SGleb Smirnoff $$->rport = $4; 38543b3a8eb9SGleb Smirnoff } 38553b3a8eb9SGleb Smirnoff ; 38563b3a8eb9SGleb Smirnoff 38573b3a8eb9SGleb Smirnoff natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 38583b3a8eb9SGleb Smirnoff | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 38593b3a8eb9SGleb Smirnoff | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 38603b3a8eb9SGleb Smirnoff | log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; } 38613b3a8eb9SGleb Smirnoff ; 38623b3a8eb9SGleb Smirnoff 38633b3a8eb9SGleb Smirnoff nataction : no NAT natpasslog { 38643b3a8eb9SGleb Smirnoff if ($1 && $3.b1) { 38653b3a8eb9SGleb Smirnoff yyerror("\"pass\" not valid with \"no\""); 38663b3a8eb9SGleb Smirnoff YYERROR; 38673b3a8eb9SGleb Smirnoff } 38683b3a8eb9SGleb Smirnoff if ($1) 38693b3a8eb9SGleb Smirnoff $$.b1 = PF_NONAT; 38703b3a8eb9SGleb Smirnoff else 38713b3a8eb9SGleb Smirnoff $$.b1 = PF_NAT; 38723b3a8eb9SGleb Smirnoff $$.b2 = $3.b1; 38733b3a8eb9SGleb Smirnoff $$.w = $3.b2; 38743b3a8eb9SGleb Smirnoff $$.w2 = $3.w2; 38753b3a8eb9SGleb Smirnoff } 38763b3a8eb9SGleb Smirnoff | no RDR natpasslog { 38773b3a8eb9SGleb Smirnoff if ($1 && $3.b1) { 38783b3a8eb9SGleb Smirnoff yyerror("\"pass\" not valid with \"no\""); 38793b3a8eb9SGleb Smirnoff YYERROR; 38803b3a8eb9SGleb Smirnoff } 38813b3a8eb9SGleb Smirnoff if ($1) 38823b3a8eb9SGleb Smirnoff $$.b1 = PF_NORDR; 38833b3a8eb9SGleb Smirnoff else 38843b3a8eb9SGleb Smirnoff $$.b1 = PF_RDR; 38853b3a8eb9SGleb Smirnoff $$.b2 = $3.b1; 38863b3a8eb9SGleb Smirnoff $$.w = $3.b2; 38873b3a8eb9SGleb Smirnoff $$.w2 = $3.w2; 38883b3a8eb9SGleb Smirnoff } 38893b3a8eb9SGleb Smirnoff ; 38903b3a8eb9SGleb Smirnoff 38913b3a8eb9SGleb Smirnoff natrule : nataction interface af proto fromto tag tagged rtable 38923b3a8eb9SGleb Smirnoff redirpool pool_opts 38933b3a8eb9SGleb Smirnoff { 38943b3a8eb9SGleb Smirnoff struct pf_rule r; 38953b3a8eb9SGleb Smirnoff 38963b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) 38973b3a8eb9SGleb Smirnoff YYERROR; 38983b3a8eb9SGleb Smirnoff 38993b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 39003b3a8eb9SGleb Smirnoff 39013b3a8eb9SGleb Smirnoff r.action = $1.b1; 39023b3a8eb9SGleb Smirnoff r.natpass = $1.b2; 39033b3a8eb9SGleb Smirnoff r.log = $1.w; 39043b3a8eb9SGleb Smirnoff r.logif = $1.w2; 39053b3a8eb9SGleb Smirnoff r.af = $3; 39063b3a8eb9SGleb Smirnoff 39073b3a8eb9SGleb Smirnoff if (!r.af) { 39083b3a8eb9SGleb Smirnoff if ($5.src.host && $5.src.host->af && 39093b3a8eb9SGleb Smirnoff !$5.src.host->ifindex) 39103b3a8eb9SGleb Smirnoff r.af = $5.src.host->af; 39113b3a8eb9SGleb Smirnoff else if ($5.dst.host && $5.dst.host->af && 39123b3a8eb9SGleb Smirnoff !$5.dst.host->ifindex) 39133b3a8eb9SGleb Smirnoff r.af = $5.dst.host->af; 39143b3a8eb9SGleb Smirnoff } 39153b3a8eb9SGleb Smirnoff 39163b3a8eb9SGleb Smirnoff if ($6 != NULL) 39173b3a8eb9SGleb Smirnoff if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 39183b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) { 39193b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 39203b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 39213b3a8eb9SGleb Smirnoff YYERROR; 39223b3a8eb9SGleb Smirnoff } 39233b3a8eb9SGleb Smirnoff 39243b3a8eb9SGleb Smirnoff if ($7.name) 39253b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $7.name, 39263b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 39273b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 39283b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 39293b3a8eb9SGleb Smirnoff YYERROR; 39303b3a8eb9SGleb Smirnoff } 39313b3a8eb9SGleb Smirnoff r.match_tag_not = $7.neg; 39323b3a8eb9SGleb Smirnoff r.rtableid = $8; 39333b3a8eb9SGleb Smirnoff 39343b3a8eb9SGleb Smirnoff if (r.action == PF_NONAT || r.action == PF_NORDR) { 39353b3a8eb9SGleb Smirnoff if ($9 != NULL) { 39363b3a8eb9SGleb Smirnoff yyerror("translation rule with 'no' " 39373b3a8eb9SGleb Smirnoff "does not need '->'"); 39383b3a8eb9SGleb Smirnoff YYERROR; 39393b3a8eb9SGleb Smirnoff } 39403b3a8eb9SGleb Smirnoff } else { 39413b3a8eb9SGleb Smirnoff if ($9 == NULL || $9->host == NULL) { 39423b3a8eb9SGleb Smirnoff yyerror("translation rule requires '-> " 39433b3a8eb9SGleb Smirnoff "address'"); 39443b3a8eb9SGleb Smirnoff YYERROR; 39453b3a8eb9SGleb Smirnoff } 39463b3a8eb9SGleb Smirnoff if (!r.af && ! $9->host->ifindex) 39473b3a8eb9SGleb Smirnoff r.af = $9->host->af; 39483b3a8eb9SGleb Smirnoff 39493b3a8eb9SGleb Smirnoff remove_invalid_hosts(&$9->host, &r.af); 39503b3a8eb9SGleb Smirnoff if (invalid_redirect($9->host, r.af)) 39513b3a8eb9SGleb Smirnoff YYERROR; 39523b3a8eb9SGleb Smirnoff if (check_netmask($9->host, r.af)) 39533b3a8eb9SGleb Smirnoff YYERROR; 39543b3a8eb9SGleb Smirnoff 39553b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0] = ntohs($9->rport.a); 39563b3a8eb9SGleb Smirnoff 39573b3a8eb9SGleb Smirnoff switch (r.action) { 39583b3a8eb9SGleb Smirnoff case PF_RDR: 39593b3a8eb9SGleb Smirnoff if (!$9->rport.b && $9->rport.t && 39603b3a8eb9SGleb Smirnoff $5.dst.port != NULL) { 39613b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 39623b3a8eb9SGleb Smirnoff ntohs($9->rport.a) + 39633b3a8eb9SGleb Smirnoff (ntohs( 39643b3a8eb9SGleb Smirnoff $5.dst.port->port[1]) - 39653b3a8eb9SGleb Smirnoff ntohs( 39663b3a8eb9SGleb Smirnoff $5.dst.port->port[0])); 39673b3a8eb9SGleb Smirnoff } else 39683b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 39693b3a8eb9SGleb Smirnoff ntohs($9->rport.b); 39703b3a8eb9SGleb Smirnoff break; 39713b3a8eb9SGleb Smirnoff case PF_NAT: 39723b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 39733b3a8eb9SGleb Smirnoff ntohs($9->rport.b); 39743b3a8eb9SGleb Smirnoff if (!r.rpool.proxy_port[0] && 39753b3a8eb9SGleb Smirnoff !r.rpool.proxy_port[1]) { 39763b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0] = 39773b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_LOW; 39783b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 39793b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_HIGH; 39803b3a8eb9SGleb Smirnoff } else if (!r.rpool.proxy_port[1]) 39813b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 39823b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0]; 39833b3a8eb9SGleb Smirnoff break; 39843b3a8eb9SGleb Smirnoff default: 39853b3a8eb9SGleb Smirnoff break; 39863b3a8eb9SGleb Smirnoff } 39873b3a8eb9SGleb Smirnoff 39883b3a8eb9SGleb Smirnoff r.rpool.opts = $10.type; 39893b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) == 39903b3a8eb9SGleb Smirnoff PF_POOL_NONE && ($9->host->next != NULL || 39913b3a8eb9SGleb Smirnoff $9->host->addr.type == PF_ADDR_TABLE || 39923b3a8eb9SGleb Smirnoff DYNIF_MULTIADDR($9->host->addr))) 39933b3a8eb9SGleb Smirnoff r.rpool.opts = PF_POOL_ROUNDROBIN; 39943b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 39953b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 39963b3a8eb9SGleb Smirnoff disallow_table($9->host, "tables are only " 39973b3a8eb9SGleb Smirnoff "supported in round-robin redirection " 39983b3a8eb9SGleb Smirnoff "pools")) 39993b3a8eb9SGleb Smirnoff YYERROR; 40003b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 40013b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 40023b3a8eb9SGleb Smirnoff disallow_alias($9->host, "interface (%s) " 40033b3a8eb9SGleb Smirnoff "is only supported in round-robin " 40043b3a8eb9SGleb Smirnoff "redirection pools")) 40053b3a8eb9SGleb Smirnoff YYERROR; 40063b3a8eb9SGleb Smirnoff if ($9->host->next != NULL) { 40073b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 40083b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN) { 40093b3a8eb9SGleb Smirnoff yyerror("only round-robin " 40103b3a8eb9SGleb Smirnoff "valid for multiple " 40113b3a8eb9SGleb Smirnoff "redirection addresses"); 40123b3a8eb9SGleb Smirnoff YYERROR; 40133b3a8eb9SGleb Smirnoff } 40143b3a8eb9SGleb Smirnoff } 40153b3a8eb9SGleb Smirnoff } 40163b3a8eb9SGleb Smirnoff 40173b3a8eb9SGleb Smirnoff if ($10.key != NULL) 40183b3a8eb9SGleb Smirnoff memcpy(&r.rpool.key, $10.key, 40193b3a8eb9SGleb Smirnoff sizeof(struct pf_poolhashkey)); 40203b3a8eb9SGleb Smirnoff 40213b3a8eb9SGleb Smirnoff if ($10.opts) 40223b3a8eb9SGleb Smirnoff r.rpool.opts |= $10.opts; 40233b3a8eb9SGleb Smirnoff 40243b3a8eb9SGleb Smirnoff if ($10.staticport) { 40253b3a8eb9SGleb Smirnoff if (r.action != PF_NAT) { 40263b3a8eb9SGleb Smirnoff yyerror("the 'static-port' option is " 40273b3a8eb9SGleb Smirnoff "only valid with nat rules"); 40283b3a8eb9SGleb Smirnoff YYERROR; 40293b3a8eb9SGleb Smirnoff } 40303b3a8eb9SGleb Smirnoff if (r.rpool.proxy_port[0] != 40313b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_LOW && 40323b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] != 40333b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_HIGH) { 40343b3a8eb9SGleb Smirnoff yyerror("the 'static-port' option can't" 40353b3a8eb9SGleb Smirnoff " be used when specifying a port" 40363b3a8eb9SGleb Smirnoff " range"); 40373b3a8eb9SGleb Smirnoff YYERROR; 40383b3a8eb9SGleb Smirnoff } 40393b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0] = 0; 40403b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 0; 40413b3a8eb9SGleb Smirnoff } 40423b3a8eb9SGleb Smirnoff 40433b3a8eb9SGleb Smirnoff expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 40443b3a8eb9SGleb Smirnoff $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 40453b3a8eb9SGleb Smirnoff $5.dst.port, 0, 0, 0, ""); 40463b3a8eb9SGleb Smirnoff free($9); 40473b3a8eb9SGleb Smirnoff } 40483b3a8eb9SGleb Smirnoff ; 40493b3a8eb9SGleb Smirnoff 40503b3a8eb9SGleb Smirnoff binatrule : no BINAT natpasslog interface af proto FROM host toipspec tag 40513b3a8eb9SGleb Smirnoff tagged rtable redirection 40523b3a8eb9SGleb Smirnoff { 40533b3a8eb9SGleb Smirnoff struct pf_rule binat; 40543b3a8eb9SGleb Smirnoff struct pf_pooladdr *pa; 40553b3a8eb9SGleb Smirnoff 40563b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) 40573b3a8eb9SGleb Smirnoff YYERROR; 40583b3a8eb9SGleb Smirnoff if (disallow_urpf_failed($9, "\"urpf-failed\" is not " 40593b3a8eb9SGleb Smirnoff "permitted as a binat destination")) 40603b3a8eb9SGleb Smirnoff YYERROR; 40613b3a8eb9SGleb Smirnoff 40623b3a8eb9SGleb Smirnoff memset(&binat, 0, sizeof(binat)); 40633b3a8eb9SGleb Smirnoff 40643b3a8eb9SGleb Smirnoff if ($1 && $3.b1) { 40653b3a8eb9SGleb Smirnoff yyerror("\"pass\" not valid with \"no\""); 40663b3a8eb9SGleb Smirnoff YYERROR; 40673b3a8eb9SGleb Smirnoff } 40683b3a8eb9SGleb Smirnoff if ($1) 40693b3a8eb9SGleb Smirnoff binat.action = PF_NOBINAT; 40703b3a8eb9SGleb Smirnoff else 40713b3a8eb9SGleb Smirnoff binat.action = PF_BINAT; 40723b3a8eb9SGleb Smirnoff binat.natpass = $3.b1; 40733b3a8eb9SGleb Smirnoff binat.log = $3.b2; 40743b3a8eb9SGleb Smirnoff binat.logif = $3.w2; 40753b3a8eb9SGleb Smirnoff binat.af = $5; 40763b3a8eb9SGleb Smirnoff if (!binat.af && $8 != NULL && $8->af) 40773b3a8eb9SGleb Smirnoff binat.af = $8->af; 40783b3a8eb9SGleb Smirnoff if (!binat.af && $9 != NULL && $9->af) 40793b3a8eb9SGleb Smirnoff binat.af = $9->af; 40803b3a8eb9SGleb Smirnoff 40813b3a8eb9SGleb Smirnoff if (!binat.af && $13 != NULL && $13->host) 40823b3a8eb9SGleb Smirnoff binat.af = $13->host->af; 40833b3a8eb9SGleb Smirnoff if (!binat.af) { 40843b3a8eb9SGleb Smirnoff yyerror("address family (inet/inet6) " 40853b3a8eb9SGleb Smirnoff "undefined"); 40863b3a8eb9SGleb Smirnoff YYERROR; 40873b3a8eb9SGleb Smirnoff } 40883b3a8eb9SGleb Smirnoff 40893b3a8eb9SGleb Smirnoff if ($4 != NULL) { 40903b3a8eb9SGleb Smirnoff memcpy(binat.ifname, $4->ifname, 40913b3a8eb9SGleb Smirnoff sizeof(binat.ifname)); 40923b3a8eb9SGleb Smirnoff binat.ifnot = $4->not; 40933b3a8eb9SGleb Smirnoff free($4); 40943b3a8eb9SGleb Smirnoff } 40953b3a8eb9SGleb Smirnoff 40963b3a8eb9SGleb Smirnoff if ($10 != NULL) 40973b3a8eb9SGleb Smirnoff if (strlcpy(binat.tagname, $10, 40983b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 40993b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 41003b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 41013b3a8eb9SGleb Smirnoff YYERROR; 41023b3a8eb9SGleb Smirnoff } 41033b3a8eb9SGleb Smirnoff if ($11.name) 41043b3a8eb9SGleb Smirnoff if (strlcpy(binat.match_tagname, $11.name, 41053b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 41063b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 41073b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 41083b3a8eb9SGleb Smirnoff YYERROR; 41093b3a8eb9SGleb Smirnoff } 41103b3a8eb9SGleb Smirnoff binat.match_tag_not = $11.neg; 41113b3a8eb9SGleb Smirnoff binat.rtableid = $12; 41123b3a8eb9SGleb Smirnoff 41133b3a8eb9SGleb Smirnoff if ($6 != NULL) { 41143b3a8eb9SGleb Smirnoff binat.proto = $6->proto; 41153b3a8eb9SGleb Smirnoff free($6); 41163b3a8eb9SGleb Smirnoff } 41173b3a8eb9SGleb Smirnoff 41183b3a8eb9SGleb Smirnoff if ($8 != NULL && disallow_table($8, "invalid use of " 41193b3a8eb9SGleb Smirnoff "table <%s> as the source address of a binat rule")) 41203b3a8eb9SGleb Smirnoff YYERROR; 41213b3a8eb9SGleb Smirnoff if ($8 != NULL && disallow_alias($8, "invalid use of " 41223b3a8eb9SGleb Smirnoff "interface (%s) as the source address of a binat " 41233b3a8eb9SGleb Smirnoff "rule")) 41243b3a8eb9SGleb Smirnoff YYERROR; 41253b3a8eb9SGleb Smirnoff if ($13 != NULL && $13->host != NULL && disallow_table( 41263b3a8eb9SGleb Smirnoff $13->host, "invalid use of table <%s> as the " 41273b3a8eb9SGleb Smirnoff "redirect address of a binat rule")) 41283b3a8eb9SGleb Smirnoff YYERROR; 41293b3a8eb9SGleb Smirnoff if ($13 != NULL && $13->host != NULL && disallow_alias( 41303b3a8eb9SGleb Smirnoff $13->host, "invalid use of interface (%s) as the " 41313b3a8eb9SGleb Smirnoff "redirect address of a binat rule")) 41323b3a8eb9SGleb Smirnoff YYERROR; 41333b3a8eb9SGleb Smirnoff 41343b3a8eb9SGleb Smirnoff if ($8 != NULL) { 41353b3a8eb9SGleb Smirnoff if ($8->next) { 41363b3a8eb9SGleb Smirnoff yyerror("multiple binat ip addresses"); 41373b3a8eb9SGleb Smirnoff YYERROR; 41383b3a8eb9SGleb Smirnoff } 41393b3a8eb9SGleb Smirnoff if ($8->addr.type == PF_ADDR_DYNIFTL) 41403b3a8eb9SGleb Smirnoff $8->af = binat.af; 41413b3a8eb9SGleb Smirnoff if ($8->af != binat.af) { 41423b3a8eb9SGleb Smirnoff yyerror("binat ip versions must match"); 41433b3a8eb9SGleb Smirnoff YYERROR; 41443b3a8eb9SGleb Smirnoff } 41453b3a8eb9SGleb Smirnoff if (check_netmask($8, binat.af)) 41463b3a8eb9SGleb Smirnoff YYERROR; 41473b3a8eb9SGleb Smirnoff memcpy(&binat.src.addr, &$8->addr, 41483b3a8eb9SGleb Smirnoff sizeof(binat.src.addr)); 41493b3a8eb9SGleb Smirnoff free($8); 41503b3a8eb9SGleb Smirnoff } 41513b3a8eb9SGleb Smirnoff if ($9 != NULL) { 41523b3a8eb9SGleb Smirnoff if ($9->next) { 41533b3a8eb9SGleb Smirnoff yyerror("multiple binat ip addresses"); 41543b3a8eb9SGleb Smirnoff YYERROR; 41553b3a8eb9SGleb Smirnoff } 41563b3a8eb9SGleb Smirnoff if ($9->af != binat.af && $9->af) { 41573b3a8eb9SGleb Smirnoff yyerror("binat ip versions must match"); 41583b3a8eb9SGleb Smirnoff YYERROR; 41593b3a8eb9SGleb Smirnoff } 41603b3a8eb9SGleb Smirnoff if (check_netmask($9, binat.af)) 41613b3a8eb9SGleb Smirnoff YYERROR; 41623b3a8eb9SGleb Smirnoff memcpy(&binat.dst.addr, &$9->addr, 41633b3a8eb9SGleb Smirnoff sizeof(binat.dst.addr)); 41643b3a8eb9SGleb Smirnoff binat.dst.neg = $9->not; 41653b3a8eb9SGleb Smirnoff free($9); 41663b3a8eb9SGleb Smirnoff } 41673b3a8eb9SGleb Smirnoff 41683b3a8eb9SGleb Smirnoff if (binat.action == PF_NOBINAT) { 41693b3a8eb9SGleb Smirnoff if ($13 != NULL) { 41703b3a8eb9SGleb Smirnoff yyerror("'no binat' rule does not need" 41713b3a8eb9SGleb Smirnoff " '->'"); 41723b3a8eb9SGleb Smirnoff YYERROR; 41733b3a8eb9SGleb Smirnoff } 41743b3a8eb9SGleb Smirnoff } else { 41753b3a8eb9SGleb Smirnoff if ($13 == NULL || $13->host == NULL) { 41763b3a8eb9SGleb Smirnoff yyerror("'binat' rule requires" 41773b3a8eb9SGleb Smirnoff " '-> address'"); 41783b3a8eb9SGleb Smirnoff YYERROR; 41793b3a8eb9SGleb Smirnoff } 41803b3a8eb9SGleb Smirnoff 41813b3a8eb9SGleb Smirnoff remove_invalid_hosts(&$13->host, &binat.af); 41823b3a8eb9SGleb Smirnoff if (invalid_redirect($13->host, binat.af)) 41833b3a8eb9SGleb Smirnoff YYERROR; 41843b3a8eb9SGleb Smirnoff if ($13->host->next != NULL) { 41853b3a8eb9SGleb Smirnoff yyerror("binat rule must redirect to " 41863b3a8eb9SGleb Smirnoff "a single address"); 41873b3a8eb9SGleb Smirnoff YYERROR; 41883b3a8eb9SGleb Smirnoff } 41893b3a8eb9SGleb Smirnoff if (check_netmask($13->host, binat.af)) 41903b3a8eb9SGleb Smirnoff YYERROR; 41913b3a8eb9SGleb Smirnoff 41923b3a8eb9SGleb Smirnoff if (!PF_AZERO(&binat.src.addr.v.a.mask, 41933b3a8eb9SGleb Smirnoff binat.af) && 41943b3a8eb9SGleb Smirnoff !PF_AEQ(&binat.src.addr.v.a.mask, 41953b3a8eb9SGleb Smirnoff &$13->host->addr.v.a.mask, binat.af)) { 41963b3a8eb9SGleb Smirnoff yyerror("'binat' source mask and " 41973b3a8eb9SGleb Smirnoff "redirect mask must be the same"); 41983b3a8eb9SGleb Smirnoff YYERROR; 41993b3a8eb9SGleb Smirnoff } 42003b3a8eb9SGleb Smirnoff 42013b3a8eb9SGleb Smirnoff TAILQ_INIT(&binat.rpool.list); 42023b3a8eb9SGleb Smirnoff pa = calloc(1, sizeof(struct pf_pooladdr)); 42033b3a8eb9SGleb Smirnoff if (pa == NULL) 42043b3a8eb9SGleb Smirnoff err(1, "binat: calloc"); 42053b3a8eb9SGleb Smirnoff pa->addr = $13->host->addr; 42063b3a8eb9SGleb Smirnoff pa->ifname[0] = 0; 42073b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&binat.rpool.list, 42083b3a8eb9SGleb Smirnoff pa, entries); 42093b3a8eb9SGleb Smirnoff 42103b3a8eb9SGleb Smirnoff free($13); 42113b3a8eb9SGleb Smirnoff } 42123b3a8eb9SGleb Smirnoff 42133b3a8eb9SGleb Smirnoff pfctl_add_rule(pf, &binat, ""); 42143b3a8eb9SGleb Smirnoff } 42153b3a8eb9SGleb Smirnoff ; 42163b3a8eb9SGleb Smirnoff 42173b3a8eb9SGleb Smirnoff tag : /* empty */ { $$ = NULL; } 42183b3a8eb9SGleb Smirnoff | TAG STRING { $$ = $2; } 42193b3a8eb9SGleb Smirnoff ; 42203b3a8eb9SGleb Smirnoff 42213b3a8eb9SGleb Smirnoff tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 42223b3a8eb9SGleb Smirnoff | not TAGGED string { $$.neg = $1; $$.name = $3; } 42233b3a8eb9SGleb Smirnoff ; 42243b3a8eb9SGleb Smirnoff 42253b3a8eb9SGleb Smirnoff rtable : /* empty */ { $$ = -1; } 42263b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 42273b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 42283b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 42293b3a8eb9SGleb Smirnoff YYERROR; 42303b3a8eb9SGleb Smirnoff } 42313b3a8eb9SGleb Smirnoff $$ = $2; 42323b3a8eb9SGleb Smirnoff } 42333b3a8eb9SGleb Smirnoff ; 42343b3a8eb9SGleb Smirnoff 42353b3a8eb9SGleb Smirnoff route_host : STRING { 42363b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 42373b3a8eb9SGleb Smirnoff if ($$ == NULL) 42383b3a8eb9SGleb Smirnoff err(1, "route_host: calloc"); 42393b3a8eb9SGleb Smirnoff $$->ifname = $1; 42403b3a8eb9SGleb Smirnoff set_ipmask($$, 128); 42413b3a8eb9SGleb Smirnoff $$->next = NULL; 42423b3a8eb9SGleb Smirnoff $$->tail = $$; 42433b3a8eb9SGleb Smirnoff } 42443b3a8eb9SGleb Smirnoff | '(' STRING host ')' { 42453b3a8eb9SGleb Smirnoff $$ = $3; 42463b3a8eb9SGleb Smirnoff $$->ifname = $2; 42473b3a8eb9SGleb Smirnoff } 42483b3a8eb9SGleb Smirnoff ; 42493b3a8eb9SGleb Smirnoff 42503b3a8eb9SGleb Smirnoff route_host_list : route_host optnl { $$ = $1; } 42513b3a8eb9SGleb Smirnoff | route_host_list comma route_host optnl { 42523b3a8eb9SGleb Smirnoff if ($1->af == 0) 42533b3a8eb9SGleb Smirnoff $1->af = $3->af; 42543b3a8eb9SGleb Smirnoff if ($1->af != $3->af) { 42553b3a8eb9SGleb Smirnoff yyerror("all pool addresses must be in the " 42563b3a8eb9SGleb Smirnoff "same address family"); 42573b3a8eb9SGleb Smirnoff YYERROR; 42583b3a8eb9SGleb Smirnoff } 42593b3a8eb9SGleb Smirnoff $1->tail->next = $3; 42603b3a8eb9SGleb Smirnoff $1->tail = $3->tail; 42613b3a8eb9SGleb Smirnoff $$ = $1; 42623b3a8eb9SGleb Smirnoff } 42633b3a8eb9SGleb Smirnoff ; 42643b3a8eb9SGleb Smirnoff 42653b3a8eb9SGleb Smirnoff routespec : route_host { $$ = $1; } 42663b3a8eb9SGleb Smirnoff | '{' optnl route_host_list '}' { $$ = $3; } 42673b3a8eb9SGleb Smirnoff ; 42683b3a8eb9SGleb Smirnoff 42693b3a8eb9SGleb Smirnoff route : /* empty */ { 42703b3a8eb9SGleb Smirnoff $$.host = NULL; 42713b3a8eb9SGleb Smirnoff $$.rt = 0; 42723b3a8eb9SGleb Smirnoff $$.pool_opts = 0; 42733b3a8eb9SGleb Smirnoff } 42743b3a8eb9SGleb Smirnoff | FASTROUTE { 42753b3a8eb9SGleb Smirnoff $$.host = NULL; 42763b3a8eb9SGleb Smirnoff $$.rt = PF_FASTROUTE; 42773b3a8eb9SGleb Smirnoff $$.pool_opts = 0; 42783b3a8eb9SGleb Smirnoff } 42793b3a8eb9SGleb Smirnoff | ROUTETO routespec pool_opts { 42803b3a8eb9SGleb Smirnoff $$.host = $2; 42813b3a8eb9SGleb Smirnoff $$.rt = PF_ROUTETO; 42823b3a8eb9SGleb Smirnoff $$.pool_opts = $3.type | $3.opts; 42833b3a8eb9SGleb Smirnoff if ($3.key != NULL) 42843b3a8eb9SGleb Smirnoff $$.key = $3.key; 42853b3a8eb9SGleb Smirnoff } 42863b3a8eb9SGleb Smirnoff | REPLYTO routespec pool_opts { 42873b3a8eb9SGleb Smirnoff $$.host = $2; 42883b3a8eb9SGleb Smirnoff $$.rt = PF_REPLYTO; 42893b3a8eb9SGleb Smirnoff $$.pool_opts = $3.type | $3.opts; 42903b3a8eb9SGleb Smirnoff if ($3.key != NULL) 42913b3a8eb9SGleb Smirnoff $$.key = $3.key; 42923b3a8eb9SGleb Smirnoff } 42933b3a8eb9SGleb Smirnoff | DUPTO routespec pool_opts { 42943b3a8eb9SGleb Smirnoff $$.host = $2; 42953b3a8eb9SGleb Smirnoff $$.rt = PF_DUPTO; 42963b3a8eb9SGleb Smirnoff $$.pool_opts = $3.type | $3.opts; 42973b3a8eb9SGleb Smirnoff if ($3.key != NULL) 42983b3a8eb9SGleb Smirnoff $$.key = $3.key; 42993b3a8eb9SGleb Smirnoff } 43003b3a8eb9SGleb Smirnoff ; 43013b3a8eb9SGleb Smirnoff 43023b3a8eb9SGleb Smirnoff timeout_spec : STRING NUMBER 43033b3a8eb9SGleb Smirnoff { 43043b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 43053b3a8eb9SGleb Smirnoff free($1); 43063b3a8eb9SGleb Smirnoff YYERROR; 43073b3a8eb9SGleb Smirnoff } 43083b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 43093b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 43103b3a8eb9SGleb Smirnoff YYERROR; 43113b3a8eb9SGleb Smirnoff } 43123b3a8eb9SGleb Smirnoff if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 43133b3a8eb9SGleb Smirnoff yyerror("unknown timeout %s", $1); 43143b3a8eb9SGleb Smirnoff free($1); 43153b3a8eb9SGleb Smirnoff YYERROR; 43163b3a8eb9SGleb Smirnoff } 43173b3a8eb9SGleb Smirnoff free($1); 43183b3a8eb9SGleb Smirnoff } 43193b3a8eb9SGleb Smirnoff ; 43203b3a8eb9SGleb Smirnoff 43213b3a8eb9SGleb Smirnoff timeout_list : timeout_list comma timeout_spec optnl 43223b3a8eb9SGleb Smirnoff | timeout_spec optnl 43233b3a8eb9SGleb Smirnoff ; 43243b3a8eb9SGleb Smirnoff 43253b3a8eb9SGleb Smirnoff limit_spec : STRING NUMBER 43263b3a8eb9SGleb Smirnoff { 43273b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 43283b3a8eb9SGleb Smirnoff free($1); 43293b3a8eb9SGleb Smirnoff YYERROR; 43303b3a8eb9SGleb Smirnoff } 43313b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 43323b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 43333b3a8eb9SGleb Smirnoff YYERROR; 43343b3a8eb9SGleb Smirnoff } 43353b3a8eb9SGleb Smirnoff if (pfctl_set_limit(pf, $1, $2) != 0) { 43363b3a8eb9SGleb Smirnoff yyerror("unable to set limit %s %u", $1, $2); 43373b3a8eb9SGleb Smirnoff free($1); 43383b3a8eb9SGleb Smirnoff YYERROR; 43393b3a8eb9SGleb Smirnoff } 43403b3a8eb9SGleb Smirnoff free($1); 43413b3a8eb9SGleb Smirnoff } 43423b3a8eb9SGleb Smirnoff ; 43433b3a8eb9SGleb Smirnoff 43443b3a8eb9SGleb Smirnoff limit_list : limit_list comma limit_spec optnl 43453b3a8eb9SGleb Smirnoff | limit_spec optnl 43463b3a8eb9SGleb Smirnoff ; 43473b3a8eb9SGleb Smirnoff 43483b3a8eb9SGleb Smirnoff comma : ',' 43493b3a8eb9SGleb Smirnoff | /* empty */ 43503b3a8eb9SGleb Smirnoff ; 43513b3a8eb9SGleb Smirnoff 43523b3a8eb9SGleb Smirnoff yesno : NO { $$ = 0; } 43533b3a8eb9SGleb Smirnoff | STRING { 43543b3a8eb9SGleb Smirnoff if (!strcmp($1, "yes")) 43553b3a8eb9SGleb Smirnoff $$ = 1; 43563b3a8eb9SGleb Smirnoff else { 43573b3a8eb9SGleb Smirnoff yyerror("invalid value '%s', expected 'yes' " 43583b3a8eb9SGleb Smirnoff "or 'no'", $1); 43593b3a8eb9SGleb Smirnoff free($1); 43603b3a8eb9SGleb Smirnoff YYERROR; 43613b3a8eb9SGleb Smirnoff } 43623b3a8eb9SGleb Smirnoff free($1); 43633b3a8eb9SGleb Smirnoff } 43643b3a8eb9SGleb Smirnoff ; 43653b3a8eb9SGleb Smirnoff 43663b3a8eb9SGleb Smirnoff unaryop : '=' { $$ = PF_OP_EQ; } 43673b3a8eb9SGleb Smirnoff | '!' '=' { $$ = PF_OP_NE; } 43683b3a8eb9SGleb Smirnoff | '<' '=' { $$ = PF_OP_LE; } 43693b3a8eb9SGleb Smirnoff | '<' { $$ = PF_OP_LT; } 43703b3a8eb9SGleb Smirnoff | '>' '=' { $$ = PF_OP_GE; } 43713b3a8eb9SGleb Smirnoff | '>' { $$ = PF_OP_GT; } 43723b3a8eb9SGleb Smirnoff ; 43733b3a8eb9SGleb Smirnoff 43743b3a8eb9SGleb Smirnoff %% 43753b3a8eb9SGleb Smirnoff 43763b3a8eb9SGleb Smirnoff int 43773b3a8eb9SGleb Smirnoff yyerror(const char *fmt, ...) 43783b3a8eb9SGleb Smirnoff { 43793b3a8eb9SGleb Smirnoff va_list ap; 43803b3a8eb9SGleb Smirnoff 43813b3a8eb9SGleb Smirnoff file->errors++; 43823b3a8eb9SGleb Smirnoff va_start(ap, fmt); 43833b3a8eb9SGleb Smirnoff fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 43843b3a8eb9SGleb Smirnoff vfprintf(stderr, fmt, ap); 43853b3a8eb9SGleb Smirnoff fprintf(stderr, "\n"); 43863b3a8eb9SGleb Smirnoff va_end(ap); 43873b3a8eb9SGleb Smirnoff return (0); 43883b3a8eb9SGleb Smirnoff } 43893b3a8eb9SGleb Smirnoff 43903b3a8eb9SGleb Smirnoff int 43913b3a8eb9SGleb Smirnoff disallow_table(struct node_host *h, const char *fmt) 43923b3a8eb9SGleb Smirnoff { 43933b3a8eb9SGleb Smirnoff for (; h != NULL; h = h->next) 43943b3a8eb9SGleb Smirnoff if (h->addr.type == PF_ADDR_TABLE) { 43953b3a8eb9SGleb Smirnoff yyerror(fmt, h->addr.v.tblname); 43963b3a8eb9SGleb Smirnoff return (1); 43973b3a8eb9SGleb Smirnoff } 43983b3a8eb9SGleb Smirnoff return (0); 43993b3a8eb9SGleb Smirnoff } 44003b3a8eb9SGleb Smirnoff 44013b3a8eb9SGleb Smirnoff int 44023b3a8eb9SGleb Smirnoff disallow_urpf_failed(struct node_host *h, const char *fmt) 44033b3a8eb9SGleb Smirnoff { 44043b3a8eb9SGleb Smirnoff for (; h != NULL; h = h->next) 44053b3a8eb9SGleb Smirnoff if (h->addr.type == PF_ADDR_URPFFAILED) { 44063b3a8eb9SGleb Smirnoff yyerror(fmt); 44073b3a8eb9SGleb Smirnoff return (1); 44083b3a8eb9SGleb Smirnoff } 44093b3a8eb9SGleb Smirnoff return (0); 44103b3a8eb9SGleb Smirnoff } 44113b3a8eb9SGleb Smirnoff 44123b3a8eb9SGleb Smirnoff int 44133b3a8eb9SGleb Smirnoff disallow_alias(struct node_host *h, const char *fmt) 44143b3a8eb9SGleb Smirnoff { 44153b3a8eb9SGleb Smirnoff for (; h != NULL; h = h->next) 44163b3a8eb9SGleb Smirnoff if (DYNIF_MULTIADDR(h->addr)) { 44173b3a8eb9SGleb Smirnoff yyerror(fmt, h->addr.v.tblname); 44183b3a8eb9SGleb Smirnoff return (1); 44193b3a8eb9SGleb Smirnoff } 44203b3a8eb9SGleb Smirnoff return (0); 44213b3a8eb9SGleb Smirnoff } 44223b3a8eb9SGleb Smirnoff 44233b3a8eb9SGleb Smirnoff int 44243b3a8eb9SGleb Smirnoff rule_consistent(struct pf_rule *r, int anchor_call) 44253b3a8eb9SGleb Smirnoff { 44263b3a8eb9SGleb Smirnoff int problems = 0; 44273b3a8eb9SGleb Smirnoff 44283b3a8eb9SGleb Smirnoff switch (r->action) { 44293b3a8eb9SGleb Smirnoff case PF_PASS: 44303b3a8eb9SGleb Smirnoff case PF_DROP: 44313b3a8eb9SGleb Smirnoff case PF_SCRUB: 44323b3a8eb9SGleb Smirnoff case PF_NOSCRUB: 44333b3a8eb9SGleb Smirnoff problems = filter_consistent(r, anchor_call); 44343b3a8eb9SGleb Smirnoff break; 44353b3a8eb9SGleb Smirnoff case PF_NAT: 44363b3a8eb9SGleb Smirnoff case PF_NONAT: 44373b3a8eb9SGleb Smirnoff problems = nat_consistent(r); 44383b3a8eb9SGleb Smirnoff break; 44393b3a8eb9SGleb Smirnoff case PF_RDR: 44403b3a8eb9SGleb Smirnoff case PF_NORDR: 44413b3a8eb9SGleb Smirnoff problems = rdr_consistent(r); 44423b3a8eb9SGleb Smirnoff break; 44433b3a8eb9SGleb Smirnoff case PF_BINAT: 44443b3a8eb9SGleb Smirnoff case PF_NOBINAT: 44453b3a8eb9SGleb Smirnoff default: 44463b3a8eb9SGleb Smirnoff break; 44473b3a8eb9SGleb Smirnoff } 44483b3a8eb9SGleb Smirnoff return (problems); 44493b3a8eb9SGleb Smirnoff } 44503b3a8eb9SGleb Smirnoff 44513b3a8eb9SGleb Smirnoff int 44523b3a8eb9SGleb Smirnoff filter_consistent(struct pf_rule *r, int anchor_call) 44533b3a8eb9SGleb Smirnoff { 44543b3a8eb9SGleb Smirnoff int problems = 0; 44553b3a8eb9SGleb Smirnoff 44563b3a8eb9SGleb Smirnoff if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 44573b3a8eb9SGleb Smirnoff (r->src.port_op || r->dst.port_op)) { 44583b3a8eb9SGleb Smirnoff yyerror("port only applies to tcp/udp"); 44593b3a8eb9SGleb Smirnoff problems++; 44603b3a8eb9SGleb Smirnoff } 44613b3a8eb9SGleb Smirnoff if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 44623b3a8eb9SGleb Smirnoff (r->type || r->code)) { 44633b3a8eb9SGleb Smirnoff yyerror("icmp-type/code only applies to icmp"); 44643b3a8eb9SGleb Smirnoff problems++; 44653b3a8eb9SGleb Smirnoff } 44663b3a8eb9SGleb Smirnoff if (!r->af && (r->type || r->code)) { 44673b3a8eb9SGleb Smirnoff yyerror("must indicate address family with icmp-type/code"); 44683b3a8eb9SGleb Smirnoff problems++; 44693b3a8eb9SGleb Smirnoff } 44703b3a8eb9SGleb Smirnoff if (r->overload_tblname[0] && 44713b3a8eb9SGleb Smirnoff r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 44723b3a8eb9SGleb Smirnoff yyerror("'overload' requires 'max-src-conn' " 44733b3a8eb9SGleb Smirnoff "or 'max-src-conn-rate'"); 44743b3a8eb9SGleb Smirnoff problems++; 44753b3a8eb9SGleb Smirnoff } 44763b3a8eb9SGleb Smirnoff if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 44773b3a8eb9SGleb Smirnoff (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 44783b3a8eb9SGleb Smirnoff yyerror("proto %s doesn't match address family %s", 44793b3a8eb9SGleb Smirnoff r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 44803b3a8eb9SGleb Smirnoff r->af == AF_INET ? "inet" : "inet6"); 44813b3a8eb9SGleb Smirnoff problems++; 44823b3a8eb9SGleb Smirnoff } 44833b3a8eb9SGleb Smirnoff if (r->allow_opts && r->action != PF_PASS) { 44843b3a8eb9SGleb Smirnoff yyerror("allow-opts can only be specified for pass rules"); 44853b3a8eb9SGleb Smirnoff problems++; 44863b3a8eb9SGleb Smirnoff } 44873b3a8eb9SGleb Smirnoff if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 44883b3a8eb9SGleb Smirnoff r->dst.port_op || r->flagset || r->type || r->code)) { 44893b3a8eb9SGleb Smirnoff yyerror("fragments can be filtered only on IP header fields"); 44903b3a8eb9SGleb Smirnoff problems++; 44913b3a8eb9SGleb Smirnoff } 44923b3a8eb9SGleb Smirnoff if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 44933b3a8eb9SGleb Smirnoff yyerror("return-rst can only be applied to TCP rules"); 44943b3a8eb9SGleb Smirnoff problems++; 44953b3a8eb9SGleb Smirnoff } 44963b3a8eb9SGleb Smirnoff if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 44973b3a8eb9SGleb Smirnoff yyerror("max-src-nodes requires 'source-track rule'"); 44983b3a8eb9SGleb Smirnoff problems++; 44993b3a8eb9SGleb Smirnoff } 45003b3a8eb9SGleb Smirnoff if (r->action == PF_DROP && r->keep_state) { 45013b3a8eb9SGleb Smirnoff yyerror("keep state on block rules doesn't make sense"); 45023b3a8eb9SGleb Smirnoff problems++; 45033b3a8eb9SGleb Smirnoff } 45043b3a8eb9SGleb Smirnoff if (r->rule_flag & PFRULE_STATESLOPPY && 45053b3a8eb9SGleb Smirnoff (r->keep_state == PF_STATE_MODULATE || 45063b3a8eb9SGleb Smirnoff r->keep_state == PF_STATE_SYNPROXY)) { 45073b3a8eb9SGleb Smirnoff yyerror("sloppy state matching cannot be used with " 45083b3a8eb9SGleb Smirnoff "synproxy state or modulate state"); 45093b3a8eb9SGleb Smirnoff problems++; 45103b3a8eb9SGleb Smirnoff } 45113b3a8eb9SGleb Smirnoff return (-problems); 45123b3a8eb9SGleb Smirnoff } 45133b3a8eb9SGleb Smirnoff 45143b3a8eb9SGleb Smirnoff int 45153b3a8eb9SGleb Smirnoff nat_consistent(struct pf_rule *r) 45163b3a8eb9SGleb Smirnoff { 45173b3a8eb9SGleb Smirnoff return (0); /* yeah! */ 45183b3a8eb9SGleb Smirnoff } 45193b3a8eb9SGleb Smirnoff 45203b3a8eb9SGleb Smirnoff int 45213b3a8eb9SGleb Smirnoff rdr_consistent(struct pf_rule *r) 45223b3a8eb9SGleb Smirnoff { 45233b3a8eb9SGleb Smirnoff int problems = 0; 45243b3a8eb9SGleb Smirnoff 45253b3a8eb9SGleb Smirnoff if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 45263b3a8eb9SGleb Smirnoff if (r->src.port_op) { 45273b3a8eb9SGleb Smirnoff yyerror("src port only applies to tcp/udp"); 45283b3a8eb9SGleb Smirnoff problems++; 45293b3a8eb9SGleb Smirnoff } 45303b3a8eb9SGleb Smirnoff if (r->dst.port_op) { 45313b3a8eb9SGleb Smirnoff yyerror("dst port only applies to tcp/udp"); 45323b3a8eb9SGleb Smirnoff problems++; 45333b3a8eb9SGleb Smirnoff } 45343b3a8eb9SGleb Smirnoff if (r->rpool.proxy_port[0]) { 45353b3a8eb9SGleb Smirnoff yyerror("rpool port only applies to tcp/udp"); 45363b3a8eb9SGleb Smirnoff problems++; 45373b3a8eb9SGleb Smirnoff } 45383b3a8eb9SGleb Smirnoff } 45393b3a8eb9SGleb Smirnoff if (r->dst.port_op && 45403b3a8eb9SGleb Smirnoff r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 45413b3a8eb9SGleb Smirnoff yyerror("invalid port operator for rdr destination port"); 45423b3a8eb9SGleb Smirnoff problems++; 45433b3a8eb9SGleb Smirnoff } 45443b3a8eb9SGleb Smirnoff return (-problems); 45453b3a8eb9SGleb Smirnoff } 45463b3a8eb9SGleb Smirnoff 45473b3a8eb9SGleb Smirnoff int 45483b3a8eb9SGleb Smirnoff process_tabledef(char *name, struct table_opts *opts) 45493b3a8eb9SGleb Smirnoff { 45503b3a8eb9SGleb Smirnoff struct pfr_buffer ab; 45513b3a8eb9SGleb Smirnoff struct node_tinit *ti; 45523b3a8eb9SGleb Smirnoff 45533b3a8eb9SGleb Smirnoff bzero(&ab, sizeof(ab)); 45543b3a8eb9SGleb Smirnoff ab.pfrb_type = PFRB_ADDRS; 45553b3a8eb9SGleb Smirnoff SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 45563b3a8eb9SGleb Smirnoff if (ti->file) 45573b3a8eb9SGleb Smirnoff if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 45583b3a8eb9SGleb Smirnoff if (errno) 45593b3a8eb9SGleb Smirnoff yyerror("cannot load \"%s\": %s", 45603b3a8eb9SGleb Smirnoff ti->file, strerror(errno)); 45613b3a8eb9SGleb Smirnoff else 45623b3a8eb9SGleb Smirnoff yyerror("file \"%s\" contains bad data", 45633b3a8eb9SGleb Smirnoff ti->file); 45643b3a8eb9SGleb Smirnoff goto _error; 45653b3a8eb9SGleb Smirnoff } 45663b3a8eb9SGleb Smirnoff if (ti->host) 45673b3a8eb9SGleb Smirnoff if (append_addr_host(&ab, ti->host, 0, 0)) { 45683b3a8eb9SGleb Smirnoff yyerror("cannot create address buffer: %s", 45693b3a8eb9SGleb Smirnoff strerror(errno)); 45703b3a8eb9SGleb Smirnoff goto _error; 45713b3a8eb9SGleb Smirnoff } 45723b3a8eb9SGleb Smirnoff } 45733b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 45743b3a8eb9SGleb Smirnoff print_tabledef(name, opts->flags, opts->init_addr, 45753b3a8eb9SGleb Smirnoff &opts->init_nodes); 45763b3a8eb9SGleb Smirnoff if (!(pf->opts & PF_OPT_NOACTION) && 45773b3a8eb9SGleb Smirnoff pfctl_define_table(name, opts->flags, opts->init_addr, 45783b3a8eb9SGleb Smirnoff pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 45793b3a8eb9SGleb Smirnoff yyerror("cannot define table %s: %s", name, 45803b3a8eb9SGleb Smirnoff pfr_strerror(errno)); 45813b3a8eb9SGleb Smirnoff goto _error; 45823b3a8eb9SGleb Smirnoff } 45833b3a8eb9SGleb Smirnoff pf->tdirty = 1; 45843b3a8eb9SGleb Smirnoff pfr_buf_clear(&ab); 45853b3a8eb9SGleb Smirnoff return (0); 45863b3a8eb9SGleb Smirnoff _error: 45873b3a8eb9SGleb Smirnoff pfr_buf_clear(&ab); 45883b3a8eb9SGleb Smirnoff return (-1); 45893b3a8eb9SGleb Smirnoff } 45903b3a8eb9SGleb Smirnoff 45913b3a8eb9SGleb Smirnoff struct keywords { 45923b3a8eb9SGleb Smirnoff const char *k_name; 45933b3a8eb9SGleb Smirnoff int k_val; 45943b3a8eb9SGleb Smirnoff }; 45953b3a8eb9SGleb Smirnoff 45963b3a8eb9SGleb Smirnoff /* macro gore, but you should've seen the prior indentation nightmare... */ 45973b3a8eb9SGleb Smirnoff 45983b3a8eb9SGleb Smirnoff #define FREE_LIST(T,r) \ 45993b3a8eb9SGleb Smirnoff do { \ 46003b3a8eb9SGleb Smirnoff T *p, *node = r; \ 46013b3a8eb9SGleb Smirnoff while (node != NULL) { \ 46023b3a8eb9SGleb Smirnoff p = node; \ 46033b3a8eb9SGleb Smirnoff node = node->next; \ 46043b3a8eb9SGleb Smirnoff free(p); \ 46053b3a8eb9SGleb Smirnoff } \ 46063b3a8eb9SGleb Smirnoff } while (0) 46073b3a8eb9SGleb Smirnoff 46083b3a8eb9SGleb Smirnoff #define LOOP_THROUGH(T,n,r,C) \ 46093b3a8eb9SGleb Smirnoff do { \ 46103b3a8eb9SGleb Smirnoff T *n; \ 46113b3a8eb9SGleb Smirnoff if (r == NULL) { \ 46123b3a8eb9SGleb Smirnoff r = calloc(1, sizeof(T)); \ 46133b3a8eb9SGleb Smirnoff if (r == NULL) \ 46143b3a8eb9SGleb Smirnoff err(1, "LOOP: calloc"); \ 46153b3a8eb9SGleb Smirnoff r->next = NULL; \ 46163b3a8eb9SGleb Smirnoff } \ 46173b3a8eb9SGleb Smirnoff n = r; \ 46183b3a8eb9SGleb Smirnoff while (n != NULL) { \ 46193b3a8eb9SGleb Smirnoff do { \ 46203b3a8eb9SGleb Smirnoff C; \ 46213b3a8eb9SGleb Smirnoff } while (0); \ 46223b3a8eb9SGleb Smirnoff n = n->next; \ 46233b3a8eb9SGleb Smirnoff } \ 46243b3a8eb9SGleb Smirnoff } while (0) 46253b3a8eb9SGleb Smirnoff 46263b3a8eb9SGleb Smirnoff void 46273b3a8eb9SGleb Smirnoff expand_label_str(char *label, size_t len, const char *srch, const char *repl) 46283b3a8eb9SGleb Smirnoff { 46293b3a8eb9SGleb Smirnoff char *tmp; 46303b3a8eb9SGleb Smirnoff char *p, *q; 46313b3a8eb9SGleb Smirnoff 46323b3a8eb9SGleb Smirnoff if ((tmp = calloc(1, len)) == NULL) 46333b3a8eb9SGleb Smirnoff err(1, "expand_label_str: calloc"); 46343b3a8eb9SGleb Smirnoff p = q = label; 46353b3a8eb9SGleb Smirnoff while ((q = strstr(p, srch)) != NULL) { 46363b3a8eb9SGleb Smirnoff *q = '\0'; 46373b3a8eb9SGleb Smirnoff if ((strlcat(tmp, p, len) >= len) || 46383b3a8eb9SGleb Smirnoff (strlcat(tmp, repl, len) >= len)) 46393b3a8eb9SGleb Smirnoff errx(1, "expand_label: label too long"); 46403b3a8eb9SGleb Smirnoff q += strlen(srch); 46413b3a8eb9SGleb Smirnoff p = q; 46423b3a8eb9SGleb Smirnoff } 46433b3a8eb9SGleb Smirnoff if (strlcat(tmp, p, len) >= len) 46443b3a8eb9SGleb Smirnoff errx(1, "expand_label: label too long"); 46453b3a8eb9SGleb Smirnoff strlcpy(label, tmp, len); /* always fits */ 46463b3a8eb9SGleb Smirnoff free(tmp); 46473b3a8eb9SGleb Smirnoff } 46483b3a8eb9SGleb Smirnoff 46493b3a8eb9SGleb Smirnoff void 46503b3a8eb9SGleb Smirnoff expand_label_if(const char *name, char *label, size_t len, const char *ifname) 46513b3a8eb9SGleb Smirnoff { 46523b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 46533b3a8eb9SGleb Smirnoff if (!*ifname) 46543b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, "any"); 46553b3a8eb9SGleb Smirnoff else 46563b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, ifname); 46573b3a8eb9SGleb Smirnoff } 46583b3a8eb9SGleb Smirnoff } 46593b3a8eb9SGleb Smirnoff 46603b3a8eb9SGleb Smirnoff void 46613b3a8eb9SGleb Smirnoff expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 46623b3a8eb9SGleb Smirnoff struct node_host *h) 46633b3a8eb9SGleb Smirnoff { 46643b3a8eb9SGleb Smirnoff char tmp[64], tmp_not[66]; 46653b3a8eb9SGleb Smirnoff 46663b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 46673b3a8eb9SGleb Smirnoff switch (h->addr.type) { 46683b3a8eb9SGleb Smirnoff case PF_ADDR_DYNIFTL: 46693b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 46703b3a8eb9SGleb Smirnoff break; 46713b3a8eb9SGleb Smirnoff case PF_ADDR_TABLE: 46723b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 46733b3a8eb9SGleb Smirnoff break; 46743b3a8eb9SGleb Smirnoff case PF_ADDR_NOROUTE: 46753b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "no-route"); 46763b3a8eb9SGleb Smirnoff break; 46773b3a8eb9SGleb Smirnoff case PF_ADDR_URPFFAILED: 46783b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "urpf-failed"); 46793b3a8eb9SGleb Smirnoff break; 46803b3a8eb9SGleb Smirnoff case PF_ADDR_ADDRMASK: 46813b3a8eb9SGleb Smirnoff if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 46823b3a8eb9SGleb Smirnoff PF_AZERO(&h->addr.v.a.mask, af))) 46833b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "any"); 46843b3a8eb9SGleb Smirnoff else { 46853b3a8eb9SGleb Smirnoff char a[48]; 46863b3a8eb9SGleb Smirnoff int bits; 46873b3a8eb9SGleb Smirnoff 46883b3a8eb9SGleb Smirnoff if (inet_ntop(af, &h->addr.v.a.addr, a, 46893b3a8eb9SGleb Smirnoff sizeof(a)) == NULL) 46903b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "?"); 46913b3a8eb9SGleb Smirnoff else { 46923b3a8eb9SGleb Smirnoff bits = unmask(&h->addr.v.a.mask, af); 46933b3a8eb9SGleb Smirnoff if ((af == AF_INET && bits < 32) || 46943b3a8eb9SGleb Smirnoff (af == AF_INET6 && bits < 128)) 46953b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), 46963b3a8eb9SGleb Smirnoff "%s/%d", a, bits); 46973b3a8eb9SGleb Smirnoff else 46983b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), 46993b3a8eb9SGleb Smirnoff "%s", a); 47003b3a8eb9SGleb Smirnoff } 47013b3a8eb9SGleb Smirnoff } 47023b3a8eb9SGleb Smirnoff break; 47033b3a8eb9SGleb Smirnoff default: 47043b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "?"); 47053b3a8eb9SGleb Smirnoff break; 47063b3a8eb9SGleb Smirnoff } 47073b3a8eb9SGleb Smirnoff 47083b3a8eb9SGleb Smirnoff if (h->not) { 47093b3a8eb9SGleb Smirnoff snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 47103b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, tmp_not); 47113b3a8eb9SGleb Smirnoff } else 47123b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, tmp); 47133b3a8eb9SGleb Smirnoff } 47143b3a8eb9SGleb Smirnoff } 47153b3a8eb9SGleb Smirnoff 47163b3a8eb9SGleb Smirnoff void 47173b3a8eb9SGleb Smirnoff expand_label_port(const char *name, char *label, size_t len, 47183b3a8eb9SGleb Smirnoff struct node_port *port) 47193b3a8eb9SGleb Smirnoff { 47203b3a8eb9SGleb Smirnoff char a1[6], a2[6], op[13] = ""; 47213b3a8eb9SGleb Smirnoff 47223b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 47233b3a8eb9SGleb Smirnoff snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 47243b3a8eb9SGleb Smirnoff snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 47253b3a8eb9SGleb Smirnoff if (!port->op) 47263b3a8eb9SGleb Smirnoff ; 47273b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_IRG) 47283b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "%s><%s", a1, a2); 47293b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_XRG) 47303b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "%s<>%s", a1, a2); 47313b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_EQ) 47323b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "%s", a1); 47333b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_NE) 47343b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "!=%s", a1); 47353b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_LT) 47363b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "<%s", a1); 47373b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_LE) 47383b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "<=%s", a1); 47393b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_GT) 47403b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), ">%s", a1); 47413b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_GE) 47423b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), ">=%s", a1); 47433b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, op); 47443b3a8eb9SGleb Smirnoff } 47453b3a8eb9SGleb Smirnoff } 47463b3a8eb9SGleb Smirnoff 47473b3a8eb9SGleb Smirnoff void 47483b3a8eb9SGleb Smirnoff expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 47493b3a8eb9SGleb Smirnoff { 47503b3a8eb9SGleb Smirnoff struct protoent *pe; 47513b3a8eb9SGleb Smirnoff char n[4]; 47523b3a8eb9SGleb Smirnoff 47533b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 47543b3a8eb9SGleb Smirnoff pe = getprotobynumber(proto); 47553b3a8eb9SGleb Smirnoff if (pe != NULL) 47563b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, pe->p_name); 47573b3a8eb9SGleb Smirnoff else { 47583b3a8eb9SGleb Smirnoff snprintf(n, sizeof(n), "%u", proto); 47593b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, n); 47603b3a8eb9SGleb Smirnoff } 47613b3a8eb9SGleb Smirnoff } 47623b3a8eb9SGleb Smirnoff } 47633b3a8eb9SGleb Smirnoff 47643b3a8eb9SGleb Smirnoff void 47653b3a8eb9SGleb Smirnoff expand_label_nr(const char *name, char *label, size_t len) 47663b3a8eb9SGleb Smirnoff { 47673b3a8eb9SGleb Smirnoff char n[11]; 47683b3a8eb9SGleb Smirnoff 47693b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 47703b3a8eb9SGleb Smirnoff snprintf(n, sizeof(n), "%u", pf->anchor->match); 47713b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, n); 47723b3a8eb9SGleb Smirnoff } 47733b3a8eb9SGleb Smirnoff } 47743b3a8eb9SGleb Smirnoff 47753b3a8eb9SGleb Smirnoff void 47763b3a8eb9SGleb Smirnoff expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 47773b3a8eb9SGleb Smirnoff struct node_host *src_host, struct node_port *src_port, 47783b3a8eb9SGleb Smirnoff struct node_host *dst_host, struct node_port *dst_port, 47793b3a8eb9SGleb Smirnoff u_int8_t proto) 47803b3a8eb9SGleb Smirnoff { 47813b3a8eb9SGleb Smirnoff expand_label_if("$if", label, len, ifname); 47823b3a8eb9SGleb Smirnoff expand_label_addr("$srcaddr", label, len, af, src_host); 47833b3a8eb9SGleb Smirnoff expand_label_addr("$dstaddr", label, len, af, dst_host); 47843b3a8eb9SGleb Smirnoff expand_label_port("$srcport", label, len, src_port); 47853b3a8eb9SGleb Smirnoff expand_label_port("$dstport", label, len, dst_port); 47863b3a8eb9SGleb Smirnoff expand_label_proto("$proto", label, len, proto); 47873b3a8eb9SGleb Smirnoff expand_label_nr("$nr", label, len); 47883b3a8eb9SGleb Smirnoff } 47893b3a8eb9SGleb Smirnoff 47903b3a8eb9SGleb Smirnoff int 47913b3a8eb9SGleb Smirnoff expand_altq(struct pf_altq *a, struct node_if *interfaces, 47923b3a8eb9SGleb Smirnoff struct node_queue *nqueues, struct node_queue_bw bwspec, 47933b3a8eb9SGleb Smirnoff struct node_queue_opt *opts) 47943b3a8eb9SGleb Smirnoff { 47953b3a8eb9SGleb Smirnoff struct pf_altq pa, pb; 47963b3a8eb9SGleb Smirnoff char qname[PF_QNAME_SIZE]; 47973b3a8eb9SGleb Smirnoff struct node_queue *n; 47983b3a8eb9SGleb Smirnoff struct node_queue_bw bw; 47993b3a8eb9SGleb Smirnoff int errs = 0; 48003b3a8eb9SGleb Smirnoff 48013b3a8eb9SGleb Smirnoff if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 48023b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 48033b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 48043b3a8eb9SGleb Smirnoff return (0); 48053b3a8eb9SGleb Smirnoff } 48063b3a8eb9SGleb Smirnoff 48073b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 48083b3a8eb9SGleb Smirnoff memcpy(&pa, a, sizeof(struct pf_altq)); 48093b3a8eb9SGleb Smirnoff if (strlcpy(pa.ifname, interface->ifname, 48103b3a8eb9SGleb Smirnoff sizeof(pa.ifname)) >= sizeof(pa.ifname)) 48113b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48123b3a8eb9SGleb Smirnoff 48133b3a8eb9SGleb Smirnoff if (interface->not) { 48143b3a8eb9SGleb Smirnoff yyerror("altq on ! <interface> is not supported"); 48153b3a8eb9SGleb Smirnoff errs++; 48163b3a8eb9SGleb Smirnoff } else { 48173b3a8eb9SGleb Smirnoff if (eval_pfaltq(pf, &pa, &bwspec, opts)) 48183b3a8eb9SGleb Smirnoff errs++; 48193b3a8eb9SGleb Smirnoff else 48203b3a8eb9SGleb Smirnoff if (pfctl_add_altq(pf, &pa)) 48213b3a8eb9SGleb Smirnoff errs++; 48223b3a8eb9SGleb Smirnoff 48233b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) { 48243b3a8eb9SGleb Smirnoff print_altq(&pf->paltq->altq, 0, 48253b3a8eb9SGleb Smirnoff &bwspec, opts); 48263b3a8eb9SGleb Smirnoff if (nqueues && nqueues->tail) { 48273b3a8eb9SGleb Smirnoff printf("queue { "); 48283b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, queue, 48293b3a8eb9SGleb Smirnoff nqueues, 48303b3a8eb9SGleb Smirnoff printf("%s ", 48313b3a8eb9SGleb Smirnoff queue->queue); 48323b3a8eb9SGleb Smirnoff ); 48333b3a8eb9SGleb Smirnoff printf("}"); 48343b3a8eb9SGleb Smirnoff } 48353b3a8eb9SGleb Smirnoff printf("\n"); 48363b3a8eb9SGleb Smirnoff } 48373b3a8eb9SGleb Smirnoff 48383b3a8eb9SGleb Smirnoff if (pa.scheduler == ALTQT_CBQ || 48393b3a8eb9SGleb Smirnoff pa.scheduler == ALTQT_HFSC) { 48403b3a8eb9SGleb Smirnoff /* now create a root queue */ 48413b3a8eb9SGleb Smirnoff memset(&pb, 0, sizeof(struct pf_altq)); 48423b3a8eb9SGleb Smirnoff if (strlcpy(qname, "root_", sizeof(qname)) >= 48433b3a8eb9SGleb Smirnoff sizeof(qname)) 48443b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48453b3a8eb9SGleb Smirnoff if (strlcat(qname, interface->ifname, 48463b3a8eb9SGleb Smirnoff sizeof(qname)) >= sizeof(qname)) 48473b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcat"); 48483b3a8eb9SGleb Smirnoff if (strlcpy(pb.qname, qname, 48493b3a8eb9SGleb Smirnoff sizeof(pb.qname)) >= sizeof(pb.qname)) 48503b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48513b3a8eb9SGleb Smirnoff if (strlcpy(pb.ifname, interface->ifname, 48523b3a8eb9SGleb Smirnoff sizeof(pb.ifname)) >= sizeof(pb.ifname)) 48533b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48543b3a8eb9SGleb Smirnoff pb.qlimit = pa.qlimit; 48553b3a8eb9SGleb Smirnoff pb.scheduler = pa.scheduler; 48563b3a8eb9SGleb Smirnoff bw.bw_absolute = pa.ifbandwidth; 48573b3a8eb9SGleb Smirnoff bw.bw_percent = 0; 48583b3a8eb9SGleb Smirnoff if (eval_pfqueue(pf, &pb, &bw, opts)) 48593b3a8eb9SGleb Smirnoff errs++; 48603b3a8eb9SGleb Smirnoff else 48613b3a8eb9SGleb Smirnoff if (pfctl_add_altq(pf, &pb)) 48623b3a8eb9SGleb Smirnoff errs++; 48633b3a8eb9SGleb Smirnoff } 48643b3a8eb9SGleb Smirnoff 48653b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, queue, nqueues, 48663b3a8eb9SGleb Smirnoff n = calloc(1, sizeof(struct node_queue)); 48673b3a8eb9SGleb Smirnoff if (n == NULL) 48683b3a8eb9SGleb Smirnoff err(1, "expand_altq: calloc"); 48693b3a8eb9SGleb Smirnoff if (pa.scheduler == ALTQT_CBQ || 48703b3a8eb9SGleb Smirnoff pa.scheduler == ALTQT_HFSC) 48713b3a8eb9SGleb Smirnoff if (strlcpy(n->parent, qname, 48723b3a8eb9SGleb Smirnoff sizeof(n->parent)) >= 48733b3a8eb9SGleb Smirnoff sizeof(n->parent)) 48743b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48753b3a8eb9SGleb Smirnoff if (strlcpy(n->queue, queue->queue, 48763b3a8eb9SGleb Smirnoff sizeof(n->queue)) >= sizeof(n->queue)) 48773b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48783b3a8eb9SGleb Smirnoff if (strlcpy(n->ifname, interface->ifname, 48793b3a8eb9SGleb Smirnoff sizeof(n->ifname)) >= sizeof(n->ifname)) 48803b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 48813b3a8eb9SGleb Smirnoff n->scheduler = pa.scheduler; 48823b3a8eb9SGleb Smirnoff n->next = NULL; 48833b3a8eb9SGleb Smirnoff n->tail = n; 48843b3a8eb9SGleb Smirnoff if (queues == NULL) 48853b3a8eb9SGleb Smirnoff queues = n; 48863b3a8eb9SGleb Smirnoff else { 48873b3a8eb9SGleb Smirnoff queues->tail->next = n; 48883b3a8eb9SGleb Smirnoff queues->tail = n; 48893b3a8eb9SGleb Smirnoff } 48903b3a8eb9SGleb Smirnoff ); 48913b3a8eb9SGleb Smirnoff } 48923b3a8eb9SGleb Smirnoff ); 48933b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 48943b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 48953b3a8eb9SGleb Smirnoff 48963b3a8eb9SGleb Smirnoff return (errs); 48973b3a8eb9SGleb Smirnoff } 48983b3a8eb9SGleb Smirnoff 48993b3a8eb9SGleb Smirnoff int 49003b3a8eb9SGleb Smirnoff expand_queue(struct pf_altq *a, struct node_if *interfaces, 49013b3a8eb9SGleb Smirnoff struct node_queue *nqueues, struct node_queue_bw bwspec, 49023b3a8eb9SGleb Smirnoff struct node_queue_opt *opts) 49033b3a8eb9SGleb Smirnoff { 49043b3a8eb9SGleb Smirnoff struct node_queue *n, *nq; 49053b3a8eb9SGleb Smirnoff struct pf_altq pa; 49063b3a8eb9SGleb Smirnoff u_int8_t found = 0; 49073b3a8eb9SGleb Smirnoff u_int8_t errs = 0; 49083b3a8eb9SGleb Smirnoff 49093b3a8eb9SGleb Smirnoff if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 49103b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 49113b3a8eb9SGleb Smirnoff return (0); 49123b3a8eb9SGleb Smirnoff } 49133b3a8eb9SGleb Smirnoff 49143b3a8eb9SGleb Smirnoff if (queues == NULL) { 49153b3a8eb9SGleb Smirnoff yyerror("queue %s has no parent", a->qname); 49163b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 49173b3a8eb9SGleb Smirnoff return (1); 49183b3a8eb9SGleb Smirnoff } 49193b3a8eb9SGleb Smirnoff 49203b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 49213b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, tqueue, queues, 49223b3a8eb9SGleb Smirnoff if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 49233b3a8eb9SGleb Smirnoff (interface->ifname[0] == 0 || 49243b3a8eb9SGleb Smirnoff (!interface->not && !strncmp(interface->ifname, 49253b3a8eb9SGleb Smirnoff tqueue->ifname, IFNAMSIZ)) || 49263b3a8eb9SGleb Smirnoff (interface->not && strncmp(interface->ifname, 49273b3a8eb9SGleb Smirnoff tqueue->ifname, IFNAMSIZ)))) { 49283b3a8eb9SGleb Smirnoff /* found ourself in queues */ 49293b3a8eb9SGleb Smirnoff found++; 49303b3a8eb9SGleb Smirnoff 49313b3a8eb9SGleb Smirnoff memcpy(&pa, a, sizeof(struct pf_altq)); 49323b3a8eb9SGleb Smirnoff 49333b3a8eb9SGleb Smirnoff if (pa.scheduler != ALTQT_NONE && 49343b3a8eb9SGleb Smirnoff pa.scheduler != tqueue->scheduler) { 49353b3a8eb9SGleb Smirnoff yyerror("exactly one scheduler type " 49363b3a8eb9SGleb Smirnoff "per interface allowed"); 49373b3a8eb9SGleb Smirnoff return (1); 49383b3a8eb9SGleb Smirnoff } 49393b3a8eb9SGleb Smirnoff pa.scheduler = tqueue->scheduler; 49403b3a8eb9SGleb Smirnoff 49413b3a8eb9SGleb Smirnoff /* scheduler dependent error checking */ 49423b3a8eb9SGleb Smirnoff switch (pa.scheduler) { 49433b3a8eb9SGleb Smirnoff case ALTQT_PRIQ: 49443b3a8eb9SGleb Smirnoff if (nqueues != NULL) { 49453b3a8eb9SGleb Smirnoff yyerror("priq queues cannot " 49463b3a8eb9SGleb Smirnoff "have child queues"); 49473b3a8eb9SGleb Smirnoff return (1); 49483b3a8eb9SGleb Smirnoff } 49493b3a8eb9SGleb Smirnoff if (bwspec.bw_absolute > 0 || 49503b3a8eb9SGleb Smirnoff bwspec.bw_percent < 100) { 49513b3a8eb9SGleb Smirnoff yyerror("priq doesn't take " 49523b3a8eb9SGleb Smirnoff "bandwidth"); 49533b3a8eb9SGleb Smirnoff return (1); 49543b3a8eb9SGleb Smirnoff } 49553b3a8eb9SGleb Smirnoff break; 49563b3a8eb9SGleb Smirnoff default: 49573b3a8eb9SGleb Smirnoff break; 49583b3a8eb9SGleb Smirnoff } 49593b3a8eb9SGleb Smirnoff 49603b3a8eb9SGleb Smirnoff if (strlcpy(pa.ifname, tqueue->ifname, 49613b3a8eb9SGleb Smirnoff sizeof(pa.ifname)) >= sizeof(pa.ifname)) 49623b3a8eb9SGleb Smirnoff errx(1, "expand_queue: strlcpy"); 49633b3a8eb9SGleb Smirnoff if (strlcpy(pa.parent, tqueue->parent, 49643b3a8eb9SGleb Smirnoff sizeof(pa.parent)) >= sizeof(pa.parent)) 49653b3a8eb9SGleb Smirnoff errx(1, "expand_queue: strlcpy"); 49663b3a8eb9SGleb Smirnoff 49673b3a8eb9SGleb Smirnoff if (eval_pfqueue(pf, &pa, &bwspec, opts)) 49683b3a8eb9SGleb Smirnoff errs++; 49693b3a8eb9SGleb Smirnoff else 49703b3a8eb9SGleb Smirnoff if (pfctl_add_altq(pf, &pa)) 49713b3a8eb9SGleb Smirnoff errs++; 49723b3a8eb9SGleb Smirnoff 49733b3a8eb9SGleb Smirnoff for (nq = nqueues; nq != NULL; nq = nq->next) { 49743b3a8eb9SGleb Smirnoff if (!strcmp(a->qname, nq->queue)) { 49753b3a8eb9SGleb Smirnoff yyerror("queue cannot have " 49763b3a8eb9SGleb Smirnoff "itself as child"); 49773b3a8eb9SGleb Smirnoff errs++; 49783b3a8eb9SGleb Smirnoff continue; 49793b3a8eb9SGleb Smirnoff } 49803b3a8eb9SGleb Smirnoff n = calloc(1, 49813b3a8eb9SGleb Smirnoff sizeof(struct node_queue)); 49823b3a8eb9SGleb Smirnoff if (n == NULL) 49833b3a8eb9SGleb Smirnoff err(1, "expand_queue: calloc"); 49843b3a8eb9SGleb Smirnoff if (strlcpy(n->parent, a->qname, 49853b3a8eb9SGleb Smirnoff sizeof(n->parent)) >= 49863b3a8eb9SGleb Smirnoff sizeof(n->parent)) 49873b3a8eb9SGleb Smirnoff errx(1, "expand_queue strlcpy"); 49883b3a8eb9SGleb Smirnoff if (strlcpy(n->queue, nq->queue, 49893b3a8eb9SGleb Smirnoff sizeof(n->queue)) >= 49903b3a8eb9SGleb Smirnoff sizeof(n->queue)) 49913b3a8eb9SGleb Smirnoff errx(1, "expand_queue strlcpy"); 49923b3a8eb9SGleb Smirnoff if (strlcpy(n->ifname, tqueue->ifname, 49933b3a8eb9SGleb Smirnoff sizeof(n->ifname)) >= 49943b3a8eb9SGleb Smirnoff sizeof(n->ifname)) 49953b3a8eb9SGleb Smirnoff errx(1, "expand_queue strlcpy"); 49963b3a8eb9SGleb Smirnoff n->scheduler = tqueue->scheduler; 49973b3a8eb9SGleb Smirnoff n->next = NULL; 49983b3a8eb9SGleb Smirnoff n->tail = n; 49993b3a8eb9SGleb Smirnoff if (queues == NULL) 50003b3a8eb9SGleb Smirnoff queues = n; 50013b3a8eb9SGleb Smirnoff else { 50023b3a8eb9SGleb Smirnoff queues->tail->next = n; 50033b3a8eb9SGleb Smirnoff queues->tail = n; 50043b3a8eb9SGleb Smirnoff } 50053b3a8eb9SGleb Smirnoff } 50063b3a8eb9SGleb Smirnoff if ((pf->opts & PF_OPT_VERBOSE) && ( 50073b3a8eb9SGleb Smirnoff (found == 1 && interface->ifname[0] == 0) || 50083b3a8eb9SGleb Smirnoff (found > 0 && interface->ifname[0] != 0))) { 50093b3a8eb9SGleb Smirnoff print_queue(&pf->paltq->altq, 0, 50103b3a8eb9SGleb Smirnoff &bwspec, interface->ifname[0] != 0, 50113b3a8eb9SGleb Smirnoff opts); 50123b3a8eb9SGleb Smirnoff if (nqueues && nqueues->tail) { 50133b3a8eb9SGleb Smirnoff printf("{ "); 50143b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, 50153b3a8eb9SGleb Smirnoff queue, nqueues, 50163b3a8eb9SGleb Smirnoff printf("%s ", 50173b3a8eb9SGleb Smirnoff queue->queue); 50183b3a8eb9SGleb Smirnoff ); 50193b3a8eb9SGleb Smirnoff printf("}"); 50203b3a8eb9SGleb Smirnoff } 50213b3a8eb9SGleb Smirnoff printf("\n"); 50223b3a8eb9SGleb Smirnoff } 50233b3a8eb9SGleb Smirnoff } 50243b3a8eb9SGleb Smirnoff ); 50253b3a8eb9SGleb Smirnoff ); 50263b3a8eb9SGleb Smirnoff 50273b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 50283b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 50293b3a8eb9SGleb Smirnoff 50303b3a8eb9SGleb Smirnoff if (!found) { 50313b3a8eb9SGleb Smirnoff yyerror("queue %s has no parent", a->qname); 50323b3a8eb9SGleb Smirnoff errs++; 50333b3a8eb9SGleb Smirnoff } 50343b3a8eb9SGleb Smirnoff 50353b3a8eb9SGleb Smirnoff if (errs) 50363b3a8eb9SGleb Smirnoff return (1); 50373b3a8eb9SGleb Smirnoff else 50383b3a8eb9SGleb Smirnoff return (0); 50393b3a8eb9SGleb Smirnoff } 50403b3a8eb9SGleb Smirnoff 50413b3a8eb9SGleb Smirnoff void 50423b3a8eb9SGleb Smirnoff expand_rule(struct pf_rule *r, 50433b3a8eb9SGleb Smirnoff struct node_if *interfaces, struct node_host *rpool_hosts, 50443b3a8eb9SGleb Smirnoff struct node_proto *protos, struct node_os *src_oses, 50453b3a8eb9SGleb Smirnoff struct node_host *src_hosts, struct node_port *src_ports, 50463b3a8eb9SGleb Smirnoff struct node_host *dst_hosts, struct node_port *dst_ports, 50473b3a8eb9SGleb Smirnoff struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 50483b3a8eb9SGleb Smirnoff const char *anchor_call) 50493b3a8eb9SGleb Smirnoff { 50503b3a8eb9SGleb Smirnoff sa_family_t af = r->af; 50513b3a8eb9SGleb Smirnoff int added = 0, error = 0; 50523b3a8eb9SGleb Smirnoff char ifname[IF_NAMESIZE]; 50533b3a8eb9SGleb Smirnoff char label[PF_RULE_LABEL_SIZE]; 50543b3a8eb9SGleb Smirnoff char tagname[PF_TAG_NAME_SIZE]; 50553b3a8eb9SGleb Smirnoff char match_tagname[PF_TAG_NAME_SIZE]; 50563b3a8eb9SGleb Smirnoff struct pf_pooladdr *pa; 50573b3a8eb9SGleb Smirnoff struct node_host *h; 50583b3a8eb9SGleb Smirnoff u_int8_t flags, flagset, keep_state; 50593b3a8eb9SGleb Smirnoff 50603b3a8eb9SGleb Smirnoff if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 50613b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 50623b3a8eb9SGleb Smirnoff if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 50633b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 50643b3a8eb9SGleb Smirnoff if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 50653b3a8eb9SGleb Smirnoff sizeof(match_tagname)) 50663b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 50673b3a8eb9SGleb Smirnoff flags = r->flags; 50683b3a8eb9SGleb Smirnoff flagset = r->flagset; 50693b3a8eb9SGleb Smirnoff keep_state = r->keep_state; 50703b3a8eb9SGleb Smirnoff 50713b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 50723b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_proto, proto, protos, 50733b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 50743b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_host, src_host, src_hosts, 50753b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_port, src_port, src_ports, 50763b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_os, src_os, src_oses, 50773b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 50783b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_port, dst_port, dst_ports, 50793b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_uid, uid, uids, 50803b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_gid, gid, gids, 50813b3a8eb9SGleb Smirnoff 50823b3a8eb9SGleb Smirnoff r->af = af; 50833b3a8eb9SGleb Smirnoff /* for link-local IPv6 address, interface must match up */ 50843b3a8eb9SGleb Smirnoff if ((r->af && src_host->af && r->af != src_host->af) || 50853b3a8eb9SGleb Smirnoff (r->af && dst_host->af && r->af != dst_host->af) || 50863b3a8eb9SGleb Smirnoff (src_host->af && dst_host->af && 50873b3a8eb9SGleb Smirnoff src_host->af != dst_host->af) || 50883b3a8eb9SGleb Smirnoff (src_host->ifindex && dst_host->ifindex && 50893b3a8eb9SGleb Smirnoff src_host->ifindex != dst_host->ifindex) || 50903b3a8eb9SGleb Smirnoff (src_host->ifindex && *interface->ifname && 50913b3a8eb9SGleb Smirnoff src_host->ifindex != if_nametoindex(interface->ifname)) || 50923b3a8eb9SGleb Smirnoff (dst_host->ifindex && *interface->ifname && 50933b3a8eb9SGleb Smirnoff dst_host->ifindex != if_nametoindex(interface->ifname))) 50943b3a8eb9SGleb Smirnoff continue; 50953b3a8eb9SGleb Smirnoff if (!r->af && src_host->af) 50963b3a8eb9SGleb Smirnoff r->af = src_host->af; 50973b3a8eb9SGleb Smirnoff else if (!r->af && dst_host->af) 50983b3a8eb9SGleb Smirnoff r->af = dst_host->af; 50993b3a8eb9SGleb Smirnoff 51003b3a8eb9SGleb Smirnoff if (*interface->ifname) 51013b3a8eb9SGleb Smirnoff strlcpy(r->ifname, interface->ifname, 51023b3a8eb9SGleb Smirnoff sizeof(r->ifname)); 51033b3a8eb9SGleb Smirnoff else if (if_indextoname(src_host->ifindex, ifname)) 51043b3a8eb9SGleb Smirnoff strlcpy(r->ifname, ifname, sizeof(r->ifname)); 51053b3a8eb9SGleb Smirnoff else if (if_indextoname(dst_host->ifindex, ifname)) 51063b3a8eb9SGleb Smirnoff strlcpy(r->ifname, ifname, sizeof(r->ifname)); 51073b3a8eb9SGleb Smirnoff else 51083b3a8eb9SGleb Smirnoff memset(r->ifname, '\0', sizeof(r->ifname)); 51093b3a8eb9SGleb Smirnoff 51103b3a8eb9SGleb Smirnoff if (strlcpy(r->label, label, sizeof(r->label)) >= 51113b3a8eb9SGleb Smirnoff sizeof(r->label)) 51123b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 51133b3a8eb9SGleb Smirnoff if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 51143b3a8eb9SGleb Smirnoff sizeof(r->tagname)) 51153b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 51163b3a8eb9SGleb Smirnoff if (strlcpy(r->match_tagname, match_tagname, 51173b3a8eb9SGleb Smirnoff sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 51183b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 51193b3a8eb9SGleb Smirnoff expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 51203b3a8eb9SGleb Smirnoff src_host, src_port, dst_host, dst_port, proto->proto); 51213b3a8eb9SGleb Smirnoff expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 51223b3a8eb9SGleb Smirnoff src_host, src_port, dst_host, dst_port, proto->proto); 51233b3a8eb9SGleb Smirnoff expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 51243b3a8eb9SGleb Smirnoff r->af, src_host, src_port, dst_host, dst_port, 51253b3a8eb9SGleb Smirnoff proto->proto); 51263b3a8eb9SGleb Smirnoff 51273b3a8eb9SGleb Smirnoff error += check_netmask(src_host, r->af); 51283b3a8eb9SGleb Smirnoff error += check_netmask(dst_host, r->af); 51293b3a8eb9SGleb Smirnoff 51303b3a8eb9SGleb Smirnoff r->ifnot = interface->not; 51313b3a8eb9SGleb Smirnoff r->proto = proto->proto; 51323b3a8eb9SGleb Smirnoff r->src.addr = src_host->addr; 51333b3a8eb9SGleb Smirnoff r->src.neg = src_host->not; 51343b3a8eb9SGleb Smirnoff r->src.port[0] = src_port->port[0]; 51353b3a8eb9SGleb Smirnoff r->src.port[1] = src_port->port[1]; 51363b3a8eb9SGleb Smirnoff r->src.port_op = src_port->op; 51373b3a8eb9SGleb Smirnoff r->dst.addr = dst_host->addr; 51383b3a8eb9SGleb Smirnoff r->dst.neg = dst_host->not; 51393b3a8eb9SGleb Smirnoff r->dst.port[0] = dst_port->port[0]; 51403b3a8eb9SGleb Smirnoff r->dst.port[1] = dst_port->port[1]; 51413b3a8eb9SGleb Smirnoff r->dst.port_op = dst_port->op; 51423b3a8eb9SGleb Smirnoff r->uid.op = uid->op; 51433b3a8eb9SGleb Smirnoff r->uid.uid[0] = uid->uid[0]; 51443b3a8eb9SGleb Smirnoff r->uid.uid[1] = uid->uid[1]; 51453b3a8eb9SGleb Smirnoff r->gid.op = gid->op; 51463b3a8eb9SGleb Smirnoff r->gid.gid[0] = gid->gid[0]; 51473b3a8eb9SGleb Smirnoff r->gid.gid[1] = gid->gid[1]; 51483b3a8eb9SGleb Smirnoff r->type = icmp_type->type; 51493b3a8eb9SGleb Smirnoff r->code = icmp_type->code; 51503b3a8eb9SGleb Smirnoff 51513b3a8eb9SGleb Smirnoff if ((keep_state == PF_STATE_MODULATE || 51523b3a8eb9SGleb Smirnoff keep_state == PF_STATE_SYNPROXY) && 51533b3a8eb9SGleb Smirnoff r->proto && r->proto != IPPROTO_TCP) 51543b3a8eb9SGleb Smirnoff r->keep_state = PF_STATE_NORMAL; 51553b3a8eb9SGleb Smirnoff else 51563b3a8eb9SGleb Smirnoff r->keep_state = keep_state; 51573b3a8eb9SGleb Smirnoff 51583b3a8eb9SGleb Smirnoff if (r->proto && r->proto != IPPROTO_TCP) { 51593b3a8eb9SGleb Smirnoff r->flags = 0; 51603b3a8eb9SGleb Smirnoff r->flagset = 0; 51613b3a8eb9SGleb Smirnoff } else { 51623b3a8eb9SGleb Smirnoff r->flags = flags; 51633b3a8eb9SGleb Smirnoff r->flagset = flagset; 51643b3a8eb9SGleb Smirnoff } 51653b3a8eb9SGleb Smirnoff if (icmp_type->proto && r->proto != icmp_type->proto) { 51663b3a8eb9SGleb Smirnoff yyerror("icmp-type mismatch"); 51673b3a8eb9SGleb Smirnoff error++; 51683b3a8eb9SGleb Smirnoff } 51693b3a8eb9SGleb Smirnoff 51703b3a8eb9SGleb Smirnoff if (src_os && src_os->os) { 51713b3a8eb9SGleb Smirnoff r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 51723b3a8eb9SGleb Smirnoff if ((pf->opts & PF_OPT_VERBOSE2) && 51733b3a8eb9SGleb Smirnoff r->os_fingerprint == PF_OSFP_NOMATCH) 51743b3a8eb9SGleb Smirnoff fprintf(stderr, 51753b3a8eb9SGleb Smirnoff "warning: unknown '%s' OS fingerprint\n", 51763b3a8eb9SGleb Smirnoff src_os->os); 51773b3a8eb9SGleb Smirnoff } else { 51783b3a8eb9SGleb Smirnoff r->os_fingerprint = PF_OSFP_ANY; 51793b3a8eb9SGleb Smirnoff } 51803b3a8eb9SGleb Smirnoff 51813b3a8eb9SGleb Smirnoff TAILQ_INIT(&r->rpool.list); 51823b3a8eb9SGleb Smirnoff for (h = rpool_hosts; h != NULL; h = h->next) { 51833b3a8eb9SGleb Smirnoff pa = calloc(1, sizeof(struct pf_pooladdr)); 51843b3a8eb9SGleb Smirnoff if (pa == NULL) 51853b3a8eb9SGleb Smirnoff err(1, "expand_rule: calloc"); 51863b3a8eb9SGleb Smirnoff pa->addr = h->addr; 51873b3a8eb9SGleb Smirnoff if (h->ifname != NULL) { 51883b3a8eb9SGleb Smirnoff if (strlcpy(pa->ifname, h->ifname, 51893b3a8eb9SGleb Smirnoff sizeof(pa->ifname)) >= 51903b3a8eb9SGleb Smirnoff sizeof(pa->ifname)) 51913b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 51923b3a8eb9SGleb Smirnoff } else 51933b3a8eb9SGleb Smirnoff pa->ifname[0] = 0; 51943b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 51953b3a8eb9SGleb Smirnoff } 51963b3a8eb9SGleb Smirnoff 51973b3a8eb9SGleb Smirnoff if (rule_consistent(r, anchor_call[0]) < 0 || error) 51983b3a8eb9SGleb Smirnoff yyerror("skipping rule due to errors"); 51993b3a8eb9SGleb Smirnoff else { 52003b3a8eb9SGleb Smirnoff r->nr = pf->astack[pf->asd]->match++; 52013b3a8eb9SGleb Smirnoff pfctl_add_rule(pf, r, anchor_call); 52023b3a8eb9SGleb Smirnoff added++; 52033b3a8eb9SGleb Smirnoff } 52043b3a8eb9SGleb Smirnoff 52053b3a8eb9SGleb Smirnoff )))))))))); 52063b3a8eb9SGleb Smirnoff 52073b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 52083b3a8eb9SGleb Smirnoff FREE_LIST(struct node_proto, protos); 52093b3a8eb9SGleb Smirnoff FREE_LIST(struct node_host, src_hosts); 52103b3a8eb9SGleb Smirnoff FREE_LIST(struct node_port, src_ports); 52113b3a8eb9SGleb Smirnoff FREE_LIST(struct node_os, src_oses); 52123b3a8eb9SGleb Smirnoff FREE_LIST(struct node_host, dst_hosts); 52133b3a8eb9SGleb Smirnoff FREE_LIST(struct node_port, dst_ports); 52143b3a8eb9SGleb Smirnoff FREE_LIST(struct node_uid, uids); 52153b3a8eb9SGleb Smirnoff FREE_LIST(struct node_gid, gids); 52163b3a8eb9SGleb Smirnoff FREE_LIST(struct node_icmp, icmp_types); 52173b3a8eb9SGleb Smirnoff FREE_LIST(struct node_host, rpool_hosts); 52183b3a8eb9SGleb Smirnoff 52193b3a8eb9SGleb Smirnoff if (!added) 52203b3a8eb9SGleb Smirnoff yyerror("rule expands to no valid combination"); 52213b3a8eb9SGleb Smirnoff } 52223b3a8eb9SGleb Smirnoff 52233b3a8eb9SGleb Smirnoff int 52243b3a8eb9SGleb Smirnoff expand_skip_interface(struct node_if *interfaces) 52253b3a8eb9SGleb Smirnoff { 52263b3a8eb9SGleb Smirnoff int errs = 0; 52273b3a8eb9SGleb Smirnoff 52283b3a8eb9SGleb Smirnoff if (!interfaces || (!interfaces->next && !interfaces->not && 52293b3a8eb9SGleb Smirnoff !strcmp(interfaces->ifname, "none"))) { 52303b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 52313b3a8eb9SGleb Smirnoff printf("set skip on none\n"); 52323b3a8eb9SGleb Smirnoff errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 52333b3a8eb9SGleb Smirnoff return (errs); 52343b3a8eb9SGleb Smirnoff } 52353b3a8eb9SGleb Smirnoff 52363b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 52373b3a8eb9SGleb Smirnoff printf("set skip on {"); 52383b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 52393b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 52403b3a8eb9SGleb Smirnoff printf(" %s", interface->ifname); 52413b3a8eb9SGleb Smirnoff if (interface->not) { 52423b3a8eb9SGleb Smirnoff yyerror("skip on ! <interface> is not supported"); 52433b3a8eb9SGleb Smirnoff errs++; 52443b3a8eb9SGleb Smirnoff } else 52453b3a8eb9SGleb Smirnoff errs += pfctl_set_interface_flags(pf, 52463b3a8eb9SGleb Smirnoff interface->ifname, PFI_IFLAG_SKIP, 1); 52473b3a8eb9SGleb Smirnoff ); 52483b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 52493b3a8eb9SGleb Smirnoff printf(" }\n"); 52503b3a8eb9SGleb Smirnoff 52513b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 52523b3a8eb9SGleb Smirnoff 52533b3a8eb9SGleb Smirnoff if (errs) 52543b3a8eb9SGleb Smirnoff return (1); 52553b3a8eb9SGleb Smirnoff else 52563b3a8eb9SGleb Smirnoff return (0); 52573b3a8eb9SGleb Smirnoff } 52583b3a8eb9SGleb Smirnoff 52593b3a8eb9SGleb Smirnoff #undef FREE_LIST 52603b3a8eb9SGleb Smirnoff #undef LOOP_THROUGH 52613b3a8eb9SGleb Smirnoff 52623b3a8eb9SGleb Smirnoff int 52633b3a8eb9SGleb Smirnoff check_rulestate(int desired_state) 52643b3a8eb9SGleb Smirnoff { 52653b3a8eb9SGleb Smirnoff if (require_order && (rulestate > desired_state)) { 52663b3a8eb9SGleb Smirnoff yyerror("Rules must be in order: options, normalization, " 52673b3a8eb9SGleb Smirnoff "queueing, translation, filtering"); 52683b3a8eb9SGleb Smirnoff return (1); 52693b3a8eb9SGleb Smirnoff } 52703b3a8eb9SGleb Smirnoff rulestate = desired_state; 52713b3a8eb9SGleb Smirnoff return (0); 52723b3a8eb9SGleb Smirnoff } 52733b3a8eb9SGleb Smirnoff 52743b3a8eb9SGleb Smirnoff int 52753b3a8eb9SGleb Smirnoff kw_cmp(const void *k, const void *e) 52763b3a8eb9SGleb Smirnoff { 52773b3a8eb9SGleb Smirnoff return (strcmp(k, ((const struct keywords *)e)->k_name)); 52783b3a8eb9SGleb Smirnoff } 52793b3a8eb9SGleb Smirnoff 52803b3a8eb9SGleb Smirnoff int 52813b3a8eb9SGleb Smirnoff lookup(char *s) 52823b3a8eb9SGleb Smirnoff { 52833b3a8eb9SGleb Smirnoff /* this has to be sorted always */ 52843b3a8eb9SGleb Smirnoff static const struct keywords keywords[] = { 52853b3a8eb9SGleb Smirnoff { "all", ALL}, 52863b3a8eb9SGleb Smirnoff { "allow-opts", ALLOWOPTS}, 52873b3a8eb9SGleb Smirnoff { "altq", ALTQ}, 52883b3a8eb9SGleb Smirnoff { "anchor", ANCHOR}, 52893b3a8eb9SGleb Smirnoff { "antispoof", ANTISPOOF}, 52903b3a8eb9SGleb Smirnoff { "any", ANY}, 52913b3a8eb9SGleb Smirnoff { "bandwidth", BANDWIDTH}, 52923b3a8eb9SGleb Smirnoff { "binat", BINAT}, 52933b3a8eb9SGleb Smirnoff { "binat-anchor", BINATANCHOR}, 52943b3a8eb9SGleb Smirnoff { "bitmask", BITMASK}, 52953b3a8eb9SGleb Smirnoff { "block", BLOCK}, 52963b3a8eb9SGleb Smirnoff { "block-policy", BLOCKPOLICY}, 5297*a5b789f6SErmal Luçi { "buckets", BUCKETS}, 52983b3a8eb9SGleb Smirnoff { "cbq", CBQ}, 52993b3a8eb9SGleb Smirnoff { "code", CODE}, 53003b3a8eb9SGleb Smirnoff { "crop", FRAGCROP}, 53013b3a8eb9SGleb Smirnoff { "debug", DEBUG}, 53023b3a8eb9SGleb Smirnoff { "divert-reply", DIVERTREPLY}, 53033b3a8eb9SGleb Smirnoff { "divert-to", DIVERTTO}, 53043b3a8eb9SGleb Smirnoff { "drop", DROP}, 53053b3a8eb9SGleb Smirnoff { "drop-ovl", FRAGDROP}, 53063b3a8eb9SGleb Smirnoff { "dup-to", DUPTO}, 5307*a5b789f6SErmal Luçi { "fairq", FAIRQ}, 53083b3a8eb9SGleb Smirnoff { "fastroute", FASTROUTE}, 53093b3a8eb9SGleb Smirnoff { "file", FILENAME}, 53103b3a8eb9SGleb Smirnoff { "fingerprints", FINGERPRINTS}, 53113b3a8eb9SGleb Smirnoff { "flags", FLAGS}, 53123b3a8eb9SGleb Smirnoff { "floating", FLOATING}, 53133b3a8eb9SGleb Smirnoff { "flush", FLUSH}, 53143b3a8eb9SGleb Smirnoff { "for", FOR}, 53153b3a8eb9SGleb Smirnoff { "fragment", FRAGMENT}, 53163b3a8eb9SGleb Smirnoff { "from", FROM}, 53173b3a8eb9SGleb Smirnoff { "global", GLOBAL}, 53183b3a8eb9SGleb Smirnoff { "group", GROUP}, 53193b3a8eb9SGleb Smirnoff { "hfsc", HFSC}, 5320*a5b789f6SErmal Luçi { "hogs", HOGS}, 53213b3a8eb9SGleb Smirnoff { "hostid", HOSTID}, 53223b3a8eb9SGleb Smirnoff { "icmp-type", ICMPTYPE}, 53233b3a8eb9SGleb Smirnoff { "icmp6-type", ICMP6TYPE}, 53243b3a8eb9SGleb Smirnoff { "if-bound", IFBOUND}, 53253b3a8eb9SGleb Smirnoff { "in", IN}, 53263b3a8eb9SGleb Smirnoff { "include", INCLUDE}, 53273b3a8eb9SGleb Smirnoff { "inet", INET}, 53283b3a8eb9SGleb Smirnoff { "inet6", INET6}, 53293b3a8eb9SGleb Smirnoff { "keep", KEEP}, 53303b3a8eb9SGleb Smirnoff { "label", LABEL}, 53313b3a8eb9SGleb Smirnoff { "limit", LIMIT}, 53323b3a8eb9SGleb Smirnoff { "linkshare", LINKSHARE}, 53333b3a8eb9SGleb Smirnoff { "load", LOAD}, 53343b3a8eb9SGleb Smirnoff { "log", LOG}, 53353b3a8eb9SGleb Smirnoff { "loginterface", LOGINTERFACE}, 53363b3a8eb9SGleb Smirnoff { "max", MAXIMUM}, 53373b3a8eb9SGleb Smirnoff { "max-mss", MAXMSS}, 53383b3a8eb9SGleb Smirnoff { "max-src-conn", MAXSRCCONN}, 53393b3a8eb9SGleb Smirnoff { "max-src-conn-rate", MAXSRCCONNRATE}, 53403b3a8eb9SGleb Smirnoff { "max-src-nodes", MAXSRCNODES}, 53413b3a8eb9SGleb Smirnoff { "max-src-states", MAXSRCSTATES}, 53423b3a8eb9SGleb Smirnoff { "min-ttl", MINTTL}, 53433b3a8eb9SGleb Smirnoff { "modulate", MODULATE}, 53443b3a8eb9SGleb Smirnoff { "nat", NAT}, 53453b3a8eb9SGleb Smirnoff { "nat-anchor", NATANCHOR}, 53463b3a8eb9SGleb Smirnoff { "no", NO}, 53473b3a8eb9SGleb Smirnoff { "no-df", NODF}, 53483b3a8eb9SGleb Smirnoff { "no-route", NOROUTE}, 53493b3a8eb9SGleb Smirnoff { "no-sync", NOSYNC}, 53503b3a8eb9SGleb Smirnoff { "on", ON}, 53513b3a8eb9SGleb Smirnoff { "optimization", OPTIMIZATION}, 53523b3a8eb9SGleb Smirnoff { "os", OS}, 53533b3a8eb9SGleb Smirnoff { "out", OUT}, 53543b3a8eb9SGleb Smirnoff { "overload", OVERLOAD}, 53553b3a8eb9SGleb Smirnoff { "pass", PASS}, 53563b3a8eb9SGleb Smirnoff { "port", PORT}, 53573b3a8eb9SGleb Smirnoff { "priority", PRIORITY}, 53583b3a8eb9SGleb Smirnoff { "priq", PRIQ}, 53593b3a8eb9SGleb Smirnoff { "probability", PROBABILITY}, 53603b3a8eb9SGleb Smirnoff { "proto", PROTO}, 53613b3a8eb9SGleb Smirnoff { "qlimit", QLIMIT}, 53623b3a8eb9SGleb Smirnoff { "queue", QUEUE}, 53633b3a8eb9SGleb Smirnoff { "quick", QUICK}, 53643b3a8eb9SGleb Smirnoff { "random", RANDOM}, 53653b3a8eb9SGleb Smirnoff { "random-id", RANDOMID}, 53663b3a8eb9SGleb Smirnoff { "rdr", RDR}, 53673b3a8eb9SGleb Smirnoff { "rdr-anchor", RDRANCHOR}, 53683b3a8eb9SGleb Smirnoff { "realtime", REALTIME}, 53693b3a8eb9SGleb Smirnoff { "reassemble", REASSEMBLE}, 53703b3a8eb9SGleb Smirnoff { "reply-to", REPLYTO}, 53713b3a8eb9SGleb Smirnoff { "require-order", REQUIREORDER}, 53723b3a8eb9SGleb Smirnoff { "return", RETURN}, 53733b3a8eb9SGleb Smirnoff { "return-icmp", RETURNICMP}, 53743b3a8eb9SGleb Smirnoff { "return-icmp6", RETURNICMP6}, 53753b3a8eb9SGleb Smirnoff { "return-rst", RETURNRST}, 53763b3a8eb9SGleb Smirnoff { "round-robin", ROUNDROBIN}, 53773b3a8eb9SGleb Smirnoff { "route", ROUTE}, 53783b3a8eb9SGleb Smirnoff { "route-to", ROUTETO}, 53793b3a8eb9SGleb Smirnoff { "rtable", RTABLE}, 53803b3a8eb9SGleb Smirnoff { "rule", RULE}, 53813b3a8eb9SGleb Smirnoff { "ruleset-optimization", RULESET_OPTIMIZATION}, 53823b3a8eb9SGleb Smirnoff { "scrub", SCRUB}, 53833b3a8eb9SGleb Smirnoff { "set", SET}, 53843b3a8eb9SGleb Smirnoff { "set-tos", SETTOS}, 53853b3a8eb9SGleb Smirnoff { "skip", SKIP}, 53863b3a8eb9SGleb Smirnoff { "sloppy", SLOPPY}, 53873b3a8eb9SGleb Smirnoff { "source-hash", SOURCEHASH}, 53883b3a8eb9SGleb Smirnoff { "source-track", SOURCETRACK}, 53893b3a8eb9SGleb Smirnoff { "state", STATE}, 53903b3a8eb9SGleb Smirnoff { "state-defaults", STATEDEFAULTS}, 53913b3a8eb9SGleb Smirnoff { "state-policy", STATEPOLICY}, 53923b3a8eb9SGleb Smirnoff { "static-port", STATICPORT}, 53933b3a8eb9SGleb Smirnoff { "sticky-address", STICKYADDRESS}, 53943b3a8eb9SGleb Smirnoff { "synproxy", SYNPROXY}, 53953b3a8eb9SGleb Smirnoff { "table", TABLE}, 53963b3a8eb9SGleb Smirnoff { "tag", TAG}, 53973b3a8eb9SGleb Smirnoff { "tagged", TAGGED}, 53983b3a8eb9SGleb Smirnoff { "tbrsize", TBRSIZE}, 53993b3a8eb9SGleb Smirnoff { "timeout", TIMEOUT}, 54003b3a8eb9SGleb Smirnoff { "to", TO}, 54013b3a8eb9SGleb Smirnoff { "tos", TOS}, 54023b3a8eb9SGleb Smirnoff { "ttl", TTL}, 54033b3a8eb9SGleb Smirnoff { "upperlimit", UPPERLIMIT}, 54043b3a8eb9SGleb Smirnoff { "urpf-failed", URPFFAILED}, 54053b3a8eb9SGleb Smirnoff { "user", USER}, 54063b3a8eb9SGleb Smirnoff }; 54073b3a8eb9SGleb Smirnoff const struct keywords *p; 54083b3a8eb9SGleb Smirnoff 54093b3a8eb9SGleb Smirnoff p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 54103b3a8eb9SGleb Smirnoff sizeof(keywords[0]), kw_cmp); 54113b3a8eb9SGleb Smirnoff 54123b3a8eb9SGleb Smirnoff if (p) { 54133b3a8eb9SGleb Smirnoff if (debug > 1) 54143b3a8eb9SGleb Smirnoff fprintf(stderr, "%s: %d\n", s, p->k_val); 54153b3a8eb9SGleb Smirnoff return (p->k_val); 54163b3a8eb9SGleb Smirnoff } else { 54173b3a8eb9SGleb Smirnoff if (debug > 1) 54183b3a8eb9SGleb Smirnoff fprintf(stderr, "string: %s\n", s); 54193b3a8eb9SGleb Smirnoff return (STRING); 54203b3a8eb9SGleb Smirnoff } 54213b3a8eb9SGleb Smirnoff } 54223b3a8eb9SGleb Smirnoff 54233b3a8eb9SGleb Smirnoff #define MAXPUSHBACK 128 54243b3a8eb9SGleb Smirnoff 54253b3a8eb9SGleb Smirnoff char *parsebuf; 54263b3a8eb9SGleb Smirnoff int parseindex; 54273b3a8eb9SGleb Smirnoff char pushback_buffer[MAXPUSHBACK]; 54283b3a8eb9SGleb Smirnoff int pushback_index = 0; 54293b3a8eb9SGleb Smirnoff 54303b3a8eb9SGleb Smirnoff int 54313b3a8eb9SGleb Smirnoff lgetc(int quotec) 54323b3a8eb9SGleb Smirnoff { 54333b3a8eb9SGleb Smirnoff int c, next; 54343b3a8eb9SGleb Smirnoff 54353b3a8eb9SGleb Smirnoff if (parsebuf) { 54363b3a8eb9SGleb Smirnoff /* Read character from the parsebuffer instead of input. */ 54373b3a8eb9SGleb Smirnoff if (parseindex >= 0) { 54383b3a8eb9SGleb Smirnoff c = parsebuf[parseindex++]; 54393b3a8eb9SGleb Smirnoff if (c != '\0') 54403b3a8eb9SGleb Smirnoff return (c); 54413b3a8eb9SGleb Smirnoff parsebuf = NULL; 54423b3a8eb9SGleb Smirnoff } else 54433b3a8eb9SGleb Smirnoff parseindex++; 54443b3a8eb9SGleb Smirnoff } 54453b3a8eb9SGleb Smirnoff 54463b3a8eb9SGleb Smirnoff if (pushback_index) 54473b3a8eb9SGleb Smirnoff return (pushback_buffer[--pushback_index]); 54483b3a8eb9SGleb Smirnoff 54493b3a8eb9SGleb Smirnoff if (quotec) { 54503b3a8eb9SGleb Smirnoff if ((c = getc(file->stream)) == EOF) { 54513b3a8eb9SGleb Smirnoff yyerror("reached end of file while parsing quoted string"); 54523b3a8eb9SGleb Smirnoff if (popfile() == EOF) 54533b3a8eb9SGleb Smirnoff return (EOF); 54543b3a8eb9SGleb Smirnoff return (quotec); 54553b3a8eb9SGleb Smirnoff } 54563b3a8eb9SGleb Smirnoff return (c); 54573b3a8eb9SGleb Smirnoff } 54583b3a8eb9SGleb Smirnoff 54593b3a8eb9SGleb Smirnoff while ((c = getc(file->stream)) == '\\') { 54603b3a8eb9SGleb Smirnoff next = getc(file->stream); 54613b3a8eb9SGleb Smirnoff if (next != '\n') { 54623b3a8eb9SGleb Smirnoff c = next; 54633b3a8eb9SGleb Smirnoff break; 54643b3a8eb9SGleb Smirnoff } 54653b3a8eb9SGleb Smirnoff yylval.lineno = file->lineno; 54663b3a8eb9SGleb Smirnoff file->lineno++; 54673b3a8eb9SGleb Smirnoff } 54683b3a8eb9SGleb Smirnoff 54693b3a8eb9SGleb Smirnoff while (c == EOF) { 54703b3a8eb9SGleb Smirnoff if (popfile() == EOF) 54713b3a8eb9SGleb Smirnoff return (EOF); 54723b3a8eb9SGleb Smirnoff c = getc(file->stream); 54733b3a8eb9SGleb Smirnoff } 54743b3a8eb9SGleb Smirnoff return (c); 54753b3a8eb9SGleb Smirnoff } 54763b3a8eb9SGleb Smirnoff 54773b3a8eb9SGleb Smirnoff int 54783b3a8eb9SGleb Smirnoff lungetc(int c) 54793b3a8eb9SGleb Smirnoff { 54803b3a8eb9SGleb Smirnoff if (c == EOF) 54813b3a8eb9SGleb Smirnoff return (EOF); 54823b3a8eb9SGleb Smirnoff if (parsebuf) { 54833b3a8eb9SGleb Smirnoff parseindex--; 54843b3a8eb9SGleb Smirnoff if (parseindex >= 0) 54853b3a8eb9SGleb Smirnoff return (c); 54863b3a8eb9SGleb Smirnoff } 54873b3a8eb9SGleb Smirnoff if (pushback_index < MAXPUSHBACK-1) 54883b3a8eb9SGleb Smirnoff return (pushback_buffer[pushback_index++] = c); 54893b3a8eb9SGleb Smirnoff else 54903b3a8eb9SGleb Smirnoff return (EOF); 54913b3a8eb9SGleb Smirnoff } 54923b3a8eb9SGleb Smirnoff 54933b3a8eb9SGleb Smirnoff int 54943b3a8eb9SGleb Smirnoff findeol(void) 54953b3a8eb9SGleb Smirnoff { 54963b3a8eb9SGleb Smirnoff int c; 54973b3a8eb9SGleb Smirnoff 54983b3a8eb9SGleb Smirnoff parsebuf = NULL; 54993b3a8eb9SGleb Smirnoff 55003b3a8eb9SGleb Smirnoff /* skip to either EOF or the first real EOL */ 55013b3a8eb9SGleb Smirnoff while (1) { 55023b3a8eb9SGleb Smirnoff if (pushback_index) 55033b3a8eb9SGleb Smirnoff c = pushback_buffer[--pushback_index]; 55043b3a8eb9SGleb Smirnoff else 55053b3a8eb9SGleb Smirnoff c = lgetc(0); 55063b3a8eb9SGleb Smirnoff if (c == '\n') { 55073b3a8eb9SGleb Smirnoff file->lineno++; 55083b3a8eb9SGleb Smirnoff break; 55093b3a8eb9SGleb Smirnoff } 55103b3a8eb9SGleb Smirnoff if (c == EOF) 55113b3a8eb9SGleb Smirnoff break; 55123b3a8eb9SGleb Smirnoff } 55133b3a8eb9SGleb Smirnoff return (ERROR); 55143b3a8eb9SGleb Smirnoff } 55153b3a8eb9SGleb Smirnoff 55163b3a8eb9SGleb Smirnoff int 55173b3a8eb9SGleb Smirnoff yylex(void) 55183b3a8eb9SGleb Smirnoff { 55193b3a8eb9SGleb Smirnoff char buf[8096]; 55203b3a8eb9SGleb Smirnoff char *p, *val; 55213b3a8eb9SGleb Smirnoff int quotec, next, c; 55223b3a8eb9SGleb Smirnoff int token; 55233b3a8eb9SGleb Smirnoff 55243b3a8eb9SGleb Smirnoff top: 55253b3a8eb9SGleb Smirnoff p = buf; 55263b3a8eb9SGleb Smirnoff while ((c = lgetc(0)) == ' ' || c == '\t') 55273b3a8eb9SGleb Smirnoff ; /* nothing */ 55283b3a8eb9SGleb Smirnoff 55293b3a8eb9SGleb Smirnoff yylval.lineno = file->lineno; 55303b3a8eb9SGleb Smirnoff if (c == '#') 55313b3a8eb9SGleb Smirnoff while ((c = lgetc(0)) != '\n' && c != EOF) 55323b3a8eb9SGleb Smirnoff ; /* nothing */ 55333b3a8eb9SGleb Smirnoff if (c == '$' && parsebuf == NULL) { 55343b3a8eb9SGleb Smirnoff while (1) { 55353b3a8eb9SGleb Smirnoff if ((c = lgetc(0)) == EOF) 55363b3a8eb9SGleb Smirnoff return (0); 55373b3a8eb9SGleb Smirnoff 55383b3a8eb9SGleb Smirnoff if (p + 1 >= buf + sizeof(buf) - 1) { 55393b3a8eb9SGleb Smirnoff yyerror("string too long"); 55403b3a8eb9SGleb Smirnoff return (findeol()); 55413b3a8eb9SGleb Smirnoff } 55423b3a8eb9SGleb Smirnoff if (isalnum(c) || c == '_') { 55433b3a8eb9SGleb Smirnoff *p++ = (char)c; 55443b3a8eb9SGleb Smirnoff continue; 55453b3a8eb9SGleb Smirnoff } 55463b3a8eb9SGleb Smirnoff *p = '\0'; 55473b3a8eb9SGleb Smirnoff lungetc(c); 55483b3a8eb9SGleb Smirnoff break; 55493b3a8eb9SGleb Smirnoff } 55503b3a8eb9SGleb Smirnoff val = symget(buf); 55513b3a8eb9SGleb Smirnoff if (val == NULL) { 55523b3a8eb9SGleb Smirnoff yyerror("macro '%s' not defined", buf); 55533b3a8eb9SGleb Smirnoff return (findeol()); 55543b3a8eb9SGleb Smirnoff } 55553b3a8eb9SGleb Smirnoff parsebuf = val; 55563b3a8eb9SGleb Smirnoff parseindex = 0; 55573b3a8eb9SGleb Smirnoff goto top; 55583b3a8eb9SGleb Smirnoff } 55593b3a8eb9SGleb Smirnoff 55603b3a8eb9SGleb Smirnoff switch (c) { 55613b3a8eb9SGleb Smirnoff case '\'': 55623b3a8eb9SGleb Smirnoff case '"': 55633b3a8eb9SGleb Smirnoff quotec = c; 55643b3a8eb9SGleb Smirnoff while (1) { 55653b3a8eb9SGleb Smirnoff if ((c = lgetc(quotec)) == EOF) 55663b3a8eb9SGleb Smirnoff return (0); 55673b3a8eb9SGleb Smirnoff if (c == '\n') { 55683b3a8eb9SGleb Smirnoff file->lineno++; 55693b3a8eb9SGleb Smirnoff continue; 55703b3a8eb9SGleb Smirnoff } else if (c == '\\') { 55713b3a8eb9SGleb Smirnoff if ((next = lgetc(quotec)) == EOF) 55723b3a8eb9SGleb Smirnoff return (0); 55733b3a8eb9SGleb Smirnoff if (next == quotec || c == ' ' || c == '\t') 55743b3a8eb9SGleb Smirnoff c = next; 55753b3a8eb9SGleb Smirnoff else if (next == '\n') 55763b3a8eb9SGleb Smirnoff continue; 55773b3a8eb9SGleb Smirnoff else 55783b3a8eb9SGleb Smirnoff lungetc(next); 55793b3a8eb9SGleb Smirnoff } else if (c == quotec) { 55803b3a8eb9SGleb Smirnoff *p = '\0'; 55813b3a8eb9SGleb Smirnoff break; 55823b3a8eb9SGleb Smirnoff } 55833b3a8eb9SGleb Smirnoff if (p + 1 >= buf + sizeof(buf) - 1) { 55843b3a8eb9SGleb Smirnoff yyerror("string too long"); 55853b3a8eb9SGleb Smirnoff return (findeol()); 55863b3a8eb9SGleb Smirnoff } 55873b3a8eb9SGleb Smirnoff *p++ = (char)c; 55883b3a8eb9SGleb Smirnoff } 55893b3a8eb9SGleb Smirnoff yylval.v.string = strdup(buf); 55903b3a8eb9SGleb Smirnoff if (yylval.v.string == NULL) 55913b3a8eb9SGleb Smirnoff err(1, "yylex: strdup"); 55923b3a8eb9SGleb Smirnoff return (STRING); 55933b3a8eb9SGleb Smirnoff case '<': 55943b3a8eb9SGleb Smirnoff next = lgetc(0); 55953b3a8eb9SGleb Smirnoff if (next == '>') { 55963b3a8eb9SGleb Smirnoff yylval.v.i = PF_OP_XRG; 55973b3a8eb9SGleb Smirnoff return (PORTBINARY); 55983b3a8eb9SGleb Smirnoff } 55993b3a8eb9SGleb Smirnoff lungetc(next); 56003b3a8eb9SGleb Smirnoff break; 56013b3a8eb9SGleb Smirnoff case '>': 56023b3a8eb9SGleb Smirnoff next = lgetc(0); 56033b3a8eb9SGleb Smirnoff if (next == '<') { 56043b3a8eb9SGleb Smirnoff yylval.v.i = PF_OP_IRG; 56053b3a8eb9SGleb Smirnoff return (PORTBINARY); 56063b3a8eb9SGleb Smirnoff } 56073b3a8eb9SGleb Smirnoff lungetc(next); 56083b3a8eb9SGleb Smirnoff break; 56093b3a8eb9SGleb Smirnoff case '-': 56103b3a8eb9SGleb Smirnoff next = lgetc(0); 56113b3a8eb9SGleb Smirnoff if (next == '>') 56123b3a8eb9SGleb Smirnoff return (ARROW); 56133b3a8eb9SGleb Smirnoff lungetc(next); 56143b3a8eb9SGleb Smirnoff break; 56153b3a8eb9SGleb Smirnoff } 56163b3a8eb9SGleb Smirnoff 56173b3a8eb9SGleb Smirnoff #define allowed_to_end_number(x) \ 56183b3a8eb9SGleb Smirnoff (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 56193b3a8eb9SGleb Smirnoff 56203b3a8eb9SGleb Smirnoff if (c == '-' || isdigit(c)) { 56213b3a8eb9SGleb Smirnoff do { 56223b3a8eb9SGleb Smirnoff *p++ = c; 56233b3a8eb9SGleb Smirnoff if ((unsigned)(p-buf) >= sizeof(buf)) { 56243b3a8eb9SGleb Smirnoff yyerror("string too long"); 56253b3a8eb9SGleb Smirnoff return (findeol()); 56263b3a8eb9SGleb Smirnoff } 56273b3a8eb9SGleb Smirnoff } while ((c = lgetc(0)) != EOF && isdigit(c)); 56283b3a8eb9SGleb Smirnoff lungetc(c); 56293b3a8eb9SGleb Smirnoff if (p == buf + 1 && buf[0] == '-') 56303b3a8eb9SGleb Smirnoff goto nodigits; 56313b3a8eb9SGleb Smirnoff if (c == EOF || allowed_to_end_number(c)) { 56323b3a8eb9SGleb Smirnoff const char *errstr = NULL; 56333b3a8eb9SGleb Smirnoff 56343b3a8eb9SGleb Smirnoff *p = '\0'; 56353b3a8eb9SGleb Smirnoff yylval.v.number = strtonum(buf, LLONG_MIN, 56363b3a8eb9SGleb Smirnoff LLONG_MAX, &errstr); 56373b3a8eb9SGleb Smirnoff if (errstr) { 56383b3a8eb9SGleb Smirnoff yyerror("\"%s\" invalid number: %s", 56393b3a8eb9SGleb Smirnoff buf, errstr); 56403b3a8eb9SGleb Smirnoff return (findeol()); 56413b3a8eb9SGleb Smirnoff } 56423b3a8eb9SGleb Smirnoff return (NUMBER); 56433b3a8eb9SGleb Smirnoff } else { 56443b3a8eb9SGleb Smirnoff nodigits: 56453b3a8eb9SGleb Smirnoff while (p > buf + 1) 56463b3a8eb9SGleb Smirnoff lungetc(*--p); 56473b3a8eb9SGleb Smirnoff c = *--p; 56483b3a8eb9SGleb Smirnoff if (c == '-') 56493b3a8eb9SGleb Smirnoff return (c); 56503b3a8eb9SGleb Smirnoff } 56513b3a8eb9SGleb Smirnoff } 56523b3a8eb9SGleb Smirnoff 56533b3a8eb9SGleb Smirnoff #define allowed_in_string(x) \ 56543b3a8eb9SGleb Smirnoff (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 56553b3a8eb9SGleb Smirnoff x != '{' && x != '}' && x != '<' && x != '>' && \ 56563b3a8eb9SGleb Smirnoff x != '!' && x != '=' && x != '/' && x != '#' && \ 56573b3a8eb9SGleb Smirnoff x != ',')) 56583b3a8eb9SGleb Smirnoff 56593b3a8eb9SGleb Smirnoff if (isalnum(c) || c == ':' || c == '_') { 56603b3a8eb9SGleb Smirnoff do { 56613b3a8eb9SGleb Smirnoff *p++ = c; 56623b3a8eb9SGleb Smirnoff if ((unsigned)(p-buf) >= sizeof(buf)) { 56633b3a8eb9SGleb Smirnoff yyerror("string too long"); 56643b3a8eb9SGleb Smirnoff return (findeol()); 56653b3a8eb9SGleb Smirnoff } 56663b3a8eb9SGleb Smirnoff } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 56673b3a8eb9SGleb Smirnoff lungetc(c); 56683b3a8eb9SGleb Smirnoff *p = '\0'; 56693b3a8eb9SGleb Smirnoff if ((token = lookup(buf)) == STRING) 56703b3a8eb9SGleb Smirnoff if ((yylval.v.string = strdup(buf)) == NULL) 56713b3a8eb9SGleb Smirnoff err(1, "yylex: strdup"); 56723b3a8eb9SGleb Smirnoff return (token); 56733b3a8eb9SGleb Smirnoff } 56743b3a8eb9SGleb Smirnoff if (c == '\n') { 56753b3a8eb9SGleb Smirnoff yylval.lineno = file->lineno; 56763b3a8eb9SGleb Smirnoff file->lineno++; 56773b3a8eb9SGleb Smirnoff } 56783b3a8eb9SGleb Smirnoff if (c == EOF) 56793b3a8eb9SGleb Smirnoff return (0); 56803b3a8eb9SGleb Smirnoff return (c); 56813b3a8eb9SGleb Smirnoff } 56823b3a8eb9SGleb Smirnoff 56833b3a8eb9SGleb Smirnoff int 56843b3a8eb9SGleb Smirnoff check_file_secrecy(int fd, const char *fname) 56853b3a8eb9SGleb Smirnoff { 56863b3a8eb9SGleb Smirnoff struct stat st; 56873b3a8eb9SGleb Smirnoff 56883b3a8eb9SGleb Smirnoff if (fstat(fd, &st)) { 56893b3a8eb9SGleb Smirnoff warn("cannot stat %s", fname); 56903b3a8eb9SGleb Smirnoff return (-1); 56913b3a8eb9SGleb Smirnoff } 56923b3a8eb9SGleb Smirnoff if (st.st_uid != 0 && st.st_uid != getuid()) { 56933b3a8eb9SGleb Smirnoff warnx("%s: owner not root or current user", fname); 56943b3a8eb9SGleb Smirnoff return (-1); 56953b3a8eb9SGleb Smirnoff } 56963b3a8eb9SGleb Smirnoff if (st.st_mode & (S_IRWXG | S_IRWXO)) { 56973b3a8eb9SGleb Smirnoff warnx("%s: group/world readable/writeable", fname); 56983b3a8eb9SGleb Smirnoff return (-1); 56993b3a8eb9SGleb Smirnoff } 57003b3a8eb9SGleb Smirnoff return (0); 57013b3a8eb9SGleb Smirnoff } 57023b3a8eb9SGleb Smirnoff 57033b3a8eb9SGleb Smirnoff struct file * 57043b3a8eb9SGleb Smirnoff pushfile(const char *name, int secret) 57053b3a8eb9SGleb Smirnoff { 57063b3a8eb9SGleb Smirnoff struct file *nfile; 57073b3a8eb9SGleb Smirnoff 57083b3a8eb9SGleb Smirnoff if ((nfile = calloc(1, sizeof(struct file))) == NULL || 57093b3a8eb9SGleb Smirnoff (nfile->name = strdup(name)) == NULL) { 57103b3a8eb9SGleb Smirnoff warn("malloc"); 57113b3a8eb9SGleb Smirnoff return (NULL); 57123b3a8eb9SGleb Smirnoff } 57133b3a8eb9SGleb Smirnoff if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 57143b3a8eb9SGleb Smirnoff nfile->stream = stdin; 57153b3a8eb9SGleb Smirnoff free(nfile->name); 57163b3a8eb9SGleb Smirnoff if ((nfile->name = strdup("stdin")) == NULL) { 57173b3a8eb9SGleb Smirnoff warn("strdup"); 57183b3a8eb9SGleb Smirnoff free(nfile); 57193b3a8eb9SGleb Smirnoff return (NULL); 57203b3a8eb9SGleb Smirnoff } 57213b3a8eb9SGleb Smirnoff } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 57223b3a8eb9SGleb Smirnoff warn("%s", nfile->name); 57233b3a8eb9SGleb Smirnoff free(nfile->name); 57243b3a8eb9SGleb Smirnoff free(nfile); 57253b3a8eb9SGleb Smirnoff return (NULL); 57263b3a8eb9SGleb Smirnoff } else if (secret && 57273b3a8eb9SGleb Smirnoff check_file_secrecy(fileno(nfile->stream), nfile->name)) { 57283b3a8eb9SGleb Smirnoff fclose(nfile->stream); 57293b3a8eb9SGleb Smirnoff free(nfile->name); 57303b3a8eb9SGleb Smirnoff free(nfile); 57313b3a8eb9SGleb Smirnoff return (NULL); 57323b3a8eb9SGleb Smirnoff } 57333b3a8eb9SGleb Smirnoff nfile->lineno = 1; 57343b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&files, nfile, entry); 57353b3a8eb9SGleb Smirnoff return (nfile); 57363b3a8eb9SGleb Smirnoff } 57373b3a8eb9SGleb Smirnoff 57383b3a8eb9SGleb Smirnoff int 57393b3a8eb9SGleb Smirnoff popfile(void) 57403b3a8eb9SGleb Smirnoff { 57413b3a8eb9SGleb Smirnoff struct file *prev; 57423b3a8eb9SGleb Smirnoff 57433b3a8eb9SGleb Smirnoff if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 57443b3a8eb9SGleb Smirnoff prev->errors += file->errors; 57453b3a8eb9SGleb Smirnoff TAILQ_REMOVE(&files, file, entry); 57463b3a8eb9SGleb Smirnoff fclose(file->stream); 57473b3a8eb9SGleb Smirnoff free(file->name); 57483b3a8eb9SGleb Smirnoff free(file); 57493b3a8eb9SGleb Smirnoff file = prev; 57503b3a8eb9SGleb Smirnoff return (0); 57513b3a8eb9SGleb Smirnoff } 57523b3a8eb9SGleb Smirnoff return (EOF); 57533b3a8eb9SGleb Smirnoff } 57543b3a8eb9SGleb Smirnoff 57553b3a8eb9SGleb Smirnoff int 57563b3a8eb9SGleb Smirnoff parse_config(char *filename, struct pfctl *xpf) 57573b3a8eb9SGleb Smirnoff { 57583b3a8eb9SGleb Smirnoff int errors = 0; 57593b3a8eb9SGleb Smirnoff struct sym *sym; 57603b3a8eb9SGleb Smirnoff 57613b3a8eb9SGleb Smirnoff pf = xpf; 57623b3a8eb9SGleb Smirnoff errors = 0; 57633b3a8eb9SGleb Smirnoff rulestate = PFCTL_STATE_NONE; 57643b3a8eb9SGleb Smirnoff returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 57653b3a8eb9SGleb Smirnoff returnicmp6default = 57663b3a8eb9SGleb Smirnoff (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 57673b3a8eb9SGleb Smirnoff blockpolicy = PFRULE_DROP; 57683b3a8eb9SGleb Smirnoff require_order = 1; 57693b3a8eb9SGleb Smirnoff 57703b3a8eb9SGleb Smirnoff if ((file = pushfile(filename, 0)) == NULL) { 57713b3a8eb9SGleb Smirnoff warn("cannot open the main config file!"); 57723b3a8eb9SGleb Smirnoff return (-1); 57733b3a8eb9SGleb Smirnoff } 57743b3a8eb9SGleb Smirnoff 57753b3a8eb9SGleb Smirnoff yyparse(); 57763b3a8eb9SGleb Smirnoff errors = file->errors; 57773b3a8eb9SGleb Smirnoff popfile(); 57783b3a8eb9SGleb Smirnoff 57793b3a8eb9SGleb Smirnoff /* Free macros and check which have not been used. */ 57803b3a8eb9SGleb Smirnoff while ((sym = TAILQ_FIRST(&symhead))) { 57813b3a8eb9SGleb Smirnoff if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 57823b3a8eb9SGleb Smirnoff fprintf(stderr, "warning: macro '%s' not " 57833b3a8eb9SGleb Smirnoff "used\n", sym->nam); 57843b3a8eb9SGleb Smirnoff free(sym->nam); 57853b3a8eb9SGleb Smirnoff free(sym->val); 57863b3a8eb9SGleb Smirnoff TAILQ_REMOVE(&symhead, sym, entry); 57873b3a8eb9SGleb Smirnoff free(sym); 57883b3a8eb9SGleb Smirnoff } 57893b3a8eb9SGleb Smirnoff 57903b3a8eb9SGleb Smirnoff return (errors ? -1 : 0); 57913b3a8eb9SGleb Smirnoff } 57923b3a8eb9SGleb Smirnoff 57933b3a8eb9SGleb Smirnoff int 57943b3a8eb9SGleb Smirnoff symset(const char *nam, const char *val, int persist) 57953b3a8eb9SGleb Smirnoff { 57963b3a8eb9SGleb Smirnoff struct sym *sym; 57973b3a8eb9SGleb Smirnoff 57983b3a8eb9SGleb Smirnoff for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 57993b3a8eb9SGleb Smirnoff sym = TAILQ_NEXT(sym, entry)) 58003b3a8eb9SGleb Smirnoff ; /* nothing */ 58013b3a8eb9SGleb Smirnoff 58023b3a8eb9SGleb Smirnoff if (sym != NULL) { 58033b3a8eb9SGleb Smirnoff if (sym->persist == 1) 58043b3a8eb9SGleb Smirnoff return (0); 58053b3a8eb9SGleb Smirnoff else { 58063b3a8eb9SGleb Smirnoff free(sym->nam); 58073b3a8eb9SGleb Smirnoff free(sym->val); 58083b3a8eb9SGleb Smirnoff TAILQ_REMOVE(&symhead, sym, entry); 58093b3a8eb9SGleb Smirnoff free(sym); 58103b3a8eb9SGleb Smirnoff } 58113b3a8eb9SGleb Smirnoff } 58123b3a8eb9SGleb Smirnoff if ((sym = calloc(1, sizeof(*sym))) == NULL) 58133b3a8eb9SGleb Smirnoff return (-1); 58143b3a8eb9SGleb Smirnoff 58153b3a8eb9SGleb Smirnoff sym->nam = strdup(nam); 58163b3a8eb9SGleb Smirnoff if (sym->nam == NULL) { 58173b3a8eb9SGleb Smirnoff free(sym); 58183b3a8eb9SGleb Smirnoff return (-1); 58193b3a8eb9SGleb Smirnoff } 58203b3a8eb9SGleb Smirnoff sym->val = strdup(val); 58213b3a8eb9SGleb Smirnoff if (sym->val == NULL) { 58223b3a8eb9SGleb Smirnoff free(sym->nam); 58233b3a8eb9SGleb Smirnoff free(sym); 58243b3a8eb9SGleb Smirnoff return (-1); 58253b3a8eb9SGleb Smirnoff } 58263b3a8eb9SGleb Smirnoff sym->used = 0; 58273b3a8eb9SGleb Smirnoff sym->persist = persist; 58283b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&symhead, sym, entry); 58293b3a8eb9SGleb Smirnoff return (0); 58303b3a8eb9SGleb Smirnoff } 58313b3a8eb9SGleb Smirnoff 58323b3a8eb9SGleb Smirnoff int 58333b3a8eb9SGleb Smirnoff pfctl_cmdline_symset(char *s) 58343b3a8eb9SGleb Smirnoff { 58353b3a8eb9SGleb Smirnoff char *sym, *val; 58363b3a8eb9SGleb Smirnoff int ret; 58373b3a8eb9SGleb Smirnoff 58383b3a8eb9SGleb Smirnoff if ((val = strrchr(s, '=')) == NULL) 58393b3a8eb9SGleb Smirnoff return (-1); 58403b3a8eb9SGleb Smirnoff 58413b3a8eb9SGleb Smirnoff if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 58423b3a8eb9SGleb Smirnoff err(1, "pfctl_cmdline_symset: malloc"); 58433b3a8eb9SGleb Smirnoff 58443b3a8eb9SGleb Smirnoff strlcpy(sym, s, strlen(s) - strlen(val) + 1); 58453b3a8eb9SGleb Smirnoff 58463b3a8eb9SGleb Smirnoff ret = symset(sym, val + 1, 1); 58473b3a8eb9SGleb Smirnoff free(sym); 58483b3a8eb9SGleb Smirnoff 58493b3a8eb9SGleb Smirnoff return (ret); 58503b3a8eb9SGleb Smirnoff } 58513b3a8eb9SGleb Smirnoff 58523b3a8eb9SGleb Smirnoff char * 58533b3a8eb9SGleb Smirnoff symget(const char *nam) 58543b3a8eb9SGleb Smirnoff { 58553b3a8eb9SGleb Smirnoff struct sym *sym; 58563b3a8eb9SGleb Smirnoff 58573b3a8eb9SGleb Smirnoff TAILQ_FOREACH(sym, &symhead, entry) 58583b3a8eb9SGleb Smirnoff if (strcmp(nam, sym->nam) == 0) { 58593b3a8eb9SGleb Smirnoff sym->used = 1; 58603b3a8eb9SGleb Smirnoff return (sym->val); 58613b3a8eb9SGleb Smirnoff } 58623b3a8eb9SGleb Smirnoff return (NULL); 58633b3a8eb9SGleb Smirnoff } 58643b3a8eb9SGleb Smirnoff 58653b3a8eb9SGleb Smirnoff void 58663b3a8eb9SGleb Smirnoff mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 58673b3a8eb9SGleb Smirnoff { 58683b3a8eb9SGleb Smirnoff int i; 58693b3a8eb9SGleb Smirnoff struct pf_rule *r; 58703b3a8eb9SGleb Smirnoff 58713b3a8eb9SGleb Smirnoff for (i = 0; i < PF_RULESET_MAX; ++i) { 58723b3a8eb9SGleb Smirnoff while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 58733b3a8eb9SGleb Smirnoff != NULL) { 58743b3a8eb9SGleb Smirnoff TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 58753b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 58763b3a8eb9SGleb Smirnoff dst->anchor->match++; 58773b3a8eb9SGleb Smirnoff } 58783b3a8eb9SGleb Smirnoff src->anchor->match = 0; 58793b3a8eb9SGleb Smirnoff while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 58803b3a8eb9SGleb Smirnoff != NULL) { 58813b3a8eb9SGleb Smirnoff TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 58823b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 58833b3a8eb9SGleb Smirnoff r, entries); 58843b3a8eb9SGleb Smirnoff } 58853b3a8eb9SGleb Smirnoff } 58863b3a8eb9SGleb Smirnoff } 58873b3a8eb9SGleb Smirnoff 58883b3a8eb9SGleb Smirnoff void 58893b3a8eb9SGleb Smirnoff decide_address_family(struct node_host *n, sa_family_t *af) 58903b3a8eb9SGleb Smirnoff { 58913b3a8eb9SGleb Smirnoff if (*af != 0 || n == NULL) 58923b3a8eb9SGleb Smirnoff return; 58933b3a8eb9SGleb Smirnoff *af = n->af; 58943b3a8eb9SGleb Smirnoff while ((n = n->next) != NULL) { 58953b3a8eb9SGleb Smirnoff if (n->af != *af) { 58963b3a8eb9SGleb Smirnoff *af = 0; 58973b3a8eb9SGleb Smirnoff return; 58983b3a8eb9SGleb Smirnoff } 58993b3a8eb9SGleb Smirnoff } 59003b3a8eb9SGleb Smirnoff } 59013b3a8eb9SGleb Smirnoff 59023b3a8eb9SGleb Smirnoff void 59033b3a8eb9SGleb Smirnoff remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 59043b3a8eb9SGleb Smirnoff { 59053b3a8eb9SGleb Smirnoff struct node_host *n = *nh, *prev = NULL; 59063b3a8eb9SGleb Smirnoff 59073b3a8eb9SGleb Smirnoff while (n != NULL) { 59083b3a8eb9SGleb Smirnoff if (*af && n->af && n->af != *af) { 59093b3a8eb9SGleb Smirnoff /* unlink and free n */ 59103b3a8eb9SGleb Smirnoff struct node_host *next = n->next; 59113b3a8eb9SGleb Smirnoff 59123b3a8eb9SGleb Smirnoff /* adjust tail pointer */ 59133b3a8eb9SGleb Smirnoff if (n == (*nh)->tail) 59143b3a8eb9SGleb Smirnoff (*nh)->tail = prev; 59153b3a8eb9SGleb Smirnoff /* adjust previous node's next pointer */ 59163b3a8eb9SGleb Smirnoff if (prev == NULL) 59173b3a8eb9SGleb Smirnoff *nh = next; 59183b3a8eb9SGleb Smirnoff else 59193b3a8eb9SGleb Smirnoff prev->next = next; 59203b3a8eb9SGleb Smirnoff /* free node */ 59213b3a8eb9SGleb Smirnoff if (n->ifname != NULL) 59223b3a8eb9SGleb Smirnoff free(n->ifname); 59233b3a8eb9SGleb Smirnoff free(n); 59243b3a8eb9SGleb Smirnoff n = next; 59253b3a8eb9SGleb Smirnoff } else { 59263b3a8eb9SGleb Smirnoff if (n->af && !*af) 59273b3a8eb9SGleb Smirnoff *af = n->af; 59283b3a8eb9SGleb Smirnoff prev = n; 59293b3a8eb9SGleb Smirnoff n = n->next; 59303b3a8eb9SGleb Smirnoff } 59313b3a8eb9SGleb Smirnoff } 59323b3a8eb9SGleb Smirnoff } 59333b3a8eb9SGleb Smirnoff 59343b3a8eb9SGleb Smirnoff int 59353b3a8eb9SGleb Smirnoff invalid_redirect(struct node_host *nh, sa_family_t af) 59363b3a8eb9SGleb Smirnoff { 59373b3a8eb9SGleb Smirnoff if (!af) { 59383b3a8eb9SGleb Smirnoff struct node_host *n; 59393b3a8eb9SGleb Smirnoff 59403b3a8eb9SGleb Smirnoff /* tables and dyniftl are ok without an address family */ 59413b3a8eb9SGleb Smirnoff for (n = nh; n != NULL; n = n->next) { 59423b3a8eb9SGleb Smirnoff if (n->addr.type != PF_ADDR_TABLE && 59433b3a8eb9SGleb Smirnoff n->addr.type != PF_ADDR_DYNIFTL) { 59443b3a8eb9SGleb Smirnoff yyerror("address family not given and " 59453b3a8eb9SGleb Smirnoff "translation address expands to multiple " 59463b3a8eb9SGleb Smirnoff "address families"); 59473b3a8eb9SGleb Smirnoff return (1); 59483b3a8eb9SGleb Smirnoff } 59493b3a8eb9SGleb Smirnoff } 59503b3a8eb9SGleb Smirnoff } 59513b3a8eb9SGleb Smirnoff if (nh == NULL) { 59523b3a8eb9SGleb Smirnoff yyerror("no translation address with matching address family " 59533b3a8eb9SGleb Smirnoff "found."); 59543b3a8eb9SGleb Smirnoff return (1); 59553b3a8eb9SGleb Smirnoff } 59563b3a8eb9SGleb Smirnoff return (0); 59573b3a8eb9SGleb Smirnoff } 59583b3a8eb9SGleb Smirnoff 59593b3a8eb9SGleb Smirnoff int 59603b3a8eb9SGleb Smirnoff atoul(char *s, u_long *ulvalp) 59613b3a8eb9SGleb Smirnoff { 59623b3a8eb9SGleb Smirnoff u_long ulval; 59633b3a8eb9SGleb Smirnoff char *ep; 59643b3a8eb9SGleb Smirnoff 59653b3a8eb9SGleb Smirnoff errno = 0; 59663b3a8eb9SGleb Smirnoff ulval = strtoul(s, &ep, 0); 59673b3a8eb9SGleb Smirnoff if (s[0] == '\0' || *ep != '\0') 59683b3a8eb9SGleb Smirnoff return (-1); 59693b3a8eb9SGleb Smirnoff if (errno == ERANGE && ulval == ULONG_MAX) 59703b3a8eb9SGleb Smirnoff return (-1); 59713b3a8eb9SGleb Smirnoff *ulvalp = ulval; 59723b3a8eb9SGleb Smirnoff return (0); 59733b3a8eb9SGleb Smirnoff } 59743b3a8eb9SGleb Smirnoff 59753b3a8eb9SGleb Smirnoff int 59763b3a8eb9SGleb Smirnoff getservice(char *n) 59773b3a8eb9SGleb Smirnoff { 59783b3a8eb9SGleb Smirnoff struct servent *s; 59793b3a8eb9SGleb Smirnoff u_long ulval; 59803b3a8eb9SGleb Smirnoff 59813b3a8eb9SGleb Smirnoff if (atoul(n, &ulval) == 0) { 59823b3a8eb9SGleb Smirnoff if (ulval > 65535) { 59833b3a8eb9SGleb Smirnoff yyerror("illegal port value %lu", ulval); 59843b3a8eb9SGleb Smirnoff return (-1); 59853b3a8eb9SGleb Smirnoff } 59863b3a8eb9SGleb Smirnoff return (htons(ulval)); 59873b3a8eb9SGleb Smirnoff } else { 59883b3a8eb9SGleb Smirnoff s = getservbyname(n, "tcp"); 59893b3a8eb9SGleb Smirnoff if (s == NULL) 59903b3a8eb9SGleb Smirnoff s = getservbyname(n, "udp"); 59913b3a8eb9SGleb Smirnoff if (s == NULL) { 59923b3a8eb9SGleb Smirnoff yyerror("unknown port %s", n); 59933b3a8eb9SGleb Smirnoff return (-1); 59943b3a8eb9SGleb Smirnoff } 59953b3a8eb9SGleb Smirnoff return (s->s_port); 59963b3a8eb9SGleb Smirnoff } 59973b3a8eb9SGleb Smirnoff } 59983b3a8eb9SGleb Smirnoff 59993b3a8eb9SGleb Smirnoff int 60003b3a8eb9SGleb Smirnoff rule_label(struct pf_rule *r, char *s) 60013b3a8eb9SGleb Smirnoff { 60023b3a8eb9SGleb Smirnoff if (s) { 60033b3a8eb9SGleb Smirnoff if (strlcpy(r->label, s, sizeof(r->label)) >= 60043b3a8eb9SGleb Smirnoff sizeof(r->label)) { 60053b3a8eb9SGleb Smirnoff yyerror("rule label too long (max %d chars)", 60063b3a8eb9SGleb Smirnoff sizeof(r->label)-1); 60073b3a8eb9SGleb Smirnoff return (-1); 60083b3a8eb9SGleb Smirnoff } 60093b3a8eb9SGleb Smirnoff } 60103b3a8eb9SGleb Smirnoff return (0); 60113b3a8eb9SGleb Smirnoff } 60123b3a8eb9SGleb Smirnoff 60133b3a8eb9SGleb Smirnoff u_int16_t 60143b3a8eb9SGleb Smirnoff parseicmpspec(char *w, sa_family_t af) 60153b3a8eb9SGleb Smirnoff { 60163b3a8eb9SGleb Smirnoff const struct icmpcodeent *p; 60173b3a8eb9SGleb Smirnoff u_long ulval; 60183b3a8eb9SGleb Smirnoff u_int8_t icmptype; 60193b3a8eb9SGleb Smirnoff 60203b3a8eb9SGleb Smirnoff if (af == AF_INET) 60213b3a8eb9SGleb Smirnoff icmptype = returnicmpdefault >> 8; 60223b3a8eb9SGleb Smirnoff else 60233b3a8eb9SGleb Smirnoff icmptype = returnicmp6default >> 8; 60243b3a8eb9SGleb Smirnoff 60253b3a8eb9SGleb Smirnoff if (atoul(w, &ulval) == -1) { 60263b3a8eb9SGleb Smirnoff if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 60273b3a8eb9SGleb Smirnoff yyerror("unknown icmp code %s", w); 60283b3a8eb9SGleb Smirnoff return (0); 60293b3a8eb9SGleb Smirnoff } 60303b3a8eb9SGleb Smirnoff ulval = p->code; 60313b3a8eb9SGleb Smirnoff } 60323b3a8eb9SGleb Smirnoff if (ulval > 255) { 60333b3a8eb9SGleb Smirnoff yyerror("invalid icmp code %lu", ulval); 60343b3a8eb9SGleb Smirnoff return (0); 60353b3a8eb9SGleb Smirnoff } 60363b3a8eb9SGleb Smirnoff return (icmptype << 8 | ulval); 60373b3a8eb9SGleb Smirnoff } 60383b3a8eb9SGleb Smirnoff 60393b3a8eb9SGleb Smirnoff int 60403b3a8eb9SGleb Smirnoff parseport(char *port, struct range *r, int extensions) 60413b3a8eb9SGleb Smirnoff { 60423b3a8eb9SGleb Smirnoff char *p = strchr(port, ':'); 60433b3a8eb9SGleb Smirnoff 60443b3a8eb9SGleb Smirnoff if (p == NULL) { 60453b3a8eb9SGleb Smirnoff if ((r->a = getservice(port)) == -1) 60463b3a8eb9SGleb Smirnoff return (-1); 60473b3a8eb9SGleb Smirnoff r->b = 0; 60483b3a8eb9SGleb Smirnoff r->t = PF_OP_NONE; 60493b3a8eb9SGleb Smirnoff return (0); 60503b3a8eb9SGleb Smirnoff } 60513b3a8eb9SGleb Smirnoff if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 60523b3a8eb9SGleb Smirnoff *p = 0; 60533b3a8eb9SGleb Smirnoff if ((r->a = getservice(port)) == -1) 60543b3a8eb9SGleb Smirnoff return (-1); 60553b3a8eb9SGleb Smirnoff r->b = 0; 60563b3a8eb9SGleb Smirnoff r->t = PF_OP_IRG; 60573b3a8eb9SGleb Smirnoff return (0); 60583b3a8eb9SGleb Smirnoff } 60593b3a8eb9SGleb Smirnoff if ((extensions & PPORT_RANGE)) { 60603b3a8eb9SGleb Smirnoff *p++ = 0; 60613b3a8eb9SGleb Smirnoff if ((r->a = getservice(port)) == -1 || 60623b3a8eb9SGleb Smirnoff (r->b = getservice(p)) == -1) 60633b3a8eb9SGleb Smirnoff return (-1); 60643b3a8eb9SGleb Smirnoff if (r->a == r->b) { 60653b3a8eb9SGleb Smirnoff r->b = 0; 60663b3a8eb9SGleb Smirnoff r->t = PF_OP_NONE; 60673b3a8eb9SGleb Smirnoff } else 60683b3a8eb9SGleb Smirnoff r->t = PF_OP_RRG; 60693b3a8eb9SGleb Smirnoff return (0); 60703b3a8eb9SGleb Smirnoff } 60713b3a8eb9SGleb Smirnoff return (-1); 60723b3a8eb9SGleb Smirnoff } 60733b3a8eb9SGleb Smirnoff 60743b3a8eb9SGleb Smirnoff int 60753b3a8eb9SGleb Smirnoff pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 60763b3a8eb9SGleb Smirnoff { 60773b3a8eb9SGleb Smirnoff struct loadanchors *la; 60783b3a8eb9SGleb Smirnoff 60793b3a8eb9SGleb Smirnoff TAILQ_FOREACH(la, &loadanchorshead, entries) { 60803b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 60813b3a8eb9SGleb Smirnoff fprintf(stderr, "\nLoading anchor %s from %s\n", 60823b3a8eb9SGleb Smirnoff la->anchorname, la->filename); 60833b3a8eb9SGleb Smirnoff if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 60843b3a8eb9SGleb Smirnoff la->anchorname, trans) == -1) 60853b3a8eb9SGleb Smirnoff return (-1); 60863b3a8eb9SGleb Smirnoff } 60873b3a8eb9SGleb Smirnoff 60883b3a8eb9SGleb Smirnoff return (0); 60893b3a8eb9SGleb Smirnoff } 60903b3a8eb9SGleb Smirnoff 60913b3a8eb9SGleb Smirnoff int 60923b3a8eb9SGleb Smirnoff rt_tableid_max(void) 60933b3a8eb9SGleb Smirnoff { 60943b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 60953b3a8eb9SGleb Smirnoff int fibs; 60963b3a8eb9SGleb Smirnoff size_t l = sizeof(fibs); 60973b3a8eb9SGleb Smirnoff 60983b3a8eb9SGleb Smirnoff if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1) 60993b3a8eb9SGleb Smirnoff fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */ 61003b3a8eb9SGleb Smirnoff /* 61013b3a8eb9SGleb Smirnoff * As the OpenBSD code only compares > and not >= we need to adjust 61023b3a8eb9SGleb Smirnoff * here given we only accept values of 0..n and want to avoid #ifdefs 61033b3a8eb9SGleb Smirnoff * in the grammer. 61043b3a8eb9SGleb Smirnoff */ 61053b3a8eb9SGleb Smirnoff return (fibs - 1); 61063b3a8eb9SGleb Smirnoff #else 61073b3a8eb9SGleb Smirnoff return (RT_TABLEID_MAX); 61083b3a8eb9SGleb Smirnoff #endif 61093b3a8eb9SGleb Smirnoff } 6110