xref: /freebsd/sbin/pfctl/parse.y (revision a5b789f65a306f8abd91a8b2eea77df2e77f90f6)
13b3a8eb9SGleb Smirnoff /*	$OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $	*/
23b3a8eb9SGleb Smirnoff 
33b3a8eb9SGleb Smirnoff /*
43b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
53b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
63b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
73b3a8eb9SGleb Smirnoff  * Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
83b3a8eb9SGleb Smirnoff  *
93b3a8eb9SGleb Smirnoff  * Redistribution and use in source and binary forms, with or without
103b3a8eb9SGleb Smirnoff  * modification, are permitted provided that the following conditions
113b3a8eb9SGleb Smirnoff  * are met:
123b3a8eb9SGleb Smirnoff  * 1. Redistributions of source code must retain the above copyright
133b3a8eb9SGleb Smirnoff  *    notice, this list of conditions and the following disclaimer.
143b3a8eb9SGleb Smirnoff  * 2. Redistributions in binary form must reproduce the above copyright
153b3a8eb9SGleb Smirnoff  *    notice, this list of conditions and the following disclaimer in the
163b3a8eb9SGleb Smirnoff  *    documentation and/or other materials provided with the distribution.
173b3a8eb9SGleb Smirnoff  *
183b3a8eb9SGleb Smirnoff  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
193b3a8eb9SGleb Smirnoff  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
203b3a8eb9SGleb Smirnoff  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
213b3a8eb9SGleb Smirnoff  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
223b3a8eb9SGleb Smirnoff  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
233b3a8eb9SGleb Smirnoff  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
243b3a8eb9SGleb Smirnoff  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
253b3a8eb9SGleb Smirnoff  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
263b3a8eb9SGleb Smirnoff  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
273b3a8eb9SGleb Smirnoff  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
283b3a8eb9SGleb Smirnoff  */
293b3a8eb9SGleb Smirnoff %{
303b3a8eb9SGleb Smirnoff #include <sys/cdefs.h>
313b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$");
323b3a8eb9SGleb Smirnoff 
333b3a8eb9SGleb Smirnoff #include <sys/types.h>
343b3a8eb9SGleb Smirnoff #include <sys/socket.h>
353b3a8eb9SGleb Smirnoff #include <sys/stat.h>
363b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
373b3a8eb9SGleb Smirnoff #include <sys/sysctl.h>
383b3a8eb9SGleb Smirnoff #endif
393b3a8eb9SGleb Smirnoff #include <net/if.h>
403b3a8eb9SGleb Smirnoff #include <netinet/in.h>
413b3a8eb9SGleb Smirnoff #include <netinet/in_systm.h>
423b3a8eb9SGleb Smirnoff #include <netinet/ip.h>
433b3a8eb9SGleb Smirnoff #include <netinet/ip_icmp.h>
443b3a8eb9SGleb Smirnoff #include <netinet/icmp6.h>
453b3a8eb9SGleb Smirnoff #include <net/pfvar.h>
463b3a8eb9SGleb Smirnoff #include <arpa/inet.h>
47772e66a6SGleb Smirnoff #include <net/altq/altq.h>
48772e66a6SGleb Smirnoff #include <net/altq/altq_cbq.h>
49772e66a6SGleb Smirnoff #include <net/altq/altq_priq.h>
50772e66a6SGleb Smirnoff #include <net/altq/altq_hfsc.h>
51*a5b789f6SErmal Luçi #include <net/altq/altq_fairq.h>
523b3a8eb9SGleb Smirnoff 
533b3a8eb9SGleb Smirnoff #include <stdio.h>
543b3a8eb9SGleb Smirnoff #include <unistd.h>
553b3a8eb9SGleb Smirnoff #include <stdlib.h>
563b3a8eb9SGleb Smirnoff #include <netdb.h>
573b3a8eb9SGleb Smirnoff #include <stdarg.h>
583b3a8eb9SGleb Smirnoff #include <errno.h>
593b3a8eb9SGleb Smirnoff #include <string.h>
603b3a8eb9SGleb Smirnoff #include <ctype.h>
613b3a8eb9SGleb Smirnoff #include <math.h>
623b3a8eb9SGleb Smirnoff #include <err.h>
633b3a8eb9SGleb Smirnoff #include <limits.h>
643b3a8eb9SGleb Smirnoff #include <pwd.h>
653b3a8eb9SGleb Smirnoff #include <grp.h>
663b3a8eb9SGleb Smirnoff #include <md5.h>
673b3a8eb9SGleb Smirnoff 
683b3a8eb9SGleb Smirnoff #include "pfctl_parser.h"
693b3a8eb9SGleb Smirnoff #include "pfctl.h"
703b3a8eb9SGleb Smirnoff 
713b3a8eb9SGleb Smirnoff static struct pfctl	*pf = NULL;
723b3a8eb9SGleb Smirnoff static int		 debug = 0;
733b3a8eb9SGleb Smirnoff static int		 rulestate = 0;
743b3a8eb9SGleb Smirnoff static u_int16_t	 returnicmpdefault =
753b3a8eb9SGleb Smirnoff 			    (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
763b3a8eb9SGleb Smirnoff static u_int16_t	 returnicmp6default =
773b3a8eb9SGleb Smirnoff 			    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
783b3a8eb9SGleb Smirnoff static int		 blockpolicy = PFRULE_DROP;
793b3a8eb9SGleb Smirnoff static int		 require_order = 1;
803b3a8eb9SGleb Smirnoff static int		 default_statelock;
813b3a8eb9SGleb Smirnoff 
823b3a8eb9SGleb Smirnoff TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
833b3a8eb9SGleb Smirnoff static struct file {
843b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(file)	 entry;
853b3a8eb9SGleb Smirnoff 	FILE			*stream;
863b3a8eb9SGleb Smirnoff 	char			*name;
873b3a8eb9SGleb Smirnoff 	int			 lineno;
883b3a8eb9SGleb Smirnoff 	int			 errors;
893b3a8eb9SGleb Smirnoff } *file;
903b3a8eb9SGleb Smirnoff struct file	*pushfile(const char *, int);
913b3a8eb9SGleb Smirnoff int		 popfile(void);
923b3a8eb9SGleb Smirnoff int		 check_file_secrecy(int, const char *);
933b3a8eb9SGleb Smirnoff int		 yyparse(void);
943b3a8eb9SGleb Smirnoff int		 yylex(void);
953b3a8eb9SGleb Smirnoff int		 yyerror(const char *, ...);
963b3a8eb9SGleb Smirnoff int		 kw_cmp(const void *, const void *);
973b3a8eb9SGleb Smirnoff int		 lookup(char *);
983b3a8eb9SGleb Smirnoff int		 lgetc(int);
993b3a8eb9SGleb Smirnoff int		 lungetc(int);
1003b3a8eb9SGleb Smirnoff int		 findeol(void);
1013b3a8eb9SGleb Smirnoff 
1023b3a8eb9SGleb Smirnoff TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
1033b3a8eb9SGleb Smirnoff struct sym {
1043b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(sym)	 entry;
1053b3a8eb9SGleb Smirnoff 	int			 used;
1063b3a8eb9SGleb Smirnoff 	int			 persist;
1073b3a8eb9SGleb Smirnoff 	char			*nam;
1083b3a8eb9SGleb Smirnoff 	char			*val;
1093b3a8eb9SGleb Smirnoff };
1103b3a8eb9SGleb Smirnoff int		 symset(const char *, const char *, int);
1113b3a8eb9SGleb Smirnoff char		*symget(const char *);
1123b3a8eb9SGleb Smirnoff 
1133b3a8eb9SGleb Smirnoff int		 atoul(char *, u_long *);
1143b3a8eb9SGleb Smirnoff 
1153b3a8eb9SGleb Smirnoff enum {
1163b3a8eb9SGleb Smirnoff 	PFCTL_STATE_NONE,
1173b3a8eb9SGleb Smirnoff 	PFCTL_STATE_OPTION,
1183b3a8eb9SGleb Smirnoff 	PFCTL_STATE_SCRUB,
1193b3a8eb9SGleb Smirnoff 	PFCTL_STATE_QUEUE,
1203b3a8eb9SGleb Smirnoff 	PFCTL_STATE_NAT,
1213b3a8eb9SGleb Smirnoff 	PFCTL_STATE_FILTER
1223b3a8eb9SGleb Smirnoff };
1233b3a8eb9SGleb Smirnoff 
1243b3a8eb9SGleb Smirnoff struct node_proto {
1253b3a8eb9SGleb Smirnoff 	u_int8_t		 proto;
1263b3a8eb9SGleb Smirnoff 	struct node_proto	*next;
1273b3a8eb9SGleb Smirnoff 	struct node_proto	*tail;
1283b3a8eb9SGleb Smirnoff };
1293b3a8eb9SGleb Smirnoff 
1303b3a8eb9SGleb Smirnoff struct node_port {
1313b3a8eb9SGleb Smirnoff 	u_int16_t		 port[2];
1323b3a8eb9SGleb Smirnoff 	u_int8_t		 op;
1333b3a8eb9SGleb Smirnoff 	struct node_port	*next;
1343b3a8eb9SGleb Smirnoff 	struct node_port	*tail;
1353b3a8eb9SGleb Smirnoff };
1363b3a8eb9SGleb Smirnoff 
1373b3a8eb9SGleb Smirnoff struct node_uid {
1383b3a8eb9SGleb Smirnoff 	uid_t			 uid[2];
1393b3a8eb9SGleb Smirnoff 	u_int8_t		 op;
1403b3a8eb9SGleb Smirnoff 	struct node_uid		*next;
1413b3a8eb9SGleb Smirnoff 	struct node_uid		*tail;
1423b3a8eb9SGleb Smirnoff };
1433b3a8eb9SGleb Smirnoff 
1443b3a8eb9SGleb Smirnoff struct node_gid {
1453b3a8eb9SGleb Smirnoff 	gid_t			 gid[2];
1463b3a8eb9SGleb Smirnoff 	u_int8_t		 op;
1473b3a8eb9SGleb Smirnoff 	struct node_gid		*next;
1483b3a8eb9SGleb Smirnoff 	struct node_gid		*tail;
1493b3a8eb9SGleb Smirnoff };
1503b3a8eb9SGleb Smirnoff 
1513b3a8eb9SGleb Smirnoff struct node_icmp {
1523b3a8eb9SGleb Smirnoff 	u_int8_t		 code;
1533b3a8eb9SGleb Smirnoff 	u_int8_t		 type;
1543b3a8eb9SGleb Smirnoff 	u_int8_t		 proto;
1553b3a8eb9SGleb Smirnoff 	struct node_icmp	*next;
1563b3a8eb9SGleb Smirnoff 	struct node_icmp	*tail;
1573b3a8eb9SGleb Smirnoff };
1583b3a8eb9SGleb Smirnoff 
1593b3a8eb9SGleb Smirnoff enum	{ PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
1603b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
1613b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
1623b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
1633b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, };
1643b3a8eb9SGleb Smirnoff 
1653b3a8eb9SGleb Smirnoff enum	{ PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
1663b3a8eb9SGleb Smirnoff 
1673b3a8eb9SGleb Smirnoff struct node_state_opt {
1683b3a8eb9SGleb Smirnoff 	int			 type;
1693b3a8eb9SGleb Smirnoff 	union {
1703b3a8eb9SGleb Smirnoff 		u_int32_t	 max_states;
1713b3a8eb9SGleb Smirnoff 		u_int32_t	 max_src_states;
1723b3a8eb9SGleb Smirnoff 		u_int32_t	 max_src_conn;
1733b3a8eb9SGleb Smirnoff 		struct {
1743b3a8eb9SGleb Smirnoff 			u_int32_t	limit;
1753b3a8eb9SGleb Smirnoff 			u_int32_t	seconds;
1763b3a8eb9SGleb Smirnoff 		}		 max_src_conn_rate;
1773b3a8eb9SGleb Smirnoff 		struct {
1783b3a8eb9SGleb Smirnoff 			u_int8_t	flush;
1793b3a8eb9SGleb Smirnoff 			char		tblname[PF_TABLE_NAME_SIZE];
1803b3a8eb9SGleb Smirnoff 		}		 overload;
1813b3a8eb9SGleb Smirnoff 		u_int32_t	 max_src_nodes;
1823b3a8eb9SGleb Smirnoff 		u_int8_t	 src_track;
1833b3a8eb9SGleb Smirnoff 		u_int32_t	 statelock;
1843b3a8eb9SGleb Smirnoff 		struct {
1853b3a8eb9SGleb Smirnoff 			int		number;
1863b3a8eb9SGleb Smirnoff 			u_int32_t	seconds;
1873b3a8eb9SGleb Smirnoff 		}		 timeout;
1883b3a8eb9SGleb Smirnoff 	}			 data;
1893b3a8eb9SGleb Smirnoff 	struct node_state_opt	*next;
1903b3a8eb9SGleb Smirnoff 	struct node_state_opt	*tail;
1913b3a8eb9SGleb Smirnoff };
1923b3a8eb9SGleb Smirnoff 
1933b3a8eb9SGleb Smirnoff struct peer {
1943b3a8eb9SGleb Smirnoff 	struct node_host	*host;
1953b3a8eb9SGleb Smirnoff 	struct node_port	*port;
1963b3a8eb9SGleb Smirnoff };
1973b3a8eb9SGleb Smirnoff 
1983b3a8eb9SGleb Smirnoff struct node_queue {
1993b3a8eb9SGleb Smirnoff 	char			 queue[PF_QNAME_SIZE];
2003b3a8eb9SGleb Smirnoff 	char			 parent[PF_QNAME_SIZE];
2013b3a8eb9SGleb Smirnoff 	char			 ifname[IFNAMSIZ];
2023b3a8eb9SGleb Smirnoff 	int			 scheduler;
2033b3a8eb9SGleb Smirnoff 	struct node_queue	*next;
2043b3a8eb9SGleb Smirnoff 	struct node_queue	*tail;
2053b3a8eb9SGleb Smirnoff }	*queues = NULL;
2063b3a8eb9SGleb Smirnoff 
2073b3a8eb9SGleb Smirnoff struct node_qassign {
2083b3a8eb9SGleb Smirnoff 	char		*qname;
2093b3a8eb9SGleb Smirnoff 	char		*pqname;
2103b3a8eb9SGleb Smirnoff };
2113b3a8eb9SGleb Smirnoff 
2123b3a8eb9SGleb Smirnoff struct filter_opts {
2133b3a8eb9SGleb Smirnoff 	int			 marker;
2143b3a8eb9SGleb Smirnoff #define FOM_FLAGS	0x01
2153b3a8eb9SGleb Smirnoff #define FOM_ICMP	0x02
2163b3a8eb9SGleb Smirnoff #define FOM_TOS		0x04
2173b3a8eb9SGleb Smirnoff #define FOM_KEEP	0x08
2183b3a8eb9SGleb Smirnoff #define FOM_SRCTRACK	0x10
2193b3a8eb9SGleb Smirnoff 	struct node_uid		*uid;
2203b3a8eb9SGleb Smirnoff 	struct node_gid		*gid;
2213b3a8eb9SGleb Smirnoff 	struct {
2223b3a8eb9SGleb Smirnoff 		u_int8_t	 b1;
2233b3a8eb9SGleb Smirnoff 		u_int8_t	 b2;
2243b3a8eb9SGleb Smirnoff 		u_int16_t	 w;
2253b3a8eb9SGleb Smirnoff 		u_int16_t	 w2;
2263b3a8eb9SGleb Smirnoff 	} flags;
2273b3a8eb9SGleb Smirnoff 	struct node_icmp	*icmpspec;
2283b3a8eb9SGleb Smirnoff 	u_int32_t		 tos;
2293b3a8eb9SGleb Smirnoff 	u_int32_t		 prob;
2303b3a8eb9SGleb Smirnoff 	struct {
2313b3a8eb9SGleb Smirnoff 		int			 action;
2323b3a8eb9SGleb Smirnoff 		struct node_state_opt	*options;
2333b3a8eb9SGleb Smirnoff 	} keep;
2343b3a8eb9SGleb Smirnoff 	int			 fragment;
2353b3a8eb9SGleb Smirnoff 	int			 allowopts;
2363b3a8eb9SGleb Smirnoff 	char			*label;
2373b3a8eb9SGleb Smirnoff 	struct node_qassign	 queues;
2383b3a8eb9SGleb Smirnoff 	char			*tag;
2393b3a8eb9SGleb Smirnoff 	char			*match_tag;
2403b3a8eb9SGleb Smirnoff 	u_int8_t		 match_tag_not;
2413b3a8eb9SGleb Smirnoff 	u_int			 rtableid;
2423b3a8eb9SGleb Smirnoff 	struct {
2433b3a8eb9SGleb Smirnoff 		struct node_host	*addr;
2443b3a8eb9SGleb Smirnoff 		u_int16_t		port;
2453b3a8eb9SGleb Smirnoff 	}			 divert;
2463b3a8eb9SGleb Smirnoff } filter_opts;
2473b3a8eb9SGleb Smirnoff 
2483b3a8eb9SGleb Smirnoff struct antispoof_opts {
2493b3a8eb9SGleb Smirnoff 	char			*label;
2503b3a8eb9SGleb Smirnoff 	u_int			 rtableid;
2513b3a8eb9SGleb Smirnoff } antispoof_opts;
2523b3a8eb9SGleb Smirnoff 
2533b3a8eb9SGleb Smirnoff struct scrub_opts {
2543b3a8eb9SGleb Smirnoff 	int			 marker;
2553b3a8eb9SGleb Smirnoff #define SOM_MINTTL	0x01
2563b3a8eb9SGleb Smirnoff #define SOM_MAXMSS	0x02
2573b3a8eb9SGleb Smirnoff #define SOM_FRAGCACHE	0x04
2583b3a8eb9SGleb Smirnoff #define SOM_SETTOS	0x08
2593b3a8eb9SGleb Smirnoff 	int			 nodf;
2603b3a8eb9SGleb Smirnoff 	int			 minttl;
2613b3a8eb9SGleb Smirnoff 	int			 maxmss;
2623b3a8eb9SGleb Smirnoff 	int			 settos;
2633b3a8eb9SGleb Smirnoff 	int			 fragcache;
2643b3a8eb9SGleb Smirnoff 	int			 randomid;
2653b3a8eb9SGleb Smirnoff 	int			 reassemble_tcp;
2663b3a8eb9SGleb Smirnoff 	char			*match_tag;
2673b3a8eb9SGleb Smirnoff 	u_int8_t		 match_tag_not;
2683b3a8eb9SGleb Smirnoff 	u_int			 rtableid;
2693b3a8eb9SGleb Smirnoff } scrub_opts;
2703b3a8eb9SGleb Smirnoff 
2713b3a8eb9SGleb Smirnoff struct queue_opts {
2723b3a8eb9SGleb Smirnoff 	int			marker;
2733b3a8eb9SGleb Smirnoff #define QOM_BWSPEC	0x01
2743b3a8eb9SGleb Smirnoff #define QOM_SCHEDULER	0x02
2753b3a8eb9SGleb Smirnoff #define QOM_PRIORITY	0x04
2763b3a8eb9SGleb Smirnoff #define QOM_TBRSIZE	0x08
2773b3a8eb9SGleb Smirnoff #define QOM_QLIMIT	0x10
2783b3a8eb9SGleb Smirnoff 	struct node_queue_bw	queue_bwspec;
2793b3a8eb9SGleb Smirnoff 	struct node_queue_opt	scheduler;
2803b3a8eb9SGleb Smirnoff 	int			priority;
2813b3a8eb9SGleb Smirnoff 	int			tbrsize;
2823b3a8eb9SGleb Smirnoff 	int			qlimit;
2833b3a8eb9SGleb Smirnoff } queue_opts;
2843b3a8eb9SGleb Smirnoff 
2853b3a8eb9SGleb Smirnoff struct table_opts {
2863b3a8eb9SGleb Smirnoff 	int			flags;
2873b3a8eb9SGleb Smirnoff 	int			init_addr;
2883b3a8eb9SGleb Smirnoff 	struct node_tinithead	init_nodes;
2893b3a8eb9SGleb Smirnoff } table_opts;
2903b3a8eb9SGleb Smirnoff 
2913b3a8eb9SGleb Smirnoff struct pool_opts {
2923b3a8eb9SGleb Smirnoff 	int			 marker;
2933b3a8eb9SGleb Smirnoff #define POM_TYPE		0x01
2943b3a8eb9SGleb Smirnoff #define POM_STICKYADDRESS	0x02
2953b3a8eb9SGleb Smirnoff 	u_int8_t		 opts;
2963b3a8eb9SGleb Smirnoff 	int			 type;
2973b3a8eb9SGleb Smirnoff 	int			 staticport;
2983b3a8eb9SGleb Smirnoff 	struct pf_poolhashkey	*key;
2993b3a8eb9SGleb Smirnoff 
3003b3a8eb9SGleb Smirnoff } pool_opts;
3013b3a8eb9SGleb Smirnoff 
3023b3a8eb9SGleb Smirnoff 
3033b3a8eb9SGleb Smirnoff struct node_hfsc_opts	 hfsc_opts;
304*a5b789f6SErmal Luçi struct node_fairq_opts	 fairq_opts;
3053b3a8eb9SGleb Smirnoff struct node_state_opt	*keep_state_defaults = NULL;
3063b3a8eb9SGleb Smirnoff 
3073b3a8eb9SGleb Smirnoff int		 disallow_table(struct node_host *, const char *);
3083b3a8eb9SGleb Smirnoff int		 disallow_urpf_failed(struct node_host *, const char *);
3093b3a8eb9SGleb Smirnoff int		 disallow_alias(struct node_host *, const char *);
3103b3a8eb9SGleb Smirnoff int		 rule_consistent(struct pf_rule *, int);
3113b3a8eb9SGleb Smirnoff int		 filter_consistent(struct pf_rule *, int);
3123b3a8eb9SGleb Smirnoff int		 nat_consistent(struct pf_rule *);
3133b3a8eb9SGleb Smirnoff int		 rdr_consistent(struct pf_rule *);
3143b3a8eb9SGleb Smirnoff int		 process_tabledef(char *, struct table_opts *);
3153b3a8eb9SGleb Smirnoff void		 expand_label_str(char *, size_t, const char *, const char *);
3163b3a8eb9SGleb Smirnoff void		 expand_label_if(const char *, char *, size_t, const char *);
3173b3a8eb9SGleb Smirnoff void		 expand_label_addr(const char *, char *, size_t, u_int8_t,
3183b3a8eb9SGleb Smirnoff 		    struct node_host *);
3193b3a8eb9SGleb Smirnoff void		 expand_label_port(const char *, char *, size_t,
3203b3a8eb9SGleb Smirnoff 		    struct node_port *);
3213b3a8eb9SGleb Smirnoff void		 expand_label_proto(const char *, char *, size_t, u_int8_t);
3223b3a8eb9SGleb Smirnoff void		 expand_label_nr(const char *, char *, size_t);
3233b3a8eb9SGleb Smirnoff void		 expand_label(char *, size_t, const char *, u_int8_t,
3243b3a8eb9SGleb Smirnoff 		    struct node_host *, struct node_port *, struct node_host *,
3253b3a8eb9SGleb Smirnoff 		    struct node_port *, u_int8_t);
3263b3a8eb9SGleb Smirnoff void		 expand_rule(struct pf_rule *, struct node_if *,
3273b3a8eb9SGleb Smirnoff 		    struct node_host *, struct node_proto *, struct node_os *,
3283b3a8eb9SGleb Smirnoff 		    struct node_host *, struct node_port *, struct node_host *,
3293b3a8eb9SGleb Smirnoff 		    struct node_port *, struct node_uid *, struct node_gid *,
3303b3a8eb9SGleb Smirnoff 		    struct node_icmp *, const char *);
3313b3a8eb9SGleb Smirnoff int		 expand_altq(struct pf_altq *, struct node_if *,
3323b3a8eb9SGleb Smirnoff 		    struct node_queue *, struct node_queue_bw bwspec,
3333b3a8eb9SGleb Smirnoff 		    struct node_queue_opt *);
3343b3a8eb9SGleb Smirnoff int		 expand_queue(struct pf_altq *, struct node_if *,
3353b3a8eb9SGleb Smirnoff 		    struct node_queue *, struct node_queue_bw,
3363b3a8eb9SGleb Smirnoff 		    struct node_queue_opt *);
3373b3a8eb9SGleb Smirnoff int		 expand_skip_interface(struct node_if *);
3383b3a8eb9SGleb Smirnoff 
3393b3a8eb9SGleb Smirnoff int	 check_rulestate(int);
3403b3a8eb9SGleb Smirnoff int	 getservice(char *);
3413b3a8eb9SGleb Smirnoff int	 rule_label(struct pf_rule *, char *);
3423b3a8eb9SGleb Smirnoff int	 rt_tableid_max(void);
3433b3a8eb9SGleb Smirnoff 
3443b3a8eb9SGleb Smirnoff void	 mv_rules(struct pf_ruleset *, struct pf_ruleset *);
3453b3a8eb9SGleb Smirnoff void	 decide_address_family(struct node_host *, sa_family_t *);
3463b3a8eb9SGleb Smirnoff void	 remove_invalid_hosts(struct node_host **, sa_family_t *);
3473b3a8eb9SGleb Smirnoff int	 invalid_redirect(struct node_host *, sa_family_t);
3483b3a8eb9SGleb Smirnoff u_int16_t parseicmpspec(char *, sa_family_t);
3493b3a8eb9SGleb Smirnoff 
3503b3a8eb9SGleb Smirnoff TAILQ_HEAD(loadanchorshead, loadanchors)
3513b3a8eb9SGleb Smirnoff     loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
3523b3a8eb9SGleb Smirnoff 
3533b3a8eb9SGleb Smirnoff struct loadanchors {
3543b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(loadanchors)	 entries;
3553b3a8eb9SGleb Smirnoff 	char				*anchorname;
3563b3a8eb9SGleb Smirnoff 	char				*filename;
3573b3a8eb9SGleb Smirnoff };
3583b3a8eb9SGleb Smirnoff 
3593b3a8eb9SGleb Smirnoff typedef struct {
3603b3a8eb9SGleb Smirnoff 	union {
3613b3a8eb9SGleb Smirnoff 		int64_t			 number;
3623b3a8eb9SGleb Smirnoff 		double			 probability;
3633b3a8eb9SGleb Smirnoff 		int			 i;
3643b3a8eb9SGleb Smirnoff 		char			*string;
3653b3a8eb9SGleb Smirnoff 		u_int			 rtableid;
3663b3a8eb9SGleb Smirnoff 		struct {
3673b3a8eb9SGleb Smirnoff 			u_int8_t	 b1;
3683b3a8eb9SGleb Smirnoff 			u_int8_t	 b2;
3693b3a8eb9SGleb Smirnoff 			u_int16_t	 w;
3703b3a8eb9SGleb Smirnoff 			u_int16_t	 w2;
3713b3a8eb9SGleb Smirnoff 		}			 b;
3723b3a8eb9SGleb Smirnoff 		struct range {
3733b3a8eb9SGleb Smirnoff 			int		 a;
3743b3a8eb9SGleb Smirnoff 			int		 b;
3753b3a8eb9SGleb Smirnoff 			int		 t;
3763b3a8eb9SGleb Smirnoff 		}			 range;
3773b3a8eb9SGleb Smirnoff 		struct node_if		*interface;
3783b3a8eb9SGleb Smirnoff 		struct node_proto	*proto;
3793b3a8eb9SGleb Smirnoff 		struct node_icmp	*icmp;
3803b3a8eb9SGleb Smirnoff 		struct node_host	*host;
3813b3a8eb9SGleb Smirnoff 		struct node_os		*os;
3823b3a8eb9SGleb Smirnoff 		struct node_port	*port;
3833b3a8eb9SGleb Smirnoff 		struct node_uid		*uid;
3843b3a8eb9SGleb Smirnoff 		struct node_gid		*gid;
3853b3a8eb9SGleb Smirnoff 		struct node_state_opt	*state_opt;
3863b3a8eb9SGleb Smirnoff 		struct peer		 peer;
3873b3a8eb9SGleb Smirnoff 		struct {
3883b3a8eb9SGleb Smirnoff 			struct peer	 src, dst;
3893b3a8eb9SGleb Smirnoff 			struct node_os	*src_os;
3903b3a8eb9SGleb Smirnoff 		}			 fromto;
3913b3a8eb9SGleb Smirnoff 		struct {
3923b3a8eb9SGleb Smirnoff 			struct node_host	*host;
3933b3a8eb9SGleb Smirnoff 			u_int8_t		 rt;
3943b3a8eb9SGleb Smirnoff 			u_int8_t		 pool_opts;
3953b3a8eb9SGleb Smirnoff 			sa_family_t		 af;
3963b3a8eb9SGleb Smirnoff 			struct pf_poolhashkey	*key;
3973b3a8eb9SGleb Smirnoff 		}			 route;
3983b3a8eb9SGleb Smirnoff 		struct redirection {
3993b3a8eb9SGleb Smirnoff 			struct node_host	*host;
4003b3a8eb9SGleb Smirnoff 			struct range		 rport;
4013b3a8eb9SGleb Smirnoff 		}			*redirection;
4023b3a8eb9SGleb Smirnoff 		struct {
4033b3a8eb9SGleb Smirnoff 			int			 action;
4043b3a8eb9SGleb Smirnoff 			struct node_state_opt	*options;
4053b3a8eb9SGleb Smirnoff 		}			 keep_state;
4063b3a8eb9SGleb Smirnoff 		struct {
4073b3a8eb9SGleb Smirnoff 			u_int8_t	 log;
4083b3a8eb9SGleb Smirnoff 			u_int8_t	 logif;
4093b3a8eb9SGleb Smirnoff 			u_int8_t	 quick;
4103b3a8eb9SGleb Smirnoff 		}			 logquick;
4113b3a8eb9SGleb Smirnoff 		struct {
4123b3a8eb9SGleb Smirnoff 			int		 neg;
4133b3a8eb9SGleb Smirnoff 			char		*name;
4143b3a8eb9SGleb Smirnoff 		}			 tagged;
4153b3a8eb9SGleb Smirnoff 		struct pf_poolhashkey	*hashkey;
4163b3a8eb9SGleb Smirnoff 		struct node_queue	*queue;
4173b3a8eb9SGleb Smirnoff 		struct node_queue_opt	 queue_options;
4183b3a8eb9SGleb Smirnoff 		struct node_queue_bw	 queue_bwspec;
4193b3a8eb9SGleb Smirnoff 		struct node_qassign	 qassign;
4203b3a8eb9SGleb Smirnoff 		struct filter_opts	 filter_opts;
4213b3a8eb9SGleb Smirnoff 		struct antispoof_opts	 antispoof_opts;
4223b3a8eb9SGleb Smirnoff 		struct queue_opts	 queue_opts;
4233b3a8eb9SGleb Smirnoff 		struct scrub_opts	 scrub_opts;
4243b3a8eb9SGleb Smirnoff 		struct table_opts	 table_opts;
4253b3a8eb9SGleb Smirnoff 		struct pool_opts	 pool_opts;
4263b3a8eb9SGleb Smirnoff 		struct node_hfsc_opts	 hfsc_opts;
427*a5b789f6SErmal Luçi 		struct node_fairq_opts	 fairq_opts;
4283b3a8eb9SGleb Smirnoff 	} v;
4293b3a8eb9SGleb Smirnoff 	int lineno;
4303b3a8eb9SGleb Smirnoff } YYSTYPE;
4313b3a8eb9SGleb Smirnoff 
4323b3a8eb9SGleb Smirnoff #define PPORT_RANGE	1
4333b3a8eb9SGleb Smirnoff #define PPORT_STAR	2
4343b3a8eb9SGleb Smirnoff int	parseport(char *, struct range *r, int);
4353b3a8eb9SGleb Smirnoff 
4363b3a8eb9SGleb Smirnoff #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
4373b3a8eb9SGleb Smirnoff 	(!((addr).iflags & PFI_AFLAG_NOALIAS) ||		 \
4383b3a8eb9SGleb Smirnoff 	!isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
4393b3a8eb9SGleb Smirnoff 
4403b3a8eb9SGleb Smirnoff %}
4413b3a8eb9SGleb Smirnoff 
4423b3a8eb9SGleb Smirnoff %token	PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
4433b3a8eb9SGleb Smirnoff %token	RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
4443b3a8eb9SGleb Smirnoff %token	ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
4453b3a8eb9SGleb Smirnoff %token	MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
4463b3a8eb9SGleb Smirnoff %token	NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
4473b3a8eb9SGleb Smirnoff %token	REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
4483b3a8eb9SGleb Smirnoff %token	SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
4493b3a8eb9SGleb Smirnoff %token	REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
4503b3a8eb9SGleb Smirnoff %token	ANTISPOOF FOR INCLUDE
4513b3a8eb9SGleb Smirnoff %token	BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
452*a5b789f6SErmal Luçi %token	ALTQ CBQ PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT
453*a5b789f6SErmal Luçi %token	QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE
4543b3a8eb9SGleb Smirnoff %token	LOAD RULESET_OPTIMIZATION
4553b3a8eb9SGleb Smirnoff %token	STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
4563b3a8eb9SGleb Smirnoff %token	MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY
4573b3a8eb9SGleb Smirnoff %token	TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS
4583b3a8eb9SGleb Smirnoff %token	DIVERTTO DIVERTREPLY
4593b3a8eb9SGleb Smirnoff %token	<v.string>		STRING
4603b3a8eb9SGleb Smirnoff %token	<v.number>		NUMBER
4613b3a8eb9SGleb Smirnoff %token	<v.i>			PORTBINARY
4623b3a8eb9SGleb Smirnoff %type	<v.interface>		interface if_list if_item_not if_item
4633b3a8eb9SGleb Smirnoff %type	<v.number>		number icmptype icmp6type uid gid
4643b3a8eb9SGleb Smirnoff %type	<v.number>		tos not yesno
4653b3a8eb9SGleb Smirnoff %type	<v.probability>		probability
4663b3a8eb9SGleb Smirnoff %type	<v.i>			no dir af fragcache optimizer
4673b3a8eb9SGleb Smirnoff %type	<v.i>			sourcetrack flush unaryop statelock
4683b3a8eb9SGleb Smirnoff %type	<v.b>			action nataction natpasslog scrubaction
4693b3a8eb9SGleb Smirnoff %type	<v.b>			flags flag blockspec
4703b3a8eb9SGleb Smirnoff %type	<v.range>		portplain portstar portrange
4713b3a8eb9SGleb Smirnoff %type	<v.hashkey>		hashkey
4723b3a8eb9SGleb Smirnoff %type	<v.proto>		proto proto_list proto_item
4733b3a8eb9SGleb Smirnoff %type	<v.number>		protoval
4743b3a8eb9SGleb Smirnoff %type	<v.icmp>		icmpspec
4753b3a8eb9SGleb Smirnoff %type	<v.icmp>		icmp_list icmp_item
4763b3a8eb9SGleb Smirnoff %type	<v.icmp>		icmp6_list icmp6_item
4773b3a8eb9SGleb Smirnoff %type	<v.number>		reticmpspec reticmp6spec
4783b3a8eb9SGleb Smirnoff %type	<v.fromto>		fromto
4793b3a8eb9SGleb Smirnoff %type	<v.peer>		ipportspec from to
4803b3a8eb9SGleb Smirnoff %type	<v.host>		ipspec toipspec xhost host dynaddr host_list
4813b3a8eb9SGleb Smirnoff %type	<v.host>		redir_host_list redirspec
4823b3a8eb9SGleb Smirnoff %type	<v.host>		route_host route_host_list routespec
4833b3a8eb9SGleb Smirnoff %type	<v.os>			os xos os_list
4843b3a8eb9SGleb Smirnoff %type	<v.port>		portspec port_list port_item
4853b3a8eb9SGleb Smirnoff %type	<v.uid>			uids uid_list uid_item
4863b3a8eb9SGleb Smirnoff %type	<v.gid>			gids gid_list gid_item
4873b3a8eb9SGleb Smirnoff %type	<v.route>		route
4883b3a8eb9SGleb Smirnoff %type	<v.redirection>		redirection redirpool
4893b3a8eb9SGleb Smirnoff %type	<v.string>		label stringall tag anchorname
4903b3a8eb9SGleb Smirnoff %type	<v.string>		string varstring numberstring
4913b3a8eb9SGleb Smirnoff %type	<v.keep_state>		keep
4923b3a8eb9SGleb Smirnoff %type	<v.state_opt>		state_opt_spec state_opt_list state_opt_item
4933b3a8eb9SGleb Smirnoff %type	<v.logquick>		logquick quick log logopts logopt
4943b3a8eb9SGleb Smirnoff %type	<v.interface>		antispoof_ifspc antispoof_iflst antispoof_if
4953b3a8eb9SGleb Smirnoff %type	<v.qassign>		qname
4963b3a8eb9SGleb Smirnoff %type	<v.queue>		qassign qassign_list qassign_item
4973b3a8eb9SGleb Smirnoff %type	<v.queue_options>	scheduler
4983b3a8eb9SGleb Smirnoff %type	<v.number>		cbqflags_list cbqflags_item
4993b3a8eb9SGleb Smirnoff %type	<v.number>		priqflags_list priqflags_item
5003b3a8eb9SGleb Smirnoff %type	<v.hfsc_opts>		hfscopts_list hfscopts_item hfsc_opts
501*a5b789f6SErmal Luçi %type	<v.fairq_opts>		fairqopts_list fairqopts_item fairq_opts
5023b3a8eb9SGleb Smirnoff %type	<v.queue_bwspec>	bandwidth
5033b3a8eb9SGleb Smirnoff %type	<v.filter_opts>		filter_opts filter_opt filter_opts_l
5043b3a8eb9SGleb Smirnoff %type	<v.antispoof_opts>	antispoof_opts antispoof_opt antispoof_opts_l
5053b3a8eb9SGleb Smirnoff %type	<v.queue_opts>		queue_opts queue_opt queue_opts_l
5063b3a8eb9SGleb Smirnoff %type	<v.scrub_opts>		scrub_opts scrub_opt scrub_opts_l
5073b3a8eb9SGleb Smirnoff %type	<v.table_opts>		table_opts table_opt table_opts_l
5083b3a8eb9SGleb Smirnoff %type	<v.pool_opts>		pool_opts pool_opt pool_opts_l
5093b3a8eb9SGleb Smirnoff %type	<v.tagged>		tagged
5103b3a8eb9SGleb Smirnoff %type	<v.rtableid>		rtable
5113b3a8eb9SGleb Smirnoff %%
5123b3a8eb9SGleb Smirnoff 
5133b3a8eb9SGleb Smirnoff ruleset		: /* empty */
5143b3a8eb9SGleb Smirnoff 		| ruleset include '\n'
5153b3a8eb9SGleb Smirnoff 		| ruleset '\n'
5163b3a8eb9SGleb Smirnoff 		| ruleset option '\n'
5173b3a8eb9SGleb Smirnoff 		| ruleset scrubrule '\n'
5183b3a8eb9SGleb Smirnoff 		| ruleset natrule '\n'
5193b3a8eb9SGleb Smirnoff 		| ruleset binatrule '\n'
5203b3a8eb9SGleb Smirnoff 		| ruleset pfrule '\n'
5213b3a8eb9SGleb Smirnoff 		| ruleset anchorrule '\n'
5223b3a8eb9SGleb Smirnoff 		| ruleset loadrule '\n'
5233b3a8eb9SGleb Smirnoff 		| ruleset altqif '\n'
5243b3a8eb9SGleb Smirnoff 		| ruleset queuespec '\n'
5253b3a8eb9SGleb Smirnoff 		| ruleset varset '\n'
5263b3a8eb9SGleb Smirnoff 		| ruleset antispoof '\n'
5273b3a8eb9SGleb Smirnoff 		| ruleset tabledef '\n'
5283b3a8eb9SGleb Smirnoff 		| '{' fakeanchor '}' '\n';
5293b3a8eb9SGleb Smirnoff 		| ruleset error '\n'		{ file->errors++; }
5303b3a8eb9SGleb Smirnoff 		;
5313b3a8eb9SGleb Smirnoff 
5323b3a8eb9SGleb Smirnoff include		: INCLUDE STRING		{
5333b3a8eb9SGleb Smirnoff 			struct file	*nfile;
5343b3a8eb9SGleb Smirnoff 
5353b3a8eb9SGleb Smirnoff 			if ((nfile = pushfile($2, 0)) == NULL) {
5363b3a8eb9SGleb Smirnoff 				yyerror("failed to include file %s", $2);
5373b3a8eb9SGleb Smirnoff 				free($2);
5383b3a8eb9SGleb Smirnoff 				YYERROR;
5393b3a8eb9SGleb Smirnoff 			}
5403b3a8eb9SGleb Smirnoff 			free($2);
5413b3a8eb9SGleb Smirnoff 
5423b3a8eb9SGleb Smirnoff 			file = nfile;
5433b3a8eb9SGleb Smirnoff 			lungetc('\n');
5443b3a8eb9SGleb Smirnoff 		}
5453b3a8eb9SGleb Smirnoff 		;
5463b3a8eb9SGleb Smirnoff 
5473b3a8eb9SGleb Smirnoff /*
5483b3a8eb9SGleb Smirnoff  * apply to previouslys specified rule: must be careful to note
5493b3a8eb9SGleb Smirnoff  * what that is: pf or nat or binat or rdr
5503b3a8eb9SGleb Smirnoff  */
5513b3a8eb9SGleb Smirnoff fakeanchor	: fakeanchor '\n'
5523b3a8eb9SGleb Smirnoff 		| fakeanchor anchorrule '\n'
5533b3a8eb9SGleb Smirnoff 		| fakeanchor binatrule '\n'
5543b3a8eb9SGleb Smirnoff 		| fakeanchor natrule '\n'
5553b3a8eb9SGleb Smirnoff 		| fakeanchor pfrule '\n'
5563b3a8eb9SGleb Smirnoff 		| fakeanchor error '\n'
5573b3a8eb9SGleb Smirnoff 		;
5583b3a8eb9SGleb Smirnoff 
5593b3a8eb9SGleb Smirnoff optimizer	: string	{
5603b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "none"))
5613b3a8eb9SGleb Smirnoff 				$$ = 0;
5623b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "basic"))
5633b3a8eb9SGleb Smirnoff 				$$ = PF_OPTIMIZE_BASIC;
5643b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "profile"))
5653b3a8eb9SGleb Smirnoff 				$$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE;
5663b3a8eb9SGleb Smirnoff 			else {
5673b3a8eb9SGleb Smirnoff 				yyerror("unknown ruleset-optimization %s", $1);
5683b3a8eb9SGleb Smirnoff 				YYERROR;
5693b3a8eb9SGleb Smirnoff 			}
5703b3a8eb9SGleb Smirnoff 		}
5713b3a8eb9SGleb Smirnoff 		;
5723b3a8eb9SGleb Smirnoff 
5733b3a8eb9SGleb Smirnoff option		: SET OPTIMIZATION STRING		{
5743b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
5753b3a8eb9SGleb Smirnoff 				free($3);
5763b3a8eb9SGleb Smirnoff 				YYERROR;
5773b3a8eb9SGleb Smirnoff 			}
5783b3a8eb9SGleb Smirnoff 			if (pfctl_set_optimization(pf, $3) != 0) {
5793b3a8eb9SGleb Smirnoff 				yyerror("unknown optimization %s", $3);
5803b3a8eb9SGleb Smirnoff 				free($3);
5813b3a8eb9SGleb Smirnoff 				YYERROR;
5823b3a8eb9SGleb Smirnoff 			}
5833b3a8eb9SGleb Smirnoff 			free($3);
5843b3a8eb9SGleb Smirnoff 		}
5853b3a8eb9SGleb Smirnoff 		| SET RULESET_OPTIMIZATION optimizer {
5863b3a8eb9SGleb Smirnoff 			if (!(pf->opts & PF_OPT_OPTIMIZE)) {
5873b3a8eb9SGleb Smirnoff 				pf->opts |= PF_OPT_OPTIMIZE;
5883b3a8eb9SGleb Smirnoff 				pf->optimize = $3;
5893b3a8eb9SGleb Smirnoff 			}
5903b3a8eb9SGleb Smirnoff 		}
5913b3a8eb9SGleb Smirnoff 		| SET TIMEOUT timeout_spec
5923b3a8eb9SGleb Smirnoff 		| SET TIMEOUT '{' optnl timeout_list '}'
5933b3a8eb9SGleb Smirnoff 		| SET LIMIT limit_spec
5943b3a8eb9SGleb Smirnoff 		| SET LIMIT '{' optnl limit_list '}'
5953b3a8eb9SGleb Smirnoff 		| SET LOGINTERFACE stringall		{
5963b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
5973b3a8eb9SGleb Smirnoff 				free($3);
5983b3a8eb9SGleb Smirnoff 				YYERROR;
5993b3a8eb9SGleb Smirnoff 			}
6003b3a8eb9SGleb Smirnoff 			if (pfctl_set_logif(pf, $3) != 0) {
6013b3a8eb9SGleb Smirnoff 				yyerror("error setting loginterface %s", $3);
6023b3a8eb9SGleb Smirnoff 				free($3);
6033b3a8eb9SGleb Smirnoff 				YYERROR;
6043b3a8eb9SGleb Smirnoff 			}
6053b3a8eb9SGleb Smirnoff 			free($3);
6063b3a8eb9SGleb Smirnoff 		}
6073b3a8eb9SGleb Smirnoff 		| SET HOSTID number {
6083b3a8eb9SGleb Smirnoff 			if ($3 == 0 || $3 > UINT_MAX) {
6093b3a8eb9SGleb Smirnoff 				yyerror("hostid must be non-zero");
6103b3a8eb9SGleb Smirnoff 				YYERROR;
6113b3a8eb9SGleb Smirnoff 			}
6123b3a8eb9SGleb Smirnoff 			if (pfctl_set_hostid(pf, $3) != 0) {
6133b3a8eb9SGleb Smirnoff 				yyerror("error setting hostid %08x", $3);
6143b3a8eb9SGleb Smirnoff 				YYERROR;
6153b3a8eb9SGleb Smirnoff 			}
6163b3a8eb9SGleb Smirnoff 		}
6173b3a8eb9SGleb Smirnoff 		| SET BLOCKPOLICY DROP	{
6183b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6193b3a8eb9SGleb Smirnoff 				printf("set block-policy drop\n");
6203b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION))
6213b3a8eb9SGleb Smirnoff 				YYERROR;
6223b3a8eb9SGleb Smirnoff 			blockpolicy = PFRULE_DROP;
6233b3a8eb9SGleb Smirnoff 		}
6243b3a8eb9SGleb Smirnoff 		| SET BLOCKPOLICY RETURN {
6253b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6263b3a8eb9SGleb Smirnoff 				printf("set block-policy return\n");
6273b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION))
6283b3a8eb9SGleb Smirnoff 				YYERROR;
6293b3a8eb9SGleb Smirnoff 			blockpolicy = PFRULE_RETURN;
6303b3a8eb9SGleb Smirnoff 		}
6313b3a8eb9SGleb Smirnoff 		| SET REQUIREORDER yesno {
6323b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6333b3a8eb9SGleb Smirnoff 				printf("set require-order %s\n",
6343b3a8eb9SGleb Smirnoff 				    $3 == 1 ? "yes" : "no");
6353b3a8eb9SGleb Smirnoff 			require_order = $3;
6363b3a8eb9SGleb Smirnoff 		}
6373b3a8eb9SGleb Smirnoff 		| SET FINGERPRINTS STRING {
6383b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6393b3a8eb9SGleb Smirnoff 				printf("set fingerprints \"%s\"\n", $3);
6403b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
6413b3a8eb9SGleb Smirnoff 				free($3);
6423b3a8eb9SGleb Smirnoff 				YYERROR;
6433b3a8eb9SGleb Smirnoff 			}
6443b3a8eb9SGleb Smirnoff 			if (!pf->anchor->name[0]) {
6453b3a8eb9SGleb Smirnoff 				if (pfctl_file_fingerprints(pf->dev,
6463b3a8eb9SGleb Smirnoff 				    pf->opts, $3)) {
6473b3a8eb9SGleb Smirnoff 					yyerror("error loading "
6483b3a8eb9SGleb Smirnoff 					    "fingerprints %s", $3);
6493b3a8eb9SGleb Smirnoff 					free($3);
6503b3a8eb9SGleb Smirnoff 					YYERROR;
6513b3a8eb9SGleb Smirnoff 				}
6523b3a8eb9SGleb Smirnoff 			}
6533b3a8eb9SGleb Smirnoff 			free($3);
6543b3a8eb9SGleb Smirnoff 		}
6553b3a8eb9SGleb Smirnoff 		| SET STATEPOLICY statelock {
6563b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6573b3a8eb9SGleb Smirnoff 				switch ($3) {
6583b3a8eb9SGleb Smirnoff 				case 0:
6593b3a8eb9SGleb Smirnoff 					printf("set state-policy floating\n");
6603b3a8eb9SGleb Smirnoff 					break;
6613b3a8eb9SGleb Smirnoff 				case PFRULE_IFBOUND:
6623b3a8eb9SGleb Smirnoff 					printf("set state-policy if-bound\n");
6633b3a8eb9SGleb Smirnoff 					break;
6643b3a8eb9SGleb Smirnoff 				}
6653b3a8eb9SGleb Smirnoff 			default_statelock = $3;
6663b3a8eb9SGleb Smirnoff 		}
6673b3a8eb9SGleb Smirnoff 		| SET DEBUG STRING {
6683b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
6693b3a8eb9SGleb Smirnoff 				free($3);
6703b3a8eb9SGleb Smirnoff 				YYERROR;
6713b3a8eb9SGleb Smirnoff 			}
6723b3a8eb9SGleb Smirnoff 			if (pfctl_set_debug(pf, $3) != 0) {
6733b3a8eb9SGleb Smirnoff 				yyerror("error setting debuglevel %s", $3);
6743b3a8eb9SGleb Smirnoff 				free($3);
6753b3a8eb9SGleb Smirnoff 				YYERROR;
6763b3a8eb9SGleb Smirnoff 			}
6773b3a8eb9SGleb Smirnoff 			free($3);
6783b3a8eb9SGleb Smirnoff 		}
6793b3a8eb9SGleb Smirnoff 		| SET SKIP interface {
6803b3a8eb9SGleb Smirnoff 			if (expand_skip_interface($3) != 0) {
6813b3a8eb9SGleb Smirnoff 				yyerror("error setting skip interface(s)");
6823b3a8eb9SGleb Smirnoff 				YYERROR;
6833b3a8eb9SGleb Smirnoff 			}
6843b3a8eb9SGleb Smirnoff 		}
6853b3a8eb9SGleb Smirnoff 		| SET STATEDEFAULTS state_opt_list {
6863b3a8eb9SGleb Smirnoff 			if (keep_state_defaults != NULL) {
6873b3a8eb9SGleb Smirnoff 				yyerror("cannot redefine state-defaults");
6883b3a8eb9SGleb Smirnoff 				YYERROR;
6893b3a8eb9SGleb Smirnoff 			}
6903b3a8eb9SGleb Smirnoff 			keep_state_defaults = $3;
6913b3a8eb9SGleb Smirnoff 		}
6923b3a8eb9SGleb Smirnoff 		;
6933b3a8eb9SGleb Smirnoff 
6943b3a8eb9SGleb Smirnoff stringall	: STRING	{ $$ = $1; }
6953b3a8eb9SGleb Smirnoff 		| ALL		{
6963b3a8eb9SGleb Smirnoff 			if (($$ = strdup("all")) == NULL) {
6973b3a8eb9SGleb Smirnoff 				err(1, "stringall: strdup");
6983b3a8eb9SGleb Smirnoff 			}
6993b3a8eb9SGleb Smirnoff 		}
7003b3a8eb9SGleb Smirnoff 		;
7013b3a8eb9SGleb Smirnoff 
7023b3a8eb9SGleb Smirnoff string		: STRING string				{
7033b3a8eb9SGleb Smirnoff 			if (asprintf(&$$, "%s %s", $1, $2) == -1)
7043b3a8eb9SGleb Smirnoff 				err(1, "string: asprintf");
7053b3a8eb9SGleb Smirnoff 			free($1);
7063b3a8eb9SGleb Smirnoff 			free($2);
7073b3a8eb9SGleb Smirnoff 		}
7083b3a8eb9SGleb Smirnoff 		| STRING
7093b3a8eb9SGleb Smirnoff 		;
7103b3a8eb9SGleb Smirnoff 
7113b3a8eb9SGleb Smirnoff varstring	: numberstring varstring 		{
7123b3a8eb9SGleb Smirnoff 			if (asprintf(&$$, "%s %s", $1, $2) == -1)
7133b3a8eb9SGleb Smirnoff 				err(1, "string: asprintf");
7143b3a8eb9SGleb Smirnoff 			free($1);
7153b3a8eb9SGleb Smirnoff 			free($2);
7163b3a8eb9SGleb Smirnoff 		}
7173b3a8eb9SGleb Smirnoff 		| numberstring
7183b3a8eb9SGleb Smirnoff 		;
7193b3a8eb9SGleb Smirnoff 
7203b3a8eb9SGleb Smirnoff numberstring	: NUMBER				{
7213b3a8eb9SGleb Smirnoff 			char	*s;
7223b3a8eb9SGleb Smirnoff 			if (asprintf(&s, "%lld", (long long)$1) == -1) {
7233b3a8eb9SGleb Smirnoff 				yyerror("string: asprintf");
7243b3a8eb9SGleb Smirnoff 				YYERROR;
7253b3a8eb9SGleb Smirnoff 			}
7263b3a8eb9SGleb Smirnoff 			$$ = s;
7273b3a8eb9SGleb Smirnoff 		}
7283b3a8eb9SGleb Smirnoff 		| STRING
7293b3a8eb9SGleb Smirnoff 		;
7303b3a8eb9SGleb Smirnoff 
7313b3a8eb9SGleb Smirnoff varset		: STRING '=' varstring	{
7323b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
7333b3a8eb9SGleb Smirnoff 				printf("%s = \"%s\"\n", $1, $3);
7343b3a8eb9SGleb Smirnoff 			if (symset($1, $3, 0) == -1)
7353b3a8eb9SGleb Smirnoff 				err(1, "cannot store variable %s", $1);
7363b3a8eb9SGleb Smirnoff 			free($1);
7373b3a8eb9SGleb Smirnoff 			free($3);
7383b3a8eb9SGleb Smirnoff 		}
7393b3a8eb9SGleb Smirnoff 		;
7403b3a8eb9SGleb Smirnoff 
7413b3a8eb9SGleb Smirnoff anchorname	: STRING			{ $$ = $1; }
7423b3a8eb9SGleb Smirnoff 		| /* empty */			{ $$ = NULL; }
7433b3a8eb9SGleb Smirnoff 		;
7443b3a8eb9SGleb Smirnoff 
7453b3a8eb9SGleb Smirnoff pfa_anchorlist	: /* empty */
7463b3a8eb9SGleb Smirnoff 		| pfa_anchorlist '\n'
7473b3a8eb9SGleb Smirnoff 		| pfa_anchorlist pfrule '\n'
7483b3a8eb9SGleb Smirnoff 		| pfa_anchorlist anchorrule '\n'
7493b3a8eb9SGleb Smirnoff 		;
7503b3a8eb9SGleb Smirnoff 
7513b3a8eb9SGleb Smirnoff pfa_anchor	: '{'
7523b3a8eb9SGleb Smirnoff 		{
7533b3a8eb9SGleb Smirnoff 			char ta[PF_ANCHOR_NAME_SIZE];
7543b3a8eb9SGleb Smirnoff 			struct pf_ruleset *rs;
7553b3a8eb9SGleb Smirnoff 
7563b3a8eb9SGleb Smirnoff 			/* steping into a brace anchor */
7573b3a8eb9SGleb Smirnoff 			pf->asd++;
7583b3a8eb9SGleb Smirnoff 			pf->bn++;
7593b3a8eb9SGleb Smirnoff 			pf->brace = 1;
7603b3a8eb9SGleb Smirnoff 
7613b3a8eb9SGleb Smirnoff 			/* create a holding ruleset in the root */
7623b3a8eb9SGleb Smirnoff 			snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn);
7633b3a8eb9SGleb Smirnoff 			rs = pf_find_or_create_ruleset(ta);
7643b3a8eb9SGleb Smirnoff 			if (rs == NULL)
7653b3a8eb9SGleb Smirnoff 				err(1, "pfa_anchor: pf_find_or_create_ruleset");
7663b3a8eb9SGleb Smirnoff 			pf->astack[pf->asd] = rs->anchor;
7673b3a8eb9SGleb Smirnoff 			pf->anchor = rs->anchor;
7683b3a8eb9SGleb Smirnoff 		} '\n' pfa_anchorlist '}'
7693b3a8eb9SGleb Smirnoff 		{
7703b3a8eb9SGleb Smirnoff 			pf->alast = pf->anchor;
7713b3a8eb9SGleb Smirnoff 			pf->asd--;
7723b3a8eb9SGleb Smirnoff 			pf->anchor = pf->astack[pf->asd];
7733b3a8eb9SGleb Smirnoff 		}
7743b3a8eb9SGleb Smirnoff 		| /* empty */
7753b3a8eb9SGleb Smirnoff 		;
7763b3a8eb9SGleb Smirnoff 
7773b3a8eb9SGleb Smirnoff anchorrule	: ANCHOR anchorname dir quick interface af proto fromto
7783b3a8eb9SGleb Smirnoff 		    filter_opts pfa_anchor
7793b3a8eb9SGleb Smirnoff 		{
7803b3a8eb9SGleb Smirnoff 			struct pf_rule	r;
7813b3a8eb9SGleb Smirnoff 			struct node_proto	*proto;
7823b3a8eb9SGleb Smirnoff 
7833b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_FILTER)) {
7843b3a8eb9SGleb Smirnoff 				if ($2)
7853b3a8eb9SGleb Smirnoff 					free($2);
7863b3a8eb9SGleb Smirnoff 				YYERROR;
7873b3a8eb9SGleb Smirnoff 			}
7883b3a8eb9SGleb Smirnoff 
7893b3a8eb9SGleb Smirnoff 			if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) {
7903b3a8eb9SGleb Smirnoff 				free($2);
7913b3a8eb9SGleb Smirnoff 				yyerror("anchor names beginning with '_' "
7923b3a8eb9SGleb Smirnoff 				    "are reserved for internal use");
7933b3a8eb9SGleb Smirnoff 				YYERROR;
7943b3a8eb9SGleb Smirnoff 			}
7953b3a8eb9SGleb Smirnoff 
7963b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
7973b3a8eb9SGleb Smirnoff 			if (pf->astack[pf->asd + 1]) {
7983b3a8eb9SGleb Smirnoff 				/* move inline rules into relative location */
7993b3a8eb9SGleb Smirnoff 				pf_anchor_setup(&r,
8003b3a8eb9SGleb Smirnoff 				    &pf->astack[pf->asd]->ruleset,
8013b3a8eb9SGleb Smirnoff 				    $2 ? $2 : pf->alast->name);
8023b3a8eb9SGleb Smirnoff 
8033b3a8eb9SGleb Smirnoff 				if (r.anchor == NULL)
8043b3a8eb9SGleb Smirnoff 					err(1, "anchorrule: unable to "
8053b3a8eb9SGleb Smirnoff 					    "create ruleset");
8063b3a8eb9SGleb Smirnoff 
8073b3a8eb9SGleb Smirnoff 				if (pf->alast != r.anchor) {
8083b3a8eb9SGleb Smirnoff 					if (r.anchor->match) {
8093b3a8eb9SGleb Smirnoff 						yyerror("inline anchor '%s' "
8103b3a8eb9SGleb Smirnoff 						    "already exists",
8113b3a8eb9SGleb Smirnoff 						    r.anchor->name);
8123b3a8eb9SGleb Smirnoff 						YYERROR;
8133b3a8eb9SGleb Smirnoff 					}
8143b3a8eb9SGleb Smirnoff 					mv_rules(&pf->alast->ruleset,
8153b3a8eb9SGleb Smirnoff 					    &r.anchor->ruleset);
8163b3a8eb9SGleb Smirnoff 				}
8173b3a8eb9SGleb Smirnoff 				pf_remove_if_empty_ruleset(&pf->alast->ruleset);
8183b3a8eb9SGleb Smirnoff 				pf->alast = r.anchor;
8193b3a8eb9SGleb Smirnoff 			} else {
8203b3a8eb9SGleb Smirnoff 				if (!$2) {
8213b3a8eb9SGleb Smirnoff 					yyerror("anchors without explicit "
8223b3a8eb9SGleb Smirnoff 					    "rules must specify a name");
8233b3a8eb9SGleb Smirnoff 					YYERROR;
8243b3a8eb9SGleb Smirnoff 				}
8253b3a8eb9SGleb Smirnoff 			}
8263b3a8eb9SGleb Smirnoff 			r.direction = $3;
8273b3a8eb9SGleb Smirnoff 			r.quick = $4.quick;
8283b3a8eb9SGleb Smirnoff 			r.af = $6;
8293b3a8eb9SGleb Smirnoff 			r.prob = $9.prob;
8303b3a8eb9SGleb Smirnoff 			r.rtableid = $9.rtableid;
8313b3a8eb9SGleb Smirnoff 
8323b3a8eb9SGleb Smirnoff 			if ($9.tag)
8333b3a8eb9SGleb Smirnoff 				if (strlcpy(r.tagname, $9.tag,
8343b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
8353b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
8363b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
8373b3a8eb9SGleb Smirnoff 					YYERROR;
8383b3a8eb9SGleb Smirnoff 				}
8393b3a8eb9SGleb Smirnoff 			if ($9.match_tag)
8403b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $9.match_tag,
8413b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
8423b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
8433b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
8443b3a8eb9SGleb Smirnoff 					YYERROR;
8453b3a8eb9SGleb Smirnoff 				}
8463b3a8eb9SGleb Smirnoff 			r.match_tag_not = $9.match_tag_not;
8473b3a8eb9SGleb Smirnoff 			if (rule_label(&r, $9.label))
8483b3a8eb9SGleb Smirnoff 				YYERROR;
8493b3a8eb9SGleb Smirnoff 			free($9.label);
8503b3a8eb9SGleb Smirnoff 			r.flags = $9.flags.b1;
8513b3a8eb9SGleb Smirnoff 			r.flagset = $9.flags.b2;
8523b3a8eb9SGleb Smirnoff 			if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
8533b3a8eb9SGleb Smirnoff 				yyerror("flags always false");
8543b3a8eb9SGleb Smirnoff 				YYERROR;
8553b3a8eb9SGleb Smirnoff 			}
8563b3a8eb9SGleb Smirnoff 			if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
8573b3a8eb9SGleb Smirnoff 				for (proto = $7; proto != NULL &&
8583b3a8eb9SGleb Smirnoff 				    proto->proto != IPPROTO_TCP;
8593b3a8eb9SGleb Smirnoff 				    proto = proto->next)
8603b3a8eb9SGleb Smirnoff 					;	/* nothing */
8613b3a8eb9SGleb Smirnoff 				if (proto == NULL && $7 != NULL) {
8623b3a8eb9SGleb Smirnoff 					if ($9.flags.b1 || $9.flags.b2)
8633b3a8eb9SGleb Smirnoff 						yyerror(
8643b3a8eb9SGleb Smirnoff 						    "flags only apply to tcp");
8653b3a8eb9SGleb Smirnoff 					if ($8.src_os)
8663b3a8eb9SGleb Smirnoff 						yyerror(
8673b3a8eb9SGleb Smirnoff 						    "OS fingerprinting only "
8683b3a8eb9SGleb Smirnoff 						    "applies to tcp");
8693b3a8eb9SGleb Smirnoff 					YYERROR;
8703b3a8eb9SGleb Smirnoff 				}
8713b3a8eb9SGleb Smirnoff 			}
8723b3a8eb9SGleb Smirnoff 
8733b3a8eb9SGleb Smirnoff 			r.tos = $9.tos;
8743b3a8eb9SGleb Smirnoff 
8753b3a8eb9SGleb Smirnoff 			if ($9.keep.action) {
8763b3a8eb9SGleb Smirnoff 				yyerror("cannot specify state handling "
8773b3a8eb9SGleb Smirnoff 				    "on anchors");
8783b3a8eb9SGleb Smirnoff 				YYERROR;
8793b3a8eb9SGleb Smirnoff 			}
8803b3a8eb9SGleb Smirnoff 
8813b3a8eb9SGleb Smirnoff 			if ($9.match_tag)
8823b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $9.match_tag,
8833b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
8843b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
8853b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
8863b3a8eb9SGleb Smirnoff 					YYERROR;
8873b3a8eb9SGleb Smirnoff 				}
8883b3a8eb9SGleb Smirnoff 			r.match_tag_not = $9.match_tag_not;
8893b3a8eb9SGleb Smirnoff 
8903b3a8eb9SGleb Smirnoff 			decide_address_family($8.src.host, &r.af);
8913b3a8eb9SGleb Smirnoff 			decide_address_family($8.dst.host, &r.af);
8923b3a8eb9SGleb Smirnoff 
8933b3a8eb9SGleb Smirnoff 			expand_rule(&r, $5, NULL, $7, $8.src_os,
8943b3a8eb9SGleb Smirnoff 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
8953b3a8eb9SGleb Smirnoff 			    $9.uid, $9.gid, $9.icmpspec,
8963b3a8eb9SGleb Smirnoff 			    pf->astack[pf->asd + 1] ? pf->alast->name : $2);
8973b3a8eb9SGleb Smirnoff 			free($2);
8983b3a8eb9SGleb Smirnoff 			pf->astack[pf->asd + 1] = NULL;
8993b3a8eb9SGleb Smirnoff 		}
9003b3a8eb9SGleb Smirnoff 		| NATANCHOR string interface af proto fromto rtable {
9013b3a8eb9SGleb Smirnoff 			struct pf_rule	r;
9023b3a8eb9SGleb Smirnoff 
9033b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT)) {
9043b3a8eb9SGleb Smirnoff 				free($2);
9053b3a8eb9SGleb Smirnoff 				YYERROR;
9063b3a8eb9SGleb Smirnoff 			}
9073b3a8eb9SGleb Smirnoff 
9083b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
9093b3a8eb9SGleb Smirnoff 			r.action = PF_NAT;
9103b3a8eb9SGleb Smirnoff 			r.af = $4;
9113b3a8eb9SGleb Smirnoff 			r.rtableid = $7;
9123b3a8eb9SGleb Smirnoff 
9133b3a8eb9SGleb Smirnoff 			decide_address_family($6.src.host, &r.af);
9143b3a8eb9SGleb Smirnoff 			decide_address_family($6.dst.host, &r.af);
9153b3a8eb9SGleb Smirnoff 
9163b3a8eb9SGleb Smirnoff 			expand_rule(&r, $3, NULL, $5, $6.src_os,
9173b3a8eb9SGleb Smirnoff 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
9183b3a8eb9SGleb Smirnoff 			    0, 0, 0, $2);
9193b3a8eb9SGleb Smirnoff 			free($2);
9203b3a8eb9SGleb Smirnoff 		}
9213b3a8eb9SGleb Smirnoff 		| RDRANCHOR string interface af proto fromto rtable {
9223b3a8eb9SGleb Smirnoff 			struct pf_rule	r;
9233b3a8eb9SGleb Smirnoff 
9243b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT)) {
9253b3a8eb9SGleb Smirnoff 				free($2);
9263b3a8eb9SGleb Smirnoff 				YYERROR;
9273b3a8eb9SGleb Smirnoff 			}
9283b3a8eb9SGleb Smirnoff 
9293b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
9303b3a8eb9SGleb Smirnoff 			r.action = PF_RDR;
9313b3a8eb9SGleb Smirnoff 			r.af = $4;
9323b3a8eb9SGleb Smirnoff 			r.rtableid = $7;
9333b3a8eb9SGleb Smirnoff 
9343b3a8eb9SGleb Smirnoff 			decide_address_family($6.src.host, &r.af);
9353b3a8eb9SGleb Smirnoff 			decide_address_family($6.dst.host, &r.af);
9363b3a8eb9SGleb Smirnoff 
9373b3a8eb9SGleb Smirnoff 			if ($6.src.port != NULL) {
9383b3a8eb9SGleb Smirnoff 				yyerror("source port parameter not supported"
9393b3a8eb9SGleb Smirnoff 				    " in rdr-anchor");
9403b3a8eb9SGleb Smirnoff 				YYERROR;
9413b3a8eb9SGleb Smirnoff 			}
9423b3a8eb9SGleb Smirnoff 			if ($6.dst.port != NULL) {
9433b3a8eb9SGleb Smirnoff 				if ($6.dst.port->next != NULL) {
9443b3a8eb9SGleb Smirnoff 					yyerror("destination port list "
9453b3a8eb9SGleb Smirnoff 					    "expansion not supported in "
9463b3a8eb9SGleb Smirnoff 					    "rdr-anchor");
9473b3a8eb9SGleb Smirnoff 					YYERROR;
9483b3a8eb9SGleb Smirnoff 				} else if ($6.dst.port->op != PF_OP_EQ) {
9493b3a8eb9SGleb Smirnoff 					yyerror("destination port operators"
9503b3a8eb9SGleb Smirnoff 					    " not supported in rdr-anchor");
9513b3a8eb9SGleb Smirnoff 					YYERROR;
9523b3a8eb9SGleb Smirnoff 				}
9533b3a8eb9SGleb Smirnoff 				r.dst.port[0] = $6.dst.port->port[0];
9543b3a8eb9SGleb Smirnoff 				r.dst.port[1] = $6.dst.port->port[1];
9553b3a8eb9SGleb Smirnoff 				r.dst.port_op = $6.dst.port->op;
9563b3a8eb9SGleb Smirnoff 			}
9573b3a8eb9SGleb Smirnoff 
9583b3a8eb9SGleb Smirnoff 			expand_rule(&r, $3, NULL, $5, $6.src_os,
9593b3a8eb9SGleb Smirnoff 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
9603b3a8eb9SGleb Smirnoff 			    0, 0, 0, $2);
9613b3a8eb9SGleb Smirnoff 			free($2);
9623b3a8eb9SGleb Smirnoff 		}
9633b3a8eb9SGleb Smirnoff 		| BINATANCHOR string interface af proto fromto rtable {
9643b3a8eb9SGleb Smirnoff 			struct pf_rule	r;
9653b3a8eb9SGleb Smirnoff 
9663b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT)) {
9673b3a8eb9SGleb Smirnoff 				free($2);
9683b3a8eb9SGleb Smirnoff 				YYERROR;
9693b3a8eb9SGleb Smirnoff 			}
9703b3a8eb9SGleb Smirnoff 
9713b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
9723b3a8eb9SGleb Smirnoff 			r.action = PF_BINAT;
9733b3a8eb9SGleb Smirnoff 			r.af = $4;
9743b3a8eb9SGleb Smirnoff 			r.rtableid = $7;
9753b3a8eb9SGleb Smirnoff 			if ($5 != NULL) {
9763b3a8eb9SGleb Smirnoff 				if ($5->next != NULL) {
9773b3a8eb9SGleb Smirnoff 					yyerror("proto list expansion"
9783b3a8eb9SGleb Smirnoff 					    " not supported in binat-anchor");
9793b3a8eb9SGleb Smirnoff 					YYERROR;
9803b3a8eb9SGleb Smirnoff 				}
9813b3a8eb9SGleb Smirnoff 				r.proto = $5->proto;
9823b3a8eb9SGleb Smirnoff 				free($5);
9833b3a8eb9SGleb Smirnoff 			}
9843b3a8eb9SGleb Smirnoff 
9853b3a8eb9SGleb Smirnoff 			if ($6.src.host != NULL || $6.src.port != NULL ||
9863b3a8eb9SGleb Smirnoff 			    $6.dst.host != NULL || $6.dst.port != NULL) {
9873b3a8eb9SGleb Smirnoff 				yyerror("fromto parameter not supported"
9883b3a8eb9SGleb Smirnoff 				    " in binat-anchor");
9893b3a8eb9SGleb Smirnoff 				YYERROR;
9903b3a8eb9SGleb Smirnoff 			}
9913b3a8eb9SGleb Smirnoff 
9923b3a8eb9SGleb Smirnoff 			decide_address_family($6.src.host, &r.af);
9933b3a8eb9SGleb Smirnoff 			decide_address_family($6.dst.host, &r.af);
9943b3a8eb9SGleb Smirnoff 
9953b3a8eb9SGleb Smirnoff 			pfctl_add_rule(pf, &r, $2);
9963b3a8eb9SGleb Smirnoff 			free($2);
9973b3a8eb9SGleb Smirnoff 		}
9983b3a8eb9SGleb Smirnoff 		;
9993b3a8eb9SGleb Smirnoff 
10003b3a8eb9SGleb Smirnoff loadrule	: LOAD ANCHOR string FROM string	{
10013b3a8eb9SGleb Smirnoff 			struct loadanchors	*loadanchor;
10023b3a8eb9SGleb Smirnoff 
10033b3a8eb9SGleb Smirnoff 			if (strlen(pf->anchor->name) + 1 +
10043b3a8eb9SGleb Smirnoff 			    strlen($3) >= MAXPATHLEN) {
10053b3a8eb9SGleb Smirnoff 				yyerror("anchorname %s too long, max %u\n",
10063b3a8eb9SGleb Smirnoff 				    $3, MAXPATHLEN - 1);
10073b3a8eb9SGleb Smirnoff 				free($3);
10083b3a8eb9SGleb Smirnoff 				YYERROR;
10093b3a8eb9SGleb Smirnoff 			}
10103b3a8eb9SGleb Smirnoff 			loadanchor = calloc(1, sizeof(struct loadanchors));
10113b3a8eb9SGleb Smirnoff 			if (loadanchor == NULL)
10123b3a8eb9SGleb Smirnoff 				err(1, "loadrule: calloc");
10133b3a8eb9SGleb Smirnoff 			if ((loadanchor->anchorname = malloc(MAXPATHLEN)) ==
10143b3a8eb9SGleb Smirnoff 			    NULL)
10153b3a8eb9SGleb Smirnoff 				err(1, "loadrule: malloc");
10163b3a8eb9SGleb Smirnoff 			if (pf->anchor->name[0])
10173b3a8eb9SGleb Smirnoff 				snprintf(loadanchor->anchorname, MAXPATHLEN,
10183b3a8eb9SGleb Smirnoff 				    "%s/%s", pf->anchor->name, $3);
10193b3a8eb9SGleb Smirnoff 			else
10203b3a8eb9SGleb Smirnoff 				strlcpy(loadanchor->anchorname, $3, MAXPATHLEN);
10213b3a8eb9SGleb Smirnoff 			if ((loadanchor->filename = strdup($5)) == NULL)
10223b3a8eb9SGleb Smirnoff 				err(1, "loadrule: strdup");
10233b3a8eb9SGleb Smirnoff 
10243b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
10253b3a8eb9SGleb Smirnoff 			    entries);
10263b3a8eb9SGleb Smirnoff 
10273b3a8eb9SGleb Smirnoff 			free($3);
10283b3a8eb9SGleb Smirnoff 			free($5);
10293b3a8eb9SGleb Smirnoff 		};
10303b3a8eb9SGleb Smirnoff 
10313b3a8eb9SGleb Smirnoff scrubaction	: no SCRUB {
10323b3a8eb9SGleb Smirnoff 			$$.b2 = $$.w = 0;
10333b3a8eb9SGleb Smirnoff 			if ($1)
10343b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NOSCRUB;
10353b3a8eb9SGleb Smirnoff 			else
10363b3a8eb9SGleb Smirnoff 				$$.b1 = PF_SCRUB;
10373b3a8eb9SGleb Smirnoff 		}
10383b3a8eb9SGleb Smirnoff 		;
10393b3a8eb9SGleb Smirnoff 
10403b3a8eb9SGleb Smirnoff scrubrule	: scrubaction dir logquick interface af proto fromto scrub_opts
10413b3a8eb9SGleb Smirnoff 		{
10423b3a8eb9SGleb Smirnoff 			struct pf_rule	r;
10433b3a8eb9SGleb Smirnoff 
10443b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_SCRUB))
10453b3a8eb9SGleb Smirnoff 				YYERROR;
10463b3a8eb9SGleb Smirnoff 
10473b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
10483b3a8eb9SGleb Smirnoff 
10493b3a8eb9SGleb Smirnoff 			r.action = $1.b1;
10503b3a8eb9SGleb Smirnoff 			r.direction = $2;
10513b3a8eb9SGleb Smirnoff 
10523b3a8eb9SGleb Smirnoff 			r.log = $3.log;
10533b3a8eb9SGleb Smirnoff 			r.logif = $3.logif;
10543b3a8eb9SGleb Smirnoff 			if ($3.quick) {
10553b3a8eb9SGleb Smirnoff 				yyerror("scrub rules do not support 'quick'");
10563b3a8eb9SGleb Smirnoff 				YYERROR;
10573b3a8eb9SGleb Smirnoff 			}
10583b3a8eb9SGleb Smirnoff 
10593b3a8eb9SGleb Smirnoff 			r.af = $5;
10603b3a8eb9SGleb Smirnoff 			if ($8.nodf)
10613b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_NODF;
10623b3a8eb9SGleb Smirnoff 			if ($8.randomid)
10633b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RANDOMID;
10643b3a8eb9SGleb Smirnoff 			if ($8.reassemble_tcp) {
10653b3a8eb9SGleb Smirnoff 				if (r.direction != PF_INOUT) {
10663b3a8eb9SGleb Smirnoff 					yyerror("reassemble tcp rules can not "
10673b3a8eb9SGleb Smirnoff 					    "specify direction");
10683b3a8eb9SGleb Smirnoff 					YYERROR;
10693b3a8eb9SGleb Smirnoff 				}
10703b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_REASSEMBLE_TCP;
10713b3a8eb9SGleb Smirnoff 			}
10723b3a8eb9SGleb Smirnoff 			if ($8.minttl)
10733b3a8eb9SGleb Smirnoff 				r.min_ttl = $8.minttl;
10743b3a8eb9SGleb Smirnoff 			if ($8.maxmss)
10753b3a8eb9SGleb Smirnoff 				r.max_mss = $8.maxmss;
10763b3a8eb9SGleb Smirnoff 			if ($8.marker & SOM_SETTOS) {
10773b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_SET_TOS;
10783b3a8eb9SGleb Smirnoff 				r.set_tos = $8.settos;
10793b3a8eb9SGleb Smirnoff 			}
10803b3a8eb9SGleb Smirnoff 			if ($8.fragcache)
10813b3a8eb9SGleb Smirnoff 				r.rule_flag |= $8.fragcache;
10823b3a8eb9SGleb Smirnoff 			if ($8.match_tag)
10833b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $8.match_tag,
10843b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
10853b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
10863b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
10873b3a8eb9SGleb Smirnoff 					YYERROR;
10883b3a8eb9SGleb Smirnoff 				}
10893b3a8eb9SGleb Smirnoff 			r.match_tag_not = $8.match_tag_not;
10903b3a8eb9SGleb Smirnoff 			r.rtableid = $8.rtableid;
10913b3a8eb9SGleb Smirnoff 
10923b3a8eb9SGleb Smirnoff 			expand_rule(&r, $4, NULL, $6, $7.src_os,
10933b3a8eb9SGleb Smirnoff 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
10943b3a8eb9SGleb Smirnoff 			    NULL, NULL, NULL, "");
10953b3a8eb9SGleb Smirnoff 		}
10963b3a8eb9SGleb Smirnoff 		;
10973b3a8eb9SGleb Smirnoff 
10983b3a8eb9SGleb Smirnoff scrub_opts	:	{
10993b3a8eb9SGleb Smirnoff 				bzero(&scrub_opts, sizeof scrub_opts);
11003b3a8eb9SGleb Smirnoff 				scrub_opts.rtableid = -1;
11013b3a8eb9SGleb Smirnoff 			}
11023b3a8eb9SGleb Smirnoff 		    scrub_opts_l
11033b3a8eb9SGleb Smirnoff 			{ $$ = scrub_opts; }
11043b3a8eb9SGleb Smirnoff 		| /* empty */ {
11053b3a8eb9SGleb Smirnoff 			bzero(&scrub_opts, sizeof scrub_opts);
11063b3a8eb9SGleb Smirnoff 			scrub_opts.rtableid = -1;
11073b3a8eb9SGleb Smirnoff 			$$ = scrub_opts;
11083b3a8eb9SGleb Smirnoff 		}
11093b3a8eb9SGleb Smirnoff 		;
11103b3a8eb9SGleb Smirnoff 
11113b3a8eb9SGleb Smirnoff scrub_opts_l	: scrub_opts_l scrub_opt
11123b3a8eb9SGleb Smirnoff 		| scrub_opt
11133b3a8eb9SGleb Smirnoff 		;
11143b3a8eb9SGleb Smirnoff 
11153b3a8eb9SGleb Smirnoff scrub_opt	: NODF	{
11163b3a8eb9SGleb Smirnoff 			if (scrub_opts.nodf) {
11173b3a8eb9SGleb Smirnoff 				yyerror("no-df cannot be respecified");
11183b3a8eb9SGleb Smirnoff 				YYERROR;
11193b3a8eb9SGleb Smirnoff 			}
11203b3a8eb9SGleb Smirnoff 			scrub_opts.nodf = 1;
11213b3a8eb9SGleb Smirnoff 		}
11223b3a8eb9SGleb Smirnoff 		| MINTTL NUMBER {
11233b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_MINTTL) {
11243b3a8eb9SGleb Smirnoff 				yyerror("min-ttl cannot be respecified");
11253b3a8eb9SGleb Smirnoff 				YYERROR;
11263b3a8eb9SGleb Smirnoff 			}
11273b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 255) {
11283b3a8eb9SGleb Smirnoff 				yyerror("illegal min-ttl value %d", $2);
11293b3a8eb9SGleb Smirnoff 				YYERROR;
11303b3a8eb9SGleb Smirnoff 			}
11313b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_MINTTL;
11323b3a8eb9SGleb Smirnoff 			scrub_opts.minttl = $2;
11333b3a8eb9SGleb Smirnoff 		}
11343b3a8eb9SGleb Smirnoff 		| MAXMSS NUMBER {
11353b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_MAXMSS) {
11363b3a8eb9SGleb Smirnoff 				yyerror("max-mss cannot be respecified");
11373b3a8eb9SGleb Smirnoff 				YYERROR;
11383b3a8eb9SGleb Smirnoff 			}
11393b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 65535) {
11403b3a8eb9SGleb Smirnoff 				yyerror("illegal max-mss value %d", $2);
11413b3a8eb9SGleb Smirnoff 				YYERROR;
11423b3a8eb9SGleb Smirnoff 			}
11433b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_MAXMSS;
11443b3a8eb9SGleb Smirnoff 			scrub_opts.maxmss = $2;
11453b3a8eb9SGleb Smirnoff 		}
11463b3a8eb9SGleb Smirnoff 		| SETTOS tos {
11473b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_SETTOS) {
11483b3a8eb9SGleb Smirnoff 				yyerror("set-tos cannot be respecified");
11493b3a8eb9SGleb Smirnoff 				YYERROR;
11503b3a8eb9SGleb Smirnoff 			}
11513b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_SETTOS;
11523b3a8eb9SGleb Smirnoff 			scrub_opts.settos = $2;
11533b3a8eb9SGleb Smirnoff 		}
11543b3a8eb9SGleb Smirnoff 		| fragcache {
11553b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_FRAGCACHE) {
11563b3a8eb9SGleb Smirnoff 				yyerror("fragcache cannot be respecified");
11573b3a8eb9SGleb Smirnoff 				YYERROR;
11583b3a8eb9SGleb Smirnoff 			}
11593b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_FRAGCACHE;
11603b3a8eb9SGleb Smirnoff 			scrub_opts.fragcache = $1;
11613b3a8eb9SGleb Smirnoff 		}
11623b3a8eb9SGleb Smirnoff 		| REASSEMBLE STRING {
11633b3a8eb9SGleb Smirnoff 			if (strcasecmp($2, "tcp") != 0) {
11643b3a8eb9SGleb Smirnoff 				yyerror("scrub reassemble supports only tcp, "
11653b3a8eb9SGleb Smirnoff 				    "not '%s'", $2);
11663b3a8eb9SGleb Smirnoff 				free($2);
11673b3a8eb9SGleb Smirnoff 				YYERROR;
11683b3a8eb9SGleb Smirnoff 			}
11693b3a8eb9SGleb Smirnoff 			free($2);
11703b3a8eb9SGleb Smirnoff 			if (scrub_opts.reassemble_tcp) {
11713b3a8eb9SGleb Smirnoff 				yyerror("reassemble tcp cannot be respecified");
11723b3a8eb9SGleb Smirnoff 				YYERROR;
11733b3a8eb9SGleb Smirnoff 			}
11743b3a8eb9SGleb Smirnoff 			scrub_opts.reassemble_tcp = 1;
11753b3a8eb9SGleb Smirnoff 		}
11763b3a8eb9SGleb Smirnoff 		| RANDOMID {
11773b3a8eb9SGleb Smirnoff 			if (scrub_opts.randomid) {
11783b3a8eb9SGleb Smirnoff 				yyerror("random-id cannot be respecified");
11793b3a8eb9SGleb Smirnoff 				YYERROR;
11803b3a8eb9SGleb Smirnoff 			}
11813b3a8eb9SGleb Smirnoff 			scrub_opts.randomid = 1;
11823b3a8eb9SGleb Smirnoff 		}
11833b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER				{
11843b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
11853b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
11863b3a8eb9SGleb Smirnoff 				YYERROR;
11873b3a8eb9SGleb Smirnoff 			}
11883b3a8eb9SGleb Smirnoff 			scrub_opts.rtableid = $2;
11893b3a8eb9SGleb Smirnoff 		}
11903b3a8eb9SGleb Smirnoff 		| not TAGGED string			{
11913b3a8eb9SGleb Smirnoff 			scrub_opts.match_tag = $3;
11923b3a8eb9SGleb Smirnoff 			scrub_opts.match_tag_not = $1;
11933b3a8eb9SGleb Smirnoff 		}
11943b3a8eb9SGleb Smirnoff 		;
11953b3a8eb9SGleb Smirnoff 
11963b3a8eb9SGleb Smirnoff fragcache	: FRAGMENT REASSEMBLE	{ $$ = 0; /* default */ }
11973b3a8eb9SGleb Smirnoff 		| FRAGMENT FRAGCROP	{ $$ = PFRULE_FRAGCROP; }
11983b3a8eb9SGleb Smirnoff 		| FRAGMENT FRAGDROP	{ $$ = PFRULE_FRAGDROP; }
11993b3a8eb9SGleb Smirnoff 		;
12003b3a8eb9SGleb Smirnoff 
12013b3a8eb9SGleb Smirnoff antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
12023b3a8eb9SGleb Smirnoff 			struct pf_rule		 r;
12033b3a8eb9SGleb Smirnoff 			struct node_host	*h = NULL, *hh;
12043b3a8eb9SGleb Smirnoff 			struct node_if		*i, *j;
12053b3a8eb9SGleb Smirnoff 
12063b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_FILTER))
12073b3a8eb9SGleb Smirnoff 				YYERROR;
12083b3a8eb9SGleb Smirnoff 
12093b3a8eb9SGleb Smirnoff 			for (i = $3; i; i = i->next) {
12103b3a8eb9SGleb Smirnoff 				bzero(&r, sizeof(r));
12113b3a8eb9SGleb Smirnoff 
12123b3a8eb9SGleb Smirnoff 				r.action = PF_DROP;
12133b3a8eb9SGleb Smirnoff 				r.direction = PF_IN;
12143b3a8eb9SGleb Smirnoff 				r.log = $2.log;
12153b3a8eb9SGleb Smirnoff 				r.logif = $2.logif;
12163b3a8eb9SGleb Smirnoff 				r.quick = $2.quick;
12173b3a8eb9SGleb Smirnoff 				r.af = $4;
12183b3a8eb9SGleb Smirnoff 				if (rule_label(&r, $5.label))
12193b3a8eb9SGleb Smirnoff 					YYERROR;
12203b3a8eb9SGleb Smirnoff 				r.rtableid = $5.rtableid;
12213b3a8eb9SGleb Smirnoff 				j = calloc(1, sizeof(struct node_if));
12223b3a8eb9SGleb Smirnoff 				if (j == NULL)
12233b3a8eb9SGleb Smirnoff 					err(1, "antispoof: calloc");
12243b3a8eb9SGleb Smirnoff 				if (strlcpy(j->ifname, i->ifname,
12253b3a8eb9SGleb Smirnoff 				    sizeof(j->ifname)) >= sizeof(j->ifname)) {
12263b3a8eb9SGleb Smirnoff 					free(j);
12273b3a8eb9SGleb Smirnoff 					yyerror("interface name too long");
12283b3a8eb9SGleb Smirnoff 					YYERROR;
12293b3a8eb9SGleb Smirnoff 				}
12303b3a8eb9SGleb Smirnoff 				j->not = 1;
12313b3a8eb9SGleb Smirnoff 				if (i->dynamic) {
12323b3a8eb9SGleb Smirnoff 					h = calloc(1, sizeof(*h));
12333b3a8eb9SGleb Smirnoff 					if (h == NULL)
12343b3a8eb9SGleb Smirnoff 						err(1, "address: calloc");
12353b3a8eb9SGleb Smirnoff 					h->addr.type = PF_ADDR_DYNIFTL;
12363b3a8eb9SGleb Smirnoff 					set_ipmask(h, 128);
12373b3a8eb9SGleb Smirnoff 					if (strlcpy(h->addr.v.ifname, i->ifname,
12383b3a8eb9SGleb Smirnoff 					    sizeof(h->addr.v.ifname)) >=
12393b3a8eb9SGleb Smirnoff 					    sizeof(h->addr.v.ifname)) {
12403b3a8eb9SGleb Smirnoff 						free(h);
12413b3a8eb9SGleb Smirnoff 						yyerror(
12423b3a8eb9SGleb Smirnoff 						    "interface name too long");
12433b3a8eb9SGleb Smirnoff 						YYERROR;
12443b3a8eb9SGleb Smirnoff 					}
12453b3a8eb9SGleb Smirnoff 					hh = malloc(sizeof(*hh));
12463b3a8eb9SGleb Smirnoff 					if (hh == NULL)
12473b3a8eb9SGleb Smirnoff 						 err(1, "address: malloc");
12483b3a8eb9SGleb Smirnoff 					bcopy(h, hh, sizeof(*hh));
12493b3a8eb9SGleb Smirnoff 					h->addr.iflags = PFI_AFLAG_NETWORK;
12503b3a8eb9SGleb Smirnoff 				} else {
12513b3a8eb9SGleb Smirnoff 					h = ifa_lookup(j->ifname,
12523b3a8eb9SGleb Smirnoff 					    PFI_AFLAG_NETWORK);
12533b3a8eb9SGleb Smirnoff 					hh = NULL;
12543b3a8eb9SGleb Smirnoff 				}
12553b3a8eb9SGleb Smirnoff 
12563b3a8eb9SGleb Smirnoff 				if (h != NULL)
12573b3a8eb9SGleb Smirnoff 					expand_rule(&r, j, NULL, NULL, NULL, h,
12583b3a8eb9SGleb Smirnoff 					    NULL, NULL, NULL, NULL, NULL,
12593b3a8eb9SGleb Smirnoff 					    NULL, "");
12603b3a8eb9SGleb Smirnoff 
12613b3a8eb9SGleb Smirnoff 				if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
12623b3a8eb9SGleb Smirnoff 					bzero(&r, sizeof(r));
12633b3a8eb9SGleb Smirnoff 
12643b3a8eb9SGleb Smirnoff 					r.action = PF_DROP;
12653b3a8eb9SGleb Smirnoff 					r.direction = PF_IN;
12663b3a8eb9SGleb Smirnoff 					r.log = $2.log;
12673b3a8eb9SGleb Smirnoff 					r.logif = $2.logif;
12683b3a8eb9SGleb Smirnoff 					r.quick = $2.quick;
12693b3a8eb9SGleb Smirnoff 					r.af = $4;
12703b3a8eb9SGleb Smirnoff 					if (rule_label(&r, $5.label))
12713b3a8eb9SGleb Smirnoff 						YYERROR;
12723b3a8eb9SGleb Smirnoff 					r.rtableid = $5.rtableid;
12733b3a8eb9SGleb Smirnoff 					if (hh != NULL)
12743b3a8eb9SGleb Smirnoff 						h = hh;
12753b3a8eb9SGleb Smirnoff 					else
12763b3a8eb9SGleb Smirnoff 						h = ifa_lookup(i->ifname, 0);
12773b3a8eb9SGleb Smirnoff 					if (h != NULL)
12783b3a8eb9SGleb Smirnoff 						expand_rule(&r, NULL, NULL,
12793b3a8eb9SGleb Smirnoff 						    NULL, NULL, h, NULL, NULL,
12803b3a8eb9SGleb Smirnoff 						    NULL, NULL, NULL, NULL, "");
12813b3a8eb9SGleb Smirnoff 				} else
12823b3a8eb9SGleb Smirnoff 					free(hh);
12833b3a8eb9SGleb Smirnoff 			}
12843b3a8eb9SGleb Smirnoff 			free($5.label);
12853b3a8eb9SGleb Smirnoff 		}
12863b3a8eb9SGleb Smirnoff 		;
12873b3a8eb9SGleb Smirnoff 
12883b3a8eb9SGleb Smirnoff antispoof_ifspc	: FOR antispoof_if			{ $$ = $2; }
12893b3a8eb9SGleb Smirnoff 		| FOR '{' optnl antispoof_iflst '}'	{ $$ = $4; }
12903b3a8eb9SGleb Smirnoff 		;
12913b3a8eb9SGleb Smirnoff 
12923b3a8eb9SGleb Smirnoff antispoof_iflst	: antispoof_if optnl			{ $$ = $1; }
12933b3a8eb9SGleb Smirnoff 		| antispoof_iflst comma antispoof_if optnl {
12943b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
12953b3a8eb9SGleb Smirnoff 			$1->tail = $3;
12963b3a8eb9SGleb Smirnoff 			$$ = $1;
12973b3a8eb9SGleb Smirnoff 		}
12983b3a8eb9SGleb Smirnoff 		;
12993b3a8eb9SGleb Smirnoff 
13003b3a8eb9SGleb Smirnoff antispoof_if	: if_item				{ $$ = $1; }
13013b3a8eb9SGleb Smirnoff 		| '(' if_item ')'			{
13023b3a8eb9SGleb Smirnoff 			$2->dynamic = 1;
13033b3a8eb9SGleb Smirnoff 			$$ = $2;
13043b3a8eb9SGleb Smirnoff 		}
13053b3a8eb9SGleb Smirnoff 		;
13063b3a8eb9SGleb Smirnoff 
13073b3a8eb9SGleb Smirnoff antispoof_opts	:	{
13083b3a8eb9SGleb Smirnoff 				bzero(&antispoof_opts, sizeof antispoof_opts);
13093b3a8eb9SGleb Smirnoff 				antispoof_opts.rtableid = -1;
13103b3a8eb9SGleb Smirnoff 			}
13113b3a8eb9SGleb Smirnoff 		    antispoof_opts_l
13123b3a8eb9SGleb Smirnoff 			{ $$ = antispoof_opts; }
13133b3a8eb9SGleb Smirnoff 		| /* empty */	{
13143b3a8eb9SGleb Smirnoff 			bzero(&antispoof_opts, sizeof antispoof_opts);
13153b3a8eb9SGleb Smirnoff 			antispoof_opts.rtableid = -1;
13163b3a8eb9SGleb Smirnoff 			$$ = antispoof_opts;
13173b3a8eb9SGleb Smirnoff 		}
13183b3a8eb9SGleb Smirnoff 		;
13193b3a8eb9SGleb Smirnoff 
13203b3a8eb9SGleb Smirnoff antispoof_opts_l	: antispoof_opts_l antispoof_opt
13213b3a8eb9SGleb Smirnoff 			| antispoof_opt
13223b3a8eb9SGleb Smirnoff 			;
13233b3a8eb9SGleb Smirnoff 
13243b3a8eb9SGleb Smirnoff antispoof_opt	: label	{
13253b3a8eb9SGleb Smirnoff 			if (antispoof_opts.label) {
13263b3a8eb9SGleb Smirnoff 				yyerror("label cannot be redefined");
13273b3a8eb9SGleb Smirnoff 				YYERROR;
13283b3a8eb9SGleb Smirnoff 			}
13293b3a8eb9SGleb Smirnoff 			antispoof_opts.label = $1;
13303b3a8eb9SGleb Smirnoff 		}
13313b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER				{
13323b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
13333b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
13343b3a8eb9SGleb Smirnoff 				YYERROR;
13353b3a8eb9SGleb Smirnoff 			}
13363b3a8eb9SGleb Smirnoff 			antispoof_opts.rtableid = $2;
13373b3a8eb9SGleb Smirnoff 		}
13383b3a8eb9SGleb Smirnoff 		;
13393b3a8eb9SGleb Smirnoff 
13403b3a8eb9SGleb Smirnoff not		: '!'		{ $$ = 1; }
13413b3a8eb9SGleb Smirnoff 		| /* empty */	{ $$ = 0; }
13423b3a8eb9SGleb Smirnoff 		;
13433b3a8eb9SGleb Smirnoff 
13443b3a8eb9SGleb Smirnoff tabledef	: TABLE '<' STRING '>' table_opts {
13453b3a8eb9SGleb Smirnoff 			struct node_host	 *h, *nh;
13463b3a8eb9SGleb Smirnoff 			struct node_tinit	 *ti, *nti;
13473b3a8eb9SGleb Smirnoff 
13483b3a8eb9SGleb Smirnoff 			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
13493b3a8eb9SGleb Smirnoff 				yyerror("table name too long, max %d chars",
13503b3a8eb9SGleb Smirnoff 				    PF_TABLE_NAME_SIZE - 1);
13513b3a8eb9SGleb Smirnoff 				free($3);
13523b3a8eb9SGleb Smirnoff 				YYERROR;
13533b3a8eb9SGleb Smirnoff 			}
13543b3a8eb9SGleb Smirnoff 			if (pf->loadopt & PFCTL_FLAG_TABLE)
13553b3a8eb9SGleb Smirnoff 				if (process_tabledef($3, &$5)) {
13563b3a8eb9SGleb Smirnoff 					free($3);
13573b3a8eb9SGleb Smirnoff 					YYERROR;
13583b3a8eb9SGleb Smirnoff 				}
13593b3a8eb9SGleb Smirnoff 			free($3);
13603b3a8eb9SGleb Smirnoff 			for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
13613b3a8eb9SGleb Smirnoff 			    ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
13623b3a8eb9SGleb Smirnoff 				if (ti->file)
13633b3a8eb9SGleb Smirnoff 					free(ti->file);
13643b3a8eb9SGleb Smirnoff 				for (h = ti->host; h != NULL; h = nh) {
13653b3a8eb9SGleb Smirnoff 					nh = h->next;
13663b3a8eb9SGleb Smirnoff 					free(h);
13673b3a8eb9SGleb Smirnoff 				}
13683b3a8eb9SGleb Smirnoff 				nti = SIMPLEQ_NEXT(ti, entries);
13693b3a8eb9SGleb Smirnoff 				free(ti);
13703b3a8eb9SGleb Smirnoff 			}
13713b3a8eb9SGleb Smirnoff 		}
13723b3a8eb9SGleb Smirnoff 		;
13733b3a8eb9SGleb Smirnoff 
13743b3a8eb9SGleb Smirnoff table_opts	:	{
13753b3a8eb9SGleb Smirnoff 			bzero(&table_opts, sizeof table_opts);
13763b3a8eb9SGleb Smirnoff 			SIMPLEQ_INIT(&table_opts.init_nodes);
13773b3a8eb9SGleb Smirnoff 		}
13783b3a8eb9SGleb Smirnoff 		    table_opts_l
13793b3a8eb9SGleb Smirnoff 			{ $$ = table_opts; }
13803b3a8eb9SGleb Smirnoff 		| /* empty */
13813b3a8eb9SGleb Smirnoff 			{
13823b3a8eb9SGleb Smirnoff 			bzero(&table_opts, sizeof table_opts);
13833b3a8eb9SGleb Smirnoff 			SIMPLEQ_INIT(&table_opts.init_nodes);
13843b3a8eb9SGleb Smirnoff 			$$ = table_opts;
13853b3a8eb9SGleb Smirnoff 		}
13863b3a8eb9SGleb Smirnoff 		;
13873b3a8eb9SGleb Smirnoff 
13883b3a8eb9SGleb Smirnoff table_opts_l	: table_opts_l table_opt
13893b3a8eb9SGleb Smirnoff 		| table_opt
13903b3a8eb9SGleb Smirnoff 		;
13913b3a8eb9SGleb Smirnoff 
13923b3a8eb9SGleb Smirnoff table_opt	: STRING		{
13933b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "const"))
13943b3a8eb9SGleb Smirnoff 				table_opts.flags |= PFR_TFLAG_CONST;
13953b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "persist"))
13963b3a8eb9SGleb Smirnoff 				table_opts.flags |= PFR_TFLAG_PERSIST;
13973b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "counters"))
13983b3a8eb9SGleb Smirnoff 				table_opts.flags |= PFR_TFLAG_COUNTERS;
13993b3a8eb9SGleb Smirnoff 			else {
14003b3a8eb9SGleb Smirnoff 				yyerror("invalid table option '%s'", $1);
14013b3a8eb9SGleb Smirnoff 				free($1);
14023b3a8eb9SGleb Smirnoff 				YYERROR;
14033b3a8eb9SGleb Smirnoff 			}
14043b3a8eb9SGleb Smirnoff 			free($1);
14053b3a8eb9SGleb Smirnoff 		}
14063b3a8eb9SGleb Smirnoff 		| '{' optnl '}'		{ table_opts.init_addr = 1; }
14073b3a8eb9SGleb Smirnoff 		| '{' optnl host_list '}'	{
14083b3a8eb9SGleb Smirnoff 			struct node_host	*n;
14093b3a8eb9SGleb Smirnoff 			struct node_tinit	*ti;
14103b3a8eb9SGleb Smirnoff 
14113b3a8eb9SGleb Smirnoff 			for (n = $3; n != NULL; n = n->next) {
14123b3a8eb9SGleb Smirnoff 				switch (n->addr.type) {
14133b3a8eb9SGleb Smirnoff 				case PF_ADDR_ADDRMASK:
14143b3a8eb9SGleb Smirnoff 					continue; /* ok */
14153b3a8eb9SGleb Smirnoff 				case PF_ADDR_RANGE:
14163b3a8eb9SGleb Smirnoff 					yyerror("address ranges are not "
14173b3a8eb9SGleb Smirnoff 					    "permitted inside tables");
14183b3a8eb9SGleb Smirnoff 					break;
14193b3a8eb9SGleb Smirnoff 				case PF_ADDR_DYNIFTL:
14203b3a8eb9SGleb Smirnoff 					yyerror("dynamic addresses are not "
14213b3a8eb9SGleb Smirnoff 					    "permitted inside tables");
14223b3a8eb9SGleb Smirnoff 					break;
14233b3a8eb9SGleb Smirnoff 				case PF_ADDR_TABLE:
14243b3a8eb9SGleb Smirnoff 					yyerror("tables cannot contain tables");
14253b3a8eb9SGleb Smirnoff 					break;
14263b3a8eb9SGleb Smirnoff 				case PF_ADDR_NOROUTE:
14273b3a8eb9SGleb Smirnoff 					yyerror("\"no-route\" is not permitted "
14283b3a8eb9SGleb Smirnoff 					    "inside tables");
14293b3a8eb9SGleb Smirnoff 					break;
14303b3a8eb9SGleb Smirnoff 				case PF_ADDR_URPFFAILED:
14313b3a8eb9SGleb Smirnoff 					yyerror("\"urpf-failed\" is not "
14323b3a8eb9SGleb Smirnoff 					    "permitted inside tables");
14333b3a8eb9SGleb Smirnoff 					break;
14343b3a8eb9SGleb Smirnoff 				default:
14353b3a8eb9SGleb Smirnoff 					yyerror("unknown address type %d",
14363b3a8eb9SGleb Smirnoff 					    n->addr.type);
14373b3a8eb9SGleb Smirnoff 				}
14383b3a8eb9SGleb Smirnoff 				YYERROR;
14393b3a8eb9SGleb Smirnoff 			}
14403b3a8eb9SGleb Smirnoff 			if (!(ti = calloc(1, sizeof(*ti))))
14413b3a8eb9SGleb Smirnoff 				err(1, "table_opt: calloc");
14423b3a8eb9SGleb Smirnoff 			ti->host = $3;
14433b3a8eb9SGleb Smirnoff 			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
14443b3a8eb9SGleb Smirnoff 			    entries);
14453b3a8eb9SGleb Smirnoff 			table_opts.init_addr = 1;
14463b3a8eb9SGleb Smirnoff 		}
14473b3a8eb9SGleb Smirnoff 		| FILENAME STRING	{
14483b3a8eb9SGleb Smirnoff 			struct node_tinit	*ti;
14493b3a8eb9SGleb Smirnoff 
14503b3a8eb9SGleb Smirnoff 			if (!(ti = calloc(1, sizeof(*ti))))
14513b3a8eb9SGleb Smirnoff 				err(1, "table_opt: calloc");
14523b3a8eb9SGleb Smirnoff 			ti->file = $2;
14533b3a8eb9SGleb Smirnoff 			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
14543b3a8eb9SGleb Smirnoff 			    entries);
14553b3a8eb9SGleb Smirnoff 			table_opts.init_addr = 1;
14563b3a8eb9SGleb Smirnoff 		}
14573b3a8eb9SGleb Smirnoff 		;
14583b3a8eb9SGleb Smirnoff 
14593b3a8eb9SGleb Smirnoff altqif		: ALTQ interface queue_opts QUEUE qassign {
14603b3a8eb9SGleb Smirnoff 			struct pf_altq	a;
14613b3a8eb9SGleb Smirnoff 
14623b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_QUEUE))
14633b3a8eb9SGleb Smirnoff 				YYERROR;
14643b3a8eb9SGleb Smirnoff 
14653b3a8eb9SGleb Smirnoff 			memset(&a, 0, sizeof(a));
14663b3a8eb9SGleb Smirnoff 			if ($3.scheduler.qtype == ALTQT_NONE) {
14673b3a8eb9SGleb Smirnoff 				yyerror("no scheduler specified!");
14683b3a8eb9SGleb Smirnoff 				YYERROR;
14693b3a8eb9SGleb Smirnoff 			}
14703b3a8eb9SGleb Smirnoff 			a.scheduler = $3.scheduler.qtype;
14713b3a8eb9SGleb Smirnoff 			a.qlimit = $3.qlimit;
14723b3a8eb9SGleb Smirnoff 			a.tbrsize = $3.tbrsize;
14733b3a8eb9SGleb Smirnoff 			if ($5 == NULL) {
14743b3a8eb9SGleb Smirnoff 				yyerror("no child queues specified");
14753b3a8eb9SGleb Smirnoff 				YYERROR;
14763b3a8eb9SGleb Smirnoff 			}
14773b3a8eb9SGleb Smirnoff 			if (expand_altq(&a, $2, $5, $3.queue_bwspec,
14783b3a8eb9SGleb Smirnoff 			    &$3.scheduler))
14793b3a8eb9SGleb Smirnoff 				YYERROR;
14803b3a8eb9SGleb Smirnoff 		}
14813b3a8eb9SGleb Smirnoff 		;
14823b3a8eb9SGleb Smirnoff 
14833b3a8eb9SGleb Smirnoff queuespec	: QUEUE STRING interface queue_opts qassign {
14843b3a8eb9SGleb Smirnoff 			struct pf_altq	a;
14853b3a8eb9SGleb Smirnoff 
14863b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_QUEUE)) {
14873b3a8eb9SGleb Smirnoff 				free($2);
14883b3a8eb9SGleb Smirnoff 				YYERROR;
14893b3a8eb9SGleb Smirnoff 			}
14903b3a8eb9SGleb Smirnoff 
14913b3a8eb9SGleb Smirnoff 			memset(&a, 0, sizeof(a));
14923b3a8eb9SGleb Smirnoff 
14933b3a8eb9SGleb Smirnoff 			if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
14943b3a8eb9SGleb Smirnoff 			    sizeof(a.qname)) {
14953b3a8eb9SGleb Smirnoff 				yyerror("queue name too long (max "
14963b3a8eb9SGleb Smirnoff 				    "%d chars)", PF_QNAME_SIZE-1);
14973b3a8eb9SGleb Smirnoff 				free($2);
14983b3a8eb9SGleb Smirnoff 				YYERROR;
14993b3a8eb9SGleb Smirnoff 			}
15003b3a8eb9SGleb Smirnoff 			free($2);
15013b3a8eb9SGleb Smirnoff 			if ($4.tbrsize) {
15023b3a8eb9SGleb Smirnoff 				yyerror("cannot specify tbrsize for queue");
15033b3a8eb9SGleb Smirnoff 				YYERROR;
15043b3a8eb9SGleb Smirnoff 			}
15053b3a8eb9SGleb Smirnoff 			if ($4.priority > 255) {
15063b3a8eb9SGleb Smirnoff 				yyerror("priority out of range: max 255");
15073b3a8eb9SGleb Smirnoff 				YYERROR;
15083b3a8eb9SGleb Smirnoff 			}
15093b3a8eb9SGleb Smirnoff 			a.priority = $4.priority;
15103b3a8eb9SGleb Smirnoff 			a.qlimit = $4.qlimit;
15113b3a8eb9SGleb Smirnoff 			a.scheduler = $4.scheduler.qtype;
15123b3a8eb9SGleb Smirnoff 			if (expand_queue(&a, $3, $5, $4.queue_bwspec,
15133b3a8eb9SGleb Smirnoff 			    &$4.scheduler)) {
15143b3a8eb9SGleb Smirnoff 				yyerror("errors in queue definition");
15153b3a8eb9SGleb Smirnoff 				YYERROR;
15163b3a8eb9SGleb Smirnoff 			}
15173b3a8eb9SGleb Smirnoff 		}
15183b3a8eb9SGleb Smirnoff 		;
15193b3a8eb9SGleb Smirnoff 
15203b3a8eb9SGleb Smirnoff queue_opts	:	{
15213b3a8eb9SGleb Smirnoff 			bzero(&queue_opts, sizeof queue_opts);
15223b3a8eb9SGleb Smirnoff 			queue_opts.priority = DEFAULT_PRIORITY;
15233b3a8eb9SGleb Smirnoff 			queue_opts.qlimit = DEFAULT_QLIMIT;
15243b3a8eb9SGleb Smirnoff 			queue_opts.scheduler.qtype = ALTQT_NONE;
15253b3a8eb9SGleb Smirnoff 			queue_opts.queue_bwspec.bw_percent = 100;
15263b3a8eb9SGleb Smirnoff 		}
15273b3a8eb9SGleb Smirnoff 		    queue_opts_l
15283b3a8eb9SGleb Smirnoff 			{ $$ = queue_opts; }
15293b3a8eb9SGleb Smirnoff 		| /* empty */ {
15303b3a8eb9SGleb Smirnoff 			bzero(&queue_opts, sizeof queue_opts);
15313b3a8eb9SGleb Smirnoff 			queue_opts.priority = DEFAULT_PRIORITY;
15323b3a8eb9SGleb Smirnoff 			queue_opts.qlimit = DEFAULT_QLIMIT;
15333b3a8eb9SGleb Smirnoff 			queue_opts.scheduler.qtype = ALTQT_NONE;
15343b3a8eb9SGleb Smirnoff 			queue_opts.queue_bwspec.bw_percent = 100;
15353b3a8eb9SGleb Smirnoff 			$$ = queue_opts;
15363b3a8eb9SGleb Smirnoff 		}
15373b3a8eb9SGleb Smirnoff 		;
15383b3a8eb9SGleb Smirnoff 
15393b3a8eb9SGleb Smirnoff queue_opts_l	: queue_opts_l queue_opt
15403b3a8eb9SGleb Smirnoff 		| queue_opt
15413b3a8eb9SGleb Smirnoff 		;
15423b3a8eb9SGleb Smirnoff 
15433b3a8eb9SGleb Smirnoff queue_opt	: BANDWIDTH bandwidth	{
15443b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_BWSPEC) {
15453b3a8eb9SGleb Smirnoff 				yyerror("bandwidth cannot be respecified");
15463b3a8eb9SGleb Smirnoff 				YYERROR;
15473b3a8eb9SGleb Smirnoff 			}
15483b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_BWSPEC;
15493b3a8eb9SGleb Smirnoff 			queue_opts.queue_bwspec = $2;
15503b3a8eb9SGleb Smirnoff 		}
15513b3a8eb9SGleb Smirnoff 		| PRIORITY NUMBER	{
15523b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_PRIORITY) {
15533b3a8eb9SGleb Smirnoff 				yyerror("priority cannot be respecified");
15543b3a8eb9SGleb Smirnoff 				YYERROR;
15553b3a8eb9SGleb Smirnoff 			}
15563b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 255) {
15573b3a8eb9SGleb Smirnoff 				yyerror("priority out of range: max 255");
15583b3a8eb9SGleb Smirnoff 				YYERROR;
15593b3a8eb9SGleb Smirnoff 			}
15603b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_PRIORITY;
15613b3a8eb9SGleb Smirnoff 			queue_opts.priority = $2;
15623b3a8eb9SGleb Smirnoff 		}
15633b3a8eb9SGleb Smirnoff 		| QLIMIT NUMBER	{
15643b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_QLIMIT) {
15653b3a8eb9SGleb Smirnoff 				yyerror("qlimit cannot be respecified");
15663b3a8eb9SGleb Smirnoff 				YYERROR;
15673b3a8eb9SGleb Smirnoff 			}
15683b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 65535) {
15693b3a8eb9SGleb Smirnoff 				yyerror("qlimit out of range: max 65535");
15703b3a8eb9SGleb Smirnoff 				YYERROR;
15713b3a8eb9SGleb Smirnoff 			}
15723b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_QLIMIT;
15733b3a8eb9SGleb Smirnoff 			queue_opts.qlimit = $2;
15743b3a8eb9SGleb Smirnoff 		}
15753b3a8eb9SGleb Smirnoff 		| scheduler	{
15763b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_SCHEDULER) {
15773b3a8eb9SGleb Smirnoff 				yyerror("scheduler cannot be respecified");
15783b3a8eb9SGleb Smirnoff 				YYERROR;
15793b3a8eb9SGleb Smirnoff 			}
15803b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_SCHEDULER;
15813b3a8eb9SGleb Smirnoff 			queue_opts.scheduler = $1;
15823b3a8eb9SGleb Smirnoff 		}
15833b3a8eb9SGleb Smirnoff 		| TBRSIZE NUMBER	{
15843b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_TBRSIZE) {
15853b3a8eb9SGleb Smirnoff 				yyerror("tbrsize cannot be respecified");
15863b3a8eb9SGleb Smirnoff 				YYERROR;
15873b3a8eb9SGleb Smirnoff 			}
15883b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 65535) {
15893b3a8eb9SGleb Smirnoff 				yyerror("tbrsize too big: max 65535");
15903b3a8eb9SGleb Smirnoff 				YYERROR;
15913b3a8eb9SGleb Smirnoff 			}
15923b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_TBRSIZE;
15933b3a8eb9SGleb Smirnoff 			queue_opts.tbrsize = $2;
15943b3a8eb9SGleb Smirnoff 		}
15953b3a8eb9SGleb Smirnoff 		;
15963b3a8eb9SGleb Smirnoff 
15973b3a8eb9SGleb Smirnoff bandwidth	: STRING {
15983b3a8eb9SGleb Smirnoff 			double	 bps;
15993b3a8eb9SGleb Smirnoff 			char	*cp;
16003b3a8eb9SGleb Smirnoff 
16013b3a8eb9SGleb Smirnoff 			$$.bw_percent = 0;
16023b3a8eb9SGleb Smirnoff 
16033b3a8eb9SGleb Smirnoff 			bps = strtod($1, &cp);
16043b3a8eb9SGleb Smirnoff 			if (cp != NULL) {
16053b3a8eb9SGleb Smirnoff 				if (!strcmp(cp, "b"))
16063b3a8eb9SGleb Smirnoff 					; /* nothing */
16073b3a8eb9SGleb Smirnoff 				else if (!strcmp(cp, "Kb"))
16083b3a8eb9SGleb Smirnoff 					bps *= 1000;
16093b3a8eb9SGleb Smirnoff 				else if (!strcmp(cp, "Mb"))
16103b3a8eb9SGleb Smirnoff 					bps *= 1000 * 1000;
16113b3a8eb9SGleb Smirnoff 				else if (!strcmp(cp, "Gb"))
16123b3a8eb9SGleb Smirnoff 					bps *= 1000 * 1000 * 1000;
16133b3a8eb9SGleb Smirnoff 				else if (!strcmp(cp, "%")) {
16143b3a8eb9SGleb Smirnoff 					if (bps < 0 || bps > 100) {
16153b3a8eb9SGleb Smirnoff 						yyerror("bandwidth spec "
16163b3a8eb9SGleb Smirnoff 						    "out of range");
16173b3a8eb9SGleb Smirnoff 						free($1);
16183b3a8eb9SGleb Smirnoff 						YYERROR;
16193b3a8eb9SGleb Smirnoff 					}
16203b3a8eb9SGleb Smirnoff 					$$.bw_percent = bps;
16213b3a8eb9SGleb Smirnoff 					bps = 0;
16223b3a8eb9SGleb Smirnoff 				} else {
16233b3a8eb9SGleb Smirnoff 					yyerror("unknown unit %s", cp);
16243b3a8eb9SGleb Smirnoff 					free($1);
16253b3a8eb9SGleb Smirnoff 					YYERROR;
16263b3a8eb9SGleb Smirnoff 				}
16273b3a8eb9SGleb Smirnoff 			}
16283b3a8eb9SGleb Smirnoff 			free($1);
16293b3a8eb9SGleb Smirnoff 			$$.bw_absolute = (u_int32_t)bps;
16303b3a8eb9SGleb Smirnoff 		}
16313b3a8eb9SGleb Smirnoff 		| NUMBER {
16323b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > UINT_MAX) {
16333b3a8eb9SGleb Smirnoff 				yyerror("bandwidth number too big");
16343b3a8eb9SGleb Smirnoff 				YYERROR;
16353b3a8eb9SGleb Smirnoff 			}
16363b3a8eb9SGleb Smirnoff 			$$.bw_percent = 0;
16373b3a8eb9SGleb Smirnoff 			$$.bw_absolute = $1;
16383b3a8eb9SGleb Smirnoff 		}
16393b3a8eb9SGleb Smirnoff 		;
16403b3a8eb9SGleb Smirnoff 
16413b3a8eb9SGleb Smirnoff scheduler	: CBQ				{
16423b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_CBQ;
16433b3a8eb9SGleb Smirnoff 			$$.data.cbq_opts.flags = 0;
16443b3a8eb9SGleb Smirnoff 		}
16453b3a8eb9SGleb Smirnoff 		| CBQ '(' cbqflags_list ')'	{
16463b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_CBQ;
16473b3a8eb9SGleb Smirnoff 			$$.data.cbq_opts.flags = $3;
16483b3a8eb9SGleb Smirnoff 		}
16493b3a8eb9SGleb Smirnoff 		| PRIQ				{
16503b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_PRIQ;
16513b3a8eb9SGleb Smirnoff 			$$.data.priq_opts.flags = 0;
16523b3a8eb9SGleb Smirnoff 		}
16533b3a8eb9SGleb Smirnoff 		| PRIQ '(' priqflags_list ')'	{
16543b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_PRIQ;
16553b3a8eb9SGleb Smirnoff 			$$.data.priq_opts.flags = $3;
16563b3a8eb9SGleb Smirnoff 		}
16573b3a8eb9SGleb Smirnoff 		| HFSC				{
16583b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_HFSC;
16593b3a8eb9SGleb Smirnoff 			bzero(&$$.data.hfsc_opts,
16603b3a8eb9SGleb Smirnoff 			    sizeof(struct node_hfsc_opts));
16613b3a8eb9SGleb Smirnoff 		}
16623b3a8eb9SGleb Smirnoff 		| HFSC '(' hfsc_opts ')'	{
16633b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_HFSC;
16643b3a8eb9SGleb Smirnoff 			$$.data.hfsc_opts = $3;
16653b3a8eb9SGleb Smirnoff 		}
1666*a5b789f6SErmal Luçi 		| FAIRQ				{
1667*a5b789f6SErmal Luçi 			$$.qtype = ALTQT_FAIRQ;
1668*a5b789f6SErmal Luçi 			bzero(&$$.data.fairq_opts,
1669*a5b789f6SErmal Luçi 				sizeof(struct node_fairq_opts));
1670*a5b789f6SErmal Luçi 		}
1671*a5b789f6SErmal Luçi 		| FAIRQ '(' fairq_opts ')'      {
1672*a5b789f6SErmal Luçi 			$$.qtype = ALTQT_FAIRQ;
1673*a5b789f6SErmal Luçi 			$$.data.fairq_opts = $3;
1674*a5b789f6SErmal Luçi 		}
16753b3a8eb9SGleb Smirnoff 		;
16763b3a8eb9SGleb Smirnoff 
16773b3a8eb9SGleb Smirnoff cbqflags_list	: cbqflags_item				{ $$ |= $1; }
16783b3a8eb9SGleb Smirnoff 		| cbqflags_list comma cbqflags_item	{ $$ |= $3; }
16793b3a8eb9SGleb Smirnoff 		;
16803b3a8eb9SGleb Smirnoff 
16813b3a8eb9SGleb Smirnoff cbqflags_item	: STRING	{
16823b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "default"))
16833b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_DEFCLASS;
16843b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "borrow"))
16853b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_BORROW;
16863b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "red"))
16873b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_RED;
16883b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "ecn"))
16893b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_RED|CBQCLF_ECN;
16903b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "rio"))
16913b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_RIO;
16923b3a8eb9SGleb Smirnoff 			else {
16933b3a8eb9SGleb Smirnoff 				yyerror("unknown cbq flag \"%s\"", $1);
16943b3a8eb9SGleb Smirnoff 				free($1);
16953b3a8eb9SGleb Smirnoff 				YYERROR;
16963b3a8eb9SGleb Smirnoff 			}
16973b3a8eb9SGleb Smirnoff 			free($1);
16983b3a8eb9SGleb Smirnoff 		}
16993b3a8eb9SGleb Smirnoff 		;
17003b3a8eb9SGleb Smirnoff 
17013b3a8eb9SGleb Smirnoff priqflags_list	: priqflags_item			{ $$ |= $1; }
17023b3a8eb9SGleb Smirnoff 		| priqflags_list comma priqflags_item	{ $$ |= $3; }
17033b3a8eb9SGleb Smirnoff 		;
17043b3a8eb9SGleb Smirnoff 
17053b3a8eb9SGleb Smirnoff priqflags_item	: STRING	{
17063b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "default"))
17073b3a8eb9SGleb Smirnoff 				$$ = PRCF_DEFAULTCLASS;
17083b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "red"))
17093b3a8eb9SGleb Smirnoff 				$$ = PRCF_RED;
17103b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "ecn"))
17113b3a8eb9SGleb Smirnoff 				$$ = PRCF_RED|PRCF_ECN;
17123b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "rio"))
17133b3a8eb9SGleb Smirnoff 				$$ = PRCF_RIO;
17143b3a8eb9SGleb Smirnoff 			else {
17153b3a8eb9SGleb Smirnoff 				yyerror("unknown priq flag \"%s\"", $1);
17163b3a8eb9SGleb Smirnoff 				free($1);
17173b3a8eb9SGleb Smirnoff 				YYERROR;
17183b3a8eb9SGleb Smirnoff 			}
17193b3a8eb9SGleb Smirnoff 			free($1);
17203b3a8eb9SGleb Smirnoff 		}
17213b3a8eb9SGleb Smirnoff 		;
17223b3a8eb9SGleb Smirnoff 
17233b3a8eb9SGleb Smirnoff hfsc_opts	:	{
17243b3a8eb9SGleb Smirnoff 				bzero(&hfsc_opts,
17253b3a8eb9SGleb Smirnoff 				    sizeof(struct node_hfsc_opts));
17263b3a8eb9SGleb Smirnoff 			}
17273b3a8eb9SGleb Smirnoff 		    hfscopts_list				{
17283b3a8eb9SGleb Smirnoff 			$$ = hfsc_opts;
17293b3a8eb9SGleb Smirnoff 		}
17303b3a8eb9SGleb Smirnoff 		;
17313b3a8eb9SGleb Smirnoff 
17323b3a8eb9SGleb Smirnoff hfscopts_list	: hfscopts_item
17333b3a8eb9SGleb Smirnoff 		| hfscopts_list comma hfscopts_item
17343b3a8eb9SGleb Smirnoff 		;
17353b3a8eb9SGleb Smirnoff 
17363b3a8eb9SGleb Smirnoff hfscopts_item	: LINKSHARE bandwidth				{
17373b3a8eb9SGleb Smirnoff 			if (hfsc_opts.linkshare.used) {
17383b3a8eb9SGleb Smirnoff 				yyerror("linkshare already specified");
17393b3a8eb9SGleb Smirnoff 				YYERROR;
17403b3a8eb9SGleb Smirnoff 			}
17413b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.m2 = $2;
17423b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.used = 1;
17433b3a8eb9SGleb Smirnoff 		}
17443b3a8eb9SGleb Smirnoff 		| LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')'
17453b3a8eb9SGleb Smirnoff 		    {
17463b3a8eb9SGleb Smirnoff 			if ($5 < 0 || $5 > INT_MAX) {
17473b3a8eb9SGleb Smirnoff 				yyerror("timing in curve out of range");
17483b3a8eb9SGleb Smirnoff 				YYERROR;
17493b3a8eb9SGleb Smirnoff 			}
17503b3a8eb9SGleb Smirnoff 			if (hfsc_opts.linkshare.used) {
17513b3a8eb9SGleb Smirnoff 				yyerror("linkshare already specified");
17523b3a8eb9SGleb Smirnoff 				YYERROR;
17533b3a8eb9SGleb Smirnoff 			}
17543b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.m1 = $3;
17553b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.d = $5;
17563b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.m2 = $7;
17573b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.used = 1;
17583b3a8eb9SGleb Smirnoff 		}
17593b3a8eb9SGleb Smirnoff 		| REALTIME bandwidth				{
17603b3a8eb9SGleb Smirnoff 			if (hfsc_opts.realtime.used) {
17613b3a8eb9SGleb Smirnoff 				yyerror("realtime already specified");
17623b3a8eb9SGleb Smirnoff 				YYERROR;
17633b3a8eb9SGleb Smirnoff 			}
17643b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.m2 = $2;
17653b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.used = 1;
17663b3a8eb9SGleb Smirnoff 		}
17673b3a8eb9SGleb Smirnoff 		| REALTIME '(' bandwidth comma NUMBER comma bandwidth ')'
17683b3a8eb9SGleb Smirnoff 		    {
17693b3a8eb9SGleb Smirnoff 			if ($5 < 0 || $5 > INT_MAX) {
17703b3a8eb9SGleb Smirnoff 				yyerror("timing in curve out of range");
17713b3a8eb9SGleb Smirnoff 				YYERROR;
17723b3a8eb9SGleb Smirnoff 			}
17733b3a8eb9SGleb Smirnoff 			if (hfsc_opts.realtime.used) {
17743b3a8eb9SGleb Smirnoff 				yyerror("realtime already specified");
17753b3a8eb9SGleb Smirnoff 				YYERROR;
17763b3a8eb9SGleb Smirnoff 			}
17773b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.m1 = $3;
17783b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.d = $5;
17793b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.m2 = $7;
17803b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.used = 1;
17813b3a8eb9SGleb Smirnoff 		}
17823b3a8eb9SGleb Smirnoff 		| UPPERLIMIT bandwidth				{
17833b3a8eb9SGleb Smirnoff 			if (hfsc_opts.upperlimit.used) {
17843b3a8eb9SGleb Smirnoff 				yyerror("upperlimit already specified");
17853b3a8eb9SGleb Smirnoff 				YYERROR;
17863b3a8eb9SGleb Smirnoff 			}
17873b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.m2 = $2;
17883b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.used = 1;
17893b3a8eb9SGleb Smirnoff 		}
17903b3a8eb9SGleb Smirnoff 		| UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')'
17913b3a8eb9SGleb Smirnoff 		    {
17923b3a8eb9SGleb Smirnoff 			if ($5 < 0 || $5 > INT_MAX) {
17933b3a8eb9SGleb Smirnoff 				yyerror("timing in curve out of range");
17943b3a8eb9SGleb Smirnoff 				YYERROR;
17953b3a8eb9SGleb Smirnoff 			}
17963b3a8eb9SGleb Smirnoff 			if (hfsc_opts.upperlimit.used) {
17973b3a8eb9SGleb Smirnoff 				yyerror("upperlimit already specified");
17983b3a8eb9SGleb Smirnoff 				YYERROR;
17993b3a8eb9SGleb Smirnoff 			}
18003b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.m1 = $3;
18013b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.d = $5;
18023b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.m2 = $7;
18033b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.used = 1;
18043b3a8eb9SGleb Smirnoff 		}
18053b3a8eb9SGleb Smirnoff 		| STRING	{
18063b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "default"))
18073b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_DEFAULTCLASS;
18083b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "red"))
18093b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_RED;
18103b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "ecn"))
18113b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_RED|HFCF_ECN;
18123b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "rio"))
18133b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_RIO;
18143b3a8eb9SGleb Smirnoff 			else {
18153b3a8eb9SGleb Smirnoff 				yyerror("unknown hfsc flag \"%s\"", $1);
18163b3a8eb9SGleb Smirnoff 				free($1);
18173b3a8eb9SGleb Smirnoff 				YYERROR;
18183b3a8eb9SGleb Smirnoff 			}
18193b3a8eb9SGleb Smirnoff 			free($1);
18203b3a8eb9SGleb Smirnoff 		}
18213b3a8eb9SGleb Smirnoff 		;
18223b3a8eb9SGleb Smirnoff 
1823*a5b789f6SErmal Luçi fairq_opts	:	{
1824*a5b789f6SErmal Luçi 				bzero(&fairq_opts,
1825*a5b789f6SErmal Luçi 				    sizeof(struct node_fairq_opts));
1826*a5b789f6SErmal Luçi 			}
1827*a5b789f6SErmal Luçi 		    fairqopts_list				{
1828*a5b789f6SErmal Luçi 			$$ = fairq_opts;
1829*a5b789f6SErmal Luçi 		}
1830*a5b789f6SErmal Luçi 		;
1831*a5b789f6SErmal Luçi 
1832*a5b789f6SErmal Luçi fairqopts_list	: fairqopts_item
1833*a5b789f6SErmal Luçi 		| fairqopts_list comma fairqopts_item
1834*a5b789f6SErmal Luçi 		;
1835*a5b789f6SErmal Luçi 
1836*a5b789f6SErmal Luçi fairqopts_item	: LINKSHARE bandwidth				{
1837*a5b789f6SErmal Luçi 			if (fairq_opts.linkshare.used) {
1838*a5b789f6SErmal Luçi 				yyerror("linkshare already specified");
1839*a5b789f6SErmal Luçi 				YYERROR;
1840*a5b789f6SErmal Luçi 			}
1841*a5b789f6SErmal Luçi 			fairq_opts.linkshare.m2 = $2;
1842*a5b789f6SErmal Luçi 			fairq_opts.linkshare.used = 1;
1843*a5b789f6SErmal Luçi 		}
1844*a5b789f6SErmal Luçi 		| LINKSHARE '(' bandwidth number bandwidth ')'	{
1845*a5b789f6SErmal Luçi 			if (fairq_opts.linkshare.used) {
1846*a5b789f6SErmal Luçi 				yyerror("linkshare already specified");
1847*a5b789f6SErmal Luçi 				YYERROR;
1848*a5b789f6SErmal Luçi 			}
1849*a5b789f6SErmal Luçi 			fairq_opts.linkshare.m1 = $3;
1850*a5b789f6SErmal Luçi 			fairq_opts.linkshare.d = $4;
1851*a5b789f6SErmal Luçi 			fairq_opts.linkshare.m2 = $5;
1852*a5b789f6SErmal Luçi 			fairq_opts.linkshare.used = 1;
1853*a5b789f6SErmal Luçi 		}
1854*a5b789f6SErmal Luçi 		| HOGS bandwidth {
1855*a5b789f6SErmal Luçi 			fairq_opts.hogs_bw = $2;
1856*a5b789f6SErmal Luçi 		}
1857*a5b789f6SErmal Luçi 		| BUCKETS number {
1858*a5b789f6SErmal Luçi 			fairq_opts.nbuckets = $2;
1859*a5b789f6SErmal Luçi 		}
1860*a5b789f6SErmal Luçi 		| STRING	{
1861*a5b789f6SErmal Luçi 			if (!strcmp($1, "default"))
1862*a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_DEFAULTCLASS;
1863*a5b789f6SErmal Luçi 			else if (!strcmp($1, "red"))
1864*a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_RED;
1865*a5b789f6SErmal Luçi 			else if (!strcmp($1, "ecn"))
1866*a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_RED|FARF_ECN;
1867*a5b789f6SErmal Luçi 			else if (!strcmp($1, "rio"))
1868*a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_RIO;
1869*a5b789f6SErmal Luçi 			else {
1870*a5b789f6SErmal Luçi 				yyerror("unknown fairq flag \"%s\"", $1);
1871*a5b789f6SErmal Luçi 				free($1);
1872*a5b789f6SErmal Luçi 				YYERROR;
1873*a5b789f6SErmal Luçi 			}
1874*a5b789f6SErmal Luçi 			free($1);
1875*a5b789f6SErmal Luçi 		}
1876*a5b789f6SErmal Luçi 		;
1877*a5b789f6SErmal Luçi 
18783b3a8eb9SGleb Smirnoff qassign		: /* empty */		{ $$ = NULL; }
18793b3a8eb9SGleb Smirnoff 		| qassign_item		{ $$ = $1; }
18803b3a8eb9SGleb Smirnoff 		| '{' optnl qassign_list '}'	{ $$ = $3; }
18813b3a8eb9SGleb Smirnoff 		;
18823b3a8eb9SGleb Smirnoff 
18833b3a8eb9SGleb Smirnoff qassign_list	: qassign_item optnl		{ $$ = $1; }
18843b3a8eb9SGleb Smirnoff 		| qassign_list comma qassign_item optnl	{
18853b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
18863b3a8eb9SGleb Smirnoff 			$1->tail = $3;
18873b3a8eb9SGleb Smirnoff 			$$ = $1;
18883b3a8eb9SGleb Smirnoff 		}
18893b3a8eb9SGleb Smirnoff 		;
18903b3a8eb9SGleb Smirnoff 
18913b3a8eb9SGleb Smirnoff qassign_item	: STRING			{
18923b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_queue));
18933b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
18943b3a8eb9SGleb Smirnoff 				err(1, "qassign_item: calloc");
18953b3a8eb9SGleb Smirnoff 			if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
18963b3a8eb9SGleb Smirnoff 			    sizeof($$->queue)) {
18973b3a8eb9SGleb Smirnoff 				yyerror("queue name '%s' too long (max "
18983b3a8eb9SGleb Smirnoff 				    "%d chars)", $1, sizeof($$->queue)-1);
18993b3a8eb9SGleb Smirnoff 				free($1);
19003b3a8eb9SGleb Smirnoff 				free($$);
19013b3a8eb9SGleb Smirnoff 				YYERROR;
19023b3a8eb9SGleb Smirnoff 			}
19033b3a8eb9SGleb Smirnoff 			free($1);
19043b3a8eb9SGleb Smirnoff 			$$->next = NULL;
19053b3a8eb9SGleb Smirnoff 			$$->tail = $$;
19063b3a8eb9SGleb Smirnoff 		}
19073b3a8eb9SGleb Smirnoff 		;
19083b3a8eb9SGleb Smirnoff 
19093b3a8eb9SGleb Smirnoff pfrule		: action dir logquick interface route af proto fromto
19103b3a8eb9SGleb Smirnoff 		    filter_opts
19113b3a8eb9SGleb Smirnoff 		{
19123b3a8eb9SGleb Smirnoff 			struct pf_rule		 r;
19133b3a8eb9SGleb Smirnoff 			struct node_state_opt	*o;
19143b3a8eb9SGleb Smirnoff 			struct node_proto	*proto;
19153b3a8eb9SGleb Smirnoff 			int			 srctrack = 0;
19163b3a8eb9SGleb Smirnoff 			int			 statelock = 0;
19173b3a8eb9SGleb Smirnoff 			int			 adaptive = 0;
19183b3a8eb9SGleb Smirnoff 			int			 defaults = 0;
19193b3a8eb9SGleb Smirnoff 
19203b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_FILTER))
19213b3a8eb9SGleb Smirnoff 				YYERROR;
19223b3a8eb9SGleb Smirnoff 
19233b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
19243b3a8eb9SGleb Smirnoff 
19253b3a8eb9SGleb Smirnoff 			r.action = $1.b1;
19263b3a8eb9SGleb Smirnoff 			switch ($1.b2) {
19273b3a8eb9SGleb Smirnoff 			case PFRULE_RETURNRST:
19283b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RETURNRST;
19293b3a8eb9SGleb Smirnoff 				r.return_ttl = $1.w;
19303b3a8eb9SGleb Smirnoff 				break;
19313b3a8eb9SGleb Smirnoff 			case PFRULE_RETURNICMP:
19323b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RETURNICMP;
19333b3a8eb9SGleb Smirnoff 				r.return_icmp = $1.w;
19343b3a8eb9SGleb Smirnoff 				r.return_icmp6 = $1.w2;
19353b3a8eb9SGleb Smirnoff 				break;
19363b3a8eb9SGleb Smirnoff 			case PFRULE_RETURN:
19373b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RETURN;
19383b3a8eb9SGleb Smirnoff 				r.return_icmp = $1.w;
19393b3a8eb9SGleb Smirnoff 				r.return_icmp6 = $1.w2;
19403b3a8eb9SGleb Smirnoff 				break;
19413b3a8eb9SGleb Smirnoff 			}
19423b3a8eb9SGleb Smirnoff 			r.direction = $2;
19433b3a8eb9SGleb Smirnoff 			r.log = $3.log;
19443b3a8eb9SGleb Smirnoff 			r.logif = $3.logif;
19453b3a8eb9SGleb Smirnoff 			r.quick = $3.quick;
19463b3a8eb9SGleb Smirnoff 			r.prob = $9.prob;
19473b3a8eb9SGleb Smirnoff 			r.rtableid = $9.rtableid;
19483b3a8eb9SGleb Smirnoff 
19493b3a8eb9SGleb Smirnoff 			r.af = $6;
19503b3a8eb9SGleb Smirnoff 			if ($9.tag)
19513b3a8eb9SGleb Smirnoff 				if (strlcpy(r.tagname, $9.tag,
19523b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
19533b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
19543b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
19553b3a8eb9SGleb Smirnoff 					YYERROR;
19563b3a8eb9SGleb Smirnoff 				}
19573b3a8eb9SGleb Smirnoff 			if ($9.match_tag)
19583b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $9.match_tag,
19593b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
19603b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
19613b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
19623b3a8eb9SGleb Smirnoff 					YYERROR;
19633b3a8eb9SGleb Smirnoff 				}
19643b3a8eb9SGleb Smirnoff 			r.match_tag_not = $9.match_tag_not;
19653b3a8eb9SGleb Smirnoff 			if (rule_label(&r, $9.label))
19663b3a8eb9SGleb Smirnoff 				YYERROR;
19673b3a8eb9SGleb Smirnoff 			free($9.label);
19683b3a8eb9SGleb Smirnoff 			r.flags = $9.flags.b1;
19693b3a8eb9SGleb Smirnoff 			r.flagset = $9.flags.b2;
19703b3a8eb9SGleb Smirnoff 			if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
19713b3a8eb9SGleb Smirnoff 				yyerror("flags always false");
19723b3a8eb9SGleb Smirnoff 				YYERROR;
19733b3a8eb9SGleb Smirnoff 			}
19743b3a8eb9SGleb Smirnoff 			if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
19753b3a8eb9SGleb Smirnoff 				for (proto = $7; proto != NULL &&
19763b3a8eb9SGleb Smirnoff 				    proto->proto != IPPROTO_TCP;
19773b3a8eb9SGleb Smirnoff 				    proto = proto->next)
19783b3a8eb9SGleb Smirnoff 					;	/* nothing */
19793b3a8eb9SGleb Smirnoff 				if (proto == NULL && $7 != NULL) {
19803b3a8eb9SGleb Smirnoff 					if ($9.flags.b1 || $9.flags.b2)
19813b3a8eb9SGleb Smirnoff 						yyerror(
19823b3a8eb9SGleb Smirnoff 						    "flags only apply to tcp");
19833b3a8eb9SGleb Smirnoff 					if ($8.src_os)
19843b3a8eb9SGleb Smirnoff 						yyerror(
19853b3a8eb9SGleb Smirnoff 						    "OS fingerprinting only "
19863b3a8eb9SGleb Smirnoff 						    "apply to tcp");
19873b3a8eb9SGleb Smirnoff 					YYERROR;
19883b3a8eb9SGleb Smirnoff 				}
19893b3a8eb9SGleb Smirnoff #if 0
19903b3a8eb9SGleb Smirnoff 				if (($9.flags.b1 & parse_flags("S")) == 0 &&
19913b3a8eb9SGleb Smirnoff 				    $8.src_os) {
19923b3a8eb9SGleb Smirnoff 					yyerror("OS fingerprinting requires "
19933b3a8eb9SGleb Smirnoff 					    "the SYN TCP flag (flags S/SA)");
19943b3a8eb9SGleb Smirnoff 					YYERROR;
19953b3a8eb9SGleb Smirnoff 				}
19963b3a8eb9SGleb Smirnoff #endif
19973b3a8eb9SGleb Smirnoff 			}
19983b3a8eb9SGleb Smirnoff 
19993b3a8eb9SGleb Smirnoff 			r.tos = $9.tos;
20003b3a8eb9SGleb Smirnoff 			r.keep_state = $9.keep.action;
20013b3a8eb9SGleb Smirnoff 			o = $9.keep.options;
20023b3a8eb9SGleb Smirnoff 
20033b3a8eb9SGleb Smirnoff 			/* 'keep state' by default on pass rules. */
20043b3a8eb9SGleb Smirnoff 			if (!r.keep_state && !r.action &&
20053b3a8eb9SGleb Smirnoff 			    !($9.marker & FOM_KEEP)) {
20063b3a8eb9SGleb Smirnoff 				r.keep_state = PF_STATE_NORMAL;
20073b3a8eb9SGleb Smirnoff 				o = keep_state_defaults;
20083b3a8eb9SGleb Smirnoff 				defaults = 1;
20093b3a8eb9SGleb Smirnoff 			}
20103b3a8eb9SGleb Smirnoff 
20113b3a8eb9SGleb Smirnoff 			while (o) {
20123b3a8eb9SGleb Smirnoff 				struct node_state_opt	*p = o;
20133b3a8eb9SGleb Smirnoff 
20143b3a8eb9SGleb Smirnoff 				switch (o->type) {
20153b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX:
20163b3a8eb9SGleb Smirnoff 					if (r.max_states) {
20173b3a8eb9SGleb Smirnoff 						yyerror("state option 'max' "
20183b3a8eb9SGleb Smirnoff 						    "multiple definitions");
20193b3a8eb9SGleb Smirnoff 						YYERROR;
20203b3a8eb9SGleb Smirnoff 					}
20213b3a8eb9SGleb Smirnoff 					r.max_states = o->data.max_states;
20223b3a8eb9SGleb Smirnoff 					break;
20233b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_NOSYNC:
20243b3a8eb9SGleb Smirnoff 					if (r.rule_flag & PFRULE_NOSYNC) {
20253b3a8eb9SGleb Smirnoff 						yyerror("state option 'sync' "
20263b3a8eb9SGleb Smirnoff 						    "multiple definitions");
20273b3a8eb9SGleb Smirnoff 						YYERROR;
20283b3a8eb9SGleb Smirnoff 					}
20293b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_NOSYNC;
20303b3a8eb9SGleb Smirnoff 					break;
20313b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_SRCTRACK:
20323b3a8eb9SGleb Smirnoff 					if (srctrack) {
20333b3a8eb9SGleb Smirnoff 						yyerror("state option "
20343b3a8eb9SGleb Smirnoff 						    "'source-track' "
20353b3a8eb9SGleb Smirnoff 						    "multiple definitions");
20363b3a8eb9SGleb Smirnoff 						YYERROR;
20373b3a8eb9SGleb Smirnoff 					}
20383b3a8eb9SGleb Smirnoff 					srctrack =  o->data.src_track;
20393b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK;
20403b3a8eb9SGleb Smirnoff 					break;
20413b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_STATES:
20423b3a8eb9SGleb Smirnoff 					if (r.max_src_states) {
20433b3a8eb9SGleb Smirnoff 						yyerror("state option "
20443b3a8eb9SGleb Smirnoff 						    "'max-src-states' "
20453b3a8eb9SGleb Smirnoff 						    "multiple definitions");
20463b3a8eb9SGleb Smirnoff 						YYERROR;
20473b3a8eb9SGleb Smirnoff 					}
20483b3a8eb9SGleb Smirnoff 					if (o->data.max_src_states == 0) {
20493b3a8eb9SGleb Smirnoff 						yyerror("'max-src-states' must "
20503b3a8eb9SGleb Smirnoff 						    "be > 0");
20513b3a8eb9SGleb Smirnoff 						YYERROR;
20523b3a8eb9SGleb Smirnoff 					}
20533b3a8eb9SGleb Smirnoff 					r.max_src_states =
20543b3a8eb9SGleb Smirnoff 					    o->data.max_src_states;
20553b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK;
20563b3a8eb9SGleb Smirnoff 					break;
20573b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_OVERLOAD:
20583b3a8eb9SGleb Smirnoff 					if (r.overload_tblname[0]) {
20593b3a8eb9SGleb Smirnoff 						yyerror("multiple 'overload' "
20603b3a8eb9SGleb Smirnoff 						    "table definitions");
20613b3a8eb9SGleb Smirnoff 						YYERROR;
20623b3a8eb9SGleb Smirnoff 					}
20633b3a8eb9SGleb Smirnoff 					if (strlcpy(r.overload_tblname,
20643b3a8eb9SGleb Smirnoff 					    o->data.overload.tblname,
20653b3a8eb9SGleb Smirnoff 					    PF_TABLE_NAME_SIZE) >=
20663b3a8eb9SGleb Smirnoff 					    PF_TABLE_NAME_SIZE) {
20673b3a8eb9SGleb Smirnoff 						yyerror("state option: "
20683b3a8eb9SGleb Smirnoff 						    "strlcpy");
20693b3a8eb9SGleb Smirnoff 						YYERROR;
20703b3a8eb9SGleb Smirnoff 					}
20713b3a8eb9SGleb Smirnoff 					r.flush = o->data.overload.flush;
20723b3a8eb9SGleb Smirnoff 					break;
20733b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_CONN:
20743b3a8eb9SGleb Smirnoff 					if (r.max_src_conn) {
20753b3a8eb9SGleb Smirnoff 						yyerror("state option "
20763b3a8eb9SGleb Smirnoff 						    "'max-src-conn' "
20773b3a8eb9SGleb Smirnoff 						    "multiple definitions");
20783b3a8eb9SGleb Smirnoff 						YYERROR;
20793b3a8eb9SGleb Smirnoff 					}
20803b3a8eb9SGleb Smirnoff 					if (o->data.max_src_conn == 0) {
20813b3a8eb9SGleb Smirnoff 						yyerror("'max-src-conn' "
20823b3a8eb9SGleb Smirnoff 						    "must be > 0");
20833b3a8eb9SGleb Smirnoff 						YYERROR;
20843b3a8eb9SGleb Smirnoff 					}
20853b3a8eb9SGleb Smirnoff 					r.max_src_conn =
20863b3a8eb9SGleb Smirnoff 					    o->data.max_src_conn;
20873b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK |
20883b3a8eb9SGleb Smirnoff 					    PFRULE_RULESRCTRACK;
20893b3a8eb9SGleb Smirnoff 					break;
20903b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_CONN_RATE:
20913b3a8eb9SGleb Smirnoff 					if (r.max_src_conn_rate.limit) {
20923b3a8eb9SGleb Smirnoff 						yyerror("state option "
20933b3a8eb9SGleb Smirnoff 						    "'max-src-conn-rate' "
20943b3a8eb9SGleb Smirnoff 						    "multiple definitions");
20953b3a8eb9SGleb Smirnoff 						YYERROR;
20963b3a8eb9SGleb Smirnoff 					}
20973b3a8eb9SGleb Smirnoff 					if (!o->data.max_src_conn_rate.limit ||
20983b3a8eb9SGleb Smirnoff 					    !o->data.max_src_conn_rate.seconds) {
20993b3a8eb9SGleb Smirnoff 						yyerror("'max-src-conn-rate' "
21003b3a8eb9SGleb Smirnoff 						    "values must be > 0");
21013b3a8eb9SGleb Smirnoff 						YYERROR;
21023b3a8eb9SGleb Smirnoff 					}
21033b3a8eb9SGleb Smirnoff 					if (o->data.max_src_conn_rate.limit >
21043b3a8eb9SGleb Smirnoff 					    PF_THRESHOLD_MAX) {
21053b3a8eb9SGleb Smirnoff 						yyerror("'max-src-conn-rate' "
21063b3a8eb9SGleb Smirnoff 						    "maximum rate must be < %u",
21073b3a8eb9SGleb Smirnoff 						    PF_THRESHOLD_MAX);
21083b3a8eb9SGleb Smirnoff 						YYERROR;
21093b3a8eb9SGleb Smirnoff 					}
21103b3a8eb9SGleb Smirnoff 					r.max_src_conn_rate.limit =
21113b3a8eb9SGleb Smirnoff 					    o->data.max_src_conn_rate.limit;
21123b3a8eb9SGleb Smirnoff 					r.max_src_conn_rate.seconds =
21133b3a8eb9SGleb Smirnoff 					    o->data.max_src_conn_rate.seconds;
21143b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK |
21153b3a8eb9SGleb Smirnoff 					    PFRULE_RULESRCTRACK;
21163b3a8eb9SGleb Smirnoff 					break;
21173b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_NODES:
21183b3a8eb9SGleb Smirnoff 					if (r.max_src_nodes) {
21193b3a8eb9SGleb Smirnoff 						yyerror("state option "
21203b3a8eb9SGleb Smirnoff 						    "'max-src-nodes' "
21213b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21223b3a8eb9SGleb Smirnoff 						YYERROR;
21233b3a8eb9SGleb Smirnoff 					}
21243b3a8eb9SGleb Smirnoff 					if (o->data.max_src_nodes == 0) {
21253b3a8eb9SGleb Smirnoff 						yyerror("'max-src-nodes' must "
21263b3a8eb9SGleb Smirnoff 						    "be > 0");
21273b3a8eb9SGleb Smirnoff 						YYERROR;
21283b3a8eb9SGleb Smirnoff 					}
21293b3a8eb9SGleb Smirnoff 					r.max_src_nodes =
21303b3a8eb9SGleb Smirnoff 					    o->data.max_src_nodes;
21313b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK |
21323b3a8eb9SGleb Smirnoff 					    PFRULE_RULESRCTRACK;
21333b3a8eb9SGleb Smirnoff 					break;
21343b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_STATELOCK:
21353b3a8eb9SGleb Smirnoff 					if (statelock) {
21363b3a8eb9SGleb Smirnoff 						yyerror("state locking option: "
21373b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21383b3a8eb9SGleb Smirnoff 						YYERROR;
21393b3a8eb9SGleb Smirnoff 					}
21403b3a8eb9SGleb Smirnoff 					statelock = 1;
21413b3a8eb9SGleb Smirnoff 					r.rule_flag |= o->data.statelock;
21423b3a8eb9SGleb Smirnoff 					break;
21433b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_SLOPPY:
21443b3a8eb9SGleb Smirnoff 					if (r.rule_flag & PFRULE_STATESLOPPY) {
21453b3a8eb9SGleb Smirnoff 						yyerror("state sloppy option: "
21463b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21473b3a8eb9SGleb Smirnoff 						YYERROR;
21483b3a8eb9SGleb Smirnoff 					}
21493b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_STATESLOPPY;
21503b3a8eb9SGleb Smirnoff 					break;
21513b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_TIMEOUT:
21523b3a8eb9SGleb Smirnoff 					if (o->data.timeout.number ==
21533b3a8eb9SGleb Smirnoff 					    PFTM_ADAPTIVE_START ||
21543b3a8eb9SGleb Smirnoff 					    o->data.timeout.number ==
21553b3a8eb9SGleb Smirnoff 					    PFTM_ADAPTIVE_END)
21563b3a8eb9SGleb Smirnoff 						adaptive = 1;
21573b3a8eb9SGleb Smirnoff 					if (r.timeout[o->data.timeout.number]) {
21583b3a8eb9SGleb Smirnoff 						yyerror("state timeout %s "
21593b3a8eb9SGleb Smirnoff 						    "multiple definitions",
21603b3a8eb9SGleb Smirnoff 						    pf_timeouts[o->data.
21613b3a8eb9SGleb Smirnoff 						    timeout.number].name);
21623b3a8eb9SGleb Smirnoff 						YYERROR;
21633b3a8eb9SGleb Smirnoff 					}
21643b3a8eb9SGleb Smirnoff 					r.timeout[o->data.timeout.number] =
21653b3a8eb9SGleb Smirnoff 					    o->data.timeout.seconds;
21663b3a8eb9SGleb Smirnoff 				}
21673b3a8eb9SGleb Smirnoff 				o = o->next;
21683b3a8eb9SGleb Smirnoff 				if (!defaults)
21693b3a8eb9SGleb Smirnoff 					free(p);
21703b3a8eb9SGleb Smirnoff 			}
21713b3a8eb9SGleb Smirnoff 
21723b3a8eb9SGleb Smirnoff 			/* 'flags S/SA' by default on stateful rules */
21733b3a8eb9SGleb Smirnoff 			if (!r.action && !r.flags && !r.flagset &&
21743b3a8eb9SGleb Smirnoff 			    !$9.fragment && !($9.marker & FOM_FLAGS) &&
21753b3a8eb9SGleb Smirnoff 			    r.keep_state) {
21763b3a8eb9SGleb Smirnoff 				r.flags = parse_flags("S");
21773b3a8eb9SGleb Smirnoff 				r.flagset =  parse_flags("SA");
21783b3a8eb9SGleb Smirnoff 			}
21793b3a8eb9SGleb Smirnoff 			if (!adaptive && r.max_states) {
21803b3a8eb9SGleb Smirnoff 				r.timeout[PFTM_ADAPTIVE_START] =
21813b3a8eb9SGleb Smirnoff 				    (r.max_states / 10) * 6;
21823b3a8eb9SGleb Smirnoff 				r.timeout[PFTM_ADAPTIVE_END] =
21833b3a8eb9SGleb Smirnoff 				    (r.max_states / 10) * 12;
21843b3a8eb9SGleb Smirnoff 			}
21853b3a8eb9SGleb Smirnoff 			if (r.rule_flag & PFRULE_SRCTRACK) {
21863b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_GLOBAL &&
21873b3a8eb9SGleb Smirnoff 				    r.max_src_nodes) {
21883b3a8eb9SGleb Smirnoff 					yyerror("'max-src-nodes' is "
21893b3a8eb9SGleb Smirnoff 					    "incompatible with "
21903b3a8eb9SGleb Smirnoff 					    "'source-track global'");
21913b3a8eb9SGleb Smirnoff 					YYERROR;
21923b3a8eb9SGleb Smirnoff 				}
21933b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_GLOBAL &&
21943b3a8eb9SGleb Smirnoff 				    r.max_src_conn) {
21953b3a8eb9SGleb Smirnoff 					yyerror("'max-src-conn' is "
21963b3a8eb9SGleb Smirnoff 					    "incompatible with "
21973b3a8eb9SGleb Smirnoff 					    "'source-track global'");
21983b3a8eb9SGleb Smirnoff 					YYERROR;
21993b3a8eb9SGleb Smirnoff 				}
22003b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_GLOBAL &&
22013b3a8eb9SGleb Smirnoff 				    r.max_src_conn_rate.seconds) {
22023b3a8eb9SGleb Smirnoff 					yyerror("'max-src-conn-rate' is "
22033b3a8eb9SGleb Smirnoff 					    "incompatible with "
22043b3a8eb9SGleb Smirnoff 					    "'source-track global'");
22053b3a8eb9SGleb Smirnoff 					YYERROR;
22063b3a8eb9SGleb Smirnoff 				}
22073b3a8eb9SGleb Smirnoff 				if (r.timeout[PFTM_SRC_NODE] <
22083b3a8eb9SGleb Smirnoff 				    r.max_src_conn_rate.seconds)
22093b3a8eb9SGleb Smirnoff 					r.timeout[PFTM_SRC_NODE] =
22103b3a8eb9SGleb Smirnoff 					    r.max_src_conn_rate.seconds;
22113b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_SRCTRACK;
22123b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_RULE)
22133b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_RULESRCTRACK;
22143b3a8eb9SGleb Smirnoff 			}
22153b3a8eb9SGleb Smirnoff 			if (r.keep_state && !statelock)
22163b3a8eb9SGleb Smirnoff 				r.rule_flag |= default_statelock;
22173b3a8eb9SGleb Smirnoff 
22183b3a8eb9SGleb Smirnoff 			if ($9.fragment)
22193b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_FRAGMENT;
22203b3a8eb9SGleb Smirnoff 			r.allow_opts = $9.allowopts;
22213b3a8eb9SGleb Smirnoff 
22223b3a8eb9SGleb Smirnoff 			decide_address_family($8.src.host, &r.af);
22233b3a8eb9SGleb Smirnoff 			decide_address_family($8.dst.host, &r.af);
22243b3a8eb9SGleb Smirnoff 
22253b3a8eb9SGleb Smirnoff 			if ($5.rt) {
22263b3a8eb9SGleb Smirnoff 				if (!r.direction) {
22273b3a8eb9SGleb Smirnoff 					yyerror("direction must be explicit "
22283b3a8eb9SGleb Smirnoff 					    "with rules that specify routing");
22293b3a8eb9SGleb Smirnoff 					YYERROR;
22303b3a8eb9SGleb Smirnoff 				}
22313b3a8eb9SGleb Smirnoff 				r.rt = $5.rt;
22323b3a8eb9SGleb Smirnoff 				r.rpool.opts = $5.pool_opts;
22333b3a8eb9SGleb Smirnoff 				if ($5.key != NULL)
22343b3a8eb9SGleb Smirnoff 					memcpy(&r.rpool.key, $5.key,
22353b3a8eb9SGleb Smirnoff 					    sizeof(struct pf_poolhashkey));
22363b3a8eb9SGleb Smirnoff 			}
22373b3a8eb9SGleb Smirnoff 			if (r.rt && r.rt != PF_FASTROUTE) {
22383b3a8eb9SGleb Smirnoff 				decide_address_family($5.host, &r.af);
22393b3a8eb9SGleb Smirnoff 				remove_invalid_hosts(&$5.host, &r.af);
22403b3a8eb9SGleb Smirnoff 				if ($5.host == NULL) {
22413b3a8eb9SGleb Smirnoff 					yyerror("no routing address with "
22423b3a8eb9SGleb Smirnoff 					    "matching address family found.");
22433b3a8eb9SGleb Smirnoff 					YYERROR;
22443b3a8eb9SGleb Smirnoff 				}
22453b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
22463b3a8eb9SGleb Smirnoff 				    PF_POOL_NONE && ($5.host->next != NULL ||
22473b3a8eb9SGleb Smirnoff 				    $5.host->addr.type == PF_ADDR_TABLE ||
22483b3a8eb9SGleb Smirnoff 				    DYNIF_MULTIADDR($5.host->addr)))
22493b3a8eb9SGleb Smirnoff 					r.rpool.opts |= PF_POOL_ROUNDROBIN;
22503b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
22513b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
22523b3a8eb9SGleb Smirnoff 				    disallow_table($5.host, "tables are only "
22533b3a8eb9SGleb Smirnoff 				    "supported in round-robin routing pools"))
22543b3a8eb9SGleb Smirnoff 					YYERROR;
22553b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
22563b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
22573b3a8eb9SGleb Smirnoff 				    disallow_alias($5.host, "interface (%s) "
22583b3a8eb9SGleb Smirnoff 				    "is only supported in round-robin "
22593b3a8eb9SGleb Smirnoff 				    "routing pools"))
22603b3a8eb9SGleb Smirnoff 					YYERROR;
22613b3a8eb9SGleb Smirnoff 				if ($5.host->next != NULL) {
22623b3a8eb9SGleb Smirnoff 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
22633b3a8eb9SGleb Smirnoff 					    PF_POOL_ROUNDROBIN) {
22643b3a8eb9SGleb Smirnoff 						yyerror("r.rpool.opts must "
22653b3a8eb9SGleb Smirnoff 						    "be PF_POOL_ROUNDROBIN");
22663b3a8eb9SGleb Smirnoff 						YYERROR;
22673b3a8eb9SGleb Smirnoff 					}
22683b3a8eb9SGleb Smirnoff 				}
22693b3a8eb9SGleb Smirnoff 			}
22703b3a8eb9SGleb Smirnoff 			if ($9.queues.qname != NULL) {
22713b3a8eb9SGleb Smirnoff 				if (strlcpy(r.qname, $9.queues.qname,
22723b3a8eb9SGleb Smirnoff 				    sizeof(r.qname)) >= sizeof(r.qname)) {
22733b3a8eb9SGleb Smirnoff 					yyerror("rule qname too long (max "
22743b3a8eb9SGleb Smirnoff 					    "%d chars)", sizeof(r.qname)-1);
22753b3a8eb9SGleb Smirnoff 					YYERROR;
22763b3a8eb9SGleb Smirnoff 				}
22773b3a8eb9SGleb Smirnoff 				free($9.queues.qname);
22783b3a8eb9SGleb Smirnoff 			}
22793b3a8eb9SGleb Smirnoff 			if ($9.queues.pqname != NULL) {
22803b3a8eb9SGleb Smirnoff 				if (strlcpy(r.pqname, $9.queues.pqname,
22813b3a8eb9SGleb Smirnoff 				    sizeof(r.pqname)) >= sizeof(r.pqname)) {
22823b3a8eb9SGleb Smirnoff 					yyerror("rule pqname too long (max "
22833b3a8eb9SGleb Smirnoff 					    "%d chars)", sizeof(r.pqname)-1);
22843b3a8eb9SGleb Smirnoff 					YYERROR;
22853b3a8eb9SGleb Smirnoff 				}
22863b3a8eb9SGleb Smirnoff 				free($9.queues.pqname);
22873b3a8eb9SGleb Smirnoff 			}
22883b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
22893b3a8eb9SGleb Smirnoff 			r.divert.port = $9.divert.port;
22903b3a8eb9SGleb Smirnoff #else
22913b3a8eb9SGleb Smirnoff 			if ((r.divert.port = $9.divert.port)) {
22923b3a8eb9SGleb Smirnoff 				if (r.direction == PF_OUT) {
22933b3a8eb9SGleb Smirnoff 					if ($9.divert.addr) {
22943b3a8eb9SGleb Smirnoff 						yyerror("address specified "
22953b3a8eb9SGleb Smirnoff 						    "for outgoing divert");
22963b3a8eb9SGleb Smirnoff 						YYERROR;
22973b3a8eb9SGleb Smirnoff 					}
22983b3a8eb9SGleb Smirnoff 					bzero(&r.divert.addr,
22993b3a8eb9SGleb Smirnoff 					    sizeof(r.divert.addr));
23003b3a8eb9SGleb Smirnoff 				} else {
23013b3a8eb9SGleb Smirnoff 					if (!$9.divert.addr) {
23023b3a8eb9SGleb Smirnoff 						yyerror("no address specified "
23033b3a8eb9SGleb Smirnoff 						    "for incoming divert");
23043b3a8eb9SGleb Smirnoff 						YYERROR;
23053b3a8eb9SGleb Smirnoff 					}
23063b3a8eb9SGleb Smirnoff 					if ($9.divert.addr->af != r.af) {
23073b3a8eb9SGleb Smirnoff 						yyerror("address family "
23083b3a8eb9SGleb Smirnoff 						    "mismatch for divert");
23093b3a8eb9SGleb Smirnoff 						YYERROR;
23103b3a8eb9SGleb Smirnoff 					}
23113b3a8eb9SGleb Smirnoff 					r.divert.addr =
23123b3a8eb9SGleb Smirnoff 					    $9.divert.addr->addr.v.a.addr;
23133b3a8eb9SGleb Smirnoff 				}
23143b3a8eb9SGleb Smirnoff 			}
23153b3a8eb9SGleb Smirnoff #endif
23163b3a8eb9SGleb Smirnoff 
23173b3a8eb9SGleb Smirnoff 			expand_rule(&r, $4, $5.host, $7, $8.src_os,
23183b3a8eb9SGleb Smirnoff 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
23193b3a8eb9SGleb Smirnoff 			    $9.uid, $9.gid, $9.icmpspec, "");
23203b3a8eb9SGleb Smirnoff 		}
23213b3a8eb9SGleb Smirnoff 		;
23223b3a8eb9SGleb Smirnoff 
23233b3a8eb9SGleb Smirnoff filter_opts	:	{
23243b3a8eb9SGleb Smirnoff 				bzero(&filter_opts, sizeof filter_opts);
23253b3a8eb9SGleb Smirnoff 				filter_opts.rtableid = -1;
23263b3a8eb9SGleb Smirnoff 			}
23273b3a8eb9SGleb Smirnoff 		    filter_opts_l
23283b3a8eb9SGleb Smirnoff 			{ $$ = filter_opts; }
23293b3a8eb9SGleb Smirnoff 		| /* empty */	{
23303b3a8eb9SGleb Smirnoff 			bzero(&filter_opts, sizeof filter_opts);
23313b3a8eb9SGleb Smirnoff 			filter_opts.rtableid = -1;
23323b3a8eb9SGleb Smirnoff 			$$ = filter_opts;
23333b3a8eb9SGleb Smirnoff 		}
23343b3a8eb9SGleb Smirnoff 		;
23353b3a8eb9SGleb Smirnoff 
23363b3a8eb9SGleb Smirnoff filter_opts_l	: filter_opts_l filter_opt
23373b3a8eb9SGleb Smirnoff 		| filter_opt
23383b3a8eb9SGleb Smirnoff 		;
23393b3a8eb9SGleb Smirnoff 
23403b3a8eb9SGleb Smirnoff filter_opt	: USER uids {
23413b3a8eb9SGleb Smirnoff 			if (filter_opts.uid)
23423b3a8eb9SGleb Smirnoff 				$2->tail->next = filter_opts.uid;
23433b3a8eb9SGleb Smirnoff 			filter_opts.uid = $2;
23443b3a8eb9SGleb Smirnoff 		}
23453b3a8eb9SGleb Smirnoff 		| GROUP gids {
23463b3a8eb9SGleb Smirnoff 			if (filter_opts.gid)
23473b3a8eb9SGleb Smirnoff 				$2->tail->next = filter_opts.gid;
23483b3a8eb9SGleb Smirnoff 			filter_opts.gid = $2;
23493b3a8eb9SGleb Smirnoff 		}
23503b3a8eb9SGleb Smirnoff 		| flags {
23513b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_FLAGS) {
23523b3a8eb9SGleb Smirnoff 				yyerror("flags cannot be redefined");
23533b3a8eb9SGleb Smirnoff 				YYERROR;
23543b3a8eb9SGleb Smirnoff 			}
23553b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_FLAGS;
23563b3a8eb9SGleb Smirnoff 			filter_opts.flags.b1 |= $1.b1;
23573b3a8eb9SGleb Smirnoff 			filter_opts.flags.b2 |= $1.b2;
23583b3a8eb9SGleb Smirnoff 			filter_opts.flags.w |= $1.w;
23593b3a8eb9SGleb Smirnoff 			filter_opts.flags.w2 |= $1.w2;
23603b3a8eb9SGleb Smirnoff 		}
23613b3a8eb9SGleb Smirnoff 		| icmpspec {
23623b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_ICMP) {
23633b3a8eb9SGleb Smirnoff 				yyerror("icmp-type cannot be redefined");
23643b3a8eb9SGleb Smirnoff 				YYERROR;
23653b3a8eb9SGleb Smirnoff 			}
23663b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_ICMP;
23673b3a8eb9SGleb Smirnoff 			filter_opts.icmpspec = $1;
23683b3a8eb9SGleb Smirnoff 		}
23693b3a8eb9SGleb Smirnoff 		| TOS tos {
23703b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_TOS) {
23713b3a8eb9SGleb Smirnoff 				yyerror("tos cannot be redefined");
23723b3a8eb9SGleb Smirnoff 				YYERROR;
23733b3a8eb9SGleb Smirnoff 			}
23743b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_TOS;
23753b3a8eb9SGleb Smirnoff 			filter_opts.tos = $2;
23763b3a8eb9SGleb Smirnoff 		}
23773b3a8eb9SGleb Smirnoff 		| keep {
23783b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_KEEP) {
23793b3a8eb9SGleb Smirnoff 				yyerror("modulate or keep cannot be redefined");
23803b3a8eb9SGleb Smirnoff 				YYERROR;
23813b3a8eb9SGleb Smirnoff 			}
23823b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_KEEP;
23833b3a8eb9SGleb Smirnoff 			filter_opts.keep.action = $1.action;
23843b3a8eb9SGleb Smirnoff 			filter_opts.keep.options = $1.options;
23853b3a8eb9SGleb Smirnoff 		}
23863b3a8eb9SGleb Smirnoff 		| FRAGMENT {
23873b3a8eb9SGleb Smirnoff 			filter_opts.fragment = 1;
23883b3a8eb9SGleb Smirnoff 		}
23893b3a8eb9SGleb Smirnoff 		| ALLOWOPTS {
23903b3a8eb9SGleb Smirnoff 			filter_opts.allowopts = 1;
23913b3a8eb9SGleb Smirnoff 		}
23923b3a8eb9SGleb Smirnoff 		| label	{
23933b3a8eb9SGleb Smirnoff 			if (filter_opts.label) {
23943b3a8eb9SGleb Smirnoff 				yyerror("label cannot be redefined");
23953b3a8eb9SGleb Smirnoff 				YYERROR;
23963b3a8eb9SGleb Smirnoff 			}
23973b3a8eb9SGleb Smirnoff 			filter_opts.label = $1;
23983b3a8eb9SGleb Smirnoff 		}
23993b3a8eb9SGleb Smirnoff 		| qname	{
24003b3a8eb9SGleb Smirnoff 			if (filter_opts.queues.qname) {
24013b3a8eb9SGleb Smirnoff 				yyerror("queue cannot be redefined");
24023b3a8eb9SGleb Smirnoff 				YYERROR;
24033b3a8eb9SGleb Smirnoff 			}
24043b3a8eb9SGleb Smirnoff 			filter_opts.queues = $1;
24053b3a8eb9SGleb Smirnoff 		}
24063b3a8eb9SGleb Smirnoff 		| TAG string				{
24073b3a8eb9SGleb Smirnoff 			filter_opts.tag = $2;
24083b3a8eb9SGleb Smirnoff 		}
24093b3a8eb9SGleb Smirnoff 		| not TAGGED string			{
24103b3a8eb9SGleb Smirnoff 			filter_opts.match_tag = $3;
24113b3a8eb9SGleb Smirnoff 			filter_opts.match_tag_not = $1;
24123b3a8eb9SGleb Smirnoff 		}
24133b3a8eb9SGleb Smirnoff 		| PROBABILITY probability		{
24143b3a8eb9SGleb Smirnoff 			double	p;
24153b3a8eb9SGleb Smirnoff 
24163b3a8eb9SGleb Smirnoff 			p = floor($2 * UINT_MAX + 0.5);
24173b3a8eb9SGleb Smirnoff 			if (p < 0.0 || p > UINT_MAX) {
24183b3a8eb9SGleb Smirnoff 				yyerror("invalid probability: %lf", p);
24193b3a8eb9SGleb Smirnoff 				YYERROR;
24203b3a8eb9SGleb Smirnoff 			}
24213b3a8eb9SGleb Smirnoff 			filter_opts.prob = (u_int32_t)p;
24223b3a8eb9SGleb Smirnoff 			if (filter_opts.prob == 0)
24233b3a8eb9SGleb Smirnoff 				filter_opts.prob = 1;
24243b3a8eb9SGleb Smirnoff 		}
24253b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER				{
24263b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
24273b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
24283b3a8eb9SGleb Smirnoff 				YYERROR;
24293b3a8eb9SGleb Smirnoff 			}
24303b3a8eb9SGleb Smirnoff 			filter_opts.rtableid = $2;
24313b3a8eb9SGleb Smirnoff 		}
24323b3a8eb9SGleb Smirnoff 		| DIVERTTO portplain {
24333b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
24343b3a8eb9SGleb Smirnoff 			filter_opts.divert.port = $2.a;
24353b3a8eb9SGleb Smirnoff 			if (!filter_opts.divert.port) {
24363b3a8eb9SGleb Smirnoff 				yyerror("invalid divert port: %u", ntohs($2.a));
24373b3a8eb9SGleb Smirnoff 				YYERROR;
24383b3a8eb9SGleb Smirnoff 			}
24393b3a8eb9SGleb Smirnoff #endif
24403b3a8eb9SGleb Smirnoff 		}
24413b3a8eb9SGleb Smirnoff 		| DIVERTTO STRING PORT portplain {
24423b3a8eb9SGleb Smirnoff #ifndef __FreeBSD__
24433b3a8eb9SGleb Smirnoff 			if ((filter_opts.divert.addr = host($2)) == NULL) {
24443b3a8eb9SGleb Smirnoff 				yyerror("could not parse divert address: %s",
24453b3a8eb9SGleb Smirnoff 				    $2);
24463b3a8eb9SGleb Smirnoff 				free($2);
24473b3a8eb9SGleb Smirnoff 				YYERROR;
24483b3a8eb9SGleb Smirnoff 			}
24493b3a8eb9SGleb Smirnoff #else
24503b3a8eb9SGleb Smirnoff 			if ($2)
24513b3a8eb9SGleb Smirnoff #endif
24523b3a8eb9SGleb Smirnoff 			free($2);
24533b3a8eb9SGleb Smirnoff 			filter_opts.divert.port = $4.a;
24543b3a8eb9SGleb Smirnoff 			if (!filter_opts.divert.port) {
24553b3a8eb9SGleb Smirnoff 				yyerror("invalid divert port: %u", ntohs($4.a));
24563b3a8eb9SGleb Smirnoff 				YYERROR;
24573b3a8eb9SGleb Smirnoff 			}
24583b3a8eb9SGleb Smirnoff 		}
24593b3a8eb9SGleb Smirnoff 		| DIVERTREPLY {
24603b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
24613b3a8eb9SGleb Smirnoff 			yyerror("divert-reply has no meaning in FreeBSD pf(4)");
24623b3a8eb9SGleb Smirnoff 			YYERROR;
24633b3a8eb9SGleb Smirnoff #else
24643b3a8eb9SGleb Smirnoff 			filter_opts.divert.port = 1;	/* some random value */
24653b3a8eb9SGleb Smirnoff #endif
24663b3a8eb9SGleb Smirnoff 		}
24673b3a8eb9SGleb Smirnoff 		;
24683b3a8eb9SGleb Smirnoff 
24693b3a8eb9SGleb Smirnoff probability	: STRING				{
24703b3a8eb9SGleb Smirnoff 			char	*e;
24713b3a8eb9SGleb Smirnoff 			double	 p = strtod($1, &e);
24723b3a8eb9SGleb Smirnoff 
24733b3a8eb9SGleb Smirnoff 			if (*e == '%') {
24743b3a8eb9SGleb Smirnoff 				p *= 0.01;
24753b3a8eb9SGleb Smirnoff 				e++;
24763b3a8eb9SGleb Smirnoff 			}
24773b3a8eb9SGleb Smirnoff 			if (*e) {
24783b3a8eb9SGleb Smirnoff 				yyerror("invalid probability: %s", $1);
24793b3a8eb9SGleb Smirnoff 				free($1);
24803b3a8eb9SGleb Smirnoff 				YYERROR;
24813b3a8eb9SGleb Smirnoff 			}
24823b3a8eb9SGleb Smirnoff 			free($1);
24833b3a8eb9SGleb Smirnoff 			$$ = p;
24843b3a8eb9SGleb Smirnoff 		}
24853b3a8eb9SGleb Smirnoff 		| NUMBER				{
24863b3a8eb9SGleb Smirnoff 			$$ = (double)$1;
24873b3a8eb9SGleb Smirnoff 		}
24883b3a8eb9SGleb Smirnoff 		;
24893b3a8eb9SGleb Smirnoff 
24903b3a8eb9SGleb Smirnoff 
24913b3a8eb9SGleb Smirnoff action		: PASS			{ $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
24923b3a8eb9SGleb Smirnoff 		| BLOCK blockspec	{ $$ = $2; $$.b1 = PF_DROP; }
24933b3a8eb9SGleb Smirnoff 		;
24943b3a8eb9SGleb Smirnoff 
24953b3a8eb9SGleb Smirnoff blockspec	: /* empty */		{
24963b3a8eb9SGleb Smirnoff 			$$.b2 = blockpolicy;
24973b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
24983b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
24993b3a8eb9SGleb Smirnoff 		}
25003b3a8eb9SGleb Smirnoff 		| DROP			{
25013b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_DROP;
25023b3a8eb9SGleb Smirnoff 			$$.w = 0;
25033b3a8eb9SGleb Smirnoff 			$$.w2 = 0;
25043b3a8eb9SGleb Smirnoff 		}
25053b3a8eb9SGleb Smirnoff 		| RETURNRST		{
25063b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNRST;
25073b3a8eb9SGleb Smirnoff 			$$.w = 0;
25083b3a8eb9SGleb Smirnoff 			$$.w2 = 0;
25093b3a8eb9SGleb Smirnoff 		}
25103b3a8eb9SGleb Smirnoff 		| RETURNRST '(' TTL NUMBER ')'	{
25113b3a8eb9SGleb Smirnoff 			if ($4 < 0 || $4 > 255) {
25123b3a8eb9SGleb Smirnoff 				yyerror("illegal ttl value %d", $4);
25133b3a8eb9SGleb Smirnoff 				YYERROR;
25143b3a8eb9SGleb Smirnoff 			}
25153b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNRST;
25163b3a8eb9SGleb Smirnoff 			$$.w = $4;
25173b3a8eb9SGleb Smirnoff 			$$.w2 = 0;
25183b3a8eb9SGleb Smirnoff 		}
25193b3a8eb9SGleb Smirnoff 		| RETURNICMP		{
25203b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
25213b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
25223b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
25233b3a8eb9SGleb Smirnoff 		}
25243b3a8eb9SGleb Smirnoff 		| RETURNICMP6		{
25253b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
25263b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
25273b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
25283b3a8eb9SGleb Smirnoff 		}
25293b3a8eb9SGleb Smirnoff 		| RETURNICMP '(' reticmpspec ')'	{
25303b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
25313b3a8eb9SGleb Smirnoff 			$$.w = $3;
25323b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmpdefault;
25333b3a8eb9SGleb Smirnoff 		}
25343b3a8eb9SGleb Smirnoff 		| RETURNICMP6 '(' reticmp6spec ')'	{
25353b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
25363b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
25373b3a8eb9SGleb Smirnoff 			$$.w2 = $3;
25383b3a8eb9SGleb Smirnoff 		}
25393b3a8eb9SGleb Smirnoff 		| RETURNICMP '(' reticmpspec comma reticmp6spec ')' {
25403b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
25413b3a8eb9SGleb Smirnoff 			$$.w = $3;
25423b3a8eb9SGleb Smirnoff 			$$.w2 = $5;
25433b3a8eb9SGleb Smirnoff 		}
25443b3a8eb9SGleb Smirnoff 		| RETURN {
25453b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURN;
25463b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
25473b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
25483b3a8eb9SGleb Smirnoff 		}
25493b3a8eb9SGleb Smirnoff 		;
25503b3a8eb9SGleb Smirnoff 
25513b3a8eb9SGleb Smirnoff reticmpspec	: STRING			{
25523b3a8eb9SGleb Smirnoff 			if (!($$ = parseicmpspec($1, AF_INET))) {
25533b3a8eb9SGleb Smirnoff 				free($1);
25543b3a8eb9SGleb Smirnoff 				YYERROR;
25553b3a8eb9SGleb Smirnoff 			}
25563b3a8eb9SGleb Smirnoff 			free($1);
25573b3a8eb9SGleb Smirnoff 		}
25583b3a8eb9SGleb Smirnoff 		| NUMBER			{
25593b3a8eb9SGleb Smirnoff 			u_int8_t		icmptype;
25603b3a8eb9SGleb Smirnoff 
25613b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
25623b3a8eb9SGleb Smirnoff 				yyerror("invalid icmp code %lu", $1);
25633b3a8eb9SGleb Smirnoff 				YYERROR;
25643b3a8eb9SGleb Smirnoff 			}
25653b3a8eb9SGleb Smirnoff 			icmptype = returnicmpdefault >> 8;
25663b3a8eb9SGleb Smirnoff 			$$ = (icmptype << 8 | $1);
25673b3a8eb9SGleb Smirnoff 		}
25683b3a8eb9SGleb Smirnoff 		;
25693b3a8eb9SGleb Smirnoff 
25703b3a8eb9SGleb Smirnoff reticmp6spec	: STRING			{
25713b3a8eb9SGleb Smirnoff 			if (!($$ = parseicmpspec($1, AF_INET6))) {
25723b3a8eb9SGleb Smirnoff 				free($1);
25733b3a8eb9SGleb Smirnoff 				YYERROR;
25743b3a8eb9SGleb Smirnoff 			}
25753b3a8eb9SGleb Smirnoff 			free($1);
25763b3a8eb9SGleb Smirnoff 		}
25773b3a8eb9SGleb Smirnoff 		| NUMBER			{
25783b3a8eb9SGleb Smirnoff 			u_int8_t		icmptype;
25793b3a8eb9SGleb Smirnoff 
25803b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
25813b3a8eb9SGleb Smirnoff 				yyerror("invalid icmp code %lu", $1);
25823b3a8eb9SGleb Smirnoff 				YYERROR;
25833b3a8eb9SGleb Smirnoff 			}
25843b3a8eb9SGleb Smirnoff 			icmptype = returnicmp6default >> 8;
25853b3a8eb9SGleb Smirnoff 			$$ = (icmptype << 8 | $1);
25863b3a8eb9SGleb Smirnoff 		}
25873b3a8eb9SGleb Smirnoff 		;
25883b3a8eb9SGleb Smirnoff 
25893b3a8eb9SGleb Smirnoff dir		: /* empty */			{ $$ = PF_INOUT; }
25903b3a8eb9SGleb Smirnoff 		| IN				{ $$ = PF_IN; }
25913b3a8eb9SGleb Smirnoff 		| OUT				{ $$ = PF_OUT; }
25923b3a8eb9SGleb Smirnoff 		;
25933b3a8eb9SGleb Smirnoff 
25943b3a8eb9SGleb Smirnoff quick		: /* empty */			{ $$.quick = 0; }
25953b3a8eb9SGleb Smirnoff 		| QUICK				{ $$.quick = 1; }
25963b3a8eb9SGleb Smirnoff 		;
25973b3a8eb9SGleb Smirnoff 
25983b3a8eb9SGleb Smirnoff logquick	: /* empty */	{ $$.log = 0; $$.quick = 0; $$.logif = 0; }
25993b3a8eb9SGleb Smirnoff 		| log		{ $$ = $1; $$.quick = 0; }
26003b3a8eb9SGleb Smirnoff 		| QUICK		{ $$.quick = 1; $$.log = 0; $$.logif = 0; }
26013b3a8eb9SGleb Smirnoff 		| log QUICK	{ $$ = $1; $$.quick = 1; }
26023b3a8eb9SGleb Smirnoff 		| QUICK log	{ $$ = $2; $$.quick = 1; }
26033b3a8eb9SGleb Smirnoff 		;
26043b3a8eb9SGleb Smirnoff 
26053b3a8eb9SGleb Smirnoff log		: LOG			{ $$.log = PF_LOG; $$.logif = 0; }
26063b3a8eb9SGleb Smirnoff 		| LOG '(' logopts ')'	{
26073b3a8eb9SGleb Smirnoff 			$$.log = PF_LOG | $3.log;
26083b3a8eb9SGleb Smirnoff 			$$.logif = $3.logif;
26093b3a8eb9SGleb Smirnoff 		}
26103b3a8eb9SGleb Smirnoff 		;
26113b3a8eb9SGleb Smirnoff 
26123b3a8eb9SGleb Smirnoff logopts		: logopt			{ $$ = $1; }
26133b3a8eb9SGleb Smirnoff 		| logopts comma logopt		{
26143b3a8eb9SGleb Smirnoff 			$$.log = $1.log | $3.log;
26153b3a8eb9SGleb Smirnoff 			$$.logif = $3.logif;
26163b3a8eb9SGleb Smirnoff 			if ($$.logif == 0)
26173b3a8eb9SGleb Smirnoff 				$$.logif = $1.logif;
26183b3a8eb9SGleb Smirnoff 		}
26193b3a8eb9SGleb Smirnoff 		;
26203b3a8eb9SGleb Smirnoff 
26213b3a8eb9SGleb Smirnoff logopt		: ALL		{ $$.log = PF_LOG_ALL; $$.logif = 0; }
26223b3a8eb9SGleb Smirnoff 		| USER		{ $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
26233b3a8eb9SGleb Smirnoff 		| GROUP		{ $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
26243b3a8eb9SGleb Smirnoff 		| TO string	{
26253b3a8eb9SGleb Smirnoff 			const char	*errstr;
26263b3a8eb9SGleb Smirnoff 			u_int		 i;
26273b3a8eb9SGleb Smirnoff 
26283b3a8eb9SGleb Smirnoff 			$$.log = 0;
26293b3a8eb9SGleb Smirnoff 			if (strncmp($2, "pflog", 5)) {
26303b3a8eb9SGleb Smirnoff 				yyerror("%s: should be a pflog interface", $2);
26313b3a8eb9SGleb Smirnoff 				free($2);
26323b3a8eb9SGleb Smirnoff 				YYERROR;
26333b3a8eb9SGleb Smirnoff 			}
26343b3a8eb9SGleb Smirnoff 			i = strtonum($2 + 5, 0, 255, &errstr);
26353b3a8eb9SGleb Smirnoff 			if (errstr) {
26363b3a8eb9SGleb Smirnoff 				yyerror("%s: %s", $2, errstr);
26373b3a8eb9SGleb Smirnoff 				free($2);
26383b3a8eb9SGleb Smirnoff 				YYERROR;
26393b3a8eb9SGleb Smirnoff 			}
26403b3a8eb9SGleb Smirnoff 			free($2);
26413b3a8eb9SGleb Smirnoff 			$$.logif = i;
26423b3a8eb9SGleb Smirnoff 		}
26433b3a8eb9SGleb Smirnoff 		;
26443b3a8eb9SGleb Smirnoff 
26453b3a8eb9SGleb Smirnoff interface	: /* empty */			{ $$ = NULL; }
26463b3a8eb9SGleb Smirnoff 		| ON if_item_not		{ $$ = $2; }
26473b3a8eb9SGleb Smirnoff 		| ON '{' optnl if_list '}'	{ $$ = $4; }
26483b3a8eb9SGleb Smirnoff 		;
26493b3a8eb9SGleb Smirnoff 
26503b3a8eb9SGleb Smirnoff if_list		: if_item_not optnl		{ $$ = $1; }
26513b3a8eb9SGleb Smirnoff 		| if_list comma if_item_not optnl	{
26523b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
26533b3a8eb9SGleb Smirnoff 			$1->tail = $3;
26543b3a8eb9SGleb Smirnoff 			$$ = $1;
26553b3a8eb9SGleb Smirnoff 		}
26563b3a8eb9SGleb Smirnoff 		;
26573b3a8eb9SGleb Smirnoff 
26583b3a8eb9SGleb Smirnoff if_item_not	: not if_item			{ $$ = $2; $$->not = $1; }
26593b3a8eb9SGleb Smirnoff 		;
26603b3a8eb9SGleb Smirnoff 
26613b3a8eb9SGleb Smirnoff if_item		: STRING			{
26623b3a8eb9SGleb Smirnoff 			struct node_host	*n;
26633b3a8eb9SGleb Smirnoff 
26643b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_if));
26653b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
26663b3a8eb9SGleb Smirnoff 				err(1, "if_item: calloc");
26673b3a8eb9SGleb Smirnoff 			if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
26683b3a8eb9SGleb Smirnoff 			    sizeof($$->ifname)) {
26693b3a8eb9SGleb Smirnoff 				free($1);
26703b3a8eb9SGleb Smirnoff 				free($$);
26713b3a8eb9SGleb Smirnoff 				yyerror("interface name too long");
26723b3a8eb9SGleb Smirnoff 				YYERROR;
26733b3a8eb9SGleb Smirnoff 			}
26743b3a8eb9SGleb Smirnoff 
26753b3a8eb9SGleb Smirnoff 			if ((n = ifa_exists($1)) != NULL)
26763b3a8eb9SGleb Smirnoff 				$$->ifa_flags = n->ifa_flags;
26773b3a8eb9SGleb Smirnoff 
26783b3a8eb9SGleb Smirnoff 			free($1);
26793b3a8eb9SGleb Smirnoff 			$$->not = 0;
26803b3a8eb9SGleb Smirnoff 			$$->next = NULL;
26813b3a8eb9SGleb Smirnoff 			$$->tail = $$;
26823b3a8eb9SGleb Smirnoff 		}
26833b3a8eb9SGleb Smirnoff 		;
26843b3a8eb9SGleb Smirnoff 
26853b3a8eb9SGleb Smirnoff af		: /* empty */			{ $$ = 0; }
26863b3a8eb9SGleb Smirnoff 		| INET				{ $$ = AF_INET; }
26873b3a8eb9SGleb Smirnoff 		| INET6				{ $$ = AF_INET6; }
26883b3a8eb9SGleb Smirnoff 		;
26893b3a8eb9SGleb Smirnoff 
26903b3a8eb9SGleb Smirnoff proto		: /* empty */				{ $$ = NULL; }
26913b3a8eb9SGleb Smirnoff 		| PROTO proto_item			{ $$ = $2; }
26923b3a8eb9SGleb Smirnoff 		| PROTO '{' optnl proto_list '}'	{ $$ = $4; }
26933b3a8eb9SGleb Smirnoff 		;
26943b3a8eb9SGleb Smirnoff 
26953b3a8eb9SGleb Smirnoff proto_list	: proto_item optnl		{ $$ = $1; }
26963b3a8eb9SGleb Smirnoff 		| proto_list comma proto_item optnl	{
26973b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
26983b3a8eb9SGleb Smirnoff 			$1->tail = $3;
26993b3a8eb9SGleb Smirnoff 			$$ = $1;
27003b3a8eb9SGleb Smirnoff 		}
27013b3a8eb9SGleb Smirnoff 		;
27023b3a8eb9SGleb Smirnoff 
27033b3a8eb9SGleb Smirnoff proto_item	: protoval			{
27043b3a8eb9SGleb Smirnoff 			u_int8_t	pr;
27053b3a8eb9SGleb Smirnoff 
27063b3a8eb9SGleb Smirnoff 			pr = (u_int8_t)$1;
27073b3a8eb9SGleb Smirnoff 			if (pr == 0) {
27083b3a8eb9SGleb Smirnoff 				yyerror("proto 0 cannot be used");
27093b3a8eb9SGleb Smirnoff 				YYERROR;
27103b3a8eb9SGleb Smirnoff 			}
27113b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_proto));
27123b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
27133b3a8eb9SGleb Smirnoff 				err(1, "proto_item: calloc");
27143b3a8eb9SGleb Smirnoff 			$$->proto = pr;
27153b3a8eb9SGleb Smirnoff 			$$->next = NULL;
27163b3a8eb9SGleb Smirnoff 			$$->tail = $$;
27173b3a8eb9SGleb Smirnoff 		}
27183b3a8eb9SGleb Smirnoff 		;
27193b3a8eb9SGleb Smirnoff 
27203b3a8eb9SGleb Smirnoff protoval	: STRING			{
27213b3a8eb9SGleb Smirnoff 			struct protoent	*p;
27223b3a8eb9SGleb Smirnoff 
27233b3a8eb9SGleb Smirnoff 			p = getprotobyname($1);
27243b3a8eb9SGleb Smirnoff 			if (p == NULL) {
27253b3a8eb9SGleb Smirnoff 				yyerror("unknown protocol %s", $1);
27263b3a8eb9SGleb Smirnoff 				free($1);
27273b3a8eb9SGleb Smirnoff 				YYERROR;
27283b3a8eb9SGleb Smirnoff 			}
27293b3a8eb9SGleb Smirnoff 			$$ = p->p_proto;
27303b3a8eb9SGleb Smirnoff 			free($1);
27313b3a8eb9SGleb Smirnoff 		}
27323b3a8eb9SGleb Smirnoff 		| NUMBER			{
27333b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
27343b3a8eb9SGleb Smirnoff 				yyerror("protocol outside range");
27353b3a8eb9SGleb Smirnoff 				YYERROR;
27363b3a8eb9SGleb Smirnoff 			}
27373b3a8eb9SGleb Smirnoff 		}
27383b3a8eb9SGleb Smirnoff 		;
27393b3a8eb9SGleb Smirnoff 
27403b3a8eb9SGleb Smirnoff fromto		: ALL				{
27413b3a8eb9SGleb Smirnoff 			$$.src.host = NULL;
27423b3a8eb9SGleb Smirnoff 			$$.src.port = NULL;
27433b3a8eb9SGleb Smirnoff 			$$.dst.host = NULL;
27443b3a8eb9SGleb Smirnoff 			$$.dst.port = NULL;
27453b3a8eb9SGleb Smirnoff 			$$.src_os = NULL;
27463b3a8eb9SGleb Smirnoff 		}
27473b3a8eb9SGleb Smirnoff 		| from os to			{
27483b3a8eb9SGleb Smirnoff 			$$.src = $1;
27493b3a8eb9SGleb Smirnoff 			$$.src_os = $2;
27503b3a8eb9SGleb Smirnoff 			$$.dst = $3;
27513b3a8eb9SGleb Smirnoff 		}
27523b3a8eb9SGleb Smirnoff 		;
27533b3a8eb9SGleb Smirnoff 
27543b3a8eb9SGleb Smirnoff os		: /* empty */			{ $$ = NULL; }
27553b3a8eb9SGleb Smirnoff 		| OS xos			{ $$ = $2; }
27563b3a8eb9SGleb Smirnoff 		| OS '{' optnl os_list '}'	{ $$ = $4; }
27573b3a8eb9SGleb Smirnoff 		;
27583b3a8eb9SGleb Smirnoff 
27593b3a8eb9SGleb Smirnoff xos		: STRING {
27603b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_os));
27613b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
27623b3a8eb9SGleb Smirnoff 				err(1, "os: calloc");
27633b3a8eb9SGleb Smirnoff 			$$->os = $1;
27643b3a8eb9SGleb Smirnoff 			$$->tail = $$;
27653b3a8eb9SGleb Smirnoff 		}
27663b3a8eb9SGleb Smirnoff 		;
27673b3a8eb9SGleb Smirnoff 
27683b3a8eb9SGleb Smirnoff os_list		: xos optnl 			{ $$ = $1; }
27693b3a8eb9SGleb Smirnoff 		| os_list comma xos optnl	{
27703b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
27713b3a8eb9SGleb Smirnoff 			$1->tail = $3;
27723b3a8eb9SGleb Smirnoff 			$$ = $1;
27733b3a8eb9SGleb Smirnoff 		}
27743b3a8eb9SGleb Smirnoff 		;
27753b3a8eb9SGleb Smirnoff 
27763b3a8eb9SGleb Smirnoff from		: /* empty */			{
27773b3a8eb9SGleb Smirnoff 			$$.host = NULL;
27783b3a8eb9SGleb Smirnoff 			$$.port = NULL;
27793b3a8eb9SGleb Smirnoff 		}
27803b3a8eb9SGleb Smirnoff 		| FROM ipportspec		{
27813b3a8eb9SGleb Smirnoff 			$$ = $2;
27823b3a8eb9SGleb Smirnoff 		}
27833b3a8eb9SGleb Smirnoff 		;
27843b3a8eb9SGleb Smirnoff 
27853b3a8eb9SGleb Smirnoff to		: /* empty */			{
27863b3a8eb9SGleb Smirnoff 			$$.host = NULL;
27873b3a8eb9SGleb Smirnoff 			$$.port = NULL;
27883b3a8eb9SGleb Smirnoff 		}
27893b3a8eb9SGleb Smirnoff 		| TO ipportspec		{
27903b3a8eb9SGleb Smirnoff 			if (disallow_urpf_failed($2.host, "\"urpf-failed\" is "
27913b3a8eb9SGleb Smirnoff 			    "not permitted in a destination address"))
27923b3a8eb9SGleb Smirnoff 				YYERROR;
27933b3a8eb9SGleb Smirnoff 			$$ = $2;
27943b3a8eb9SGleb Smirnoff 		}
27953b3a8eb9SGleb Smirnoff 		;
27963b3a8eb9SGleb Smirnoff 
27973b3a8eb9SGleb Smirnoff ipportspec	: ipspec			{
27983b3a8eb9SGleb Smirnoff 			$$.host = $1;
27993b3a8eb9SGleb Smirnoff 			$$.port = NULL;
28003b3a8eb9SGleb Smirnoff 		}
28013b3a8eb9SGleb Smirnoff 		| ipspec PORT portspec		{
28023b3a8eb9SGleb Smirnoff 			$$.host = $1;
28033b3a8eb9SGleb Smirnoff 			$$.port = $3;
28043b3a8eb9SGleb Smirnoff 		}
28053b3a8eb9SGleb Smirnoff 		| PORT portspec			{
28063b3a8eb9SGleb Smirnoff 			$$.host = NULL;
28073b3a8eb9SGleb Smirnoff 			$$.port = $2;
28083b3a8eb9SGleb Smirnoff 		}
28093b3a8eb9SGleb Smirnoff 		;
28103b3a8eb9SGleb Smirnoff 
28113b3a8eb9SGleb Smirnoff optnl		: '\n' optnl
28123b3a8eb9SGleb Smirnoff 		|
28133b3a8eb9SGleb Smirnoff 		;
28143b3a8eb9SGleb Smirnoff 
28153b3a8eb9SGleb Smirnoff ipspec		: ANY				{ $$ = NULL; }
28163b3a8eb9SGleb Smirnoff 		| xhost				{ $$ = $1; }
28173b3a8eb9SGleb Smirnoff 		| '{' optnl host_list '}'	{ $$ = $3; }
28183b3a8eb9SGleb Smirnoff 		;
28193b3a8eb9SGleb Smirnoff 
28203b3a8eb9SGleb Smirnoff toipspec	: TO ipspec			{ $$ = $2; }
28213b3a8eb9SGleb Smirnoff 		| /* empty */			{ $$ = NULL; }
28223b3a8eb9SGleb Smirnoff 		;
28233b3a8eb9SGleb Smirnoff 
28243b3a8eb9SGleb Smirnoff host_list	: ipspec optnl			{ $$ = $1; }
28253b3a8eb9SGleb Smirnoff 		| host_list comma ipspec optnl	{
28263b3a8eb9SGleb Smirnoff 			if ($3 == NULL)
28273b3a8eb9SGleb Smirnoff 				$$ = $1;
28283b3a8eb9SGleb Smirnoff 			else if ($1 == NULL)
28293b3a8eb9SGleb Smirnoff 				$$ = $3;
28303b3a8eb9SGleb Smirnoff 			else {
28313b3a8eb9SGleb Smirnoff 				$1->tail->next = $3;
28323b3a8eb9SGleb Smirnoff 				$1->tail = $3->tail;
28333b3a8eb9SGleb Smirnoff 				$$ = $1;
28343b3a8eb9SGleb Smirnoff 			}
28353b3a8eb9SGleb Smirnoff 		}
28363b3a8eb9SGleb Smirnoff 		;
28373b3a8eb9SGleb Smirnoff 
28383b3a8eb9SGleb Smirnoff xhost		: not host			{
28393b3a8eb9SGleb Smirnoff 			struct node_host	*n;
28403b3a8eb9SGleb Smirnoff 
28413b3a8eb9SGleb Smirnoff 			for (n = $2; n != NULL; n = n->next)
28423b3a8eb9SGleb Smirnoff 				n->not = $1;
28433b3a8eb9SGleb Smirnoff 			$$ = $2;
28443b3a8eb9SGleb Smirnoff 		}
28453b3a8eb9SGleb Smirnoff 		| not NOROUTE			{
28463b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
28473b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
28483b3a8eb9SGleb Smirnoff 				err(1, "xhost: calloc");
28493b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_NOROUTE;
28503b3a8eb9SGleb Smirnoff 			$$->next = NULL;
28513b3a8eb9SGleb Smirnoff 			$$->not = $1;
28523b3a8eb9SGleb Smirnoff 			$$->tail = $$;
28533b3a8eb9SGleb Smirnoff 		}
28543b3a8eb9SGleb Smirnoff 		| not URPFFAILED		{
28553b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
28563b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
28573b3a8eb9SGleb Smirnoff 				err(1, "xhost: calloc");
28583b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_URPFFAILED;
28593b3a8eb9SGleb Smirnoff 			$$->next = NULL;
28603b3a8eb9SGleb Smirnoff 			$$->not = $1;
28613b3a8eb9SGleb Smirnoff 			$$->tail = $$;
28623b3a8eb9SGleb Smirnoff 		}
28633b3a8eb9SGleb Smirnoff 		;
28643b3a8eb9SGleb Smirnoff 
28653b3a8eb9SGleb Smirnoff host		: STRING			{
28663b3a8eb9SGleb Smirnoff 			if (($$ = host($1)) == NULL)	{
28673b3a8eb9SGleb Smirnoff 				/* error. "any" is handled elsewhere */
28683b3a8eb9SGleb Smirnoff 				free($1);
28693b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
28703b3a8eb9SGleb Smirnoff 				YYERROR;
28713b3a8eb9SGleb Smirnoff 			}
28723b3a8eb9SGleb Smirnoff 			free($1);
28733b3a8eb9SGleb Smirnoff 
28743b3a8eb9SGleb Smirnoff 		}
28753b3a8eb9SGleb Smirnoff 		| STRING '-' STRING		{
28763b3a8eb9SGleb Smirnoff 			struct node_host *b, *e;
28773b3a8eb9SGleb Smirnoff 
28783b3a8eb9SGleb Smirnoff 			if ((b = host($1)) == NULL || (e = host($3)) == NULL) {
28793b3a8eb9SGleb Smirnoff 				free($1);
28803b3a8eb9SGleb Smirnoff 				free($3);
28813b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
28823b3a8eb9SGleb Smirnoff 				YYERROR;
28833b3a8eb9SGleb Smirnoff 			}
28843b3a8eb9SGleb Smirnoff 			if (b->af != e->af ||
28853b3a8eb9SGleb Smirnoff 			    b->addr.type != PF_ADDR_ADDRMASK ||
28863b3a8eb9SGleb Smirnoff 			    e->addr.type != PF_ADDR_ADDRMASK ||
28873b3a8eb9SGleb Smirnoff 			    unmask(&b->addr.v.a.mask, b->af) !=
28883b3a8eb9SGleb Smirnoff 			    (b->af == AF_INET ? 32 : 128) ||
28893b3a8eb9SGleb Smirnoff 			    unmask(&e->addr.v.a.mask, e->af) !=
28903b3a8eb9SGleb Smirnoff 			    (e->af == AF_INET ? 32 : 128) ||
28913b3a8eb9SGleb Smirnoff 			    b->next != NULL || b->not ||
28923b3a8eb9SGleb Smirnoff 			    e->next != NULL || e->not) {
28933b3a8eb9SGleb Smirnoff 				free(b);
28943b3a8eb9SGleb Smirnoff 				free(e);
28953b3a8eb9SGleb Smirnoff 				free($1);
28963b3a8eb9SGleb Smirnoff 				free($3);
28973b3a8eb9SGleb Smirnoff 				yyerror("invalid address range");
28983b3a8eb9SGleb Smirnoff 				YYERROR;
28993b3a8eb9SGleb Smirnoff 			}
29003b3a8eb9SGleb Smirnoff 			memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr,
29013b3a8eb9SGleb Smirnoff 			    sizeof(b->addr.v.a.mask));
29023b3a8eb9SGleb Smirnoff 			b->addr.type = PF_ADDR_RANGE;
29033b3a8eb9SGleb Smirnoff 			$$ = b;
29043b3a8eb9SGleb Smirnoff 			free(e);
29053b3a8eb9SGleb Smirnoff 			free($1);
29063b3a8eb9SGleb Smirnoff 			free($3);
29073b3a8eb9SGleb Smirnoff 		}
29083b3a8eb9SGleb Smirnoff 		| STRING '/' NUMBER		{
29093b3a8eb9SGleb Smirnoff 			char	*buf;
29103b3a8eb9SGleb Smirnoff 
29113b3a8eb9SGleb Smirnoff 			if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1)
29123b3a8eb9SGleb Smirnoff 				err(1, "host: asprintf");
29133b3a8eb9SGleb Smirnoff 			free($1);
29143b3a8eb9SGleb Smirnoff 			if (($$ = host(buf)) == NULL)	{
29153b3a8eb9SGleb Smirnoff 				/* error. "any" is handled elsewhere */
29163b3a8eb9SGleb Smirnoff 				free(buf);
29173b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
29183b3a8eb9SGleb Smirnoff 				YYERROR;
29193b3a8eb9SGleb Smirnoff 			}
29203b3a8eb9SGleb Smirnoff 			free(buf);
29213b3a8eb9SGleb Smirnoff 		}
29223b3a8eb9SGleb Smirnoff 		| NUMBER '/' NUMBER		{
29233b3a8eb9SGleb Smirnoff 			char	*buf;
29243b3a8eb9SGleb Smirnoff 
29253b3a8eb9SGleb Smirnoff 			/* ie. for 10/8 parsing */
29263b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
29273b3a8eb9SGleb Smirnoff 			if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1)
29283b3a8eb9SGleb Smirnoff #else
29293b3a8eb9SGleb Smirnoff 			if (asprintf(&buf, "%lld/%lld", $1, $3) == -1)
29303b3a8eb9SGleb Smirnoff #endif
29313b3a8eb9SGleb Smirnoff 				err(1, "host: asprintf");
29323b3a8eb9SGleb Smirnoff 			if (($$ = host(buf)) == NULL)	{
29333b3a8eb9SGleb Smirnoff 				/* error. "any" is handled elsewhere */
29343b3a8eb9SGleb Smirnoff 				free(buf);
29353b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
29363b3a8eb9SGleb Smirnoff 				YYERROR;
29373b3a8eb9SGleb Smirnoff 			}
29383b3a8eb9SGleb Smirnoff 			free(buf);
29393b3a8eb9SGleb Smirnoff 		}
29403b3a8eb9SGleb Smirnoff 		| dynaddr
29413b3a8eb9SGleb Smirnoff 		| dynaddr '/' NUMBER		{
29423b3a8eb9SGleb Smirnoff 			struct node_host	*n;
29433b3a8eb9SGleb Smirnoff 
29443b3a8eb9SGleb Smirnoff 			if ($3 < 0 || $3 > 128) {
29453b3a8eb9SGleb Smirnoff 				yyerror("bit number too big");
29463b3a8eb9SGleb Smirnoff 				YYERROR;
29473b3a8eb9SGleb Smirnoff 			}
29483b3a8eb9SGleb Smirnoff 			$$ = $1;
29493b3a8eb9SGleb Smirnoff 			for (n = $1; n != NULL; n = n->next)
29503b3a8eb9SGleb Smirnoff 				set_ipmask(n, $3);
29513b3a8eb9SGleb Smirnoff 		}
29523b3a8eb9SGleb Smirnoff 		| '<' STRING '>'	{
29533b3a8eb9SGleb Smirnoff 			if (strlen($2) >= PF_TABLE_NAME_SIZE) {
29543b3a8eb9SGleb Smirnoff 				yyerror("table name '%s' too long", $2);
29553b3a8eb9SGleb Smirnoff 				free($2);
29563b3a8eb9SGleb Smirnoff 				YYERROR;
29573b3a8eb9SGleb Smirnoff 			}
29583b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
29593b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
29603b3a8eb9SGleb Smirnoff 				err(1, "host: calloc");
29613b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_TABLE;
29623b3a8eb9SGleb Smirnoff 			if (strlcpy($$->addr.v.tblname, $2,
29633b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.tblname)) >=
29643b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.tblname))
29653b3a8eb9SGleb Smirnoff 				errx(1, "host: strlcpy");
29663b3a8eb9SGleb Smirnoff 			free($2);
29673b3a8eb9SGleb Smirnoff 			$$->next = NULL;
29683b3a8eb9SGleb Smirnoff 			$$->tail = $$;
29693b3a8eb9SGleb Smirnoff 		}
29703b3a8eb9SGleb Smirnoff 		;
29713b3a8eb9SGleb Smirnoff 
29723b3a8eb9SGleb Smirnoff number		: NUMBER
29733b3a8eb9SGleb Smirnoff 		| STRING		{
29743b3a8eb9SGleb Smirnoff 			u_long	ulval;
29753b3a8eb9SGleb Smirnoff 
29763b3a8eb9SGleb Smirnoff 			if (atoul($1, &ulval) == -1) {
29773b3a8eb9SGleb Smirnoff 				yyerror("%s is not a number", $1);
29783b3a8eb9SGleb Smirnoff 				free($1);
29793b3a8eb9SGleb Smirnoff 				YYERROR;
29803b3a8eb9SGleb Smirnoff 			} else
29813b3a8eb9SGleb Smirnoff 				$$ = ulval;
29823b3a8eb9SGleb Smirnoff 			free($1);
29833b3a8eb9SGleb Smirnoff 		}
29843b3a8eb9SGleb Smirnoff 		;
29853b3a8eb9SGleb Smirnoff 
29863b3a8eb9SGleb Smirnoff dynaddr		: '(' STRING ')'		{
29873b3a8eb9SGleb Smirnoff 			int	 flags = 0;
29883b3a8eb9SGleb Smirnoff 			char	*p, *op;
29893b3a8eb9SGleb Smirnoff 
29903b3a8eb9SGleb Smirnoff 			op = $2;
29913b3a8eb9SGleb Smirnoff 			if (!isalpha(op[0])) {
29923b3a8eb9SGleb Smirnoff 				yyerror("invalid interface name '%s'", op);
29933b3a8eb9SGleb Smirnoff 				free(op);
29943b3a8eb9SGleb Smirnoff 				YYERROR;
29953b3a8eb9SGleb Smirnoff 			}
29963b3a8eb9SGleb Smirnoff 			while ((p = strrchr($2, ':')) != NULL) {
29973b3a8eb9SGleb Smirnoff 				if (!strcmp(p+1, "network"))
29983b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_NETWORK;
29993b3a8eb9SGleb Smirnoff 				else if (!strcmp(p+1, "broadcast"))
30003b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_BROADCAST;
30013b3a8eb9SGleb Smirnoff 				else if (!strcmp(p+1, "peer"))
30023b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_PEER;
30033b3a8eb9SGleb Smirnoff 				else if (!strcmp(p+1, "0"))
30043b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_NOALIAS;
30053b3a8eb9SGleb Smirnoff 				else {
30063b3a8eb9SGleb Smirnoff 					yyerror("interface %s has bad modifier",
30073b3a8eb9SGleb Smirnoff 					    $2);
30083b3a8eb9SGleb Smirnoff 					free(op);
30093b3a8eb9SGleb Smirnoff 					YYERROR;
30103b3a8eb9SGleb Smirnoff 				}
30113b3a8eb9SGleb Smirnoff 				*p = '\0';
30123b3a8eb9SGleb Smirnoff 			}
30133b3a8eb9SGleb Smirnoff 			if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
30143b3a8eb9SGleb Smirnoff 				free(op);
30153b3a8eb9SGleb Smirnoff 				yyerror("illegal combination of "
30163b3a8eb9SGleb Smirnoff 				    "interface modifiers");
30173b3a8eb9SGleb Smirnoff 				YYERROR;
30183b3a8eb9SGleb Smirnoff 			}
30193b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
30203b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
30213b3a8eb9SGleb Smirnoff 				err(1, "address: calloc");
30223b3a8eb9SGleb Smirnoff 			$$->af = 0;
30233b3a8eb9SGleb Smirnoff 			set_ipmask($$, 128);
30243b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_DYNIFTL;
30253b3a8eb9SGleb Smirnoff 			$$->addr.iflags = flags;
30263b3a8eb9SGleb Smirnoff 			if (strlcpy($$->addr.v.ifname, $2,
30273b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.ifname)) >=
30283b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.ifname)) {
30293b3a8eb9SGleb Smirnoff 				free(op);
30303b3a8eb9SGleb Smirnoff 				free($$);
30313b3a8eb9SGleb Smirnoff 				yyerror("interface name too long");
30323b3a8eb9SGleb Smirnoff 				YYERROR;
30333b3a8eb9SGleb Smirnoff 			}
30343b3a8eb9SGleb Smirnoff 			free(op);
30353b3a8eb9SGleb Smirnoff 			$$->next = NULL;
30363b3a8eb9SGleb Smirnoff 			$$->tail = $$;
30373b3a8eb9SGleb Smirnoff 		}
30383b3a8eb9SGleb Smirnoff 		;
30393b3a8eb9SGleb Smirnoff 
30403b3a8eb9SGleb Smirnoff portspec	: port_item			{ $$ = $1; }
30413b3a8eb9SGleb Smirnoff 		| '{' optnl port_list '}'	{ $$ = $3; }
30423b3a8eb9SGleb Smirnoff 		;
30433b3a8eb9SGleb Smirnoff 
30443b3a8eb9SGleb Smirnoff port_list	: port_item optnl		{ $$ = $1; }
30453b3a8eb9SGleb Smirnoff 		| port_list comma port_item optnl	{
30463b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
30473b3a8eb9SGleb Smirnoff 			$1->tail = $3;
30483b3a8eb9SGleb Smirnoff 			$$ = $1;
30493b3a8eb9SGleb Smirnoff 		}
30503b3a8eb9SGleb Smirnoff 		;
30513b3a8eb9SGleb Smirnoff 
30523b3a8eb9SGleb Smirnoff port_item	: portrange			{
30533b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_port));
30543b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
30553b3a8eb9SGleb Smirnoff 				err(1, "port_item: calloc");
30563b3a8eb9SGleb Smirnoff 			$$->port[0] = $1.a;
30573b3a8eb9SGleb Smirnoff 			$$->port[1] = $1.b;
30583b3a8eb9SGleb Smirnoff 			if ($1.t)
30593b3a8eb9SGleb Smirnoff 				$$->op = PF_OP_RRG;
30603b3a8eb9SGleb Smirnoff 			else
30613b3a8eb9SGleb Smirnoff 				$$->op = PF_OP_EQ;
30623b3a8eb9SGleb Smirnoff 			$$->next = NULL;
30633b3a8eb9SGleb Smirnoff 			$$->tail = $$;
30643b3a8eb9SGleb Smirnoff 		}
30653b3a8eb9SGleb Smirnoff 		| unaryop portrange	{
30663b3a8eb9SGleb Smirnoff 			if ($2.t) {
30673b3a8eb9SGleb Smirnoff 				yyerror("':' cannot be used with an other "
30683b3a8eb9SGleb Smirnoff 				    "port operator");
30693b3a8eb9SGleb Smirnoff 				YYERROR;
30703b3a8eb9SGleb Smirnoff 			}
30713b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_port));
30723b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
30733b3a8eb9SGleb Smirnoff 				err(1, "port_item: calloc");
30743b3a8eb9SGleb Smirnoff 			$$->port[0] = $2.a;
30753b3a8eb9SGleb Smirnoff 			$$->port[1] = $2.b;
30763b3a8eb9SGleb Smirnoff 			$$->op = $1;
30773b3a8eb9SGleb Smirnoff 			$$->next = NULL;
30783b3a8eb9SGleb Smirnoff 			$$->tail = $$;
30793b3a8eb9SGleb Smirnoff 		}
30803b3a8eb9SGleb Smirnoff 		| portrange PORTBINARY portrange	{
30813b3a8eb9SGleb Smirnoff 			if ($1.t || $3.t) {
30823b3a8eb9SGleb Smirnoff 				yyerror("':' cannot be used with an other "
30833b3a8eb9SGleb Smirnoff 				    "port operator");
30843b3a8eb9SGleb Smirnoff 				YYERROR;
30853b3a8eb9SGleb Smirnoff 			}
30863b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_port));
30873b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
30883b3a8eb9SGleb Smirnoff 				err(1, "port_item: calloc");
30893b3a8eb9SGleb Smirnoff 			$$->port[0] = $1.a;
30903b3a8eb9SGleb Smirnoff 			$$->port[1] = $3.a;
30913b3a8eb9SGleb Smirnoff 			$$->op = $2;
30923b3a8eb9SGleb Smirnoff 			$$->next = NULL;
30933b3a8eb9SGleb Smirnoff 			$$->tail = $$;
30943b3a8eb9SGleb Smirnoff 		}
30953b3a8eb9SGleb Smirnoff 		;
30963b3a8eb9SGleb Smirnoff 
30973b3a8eb9SGleb Smirnoff portplain	: numberstring			{
30983b3a8eb9SGleb Smirnoff 			if (parseport($1, &$$, 0) == -1) {
30993b3a8eb9SGleb Smirnoff 				free($1);
31003b3a8eb9SGleb Smirnoff 				YYERROR;
31013b3a8eb9SGleb Smirnoff 			}
31023b3a8eb9SGleb Smirnoff 			free($1);
31033b3a8eb9SGleb Smirnoff 		}
31043b3a8eb9SGleb Smirnoff 		;
31053b3a8eb9SGleb Smirnoff 
31063b3a8eb9SGleb Smirnoff portrange	: numberstring			{
31073b3a8eb9SGleb Smirnoff 			if (parseport($1, &$$, PPORT_RANGE) == -1) {
31083b3a8eb9SGleb Smirnoff 				free($1);
31093b3a8eb9SGleb Smirnoff 				YYERROR;
31103b3a8eb9SGleb Smirnoff 			}
31113b3a8eb9SGleb Smirnoff 			free($1);
31123b3a8eb9SGleb Smirnoff 		}
31133b3a8eb9SGleb Smirnoff 		;
31143b3a8eb9SGleb Smirnoff 
31153b3a8eb9SGleb Smirnoff uids		: uid_item			{ $$ = $1; }
31163b3a8eb9SGleb Smirnoff 		| '{' optnl uid_list '}'	{ $$ = $3; }
31173b3a8eb9SGleb Smirnoff 		;
31183b3a8eb9SGleb Smirnoff 
31193b3a8eb9SGleb Smirnoff uid_list	: uid_item optnl		{ $$ = $1; }
31203b3a8eb9SGleb Smirnoff 		| uid_list comma uid_item optnl	{
31213b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
31223b3a8eb9SGleb Smirnoff 			$1->tail = $3;
31233b3a8eb9SGleb Smirnoff 			$$ = $1;
31243b3a8eb9SGleb Smirnoff 		}
31253b3a8eb9SGleb Smirnoff 		;
31263b3a8eb9SGleb Smirnoff 
31273b3a8eb9SGleb Smirnoff uid_item	: uid				{
31283b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_uid));
31293b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
31303b3a8eb9SGleb Smirnoff 				err(1, "uid_item: calloc");
31313b3a8eb9SGleb Smirnoff 			$$->uid[0] = $1;
31323b3a8eb9SGleb Smirnoff 			$$->uid[1] = $1;
31333b3a8eb9SGleb Smirnoff 			$$->op = PF_OP_EQ;
31343b3a8eb9SGleb Smirnoff 			$$->next = NULL;
31353b3a8eb9SGleb Smirnoff 			$$->tail = $$;
31363b3a8eb9SGleb Smirnoff 		}
31373b3a8eb9SGleb Smirnoff 		| unaryop uid			{
31383b3a8eb9SGleb Smirnoff 			if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
31393b3a8eb9SGleb Smirnoff 				yyerror("user unknown requires operator = or "
31403b3a8eb9SGleb Smirnoff 				    "!=");
31413b3a8eb9SGleb Smirnoff 				YYERROR;
31423b3a8eb9SGleb Smirnoff 			}
31433b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_uid));
31443b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
31453b3a8eb9SGleb Smirnoff 				err(1, "uid_item: calloc");
31463b3a8eb9SGleb Smirnoff 			$$->uid[0] = $2;
31473b3a8eb9SGleb Smirnoff 			$$->uid[1] = $2;
31483b3a8eb9SGleb Smirnoff 			$$->op = $1;
31493b3a8eb9SGleb Smirnoff 			$$->next = NULL;
31503b3a8eb9SGleb Smirnoff 			$$->tail = $$;
31513b3a8eb9SGleb Smirnoff 		}
31523b3a8eb9SGleb Smirnoff 		| uid PORTBINARY uid		{
31533b3a8eb9SGleb Smirnoff 			if ($1 == UID_MAX || $3 == UID_MAX) {
31543b3a8eb9SGleb Smirnoff 				yyerror("user unknown requires operator = or "
31553b3a8eb9SGleb Smirnoff 				    "!=");
31563b3a8eb9SGleb Smirnoff 				YYERROR;
31573b3a8eb9SGleb Smirnoff 			}
31583b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_uid));
31593b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
31603b3a8eb9SGleb Smirnoff 				err(1, "uid_item: calloc");
31613b3a8eb9SGleb Smirnoff 			$$->uid[0] = $1;
31623b3a8eb9SGleb Smirnoff 			$$->uid[1] = $3;
31633b3a8eb9SGleb Smirnoff 			$$->op = $2;
31643b3a8eb9SGleb Smirnoff 			$$->next = NULL;
31653b3a8eb9SGleb Smirnoff 			$$->tail = $$;
31663b3a8eb9SGleb Smirnoff 		}
31673b3a8eb9SGleb Smirnoff 		;
31683b3a8eb9SGleb Smirnoff 
31693b3a8eb9SGleb Smirnoff uid		: STRING			{
31703b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "unknown"))
31713b3a8eb9SGleb Smirnoff 				$$ = UID_MAX;
31723b3a8eb9SGleb Smirnoff 			else {
31733b3a8eb9SGleb Smirnoff 				struct passwd	*pw;
31743b3a8eb9SGleb Smirnoff 
31753b3a8eb9SGleb Smirnoff 				if ((pw = getpwnam($1)) == NULL) {
31763b3a8eb9SGleb Smirnoff 					yyerror("unknown user %s", $1);
31773b3a8eb9SGleb Smirnoff 					free($1);
31783b3a8eb9SGleb Smirnoff 					YYERROR;
31793b3a8eb9SGleb Smirnoff 				}
31803b3a8eb9SGleb Smirnoff 				$$ = pw->pw_uid;
31813b3a8eb9SGleb Smirnoff 			}
31823b3a8eb9SGleb Smirnoff 			free($1);
31833b3a8eb9SGleb Smirnoff 		}
31843b3a8eb9SGleb Smirnoff 		| NUMBER			{
31853b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 >= UID_MAX) {
31863b3a8eb9SGleb Smirnoff 				yyerror("illegal uid value %lu", $1);
31873b3a8eb9SGleb Smirnoff 				YYERROR;
31883b3a8eb9SGleb Smirnoff 			}
31893b3a8eb9SGleb Smirnoff 			$$ = $1;
31903b3a8eb9SGleb Smirnoff 		}
31913b3a8eb9SGleb Smirnoff 		;
31923b3a8eb9SGleb Smirnoff 
31933b3a8eb9SGleb Smirnoff gids		: gid_item			{ $$ = $1; }
31943b3a8eb9SGleb Smirnoff 		| '{' optnl gid_list '}'	{ $$ = $3; }
31953b3a8eb9SGleb Smirnoff 		;
31963b3a8eb9SGleb Smirnoff 
31973b3a8eb9SGleb Smirnoff gid_list	: gid_item optnl		{ $$ = $1; }
31983b3a8eb9SGleb Smirnoff 		| gid_list comma gid_item optnl	{
31993b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
32003b3a8eb9SGleb Smirnoff 			$1->tail = $3;
32013b3a8eb9SGleb Smirnoff 			$$ = $1;
32023b3a8eb9SGleb Smirnoff 		}
32033b3a8eb9SGleb Smirnoff 		;
32043b3a8eb9SGleb Smirnoff 
32053b3a8eb9SGleb Smirnoff gid_item	: gid				{
32063b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_gid));
32073b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32083b3a8eb9SGleb Smirnoff 				err(1, "gid_item: calloc");
32093b3a8eb9SGleb Smirnoff 			$$->gid[0] = $1;
32103b3a8eb9SGleb Smirnoff 			$$->gid[1] = $1;
32113b3a8eb9SGleb Smirnoff 			$$->op = PF_OP_EQ;
32123b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32133b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32143b3a8eb9SGleb Smirnoff 		}
32153b3a8eb9SGleb Smirnoff 		| unaryop gid			{
32163b3a8eb9SGleb Smirnoff 			if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
32173b3a8eb9SGleb Smirnoff 				yyerror("group unknown requires operator = or "
32183b3a8eb9SGleb Smirnoff 				    "!=");
32193b3a8eb9SGleb Smirnoff 				YYERROR;
32203b3a8eb9SGleb Smirnoff 			}
32213b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_gid));
32223b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32233b3a8eb9SGleb Smirnoff 				err(1, "gid_item: calloc");
32243b3a8eb9SGleb Smirnoff 			$$->gid[0] = $2;
32253b3a8eb9SGleb Smirnoff 			$$->gid[1] = $2;
32263b3a8eb9SGleb Smirnoff 			$$->op = $1;
32273b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32283b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32293b3a8eb9SGleb Smirnoff 		}
32303b3a8eb9SGleb Smirnoff 		| gid PORTBINARY gid		{
32313b3a8eb9SGleb Smirnoff 			if ($1 == GID_MAX || $3 == GID_MAX) {
32323b3a8eb9SGleb Smirnoff 				yyerror("group unknown requires operator = or "
32333b3a8eb9SGleb Smirnoff 				    "!=");
32343b3a8eb9SGleb Smirnoff 				YYERROR;
32353b3a8eb9SGleb Smirnoff 			}
32363b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_gid));
32373b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32383b3a8eb9SGleb Smirnoff 				err(1, "gid_item: calloc");
32393b3a8eb9SGleb Smirnoff 			$$->gid[0] = $1;
32403b3a8eb9SGleb Smirnoff 			$$->gid[1] = $3;
32413b3a8eb9SGleb Smirnoff 			$$->op = $2;
32423b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32433b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32443b3a8eb9SGleb Smirnoff 		}
32453b3a8eb9SGleb Smirnoff 		;
32463b3a8eb9SGleb Smirnoff 
32473b3a8eb9SGleb Smirnoff gid		: STRING			{
32483b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "unknown"))
32493b3a8eb9SGleb Smirnoff 				$$ = GID_MAX;
32503b3a8eb9SGleb Smirnoff 			else {
32513b3a8eb9SGleb Smirnoff 				struct group	*grp;
32523b3a8eb9SGleb Smirnoff 
32533b3a8eb9SGleb Smirnoff 				if ((grp = getgrnam($1)) == NULL) {
32543b3a8eb9SGleb Smirnoff 					yyerror("unknown group %s", $1);
32553b3a8eb9SGleb Smirnoff 					free($1);
32563b3a8eb9SGleb Smirnoff 					YYERROR;
32573b3a8eb9SGleb Smirnoff 				}
32583b3a8eb9SGleb Smirnoff 				$$ = grp->gr_gid;
32593b3a8eb9SGleb Smirnoff 			}
32603b3a8eb9SGleb Smirnoff 			free($1);
32613b3a8eb9SGleb Smirnoff 		}
32623b3a8eb9SGleb Smirnoff 		| NUMBER			{
32633b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 >= GID_MAX) {
32643b3a8eb9SGleb Smirnoff 				yyerror("illegal gid value %lu", $1);
32653b3a8eb9SGleb Smirnoff 				YYERROR;
32663b3a8eb9SGleb Smirnoff 			}
32673b3a8eb9SGleb Smirnoff 			$$ = $1;
32683b3a8eb9SGleb Smirnoff 		}
32693b3a8eb9SGleb Smirnoff 		;
32703b3a8eb9SGleb Smirnoff 
32713b3a8eb9SGleb Smirnoff flag		: STRING			{
32723b3a8eb9SGleb Smirnoff 			int	f;
32733b3a8eb9SGleb Smirnoff 
32743b3a8eb9SGleb Smirnoff 			if ((f = parse_flags($1)) < 0) {
32753b3a8eb9SGleb Smirnoff 				yyerror("bad flags %s", $1);
32763b3a8eb9SGleb Smirnoff 				free($1);
32773b3a8eb9SGleb Smirnoff 				YYERROR;
32783b3a8eb9SGleb Smirnoff 			}
32793b3a8eb9SGleb Smirnoff 			free($1);
32803b3a8eb9SGleb Smirnoff 			$$.b1 = f;
32813b3a8eb9SGleb Smirnoff 		}
32823b3a8eb9SGleb Smirnoff 		;
32833b3a8eb9SGleb Smirnoff 
32843b3a8eb9SGleb Smirnoff flags		: FLAGS flag '/' flag	{ $$.b1 = $2.b1; $$.b2 = $4.b1; }
32853b3a8eb9SGleb Smirnoff 		| FLAGS '/' flag	{ $$.b1 = 0; $$.b2 = $3.b1; }
32863b3a8eb9SGleb Smirnoff 		| FLAGS ANY		{ $$.b1 = 0; $$.b2 = 0; }
32873b3a8eb9SGleb Smirnoff 		;
32883b3a8eb9SGleb Smirnoff 
32893b3a8eb9SGleb Smirnoff icmpspec	: ICMPTYPE icmp_item			{ $$ = $2; }
32903b3a8eb9SGleb Smirnoff 		| ICMPTYPE '{' optnl icmp_list '}'	{ $$ = $4; }
32913b3a8eb9SGleb Smirnoff 		| ICMP6TYPE icmp6_item			{ $$ = $2; }
32923b3a8eb9SGleb Smirnoff 		| ICMP6TYPE '{' optnl icmp6_list '}'	{ $$ = $4; }
32933b3a8eb9SGleb Smirnoff 		;
32943b3a8eb9SGleb Smirnoff 
32953b3a8eb9SGleb Smirnoff icmp_list	: icmp_item optnl		{ $$ = $1; }
32963b3a8eb9SGleb Smirnoff 		| icmp_list comma icmp_item optnl {
32973b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
32983b3a8eb9SGleb Smirnoff 			$1->tail = $3;
32993b3a8eb9SGleb Smirnoff 			$$ = $1;
33003b3a8eb9SGleb Smirnoff 		}
33013b3a8eb9SGleb Smirnoff 		;
33023b3a8eb9SGleb Smirnoff 
33033b3a8eb9SGleb Smirnoff icmp6_list	: icmp6_item optnl		{ $$ = $1; }
33043b3a8eb9SGleb Smirnoff 		| icmp6_list comma icmp6_item optnl {
33053b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
33063b3a8eb9SGleb Smirnoff 			$1->tail = $3;
33073b3a8eb9SGleb Smirnoff 			$$ = $1;
33083b3a8eb9SGleb Smirnoff 		}
33093b3a8eb9SGleb Smirnoff 		;
33103b3a8eb9SGleb Smirnoff 
33113b3a8eb9SGleb Smirnoff icmp_item	: icmptype		{
33123b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
33133b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33143b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
33153b3a8eb9SGleb Smirnoff 			$$->type = $1;
33163b3a8eb9SGleb Smirnoff 			$$->code = 0;
33173b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMP;
33183b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33193b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33203b3a8eb9SGleb Smirnoff 		}
33213b3a8eb9SGleb Smirnoff 		| icmptype CODE STRING	{
33223b3a8eb9SGleb Smirnoff 			const struct icmpcodeent	*p;
33233b3a8eb9SGleb Smirnoff 
33243b3a8eb9SGleb Smirnoff 			if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) {
33253b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp-code %s", $3);
33263b3a8eb9SGleb Smirnoff 				free($3);
33273b3a8eb9SGleb Smirnoff 				YYERROR;
33283b3a8eb9SGleb Smirnoff 			}
33293b3a8eb9SGleb Smirnoff 
33303b3a8eb9SGleb Smirnoff 			free($3);
33313b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
33323b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33333b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
33343b3a8eb9SGleb Smirnoff 			$$->type = $1;
33353b3a8eb9SGleb Smirnoff 			$$->code = p->code + 1;
33363b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMP;
33373b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33383b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33393b3a8eb9SGleb Smirnoff 		}
33403b3a8eb9SGleb Smirnoff 		| icmptype CODE NUMBER	{
33413b3a8eb9SGleb Smirnoff 			if ($3 < 0 || $3 > 255) {
33423b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp-code %lu", $3);
33433b3a8eb9SGleb Smirnoff 				YYERROR;
33443b3a8eb9SGleb Smirnoff 			}
33453b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
33463b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33473b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
33483b3a8eb9SGleb Smirnoff 			$$->type = $1;
33493b3a8eb9SGleb Smirnoff 			$$->code = $3 + 1;
33503b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMP;
33513b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33523b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33533b3a8eb9SGleb Smirnoff 		}
33543b3a8eb9SGleb Smirnoff 		;
33553b3a8eb9SGleb Smirnoff 
33563b3a8eb9SGleb Smirnoff icmp6_item	: icmp6type		{
33573b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
33583b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33593b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
33603b3a8eb9SGleb Smirnoff 			$$->type = $1;
33613b3a8eb9SGleb Smirnoff 			$$->code = 0;
33623b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMPV6;
33633b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33643b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33653b3a8eb9SGleb Smirnoff 		}
33663b3a8eb9SGleb Smirnoff 		| icmp6type CODE STRING	{
33673b3a8eb9SGleb Smirnoff 			const struct icmpcodeent	*p;
33683b3a8eb9SGleb Smirnoff 
33693b3a8eb9SGleb Smirnoff 			if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) {
33703b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp6-code %s", $3);
33713b3a8eb9SGleb Smirnoff 				free($3);
33723b3a8eb9SGleb Smirnoff 				YYERROR;
33733b3a8eb9SGleb Smirnoff 			}
33743b3a8eb9SGleb Smirnoff 			free($3);
33753b3a8eb9SGleb Smirnoff 
33763b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
33773b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33783b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
33793b3a8eb9SGleb Smirnoff 			$$->type = $1;
33803b3a8eb9SGleb Smirnoff 			$$->code = p->code + 1;
33813b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMPV6;
33823b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33833b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33843b3a8eb9SGleb Smirnoff 		}
33853b3a8eb9SGleb Smirnoff 		| icmp6type CODE NUMBER	{
33863b3a8eb9SGleb Smirnoff 			if ($3 < 0 || $3 > 255) {
33873b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp-code %lu", $3);
33883b3a8eb9SGleb Smirnoff 				YYERROR;
33893b3a8eb9SGleb Smirnoff 			}
33903b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
33913b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33923b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
33933b3a8eb9SGleb Smirnoff 			$$->type = $1;
33943b3a8eb9SGleb Smirnoff 			$$->code = $3 + 1;
33953b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMPV6;
33963b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33973b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33983b3a8eb9SGleb Smirnoff 		}
33993b3a8eb9SGleb Smirnoff 		;
34003b3a8eb9SGleb Smirnoff 
34013b3a8eb9SGleb Smirnoff icmptype	: STRING			{
34023b3a8eb9SGleb Smirnoff 			const struct icmptypeent	*p;
34033b3a8eb9SGleb Smirnoff 
34043b3a8eb9SGleb Smirnoff 			if ((p = geticmptypebyname($1, AF_INET)) == NULL) {
34053b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp-type %s", $1);
34063b3a8eb9SGleb Smirnoff 				free($1);
34073b3a8eb9SGleb Smirnoff 				YYERROR;
34083b3a8eb9SGleb Smirnoff 			}
34093b3a8eb9SGleb Smirnoff 			$$ = p->type + 1;
34103b3a8eb9SGleb Smirnoff 			free($1);
34113b3a8eb9SGleb Smirnoff 		}
34123b3a8eb9SGleb Smirnoff 		| NUMBER			{
34133b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
34143b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp-type %lu", $1);
34153b3a8eb9SGleb Smirnoff 				YYERROR;
34163b3a8eb9SGleb Smirnoff 			}
34173b3a8eb9SGleb Smirnoff 			$$ = $1 + 1;
34183b3a8eb9SGleb Smirnoff 		}
34193b3a8eb9SGleb Smirnoff 		;
34203b3a8eb9SGleb Smirnoff 
34213b3a8eb9SGleb Smirnoff icmp6type	: STRING			{
34223b3a8eb9SGleb Smirnoff 			const struct icmptypeent	*p;
34233b3a8eb9SGleb Smirnoff 
34243b3a8eb9SGleb Smirnoff 			if ((p = geticmptypebyname($1, AF_INET6)) ==
34253b3a8eb9SGleb Smirnoff 			    NULL) {
34263b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp6-type %s", $1);
34273b3a8eb9SGleb Smirnoff 				free($1);
34283b3a8eb9SGleb Smirnoff 				YYERROR;
34293b3a8eb9SGleb Smirnoff 			}
34303b3a8eb9SGleb Smirnoff 			$$ = p->type + 1;
34313b3a8eb9SGleb Smirnoff 			free($1);
34323b3a8eb9SGleb Smirnoff 		}
34333b3a8eb9SGleb Smirnoff 		| NUMBER			{
34343b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
34353b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp6-type %lu", $1);
34363b3a8eb9SGleb Smirnoff 				YYERROR;
34373b3a8eb9SGleb Smirnoff 			}
34383b3a8eb9SGleb Smirnoff 			$$ = $1 + 1;
34393b3a8eb9SGleb Smirnoff 		}
34403b3a8eb9SGleb Smirnoff 		;
34413b3a8eb9SGleb Smirnoff 
34423b3a8eb9SGleb Smirnoff tos	: STRING			{
34433b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "lowdelay"))
34443b3a8eb9SGleb Smirnoff 				$$ = IPTOS_LOWDELAY;
34453b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "throughput"))
34463b3a8eb9SGleb Smirnoff 				$$ = IPTOS_THROUGHPUT;
34473b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "reliability"))
34483b3a8eb9SGleb Smirnoff 				$$ = IPTOS_RELIABILITY;
34493b3a8eb9SGleb Smirnoff 			else if ($1[0] == '0' && $1[1] == 'x')
34503b3a8eb9SGleb Smirnoff 				$$ = strtoul($1, NULL, 16);
34513b3a8eb9SGleb Smirnoff 			else
34523b3a8eb9SGleb Smirnoff 				$$ = 0;		/* flag bad argument */
34533b3a8eb9SGleb Smirnoff 			if (!$$ || $$ > 255) {
34543b3a8eb9SGleb Smirnoff 				yyerror("illegal tos value %s", $1);
34553b3a8eb9SGleb Smirnoff 				free($1);
34563b3a8eb9SGleb Smirnoff 				YYERROR;
34573b3a8eb9SGleb Smirnoff 			}
34583b3a8eb9SGleb Smirnoff 			free($1);
34593b3a8eb9SGleb Smirnoff 		}
34603b3a8eb9SGleb Smirnoff 		| NUMBER			{
34613b3a8eb9SGleb Smirnoff 			$$ = $1;
34623b3a8eb9SGleb Smirnoff 			if (!$$ || $$ > 255) {
34633b3a8eb9SGleb Smirnoff 				yyerror("illegal tos value %s", $1);
34643b3a8eb9SGleb Smirnoff 				YYERROR;
34653b3a8eb9SGleb Smirnoff 			}
34663b3a8eb9SGleb Smirnoff 		}
34673b3a8eb9SGleb Smirnoff 		;
34683b3a8eb9SGleb Smirnoff 
34693b3a8eb9SGleb Smirnoff sourcetrack	: SOURCETRACK		{ $$ = PF_SRCTRACK; }
34703b3a8eb9SGleb Smirnoff 		| SOURCETRACK GLOBAL	{ $$ = PF_SRCTRACK_GLOBAL; }
34713b3a8eb9SGleb Smirnoff 		| SOURCETRACK RULE	{ $$ = PF_SRCTRACK_RULE; }
34723b3a8eb9SGleb Smirnoff 		;
34733b3a8eb9SGleb Smirnoff 
34743b3a8eb9SGleb Smirnoff statelock	: IFBOUND {
34753b3a8eb9SGleb Smirnoff 			$$ = PFRULE_IFBOUND;
34763b3a8eb9SGleb Smirnoff 		}
34773b3a8eb9SGleb Smirnoff 		| FLOATING {
34783b3a8eb9SGleb Smirnoff 			$$ = 0;
34793b3a8eb9SGleb Smirnoff 		}
34803b3a8eb9SGleb Smirnoff 		;
34813b3a8eb9SGleb Smirnoff 
34823b3a8eb9SGleb Smirnoff keep		: NO STATE			{
34833b3a8eb9SGleb Smirnoff 			$$.action = 0;
34843b3a8eb9SGleb Smirnoff 			$$.options = NULL;
34853b3a8eb9SGleb Smirnoff 		}
34863b3a8eb9SGleb Smirnoff 		| KEEP STATE state_opt_spec	{
34873b3a8eb9SGleb Smirnoff 			$$.action = PF_STATE_NORMAL;
34883b3a8eb9SGleb Smirnoff 			$$.options = $3;
34893b3a8eb9SGleb Smirnoff 		}
34903b3a8eb9SGleb Smirnoff 		| MODULATE STATE state_opt_spec {
34913b3a8eb9SGleb Smirnoff 			$$.action = PF_STATE_MODULATE;
34923b3a8eb9SGleb Smirnoff 			$$.options = $3;
34933b3a8eb9SGleb Smirnoff 		}
34943b3a8eb9SGleb Smirnoff 		| SYNPROXY STATE state_opt_spec {
34953b3a8eb9SGleb Smirnoff 			$$.action = PF_STATE_SYNPROXY;
34963b3a8eb9SGleb Smirnoff 			$$.options = $3;
34973b3a8eb9SGleb Smirnoff 		}
34983b3a8eb9SGleb Smirnoff 		;
34993b3a8eb9SGleb Smirnoff 
35003b3a8eb9SGleb Smirnoff flush		: /* empty */			{ $$ = 0; }
35013b3a8eb9SGleb Smirnoff 		| FLUSH				{ $$ = PF_FLUSH; }
35023b3a8eb9SGleb Smirnoff 		| FLUSH GLOBAL			{
35033b3a8eb9SGleb Smirnoff 			$$ = PF_FLUSH | PF_FLUSH_GLOBAL;
35043b3a8eb9SGleb Smirnoff 		}
35053b3a8eb9SGleb Smirnoff 		;
35063b3a8eb9SGleb Smirnoff 
35073b3a8eb9SGleb Smirnoff state_opt_spec	: '(' state_opt_list ')'	{ $$ = $2; }
35083b3a8eb9SGleb Smirnoff 		| /* empty */			{ $$ = NULL; }
35093b3a8eb9SGleb Smirnoff 		;
35103b3a8eb9SGleb Smirnoff 
35113b3a8eb9SGleb Smirnoff state_opt_list	: state_opt_item		{ $$ = $1; }
35123b3a8eb9SGleb Smirnoff 		| state_opt_list comma state_opt_item {
35133b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
35143b3a8eb9SGleb Smirnoff 			$1->tail = $3;
35153b3a8eb9SGleb Smirnoff 			$$ = $1;
35163b3a8eb9SGleb Smirnoff 		}
35173b3a8eb9SGleb Smirnoff 		;
35183b3a8eb9SGleb Smirnoff 
35193b3a8eb9SGleb Smirnoff state_opt_item	: MAXIMUM NUMBER		{
35203b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
35213b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
35223b3a8eb9SGleb Smirnoff 				YYERROR;
35233b3a8eb9SGleb Smirnoff 			}
35243b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
35253b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35263b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
35273b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX;
35283b3a8eb9SGleb Smirnoff 			$$->data.max_states = $2;
35293b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35303b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35313b3a8eb9SGleb Smirnoff 		}
35323b3a8eb9SGleb Smirnoff 		| NOSYNC				{
35333b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
35343b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35353b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
35363b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_NOSYNC;
35373b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35383b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35393b3a8eb9SGleb Smirnoff 		}
35403b3a8eb9SGleb Smirnoff 		| MAXSRCSTATES NUMBER			{
35413b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
35423b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
35433b3a8eb9SGleb Smirnoff 				YYERROR;
35443b3a8eb9SGleb Smirnoff 			}
35453b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
35463b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35473b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
35483b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_STATES;
35493b3a8eb9SGleb Smirnoff 			$$->data.max_src_states = $2;
35503b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35513b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35523b3a8eb9SGleb Smirnoff 		}
35533b3a8eb9SGleb Smirnoff 		| MAXSRCCONN NUMBER			{
35543b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
35553b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
35563b3a8eb9SGleb Smirnoff 				YYERROR;
35573b3a8eb9SGleb Smirnoff 			}
35583b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
35593b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35603b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
35613b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_CONN;
35623b3a8eb9SGleb Smirnoff 			$$->data.max_src_conn = $2;
35633b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35643b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35653b3a8eb9SGleb Smirnoff 		}
35663b3a8eb9SGleb Smirnoff 		| MAXSRCCONNRATE NUMBER '/' NUMBER	{
35673b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX ||
35683b3a8eb9SGleb Smirnoff 			    $4 < 0 || $4 > UINT_MAX) {
35693b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
35703b3a8eb9SGleb Smirnoff 				YYERROR;
35713b3a8eb9SGleb Smirnoff 			}
35723b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
35733b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35743b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
35753b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
35763b3a8eb9SGleb Smirnoff 			$$->data.max_src_conn_rate.limit = $2;
35773b3a8eb9SGleb Smirnoff 			$$->data.max_src_conn_rate.seconds = $4;
35783b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35793b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35803b3a8eb9SGleb Smirnoff 		}
35813b3a8eb9SGleb Smirnoff 		| OVERLOAD '<' STRING '>' flush		{
35823b3a8eb9SGleb Smirnoff 			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
35833b3a8eb9SGleb Smirnoff 				yyerror("table name '%s' too long", $3);
35843b3a8eb9SGleb Smirnoff 				free($3);
35853b3a8eb9SGleb Smirnoff 				YYERROR;
35863b3a8eb9SGleb Smirnoff 			}
35873b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
35883b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35893b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
35903b3a8eb9SGleb Smirnoff 			if (strlcpy($$->data.overload.tblname, $3,
35913b3a8eb9SGleb Smirnoff 			    PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
35923b3a8eb9SGleb Smirnoff 				errx(1, "state_opt_item: strlcpy");
35933b3a8eb9SGleb Smirnoff 			free($3);
35943b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_OVERLOAD;
35953b3a8eb9SGleb Smirnoff 			$$->data.overload.flush = $5;
35963b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35973b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35983b3a8eb9SGleb Smirnoff 		}
35993b3a8eb9SGleb Smirnoff 		| MAXSRCNODES NUMBER			{
36003b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
36013b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
36023b3a8eb9SGleb Smirnoff 				YYERROR;
36033b3a8eb9SGleb Smirnoff 			}
36043b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
36053b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
36063b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
36073b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_NODES;
36083b3a8eb9SGleb Smirnoff 			$$->data.max_src_nodes = $2;
36093b3a8eb9SGleb Smirnoff 			$$->next = NULL;
36103b3a8eb9SGleb Smirnoff 			$$->tail = $$;
36113b3a8eb9SGleb Smirnoff 		}
36123b3a8eb9SGleb Smirnoff 		| sourcetrack {
36133b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
36143b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
36153b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
36163b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_SRCTRACK;
36173b3a8eb9SGleb Smirnoff 			$$->data.src_track = $1;
36183b3a8eb9SGleb Smirnoff 			$$->next = NULL;
36193b3a8eb9SGleb Smirnoff 			$$->tail = $$;
36203b3a8eb9SGleb Smirnoff 		}
36213b3a8eb9SGleb Smirnoff 		| statelock {
36223b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
36233b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
36243b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
36253b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_STATELOCK;
36263b3a8eb9SGleb Smirnoff 			$$->data.statelock = $1;
36273b3a8eb9SGleb Smirnoff 			$$->next = NULL;
36283b3a8eb9SGleb Smirnoff 			$$->tail = $$;
36293b3a8eb9SGleb Smirnoff 		}
36303b3a8eb9SGleb Smirnoff 		| SLOPPY {
36313b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
36323b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
36333b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
36343b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_SLOPPY;
36353b3a8eb9SGleb Smirnoff 			$$->next = NULL;
36363b3a8eb9SGleb Smirnoff 			$$->tail = $$;
36373b3a8eb9SGleb Smirnoff 		}
36383b3a8eb9SGleb Smirnoff 		| STRING NUMBER			{
36393b3a8eb9SGleb Smirnoff 			int	i;
36403b3a8eb9SGleb Smirnoff 
36413b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
36423b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
36433b3a8eb9SGleb Smirnoff 				YYERROR;
36443b3a8eb9SGleb Smirnoff 			}
36453b3a8eb9SGleb Smirnoff 			for (i = 0; pf_timeouts[i].name &&
36463b3a8eb9SGleb Smirnoff 			    strcmp(pf_timeouts[i].name, $1); ++i)
36473b3a8eb9SGleb Smirnoff 				;	/* nothing */
36483b3a8eb9SGleb Smirnoff 			if (!pf_timeouts[i].name) {
36493b3a8eb9SGleb Smirnoff 				yyerror("illegal timeout name %s", $1);
36503b3a8eb9SGleb Smirnoff 				free($1);
36513b3a8eb9SGleb Smirnoff 				YYERROR;
36523b3a8eb9SGleb Smirnoff 			}
36533b3a8eb9SGleb Smirnoff 			if (strchr(pf_timeouts[i].name, '.') == NULL) {
36543b3a8eb9SGleb Smirnoff 				yyerror("illegal state timeout %s", $1);
36553b3a8eb9SGleb Smirnoff 				free($1);
36563b3a8eb9SGleb Smirnoff 				YYERROR;
36573b3a8eb9SGleb Smirnoff 			}
36583b3a8eb9SGleb Smirnoff 			free($1);
36593b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
36603b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
36613b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
36623b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_TIMEOUT;
36633b3a8eb9SGleb Smirnoff 			$$->data.timeout.number = pf_timeouts[i].timeout;
36643b3a8eb9SGleb Smirnoff 			$$->data.timeout.seconds = $2;
36653b3a8eb9SGleb Smirnoff 			$$->next = NULL;
36663b3a8eb9SGleb Smirnoff 			$$->tail = $$;
36673b3a8eb9SGleb Smirnoff 		}
36683b3a8eb9SGleb Smirnoff 		;
36693b3a8eb9SGleb Smirnoff 
36703b3a8eb9SGleb Smirnoff label		: LABEL STRING			{
36713b3a8eb9SGleb Smirnoff 			$$ = $2;
36723b3a8eb9SGleb Smirnoff 		}
36733b3a8eb9SGleb Smirnoff 		;
36743b3a8eb9SGleb Smirnoff 
36753b3a8eb9SGleb Smirnoff qname		: QUEUE STRING				{
36763b3a8eb9SGleb Smirnoff 			$$.qname = $2;
36773b3a8eb9SGleb Smirnoff 			$$.pqname = NULL;
36783b3a8eb9SGleb Smirnoff 		}
36793b3a8eb9SGleb Smirnoff 		| QUEUE '(' STRING ')'			{
36803b3a8eb9SGleb Smirnoff 			$$.qname = $3;
36813b3a8eb9SGleb Smirnoff 			$$.pqname = NULL;
36823b3a8eb9SGleb Smirnoff 		}
36833b3a8eb9SGleb Smirnoff 		| QUEUE '(' STRING comma STRING ')'	{
36843b3a8eb9SGleb Smirnoff 			$$.qname = $3;
36853b3a8eb9SGleb Smirnoff 			$$.pqname = $5;
36863b3a8eb9SGleb Smirnoff 		}
36873b3a8eb9SGleb Smirnoff 		;
36883b3a8eb9SGleb Smirnoff 
36893b3a8eb9SGleb Smirnoff no		: /* empty */			{ $$ = 0; }
36903b3a8eb9SGleb Smirnoff 		| NO				{ $$ = 1; }
36913b3a8eb9SGleb Smirnoff 		;
36923b3a8eb9SGleb Smirnoff 
36933b3a8eb9SGleb Smirnoff portstar	: numberstring			{
36943b3a8eb9SGleb Smirnoff 			if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) {
36953b3a8eb9SGleb Smirnoff 				free($1);
36963b3a8eb9SGleb Smirnoff 				YYERROR;
36973b3a8eb9SGleb Smirnoff 			}
36983b3a8eb9SGleb Smirnoff 			free($1);
36993b3a8eb9SGleb Smirnoff 		}
37003b3a8eb9SGleb Smirnoff 		;
37013b3a8eb9SGleb Smirnoff 
37023b3a8eb9SGleb Smirnoff redirspec	: host				{ $$ = $1; }
37033b3a8eb9SGleb Smirnoff 		| '{' optnl redir_host_list '}'	{ $$ = $3; }
37043b3a8eb9SGleb Smirnoff 		;
37053b3a8eb9SGleb Smirnoff 
37063b3a8eb9SGleb Smirnoff redir_host_list	: host optnl			{ $$ = $1; }
37073b3a8eb9SGleb Smirnoff 		| redir_host_list comma host optnl {
37083b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
37093b3a8eb9SGleb Smirnoff 			$1->tail = $3->tail;
37103b3a8eb9SGleb Smirnoff 			$$ = $1;
37113b3a8eb9SGleb Smirnoff 		}
37123b3a8eb9SGleb Smirnoff 		;
37133b3a8eb9SGleb Smirnoff 
37143b3a8eb9SGleb Smirnoff redirpool	: /* empty */			{ $$ = NULL; }
37153b3a8eb9SGleb Smirnoff 		| ARROW redirspec		{
37163b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
37173b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37183b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
37193b3a8eb9SGleb Smirnoff 			$$->host = $2;
37203b3a8eb9SGleb Smirnoff 			$$->rport.a = $$->rport.b = $$->rport.t = 0;
37213b3a8eb9SGleb Smirnoff 		}
37223b3a8eb9SGleb Smirnoff 		| ARROW redirspec PORT portstar	{
37233b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
37243b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37253b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
37263b3a8eb9SGleb Smirnoff 			$$->host = $2;
37273b3a8eb9SGleb Smirnoff 			$$->rport = $4;
37283b3a8eb9SGleb Smirnoff 		}
37293b3a8eb9SGleb Smirnoff 		;
37303b3a8eb9SGleb Smirnoff 
37313b3a8eb9SGleb Smirnoff hashkey		: /* empty */
37323b3a8eb9SGleb Smirnoff 		{
37333b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct pf_poolhashkey));
37343b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37353b3a8eb9SGleb Smirnoff 				err(1, "hashkey: calloc");
37363b3a8eb9SGleb Smirnoff 			$$->key32[0] = arc4random();
37373b3a8eb9SGleb Smirnoff 			$$->key32[1] = arc4random();
37383b3a8eb9SGleb Smirnoff 			$$->key32[2] = arc4random();
37393b3a8eb9SGleb Smirnoff 			$$->key32[3] = arc4random();
37403b3a8eb9SGleb Smirnoff 		}
37413b3a8eb9SGleb Smirnoff 		| string
37423b3a8eb9SGleb Smirnoff 		{
37433b3a8eb9SGleb Smirnoff 			if (!strncmp($1, "0x", 2)) {
37443b3a8eb9SGleb Smirnoff 				if (strlen($1) != 34) {
37453b3a8eb9SGleb Smirnoff 					free($1);
37463b3a8eb9SGleb Smirnoff 					yyerror("hex key must be 128 bits "
37473b3a8eb9SGleb Smirnoff 						"(32 hex digits) long");
37483b3a8eb9SGleb Smirnoff 					YYERROR;
37493b3a8eb9SGleb Smirnoff 				}
37503b3a8eb9SGleb Smirnoff 				$$ = calloc(1, sizeof(struct pf_poolhashkey));
37513b3a8eb9SGleb Smirnoff 				if ($$ == NULL)
37523b3a8eb9SGleb Smirnoff 					err(1, "hashkey: calloc");
37533b3a8eb9SGleb Smirnoff 
37543b3a8eb9SGleb Smirnoff 				if (sscanf($1, "0x%8x%8x%8x%8x",
37553b3a8eb9SGleb Smirnoff 				    &$$->key32[0], &$$->key32[1],
37563b3a8eb9SGleb Smirnoff 				    &$$->key32[2], &$$->key32[3]) != 4) {
37573b3a8eb9SGleb Smirnoff 					free($$);
37583b3a8eb9SGleb Smirnoff 					free($1);
37593b3a8eb9SGleb Smirnoff 					yyerror("invalid hex key");
37603b3a8eb9SGleb Smirnoff 					YYERROR;
37613b3a8eb9SGleb Smirnoff 				}
37623b3a8eb9SGleb Smirnoff 			} else {
37633b3a8eb9SGleb Smirnoff 				MD5_CTX	context;
37643b3a8eb9SGleb Smirnoff 
37653b3a8eb9SGleb Smirnoff 				$$ = calloc(1, sizeof(struct pf_poolhashkey));
37663b3a8eb9SGleb Smirnoff 				if ($$ == NULL)
37673b3a8eb9SGleb Smirnoff 					err(1, "hashkey: calloc");
37683b3a8eb9SGleb Smirnoff 				MD5Init(&context);
37693b3a8eb9SGleb Smirnoff 				MD5Update(&context, (unsigned char *)$1,
37703b3a8eb9SGleb Smirnoff 				    strlen($1));
37713b3a8eb9SGleb Smirnoff 				MD5Final((unsigned char *)$$, &context);
37723b3a8eb9SGleb Smirnoff 				HTONL($$->key32[0]);
37733b3a8eb9SGleb Smirnoff 				HTONL($$->key32[1]);
37743b3a8eb9SGleb Smirnoff 				HTONL($$->key32[2]);
37753b3a8eb9SGleb Smirnoff 				HTONL($$->key32[3]);
37763b3a8eb9SGleb Smirnoff 			}
37773b3a8eb9SGleb Smirnoff 			free($1);
37783b3a8eb9SGleb Smirnoff 		}
37793b3a8eb9SGleb Smirnoff 		;
37803b3a8eb9SGleb Smirnoff 
37813b3a8eb9SGleb Smirnoff pool_opts	:	{ bzero(&pool_opts, sizeof pool_opts); }
37823b3a8eb9SGleb Smirnoff 		    pool_opts_l
37833b3a8eb9SGleb Smirnoff 			{ $$ = pool_opts; }
37843b3a8eb9SGleb Smirnoff 		| /* empty */	{
37853b3a8eb9SGleb Smirnoff 			bzero(&pool_opts, sizeof pool_opts);
37863b3a8eb9SGleb Smirnoff 			$$ = pool_opts;
37873b3a8eb9SGleb Smirnoff 		}
37883b3a8eb9SGleb Smirnoff 		;
37893b3a8eb9SGleb Smirnoff 
37903b3a8eb9SGleb Smirnoff pool_opts_l	: pool_opts_l pool_opt
37913b3a8eb9SGleb Smirnoff 		| pool_opt
37923b3a8eb9SGleb Smirnoff 		;
37933b3a8eb9SGleb Smirnoff 
37943b3a8eb9SGleb Smirnoff pool_opt	: BITMASK	{
37953b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
37963b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
37973b3a8eb9SGleb Smirnoff 				YYERROR;
37983b3a8eb9SGleb Smirnoff 			}
37993b3a8eb9SGleb Smirnoff 			pool_opts.type =  PF_POOL_BITMASK;
38003b3a8eb9SGleb Smirnoff 		}
38013b3a8eb9SGleb Smirnoff 		| RANDOM	{
38023b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
38033b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
38043b3a8eb9SGleb Smirnoff 				YYERROR;
38053b3a8eb9SGleb Smirnoff 			}
38063b3a8eb9SGleb Smirnoff 			pool_opts.type = PF_POOL_RANDOM;
38073b3a8eb9SGleb Smirnoff 		}
38083b3a8eb9SGleb Smirnoff 		| SOURCEHASH hashkey {
38093b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
38103b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
38113b3a8eb9SGleb Smirnoff 				YYERROR;
38123b3a8eb9SGleb Smirnoff 			}
38133b3a8eb9SGleb Smirnoff 			pool_opts.type = PF_POOL_SRCHASH;
38143b3a8eb9SGleb Smirnoff 			pool_opts.key = $2;
38153b3a8eb9SGleb Smirnoff 		}
38163b3a8eb9SGleb Smirnoff 		| ROUNDROBIN	{
38173b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
38183b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
38193b3a8eb9SGleb Smirnoff 				YYERROR;
38203b3a8eb9SGleb Smirnoff 			}
38213b3a8eb9SGleb Smirnoff 			pool_opts.type = PF_POOL_ROUNDROBIN;
38223b3a8eb9SGleb Smirnoff 		}
38233b3a8eb9SGleb Smirnoff 		| STATICPORT	{
38243b3a8eb9SGleb Smirnoff 			if (pool_opts.staticport) {
38253b3a8eb9SGleb Smirnoff 				yyerror("static-port cannot be redefined");
38263b3a8eb9SGleb Smirnoff 				YYERROR;
38273b3a8eb9SGleb Smirnoff 			}
38283b3a8eb9SGleb Smirnoff 			pool_opts.staticport = 1;
38293b3a8eb9SGleb Smirnoff 		}
38303b3a8eb9SGleb Smirnoff 		| STICKYADDRESS	{
38313b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & POM_STICKYADDRESS) {
38323b3a8eb9SGleb Smirnoff 				yyerror("sticky-address cannot be redefined");
38333b3a8eb9SGleb Smirnoff 				YYERROR;
38343b3a8eb9SGleb Smirnoff 			}
38353b3a8eb9SGleb Smirnoff 			pool_opts.marker |= POM_STICKYADDRESS;
38363b3a8eb9SGleb Smirnoff 			pool_opts.opts |= PF_POOL_STICKYADDR;
38373b3a8eb9SGleb Smirnoff 		}
38383b3a8eb9SGleb Smirnoff 		;
38393b3a8eb9SGleb Smirnoff 
38403b3a8eb9SGleb Smirnoff redirection	: /* empty */			{ $$ = NULL; }
38413b3a8eb9SGleb Smirnoff 		| ARROW host			{
38423b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
38433b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38443b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
38453b3a8eb9SGleb Smirnoff 			$$->host = $2;
38463b3a8eb9SGleb Smirnoff 			$$->rport.a = $$->rport.b = $$->rport.t = 0;
38473b3a8eb9SGleb Smirnoff 		}
38483b3a8eb9SGleb Smirnoff 		| ARROW host PORT portstar	{
38493b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
38503b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38513b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
38523b3a8eb9SGleb Smirnoff 			$$->host = $2;
38533b3a8eb9SGleb Smirnoff 			$$->rport = $4;
38543b3a8eb9SGleb Smirnoff 		}
38553b3a8eb9SGleb Smirnoff 		;
38563b3a8eb9SGleb Smirnoff 
38573b3a8eb9SGleb Smirnoff natpasslog	: /* empty */	{ $$.b1 = $$.b2 = 0; $$.w2 = 0; }
38583b3a8eb9SGleb Smirnoff 		| PASS		{ $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; }
38593b3a8eb9SGleb Smirnoff 		| PASS log	{ $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; }
38603b3a8eb9SGleb Smirnoff 		| log		{ $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; }
38613b3a8eb9SGleb Smirnoff 		;
38623b3a8eb9SGleb Smirnoff 
38633b3a8eb9SGleb Smirnoff nataction	: no NAT natpasslog {
38643b3a8eb9SGleb Smirnoff 			if ($1 && $3.b1) {
38653b3a8eb9SGleb Smirnoff 				yyerror("\"pass\" not valid with \"no\"");
38663b3a8eb9SGleb Smirnoff 				YYERROR;
38673b3a8eb9SGleb Smirnoff 			}
38683b3a8eb9SGleb Smirnoff 			if ($1)
38693b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NONAT;
38703b3a8eb9SGleb Smirnoff 			else
38713b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NAT;
38723b3a8eb9SGleb Smirnoff 			$$.b2 = $3.b1;
38733b3a8eb9SGleb Smirnoff 			$$.w = $3.b2;
38743b3a8eb9SGleb Smirnoff 			$$.w2 = $3.w2;
38753b3a8eb9SGleb Smirnoff 		}
38763b3a8eb9SGleb Smirnoff 		| no RDR natpasslog {
38773b3a8eb9SGleb Smirnoff 			if ($1 && $3.b1) {
38783b3a8eb9SGleb Smirnoff 				yyerror("\"pass\" not valid with \"no\"");
38793b3a8eb9SGleb Smirnoff 				YYERROR;
38803b3a8eb9SGleb Smirnoff 			}
38813b3a8eb9SGleb Smirnoff 			if ($1)
38823b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NORDR;
38833b3a8eb9SGleb Smirnoff 			else
38843b3a8eb9SGleb Smirnoff 				$$.b1 = PF_RDR;
38853b3a8eb9SGleb Smirnoff 			$$.b2 = $3.b1;
38863b3a8eb9SGleb Smirnoff 			$$.w = $3.b2;
38873b3a8eb9SGleb Smirnoff 			$$.w2 = $3.w2;
38883b3a8eb9SGleb Smirnoff 		}
38893b3a8eb9SGleb Smirnoff 		;
38903b3a8eb9SGleb Smirnoff 
38913b3a8eb9SGleb Smirnoff natrule		: nataction interface af proto fromto tag tagged rtable
38923b3a8eb9SGleb Smirnoff 		    redirpool pool_opts
38933b3a8eb9SGleb Smirnoff 		{
38943b3a8eb9SGleb Smirnoff 			struct pf_rule	r;
38953b3a8eb9SGleb Smirnoff 
38963b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT))
38973b3a8eb9SGleb Smirnoff 				YYERROR;
38983b3a8eb9SGleb Smirnoff 
38993b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
39003b3a8eb9SGleb Smirnoff 
39013b3a8eb9SGleb Smirnoff 			r.action = $1.b1;
39023b3a8eb9SGleb Smirnoff 			r.natpass = $1.b2;
39033b3a8eb9SGleb Smirnoff 			r.log = $1.w;
39043b3a8eb9SGleb Smirnoff 			r.logif = $1.w2;
39053b3a8eb9SGleb Smirnoff 			r.af = $3;
39063b3a8eb9SGleb Smirnoff 
39073b3a8eb9SGleb Smirnoff 			if (!r.af) {
39083b3a8eb9SGleb Smirnoff 				if ($5.src.host && $5.src.host->af &&
39093b3a8eb9SGleb Smirnoff 				    !$5.src.host->ifindex)
39103b3a8eb9SGleb Smirnoff 					r.af = $5.src.host->af;
39113b3a8eb9SGleb Smirnoff 				else if ($5.dst.host && $5.dst.host->af &&
39123b3a8eb9SGleb Smirnoff 				    !$5.dst.host->ifindex)
39133b3a8eb9SGleb Smirnoff 					r.af = $5.dst.host->af;
39143b3a8eb9SGleb Smirnoff 			}
39153b3a8eb9SGleb Smirnoff 
39163b3a8eb9SGleb Smirnoff 			if ($6 != NULL)
39173b3a8eb9SGleb Smirnoff 				if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
39183b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) {
39193b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
39203b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
39213b3a8eb9SGleb Smirnoff 					YYERROR;
39223b3a8eb9SGleb Smirnoff 				}
39233b3a8eb9SGleb Smirnoff 
39243b3a8eb9SGleb Smirnoff 			if ($7.name)
39253b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $7.name,
39263b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
39273b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
39283b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
39293b3a8eb9SGleb Smirnoff 					YYERROR;
39303b3a8eb9SGleb Smirnoff 				}
39313b3a8eb9SGleb Smirnoff 			r.match_tag_not = $7.neg;
39323b3a8eb9SGleb Smirnoff 			r.rtableid = $8;
39333b3a8eb9SGleb Smirnoff 
39343b3a8eb9SGleb Smirnoff 			if (r.action == PF_NONAT || r.action == PF_NORDR) {
39353b3a8eb9SGleb Smirnoff 				if ($9 != NULL) {
39363b3a8eb9SGleb Smirnoff 					yyerror("translation rule with 'no' "
39373b3a8eb9SGleb Smirnoff 					    "does not need '->'");
39383b3a8eb9SGleb Smirnoff 					YYERROR;
39393b3a8eb9SGleb Smirnoff 				}
39403b3a8eb9SGleb Smirnoff 			} else {
39413b3a8eb9SGleb Smirnoff 				if ($9 == NULL || $9->host == NULL) {
39423b3a8eb9SGleb Smirnoff 					yyerror("translation rule requires '-> "
39433b3a8eb9SGleb Smirnoff 					    "address'");
39443b3a8eb9SGleb Smirnoff 					YYERROR;
39453b3a8eb9SGleb Smirnoff 				}
39463b3a8eb9SGleb Smirnoff 				if (!r.af && ! $9->host->ifindex)
39473b3a8eb9SGleb Smirnoff 					r.af = $9->host->af;
39483b3a8eb9SGleb Smirnoff 
39493b3a8eb9SGleb Smirnoff 				remove_invalid_hosts(&$9->host, &r.af);
39503b3a8eb9SGleb Smirnoff 				if (invalid_redirect($9->host, r.af))
39513b3a8eb9SGleb Smirnoff 					YYERROR;
39523b3a8eb9SGleb Smirnoff 				if (check_netmask($9->host, r.af))
39533b3a8eb9SGleb Smirnoff 					YYERROR;
39543b3a8eb9SGleb Smirnoff 
39553b3a8eb9SGleb Smirnoff 				r.rpool.proxy_port[0] = ntohs($9->rport.a);
39563b3a8eb9SGleb Smirnoff 
39573b3a8eb9SGleb Smirnoff 				switch (r.action) {
39583b3a8eb9SGleb Smirnoff 				case PF_RDR:
39593b3a8eb9SGleb Smirnoff 					if (!$9->rport.b && $9->rport.t &&
39603b3a8eb9SGleb Smirnoff 					    $5.dst.port != NULL) {
39613b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
39623b3a8eb9SGleb Smirnoff 						    ntohs($9->rport.a) +
39633b3a8eb9SGleb Smirnoff 						    (ntohs(
39643b3a8eb9SGleb Smirnoff 						    $5.dst.port->port[1]) -
39653b3a8eb9SGleb Smirnoff 						    ntohs(
39663b3a8eb9SGleb Smirnoff 						    $5.dst.port->port[0]));
39673b3a8eb9SGleb Smirnoff 					} else
39683b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
39693b3a8eb9SGleb Smirnoff 						    ntohs($9->rport.b);
39703b3a8eb9SGleb Smirnoff 					break;
39713b3a8eb9SGleb Smirnoff 				case PF_NAT:
39723b3a8eb9SGleb Smirnoff 					r.rpool.proxy_port[1] =
39733b3a8eb9SGleb Smirnoff 					    ntohs($9->rport.b);
39743b3a8eb9SGleb Smirnoff 					if (!r.rpool.proxy_port[0] &&
39753b3a8eb9SGleb Smirnoff 					    !r.rpool.proxy_port[1]) {
39763b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[0] =
39773b3a8eb9SGleb Smirnoff 						    PF_NAT_PROXY_PORT_LOW;
39783b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
39793b3a8eb9SGleb Smirnoff 						    PF_NAT_PROXY_PORT_HIGH;
39803b3a8eb9SGleb Smirnoff 					} else if (!r.rpool.proxy_port[1])
39813b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
39823b3a8eb9SGleb Smirnoff 						    r.rpool.proxy_port[0];
39833b3a8eb9SGleb Smirnoff 					break;
39843b3a8eb9SGleb Smirnoff 				default:
39853b3a8eb9SGleb Smirnoff 					break;
39863b3a8eb9SGleb Smirnoff 				}
39873b3a8eb9SGleb Smirnoff 
39883b3a8eb9SGleb Smirnoff 				r.rpool.opts = $10.type;
39893b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
39903b3a8eb9SGleb Smirnoff 				    PF_POOL_NONE && ($9->host->next != NULL ||
39913b3a8eb9SGleb Smirnoff 				    $9->host->addr.type == PF_ADDR_TABLE ||
39923b3a8eb9SGleb Smirnoff 				    DYNIF_MULTIADDR($9->host->addr)))
39933b3a8eb9SGleb Smirnoff 					r.rpool.opts = PF_POOL_ROUNDROBIN;
39943b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
39953b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
39963b3a8eb9SGleb Smirnoff 				    disallow_table($9->host, "tables are only "
39973b3a8eb9SGleb Smirnoff 				    "supported in round-robin redirection "
39983b3a8eb9SGleb Smirnoff 				    "pools"))
39993b3a8eb9SGleb Smirnoff 					YYERROR;
40003b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
40013b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
40023b3a8eb9SGleb Smirnoff 				    disallow_alias($9->host, "interface (%s) "
40033b3a8eb9SGleb Smirnoff 				    "is only supported in round-robin "
40043b3a8eb9SGleb Smirnoff 				    "redirection pools"))
40053b3a8eb9SGleb Smirnoff 					YYERROR;
40063b3a8eb9SGleb Smirnoff 				if ($9->host->next != NULL) {
40073b3a8eb9SGleb Smirnoff 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
40083b3a8eb9SGleb Smirnoff 					    PF_POOL_ROUNDROBIN) {
40093b3a8eb9SGleb Smirnoff 						yyerror("only round-robin "
40103b3a8eb9SGleb Smirnoff 						    "valid for multiple "
40113b3a8eb9SGleb Smirnoff 						    "redirection addresses");
40123b3a8eb9SGleb Smirnoff 						YYERROR;
40133b3a8eb9SGleb Smirnoff 					}
40143b3a8eb9SGleb Smirnoff 				}
40153b3a8eb9SGleb Smirnoff 			}
40163b3a8eb9SGleb Smirnoff 
40173b3a8eb9SGleb Smirnoff 			if ($10.key != NULL)
40183b3a8eb9SGleb Smirnoff 				memcpy(&r.rpool.key, $10.key,
40193b3a8eb9SGleb Smirnoff 				    sizeof(struct pf_poolhashkey));
40203b3a8eb9SGleb Smirnoff 
40213b3a8eb9SGleb Smirnoff 			 if ($10.opts)
40223b3a8eb9SGleb Smirnoff 				r.rpool.opts |= $10.opts;
40233b3a8eb9SGleb Smirnoff 
40243b3a8eb9SGleb Smirnoff 			if ($10.staticport) {
40253b3a8eb9SGleb Smirnoff 				if (r.action != PF_NAT) {
40263b3a8eb9SGleb Smirnoff 					yyerror("the 'static-port' option is "
40273b3a8eb9SGleb Smirnoff 					    "only valid with nat rules");
40283b3a8eb9SGleb Smirnoff 					YYERROR;
40293b3a8eb9SGleb Smirnoff 				}
40303b3a8eb9SGleb Smirnoff 				if (r.rpool.proxy_port[0] !=
40313b3a8eb9SGleb Smirnoff 				    PF_NAT_PROXY_PORT_LOW &&
40323b3a8eb9SGleb Smirnoff 				    r.rpool.proxy_port[1] !=
40333b3a8eb9SGleb Smirnoff 				    PF_NAT_PROXY_PORT_HIGH) {
40343b3a8eb9SGleb Smirnoff 					yyerror("the 'static-port' option can't"
40353b3a8eb9SGleb Smirnoff 					    " be used when specifying a port"
40363b3a8eb9SGleb Smirnoff 					    " range");
40373b3a8eb9SGleb Smirnoff 					YYERROR;
40383b3a8eb9SGleb Smirnoff 				}
40393b3a8eb9SGleb Smirnoff 				r.rpool.proxy_port[0] = 0;
40403b3a8eb9SGleb Smirnoff 				r.rpool.proxy_port[1] = 0;
40413b3a8eb9SGleb Smirnoff 			}
40423b3a8eb9SGleb Smirnoff 
40433b3a8eb9SGleb Smirnoff 			expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4,
40443b3a8eb9SGleb Smirnoff 			    $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
40453b3a8eb9SGleb Smirnoff 			    $5.dst.port, 0, 0, 0, "");
40463b3a8eb9SGleb Smirnoff 			free($9);
40473b3a8eb9SGleb Smirnoff 		}
40483b3a8eb9SGleb Smirnoff 		;
40493b3a8eb9SGleb Smirnoff 
40503b3a8eb9SGleb Smirnoff binatrule	: no BINAT natpasslog interface af proto FROM host toipspec tag
40513b3a8eb9SGleb Smirnoff 		    tagged rtable redirection
40523b3a8eb9SGleb Smirnoff 		{
40533b3a8eb9SGleb Smirnoff 			struct pf_rule		binat;
40543b3a8eb9SGleb Smirnoff 			struct pf_pooladdr	*pa;
40553b3a8eb9SGleb Smirnoff 
40563b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT))
40573b3a8eb9SGleb Smirnoff 				YYERROR;
40583b3a8eb9SGleb Smirnoff 			if (disallow_urpf_failed($9, "\"urpf-failed\" is not "
40593b3a8eb9SGleb Smirnoff 			    "permitted as a binat destination"))
40603b3a8eb9SGleb Smirnoff 				YYERROR;
40613b3a8eb9SGleb Smirnoff 
40623b3a8eb9SGleb Smirnoff 			memset(&binat, 0, sizeof(binat));
40633b3a8eb9SGleb Smirnoff 
40643b3a8eb9SGleb Smirnoff 			if ($1 && $3.b1) {
40653b3a8eb9SGleb Smirnoff 				yyerror("\"pass\" not valid with \"no\"");
40663b3a8eb9SGleb Smirnoff 				YYERROR;
40673b3a8eb9SGleb Smirnoff 			}
40683b3a8eb9SGleb Smirnoff 			if ($1)
40693b3a8eb9SGleb Smirnoff 				binat.action = PF_NOBINAT;
40703b3a8eb9SGleb Smirnoff 			else
40713b3a8eb9SGleb Smirnoff 				binat.action = PF_BINAT;
40723b3a8eb9SGleb Smirnoff 			binat.natpass = $3.b1;
40733b3a8eb9SGleb Smirnoff 			binat.log = $3.b2;
40743b3a8eb9SGleb Smirnoff 			binat.logif = $3.w2;
40753b3a8eb9SGleb Smirnoff 			binat.af = $5;
40763b3a8eb9SGleb Smirnoff 			if (!binat.af && $8 != NULL && $8->af)
40773b3a8eb9SGleb Smirnoff 				binat.af = $8->af;
40783b3a8eb9SGleb Smirnoff 			if (!binat.af && $9 != NULL && $9->af)
40793b3a8eb9SGleb Smirnoff 				binat.af = $9->af;
40803b3a8eb9SGleb Smirnoff 
40813b3a8eb9SGleb Smirnoff 			if (!binat.af && $13 != NULL && $13->host)
40823b3a8eb9SGleb Smirnoff 				binat.af = $13->host->af;
40833b3a8eb9SGleb Smirnoff 			if (!binat.af) {
40843b3a8eb9SGleb Smirnoff 				yyerror("address family (inet/inet6) "
40853b3a8eb9SGleb Smirnoff 				    "undefined");
40863b3a8eb9SGleb Smirnoff 				YYERROR;
40873b3a8eb9SGleb Smirnoff 			}
40883b3a8eb9SGleb Smirnoff 
40893b3a8eb9SGleb Smirnoff 			if ($4 != NULL) {
40903b3a8eb9SGleb Smirnoff 				memcpy(binat.ifname, $4->ifname,
40913b3a8eb9SGleb Smirnoff 				    sizeof(binat.ifname));
40923b3a8eb9SGleb Smirnoff 				binat.ifnot = $4->not;
40933b3a8eb9SGleb Smirnoff 				free($4);
40943b3a8eb9SGleb Smirnoff 			}
40953b3a8eb9SGleb Smirnoff 
40963b3a8eb9SGleb Smirnoff 			if ($10 != NULL)
40973b3a8eb9SGleb Smirnoff 				if (strlcpy(binat.tagname, $10,
40983b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
40993b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
41003b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
41013b3a8eb9SGleb Smirnoff 					YYERROR;
41023b3a8eb9SGleb Smirnoff 				}
41033b3a8eb9SGleb Smirnoff 			if ($11.name)
41043b3a8eb9SGleb Smirnoff 				if (strlcpy(binat.match_tagname, $11.name,
41053b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
41063b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
41073b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
41083b3a8eb9SGleb Smirnoff 					YYERROR;
41093b3a8eb9SGleb Smirnoff 				}
41103b3a8eb9SGleb Smirnoff 			binat.match_tag_not = $11.neg;
41113b3a8eb9SGleb Smirnoff 			binat.rtableid = $12;
41123b3a8eb9SGleb Smirnoff 
41133b3a8eb9SGleb Smirnoff 			if ($6 != NULL) {
41143b3a8eb9SGleb Smirnoff 				binat.proto = $6->proto;
41153b3a8eb9SGleb Smirnoff 				free($6);
41163b3a8eb9SGleb Smirnoff 			}
41173b3a8eb9SGleb Smirnoff 
41183b3a8eb9SGleb Smirnoff 			if ($8 != NULL && disallow_table($8, "invalid use of "
41193b3a8eb9SGleb Smirnoff 			    "table <%s> as the source address of a binat rule"))
41203b3a8eb9SGleb Smirnoff 				YYERROR;
41213b3a8eb9SGleb Smirnoff 			if ($8 != NULL && disallow_alias($8, "invalid use of "
41223b3a8eb9SGleb Smirnoff 			    "interface (%s) as the source address of a binat "
41233b3a8eb9SGleb Smirnoff 			    "rule"))
41243b3a8eb9SGleb Smirnoff 				YYERROR;
41253b3a8eb9SGleb Smirnoff 			if ($13 != NULL && $13->host != NULL && disallow_table(
41263b3a8eb9SGleb Smirnoff 			    $13->host, "invalid use of table <%s> as the "
41273b3a8eb9SGleb Smirnoff 			    "redirect address of a binat rule"))
41283b3a8eb9SGleb Smirnoff 				YYERROR;
41293b3a8eb9SGleb Smirnoff 			if ($13 != NULL && $13->host != NULL && disallow_alias(
41303b3a8eb9SGleb Smirnoff 			    $13->host, "invalid use of interface (%s) as the "
41313b3a8eb9SGleb Smirnoff 			    "redirect address of a binat rule"))
41323b3a8eb9SGleb Smirnoff 				YYERROR;
41333b3a8eb9SGleb Smirnoff 
41343b3a8eb9SGleb Smirnoff 			if ($8 != NULL) {
41353b3a8eb9SGleb Smirnoff 				if ($8->next) {
41363b3a8eb9SGleb Smirnoff 					yyerror("multiple binat ip addresses");
41373b3a8eb9SGleb Smirnoff 					YYERROR;
41383b3a8eb9SGleb Smirnoff 				}
41393b3a8eb9SGleb Smirnoff 				if ($8->addr.type == PF_ADDR_DYNIFTL)
41403b3a8eb9SGleb Smirnoff 					$8->af = binat.af;
41413b3a8eb9SGleb Smirnoff 				if ($8->af != binat.af) {
41423b3a8eb9SGleb Smirnoff 					yyerror("binat ip versions must match");
41433b3a8eb9SGleb Smirnoff 					YYERROR;
41443b3a8eb9SGleb Smirnoff 				}
41453b3a8eb9SGleb Smirnoff 				if (check_netmask($8, binat.af))
41463b3a8eb9SGleb Smirnoff 					YYERROR;
41473b3a8eb9SGleb Smirnoff 				memcpy(&binat.src.addr, &$8->addr,
41483b3a8eb9SGleb Smirnoff 				    sizeof(binat.src.addr));
41493b3a8eb9SGleb Smirnoff 				free($8);
41503b3a8eb9SGleb Smirnoff 			}
41513b3a8eb9SGleb Smirnoff 			if ($9 != NULL) {
41523b3a8eb9SGleb Smirnoff 				if ($9->next) {
41533b3a8eb9SGleb Smirnoff 					yyerror("multiple binat ip addresses");
41543b3a8eb9SGleb Smirnoff 					YYERROR;
41553b3a8eb9SGleb Smirnoff 				}
41563b3a8eb9SGleb Smirnoff 				if ($9->af != binat.af && $9->af) {
41573b3a8eb9SGleb Smirnoff 					yyerror("binat ip versions must match");
41583b3a8eb9SGleb Smirnoff 					YYERROR;
41593b3a8eb9SGleb Smirnoff 				}
41603b3a8eb9SGleb Smirnoff 				if (check_netmask($9, binat.af))
41613b3a8eb9SGleb Smirnoff 					YYERROR;
41623b3a8eb9SGleb Smirnoff 				memcpy(&binat.dst.addr, &$9->addr,
41633b3a8eb9SGleb Smirnoff 				    sizeof(binat.dst.addr));
41643b3a8eb9SGleb Smirnoff 				binat.dst.neg = $9->not;
41653b3a8eb9SGleb Smirnoff 				free($9);
41663b3a8eb9SGleb Smirnoff 			}
41673b3a8eb9SGleb Smirnoff 
41683b3a8eb9SGleb Smirnoff 			if (binat.action == PF_NOBINAT) {
41693b3a8eb9SGleb Smirnoff 				if ($13 != NULL) {
41703b3a8eb9SGleb Smirnoff 					yyerror("'no binat' rule does not need"
41713b3a8eb9SGleb Smirnoff 					    " '->'");
41723b3a8eb9SGleb Smirnoff 					YYERROR;
41733b3a8eb9SGleb Smirnoff 				}
41743b3a8eb9SGleb Smirnoff 			} else {
41753b3a8eb9SGleb Smirnoff 				if ($13 == NULL || $13->host == NULL) {
41763b3a8eb9SGleb Smirnoff 					yyerror("'binat' rule requires"
41773b3a8eb9SGleb Smirnoff 					    " '-> address'");
41783b3a8eb9SGleb Smirnoff 					YYERROR;
41793b3a8eb9SGleb Smirnoff 				}
41803b3a8eb9SGleb Smirnoff 
41813b3a8eb9SGleb Smirnoff 				remove_invalid_hosts(&$13->host, &binat.af);
41823b3a8eb9SGleb Smirnoff 				if (invalid_redirect($13->host, binat.af))
41833b3a8eb9SGleb Smirnoff 					YYERROR;
41843b3a8eb9SGleb Smirnoff 				if ($13->host->next != NULL) {
41853b3a8eb9SGleb Smirnoff 					yyerror("binat rule must redirect to "
41863b3a8eb9SGleb Smirnoff 					    "a single address");
41873b3a8eb9SGleb Smirnoff 					YYERROR;
41883b3a8eb9SGleb Smirnoff 				}
41893b3a8eb9SGleb Smirnoff 				if (check_netmask($13->host, binat.af))
41903b3a8eb9SGleb Smirnoff 					YYERROR;
41913b3a8eb9SGleb Smirnoff 
41923b3a8eb9SGleb Smirnoff 				if (!PF_AZERO(&binat.src.addr.v.a.mask,
41933b3a8eb9SGleb Smirnoff 				    binat.af) &&
41943b3a8eb9SGleb Smirnoff 				    !PF_AEQ(&binat.src.addr.v.a.mask,
41953b3a8eb9SGleb Smirnoff 				    &$13->host->addr.v.a.mask, binat.af)) {
41963b3a8eb9SGleb Smirnoff 					yyerror("'binat' source mask and "
41973b3a8eb9SGleb Smirnoff 					    "redirect mask must be the same");
41983b3a8eb9SGleb Smirnoff 					YYERROR;
41993b3a8eb9SGleb Smirnoff 				}
42003b3a8eb9SGleb Smirnoff 
42013b3a8eb9SGleb Smirnoff 				TAILQ_INIT(&binat.rpool.list);
42023b3a8eb9SGleb Smirnoff 				pa = calloc(1, sizeof(struct pf_pooladdr));
42033b3a8eb9SGleb Smirnoff 				if (pa == NULL)
42043b3a8eb9SGleb Smirnoff 					err(1, "binat: calloc");
42053b3a8eb9SGleb Smirnoff 				pa->addr = $13->host->addr;
42063b3a8eb9SGleb Smirnoff 				pa->ifname[0] = 0;
42073b3a8eb9SGleb Smirnoff 				TAILQ_INSERT_TAIL(&binat.rpool.list,
42083b3a8eb9SGleb Smirnoff 				    pa, entries);
42093b3a8eb9SGleb Smirnoff 
42103b3a8eb9SGleb Smirnoff 				free($13);
42113b3a8eb9SGleb Smirnoff 			}
42123b3a8eb9SGleb Smirnoff 
42133b3a8eb9SGleb Smirnoff 			pfctl_add_rule(pf, &binat, "");
42143b3a8eb9SGleb Smirnoff 		}
42153b3a8eb9SGleb Smirnoff 		;
42163b3a8eb9SGleb Smirnoff 
42173b3a8eb9SGleb Smirnoff tag		: /* empty */		{ $$ = NULL; }
42183b3a8eb9SGleb Smirnoff 		| TAG STRING		{ $$ = $2; }
42193b3a8eb9SGleb Smirnoff 		;
42203b3a8eb9SGleb Smirnoff 
42213b3a8eb9SGleb Smirnoff tagged		: /* empty */		{ $$.neg = 0; $$.name = NULL; }
42223b3a8eb9SGleb Smirnoff 		| not TAGGED string	{ $$.neg = $1; $$.name = $3; }
42233b3a8eb9SGleb Smirnoff 		;
42243b3a8eb9SGleb Smirnoff 
42253b3a8eb9SGleb Smirnoff rtable		: /* empty */		{ $$ = -1; }
42263b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER		{
42273b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
42283b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
42293b3a8eb9SGleb Smirnoff 				YYERROR;
42303b3a8eb9SGleb Smirnoff 			}
42313b3a8eb9SGleb Smirnoff 			$$ = $2;
42323b3a8eb9SGleb Smirnoff 		}
42333b3a8eb9SGleb Smirnoff 		;
42343b3a8eb9SGleb Smirnoff 
42353b3a8eb9SGleb Smirnoff route_host	: STRING			{
42363b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
42373b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
42383b3a8eb9SGleb Smirnoff 				err(1, "route_host: calloc");
42393b3a8eb9SGleb Smirnoff 			$$->ifname = $1;
42403b3a8eb9SGleb Smirnoff 			set_ipmask($$, 128);
42413b3a8eb9SGleb Smirnoff 			$$->next = NULL;
42423b3a8eb9SGleb Smirnoff 			$$->tail = $$;
42433b3a8eb9SGleb Smirnoff 		}
42443b3a8eb9SGleb Smirnoff 		| '(' STRING host ')'		{
42453b3a8eb9SGleb Smirnoff 			$$ = $3;
42463b3a8eb9SGleb Smirnoff 			$$->ifname = $2;
42473b3a8eb9SGleb Smirnoff 		}
42483b3a8eb9SGleb Smirnoff 		;
42493b3a8eb9SGleb Smirnoff 
42503b3a8eb9SGleb Smirnoff route_host_list	: route_host optnl			{ $$ = $1; }
42513b3a8eb9SGleb Smirnoff 		| route_host_list comma route_host optnl {
42523b3a8eb9SGleb Smirnoff 			if ($1->af == 0)
42533b3a8eb9SGleb Smirnoff 				$1->af = $3->af;
42543b3a8eb9SGleb Smirnoff 			if ($1->af != $3->af) {
42553b3a8eb9SGleb Smirnoff 				yyerror("all pool addresses must be in the "
42563b3a8eb9SGleb Smirnoff 				    "same address family");
42573b3a8eb9SGleb Smirnoff 				YYERROR;
42583b3a8eb9SGleb Smirnoff 			}
42593b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
42603b3a8eb9SGleb Smirnoff 			$1->tail = $3->tail;
42613b3a8eb9SGleb Smirnoff 			$$ = $1;
42623b3a8eb9SGleb Smirnoff 		}
42633b3a8eb9SGleb Smirnoff 		;
42643b3a8eb9SGleb Smirnoff 
42653b3a8eb9SGleb Smirnoff routespec	: route_host			{ $$ = $1; }
42663b3a8eb9SGleb Smirnoff 		| '{' optnl route_host_list '}'	{ $$ = $3; }
42673b3a8eb9SGleb Smirnoff 		;
42683b3a8eb9SGleb Smirnoff 
42693b3a8eb9SGleb Smirnoff route		: /* empty */			{
42703b3a8eb9SGleb Smirnoff 			$$.host = NULL;
42713b3a8eb9SGleb Smirnoff 			$$.rt = 0;
42723b3a8eb9SGleb Smirnoff 			$$.pool_opts = 0;
42733b3a8eb9SGleb Smirnoff 		}
42743b3a8eb9SGleb Smirnoff 		| FASTROUTE {
42753b3a8eb9SGleb Smirnoff 			$$.host = NULL;
42763b3a8eb9SGleb Smirnoff 			$$.rt = PF_FASTROUTE;
42773b3a8eb9SGleb Smirnoff 			$$.pool_opts = 0;
42783b3a8eb9SGleb Smirnoff 		}
42793b3a8eb9SGleb Smirnoff 		| ROUTETO routespec pool_opts {
42803b3a8eb9SGleb Smirnoff 			$$.host = $2;
42813b3a8eb9SGleb Smirnoff 			$$.rt = PF_ROUTETO;
42823b3a8eb9SGleb Smirnoff 			$$.pool_opts = $3.type | $3.opts;
42833b3a8eb9SGleb Smirnoff 			if ($3.key != NULL)
42843b3a8eb9SGleb Smirnoff 				$$.key = $3.key;
42853b3a8eb9SGleb Smirnoff 		}
42863b3a8eb9SGleb Smirnoff 		| REPLYTO routespec pool_opts {
42873b3a8eb9SGleb Smirnoff 			$$.host = $2;
42883b3a8eb9SGleb Smirnoff 			$$.rt = PF_REPLYTO;
42893b3a8eb9SGleb Smirnoff 			$$.pool_opts = $3.type | $3.opts;
42903b3a8eb9SGleb Smirnoff 			if ($3.key != NULL)
42913b3a8eb9SGleb Smirnoff 				$$.key = $3.key;
42923b3a8eb9SGleb Smirnoff 		}
42933b3a8eb9SGleb Smirnoff 		| DUPTO routespec pool_opts {
42943b3a8eb9SGleb Smirnoff 			$$.host = $2;
42953b3a8eb9SGleb Smirnoff 			$$.rt = PF_DUPTO;
42963b3a8eb9SGleb Smirnoff 			$$.pool_opts = $3.type | $3.opts;
42973b3a8eb9SGleb Smirnoff 			if ($3.key != NULL)
42983b3a8eb9SGleb Smirnoff 				$$.key = $3.key;
42993b3a8eb9SGleb Smirnoff 		}
43003b3a8eb9SGleb Smirnoff 		;
43013b3a8eb9SGleb Smirnoff 
43023b3a8eb9SGleb Smirnoff timeout_spec	: STRING NUMBER
43033b3a8eb9SGleb Smirnoff 		{
43043b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
43053b3a8eb9SGleb Smirnoff 				free($1);
43063b3a8eb9SGleb Smirnoff 				YYERROR;
43073b3a8eb9SGleb Smirnoff 			}
43083b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
43093b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
43103b3a8eb9SGleb Smirnoff 				YYERROR;
43113b3a8eb9SGleb Smirnoff 			}
43123b3a8eb9SGleb Smirnoff 			if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
43133b3a8eb9SGleb Smirnoff 				yyerror("unknown timeout %s", $1);
43143b3a8eb9SGleb Smirnoff 				free($1);
43153b3a8eb9SGleb Smirnoff 				YYERROR;
43163b3a8eb9SGleb Smirnoff 			}
43173b3a8eb9SGleb Smirnoff 			free($1);
43183b3a8eb9SGleb Smirnoff 		}
43193b3a8eb9SGleb Smirnoff 		;
43203b3a8eb9SGleb Smirnoff 
43213b3a8eb9SGleb Smirnoff timeout_list	: timeout_list comma timeout_spec optnl
43223b3a8eb9SGleb Smirnoff 		| timeout_spec optnl
43233b3a8eb9SGleb Smirnoff 		;
43243b3a8eb9SGleb Smirnoff 
43253b3a8eb9SGleb Smirnoff limit_spec	: STRING NUMBER
43263b3a8eb9SGleb Smirnoff 		{
43273b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
43283b3a8eb9SGleb Smirnoff 				free($1);
43293b3a8eb9SGleb Smirnoff 				YYERROR;
43303b3a8eb9SGleb Smirnoff 			}
43313b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
43323b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
43333b3a8eb9SGleb Smirnoff 				YYERROR;
43343b3a8eb9SGleb Smirnoff 			}
43353b3a8eb9SGleb Smirnoff 			if (pfctl_set_limit(pf, $1, $2) != 0) {
43363b3a8eb9SGleb Smirnoff 				yyerror("unable to set limit %s %u", $1, $2);
43373b3a8eb9SGleb Smirnoff 				free($1);
43383b3a8eb9SGleb Smirnoff 				YYERROR;
43393b3a8eb9SGleb Smirnoff 			}
43403b3a8eb9SGleb Smirnoff 			free($1);
43413b3a8eb9SGleb Smirnoff 		}
43423b3a8eb9SGleb Smirnoff 		;
43433b3a8eb9SGleb Smirnoff 
43443b3a8eb9SGleb Smirnoff limit_list	: limit_list comma limit_spec optnl
43453b3a8eb9SGleb Smirnoff 		| limit_spec optnl
43463b3a8eb9SGleb Smirnoff 		;
43473b3a8eb9SGleb Smirnoff 
43483b3a8eb9SGleb Smirnoff comma		: ','
43493b3a8eb9SGleb Smirnoff 		| /* empty */
43503b3a8eb9SGleb Smirnoff 		;
43513b3a8eb9SGleb Smirnoff 
43523b3a8eb9SGleb Smirnoff yesno		: NO			{ $$ = 0; }
43533b3a8eb9SGleb Smirnoff 		| STRING		{
43543b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "yes"))
43553b3a8eb9SGleb Smirnoff 				$$ = 1;
43563b3a8eb9SGleb Smirnoff 			else {
43573b3a8eb9SGleb Smirnoff 				yyerror("invalid value '%s', expected 'yes' "
43583b3a8eb9SGleb Smirnoff 				    "or 'no'", $1);
43593b3a8eb9SGleb Smirnoff 				free($1);
43603b3a8eb9SGleb Smirnoff 				YYERROR;
43613b3a8eb9SGleb Smirnoff 			}
43623b3a8eb9SGleb Smirnoff 			free($1);
43633b3a8eb9SGleb Smirnoff 		}
43643b3a8eb9SGleb Smirnoff 		;
43653b3a8eb9SGleb Smirnoff 
43663b3a8eb9SGleb Smirnoff unaryop		: '='		{ $$ = PF_OP_EQ; }
43673b3a8eb9SGleb Smirnoff 		| '!' '='	{ $$ = PF_OP_NE; }
43683b3a8eb9SGleb Smirnoff 		| '<' '='	{ $$ = PF_OP_LE; }
43693b3a8eb9SGleb Smirnoff 		| '<'		{ $$ = PF_OP_LT; }
43703b3a8eb9SGleb Smirnoff 		| '>' '='	{ $$ = PF_OP_GE; }
43713b3a8eb9SGleb Smirnoff 		| '>'		{ $$ = PF_OP_GT; }
43723b3a8eb9SGleb Smirnoff 		;
43733b3a8eb9SGleb Smirnoff 
43743b3a8eb9SGleb Smirnoff %%
43753b3a8eb9SGleb Smirnoff 
43763b3a8eb9SGleb Smirnoff int
43773b3a8eb9SGleb Smirnoff yyerror(const char *fmt, ...)
43783b3a8eb9SGleb Smirnoff {
43793b3a8eb9SGleb Smirnoff 	va_list		 ap;
43803b3a8eb9SGleb Smirnoff 
43813b3a8eb9SGleb Smirnoff 	file->errors++;
43823b3a8eb9SGleb Smirnoff 	va_start(ap, fmt);
43833b3a8eb9SGleb Smirnoff 	fprintf(stderr, "%s:%d: ", file->name, yylval.lineno);
43843b3a8eb9SGleb Smirnoff 	vfprintf(stderr, fmt, ap);
43853b3a8eb9SGleb Smirnoff 	fprintf(stderr, "\n");
43863b3a8eb9SGleb Smirnoff 	va_end(ap);
43873b3a8eb9SGleb Smirnoff 	return (0);
43883b3a8eb9SGleb Smirnoff }
43893b3a8eb9SGleb Smirnoff 
43903b3a8eb9SGleb Smirnoff int
43913b3a8eb9SGleb Smirnoff disallow_table(struct node_host *h, const char *fmt)
43923b3a8eb9SGleb Smirnoff {
43933b3a8eb9SGleb Smirnoff 	for (; h != NULL; h = h->next)
43943b3a8eb9SGleb Smirnoff 		if (h->addr.type == PF_ADDR_TABLE) {
43953b3a8eb9SGleb Smirnoff 			yyerror(fmt, h->addr.v.tblname);
43963b3a8eb9SGleb Smirnoff 			return (1);
43973b3a8eb9SGleb Smirnoff 		}
43983b3a8eb9SGleb Smirnoff 	return (0);
43993b3a8eb9SGleb Smirnoff }
44003b3a8eb9SGleb Smirnoff 
44013b3a8eb9SGleb Smirnoff int
44023b3a8eb9SGleb Smirnoff disallow_urpf_failed(struct node_host *h, const char *fmt)
44033b3a8eb9SGleb Smirnoff {
44043b3a8eb9SGleb Smirnoff 	for (; h != NULL; h = h->next)
44053b3a8eb9SGleb Smirnoff 		if (h->addr.type == PF_ADDR_URPFFAILED) {
44063b3a8eb9SGleb Smirnoff 			yyerror(fmt);
44073b3a8eb9SGleb Smirnoff 			return (1);
44083b3a8eb9SGleb Smirnoff 		}
44093b3a8eb9SGleb Smirnoff 	return (0);
44103b3a8eb9SGleb Smirnoff }
44113b3a8eb9SGleb Smirnoff 
44123b3a8eb9SGleb Smirnoff int
44133b3a8eb9SGleb Smirnoff disallow_alias(struct node_host *h, const char *fmt)
44143b3a8eb9SGleb Smirnoff {
44153b3a8eb9SGleb Smirnoff 	for (; h != NULL; h = h->next)
44163b3a8eb9SGleb Smirnoff 		if (DYNIF_MULTIADDR(h->addr)) {
44173b3a8eb9SGleb Smirnoff 			yyerror(fmt, h->addr.v.tblname);
44183b3a8eb9SGleb Smirnoff 			return (1);
44193b3a8eb9SGleb Smirnoff 		}
44203b3a8eb9SGleb Smirnoff 	return (0);
44213b3a8eb9SGleb Smirnoff }
44223b3a8eb9SGleb Smirnoff 
44233b3a8eb9SGleb Smirnoff int
44243b3a8eb9SGleb Smirnoff rule_consistent(struct pf_rule *r, int anchor_call)
44253b3a8eb9SGleb Smirnoff {
44263b3a8eb9SGleb Smirnoff 	int	problems = 0;
44273b3a8eb9SGleb Smirnoff 
44283b3a8eb9SGleb Smirnoff 	switch (r->action) {
44293b3a8eb9SGleb Smirnoff 	case PF_PASS:
44303b3a8eb9SGleb Smirnoff 	case PF_DROP:
44313b3a8eb9SGleb Smirnoff 	case PF_SCRUB:
44323b3a8eb9SGleb Smirnoff 	case PF_NOSCRUB:
44333b3a8eb9SGleb Smirnoff 		problems = filter_consistent(r, anchor_call);
44343b3a8eb9SGleb Smirnoff 		break;
44353b3a8eb9SGleb Smirnoff 	case PF_NAT:
44363b3a8eb9SGleb Smirnoff 	case PF_NONAT:
44373b3a8eb9SGleb Smirnoff 		problems = nat_consistent(r);
44383b3a8eb9SGleb Smirnoff 		break;
44393b3a8eb9SGleb Smirnoff 	case PF_RDR:
44403b3a8eb9SGleb Smirnoff 	case PF_NORDR:
44413b3a8eb9SGleb Smirnoff 		problems = rdr_consistent(r);
44423b3a8eb9SGleb Smirnoff 		break;
44433b3a8eb9SGleb Smirnoff 	case PF_BINAT:
44443b3a8eb9SGleb Smirnoff 	case PF_NOBINAT:
44453b3a8eb9SGleb Smirnoff 	default:
44463b3a8eb9SGleb Smirnoff 		break;
44473b3a8eb9SGleb Smirnoff 	}
44483b3a8eb9SGleb Smirnoff 	return (problems);
44493b3a8eb9SGleb Smirnoff }
44503b3a8eb9SGleb Smirnoff 
44513b3a8eb9SGleb Smirnoff int
44523b3a8eb9SGleb Smirnoff filter_consistent(struct pf_rule *r, int anchor_call)
44533b3a8eb9SGleb Smirnoff {
44543b3a8eb9SGleb Smirnoff 	int	problems = 0;
44553b3a8eb9SGleb Smirnoff 
44563b3a8eb9SGleb Smirnoff 	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
44573b3a8eb9SGleb Smirnoff 	    (r->src.port_op || r->dst.port_op)) {
44583b3a8eb9SGleb Smirnoff 		yyerror("port only applies to tcp/udp");
44593b3a8eb9SGleb Smirnoff 		problems++;
44603b3a8eb9SGleb Smirnoff 	}
44613b3a8eb9SGleb Smirnoff 	if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
44623b3a8eb9SGleb Smirnoff 	    (r->type || r->code)) {
44633b3a8eb9SGleb Smirnoff 		yyerror("icmp-type/code only applies to icmp");
44643b3a8eb9SGleb Smirnoff 		problems++;
44653b3a8eb9SGleb Smirnoff 	}
44663b3a8eb9SGleb Smirnoff 	if (!r->af && (r->type || r->code)) {
44673b3a8eb9SGleb Smirnoff 		yyerror("must indicate address family with icmp-type/code");
44683b3a8eb9SGleb Smirnoff 		problems++;
44693b3a8eb9SGleb Smirnoff 	}
44703b3a8eb9SGleb Smirnoff 	if (r->overload_tblname[0] &&
44713b3a8eb9SGleb Smirnoff 	    r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
44723b3a8eb9SGleb Smirnoff 		yyerror("'overload' requires 'max-src-conn' "
44733b3a8eb9SGleb Smirnoff 		    "or 'max-src-conn-rate'");
44743b3a8eb9SGleb Smirnoff 		problems++;
44753b3a8eb9SGleb Smirnoff 	}
44763b3a8eb9SGleb Smirnoff 	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
44773b3a8eb9SGleb Smirnoff 	    (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
44783b3a8eb9SGleb Smirnoff 		yyerror("proto %s doesn't match address family %s",
44793b3a8eb9SGleb Smirnoff 		    r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
44803b3a8eb9SGleb Smirnoff 		    r->af == AF_INET ? "inet" : "inet6");
44813b3a8eb9SGleb Smirnoff 		problems++;
44823b3a8eb9SGleb Smirnoff 	}
44833b3a8eb9SGleb Smirnoff 	if (r->allow_opts && r->action != PF_PASS) {
44843b3a8eb9SGleb Smirnoff 		yyerror("allow-opts can only be specified for pass rules");
44853b3a8eb9SGleb Smirnoff 		problems++;
44863b3a8eb9SGleb Smirnoff 	}
44873b3a8eb9SGleb Smirnoff 	if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
44883b3a8eb9SGleb Smirnoff 	    r->dst.port_op || r->flagset || r->type || r->code)) {
44893b3a8eb9SGleb Smirnoff 		yyerror("fragments can be filtered only on IP header fields");
44903b3a8eb9SGleb Smirnoff 		problems++;
44913b3a8eb9SGleb Smirnoff 	}
44923b3a8eb9SGleb Smirnoff 	if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
44933b3a8eb9SGleb Smirnoff 		yyerror("return-rst can only be applied to TCP rules");
44943b3a8eb9SGleb Smirnoff 		problems++;
44953b3a8eb9SGleb Smirnoff 	}
44963b3a8eb9SGleb Smirnoff 	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
44973b3a8eb9SGleb Smirnoff 		yyerror("max-src-nodes requires 'source-track rule'");
44983b3a8eb9SGleb Smirnoff 		problems++;
44993b3a8eb9SGleb Smirnoff 	}
45003b3a8eb9SGleb Smirnoff 	if (r->action == PF_DROP && r->keep_state) {
45013b3a8eb9SGleb Smirnoff 		yyerror("keep state on block rules doesn't make sense");
45023b3a8eb9SGleb Smirnoff 		problems++;
45033b3a8eb9SGleb Smirnoff 	}
45043b3a8eb9SGleb Smirnoff 	if (r->rule_flag & PFRULE_STATESLOPPY &&
45053b3a8eb9SGleb Smirnoff 	    (r->keep_state == PF_STATE_MODULATE ||
45063b3a8eb9SGleb Smirnoff 	    r->keep_state == PF_STATE_SYNPROXY)) {
45073b3a8eb9SGleb Smirnoff 		yyerror("sloppy state matching cannot be used with "
45083b3a8eb9SGleb Smirnoff 		    "synproxy state or modulate state");
45093b3a8eb9SGleb Smirnoff 		problems++;
45103b3a8eb9SGleb Smirnoff 	}
45113b3a8eb9SGleb Smirnoff 	return (-problems);
45123b3a8eb9SGleb Smirnoff }
45133b3a8eb9SGleb Smirnoff 
45143b3a8eb9SGleb Smirnoff int
45153b3a8eb9SGleb Smirnoff nat_consistent(struct pf_rule *r)
45163b3a8eb9SGleb Smirnoff {
45173b3a8eb9SGleb Smirnoff 	return (0);	/* yeah! */
45183b3a8eb9SGleb Smirnoff }
45193b3a8eb9SGleb Smirnoff 
45203b3a8eb9SGleb Smirnoff int
45213b3a8eb9SGleb Smirnoff rdr_consistent(struct pf_rule *r)
45223b3a8eb9SGleb Smirnoff {
45233b3a8eb9SGleb Smirnoff 	int			 problems = 0;
45243b3a8eb9SGleb Smirnoff 
45253b3a8eb9SGleb Smirnoff 	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
45263b3a8eb9SGleb Smirnoff 		if (r->src.port_op) {
45273b3a8eb9SGleb Smirnoff 			yyerror("src port only applies to tcp/udp");
45283b3a8eb9SGleb Smirnoff 			problems++;
45293b3a8eb9SGleb Smirnoff 		}
45303b3a8eb9SGleb Smirnoff 		if (r->dst.port_op) {
45313b3a8eb9SGleb Smirnoff 			yyerror("dst port only applies to tcp/udp");
45323b3a8eb9SGleb Smirnoff 			problems++;
45333b3a8eb9SGleb Smirnoff 		}
45343b3a8eb9SGleb Smirnoff 		if (r->rpool.proxy_port[0]) {
45353b3a8eb9SGleb Smirnoff 			yyerror("rpool port only applies to tcp/udp");
45363b3a8eb9SGleb Smirnoff 			problems++;
45373b3a8eb9SGleb Smirnoff 		}
45383b3a8eb9SGleb Smirnoff 	}
45393b3a8eb9SGleb Smirnoff 	if (r->dst.port_op &&
45403b3a8eb9SGleb Smirnoff 	    r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
45413b3a8eb9SGleb Smirnoff 		yyerror("invalid port operator for rdr destination port");
45423b3a8eb9SGleb Smirnoff 		problems++;
45433b3a8eb9SGleb Smirnoff 	}
45443b3a8eb9SGleb Smirnoff 	return (-problems);
45453b3a8eb9SGleb Smirnoff }
45463b3a8eb9SGleb Smirnoff 
45473b3a8eb9SGleb Smirnoff int
45483b3a8eb9SGleb Smirnoff process_tabledef(char *name, struct table_opts *opts)
45493b3a8eb9SGleb Smirnoff {
45503b3a8eb9SGleb Smirnoff 	struct pfr_buffer	 ab;
45513b3a8eb9SGleb Smirnoff 	struct node_tinit	*ti;
45523b3a8eb9SGleb Smirnoff 
45533b3a8eb9SGleb Smirnoff 	bzero(&ab, sizeof(ab));
45543b3a8eb9SGleb Smirnoff 	ab.pfrb_type = PFRB_ADDRS;
45553b3a8eb9SGleb Smirnoff 	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
45563b3a8eb9SGleb Smirnoff 		if (ti->file)
45573b3a8eb9SGleb Smirnoff 			if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
45583b3a8eb9SGleb Smirnoff 				if (errno)
45593b3a8eb9SGleb Smirnoff 					yyerror("cannot load \"%s\": %s",
45603b3a8eb9SGleb Smirnoff 					    ti->file, strerror(errno));
45613b3a8eb9SGleb Smirnoff 				else
45623b3a8eb9SGleb Smirnoff 					yyerror("file \"%s\" contains bad data",
45633b3a8eb9SGleb Smirnoff 					    ti->file);
45643b3a8eb9SGleb Smirnoff 				goto _error;
45653b3a8eb9SGleb Smirnoff 			}
45663b3a8eb9SGleb Smirnoff 		if (ti->host)
45673b3a8eb9SGleb Smirnoff 			if (append_addr_host(&ab, ti->host, 0, 0)) {
45683b3a8eb9SGleb Smirnoff 				yyerror("cannot create address buffer: %s",
45693b3a8eb9SGleb Smirnoff 				    strerror(errno));
45703b3a8eb9SGleb Smirnoff 				goto _error;
45713b3a8eb9SGleb Smirnoff 			}
45723b3a8eb9SGleb Smirnoff 	}
45733b3a8eb9SGleb Smirnoff 	if (pf->opts & PF_OPT_VERBOSE)
45743b3a8eb9SGleb Smirnoff 		print_tabledef(name, opts->flags, opts->init_addr,
45753b3a8eb9SGleb Smirnoff 		    &opts->init_nodes);
45763b3a8eb9SGleb Smirnoff 	if (!(pf->opts & PF_OPT_NOACTION) &&
45773b3a8eb9SGleb Smirnoff 	    pfctl_define_table(name, opts->flags, opts->init_addr,
45783b3a8eb9SGleb Smirnoff 	    pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) {
45793b3a8eb9SGleb Smirnoff 		yyerror("cannot define table %s: %s", name,
45803b3a8eb9SGleb Smirnoff 		    pfr_strerror(errno));
45813b3a8eb9SGleb Smirnoff 		goto _error;
45823b3a8eb9SGleb Smirnoff 	}
45833b3a8eb9SGleb Smirnoff 	pf->tdirty = 1;
45843b3a8eb9SGleb Smirnoff 	pfr_buf_clear(&ab);
45853b3a8eb9SGleb Smirnoff 	return (0);
45863b3a8eb9SGleb Smirnoff _error:
45873b3a8eb9SGleb Smirnoff 	pfr_buf_clear(&ab);
45883b3a8eb9SGleb Smirnoff 	return (-1);
45893b3a8eb9SGleb Smirnoff }
45903b3a8eb9SGleb Smirnoff 
45913b3a8eb9SGleb Smirnoff struct keywords {
45923b3a8eb9SGleb Smirnoff 	const char	*k_name;
45933b3a8eb9SGleb Smirnoff 	int		 k_val;
45943b3a8eb9SGleb Smirnoff };
45953b3a8eb9SGleb Smirnoff 
45963b3a8eb9SGleb Smirnoff /* macro gore, but you should've seen the prior indentation nightmare... */
45973b3a8eb9SGleb Smirnoff 
45983b3a8eb9SGleb Smirnoff #define FREE_LIST(T,r) \
45993b3a8eb9SGleb Smirnoff 	do { \
46003b3a8eb9SGleb Smirnoff 		T *p, *node = r; \
46013b3a8eb9SGleb Smirnoff 		while (node != NULL) { \
46023b3a8eb9SGleb Smirnoff 			p = node; \
46033b3a8eb9SGleb Smirnoff 			node = node->next; \
46043b3a8eb9SGleb Smirnoff 			free(p); \
46053b3a8eb9SGleb Smirnoff 		} \
46063b3a8eb9SGleb Smirnoff 	} while (0)
46073b3a8eb9SGleb Smirnoff 
46083b3a8eb9SGleb Smirnoff #define LOOP_THROUGH(T,n,r,C) \
46093b3a8eb9SGleb Smirnoff 	do { \
46103b3a8eb9SGleb Smirnoff 		T *n; \
46113b3a8eb9SGleb Smirnoff 		if (r == NULL) { \
46123b3a8eb9SGleb Smirnoff 			r = calloc(1, sizeof(T)); \
46133b3a8eb9SGleb Smirnoff 			if (r == NULL) \
46143b3a8eb9SGleb Smirnoff 				err(1, "LOOP: calloc"); \
46153b3a8eb9SGleb Smirnoff 			r->next = NULL; \
46163b3a8eb9SGleb Smirnoff 		} \
46173b3a8eb9SGleb Smirnoff 		n = r; \
46183b3a8eb9SGleb Smirnoff 		while (n != NULL) { \
46193b3a8eb9SGleb Smirnoff 			do { \
46203b3a8eb9SGleb Smirnoff 				C; \
46213b3a8eb9SGleb Smirnoff 			} while (0); \
46223b3a8eb9SGleb Smirnoff 			n = n->next; \
46233b3a8eb9SGleb Smirnoff 		} \
46243b3a8eb9SGleb Smirnoff 	} while (0)
46253b3a8eb9SGleb Smirnoff 
46263b3a8eb9SGleb Smirnoff void
46273b3a8eb9SGleb Smirnoff expand_label_str(char *label, size_t len, const char *srch, const char *repl)
46283b3a8eb9SGleb Smirnoff {
46293b3a8eb9SGleb Smirnoff 	char *tmp;
46303b3a8eb9SGleb Smirnoff 	char *p, *q;
46313b3a8eb9SGleb Smirnoff 
46323b3a8eb9SGleb Smirnoff 	if ((tmp = calloc(1, len)) == NULL)
46333b3a8eb9SGleb Smirnoff 		err(1, "expand_label_str: calloc");
46343b3a8eb9SGleb Smirnoff 	p = q = label;
46353b3a8eb9SGleb Smirnoff 	while ((q = strstr(p, srch)) != NULL) {
46363b3a8eb9SGleb Smirnoff 		*q = '\0';
46373b3a8eb9SGleb Smirnoff 		if ((strlcat(tmp, p, len) >= len) ||
46383b3a8eb9SGleb Smirnoff 		    (strlcat(tmp, repl, len) >= len))
46393b3a8eb9SGleb Smirnoff 			errx(1, "expand_label: label too long");
46403b3a8eb9SGleb Smirnoff 		q += strlen(srch);
46413b3a8eb9SGleb Smirnoff 		p = q;
46423b3a8eb9SGleb Smirnoff 	}
46433b3a8eb9SGleb Smirnoff 	if (strlcat(tmp, p, len) >= len)
46443b3a8eb9SGleb Smirnoff 		errx(1, "expand_label: label too long");
46453b3a8eb9SGleb Smirnoff 	strlcpy(label, tmp, len);	/* always fits */
46463b3a8eb9SGleb Smirnoff 	free(tmp);
46473b3a8eb9SGleb Smirnoff }
46483b3a8eb9SGleb Smirnoff 
46493b3a8eb9SGleb Smirnoff void
46503b3a8eb9SGleb Smirnoff expand_label_if(const char *name, char *label, size_t len, const char *ifname)
46513b3a8eb9SGleb Smirnoff {
46523b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
46533b3a8eb9SGleb Smirnoff 		if (!*ifname)
46543b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, "any");
46553b3a8eb9SGleb Smirnoff 		else
46563b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, ifname);
46573b3a8eb9SGleb Smirnoff 	}
46583b3a8eb9SGleb Smirnoff }
46593b3a8eb9SGleb Smirnoff 
46603b3a8eb9SGleb Smirnoff void
46613b3a8eb9SGleb Smirnoff expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
46623b3a8eb9SGleb Smirnoff     struct node_host *h)
46633b3a8eb9SGleb Smirnoff {
46643b3a8eb9SGleb Smirnoff 	char tmp[64], tmp_not[66];
46653b3a8eb9SGleb Smirnoff 
46663b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
46673b3a8eb9SGleb Smirnoff 		switch (h->addr.type) {
46683b3a8eb9SGleb Smirnoff 		case PF_ADDR_DYNIFTL:
46693b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
46703b3a8eb9SGleb Smirnoff 			break;
46713b3a8eb9SGleb Smirnoff 		case PF_ADDR_TABLE:
46723b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
46733b3a8eb9SGleb Smirnoff 			break;
46743b3a8eb9SGleb Smirnoff 		case PF_ADDR_NOROUTE:
46753b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "no-route");
46763b3a8eb9SGleb Smirnoff 			break;
46773b3a8eb9SGleb Smirnoff 		case PF_ADDR_URPFFAILED:
46783b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "urpf-failed");
46793b3a8eb9SGleb Smirnoff 			break;
46803b3a8eb9SGleb Smirnoff 		case PF_ADDR_ADDRMASK:
46813b3a8eb9SGleb Smirnoff 			if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
46823b3a8eb9SGleb Smirnoff 			    PF_AZERO(&h->addr.v.a.mask, af)))
46833b3a8eb9SGleb Smirnoff 				snprintf(tmp, sizeof(tmp), "any");
46843b3a8eb9SGleb Smirnoff 			else {
46853b3a8eb9SGleb Smirnoff 				char	a[48];
46863b3a8eb9SGleb Smirnoff 				int	bits;
46873b3a8eb9SGleb Smirnoff 
46883b3a8eb9SGleb Smirnoff 				if (inet_ntop(af, &h->addr.v.a.addr, a,
46893b3a8eb9SGleb Smirnoff 				    sizeof(a)) == NULL)
46903b3a8eb9SGleb Smirnoff 					snprintf(tmp, sizeof(tmp), "?");
46913b3a8eb9SGleb Smirnoff 				else {
46923b3a8eb9SGleb Smirnoff 					bits = unmask(&h->addr.v.a.mask, af);
46933b3a8eb9SGleb Smirnoff 					if ((af == AF_INET && bits < 32) ||
46943b3a8eb9SGleb Smirnoff 					    (af == AF_INET6 && bits < 128))
46953b3a8eb9SGleb Smirnoff 						snprintf(tmp, sizeof(tmp),
46963b3a8eb9SGleb Smirnoff 						    "%s/%d", a, bits);
46973b3a8eb9SGleb Smirnoff 					else
46983b3a8eb9SGleb Smirnoff 						snprintf(tmp, sizeof(tmp),
46993b3a8eb9SGleb Smirnoff 						    "%s", a);
47003b3a8eb9SGleb Smirnoff 				}
47013b3a8eb9SGleb Smirnoff 			}
47023b3a8eb9SGleb Smirnoff 			break;
47033b3a8eb9SGleb Smirnoff 		default:
47043b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "?");
47053b3a8eb9SGleb Smirnoff 			break;
47063b3a8eb9SGleb Smirnoff 		}
47073b3a8eb9SGleb Smirnoff 
47083b3a8eb9SGleb Smirnoff 		if (h->not) {
47093b3a8eb9SGleb Smirnoff 			snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
47103b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, tmp_not);
47113b3a8eb9SGleb Smirnoff 		} else
47123b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, tmp);
47133b3a8eb9SGleb Smirnoff 	}
47143b3a8eb9SGleb Smirnoff }
47153b3a8eb9SGleb Smirnoff 
47163b3a8eb9SGleb Smirnoff void
47173b3a8eb9SGleb Smirnoff expand_label_port(const char *name, char *label, size_t len,
47183b3a8eb9SGleb Smirnoff     struct node_port *port)
47193b3a8eb9SGleb Smirnoff {
47203b3a8eb9SGleb Smirnoff 	char	 a1[6], a2[6], op[13] = "";
47213b3a8eb9SGleb Smirnoff 
47223b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
47233b3a8eb9SGleb Smirnoff 		snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
47243b3a8eb9SGleb Smirnoff 		snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
47253b3a8eb9SGleb Smirnoff 		if (!port->op)
47263b3a8eb9SGleb Smirnoff 			;
47273b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_IRG)
47283b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "%s><%s", a1, a2);
47293b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_XRG)
47303b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "%s<>%s", a1, a2);
47313b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_EQ)
47323b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "%s", a1);
47333b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_NE)
47343b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "!=%s", a1);
47353b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_LT)
47363b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "<%s", a1);
47373b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_LE)
47383b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "<=%s", a1);
47393b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_GT)
47403b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), ">%s", a1);
47413b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_GE)
47423b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), ">=%s", a1);
47433b3a8eb9SGleb Smirnoff 		expand_label_str(label, len, name, op);
47443b3a8eb9SGleb Smirnoff 	}
47453b3a8eb9SGleb Smirnoff }
47463b3a8eb9SGleb Smirnoff 
47473b3a8eb9SGleb Smirnoff void
47483b3a8eb9SGleb Smirnoff expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
47493b3a8eb9SGleb Smirnoff {
47503b3a8eb9SGleb Smirnoff 	struct protoent *pe;
47513b3a8eb9SGleb Smirnoff 	char n[4];
47523b3a8eb9SGleb Smirnoff 
47533b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
47543b3a8eb9SGleb Smirnoff 		pe = getprotobynumber(proto);
47553b3a8eb9SGleb Smirnoff 		if (pe != NULL)
47563b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, pe->p_name);
47573b3a8eb9SGleb Smirnoff 		else {
47583b3a8eb9SGleb Smirnoff 			snprintf(n, sizeof(n), "%u", proto);
47593b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, n);
47603b3a8eb9SGleb Smirnoff 		}
47613b3a8eb9SGleb Smirnoff 	}
47623b3a8eb9SGleb Smirnoff }
47633b3a8eb9SGleb Smirnoff 
47643b3a8eb9SGleb Smirnoff void
47653b3a8eb9SGleb Smirnoff expand_label_nr(const char *name, char *label, size_t len)
47663b3a8eb9SGleb Smirnoff {
47673b3a8eb9SGleb Smirnoff 	char n[11];
47683b3a8eb9SGleb Smirnoff 
47693b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
47703b3a8eb9SGleb Smirnoff 		snprintf(n, sizeof(n), "%u", pf->anchor->match);
47713b3a8eb9SGleb Smirnoff 		expand_label_str(label, len, name, n);
47723b3a8eb9SGleb Smirnoff 	}
47733b3a8eb9SGleb Smirnoff }
47743b3a8eb9SGleb Smirnoff 
47753b3a8eb9SGleb Smirnoff void
47763b3a8eb9SGleb Smirnoff expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
47773b3a8eb9SGleb Smirnoff     struct node_host *src_host, struct node_port *src_port,
47783b3a8eb9SGleb Smirnoff     struct node_host *dst_host, struct node_port *dst_port,
47793b3a8eb9SGleb Smirnoff     u_int8_t proto)
47803b3a8eb9SGleb Smirnoff {
47813b3a8eb9SGleb Smirnoff 	expand_label_if("$if", label, len, ifname);
47823b3a8eb9SGleb Smirnoff 	expand_label_addr("$srcaddr", label, len, af, src_host);
47833b3a8eb9SGleb Smirnoff 	expand_label_addr("$dstaddr", label, len, af, dst_host);
47843b3a8eb9SGleb Smirnoff 	expand_label_port("$srcport", label, len, src_port);
47853b3a8eb9SGleb Smirnoff 	expand_label_port("$dstport", label, len, dst_port);
47863b3a8eb9SGleb Smirnoff 	expand_label_proto("$proto", label, len, proto);
47873b3a8eb9SGleb Smirnoff 	expand_label_nr("$nr", label, len);
47883b3a8eb9SGleb Smirnoff }
47893b3a8eb9SGleb Smirnoff 
47903b3a8eb9SGleb Smirnoff int
47913b3a8eb9SGleb Smirnoff expand_altq(struct pf_altq *a, struct node_if *interfaces,
47923b3a8eb9SGleb Smirnoff     struct node_queue *nqueues, struct node_queue_bw bwspec,
47933b3a8eb9SGleb Smirnoff     struct node_queue_opt *opts)
47943b3a8eb9SGleb Smirnoff {
47953b3a8eb9SGleb Smirnoff 	struct pf_altq		 pa, pb;
47963b3a8eb9SGleb Smirnoff 	char			 qname[PF_QNAME_SIZE];
47973b3a8eb9SGleb Smirnoff 	struct node_queue	*n;
47983b3a8eb9SGleb Smirnoff 	struct node_queue_bw	 bw;
47993b3a8eb9SGleb Smirnoff 	int			 errs = 0;
48003b3a8eb9SGleb Smirnoff 
48013b3a8eb9SGleb Smirnoff 	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
48023b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_if, interfaces);
48033b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_queue, nqueues);
48043b3a8eb9SGleb Smirnoff 		return (0);
48053b3a8eb9SGleb Smirnoff 	}
48063b3a8eb9SGleb Smirnoff 
48073b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
48083b3a8eb9SGleb Smirnoff 		memcpy(&pa, a, sizeof(struct pf_altq));
48093b3a8eb9SGleb Smirnoff 		if (strlcpy(pa.ifname, interface->ifname,
48103b3a8eb9SGleb Smirnoff 		    sizeof(pa.ifname)) >= sizeof(pa.ifname))
48113b3a8eb9SGleb Smirnoff 			errx(1, "expand_altq: strlcpy");
48123b3a8eb9SGleb Smirnoff 
48133b3a8eb9SGleb Smirnoff 		if (interface->not) {
48143b3a8eb9SGleb Smirnoff 			yyerror("altq on ! <interface> is not supported");
48153b3a8eb9SGleb Smirnoff 			errs++;
48163b3a8eb9SGleb Smirnoff 		} else {
48173b3a8eb9SGleb Smirnoff 			if (eval_pfaltq(pf, &pa, &bwspec, opts))
48183b3a8eb9SGleb Smirnoff 				errs++;
48193b3a8eb9SGleb Smirnoff 			else
48203b3a8eb9SGleb Smirnoff 				if (pfctl_add_altq(pf, &pa))
48213b3a8eb9SGleb Smirnoff 					errs++;
48223b3a8eb9SGleb Smirnoff 
48233b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE) {
48243b3a8eb9SGleb Smirnoff 				print_altq(&pf->paltq->altq, 0,
48253b3a8eb9SGleb Smirnoff 				    &bwspec, opts);
48263b3a8eb9SGleb Smirnoff 				if (nqueues && nqueues->tail) {
48273b3a8eb9SGleb Smirnoff 					printf("queue { ");
48283b3a8eb9SGleb Smirnoff 					LOOP_THROUGH(struct node_queue, queue,
48293b3a8eb9SGleb Smirnoff 					    nqueues,
48303b3a8eb9SGleb Smirnoff 						printf("%s ",
48313b3a8eb9SGleb Smirnoff 						    queue->queue);
48323b3a8eb9SGleb Smirnoff 					);
48333b3a8eb9SGleb Smirnoff 					printf("}");
48343b3a8eb9SGleb Smirnoff 				}
48353b3a8eb9SGleb Smirnoff 				printf("\n");
48363b3a8eb9SGleb Smirnoff 			}
48373b3a8eb9SGleb Smirnoff 
48383b3a8eb9SGleb Smirnoff 			if (pa.scheduler == ALTQT_CBQ ||
48393b3a8eb9SGleb Smirnoff 			    pa.scheduler == ALTQT_HFSC) {
48403b3a8eb9SGleb Smirnoff 				/* now create a root queue */
48413b3a8eb9SGleb Smirnoff 				memset(&pb, 0, sizeof(struct pf_altq));
48423b3a8eb9SGleb Smirnoff 				if (strlcpy(qname, "root_", sizeof(qname)) >=
48433b3a8eb9SGleb Smirnoff 				    sizeof(qname))
48443b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
48453b3a8eb9SGleb Smirnoff 				if (strlcat(qname, interface->ifname,
48463b3a8eb9SGleb Smirnoff 				    sizeof(qname)) >= sizeof(qname))
48473b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcat");
48483b3a8eb9SGleb Smirnoff 				if (strlcpy(pb.qname, qname,
48493b3a8eb9SGleb Smirnoff 				    sizeof(pb.qname)) >= sizeof(pb.qname))
48503b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
48513b3a8eb9SGleb Smirnoff 				if (strlcpy(pb.ifname, interface->ifname,
48523b3a8eb9SGleb Smirnoff 				    sizeof(pb.ifname)) >= sizeof(pb.ifname))
48533b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
48543b3a8eb9SGleb Smirnoff 				pb.qlimit = pa.qlimit;
48553b3a8eb9SGleb Smirnoff 				pb.scheduler = pa.scheduler;
48563b3a8eb9SGleb Smirnoff 				bw.bw_absolute = pa.ifbandwidth;
48573b3a8eb9SGleb Smirnoff 				bw.bw_percent = 0;
48583b3a8eb9SGleb Smirnoff 				if (eval_pfqueue(pf, &pb, &bw, opts))
48593b3a8eb9SGleb Smirnoff 					errs++;
48603b3a8eb9SGleb Smirnoff 				else
48613b3a8eb9SGleb Smirnoff 					if (pfctl_add_altq(pf, &pb))
48623b3a8eb9SGleb Smirnoff 						errs++;
48633b3a8eb9SGleb Smirnoff 			}
48643b3a8eb9SGleb Smirnoff 
48653b3a8eb9SGleb Smirnoff 			LOOP_THROUGH(struct node_queue, queue, nqueues,
48663b3a8eb9SGleb Smirnoff 				n = calloc(1, sizeof(struct node_queue));
48673b3a8eb9SGleb Smirnoff 				if (n == NULL)
48683b3a8eb9SGleb Smirnoff 					err(1, "expand_altq: calloc");
48693b3a8eb9SGleb Smirnoff 				if (pa.scheduler == ALTQT_CBQ ||
48703b3a8eb9SGleb Smirnoff 				    pa.scheduler == ALTQT_HFSC)
48713b3a8eb9SGleb Smirnoff 					if (strlcpy(n->parent, qname,
48723b3a8eb9SGleb Smirnoff 					    sizeof(n->parent)) >=
48733b3a8eb9SGleb Smirnoff 					    sizeof(n->parent))
48743b3a8eb9SGleb Smirnoff 						errx(1, "expand_altq: strlcpy");
48753b3a8eb9SGleb Smirnoff 				if (strlcpy(n->queue, queue->queue,
48763b3a8eb9SGleb Smirnoff 				    sizeof(n->queue)) >= sizeof(n->queue))
48773b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
48783b3a8eb9SGleb Smirnoff 				if (strlcpy(n->ifname, interface->ifname,
48793b3a8eb9SGleb Smirnoff 				    sizeof(n->ifname)) >= sizeof(n->ifname))
48803b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
48813b3a8eb9SGleb Smirnoff 				n->scheduler = pa.scheduler;
48823b3a8eb9SGleb Smirnoff 				n->next = NULL;
48833b3a8eb9SGleb Smirnoff 				n->tail = n;
48843b3a8eb9SGleb Smirnoff 				if (queues == NULL)
48853b3a8eb9SGleb Smirnoff 					queues = n;
48863b3a8eb9SGleb Smirnoff 				else {
48873b3a8eb9SGleb Smirnoff 					queues->tail->next = n;
48883b3a8eb9SGleb Smirnoff 					queues->tail = n;
48893b3a8eb9SGleb Smirnoff 				}
48903b3a8eb9SGleb Smirnoff 			);
48913b3a8eb9SGleb Smirnoff 		}
48923b3a8eb9SGleb Smirnoff 	);
48933b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
48943b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_queue, nqueues);
48953b3a8eb9SGleb Smirnoff 
48963b3a8eb9SGleb Smirnoff 	return (errs);
48973b3a8eb9SGleb Smirnoff }
48983b3a8eb9SGleb Smirnoff 
48993b3a8eb9SGleb Smirnoff int
49003b3a8eb9SGleb Smirnoff expand_queue(struct pf_altq *a, struct node_if *interfaces,
49013b3a8eb9SGleb Smirnoff     struct node_queue *nqueues, struct node_queue_bw bwspec,
49023b3a8eb9SGleb Smirnoff     struct node_queue_opt *opts)
49033b3a8eb9SGleb Smirnoff {
49043b3a8eb9SGleb Smirnoff 	struct node_queue	*n, *nq;
49053b3a8eb9SGleb Smirnoff 	struct pf_altq		 pa;
49063b3a8eb9SGleb Smirnoff 	u_int8_t		 found = 0;
49073b3a8eb9SGleb Smirnoff 	u_int8_t		 errs = 0;
49083b3a8eb9SGleb Smirnoff 
49093b3a8eb9SGleb Smirnoff 	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
49103b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_queue, nqueues);
49113b3a8eb9SGleb Smirnoff 		return (0);
49123b3a8eb9SGleb Smirnoff 	}
49133b3a8eb9SGleb Smirnoff 
49143b3a8eb9SGleb Smirnoff 	if (queues == NULL) {
49153b3a8eb9SGleb Smirnoff 		yyerror("queue %s has no parent", a->qname);
49163b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_queue, nqueues);
49173b3a8eb9SGleb Smirnoff 		return (1);
49183b3a8eb9SGleb Smirnoff 	}
49193b3a8eb9SGleb Smirnoff 
49203b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
49213b3a8eb9SGleb Smirnoff 		LOOP_THROUGH(struct node_queue, tqueue, queues,
49223b3a8eb9SGleb Smirnoff 			if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
49233b3a8eb9SGleb Smirnoff 			    (interface->ifname[0] == 0 ||
49243b3a8eb9SGleb Smirnoff 			    (!interface->not && !strncmp(interface->ifname,
49253b3a8eb9SGleb Smirnoff 			    tqueue->ifname, IFNAMSIZ)) ||
49263b3a8eb9SGleb Smirnoff 			    (interface->not && strncmp(interface->ifname,
49273b3a8eb9SGleb Smirnoff 			    tqueue->ifname, IFNAMSIZ)))) {
49283b3a8eb9SGleb Smirnoff 				/* found ourself in queues */
49293b3a8eb9SGleb Smirnoff 				found++;
49303b3a8eb9SGleb Smirnoff 
49313b3a8eb9SGleb Smirnoff 				memcpy(&pa, a, sizeof(struct pf_altq));
49323b3a8eb9SGleb Smirnoff 
49333b3a8eb9SGleb Smirnoff 				if (pa.scheduler != ALTQT_NONE &&
49343b3a8eb9SGleb Smirnoff 				    pa.scheduler != tqueue->scheduler) {
49353b3a8eb9SGleb Smirnoff 					yyerror("exactly one scheduler type "
49363b3a8eb9SGleb Smirnoff 					    "per interface allowed");
49373b3a8eb9SGleb Smirnoff 					return (1);
49383b3a8eb9SGleb Smirnoff 				}
49393b3a8eb9SGleb Smirnoff 				pa.scheduler = tqueue->scheduler;
49403b3a8eb9SGleb Smirnoff 
49413b3a8eb9SGleb Smirnoff 				/* scheduler dependent error checking */
49423b3a8eb9SGleb Smirnoff 				switch (pa.scheduler) {
49433b3a8eb9SGleb Smirnoff 				case ALTQT_PRIQ:
49443b3a8eb9SGleb Smirnoff 					if (nqueues != NULL) {
49453b3a8eb9SGleb Smirnoff 						yyerror("priq queues cannot "
49463b3a8eb9SGleb Smirnoff 						    "have child queues");
49473b3a8eb9SGleb Smirnoff 						return (1);
49483b3a8eb9SGleb Smirnoff 					}
49493b3a8eb9SGleb Smirnoff 					if (bwspec.bw_absolute > 0 ||
49503b3a8eb9SGleb Smirnoff 					    bwspec.bw_percent < 100) {
49513b3a8eb9SGleb Smirnoff 						yyerror("priq doesn't take "
49523b3a8eb9SGleb Smirnoff 						    "bandwidth");
49533b3a8eb9SGleb Smirnoff 						return (1);
49543b3a8eb9SGleb Smirnoff 					}
49553b3a8eb9SGleb Smirnoff 					break;
49563b3a8eb9SGleb Smirnoff 				default:
49573b3a8eb9SGleb Smirnoff 					break;
49583b3a8eb9SGleb Smirnoff 				}
49593b3a8eb9SGleb Smirnoff 
49603b3a8eb9SGleb Smirnoff 				if (strlcpy(pa.ifname, tqueue->ifname,
49613b3a8eb9SGleb Smirnoff 				    sizeof(pa.ifname)) >= sizeof(pa.ifname))
49623b3a8eb9SGleb Smirnoff 					errx(1, "expand_queue: strlcpy");
49633b3a8eb9SGleb Smirnoff 				if (strlcpy(pa.parent, tqueue->parent,
49643b3a8eb9SGleb Smirnoff 				    sizeof(pa.parent)) >= sizeof(pa.parent))
49653b3a8eb9SGleb Smirnoff 					errx(1, "expand_queue: strlcpy");
49663b3a8eb9SGleb Smirnoff 
49673b3a8eb9SGleb Smirnoff 				if (eval_pfqueue(pf, &pa, &bwspec, opts))
49683b3a8eb9SGleb Smirnoff 					errs++;
49693b3a8eb9SGleb Smirnoff 				else
49703b3a8eb9SGleb Smirnoff 					if (pfctl_add_altq(pf, &pa))
49713b3a8eb9SGleb Smirnoff 						errs++;
49723b3a8eb9SGleb Smirnoff 
49733b3a8eb9SGleb Smirnoff 				for (nq = nqueues; nq != NULL; nq = nq->next) {
49743b3a8eb9SGleb Smirnoff 					if (!strcmp(a->qname, nq->queue)) {
49753b3a8eb9SGleb Smirnoff 						yyerror("queue cannot have "
49763b3a8eb9SGleb Smirnoff 						    "itself as child");
49773b3a8eb9SGleb Smirnoff 						errs++;
49783b3a8eb9SGleb Smirnoff 						continue;
49793b3a8eb9SGleb Smirnoff 					}
49803b3a8eb9SGleb Smirnoff 					n = calloc(1,
49813b3a8eb9SGleb Smirnoff 					    sizeof(struct node_queue));
49823b3a8eb9SGleb Smirnoff 					if (n == NULL)
49833b3a8eb9SGleb Smirnoff 						err(1, "expand_queue: calloc");
49843b3a8eb9SGleb Smirnoff 					if (strlcpy(n->parent, a->qname,
49853b3a8eb9SGleb Smirnoff 					    sizeof(n->parent)) >=
49863b3a8eb9SGleb Smirnoff 					    sizeof(n->parent))
49873b3a8eb9SGleb Smirnoff 						errx(1, "expand_queue strlcpy");
49883b3a8eb9SGleb Smirnoff 					if (strlcpy(n->queue, nq->queue,
49893b3a8eb9SGleb Smirnoff 					    sizeof(n->queue)) >=
49903b3a8eb9SGleb Smirnoff 					    sizeof(n->queue))
49913b3a8eb9SGleb Smirnoff 						errx(1, "expand_queue strlcpy");
49923b3a8eb9SGleb Smirnoff 					if (strlcpy(n->ifname, tqueue->ifname,
49933b3a8eb9SGleb Smirnoff 					    sizeof(n->ifname)) >=
49943b3a8eb9SGleb Smirnoff 					    sizeof(n->ifname))
49953b3a8eb9SGleb Smirnoff 						errx(1, "expand_queue strlcpy");
49963b3a8eb9SGleb Smirnoff 					n->scheduler = tqueue->scheduler;
49973b3a8eb9SGleb Smirnoff 					n->next = NULL;
49983b3a8eb9SGleb Smirnoff 					n->tail = n;
49993b3a8eb9SGleb Smirnoff 					if (queues == NULL)
50003b3a8eb9SGleb Smirnoff 						queues = n;
50013b3a8eb9SGleb Smirnoff 					else {
50023b3a8eb9SGleb Smirnoff 						queues->tail->next = n;
50033b3a8eb9SGleb Smirnoff 						queues->tail = n;
50043b3a8eb9SGleb Smirnoff 					}
50053b3a8eb9SGleb Smirnoff 				}
50063b3a8eb9SGleb Smirnoff 				if ((pf->opts & PF_OPT_VERBOSE) && (
50073b3a8eb9SGleb Smirnoff 				    (found == 1 && interface->ifname[0] == 0) ||
50083b3a8eb9SGleb Smirnoff 				    (found > 0 && interface->ifname[0] != 0))) {
50093b3a8eb9SGleb Smirnoff 					print_queue(&pf->paltq->altq, 0,
50103b3a8eb9SGleb Smirnoff 					    &bwspec, interface->ifname[0] != 0,
50113b3a8eb9SGleb Smirnoff 					    opts);
50123b3a8eb9SGleb Smirnoff 					if (nqueues && nqueues->tail) {
50133b3a8eb9SGleb Smirnoff 						printf("{ ");
50143b3a8eb9SGleb Smirnoff 						LOOP_THROUGH(struct node_queue,
50153b3a8eb9SGleb Smirnoff 						    queue, nqueues,
50163b3a8eb9SGleb Smirnoff 							printf("%s ",
50173b3a8eb9SGleb Smirnoff 							    queue->queue);
50183b3a8eb9SGleb Smirnoff 						);
50193b3a8eb9SGleb Smirnoff 						printf("}");
50203b3a8eb9SGleb Smirnoff 					}
50213b3a8eb9SGleb Smirnoff 					printf("\n");
50223b3a8eb9SGleb Smirnoff 				}
50233b3a8eb9SGleb Smirnoff 			}
50243b3a8eb9SGleb Smirnoff 		);
50253b3a8eb9SGleb Smirnoff 	);
50263b3a8eb9SGleb Smirnoff 
50273b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_queue, nqueues);
50283b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
50293b3a8eb9SGleb Smirnoff 
50303b3a8eb9SGleb Smirnoff 	if (!found) {
50313b3a8eb9SGleb Smirnoff 		yyerror("queue %s has no parent", a->qname);
50323b3a8eb9SGleb Smirnoff 		errs++;
50333b3a8eb9SGleb Smirnoff 	}
50343b3a8eb9SGleb Smirnoff 
50353b3a8eb9SGleb Smirnoff 	if (errs)
50363b3a8eb9SGleb Smirnoff 		return (1);
50373b3a8eb9SGleb Smirnoff 	else
50383b3a8eb9SGleb Smirnoff 		return (0);
50393b3a8eb9SGleb Smirnoff }
50403b3a8eb9SGleb Smirnoff 
50413b3a8eb9SGleb Smirnoff void
50423b3a8eb9SGleb Smirnoff expand_rule(struct pf_rule *r,
50433b3a8eb9SGleb Smirnoff     struct node_if *interfaces, struct node_host *rpool_hosts,
50443b3a8eb9SGleb Smirnoff     struct node_proto *protos, struct node_os *src_oses,
50453b3a8eb9SGleb Smirnoff     struct node_host *src_hosts, struct node_port *src_ports,
50463b3a8eb9SGleb Smirnoff     struct node_host *dst_hosts, struct node_port *dst_ports,
50473b3a8eb9SGleb Smirnoff     struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types,
50483b3a8eb9SGleb Smirnoff     const char *anchor_call)
50493b3a8eb9SGleb Smirnoff {
50503b3a8eb9SGleb Smirnoff 	sa_family_t		 af = r->af;
50513b3a8eb9SGleb Smirnoff 	int			 added = 0, error = 0;
50523b3a8eb9SGleb Smirnoff 	char			 ifname[IF_NAMESIZE];
50533b3a8eb9SGleb Smirnoff 	char			 label[PF_RULE_LABEL_SIZE];
50543b3a8eb9SGleb Smirnoff 	char			 tagname[PF_TAG_NAME_SIZE];
50553b3a8eb9SGleb Smirnoff 	char			 match_tagname[PF_TAG_NAME_SIZE];
50563b3a8eb9SGleb Smirnoff 	struct pf_pooladdr	*pa;
50573b3a8eb9SGleb Smirnoff 	struct node_host	*h;
50583b3a8eb9SGleb Smirnoff 	u_int8_t		 flags, flagset, keep_state;
50593b3a8eb9SGleb Smirnoff 
50603b3a8eb9SGleb Smirnoff 	if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
50613b3a8eb9SGleb Smirnoff 		errx(1, "expand_rule: strlcpy");
50623b3a8eb9SGleb Smirnoff 	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
50633b3a8eb9SGleb Smirnoff 		errx(1, "expand_rule: strlcpy");
50643b3a8eb9SGleb Smirnoff 	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
50653b3a8eb9SGleb Smirnoff 	    sizeof(match_tagname))
50663b3a8eb9SGleb Smirnoff 		errx(1, "expand_rule: strlcpy");
50673b3a8eb9SGleb Smirnoff 	flags = r->flags;
50683b3a8eb9SGleb Smirnoff 	flagset = r->flagset;
50693b3a8eb9SGleb Smirnoff 	keep_state = r->keep_state;
50703b3a8eb9SGleb Smirnoff 
50713b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
50723b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_proto, proto, protos,
50733b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
50743b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_host, src_host, src_hosts,
50753b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_port, src_port, src_ports,
50763b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_os, src_os, src_oses,
50773b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
50783b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
50793b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_uid, uid, uids,
50803b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_gid, gid, gids,
50813b3a8eb9SGleb Smirnoff 
50823b3a8eb9SGleb Smirnoff 		r->af = af;
50833b3a8eb9SGleb Smirnoff 		/* for link-local IPv6 address, interface must match up */
50843b3a8eb9SGleb Smirnoff 		if ((r->af && src_host->af && r->af != src_host->af) ||
50853b3a8eb9SGleb Smirnoff 		    (r->af && dst_host->af && r->af != dst_host->af) ||
50863b3a8eb9SGleb Smirnoff 		    (src_host->af && dst_host->af &&
50873b3a8eb9SGleb Smirnoff 		    src_host->af != dst_host->af) ||
50883b3a8eb9SGleb Smirnoff 		    (src_host->ifindex && dst_host->ifindex &&
50893b3a8eb9SGleb Smirnoff 		    src_host->ifindex != dst_host->ifindex) ||
50903b3a8eb9SGleb Smirnoff 		    (src_host->ifindex && *interface->ifname &&
50913b3a8eb9SGleb Smirnoff 		    src_host->ifindex != if_nametoindex(interface->ifname)) ||
50923b3a8eb9SGleb Smirnoff 		    (dst_host->ifindex && *interface->ifname &&
50933b3a8eb9SGleb Smirnoff 		    dst_host->ifindex != if_nametoindex(interface->ifname)))
50943b3a8eb9SGleb Smirnoff 			continue;
50953b3a8eb9SGleb Smirnoff 		if (!r->af && src_host->af)
50963b3a8eb9SGleb Smirnoff 			r->af = src_host->af;
50973b3a8eb9SGleb Smirnoff 		else if (!r->af && dst_host->af)
50983b3a8eb9SGleb Smirnoff 			r->af = dst_host->af;
50993b3a8eb9SGleb Smirnoff 
51003b3a8eb9SGleb Smirnoff 		if (*interface->ifname)
51013b3a8eb9SGleb Smirnoff 			strlcpy(r->ifname, interface->ifname,
51023b3a8eb9SGleb Smirnoff 			    sizeof(r->ifname));
51033b3a8eb9SGleb Smirnoff 		else if (if_indextoname(src_host->ifindex, ifname))
51043b3a8eb9SGleb Smirnoff 			strlcpy(r->ifname, ifname, sizeof(r->ifname));
51053b3a8eb9SGleb Smirnoff 		else if (if_indextoname(dst_host->ifindex, ifname))
51063b3a8eb9SGleb Smirnoff 			strlcpy(r->ifname, ifname, sizeof(r->ifname));
51073b3a8eb9SGleb Smirnoff 		else
51083b3a8eb9SGleb Smirnoff 			memset(r->ifname, '\0', sizeof(r->ifname));
51093b3a8eb9SGleb Smirnoff 
51103b3a8eb9SGleb Smirnoff 		if (strlcpy(r->label, label, sizeof(r->label)) >=
51113b3a8eb9SGleb Smirnoff 		    sizeof(r->label))
51123b3a8eb9SGleb Smirnoff 			errx(1, "expand_rule: strlcpy");
51133b3a8eb9SGleb Smirnoff 		if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
51143b3a8eb9SGleb Smirnoff 		    sizeof(r->tagname))
51153b3a8eb9SGleb Smirnoff 			errx(1, "expand_rule: strlcpy");
51163b3a8eb9SGleb Smirnoff 		if (strlcpy(r->match_tagname, match_tagname,
51173b3a8eb9SGleb Smirnoff 		    sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
51183b3a8eb9SGleb Smirnoff 			errx(1, "expand_rule: strlcpy");
51193b3a8eb9SGleb Smirnoff 		expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
51203b3a8eb9SGleb Smirnoff 		    src_host, src_port, dst_host, dst_port, proto->proto);
51213b3a8eb9SGleb Smirnoff 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
51223b3a8eb9SGleb Smirnoff 		    src_host, src_port, dst_host, dst_port, proto->proto);
51233b3a8eb9SGleb Smirnoff 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
51243b3a8eb9SGleb Smirnoff 		    r->af, src_host, src_port, dst_host, dst_port,
51253b3a8eb9SGleb Smirnoff 		    proto->proto);
51263b3a8eb9SGleb Smirnoff 
51273b3a8eb9SGleb Smirnoff 		error += check_netmask(src_host, r->af);
51283b3a8eb9SGleb Smirnoff 		error += check_netmask(dst_host, r->af);
51293b3a8eb9SGleb Smirnoff 
51303b3a8eb9SGleb Smirnoff 		r->ifnot = interface->not;
51313b3a8eb9SGleb Smirnoff 		r->proto = proto->proto;
51323b3a8eb9SGleb Smirnoff 		r->src.addr = src_host->addr;
51333b3a8eb9SGleb Smirnoff 		r->src.neg = src_host->not;
51343b3a8eb9SGleb Smirnoff 		r->src.port[0] = src_port->port[0];
51353b3a8eb9SGleb Smirnoff 		r->src.port[1] = src_port->port[1];
51363b3a8eb9SGleb Smirnoff 		r->src.port_op = src_port->op;
51373b3a8eb9SGleb Smirnoff 		r->dst.addr = dst_host->addr;
51383b3a8eb9SGleb Smirnoff 		r->dst.neg = dst_host->not;
51393b3a8eb9SGleb Smirnoff 		r->dst.port[0] = dst_port->port[0];
51403b3a8eb9SGleb Smirnoff 		r->dst.port[1] = dst_port->port[1];
51413b3a8eb9SGleb Smirnoff 		r->dst.port_op = dst_port->op;
51423b3a8eb9SGleb Smirnoff 		r->uid.op = uid->op;
51433b3a8eb9SGleb Smirnoff 		r->uid.uid[0] = uid->uid[0];
51443b3a8eb9SGleb Smirnoff 		r->uid.uid[1] = uid->uid[1];
51453b3a8eb9SGleb Smirnoff 		r->gid.op = gid->op;
51463b3a8eb9SGleb Smirnoff 		r->gid.gid[0] = gid->gid[0];
51473b3a8eb9SGleb Smirnoff 		r->gid.gid[1] = gid->gid[1];
51483b3a8eb9SGleb Smirnoff 		r->type = icmp_type->type;
51493b3a8eb9SGleb Smirnoff 		r->code = icmp_type->code;
51503b3a8eb9SGleb Smirnoff 
51513b3a8eb9SGleb Smirnoff 		if ((keep_state == PF_STATE_MODULATE ||
51523b3a8eb9SGleb Smirnoff 		    keep_state == PF_STATE_SYNPROXY) &&
51533b3a8eb9SGleb Smirnoff 		    r->proto && r->proto != IPPROTO_TCP)
51543b3a8eb9SGleb Smirnoff 			r->keep_state = PF_STATE_NORMAL;
51553b3a8eb9SGleb Smirnoff 		else
51563b3a8eb9SGleb Smirnoff 			r->keep_state = keep_state;
51573b3a8eb9SGleb Smirnoff 
51583b3a8eb9SGleb Smirnoff 		if (r->proto && r->proto != IPPROTO_TCP) {
51593b3a8eb9SGleb Smirnoff 			r->flags = 0;
51603b3a8eb9SGleb Smirnoff 			r->flagset = 0;
51613b3a8eb9SGleb Smirnoff 		} else {
51623b3a8eb9SGleb Smirnoff 			r->flags = flags;
51633b3a8eb9SGleb Smirnoff 			r->flagset = flagset;
51643b3a8eb9SGleb Smirnoff 		}
51653b3a8eb9SGleb Smirnoff 		if (icmp_type->proto && r->proto != icmp_type->proto) {
51663b3a8eb9SGleb Smirnoff 			yyerror("icmp-type mismatch");
51673b3a8eb9SGleb Smirnoff 			error++;
51683b3a8eb9SGleb Smirnoff 		}
51693b3a8eb9SGleb Smirnoff 
51703b3a8eb9SGleb Smirnoff 		if (src_os && src_os->os) {
51713b3a8eb9SGleb Smirnoff 			r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
51723b3a8eb9SGleb Smirnoff 			if ((pf->opts & PF_OPT_VERBOSE2) &&
51733b3a8eb9SGleb Smirnoff 			    r->os_fingerprint == PF_OSFP_NOMATCH)
51743b3a8eb9SGleb Smirnoff 				fprintf(stderr,
51753b3a8eb9SGleb Smirnoff 				    "warning: unknown '%s' OS fingerprint\n",
51763b3a8eb9SGleb Smirnoff 				    src_os->os);
51773b3a8eb9SGleb Smirnoff 		} else {
51783b3a8eb9SGleb Smirnoff 			r->os_fingerprint = PF_OSFP_ANY;
51793b3a8eb9SGleb Smirnoff 		}
51803b3a8eb9SGleb Smirnoff 
51813b3a8eb9SGleb Smirnoff 		TAILQ_INIT(&r->rpool.list);
51823b3a8eb9SGleb Smirnoff 		for (h = rpool_hosts; h != NULL; h = h->next) {
51833b3a8eb9SGleb Smirnoff 			pa = calloc(1, sizeof(struct pf_pooladdr));
51843b3a8eb9SGleb Smirnoff 			if (pa == NULL)
51853b3a8eb9SGleb Smirnoff 				err(1, "expand_rule: calloc");
51863b3a8eb9SGleb Smirnoff 			pa->addr = h->addr;
51873b3a8eb9SGleb Smirnoff 			if (h->ifname != NULL) {
51883b3a8eb9SGleb Smirnoff 				if (strlcpy(pa->ifname, h->ifname,
51893b3a8eb9SGleb Smirnoff 				    sizeof(pa->ifname)) >=
51903b3a8eb9SGleb Smirnoff 				    sizeof(pa->ifname))
51913b3a8eb9SGleb Smirnoff 					errx(1, "expand_rule: strlcpy");
51923b3a8eb9SGleb Smirnoff 			} else
51933b3a8eb9SGleb Smirnoff 				pa->ifname[0] = 0;
51943b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
51953b3a8eb9SGleb Smirnoff 		}
51963b3a8eb9SGleb Smirnoff 
51973b3a8eb9SGleb Smirnoff 		if (rule_consistent(r, anchor_call[0]) < 0 || error)
51983b3a8eb9SGleb Smirnoff 			yyerror("skipping rule due to errors");
51993b3a8eb9SGleb Smirnoff 		else {
52003b3a8eb9SGleb Smirnoff 			r->nr = pf->astack[pf->asd]->match++;
52013b3a8eb9SGleb Smirnoff 			pfctl_add_rule(pf, r, anchor_call);
52023b3a8eb9SGleb Smirnoff 			added++;
52033b3a8eb9SGleb Smirnoff 		}
52043b3a8eb9SGleb Smirnoff 
52053b3a8eb9SGleb Smirnoff 	))))))))));
52063b3a8eb9SGleb Smirnoff 
52073b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
52083b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_proto, protos);
52093b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_host, src_hosts);
52103b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_port, src_ports);
52113b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_os, src_oses);
52123b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_host, dst_hosts);
52133b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_port, dst_ports);
52143b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_uid, uids);
52153b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_gid, gids);
52163b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_icmp, icmp_types);
52173b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_host, rpool_hosts);
52183b3a8eb9SGleb Smirnoff 
52193b3a8eb9SGleb Smirnoff 	if (!added)
52203b3a8eb9SGleb Smirnoff 		yyerror("rule expands to no valid combination");
52213b3a8eb9SGleb Smirnoff }
52223b3a8eb9SGleb Smirnoff 
52233b3a8eb9SGleb Smirnoff int
52243b3a8eb9SGleb Smirnoff expand_skip_interface(struct node_if *interfaces)
52253b3a8eb9SGleb Smirnoff {
52263b3a8eb9SGleb Smirnoff 	int	errs = 0;
52273b3a8eb9SGleb Smirnoff 
52283b3a8eb9SGleb Smirnoff 	if (!interfaces || (!interfaces->next && !interfaces->not &&
52293b3a8eb9SGleb Smirnoff 	    !strcmp(interfaces->ifname, "none"))) {
52303b3a8eb9SGleb Smirnoff 		if (pf->opts & PF_OPT_VERBOSE)
52313b3a8eb9SGleb Smirnoff 			printf("set skip on none\n");
52323b3a8eb9SGleb Smirnoff 		errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
52333b3a8eb9SGleb Smirnoff 		return (errs);
52343b3a8eb9SGleb Smirnoff 	}
52353b3a8eb9SGleb Smirnoff 
52363b3a8eb9SGleb Smirnoff 	if (pf->opts & PF_OPT_VERBOSE)
52373b3a8eb9SGleb Smirnoff 		printf("set skip on {");
52383b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
52393b3a8eb9SGleb Smirnoff 		if (pf->opts & PF_OPT_VERBOSE)
52403b3a8eb9SGleb Smirnoff 			printf(" %s", interface->ifname);
52413b3a8eb9SGleb Smirnoff 		if (interface->not) {
52423b3a8eb9SGleb Smirnoff 			yyerror("skip on ! <interface> is not supported");
52433b3a8eb9SGleb Smirnoff 			errs++;
52443b3a8eb9SGleb Smirnoff 		} else
52453b3a8eb9SGleb Smirnoff 			errs += pfctl_set_interface_flags(pf,
52463b3a8eb9SGleb Smirnoff 			    interface->ifname, PFI_IFLAG_SKIP, 1);
52473b3a8eb9SGleb Smirnoff 	);
52483b3a8eb9SGleb Smirnoff 	if (pf->opts & PF_OPT_VERBOSE)
52493b3a8eb9SGleb Smirnoff 		printf(" }\n");
52503b3a8eb9SGleb Smirnoff 
52513b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
52523b3a8eb9SGleb Smirnoff 
52533b3a8eb9SGleb Smirnoff 	if (errs)
52543b3a8eb9SGleb Smirnoff 		return (1);
52553b3a8eb9SGleb Smirnoff 	else
52563b3a8eb9SGleb Smirnoff 		return (0);
52573b3a8eb9SGleb Smirnoff }
52583b3a8eb9SGleb Smirnoff 
52593b3a8eb9SGleb Smirnoff #undef FREE_LIST
52603b3a8eb9SGleb Smirnoff #undef LOOP_THROUGH
52613b3a8eb9SGleb Smirnoff 
52623b3a8eb9SGleb Smirnoff int
52633b3a8eb9SGleb Smirnoff check_rulestate(int desired_state)
52643b3a8eb9SGleb Smirnoff {
52653b3a8eb9SGleb Smirnoff 	if (require_order && (rulestate > desired_state)) {
52663b3a8eb9SGleb Smirnoff 		yyerror("Rules must be in order: options, normalization, "
52673b3a8eb9SGleb Smirnoff 		    "queueing, translation, filtering");
52683b3a8eb9SGleb Smirnoff 		return (1);
52693b3a8eb9SGleb Smirnoff 	}
52703b3a8eb9SGleb Smirnoff 	rulestate = desired_state;
52713b3a8eb9SGleb Smirnoff 	return (0);
52723b3a8eb9SGleb Smirnoff }
52733b3a8eb9SGleb Smirnoff 
52743b3a8eb9SGleb Smirnoff int
52753b3a8eb9SGleb Smirnoff kw_cmp(const void *k, const void *e)
52763b3a8eb9SGleb Smirnoff {
52773b3a8eb9SGleb Smirnoff 	return (strcmp(k, ((const struct keywords *)e)->k_name));
52783b3a8eb9SGleb Smirnoff }
52793b3a8eb9SGleb Smirnoff 
52803b3a8eb9SGleb Smirnoff int
52813b3a8eb9SGleb Smirnoff lookup(char *s)
52823b3a8eb9SGleb Smirnoff {
52833b3a8eb9SGleb Smirnoff 	/* this has to be sorted always */
52843b3a8eb9SGleb Smirnoff 	static const struct keywords keywords[] = {
52853b3a8eb9SGleb Smirnoff 		{ "all",		ALL},
52863b3a8eb9SGleb Smirnoff 		{ "allow-opts",		ALLOWOPTS},
52873b3a8eb9SGleb Smirnoff 		{ "altq",		ALTQ},
52883b3a8eb9SGleb Smirnoff 		{ "anchor",		ANCHOR},
52893b3a8eb9SGleb Smirnoff 		{ "antispoof",		ANTISPOOF},
52903b3a8eb9SGleb Smirnoff 		{ "any",		ANY},
52913b3a8eb9SGleb Smirnoff 		{ "bandwidth",		BANDWIDTH},
52923b3a8eb9SGleb Smirnoff 		{ "binat",		BINAT},
52933b3a8eb9SGleb Smirnoff 		{ "binat-anchor",	BINATANCHOR},
52943b3a8eb9SGleb Smirnoff 		{ "bitmask",		BITMASK},
52953b3a8eb9SGleb Smirnoff 		{ "block",		BLOCK},
52963b3a8eb9SGleb Smirnoff 		{ "block-policy",	BLOCKPOLICY},
5297*a5b789f6SErmal Luçi 		{ "buckets",		BUCKETS},
52983b3a8eb9SGleb Smirnoff 		{ "cbq",		CBQ},
52993b3a8eb9SGleb Smirnoff 		{ "code",		CODE},
53003b3a8eb9SGleb Smirnoff 		{ "crop",		FRAGCROP},
53013b3a8eb9SGleb Smirnoff 		{ "debug",		DEBUG},
53023b3a8eb9SGleb Smirnoff 		{ "divert-reply",	DIVERTREPLY},
53033b3a8eb9SGleb Smirnoff 		{ "divert-to",		DIVERTTO},
53043b3a8eb9SGleb Smirnoff 		{ "drop",		DROP},
53053b3a8eb9SGleb Smirnoff 		{ "drop-ovl",		FRAGDROP},
53063b3a8eb9SGleb Smirnoff 		{ "dup-to",		DUPTO},
5307*a5b789f6SErmal Luçi 		{ "fairq",		FAIRQ},
53083b3a8eb9SGleb Smirnoff 		{ "fastroute",		FASTROUTE},
53093b3a8eb9SGleb Smirnoff 		{ "file",		FILENAME},
53103b3a8eb9SGleb Smirnoff 		{ "fingerprints",	FINGERPRINTS},
53113b3a8eb9SGleb Smirnoff 		{ "flags",		FLAGS},
53123b3a8eb9SGleb Smirnoff 		{ "floating",		FLOATING},
53133b3a8eb9SGleb Smirnoff 		{ "flush",		FLUSH},
53143b3a8eb9SGleb Smirnoff 		{ "for",		FOR},
53153b3a8eb9SGleb Smirnoff 		{ "fragment",		FRAGMENT},
53163b3a8eb9SGleb Smirnoff 		{ "from",		FROM},
53173b3a8eb9SGleb Smirnoff 		{ "global",		GLOBAL},
53183b3a8eb9SGleb Smirnoff 		{ "group",		GROUP},
53193b3a8eb9SGleb Smirnoff 		{ "hfsc",		HFSC},
5320*a5b789f6SErmal Luçi 		{ "hogs",		HOGS},
53213b3a8eb9SGleb Smirnoff 		{ "hostid",		HOSTID},
53223b3a8eb9SGleb Smirnoff 		{ "icmp-type",		ICMPTYPE},
53233b3a8eb9SGleb Smirnoff 		{ "icmp6-type",		ICMP6TYPE},
53243b3a8eb9SGleb Smirnoff 		{ "if-bound",		IFBOUND},
53253b3a8eb9SGleb Smirnoff 		{ "in",			IN},
53263b3a8eb9SGleb Smirnoff 		{ "include",		INCLUDE},
53273b3a8eb9SGleb Smirnoff 		{ "inet",		INET},
53283b3a8eb9SGleb Smirnoff 		{ "inet6",		INET6},
53293b3a8eb9SGleb Smirnoff 		{ "keep",		KEEP},
53303b3a8eb9SGleb Smirnoff 		{ "label",		LABEL},
53313b3a8eb9SGleb Smirnoff 		{ "limit",		LIMIT},
53323b3a8eb9SGleb Smirnoff 		{ "linkshare",		LINKSHARE},
53333b3a8eb9SGleb Smirnoff 		{ "load",		LOAD},
53343b3a8eb9SGleb Smirnoff 		{ "log",		LOG},
53353b3a8eb9SGleb Smirnoff 		{ "loginterface",	LOGINTERFACE},
53363b3a8eb9SGleb Smirnoff 		{ "max",		MAXIMUM},
53373b3a8eb9SGleb Smirnoff 		{ "max-mss",		MAXMSS},
53383b3a8eb9SGleb Smirnoff 		{ "max-src-conn",	MAXSRCCONN},
53393b3a8eb9SGleb Smirnoff 		{ "max-src-conn-rate",	MAXSRCCONNRATE},
53403b3a8eb9SGleb Smirnoff 		{ "max-src-nodes",	MAXSRCNODES},
53413b3a8eb9SGleb Smirnoff 		{ "max-src-states",	MAXSRCSTATES},
53423b3a8eb9SGleb Smirnoff 		{ "min-ttl",		MINTTL},
53433b3a8eb9SGleb Smirnoff 		{ "modulate",		MODULATE},
53443b3a8eb9SGleb Smirnoff 		{ "nat",		NAT},
53453b3a8eb9SGleb Smirnoff 		{ "nat-anchor",		NATANCHOR},
53463b3a8eb9SGleb Smirnoff 		{ "no",			NO},
53473b3a8eb9SGleb Smirnoff 		{ "no-df",		NODF},
53483b3a8eb9SGleb Smirnoff 		{ "no-route",		NOROUTE},
53493b3a8eb9SGleb Smirnoff 		{ "no-sync",		NOSYNC},
53503b3a8eb9SGleb Smirnoff 		{ "on",			ON},
53513b3a8eb9SGleb Smirnoff 		{ "optimization",	OPTIMIZATION},
53523b3a8eb9SGleb Smirnoff 		{ "os",			OS},
53533b3a8eb9SGleb Smirnoff 		{ "out",		OUT},
53543b3a8eb9SGleb Smirnoff 		{ "overload",		OVERLOAD},
53553b3a8eb9SGleb Smirnoff 		{ "pass",		PASS},
53563b3a8eb9SGleb Smirnoff 		{ "port",		PORT},
53573b3a8eb9SGleb Smirnoff 		{ "priority",		PRIORITY},
53583b3a8eb9SGleb Smirnoff 		{ "priq",		PRIQ},
53593b3a8eb9SGleb Smirnoff 		{ "probability",	PROBABILITY},
53603b3a8eb9SGleb Smirnoff 		{ "proto",		PROTO},
53613b3a8eb9SGleb Smirnoff 		{ "qlimit",		QLIMIT},
53623b3a8eb9SGleb Smirnoff 		{ "queue",		QUEUE},
53633b3a8eb9SGleb Smirnoff 		{ "quick",		QUICK},
53643b3a8eb9SGleb Smirnoff 		{ "random",		RANDOM},
53653b3a8eb9SGleb Smirnoff 		{ "random-id",		RANDOMID},
53663b3a8eb9SGleb Smirnoff 		{ "rdr",		RDR},
53673b3a8eb9SGleb Smirnoff 		{ "rdr-anchor",		RDRANCHOR},
53683b3a8eb9SGleb Smirnoff 		{ "realtime",		REALTIME},
53693b3a8eb9SGleb Smirnoff 		{ "reassemble",		REASSEMBLE},
53703b3a8eb9SGleb Smirnoff 		{ "reply-to",		REPLYTO},
53713b3a8eb9SGleb Smirnoff 		{ "require-order",	REQUIREORDER},
53723b3a8eb9SGleb Smirnoff 		{ "return",		RETURN},
53733b3a8eb9SGleb Smirnoff 		{ "return-icmp",	RETURNICMP},
53743b3a8eb9SGleb Smirnoff 		{ "return-icmp6",	RETURNICMP6},
53753b3a8eb9SGleb Smirnoff 		{ "return-rst",		RETURNRST},
53763b3a8eb9SGleb Smirnoff 		{ "round-robin",	ROUNDROBIN},
53773b3a8eb9SGleb Smirnoff 		{ "route",		ROUTE},
53783b3a8eb9SGleb Smirnoff 		{ "route-to",		ROUTETO},
53793b3a8eb9SGleb Smirnoff 		{ "rtable",		RTABLE},
53803b3a8eb9SGleb Smirnoff 		{ "rule",		RULE},
53813b3a8eb9SGleb Smirnoff 		{ "ruleset-optimization",	RULESET_OPTIMIZATION},
53823b3a8eb9SGleb Smirnoff 		{ "scrub",		SCRUB},
53833b3a8eb9SGleb Smirnoff 		{ "set",		SET},
53843b3a8eb9SGleb Smirnoff 		{ "set-tos",		SETTOS},
53853b3a8eb9SGleb Smirnoff 		{ "skip",		SKIP},
53863b3a8eb9SGleb Smirnoff 		{ "sloppy",		SLOPPY},
53873b3a8eb9SGleb Smirnoff 		{ "source-hash",	SOURCEHASH},
53883b3a8eb9SGleb Smirnoff 		{ "source-track",	SOURCETRACK},
53893b3a8eb9SGleb Smirnoff 		{ "state",		STATE},
53903b3a8eb9SGleb Smirnoff 		{ "state-defaults",	STATEDEFAULTS},
53913b3a8eb9SGleb Smirnoff 		{ "state-policy",	STATEPOLICY},
53923b3a8eb9SGleb Smirnoff 		{ "static-port",	STATICPORT},
53933b3a8eb9SGleb Smirnoff 		{ "sticky-address",	STICKYADDRESS},
53943b3a8eb9SGleb Smirnoff 		{ "synproxy",		SYNPROXY},
53953b3a8eb9SGleb Smirnoff 		{ "table",		TABLE},
53963b3a8eb9SGleb Smirnoff 		{ "tag",		TAG},
53973b3a8eb9SGleb Smirnoff 		{ "tagged",		TAGGED},
53983b3a8eb9SGleb Smirnoff 		{ "tbrsize",		TBRSIZE},
53993b3a8eb9SGleb Smirnoff 		{ "timeout",		TIMEOUT},
54003b3a8eb9SGleb Smirnoff 		{ "to",			TO},
54013b3a8eb9SGleb Smirnoff 		{ "tos",		TOS},
54023b3a8eb9SGleb Smirnoff 		{ "ttl",		TTL},
54033b3a8eb9SGleb Smirnoff 		{ "upperlimit",		UPPERLIMIT},
54043b3a8eb9SGleb Smirnoff 		{ "urpf-failed",	URPFFAILED},
54053b3a8eb9SGleb Smirnoff 		{ "user",		USER},
54063b3a8eb9SGleb Smirnoff 	};
54073b3a8eb9SGleb Smirnoff 	const struct keywords	*p;
54083b3a8eb9SGleb Smirnoff 
54093b3a8eb9SGleb Smirnoff 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
54103b3a8eb9SGleb Smirnoff 	    sizeof(keywords[0]), kw_cmp);
54113b3a8eb9SGleb Smirnoff 
54123b3a8eb9SGleb Smirnoff 	if (p) {
54133b3a8eb9SGleb Smirnoff 		if (debug > 1)
54143b3a8eb9SGleb Smirnoff 			fprintf(stderr, "%s: %d\n", s, p->k_val);
54153b3a8eb9SGleb Smirnoff 		return (p->k_val);
54163b3a8eb9SGleb Smirnoff 	} else {
54173b3a8eb9SGleb Smirnoff 		if (debug > 1)
54183b3a8eb9SGleb Smirnoff 			fprintf(stderr, "string: %s\n", s);
54193b3a8eb9SGleb Smirnoff 		return (STRING);
54203b3a8eb9SGleb Smirnoff 	}
54213b3a8eb9SGleb Smirnoff }
54223b3a8eb9SGleb Smirnoff 
54233b3a8eb9SGleb Smirnoff #define MAXPUSHBACK	128
54243b3a8eb9SGleb Smirnoff 
54253b3a8eb9SGleb Smirnoff char	*parsebuf;
54263b3a8eb9SGleb Smirnoff int	 parseindex;
54273b3a8eb9SGleb Smirnoff char	 pushback_buffer[MAXPUSHBACK];
54283b3a8eb9SGleb Smirnoff int	 pushback_index = 0;
54293b3a8eb9SGleb Smirnoff 
54303b3a8eb9SGleb Smirnoff int
54313b3a8eb9SGleb Smirnoff lgetc(int quotec)
54323b3a8eb9SGleb Smirnoff {
54333b3a8eb9SGleb Smirnoff 	int		c, next;
54343b3a8eb9SGleb Smirnoff 
54353b3a8eb9SGleb Smirnoff 	if (parsebuf) {
54363b3a8eb9SGleb Smirnoff 		/* Read character from the parsebuffer instead of input. */
54373b3a8eb9SGleb Smirnoff 		if (parseindex >= 0) {
54383b3a8eb9SGleb Smirnoff 			c = parsebuf[parseindex++];
54393b3a8eb9SGleb Smirnoff 			if (c != '\0')
54403b3a8eb9SGleb Smirnoff 				return (c);
54413b3a8eb9SGleb Smirnoff 			parsebuf = NULL;
54423b3a8eb9SGleb Smirnoff 		} else
54433b3a8eb9SGleb Smirnoff 			parseindex++;
54443b3a8eb9SGleb Smirnoff 	}
54453b3a8eb9SGleb Smirnoff 
54463b3a8eb9SGleb Smirnoff 	if (pushback_index)
54473b3a8eb9SGleb Smirnoff 		return (pushback_buffer[--pushback_index]);
54483b3a8eb9SGleb Smirnoff 
54493b3a8eb9SGleb Smirnoff 	if (quotec) {
54503b3a8eb9SGleb Smirnoff 		if ((c = getc(file->stream)) == EOF) {
54513b3a8eb9SGleb Smirnoff 			yyerror("reached end of file while parsing quoted string");
54523b3a8eb9SGleb Smirnoff 			if (popfile() == EOF)
54533b3a8eb9SGleb Smirnoff 				return (EOF);
54543b3a8eb9SGleb Smirnoff 			return (quotec);
54553b3a8eb9SGleb Smirnoff 		}
54563b3a8eb9SGleb Smirnoff 		return (c);
54573b3a8eb9SGleb Smirnoff 	}
54583b3a8eb9SGleb Smirnoff 
54593b3a8eb9SGleb Smirnoff 	while ((c = getc(file->stream)) == '\\') {
54603b3a8eb9SGleb Smirnoff 		next = getc(file->stream);
54613b3a8eb9SGleb Smirnoff 		if (next != '\n') {
54623b3a8eb9SGleb Smirnoff 			c = next;
54633b3a8eb9SGleb Smirnoff 			break;
54643b3a8eb9SGleb Smirnoff 		}
54653b3a8eb9SGleb Smirnoff 		yylval.lineno = file->lineno;
54663b3a8eb9SGleb Smirnoff 		file->lineno++;
54673b3a8eb9SGleb Smirnoff 	}
54683b3a8eb9SGleb Smirnoff 
54693b3a8eb9SGleb Smirnoff 	while (c == EOF) {
54703b3a8eb9SGleb Smirnoff 		if (popfile() == EOF)
54713b3a8eb9SGleb Smirnoff 			return (EOF);
54723b3a8eb9SGleb Smirnoff 		c = getc(file->stream);
54733b3a8eb9SGleb Smirnoff 	}
54743b3a8eb9SGleb Smirnoff 	return (c);
54753b3a8eb9SGleb Smirnoff }
54763b3a8eb9SGleb Smirnoff 
54773b3a8eb9SGleb Smirnoff int
54783b3a8eb9SGleb Smirnoff lungetc(int c)
54793b3a8eb9SGleb Smirnoff {
54803b3a8eb9SGleb Smirnoff 	if (c == EOF)
54813b3a8eb9SGleb Smirnoff 		return (EOF);
54823b3a8eb9SGleb Smirnoff 	if (parsebuf) {
54833b3a8eb9SGleb Smirnoff 		parseindex--;
54843b3a8eb9SGleb Smirnoff 		if (parseindex >= 0)
54853b3a8eb9SGleb Smirnoff 			return (c);
54863b3a8eb9SGleb Smirnoff 	}
54873b3a8eb9SGleb Smirnoff 	if (pushback_index < MAXPUSHBACK-1)
54883b3a8eb9SGleb Smirnoff 		return (pushback_buffer[pushback_index++] = c);
54893b3a8eb9SGleb Smirnoff 	else
54903b3a8eb9SGleb Smirnoff 		return (EOF);
54913b3a8eb9SGleb Smirnoff }
54923b3a8eb9SGleb Smirnoff 
54933b3a8eb9SGleb Smirnoff int
54943b3a8eb9SGleb Smirnoff findeol(void)
54953b3a8eb9SGleb Smirnoff {
54963b3a8eb9SGleb Smirnoff 	int	c;
54973b3a8eb9SGleb Smirnoff 
54983b3a8eb9SGleb Smirnoff 	parsebuf = NULL;
54993b3a8eb9SGleb Smirnoff 
55003b3a8eb9SGleb Smirnoff 	/* skip to either EOF or the first real EOL */
55013b3a8eb9SGleb Smirnoff 	while (1) {
55023b3a8eb9SGleb Smirnoff 		if (pushback_index)
55033b3a8eb9SGleb Smirnoff 			c = pushback_buffer[--pushback_index];
55043b3a8eb9SGleb Smirnoff 		else
55053b3a8eb9SGleb Smirnoff 			c = lgetc(0);
55063b3a8eb9SGleb Smirnoff 		if (c == '\n') {
55073b3a8eb9SGleb Smirnoff 			file->lineno++;
55083b3a8eb9SGleb Smirnoff 			break;
55093b3a8eb9SGleb Smirnoff 		}
55103b3a8eb9SGleb Smirnoff 		if (c == EOF)
55113b3a8eb9SGleb Smirnoff 			break;
55123b3a8eb9SGleb Smirnoff 	}
55133b3a8eb9SGleb Smirnoff 	return (ERROR);
55143b3a8eb9SGleb Smirnoff }
55153b3a8eb9SGleb Smirnoff 
55163b3a8eb9SGleb Smirnoff int
55173b3a8eb9SGleb Smirnoff yylex(void)
55183b3a8eb9SGleb Smirnoff {
55193b3a8eb9SGleb Smirnoff 	char	 buf[8096];
55203b3a8eb9SGleb Smirnoff 	char	*p, *val;
55213b3a8eb9SGleb Smirnoff 	int	 quotec, next, c;
55223b3a8eb9SGleb Smirnoff 	int	 token;
55233b3a8eb9SGleb Smirnoff 
55243b3a8eb9SGleb Smirnoff top:
55253b3a8eb9SGleb Smirnoff 	p = buf;
55263b3a8eb9SGleb Smirnoff 	while ((c = lgetc(0)) == ' ' || c == '\t')
55273b3a8eb9SGleb Smirnoff 		; /* nothing */
55283b3a8eb9SGleb Smirnoff 
55293b3a8eb9SGleb Smirnoff 	yylval.lineno = file->lineno;
55303b3a8eb9SGleb Smirnoff 	if (c == '#')
55313b3a8eb9SGleb Smirnoff 		while ((c = lgetc(0)) != '\n' && c != EOF)
55323b3a8eb9SGleb Smirnoff 			; /* nothing */
55333b3a8eb9SGleb Smirnoff 	if (c == '$' && parsebuf == NULL) {
55343b3a8eb9SGleb Smirnoff 		while (1) {
55353b3a8eb9SGleb Smirnoff 			if ((c = lgetc(0)) == EOF)
55363b3a8eb9SGleb Smirnoff 				return (0);
55373b3a8eb9SGleb Smirnoff 
55383b3a8eb9SGleb Smirnoff 			if (p + 1 >= buf + sizeof(buf) - 1) {
55393b3a8eb9SGleb Smirnoff 				yyerror("string too long");
55403b3a8eb9SGleb Smirnoff 				return (findeol());
55413b3a8eb9SGleb Smirnoff 			}
55423b3a8eb9SGleb Smirnoff 			if (isalnum(c) || c == '_') {
55433b3a8eb9SGleb Smirnoff 				*p++ = (char)c;
55443b3a8eb9SGleb Smirnoff 				continue;
55453b3a8eb9SGleb Smirnoff 			}
55463b3a8eb9SGleb Smirnoff 			*p = '\0';
55473b3a8eb9SGleb Smirnoff 			lungetc(c);
55483b3a8eb9SGleb Smirnoff 			break;
55493b3a8eb9SGleb Smirnoff 		}
55503b3a8eb9SGleb Smirnoff 		val = symget(buf);
55513b3a8eb9SGleb Smirnoff 		if (val == NULL) {
55523b3a8eb9SGleb Smirnoff 			yyerror("macro '%s' not defined", buf);
55533b3a8eb9SGleb Smirnoff 			return (findeol());
55543b3a8eb9SGleb Smirnoff 		}
55553b3a8eb9SGleb Smirnoff 		parsebuf = val;
55563b3a8eb9SGleb Smirnoff 		parseindex = 0;
55573b3a8eb9SGleb Smirnoff 		goto top;
55583b3a8eb9SGleb Smirnoff 	}
55593b3a8eb9SGleb Smirnoff 
55603b3a8eb9SGleb Smirnoff 	switch (c) {
55613b3a8eb9SGleb Smirnoff 	case '\'':
55623b3a8eb9SGleb Smirnoff 	case '"':
55633b3a8eb9SGleb Smirnoff 		quotec = c;
55643b3a8eb9SGleb Smirnoff 		while (1) {
55653b3a8eb9SGleb Smirnoff 			if ((c = lgetc(quotec)) == EOF)
55663b3a8eb9SGleb Smirnoff 				return (0);
55673b3a8eb9SGleb Smirnoff 			if (c == '\n') {
55683b3a8eb9SGleb Smirnoff 				file->lineno++;
55693b3a8eb9SGleb Smirnoff 				continue;
55703b3a8eb9SGleb Smirnoff 			} else if (c == '\\') {
55713b3a8eb9SGleb Smirnoff 				if ((next = lgetc(quotec)) == EOF)
55723b3a8eb9SGleb Smirnoff 					return (0);
55733b3a8eb9SGleb Smirnoff 				if (next == quotec || c == ' ' || c == '\t')
55743b3a8eb9SGleb Smirnoff 					c = next;
55753b3a8eb9SGleb Smirnoff 				else if (next == '\n')
55763b3a8eb9SGleb Smirnoff 					continue;
55773b3a8eb9SGleb Smirnoff 				else
55783b3a8eb9SGleb Smirnoff 					lungetc(next);
55793b3a8eb9SGleb Smirnoff 			} else if (c == quotec) {
55803b3a8eb9SGleb Smirnoff 				*p = '\0';
55813b3a8eb9SGleb Smirnoff 				break;
55823b3a8eb9SGleb Smirnoff 			}
55833b3a8eb9SGleb Smirnoff 			if (p + 1 >= buf + sizeof(buf) - 1) {
55843b3a8eb9SGleb Smirnoff 				yyerror("string too long");
55853b3a8eb9SGleb Smirnoff 				return (findeol());
55863b3a8eb9SGleb Smirnoff 			}
55873b3a8eb9SGleb Smirnoff 			*p++ = (char)c;
55883b3a8eb9SGleb Smirnoff 		}
55893b3a8eb9SGleb Smirnoff 		yylval.v.string = strdup(buf);
55903b3a8eb9SGleb Smirnoff 		if (yylval.v.string == NULL)
55913b3a8eb9SGleb Smirnoff 			err(1, "yylex: strdup");
55923b3a8eb9SGleb Smirnoff 		return (STRING);
55933b3a8eb9SGleb Smirnoff 	case '<':
55943b3a8eb9SGleb Smirnoff 		next = lgetc(0);
55953b3a8eb9SGleb Smirnoff 		if (next == '>') {
55963b3a8eb9SGleb Smirnoff 			yylval.v.i = PF_OP_XRG;
55973b3a8eb9SGleb Smirnoff 			return (PORTBINARY);
55983b3a8eb9SGleb Smirnoff 		}
55993b3a8eb9SGleb Smirnoff 		lungetc(next);
56003b3a8eb9SGleb Smirnoff 		break;
56013b3a8eb9SGleb Smirnoff 	case '>':
56023b3a8eb9SGleb Smirnoff 		next = lgetc(0);
56033b3a8eb9SGleb Smirnoff 		if (next == '<') {
56043b3a8eb9SGleb Smirnoff 			yylval.v.i = PF_OP_IRG;
56053b3a8eb9SGleb Smirnoff 			return (PORTBINARY);
56063b3a8eb9SGleb Smirnoff 		}
56073b3a8eb9SGleb Smirnoff 		lungetc(next);
56083b3a8eb9SGleb Smirnoff 		break;
56093b3a8eb9SGleb Smirnoff 	case '-':
56103b3a8eb9SGleb Smirnoff 		next = lgetc(0);
56113b3a8eb9SGleb Smirnoff 		if (next == '>')
56123b3a8eb9SGleb Smirnoff 			return (ARROW);
56133b3a8eb9SGleb Smirnoff 		lungetc(next);
56143b3a8eb9SGleb Smirnoff 		break;
56153b3a8eb9SGleb Smirnoff 	}
56163b3a8eb9SGleb Smirnoff 
56173b3a8eb9SGleb Smirnoff #define allowed_to_end_number(x) \
56183b3a8eb9SGleb Smirnoff 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
56193b3a8eb9SGleb Smirnoff 
56203b3a8eb9SGleb Smirnoff 	if (c == '-' || isdigit(c)) {
56213b3a8eb9SGleb Smirnoff 		do {
56223b3a8eb9SGleb Smirnoff 			*p++ = c;
56233b3a8eb9SGleb Smirnoff 			if ((unsigned)(p-buf) >= sizeof(buf)) {
56243b3a8eb9SGleb Smirnoff 				yyerror("string too long");
56253b3a8eb9SGleb Smirnoff 				return (findeol());
56263b3a8eb9SGleb Smirnoff 			}
56273b3a8eb9SGleb Smirnoff 		} while ((c = lgetc(0)) != EOF && isdigit(c));
56283b3a8eb9SGleb Smirnoff 		lungetc(c);
56293b3a8eb9SGleb Smirnoff 		if (p == buf + 1 && buf[0] == '-')
56303b3a8eb9SGleb Smirnoff 			goto nodigits;
56313b3a8eb9SGleb Smirnoff 		if (c == EOF || allowed_to_end_number(c)) {
56323b3a8eb9SGleb Smirnoff 			const char *errstr = NULL;
56333b3a8eb9SGleb Smirnoff 
56343b3a8eb9SGleb Smirnoff 			*p = '\0';
56353b3a8eb9SGleb Smirnoff 			yylval.v.number = strtonum(buf, LLONG_MIN,
56363b3a8eb9SGleb Smirnoff 			    LLONG_MAX, &errstr);
56373b3a8eb9SGleb Smirnoff 			if (errstr) {
56383b3a8eb9SGleb Smirnoff 				yyerror("\"%s\" invalid number: %s",
56393b3a8eb9SGleb Smirnoff 				    buf, errstr);
56403b3a8eb9SGleb Smirnoff 				return (findeol());
56413b3a8eb9SGleb Smirnoff 			}
56423b3a8eb9SGleb Smirnoff 			return (NUMBER);
56433b3a8eb9SGleb Smirnoff 		} else {
56443b3a8eb9SGleb Smirnoff nodigits:
56453b3a8eb9SGleb Smirnoff 			while (p > buf + 1)
56463b3a8eb9SGleb Smirnoff 				lungetc(*--p);
56473b3a8eb9SGleb Smirnoff 			c = *--p;
56483b3a8eb9SGleb Smirnoff 			if (c == '-')
56493b3a8eb9SGleb Smirnoff 				return (c);
56503b3a8eb9SGleb Smirnoff 		}
56513b3a8eb9SGleb Smirnoff 	}
56523b3a8eb9SGleb Smirnoff 
56533b3a8eb9SGleb Smirnoff #define allowed_in_string(x) \
56543b3a8eb9SGleb Smirnoff 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
56553b3a8eb9SGleb Smirnoff 	x != '{' && x != '}' && x != '<' && x != '>' && \
56563b3a8eb9SGleb Smirnoff 	x != '!' && x != '=' && x != '/' && x != '#' && \
56573b3a8eb9SGleb Smirnoff 	x != ','))
56583b3a8eb9SGleb Smirnoff 
56593b3a8eb9SGleb Smirnoff 	if (isalnum(c) || c == ':' || c == '_') {
56603b3a8eb9SGleb Smirnoff 		do {
56613b3a8eb9SGleb Smirnoff 			*p++ = c;
56623b3a8eb9SGleb Smirnoff 			if ((unsigned)(p-buf) >= sizeof(buf)) {
56633b3a8eb9SGleb Smirnoff 				yyerror("string too long");
56643b3a8eb9SGleb Smirnoff 				return (findeol());
56653b3a8eb9SGleb Smirnoff 			}
56663b3a8eb9SGleb Smirnoff 		} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
56673b3a8eb9SGleb Smirnoff 		lungetc(c);
56683b3a8eb9SGleb Smirnoff 		*p = '\0';
56693b3a8eb9SGleb Smirnoff 		if ((token = lookup(buf)) == STRING)
56703b3a8eb9SGleb Smirnoff 			if ((yylval.v.string = strdup(buf)) == NULL)
56713b3a8eb9SGleb Smirnoff 				err(1, "yylex: strdup");
56723b3a8eb9SGleb Smirnoff 		return (token);
56733b3a8eb9SGleb Smirnoff 	}
56743b3a8eb9SGleb Smirnoff 	if (c == '\n') {
56753b3a8eb9SGleb Smirnoff 		yylval.lineno = file->lineno;
56763b3a8eb9SGleb Smirnoff 		file->lineno++;
56773b3a8eb9SGleb Smirnoff 	}
56783b3a8eb9SGleb Smirnoff 	if (c == EOF)
56793b3a8eb9SGleb Smirnoff 		return (0);
56803b3a8eb9SGleb Smirnoff 	return (c);
56813b3a8eb9SGleb Smirnoff }
56823b3a8eb9SGleb Smirnoff 
56833b3a8eb9SGleb Smirnoff int
56843b3a8eb9SGleb Smirnoff check_file_secrecy(int fd, const char *fname)
56853b3a8eb9SGleb Smirnoff {
56863b3a8eb9SGleb Smirnoff 	struct stat	st;
56873b3a8eb9SGleb Smirnoff 
56883b3a8eb9SGleb Smirnoff 	if (fstat(fd, &st)) {
56893b3a8eb9SGleb Smirnoff 		warn("cannot stat %s", fname);
56903b3a8eb9SGleb Smirnoff 		return (-1);
56913b3a8eb9SGleb Smirnoff 	}
56923b3a8eb9SGleb Smirnoff 	if (st.st_uid != 0 && st.st_uid != getuid()) {
56933b3a8eb9SGleb Smirnoff 		warnx("%s: owner not root or current user", fname);
56943b3a8eb9SGleb Smirnoff 		return (-1);
56953b3a8eb9SGleb Smirnoff 	}
56963b3a8eb9SGleb Smirnoff 	if (st.st_mode & (S_IRWXG | S_IRWXO)) {
56973b3a8eb9SGleb Smirnoff 		warnx("%s: group/world readable/writeable", fname);
56983b3a8eb9SGleb Smirnoff 		return (-1);
56993b3a8eb9SGleb Smirnoff 	}
57003b3a8eb9SGleb Smirnoff 	return (0);
57013b3a8eb9SGleb Smirnoff }
57023b3a8eb9SGleb Smirnoff 
57033b3a8eb9SGleb Smirnoff struct file *
57043b3a8eb9SGleb Smirnoff pushfile(const char *name, int secret)
57053b3a8eb9SGleb Smirnoff {
57063b3a8eb9SGleb Smirnoff 	struct file	*nfile;
57073b3a8eb9SGleb Smirnoff 
57083b3a8eb9SGleb Smirnoff 	if ((nfile = calloc(1, sizeof(struct file))) == NULL ||
57093b3a8eb9SGleb Smirnoff 	    (nfile->name = strdup(name)) == NULL) {
57103b3a8eb9SGleb Smirnoff 		warn("malloc");
57113b3a8eb9SGleb Smirnoff 		return (NULL);
57123b3a8eb9SGleb Smirnoff 	}
57133b3a8eb9SGleb Smirnoff 	if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) {
57143b3a8eb9SGleb Smirnoff 		nfile->stream = stdin;
57153b3a8eb9SGleb Smirnoff 		free(nfile->name);
57163b3a8eb9SGleb Smirnoff 		if ((nfile->name = strdup("stdin")) == NULL) {
57173b3a8eb9SGleb Smirnoff 			warn("strdup");
57183b3a8eb9SGleb Smirnoff 			free(nfile);
57193b3a8eb9SGleb Smirnoff 			return (NULL);
57203b3a8eb9SGleb Smirnoff 		}
57213b3a8eb9SGleb Smirnoff 	} else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
57223b3a8eb9SGleb Smirnoff 		warn("%s", nfile->name);
57233b3a8eb9SGleb Smirnoff 		free(nfile->name);
57243b3a8eb9SGleb Smirnoff 		free(nfile);
57253b3a8eb9SGleb Smirnoff 		return (NULL);
57263b3a8eb9SGleb Smirnoff 	} else if (secret &&
57273b3a8eb9SGleb Smirnoff 	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
57283b3a8eb9SGleb Smirnoff 		fclose(nfile->stream);
57293b3a8eb9SGleb Smirnoff 		free(nfile->name);
57303b3a8eb9SGleb Smirnoff 		free(nfile);
57313b3a8eb9SGleb Smirnoff 		return (NULL);
57323b3a8eb9SGleb Smirnoff 	}
57333b3a8eb9SGleb Smirnoff 	nfile->lineno = 1;
57343b3a8eb9SGleb Smirnoff 	TAILQ_INSERT_TAIL(&files, nfile, entry);
57353b3a8eb9SGleb Smirnoff 	return (nfile);
57363b3a8eb9SGleb Smirnoff }
57373b3a8eb9SGleb Smirnoff 
57383b3a8eb9SGleb Smirnoff int
57393b3a8eb9SGleb Smirnoff popfile(void)
57403b3a8eb9SGleb Smirnoff {
57413b3a8eb9SGleb Smirnoff 	struct file	*prev;
57423b3a8eb9SGleb Smirnoff 
57433b3a8eb9SGleb Smirnoff 	if ((prev = TAILQ_PREV(file, files, entry)) != NULL) {
57443b3a8eb9SGleb Smirnoff 		prev->errors += file->errors;
57453b3a8eb9SGleb Smirnoff 		TAILQ_REMOVE(&files, file, entry);
57463b3a8eb9SGleb Smirnoff 		fclose(file->stream);
57473b3a8eb9SGleb Smirnoff 		free(file->name);
57483b3a8eb9SGleb Smirnoff 		free(file);
57493b3a8eb9SGleb Smirnoff 		file = prev;
57503b3a8eb9SGleb Smirnoff 		return (0);
57513b3a8eb9SGleb Smirnoff 	}
57523b3a8eb9SGleb Smirnoff 	return (EOF);
57533b3a8eb9SGleb Smirnoff }
57543b3a8eb9SGleb Smirnoff 
57553b3a8eb9SGleb Smirnoff int
57563b3a8eb9SGleb Smirnoff parse_config(char *filename, struct pfctl *xpf)
57573b3a8eb9SGleb Smirnoff {
57583b3a8eb9SGleb Smirnoff 	int		 errors = 0;
57593b3a8eb9SGleb Smirnoff 	struct sym	*sym;
57603b3a8eb9SGleb Smirnoff 
57613b3a8eb9SGleb Smirnoff 	pf = xpf;
57623b3a8eb9SGleb Smirnoff 	errors = 0;
57633b3a8eb9SGleb Smirnoff 	rulestate = PFCTL_STATE_NONE;
57643b3a8eb9SGleb Smirnoff 	returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
57653b3a8eb9SGleb Smirnoff 	returnicmp6default =
57663b3a8eb9SGleb Smirnoff 	    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
57673b3a8eb9SGleb Smirnoff 	blockpolicy = PFRULE_DROP;
57683b3a8eb9SGleb Smirnoff 	require_order = 1;
57693b3a8eb9SGleb Smirnoff 
57703b3a8eb9SGleb Smirnoff 	if ((file = pushfile(filename, 0)) == NULL) {
57713b3a8eb9SGleb Smirnoff 		warn("cannot open the main config file!");
57723b3a8eb9SGleb Smirnoff 		return (-1);
57733b3a8eb9SGleb Smirnoff 	}
57743b3a8eb9SGleb Smirnoff 
57753b3a8eb9SGleb Smirnoff 	yyparse();
57763b3a8eb9SGleb Smirnoff 	errors = file->errors;
57773b3a8eb9SGleb Smirnoff 	popfile();
57783b3a8eb9SGleb Smirnoff 
57793b3a8eb9SGleb Smirnoff 	/* Free macros and check which have not been used. */
57803b3a8eb9SGleb Smirnoff 	while ((sym = TAILQ_FIRST(&symhead))) {
57813b3a8eb9SGleb Smirnoff 		if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
57823b3a8eb9SGleb Smirnoff 			fprintf(stderr, "warning: macro '%s' not "
57833b3a8eb9SGleb Smirnoff 			    "used\n", sym->nam);
57843b3a8eb9SGleb Smirnoff 		free(sym->nam);
57853b3a8eb9SGleb Smirnoff 		free(sym->val);
57863b3a8eb9SGleb Smirnoff 		TAILQ_REMOVE(&symhead, sym, entry);
57873b3a8eb9SGleb Smirnoff 		free(sym);
57883b3a8eb9SGleb Smirnoff 	}
57893b3a8eb9SGleb Smirnoff 
57903b3a8eb9SGleb Smirnoff 	return (errors ? -1 : 0);
57913b3a8eb9SGleb Smirnoff }
57923b3a8eb9SGleb Smirnoff 
57933b3a8eb9SGleb Smirnoff int
57943b3a8eb9SGleb Smirnoff symset(const char *nam, const char *val, int persist)
57953b3a8eb9SGleb Smirnoff {
57963b3a8eb9SGleb Smirnoff 	struct sym	*sym;
57973b3a8eb9SGleb Smirnoff 
57983b3a8eb9SGleb Smirnoff 	for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
57993b3a8eb9SGleb Smirnoff 	    sym = TAILQ_NEXT(sym, entry))
58003b3a8eb9SGleb Smirnoff 		;	/* nothing */
58013b3a8eb9SGleb Smirnoff 
58023b3a8eb9SGleb Smirnoff 	if (sym != NULL) {
58033b3a8eb9SGleb Smirnoff 		if (sym->persist == 1)
58043b3a8eb9SGleb Smirnoff 			return (0);
58053b3a8eb9SGleb Smirnoff 		else {
58063b3a8eb9SGleb Smirnoff 			free(sym->nam);
58073b3a8eb9SGleb Smirnoff 			free(sym->val);
58083b3a8eb9SGleb Smirnoff 			TAILQ_REMOVE(&symhead, sym, entry);
58093b3a8eb9SGleb Smirnoff 			free(sym);
58103b3a8eb9SGleb Smirnoff 		}
58113b3a8eb9SGleb Smirnoff 	}
58123b3a8eb9SGleb Smirnoff 	if ((sym = calloc(1, sizeof(*sym))) == NULL)
58133b3a8eb9SGleb Smirnoff 		return (-1);
58143b3a8eb9SGleb Smirnoff 
58153b3a8eb9SGleb Smirnoff 	sym->nam = strdup(nam);
58163b3a8eb9SGleb Smirnoff 	if (sym->nam == NULL) {
58173b3a8eb9SGleb Smirnoff 		free(sym);
58183b3a8eb9SGleb Smirnoff 		return (-1);
58193b3a8eb9SGleb Smirnoff 	}
58203b3a8eb9SGleb Smirnoff 	sym->val = strdup(val);
58213b3a8eb9SGleb Smirnoff 	if (sym->val == NULL) {
58223b3a8eb9SGleb Smirnoff 		free(sym->nam);
58233b3a8eb9SGleb Smirnoff 		free(sym);
58243b3a8eb9SGleb Smirnoff 		return (-1);
58253b3a8eb9SGleb Smirnoff 	}
58263b3a8eb9SGleb Smirnoff 	sym->used = 0;
58273b3a8eb9SGleb Smirnoff 	sym->persist = persist;
58283b3a8eb9SGleb Smirnoff 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
58293b3a8eb9SGleb Smirnoff 	return (0);
58303b3a8eb9SGleb Smirnoff }
58313b3a8eb9SGleb Smirnoff 
58323b3a8eb9SGleb Smirnoff int
58333b3a8eb9SGleb Smirnoff pfctl_cmdline_symset(char *s)
58343b3a8eb9SGleb Smirnoff {
58353b3a8eb9SGleb Smirnoff 	char	*sym, *val;
58363b3a8eb9SGleb Smirnoff 	int	 ret;
58373b3a8eb9SGleb Smirnoff 
58383b3a8eb9SGleb Smirnoff 	if ((val = strrchr(s, '=')) == NULL)
58393b3a8eb9SGleb Smirnoff 		return (-1);
58403b3a8eb9SGleb Smirnoff 
58413b3a8eb9SGleb Smirnoff 	if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
58423b3a8eb9SGleb Smirnoff 		err(1, "pfctl_cmdline_symset: malloc");
58433b3a8eb9SGleb Smirnoff 
58443b3a8eb9SGleb Smirnoff 	strlcpy(sym, s, strlen(s) - strlen(val) + 1);
58453b3a8eb9SGleb Smirnoff 
58463b3a8eb9SGleb Smirnoff 	ret = symset(sym, val + 1, 1);
58473b3a8eb9SGleb Smirnoff 	free(sym);
58483b3a8eb9SGleb Smirnoff 
58493b3a8eb9SGleb Smirnoff 	return (ret);
58503b3a8eb9SGleb Smirnoff }
58513b3a8eb9SGleb Smirnoff 
58523b3a8eb9SGleb Smirnoff char *
58533b3a8eb9SGleb Smirnoff symget(const char *nam)
58543b3a8eb9SGleb Smirnoff {
58553b3a8eb9SGleb Smirnoff 	struct sym	*sym;
58563b3a8eb9SGleb Smirnoff 
58573b3a8eb9SGleb Smirnoff 	TAILQ_FOREACH(sym, &symhead, entry)
58583b3a8eb9SGleb Smirnoff 		if (strcmp(nam, sym->nam) == 0) {
58593b3a8eb9SGleb Smirnoff 			sym->used = 1;
58603b3a8eb9SGleb Smirnoff 			return (sym->val);
58613b3a8eb9SGleb Smirnoff 		}
58623b3a8eb9SGleb Smirnoff 	return (NULL);
58633b3a8eb9SGleb Smirnoff }
58643b3a8eb9SGleb Smirnoff 
58653b3a8eb9SGleb Smirnoff void
58663b3a8eb9SGleb Smirnoff mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst)
58673b3a8eb9SGleb Smirnoff {
58683b3a8eb9SGleb Smirnoff 	int i;
58693b3a8eb9SGleb Smirnoff 	struct pf_rule *r;
58703b3a8eb9SGleb Smirnoff 
58713b3a8eb9SGleb Smirnoff 	for (i = 0; i < PF_RULESET_MAX; ++i) {
58723b3a8eb9SGleb Smirnoff 		while ((r = TAILQ_FIRST(src->rules[i].active.ptr))
58733b3a8eb9SGleb Smirnoff 		    != NULL) {
58743b3a8eb9SGleb Smirnoff 			TAILQ_REMOVE(src->rules[i].active.ptr, r, entries);
58753b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries);
58763b3a8eb9SGleb Smirnoff 			dst->anchor->match++;
58773b3a8eb9SGleb Smirnoff 		}
58783b3a8eb9SGleb Smirnoff 		src->anchor->match = 0;
58793b3a8eb9SGleb Smirnoff 		while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr))
58803b3a8eb9SGleb Smirnoff 		    != NULL) {
58813b3a8eb9SGleb Smirnoff 			TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries);
58823b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr,
58833b3a8eb9SGleb Smirnoff 				r, entries);
58843b3a8eb9SGleb Smirnoff 		}
58853b3a8eb9SGleb Smirnoff 	}
58863b3a8eb9SGleb Smirnoff }
58873b3a8eb9SGleb Smirnoff 
58883b3a8eb9SGleb Smirnoff void
58893b3a8eb9SGleb Smirnoff decide_address_family(struct node_host *n, sa_family_t *af)
58903b3a8eb9SGleb Smirnoff {
58913b3a8eb9SGleb Smirnoff 	if (*af != 0 || n == NULL)
58923b3a8eb9SGleb Smirnoff 		return;
58933b3a8eb9SGleb Smirnoff 	*af = n->af;
58943b3a8eb9SGleb Smirnoff 	while ((n = n->next) != NULL) {
58953b3a8eb9SGleb Smirnoff 		if (n->af != *af) {
58963b3a8eb9SGleb Smirnoff 			*af = 0;
58973b3a8eb9SGleb Smirnoff 			return;
58983b3a8eb9SGleb Smirnoff 		}
58993b3a8eb9SGleb Smirnoff 	}
59003b3a8eb9SGleb Smirnoff }
59013b3a8eb9SGleb Smirnoff 
59023b3a8eb9SGleb Smirnoff void
59033b3a8eb9SGleb Smirnoff remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
59043b3a8eb9SGleb Smirnoff {
59053b3a8eb9SGleb Smirnoff 	struct node_host	*n = *nh, *prev = NULL;
59063b3a8eb9SGleb Smirnoff 
59073b3a8eb9SGleb Smirnoff 	while (n != NULL) {
59083b3a8eb9SGleb Smirnoff 		if (*af && n->af && n->af != *af) {
59093b3a8eb9SGleb Smirnoff 			/* unlink and free n */
59103b3a8eb9SGleb Smirnoff 			struct node_host *next = n->next;
59113b3a8eb9SGleb Smirnoff 
59123b3a8eb9SGleb Smirnoff 			/* adjust tail pointer */
59133b3a8eb9SGleb Smirnoff 			if (n == (*nh)->tail)
59143b3a8eb9SGleb Smirnoff 				(*nh)->tail = prev;
59153b3a8eb9SGleb Smirnoff 			/* adjust previous node's next pointer */
59163b3a8eb9SGleb Smirnoff 			if (prev == NULL)
59173b3a8eb9SGleb Smirnoff 				*nh = next;
59183b3a8eb9SGleb Smirnoff 			else
59193b3a8eb9SGleb Smirnoff 				prev->next = next;
59203b3a8eb9SGleb Smirnoff 			/* free node */
59213b3a8eb9SGleb Smirnoff 			if (n->ifname != NULL)
59223b3a8eb9SGleb Smirnoff 				free(n->ifname);
59233b3a8eb9SGleb Smirnoff 			free(n);
59243b3a8eb9SGleb Smirnoff 			n = next;
59253b3a8eb9SGleb Smirnoff 		} else {
59263b3a8eb9SGleb Smirnoff 			if (n->af && !*af)
59273b3a8eb9SGleb Smirnoff 				*af = n->af;
59283b3a8eb9SGleb Smirnoff 			prev = n;
59293b3a8eb9SGleb Smirnoff 			n = n->next;
59303b3a8eb9SGleb Smirnoff 		}
59313b3a8eb9SGleb Smirnoff 	}
59323b3a8eb9SGleb Smirnoff }
59333b3a8eb9SGleb Smirnoff 
59343b3a8eb9SGleb Smirnoff int
59353b3a8eb9SGleb Smirnoff invalid_redirect(struct node_host *nh, sa_family_t af)
59363b3a8eb9SGleb Smirnoff {
59373b3a8eb9SGleb Smirnoff 	if (!af) {
59383b3a8eb9SGleb Smirnoff 		struct node_host *n;
59393b3a8eb9SGleb Smirnoff 
59403b3a8eb9SGleb Smirnoff 		/* tables and dyniftl are ok without an address family */
59413b3a8eb9SGleb Smirnoff 		for (n = nh; n != NULL; n = n->next) {
59423b3a8eb9SGleb Smirnoff 			if (n->addr.type != PF_ADDR_TABLE &&
59433b3a8eb9SGleb Smirnoff 			    n->addr.type != PF_ADDR_DYNIFTL) {
59443b3a8eb9SGleb Smirnoff 				yyerror("address family not given and "
59453b3a8eb9SGleb Smirnoff 				    "translation address expands to multiple "
59463b3a8eb9SGleb Smirnoff 				    "address families");
59473b3a8eb9SGleb Smirnoff 				return (1);
59483b3a8eb9SGleb Smirnoff 			}
59493b3a8eb9SGleb Smirnoff 		}
59503b3a8eb9SGleb Smirnoff 	}
59513b3a8eb9SGleb Smirnoff 	if (nh == NULL) {
59523b3a8eb9SGleb Smirnoff 		yyerror("no translation address with matching address family "
59533b3a8eb9SGleb Smirnoff 		    "found.");
59543b3a8eb9SGleb Smirnoff 		return (1);
59553b3a8eb9SGleb Smirnoff 	}
59563b3a8eb9SGleb Smirnoff 	return (0);
59573b3a8eb9SGleb Smirnoff }
59583b3a8eb9SGleb Smirnoff 
59593b3a8eb9SGleb Smirnoff int
59603b3a8eb9SGleb Smirnoff atoul(char *s, u_long *ulvalp)
59613b3a8eb9SGleb Smirnoff {
59623b3a8eb9SGleb Smirnoff 	u_long	 ulval;
59633b3a8eb9SGleb Smirnoff 	char	*ep;
59643b3a8eb9SGleb Smirnoff 
59653b3a8eb9SGleb Smirnoff 	errno = 0;
59663b3a8eb9SGleb Smirnoff 	ulval = strtoul(s, &ep, 0);
59673b3a8eb9SGleb Smirnoff 	if (s[0] == '\0' || *ep != '\0')
59683b3a8eb9SGleb Smirnoff 		return (-1);
59693b3a8eb9SGleb Smirnoff 	if (errno == ERANGE && ulval == ULONG_MAX)
59703b3a8eb9SGleb Smirnoff 		return (-1);
59713b3a8eb9SGleb Smirnoff 	*ulvalp = ulval;
59723b3a8eb9SGleb Smirnoff 	return (0);
59733b3a8eb9SGleb Smirnoff }
59743b3a8eb9SGleb Smirnoff 
59753b3a8eb9SGleb Smirnoff int
59763b3a8eb9SGleb Smirnoff getservice(char *n)
59773b3a8eb9SGleb Smirnoff {
59783b3a8eb9SGleb Smirnoff 	struct servent	*s;
59793b3a8eb9SGleb Smirnoff 	u_long		 ulval;
59803b3a8eb9SGleb Smirnoff 
59813b3a8eb9SGleb Smirnoff 	if (atoul(n, &ulval) == 0) {
59823b3a8eb9SGleb Smirnoff 		if (ulval > 65535) {
59833b3a8eb9SGleb Smirnoff 			yyerror("illegal port value %lu", ulval);
59843b3a8eb9SGleb Smirnoff 			return (-1);
59853b3a8eb9SGleb Smirnoff 		}
59863b3a8eb9SGleb Smirnoff 		return (htons(ulval));
59873b3a8eb9SGleb Smirnoff 	} else {
59883b3a8eb9SGleb Smirnoff 		s = getservbyname(n, "tcp");
59893b3a8eb9SGleb Smirnoff 		if (s == NULL)
59903b3a8eb9SGleb Smirnoff 			s = getservbyname(n, "udp");
59913b3a8eb9SGleb Smirnoff 		if (s == NULL) {
59923b3a8eb9SGleb Smirnoff 			yyerror("unknown port %s", n);
59933b3a8eb9SGleb Smirnoff 			return (-1);
59943b3a8eb9SGleb Smirnoff 		}
59953b3a8eb9SGleb Smirnoff 		return (s->s_port);
59963b3a8eb9SGleb Smirnoff 	}
59973b3a8eb9SGleb Smirnoff }
59983b3a8eb9SGleb Smirnoff 
59993b3a8eb9SGleb Smirnoff int
60003b3a8eb9SGleb Smirnoff rule_label(struct pf_rule *r, char *s)
60013b3a8eb9SGleb Smirnoff {
60023b3a8eb9SGleb Smirnoff 	if (s) {
60033b3a8eb9SGleb Smirnoff 		if (strlcpy(r->label, s, sizeof(r->label)) >=
60043b3a8eb9SGleb Smirnoff 		    sizeof(r->label)) {
60053b3a8eb9SGleb Smirnoff 			yyerror("rule label too long (max %d chars)",
60063b3a8eb9SGleb Smirnoff 			    sizeof(r->label)-1);
60073b3a8eb9SGleb Smirnoff 			return (-1);
60083b3a8eb9SGleb Smirnoff 		}
60093b3a8eb9SGleb Smirnoff 	}
60103b3a8eb9SGleb Smirnoff 	return (0);
60113b3a8eb9SGleb Smirnoff }
60123b3a8eb9SGleb Smirnoff 
60133b3a8eb9SGleb Smirnoff u_int16_t
60143b3a8eb9SGleb Smirnoff parseicmpspec(char *w, sa_family_t af)
60153b3a8eb9SGleb Smirnoff {
60163b3a8eb9SGleb Smirnoff 	const struct icmpcodeent	*p;
60173b3a8eb9SGleb Smirnoff 	u_long				 ulval;
60183b3a8eb9SGleb Smirnoff 	u_int8_t			 icmptype;
60193b3a8eb9SGleb Smirnoff 
60203b3a8eb9SGleb Smirnoff 	if (af == AF_INET)
60213b3a8eb9SGleb Smirnoff 		icmptype = returnicmpdefault >> 8;
60223b3a8eb9SGleb Smirnoff 	else
60233b3a8eb9SGleb Smirnoff 		icmptype = returnicmp6default >> 8;
60243b3a8eb9SGleb Smirnoff 
60253b3a8eb9SGleb Smirnoff 	if (atoul(w, &ulval) == -1) {
60263b3a8eb9SGleb Smirnoff 		if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
60273b3a8eb9SGleb Smirnoff 			yyerror("unknown icmp code %s", w);
60283b3a8eb9SGleb Smirnoff 			return (0);
60293b3a8eb9SGleb Smirnoff 		}
60303b3a8eb9SGleb Smirnoff 		ulval = p->code;
60313b3a8eb9SGleb Smirnoff 	}
60323b3a8eb9SGleb Smirnoff 	if (ulval > 255) {
60333b3a8eb9SGleb Smirnoff 		yyerror("invalid icmp code %lu", ulval);
60343b3a8eb9SGleb Smirnoff 		return (0);
60353b3a8eb9SGleb Smirnoff 	}
60363b3a8eb9SGleb Smirnoff 	return (icmptype << 8 | ulval);
60373b3a8eb9SGleb Smirnoff }
60383b3a8eb9SGleb Smirnoff 
60393b3a8eb9SGleb Smirnoff int
60403b3a8eb9SGleb Smirnoff parseport(char *port, struct range *r, int extensions)
60413b3a8eb9SGleb Smirnoff {
60423b3a8eb9SGleb Smirnoff 	char	*p = strchr(port, ':');
60433b3a8eb9SGleb Smirnoff 
60443b3a8eb9SGleb Smirnoff 	if (p == NULL) {
60453b3a8eb9SGleb Smirnoff 		if ((r->a = getservice(port)) == -1)
60463b3a8eb9SGleb Smirnoff 			return (-1);
60473b3a8eb9SGleb Smirnoff 		r->b = 0;
60483b3a8eb9SGleb Smirnoff 		r->t = PF_OP_NONE;
60493b3a8eb9SGleb Smirnoff 		return (0);
60503b3a8eb9SGleb Smirnoff 	}
60513b3a8eb9SGleb Smirnoff 	if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) {
60523b3a8eb9SGleb Smirnoff 		*p = 0;
60533b3a8eb9SGleb Smirnoff 		if ((r->a = getservice(port)) == -1)
60543b3a8eb9SGleb Smirnoff 			return (-1);
60553b3a8eb9SGleb Smirnoff 		r->b = 0;
60563b3a8eb9SGleb Smirnoff 		r->t = PF_OP_IRG;
60573b3a8eb9SGleb Smirnoff 		return (0);
60583b3a8eb9SGleb Smirnoff 	}
60593b3a8eb9SGleb Smirnoff 	if ((extensions & PPORT_RANGE)) {
60603b3a8eb9SGleb Smirnoff 		*p++ = 0;
60613b3a8eb9SGleb Smirnoff 		if ((r->a = getservice(port)) == -1 ||
60623b3a8eb9SGleb Smirnoff 		    (r->b = getservice(p)) == -1)
60633b3a8eb9SGleb Smirnoff 			return (-1);
60643b3a8eb9SGleb Smirnoff 		if (r->a == r->b) {
60653b3a8eb9SGleb Smirnoff 			r->b = 0;
60663b3a8eb9SGleb Smirnoff 			r->t = PF_OP_NONE;
60673b3a8eb9SGleb Smirnoff 		} else
60683b3a8eb9SGleb Smirnoff 			r->t = PF_OP_RRG;
60693b3a8eb9SGleb Smirnoff 		return (0);
60703b3a8eb9SGleb Smirnoff 	}
60713b3a8eb9SGleb Smirnoff 	return (-1);
60723b3a8eb9SGleb Smirnoff }
60733b3a8eb9SGleb Smirnoff 
60743b3a8eb9SGleb Smirnoff int
60753b3a8eb9SGleb Smirnoff pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans)
60763b3a8eb9SGleb Smirnoff {
60773b3a8eb9SGleb Smirnoff 	struct loadanchors	*la;
60783b3a8eb9SGleb Smirnoff 
60793b3a8eb9SGleb Smirnoff 	TAILQ_FOREACH(la, &loadanchorshead, entries) {
60803b3a8eb9SGleb Smirnoff 		if (pf->opts & PF_OPT_VERBOSE)
60813b3a8eb9SGleb Smirnoff 			fprintf(stderr, "\nLoading anchor %s from %s\n",
60823b3a8eb9SGleb Smirnoff 			    la->anchorname, la->filename);
60833b3a8eb9SGleb Smirnoff 		if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize,
60843b3a8eb9SGleb Smirnoff 		    la->anchorname, trans) == -1)
60853b3a8eb9SGleb Smirnoff 			return (-1);
60863b3a8eb9SGleb Smirnoff 	}
60873b3a8eb9SGleb Smirnoff 
60883b3a8eb9SGleb Smirnoff 	return (0);
60893b3a8eb9SGleb Smirnoff }
60903b3a8eb9SGleb Smirnoff 
60913b3a8eb9SGleb Smirnoff int
60923b3a8eb9SGleb Smirnoff rt_tableid_max(void)
60933b3a8eb9SGleb Smirnoff {
60943b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
60953b3a8eb9SGleb Smirnoff 	int fibs;
60963b3a8eb9SGleb Smirnoff 	size_t l = sizeof(fibs);
60973b3a8eb9SGleb Smirnoff 
60983b3a8eb9SGleb Smirnoff         if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1)
60993b3a8eb9SGleb Smirnoff 		fibs = 16;	/* XXX RT_MAXFIBS, at least limit it some. */
61003b3a8eb9SGleb Smirnoff 	/*
61013b3a8eb9SGleb Smirnoff 	 * As the OpenBSD code only compares > and not >= we need to adjust
61023b3a8eb9SGleb Smirnoff 	 * here given we only accept values of 0..n and want to avoid #ifdefs
61033b3a8eb9SGleb Smirnoff 	 * in the grammer.
61043b3a8eb9SGleb Smirnoff 	 */
61053b3a8eb9SGleb Smirnoff 	return (fibs - 1);
61063b3a8eb9SGleb Smirnoff #else
61073b3a8eb9SGleb Smirnoff 	return (RT_TABLEID_MAX);
61083b3a8eb9SGleb Smirnoff #endif
61093b3a8eb9SGleb Smirnoff }
6110