13b3a8eb9SGleb Smirnoff /* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */ 23b3a8eb9SGleb Smirnoff 31de7b4b8SPedro F. Giffuni /*- 41de7b4b8SPedro F. Giffuni * SPDX-License-Identifier: BSD-2-Clause 51de7b4b8SPedro F. Giffuni * 63b3a8eb9SGleb Smirnoff * Copyright (c) 2001 Markus Friedl. All rights reserved. 73b3a8eb9SGleb Smirnoff * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 83b3a8eb9SGleb Smirnoff * Copyright (c) 2001 Theo de Raadt. All rights reserved. 93b3a8eb9SGleb Smirnoff * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 103b3a8eb9SGleb Smirnoff * 113b3a8eb9SGleb Smirnoff * Redistribution and use in source and binary forms, with or without 123b3a8eb9SGleb Smirnoff * modification, are permitted provided that the following conditions 133b3a8eb9SGleb Smirnoff * are met: 143b3a8eb9SGleb Smirnoff * 1. Redistributions of source code must retain the above copyright 153b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer. 163b3a8eb9SGleb Smirnoff * 2. Redistributions in binary form must reproduce the above copyright 173b3a8eb9SGleb Smirnoff * notice, this list of conditions and the following disclaimer in the 183b3a8eb9SGleb Smirnoff * documentation and/or other materials provided with the distribution. 193b3a8eb9SGleb Smirnoff * 203b3a8eb9SGleb Smirnoff * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 213b3a8eb9SGleb Smirnoff * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 223b3a8eb9SGleb Smirnoff * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 233b3a8eb9SGleb Smirnoff * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 243b3a8eb9SGleb Smirnoff * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 253b3a8eb9SGleb Smirnoff * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 263b3a8eb9SGleb Smirnoff * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 273b3a8eb9SGleb Smirnoff * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 283b3a8eb9SGleb Smirnoff * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 293b3a8eb9SGleb Smirnoff * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 303b3a8eb9SGleb Smirnoff */ 313b3a8eb9SGleb Smirnoff %{ 323b3a8eb9SGleb Smirnoff #include <sys/cdefs.h> 333b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$"); 343b3a8eb9SGleb Smirnoff 35249cc75fSPatrick Kelsey #define PFIOC_USE_LATEST 36249cc75fSPatrick Kelsey 373b3a8eb9SGleb Smirnoff #include <sys/types.h> 383b3a8eb9SGleb Smirnoff #include <sys/socket.h> 393b3a8eb9SGleb Smirnoff #include <sys/stat.h> 403b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 413b3a8eb9SGleb Smirnoff #include <sys/sysctl.h> 423b3a8eb9SGleb Smirnoff #endif 433b3a8eb9SGleb Smirnoff #include <net/if.h> 443b3a8eb9SGleb Smirnoff #include <netinet/in.h> 453b3a8eb9SGleb Smirnoff #include <netinet/in_systm.h> 463b3a8eb9SGleb Smirnoff #include <netinet/ip.h> 473b3a8eb9SGleb Smirnoff #include <netinet/ip_icmp.h> 483b3a8eb9SGleb Smirnoff #include <netinet/icmp6.h> 493b3a8eb9SGleb Smirnoff #include <net/pfvar.h> 503b3a8eb9SGleb Smirnoff #include <arpa/inet.h> 51772e66a6SGleb Smirnoff #include <net/altq/altq.h> 52772e66a6SGleb Smirnoff #include <net/altq/altq_cbq.h> 530a70aaf8SLuiz Otavio O Souza #include <net/altq/altq_codel.h> 54772e66a6SGleb Smirnoff #include <net/altq/altq_priq.h> 55772e66a6SGleb Smirnoff #include <net/altq/altq_hfsc.h> 56a5b789f6SErmal Luçi #include <net/altq/altq_fairq.h> 573b3a8eb9SGleb Smirnoff 586fcc8e04SKristof Provost #include <assert.h> 593b3a8eb9SGleb Smirnoff #include <stdio.h> 603b3a8eb9SGleb Smirnoff #include <unistd.h> 613b3a8eb9SGleb Smirnoff #include <stdlib.h> 623b3a8eb9SGleb Smirnoff #include <netdb.h> 633b3a8eb9SGleb Smirnoff #include <stdarg.h> 643b3a8eb9SGleb Smirnoff #include <errno.h> 653b3a8eb9SGleb Smirnoff #include <string.h> 663b3a8eb9SGleb Smirnoff #include <ctype.h> 673b3a8eb9SGleb Smirnoff #include <math.h> 683b3a8eb9SGleb Smirnoff #include <err.h> 693b3a8eb9SGleb Smirnoff #include <limits.h> 703b3a8eb9SGleb Smirnoff #include <pwd.h> 713b3a8eb9SGleb Smirnoff #include <grp.h> 723b3a8eb9SGleb Smirnoff #include <md5.h> 733b3a8eb9SGleb Smirnoff 743b3a8eb9SGleb Smirnoff #include "pfctl_parser.h" 753b3a8eb9SGleb Smirnoff #include "pfctl.h" 763b3a8eb9SGleb Smirnoff 773b3a8eb9SGleb Smirnoff static struct pfctl *pf = NULL; 783b3a8eb9SGleb Smirnoff static int debug = 0; 793b3a8eb9SGleb Smirnoff static int rulestate = 0; 803b3a8eb9SGleb Smirnoff static u_int16_t returnicmpdefault = 813b3a8eb9SGleb Smirnoff (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 823b3a8eb9SGleb Smirnoff static u_int16_t returnicmp6default = 833b3a8eb9SGleb Smirnoff (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 843b3a8eb9SGleb Smirnoff static int blockpolicy = PFRULE_DROP; 85150182e3SKristof Provost static int failpolicy = PFRULE_DROP; 863b3a8eb9SGleb Smirnoff static int require_order = 1; 873b3a8eb9SGleb Smirnoff static int default_statelock; 883b3a8eb9SGleb Smirnoff 8913cfafabSKristof Provost static TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 903b3a8eb9SGleb Smirnoff static struct file { 913b3a8eb9SGleb Smirnoff TAILQ_ENTRY(file) entry; 923b3a8eb9SGleb Smirnoff FILE *stream; 933b3a8eb9SGleb Smirnoff char *name; 943b3a8eb9SGleb Smirnoff int lineno; 953b3a8eb9SGleb Smirnoff int errors; 963b3a8eb9SGleb Smirnoff } *file; 973b3a8eb9SGleb Smirnoff struct file *pushfile(const char *, int); 983b3a8eb9SGleb Smirnoff int popfile(void); 993b3a8eb9SGleb Smirnoff int check_file_secrecy(int, const char *); 1003b3a8eb9SGleb Smirnoff int yyparse(void); 1013b3a8eb9SGleb Smirnoff int yylex(void); 1023b3a8eb9SGleb Smirnoff int yyerror(const char *, ...); 1033b3a8eb9SGleb Smirnoff int kw_cmp(const void *, const void *); 1043b3a8eb9SGleb Smirnoff int lookup(char *); 1053b3a8eb9SGleb Smirnoff int lgetc(int); 1063b3a8eb9SGleb Smirnoff int lungetc(int); 1073b3a8eb9SGleb Smirnoff int findeol(void); 1083b3a8eb9SGleb Smirnoff 10913cfafabSKristof Provost static TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 1103b3a8eb9SGleb Smirnoff struct sym { 1113b3a8eb9SGleb Smirnoff TAILQ_ENTRY(sym) entry; 1123b3a8eb9SGleb Smirnoff int used; 1133b3a8eb9SGleb Smirnoff int persist; 1143b3a8eb9SGleb Smirnoff char *nam; 1153b3a8eb9SGleb Smirnoff char *val; 1163b3a8eb9SGleb Smirnoff }; 1173b3a8eb9SGleb Smirnoff int symset(const char *, const char *, int); 1183b3a8eb9SGleb Smirnoff char *symget(const char *); 1193b3a8eb9SGleb Smirnoff 1203b3a8eb9SGleb Smirnoff int atoul(char *, u_long *); 1213b3a8eb9SGleb Smirnoff 1223b3a8eb9SGleb Smirnoff enum { 1233b3a8eb9SGleb Smirnoff PFCTL_STATE_NONE, 1243b3a8eb9SGleb Smirnoff PFCTL_STATE_OPTION, 1253b3a8eb9SGleb Smirnoff PFCTL_STATE_SCRUB, 1263b3a8eb9SGleb Smirnoff PFCTL_STATE_QUEUE, 1273b3a8eb9SGleb Smirnoff PFCTL_STATE_NAT, 1283b3a8eb9SGleb Smirnoff PFCTL_STATE_FILTER 1293b3a8eb9SGleb Smirnoff }; 1303b3a8eb9SGleb Smirnoff 1313b3a8eb9SGleb Smirnoff struct node_proto { 1323b3a8eb9SGleb Smirnoff u_int8_t proto; 1333b3a8eb9SGleb Smirnoff struct node_proto *next; 1343b3a8eb9SGleb Smirnoff struct node_proto *tail; 1353b3a8eb9SGleb Smirnoff }; 1363b3a8eb9SGleb Smirnoff 1373b3a8eb9SGleb Smirnoff struct node_port { 1383b3a8eb9SGleb Smirnoff u_int16_t port[2]; 1393b3a8eb9SGleb Smirnoff u_int8_t op; 1403b3a8eb9SGleb Smirnoff struct node_port *next; 1413b3a8eb9SGleb Smirnoff struct node_port *tail; 1423b3a8eb9SGleb Smirnoff }; 1433b3a8eb9SGleb Smirnoff 1443b3a8eb9SGleb Smirnoff struct node_uid { 1453b3a8eb9SGleb Smirnoff uid_t uid[2]; 1463b3a8eb9SGleb Smirnoff u_int8_t op; 1473b3a8eb9SGleb Smirnoff struct node_uid *next; 1483b3a8eb9SGleb Smirnoff struct node_uid *tail; 1493b3a8eb9SGleb Smirnoff }; 1503b3a8eb9SGleb Smirnoff 1513b3a8eb9SGleb Smirnoff struct node_gid { 1523b3a8eb9SGleb Smirnoff gid_t gid[2]; 1533b3a8eb9SGleb Smirnoff u_int8_t op; 1543b3a8eb9SGleb Smirnoff struct node_gid *next; 1553b3a8eb9SGleb Smirnoff struct node_gid *tail; 1563b3a8eb9SGleb Smirnoff }; 1573b3a8eb9SGleb Smirnoff 1583b3a8eb9SGleb Smirnoff struct node_icmp { 1593b3a8eb9SGleb Smirnoff u_int8_t code; 1603b3a8eb9SGleb Smirnoff u_int8_t type; 1613b3a8eb9SGleb Smirnoff u_int8_t proto; 1623b3a8eb9SGleb Smirnoff struct node_icmp *next; 1633b3a8eb9SGleb Smirnoff struct node_icmp *tail; 1643b3a8eb9SGleb Smirnoff }; 1653b3a8eb9SGleb Smirnoff 1663b3a8eb9SGleb Smirnoff enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 1673b3a8eb9SGleb Smirnoff PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 1683b3a8eb9SGleb Smirnoff PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 1693b3a8eb9SGleb Smirnoff PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 1703b3a8eb9SGleb Smirnoff PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, }; 1713b3a8eb9SGleb Smirnoff 1723b3a8eb9SGleb Smirnoff enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 1733b3a8eb9SGleb Smirnoff 1743b3a8eb9SGleb Smirnoff struct node_state_opt { 1753b3a8eb9SGleb Smirnoff int type; 1763b3a8eb9SGleb Smirnoff union { 1773b3a8eb9SGleb Smirnoff u_int32_t max_states; 1783b3a8eb9SGleb Smirnoff u_int32_t max_src_states; 1793b3a8eb9SGleb Smirnoff u_int32_t max_src_conn; 1803b3a8eb9SGleb Smirnoff struct { 1813b3a8eb9SGleb Smirnoff u_int32_t limit; 1823b3a8eb9SGleb Smirnoff u_int32_t seconds; 1833b3a8eb9SGleb Smirnoff } max_src_conn_rate; 1843b3a8eb9SGleb Smirnoff struct { 1853b3a8eb9SGleb Smirnoff u_int8_t flush; 1863b3a8eb9SGleb Smirnoff char tblname[PF_TABLE_NAME_SIZE]; 1873b3a8eb9SGleb Smirnoff } overload; 1883b3a8eb9SGleb Smirnoff u_int32_t max_src_nodes; 1893b3a8eb9SGleb Smirnoff u_int8_t src_track; 1903b3a8eb9SGleb Smirnoff u_int32_t statelock; 1913b3a8eb9SGleb Smirnoff struct { 1923b3a8eb9SGleb Smirnoff int number; 1933b3a8eb9SGleb Smirnoff u_int32_t seconds; 1943b3a8eb9SGleb Smirnoff } timeout; 1953b3a8eb9SGleb Smirnoff } data; 1963b3a8eb9SGleb Smirnoff struct node_state_opt *next; 1973b3a8eb9SGleb Smirnoff struct node_state_opt *tail; 1983b3a8eb9SGleb Smirnoff }; 1993b3a8eb9SGleb Smirnoff 2003b3a8eb9SGleb Smirnoff struct peer { 2013b3a8eb9SGleb Smirnoff struct node_host *host; 2023b3a8eb9SGleb Smirnoff struct node_port *port; 2033b3a8eb9SGleb Smirnoff }; 2043b3a8eb9SGleb Smirnoff 20513cfafabSKristof Provost static struct node_queue { 2063b3a8eb9SGleb Smirnoff char queue[PF_QNAME_SIZE]; 2073b3a8eb9SGleb Smirnoff char parent[PF_QNAME_SIZE]; 2083b3a8eb9SGleb Smirnoff char ifname[IFNAMSIZ]; 2093b3a8eb9SGleb Smirnoff int scheduler; 2103b3a8eb9SGleb Smirnoff struct node_queue *next; 2113b3a8eb9SGleb Smirnoff struct node_queue *tail; 2123b3a8eb9SGleb Smirnoff } *queues = NULL; 2133b3a8eb9SGleb Smirnoff 2143b3a8eb9SGleb Smirnoff struct node_qassign { 2153b3a8eb9SGleb Smirnoff char *qname; 2163b3a8eb9SGleb Smirnoff char *pqname; 2173b3a8eb9SGleb Smirnoff }; 2183b3a8eb9SGleb Smirnoff 21913cfafabSKristof Provost static struct filter_opts { 2203b3a8eb9SGleb Smirnoff int marker; 2213b3a8eb9SGleb Smirnoff #define FOM_FLAGS 0x01 2223b3a8eb9SGleb Smirnoff #define FOM_ICMP 0x02 2233b3a8eb9SGleb Smirnoff #define FOM_TOS 0x04 2243b3a8eb9SGleb Smirnoff #define FOM_KEEP 0x08 2253b3a8eb9SGleb Smirnoff #define FOM_SRCTRACK 0x10 2263e248e0fSKristof Provost #define FOM_SETPRIO 0x0400 2273e248e0fSKristof Provost #define FOM_PRIO 0x2000 2283b3a8eb9SGleb Smirnoff struct node_uid *uid; 2293b3a8eb9SGleb Smirnoff struct node_gid *gid; 2303b3a8eb9SGleb Smirnoff struct { 2313b3a8eb9SGleb Smirnoff u_int8_t b1; 2323b3a8eb9SGleb Smirnoff u_int8_t b2; 2333b3a8eb9SGleb Smirnoff u_int16_t w; 2343b3a8eb9SGleb Smirnoff u_int16_t w2; 2353b3a8eb9SGleb Smirnoff } flags; 2363b3a8eb9SGleb Smirnoff struct node_icmp *icmpspec; 2373b3a8eb9SGleb Smirnoff u_int32_t tos; 2383b3a8eb9SGleb Smirnoff u_int32_t prob; 2393b3a8eb9SGleb Smirnoff struct { 2403b3a8eb9SGleb Smirnoff int action; 2413b3a8eb9SGleb Smirnoff struct node_state_opt *options; 2423b3a8eb9SGleb Smirnoff } keep; 2433b3a8eb9SGleb Smirnoff int fragment; 2443b3a8eb9SGleb Smirnoff int allowopts; 2456fcc8e04SKristof Provost char *label[PF_RULE_MAX_LABEL_COUNT]; 2466fcc8e04SKristof Provost int labelcount; 2473b3a8eb9SGleb Smirnoff struct node_qassign queues; 2483b3a8eb9SGleb Smirnoff char *tag; 2493b3a8eb9SGleb Smirnoff char *match_tag; 2503b3a8eb9SGleb Smirnoff u_int8_t match_tag_not; 2513b3a8eb9SGleb Smirnoff u_int rtableid; 2523e248e0fSKristof Provost u_int8_t prio; 2533e248e0fSKristof Provost u_int8_t set_prio[2]; 2543b3a8eb9SGleb Smirnoff struct { 2553b3a8eb9SGleb Smirnoff struct node_host *addr; 2563b3a8eb9SGleb Smirnoff u_int16_t port; 2573b3a8eb9SGleb Smirnoff } divert; 2583b3a8eb9SGleb Smirnoff } filter_opts; 2593b3a8eb9SGleb Smirnoff 26013cfafabSKristof Provost static struct antispoof_opts { 2616fcc8e04SKristof Provost char *label[PF_RULE_MAX_LABEL_COUNT]; 2626fcc8e04SKristof Provost int labelcount; 2633b3a8eb9SGleb Smirnoff u_int rtableid; 2643b3a8eb9SGleb Smirnoff } antispoof_opts; 2653b3a8eb9SGleb Smirnoff 26613cfafabSKristof Provost static struct scrub_opts { 2673b3a8eb9SGleb Smirnoff int marker; 2683b3a8eb9SGleb Smirnoff #define SOM_MINTTL 0x01 2693b3a8eb9SGleb Smirnoff #define SOM_MAXMSS 0x02 2703b3a8eb9SGleb Smirnoff #define SOM_FRAGCACHE 0x04 2713b3a8eb9SGleb Smirnoff #define SOM_SETTOS 0x08 2723b3a8eb9SGleb Smirnoff int nodf; 2733b3a8eb9SGleb Smirnoff int minttl; 2743b3a8eb9SGleb Smirnoff int maxmss; 2753b3a8eb9SGleb Smirnoff int settos; 2763b3a8eb9SGleb Smirnoff int fragcache; 2773b3a8eb9SGleb Smirnoff int randomid; 2783b3a8eb9SGleb Smirnoff int reassemble_tcp; 2793b3a8eb9SGleb Smirnoff char *match_tag; 2803b3a8eb9SGleb Smirnoff u_int8_t match_tag_not; 2813b3a8eb9SGleb Smirnoff u_int rtableid; 2823b3a8eb9SGleb Smirnoff } scrub_opts; 2833b3a8eb9SGleb Smirnoff 28413cfafabSKristof Provost static struct queue_opts { 2853b3a8eb9SGleb Smirnoff int marker; 2863b3a8eb9SGleb Smirnoff #define QOM_BWSPEC 0x01 2873b3a8eb9SGleb Smirnoff #define QOM_SCHEDULER 0x02 2883b3a8eb9SGleb Smirnoff #define QOM_PRIORITY 0x04 2893b3a8eb9SGleb Smirnoff #define QOM_TBRSIZE 0x08 2903b3a8eb9SGleb Smirnoff #define QOM_QLIMIT 0x10 2913b3a8eb9SGleb Smirnoff struct node_queue_bw queue_bwspec; 2923b3a8eb9SGleb Smirnoff struct node_queue_opt scheduler; 2933b3a8eb9SGleb Smirnoff int priority; 294249cc75fSPatrick Kelsey unsigned int tbrsize; 2953b3a8eb9SGleb Smirnoff int qlimit; 2963b3a8eb9SGleb Smirnoff } queue_opts; 2973b3a8eb9SGleb Smirnoff 29813cfafabSKristof Provost static struct table_opts { 2993b3a8eb9SGleb Smirnoff int flags; 3003b3a8eb9SGleb Smirnoff int init_addr; 3013b3a8eb9SGleb Smirnoff struct node_tinithead init_nodes; 3023b3a8eb9SGleb Smirnoff } table_opts; 3033b3a8eb9SGleb Smirnoff 30413cfafabSKristof Provost static struct pool_opts { 3053b3a8eb9SGleb Smirnoff int marker; 3063b3a8eb9SGleb Smirnoff #define POM_TYPE 0x01 3073b3a8eb9SGleb Smirnoff #define POM_STICKYADDRESS 0x02 3083b3a8eb9SGleb Smirnoff u_int8_t opts; 3093b3a8eb9SGleb Smirnoff int type; 3103b3a8eb9SGleb Smirnoff int staticport; 3113b3a8eb9SGleb Smirnoff struct pf_poolhashkey *key; 3122aa21096SKurosawa Takahiro struct pf_mape_portset mape; 3133b3a8eb9SGleb Smirnoff 3143b3a8eb9SGleb Smirnoff } pool_opts; 3153b3a8eb9SGleb Smirnoff 31613cfafabSKristof Provost static struct codel_opts codel_opts; 31713cfafabSKristof Provost static struct node_hfsc_opts hfsc_opts; 31813cfafabSKristof Provost static struct node_fairq_opts fairq_opts; 31913cfafabSKristof Provost static struct node_state_opt *keep_state_defaults = NULL; 3203b3a8eb9SGleb Smirnoff 3213b3a8eb9SGleb Smirnoff int disallow_table(struct node_host *, const char *); 3223b3a8eb9SGleb Smirnoff int disallow_urpf_failed(struct node_host *, const char *); 3233b3a8eb9SGleb Smirnoff int disallow_alias(struct node_host *, const char *); 324e9eb0941SKristof Provost int rule_consistent(struct pfctl_rule *, int); 325e9eb0941SKristof Provost int filter_consistent(struct pfctl_rule *, int); 326e9eb0941SKristof Provost int nat_consistent(struct pfctl_rule *); 327e9eb0941SKristof Provost int rdr_consistent(struct pfctl_rule *); 3283b3a8eb9SGleb Smirnoff int process_tabledef(char *, struct table_opts *); 3293b3a8eb9SGleb Smirnoff void expand_label_str(char *, size_t, const char *, const char *); 3303b3a8eb9SGleb Smirnoff void expand_label_if(const char *, char *, size_t, const char *); 3313b3a8eb9SGleb Smirnoff void expand_label_addr(const char *, char *, size_t, u_int8_t, 3323b3a8eb9SGleb Smirnoff struct node_host *); 3333b3a8eb9SGleb Smirnoff void expand_label_port(const char *, char *, size_t, 3343b3a8eb9SGleb Smirnoff struct node_port *); 3353b3a8eb9SGleb Smirnoff void expand_label_proto(const char *, char *, size_t, u_int8_t); 3363b3a8eb9SGleb Smirnoff void expand_label_nr(const char *, char *, size_t); 3373b3a8eb9SGleb Smirnoff void expand_label(char *, size_t, const char *, u_int8_t, 3383b3a8eb9SGleb Smirnoff struct node_host *, struct node_port *, struct node_host *, 3393b3a8eb9SGleb Smirnoff struct node_port *, u_int8_t); 340e9eb0941SKristof Provost void expand_rule(struct pfctl_rule *, struct node_if *, 3413b3a8eb9SGleb Smirnoff struct node_host *, struct node_proto *, struct node_os *, 3423b3a8eb9SGleb Smirnoff struct node_host *, struct node_port *, struct node_host *, 3433b3a8eb9SGleb Smirnoff struct node_port *, struct node_uid *, struct node_gid *, 3443b3a8eb9SGleb Smirnoff struct node_icmp *, const char *); 3453b3a8eb9SGleb Smirnoff int expand_altq(struct pf_altq *, struct node_if *, 3463b3a8eb9SGleb Smirnoff struct node_queue *, struct node_queue_bw bwspec, 3473b3a8eb9SGleb Smirnoff struct node_queue_opt *); 3483b3a8eb9SGleb Smirnoff int expand_queue(struct pf_altq *, struct node_if *, 3493b3a8eb9SGleb Smirnoff struct node_queue *, struct node_queue_bw, 3503b3a8eb9SGleb Smirnoff struct node_queue_opt *); 3513b3a8eb9SGleb Smirnoff int expand_skip_interface(struct node_if *); 3523b3a8eb9SGleb Smirnoff 3533b3a8eb9SGleb Smirnoff int check_rulestate(int); 3543b3a8eb9SGleb Smirnoff int getservice(char *); 3556fcc8e04SKristof Provost int rule_label(struct pfctl_rule *, char *s[PF_RULE_MAX_LABEL_COUNT]); 3563b3a8eb9SGleb Smirnoff int rt_tableid_max(void); 3573b3a8eb9SGleb Smirnoff 358e9eb0941SKristof Provost void mv_rules(struct pfctl_ruleset *, struct pfctl_ruleset *); 3593b3a8eb9SGleb Smirnoff void decide_address_family(struct node_host *, sa_family_t *); 3603b3a8eb9SGleb Smirnoff void remove_invalid_hosts(struct node_host **, sa_family_t *); 3613b3a8eb9SGleb Smirnoff int invalid_redirect(struct node_host *, sa_family_t); 3623b3a8eb9SGleb Smirnoff u_int16_t parseicmpspec(char *, sa_family_t); 3631f495578SKristof Provost int kw_casecmp(const void *, const void *); 3641f495578SKristof Provost int map_tos(char *string, int *); 3653b3a8eb9SGleb Smirnoff 36613cfafabSKristof Provost static TAILQ_HEAD(loadanchorshead, loadanchors) 3673b3a8eb9SGleb Smirnoff loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 3683b3a8eb9SGleb Smirnoff 3693b3a8eb9SGleb Smirnoff struct loadanchors { 3703b3a8eb9SGleb Smirnoff TAILQ_ENTRY(loadanchors) entries; 3713b3a8eb9SGleb Smirnoff char *anchorname; 3723b3a8eb9SGleb Smirnoff char *filename; 3733b3a8eb9SGleb Smirnoff }; 3743b3a8eb9SGleb Smirnoff 3753b3a8eb9SGleb Smirnoff typedef struct { 3763b3a8eb9SGleb Smirnoff union { 3773b3a8eb9SGleb Smirnoff int64_t number; 3783b3a8eb9SGleb Smirnoff double probability; 3793b3a8eb9SGleb Smirnoff int i; 3803b3a8eb9SGleb Smirnoff char *string; 3813b3a8eb9SGleb Smirnoff u_int rtableid; 3823b3a8eb9SGleb Smirnoff struct { 3833b3a8eb9SGleb Smirnoff u_int8_t b1; 3843b3a8eb9SGleb Smirnoff u_int8_t b2; 3853b3a8eb9SGleb Smirnoff u_int16_t w; 3863b3a8eb9SGleb Smirnoff u_int16_t w2; 3873b3a8eb9SGleb Smirnoff } b; 3883b3a8eb9SGleb Smirnoff struct range { 3893b3a8eb9SGleb Smirnoff int a; 3903b3a8eb9SGleb Smirnoff int b; 3913b3a8eb9SGleb Smirnoff int t; 3923b3a8eb9SGleb Smirnoff } range; 3933b3a8eb9SGleb Smirnoff struct node_if *interface; 3943b3a8eb9SGleb Smirnoff struct node_proto *proto; 3953b3a8eb9SGleb Smirnoff struct node_icmp *icmp; 3963b3a8eb9SGleb Smirnoff struct node_host *host; 3973b3a8eb9SGleb Smirnoff struct node_os *os; 3983b3a8eb9SGleb Smirnoff struct node_port *port; 3993b3a8eb9SGleb Smirnoff struct node_uid *uid; 4003b3a8eb9SGleb Smirnoff struct node_gid *gid; 4013b3a8eb9SGleb Smirnoff struct node_state_opt *state_opt; 4023b3a8eb9SGleb Smirnoff struct peer peer; 4033b3a8eb9SGleb Smirnoff struct { 4043b3a8eb9SGleb Smirnoff struct peer src, dst; 4053b3a8eb9SGleb Smirnoff struct node_os *src_os; 4063b3a8eb9SGleb Smirnoff } fromto; 4073b3a8eb9SGleb Smirnoff struct { 4083b3a8eb9SGleb Smirnoff struct node_host *host; 4093b3a8eb9SGleb Smirnoff u_int8_t rt; 4103b3a8eb9SGleb Smirnoff u_int8_t pool_opts; 4113b3a8eb9SGleb Smirnoff sa_family_t af; 4123b3a8eb9SGleb Smirnoff struct pf_poolhashkey *key; 4133b3a8eb9SGleb Smirnoff } route; 4143b3a8eb9SGleb Smirnoff struct redirection { 4153b3a8eb9SGleb Smirnoff struct node_host *host; 4163b3a8eb9SGleb Smirnoff struct range rport; 4173b3a8eb9SGleb Smirnoff } *redirection; 4183b3a8eb9SGleb Smirnoff struct { 4193b3a8eb9SGleb Smirnoff int action; 4203b3a8eb9SGleb Smirnoff struct node_state_opt *options; 4213b3a8eb9SGleb Smirnoff } keep_state; 4223b3a8eb9SGleb Smirnoff struct { 4233b3a8eb9SGleb Smirnoff u_int8_t log; 4243b3a8eb9SGleb Smirnoff u_int8_t logif; 4253b3a8eb9SGleb Smirnoff u_int8_t quick; 4263b3a8eb9SGleb Smirnoff } logquick; 4273b3a8eb9SGleb Smirnoff struct { 4283b3a8eb9SGleb Smirnoff int neg; 4293b3a8eb9SGleb Smirnoff char *name; 4303b3a8eb9SGleb Smirnoff } tagged; 4313b3a8eb9SGleb Smirnoff struct pf_poolhashkey *hashkey; 4323b3a8eb9SGleb Smirnoff struct node_queue *queue; 4333b3a8eb9SGleb Smirnoff struct node_queue_opt queue_options; 4343b3a8eb9SGleb Smirnoff struct node_queue_bw queue_bwspec; 4353b3a8eb9SGleb Smirnoff struct node_qassign qassign; 4363b3a8eb9SGleb Smirnoff struct filter_opts filter_opts; 4373b3a8eb9SGleb Smirnoff struct antispoof_opts antispoof_opts; 4383b3a8eb9SGleb Smirnoff struct queue_opts queue_opts; 4393b3a8eb9SGleb Smirnoff struct scrub_opts scrub_opts; 4403b3a8eb9SGleb Smirnoff struct table_opts table_opts; 4413b3a8eb9SGleb Smirnoff struct pool_opts pool_opts; 4423b3a8eb9SGleb Smirnoff struct node_hfsc_opts hfsc_opts; 443a5b789f6SErmal Luçi struct node_fairq_opts fairq_opts; 4440a70aaf8SLuiz Otavio O Souza struct codel_opts codel_opts; 4453b3a8eb9SGleb Smirnoff } v; 4463b3a8eb9SGleb Smirnoff int lineno; 4473b3a8eb9SGleb Smirnoff } YYSTYPE; 4483b3a8eb9SGleb Smirnoff 4493b3a8eb9SGleb Smirnoff #define PPORT_RANGE 1 4503b3a8eb9SGleb Smirnoff #define PPORT_STAR 2 4513b3a8eb9SGleb Smirnoff int parseport(char *, struct range *r, int); 4523b3a8eb9SGleb Smirnoff 4533b3a8eb9SGleb Smirnoff #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 4543b3a8eb9SGleb Smirnoff (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 4553b3a8eb9SGleb Smirnoff !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 4563b3a8eb9SGleb Smirnoff 4573b3a8eb9SGleb Smirnoff %} 4583b3a8eb9SGleb Smirnoff 459ef950daaSKristof Provost %token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 4603b3a8eb9SGleb Smirnoff %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 4613b3a8eb9SGleb Smirnoff %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 4623b3a8eb9SGleb Smirnoff %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 4633b3a8eb9SGleb Smirnoff %token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 4643b3a8eb9SGleb Smirnoff %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 465150182e3SKristof Provost %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY FAILPOLICY 466150182e3SKristof Provost %token RANDOMID REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 467*c69121c4SKristof Provost %token ANTISPOOF FOR INCLUDE KEEPCOUNTERS SYNCOOKIES 4682aa21096SKurosawa Takahiro %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET 4690a70aaf8SLuiz Otavio O Souza %token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME 4700a70aaf8SLuiz Otavio O Souza %token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL 4713e248e0fSKristof Provost %token LOAD RULESET_OPTIMIZATION PRIO 4723b3a8eb9SGleb Smirnoff %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 4733b3a8eb9SGleb Smirnoff %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY 4743b3a8eb9SGleb Smirnoff %token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 4753b3a8eb9SGleb Smirnoff %token DIVERTTO DIVERTREPLY 4763b3a8eb9SGleb Smirnoff %token <v.string> STRING 4773b3a8eb9SGleb Smirnoff %token <v.number> NUMBER 4783b3a8eb9SGleb Smirnoff %token <v.i> PORTBINARY 4793b3a8eb9SGleb Smirnoff %type <v.interface> interface if_list if_item_not if_item 4803b3a8eb9SGleb Smirnoff %type <v.number> number icmptype icmp6type uid gid 4813b3a8eb9SGleb Smirnoff %type <v.number> tos not yesno 4823b3a8eb9SGleb Smirnoff %type <v.probability> probability 483*c69121c4SKristof Provost %type <v.i> no dir af fragcache optimizer syncookie_val 4843b3a8eb9SGleb Smirnoff %type <v.i> sourcetrack flush unaryop statelock 4853b3a8eb9SGleb Smirnoff %type <v.b> action nataction natpasslog scrubaction 4863e248e0fSKristof Provost %type <v.b> flags flag blockspec prio 4873b3a8eb9SGleb Smirnoff %type <v.range> portplain portstar portrange 4883b3a8eb9SGleb Smirnoff %type <v.hashkey> hashkey 4893b3a8eb9SGleb Smirnoff %type <v.proto> proto proto_list proto_item 4903b3a8eb9SGleb Smirnoff %type <v.number> protoval 4913b3a8eb9SGleb Smirnoff %type <v.icmp> icmpspec 4923b3a8eb9SGleb Smirnoff %type <v.icmp> icmp_list icmp_item 4933b3a8eb9SGleb Smirnoff %type <v.icmp> icmp6_list icmp6_item 4943b3a8eb9SGleb Smirnoff %type <v.number> reticmpspec reticmp6spec 4953b3a8eb9SGleb Smirnoff %type <v.fromto> fromto 4963b3a8eb9SGleb Smirnoff %type <v.peer> ipportspec from to 4973b3a8eb9SGleb Smirnoff %type <v.host> ipspec toipspec xhost host dynaddr host_list 4983b3a8eb9SGleb Smirnoff %type <v.host> redir_host_list redirspec 4993b3a8eb9SGleb Smirnoff %type <v.host> route_host route_host_list routespec 5003b3a8eb9SGleb Smirnoff %type <v.os> os xos os_list 5013b3a8eb9SGleb Smirnoff %type <v.port> portspec port_list port_item 5023b3a8eb9SGleb Smirnoff %type <v.uid> uids uid_list uid_item 5033b3a8eb9SGleb Smirnoff %type <v.gid> gids gid_list gid_item 5043b3a8eb9SGleb Smirnoff %type <v.route> route 5053b3a8eb9SGleb Smirnoff %type <v.redirection> redirection redirpool 5063b3a8eb9SGleb Smirnoff %type <v.string> label stringall tag anchorname 5073b3a8eb9SGleb Smirnoff %type <v.string> string varstring numberstring 5083b3a8eb9SGleb Smirnoff %type <v.keep_state> keep 5093b3a8eb9SGleb Smirnoff %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 5103b3a8eb9SGleb Smirnoff %type <v.logquick> logquick quick log logopts logopt 5113b3a8eb9SGleb Smirnoff %type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 5123b3a8eb9SGleb Smirnoff %type <v.qassign> qname 5133b3a8eb9SGleb Smirnoff %type <v.queue> qassign qassign_list qassign_item 5143b3a8eb9SGleb Smirnoff %type <v.queue_options> scheduler 5153b3a8eb9SGleb Smirnoff %type <v.number> cbqflags_list cbqflags_item 5163b3a8eb9SGleb Smirnoff %type <v.number> priqflags_list priqflags_item 5173b3a8eb9SGleb Smirnoff %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 518a5b789f6SErmal Luçi %type <v.fairq_opts> fairqopts_list fairqopts_item fairq_opts 5190a70aaf8SLuiz Otavio O Souza %type <v.codel_opts> codelopts_list codelopts_item codel_opts 5203b3a8eb9SGleb Smirnoff %type <v.queue_bwspec> bandwidth 5213b3a8eb9SGleb Smirnoff %type <v.filter_opts> filter_opts filter_opt filter_opts_l 5223e248e0fSKristof Provost %type <v.filter_opts> filter_sets filter_set filter_sets_l 5233b3a8eb9SGleb Smirnoff %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 5243b3a8eb9SGleb Smirnoff %type <v.queue_opts> queue_opts queue_opt queue_opts_l 5253b3a8eb9SGleb Smirnoff %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 5263b3a8eb9SGleb Smirnoff %type <v.table_opts> table_opts table_opt table_opts_l 5273b3a8eb9SGleb Smirnoff %type <v.pool_opts> pool_opts pool_opt pool_opts_l 5283b3a8eb9SGleb Smirnoff %type <v.tagged> tagged 5293b3a8eb9SGleb Smirnoff %type <v.rtableid> rtable 5303b3a8eb9SGleb Smirnoff %% 5313b3a8eb9SGleb Smirnoff 5323b3a8eb9SGleb Smirnoff ruleset : /* empty */ 5333b3a8eb9SGleb Smirnoff | ruleset include '\n' 5343b3a8eb9SGleb Smirnoff | ruleset '\n' 5353b3a8eb9SGleb Smirnoff | ruleset option '\n' 5363b3a8eb9SGleb Smirnoff | ruleset scrubrule '\n' 5373b3a8eb9SGleb Smirnoff | ruleset natrule '\n' 5383b3a8eb9SGleb Smirnoff | ruleset binatrule '\n' 5393b3a8eb9SGleb Smirnoff | ruleset pfrule '\n' 5403b3a8eb9SGleb Smirnoff | ruleset anchorrule '\n' 5413b3a8eb9SGleb Smirnoff | ruleset loadrule '\n' 5423b3a8eb9SGleb Smirnoff | ruleset altqif '\n' 5433b3a8eb9SGleb Smirnoff | ruleset queuespec '\n' 5443b3a8eb9SGleb Smirnoff | ruleset varset '\n' 5453b3a8eb9SGleb Smirnoff | ruleset antispoof '\n' 5463b3a8eb9SGleb Smirnoff | ruleset tabledef '\n' 5473b3a8eb9SGleb Smirnoff | '{' fakeanchor '}' '\n'; 5483b3a8eb9SGleb Smirnoff | ruleset error '\n' { file->errors++; } 5493b3a8eb9SGleb Smirnoff ; 5503b3a8eb9SGleb Smirnoff 5513b3a8eb9SGleb Smirnoff include : INCLUDE STRING { 5523b3a8eb9SGleb Smirnoff struct file *nfile; 5533b3a8eb9SGleb Smirnoff 5543b3a8eb9SGleb Smirnoff if ((nfile = pushfile($2, 0)) == NULL) { 5553b3a8eb9SGleb Smirnoff yyerror("failed to include file %s", $2); 5563b3a8eb9SGleb Smirnoff free($2); 5573b3a8eb9SGleb Smirnoff YYERROR; 5583b3a8eb9SGleb Smirnoff } 5593b3a8eb9SGleb Smirnoff free($2); 5603b3a8eb9SGleb Smirnoff 5613b3a8eb9SGleb Smirnoff file = nfile; 5623b3a8eb9SGleb Smirnoff lungetc('\n'); 5633b3a8eb9SGleb Smirnoff } 5643b3a8eb9SGleb Smirnoff ; 5653b3a8eb9SGleb Smirnoff 5663b3a8eb9SGleb Smirnoff /* 5673b3a8eb9SGleb Smirnoff * apply to previouslys specified rule: must be careful to note 5683b3a8eb9SGleb Smirnoff * what that is: pf or nat or binat or rdr 5693b3a8eb9SGleb Smirnoff */ 5703b3a8eb9SGleb Smirnoff fakeanchor : fakeanchor '\n' 5713b3a8eb9SGleb Smirnoff | fakeanchor anchorrule '\n' 5723b3a8eb9SGleb Smirnoff | fakeanchor binatrule '\n' 5733b3a8eb9SGleb Smirnoff | fakeanchor natrule '\n' 5743b3a8eb9SGleb Smirnoff | fakeanchor pfrule '\n' 5753b3a8eb9SGleb Smirnoff | fakeanchor error '\n' 5763b3a8eb9SGleb Smirnoff ; 5773b3a8eb9SGleb Smirnoff 5783b3a8eb9SGleb Smirnoff optimizer : string { 5793b3a8eb9SGleb Smirnoff if (!strcmp($1, "none")) 5803b3a8eb9SGleb Smirnoff $$ = 0; 5813b3a8eb9SGleb Smirnoff else if (!strcmp($1, "basic")) 5823b3a8eb9SGleb Smirnoff $$ = PF_OPTIMIZE_BASIC; 5833b3a8eb9SGleb Smirnoff else if (!strcmp($1, "profile")) 5843b3a8eb9SGleb Smirnoff $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 5853b3a8eb9SGleb Smirnoff else { 5863b3a8eb9SGleb Smirnoff yyerror("unknown ruleset-optimization %s", $1); 5873b3a8eb9SGleb Smirnoff YYERROR; 5883b3a8eb9SGleb Smirnoff } 5893b3a8eb9SGleb Smirnoff } 5903b3a8eb9SGleb Smirnoff ; 5913b3a8eb9SGleb Smirnoff 5923b3a8eb9SGleb Smirnoff option : SET OPTIMIZATION STRING { 5933b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 5943b3a8eb9SGleb Smirnoff free($3); 5953b3a8eb9SGleb Smirnoff YYERROR; 5963b3a8eb9SGleb Smirnoff } 5973b3a8eb9SGleb Smirnoff if (pfctl_set_optimization(pf, $3) != 0) { 5983b3a8eb9SGleb Smirnoff yyerror("unknown optimization %s", $3); 5993b3a8eb9SGleb Smirnoff free($3); 6003b3a8eb9SGleb Smirnoff YYERROR; 6013b3a8eb9SGleb Smirnoff } 6023b3a8eb9SGleb Smirnoff free($3); 6033b3a8eb9SGleb Smirnoff } 6043b3a8eb9SGleb Smirnoff | SET RULESET_OPTIMIZATION optimizer { 6053b3a8eb9SGleb Smirnoff if (!(pf->opts & PF_OPT_OPTIMIZE)) { 6063b3a8eb9SGleb Smirnoff pf->opts |= PF_OPT_OPTIMIZE; 6073b3a8eb9SGleb Smirnoff pf->optimize = $3; 6083b3a8eb9SGleb Smirnoff } 6093b3a8eb9SGleb Smirnoff } 6103b3a8eb9SGleb Smirnoff | SET TIMEOUT timeout_spec 6113b3a8eb9SGleb Smirnoff | SET TIMEOUT '{' optnl timeout_list '}' 6123b3a8eb9SGleb Smirnoff | SET LIMIT limit_spec 6133b3a8eb9SGleb Smirnoff | SET LIMIT '{' optnl limit_list '}' 6143b3a8eb9SGleb Smirnoff | SET LOGINTERFACE stringall { 6153b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 6163b3a8eb9SGleb Smirnoff free($3); 6173b3a8eb9SGleb Smirnoff YYERROR; 6183b3a8eb9SGleb Smirnoff } 6193b3a8eb9SGleb Smirnoff if (pfctl_set_logif(pf, $3) != 0) { 6203b3a8eb9SGleb Smirnoff yyerror("error setting loginterface %s", $3); 6213b3a8eb9SGleb Smirnoff free($3); 6223b3a8eb9SGleb Smirnoff YYERROR; 6233b3a8eb9SGleb Smirnoff } 6243b3a8eb9SGleb Smirnoff free($3); 6253b3a8eb9SGleb Smirnoff } 6263b3a8eb9SGleb Smirnoff | SET HOSTID number { 6273b3a8eb9SGleb Smirnoff if ($3 == 0 || $3 > UINT_MAX) { 6283b3a8eb9SGleb Smirnoff yyerror("hostid must be non-zero"); 6293b3a8eb9SGleb Smirnoff YYERROR; 6303b3a8eb9SGleb Smirnoff } 6313b3a8eb9SGleb Smirnoff if (pfctl_set_hostid(pf, $3) != 0) { 6323b3a8eb9SGleb Smirnoff yyerror("error setting hostid %08x", $3); 6333b3a8eb9SGleb Smirnoff YYERROR; 6343b3a8eb9SGleb Smirnoff } 6353b3a8eb9SGleb Smirnoff } 6363b3a8eb9SGleb Smirnoff | SET BLOCKPOLICY DROP { 6373b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6383b3a8eb9SGleb Smirnoff printf("set block-policy drop\n"); 6393b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) 6403b3a8eb9SGleb Smirnoff YYERROR; 6413b3a8eb9SGleb Smirnoff blockpolicy = PFRULE_DROP; 6423b3a8eb9SGleb Smirnoff } 6433b3a8eb9SGleb Smirnoff | SET BLOCKPOLICY RETURN { 6443b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6453b3a8eb9SGleb Smirnoff printf("set block-policy return\n"); 6463b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) 6473b3a8eb9SGleb Smirnoff YYERROR; 6483b3a8eb9SGleb Smirnoff blockpolicy = PFRULE_RETURN; 6493b3a8eb9SGleb Smirnoff } 650150182e3SKristof Provost | SET FAILPOLICY DROP { 651150182e3SKristof Provost if (pf->opts & PF_OPT_VERBOSE) 652150182e3SKristof Provost printf("set fail-policy drop\n"); 653150182e3SKristof Provost if (check_rulestate(PFCTL_STATE_OPTION)) 654150182e3SKristof Provost YYERROR; 655150182e3SKristof Provost failpolicy = PFRULE_DROP; 656150182e3SKristof Provost } 657150182e3SKristof Provost | SET FAILPOLICY RETURN { 658150182e3SKristof Provost if (pf->opts & PF_OPT_VERBOSE) 659150182e3SKristof Provost printf("set fail-policy return\n"); 660150182e3SKristof Provost if (check_rulestate(PFCTL_STATE_OPTION)) 661150182e3SKristof Provost YYERROR; 662150182e3SKristof Provost failpolicy = PFRULE_RETURN; 663150182e3SKristof Provost } 6643b3a8eb9SGleb Smirnoff | SET REQUIREORDER yesno { 6653b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6663b3a8eb9SGleb Smirnoff printf("set require-order %s\n", 6673b3a8eb9SGleb Smirnoff $3 == 1 ? "yes" : "no"); 6683b3a8eb9SGleb Smirnoff require_order = $3; 6693b3a8eb9SGleb Smirnoff } 6703b3a8eb9SGleb Smirnoff | SET FINGERPRINTS STRING { 6713b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6723b3a8eb9SGleb Smirnoff printf("set fingerprints \"%s\"\n", $3); 6733b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 6743b3a8eb9SGleb Smirnoff free($3); 6753b3a8eb9SGleb Smirnoff YYERROR; 6763b3a8eb9SGleb Smirnoff } 6773b3a8eb9SGleb Smirnoff if (!pf->anchor->name[0]) { 6783b3a8eb9SGleb Smirnoff if (pfctl_file_fingerprints(pf->dev, 6793b3a8eb9SGleb Smirnoff pf->opts, $3)) { 6803b3a8eb9SGleb Smirnoff yyerror("error loading " 6813b3a8eb9SGleb Smirnoff "fingerprints %s", $3); 6823b3a8eb9SGleb Smirnoff free($3); 6833b3a8eb9SGleb Smirnoff YYERROR; 6843b3a8eb9SGleb Smirnoff } 6853b3a8eb9SGleb Smirnoff } 6863b3a8eb9SGleb Smirnoff free($3); 6873b3a8eb9SGleb Smirnoff } 6883b3a8eb9SGleb Smirnoff | SET STATEPOLICY statelock { 6893b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 6903b3a8eb9SGleb Smirnoff switch ($3) { 6913b3a8eb9SGleb Smirnoff case 0: 6923b3a8eb9SGleb Smirnoff printf("set state-policy floating\n"); 6933b3a8eb9SGleb Smirnoff break; 6943b3a8eb9SGleb Smirnoff case PFRULE_IFBOUND: 6953b3a8eb9SGleb Smirnoff printf("set state-policy if-bound\n"); 6963b3a8eb9SGleb Smirnoff break; 6973b3a8eb9SGleb Smirnoff } 6983b3a8eb9SGleb Smirnoff default_statelock = $3; 6993b3a8eb9SGleb Smirnoff } 7003b3a8eb9SGleb Smirnoff | SET DEBUG STRING { 7013b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 7023b3a8eb9SGleb Smirnoff free($3); 7033b3a8eb9SGleb Smirnoff YYERROR; 7043b3a8eb9SGleb Smirnoff } 7053b3a8eb9SGleb Smirnoff if (pfctl_set_debug(pf, $3) != 0) { 7063b3a8eb9SGleb Smirnoff yyerror("error setting debuglevel %s", $3); 7073b3a8eb9SGleb Smirnoff free($3); 7083b3a8eb9SGleb Smirnoff YYERROR; 7093b3a8eb9SGleb Smirnoff } 7103b3a8eb9SGleb Smirnoff free($3); 7113b3a8eb9SGleb Smirnoff } 7123b3a8eb9SGleb Smirnoff | SET SKIP interface { 7133b3a8eb9SGleb Smirnoff if (expand_skip_interface($3) != 0) { 7143b3a8eb9SGleb Smirnoff yyerror("error setting skip interface(s)"); 7153b3a8eb9SGleb Smirnoff YYERROR; 7163b3a8eb9SGleb Smirnoff } 7173b3a8eb9SGleb Smirnoff } 7183b3a8eb9SGleb Smirnoff | SET STATEDEFAULTS state_opt_list { 7193b3a8eb9SGleb Smirnoff if (keep_state_defaults != NULL) { 7203b3a8eb9SGleb Smirnoff yyerror("cannot redefine state-defaults"); 7213b3a8eb9SGleb Smirnoff YYERROR; 7223b3a8eb9SGleb Smirnoff } 7233b3a8eb9SGleb Smirnoff keep_state_defaults = $3; 7243b3a8eb9SGleb Smirnoff } 72542ec75f8SKristof Provost | SET KEEPCOUNTERS { 72642ec75f8SKristof Provost pf->keep_counters = true; 72742ec75f8SKristof Provost } 728*c69121c4SKristof Provost | SET SYNCOOKIES syncookie_val { 729*c69121c4SKristof Provost pf->syncookies = $3; 730*c69121c4SKristof Provost } 731*c69121c4SKristof Provost ; 732*c69121c4SKristof Provost 733*c69121c4SKristof Provost syncookie_val : STRING { 734*c69121c4SKristof Provost if (!strcmp($1, "never")) 735*c69121c4SKristof Provost $$ = PFCTL_SYNCOOKIES_NEVER; 736*c69121c4SKristof Provost else if (!strcmp($1, "always")) 737*c69121c4SKristof Provost $$ = PFCTL_SYNCOOKIES_ALWAYS; 738*c69121c4SKristof Provost else { 739*c69121c4SKristof Provost yyerror("illegal value for syncookies"); 740*c69121c4SKristof Provost YYERROR; 741*c69121c4SKristof Provost } 742*c69121c4SKristof Provost } 7433b3a8eb9SGleb Smirnoff ; 7443b3a8eb9SGleb Smirnoff 7453b3a8eb9SGleb Smirnoff stringall : STRING { $$ = $1; } 7463b3a8eb9SGleb Smirnoff | ALL { 7473b3a8eb9SGleb Smirnoff if (($$ = strdup("all")) == NULL) { 7483b3a8eb9SGleb Smirnoff err(1, "stringall: strdup"); 7493b3a8eb9SGleb Smirnoff } 7503b3a8eb9SGleb Smirnoff } 7513b3a8eb9SGleb Smirnoff ; 7523b3a8eb9SGleb Smirnoff 7533b3a8eb9SGleb Smirnoff string : STRING string { 7543b3a8eb9SGleb Smirnoff if (asprintf(&$$, "%s %s", $1, $2) == -1) 7553b3a8eb9SGleb Smirnoff err(1, "string: asprintf"); 7563b3a8eb9SGleb Smirnoff free($1); 7573b3a8eb9SGleb Smirnoff free($2); 7583b3a8eb9SGleb Smirnoff } 7593b3a8eb9SGleb Smirnoff | STRING 7603b3a8eb9SGleb Smirnoff ; 7613b3a8eb9SGleb Smirnoff 7623b3a8eb9SGleb Smirnoff varstring : numberstring varstring { 7633b3a8eb9SGleb Smirnoff if (asprintf(&$$, "%s %s", $1, $2) == -1) 7643b3a8eb9SGleb Smirnoff err(1, "string: asprintf"); 7653b3a8eb9SGleb Smirnoff free($1); 7663b3a8eb9SGleb Smirnoff free($2); 7673b3a8eb9SGleb Smirnoff } 7683b3a8eb9SGleb Smirnoff | numberstring 7693b3a8eb9SGleb Smirnoff ; 7703b3a8eb9SGleb Smirnoff 7713b3a8eb9SGleb Smirnoff numberstring : NUMBER { 7723b3a8eb9SGleb Smirnoff char *s; 7733b3a8eb9SGleb Smirnoff if (asprintf(&s, "%lld", (long long)$1) == -1) { 7743b3a8eb9SGleb Smirnoff yyerror("string: asprintf"); 7753b3a8eb9SGleb Smirnoff YYERROR; 7763b3a8eb9SGleb Smirnoff } 7773b3a8eb9SGleb Smirnoff $$ = s; 7783b3a8eb9SGleb Smirnoff } 7793b3a8eb9SGleb Smirnoff | STRING 7803b3a8eb9SGleb Smirnoff ; 7813b3a8eb9SGleb Smirnoff 7823b3a8eb9SGleb Smirnoff varset : STRING '=' varstring { 783d3f65324SKristof Provost char *s = $1; 7843b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 7853b3a8eb9SGleb Smirnoff printf("%s = \"%s\"\n", $1, $3); 786d3f65324SKristof Provost while (*s++) { 787d3f65324SKristof Provost if (isspace((unsigned char)*s)) { 788d3f65324SKristof Provost yyerror("macro name cannot contain " 789d3f65324SKristof Provost "whitespace"); 790d3f65324SKristof Provost YYERROR; 791d3f65324SKristof Provost } 792d3f65324SKristof Provost } 7933b3a8eb9SGleb Smirnoff if (symset($1, $3, 0) == -1) 7943b3a8eb9SGleb Smirnoff err(1, "cannot store variable %s", $1); 7953b3a8eb9SGleb Smirnoff free($1); 7963b3a8eb9SGleb Smirnoff free($3); 7973b3a8eb9SGleb Smirnoff } 7983b3a8eb9SGleb Smirnoff ; 7993b3a8eb9SGleb Smirnoff 8003b3a8eb9SGleb Smirnoff anchorname : STRING { $$ = $1; } 8013b3a8eb9SGleb Smirnoff | /* empty */ { $$ = NULL; } 8023b3a8eb9SGleb Smirnoff ; 8033b3a8eb9SGleb Smirnoff 8043b3a8eb9SGleb Smirnoff pfa_anchorlist : /* empty */ 8053b3a8eb9SGleb Smirnoff | pfa_anchorlist '\n' 8063b3a8eb9SGleb Smirnoff | pfa_anchorlist pfrule '\n' 8073b3a8eb9SGleb Smirnoff | pfa_anchorlist anchorrule '\n' 8083b3a8eb9SGleb Smirnoff ; 8093b3a8eb9SGleb Smirnoff 8103b3a8eb9SGleb Smirnoff pfa_anchor : '{' 8113b3a8eb9SGleb Smirnoff { 8123b3a8eb9SGleb Smirnoff char ta[PF_ANCHOR_NAME_SIZE]; 813e9eb0941SKristof Provost struct pfctl_ruleset *rs; 8143b3a8eb9SGleb Smirnoff 8153b3a8eb9SGleb Smirnoff /* steping into a brace anchor */ 8163b3a8eb9SGleb Smirnoff pf->asd++; 8173b3a8eb9SGleb Smirnoff pf->bn++; 8183b3a8eb9SGleb Smirnoff pf->brace = 1; 8193b3a8eb9SGleb Smirnoff 8203b3a8eb9SGleb Smirnoff /* create a holding ruleset in the root */ 8213b3a8eb9SGleb Smirnoff snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 8223b3a8eb9SGleb Smirnoff rs = pf_find_or_create_ruleset(ta); 8233b3a8eb9SGleb Smirnoff if (rs == NULL) 8243b3a8eb9SGleb Smirnoff err(1, "pfa_anchor: pf_find_or_create_ruleset"); 8253b3a8eb9SGleb Smirnoff pf->astack[pf->asd] = rs->anchor; 8263b3a8eb9SGleb Smirnoff pf->anchor = rs->anchor; 8273b3a8eb9SGleb Smirnoff } '\n' pfa_anchorlist '}' 8283b3a8eb9SGleb Smirnoff { 8293b3a8eb9SGleb Smirnoff pf->alast = pf->anchor; 8303b3a8eb9SGleb Smirnoff pf->asd--; 8313b3a8eb9SGleb Smirnoff pf->anchor = pf->astack[pf->asd]; 8323b3a8eb9SGleb Smirnoff } 8333b3a8eb9SGleb Smirnoff | /* empty */ 8343b3a8eb9SGleb Smirnoff ; 8353b3a8eb9SGleb Smirnoff 8363b3a8eb9SGleb Smirnoff anchorrule : ANCHOR anchorname dir quick interface af proto fromto 8373b3a8eb9SGleb Smirnoff filter_opts pfa_anchor 8383b3a8eb9SGleb Smirnoff { 839e9eb0941SKristof Provost struct pfctl_rule r; 8403b3a8eb9SGleb Smirnoff struct node_proto *proto; 8413b3a8eb9SGleb Smirnoff 8423b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_FILTER)) { 8433b3a8eb9SGleb Smirnoff if ($2) 8443b3a8eb9SGleb Smirnoff free($2); 8453b3a8eb9SGleb Smirnoff YYERROR; 8463b3a8eb9SGleb Smirnoff } 8473b3a8eb9SGleb Smirnoff 8483b3a8eb9SGleb Smirnoff if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 8493b3a8eb9SGleb Smirnoff free($2); 8503b3a8eb9SGleb Smirnoff yyerror("anchor names beginning with '_' " 8513b3a8eb9SGleb Smirnoff "are reserved for internal use"); 8523b3a8eb9SGleb Smirnoff YYERROR; 8533b3a8eb9SGleb Smirnoff } 8543b3a8eb9SGleb Smirnoff 8553b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 8563b3a8eb9SGleb Smirnoff if (pf->astack[pf->asd + 1]) { 8573b3a8eb9SGleb Smirnoff /* move inline rules into relative location */ 858e9eb0941SKristof Provost pfctl_anchor_setup(&r, 8593b3a8eb9SGleb Smirnoff &pf->astack[pf->asd]->ruleset, 8603b3a8eb9SGleb Smirnoff $2 ? $2 : pf->alast->name); 8613b3a8eb9SGleb Smirnoff 8623b3a8eb9SGleb Smirnoff if (r.anchor == NULL) 8633b3a8eb9SGleb Smirnoff err(1, "anchorrule: unable to " 8643b3a8eb9SGleb Smirnoff "create ruleset"); 8653b3a8eb9SGleb Smirnoff 8663b3a8eb9SGleb Smirnoff if (pf->alast != r.anchor) { 8673b3a8eb9SGleb Smirnoff if (r.anchor->match) { 8683b3a8eb9SGleb Smirnoff yyerror("inline anchor '%s' " 8693b3a8eb9SGleb Smirnoff "already exists", 8703b3a8eb9SGleb Smirnoff r.anchor->name); 8713b3a8eb9SGleb Smirnoff YYERROR; 8723b3a8eb9SGleb Smirnoff } 8733b3a8eb9SGleb Smirnoff mv_rules(&pf->alast->ruleset, 8743b3a8eb9SGleb Smirnoff &r.anchor->ruleset); 8753b3a8eb9SGleb Smirnoff } 8763b3a8eb9SGleb Smirnoff pf_remove_if_empty_ruleset(&pf->alast->ruleset); 8773b3a8eb9SGleb Smirnoff pf->alast = r.anchor; 8783b3a8eb9SGleb Smirnoff } else { 8793b3a8eb9SGleb Smirnoff if (!$2) { 8803b3a8eb9SGleb Smirnoff yyerror("anchors without explicit " 8813b3a8eb9SGleb Smirnoff "rules must specify a name"); 8823b3a8eb9SGleb Smirnoff YYERROR; 8833b3a8eb9SGleb Smirnoff } 8843b3a8eb9SGleb Smirnoff } 8853b3a8eb9SGleb Smirnoff r.direction = $3; 8863b3a8eb9SGleb Smirnoff r.quick = $4.quick; 8873b3a8eb9SGleb Smirnoff r.af = $6; 8883b3a8eb9SGleb Smirnoff r.prob = $9.prob; 8893b3a8eb9SGleb Smirnoff r.rtableid = $9.rtableid; 8903b3a8eb9SGleb Smirnoff 8913b3a8eb9SGleb Smirnoff if ($9.tag) 8923b3a8eb9SGleb Smirnoff if (strlcpy(r.tagname, $9.tag, 8933b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 8943b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 8953b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 8963b3a8eb9SGleb Smirnoff YYERROR; 8973b3a8eb9SGleb Smirnoff } 8983b3a8eb9SGleb Smirnoff if ($9.match_tag) 8993b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $9.match_tag, 9003b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 9013b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 9023b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 9033b3a8eb9SGleb Smirnoff YYERROR; 9043b3a8eb9SGleb Smirnoff } 9053b3a8eb9SGleb Smirnoff r.match_tag_not = $9.match_tag_not; 9063b3a8eb9SGleb Smirnoff if (rule_label(&r, $9.label)) 9073b3a8eb9SGleb Smirnoff YYERROR; 9086fcc8e04SKristof Provost for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 9096fcc8e04SKristof Provost free($9.label[i]); 9103b3a8eb9SGleb Smirnoff r.flags = $9.flags.b1; 9113b3a8eb9SGleb Smirnoff r.flagset = $9.flags.b2; 9123b3a8eb9SGleb Smirnoff if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 9133b3a8eb9SGleb Smirnoff yyerror("flags always false"); 9143b3a8eb9SGleb Smirnoff YYERROR; 9153b3a8eb9SGleb Smirnoff } 9163b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 9173b3a8eb9SGleb Smirnoff for (proto = $7; proto != NULL && 9183b3a8eb9SGleb Smirnoff proto->proto != IPPROTO_TCP; 9193b3a8eb9SGleb Smirnoff proto = proto->next) 9203b3a8eb9SGleb Smirnoff ; /* nothing */ 9213b3a8eb9SGleb Smirnoff if (proto == NULL && $7 != NULL) { 9223b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2) 9233b3a8eb9SGleb Smirnoff yyerror( 9243b3a8eb9SGleb Smirnoff "flags only apply to tcp"); 9253b3a8eb9SGleb Smirnoff if ($8.src_os) 9263b3a8eb9SGleb Smirnoff yyerror( 9273b3a8eb9SGleb Smirnoff "OS fingerprinting only " 9283b3a8eb9SGleb Smirnoff "applies to tcp"); 9293b3a8eb9SGleb Smirnoff YYERROR; 9303b3a8eb9SGleb Smirnoff } 9313b3a8eb9SGleb Smirnoff } 9323b3a8eb9SGleb Smirnoff 9333b3a8eb9SGleb Smirnoff r.tos = $9.tos; 9343b3a8eb9SGleb Smirnoff 9353b3a8eb9SGleb Smirnoff if ($9.keep.action) { 9363b3a8eb9SGleb Smirnoff yyerror("cannot specify state handling " 9373b3a8eb9SGleb Smirnoff "on anchors"); 9383b3a8eb9SGleb Smirnoff YYERROR; 9393b3a8eb9SGleb Smirnoff } 9403b3a8eb9SGleb Smirnoff 9413b3a8eb9SGleb Smirnoff if ($9.match_tag) 9423b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $9.match_tag, 9433b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 9443b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 9453b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 9463b3a8eb9SGleb Smirnoff YYERROR; 9473b3a8eb9SGleb Smirnoff } 9483b3a8eb9SGleb Smirnoff r.match_tag_not = $9.match_tag_not; 9493e248e0fSKristof Provost if ($9.marker & FOM_PRIO) { 9503e248e0fSKristof Provost if ($9.prio == 0) 9513e248e0fSKristof Provost r.prio = PF_PRIO_ZERO; 9523e248e0fSKristof Provost else 9533e248e0fSKristof Provost r.prio = $9.prio; 9543e248e0fSKristof Provost } 9553e248e0fSKristof Provost if ($9.marker & FOM_SETPRIO) { 9563e248e0fSKristof Provost r.set_prio[0] = $9.set_prio[0]; 9573e248e0fSKristof Provost r.set_prio[1] = $9.set_prio[1]; 9583e248e0fSKristof Provost r.scrub_flags |= PFSTATE_SETPRIO; 9593e248e0fSKristof Provost } 9603b3a8eb9SGleb Smirnoff 9613b3a8eb9SGleb Smirnoff decide_address_family($8.src.host, &r.af); 9623b3a8eb9SGleb Smirnoff decide_address_family($8.dst.host, &r.af); 9633b3a8eb9SGleb Smirnoff 9643b3a8eb9SGleb Smirnoff expand_rule(&r, $5, NULL, $7, $8.src_os, 9653b3a8eb9SGleb Smirnoff $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 9663b3a8eb9SGleb Smirnoff $9.uid, $9.gid, $9.icmpspec, 9673b3a8eb9SGleb Smirnoff pf->astack[pf->asd + 1] ? pf->alast->name : $2); 9683b3a8eb9SGleb Smirnoff free($2); 9693b3a8eb9SGleb Smirnoff pf->astack[pf->asd + 1] = NULL; 9703b3a8eb9SGleb Smirnoff } 9713b3a8eb9SGleb Smirnoff | NATANCHOR string interface af proto fromto rtable { 972e9eb0941SKristof Provost struct pfctl_rule r; 9733b3a8eb9SGleb Smirnoff 9743b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) { 9753b3a8eb9SGleb Smirnoff free($2); 9763b3a8eb9SGleb Smirnoff YYERROR; 9773b3a8eb9SGleb Smirnoff } 9783b3a8eb9SGleb Smirnoff 9793b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 9803b3a8eb9SGleb Smirnoff r.action = PF_NAT; 9813b3a8eb9SGleb Smirnoff r.af = $4; 9823b3a8eb9SGleb Smirnoff r.rtableid = $7; 9833b3a8eb9SGleb Smirnoff 9843b3a8eb9SGleb Smirnoff decide_address_family($6.src.host, &r.af); 9853b3a8eb9SGleb Smirnoff decide_address_family($6.dst.host, &r.af); 9863b3a8eb9SGleb Smirnoff 9873b3a8eb9SGleb Smirnoff expand_rule(&r, $3, NULL, $5, $6.src_os, 9883b3a8eb9SGleb Smirnoff $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 9893b3a8eb9SGleb Smirnoff 0, 0, 0, $2); 9903b3a8eb9SGleb Smirnoff free($2); 9913b3a8eb9SGleb Smirnoff } 9923b3a8eb9SGleb Smirnoff | RDRANCHOR string interface af proto fromto rtable { 993e9eb0941SKristof Provost struct pfctl_rule r; 9943b3a8eb9SGleb Smirnoff 9953b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) { 9963b3a8eb9SGleb Smirnoff free($2); 9973b3a8eb9SGleb Smirnoff YYERROR; 9983b3a8eb9SGleb Smirnoff } 9993b3a8eb9SGleb Smirnoff 10003b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 10013b3a8eb9SGleb Smirnoff r.action = PF_RDR; 10023b3a8eb9SGleb Smirnoff r.af = $4; 10033b3a8eb9SGleb Smirnoff r.rtableid = $7; 10043b3a8eb9SGleb Smirnoff 10053b3a8eb9SGleb Smirnoff decide_address_family($6.src.host, &r.af); 10063b3a8eb9SGleb Smirnoff decide_address_family($6.dst.host, &r.af); 10073b3a8eb9SGleb Smirnoff 10083b3a8eb9SGleb Smirnoff if ($6.src.port != NULL) { 10093b3a8eb9SGleb Smirnoff yyerror("source port parameter not supported" 10103b3a8eb9SGleb Smirnoff " in rdr-anchor"); 10113b3a8eb9SGleb Smirnoff YYERROR; 10123b3a8eb9SGleb Smirnoff } 10133b3a8eb9SGleb Smirnoff if ($6.dst.port != NULL) { 10143b3a8eb9SGleb Smirnoff if ($6.dst.port->next != NULL) { 10153b3a8eb9SGleb Smirnoff yyerror("destination port list " 10163b3a8eb9SGleb Smirnoff "expansion not supported in " 10173b3a8eb9SGleb Smirnoff "rdr-anchor"); 10183b3a8eb9SGleb Smirnoff YYERROR; 10193b3a8eb9SGleb Smirnoff } else if ($6.dst.port->op != PF_OP_EQ) { 10203b3a8eb9SGleb Smirnoff yyerror("destination port operators" 10213b3a8eb9SGleb Smirnoff " not supported in rdr-anchor"); 10223b3a8eb9SGleb Smirnoff YYERROR; 10233b3a8eb9SGleb Smirnoff } 10243b3a8eb9SGleb Smirnoff r.dst.port[0] = $6.dst.port->port[0]; 10253b3a8eb9SGleb Smirnoff r.dst.port[1] = $6.dst.port->port[1]; 10263b3a8eb9SGleb Smirnoff r.dst.port_op = $6.dst.port->op; 10273b3a8eb9SGleb Smirnoff } 10283b3a8eb9SGleb Smirnoff 10293b3a8eb9SGleb Smirnoff expand_rule(&r, $3, NULL, $5, $6.src_os, 10303b3a8eb9SGleb Smirnoff $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 10313b3a8eb9SGleb Smirnoff 0, 0, 0, $2); 10323b3a8eb9SGleb Smirnoff free($2); 10333b3a8eb9SGleb Smirnoff } 10343b3a8eb9SGleb Smirnoff | BINATANCHOR string interface af proto fromto rtable { 1035e9eb0941SKristof Provost struct pfctl_rule r; 10363b3a8eb9SGleb Smirnoff 10373b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) { 10383b3a8eb9SGleb Smirnoff free($2); 10393b3a8eb9SGleb Smirnoff YYERROR; 10403b3a8eb9SGleb Smirnoff } 10413b3a8eb9SGleb Smirnoff 10423b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 10433b3a8eb9SGleb Smirnoff r.action = PF_BINAT; 10443b3a8eb9SGleb Smirnoff r.af = $4; 10453b3a8eb9SGleb Smirnoff r.rtableid = $7; 10463b3a8eb9SGleb Smirnoff if ($5 != NULL) { 10473b3a8eb9SGleb Smirnoff if ($5->next != NULL) { 10483b3a8eb9SGleb Smirnoff yyerror("proto list expansion" 10493b3a8eb9SGleb Smirnoff " not supported in binat-anchor"); 10503b3a8eb9SGleb Smirnoff YYERROR; 10513b3a8eb9SGleb Smirnoff } 10523b3a8eb9SGleb Smirnoff r.proto = $5->proto; 10533b3a8eb9SGleb Smirnoff free($5); 10543b3a8eb9SGleb Smirnoff } 10553b3a8eb9SGleb Smirnoff 10563b3a8eb9SGleb Smirnoff if ($6.src.host != NULL || $6.src.port != NULL || 10573b3a8eb9SGleb Smirnoff $6.dst.host != NULL || $6.dst.port != NULL) { 10583b3a8eb9SGleb Smirnoff yyerror("fromto parameter not supported" 10593b3a8eb9SGleb Smirnoff " in binat-anchor"); 10603b3a8eb9SGleb Smirnoff YYERROR; 10613b3a8eb9SGleb Smirnoff } 10623b3a8eb9SGleb Smirnoff 10633b3a8eb9SGleb Smirnoff decide_address_family($6.src.host, &r.af); 10643b3a8eb9SGleb Smirnoff decide_address_family($6.dst.host, &r.af); 10653b3a8eb9SGleb Smirnoff 10660d71f9f3SKristof Provost pfctl_append_rule(pf, &r, $2); 10673b3a8eb9SGleb Smirnoff free($2); 10683b3a8eb9SGleb Smirnoff } 10693b3a8eb9SGleb Smirnoff ; 10703b3a8eb9SGleb Smirnoff 10713b3a8eb9SGleb Smirnoff loadrule : LOAD ANCHOR string FROM string { 10723b3a8eb9SGleb Smirnoff struct loadanchors *loadanchor; 10733b3a8eb9SGleb Smirnoff 10743b3a8eb9SGleb Smirnoff if (strlen(pf->anchor->name) + 1 + 10753b3a8eb9SGleb Smirnoff strlen($3) >= MAXPATHLEN) { 10763b3a8eb9SGleb Smirnoff yyerror("anchorname %s too long, max %u\n", 10773b3a8eb9SGleb Smirnoff $3, MAXPATHLEN - 1); 10783b3a8eb9SGleb Smirnoff free($3); 10793b3a8eb9SGleb Smirnoff YYERROR; 10803b3a8eb9SGleb Smirnoff } 10813b3a8eb9SGleb Smirnoff loadanchor = calloc(1, sizeof(struct loadanchors)); 10823b3a8eb9SGleb Smirnoff if (loadanchor == NULL) 10833b3a8eb9SGleb Smirnoff err(1, "loadrule: calloc"); 10843b3a8eb9SGleb Smirnoff if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 10853b3a8eb9SGleb Smirnoff NULL) 10863b3a8eb9SGleb Smirnoff err(1, "loadrule: malloc"); 10873b3a8eb9SGleb Smirnoff if (pf->anchor->name[0]) 10883b3a8eb9SGleb Smirnoff snprintf(loadanchor->anchorname, MAXPATHLEN, 10893b3a8eb9SGleb Smirnoff "%s/%s", pf->anchor->name, $3); 10903b3a8eb9SGleb Smirnoff else 10913b3a8eb9SGleb Smirnoff strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 10923b3a8eb9SGleb Smirnoff if ((loadanchor->filename = strdup($5)) == NULL) 10933b3a8eb9SGleb Smirnoff err(1, "loadrule: strdup"); 10943b3a8eb9SGleb Smirnoff 10953b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 10963b3a8eb9SGleb Smirnoff entries); 10973b3a8eb9SGleb Smirnoff 10983b3a8eb9SGleb Smirnoff free($3); 10993b3a8eb9SGleb Smirnoff free($5); 11003b3a8eb9SGleb Smirnoff }; 11013b3a8eb9SGleb Smirnoff 11023b3a8eb9SGleb Smirnoff scrubaction : no SCRUB { 11033b3a8eb9SGleb Smirnoff $$.b2 = $$.w = 0; 11043b3a8eb9SGleb Smirnoff if ($1) 11053b3a8eb9SGleb Smirnoff $$.b1 = PF_NOSCRUB; 11063b3a8eb9SGleb Smirnoff else 11073b3a8eb9SGleb Smirnoff $$.b1 = PF_SCRUB; 11083b3a8eb9SGleb Smirnoff } 11093b3a8eb9SGleb Smirnoff ; 11103b3a8eb9SGleb Smirnoff 11113b3a8eb9SGleb Smirnoff scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 11123b3a8eb9SGleb Smirnoff { 1113e9eb0941SKristof Provost struct pfctl_rule r; 11143b3a8eb9SGleb Smirnoff 11153b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_SCRUB)) 11163b3a8eb9SGleb Smirnoff YYERROR; 11173b3a8eb9SGleb Smirnoff 11183b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 11193b3a8eb9SGleb Smirnoff 11203b3a8eb9SGleb Smirnoff r.action = $1.b1; 11213b3a8eb9SGleb Smirnoff r.direction = $2; 11223b3a8eb9SGleb Smirnoff 11233b3a8eb9SGleb Smirnoff r.log = $3.log; 11243b3a8eb9SGleb Smirnoff r.logif = $3.logif; 11253b3a8eb9SGleb Smirnoff if ($3.quick) { 11263b3a8eb9SGleb Smirnoff yyerror("scrub rules do not support 'quick'"); 11273b3a8eb9SGleb Smirnoff YYERROR; 11283b3a8eb9SGleb Smirnoff } 11293b3a8eb9SGleb Smirnoff 11303b3a8eb9SGleb Smirnoff r.af = $5; 11313b3a8eb9SGleb Smirnoff if ($8.nodf) 11323b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_NODF; 11333b3a8eb9SGleb Smirnoff if ($8.randomid) 11343b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RANDOMID; 11353b3a8eb9SGleb Smirnoff if ($8.reassemble_tcp) { 11363b3a8eb9SGleb Smirnoff if (r.direction != PF_INOUT) { 11373b3a8eb9SGleb Smirnoff yyerror("reassemble tcp rules can not " 11383b3a8eb9SGleb Smirnoff "specify direction"); 11393b3a8eb9SGleb Smirnoff YYERROR; 11403b3a8eb9SGleb Smirnoff } 11413b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_REASSEMBLE_TCP; 11423b3a8eb9SGleb Smirnoff } 11433b3a8eb9SGleb Smirnoff if ($8.minttl) 11443b3a8eb9SGleb Smirnoff r.min_ttl = $8.minttl; 11453b3a8eb9SGleb Smirnoff if ($8.maxmss) 11463b3a8eb9SGleb Smirnoff r.max_mss = $8.maxmss; 11473b3a8eb9SGleb Smirnoff if ($8.marker & SOM_SETTOS) { 11483b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SET_TOS; 11493b3a8eb9SGleb Smirnoff r.set_tos = $8.settos; 11503b3a8eb9SGleb Smirnoff } 11513b3a8eb9SGleb Smirnoff if ($8.fragcache) 11523b3a8eb9SGleb Smirnoff r.rule_flag |= $8.fragcache; 11533b3a8eb9SGleb Smirnoff if ($8.match_tag) 11543b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $8.match_tag, 11553b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 11563b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 11573b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 11583b3a8eb9SGleb Smirnoff YYERROR; 11593b3a8eb9SGleb Smirnoff } 11603b3a8eb9SGleb Smirnoff r.match_tag_not = $8.match_tag_not; 11613b3a8eb9SGleb Smirnoff r.rtableid = $8.rtableid; 11623b3a8eb9SGleb Smirnoff 11633b3a8eb9SGleb Smirnoff expand_rule(&r, $4, NULL, $6, $7.src_os, 11643b3a8eb9SGleb Smirnoff $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 11653b3a8eb9SGleb Smirnoff NULL, NULL, NULL, ""); 11663b3a8eb9SGleb Smirnoff } 11673b3a8eb9SGleb Smirnoff ; 11683b3a8eb9SGleb Smirnoff 11693b3a8eb9SGleb Smirnoff scrub_opts : { 11703b3a8eb9SGleb Smirnoff bzero(&scrub_opts, sizeof scrub_opts); 11713b3a8eb9SGleb Smirnoff scrub_opts.rtableid = -1; 11723b3a8eb9SGleb Smirnoff } 11733b3a8eb9SGleb Smirnoff scrub_opts_l 11743b3a8eb9SGleb Smirnoff { $$ = scrub_opts; } 11753b3a8eb9SGleb Smirnoff | /* empty */ { 11763b3a8eb9SGleb Smirnoff bzero(&scrub_opts, sizeof scrub_opts); 11773b3a8eb9SGleb Smirnoff scrub_opts.rtableid = -1; 11783b3a8eb9SGleb Smirnoff $$ = scrub_opts; 11793b3a8eb9SGleb Smirnoff } 11803b3a8eb9SGleb Smirnoff ; 11813b3a8eb9SGleb Smirnoff 11823b3a8eb9SGleb Smirnoff scrub_opts_l : scrub_opts_l scrub_opt 11833b3a8eb9SGleb Smirnoff | scrub_opt 11843b3a8eb9SGleb Smirnoff ; 11853b3a8eb9SGleb Smirnoff 11863b3a8eb9SGleb Smirnoff scrub_opt : NODF { 11873b3a8eb9SGleb Smirnoff if (scrub_opts.nodf) { 11883b3a8eb9SGleb Smirnoff yyerror("no-df cannot be respecified"); 11893b3a8eb9SGleb Smirnoff YYERROR; 11903b3a8eb9SGleb Smirnoff } 11913b3a8eb9SGleb Smirnoff scrub_opts.nodf = 1; 11923b3a8eb9SGleb Smirnoff } 11933b3a8eb9SGleb Smirnoff | MINTTL NUMBER { 11943b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_MINTTL) { 11953b3a8eb9SGleb Smirnoff yyerror("min-ttl cannot be respecified"); 11963b3a8eb9SGleb Smirnoff YYERROR; 11973b3a8eb9SGleb Smirnoff } 11983b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 255) { 11993b3a8eb9SGleb Smirnoff yyerror("illegal min-ttl value %d", $2); 12003b3a8eb9SGleb Smirnoff YYERROR; 12013b3a8eb9SGleb Smirnoff } 12023b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_MINTTL; 12033b3a8eb9SGleb Smirnoff scrub_opts.minttl = $2; 12043b3a8eb9SGleb Smirnoff } 12053b3a8eb9SGleb Smirnoff | MAXMSS NUMBER { 12063b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_MAXMSS) { 12073b3a8eb9SGleb Smirnoff yyerror("max-mss cannot be respecified"); 12083b3a8eb9SGleb Smirnoff YYERROR; 12093b3a8eb9SGleb Smirnoff } 12103b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 65535) { 12113b3a8eb9SGleb Smirnoff yyerror("illegal max-mss value %d", $2); 12123b3a8eb9SGleb Smirnoff YYERROR; 12133b3a8eb9SGleb Smirnoff } 12143b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_MAXMSS; 12153b3a8eb9SGleb Smirnoff scrub_opts.maxmss = $2; 12163b3a8eb9SGleb Smirnoff } 12173b3a8eb9SGleb Smirnoff | SETTOS tos { 12183b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_SETTOS) { 12193b3a8eb9SGleb Smirnoff yyerror("set-tos cannot be respecified"); 12203b3a8eb9SGleb Smirnoff YYERROR; 12213b3a8eb9SGleb Smirnoff } 12223b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_SETTOS; 12233b3a8eb9SGleb Smirnoff scrub_opts.settos = $2; 12243b3a8eb9SGleb Smirnoff } 12253b3a8eb9SGleb Smirnoff | fragcache { 12263b3a8eb9SGleb Smirnoff if (scrub_opts.marker & SOM_FRAGCACHE) { 12273b3a8eb9SGleb Smirnoff yyerror("fragcache cannot be respecified"); 12283b3a8eb9SGleb Smirnoff YYERROR; 12293b3a8eb9SGleb Smirnoff } 12303b3a8eb9SGleb Smirnoff scrub_opts.marker |= SOM_FRAGCACHE; 12313b3a8eb9SGleb Smirnoff scrub_opts.fragcache = $1; 12323b3a8eb9SGleb Smirnoff } 12333b3a8eb9SGleb Smirnoff | REASSEMBLE STRING { 12343b3a8eb9SGleb Smirnoff if (strcasecmp($2, "tcp") != 0) { 12353b3a8eb9SGleb Smirnoff yyerror("scrub reassemble supports only tcp, " 12363b3a8eb9SGleb Smirnoff "not '%s'", $2); 12373b3a8eb9SGleb Smirnoff free($2); 12383b3a8eb9SGleb Smirnoff YYERROR; 12393b3a8eb9SGleb Smirnoff } 12403b3a8eb9SGleb Smirnoff free($2); 12413b3a8eb9SGleb Smirnoff if (scrub_opts.reassemble_tcp) { 12423b3a8eb9SGleb Smirnoff yyerror("reassemble tcp cannot be respecified"); 12433b3a8eb9SGleb Smirnoff YYERROR; 12443b3a8eb9SGleb Smirnoff } 12453b3a8eb9SGleb Smirnoff scrub_opts.reassemble_tcp = 1; 12463b3a8eb9SGleb Smirnoff } 12473b3a8eb9SGleb Smirnoff | RANDOMID { 12483b3a8eb9SGleb Smirnoff if (scrub_opts.randomid) { 12493b3a8eb9SGleb Smirnoff yyerror("random-id cannot be respecified"); 12503b3a8eb9SGleb Smirnoff YYERROR; 12513b3a8eb9SGleb Smirnoff } 12523b3a8eb9SGleb Smirnoff scrub_opts.randomid = 1; 12533b3a8eb9SGleb Smirnoff } 12543b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 12553b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 12563b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 12573b3a8eb9SGleb Smirnoff YYERROR; 12583b3a8eb9SGleb Smirnoff } 12593b3a8eb9SGleb Smirnoff scrub_opts.rtableid = $2; 12603b3a8eb9SGleb Smirnoff } 12613b3a8eb9SGleb Smirnoff | not TAGGED string { 12623b3a8eb9SGleb Smirnoff scrub_opts.match_tag = $3; 12633b3a8eb9SGleb Smirnoff scrub_opts.match_tag_not = $1; 12643b3a8eb9SGleb Smirnoff } 12653b3a8eb9SGleb Smirnoff ; 12663b3a8eb9SGleb Smirnoff 12673b3a8eb9SGleb Smirnoff fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 126864b3b4d6SKristof Provost | FRAGMENT FRAGCROP { $$ = 0; } 126964b3b4d6SKristof Provost | FRAGMENT FRAGDROP { $$ = 0; } 12703b3a8eb9SGleb Smirnoff ; 12713b3a8eb9SGleb Smirnoff 12723b3a8eb9SGleb Smirnoff antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1273e9eb0941SKristof Provost struct pfctl_rule r; 12743b3a8eb9SGleb Smirnoff struct node_host *h = NULL, *hh; 12753b3a8eb9SGleb Smirnoff struct node_if *i, *j; 12763b3a8eb9SGleb Smirnoff 12773b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_FILTER)) 12783b3a8eb9SGleb Smirnoff YYERROR; 12793b3a8eb9SGleb Smirnoff 12803b3a8eb9SGleb Smirnoff for (i = $3; i; i = i->next) { 12813b3a8eb9SGleb Smirnoff bzero(&r, sizeof(r)); 12823b3a8eb9SGleb Smirnoff 12833b3a8eb9SGleb Smirnoff r.action = PF_DROP; 12843b3a8eb9SGleb Smirnoff r.direction = PF_IN; 12853b3a8eb9SGleb Smirnoff r.log = $2.log; 12863b3a8eb9SGleb Smirnoff r.logif = $2.logif; 12873b3a8eb9SGleb Smirnoff r.quick = $2.quick; 12883b3a8eb9SGleb Smirnoff r.af = $4; 12893b3a8eb9SGleb Smirnoff if (rule_label(&r, $5.label)) 12903b3a8eb9SGleb Smirnoff YYERROR; 12913b3a8eb9SGleb Smirnoff r.rtableid = $5.rtableid; 12923b3a8eb9SGleb Smirnoff j = calloc(1, sizeof(struct node_if)); 12933b3a8eb9SGleb Smirnoff if (j == NULL) 12943b3a8eb9SGleb Smirnoff err(1, "antispoof: calloc"); 12953b3a8eb9SGleb Smirnoff if (strlcpy(j->ifname, i->ifname, 12963b3a8eb9SGleb Smirnoff sizeof(j->ifname)) >= sizeof(j->ifname)) { 12973b3a8eb9SGleb Smirnoff free(j); 12983b3a8eb9SGleb Smirnoff yyerror("interface name too long"); 12993b3a8eb9SGleb Smirnoff YYERROR; 13003b3a8eb9SGleb Smirnoff } 13013b3a8eb9SGleb Smirnoff j->not = 1; 13023b3a8eb9SGleb Smirnoff if (i->dynamic) { 13033b3a8eb9SGleb Smirnoff h = calloc(1, sizeof(*h)); 13043b3a8eb9SGleb Smirnoff if (h == NULL) 13053b3a8eb9SGleb Smirnoff err(1, "address: calloc"); 13063b3a8eb9SGleb Smirnoff h->addr.type = PF_ADDR_DYNIFTL; 13073b3a8eb9SGleb Smirnoff set_ipmask(h, 128); 13083b3a8eb9SGleb Smirnoff if (strlcpy(h->addr.v.ifname, i->ifname, 13093b3a8eb9SGleb Smirnoff sizeof(h->addr.v.ifname)) >= 13103b3a8eb9SGleb Smirnoff sizeof(h->addr.v.ifname)) { 13113b3a8eb9SGleb Smirnoff free(h); 13123b3a8eb9SGleb Smirnoff yyerror( 13133b3a8eb9SGleb Smirnoff "interface name too long"); 13143b3a8eb9SGleb Smirnoff YYERROR; 13153b3a8eb9SGleb Smirnoff } 13163b3a8eb9SGleb Smirnoff hh = malloc(sizeof(*hh)); 13173b3a8eb9SGleb Smirnoff if (hh == NULL) 13183b3a8eb9SGleb Smirnoff err(1, "address: malloc"); 13193b3a8eb9SGleb Smirnoff bcopy(h, hh, sizeof(*hh)); 13203b3a8eb9SGleb Smirnoff h->addr.iflags = PFI_AFLAG_NETWORK; 13213b3a8eb9SGleb Smirnoff } else { 13223b3a8eb9SGleb Smirnoff h = ifa_lookup(j->ifname, 13233b3a8eb9SGleb Smirnoff PFI_AFLAG_NETWORK); 13243b3a8eb9SGleb Smirnoff hh = NULL; 13253b3a8eb9SGleb Smirnoff } 13263b3a8eb9SGleb Smirnoff 13273b3a8eb9SGleb Smirnoff if (h != NULL) 13283b3a8eb9SGleb Smirnoff expand_rule(&r, j, NULL, NULL, NULL, h, 13293b3a8eb9SGleb Smirnoff NULL, NULL, NULL, NULL, NULL, 13303b3a8eb9SGleb Smirnoff NULL, ""); 13313b3a8eb9SGleb Smirnoff 13323b3a8eb9SGleb Smirnoff if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 13333b3a8eb9SGleb Smirnoff bzero(&r, sizeof(r)); 13343b3a8eb9SGleb Smirnoff 13353b3a8eb9SGleb Smirnoff r.action = PF_DROP; 13363b3a8eb9SGleb Smirnoff r.direction = PF_IN; 13373b3a8eb9SGleb Smirnoff r.log = $2.log; 13383b3a8eb9SGleb Smirnoff r.logif = $2.logif; 13393b3a8eb9SGleb Smirnoff r.quick = $2.quick; 13403b3a8eb9SGleb Smirnoff r.af = $4; 13413b3a8eb9SGleb Smirnoff if (rule_label(&r, $5.label)) 13423b3a8eb9SGleb Smirnoff YYERROR; 13433b3a8eb9SGleb Smirnoff r.rtableid = $5.rtableid; 13443b3a8eb9SGleb Smirnoff if (hh != NULL) 13453b3a8eb9SGleb Smirnoff h = hh; 13463b3a8eb9SGleb Smirnoff else 13473b3a8eb9SGleb Smirnoff h = ifa_lookup(i->ifname, 0); 13483b3a8eb9SGleb Smirnoff if (h != NULL) 13493b3a8eb9SGleb Smirnoff expand_rule(&r, NULL, NULL, 13503b3a8eb9SGleb Smirnoff NULL, NULL, h, NULL, NULL, 13513b3a8eb9SGleb Smirnoff NULL, NULL, NULL, NULL, ""); 13523b3a8eb9SGleb Smirnoff } else 13533b3a8eb9SGleb Smirnoff free(hh); 13543b3a8eb9SGleb Smirnoff } 13556fcc8e04SKristof Provost for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 13566fcc8e04SKristof Provost free($5.label[i]); 13573b3a8eb9SGleb Smirnoff } 13583b3a8eb9SGleb Smirnoff ; 13593b3a8eb9SGleb Smirnoff 13603b3a8eb9SGleb Smirnoff antispoof_ifspc : FOR antispoof_if { $$ = $2; } 13613b3a8eb9SGleb Smirnoff | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 13623b3a8eb9SGleb Smirnoff ; 13633b3a8eb9SGleb Smirnoff 13643b3a8eb9SGleb Smirnoff antispoof_iflst : antispoof_if optnl { $$ = $1; } 13653b3a8eb9SGleb Smirnoff | antispoof_iflst comma antispoof_if optnl { 13663b3a8eb9SGleb Smirnoff $1->tail->next = $3; 13673b3a8eb9SGleb Smirnoff $1->tail = $3; 13683b3a8eb9SGleb Smirnoff $$ = $1; 13693b3a8eb9SGleb Smirnoff } 13703b3a8eb9SGleb Smirnoff ; 13713b3a8eb9SGleb Smirnoff 13723b3a8eb9SGleb Smirnoff antispoof_if : if_item { $$ = $1; } 13733b3a8eb9SGleb Smirnoff | '(' if_item ')' { 13743b3a8eb9SGleb Smirnoff $2->dynamic = 1; 13753b3a8eb9SGleb Smirnoff $$ = $2; 13763b3a8eb9SGleb Smirnoff } 13773b3a8eb9SGleb Smirnoff ; 13783b3a8eb9SGleb Smirnoff 13793b3a8eb9SGleb Smirnoff antispoof_opts : { 13803b3a8eb9SGleb Smirnoff bzero(&antispoof_opts, sizeof antispoof_opts); 13813b3a8eb9SGleb Smirnoff antispoof_opts.rtableid = -1; 13823b3a8eb9SGleb Smirnoff } 13833b3a8eb9SGleb Smirnoff antispoof_opts_l 13843b3a8eb9SGleb Smirnoff { $$ = antispoof_opts; } 13853b3a8eb9SGleb Smirnoff | /* empty */ { 13863b3a8eb9SGleb Smirnoff bzero(&antispoof_opts, sizeof antispoof_opts); 13873b3a8eb9SGleb Smirnoff antispoof_opts.rtableid = -1; 13883b3a8eb9SGleb Smirnoff $$ = antispoof_opts; 13893b3a8eb9SGleb Smirnoff } 13903b3a8eb9SGleb Smirnoff ; 13913b3a8eb9SGleb Smirnoff 13923b3a8eb9SGleb Smirnoff antispoof_opts_l : antispoof_opts_l antispoof_opt 13933b3a8eb9SGleb Smirnoff | antispoof_opt 13943b3a8eb9SGleb Smirnoff ; 13953b3a8eb9SGleb Smirnoff 13963b3a8eb9SGleb Smirnoff antispoof_opt : label { 13976fcc8e04SKristof Provost if (antispoof_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 13986fcc8e04SKristof Provost yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 13993b3a8eb9SGleb Smirnoff YYERROR; 14003b3a8eb9SGleb Smirnoff } 14016fcc8e04SKristof Provost antispoof_opts.label[antispoof_opts.labelcount++] = $1; 14023b3a8eb9SGleb Smirnoff } 14033b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 14043b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 14053b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 14063b3a8eb9SGleb Smirnoff YYERROR; 14073b3a8eb9SGleb Smirnoff } 14083b3a8eb9SGleb Smirnoff antispoof_opts.rtableid = $2; 14093b3a8eb9SGleb Smirnoff } 14103b3a8eb9SGleb Smirnoff ; 14113b3a8eb9SGleb Smirnoff 14123b3a8eb9SGleb Smirnoff not : '!' { $$ = 1; } 14133b3a8eb9SGleb Smirnoff | /* empty */ { $$ = 0; } 14143b3a8eb9SGleb Smirnoff ; 14153b3a8eb9SGleb Smirnoff 14163b3a8eb9SGleb Smirnoff tabledef : TABLE '<' STRING '>' table_opts { 14173b3a8eb9SGleb Smirnoff struct node_host *h, *nh; 14183b3a8eb9SGleb Smirnoff struct node_tinit *ti, *nti; 14193b3a8eb9SGleb Smirnoff 14203b3a8eb9SGleb Smirnoff if (strlen($3) >= PF_TABLE_NAME_SIZE) { 14213b3a8eb9SGleb Smirnoff yyerror("table name too long, max %d chars", 14223b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE - 1); 14233b3a8eb9SGleb Smirnoff free($3); 14243b3a8eb9SGleb Smirnoff YYERROR; 14253b3a8eb9SGleb Smirnoff } 14263b3a8eb9SGleb Smirnoff if (pf->loadopt & PFCTL_FLAG_TABLE) 14273b3a8eb9SGleb Smirnoff if (process_tabledef($3, &$5)) { 14283b3a8eb9SGleb Smirnoff free($3); 14293b3a8eb9SGleb Smirnoff YYERROR; 14303b3a8eb9SGleb Smirnoff } 14313b3a8eb9SGleb Smirnoff free($3); 14323b3a8eb9SGleb Smirnoff for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 14333b3a8eb9SGleb Smirnoff ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 14343b3a8eb9SGleb Smirnoff if (ti->file) 14353b3a8eb9SGleb Smirnoff free(ti->file); 14363b3a8eb9SGleb Smirnoff for (h = ti->host; h != NULL; h = nh) { 14373b3a8eb9SGleb Smirnoff nh = h->next; 14383b3a8eb9SGleb Smirnoff free(h); 14393b3a8eb9SGleb Smirnoff } 14403b3a8eb9SGleb Smirnoff nti = SIMPLEQ_NEXT(ti, entries); 14413b3a8eb9SGleb Smirnoff free(ti); 14423b3a8eb9SGleb Smirnoff } 14433b3a8eb9SGleb Smirnoff } 14443b3a8eb9SGleb Smirnoff ; 14453b3a8eb9SGleb Smirnoff 14463b3a8eb9SGleb Smirnoff table_opts : { 14473b3a8eb9SGleb Smirnoff bzero(&table_opts, sizeof table_opts); 14483b3a8eb9SGleb Smirnoff SIMPLEQ_INIT(&table_opts.init_nodes); 14493b3a8eb9SGleb Smirnoff } 14503b3a8eb9SGleb Smirnoff table_opts_l 14513b3a8eb9SGleb Smirnoff { $$ = table_opts; } 14523b3a8eb9SGleb Smirnoff | /* empty */ 14533b3a8eb9SGleb Smirnoff { 14543b3a8eb9SGleb Smirnoff bzero(&table_opts, sizeof table_opts); 14553b3a8eb9SGleb Smirnoff SIMPLEQ_INIT(&table_opts.init_nodes); 14563b3a8eb9SGleb Smirnoff $$ = table_opts; 14573b3a8eb9SGleb Smirnoff } 14583b3a8eb9SGleb Smirnoff ; 14593b3a8eb9SGleb Smirnoff 14603b3a8eb9SGleb Smirnoff table_opts_l : table_opts_l table_opt 14613b3a8eb9SGleb Smirnoff | table_opt 14623b3a8eb9SGleb Smirnoff ; 14633b3a8eb9SGleb Smirnoff 14643b3a8eb9SGleb Smirnoff table_opt : STRING { 14653b3a8eb9SGleb Smirnoff if (!strcmp($1, "const")) 14663b3a8eb9SGleb Smirnoff table_opts.flags |= PFR_TFLAG_CONST; 14673b3a8eb9SGleb Smirnoff else if (!strcmp($1, "persist")) 14683b3a8eb9SGleb Smirnoff table_opts.flags |= PFR_TFLAG_PERSIST; 14693b3a8eb9SGleb Smirnoff else if (!strcmp($1, "counters")) 14703b3a8eb9SGleb Smirnoff table_opts.flags |= PFR_TFLAG_COUNTERS; 14713b3a8eb9SGleb Smirnoff else { 14723b3a8eb9SGleb Smirnoff yyerror("invalid table option '%s'", $1); 14733b3a8eb9SGleb Smirnoff free($1); 14743b3a8eb9SGleb Smirnoff YYERROR; 14753b3a8eb9SGleb Smirnoff } 14763b3a8eb9SGleb Smirnoff free($1); 14773b3a8eb9SGleb Smirnoff } 14783b3a8eb9SGleb Smirnoff | '{' optnl '}' { table_opts.init_addr = 1; } 14793b3a8eb9SGleb Smirnoff | '{' optnl host_list '}' { 14803b3a8eb9SGleb Smirnoff struct node_host *n; 14813b3a8eb9SGleb Smirnoff struct node_tinit *ti; 14823b3a8eb9SGleb Smirnoff 14833b3a8eb9SGleb Smirnoff for (n = $3; n != NULL; n = n->next) { 14843b3a8eb9SGleb Smirnoff switch (n->addr.type) { 14853b3a8eb9SGleb Smirnoff case PF_ADDR_ADDRMASK: 14863b3a8eb9SGleb Smirnoff continue; /* ok */ 14873b3a8eb9SGleb Smirnoff case PF_ADDR_RANGE: 14883b3a8eb9SGleb Smirnoff yyerror("address ranges are not " 14893b3a8eb9SGleb Smirnoff "permitted inside tables"); 14903b3a8eb9SGleb Smirnoff break; 14913b3a8eb9SGleb Smirnoff case PF_ADDR_DYNIFTL: 14923b3a8eb9SGleb Smirnoff yyerror("dynamic addresses are not " 14933b3a8eb9SGleb Smirnoff "permitted inside tables"); 14943b3a8eb9SGleb Smirnoff break; 14953b3a8eb9SGleb Smirnoff case PF_ADDR_TABLE: 14963b3a8eb9SGleb Smirnoff yyerror("tables cannot contain tables"); 14973b3a8eb9SGleb Smirnoff break; 14983b3a8eb9SGleb Smirnoff case PF_ADDR_NOROUTE: 14993b3a8eb9SGleb Smirnoff yyerror("\"no-route\" is not permitted " 15003b3a8eb9SGleb Smirnoff "inside tables"); 15013b3a8eb9SGleb Smirnoff break; 15023b3a8eb9SGleb Smirnoff case PF_ADDR_URPFFAILED: 15033b3a8eb9SGleb Smirnoff yyerror("\"urpf-failed\" is not " 15043b3a8eb9SGleb Smirnoff "permitted inside tables"); 15053b3a8eb9SGleb Smirnoff break; 15063b3a8eb9SGleb Smirnoff default: 15073b3a8eb9SGleb Smirnoff yyerror("unknown address type %d", 15083b3a8eb9SGleb Smirnoff n->addr.type); 15093b3a8eb9SGleb Smirnoff } 15103b3a8eb9SGleb Smirnoff YYERROR; 15113b3a8eb9SGleb Smirnoff } 15123b3a8eb9SGleb Smirnoff if (!(ti = calloc(1, sizeof(*ti)))) 15133b3a8eb9SGleb Smirnoff err(1, "table_opt: calloc"); 15143b3a8eb9SGleb Smirnoff ti->host = $3; 15153b3a8eb9SGleb Smirnoff SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 15163b3a8eb9SGleb Smirnoff entries); 15173b3a8eb9SGleb Smirnoff table_opts.init_addr = 1; 15183b3a8eb9SGleb Smirnoff } 15193b3a8eb9SGleb Smirnoff | FILENAME STRING { 15203b3a8eb9SGleb Smirnoff struct node_tinit *ti; 15213b3a8eb9SGleb Smirnoff 15223b3a8eb9SGleb Smirnoff if (!(ti = calloc(1, sizeof(*ti)))) 15233b3a8eb9SGleb Smirnoff err(1, "table_opt: calloc"); 15243b3a8eb9SGleb Smirnoff ti->file = $2; 15253b3a8eb9SGleb Smirnoff SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 15263b3a8eb9SGleb Smirnoff entries); 15273b3a8eb9SGleb Smirnoff table_opts.init_addr = 1; 15283b3a8eb9SGleb Smirnoff } 15293b3a8eb9SGleb Smirnoff ; 15303b3a8eb9SGleb Smirnoff 15313b3a8eb9SGleb Smirnoff altqif : ALTQ interface queue_opts QUEUE qassign { 15323b3a8eb9SGleb Smirnoff struct pf_altq a; 15333b3a8eb9SGleb Smirnoff 15343b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_QUEUE)) 15353b3a8eb9SGleb Smirnoff YYERROR; 15363b3a8eb9SGleb Smirnoff 15373b3a8eb9SGleb Smirnoff memset(&a, 0, sizeof(a)); 15383b3a8eb9SGleb Smirnoff if ($3.scheduler.qtype == ALTQT_NONE) { 15393b3a8eb9SGleb Smirnoff yyerror("no scheduler specified!"); 15403b3a8eb9SGleb Smirnoff YYERROR; 15413b3a8eb9SGleb Smirnoff } 15423b3a8eb9SGleb Smirnoff a.scheduler = $3.scheduler.qtype; 15433b3a8eb9SGleb Smirnoff a.qlimit = $3.qlimit; 15443b3a8eb9SGleb Smirnoff a.tbrsize = $3.tbrsize; 15450a70aaf8SLuiz Otavio O Souza if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) { 15463b3a8eb9SGleb Smirnoff yyerror("no child queues specified"); 15473b3a8eb9SGleb Smirnoff YYERROR; 15483b3a8eb9SGleb Smirnoff } 15493b3a8eb9SGleb Smirnoff if (expand_altq(&a, $2, $5, $3.queue_bwspec, 15503b3a8eb9SGleb Smirnoff &$3.scheduler)) 15513b3a8eb9SGleb Smirnoff YYERROR; 15523b3a8eb9SGleb Smirnoff } 15533b3a8eb9SGleb Smirnoff ; 15543b3a8eb9SGleb Smirnoff 15553b3a8eb9SGleb Smirnoff queuespec : QUEUE STRING interface queue_opts qassign { 15563b3a8eb9SGleb Smirnoff struct pf_altq a; 15573b3a8eb9SGleb Smirnoff 15583b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_QUEUE)) { 15593b3a8eb9SGleb Smirnoff free($2); 15603b3a8eb9SGleb Smirnoff YYERROR; 15613b3a8eb9SGleb Smirnoff } 15623b3a8eb9SGleb Smirnoff 15633b3a8eb9SGleb Smirnoff memset(&a, 0, sizeof(a)); 15643b3a8eb9SGleb Smirnoff 15653b3a8eb9SGleb Smirnoff if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 15663b3a8eb9SGleb Smirnoff sizeof(a.qname)) { 15673b3a8eb9SGleb Smirnoff yyerror("queue name too long (max " 15683b3a8eb9SGleb Smirnoff "%d chars)", PF_QNAME_SIZE-1); 15693b3a8eb9SGleb Smirnoff free($2); 15703b3a8eb9SGleb Smirnoff YYERROR; 15713b3a8eb9SGleb Smirnoff } 15723b3a8eb9SGleb Smirnoff free($2); 15733b3a8eb9SGleb Smirnoff if ($4.tbrsize) { 15743b3a8eb9SGleb Smirnoff yyerror("cannot specify tbrsize for queue"); 15753b3a8eb9SGleb Smirnoff YYERROR; 15763b3a8eb9SGleb Smirnoff } 15773b3a8eb9SGleb Smirnoff if ($4.priority > 255) { 15783b3a8eb9SGleb Smirnoff yyerror("priority out of range: max 255"); 15793b3a8eb9SGleb Smirnoff YYERROR; 15803b3a8eb9SGleb Smirnoff } 15813b3a8eb9SGleb Smirnoff a.priority = $4.priority; 15823b3a8eb9SGleb Smirnoff a.qlimit = $4.qlimit; 15833b3a8eb9SGleb Smirnoff a.scheduler = $4.scheduler.qtype; 15843b3a8eb9SGleb Smirnoff if (expand_queue(&a, $3, $5, $4.queue_bwspec, 15853b3a8eb9SGleb Smirnoff &$4.scheduler)) { 15863b3a8eb9SGleb Smirnoff yyerror("errors in queue definition"); 15873b3a8eb9SGleb Smirnoff YYERROR; 15883b3a8eb9SGleb Smirnoff } 15893b3a8eb9SGleb Smirnoff } 15903b3a8eb9SGleb Smirnoff ; 15913b3a8eb9SGleb Smirnoff 15923b3a8eb9SGleb Smirnoff queue_opts : { 15933b3a8eb9SGleb Smirnoff bzero(&queue_opts, sizeof queue_opts); 15943b3a8eb9SGleb Smirnoff queue_opts.priority = DEFAULT_PRIORITY; 15953b3a8eb9SGleb Smirnoff queue_opts.qlimit = DEFAULT_QLIMIT; 15963b3a8eb9SGleb Smirnoff queue_opts.scheduler.qtype = ALTQT_NONE; 15973b3a8eb9SGleb Smirnoff queue_opts.queue_bwspec.bw_percent = 100; 15983b3a8eb9SGleb Smirnoff } 15993b3a8eb9SGleb Smirnoff queue_opts_l 16003b3a8eb9SGleb Smirnoff { $$ = queue_opts; } 16013b3a8eb9SGleb Smirnoff | /* empty */ { 16023b3a8eb9SGleb Smirnoff bzero(&queue_opts, sizeof queue_opts); 16033b3a8eb9SGleb Smirnoff queue_opts.priority = DEFAULT_PRIORITY; 16043b3a8eb9SGleb Smirnoff queue_opts.qlimit = DEFAULT_QLIMIT; 16053b3a8eb9SGleb Smirnoff queue_opts.scheduler.qtype = ALTQT_NONE; 16063b3a8eb9SGleb Smirnoff queue_opts.queue_bwspec.bw_percent = 100; 16073b3a8eb9SGleb Smirnoff $$ = queue_opts; 16083b3a8eb9SGleb Smirnoff } 16093b3a8eb9SGleb Smirnoff ; 16103b3a8eb9SGleb Smirnoff 16113b3a8eb9SGleb Smirnoff queue_opts_l : queue_opts_l queue_opt 16123b3a8eb9SGleb Smirnoff | queue_opt 16133b3a8eb9SGleb Smirnoff ; 16143b3a8eb9SGleb Smirnoff 16153b3a8eb9SGleb Smirnoff queue_opt : BANDWIDTH bandwidth { 16163b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_BWSPEC) { 16173b3a8eb9SGleb Smirnoff yyerror("bandwidth cannot be respecified"); 16183b3a8eb9SGleb Smirnoff YYERROR; 16193b3a8eb9SGleb Smirnoff } 16203b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_BWSPEC; 16213b3a8eb9SGleb Smirnoff queue_opts.queue_bwspec = $2; 16223b3a8eb9SGleb Smirnoff } 16233b3a8eb9SGleb Smirnoff | PRIORITY NUMBER { 16243b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_PRIORITY) { 16253b3a8eb9SGleb Smirnoff yyerror("priority cannot be respecified"); 16263b3a8eb9SGleb Smirnoff YYERROR; 16273b3a8eb9SGleb Smirnoff } 16283b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 255) { 16293b3a8eb9SGleb Smirnoff yyerror("priority out of range: max 255"); 16303b3a8eb9SGleb Smirnoff YYERROR; 16313b3a8eb9SGleb Smirnoff } 16323b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_PRIORITY; 16333b3a8eb9SGleb Smirnoff queue_opts.priority = $2; 16343b3a8eb9SGleb Smirnoff } 16353b3a8eb9SGleb Smirnoff | QLIMIT NUMBER { 16363b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_QLIMIT) { 16373b3a8eb9SGleb Smirnoff yyerror("qlimit cannot be respecified"); 16383b3a8eb9SGleb Smirnoff YYERROR; 16393b3a8eb9SGleb Smirnoff } 16403b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > 65535) { 16413b3a8eb9SGleb Smirnoff yyerror("qlimit out of range: max 65535"); 16423b3a8eb9SGleb Smirnoff YYERROR; 16433b3a8eb9SGleb Smirnoff } 16443b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_QLIMIT; 16453b3a8eb9SGleb Smirnoff queue_opts.qlimit = $2; 16463b3a8eb9SGleb Smirnoff } 16473b3a8eb9SGleb Smirnoff | scheduler { 16483b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_SCHEDULER) { 16493b3a8eb9SGleb Smirnoff yyerror("scheduler cannot be respecified"); 16503b3a8eb9SGleb Smirnoff YYERROR; 16513b3a8eb9SGleb Smirnoff } 16523b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_SCHEDULER; 16533b3a8eb9SGleb Smirnoff queue_opts.scheduler = $1; 16543b3a8eb9SGleb Smirnoff } 16553b3a8eb9SGleb Smirnoff | TBRSIZE NUMBER { 16563b3a8eb9SGleb Smirnoff if (queue_opts.marker & QOM_TBRSIZE) { 16573b3a8eb9SGleb Smirnoff yyerror("tbrsize cannot be respecified"); 16583b3a8eb9SGleb Smirnoff YYERROR; 16593b3a8eb9SGleb Smirnoff } 1660249cc75fSPatrick Kelsey if ($2 < 0 || $2 > UINT_MAX) { 1661249cc75fSPatrick Kelsey yyerror("tbrsize too big: max %u", UINT_MAX); 16623b3a8eb9SGleb Smirnoff YYERROR; 16633b3a8eb9SGleb Smirnoff } 16643b3a8eb9SGleb Smirnoff queue_opts.marker |= QOM_TBRSIZE; 16653b3a8eb9SGleb Smirnoff queue_opts.tbrsize = $2; 16663b3a8eb9SGleb Smirnoff } 16673b3a8eb9SGleb Smirnoff ; 16683b3a8eb9SGleb Smirnoff 16693b3a8eb9SGleb Smirnoff bandwidth : STRING { 16703b3a8eb9SGleb Smirnoff double bps; 16713b3a8eb9SGleb Smirnoff char *cp; 16723b3a8eb9SGleb Smirnoff 16733b3a8eb9SGleb Smirnoff $$.bw_percent = 0; 16743b3a8eb9SGleb Smirnoff 16753b3a8eb9SGleb Smirnoff bps = strtod($1, &cp); 16763b3a8eb9SGleb Smirnoff if (cp != NULL) { 1677db1bbde6SLuiz Otavio O Souza if (strlen(cp) > 1) { 1678db1bbde6SLuiz Otavio O Souza char *cu = cp + 1; 1679db1bbde6SLuiz Otavio O Souza if (!strcmp(cu, "Bit") || 1680db1bbde6SLuiz Otavio O Souza !strcmp(cu, "B") || 1681db1bbde6SLuiz Otavio O Souza !strcmp(cu, "bit") || 1682db1bbde6SLuiz Otavio O Souza !strcmp(cu, "b")) { 1683db1bbde6SLuiz Otavio O Souza *cu = 0; 1684db1bbde6SLuiz Otavio O Souza } 1685db1bbde6SLuiz Otavio O Souza } 16863b3a8eb9SGleb Smirnoff if (!strcmp(cp, "b")) 16873b3a8eb9SGleb Smirnoff ; /* nothing */ 1688db1bbde6SLuiz Otavio O Souza else if (!strcmp(cp, "K")) 16893b3a8eb9SGleb Smirnoff bps *= 1000; 1690db1bbde6SLuiz Otavio O Souza else if (!strcmp(cp, "M")) 16913b3a8eb9SGleb Smirnoff bps *= 1000 * 1000; 1692db1bbde6SLuiz Otavio O Souza else if (!strcmp(cp, "G")) 16933b3a8eb9SGleb Smirnoff bps *= 1000 * 1000 * 1000; 16943b3a8eb9SGleb Smirnoff else if (!strcmp(cp, "%")) { 16953b3a8eb9SGleb Smirnoff if (bps < 0 || bps > 100) { 16963b3a8eb9SGleb Smirnoff yyerror("bandwidth spec " 16973b3a8eb9SGleb Smirnoff "out of range"); 16983b3a8eb9SGleb Smirnoff free($1); 16993b3a8eb9SGleb Smirnoff YYERROR; 17003b3a8eb9SGleb Smirnoff } 17013b3a8eb9SGleb Smirnoff $$.bw_percent = bps; 17023b3a8eb9SGleb Smirnoff bps = 0; 17033b3a8eb9SGleb Smirnoff } else { 17043b3a8eb9SGleb Smirnoff yyerror("unknown unit %s", cp); 17053b3a8eb9SGleb Smirnoff free($1); 17063b3a8eb9SGleb Smirnoff YYERROR; 17073b3a8eb9SGleb Smirnoff } 17083b3a8eb9SGleb Smirnoff } 17093b3a8eb9SGleb Smirnoff free($1); 1710249cc75fSPatrick Kelsey $$.bw_absolute = (u_int64_t)bps; 17113b3a8eb9SGleb Smirnoff } 17123b3a8eb9SGleb Smirnoff | NUMBER { 1713249cc75fSPatrick Kelsey if ($1 < 0 || $1 >= LLONG_MAX) { 17143b3a8eb9SGleb Smirnoff yyerror("bandwidth number too big"); 17153b3a8eb9SGleb Smirnoff YYERROR; 17163b3a8eb9SGleb Smirnoff } 17173b3a8eb9SGleb Smirnoff $$.bw_percent = 0; 17183b3a8eb9SGleb Smirnoff $$.bw_absolute = $1; 17193b3a8eb9SGleb Smirnoff } 17203b3a8eb9SGleb Smirnoff ; 17213b3a8eb9SGleb Smirnoff 17223b3a8eb9SGleb Smirnoff scheduler : CBQ { 17233b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_CBQ; 17243b3a8eb9SGleb Smirnoff $$.data.cbq_opts.flags = 0; 17253b3a8eb9SGleb Smirnoff } 17263b3a8eb9SGleb Smirnoff | CBQ '(' cbqflags_list ')' { 17273b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_CBQ; 17283b3a8eb9SGleb Smirnoff $$.data.cbq_opts.flags = $3; 17293b3a8eb9SGleb Smirnoff } 17303b3a8eb9SGleb Smirnoff | PRIQ { 17313b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_PRIQ; 17323b3a8eb9SGleb Smirnoff $$.data.priq_opts.flags = 0; 17333b3a8eb9SGleb Smirnoff } 17343b3a8eb9SGleb Smirnoff | PRIQ '(' priqflags_list ')' { 17353b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_PRIQ; 17363b3a8eb9SGleb Smirnoff $$.data.priq_opts.flags = $3; 17373b3a8eb9SGleb Smirnoff } 17383b3a8eb9SGleb Smirnoff | HFSC { 17393b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_HFSC; 17403b3a8eb9SGleb Smirnoff bzero(&$$.data.hfsc_opts, 17413b3a8eb9SGleb Smirnoff sizeof(struct node_hfsc_opts)); 17423b3a8eb9SGleb Smirnoff } 17433b3a8eb9SGleb Smirnoff | HFSC '(' hfsc_opts ')' { 17443b3a8eb9SGleb Smirnoff $$.qtype = ALTQT_HFSC; 17453b3a8eb9SGleb Smirnoff $$.data.hfsc_opts = $3; 17463b3a8eb9SGleb Smirnoff } 1747a5b789f6SErmal Luçi | FAIRQ { 1748a5b789f6SErmal Luçi $$.qtype = ALTQT_FAIRQ; 1749a5b789f6SErmal Luçi bzero(&$$.data.fairq_opts, 1750a5b789f6SErmal Luçi sizeof(struct node_fairq_opts)); 1751a5b789f6SErmal Luçi } 1752a5b789f6SErmal Luçi | FAIRQ '(' fairq_opts ')' { 1753a5b789f6SErmal Luçi $$.qtype = ALTQT_FAIRQ; 1754a5b789f6SErmal Luçi $$.data.fairq_opts = $3; 1755a5b789f6SErmal Luçi } 17560a70aaf8SLuiz Otavio O Souza | CODEL { 17570a70aaf8SLuiz Otavio O Souza $$.qtype = ALTQT_CODEL; 17580a70aaf8SLuiz Otavio O Souza bzero(&$$.data.codel_opts, 17590a70aaf8SLuiz Otavio O Souza sizeof(struct codel_opts)); 17600a70aaf8SLuiz Otavio O Souza } 17610a70aaf8SLuiz Otavio O Souza | CODEL '(' codel_opts ')' { 17620a70aaf8SLuiz Otavio O Souza $$.qtype = ALTQT_CODEL; 17630a70aaf8SLuiz Otavio O Souza $$.data.codel_opts = $3; 17640a70aaf8SLuiz Otavio O Souza } 17653b3a8eb9SGleb Smirnoff ; 17663b3a8eb9SGleb Smirnoff 17673b3a8eb9SGleb Smirnoff cbqflags_list : cbqflags_item { $$ |= $1; } 17683b3a8eb9SGleb Smirnoff | cbqflags_list comma cbqflags_item { $$ |= $3; } 17693b3a8eb9SGleb Smirnoff ; 17703b3a8eb9SGleb Smirnoff 17713b3a8eb9SGleb Smirnoff cbqflags_item : STRING { 17723b3a8eb9SGleb Smirnoff if (!strcmp($1, "default")) 17733b3a8eb9SGleb Smirnoff $$ = CBQCLF_DEFCLASS; 17743b3a8eb9SGleb Smirnoff else if (!strcmp($1, "borrow")) 17753b3a8eb9SGleb Smirnoff $$ = CBQCLF_BORROW; 17763b3a8eb9SGleb Smirnoff else if (!strcmp($1, "red")) 17773b3a8eb9SGleb Smirnoff $$ = CBQCLF_RED; 17783b3a8eb9SGleb Smirnoff else if (!strcmp($1, "ecn")) 17793b3a8eb9SGleb Smirnoff $$ = CBQCLF_RED|CBQCLF_ECN; 17803b3a8eb9SGleb Smirnoff else if (!strcmp($1, "rio")) 17813b3a8eb9SGleb Smirnoff $$ = CBQCLF_RIO; 17820a70aaf8SLuiz Otavio O Souza else if (!strcmp($1, "codel")) 17830a70aaf8SLuiz Otavio O Souza $$ = CBQCLF_CODEL; 17843b3a8eb9SGleb Smirnoff else { 17853b3a8eb9SGleb Smirnoff yyerror("unknown cbq flag \"%s\"", $1); 17863b3a8eb9SGleb Smirnoff free($1); 17873b3a8eb9SGleb Smirnoff YYERROR; 17883b3a8eb9SGleb Smirnoff } 17893b3a8eb9SGleb Smirnoff free($1); 17903b3a8eb9SGleb Smirnoff } 17913b3a8eb9SGleb Smirnoff ; 17923b3a8eb9SGleb Smirnoff 17933b3a8eb9SGleb Smirnoff priqflags_list : priqflags_item { $$ |= $1; } 17943b3a8eb9SGleb Smirnoff | priqflags_list comma priqflags_item { $$ |= $3; } 17953b3a8eb9SGleb Smirnoff ; 17963b3a8eb9SGleb Smirnoff 17973b3a8eb9SGleb Smirnoff priqflags_item : STRING { 17983b3a8eb9SGleb Smirnoff if (!strcmp($1, "default")) 17993b3a8eb9SGleb Smirnoff $$ = PRCF_DEFAULTCLASS; 18003b3a8eb9SGleb Smirnoff else if (!strcmp($1, "red")) 18013b3a8eb9SGleb Smirnoff $$ = PRCF_RED; 18023b3a8eb9SGleb Smirnoff else if (!strcmp($1, "ecn")) 18033b3a8eb9SGleb Smirnoff $$ = PRCF_RED|PRCF_ECN; 18043b3a8eb9SGleb Smirnoff else if (!strcmp($1, "rio")) 18053b3a8eb9SGleb Smirnoff $$ = PRCF_RIO; 18060a70aaf8SLuiz Otavio O Souza else if (!strcmp($1, "codel")) 18070a70aaf8SLuiz Otavio O Souza $$ = PRCF_CODEL; 18083b3a8eb9SGleb Smirnoff else { 18093b3a8eb9SGleb Smirnoff yyerror("unknown priq flag \"%s\"", $1); 18103b3a8eb9SGleb Smirnoff free($1); 18113b3a8eb9SGleb Smirnoff YYERROR; 18123b3a8eb9SGleb Smirnoff } 18133b3a8eb9SGleb Smirnoff free($1); 18143b3a8eb9SGleb Smirnoff } 18153b3a8eb9SGleb Smirnoff ; 18163b3a8eb9SGleb Smirnoff 18173b3a8eb9SGleb Smirnoff hfsc_opts : { 18183b3a8eb9SGleb Smirnoff bzero(&hfsc_opts, 18193b3a8eb9SGleb Smirnoff sizeof(struct node_hfsc_opts)); 18203b3a8eb9SGleb Smirnoff } 18213b3a8eb9SGleb Smirnoff hfscopts_list { 18223b3a8eb9SGleb Smirnoff $$ = hfsc_opts; 18233b3a8eb9SGleb Smirnoff } 18243b3a8eb9SGleb Smirnoff ; 18253b3a8eb9SGleb Smirnoff 18263b3a8eb9SGleb Smirnoff hfscopts_list : hfscopts_item 18273b3a8eb9SGleb Smirnoff | hfscopts_list comma hfscopts_item 18283b3a8eb9SGleb Smirnoff ; 18293b3a8eb9SGleb Smirnoff 18303b3a8eb9SGleb Smirnoff hfscopts_item : LINKSHARE bandwidth { 18313b3a8eb9SGleb Smirnoff if (hfsc_opts.linkshare.used) { 18323b3a8eb9SGleb Smirnoff yyerror("linkshare already specified"); 18333b3a8eb9SGleb Smirnoff YYERROR; 18343b3a8eb9SGleb Smirnoff } 18353b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.m2 = $2; 18363b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.used = 1; 18373b3a8eb9SGleb Smirnoff } 18383b3a8eb9SGleb Smirnoff | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 18393b3a8eb9SGleb Smirnoff { 18403b3a8eb9SGleb Smirnoff if ($5 < 0 || $5 > INT_MAX) { 18413b3a8eb9SGleb Smirnoff yyerror("timing in curve out of range"); 18423b3a8eb9SGleb Smirnoff YYERROR; 18433b3a8eb9SGleb Smirnoff } 18443b3a8eb9SGleb Smirnoff if (hfsc_opts.linkshare.used) { 18453b3a8eb9SGleb Smirnoff yyerror("linkshare already specified"); 18463b3a8eb9SGleb Smirnoff YYERROR; 18473b3a8eb9SGleb Smirnoff } 18483b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.m1 = $3; 18493b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.d = $5; 18503b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.m2 = $7; 18513b3a8eb9SGleb Smirnoff hfsc_opts.linkshare.used = 1; 18523b3a8eb9SGleb Smirnoff } 18533b3a8eb9SGleb Smirnoff | REALTIME bandwidth { 18543b3a8eb9SGleb Smirnoff if (hfsc_opts.realtime.used) { 18553b3a8eb9SGleb Smirnoff yyerror("realtime already specified"); 18563b3a8eb9SGleb Smirnoff YYERROR; 18573b3a8eb9SGleb Smirnoff } 18583b3a8eb9SGleb Smirnoff hfsc_opts.realtime.m2 = $2; 18593b3a8eb9SGleb Smirnoff hfsc_opts.realtime.used = 1; 18603b3a8eb9SGleb Smirnoff } 18613b3a8eb9SGleb Smirnoff | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 18623b3a8eb9SGleb Smirnoff { 18633b3a8eb9SGleb Smirnoff if ($5 < 0 || $5 > INT_MAX) { 18643b3a8eb9SGleb Smirnoff yyerror("timing in curve out of range"); 18653b3a8eb9SGleb Smirnoff YYERROR; 18663b3a8eb9SGleb Smirnoff } 18673b3a8eb9SGleb Smirnoff if (hfsc_opts.realtime.used) { 18683b3a8eb9SGleb Smirnoff yyerror("realtime already specified"); 18693b3a8eb9SGleb Smirnoff YYERROR; 18703b3a8eb9SGleb Smirnoff } 18713b3a8eb9SGleb Smirnoff hfsc_opts.realtime.m1 = $3; 18723b3a8eb9SGleb Smirnoff hfsc_opts.realtime.d = $5; 18733b3a8eb9SGleb Smirnoff hfsc_opts.realtime.m2 = $7; 18743b3a8eb9SGleb Smirnoff hfsc_opts.realtime.used = 1; 18753b3a8eb9SGleb Smirnoff } 18763b3a8eb9SGleb Smirnoff | UPPERLIMIT bandwidth { 18773b3a8eb9SGleb Smirnoff if (hfsc_opts.upperlimit.used) { 18783b3a8eb9SGleb Smirnoff yyerror("upperlimit already specified"); 18793b3a8eb9SGleb Smirnoff YYERROR; 18803b3a8eb9SGleb Smirnoff } 18813b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.m2 = $2; 18823b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.used = 1; 18833b3a8eb9SGleb Smirnoff } 18843b3a8eb9SGleb Smirnoff | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 18853b3a8eb9SGleb Smirnoff { 18863b3a8eb9SGleb Smirnoff if ($5 < 0 || $5 > INT_MAX) { 18873b3a8eb9SGleb Smirnoff yyerror("timing in curve out of range"); 18883b3a8eb9SGleb Smirnoff YYERROR; 18893b3a8eb9SGleb Smirnoff } 18903b3a8eb9SGleb Smirnoff if (hfsc_opts.upperlimit.used) { 18913b3a8eb9SGleb Smirnoff yyerror("upperlimit already specified"); 18923b3a8eb9SGleb Smirnoff YYERROR; 18933b3a8eb9SGleb Smirnoff } 18943b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.m1 = $3; 18953b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.d = $5; 18963b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.m2 = $7; 18973b3a8eb9SGleb Smirnoff hfsc_opts.upperlimit.used = 1; 18983b3a8eb9SGleb Smirnoff } 18993b3a8eb9SGleb Smirnoff | STRING { 19003b3a8eb9SGleb Smirnoff if (!strcmp($1, "default")) 19013b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_DEFAULTCLASS; 19023b3a8eb9SGleb Smirnoff else if (!strcmp($1, "red")) 19033b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_RED; 19043b3a8eb9SGleb Smirnoff else if (!strcmp($1, "ecn")) 19053b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 19063b3a8eb9SGleb Smirnoff else if (!strcmp($1, "rio")) 19073b3a8eb9SGleb Smirnoff hfsc_opts.flags |= HFCF_RIO; 19080a70aaf8SLuiz Otavio O Souza else if (!strcmp($1, "codel")) 19090a70aaf8SLuiz Otavio O Souza hfsc_opts.flags |= HFCF_CODEL; 19103b3a8eb9SGleb Smirnoff else { 19113b3a8eb9SGleb Smirnoff yyerror("unknown hfsc flag \"%s\"", $1); 19123b3a8eb9SGleb Smirnoff free($1); 19133b3a8eb9SGleb Smirnoff YYERROR; 19143b3a8eb9SGleb Smirnoff } 19153b3a8eb9SGleb Smirnoff free($1); 19163b3a8eb9SGleb Smirnoff } 19173b3a8eb9SGleb Smirnoff ; 19183b3a8eb9SGleb Smirnoff 1919a5b789f6SErmal Luçi fairq_opts : { 1920a5b789f6SErmal Luçi bzero(&fairq_opts, 1921a5b789f6SErmal Luçi sizeof(struct node_fairq_opts)); 1922a5b789f6SErmal Luçi } 1923a5b789f6SErmal Luçi fairqopts_list { 1924a5b789f6SErmal Luçi $$ = fairq_opts; 1925a5b789f6SErmal Luçi } 1926a5b789f6SErmal Luçi ; 1927a5b789f6SErmal Luçi 1928a5b789f6SErmal Luçi fairqopts_list : fairqopts_item 1929a5b789f6SErmal Luçi | fairqopts_list comma fairqopts_item 1930a5b789f6SErmal Luçi ; 1931a5b789f6SErmal Luçi 1932a5b789f6SErmal Luçi fairqopts_item : LINKSHARE bandwidth { 1933a5b789f6SErmal Luçi if (fairq_opts.linkshare.used) { 1934a5b789f6SErmal Luçi yyerror("linkshare already specified"); 1935a5b789f6SErmal Luçi YYERROR; 1936a5b789f6SErmal Luçi } 1937a5b789f6SErmal Luçi fairq_opts.linkshare.m2 = $2; 1938a5b789f6SErmal Luçi fairq_opts.linkshare.used = 1; 1939a5b789f6SErmal Luçi } 1940a5b789f6SErmal Luçi | LINKSHARE '(' bandwidth number bandwidth ')' { 1941a5b789f6SErmal Luçi if (fairq_opts.linkshare.used) { 1942a5b789f6SErmal Luçi yyerror("linkshare already specified"); 1943a5b789f6SErmal Luçi YYERROR; 1944a5b789f6SErmal Luçi } 1945a5b789f6SErmal Luçi fairq_opts.linkshare.m1 = $3; 1946a5b789f6SErmal Luçi fairq_opts.linkshare.d = $4; 1947a5b789f6SErmal Luçi fairq_opts.linkshare.m2 = $5; 1948a5b789f6SErmal Luçi fairq_opts.linkshare.used = 1; 1949a5b789f6SErmal Luçi } 1950a5b789f6SErmal Luçi | HOGS bandwidth { 1951a5b789f6SErmal Luçi fairq_opts.hogs_bw = $2; 1952a5b789f6SErmal Luçi } 1953a5b789f6SErmal Luçi | BUCKETS number { 1954a5b789f6SErmal Luçi fairq_opts.nbuckets = $2; 1955a5b789f6SErmal Luçi } 1956a5b789f6SErmal Luçi | STRING { 1957a5b789f6SErmal Luçi if (!strcmp($1, "default")) 1958a5b789f6SErmal Luçi fairq_opts.flags |= FARF_DEFAULTCLASS; 1959a5b789f6SErmal Luçi else if (!strcmp($1, "red")) 1960a5b789f6SErmal Luçi fairq_opts.flags |= FARF_RED; 1961a5b789f6SErmal Luçi else if (!strcmp($1, "ecn")) 1962a5b789f6SErmal Luçi fairq_opts.flags |= FARF_RED|FARF_ECN; 1963a5b789f6SErmal Luçi else if (!strcmp($1, "rio")) 1964a5b789f6SErmal Luçi fairq_opts.flags |= FARF_RIO; 19650a70aaf8SLuiz Otavio O Souza else if (!strcmp($1, "codel")) 19660a70aaf8SLuiz Otavio O Souza fairq_opts.flags |= FARF_CODEL; 1967a5b789f6SErmal Luçi else { 1968a5b789f6SErmal Luçi yyerror("unknown fairq flag \"%s\"", $1); 1969a5b789f6SErmal Luçi free($1); 1970a5b789f6SErmal Luçi YYERROR; 1971a5b789f6SErmal Luçi } 1972a5b789f6SErmal Luçi free($1); 1973a5b789f6SErmal Luçi } 1974a5b789f6SErmal Luçi ; 1975a5b789f6SErmal Luçi 19760a70aaf8SLuiz Otavio O Souza codel_opts : { 19770a70aaf8SLuiz Otavio O Souza bzero(&codel_opts, 19780a70aaf8SLuiz Otavio O Souza sizeof(struct codel_opts)); 19790a70aaf8SLuiz Otavio O Souza } 19800a70aaf8SLuiz Otavio O Souza codelopts_list { 19810a70aaf8SLuiz Otavio O Souza $$ = codel_opts; 19820a70aaf8SLuiz Otavio O Souza } 19830a70aaf8SLuiz Otavio O Souza ; 19840a70aaf8SLuiz Otavio O Souza 19850a70aaf8SLuiz Otavio O Souza codelopts_list : codelopts_item 19860a70aaf8SLuiz Otavio O Souza | codelopts_list comma codelopts_item 19870a70aaf8SLuiz Otavio O Souza ; 19880a70aaf8SLuiz Otavio O Souza 19890a70aaf8SLuiz Otavio O Souza codelopts_item : INTERVAL number { 19900a70aaf8SLuiz Otavio O Souza if (codel_opts.interval) { 19910a70aaf8SLuiz Otavio O Souza yyerror("interval already specified"); 19920a70aaf8SLuiz Otavio O Souza YYERROR; 19930a70aaf8SLuiz Otavio O Souza } 19940a70aaf8SLuiz Otavio O Souza codel_opts.interval = $2; 19950a70aaf8SLuiz Otavio O Souza } 19960a70aaf8SLuiz Otavio O Souza | TARGET number { 19970a70aaf8SLuiz Otavio O Souza if (codel_opts.target) { 19980a70aaf8SLuiz Otavio O Souza yyerror("target already specified"); 19990a70aaf8SLuiz Otavio O Souza YYERROR; 20000a70aaf8SLuiz Otavio O Souza } 20010a70aaf8SLuiz Otavio O Souza codel_opts.target = $2; 20020a70aaf8SLuiz Otavio O Souza } 20030a70aaf8SLuiz Otavio O Souza | STRING { 20040a70aaf8SLuiz Otavio O Souza if (!strcmp($1, "ecn")) 20050a70aaf8SLuiz Otavio O Souza codel_opts.ecn = 1; 20060a70aaf8SLuiz Otavio O Souza else { 20070a70aaf8SLuiz Otavio O Souza yyerror("unknown codel option \"%s\"", $1); 20080a70aaf8SLuiz Otavio O Souza free($1); 20090a70aaf8SLuiz Otavio O Souza YYERROR; 20100a70aaf8SLuiz Otavio O Souza } 20110a70aaf8SLuiz Otavio O Souza free($1); 20120a70aaf8SLuiz Otavio O Souza } 20130a70aaf8SLuiz Otavio O Souza ; 20140a70aaf8SLuiz Otavio O Souza 20153b3a8eb9SGleb Smirnoff qassign : /* empty */ { $$ = NULL; } 20163b3a8eb9SGleb Smirnoff | qassign_item { $$ = $1; } 20173b3a8eb9SGleb Smirnoff | '{' optnl qassign_list '}' { $$ = $3; } 20183b3a8eb9SGleb Smirnoff ; 20193b3a8eb9SGleb Smirnoff 20203b3a8eb9SGleb Smirnoff qassign_list : qassign_item optnl { $$ = $1; } 20213b3a8eb9SGleb Smirnoff | qassign_list comma qassign_item optnl { 20223b3a8eb9SGleb Smirnoff $1->tail->next = $3; 20233b3a8eb9SGleb Smirnoff $1->tail = $3; 20243b3a8eb9SGleb Smirnoff $$ = $1; 20253b3a8eb9SGleb Smirnoff } 20263b3a8eb9SGleb Smirnoff ; 20273b3a8eb9SGleb Smirnoff 20283b3a8eb9SGleb Smirnoff qassign_item : STRING { 20293b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_queue)); 20303b3a8eb9SGleb Smirnoff if ($$ == NULL) 20313b3a8eb9SGleb Smirnoff err(1, "qassign_item: calloc"); 20323b3a8eb9SGleb Smirnoff if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 20333b3a8eb9SGleb Smirnoff sizeof($$->queue)) { 20343b3a8eb9SGleb Smirnoff yyerror("queue name '%s' too long (max " 20353b3a8eb9SGleb Smirnoff "%d chars)", $1, sizeof($$->queue)-1); 20363b3a8eb9SGleb Smirnoff free($1); 20373b3a8eb9SGleb Smirnoff free($$); 20383b3a8eb9SGleb Smirnoff YYERROR; 20393b3a8eb9SGleb Smirnoff } 20403b3a8eb9SGleb Smirnoff free($1); 20413b3a8eb9SGleb Smirnoff $$->next = NULL; 20423b3a8eb9SGleb Smirnoff $$->tail = $$; 20433b3a8eb9SGleb Smirnoff } 20443b3a8eb9SGleb Smirnoff ; 20453b3a8eb9SGleb Smirnoff 20463b3a8eb9SGleb Smirnoff pfrule : action dir logquick interface route af proto fromto 20473b3a8eb9SGleb Smirnoff filter_opts 20483b3a8eb9SGleb Smirnoff { 2049e9eb0941SKristof Provost struct pfctl_rule r; 20503b3a8eb9SGleb Smirnoff struct node_state_opt *o; 20513b3a8eb9SGleb Smirnoff struct node_proto *proto; 20523b3a8eb9SGleb Smirnoff int srctrack = 0; 20533b3a8eb9SGleb Smirnoff int statelock = 0; 20543b3a8eb9SGleb Smirnoff int adaptive = 0; 20553b3a8eb9SGleb Smirnoff int defaults = 0; 20563b3a8eb9SGleb Smirnoff 20573b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_FILTER)) 20583b3a8eb9SGleb Smirnoff YYERROR; 20593b3a8eb9SGleb Smirnoff 20603b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 20613b3a8eb9SGleb Smirnoff 20623b3a8eb9SGleb Smirnoff r.action = $1.b1; 20633b3a8eb9SGleb Smirnoff switch ($1.b2) { 20643b3a8eb9SGleb Smirnoff case PFRULE_RETURNRST: 20653b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RETURNRST; 20663b3a8eb9SGleb Smirnoff r.return_ttl = $1.w; 20673b3a8eb9SGleb Smirnoff break; 20683b3a8eb9SGleb Smirnoff case PFRULE_RETURNICMP: 20693b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RETURNICMP; 20703b3a8eb9SGleb Smirnoff r.return_icmp = $1.w; 20713b3a8eb9SGleb Smirnoff r.return_icmp6 = $1.w2; 20723b3a8eb9SGleb Smirnoff break; 20733b3a8eb9SGleb Smirnoff case PFRULE_RETURN: 20743b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RETURN; 20753b3a8eb9SGleb Smirnoff r.return_icmp = $1.w; 20763b3a8eb9SGleb Smirnoff r.return_icmp6 = $1.w2; 20773b3a8eb9SGleb Smirnoff break; 20783b3a8eb9SGleb Smirnoff } 20793b3a8eb9SGleb Smirnoff r.direction = $2; 20803b3a8eb9SGleb Smirnoff r.log = $3.log; 20813b3a8eb9SGleb Smirnoff r.logif = $3.logif; 20823b3a8eb9SGleb Smirnoff r.quick = $3.quick; 20833b3a8eb9SGleb Smirnoff r.prob = $9.prob; 20843b3a8eb9SGleb Smirnoff r.rtableid = $9.rtableid; 20853b3a8eb9SGleb Smirnoff 20863e248e0fSKristof Provost if ($9.marker & FOM_PRIO) { 20873e248e0fSKristof Provost if ($9.prio == 0) 20883e248e0fSKristof Provost r.prio = PF_PRIO_ZERO; 20893e248e0fSKristof Provost else 20903e248e0fSKristof Provost r.prio = $9.prio; 20913e248e0fSKristof Provost } 20923e248e0fSKristof Provost if ($9.marker & FOM_SETPRIO) { 20933e248e0fSKristof Provost r.set_prio[0] = $9.set_prio[0]; 20943e248e0fSKristof Provost r.set_prio[1] = $9.set_prio[1]; 20953e248e0fSKristof Provost r.scrub_flags |= PFSTATE_SETPRIO; 20963e248e0fSKristof Provost } 20973e248e0fSKristof Provost 20983b3a8eb9SGleb Smirnoff r.af = $6; 20993b3a8eb9SGleb Smirnoff if ($9.tag) 21003b3a8eb9SGleb Smirnoff if (strlcpy(r.tagname, $9.tag, 21013b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 21023b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 21033b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 21043b3a8eb9SGleb Smirnoff YYERROR; 21053b3a8eb9SGleb Smirnoff } 21063b3a8eb9SGleb Smirnoff if ($9.match_tag) 21073b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $9.match_tag, 21083b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 21093b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 21103b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 21113b3a8eb9SGleb Smirnoff YYERROR; 21123b3a8eb9SGleb Smirnoff } 21133b3a8eb9SGleb Smirnoff r.match_tag_not = $9.match_tag_not; 21143b3a8eb9SGleb Smirnoff if (rule_label(&r, $9.label)) 21153b3a8eb9SGleb Smirnoff YYERROR; 21166fcc8e04SKristof Provost for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 21176fcc8e04SKristof Provost free($9.label[i]); 21183b3a8eb9SGleb Smirnoff r.flags = $9.flags.b1; 21193b3a8eb9SGleb Smirnoff r.flagset = $9.flags.b2; 21203b3a8eb9SGleb Smirnoff if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 21213b3a8eb9SGleb Smirnoff yyerror("flags always false"); 21223b3a8eb9SGleb Smirnoff YYERROR; 21233b3a8eb9SGleb Smirnoff } 21243b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 21253b3a8eb9SGleb Smirnoff for (proto = $7; proto != NULL && 21263b3a8eb9SGleb Smirnoff proto->proto != IPPROTO_TCP; 21273b3a8eb9SGleb Smirnoff proto = proto->next) 21283b3a8eb9SGleb Smirnoff ; /* nothing */ 21293b3a8eb9SGleb Smirnoff if (proto == NULL && $7 != NULL) { 21303b3a8eb9SGleb Smirnoff if ($9.flags.b1 || $9.flags.b2) 21313b3a8eb9SGleb Smirnoff yyerror( 21323b3a8eb9SGleb Smirnoff "flags only apply to tcp"); 21333b3a8eb9SGleb Smirnoff if ($8.src_os) 21343b3a8eb9SGleb Smirnoff yyerror( 21353b3a8eb9SGleb Smirnoff "OS fingerprinting only " 21363b3a8eb9SGleb Smirnoff "apply to tcp"); 21373b3a8eb9SGleb Smirnoff YYERROR; 21383b3a8eb9SGleb Smirnoff } 21393b3a8eb9SGleb Smirnoff #if 0 21403b3a8eb9SGleb Smirnoff if (($9.flags.b1 & parse_flags("S")) == 0 && 21413b3a8eb9SGleb Smirnoff $8.src_os) { 21423b3a8eb9SGleb Smirnoff yyerror("OS fingerprinting requires " 21433b3a8eb9SGleb Smirnoff "the SYN TCP flag (flags S/SA)"); 21443b3a8eb9SGleb Smirnoff YYERROR; 21453b3a8eb9SGleb Smirnoff } 21463b3a8eb9SGleb Smirnoff #endif 21473b3a8eb9SGleb Smirnoff } 21483b3a8eb9SGleb Smirnoff 21493b3a8eb9SGleb Smirnoff r.tos = $9.tos; 21503b3a8eb9SGleb Smirnoff r.keep_state = $9.keep.action; 21513b3a8eb9SGleb Smirnoff o = $9.keep.options; 21523b3a8eb9SGleb Smirnoff 21533b3a8eb9SGleb Smirnoff /* 'keep state' by default on pass rules. */ 21543b3a8eb9SGleb Smirnoff if (!r.keep_state && !r.action && 21553b3a8eb9SGleb Smirnoff !($9.marker & FOM_KEEP)) { 21563b3a8eb9SGleb Smirnoff r.keep_state = PF_STATE_NORMAL; 21573b3a8eb9SGleb Smirnoff o = keep_state_defaults; 21583b3a8eb9SGleb Smirnoff defaults = 1; 21593b3a8eb9SGleb Smirnoff } 21603b3a8eb9SGleb Smirnoff 21613b3a8eb9SGleb Smirnoff while (o) { 21623b3a8eb9SGleb Smirnoff struct node_state_opt *p = o; 21633b3a8eb9SGleb Smirnoff 21643b3a8eb9SGleb Smirnoff switch (o->type) { 21653b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX: 21663b3a8eb9SGleb Smirnoff if (r.max_states) { 21673b3a8eb9SGleb Smirnoff yyerror("state option 'max' " 21683b3a8eb9SGleb Smirnoff "multiple definitions"); 21693b3a8eb9SGleb Smirnoff YYERROR; 21703b3a8eb9SGleb Smirnoff } 21713b3a8eb9SGleb Smirnoff r.max_states = o->data.max_states; 21723b3a8eb9SGleb Smirnoff break; 21733b3a8eb9SGleb Smirnoff case PF_STATE_OPT_NOSYNC: 21743b3a8eb9SGleb Smirnoff if (r.rule_flag & PFRULE_NOSYNC) { 21753b3a8eb9SGleb Smirnoff yyerror("state option 'sync' " 21763b3a8eb9SGleb Smirnoff "multiple definitions"); 21773b3a8eb9SGleb Smirnoff YYERROR; 21783b3a8eb9SGleb Smirnoff } 21793b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_NOSYNC; 21803b3a8eb9SGleb Smirnoff break; 21813b3a8eb9SGleb Smirnoff case PF_STATE_OPT_SRCTRACK: 21823b3a8eb9SGleb Smirnoff if (srctrack) { 21833b3a8eb9SGleb Smirnoff yyerror("state option " 21843b3a8eb9SGleb Smirnoff "'source-track' " 21853b3a8eb9SGleb Smirnoff "multiple definitions"); 21863b3a8eb9SGleb Smirnoff YYERROR; 21873b3a8eb9SGleb Smirnoff } 21883b3a8eb9SGleb Smirnoff srctrack = o->data.src_track; 21893b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK; 21903b3a8eb9SGleb Smirnoff break; 21913b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_STATES: 21923b3a8eb9SGleb Smirnoff if (r.max_src_states) { 21933b3a8eb9SGleb Smirnoff yyerror("state option " 21943b3a8eb9SGleb Smirnoff "'max-src-states' " 21953b3a8eb9SGleb Smirnoff "multiple definitions"); 21963b3a8eb9SGleb Smirnoff YYERROR; 21973b3a8eb9SGleb Smirnoff } 21983b3a8eb9SGleb Smirnoff if (o->data.max_src_states == 0) { 21993b3a8eb9SGleb Smirnoff yyerror("'max-src-states' must " 22003b3a8eb9SGleb Smirnoff "be > 0"); 22013b3a8eb9SGleb Smirnoff YYERROR; 22023b3a8eb9SGleb Smirnoff } 22033b3a8eb9SGleb Smirnoff r.max_src_states = 22043b3a8eb9SGleb Smirnoff o->data.max_src_states; 22053b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK; 22063b3a8eb9SGleb Smirnoff break; 22073b3a8eb9SGleb Smirnoff case PF_STATE_OPT_OVERLOAD: 22083b3a8eb9SGleb Smirnoff if (r.overload_tblname[0]) { 22093b3a8eb9SGleb Smirnoff yyerror("multiple 'overload' " 22103b3a8eb9SGleb Smirnoff "table definitions"); 22113b3a8eb9SGleb Smirnoff YYERROR; 22123b3a8eb9SGleb Smirnoff } 22133b3a8eb9SGleb Smirnoff if (strlcpy(r.overload_tblname, 22143b3a8eb9SGleb Smirnoff o->data.overload.tblname, 22153b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE) >= 22163b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE) { 22173b3a8eb9SGleb Smirnoff yyerror("state option: " 22183b3a8eb9SGleb Smirnoff "strlcpy"); 22193b3a8eb9SGleb Smirnoff YYERROR; 22203b3a8eb9SGleb Smirnoff } 22213b3a8eb9SGleb Smirnoff r.flush = o->data.overload.flush; 22223b3a8eb9SGleb Smirnoff break; 22233b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_CONN: 22243b3a8eb9SGleb Smirnoff if (r.max_src_conn) { 22253b3a8eb9SGleb Smirnoff yyerror("state option " 22263b3a8eb9SGleb Smirnoff "'max-src-conn' " 22273b3a8eb9SGleb Smirnoff "multiple definitions"); 22283b3a8eb9SGleb Smirnoff YYERROR; 22293b3a8eb9SGleb Smirnoff } 22303b3a8eb9SGleb Smirnoff if (o->data.max_src_conn == 0) { 22313b3a8eb9SGleb Smirnoff yyerror("'max-src-conn' " 22323b3a8eb9SGleb Smirnoff "must be > 0"); 22333b3a8eb9SGleb Smirnoff YYERROR; 22343b3a8eb9SGleb Smirnoff } 22353b3a8eb9SGleb Smirnoff r.max_src_conn = 22363b3a8eb9SGleb Smirnoff o->data.max_src_conn; 22373b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK | 22383b3a8eb9SGleb Smirnoff PFRULE_RULESRCTRACK; 22393b3a8eb9SGleb Smirnoff break; 22403b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_CONN_RATE: 22413b3a8eb9SGleb Smirnoff if (r.max_src_conn_rate.limit) { 22423b3a8eb9SGleb Smirnoff yyerror("state option " 22433b3a8eb9SGleb Smirnoff "'max-src-conn-rate' " 22443b3a8eb9SGleb Smirnoff "multiple definitions"); 22453b3a8eb9SGleb Smirnoff YYERROR; 22463b3a8eb9SGleb Smirnoff } 22473b3a8eb9SGleb Smirnoff if (!o->data.max_src_conn_rate.limit || 22483b3a8eb9SGleb Smirnoff !o->data.max_src_conn_rate.seconds) { 22493b3a8eb9SGleb Smirnoff yyerror("'max-src-conn-rate' " 22503b3a8eb9SGleb Smirnoff "values must be > 0"); 22513b3a8eb9SGleb Smirnoff YYERROR; 22523b3a8eb9SGleb Smirnoff } 22533b3a8eb9SGleb Smirnoff if (o->data.max_src_conn_rate.limit > 22543b3a8eb9SGleb Smirnoff PF_THRESHOLD_MAX) { 22553b3a8eb9SGleb Smirnoff yyerror("'max-src-conn-rate' " 22563b3a8eb9SGleb Smirnoff "maximum rate must be < %u", 22573b3a8eb9SGleb Smirnoff PF_THRESHOLD_MAX); 22583b3a8eb9SGleb Smirnoff YYERROR; 22593b3a8eb9SGleb Smirnoff } 22603b3a8eb9SGleb Smirnoff r.max_src_conn_rate.limit = 22613b3a8eb9SGleb Smirnoff o->data.max_src_conn_rate.limit; 22623b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds = 22633b3a8eb9SGleb Smirnoff o->data.max_src_conn_rate.seconds; 22643b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK | 22653b3a8eb9SGleb Smirnoff PFRULE_RULESRCTRACK; 22663b3a8eb9SGleb Smirnoff break; 22673b3a8eb9SGleb Smirnoff case PF_STATE_OPT_MAX_SRC_NODES: 22683b3a8eb9SGleb Smirnoff if (r.max_src_nodes) { 22693b3a8eb9SGleb Smirnoff yyerror("state option " 22703b3a8eb9SGleb Smirnoff "'max-src-nodes' " 22713b3a8eb9SGleb Smirnoff "multiple definitions"); 22723b3a8eb9SGleb Smirnoff YYERROR; 22733b3a8eb9SGleb Smirnoff } 22743b3a8eb9SGleb Smirnoff if (o->data.max_src_nodes == 0) { 22753b3a8eb9SGleb Smirnoff yyerror("'max-src-nodes' must " 22763b3a8eb9SGleb Smirnoff "be > 0"); 22773b3a8eb9SGleb Smirnoff YYERROR; 22783b3a8eb9SGleb Smirnoff } 22793b3a8eb9SGleb Smirnoff r.max_src_nodes = 22803b3a8eb9SGleb Smirnoff o->data.max_src_nodes; 22813b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK | 22823b3a8eb9SGleb Smirnoff PFRULE_RULESRCTRACK; 22833b3a8eb9SGleb Smirnoff break; 22843b3a8eb9SGleb Smirnoff case PF_STATE_OPT_STATELOCK: 22853b3a8eb9SGleb Smirnoff if (statelock) { 22863b3a8eb9SGleb Smirnoff yyerror("state locking option: " 22873b3a8eb9SGleb Smirnoff "multiple definitions"); 22883b3a8eb9SGleb Smirnoff YYERROR; 22893b3a8eb9SGleb Smirnoff } 22903b3a8eb9SGleb Smirnoff statelock = 1; 22913b3a8eb9SGleb Smirnoff r.rule_flag |= o->data.statelock; 22923b3a8eb9SGleb Smirnoff break; 22933b3a8eb9SGleb Smirnoff case PF_STATE_OPT_SLOPPY: 22943b3a8eb9SGleb Smirnoff if (r.rule_flag & PFRULE_STATESLOPPY) { 22953b3a8eb9SGleb Smirnoff yyerror("state sloppy option: " 22963b3a8eb9SGleb Smirnoff "multiple definitions"); 22973b3a8eb9SGleb Smirnoff YYERROR; 22983b3a8eb9SGleb Smirnoff } 22993b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_STATESLOPPY; 23003b3a8eb9SGleb Smirnoff break; 23013b3a8eb9SGleb Smirnoff case PF_STATE_OPT_TIMEOUT: 23023b3a8eb9SGleb Smirnoff if (o->data.timeout.number == 23033b3a8eb9SGleb Smirnoff PFTM_ADAPTIVE_START || 23043b3a8eb9SGleb Smirnoff o->data.timeout.number == 23053b3a8eb9SGleb Smirnoff PFTM_ADAPTIVE_END) 23063b3a8eb9SGleb Smirnoff adaptive = 1; 23073b3a8eb9SGleb Smirnoff if (r.timeout[o->data.timeout.number]) { 23083b3a8eb9SGleb Smirnoff yyerror("state timeout %s " 23093b3a8eb9SGleb Smirnoff "multiple definitions", 23103b3a8eb9SGleb Smirnoff pf_timeouts[o->data. 23113b3a8eb9SGleb Smirnoff timeout.number].name); 23123b3a8eb9SGleb Smirnoff YYERROR; 23133b3a8eb9SGleb Smirnoff } 23143b3a8eb9SGleb Smirnoff r.timeout[o->data.timeout.number] = 23153b3a8eb9SGleb Smirnoff o->data.timeout.seconds; 23163b3a8eb9SGleb Smirnoff } 23173b3a8eb9SGleb Smirnoff o = o->next; 23183b3a8eb9SGleb Smirnoff if (!defaults) 23193b3a8eb9SGleb Smirnoff free(p); 23203b3a8eb9SGleb Smirnoff } 23213b3a8eb9SGleb Smirnoff 23223b3a8eb9SGleb Smirnoff /* 'flags S/SA' by default on stateful rules */ 23233b3a8eb9SGleb Smirnoff if (!r.action && !r.flags && !r.flagset && 23243b3a8eb9SGleb Smirnoff !$9.fragment && !($9.marker & FOM_FLAGS) && 23253b3a8eb9SGleb Smirnoff r.keep_state) { 23263b3a8eb9SGleb Smirnoff r.flags = parse_flags("S"); 23273b3a8eb9SGleb Smirnoff r.flagset = parse_flags("SA"); 23283b3a8eb9SGleb Smirnoff } 23293b3a8eb9SGleb Smirnoff if (!adaptive && r.max_states) { 23303b3a8eb9SGleb Smirnoff r.timeout[PFTM_ADAPTIVE_START] = 23313b3a8eb9SGleb Smirnoff (r.max_states / 10) * 6; 23323b3a8eb9SGleb Smirnoff r.timeout[PFTM_ADAPTIVE_END] = 23333b3a8eb9SGleb Smirnoff (r.max_states / 10) * 12; 23343b3a8eb9SGleb Smirnoff } 23353b3a8eb9SGleb Smirnoff if (r.rule_flag & PFRULE_SRCTRACK) { 23363b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_GLOBAL && 23373b3a8eb9SGleb Smirnoff r.max_src_nodes) { 23383b3a8eb9SGleb Smirnoff yyerror("'max-src-nodes' is " 23393b3a8eb9SGleb Smirnoff "incompatible with " 23403b3a8eb9SGleb Smirnoff "'source-track global'"); 23413b3a8eb9SGleb Smirnoff YYERROR; 23423b3a8eb9SGleb Smirnoff } 23433b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_GLOBAL && 23443b3a8eb9SGleb Smirnoff r.max_src_conn) { 23453b3a8eb9SGleb Smirnoff yyerror("'max-src-conn' is " 23463b3a8eb9SGleb Smirnoff "incompatible with " 23473b3a8eb9SGleb Smirnoff "'source-track global'"); 23483b3a8eb9SGleb Smirnoff YYERROR; 23493b3a8eb9SGleb Smirnoff } 23503b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_GLOBAL && 23513b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds) { 23523b3a8eb9SGleb Smirnoff yyerror("'max-src-conn-rate' is " 23533b3a8eb9SGleb Smirnoff "incompatible with " 23543b3a8eb9SGleb Smirnoff "'source-track global'"); 23553b3a8eb9SGleb Smirnoff YYERROR; 23563b3a8eb9SGleb Smirnoff } 23573b3a8eb9SGleb Smirnoff if (r.timeout[PFTM_SRC_NODE] < 23583b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds) 23593b3a8eb9SGleb Smirnoff r.timeout[PFTM_SRC_NODE] = 23603b3a8eb9SGleb Smirnoff r.max_src_conn_rate.seconds; 23613b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_SRCTRACK; 23623b3a8eb9SGleb Smirnoff if (srctrack == PF_SRCTRACK_RULE) 23633b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_RULESRCTRACK; 23643b3a8eb9SGleb Smirnoff } 23653b3a8eb9SGleb Smirnoff if (r.keep_state && !statelock) 23663b3a8eb9SGleb Smirnoff r.rule_flag |= default_statelock; 23673b3a8eb9SGleb Smirnoff 23683b3a8eb9SGleb Smirnoff if ($9.fragment) 23693b3a8eb9SGleb Smirnoff r.rule_flag |= PFRULE_FRAGMENT; 23703b3a8eb9SGleb Smirnoff r.allow_opts = $9.allowopts; 23713b3a8eb9SGleb Smirnoff 23723b3a8eb9SGleb Smirnoff decide_address_family($8.src.host, &r.af); 23733b3a8eb9SGleb Smirnoff decide_address_family($8.dst.host, &r.af); 23743b3a8eb9SGleb Smirnoff 23753b3a8eb9SGleb Smirnoff if ($5.rt) { 23763b3a8eb9SGleb Smirnoff if (!r.direction) { 23773b3a8eb9SGleb Smirnoff yyerror("direction must be explicit " 23783b3a8eb9SGleb Smirnoff "with rules that specify routing"); 23793b3a8eb9SGleb Smirnoff YYERROR; 23803b3a8eb9SGleb Smirnoff } 23813b3a8eb9SGleb Smirnoff r.rt = $5.rt; 23823b3a8eb9SGleb Smirnoff r.rpool.opts = $5.pool_opts; 23833b3a8eb9SGleb Smirnoff if ($5.key != NULL) 23843b3a8eb9SGleb Smirnoff memcpy(&r.rpool.key, $5.key, 23853b3a8eb9SGleb Smirnoff sizeof(struct pf_poolhashkey)); 23863b3a8eb9SGleb Smirnoff } 2387813196a1SKristof Provost if (r.rt) { 23883b3a8eb9SGleb Smirnoff decide_address_family($5.host, &r.af); 23893b3a8eb9SGleb Smirnoff remove_invalid_hosts(&$5.host, &r.af); 23903b3a8eb9SGleb Smirnoff if ($5.host == NULL) { 23913b3a8eb9SGleb Smirnoff yyerror("no routing address with " 23923b3a8eb9SGleb Smirnoff "matching address family found."); 23933b3a8eb9SGleb Smirnoff YYERROR; 23943b3a8eb9SGleb Smirnoff } 23953b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) == 23963b3a8eb9SGleb Smirnoff PF_POOL_NONE && ($5.host->next != NULL || 23973b3a8eb9SGleb Smirnoff $5.host->addr.type == PF_ADDR_TABLE || 23983b3a8eb9SGleb Smirnoff DYNIF_MULTIADDR($5.host->addr))) 23993b3a8eb9SGleb Smirnoff r.rpool.opts |= PF_POOL_ROUNDROBIN; 24003b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 24013b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 24023b3a8eb9SGleb Smirnoff disallow_table($5.host, "tables are only " 24033b3a8eb9SGleb Smirnoff "supported in round-robin routing pools")) 24043b3a8eb9SGleb Smirnoff YYERROR; 24053b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 24063b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 24073b3a8eb9SGleb Smirnoff disallow_alias($5.host, "interface (%s) " 24083b3a8eb9SGleb Smirnoff "is only supported in round-robin " 24093b3a8eb9SGleb Smirnoff "routing pools")) 24103b3a8eb9SGleb Smirnoff YYERROR; 24113b3a8eb9SGleb Smirnoff if ($5.host->next != NULL) { 24123b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 24133b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN) { 24143b3a8eb9SGleb Smirnoff yyerror("r.rpool.opts must " 24153b3a8eb9SGleb Smirnoff "be PF_POOL_ROUNDROBIN"); 24163b3a8eb9SGleb Smirnoff YYERROR; 24173b3a8eb9SGleb Smirnoff } 24183b3a8eb9SGleb Smirnoff } 24193b3a8eb9SGleb Smirnoff } 24203b3a8eb9SGleb Smirnoff if ($9.queues.qname != NULL) { 24213b3a8eb9SGleb Smirnoff if (strlcpy(r.qname, $9.queues.qname, 24223b3a8eb9SGleb Smirnoff sizeof(r.qname)) >= sizeof(r.qname)) { 24233b3a8eb9SGleb Smirnoff yyerror("rule qname too long (max " 24243b3a8eb9SGleb Smirnoff "%d chars)", sizeof(r.qname)-1); 24253b3a8eb9SGleb Smirnoff YYERROR; 24263b3a8eb9SGleb Smirnoff } 24273b3a8eb9SGleb Smirnoff free($9.queues.qname); 24283b3a8eb9SGleb Smirnoff } 24293b3a8eb9SGleb Smirnoff if ($9.queues.pqname != NULL) { 24303b3a8eb9SGleb Smirnoff if (strlcpy(r.pqname, $9.queues.pqname, 24313b3a8eb9SGleb Smirnoff sizeof(r.pqname)) >= sizeof(r.pqname)) { 24323b3a8eb9SGleb Smirnoff yyerror("rule pqname too long (max " 24333b3a8eb9SGleb Smirnoff "%d chars)", sizeof(r.pqname)-1); 24343b3a8eb9SGleb Smirnoff YYERROR; 24353b3a8eb9SGleb Smirnoff } 24363b3a8eb9SGleb Smirnoff free($9.queues.pqname); 24373b3a8eb9SGleb Smirnoff } 24383b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 24393b3a8eb9SGleb Smirnoff r.divert.port = $9.divert.port; 24403b3a8eb9SGleb Smirnoff #else 24413b3a8eb9SGleb Smirnoff if ((r.divert.port = $9.divert.port)) { 24423b3a8eb9SGleb Smirnoff if (r.direction == PF_OUT) { 24433b3a8eb9SGleb Smirnoff if ($9.divert.addr) { 24443b3a8eb9SGleb Smirnoff yyerror("address specified " 24453b3a8eb9SGleb Smirnoff "for outgoing divert"); 24463b3a8eb9SGleb Smirnoff YYERROR; 24473b3a8eb9SGleb Smirnoff } 24483b3a8eb9SGleb Smirnoff bzero(&r.divert.addr, 24493b3a8eb9SGleb Smirnoff sizeof(r.divert.addr)); 24503b3a8eb9SGleb Smirnoff } else { 24513b3a8eb9SGleb Smirnoff if (!$9.divert.addr) { 24523b3a8eb9SGleb Smirnoff yyerror("no address specified " 24533b3a8eb9SGleb Smirnoff "for incoming divert"); 24543b3a8eb9SGleb Smirnoff YYERROR; 24553b3a8eb9SGleb Smirnoff } 24563b3a8eb9SGleb Smirnoff if ($9.divert.addr->af != r.af) { 24573b3a8eb9SGleb Smirnoff yyerror("address family " 24583b3a8eb9SGleb Smirnoff "mismatch for divert"); 24593b3a8eb9SGleb Smirnoff YYERROR; 24603b3a8eb9SGleb Smirnoff } 24613b3a8eb9SGleb Smirnoff r.divert.addr = 24623b3a8eb9SGleb Smirnoff $9.divert.addr->addr.v.a.addr; 24633b3a8eb9SGleb Smirnoff } 24643b3a8eb9SGleb Smirnoff } 24653b3a8eb9SGleb Smirnoff #endif 24663b3a8eb9SGleb Smirnoff 24673b3a8eb9SGleb Smirnoff expand_rule(&r, $4, $5.host, $7, $8.src_os, 24683b3a8eb9SGleb Smirnoff $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 24693b3a8eb9SGleb Smirnoff $9.uid, $9.gid, $9.icmpspec, ""); 24703b3a8eb9SGleb Smirnoff } 24713b3a8eb9SGleb Smirnoff ; 24723b3a8eb9SGleb Smirnoff 24733b3a8eb9SGleb Smirnoff filter_opts : { 24743b3a8eb9SGleb Smirnoff bzero(&filter_opts, sizeof filter_opts); 24753b3a8eb9SGleb Smirnoff filter_opts.rtableid = -1; 24763b3a8eb9SGleb Smirnoff } 24773b3a8eb9SGleb Smirnoff filter_opts_l 24783b3a8eb9SGleb Smirnoff { $$ = filter_opts; } 24793b3a8eb9SGleb Smirnoff | /* empty */ { 24803b3a8eb9SGleb Smirnoff bzero(&filter_opts, sizeof filter_opts); 24813b3a8eb9SGleb Smirnoff filter_opts.rtableid = -1; 24823b3a8eb9SGleb Smirnoff $$ = filter_opts; 24833b3a8eb9SGleb Smirnoff } 24843b3a8eb9SGleb Smirnoff ; 24853b3a8eb9SGleb Smirnoff 24863b3a8eb9SGleb Smirnoff filter_opts_l : filter_opts_l filter_opt 24873b3a8eb9SGleb Smirnoff | filter_opt 24883b3a8eb9SGleb Smirnoff ; 24893b3a8eb9SGleb Smirnoff 24903b3a8eb9SGleb Smirnoff filter_opt : USER uids { 24913b3a8eb9SGleb Smirnoff if (filter_opts.uid) 24923b3a8eb9SGleb Smirnoff $2->tail->next = filter_opts.uid; 24933b3a8eb9SGleb Smirnoff filter_opts.uid = $2; 24943b3a8eb9SGleb Smirnoff } 24953b3a8eb9SGleb Smirnoff | GROUP gids { 24963b3a8eb9SGleb Smirnoff if (filter_opts.gid) 24973b3a8eb9SGleb Smirnoff $2->tail->next = filter_opts.gid; 24983b3a8eb9SGleb Smirnoff filter_opts.gid = $2; 24993b3a8eb9SGleb Smirnoff } 25003b3a8eb9SGleb Smirnoff | flags { 25013b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_FLAGS) { 25023b3a8eb9SGleb Smirnoff yyerror("flags cannot be redefined"); 25033b3a8eb9SGleb Smirnoff YYERROR; 25043b3a8eb9SGleb Smirnoff } 25053b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_FLAGS; 25063b3a8eb9SGleb Smirnoff filter_opts.flags.b1 |= $1.b1; 25073b3a8eb9SGleb Smirnoff filter_opts.flags.b2 |= $1.b2; 25083b3a8eb9SGleb Smirnoff filter_opts.flags.w |= $1.w; 25093b3a8eb9SGleb Smirnoff filter_opts.flags.w2 |= $1.w2; 25103b3a8eb9SGleb Smirnoff } 25113b3a8eb9SGleb Smirnoff | icmpspec { 25123b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_ICMP) { 25133b3a8eb9SGleb Smirnoff yyerror("icmp-type cannot be redefined"); 25143b3a8eb9SGleb Smirnoff YYERROR; 25153b3a8eb9SGleb Smirnoff } 25163b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_ICMP; 25173b3a8eb9SGleb Smirnoff filter_opts.icmpspec = $1; 25183b3a8eb9SGleb Smirnoff } 25193e248e0fSKristof Provost | PRIO NUMBER { 25203e248e0fSKristof Provost if (filter_opts.marker & FOM_PRIO) { 25213e248e0fSKristof Provost yyerror("prio cannot be redefined"); 25223e248e0fSKristof Provost YYERROR; 25233e248e0fSKristof Provost } 25243e248e0fSKristof Provost if ($2 < 0 || $2 > PF_PRIO_MAX) { 25253e248e0fSKristof Provost yyerror("prio must be 0 - %u", PF_PRIO_MAX); 25263e248e0fSKristof Provost YYERROR; 25273e248e0fSKristof Provost } 25283e248e0fSKristof Provost filter_opts.marker |= FOM_PRIO; 25293e248e0fSKristof Provost filter_opts.prio = $2; 25303e248e0fSKristof Provost } 25313b3a8eb9SGleb Smirnoff | TOS tos { 25323b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_TOS) { 25333b3a8eb9SGleb Smirnoff yyerror("tos cannot be redefined"); 25343b3a8eb9SGleb Smirnoff YYERROR; 25353b3a8eb9SGleb Smirnoff } 25363b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_TOS; 25373b3a8eb9SGleb Smirnoff filter_opts.tos = $2; 25383b3a8eb9SGleb Smirnoff } 25393b3a8eb9SGleb Smirnoff | keep { 25403b3a8eb9SGleb Smirnoff if (filter_opts.marker & FOM_KEEP) { 25413b3a8eb9SGleb Smirnoff yyerror("modulate or keep cannot be redefined"); 25423b3a8eb9SGleb Smirnoff YYERROR; 25433b3a8eb9SGleb Smirnoff } 25443b3a8eb9SGleb Smirnoff filter_opts.marker |= FOM_KEEP; 25453b3a8eb9SGleb Smirnoff filter_opts.keep.action = $1.action; 25463b3a8eb9SGleb Smirnoff filter_opts.keep.options = $1.options; 25473b3a8eb9SGleb Smirnoff } 25483b3a8eb9SGleb Smirnoff | FRAGMENT { 25493b3a8eb9SGleb Smirnoff filter_opts.fragment = 1; 25503b3a8eb9SGleb Smirnoff } 25513b3a8eb9SGleb Smirnoff | ALLOWOPTS { 25523b3a8eb9SGleb Smirnoff filter_opts.allowopts = 1; 25533b3a8eb9SGleb Smirnoff } 25543b3a8eb9SGleb Smirnoff | label { 25556fcc8e04SKristof Provost if (filter_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 25566fcc8e04SKristof Provost yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 25573b3a8eb9SGleb Smirnoff YYERROR; 25583b3a8eb9SGleb Smirnoff } 25596fcc8e04SKristof Provost filter_opts.label[filter_opts.labelcount++] = $1; 25603b3a8eb9SGleb Smirnoff } 25613b3a8eb9SGleb Smirnoff | qname { 25623b3a8eb9SGleb Smirnoff if (filter_opts.queues.qname) { 25633b3a8eb9SGleb Smirnoff yyerror("queue cannot be redefined"); 25643b3a8eb9SGleb Smirnoff YYERROR; 25653b3a8eb9SGleb Smirnoff } 25663b3a8eb9SGleb Smirnoff filter_opts.queues = $1; 25673b3a8eb9SGleb Smirnoff } 25683b3a8eb9SGleb Smirnoff | TAG string { 25693b3a8eb9SGleb Smirnoff filter_opts.tag = $2; 25703b3a8eb9SGleb Smirnoff } 25713b3a8eb9SGleb Smirnoff | not TAGGED string { 25723b3a8eb9SGleb Smirnoff filter_opts.match_tag = $3; 25733b3a8eb9SGleb Smirnoff filter_opts.match_tag_not = $1; 25743b3a8eb9SGleb Smirnoff } 25753b3a8eb9SGleb Smirnoff | PROBABILITY probability { 25763b3a8eb9SGleb Smirnoff double p; 25773b3a8eb9SGleb Smirnoff 25783b3a8eb9SGleb Smirnoff p = floor($2 * UINT_MAX + 0.5); 25793b3a8eb9SGleb Smirnoff if (p < 0.0 || p > UINT_MAX) { 25803b3a8eb9SGleb Smirnoff yyerror("invalid probability: %lf", p); 25813b3a8eb9SGleb Smirnoff YYERROR; 25823b3a8eb9SGleb Smirnoff } 25833b3a8eb9SGleb Smirnoff filter_opts.prob = (u_int32_t)p; 25843b3a8eb9SGleb Smirnoff if (filter_opts.prob == 0) 25853b3a8eb9SGleb Smirnoff filter_opts.prob = 1; 25863b3a8eb9SGleb Smirnoff } 25873b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 25883b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 25893b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 25903b3a8eb9SGleb Smirnoff YYERROR; 25913b3a8eb9SGleb Smirnoff } 25923b3a8eb9SGleb Smirnoff filter_opts.rtableid = $2; 25933b3a8eb9SGleb Smirnoff } 25943b3a8eb9SGleb Smirnoff | DIVERTTO portplain { 25953b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 25963b3a8eb9SGleb Smirnoff filter_opts.divert.port = $2.a; 25973b3a8eb9SGleb Smirnoff if (!filter_opts.divert.port) { 25983b3a8eb9SGleb Smirnoff yyerror("invalid divert port: %u", ntohs($2.a)); 25993b3a8eb9SGleb Smirnoff YYERROR; 26003b3a8eb9SGleb Smirnoff } 26013b3a8eb9SGleb Smirnoff #endif 26023b3a8eb9SGleb Smirnoff } 26033b3a8eb9SGleb Smirnoff | DIVERTTO STRING PORT portplain { 26043b3a8eb9SGleb Smirnoff #ifndef __FreeBSD__ 26053b3a8eb9SGleb Smirnoff if ((filter_opts.divert.addr = host($2)) == NULL) { 26063b3a8eb9SGleb Smirnoff yyerror("could not parse divert address: %s", 26073b3a8eb9SGleb Smirnoff $2); 26083b3a8eb9SGleb Smirnoff free($2); 26093b3a8eb9SGleb Smirnoff YYERROR; 26103b3a8eb9SGleb Smirnoff } 26113b3a8eb9SGleb Smirnoff #else 26123b3a8eb9SGleb Smirnoff if ($2) 26133b3a8eb9SGleb Smirnoff #endif 26143b3a8eb9SGleb Smirnoff free($2); 26153b3a8eb9SGleb Smirnoff filter_opts.divert.port = $4.a; 26163b3a8eb9SGleb Smirnoff if (!filter_opts.divert.port) { 26173b3a8eb9SGleb Smirnoff yyerror("invalid divert port: %u", ntohs($4.a)); 26183b3a8eb9SGleb Smirnoff YYERROR; 26193b3a8eb9SGleb Smirnoff } 26203b3a8eb9SGleb Smirnoff } 26213b3a8eb9SGleb Smirnoff | DIVERTREPLY { 26223b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 26233b3a8eb9SGleb Smirnoff yyerror("divert-reply has no meaning in FreeBSD pf(4)"); 26243b3a8eb9SGleb Smirnoff YYERROR; 26253b3a8eb9SGleb Smirnoff #else 26263b3a8eb9SGleb Smirnoff filter_opts.divert.port = 1; /* some random value */ 26273b3a8eb9SGleb Smirnoff #endif 26283b3a8eb9SGleb Smirnoff } 26293e248e0fSKristof Provost | filter_sets 26303e248e0fSKristof Provost ; 26313e248e0fSKristof Provost 26323e248e0fSKristof Provost filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; } 26333e248e0fSKristof Provost | SET filter_set { $$ = filter_opts; } 26343e248e0fSKristof Provost ; 26353e248e0fSKristof Provost 26363e248e0fSKristof Provost filter_sets_l : filter_sets_l comma filter_set 26373e248e0fSKristof Provost | filter_set 26383e248e0fSKristof Provost ; 26393e248e0fSKristof Provost 26403e248e0fSKristof Provost filter_set : prio { 26413e248e0fSKristof Provost if (filter_opts.marker & FOM_SETPRIO) { 26423e248e0fSKristof Provost yyerror("prio cannot be redefined"); 26433e248e0fSKristof Provost YYERROR; 26443e248e0fSKristof Provost } 26453e248e0fSKristof Provost filter_opts.marker |= FOM_SETPRIO; 26463e248e0fSKristof Provost filter_opts.set_prio[0] = $1.b1; 26473e248e0fSKristof Provost filter_opts.set_prio[1] = $1.b2; 26483e248e0fSKristof Provost } 26493e248e0fSKristof Provost prio : PRIO NUMBER { 26503e248e0fSKristof Provost if ($2 < 0 || $2 > PF_PRIO_MAX) { 26513e248e0fSKristof Provost yyerror("prio must be 0 - %u", PF_PRIO_MAX); 26523e248e0fSKristof Provost YYERROR; 26533e248e0fSKristof Provost } 26543e248e0fSKristof Provost $$.b1 = $$.b2 = $2; 26553e248e0fSKristof Provost } 26563e248e0fSKristof Provost | PRIO '(' NUMBER comma NUMBER ')' { 26573e248e0fSKristof Provost if ($3 < 0 || $3 > PF_PRIO_MAX || 26583e248e0fSKristof Provost $5 < 0 || $5 > PF_PRIO_MAX) { 26593e248e0fSKristof Provost yyerror("prio must be 0 - %u", PF_PRIO_MAX); 26603e248e0fSKristof Provost YYERROR; 26613e248e0fSKristof Provost } 26623e248e0fSKristof Provost $$.b1 = $3; 26633e248e0fSKristof Provost $$.b2 = $5; 26643e248e0fSKristof Provost } 26653b3a8eb9SGleb Smirnoff ; 26663b3a8eb9SGleb Smirnoff 26673b3a8eb9SGleb Smirnoff probability : STRING { 26683b3a8eb9SGleb Smirnoff char *e; 26693b3a8eb9SGleb Smirnoff double p = strtod($1, &e); 26703b3a8eb9SGleb Smirnoff 26713b3a8eb9SGleb Smirnoff if (*e == '%') { 26723b3a8eb9SGleb Smirnoff p *= 0.01; 26733b3a8eb9SGleb Smirnoff e++; 26743b3a8eb9SGleb Smirnoff } 26753b3a8eb9SGleb Smirnoff if (*e) { 26763b3a8eb9SGleb Smirnoff yyerror("invalid probability: %s", $1); 26773b3a8eb9SGleb Smirnoff free($1); 26783b3a8eb9SGleb Smirnoff YYERROR; 26793b3a8eb9SGleb Smirnoff } 26803b3a8eb9SGleb Smirnoff free($1); 26813b3a8eb9SGleb Smirnoff $$ = p; 26823b3a8eb9SGleb Smirnoff } 26833b3a8eb9SGleb Smirnoff | NUMBER { 26843b3a8eb9SGleb Smirnoff $$ = (double)$1; 26853b3a8eb9SGleb Smirnoff } 26863b3a8eb9SGleb Smirnoff ; 26873b3a8eb9SGleb Smirnoff 26883b3a8eb9SGleb Smirnoff 2689150182e3SKristof Provost action : PASS { 2690150182e3SKristof Provost $$.b1 = PF_PASS; 2691150182e3SKristof Provost $$.b2 = failpolicy; 2692150182e3SKristof Provost $$.w = returnicmpdefault; 2693150182e3SKristof Provost $$.w2 = returnicmp6default; 2694150182e3SKristof Provost } 2695ef950daaSKristof Provost | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 26963b3a8eb9SGleb Smirnoff | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 26973b3a8eb9SGleb Smirnoff ; 26983b3a8eb9SGleb Smirnoff 26993b3a8eb9SGleb Smirnoff blockspec : /* empty */ { 27003b3a8eb9SGleb Smirnoff $$.b2 = blockpolicy; 27013b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 27023b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 27033b3a8eb9SGleb Smirnoff } 27043b3a8eb9SGleb Smirnoff | DROP { 27053b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_DROP; 27063b3a8eb9SGleb Smirnoff $$.w = 0; 27073b3a8eb9SGleb Smirnoff $$.w2 = 0; 27083b3a8eb9SGleb Smirnoff } 27093b3a8eb9SGleb Smirnoff | RETURNRST { 27103b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNRST; 27113b3a8eb9SGleb Smirnoff $$.w = 0; 27123b3a8eb9SGleb Smirnoff $$.w2 = 0; 27133b3a8eb9SGleb Smirnoff } 27143b3a8eb9SGleb Smirnoff | RETURNRST '(' TTL NUMBER ')' { 27153b3a8eb9SGleb Smirnoff if ($4 < 0 || $4 > 255) { 27163b3a8eb9SGleb Smirnoff yyerror("illegal ttl value %d", $4); 27173b3a8eb9SGleb Smirnoff YYERROR; 27183b3a8eb9SGleb Smirnoff } 27193b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNRST; 27203b3a8eb9SGleb Smirnoff $$.w = $4; 27213b3a8eb9SGleb Smirnoff $$.w2 = 0; 27223b3a8eb9SGleb Smirnoff } 27233b3a8eb9SGleb Smirnoff | RETURNICMP { 27243b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 27253b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 27263b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 27273b3a8eb9SGleb Smirnoff } 27283b3a8eb9SGleb Smirnoff | RETURNICMP6 { 27293b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 27303b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 27313b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 27323b3a8eb9SGleb Smirnoff } 27333b3a8eb9SGleb Smirnoff | RETURNICMP '(' reticmpspec ')' { 27343b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 27353b3a8eb9SGleb Smirnoff $$.w = $3; 27363b3a8eb9SGleb Smirnoff $$.w2 = returnicmpdefault; 27373b3a8eb9SGleb Smirnoff } 27383b3a8eb9SGleb Smirnoff | RETURNICMP6 '(' reticmp6spec ')' { 27393b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 27403b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 27413b3a8eb9SGleb Smirnoff $$.w2 = $3; 27423b3a8eb9SGleb Smirnoff } 27433b3a8eb9SGleb Smirnoff | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 27443b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURNICMP; 27453b3a8eb9SGleb Smirnoff $$.w = $3; 27463b3a8eb9SGleb Smirnoff $$.w2 = $5; 27473b3a8eb9SGleb Smirnoff } 27483b3a8eb9SGleb Smirnoff | RETURN { 27493b3a8eb9SGleb Smirnoff $$.b2 = PFRULE_RETURN; 27503b3a8eb9SGleb Smirnoff $$.w = returnicmpdefault; 27513b3a8eb9SGleb Smirnoff $$.w2 = returnicmp6default; 27523b3a8eb9SGleb Smirnoff } 27533b3a8eb9SGleb Smirnoff ; 27543b3a8eb9SGleb Smirnoff 27553b3a8eb9SGleb Smirnoff reticmpspec : STRING { 27563b3a8eb9SGleb Smirnoff if (!($$ = parseicmpspec($1, AF_INET))) { 27573b3a8eb9SGleb Smirnoff free($1); 27583b3a8eb9SGleb Smirnoff YYERROR; 27593b3a8eb9SGleb Smirnoff } 27603b3a8eb9SGleb Smirnoff free($1); 27613b3a8eb9SGleb Smirnoff } 27623b3a8eb9SGleb Smirnoff | NUMBER { 27633b3a8eb9SGleb Smirnoff u_int8_t icmptype; 27643b3a8eb9SGleb Smirnoff 27653b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 27663b3a8eb9SGleb Smirnoff yyerror("invalid icmp code %lu", $1); 27673b3a8eb9SGleb Smirnoff YYERROR; 27683b3a8eb9SGleb Smirnoff } 27693b3a8eb9SGleb Smirnoff icmptype = returnicmpdefault >> 8; 27703b3a8eb9SGleb Smirnoff $$ = (icmptype << 8 | $1); 27713b3a8eb9SGleb Smirnoff } 27723b3a8eb9SGleb Smirnoff ; 27733b3a8eb9SGleb Smirnoff 27743b3a8eb9SGleb Smirnoff reticmp6spec : STRING { 27753b3a8eb9SGleb Smirnoff if (!($$ = parseicmpspec($1, AF_INET6))) { 27763b3a8eb9SGleb Smirnoff free($1); 27773b3a8eb9SGleb Smirnoff YYERROR; 27783b3a8eb9SGleb Smirnoff } 27793b3a8eb9SGleb Smirnoff free($1); 27803b3a8eb9SGleb Smirnoff } 27813b3a8eb9SGleb Smirnoff | NUMBER { 27823b3a8eb9SGleb Smirnoff u_int8_t icmptype; 27833b3a8eb9SGleb Smirnoff 27843b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 27853b3a8eb9SGleb Smirnoff yyerror("invalid icmp code %lu", $1); 27863b3a8eb9SGleb Smirnoff YYERROR; 27873b3a8eb9SGleb Smirnoff } 27883b3a8eb9SGleb Smirnoff icmptype = returnicmp6default >> 8; 27893b3a8eb9SGleb Smirnoff $$ = (icmptype << 8 | $1); 27903b3a8eb9SGleb Smirnoff } 27913b3a8eb9SGleb Smirnoff ; 27923b3a8eb9SGleb Smirnoff 27933b3a8eb9SGleb Smirnoff dir : /* empty */ { $$ = PF_INOUT; } 27943b3a8eb9SGleb Smirnoff | IN { $$ = PF_IN; } 27953b3a8eb9SGleb Smirnoff | OUT { $$ = PF_OUT; } 27963b3a8eb9SGleb Smirnoff ; 27973b3a8eb9SGleb Smirnoff 27983b3a8eb9SGleb Smirnoff quick : /* empty */ { $$.quick = 0; } 27993b3a8eb9SGleb Smirnoff | QUICK { $$.quick = 1; } 28003b3a8eb9SGleb Smirnoff ; 28013b3a8eb9SGleb Smirnoff 28023b3a8eb9SGleb Smirnoff logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 28033b3a8eb9SGleb Smirnoff | log { $$ = $1; $$.quick = 0; } 28043b3a8eb9SGleb Smirnoff | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 28053b3a8eb9SGleb Smirnoff | log QUICK { $$ = $1; $$.quick = 1; } 28063b3a8eb9SGleb Smirnoff | QUICK log { $$ = $2; $$.quick = 1; } 28073b3a8eb9SGleb Smirnoff ; 28083b3a8eb9SGleb Smirnoff 28093b3a8eb9SGleb Smirnoff log : LOG { $$.log = PF_LOG; $$.logif = 0; } 28103b3a8eb9SGleb Smirnoff | LOG '(' logopts ')' { 28113b3a8eb9SGleb Smirnoff $$.log = PF_LOG | $3.log; 28123b3a8eb9SGleb Smirnoff $$.logif = $3.logif; 28133b3a8eb9SGleb Smirnoff } 28143b3a8eb9SGleb Smirnoff ; 28153b3a8eb9SGleb Smirnoff 28163b3a8eb9SGleb Smirnoff logopts : logopt { $$ = $1; } 28173b3a8eb9SGleb Smirnoff | logopts comma logopt { 28183b3a8eb9SGleb Smirnoff $$.log = $1.log | $3.log; 28193b3a8eb9SGleb Smirnoff $$.logif = $3.logif; 28203b3a8eb9SGleb Smirnoff if ($$.logif == 0) 28213b3a8eb9SGleb Smirnoff $$.logif = $1.logif; 28223b3a8eb9SGleb Smirnoff } 28233b3a8eb9SGleb Smirnoff ; 28243b3a8eb9SGleb Smirnoff 28253b3a8eb9SGleb Smirnoff logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 28263b3a8eb9SGleb Smirnoff | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 28273b3a8eb9SGleb Smirnoff | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 28283b3a8eb9SGleb Smirnoff | TO string { 28293b3a8eb9SGleb Smirnoff const char *errstr; 28303b3a8eb9SGleb Smirnoff u_int i; 28313b3a8eb9SGleb Smirnoff 28323b3a8eb9SGleb Smirnoff $$.log = 0; 28333b3a8eb9SGleb Smirnoff if (strncmp($2, "pflog", 5)) { 28343b3a8eb9SGleb Smirnoff yyerror("%s: should be a pflog interface", $2); 28353b3a8eb9SGleb Smirnoff free($2); 28363b3a8eb9SGleb Smirnoff YYERROR; 28373b3a8eb9SGleb Smirnoff } 28383b3a8eb9SGleb Smirnoff i = strtonum($2 + 5, 0, 255, &errstr); 28393b3a8eb9SGleb Smirnoff if (errstr) { 28403b3a8eb9SGleb Smirnoff yyerror("%s: %s", $2, errstr); 28413b3a8eb9SGleb Smirnoff free($2); 28423b3a8eb9SGleb Smirnoff YYERROR; 28433b3a8eb9SGleb Smirnoff } 28443b3a8eb9SGleb Smirnoff free($2); 28453b3a8eb9SGleb Smirnoff $$.logif = i; 28463b3a8eb9SGleb Smirnoff } 28473b3a8eb9SGleb Smirnoff ; 28483b3a8eb9SGleb Smirnoff 28493b3a8eb9SGleb Smirnoff interface : /* empty */ { $$ = NULL; } 28503b3a8eb9SGleb Smirnoff | ON if_item_not { $$ = $2; } 28513b3a8eb9SGleb Smirnoff | ON '{' optnl if_list '}' { $$ = $4; } 28523b3a8eb9SGleb Smirnoff ; 28533b3a8eb9SGleb Smirnoff 28543b3a8eb9SGleb Smirnoff if_list : if_item_not optnl { $$ = $1; } 28553b3a8eb9SGleb Smirnoff | if_list comma if_item_not optnl { 28563b3a8eb9SGleb Smirnoff $1->tail->next = $3; 28573b3a8eb9SGleb Smirnoff $1->tail = $3; 28583b3a8eb9SGleb Smirnoff $$ = $1; 28593b3a8eb9SGleb Smirnoff } 28603b3a8eb9SGleb Smirnoff ; 28613b3a8eb9SGleb Smirnoff 28623b3a8eb9SGleb Smirnoff if_item_not : not if_item { $$ = $2; $$->not = $1; } 28633b3a8eb9SGleb Smirnoff ; 28643b3a8eb9SGleb Smirnoff 28653b3a8eb9SGleb Smirnoff if_item : STRING { 28663b3a8eb9SGleb Smirnoff struct node_host *n; 28673b3a8eb9SGleb Smirnoff 28683b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_if)); 28693b3a8eb9SGleb Smirnoff if ($$ == NULL) 28703b3a8eb9SGleb Smirnoff err(1, "if_item: calloc"); 28713b3a8eb9SGleb Smirnoff if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 28723b3a8eb9SGleb Smirnoff sizeof($$->ifname)) { 28733b3a8eb9SGleb Smirnoff free($1); 28743b3a8eb9SGleb Smirnoff free($$); 28753b3a8eb9SGleb Smirnoff yyerror("interface name too long"); 28763b3a8eb9SGleb Smirnoff YYERROR; 28773b3a8eb9SGleb Smirnoff } 28783b3a8eb9SGleb Smirnoff 28793b3a8eb9SGleb Smirnoff if ((n = ifa_exists($1)) != NULL) 28803b3a8eb9SGleb Smirnoff $$->ifa_flags = n->ifa_flags; 28813b3a8eb9SGleb Smirnoff 28823b3a8eb9SGleb Smirnoff free($1); 28833b3a8eb9SGleb Smirnoff $$->not = 0; 28843b3a8eb9SGleb Smirnoff $$->next = NULL; 28853b3a8eb9SGleb Smirnoff $$->tail = $$; 28863b3a8eb9SGleb Smirnoff } 28873b3a8eb9SGleb Smirnoff ; 28883b3a8eb9SGleb Smirnoff 28893b3a8eb9SGleb Smirnoff af : /* empty */ { $$ = 0; } 28903b3a8eb9SGleb Smirnoff | INET { $$ = AF_INET; } 28913b3a8eb9SGleb Smirnoff | INET6 { $$ = AF_INET6; } 28923b3a8eb9SGleb Smirnoff ; 28933b3a8eb9SGleb Smirnoff 28943b3a8eb9SGleb Smirnoff proto : /* empty */ { $$ = NULL; } 28953b3a8eb9SGleb Smirnoff | PROTO proto_item { $$ = $2; } 28963b3a8eb9SGleb Smirnoff | PROTO '{' optnl proto_list '}' { $$ = $4; } 28973b3a8eb9SGleb Smirnoff ; 28983b3a8eb9SGleb Smirnoff 28993b3a8eb9SGleb Smirnoff proto_list : proto_item optnl { $$ = $1; } 29003b3a8eb9SGleb Smirnoff | proto_list comma proto_item optnl { 29013b3a8eb9SGleb Smirnoff $1->tail->next = $3; 29023b3a8eb9SGleb Smirnoff $1->tail = $3; 29033b3a8eb9SGleb Smirnoff $$ = $1; 29043b3a8eb9SGleb Smirnoff } 29053b3a8eb9SGleb Smirnoff ; 29063b3a8eb9SGleb Smirnoff 29073b3a8eb9SGleb Smirnoff proto_item : protoval { 29083b3a8eb9SGleb Smirnoff u_int8_t pr; 29093b3a8eb9SGleb Smirnoff 29103b3a8eb9SGleb Smirnoff pr = (u_int8_t)$1; 29113b3a8eb9SGleb Smirnoff if (pr == 0) { 29123b3a8eb9SGleb Smirnoff yyerror("proto 0 cannot be used"); 29133b3a8eb9SGleb Smirnoff YYERROR; 29143b3a8eb9SGleb Smirnoff } 29153b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_proto)); 29163b3a8eb9SGleb Smirnoff if ($$ == NULL) 29173b3a8eb9SGleb Smirnoff err(1, "proto_item: calloc"); 29183b3a8eb9SGleb Smirnoff $$->proto = pr; 29193b3a8eb9SGleb Smirnoff $$->next = NULL; 29203b3a8eb9SGleb Smirnoff $$->tail = $$; 29213b3a8eb9SGleb Smirnoff } 29223b3a8eb9SGleb Smirnoff ; 29233b3a8eb9SGleb Smirnoff 29243b3a8eb9SGleb Smirnoff protoval : STRING { 29253b3a8eb9SGleb Smirnoff struct protoent *p; 29263b3a8eb9SGleb Smirnoff 29273b3a8eb9SGleb Smirnoff p = getprotobyname($1); 29283b3a8eb9SGleb Smirnoff if (p == NULL) { 29293b3a8eb9SGleb Smirnoff yyerror("unknown protocol %s", $1); 29303b3a8eb9SGleb Smirnoff free($1); 29313b3a8eb9SGleb Smirnoff YYERROR; 29323b3a8eb9SGleb Smirnoff } 29333b3a8eb9SGleb Smirnoff $$ = p->p_proto; 29343b3a8eb9SGleb Smirnoff free($1); 29353b3a8eb9SGleb Smirnoff } 29363b3a8eb9SGleb Smirnoff | NUMBER { 29373b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 29383b3a8eb9SGleb Smirnoff yyerror("protocol outside range"); 29393b3a8eb9SGleb Smirnoff YYERROR; 29403b3a8eb9SGleb Smirnoff } 29413b3a8eb9SGleb Smirnoff } 29423b3a8eb9SGleb Smirnoff ; 29433b3a8eb9SGleb Smirnoff 29443b3a8eb9SGleb Smirnoff fromto : ALL { 29453b3a8eb9SGleb Smirnoff $$.src.host = NULL; 29463b3a8eb9SGleb Smirnoff $$.src.port = NULL; 29473b3a8eb9SGleb Smirnoff $$.dst.host = NULL; 29483b3a8eb9SGleb Smirnoff $$.dst.port = NULL; 29493b3a8eb9SGleb Smirnoff $$.src_os = NULL; 29503b3a8eb9SGleb Smirnoff } 29513b3a8eb9SGleb Smirnoff | from os to { 29523b3a8eb9SGleb Smirnoff $$.src = $1; 29533b3a8eb9SGleb Smirnoff $$.src_os = $2; 29543b3a8eb9SGleb Smirnoff $$.dst = $3; 29553b3a8eb9SGleb Smirnoff } 29563b3a8eb9SGleb Smirnoff ; 29573b3a8eb9SGleb Smirnoff 29583b3a8eb9SGleb Smirnoff os : /* empty */ { $$ = NULL; } 29593b3a8eb9SGleb Smirnoff | OS xos { $$ = $2; } 29603b3a8eb9SGleb Smirnoff | OS '{' optnl os_list '}' { $$ = $4; } 29613b3a8eb9SGleb Smirnoff ; 29623b3a8eb9SGleb Smirnoff 29633b3a8eb9SGleb Smirnoff xos : STRING { 29643b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_os)); 29653b3a8eb9SGleb Smirnoff if ($$ == NULL) 29663b3a8eb9SGleb Smirnoff err(1, "os: calloc"); 29673b3a8eb9SGleb Smirnoff $$->os = $1; 29683b3a8eb9SGleb Smirnoff $$->tail = $$; 29693b3a8eb9SGleb Smirnoff } 29703b3a8eb9SGleb Smirnoff ; 29713b3a8eb9SGleb Smirnoff 29723b3a8eb9SGleb Smirnoff os_list : xos optnl { $$ = $1; } 29733b3a8eb9SGleb Smirnoff | os_list comma xos optnl { 29743b3a8eb9SGleb Smirnoff $1->tail->next = $3; 29753b3a8eb9SGleb Smirnoff $1->tail = $3; 29763b3a8eb9SGleb Smirnoff $$ = $1; 29773b3a8eb9SGleb Smirnoff } 29783b3a8eb9SGleb Smirnoff ; 29793b3a8eb9SGleb Smirnoff 29803b3a8eb9SGleb Smirnoff from : /* empty */ { 29813b3a8eb9SGleb Smirnoff $$.host = NULL; 29823b3a8eb9SGleb Smirnoff $$.port = NULL; 29833b3a8eb9SGleb Smirnoff } 29843b3a8eb9SGleb Smirnoff | FROM ipportspec { 29853b3a8eb9SGleb Smirnoff $$ = $2; 29863b3a8eb9SGleb Smirnoff } 29873b3a8eb9SGleb Smirnoff ; 29883b3a8eb9SGleb Smirnoff 29893b3a8eb9SGleb Smirnoff to : /* empty */ { 29903b3a8eb9SGleb Smirnoff $$.host = NULL; 29913b3a8eb9SGleb Smirnoff $$.port = NULL; 29923b3a8eb9SGleb Smirnoff } 29933b3a8eb9SGleb Smirnoff | TO ipportspec { 29943b3a8eb9SGleb Smirnoff if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 29953b3a8eb9SGleb Smirnoff "not permitted in a destination address")) 29963b3a8eb9SGleb Smirnoff YYERROR; 29973b3a8eb9SGleb Smirnoff $$ = $2; 29983b3a8eb9SGleb Smirnoff } 29993b3a8eb9SGleb Smirnoff ; 30003b3a8eb9SGleb Smirnoff 30013b3a8eb9SGleb Smirnoff ipportspec : ipspec { 30023b3a8eb9SGleb Smirnoff $$.host = $1; 30033b3a8eb9SGleb Smirnoff $$.port = NULL; 30043b3a8eb9SGleb Smirnoff } 30053b3a8eb9SGleb Smirnoff | ipspec PORT portspec { 30063b3a8eb9SGleb Smirnoff $$.host = $1; 30073b3a8eb9SGleb Smirnoff $$.port = $3; 30083b3a8eb9SGleb Smirnoff } 30093b3a8eb9SGleb Smirnoff | PORT portspec { 30103b3a8eb9SGleb Smirnoff $$.host = NULL; 30113b3a8eb9SGleb Smirnoff $$.port = $2; 30123b3a8eb9SGleb Smirnoff } 30133b3a8eb9SGleb Smirnoff ; 30143b3a8eb9SGleb Smirnoff 30153b3a8eb9SGleb Smirnoff optnl : '\n' optnl 30163b3a8eb9SGleb Smirnoff | 30173b3a8eb9SGleb Smirnoff ; 30183b3a8eb9SGleb Smirnoff 30193b3a8eb9SGleb Smirnoff ipspec : ANY { $$ = NULL; } 30203b3a8eb9SGleb Smirnoff | xhost { $$ = $1; } 30213b3a8eb9SGleb Smirnoff | '{' optnl host_list '}' { $$ = $3; } 30223b3a8eb9SGleb Smirnoff ; 30233b3a8eb9SGleb Smirnoff 30243b3a8eb9SGleb Smirnoff toipspec : TO ipspec { $$ = $2; } 30253b3a8eb9SGleb Smirnoff | /* empty */ { $$ = NULL; } 30263b3a8eb9SGleb Smirnoff ; 30273b3a8eb9SGleb Smirnoff 30283b3a8eb9SGleb Smirnoff host_list : ipspec optnl { $$ = $1; } 30293b3a8eb9SGleb Smirnoff | host_list comma ipspec optnl { 30303b3a8eb9SGleb Smirnoff if ($3 == NULL) 30313b3a8eb9SGleb Smirnoff $$ = $1; 30323b3a8eb9SGleb Smirnoff else if ($1 == NULL) 30333b3a8eb9SGleb Smirnoff $$ = $3; 30343b3a8eb9SGleb Smirnoff else { 30353b3a8eb9SGleb Smirnoff $1->tail->next = $3; 30363b3a8eb9SGleb Smirnoff $1->tail = $3->tail; 30373b3a8eb9SGleb Smirnoff $$ = $1; 30383b3a8eb9SGleb Smirnoff } 30393b3a8eb9SGleb Smirnoff } 30403b3a8eb9SGleb Smirnoff ; 30413b3a8eb9SGleb Smirnoff 30423b3a8eb9SGleb Smirnoff xhost : not host { 30433b3a8eb9SGleb Smirnoff struct node_host *n; 30443b3a8eb9SGleb Smirnoff 30453b3a8eb9SGleb Smirnoff for (n = $2; n != NULL; n = n->next) 30463b3a8eb9SGleb Smirnoff n->not = $1; 30473b3a8eb9SGleb Smirnoff $$ = $2; 30483b3a8eb9SGleb Smirnoff } 30493b3a8eb9SGleb Smirnoff | not NOROUTE { 30503b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 30513b3a8eb9SGleb Smirnoff if ($$ == NULL) 30523b3a8eb9SGleb Smirnoff err(1, "xhost: calloc"); 30533b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_NOROUTE; 30543b3a8eb9SGleb Smirnoff $$->next = NULL; 30553b3a8eb9SGleb Smirnoff $$->not = $1; 30563b3a8eb9SGleb Smirnoff $$->tail = $$; 30573b3a8eb9SGleb Smirnoff } 30583b3a8eb9SGleb Smirnoff | not URPFFAILED { 30593b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 30603b3a8eb9SGleb Smirnoff if ($$ == NULL) 30613b3a8eb9SGleb Smirnoff err(1, "xhost: calloc"); 30623b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_URPFFAILED; 30633b3a8eb9SGleb Smirnoff $$->next = NULL; 30643b3a8eb9SGleb Smirnoff $$->not = $1; 30653b3a8eb9SGleb Smirnoff $$->tail = $$; 30663b3a8eb9SGleb Smirnoff } 30673b3a8eb9SGleb Smirnoff ; 30683b3a8eb9SGleb Smirnoff 30693b3a8eb9SGleb Smirnoff host : STRING { 30703b3a8eb9SGleb Smirnoff if (($$ = host($1)) == NULL) { 30713b3a8eb9SGleb Smirnoff /* error. "any" is handled elsewhere */ 30723b3a8eb9SGleb Smirnoff free($1); 30733b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 30743b3a8eb9SGleb Smirnoff YYERROR; 30753b3a8eb9SGleb Smirnoff } 30763b3a8eb9SGleb Smirnoff free($1); 30773b3a8eb9SGleb Smirnoff 30783b3a8eb9SGleb Smirnoff } 30793b3a8eb9SGleb Smirnoff | STRING '-' STRING { 30803b3a8eb9SGleb Smirnoff struct node_host *b, *e; 30813b3a8eb9SGleb Smirnoff 30823b3a8eb9SGleb Smirnoff if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 30833b3a8eb9SGleb Smirnoff free($1); 30843b3a8eb9SGleb Smirnoff free($3); 30853b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 30863b3a8eb9SGleb Smirnoff YYERROR; 30873b3a8eb9SGleb Smirnoff } 30883b3a8eb9SGleb Smirnoff if (b->af != e->af || 30893b3a8eb9SGleb Smirnoff b->addr.type != PF_ADDR_ADDRMASK || 30903b3a8eb9SGleb Smirnoff e->addr.type != PF_ADDR_ADDRMASK || 30913b3a8eb9SGleb Smirnoff unmask(&b->addr.v.a.mask, b->af) != 30923b3a8eb9SGleb Smirnoff (b->af == AF_INET ? 32 : 128) || 30933b3a8eb9SGleb Smirnoff unmask(&e->addr.v.a.mask, e->af) != 30943b3a8eb9SGleb Smirnoff (e->af == AF_INET ? 32 : 128) || 30953b3a8eb9SGleb Smirnoff b->next != NULL || b->not || 30963b3a8eb9SGleb Smirnoff e->next != NULL || e->not) { 30973b3a8eb9SGleb Smirnoff free(b); 30983b3a8eb9SGleb Smirnoff free(e); 30993b3a8eb9SGleb Smirnoff free($1); 31003b3a8eb9SGleb Smirnoff free($3); 31013b3a8eb9SGleb Smirnoff yyerror("invalid address range"); 31023b3a8eb9SGleb Smirnoff YYERROR; 31033b3a8eb9SGleb Smirnoff } 31043b3a8eb9SGleb Smirnoff memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 31053b3a8eb9SGleb Smirnoff sizeof(b->addr.v.a.mask)); 31063b3a8eb9SGleb Smirnoff b->addr.type = PF_ADDR_RANGE; 31073b3a8eb9SGleb Smirnoff $$ = b; 31083b3a8eb9SGleb Smirnoff free(e); 31093b3a8eb9SGleb Smirnoff free($1); 31103b3a8eb9SGleb Smirnoff free($3); 31113b3a8eb9SGleb Smirnoff } 31123b3a8eb9SGleb Smirnoff | STRING '/' NUMBER { 31133b3a8eb9SGleb Smirnoff char *buf; 31143b3a8eb9SGleb Smirnoff 31153b3a8eb9SGleb Smirnoff if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1) 31163b3a8eb9SGleb Smirnoff err(1, "host: asprintf"); 31173b3a8eb9SGleb Smirnoff free($1); 31183b3a8eb9SGleb Smirnoff if (($$ = host(buf)) == NULL) { 31193b3a8eb9SGleb Smirnoff /* error. "any" is handled elsewhere */ 31203b3a8eb9SGleb Smirnoff free(buf); 31213b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 31223b3a8eb9SGleb Smirnoff YYERROR; 31233b3a8eb9SGleb Smirnoff } 31243b3a8eb9SGleb Smirnoff free(buf); 31253b3a8eb9SGleb Smirnoff } 31263b3a8eb9SGleb Smirnoff | NUMBER '/' NUMBER { 31273b3a8eb9SGleb Smirnoff char *buf; 31283b3a8eb9SGleb Smirnoff 31293b3a8eb9SGleb Smirnoff /* ie. for 10/8 parsing */ 31303b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 31313b3a8eb9SGleb Smirnoff if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1) 31323b3a8eb9SGleb Smirnoff #else 31333b3a8eb9SGleb Smirnoff if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 31343b3a8eb9SGleb Smirnoff #endif 31353b3a8eb9SGleb Smirnoff err(1, "host: asprintf"); 31363b3a8eb9SGleb Smirnoff if (($$ = host(buf)) == NULL) { 31373b3a8eb9SGleb Smirnoff /* error. "any" is handled elsewhere */ 31383b3a8eb9SGleb Smirnoff free(buf); 31393b3a8eb9SGleb Smirnoff yyerror("could not parse host specification"); 31403b3a8eb9SGleb Smirnoff YYERROR; 31413b3a8eb9SGleb Smirnoff } 31423b3a8eb9SGleb Smirnoff free(buf); 31433b3a8eb9SGleb Smirnoff } 31443b3a8eb9SGleb Smirnoff | dynaddr 31453b3a8eb9SGleb Smirnoff | dynaddr '/' NUMBER { 31463b3a8eb9SGleb Smirnoff struct node_host *n; 31473b3a8eb9SGleb Smirnoff 31483b3a8eb9SGleb Smirnoff if ($3 < 0 || $3 > 128) { 31493b3a8eb9SGleb Smirnoff yyerror("bit number too big"); 31503b3a8eb9SGleb Smirnoff YYERROR; 31513b3a8eb9SGleb Smirnoff } 31523b3a8eb9SGleb Smirnoff $$ = $1; 31533b3a8eb9SGleb Smirnoff for (n = $1; n != NULL; n = n->next) 31543b3a8eb9SGleb Smirnoff set_ipmask(n, $3); 31553b3a8eb9SGleb Smirnoff } 31563b3a8eb9SGleb Smirnoff | '<' STRING '>' { 31573b3a8eb9SGleb Smirnoff if (strlen($2) >= PF_TABLE_NAME_SIZE) { 31583b3a8eb9SGleb Smirnoff yyerror("table name '%s' too long", $2); 31593b3a8eb9SGleb Smirnoff free($2); 31603b3a8eb9SGleb Smirnoff YYERROR; 31613b3a8eb9SGleb Smirnoff } 31623b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 31633b3a8eb9SGleb Smirnoff if ($$ == NULL) 31643b3a8eb9SGleb Smirnoff err(1, "host: calloc"); 31653b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_TABLE; 31663b3a8eb9SGleb Smirnoff if (strlcpy($$->addr.v.tblname, $2, 31673b3a8eb9SGleb Smirnoff sizeof($$->addr.v.tblname)) >= 31683b3a8eb9SGleb Smirnoff sizeof($$->addr.v.tblname)) 31693b3a8eb9SGleb Smirnoff errx(1, "host: strlcpy"); 31703b3a8eb9SGleb Smirnoff free($2); 31713b3a8eb9SGleb Smirnoff $$->next = NULL; 31723b3a8eb9SGleb Smirnoff $$->tail = $$; 31733b3a8eb9SGleb Smirnoff } 31743b3a8eb9SGleb Smirnoff ; 31753b3a8eb9SGleb Smirnoff 31763b3a8eb9SGleb Smirnoff number : NUMBER 31773b3a8eb9SGleb Smirnoff | STRING { 31783b3a8eb9SGleb Smirnoff u_long ulval; 31793b3a8eb9SGleb Smirnoff 31803b3a8eb9SGleb Smirnoff if (atoul($1, &ulval) == -1) { 31813b3a8eb9SGleb Smirnoff yyerror("%s is not a number", $1); 31823b3a8eb9SGleb Smirnoff free($1); 31833b3a8eb9SGleb Smirnoff YYERROR; 31843b3a8eb9SGleb Smirnoff } else 31853b3a8eb9SGleb Smirnoff $$ = ulval; 31863b3a8eb9SGleb Smirnoff free($1); 31873b3a8eb9SGleb Smirnoff } 31883b3a8eb9SGleb Smirnoff ; 31893b3a8eb9SGleb Smirnoff 31903b3a8eb9SGleb Smirnoff dynaddr : '(' STRING ')' { 31913b3a8eb9SGleb Smirnoff int flags = 0; 31923b3a8eb9SGleb Smirnoff char *p, *op; 31933b3a8eb9SGleb Smirnoff 31943b3a8eb9SGleb Smirnoff op = $2; 31953b3a8eb9SGleb Smirnoff if (!isalpha(op[0])) { 31963b3a8eb9SGleb Smirnoff yyerror("invalid interface name '%s'", op); 31973b3a8eb9SGleb Smirnoff free(op); 31983b3a8eb9SGleb Smirnoff YYERROR; 31993b3a8eb9SGleb Smirnoff } 32003b3a8eb9SGleb Smirnoff while ((p = strrchr($2, ':')) != NULL) { 32013b3a8eb9SGleb Smirnoff if (!strcmp(p+1, "network")) 32023b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_NETWORK; 32033b3a8eb9SGleb Smirnoff else if (!strcmp(p+1, "broadcast")) 32043b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_BROADCAST; 32053b3a8eb9SGleb Smirnoff else if (!strcmp(p+1, "peer")) 32063b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_PEER; 32073b3a8eb9SGleb Smirnoff else if (!strcmp(p+1, "0")) 32083b3a8eb9SGleb Smirnoff flags |= PFI_AFLAG_NOALIAS; 32093b3a8eb9SGleb Smirnoff else { 32103b3a8eb9SGleb Smirnoff yyerror("interface %s has bad modifier", 32113b3a8eb9SGleb Smirnoff $2); 32123b3a8eb9SGleb Smirnoff free(op); 32133b3a8eb9SGleb Smirnoff YYERROR; 32143b3a8eb9SGleb Smirnoff } 32153b3a8eb9SGleb Smirnoff *p = '\0'; 32163b3a8eb9SGleb Smirnoff } 32173b3a8eb9SGleb Smirnoff if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 32183b3a8eb9SGleb Smirnoff free(op); 32193b3a8eb9SGleb Smirnoff yyerror("illegal combination of " 32203b3a8eb9SGleb Smirnoff "interface modifiers"); 32213b3a8eb9SGleb Smirnoff YYERROR; 32223b3a8eb9SGleb Smirnoff } 32233b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 32243b3a8eb9SGleb Smirnoff if ($$ == NULL) 32253b3a8eb9SGleb Smirnoff err(1, "address: calloc"); 32263b3a8eb9SGleb Smirnoff $$->af = 0; 32273b3a8eb9SGleb Smirnoff set_ipmask($$, 128); 32283b3a8eb9SGleb Smirnoff $$->addr.type = PF_ADDR_DYNIFTL; 32293b3a8eb9SGleb Smirnoff $$->addr.iflags = flags; 32303b3a8eb9SGleb Smirnoff if (strlcpy($$->addr.v.ifname, $2, 32313b3a8eb9SGleb Smirnoff sizeof($$->addr.v.ifname)) >= 32323b3a8eb9SGleb Smirnoff sizeof($$->addr.v.ifname)) { 32333b3a8eb9SGleb Smirnoff free(op); 32343b3a8eb9SGleb Smirnoff free($$); 32353b3a8eb9SGleb Smirnoff yyerror("interface name too long"); 32363b3a8eb9SGleb Smirnoff YYERROR; 32373b3a8eb9SGleb Smirnoff } 32383b3a8eb9SGleb Smirnoff free(op); 32393b3a8eb9SGleb Smirnoff $$->next = NULL; 32403b3a8eb9SGleb Smirnoff $$->tail = $$; 32413b3a8eb9SGleb Smirnoff } 32423b3a8eb9SGleb Smirnoff ; 32433b3a8eb9SGleb Smirnoff 32443b3a8eb9SGleb Smirnoff portspec : port_item { $$ = $1; } 32453b3a8eb9SGleb Smirnoff | '{' optnl port_list '}' { $$ = $3; } 32463b3a8eb9SGleb Smirnoff ; 32473b3a8eb9SGleb Smirnoff 32483b3a8eb9SGleb Smirnoff port_list : port_item optnl { $$ = $1; } 32493b3a8eb9SGleb Smirnoff | port_list comma port_item optnl { 32503b3a8eb9SGleb Smirnoff $1->tail->next = $3; 32513b3a8eb9SGleb Smirnoff $1->tail = $3; 32523b3a8eb9SGleb Smirnoff $$ = $1; 32533b3a8eb9SGleb Smirnoff } 32543b3a8eb9SGleb Smirnoff ; 32553b3a8eb9SGleb Smirnoff 32563b3a8eb9SGleb Smirnoff port_item : portrange { 32573b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_port)); 32583b3a8eb9SGleb Smirnoff if ($$ == NULL) 32593b3a8eb9SGleb Smirnoff err(1, "port_item: calloc"); 32603b3a8eb9SGleb Smirnoff $$->port[0] = $1.a; 32613b3a8eb9SGleb Smirnoff $$->port[1] = $1.b; 32623b3a8eb9SGleb Smirnoff if ($1.t) 32633b3a8eb9SGleb Smirnoff $$->op = PF_OP_RRG; 32643b3a8eb9SGleb Smirnoff else 32653b3a8eb9SGleb Smirnoff $$->op = PF_OP_EQ; 32663b3a8eb9SGleb Smirnoff $$->next = NULL; 32673b3a8eb9SGleb Smirnoff $$->tail = $$; 32683b3a8eb9SGleb Smirnoff } 32693b3a8eb9SGleb Smirnoff | unaryop portrange { 32703b3a8eb9SGleb Smirnoff if ($2.t) { 32713b3a8eb9SGleb Smirnoff yyerror("':' cannot be used with an other " 32723b3a8eb9SGleb Smirnoff "port operator"); 32733b3a8eb9SGleb Smirnoff YYERROR; 32743b3a8eb9SGleb Smirnoff } 32753b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_port)); 32763b3a8eb9SGleb Smirnoff if ($$ == NULL) 32773b3a8eb9SGleb Smirnoff err(1, "port_item: calloc"); 32783b3a8eb9SGleb Smirnoff $$->port[0] = $2.a; 32793b3a8eb9SGleb Smirnoff $$->port[1] = $2.b; 32803b3a8eb9SGleb Smirnoff $$->op = $1; 32813b3a8eb9SGleb Smirnoff $$->next = NULL; 32823b3a8eb9SGleb Smirnoff $$->tail = $$; 32833b3a8eb9SGleb Smirnoff } 32843b3a8eb9SGleb Smirnoff | portrange PORTBINARY portrange { 32853b3a8eb9SGleb Smirnoff if ($1.t || $3.t) { 32863b3a8eb9SGleb Smirnoff yyerror("':' cannot be used with an other " 32873b3a8eb9SGleb Smirnoff "port operator"); 32883b3a8eb9SGleb Smirnoff YYERROR; 32893b3a8eb9SGleb Smirnoff } 32903b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_port)); 32913b3a8eb9SGleb Smirnoff if ($$ == NULL) 32923b3a8eb9SGleb Smirnoff err(1, "port_item: calloc"); 32933b3a8eb9SGleb Smirnoff $$->port[0] = $1.a; 32943b3a8eb9SGleb Smirnoff $$->port[1] = $3.a; 32953b3a8eb9SGleb Smirnoff $$->op = $2; 32963b3a8eb9SGleb Smirnoff $$->next = NULL; 32973b3a8eb9SGleb Smirnoff $$->tail = $$; 32983b3a8eb9SGleb Smirnoff } 32993b3a8eb9SGleb Smirnoff ; 33003b3a8eb9SGleb Smirnoff 33013b3a8eb9SGleb Smirnoff portplain : numberstring { 33023b3a8eb9SGleb Smirnoff if (parseport($1, &$$, 0) == -1) { 33033b3a8eb9SGleb Smirnoff free($1); 33043b3a8eb9SGleb Smirnoff YYERROR; 33053b3a8eb9SGleb Smirnoff } 33063b3a8eb9SGleb Smirnoff free($1); 33073b3a8eb9SGleb Smirnoff } 33083b3a8eb9SGleb Smirnoff ; 33093b3a8eb9SGleb Smirnoff 33103b3a8eb9SGleb Smirnoff portrange : numberstring { 33113b3a8eb9SGleb Smirnoff if (parseport($1, &$$, PPORT_RANGE) == -1) { 33123b3a8eb9SGleb Smirnoff free($1); 33133b3a8eb9SGleb Smirnoff YYERROR; 33143b3a8eb9SGleb Smirnoff } 33153b3a8eb9SGleb Smirnoff free($1); 33163b3a8eb9SGleb Smirnoff } 33173b3a8eb9SGleb Smirnoff ; 33183b3a8eb9SGleb Smirnoff 33193b3a8eb9SGleb Smirnoff uids : uid_item { $$ = $1; } 33203b3a8eb9SGleb Smirnoff | '{' optnl uid_list '}' { $$ = $3; } 33213b3a8eb9SGleb Smirnoff ; 33223b3a8eb9SGleb Smirnoff 33233b3a8eb9SGleb Smirnoff uid_list : uid_item optnl { $$ = $1; } 33243b3a8eb9SGleb Smirnoff | uid_list comma uid_item optnl { 33253b3a8eb9SGleb Smirnoff $1->tail->next = $3; 33263b3a8eb9SGleb Smirnoff $1->tail = $3; 33273b3a8eb9SGleb Smirnoff $$ = $1; 33283b3a8eb9SGleb Smirnoff } 33293b3a8eb9SGleb Smirnoff ; 33303b3a8eb9SGleb Smirnoff 33313b3a8eb9SGleb Smirnoff uid_item : uid { 33323b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_uid)); 33333b3a8eb9SGleb Smirnoff if ($$ == NULL) 33343b3a8eb9SGleb Smirnoff err(1, "uid_item: calloc"); 33353b3a8eb9SGleb Smirnoff $$->uid[0] = $1; 33363b3a8eb9SGleb Smirnoff $$->uid[1] = $1; 33373b3a8eb9SGleb Smirnoff $$->op = PF_OP_EQ; 33383b3a8eb9SGleb Smirnoff $$->next = NULL; 33393b3a8eb9SGleb Smirnoff $$->tail = $$; 33403b3a8eb9SGleb Smirnoff } 33413b3a8eb9SGleb Smirnoff | unaryop uid { 33423b3a8eb9SGleb Smirnoff if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 33433b3a8eb9SGleb Smirnoff yyerror("user unknown requires operator = or " 33443b3a8eb9SGleb Smirnoff "!="); 33453b3a8eb9SGleb Smirnoff YYERROR; 33463b3a8eb9SGleb Smirnoff } 33473b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_uid)); 33483b3a8eb9SGleb Smirnoff if ($$ == NULL) 33493b3a8eb9SGleb Smirnoff err(1, "uid_item: calloc"); 33503b3a8eb9SGleb Smirnoff $$->uid[0] = $2; 33513b3a8eb9SGleb Smirnoff $$->uid[1] = $2; 33523b3a8eb9SGleb Smirnoff $$->op = $1; 33533b3a8eb9SGleb Smirnoff $$->next = NULL; 33543b3a8eb9SGleb Smirnoff $$->tail = $$; 33553b3a8eb9SGleb Smirnoff } 33563b3a8eb9SGleb Smirnoff | uid PORTBINARY uid { 33573b3a8eb9SGleb Smirnoff if ($1 == UID_MAX || $3 == UID_MAX) { 33583b3a8eb9SGleb Smirnoff yyerror("user unknown requires operator = or " 33593b3a8eb9SGleb Smirnoff "!="); 33603b3a8eb9SGleb Smirnoff YYERROR; 33613b3a8eb9SGleb Smirnoff } 33623b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_uid)); 33633b3a8eb9SGleb Smirnoff if ($$ == NULL) 33643b3a8eb9SGleb Smirnoff err(1, "uid_item: calloc"); 33653b3a8eb9SGleb Smirnoff $$->uid[0] = $1; 33663b3a8eb9SGleb Smirnoff $$->uid[1] = $3; 33673b3a8eb9SGleb Smirnoff $$->op = $2; 33683b3a8eb9SGleb Smirnoff $$->next = NULL; 33693b3a8eb9SGleb Smirnoff $$->tail = $$; 33703b3a8eb9SGleb Smirnoff } 33713b3a8eb9SGleb Smirnoff ; 33723b3a8eb9SGleb Smirnoff 33733b3a8eb9SGleb Smirnoff uid : STRING { 33743b3a8eb9SGleb Smirnoff if (!strcmp($1, "unknown")) 33753b3a8eb9SGleb Smirnoff $$ = UID_MAX; 33763b3a8eb9SGleb Smirnoff else { 33773b3a8eb9SGleb Smirnoff struct passwd *pw; 33783b3a8eb9SGleb Smirnoff 33793b3a8eb9SGleb Smirnoff if ((pw = getpwnam($1)) == NULL) { 33803b3a8eb9SGleb Smirnoff yyerror("unknown user %s", $1); 33813b3a8eb9SGleb Smirnoff free($1); 33823b3a8eb9SGleb Smirnoff YYERROR; 33833b3a8eb9SGleb Smirnoff } 33843b3a8eb9SGleb Smirnoff $$ = pw->pw_uid; 33853b3a8eb9SGleb Smirnoff } 33863b3a8eb9SGleb Smirnoff free($1); 33873b3a8eb9SGleb Smirnoff } 33883b3a8eb9SGleb Smirnoff | NUMBER { 33893b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 >= UID_MAX) { 33903b3a8eb9SGleb Smirnoff yyerror("illegal uid value %lu", $1); 33913b3a8eb9SGleb Smirnoff YYERROR; 33923b3a8eb9SGleb Smirnoff } 33933b3a8eb9SGleb Smirnoff $$ = $1; 33943b3a8eb9SGleb Smirnoff } 33953b3a8eb9SGleb Smirnoff ; 33963b3a8eb9SGleb Smirnoff 33973b3a8eb9SGleb Smirnoff gids : gid_item { $$ = $1; } 33983b3a8eb9SGleb Smirnoff | '{' optnl gid_list '}' { $$ = $3; } 33993b3a8eb9SGleb Smirnoff ; 34003b3a8eb9SGleb Smirnoff 34013b3a8eb9SGleb Smirnoff gid_list : gid_item optnl { $$ = $1; } 34023b3a8eb9SGleb Smirnoff | gid_list comma gid_item optnl { 34033b3a8eb9SGleb Smirnoff $1->tail->next = $3; 34043b3a8eb9SGleb Smirnoff $1->tail = $3; 34053b3a8eb9SGleb Smirnoff $$ = $1; 34063b3a8eb9SGleb Smirnoff } 34073b3a8eb9SGleb Smirnoff ; 34083b3a8eb9SGleb Smirnoff 34093b3a8eb9SGleb Smirnoff gid_item : gid { 34103b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_gid)); 34113b3a8eb9SGleb Smirnoff if ($$ == NULL) 34123b3a8eb9SGleb Smirnoff err(1, "gid_item: calloc"); 34133b3a8eb9SGleb Smirnoff $$->gid[0] = $1; 34143b3a8eb9SGleb Smirnoff $$->gid[1] = $1; 34153b3a8eb9SGleb Smirnoff $$->op = PF_OP_EQ; 34163b3a8eb9SGleb Smirnoff $$->next = NULL; 34173b3a8eb9SGleb Smirnoff $$->tail = $$; 34183b3a8eb9SGleb Smirnoff } 34193b3a8eb9SGleb Smirnoff | unaryop gid { 34203b3a8eb9SGleb Smirnoff if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 34213b3a8eb9SGleb Smirnoff yyerror("group unknown requires operator = or " 34223b3a8eb9SGleb Smirnoff "!="); 34233b3a8eb9SGleb Smirnoff YYERROR; 34243b3a8eb9SGleb Smirnoff } 34253b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_gid)); 34263b3a8eb9SGleb Smirnoff if ($$ == NULL) 34273b3a8eb9SGleb Smirnoff err(1, "gid_item: calloc"); 34283b3a8eb9SGleb Smirnoff $$->gid[0] = $2; 34293b3a8eb9SGleb Smirnoff $$->gid[1] = $2; 34303b3a8eb9SGleb Smirnoff $$->op = $1; 34313b3a8eb9SGleb Smirnoff $$->next = NULL; 34323b3a8eb9SGleb Smirnoff $$->tail = $$; 34333b3a8eb9SGleb Smirnoff } 34343b3a8eb9SGleb Smirnoff | gid PORTBINARY gid { 34353b3a8eb9SGleb Smirnoff if ($1 == GID_MAX || $3 == GID_MAX) { 34363b3a8eb9SGleb Smirnoff yyerror("group unknown requires operator = or " 34373b3a8eb9SGleb Smirnoff "!="); 34383b3a8eb9SGleb Smirnoff YYERROR; 34393b3a8eb9SGleb Smirnoff } 34403b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_gid)); 34413b3a8eb9SGleb Smirnoff if ($$ == NULL) 34423b3a8eb9SGleb Smirnoff err(1, "gid_item: calloc"); 34433b3a8eb9SGleb Smirnoff $$->gid[0] = $1; 34443b3a8eb9SGleb Smirnoff $$->gid[1] = $3; 34453b3a8eb9SGleb Smirnoff $$->op = $2; 34463b3a8eb9SGleb Smirnoff $$->next = NULL; 34473b3a8eb9SGleb Smirnoff $$->tail = $$; 34483b3a8eb9SGleb Smirnoff } 34493b3a8eb9SGleb Smirnoff ; 34503b3a8eb9SGleb Smirnoff 34513b3a8eb9SGleb Smirnoff gid : STRING { 34523b3a8eb9SGleb Smirnoff if (!strcmp($1, "unknown")) 34533b3a8eb9SGleb Smirnoff $$ = GID_MAX; 34543b3a8eb9SGleb Smirnoff else { 34553b3a8eb9SGleb Smirnoff struct group *grp; 34563b3a8eb9SGleb Smirnoff 34573b3a8eb9SGleb Smirnoff if ((grp = getgrnam($1)) == NULL) { 34583b3a8eb9SGleb Smirnoff yyerror("unknown group %s", $1); 34593b3a8eb9SGleb Smirnoff free($1); 34603b3a8eb9SGleb Smirnoff YYERROR; 34613b3a8eb9SGleb Smirnoff } 34623b3a8eb9SGleb Smirnoff $$ = grp->gr_gid; 34633b3a8eb9SGleb Smirnoff } 34643b3a8eb9SGleb Smirnoff free($1); 34653b3a8eb9SGleb Smirnoff } 34663b3a8eb9SGleb Smirnoff | NUMBER { 34673b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 >= GID_MAX) { 34683b3a8eb9SGleb Smirnoff yyerror("illegal gid value %lu", $1); 34693b3a8eb9SGleb Smirnoff YYERROR; 34703b3a8eb9SGleb Smirnoff } 34713b3a8eb9SGleb Smirnoff $$ = $1; 34723b3a8eb9SGleb Smirnoff } 34733b3a8eb9SGleb Smirnoff ; 34743b3a8eb9SGleb Smirnoff 34753b3a8eb9SGleb Smirnoff flag : STRING { 34763b3a8eb9SGleb Smirnoff int f; 34773b3a8eb9SGleb Smirnoff 34783b3a8eb9SGleb Smirnoff if ((f = parse_flags($1)) < 0) { 34793b3a8eb9SGleb Smirnoff yyerror("bad flags %s", $1); 34803b3a8eb9SGleb Smirnoff free($1); 34813b3a8eb9SGleb Smirnoff YYERROR; 34823b3a8eb9SGleb Smirnoff } 34833b3a8eb9SGleb Smirnoff free($1); 34843b3a8eb9SGleb Smirnoff $$.b1 = f; 34853b3a8eb9SGleb Smirnoff } 34863b3a8eb9SGleb Smirnoff ; 34873b3a8eb9SGleb Smirnoff 34883b3a8eb9SGleb Smirnoff flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 34893b3a8eb9SGleb Smirnoff | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 34903b3a8eb9SGleb Smirnoff | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 34913b3a8eb9SGleb Smirnoff ; 34923b3a8eb9SGleb Smirnoff 34933b3a8eb9SGleb Smirnoff icmpspec : ICMPTYPE icmp_item { $$ = $2; } 34943b3a8eb9SGleb Smirnoff | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 34953b3a8eb9SGleb Smirnoff | ICMP6TYPE icmp6_item { $$ = $2; } 34963b3a8eb9SGleb Smirnoff | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 34973b3a8eb9SGleb Smirnoff ; 34983b3a8eb9SGleb Smirnoff 34993b3a8eb9SGleb Smirnoff icmp_list : icmp_item optnl { $$ = $1; } 35003b3a8eb9SGleb Smirnoff | icmp_list comma icmp_item optnl { 35013b3a8eb9SGleb Smirnoff $1->tail->next = $3; 35023b3a8eb9SGleb Smirnoff $1->tail = $3; 35033b3a8eb9SGleb Smirnoff $$ = $1; 35043b3a8eb9SGleb Smirnoff } 35053b3a8eb9SGleb Smirnoff ; 35063b3a8eb9SGleb Smirnoff 35073b3a8eb9SGleb Smirnoff icmp6_list : icmp6_item optnl { $$ = $1; } 35083b3a8eb9SGleb Smirnoff | icmp6_list comma icmp6_item optnl { 35093b3a8eb9SGleb Smirnoff $1->tail->next = $3; 35103b3a8eb9SGleb Smirnoff $1->tail = $3; 35113b3a8eb9SGleb Smirnoff $$ = $1; 35123b3a8eb9SGleb Smirnoff } 35133b3a8eb9SGleb Smirnoff ; 35143b3a8eb9SGleb Smirnoff 35153b3a8eb9SGleb Smirnoff icmp_item : icmptype { 35163b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 35173b3a8eb9SGleb Smirnoff if ($$ == NULL) 35183b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 35193b3a8eb9SGleb Smirnoff $$->type = $1; 35203b3a8eb9SGleb Smirnoff $$->code = 0; 35213b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMP; 35223b3a8eb9SGleb Smirnoff $$->next = NULL; 35233b3a8eb9SGleb Smirnoff $$->tail = $$; 35243b3a8eb9SGleb Smirnoff } 35253b3a8eb9SGleb Smirnoff | icmptype CODE STRING { 35263b3a8eb9SGleb Smirnoff const struct icmpcodeent *p; 35273b3a8eb9SGleb Smirnoff 35283b3a8eb9SGleb Smirnoff if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 35293b3a8eb9SGleb Smirnoff yyerror("unknown icmp-code %s", $3); 35303b3a8eb9SGleb Smirnoff free($3); 35313b3a8eb9SGleb Smirnoff YYERROR; 35323b3a8eb9SGleb Smirnoff } 35333b3a8eb9SGleb Smirnoff 35343b3a8eb9SGleb Smirnoff free($3); 35353b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 35363b3a8eb9SGleb Smirnoff if ($$ == NULL) 35373b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 35383b3a8eb9SGleb Smirnoff $$->type = $1; 35393b3a8eb9SGleb Smirnoff $$->code = p->code + 1; 35403b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMP; 35413b3a8eb9SGleb Smirnoff $$->next = NULL; 35423b3a8eb9SGleb Smirnoff $$->tail = $$; 35433b3a8eb9SGleb Smirnoff } 35443b3a8eb9SGleb Smirnoff | icmptype CODE NUMBER { 35453b3a8eb9SGleb Smirnoff if ($3 < 0 || $3 > 255) { 35463b3a8eb9SGleb Smirnoff yyerror("illegal icmp-code %lu", $3); 35473b3a8eb9SGleb Smirnoff YYERROR; 35483b3a8eb9SGleb Smirnoff } 35493b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 35503b3a8eb9SGleb Smirnoff if ($$ == NULL) 35513b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 35523b3a8eb9SGleb Smirnoff $$->type = $1; 35533b3a8eb9SGleb Smirnoff $$->code = $3 + 1; 35543b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMP; 35553b3a8eb9SGleb Smirnoff $$->next = NULL; 35563b3a8eb9SGleb Smirnoff $$->tail = $$; 35573b3a8eb9SGleb Smirnoff } 35583b3a8eb9SGleb Smirnoff ; 35593b3a8eb9SGleb Smirnoff 35603b3a8eb9SGleb Smirnoff icmp6_item : icmp6type { 35613b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 35623b3a8eb9SGleb Smirnoff if ($$ == NULL) 35633b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 35643b3a8eb9SGleb Smirnoff $$->type = $1; 35653b3a8eb9SGleb Smirnoff $$->code = 0; 35663b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMPV6; 35673b3a8eb9SGleb Smirnoff $$->next = NULL; 35683b3a8eb9SGleb Smirnoff $$->tail = $$; 35693b3a8eb9SGleb Smirnoff } 35703b3a8eb9SGleb Smirnoff | icmp6type CODE STRING { 35713b3a8eb9SGleb Smirnoff const struct icmpcodeent *p; 35723b3a8eb9SGleb Smirnoff 35733b3a8eb9SGleb Smirnoff if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 35743b3a8eb9SGleb Smirnoff yyerror("unknown icmp6-code %s", $3); 35753b3a8eb9SGleb Smirnoff free($3); 35763b3a8eb9SGleb Smirnoff YYERROR; 35773b3a8eb9SGleb Smirnoff } 35783b3a8eb9SGleb Smirnoff free($3); 35793b3a8eb9SGleb Smirnoff 35803b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 35813b3a8eb9SGleb Smirnoff if ($$ == NULL) 35823b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 35833b3a8eb9SGleb Smirnoff $$->type = $1; 35843b3a8eb9SGleb Smirnoff $$->code = p->code + 1; 35853b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMPV6; 35863b3a8eb9SGleb Smirnoff $$->next = NULL; 35873b3a8eb9SGleb Smirnoff $$->tail = $$; 35883b3a8eb9SGleb Smirnoff } 35893b3a8eb9SGleb Smirnoff | icmp6type CODE NUMBER { 35903b3a8eb9SGleb Smirnoff if ($3 < 0 || $3 > 255) { 35913b3a8eb9SGleb Smirnoff yyerror("illegal icmp-code %lu", $3); 35923b3a8eb9SGleb Smirnoff YYERROR; 35933b3a8eb9SGleb Smirnoff } 35943b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_icmp)); 35953b3a8eb9SGleb Smirnoff if ($$ == NULL) 35963b3a8eb9SGleb Smirnoff err(1, "icmp_item: calloc"); 35973b3a8eb9SGleb Smirnoff $$->type = $1; 35983b3a8eb9SGleb Smirnoff $$->code = $3 + 1; 35993b3a8eb9SGleb Smirnoff $$->proto = IPPROTO_ICMPV6; 36003b3a8eb9SGleb Smirnoff $$->next = NULL; 36013b3a8eb9SGleb Smirnoff $$->tail = $$; 36023b3a8eb9SGleb Smirnoff } 36033b3a8eb9SGleb Smirnoff ; 36043b3a8eb9SGleb Smirnoff 36053b3a8eb9SGleb Smirnoff icmptype : STRING { 36063b3a8eb9SGleb Smirnoff const struct icmptypeent *p; 36073b3a8eb9SGleb Smirnoff 36083b3a8eb9SGleb Smirnoff if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 36093b3a8eb9SGleb Smirnoff yyerror("unknown icmp-type %s", $1); 36103b3a8eb9SGleb Smirnoff free($1); 36113b3a8eb9SGleb Smirnoff YYERROR; 36123b3a8eb9SGleb Smirnoff } 36133b3a8eb9SGleb Smirnoff $$ = p->type + 1; 36143b3a8eb9SGleb Smirnoff free($1); 36153b3a8eb9SGleb Smirnoff } 36163b3a8eb9SGleb Smirnoff | NUMBER { 36173b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 36183b3a8eb9SGleb Smirnoff yyerror("illegal icmp-type %lu", $1); 36193b3a8eb9SGleb Smirnoff YYERROR; 36203b3a8eb9SGleb Smirnoff } 36213b3a8eb9SGleb Smirnoff $$ = $1 + 1; 36223b3a8eb9SGleb Smirnoff } 36233b3a8eb9SGleb Smirnoff ; 36243b3a8eb9SGleb Smirnoff 36253b3a8eb9SGleb Smirnoff icmp6type : STRING { 36263b3a8eb9SGleb Smirnoff const struct icmptypeent *p; 36273b3a8eb9SGleb Smirnoff 36283b3a8eb9SGleb Smirnoff if ((p = geticmptypebyname($1, AF_INET6)) == 36293b3a8eb9SGleb Smirnoff NULL) { 36303b3a8eb9SGleb Smirnoff yyerror("unknown icmp6-type %s", $1); 36313b3a8eb9SGleb Smirnoff free($1); 36323b3a8eb9SGleb Smirnoff YYERROR; 36333b3a8eb9SGleb Smirnoff } 36343b3a8eb9SGleb Smirnoff $$ = p->type + 1; 36353b3a8eb9SGleb Smirnoff free($1); 36363b3a8eb9SGleb Smirnoff } 36373b3a8eb9SGleb Smirnoff | NUMBER { 36383b3a8eb9SGleb Smirnoff if ($1 < 0 || $1 > 255) { 36393b3a8eb9SGleb Smirnoff yyerror("illegal icmp6-type %lu", $1); 36403b3a8eb9SGleb Smirnoff YYERROR; 36413b3a8eb9SGleb Smirnoff } 36423b3a8eb9SGleb Smirnoff $$ = $1 + 1; 36433b3a8eb9SGleb Smirnoff } 36443b3a8eb9SGleb Smirnoff ; 36453b3a8eb9SGleb Smirnoff 36463b3a8eb9SGleb Smirnoff tos : STRING { 36471f495578SKristof Provost int val; 36481f495578SKristof Provost char *end; 36491f495578SKristof Provost 36501f495578SKristof Provost if (map_tos($1, &val)) 36511f495578SKristof Provost $$ = val; 36521f495578SKristof Provost else if ($1[0] == '0' && $1[1] == 'x') { 36531f495578SKristof Provost errno = 0; 36541f495578SKristof Provost $$ = strtoul($1, &end, 16); 36551f495578SKristof Provost if (errno || *end != '\0') 36561f495578SKristof Provost $$ = 256; 36571f495578SKristof Provost } else 36580cd7a91aSKristof Provost $$ = 256; /* flag bad argument */ 36590cd7a91aSKristof Provost if ($$ < 0 || $$ > 255) { 36603b3a8eb9SGleb Smirnoff yyerror("illegal tos value %s", $1); 36613b3a8eb9SGleb Smirnoff free($1); 36623b3a8eb9SGleb Smirnoff YYERROR; 36633b3a8eb9SGleb Smirnoff } 36643b3a8eb9SGleb Smirnoff free($1); 36653b3a8eb9SGleb Smirnoff } 36663b3a8eb9SGleb Smirnoff | NUMBER { 36673b3a8eb9SGleb Smirnoff $$ = $1; 36680cd7a91aSKristof Provost if ($$ < 0 || $$ > 255) { 36693b3a8eb9SGleb Smirnoff yyerror("illegal tos value %s", $1); 36703b3a8eb9SGleb Smirnoff YYERROR; 36713b3a8eb9SGleb Smirnoff } 36723b3a8eb9SGleb Smirnoff } 36733b3a8eb9SGleb Smirnoff ; 36743b3a8eb9SGleb Smirnoff 36753b3a8eb9SGleb Smirnoff sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 36763b3a8eb9SGleb Smirnoff | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 36773b3a8eb9SGleb Smirnoff | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 36783b3a8eb9SGleb Smirnoff ; 36793b3a8eb9SGleb Smirnoff 36803b3a8eb9SGleb Smirnoff statelock : IFBOUND { 36813b3a8eb9SGleb Smirnoff $$ = PFRULE_IFBOUND; 36823b3a8eb9SGleb Smirnoff } 36833b3a8eb9SGleb Smirnoff | FLOATING { 36843b3a8eb9SGleb Smirnoff $$ = 0; 36853b3a8eb9SGleb Smirnoff } 36863b3a8eb9SGleb Smirnoff ; 36873b3a8eb9SGleb Smirnoff 36883b3a8eb9SGleb Smirnoff keep : NO STATE { 36893b3a8eb9SGleb Smirnoff $$.action = 0; 36903b3a8eb9SGleb Smirnoff $$.options = NULL; 36913b3a8eb9SGleb Smirnoff } 36923b3a8eb9SGleb Smirnoff | KEEP STATE state_opt_spec { 36933b3a8eb9SGleb Smirnoff $$.action = PF_STATE_NORMAL; 36943b3a8eb9SGleb Smirnoff $$.options = $3; 36953b3a8eb9SGleb Smirnoff } 36963b3a8eb9SGleb Smirnoff | MODULATE STATE state_opt_spec { 36973b3a8eb9SGleb Smirnoff $$.action = PF_STATE_MODULATE; 36983b3a8eb9SGleb Smirnoff $$.options = $3; 36993b3a8eb9SGleb Smirnoff } 37003b3a8eb9SGleb Smirnoff | SYNPROXY STATE state_opt_spec { 37013b3a8eb9SGleb Smirnoff $$.action = PF_STATE_SYNPROXY; 37023b3a8eb9SGleb Smirnoff $$.options = $3; 37033b3a8eb9SGleb Smirnoff } 37043b3a8eb9SGleb Smirnoff ; 37053b3a8eb9SGleb Smirnoff 37063b3a8eb9SGleb Smirnoff flush : /* empty */ { $$ = 0; } 37073b3a8eb9SGleb Smirnoff | FLUSH { $$ = PF_FLUSH; } 37083b3a8eb9SGleb Smirnoff | FLUSH GLOBAL { 37093b3a8eb9SGleb Smirnoff $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 37103b3a8eb9SGleb Smirnoff } 37113b3a8eb9SGleb Smirnoff ; 37123b3a8eb9SGleb Smirnoff 37133b3a8eb9SGleb Smirnoff state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 37143b3a8eb9SGleb Smirnoff | /* empty */ { $$ = NULL; } 37153b3a8eb9SGleb Smirnoff ; 37163b3a8eb9SGleb Smirnoff 37173b3a8eb9SGleb Smirnoff state_opt_list : state_opt_item { $$ = $1; } 37183b3a8eb9SGleb Smirnoff | state_opt_list comma state_opt_item { 37193b3a8eb9SGleb Smirnoff $1->tail->next = $3; 37203b3a8eb9SGleb Smirnoff $1->tail = $3; 37213b3a8eb9SGleb Smirnoff $$ = $1; 37223b3a8eb9SGleb Smirnoff } 37233b3a8eb9SGleb Smirnoff ; 37243b3a8eb9SGleb Smirnoff 37253b3a8eb9SGleb Smirnoff state_opt_item : MAXIMUM NUMBER { 37263b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 37273b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 37283b3a8eb9SGleb Smirnoff YYERROR; 37293b3a8eb9SGleb Smirnoff } 37303b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 37313b3a8eb9SGleb Smirnoff if ($$ == NULL) 37323b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 37333b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX; 37343b3a8eb9SGleb Smirnoff $$->data.max_states = $2; 37353b3a8eb9SGleb Smirnoff $$->next = NULL; 37363b3a8eb9SGleb Smirnoff $$->tail = $$; 37373b3a8eb9SGleb Smirnoff } 37383b3a8eb9SGleb Smirnoff | NOSYNC { 37393b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 37403b3a8eb9SGleb Smirnoff if ($$ == NULL) 37413b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 37423b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_NOSYNC; 37433b3a8eb9SGleb Smirnoff $$->next = NULL; 37443b3a8eb9SGleb Smirnoff $$->tail = $$; 37453b3a8eb9SGleb Smirnoff } 37463b3a8eb9SGleb Smirnoff | MAXSRCSTATES NUMBER { 37473b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 37483b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 37493b3a8eb9SGleb Smirnoff YYERROR; 37503b3a8eb9SGleb Smirnoff } 37513b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 37523b3a8eb9SGleb Smirnoff if ($$ == NULL) 37533b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 37543b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_STATES; 37553b3a8eb9SGleb Smirnoff $$->data.max_src_states = $2; 37563b3a8eb9SGleb Smirnoff $$->next = NULL; 37573b3a8eb9SGleb Smirnoff $$->tail = $$; 37583b3a8eb9SGleb Smirnoff } 37593b3a8eb9SGleb Smirnoff | MAXSRCCONN NUMBER { 37603b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 37613b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 37623b3a8eb9SGleb Smirnoff YYERROR; 37633b3a8eb9SGleb Smirnoff } 37643b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 37653b3a8eb9SGleb Smirnoff if ($$ == NULL) 37663b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 37673b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_CONN; 37683b3a8eb9SGleb Smirnoff $$->data.max_src_conn = $2; 37693b3a8eb9SGleb Smirnoff $$->next = NULL; 37703b3a8eb9SGleb Smirnoff $$->tail = $$; 37713b3a8eb9SGleb Smirnoff } 37723b3a8eb9SGleb Smirnoff | MAXSRCCONNRATE NUMBER '/' NUMBER { 37733b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX || 37743b3a8eb9SGleb Smirnoff $4 < 0 || $4 > UINT_MAX) { 37753b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 37763b3a8eb9SGleb Smirnoff YYERROR; 37773b3a8eb9SGleb Smirnoff } 37783b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 37793b3a8eb9SGleb Smirnoff if ($$ == NULL) 37803b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 37813b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 37823b3a8eb9SGleb Smirnoff $$->data.max_src_conn_rate.limit = $2; 37833b3a8eb9SGleb Smirnoff $$->data.max_src_conn_rate.seconds = $4; 37843b3a8eb9SGleb Smirnoff $$->next = NULL; 37853b3a8eb9SGleb Smirnoff $$->tail = $$; 37863b3a8eb9SGleb Smirnoff } 37873b3a8eb9SGleb Smirnoff | OVERLOAD '<' STRING '>' flush { 37883b3a8eb9SGleb Smirnoff if (strlen($3) >= PF_TABLE_NAME_SIZE) { 37893b3a8eb9SGleb Smirnoff yyerror("table name '%s' too long", $3); 37903b3a8eb9SGleb Smirnoff free($3); 37913b3a8eb9SGleb Smirnoff YYERROR; 37923b3a8eb9SGleb Smirnoff } 37933b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 37943b3a8eb9SGleb Smirnoff if ($$ == NULL) 37953b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 37963b3a8eb9SGleb Smirnoff if (strlcpy($$->data.overload.tblname, $3, 37973b3a8eb9SGleb Smirnoff PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 37983b3a8eb9SGleb Smirnoff errx(1, "state_opt_item: strlcpy"); 37993b3a8eb9SGleb Smirnoff free($3); 38003b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_OVERLOAD; 38013b3a8eb9SGleb Smirnoff $$->data.overload.flush = $5; 38023b3a8eb9SGleb Smirnoff $$->next = NULL; 38033b3a8eb9SGleb Smirnoff $$->tail = $$; 38043b3a8eb9SGleb Smirnoff } 38053b3a8eb9SGleb Smirnoff | MAXSRCNODES NUMBER { 38063b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 38073b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 38083b3a8eb9SGleb Smirnoff YYERROR; 38093b3a8eb9SGleb Smirnoff } 38103b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 38113b3a8eb9SGleb Smirnoff if ($$ == NULL) 38123b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 38133b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_MAX_SRC_NODES; 38143b3a8eb9SGleb Smirnoff $$->data.max_src_nodes = $2; 38153b3a8eb9SGleb Smirnoff $$->next = NULL; 38163b3a8eb9SGleb Smirnoff $$->tail = $$; 38173b3a8eb9SGleb Smirnoff } 38183b3a8eb9SGleb Smirnoff | sourcetrack { 38193b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 38203b3a8eb9SGleb Smirnoff if ($$ == NULL) 38213b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 38223b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_SRCTRACK; 38233b3a8eb9SGleb Smirnoff $$->data.src_track = $1; 38243b3a8eb9SGleb Smirnoff $$->next = NULL; 38253b3a8eb9SGleb Smirnoff $$->tail = $$; 38263b3a8eb9SGleb Smirnoff } 38273b3a8eb9SGleb Smirnoff | statelock { 38283b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 38293b3a8eb9SGleb Smirnoff if ($$ == NULL) 38303b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 38313b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_STATELOCK; 38323b3a8eb9SGleb Smirnoff $$->data.statelock = $1; 38333b3a8eb9SGleb Smirnoff $$->next = NULL; 38343b3a8eb9SGleb Smirnoff $$->tail = $$; 38353b3a8eb9SGleb Smirnoff } 38363b3a8eb9SGleb Smirnoff | SLOPPY { 38373b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 38383b3a8eb9SGleb Smirnoff if ($$ == NULL) 38393b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 38403b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_SLOPPY; 38413b3a8eb9SGleb Smirnoff $$->next = NULL; 38423b3a8eb9SGleb Smirnoff $$->tail = $$; 38433b3a8eb9SGleb Smirnoff } 38443b3a8eb9SGleb Smirnoff | STRING NUMBER { 38453b3a8eb9SGleb Smirnoff int i; 38463b3a8eb9SGleb Smirnoff 38473b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 38483b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 38493b3a8eb9SGleb Smirnoff YYERROR; 38503b3a8eb9SGleb Smirnoff } 38513b3a8eb9SGleb Smirnoff for (i = 0; pf_timeouts[i].name && 38523b3a8eb9SGleb Smirnoff strcmp(pf_timeouts[i].name, $1); ++i) 38533b3a8eb9SGleb Smirnoff ; /* nothing */ 38543b3a8eb9SGleb Smirnoff if (!pf_timeouts[i].name) { 38553b3a8eb9SGleb Smirnoff yyerror("illegal timeout name %s", $1); 38563b3a8eb9SGleb Smirnoff free($1); 38573b3a8eb9SGleb Smirnoff YYERROR; 38583b3a8eb9SGleb Smirnoff } 38593b3a8eb9SGleb Smirnoff if (strchr(pf_timeouts[i].name, '.') == NULL) { 38603b3a8eb9SGleb Smirnoff yyerror("illegal state timeout %s", $1); 38613b3a8eb9SGleb Smirnoff free($1); 38623b3a8eb9SGleb Smirnoff YYERROR; 38633b3a8eb9SGleb Smirnoff } 38643b3a8eb9SGleb Smirnoff free($1); 38653b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_state_opt)); 38663b3a8eb9SGleb Smirnoff if ($$ == NULL) 38673b3a8eb9SGleb Smirnoff err(1, "state_opt_item: calloc"); 38683b3a8eb9SGleb Smirnoff $$->type = PF_STATE_OPT_TIMEOUT; 38693b3a8eb9SGleb Smirnoff $$->data.timeout.number = pf_timeouts[i].timeout; 38703b3a8eb9SGleb Smirnoff $$->data.timeout.seconds = $2; 38713b3a8eb9SGleb Smirnoff $$->next = NULL; 38723b3a8eb9SGleb Smirnoff $$->tail = $$; 38733b3a8eb9SGleb Smirnoff } 38743b3a8eb9SGleb Smirnoff ; 38753b3a8eb9SGleb Smirnoff 38763b3a8eb9SGleb Smirnoff label : LABEL STRING { 38773b3a8eb9SGleb Smirnoff $$ = $2; 38783b3a8eb9SGleb Smirnoff } 38793b3a8eb9SGleb Smirnoff ; 38803b3a8eb9SGleb Smirnoff 38813b3a8eb9SGleb Smirnoff qname : QUEUE STRING { 38823b3a8eb9SGleb Smirnoff $$.qname = $2; 38833b3a8eb9SGleb Smirnoff $$.pqname = NULL; 38843b3a8eb9SGleb Smirnoff } 38853b3a8eb9SGleb Smirnoff | QUEUE '(' STRING ')' { 38863b3a8eb9SGleb Smirnoff $$.qname = $3; 38873b3a8eb9SGleb Smirnoff $$.pqname = NULL; 38883b3a8eb9SGleb Smirnoff } 38893b3a8eb9SGleb Smirnoff | QUEUE '(' STRING comma STRING ')' { 38903b3a8eb9SGleb Smirnoff $$.qname = $3; 38913b3a8eb9SGleb Smirnoff $$.pqname = $5; 38923b3a8eb9SGleb Smirnoff } 38933b3a8eb9SGleb Smirnoff ; 38943b3a8eb9SGleb Smirnoff 38953b3a8eb9SGleb Smirnoff no : /* empty */ { $$ = 0; } 38963b3a8eb9SGleb Smirnoff | NO { $$ = 1; } 38973b3a8eb9SGleb Smirnoff ; 38983b3a8eb9SGleb Smirnoff 38993b3a8eb9SGleb Smirnoff portstar : numberstring { 39003b3a8eb9SGleb Smirnoff if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 39013b3a8eb9SGleb Smirnoff free($1); 39023b3a8eb9SGleb Smirnoff YYERROR; 39033b3a8eb9SGleb Smirnoff } 39043b3a8eb9SGleb Smirnoff free($1); 39053b3a8eb9SGleb Smirnoff } 39063b3a8eb9SGleb Smirnoff ; 39073b3a8eb9SGleb Smirnoff 39083b3a8eb9SGleb Smirnoff redirspec : host { $$ = $1; } 39093b3a8eb9SGleb Smirnoff | '{' optnl redir_host_list '}' { $$ = $3; } 39103b3a8eb9SGleb Smirnoff ; 39113b3a8eb9SGleb Smirnoff 39123b3a8eb9SGleb Smirnoff redir_host_list : host optnl { $$ = $1; } 39133b3a8eb9SGleb Smirnoff | redir_host_list comma host optnl { 39143b3a8eb9SGleb Smirnoff $1->tail->next = $3; 39153b3a8eb9SGleb Smirnoff $1->tail = $3->tail; 39163b3a8eb9SGleb Smirnoff $$ = $1; 39173b3a8eb9SGleb Smirnoff } 39183b3a8eb9SGleb Smirnoff ; 39193b3a8eb9SGleb Smirnoff 39203b3a8eb9SGleb Smirnoff redirpool : /* empty */ { $$ = NULL; } 39213b3a8eb9SGleb Smirnoff | ARROW redirspec { 39223b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 39233b3a8eb9SGleb Smirnoff if ($$ == NULL) 39243b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 39253b3a8eb9SGleb Smirnoff $$->host = $2; 39263b3a8eb9SGleb Smirnoff $$->rport.a = $$->rport.b = $$->rport.t = 0; 39273b3a8eb9SGleb Smirnoff } 39283b3a8eb9SGleb Smirnoff | ARROW redirspec PORT portstar { 39293b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 39303b3a8eb9SGleb Smirnoff if ($$ == NULL) 39313b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 39323b3a8eb9SGleb Smirnoff $$->host = $2; 39333b3a8eb9SGleb Smirnoff $$->rport = $4; 39343b3a8eb9SGleb Smirnoff } 39353b3a8eb9SGleb Smirnoff ; 39363b3a8eb9SGleb Smirnoff 39373b3a8eb9SGleb Smirnoff hashkey : /* empty */ 39383b3a8eb9SGleb Smirnoff { 39393b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct pf_poolhashkey)); 39403b3a8eb9SGleb Smirnoff if ($$ == NULL) 39413b3a8eb9SGleb Smirnoff err(1, "hashkey: calloc"); 39423b3a8eb9SGleb Smirnoff $$->key32[0] = arc4random(); 39433b3a8eb9SGleb Smirnoff $$->key32[1] = arc4random(); 39443b3a8eb9SGleb Smirnoff $$->key32[2] = arc4random(); 39453b3a8eb9SGleb Smirnoff $$->key32[3] = arc4random(); 39463b3a8eb9SGleb Smirnoff } 39473b3a8eb9SGleb Smirnoff | string 39483b3a8eb9SGleb Smirnoff { 39493b3a8eb9SGleb Smirnoff if (!strncmp($1, "0x", 2)) { 39503b3a8eb9SGleb Smirnoff if (strlen($1) != 34) { 39513b3a8eb9SGleb Smirnoff free($1); 39523b3a8eb9SGleb Smirnoff yyerror("hex key must be 128 bits " 39533b3a8eb9SGleb Smirnoff "(32 hex digits) long"); 39543b3a8eb9SGleb Smirnoff YYERROR; 39553b3a8eb9SGleb Smirnoff } 39563b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct pf_poolhashkey)); 39573b3a8eb9SGleb Smirnoff if ($$ == NULL) 39583b3a8eb9SGleb Smirnoff err(1, "hashkey: calloc"); 39593b3a8eb9SGleb Smirnoff 39603b3a8eb9SGleb Smirnoff if (sscanf($1, "0x%8x%8x%8x%8x", 39613b3a8eb9SGleb Smirnoff &$$->key32[0], &$$->key32[1], 39623b3a8eb9SGleb Smirnoff &$$->key32[2], &$$->key32[3]) != 4) { 39633b3a8eb9SGleb Smirnoff free($$); 39643b3a8eb9SGleb Smirnoff free($1); 39653b3a8eb9SGleb Smirnoff yyerror("invalid hex key"); 39663b3a8eb9SGleb Smirnoff YYERROR; 39673b3a8eb9SGleb Smirnoff } 39683b3a8eb9SGleb Smirnoff } else { 39693b3a8eb9SGleb Smirnoff MD5_CTX context; 39703b3a8eb9SGleb Smirnoff 39713b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct pf_poolhashkey)); 39723b3a8eb9SGleb Smirnoff if ($$ == NULL) 39733b3a8eb9SGleb Smirnoff err(1, "hashkey: calloc"); 39743b3a8eb9SGleb Smirnoff MD5Init(&context); 39753b3a8eb9SGleb Smirnoff MD5Update(&context, (unsigned char *)$1, 39763b3a8eb9SGleb Smirnoff strlen($1)); 39773b3a8eb9SGleb Smirnoff MD5Final((unsigned char *)$$, &context); 39783b3a8eb9SGleb Smirnoff HTONL($$->key32[0]); 39793b3a8eb9SGleb Smirnoff HTONL($$->key32[1]); 39803b3a8eb9SGleb Smirnoff HTONL($$->key32[2]); 39813b3a8eb9SGleb Smirnoff HTONL($$->key32[3]); 39823b3a8eb9SGleb Smirnoff } 39833b3a8eb9SGleb Smirnoff free($1); 39843b3a8eb9SGleb Smirnoff } 39853b3a8eb9SGleb Smirnoff ; 39863b3a8eb9SGleb Smirnoff 39873b3a8eb9SGleb Smirnoff pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 39883b3a8eb9SGleb Smirnoff pool_opts_l 39893b3a8eb9SGleb Smirnoff { $$ = pool_opts; } 39903b3a8eb9SGleb Smirnoff | /* empty */ { 39913b3a8eb9SGleb Smirnoff bzero(&pool_opts, sizeof pool_opts); 39923b3a8eb9SGleb Smirnoff $$ = pool_opts; 39933b3a8eb9SGleb Smirnoff } 39943b3a8eb9SGleb Smirnoff ; 39953b3a8eb9SGleb Smirnoff 39963b3a8eb9SGleb Smirnoff pool_opts_l : pool_opts_l pool_opt 39973b3a8eb9SGleb Smirnoff | pool_opt 39983b3a8eb9SGleb Smirnoff ; 39993b3a8eb9SGleb Smirnoff 40003b3a8eb9SGleb Smirnoff pool_opt : BITMASK { 40013b3a8eb9SGleb Smirnoff if (pool_opts.type) { 40023b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 40033b3a8eb9SGleb Smirnoff YYERROR; 40043b3a8eb9SGleb Smirnoff } 40053b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_BITMASK; 40063b3a8eb9SGleb Smirnoff } 40073b3a8eb9SGleb Smirnoff | RANDOM { 40083b3a8eb9SGleb Smirnoff if (pool_opts.type) { 40093b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 40103b3a8eb9SGleb Smirnoff YYERROR; 40113b3a8eb9SGleb Smirnoff } 40123b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_RANDOM; 40133b3a8eb9SGleb Smirnoff } 40143b3a8eb9SGleb Smirnoff | SOURCEHASH hashkey { 40153b3a8eb9SGleb Smirnoff if (pool_opts.type) { 40163b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 40173b3a8eb9SGleb Smirnoff YYERROR; 40183b3a8eb9SGleb Smirnoff } 40193b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_SRCHASH; 40203b3a8eb9SGleb Smirnoff pool_opts.key = $2; 40213b3a8eb9SGleb Smirnoff } 40223b3a8eb9SGleb Smirnoff | ROUNDROBIN { 40233b3a8eb9SGleb Smirnoff if (pool_opts.type) { 40243b3a8eb9SGleb Smirnoff yyerror("pool type cannot be redefined"); 40253b3a8eb9SGleb Smirnoff YYERROR; 40263b3a8eb9SGleb Smirnoff } 40273b3a8eb9SGleb Smirnoff pool_opts.type = PF_POOL_ROUNDROBIN; 40283b3a8eb9SGleb Smirnoff } 40293b3a8eb9SGleb Smirnoff | STATICPORT { 40303b3a8eb9SGleb Smirnoff if (pool_opts.staticport) { 40313b3a8eb9SGleb Smirnoff yyerror("static-port cannot be redefined"); 40323b3a8eb9SGleb Smirnoff YYERROR; 40333b3a8eb9SGleb Smirnoff } 40343b3a8eb9SGleb Smirnoff pool_opts.staticport = 1; 40353b3a8eb9SGleb Smirnoff } 40363b3a8eb9SGleb Smirnoff | STICKYADDRESS { 40373b3a8eb9SGleb Smirnoff if (filter_opts.marker & POM_STICKYADDRESS) { 40383b3a8eb9SGleb Smirnoff yyerror("sticky-address cannot be redefined"); 40393b3a8eb9SGleb Smirnoff YYERROR; 40403b3a8eb9SGleb Smirnoff } 40413b3a8eb9SGleb Smirnoff pool_opts.marker |= POM_STICKYADDRESS; 40423b3a8eb9SGleb Smirnoff pool_opts.opts |= PF_POOL_STICKYADDR; 40433b3a8eb9SGleb Smirnoff } 40442aa21096SKurosawa Takahiro | MAPEPORTSET number '/' number '/' number { 40452aa21096SKurosawa Takahiro if (pool_opts.mape.offset) { 40462aa21096SKurosawa Takahiro yyerror("map-e-portset cannot be redefined"); 40472aa21096SKurosawa Takahiro YYERROR; 40482aa21096SKurosawa Takahiro } 40492aa21096SKurosawa Takahiro if (pool_opts.type) { 40502aa21096SKurosawa Takahiro yyerror("map-e-portset cannot be used with " 40512aa21096SKurosawa Takahiro "address pools"); 40522aa21096SKurosawa Takahiro YYERROR; 40532aa21096SKurosawa Takahiro } 40542aa21096SKurosawa Takahiro if ($2 <= 0 || $2 >= 16) { 40552aa21096SKurosawa Takahiro yyerror("MAP-E PSID offset must be 1-15"); 40562aa21096SKurosawa Takahiro YYERROR; 40572aa21096SKurosawa Takahiro } 40582aa21096SKurosawa Takahiro if ($4 < 0 || $4 >= 16 || $2 + $4 > 16) { 40592aa21096SKurosawa Takahiro yyerror("Invalid MAP-E PSID length"); 40602aa21096SKurosawa Takahiro YYERROR; 40612aa21096SKurosawa Takahiro } else if ($4 == 0) { 40622aa21096SKurosawa Takahiro yyerror("PSID Length = 0: this means" 40632aa21096SKurosawa Takahiro " you do not need MAP-E"); 40642aa21096SKurosawa Takahiro YYERROR; 40652aa21096SKurosawa Takahiro } 40662aa21096SKurosawa Takahiro if ($6 < 0 || $6 > 65535) { 40672aa21096SKurosawa Takahiro yyerror("Invalid MAP-E PSID"); 40682aa21096SKurosawa Takahiro YYERROR; 40692aa21096SKurosawa Takahiro } 40702aa21096SKurosawa Takahiro pool_opts.mape.offset = $2; 40712aa21096SKurosawa Takahiro pool_opts.mape.psidlen = $4; 40722aa21096SKurosawa Takahiro pool_opts.mape.psid = $6; 40732aa21096SKurosawa Takahiro } 40743b3a8eb9SGleb Smirnoff ; 40753b3a8eb9SGleb Smirnoff 40763b3a8eb9SGleb Smirnoff redirection : /* empty */ { $$ = NULL; } 40773b3a8eb9SGleb Smirnoff | ARROW host { 40783b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 40793b3a8eb9SGleb Smirnoff if ($$ == NULL) 40803b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 40813b3a8eb9SGleb Smirnoff $$->host = $2; 40823b3a8eb9SGleb Smirnoff $$->rport.a = $$->rport.b = $$->rport.t = 0; 40833b3a8eb9SGleb Smirnoff } 40843b3a8eb9SGleb Smirnoff | ARROW host PORT portstar { 40853b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct redirection)); 40863b3a8eb9SGleb Smirnoff if ($$ == NULL) 40873b3a8eb9SGleb Smirnoff err(1, "redirection: calloc"); 40883b3a8eb9SGleb Smirnoff $$->host = $2; 40893b3a8eb9SGleb Smirnoff $$->rport = $4; 40903b3a8eb9SGleb Smirnoff } 40913b3a8eb9SGleb Smirnoff ; 40923b3a8eb9SGleb Smirnoff 40933b3a8eb9SGleb Smirnoff natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 40943b3a8eb9SGleb Smirnoff | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 40953b3a8eb9SGleb Smirnoff | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 40963b3a8eb9SGleb Smirnoff | log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; } 40973b3a8eb9SGleb Smirnoff ; 40983b3a8eb9SGleb Smirnoff 40993b3a8eb9SGleb Smirnoff nataction : no NAT natpasslog { 41003b3a8eb9SGleb Smirnoff if ($1 && $3.b1) { 41013b3a8eb9SGleb Smirnoff yyerror("\"pass\" not valid with \"no\""); 41023b3a8eb9SGleb Smirnoff YYERROR; 41033b3a8eb9SGleb Smirnoff } 41043b3a8eb9SGleb Smirnoff if ($1) 41053b3a8eb9SGleb Smirnoff $$.b1 = PF_NONAT; 41063b3a8eb9SGleb Smirnoff else 41073b3a8eb9SGleb Smirnoff $$.b1 = PF_NAT; 41083b3a8eb9SGleb Smirnoff $$.b2 = $3.b1; 41093b3a8eb9SGleb Smirnoff $$.w = $3.b2; 41103b3a8eb9SGleb Smirnoff $$.w2 = $3.w2; 41113b3a8eb9SGleb Smirnoff } 41123b3a8eb9SGleb Smirnoff | no RDR natpasslog { 41133b3a8eb9SGleb Smirnoff if ($1 && $3.b1) { 41143b3a8eb9SGleb Smirnoff yyerror("\"pass\" not valid with \"no\""); 41153b3a8eb9SGleb Smirnoff YYERROR; 41163b3a8eb9SGleb Smirnoff } 41173b3a8eb9SGleb Smirnoff if ($1) 41183b3a8eb9SGleb Smirnoff $$.b1 = PF_NORDR; 41193b3a8eb9SGleb Smirnoff else 41203b3a8eb9SGleb Smirnoff $$.b1 = PF_RDR; 41213b3a8eb9SGleb Smirnoff $$.b2 = $3.b1; 41223b3a8eb9SGleb Smirnoff $$.w = $3.b2; 41233b3a8eb9SGleb Smirnoff $$.w2 = $3.w2; 41243b3a8eb9SGleb Smirnoff } 41253b3a8eb9SGleb Smirnoff ; 41263b3a8eb9SGleb Smirnoff 41273b3a8eb9SGleb Smirnoff natrule : nataction interface af proto fromto tag tagged rtable 41283b3a8eb9SGleb Smirnoff redirpool pool_opts 41293b3a8eb9SGleb Smirnoff { 4130e9eb0941SKristof Provost struct pfctl_rule r; 41313b3a8eb9SGleb Smirnoff 41323b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) 41333b3a8eb9SGleb Smirnoff YYERROR; 41343b3a8eb9SGleb Smirnoff 41353b3a8eb9SGleb Smirnoff memset(&r, 0, sizeof(r)); 41363b3a8eb9SGleb Smirnoff 41373b3a8eb9SGleb Smirnoff r.action = $1.b1; 41383b3a8eb9SGleb Smirnoff r.natpass = $1.b2; 41393b3a8eb9SGleb Smirnoff r.log = $1.w; 41403b3a8eb9SGleb Smirnoff r.logif = $1.w2; 41413b3a8eb9SGleb Smirnoff r.af = $3; 41423b3a8eb9SGleb Smirnoff 41433b3a8eb9SGleb Smirnoff if (!r.af) { 41443b3a8eb9SGleb Smirnoff if ($5.src.host && $5.src.host->af && 41453b3a8eb9SGleb Smirnoff !$5.src.host->ifindex) 41463b3a8eb9SGleb Smirnoff r.af = $5.src.host->af; 41473b3a8eb9SGleb Smirnoff else if ($5.dst.host && $5.dst.host->af && 41483b3a8eb9SGleb Smirnoff !$5.dst.host->ifindex) 41493b3a8eb9SGleb Smirnoff r.af = $5.dst.host->af; 41503b3a8eb9SGleb Smirnoff } 41513b3a8eb9SGleb Smirnoff 41523b3a8eb9SGleb Smirnoff if ($6 != NULL) 41533b3a8eb9SGleb Smirnoff if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 41543b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) { 41553b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 41563b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 41573b3a8eb9SGleb Smirnoff YYERROR; 41583b3a8eb9SGleb Smirnoff } 41593b3a8eb9SGleb Smirnoff 41603b3a8eb9SGleb Smirnoff if ($7.name) 41613b3a8eb9SGleb Smirnoff if (strlcpy(r.match_tagname, $7.name, 41623b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 41633b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 41643b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 41653b3a8eb9SGleb Smirnoff YYERROR; 41663b3a8eb9SGleb Smirnoff } 41673b3a8eb9SGleb Smirnoff r.match_tag_not = $7.neg; 41683b3a8eb9SGleb Smirnoff r.rtableid = $8; 41693b3a8eb9SGleb Smirnoff 41703b3a8eb9SGleb Smirnoff if (r.action == PF_NONAT || r.action == PF_NORDR) { 41713b3a8eb9SGleb Smirnoff if ($9 != NULL) { 41723b3a8eb9SGleb Smirnoff yyerror("translation rule with 'no' " 41733b3a8eb9SGleb Smirnoff "does not need '->'"); 41743b3a8eb9SGleb Smirnoff YYERROR; 41753b3a8eb9SGleb Smirnoff } 41763b3a8eb9SGleb Smirnoff } else { 41773b3a8eb9SGleb Smirnoff if ($9 == NULL || $9->host == NULL) { 41783b3a8eb9SGleb Smirnoff yyerror("translation rule requires '-> " 41793b3a8eb9SGleb Smirnoff "address'"); 41803b3a8eb9SGleb Smirnoff YYERROR; 41813b3a8eb9SGleb Smirnoff } 41823b3a8eb9SGleb Smirnoff if (!r.af && ! $9->host->ifindex) 41833b3a8eb9SGleb Smirnoff r.af = $9->host->af; 41843b3a8eb9SGleb Smirnoff 41853b3a8eb9SGleb Smirnoff remove_invalid_hosts(&$9->host, &r.af); 41863b3a8eb9SGleb Smirnoff if (invalid_redirect($9->host, r.af)) 41873b3a8eb9SGleb Smirnoff YYERROR; 41883b3a8eb9SGleb Smirnoff if (check_netmask($9->host, r.af)) 41893b3a8eb9SGleb Smirnoff YYERROR; 41903b3a8eb9SGleb Smirnoff 41913b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0] = ntohs($9->rport.a); 41923b3a8eb9SGleb Smirnoff 41933b3a8eb9SGleb Smirnoff switch (r.action) { 41943b3a8eb9SGleb Smirnoff case PF_RDR: 41953b3a8eb9SGleb Smirnoff if (!$9->rport.b && $9->rport.t && 41963b3a8eb9SGleb Smirnoff $5.dst.port != NULL) { 41973b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 41983b3a8eb9SGleb Smirnoff ntohs($9->rport.a) + 41993b3a8eb9SGleb Smirnoff (ntohs( 42003b3a8eb9SGleb Smirnoff $5.dst.port->port[1]) - 42013b3a8eb9SGleb Smirnoff ntohs( 42023b3a8eb9SGleb Smirnoff $5.dst.port->port[0])); 42033b3a8eb9SGleb Smirnoff } else 42043b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 42053b3a8eb9SGleb Smirnoff ntohs($9->rport.b); 42063b3a8eb9SGleb Smirnoff break; 42073b3a8eb9SGleb Smirnoff case PF_NAT: 42083b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 42093b3a8eb9SGleb Smirnoff ntohs($9->rport.b); 42103b3a8eb9SGleb Smirnoff if (!r.rpool.proxy_port[0] && 42113b3a8eb9SGleb Smirnoff !r.rpool.proxy_port[1]) { 42123b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0] = 42133b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_LOW; 42143b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 42153b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_HIGH; 42163b3a8eb9SGleb Smirnoff } else if (!r.rpool.proxy_port[1]) 42173b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 42183b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0]; 42193b3a8eb9SGleb Smirnoff break; 42203b3a8eb9SGleb Smirnoff default: 42213b3a8eb9SGleb Smirnoff break; 42223b3a8eb9SGleb Smirnoff } 42233b3a8eb9SGleb Smirnoff 42243b3a8eb9SGleb Smirnoff r.rpool.opts = $10.type; 42253b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) == 42263b3a8eb9SGleb Smirnoff PF_POOL_NONE && ($9->host->next != NULL || 42273b3a8eb9SGleb Smirnoff $9->host->addr.type == PF_ADDR_TABLE || 42283b3a8eb9SGleb Smirnoff DYNIF_MULTIADDR($9->host->addr))) 42293b3a8eb9SGleb Smirnoff r.rpool.opts = PF_POOL_ROUNDROBIN; 42303b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 42313b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 42323b3a8eb9SGleb Smirnoff disallow_table($9->host, "tables are only " 42333b3a8eb9SGleb Smirnoff "supported in round-robin redirection " 42343b3a8eb9SGleb Smirnoff "pools")) 42353b3a8eb9SGleb Smirnoff YYERROR; 42363b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 42373b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN && 42383b3a8eb9SGleb Smirnoff disallow_alias($9->host, "interface (%s) " 42393b3a8eb9SGleb Smirnoff "is only supported in round-robin " 42403b3a8eb9SGleb Smirnoff "redirection pools")) 42413b3a8eb9SGleb Smirnoff YYERROR; 42423b3a8eb9SGleb Smirnoff if ($9->host->next != NULL) { 42433b3a8eb9SGleb Smirnoff if ((r.rpool.opts & PF_POOL_TYPEMASK) != 42443b3a8eb9SGleb Smirnoff PF_POOL_ROUNDROBIN) { 42453b3a8eb9SGleb Smirnoff yyerror("only round-robin " 42463b3a8eb9SGleb Smirnoff "valid for multiple " 42473b3a8eb9SGleb Smirnoff "redirection addresses"); 42483b3a8eb9SGleb Smirnoff YYERROR; 42493b3a8eb9SGleb Smirnoff } 42503b3a8eb9SGleb Smirnoff } 42513b3a8eb9SGleb Smirnoff } 42523b3a8eb9SGleb Smirnoff 42533b3a8eb9SGleb Smirnoff if ($10.key != NULL) 42543b3a8eb9SGleb Smirnoff memcpy(&r.rpool.key, $10.key, 42553b3a8eb9SGleb Smirnoff sizeof(struct pf_poolhashkey)); 42563b3a8eb9SGleb Smirnoff 42573b3a8eb9SGleb Smirnoff if ($10.opts) 42583b3a8eb9SGleb Smirnoff r.rpool.opts |= $10.opts; 42593b3a8eb9SGleb Smirnoff 42603b3a8eb9SGleb Smirnoff if ($10.staticport) { 42613b3a8eb9SGleb Smirnoff if (r.action != PF_NAT) { 42623b3a8eb9SGleb Smirnoff yyerror("the 'static-port' option is " 42633b3a8eb9SGleb Smirnoff "only valid with nat rules"); 42643b3a8eb9SGleb Smirnoff YYERROR; 42653b3a8eb9SGleb Smirnoff } 42663b3a8eb9SGleb Smirnoff if (r.rpool.proxy_port[0] != 42673b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_LOW && 42683b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] != 42693b3a8eb9SGleb Smirnoff PF_NAT_PROXY_PORT_HIGH) { 42703b3a8eb9SGleb Smirnoff yyerror("the 'static-port' option can't" 42713b3a8eb9SGleb Smirnoff " be used when specifying a port" 42723b3a8eb9SGleb Smirnoff " range"); 42733b3a8eb9SGleb Smirnoff YYERROR; 42743b3a8eb9SGleb Smirnoff } 42753b3a8eb9SGleb Smirnoff r.rpool.proxy_port[0] = 0; 42763b3a8eb9SGleb Smirnoff r.rpool.proxy_port[1] = 0; 42773b3a8eb9SGleb Smirnoff } 42783b3a8eb9SGleb Smirnoff 42792aa21096SKurosawa Takahiro if ($10.mape.offset) { 42802aa21096SKurosawa Takahiro if (r.action != PF_NAT) { 42812aa21096SKurosawa Takahiro yyerror("the 'map-e-portset' option is" 42822aa21096SKurosawa Takahiro " only valid with nat rules"); 42832aa21096SKurosawa Takahiro YYERROR; 42842aa21096SKurosawa Takahiro } 42852aa21096SKurosawa Takahiro if ($10.staticport) { 42862aa21096SKurosawa Takahiro yyerror("the 'map-e-portset' option" 42872aa21096SKurosawa Takahiro " can't be used 'static-port'"); 42882aa21096SKurosawa Takahiro YYERROR; 42892aa21096SKurosawa Takahiro } 42902aa21096SKurosawa Takahiro if (r.rpool.proxy_port[0] != 42912aa21096SKurosawa Takahiro PF_NAT_PROXY_PORT_LOW && 42922aa21096SKurosawa Takahiro r.rpool.proxy_port[1] != 42932aa21096SKurosawa Takahiro PF_NAT_PROXY_PORT_HIGH) { 42942aa21096SKurosawa Takahiro yyerror("the 'map-e-portset' option" 42952aa21096SKurosawa Takahiro " can't be used when specifying" 42962aa21096SKurosawa Takahiro " a port range"); 42972aa21096SKurosawa Takahiro YYERROR; 42982aa21096SKurosawa Takahiro } 42992aa21096SKurosawa Takahiro r.rpool.mape = $10.mape; 43002aa21096SKurosawa Takahiro } 43012aa21096SKurosawa Takahiro 43023b3a8eb9SGleb Smirnoff expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 43033b3a8eb9SGleb Smirnoff $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 43043b3a8eb9SGleb Smirnoff $5.dst.port, 0, 0, 0, ""); 43053b3a8eb9SGleb Smirnoff free($9); 43063b3a8eb9SGleb Smirnoff } 43073b3a8eb9SGleb Smirnoff ; 43083b3a8eb9SGleb Smirnoff 43091e93588bSLuiz Otavio O Souza binatrule : no BINAT natpasslog interface af proto FROM ipspec toipspec tag 43103b3a8eb9SGleb Smirnoff tagged rtable redirection 43113b3a8eb9SGleb Smirnoff { 4312e9eb0941SKristof Provost struct pfctl_rule binat; 43133b3a8eb9SGleb Smirnoff struct pf_pooladdr *pa; 43143b3a8eb9SGleb Smirnoff 43153b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_NAT)) 43163b3a8eb9SGleb Smirnoff YYERROR; 43173b3a8eb9SGleb Smirnoff if (disallow_urpf_failed($9, "\"urpf-failed\" is not " 43183b3a8eb9SGleb Smirnoff "permitted as a binat destination")) 43193b3a8eb9SGleb Smirnoff YYERROR; 43203b3a8eb9SGleb Smirnoff 43213b3a8eb9SGleb Smirnoff memset(&binat, 0, sizeof(binat)); 43223b3a8eb9SGleb Smirnoff 43233b3a8eb9SGleb Smirnoff if ($1 && $3.b1) { 43243b3a8eb9SGleb Smirnoff yyerror("\"pass\" not valid with \"no\""); 43253b3a8eb9SGleb Smirnoff YYERROR; 43263b3a8eb9SGleb Smirnoff } 43273b3a8eb9SGleb Smirnoff if ($1) 43283b3a8eb9SGleb Smirnoff binat.action = PF_NOBINAT; 43293b3a8eb9SGleb Smirnoff else 43303b3a8eb9SGleb Smirnoff binat.action = PF_BINAT; 43313b3a8eb9SGleb Smirnoff binat.natpass = $3.b1; 43323b3a8eb9SGleb Smirnoff binat.log = $3.b2; 43333b3a8eb9SGleb Smirnoff binat.logif = $3.w2; 43343b3a8eb9SGleb Smirnoff binat.af = $5; 43353b3a8eb9SGleb Smirnoff if (!binat.af && $8 != NULL && $8->af) 43363b3a8eb9SGleb Smirnoff binat.af = $8->af; 43373b3a8eb9SGleb Smirnoff if (!binat.af && $9 != NULL && $9->af) 43383b3a8eb9SGleb Smirnoff binat.af = $9->af; 43393b3a8eb9SGleb Smirnoff 43403b3a8eb9SGleb Smirnoff if (!binat.af && $13 != NULL && $13->host) 43413b3a8eb9SGleb Smirnoff binat.af = $13->host->af; 43423b3a8eb9SGleb Smirnoff if (!binat.af) { 43433b3a8eb9SGleb Smirnoff yyerror("address family (inet/inet6) " 43443b3a8eb9SGleb Smirnoff "undefined"); 43453b3a8eb9SGleb Smirnoff YYERROR; 43463b3a8eb9SGleb Smirnoff } 43473b3a8eb9SGleb Smirnoff 43483b3a8eb9SGleb Smirnoff if ($4 != NULL) { 43493b3a8eb9SGleb Smirnoff memcpy(binat.ifname, $4->ifname, 43503b3a8eb9SGleb Smirnoff sizeof(binat.ifname)); 43513b3a8eb9SGleb Smirnoff binat.ifnot = $4->not; 43523b3a8eb9SGleb Smirnoff free($4); 43533b3a8eb9SGleb Smirnoff } 43543b3a8eb9SGleb Smirnoff 43553b3a8eb9SGleb Smirnoff if ($10 != NULL) 43563b3a8eb9SGleb Smirnoff if (strlcpy(binat.tagname, $10, 43573b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 43583b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 43593b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 43603b3a8eb9SGleb Smirnoff YYERROR; 43613b3a8eb9SGleb Smirnoff } 43623b3a8eb9SGleb Smirnoff if ($11.name) 43633b3a8eb9SGleb Smirnoff if (strlcpy(binat.match_tagname, $11.name, 43643b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 43653b3a8eb9SGleb Smirnoff yyerror("tag too long, max %u chars", 43663b3a8eb9SGleb Smirnoff PF_TAG_NAME_SIZE - 1); 43673b3a8eb9SGleb Smirnoff YYERROR; 43683b3a8eb9SGleb Smirnoff } 43693b3a8eb9SGleb Smirnoff binat.match_tag_not = $11.neg; 43703b3a8eb9SGleb Smirnoff binat.rtableid = $12; 43713b3a8eb9SGleb Smirnoff 43723b3a8eb9SGleb Smirnoff if ($6 != NULL) { 43733b3a8eb9SGleb Smirnoff binat.proto = $6->proto; 43743b3a8eb9SGleb Smirnoff free($6); 43753b3a8eb9SGleb Smirnoff } 43763b3a8eb9SGleb Smirnoff 43773b3a8eb9SGleb Smirnoff if ($8 != NULL && disallow_table($8, "invalid use of " 43783b3a8eb9SGleb Smirnoff "table <%s> as the source address of a binat rule")) 43793b3a8eb9SGleb Smirnoff YYERROR; 43803b3a8eb9SGleb Smirnoff if ($8 != NULL && disallow_alias($8, "invalid use of " 43813b3a8eb9SGleb Smirnoff "interface (%s) as the source address of a binat " 43823b3a8eb9SGleb Smirnoff "rule")) 43833b3a8eb9SGleb Smirnoff YYERROR; 43843b3a8eb9SGleb Smirnoff if ($13 != NULL && $13->host != NULL && disallow_table( 43853b3a8eb9SGleb Smirnoff $13->host, "invalid use of table <%s> as the " 43863b3a8eb9SGleb Smirnoff "redirect address of a binat rule")) 43873b3a8eb9SGleb Smirnoff YYERROR; 43883b3a8eb9SGleb Smirnoff if ($13 != NULL && $13->host != NULL && disallow_alias( 43893b3a8eb9SGleb Smirnoff $13->host, "invalid use of interface (%s) as the " 43903b3a8eb9SGleb Smirnoff "redirect address of a binat rule")) 43913b3a8eb9SGleb Smirnoff YYERROR; 43923b3a8eb9SGleb Smirnoff 43933b3a8eb9SGleb Smirnoff if ($8 != NULL) { 43943b3a8eb9SGleb Smirnoff if ($8->next) { 43953b3a8eb9SGleb Smirnoff yyerror("multiple binat ip addresses"); 43963b3a8eb9SGleb Smirnoff YYERROR; 43973b3a8eb9SGleb Smirnoff } 43983b3a8eb9SGleb Smirnoff if ($8->addr.type == PF_ADDR_DYNIFTL) 43993b3a8eb9SGleb Smirnoff $8->af = binat.af; 44003b3a8eb9SGleb Smirnoff if ($8->af != binat.af) { 44013b3a8eb9SGleb Smirnoff yyerror("binat ip versions must match"); 44023b3a8eb9SGleb Smirnoff YYERROR; 44033b3a8eb9SGleb Smirnoff } 44043b3a8eb9SGleb Smirnoff if (check_netmask($8, binat.af)) 44053b3a8eb9SGleb Smirnoff YYERROR; 44063b3a8eb9SGleb Smirnoff memcpy(&binat.src.addr, &$8->addr, 44073b3a8eb9SGleb Smirnoff sizeof(binat.src.addr)); 44083b3a8eb9SGleb Smirnoff free($8); 44093b3a8eb9SGleb Smirnoff } 44103b3a8eb9SGleb Smirnoff if ($9 != NULL) { 44113b3a8eb9SGleb Smirnoff if ($9->next) { 44123b3a8eb9SGleb Smirnoff yyerror("multiple binat ip addresses"); 44133b3a8eb9SGleb Smirnoff YYERROR; 44143b3a8eb9SGleb Smirnoff } 44153b3a8eb9SGleb Smirnoff if ($9->af != binat.af && $9->af) { 44163b3a8eb9SGleb Smirnoff yyerror("binat ip versions must match"); 44173b3a8eb9SGleb Smirnoff YYERROR; 44183b3a8eb9SGleb Smirnoff } 44193b3a8eb9SGleb Smirnoff if (check_netmask($9, binat.af)) 44203b3a8eb9SGleb Smirnoff YYERROR; 44213b3a8eb9SGleb Smirnoff memcpy(&binat.dst.addr, &$9->addr, 44223b3a8eb9SGleb Smirnoff sizeof(binat.dst.addr)); 44233b3a8eb9SGleb Smirnoff binat.dst.neg = $9->not; 44243b3a8eb9SGleb Smirnoff free($9); 44253b3a8eb9SGleb Smirnoff } 44263b3a8eb9SGleb Smirnoff 44273b3a8eb9SGleb Smirnoff if (binat.action == PF_NOBINAT) { 44283b3a8eb9SGleb Smirnoff if ($13 != NULL) { 44293b3a8eb9SGleb Smirnoff yyerror("'no binat' rule does not need" 44303b3a8eb9SGleb Smirnoff " '->'"); 44313b3a8eb9SGleb Smirnoff YYERROR; 44323b3a8eb9SGleb Smirnoff } 44333b3a8eb9SGleb Smirnoff } else { 44343b3a8eb9SGleb Smirnoff if ($13 == NULL || $13->host == NULL) { 44353b3a8eb9SGleb Smirnoff yyerror("'binat' rule requires" 44363b3a8eb9SGleb Smirnoff " '-> address'"); 44373b3a8eb9SGleb Smirnoff YYERROR; 44383b3a8eb9SGleb Smirnoff } 44393b3a8eb9SGleb Smirnoff 44403b3a8eb9SGleb Smirnoff remove_invalid_hosts(&$13->host, &binat.af); 44413b3a8eb9SGleb Smirnoff if (invalid_redirect($13->host, binat.af)) 44423b3a8eb9SGleb Smirnoff YYERROR; 44433b3a8eb9SGleb Smirnoff if ($13->host->next != NULL) { 44443b3a8eb9SGleb Smirnoff yyerror("binat rule must redirect to " 44453b3a8eb9SGleb Smirnoff "a single address"); 44463b3a8eb9SGleb Smirnoff YYERROR; 44473b3a8eb9SGleb Smirnoff } 44483b3a8eb9SGleb Smirnoff if (check_netmask($13->host, binat.af)) 44493b3a8eb9SGleb Smirnoff YYERROR; 44503b3a8eb9SGleb Smirnoff 44513b3a8eb9SGleb Smirnoff if (!PF_AZERO(&binat.src.addr.v.a.mask, 44523b3a8eb9SGleb Smirnoff binat.af) && 44533b3a8eb9SGleb Smirnoff !PF_AEQ(&binat.src.addr.v.a.mask, 44543b3a8eb9SGleb Smirnoff &$13->host->addr.v.a.mask, binat.af)) { 44553b3a8eb9SGleb Smirnoff yyerror("'binat' source mask and " 44563b3a8eb9SGleb Smirnoff "redirect mask must be the same"); 44573b3a8eb9SGleb Smirnoff YYERROR; 44583b3a8eb9SGleb Smirnoff } 44593b3a8eb9SGleb Smirnoff 44603b3a8eb9SGleb Smirnoff TAILQ_INIT(&binat.rpool.list); 44613b3a8eb9SGleb Smirnoff pa = calloc(1, sizeof(struct pf_pooladdr)); 44623b3a8eb9SGleb Smirnoff if (pa == NULL) 44633b3a8eb9SGleb Smirnoff err(1, "binat: calloc"); 44643b3a8eb9SGleb Smirnoff pa->addr = $13->host->addr; 44653b3a8eb9SGleb Smirnoff pa->ifname[0] = 0; 44663b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&binat.rpool.list, 44673b3a8eb9SGleb Smirnoff pa, entries); 44683b3a8eb9SGleb Smirnoff 44693b3a8eb9SGleb Smirnoff free($13); 44703b3a8eb9SGleb Smirnoff } 44713b3a8eb9SGleb Smirnoff 44720d71f9f3SKristof Provost pfctl_append_rule(pf, &binat, ""); 44733b3a8eb9SGleb Smirnoff } 44743b3a8eb9SGleb Smirnoff ; 44753b3a8eb9SGleb Smirnoff 44763b3a8eb9SGleb Smirnoff tag : /* empty */ { $$ = NULL; } 44773b3a8eb9SGleb Smirnoff | TAG STRING { $$ = $2; } 44783b3a8eb9SGleb Smirnoff ; 44793b3a8eb9SGleb Smirnoff 44803b3a8eb9SGleb Smirnoff tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 44813b3a8eb9SGleb Smirnoff | not TAGGED string { $$.neg = $1; $$.name = $3; } 44823b3a8eb9SGleb Smirnoff ; 44833b3a8eb9SGleb Smirnoff 44843b3a8eb9SGleb Smirnoff rtable : /* empty */ { $$ = -1; } 44853b3a8eb9SGleb Smirnoff | RTABLE NUMBER { 44863b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > rt_tableid_max()) { 44873b3a8eb9SGleb Smirnoff yyerror("invalid rtable id"); 44883b3a8eb9SGleb Smirnoff YYERROR; 44893b3a8eb9SGleb Smirnoff } 44903b3a8eb9SGleb Smirnoff $$ = $2; 44913b3a8eb9SGleb Smirnoff } 44923b3a8eb9SGleb Smirnoff ; 44933b3a8eb9SGleb Smirnoff 44943b3a8eb9SGleb Smirnoff route_host : STRING { 44953b3a8eb9SGleb Smirnoff $$ = calloc(1, sizeof(struct node_host)); 44963b3a8eb9SGleb Smirnoff if ($$ == NULL) 44973b3a8eb9SGleb Smirnoff err(1, "route_host: calloc"); 4498a2a90d6eSKristof Provost $$->ifname = strdup($1); 44993b3a8eb9SGleb Smirnoff set_ipmask($$, 128); 45003b3a8eb9SGleb Smirnoff $$->next = NULL; 45013b3a8eb9SGleb Smirnoff $$->tail = $$; 45023b3a8eb9SGleb Smirnoff } 45033b3a8eb9SGleb Smirnoff | '(' STRING host ')' { 450458c8430aSKristof Provost struct node_host *n; 450558c8430aSKristof Provost 45063b3a8eb9SGleb Smirnoff $$ = $3; 450758c8430aSKristof Provost for (n = $3; n != NULL; n = n->next) 4508a2a90d6eSKristof Provost n->ifname = strdup($2); 45093b3a8eb9SGleb Smirnoff } 45103b3a8eb9SGleb Smirnoff ; 45113b3a8eb9SGleb Smirnoff 45123b3a8eb9SGleb Smirnoff route_host_list : route_host optnl { $$ = $1; } 45133b3a8eb9SGleb Smirnoff | route_host_list comma route_host optnl { 45143b3a8eb9SGleb Smirnoff if ($1->af == 0) 45153b3a8eb9SGleb Smirnoff $1->af = $3->af; 45163b3a8eb9SGleb Smirnoff if ($1->af != $3->af) { 45173b3a8eb9SGleb Smirnoff yyerror("all pool addresses must be in the " 45183b3a8eb9SGleb Smirnoff "same address family"); 45193b3a8eb9SGleb Smirnoff YYERROR; 45203b3a8eb9SGleb Smirnoff } 45213b3a8eb9SGleb Smirnoff $1->tail->next = $3; 45223b3a8eb9SGleb Smirnoff $1->tail = $3->tail; 45233b3a8eb9SGleb Smirnoff $$ = $1; 45243b3a8eb9SGleb Smirnoff } 45253b3a8eb9SGleb Smirnoff ; 45263b3a8eb9SGleb Smirnoff 45273b3a8eb9SGleb Smirnoff routespec : route_host { $$ = $1; } 45283b3a8eb9SGleb Smirnoff | '{' optnl route_host_list '}' { $$ = $3; } 45293b3a8eb9SGleb Smirnoff ; 45303b3a8eb9SGleb Smirnoff 45313b3a8eb9SGleb Smirnoff route : /* empty */ { 45323b3a8eb9SGleb Smirnoff $$.host = NULL; 45333b3a8eb9SGleb Smirnoff $$.rt = 0; 45343b3a8eb9SGleb Smirnoff $$.pool_opts = 0; 45353b3a8eb9SGleb Smirnoff } 45363b3a8eb9SGleb Smirnoff | FASTROUTE { 4537813196a1SKristof Provost /* backwards-compat */ 45383b3a8eb9SGleb Smirnoff $$.host = NULL; 4539813196a1SKristof Provost $$.rt = 0; 45403b3a8eb9SGleb Smirnoff $$.pool_opts = 0; 45413b3a8eb9SGleb Smirnoff } 45423b3a8eb9SGleb Smirnoff | ROUTETO routespec pool_opts { 45433b3a8eb9SGleb Smirnoff $$.host = $2; 45443b3a8eb9SGleb Smirnoff $$.rt = PF_ROUTETO; 45453b3a8eb9SGleb Smirnoff $$.pool_opts = $3.type | $3.opts; 45463b3a8eb9SGleb Smirnoff if ($3.key != NULL) 45473b3a8eb9SGleb Smirnoff $$.key = $3.key; 45483b3a8eb9SGleb Smirnoff } 45493b3a8eb9SGleb Smirnoff | REPLYTO routespec pool_opts { 45503b3a8eb9SGleb Smirnoff $$.host = $2; 45513b3a8eb9SGleb Smirnoff $$.rt = PF_REPLYTO; 45523b3a8eb9SGleb Smirnoff $$.pool_opts = $3.type | $3.opts; 45533b3a8eb9SGleb Smirnoff if ($3.key != NULL) 45543b3a8eb9SGleb Smirnoff $$.key = $3.key; 45553b3a8eb9SGleb Smirnoff } 45563b3a8eb9SGleb Smirnoff | DUPTO routespec pool_opts { 45573b3a8eb9SGleb Smirnoff $$.host = $2; 45583b3a8eb9SGleb Smirnoff $$.rt = PF_DUPTO; 45593b3a8eb9SGleb Smirnoff $$.pool_opts = $3.type | $3.opts; 45603b3a8eb9SGleb Smirnoff if ($3.key != NULL) 45613b3a8eb9SGleb Smirnoff $$.key = $3.key; 45623b3a8eb9SGleb Smirnoff } 45633b3a8eb9SGleb Smirnoff ; 45643b3a8eb9SGleb Smirnoff 45653b3a8eb9SGleb Smirnoff timeout_spec : STRING NUMBER 45663b3a8eb9SGleb Smirnoff { 45673b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 45683b3a8eb9SGleb Smirnoff free($1); 45693b3a8eb9SGleb Smirnoff YYERROR; 45703b3a8eb9SGleb Smirnoff } 45713b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 45723b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 45733b3a8eb9SGleb Smirnoff YYERROR; 45743b3a8eb9SGleb Smirnoff } 45753b3a8eb9SGleb Smirnoff if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 45763b3a8eb9SGleb Smirnoff yyerror("unknown timeout %s", $1); 45773b3a8eb9SGleb Smirnoff free($1); 45783b3a8eb9SGleb Smirnoff YYERROR; 45793b3a8eb9SGleb Smirnoff } 45803b3a8eb9SGleb Smirnoff free($1); 45813b3a8eb9SGleb Smirnoff } 45827f8af000SLuiz Otavio O Souza | INTERVAL NUMBER { 45837f8af000SLuiz Otavio O Souza if (check_rulestate(PFCTL_STATE_OPTION)) 45847f8af000SLuiz Otavio O Souza YYERROR; 45857f8af000SLuiz Otavio O Souza if ($2 < 0 || $2 > UINT_MAX) { 45867f8af000SLuiz Otavio O Souza yyerror("only positive values permitted"); 45877f8af000SLuiz Otavio O Souza YYERROR; 45887f8af000SLuiz Otavio O Souza } 45897f8af000SLuiz Otavio O Souza if (pfctl_set_timeout(pf, "interval", $2, 0) != 0) 45907f8af000SLuiz Otavio O Souza YYERROR; 45917f8af000SLuiz Otavio O Souza } 45923b3a8eb9SGleb Smirnoff ; 45933b3a8eb9SGleb Smirnoff 45943b3a8eb9SGleb Smirnoff timeout_list : timeout_list comma timeout_spec optnl 45953b3a8eb9SGleb Smirnoff | timeout_spec optnl 45963b3a8eb9SGleb Smirnoff ; 45973b3a8eb9SGleb Smirnoff 45983b3a8eb9SGleb Smirnoff limit_spec : STRING NUMBER 45993b3a8eb9SGleb Smirnoff { 46003b3a8eb9SGleb Smirnoff if (check_rulestate(PFCTL_STATE_OPTION)) { 46013b3a8eb9SGleb Smirnoff free($1); 46023b3a8eb9SGleb Smirnoff YYERROR; 46033b3a8eb9SGleb Smirnoff } 46043b3a8eb9SGleb Smirnoff if ($2 < 0 || $2 > UINT_MAX) { 46053b3a8eb9SGleb Smirnoff yyerror("only positive values permitted"); 46063b3a8eb9SGleb Smirnoff YYERROR; 46073b3a8eb9SGleb Smirnoff } 46083b3a8eb9SGleb Smirnoff if (pfctl_set_limit(pf, $1, $2) != 0) { 46093b3a8eb9SGleb Smirnoff yyerror("unable to set limit %s %u", $1, $2); 46103b3a8eb9SGleb Smirnoff free($1); 46113b3a8eb9SGleb Smirnoff YYERROR; 46123b3a8eb9SGleb Smirnoff } 46133b3a8eb9SGleb Smirnoff free($1); 46143b3a8eb9SGleb Smirnoff } 46153b3a8eb9SGleb Smirnoff ; 46163b3a8eb9SGleb Smirnoff 46173b3a8eb9SGleb Smirnoff limit_list : limit_list comma limit_spec optnl 46183b3a8eb9SGleb Smirnoff | limit_spec optnl 46193b3a8eb9SGleb Smirnoff ; 46203b3a8eb9SGleb Smirnoff 46213b3a8eb9SGleb Smirnoff comma : ',' 46223b3a8eb9SGleb Smirnoff | /* empty */ 46233b3a8eb9SGleb Smirnoff ; 46243b3a8eb9SGleb Smirnoff 46253b3a8eb9SGleb Smirnoff yesno : NO { $$ = 0; } 46263b3a8eb9SGleb Smirnoff | STRING { 46273b3a8eb9SGleb Smirnoff if (!strcmp($1, "yes")) 46283b3a8eb9SGleb Smirnoff $$ = 1; 46293b3a8eb9SGleb Smirnoff else { 46303b3a8eb9SGleb Smirnoff yyerror("invalid value '%s', expected 'yes' " 46313b3a8eb9SGleb Smirnoff "or 'no'", $1); 46323b3a8eb9SGleb Smirnoff free($1); 46333b3a8eb9SGleb Smirnoff YYERROR; 46343b3a8eb9SGleb Smirnoff } 46353b3a8eb9SGleb Smirnoff free($1); 46363b3a8eb9SGleb Smirnoff } 46373b3a8eb9SGleb Smirnoff ; 46383b3a8eb9SGleb Smirnoff 46393b3a8eb9SGleb Smirnoff unaryop : '=' { $$ = PF_OP_EQ; } 46403b3a8eb9SGleb Smirnoff | '!' '=' { $$ = PF_OP_NE; } 46413b3a8eb9SGleb Smirnoff | '<' '=' { $$ = PF_OP_LE; } 46423b3a8eb9SGleb Smirnoff | '<' { $$ = PF_OP_LT; } 46433b3a8eb9SGleb Smirnoff | '>' '=' { $$ = PF_OP_GE; } 46443b3a8eb9SGleb Smirnoff | '>' { $$ = PF_OP_GT; } 46453b3a8eb9SGleb Smirnoff ; 46463b3a8eb9SGleb Smirnoff 46473b3a8eb9SGleb Smirnoff %% 46483b3a8eb9SGleb Smirnoff 46493b3a8eb9SGleb Smirnoff int 46503b3a8eb9SGleb Smirnoff yyerror(const char *fmt, ...) 46513b3a8eb9SGleb Smirnoff { 46523b3a8eb9SGleb Smirnoff va_list ap; 46533b3a8eb9SGleb Smirnoff 46543b3a8eb9SGleb Smirnoff file->errors++; 46553b3a8eb9SGleb Smirnoff va_start(ap, fmt); 46563b3a8eb9SGleb Smirnoff fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 46573b3a8eb9SGleb Smirnoff vfprintf(stderr, fmt, ap); 46583b3a8eb9SGleb Smirnoff fprintf(stderr, "\n"); 46593b3a8eb9SGleb Smirnoff va_end(ap); 46603b3a8eb9SGleb Smirnoff return (0); 46613b3a8eb9SGleb Smirnoff } 46623b3a8eb9SGleb Smirnoff 46633b3a8eb9SGleb Smirnoff int 46643b3a8eb9SGleb Smirnoff disallow_table(struct node_host *h, const char *fmt) 46653b3a8eb9SGleb Smirnoff { 46663b3a8eb9SGleb Smirnoff for (; h != NULL; h = h->next) 46673b3a8eb9SGleb Smirnoff if (h->addr.type == PF_ADDR_TABLE) { 46683b3a8eb9SGleb Smirnoff yyerror(fmt, h->addr.v.tblname); 46693b3a8eb9SGleb Smirnoff return (1); 46703b3a8eb9SGleb Smirnoff } 46713b3a8eb9SGleb Smirnoff return (0); 46723b3a8eb9SGleb Smirnoff } 46733b3a8eb9SGleb Smirnoff 46743b3a8eb9SGleb Smirnoff int 46753b3a8eb9SGleb Smirnoff disallow_urpf_failed(struct node_host *h, const char *fmt) 46763b3a8eb9SGleb Smirnoff { 46773b3a8eb9SGleb Smirnoff for (; h != NULL; h = h->next) 46783b3a8eb9SGleb Smirnoff if (h->addr.type == PF_ADDR_URPFFAILED) { 46793b3a8eb9SGleb Smirnoff yyerror(fmt); 46803b3a8eb9SGleb Smirnoff return (1); 46813b3a8eb9SGleb Smirnoff } 46823b3a8eb9SGleb Smirnoff return (0); 46833b3a8eb9SGleb Smirnoff } 46843b3a8eb9SGleb Smirnoff 46853b3a8eb9SGleb Smirnoff int 46863b3a8eb9SGleb Smirnoff disallow_alias(struct node_host *h, const char *fmt) 46873b3a8eb9SGleb Smirnoff { 46883b3a8eb9SGleb Smirnoff for (; h != NULL; h = h->next) 46893b3a8eb9SGleb Smirnoff if (DYNIF_MULTIADDR(h->addr)) { 46903b3a8eb9SGleb Smirnoff yyerror(fmt, h->addr.v.tblname); 46913b3a8eb9SGleb Smirnoff return (1); 46923b3a8eb9SGleb Smirnoff } 46933b3a8eb9SGleb Smirnoff return (0); 46943b3a8eb9SGleb Smirnoff } 46953b3a8eb9SGleb Smirnoff 46963b3a8eb9SGleb Smirnoff int 4697e9eb0941SKristof Provost rule_consistent(struct pfctl_rule *r, int anchor_call) 46983b3a8eb9SGleb Smirnoff { 46993b3a8eb9SGleb Smirnoff int problems = 0; 47003b3a8eb9SGleb Smirnoff 47013b3a8eb9SGleb Smirnoff switch (r->action) { 47023b3a8eb9SGleb Smirnoff case PF_PASS: 47033b3a8eb9SGleb Smirnoff case PF_DROP: 47043b3a8eb9SGleb Smirnoff case PF_SCRUB: 47053b3a8eb9SGleb Smirnoff case PF_NOSCRUB: 47063b3a8eb9SGleb Smirnoff problems = filter_consistent(r, anchor_call); 47073b3a8eb9SGleb Smirnoff break; 47083b3a8eb9SGleb Smirnoff case PF_NAT: 47093b3a8eb9SGleb Smirnoff case PF_NONAT: 47103b3a8eb9SGleb Smirnoff problems = nat_consistent(r); 47113b3a8eb9SGleb Smirnoff break; 47123b3a8eb9SGleb Smirnoff case PF_RDR: 47133b3a8eb9SGleb Smirnoff case PF_NORDR: 47143b3a8eb9SGleb Smirnoff problems = rdr_consistent(r); 47153b3a8eb9SGleb Smirnoff break; 47163b3a8eb9SGleb Smirnoff case PF_BINAT: 47173b3a8eb9SGleb Smirnoff case PF_NOBINAT: 47183b3a8eb9SGleb Smirnoff default: 47193b3a8eb9SGleb Smirnoff break; 47203b3a8eb9SGleb Smirnoff } 47213b3a8eb9SGleb Smirnoff return (problems); 47223b3a8eb9SGleb Smirnoff } 47233b3a8eb9SGleb Smirnoff 47243b3a8eb9SGleb Smirnoff int 4725e9eb0941SKristof Provost filter_consistent(struct pfctl_rule *r, int anchor_call) 47263b3a8eb9SGleb Smirnoff { 47273b3a8eb9SGleb Smirnoff int problems = 0; 47283b3a8eb9SGleb Smirnoff 47293b3a8eb9SGleb Smirnoff if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 47303b3a8eb9SGleb Smirnoff (r->src.port_op || r->dst.port_op)) { 47313b3a8eb9SGleb Smirnoff yyerror("port only applies to tcp/udp"); 47323b3a8eb9SGleb Smirnoff problems++; 47333b3a8eb9SGleb Smirnoff } 47343b3a8eb9SGleb Smirnoff if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 47353b3a8eb9SGleb Smirnoff (r->type || r->code)) { 47363b3a8eb9SGleb Smirnoff yyerror("icmp-type/code only applies to icmp"); 47373b3a8eb9SGleb Smirnoff problems++; 47383b3a8eb9SGleb Smirnoff } 47393b3a8eb9SGleb Smirnoff if (!r->af && (r->type || r->code)) { 47403b3a8eb9SGleb Smirnoff yyerror("must indicate address family with icmp-type/code"); 47413b3a8eb9SGleb Smirnoff problems++; 47423b3a8eb9SGleb Smirnoff } 47433b3a8eb9SGleb Smirnoff if (r->overload_tblname[0] && 47443b3a8eb9SGleb Smirnoff r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 47453b3a8eb9SGleb Smirnoff yyerror("'overload' requires 'max-src-conn' " 47463b3a8eb9SGleb Smirnoff "or 'max-src-conn-rate'"); 47473b3a8eb9SGleb Smirnoff problems++; 47483b3a8eb9SGleb Smirnoff } 47493b3a8eb9SGleb Smirnoff if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 47503b3a8eb9SGleb Smirnoff (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 47513b3a8eb9SGleb Smirnoff yyerror("proto %s doesn't match address family %s", 47523b3a8eb9SGleb Smirnoff r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 47533b3a8eb9SGleb Smirnoff r->af == AF_INET ? "inet" : "inet6"); 47543b3a8eb9SGleb Smirnoff problems++; 47553b3a8eb9SGleb Smirnoff } 47563b3a8eb9SGleb Smirnoff if (r->allow_opts && r->action != PF_PASS) { 47573b3a8eb9SGleb Smirnoff yyerror("allow-opts can only be specified for pass rules"); 47583b3a8eb9SGleb Smirnoff problems++; 47593b3a8eb9SGleb Smirnoff } 47603b3a8eb9SGleb Smirnoff if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 47613b3a8eb9SGleb Smirnoff r->dst.port_op || r->flagset || r->type || r->code)) { 47623b3a8eb9SGleb Smirnoff yyerror("fragments can be filtered only on IP header fields"); 47633b3a8eb9SGleb Smirnoff problems++; 47643b3a8eb9SGleb Smirnoff } 47653b3a8eb9SGleb Smirnoff if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 47663b3a8eb9SGleb Smirnoff yyerror("return-rst can only be applied to TCP rules"); 47673b3a8eb9SGleb Smirnoff problems++; 47683b3a8eb9SGleb Smirnoff } 47693b3a8eb9SGleb Smirnoff if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 47703b3a8eb9SGleb Smirnoff yyerror("max-src-nodes requires 'source-track rule'"); 47713b3a8eb9SGleb Smirnoff problems++; 47723b3a8eb9SGleb Smirnoff } 47733b3a8eb9SGleb Smirnoff if (r->action == PF_DROP && r->keep_state) { 47743b3a8eb9SGleb Smirnoff yyerror("keep state on block rules doesn't make sense"); 47753b3a8eb9SGleb Smirnoff problems++; 47763b3a8eb9SGleb Smirnoff } 47773b3a8eb9SGleb Smirnoff if (r->rule_flag & PFRULE_STATESLOPPY && 47783b3a8eb9SGleb Smirnoff (r->keep_state == PF_STATE_MODULATE || 47793b3a8eb9SGleb Smirnoff r->keep_state == PF_STATE_SYNPROXY)) { 47803b3a8eb9SGleb Smirnoff yyerror("sloppy state matching cannot be used with " 47813b3a8eb9SGleb Smirnoff "synproxy state or modulate state"); 47823b3a8eb9SGleb Smirnoff problems++; 47833b3a8eb9SGleb Smirnoff } 47843b3a8eb9SGleb Smirnoff return (-problems); 47853b3a8eb9SGleb Smirnoff } 47863b3a8eb9SGleb Smirnoff 47873b3a8eb9SGleb Smirnoff int 4788e9eb0941SKristof Provost nat_consistent(struct pfctl_rule *r) 47893b3a8eb9SGleb Smirnoff { 47903b3a8eb9SGleb Smirnoff return (0); /* yeah! */ 47913b3a8eb9SGleb Smirnoff } 47923b3a8eb9SGleb Smirnoff 47933b3a8eb9SGleb Smirnoff int 4794e9eb0941SKristof Provost rdr_consistent(struct pfctl_rule *r) 47953b3a8eb9SGleb Smirnoff { 47963b3a8eb9SGleb Smirnoff int problems = 0; 47973b3a8eb9SGleb Smirnoff 47983b3a8eb9SGleb Smirnoff if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 47993b3a8eb9SGleb Smirnoff if (r->src.port_op) { 48003b3a8eb9SGleb Smirnoff yyerror("src port only applies to tcp/udp"); 48013b3a8eb9SGleb Smirnoff problems++; 48023b3a8eb9SGleb Smirnoff } 48033b3a8eb9SGleb Smirnoff if (r->dst.port_op) { 48043b3a8eb9SGleb Smirnoff yyerror("dst port only applies to tcp/udp"); 48053b3a8eb9SGleb Smirnoff problems++; 48063b3a8eb9SGleb Smirnoff } 48073b3a8eb9SGleb Smirnoff if (r->rpool.proxy_port[0]) { 48083b3a8eb9SGleb Smirnoff yyerror("rpool port only applies to tcp/udp"); 48093b3a8eb9SGleb Smirnoff problems++; 48103b3a8eb9SGleb Smirnoff } 48113b3a8eb9SGleb Smirnoff } 48123b3a8eb9SGleb Smirnoff if (r->dst.port_op && 48133b3a8eb9SGleb Smirnoff r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 48143b3a8eb9SGleb Smirnoff yyerror("invalid port operator for rdr destination port"); 48153b3a8eb9SGleb Smirnoff problems++; 48163b3a8eb9SGleb Smirnoff } 48173b3a8eb9SGleb Smirnoff return (-problems); 48183b3a8eb9SGleb Smirnoff } 48193b3a8eb9SGleb Smirnoff 48203b3a8eb9SGleb Smirnoff int 48213b3a8eb9SGleb Smirnoff process_tabledef(char *name, struct table_opts *opts) 48223b3a8eb9SGleb Smirnoff { 48233b3a8eb9SGleb Smirnoff struct pfr_buffer ab; 48243b3a8eb9SGleb Smirnoff struct node_tinit *ti; 4825542feeffSKristof Provost unsigned long maxcount; 4826542feeffSKristof Provost size_t s = sizeof(maxcount); 48273b3a8eb9SGleb Smirnoff 48283b3a8eb9SGleb Smirnoff bzero(&ab, sizeof(ab)); 48293b3a8eb9SGleb Smirnoff ab.pfrb_type = PFRB_ADDRS; 48303b3a8eb9SGleb Smirnoff SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 48313b3a8eb9SGleb Smirnoff if (ti->file) 48323b3a8eb9SGleb Smirnoff if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 48333b3a8eb9SGleb Smirnoff if (errno) 48343b3a8eb9SGleb Smirnoff yyerror("cannot load \"%s\": %s", 48353b3a8eb9SGleb Smirnoff ti->file, strerror(errno)); 48363b3a8eb9SGleb Smirnoff else 48373b3a8eb9SGleb Smirnoff yyerror("file \"%s\" contains bad data", 48383b3a8eb9SGleb Smirnoff ti->file); 48393b3a8eb9SGleb Smirnoff goto _error; 48403b3a8eb9SGleb Smirnoff } 48413b3a8eb9SGleb Smirnoff if (ti->host) 48423b3a8eb9SGleb Smirnoff if (append_addr_host(&ab, ti->host, 0, 0)) { 48433b3a8eb9SGleb Smirnoff yyerror("cannot create address buffer: %s", 48443b3a8eb9SGleb Smirnoff strerror(errno)); 48453b3a8eb9SGleb Smirnoff goto _error; 48463b3a8eb9SGleb Smirnoff } 48473b3a8eb9SGleb Smirnoff } 48483b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 48493b3a8eb9SGleb Smirnoff print_tabledef(name, opts->flags, opts->init_addr, 48503b3a8eb9SGleb Smirnoff &opts->init_nodes); 48513b3a8eb9SGleb Smirnoff if (!(pf->opts & PF_OPT_NOACTION) && 48523b3a8eb9SGleb Smirnoff pfctl_define_table(name, opts->flags, opts->init_addr, 48533b3a8eb9SGleb Smirnoff pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4854542feeffSKristof Provost 4855542feeffSKristof Provost if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, 4856542feeffSKristof Provost NULL, 0) == -1) 4857542feeffSKristof Provost maxcount = 65535; 4858542feeffSKristof Provost 4859542feeffSKristof Provost if (ab.pfrb_size > maxcount) 4860542feeffSKristof Provost yyerror("cannot define table %s: too many elements.\n" 4861542feeffSKristof Provost "Consider increasing net.pf.request_maxcount.", 4862542feeffSKristof Provost name); 4863542feeffSKristof Provost else 48643b3a8eb9SGleb Smirnoff yyerror("cannot define table %s: %s", name, 48653b3a8eb9SGleb Smirnoff pfr_strerror(errno)); 4866542feeffSKristof Provost 48673b3a8eb9SGleb Smirnoff goto _error; 48683b3a8eb9SGleb Smirnoff } 48693b3a8eb9SGleb Smirnoff pf->tdirty = 1; 48703b3a8eb9SGleb Smirnoff pfr_buf_clear(&ab); 48713b3a8eb9SGleb Smirnoff return (0); 48723b3a8eb9SGleb Smirnoff _error: 48733b3a8eb9SGleb Smirnoff pfr_buf_clear(&ab); 48743b3a8eb9SGleb Smirnoff return (-1); 48753b3a8eb9SGleb Smirnoff } 48763b3a8eb9SGleb Smirnoff 48773b3a8eb9SGleb Smirnoff struct keywords { 48783b3a8eb9SGleb Smirnoff const char *k_name; 48793b3a8eb9SGleb Smirnoff int k_val; 48803b3a8eb9SGleb Smirnoff }; 48813b3a8eb9SGleb Smirnoff 48823b3a8eb9SGleb Smirnoff /* macro gore, but you should've seen the prior indentation nightmare... */ 48833b3a8eb9SGleb Smirnoff 48843b3a8eb9SGleb Smirnoff #define FREE_LIST(T,r) \ 48853b3a8eb9SGleb Smirnoff do { \ 48863b3a8eb9SGleb Smirnoff T *p, *node = r; \ 48873b3a8eb9SGleb Smirnoff while (node != NULL) { \ 48883b3a8eb9SGleb Smirnoff p = node; \ 48893b3a8eb9SGleb Smirnoff node = node->next; \ 48903b3a8eb9SGleb Smirnoff free(p); \ 48913b3a8eb9SGleb Smirnoff } \ 48923b3a8eb9SGleb Smirnoff } while (0) 48933b3a8eb9SGleb Smirnoff 48943b3a8eb9SGleb Smirnoff #define LOOP_THROUGH(T,n,r,C) \ 48953b3a8eb9SGleb Smirnoff do { \ 48963b3a8eb9SGleb Smirnoff T *n; \ 48973b3a8eb9SGleb Smirnoff if (r == NULL) { \ 48983b3a8eb9SGleb Smirnoff r = calloc(1, sizeof(T)); \ 48993b3a8eb9SGleb Smirnoff if (r == NULL) \ 49003b3a8eb9SGleb Smirnoff err(1, "LOOP: calloc"); \ 49013b3a8eb9SGleb Smirnoff r->next = NULL; \ 49023b3a8eb9SGleb Smirnoff } \ 49033b3a8eb9SGleb Smirnoff n = r; \ 49043b3a8eb9SGleb Smirnoff while (n != NULL) { \ 49053b3a8eb9SGleb Smirnoff do { \ 49063b3a8eb9SGleb Smirnoff C; \ 49073b3a8eb9SGleb Smirnoff } while (0); \ 49083b3a8eb9SGleb Smirnoff n = n->next; \ 49093b3a8eb9SGleb Smirnoff } \ 49103b3a8eb9SGleb Smirnoff } while (0) 49113b3a8eb9SGleb Smirnoff 49123b3a8eb9SGleb Smirnoff void 49133b3a8eb9SGleb Smirnoff expand_label_str(char *label, size_t len, const char *srch, const char *repl) 49143b3a8eb9SGleb Smirnoff { 49153b3a8eb9SGleb Smirnoff char *tmp; 49163b3a8eb9SGleb Smirnoff char *p, *q; 49173b3a8eb9SGleb Smirnoff 49183b3a8eb9SGleb Smirnoff if ((tmp = calloc(1, len)) == NULL) 49193b3a8eb9SGleb Smirnoff err(1, "expand_label_str: calloc"); 49203b3a8eb9SGleb Smirnoff p = q = label; 49213b3a8eb9SGleb Smirnoff while ((q = strstr(p, srch)) != NULL) { 49223b3a8eb9SGleb Smirnoff *q = '\0'; 49233b3a8eb9SGleb Smirnoff if ((strlcat(tmp, p, len) >= len) || 49243b3a8eb9SGleb Smirnoff (strlcat(tmp, repl, len) >= len)) 49253b3a8eb9SGleb Smirnoff errx(1, "expand_label: label too long"); 49263b3a8eb9SGleb Smirnoff q += strlen(srch); 49273b3a8eb9SGleb Smirnoff p = q; 49283b3a8eb9SGleb Smirnoff } 49293b3a8eb9SGleb Smirnoff if (strlcat(tmp, p, len) >= len) 49303b3a8eb9SGleb Smirnoff errx(1, "expand_label: label too long"); 49313b3a8eb9SGleb Smirnoff strlcpy(label, tmp, len); /* always fits */ 49323b3a8eb9SGleb Smirnoff free(tmp); 49333b3a8eb9SGleb Smirnoff } 49343b3a8eb9SGleb Smirnoff 49353b3a8eb9SGleb Smirnoff void 49363b3a8eb9SGleb Smirnoff expand_label_if(const char *name, char *label, size_t len, const char *ifname) 49373b3a8eb9SGleb Smirnoff { 49383b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 49393b3a8eb9SGleb Smirnoff if (!*ifname) 49403b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, "any"); 49413b3a8eb9SGleb Smirnoff else 49423b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, ifname); 49433b3a8eb9SGleb Smirnoff } 49443b3a8eb9SGleb Smirnoff } 49453b3a8eb9SGleb Smirnoff 49463b3a8eb9SGleb Smirnoff void 49473b3a8eb9SGleb Smirnoff expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 49483b3a8eb9SGleb Smirnoff struct node_host *h) 49493b3a8eb9SGleb Smirnoff { 49503b3a8eb9SGleb Smirnoff char tmp[64], tmp_not[66]; 49513b3a8eb9SGleb Smirnoff 49523b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 49533b3a8eb9SGleb Smirnoff switch (h->addr.type) { 49543b3a8eb9SGleb Smirnoff case PF_ADDR_DYNIFTL: 49553b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 49563b3a8eb9SGleb Smirnoff break; 49573b3a8eb9SGleb Smirnoff case PF_ADDR_TABLE: 49583b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 49593b3a8eb9SGleb Smirnoff break; 49603b3a8eb9SGleb Smirnoff case PF_ADDR_NOROUTE: 49613b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "no-route"); 49623b3a8eb9SGleb Smirnoff break; 49633b3a8eb9SGleb Smirnoff case PF_ADDR_URPFFAILED: 49643b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "urpf-failed"); 49653b3a8eb9SGleb Smirnoff break; 49663b3a8eb9SGleb Smirnoff case PF_ADDR_ADDRMASK: 49673b3a8eb9SGleb Smirnoff if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 49683b3a8eb9SGleb Smirnoff PF_AZERO(&h->addr.v.a.mask, af))) 49693b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "any"); 49703b3a8eb9SGleb Smirnoff else { 49713b3a8eb9SGleb Smirnoff char a[48]; 49723b3a8eb9SGleb Smirnoff int bits; 49733b3a8eb9SGleb Smirnoff 49743b3a8eb9SGleb Smirnoff if (inet_ntop(af, &h->addr.v.a.addr, a, 49753b3a8eb9SGleb Smirnoff sizeof(a)) == NULL) 49763b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "?"); 49773b3a8eb9SGleb Smirnoff else { 49783b3a8eb9SGleb Smirnoff bits = unmask(&h->addr.v.a.mask, af); 49793b3a8eb9SGleb Smirnoff if ((af == AF_INET && bits < 32) || 49803b3a8eb9SGleb Smirnoff (af == AF_INET6 && bits < 128)) 49813b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), 49823b3a8eb9SGleb Smirnoff "%s/%d", a, bits); 49833b3a8eb9SGleb Smirnoff else 49843b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), 49853b3a8eb9SGleb Smirnoff "%s", a); 49863b3a8eb9SGleb Smirnoff } 49873b3a8eb9SGleb Smirnoff } 49883b3a8eb9SGleb Smirnoff break; 49893b3a8eb9SGleb Smirnoff default: 49903b3a8eb9SGleb Smirnoff snprintf(tmp, sizeof(tmp), "?"); 49913b3a8eb9SGleb Smirnoff break; 49923b3a8eb9SGleb Smirnoff } 49933b3a8eb9SGleb Smirnoff 49943b3a8eb9SGleb Smirnoff if (h->not) { 49953b3a8eb9SGleb Smirnoff snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 49963b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, tmp_not); 49973b3a8eb9SGleb Smirnoff } else 49983b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, tmp); 49993b3a8eb9SGleb Smirnoff } 50003b3a8eb9SGleb Smirnoff } 50013b3a8eb9SGleb Smirnoff 50023b3a8eb9SGleb Smirnoff void 50033b3a8eb9SGleb Smirnoff expand_label_port(const char *name, char *label, size_t len, 50043b3a8eb9SGleb Smirnoff struct node_port *port) 50053b3a8eb9SGleb Smirnoff { 50063b3a8eb9SGleb Smirnoff char a1[6], a2[6], op[13] = ""; 50073b3a8eb9SGleb Smirnoff 50083b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 50093b3a8eb9SGleb Smirnoff snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 50103b3a8eb9SGleb Smirnoff snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 50113b3a8eb9SGleb Smirnoff if (!port->op) 50123b3a8eb9SGleb Smirnoff ; 50133b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_IRG) 50143b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "%s><%s", a1, a2); 50153b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_XRG) 50163b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "%s<>%s", a1, a2); 50173b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_EQ) 50183b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "%s", a1); 50193b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_NE) 50203b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "!=%s", a1); 50213b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_LT) 50223b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "<%s", a1); 50233b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_LE) 50243b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), "<=%s", a1); 50253b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_GT) 50263b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), ">%s", a1); 50273b3a8eb9SGleb Smirnoff else if (port->op == PF_OP_GE) 50283b3a8eb9SGleb Smirnoff snprintf(op, sizeof(op), ">=%s", a1); 50293b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, op); 50303b3a8eb9SGleb Smirnoff } 50313b3a8eb9SGleb Smirnoff } 50323b3a8eb9SGleb Smirnoff 50333b3a8eb9SGleb Smirnoff void 50343b3a8eb9SGleb Smirnoff expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 50353b3a8eb9SGleb Smirnoff { 5036858937beSMateusz Guzik const char *protoname; 50373b3a8eb9SGleb Smirnoff char n[4]; 50383b3a8eb9SGleb Smirnoff 50393b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 5040858937beSMateusz Guzik protoname = pfctl_proto2name(proto); 5041858937beSMateusz Guzik if (protoname != NULL) 5042858937beSMateusz Guzik expand_label_str(label, len, name, protoname); 50433b3a8eb9SGleb Smirnoff else { 50443b3a8eb9SGleb Smirnoff snprintf(n, sizeof(n), "%u", proto); 50453b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, n); 50463b3a8eb9SGleb Smirnoff } 50473b3a8eb9SGleb Smirnoff } 50483b3a8eb9SGleb Smirnoff } 50493b3a8eb9SGleb Smirnoff 50503b3a8eb9SGleb Smirnoff void 50513b3a8eb9SGleb Smirnoff expand_label_nr(const char *name, char *label, size_t len) 50523b3a8eb9SGleb Smirnoff { 50533b3a8eb9SGleb Smirnoff char n[11]; 50543b3a8eb9SGleb Smirnoff 50553b3a8eb9SGleb Smirnoff if (strstr(label, name) != NULL) { 50563b3a8eb9SGleb Smirnoff snprintf(n, sizeof(n), "%u", pf->anchor->match); 50573b3a8eb9SGleb Smirnoff expand_label_str(label, len, name, n); 50583b3a8eb9SGleb Smirnoff } 50593b3a8eb9SGleb Smirnoff } 50603b3a8eb9SGleb Smirnoff 50613b3a8eb9SGleb Smirnoff void 50623b3a8eb9SGleb Smirnoff expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 50633b3a8eb9SGleb Smirnoff struct node_host *src_host, struct node_port *src_port, 50643b3a8eb9SGleb Smirnoff struct node_host *dst_host, struct node_port *dst_port, 50653b3a8eb9SGleb Smirnoff u_int8_t proto) 50663b3a8eb9SGleb Smirnoff { 50673b3a8eb9SGleb Smirnoff expand_label_if("$if", label, len, ifname); 50683b3a8eb9SGleb Smirnoff expand_label_addr("$srcaddr", label, len, af, src_host); 50693b3a8eb9SGleb Smirnoff expand_label_addr("$dstaddr", label, len, af, dst_host); 50703b3a8eb9SGleb Smirnoff expand_label_port("$srcport", label, len, src_port); 50713b3a8eb9SGleb Smirnoff expand_label_port("$dstport", label, len, dst_port); 50723b3a8eb9SGleb Smirnoff expand_label_proto("$proto", label, len, proto); 50733b3a8eb9SGleb Smirnoff expand_label_nr("$nr", label, len); 50743b3a8eb9SGleb Smirnoff } 50753b3a8eb9SGleb Smirnoff 50763b3a8eb9SGleb Smirnoff int 50773b3a8eb9SGleb Smirnoff expand_altq(struct pf_altq *a, struct node_if *interfaces, 50783b3a8eb9SGleb Smirnoff struct node_queue *nqueues, struct node_queue_bw bwspec, 50793b3a8eb9SGleb Smirnoff struct node_queue_opt *opts) 50803b3a8eb9SGleb Smirnoff { 50813b3a8eb9SGleb Smirnoff struct pf_altq pa, pb; 50823b3a8eb9SGleb Smirnoff char qname[PF_QNAME_SIZE]; 50833b3a8eb9SGleb Smirnoff struct node_queue *n; 50843b3a8eb9SGleb Smirnoff struct node_queue_bw bw; 50853b3a8eb9SGleb Smirnoff int errs = 0; 50863b3a8eb9SGleb Smirnoff 50873b3a8eb9SGleb Smirnoff if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 50883b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 50890a70aaf8SLuiz Otavio O Souza if (nqueues) 50903b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 50913b3a8eb9SGleb Smirnoff return (0); 50923b3a8eb9SGleb Smirnoff } 50933b3a8eb9SGleb Smirnoff 50943b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 50953b3a8eb9SGleb Smirnoff memcpy(&pa, a, sizeof(struct pf_altq)); 50963b3a8eb9SGleb Smirnoff if (strlcpy(pa.ifname, interface->ifname, 50973b3a8eb9SGleb Smirnoff sizeof(pa.ifname)) >= sizeof(pa.ifname)) 50983b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 50993b3a8eb9SGleb Smirnoff 51003b3a8eb9SGleb Smirnoff if (interface->not) { 51013b3a8eb9SGleb Smirnoff yyerror("altq on ! <interface> is not supported"); 51023b3a8eb9SGleb Smirnoff errs++; 51033b3a8eb9SGleb Smirnoff } else { 51043b3a8eb9SGleb Smirnoff if (eval_pfaltq(pf, &pa, &bwspec, opts)) 51053b3a8eb9SGleb Smirnoff errs++; 51063b3a8eb9SGleb Smirnoff else 51073b3a8eb9SGleb Smirnoff if (pfctl_add_altq(pf, &pa)) 51083b3a8eb9SGleb Smirnoff errs++; 51093b3a8eb9SGleb Smirnoff 51103b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) { 51113b3a8eb9SGleb Smirnoff print_altq(&pf->paltq->altq, 0, 51123b3a8eb9SGleb Smirnoff &bwspec, opts); 51133b3a8eb9SGleb Smirnoff if (nqueues && nqueues->tail) { 51143b3a8eb9SGleb Smirnoff printf("queue { "); 51153b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, queue, 51163b3a8eb9SGleb Smirnoff nqueues, 51173b3a8eb9SGleb Smirnoff printf("%s ", 51183b3a8eb9SGleb Smirnoff queue->queue); 51193b3a8eb9SGleb Smirnoff ); 51203b3a8eb9SGleb Smirnoff printf("}"); 51213b3a8eb9SGleb Smirnoff } 51223b3a8eb9SGleb Smirnoff printf("\n"); 51233b3a8eb9SGleb Smirnoff } 51243b3a8eb9SGleb Smirnoff 51253b3a8eb9SGleb Smirnoff if (pa.scheduler == ALTQT_CBQ || 5126dc784287SKristof Provost pa.scheduler == ALTQT_HFSC || 5127dc784287SKristof Provost pa.scheduler == ALTQT_FAIRQ) { 51283b3a8eb9SGleb Smirnoff /* now create a root queue */ 51293b3a8eb9SGleb Smirnoff memset(&pb, 0, sizeof(struct pf_altq)); 51303b3a8eb9SGleb Smirnoff if (strlcpy(qname, "root_", sizeof(qname)) >= 51313b3a8eb9SGleb Smirnoff sizeof(qname)) 51323b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 51333b3a8eb9SGleb Smirnoff if (strlcat(qname, interface->ifname, 51343b3a8eb9SGleb Smirnoff sizeof(qname)) >= sizeof(qname)) 51353b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcat"); 51363b3a8eb9SGleb Smirnoff if (strlcpy(pb.qname, qname, 51373b3a8eb9SGleb Smirnoff sizeof(pb.qname)) >= sizeof(pb.qname)) 51383b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 51393b3a8eb9SGleb Smirnoff if (strlcpy(pb.ifname, interface->ifname, 51403b3a8eb9SGleb Smirnoff sizeof(pb.ifname)) >= sizeof(pb.ifname)) 51413b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 51423b3a8eb9SGleb Smirnoff pb.qlimit = pa.qlimit; 51433b3a8eb9SGleb Smirnoff pb.scheduler = pa.scheduler; 51443b3a8eb9SGleb Smirnoff bw.bw_absolute = pa.ifbandwidth; 51453b3a8eb9SGleb Smirnoff bw.bw_percent = 0; 51463b3a8eb9SGleb Smirnoff if (eval_pfqueue(pf, &pb, &bw, opts)) 51473b3a8eb9SGleb Smirnoff errs++; 51483b3a8eb9SGleb Smirnoff else 51493b3a8eb9SGleb Smirnoff if (pfctl_add_altq(pf, &pb)) 51503b3a8eb9SGleb Smirnoff errs++; 51513b3a8eb9SGleb Smirnoff } 51523b3a8eb9SGleb Smirnoff 51533b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, queue, nqueues, 51543b3a8eb9SGleb Smirnoff n = calloc(1, sizeof(struct node_queue)); 51553b3a8eb9SGleb Smirnoff if (n == NULL) 51563b3a8eb9SGleb Smirnoff err(1, "expand_altq: calloc"); 51573b3a8eb9SGleb Smirnoff if (pa.scheduler == ALTQT_CBQ || 5158dc784287SKristof Provost pa.scheduler == ALTQT_HFSC || 5159dc784287SKristof Provost pa.scheduler == ALTQT_FAIRQ) 51603b3a8eb9SGleb Smirnoff if (strlcpy(n->parent, qname, 51613b3a8eb9SGleb Smirnoff sizeof(n->parent)) >= 51623b3a8eb9SGleb Smirnoff sizeof(n->parent)) 51633b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 51643b3a8eb9SGleb Smirnoff if (strlcpy(n->queue, queue->queue, 51653b3a8eb9SGleb Smirnoff sizeof(n->queue)) >= sizeof(n->queue)) 51663b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 51673b3a8eb9SGleb Smirnoff if (strlcpy(n->ifname, interface->ifname, 51683b3a8eb9SGleb Smirnoff sizeof(n->ifname)) >= sizeof(n->ifname)) 51693b3a8eb9SGleb Smirnoff errx(1, "expand_altq: strlcpy"); 51703b3a8eb9SGleb Smirnoff n->scheduler = pa.scheduler; 51713b3a8eb9SGleb Smirnoff n->next = NULL; 51723b3a8eb9SGleb Smirnoff n->tail = n; 51733b3a8eb9SGleb Smirnoff if (queues == NULL) 51743b3a8eb9SGleb Smirnoff queues = n; 51753b3a8eb9SGleb Smirnoff else { 51763b3a8eb9SGleb Smirnoff queues->tail->next = n; 51773b3a8eb9SGleb Smirnoff queues->tail = n; 51783b3a8eb9SGleb Smirnoff } 51793b3a8eb9SGleb Smirnoff ); 51803b3a8eb9SGleb Smirnoff } 51813b3a8eb9SGleb Smirnoff ); 51823b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 51830a70aaf8SLuiz Otavio O Souza if (nqueues) 51843b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 51853b3a8eb9SGleb Smirnoff 51863b3a8eb9SGleb Smirnoff return (errs); 51873b3a8eb9SGleb Smirnoff } 51883b3a8eb9SGleb Smirnoff 51893b3a8eb9SGleb Smirnoff int 51903b3a8eb9SGleb Smirnoff expand_queue(struct pf_altq *a, struct node_if *interfaces, 51913b3a8eb9SGleb Smirnoff struct node_queue *nqueues, struct node_queue_bw bwspec, 51923b3a8eb9SGleb Smirnoff struct node_queue_opt *opts) 51933b3a8eb9SGleb Smirnoff { 51943b3a8eb9SGleb Smirnoff struct node_queue *n, *nq; 51953b3a8eb9SGleb Smirnoff struct pf_altq pa; 51963b3a8eb9SGleb Smirnoff u_int8_t found = 0; 51973b3a8eb9SGleb Smirnoff u_int8_t errs = 0; 51983b3a8eb9SGleb Smirnoff 51993b3a8eb9SGleb Smirnoff if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 52003b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 52013b3a8eb9SGleb Smirnoff return (0); 52023b3a8eb9SGleb Smirnoff } 52033b3a8eb9SGleb Smirnoff 52043b3a8eb9SGleb Smirnoff if (queues == NULL) { 52053b3a8eb9SGleb Smirnoff yyerror("queue %s has no parent", a->qname); 52063b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 52073b3a8eb9SGleb Smirnoff return (1); 52083b3a8eb9SGleb Smirnoff } 52093b3a8eb9SGleb Smirnoff 52103b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 52113b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, tqueue, queues, 52123b3a8eb9SGleb Smirnoff if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 52133b3a8eb9SGleb Smirnoff (interface->ifname[0] == 0 || 52143b3a8eb9SGleb Smirnoff (!interface->not && !strncmp(interface->ifname, 52153b3a8eb9SGleb Smirnoff tqueue->ifname, IFNAMSIZ)) || 52163b3a8eb9SGleb Smirnoff (interface->not && strncmp(interface->ifname, 52173b3a8eb9SGleb Smirnoff tqueue->ifname, IFNAMSIZ)))) { 52183b3a8eb9SGleb Smirnoff /* found ourself in queues */ 52193b3a8eb9SGleb Smirnoff found++; 52203b3a8eb9SGleb Smirnoff 52213b3a8eb9SGleb Smirnoff memcpy(&pa, a, sizeof(struct pf_altq)); 52223b3a8eb9SGleb Smirnoff 52233b3a8eb9SGleb Smirnoff if (pa.scheduler != ALTQT_NONE && 52243b3a8eb9SGleb Smirnoff pa.scheduler != tqueue->scheduler) { 52253b3a8eb9SGleb Smirnoff yyerror("exactly one scheduler type " 52263b3a8eb9SGleb Smirnoff "per interface allowed"); 52273b3a8eb9SGleb Smirnoff return (1); 52283b3a8eb9SGleb Smirnoff } 52293b3a8eb9SGleb Smirnoff pa.scheduler = tqueue->scheduler; 52303b3a8eb9SGleb Smirnoff 52313b3a8eb9SGleb Smirnoff /* scheduler dependent error checking */ 52323b3a8eb9SGleb Smirnoff switch (pa.scheduler) { 52333b3a8eb9SGleb Smirnoff case ALTQT_PRIQ: 52343b3a8eb9SGleb Smirnoff if (nqueues != NULL) { 52353b3a8eb9SGleb Smirnoff yyerror("priq queues cannot " 52363b3a8eb9SGleb Smirnoff "have child queues"); 52373b3a8eb9SGleb Smirnoff return (1); 52383b3a8eb9SGleb Smirnoff } 52393b3a8eb9SGleb Smirnoff if (bwspec.bw_absolute > 0 || 52403b3a8eb9SGleb Smirnoff bwspec.bw_percent < 100) { 52413b3a8eb9SGleb Smirnoff yyerror("priq doesn't take " 52423b3a8eb9SGleb Smirnoff "bandwidth"); 52433b3a8eb9SGleb Smirnoff return (1); 52443b3a8eb9SGleb Smirnoff } 52453b3a8eb9SGleb Smirnoff break; 52463b3a8eb9SGleb Smirnoff default: 52473b3a8eb9SGleb Smirnoff break; 52483b3a8eb9SGleb Smirnoff } 52493b3a8eb9SGleb Smirnoff 52503b3a8eb9SGleb Smirnoff if (strlcpy(pa.ifname, tqueue->ifname, 52513b3a8eb9SGleb Smirnoff sizeof(pa.ifname)) >= sizeof(pa.ifname)) 52523b3a8eb9SGleb Smirnoff errx(1, "expand_queue: strlcpy"); 52533b3a8eb9SGleb Smirnoff if (strlcpy(pa.parent, tqueue->parent, 52543b3a8eb9SGleb Smirnoff sizeof(pa.parent)) >= sizeof(pa.parent)) 52553b3a8eb9SGleb Smirnoff errx(1, "expand_queue: strlcpy"); 52563b3a8eb9SGleb Smirnoff 52573b3a8eb9SGleb Smirnoff if (eval_pfqueue(pf, &pa, &bwspec, opts)) 52583b3a8eb9SGleb Smirnoff errs++; 52593b3a8eb9SGleb Smirnoff else 52603b3a8eb9SGleb Smirnoff if (pfctl_add_altq(pf, &pa)) 52613b3a8eb9SGleb Smirnoff errs++; 52623b3a8eb9SGleb Smirnoff 52633b3a8eb9SGleb Smirnoff for (nq = nqueues; nq != NULL; nq = nq->next) { 52643b3a8eb9SGleb Smirnoff if (!strcmp(a->qname, nq->queue)) { 52653b3a8eb9SGleb Smirnoff yyerror("queue cannot have " 52663b3a8eb9SGleb Smirnoff "itself as child"); 52673b3a8eb9SGleb Smirnoff errs++; 52683b3a8eb9SGleb Smirnoff continue; 52693b3a8eb9SGleb Smirnoff } 52703b3a8eb9SGleb Smirnoff n = calloc(1, 52713b3a8eb9SGleb Smirnoff sizeof(struct node_queue)); 52723b3a8eb9SGleb Smirnoff if (n == NULL) 52733b3a8eb9SGleb Smirnoff err(1, "expand_queue: calloc"); 52743b3a8eb9SGleb Smirnoff if (strlcpy(n->parent, a->qname, 52753b3a8eb9SGleb Smirnoff sizeof(n->parent)) >= 52763b3a8eb9SGleb Smirnoff sizeof(n->parent)) 52773b3a8eb9SGleb Smirnoff errx(1, "expand_queue strlcpy"); 52783b3a8eb9SGleb Smirnoff if (strlcpy(n->queue, nq->queue, 52793b3a8eb9SGleb Smirnoff sizeof(n->queue)) >= 52803b3a8eb9SGleb Smirnoff sizeof(n->queue)) 52813b3a8eb9SGleb Smirnoff errx(1, "expand_queue strlcpy"); 52823b3a8eb9SGleb Smirnoff if (strlcpy(n->ifname, tqueue->ifname, 52833b3a8eb9SGleb Smirnoff sizeof(n->ifname)) >= 52843b3a8eb9SGleb Smirnoff sizeof(n->ifname)) 52853b3a8eb9SGleb Smirnoff errx(1, "expand_queue strlcpy"); 52863b3a8eb9SGleb Smirnoff n->scheduler = tqueue->scheduler; 52873b3a8eb9SGleb Smirnoff n->next = NULL; 52883b3a8eb9SGleb Smirnoff n->tail = n; 52893b3a8eb9SGleb Smirnoff if (queues == NULL) 52903b3a8eb9SGleb Smirnoff queues = n; 52913b3a8eb9SGleb Smirnoff else { 52923b3a8eb9SGleb Smirnoff queues->tail->next = n; 52933b3a8eb9SGleb Smirnoff queues->tail = n; 52943b3a8eb9SGleb Smirnoff } 52953b3a8eb9SGleb Smirnoff } 52963b3a8eb9SGleb Smirnoff if ((pf->opts & PF_OPT_VERBOSE) && ( 52973b3a8eb9SGleb Smirnoff (found == 1 && interface->ifname[0] == 0) || 52983b3a8eb9SGleb Smirnoff (found > 0 && interface->ifname[0] != 0))) { 52993b3a8eb9SGleb Smirnoff print_queue(&pf->paltq->altq, 0, 53003b3a8eb9SGleb Smirnoff &bwspec, interface->ifname[0] != 0, 53013b3a8eb9SGleb Smirnoff opts); 53023b3a8eb9SGleb Smirnoff if (nqueues && nqueues->tail) { 53033b3a8eb9SGleb Smirnoff printf("{ "); 53043b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_queue, 53053b3a8eb9SGleb Smirnoff queue, nqueues, 53063b3a8eb9SGleb Smirnoff printf("%s ", 53073b3a8eb9SGleb Smirnoff queue->queue); 53083b3a8eb9SGleb Smirnoff ); 53093b3a8eb9SGleb Smirnoff printf("}"); 53103b3a8eb9SGleb Smirnoff } 53113b3a8eb9SGleb Smirnoff printf("\n"); 53123b3a8eb9SGleb Smirnoff } 53133b3a8eb9SGleb Smirnoff } 53143b3a8eb9SGleb Smirnoff ); 53153b3a8eb9SGleb Smirnoff ); 53163b3a8eb9SGleb Smirnoff 53173b3a8eb9SGleb Smirnoff FREE_LIST(struct node_queue, nqueues); 53183b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 53193b3a8eb9SGleb Smirnoff 53203b3a8eb9SGleb Smirnoff if (!found) { 53213b3a8eb9SGleb Smirnoff yyerror("queue %s has no parent", a->qname); 53223b3a8eb9SGleb Smirnoff errs++; 53233b3a8eb9SGleb Smirnoff } 53243b3a8eb9SGleb Smirnoff 53253b3a8eb9SGleb Smirnoff if (errs) 53263b3a8eb9SGleb Smirnoff return (1); 53273b3a8eb9SGleb Smirnoff else 53283b3a8eb9SGleb Smirnoff return (0); 53293b3a8eb9SGleb Smirnoff } 53303b3a8eb9SGleb Smirnoff 53313b3a8eb9SGleb Smirnoff void 5332e9eb0941SKristof Provost expand_rule(struct pfctl_rule *r, 53333b3a8eb9SGleb Smirnoff struct node_if *interfaces, struct node_host *rpool_hosts, 53343b3a8eb9SGleb Smirnoff struct node_proto *protos, struct node_os *src_oses, 53353b3a8eb9SGleb Smirnoff struct node_host *src_hosts, struct node_port *src_ports, 53363b3a8eb9SGleb Smirnoff struct node_host *dst_hosts, struct node_port *dst_ports, 53373b3a8eb9SGleb Smirnoff struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 53383b3a8eb9SGleb Smirnoff const char *anchor_call) 53393b3a8eb9SGleb Smirnoff { 53403b3a8eb9SGleb Smirnoff sa_family_t af = r->af; 53413b3a8eb9SGleb Smirnoff int added = 0, error = 0; 53423b3a8eb9SGleb Smirnoff char ifname[IF_NAMESIZE]; 53436fcc8e04SKristof Provost char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 53443b3a8eb9SGleb Smirnoff char tagname[PF_TAG_NAME_SIZE]; 53453b3a8eb9SGleb Smirnoff char match_tagname[PF_TAG_NAME_SIZE]; 53463b3a8eb9SGleb Smirnoff struct pf_pooladdr *pa; 53473b3a8eb9SGleb Smirnoff struct node_host *h; 53483b3a8eb9SGleb Smirnoff u_int8_t flags, flagset, keep_state; 53493b3a8eb9SGleb Smirnoff 53506fcc8e04SKristof Provost memcpy(label, r->label, sizeof(r->label)); 53516fcc8e04SKristof Provost assert(sizeof(r->label) == sizeof(label)); 53523b3a8eb9SGleb Smirnoff if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 53533b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 53543b3a8eb9SGleb Smirnoff if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 53553b3a8eb9SGleb Smirnoff sizeof(match_tagname)) 53563b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 53573b3a8eb9SGleb Smirnoff flags = r->flags; 53583b3a8eb9SGleb Smirnoff flagset = r->flagset; 53593b3a8eb9SGleb Smirnoff keep_state = r->keep_state; 53603b3a8eb9SGleb Smirnoff 53613b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 53623b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_proto, proto, protos, 53633b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 53643b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_host, src_host, src_hosts, 53653b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_port, src_port, src_ports, 53663b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_os, src_os, src_oses, 53673b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 53683b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_port, dst_port, dst_ports, 53693b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_uid, uid, uids, 53703b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_gid, gid, gids, 53713b3a8eb9SGleb Smirnoff 53723b3a8eb9SGleb Smirnoff r->af = af; 53733b3a8eb9SGleb Smirnoff /* for link-local IPv6 address, interface must match up */ 53743b3a8eb9SGleb Smirnoff if ((r->af && src_host->af && r->af != src_host->af) || 53753b3a8eb9SGleb Smirnoff (r->af && dst_host->af && r->af != dst_host->af) || 53763b3a8eb9SGleb Smirnoff (src_host->af && dst_host->af && 53773b3a8eb9SGleb Smirnoff src_host->af != dst_host->af) || 53783b3a8eb9SGleb Smirnoff (src_host->ifindex && dst_host->ifindex && 53793b3a8eb9SGleb Smirnoff src_host->ifindex != dst_host->ifindex) || 53803b3a8eb9SGleb Smirnoff (src_host->ifindex && *interface->ifname && 53813b3a8eb9SGleb Smirnoff src_host->ifindex != if_nametoindex(interface->ifname)) || 53823b3a8eb9SGleb Smirnoff (dst_host->ifindex && *interface->ifname && 53833b3a8eb9SGleb Smirnoff dst_host->ifindex != if_nametoindex(interface->ifname))) 53843b3a8eb9SGleb Smirnoff continue; 53853b3a8eb9SGleb Smirnoff if (!r->af && src_host->af) 53863b3a8eb9SGleb Smirnoff r->af = src_host->af; 53873b3a8eb9SGleb Smirnoff else if (!r->af && dst_host->af) 53883b3a8eb9SGleb Smirnoff r->af = dst_host->af; 53893b3a8eb9SGleb Smirnoff 53903b3a8eb9SGleb Smirnoff if (*interface->ifname) 53913b3a8eb9SGleb Smirnoff strlcpy(r->ifname, interface->ifname, 53923b3a8eb9SGleb Smirnoff sizeof(r->ifname)); 53933b3a8eb9SGleb Smirnoff else if (if_indextoname(src_host->ifindex, ifname)) 53943b3a8eb9SGleb Smirnoff strlcpy(r->ifname, ifname, sizeof(r->ifname)); 53953b3a8eb9SGleb Smirnoff else if (if_indextoname(dst_host->ifindex, ifname)) 53963b3a8eb9SGleb Smirnoff strlcpy(r->ifname, ifname, sizeof(r->ifname)); 53973b3a8eb9SGleb Smirnoff else 53983b3a8eb9SGleb Smirnoff memset(r->ifname, '\0', sizeof(r->ifname)); 53993b3a8eb9SGleb Smirnoff 54006fcc8e04SKristof Provost memcpy(r->label, label, sizeof(r->label)); 54013b3a8eb9SGleb Smirnoff if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 54023b3a8eb9SGleb Smirnoff sizeof(r->tagname)) 54033b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 54043b3a8eb9SGleb Smirnoff if (strlcpy(r->match_tagname, match_tagname, 54053b3a8eb9SGleb Smirnoff sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 54063b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 54076fcc8e04SKristof Provost for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 54086fcc8e04SKristof Provost expand_label(r->label[i], PF_RULE_LABEL_SIZE, 54096fcc8e04SKristof Provost r->ifname, r->af, src_host, src_port, dst_host, 54106fcc8e04SKristof Provost dst_port, proto->proto); 54113b3a8eb9SGleb Smirnoff expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 54123b3a8eb9SGleb Smirnoff src_host, src_port, dst_host, dst_port, proto->proto); 54133b3a8eb9SGleb Smirnoff expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 54143b3a8eb9SGleb Smirnoff r->af, src_host, src_port, dst_host, dst_port, 54153b3a8eb9SGleb Smirnoff proto->proto); 54163b3a8eb9SGleb Smirnoff 54173b3a8eb9SGleb Smirnoff error += check_netmask(src_host, r->af); 54183b3a8eb9SGleb Smirnoff error += check_netmask(dst_host, r->af); 54193b3a8eb9SGleb Smirnoff 54203b3a8eb9SGleb Smirnoff r->ifnot = interface->not; 54213b3a8eb9SGleb Smirnoff r->proto = proto->proto; 54223b3a8eb9SGleb Smirnoff r->src.addr = src_host->addr; 54233b3a8eb9SGleb Smirnoff r->src.neg = src_host->not; 54243b3a8eb9SGleb Smirnoff r->src.port[0] = src_port->port[0]; 54253b3a8eb9SGleb Smirnoff r->src.port[1] = src_port->port[1]; 54263b3a8eb9SGleb Smirnoff r->src.port_op = src_port->op; 54273b3a8eb9SGleb Smirnoff r->dst.addr = dst_host->addr; 54283b3a8eb9SGleb Smirnoff r->dst.neg = dst_host->not; 54293b3a8eb9SGleb Smirnoff r->dst.port[0] = dst_port->port[0]; 54303b3a8eb9SGleb Smirnoff r->dst.port[1] = dst_port->port[1]; 54313b3a8eb9SGleb Smirnoff r->dst.port_op = dst_port->op; 54323b3a8eb9SGleb Smirnoff r->uid.op = uid->op; 54333b3a8eb9SGleb Smirnoff r->uid.uid[0] = uid->uid[0]; 54343b3a8eb9SGleb Smirnoff r->uid.uid[1] = uid->uid[1]; 54353b3a8eb9SGleb Smirnoff r->gid.op = gid->op; 54363b3a8eb9SGleb Smirnoff r->gid.gid[0] = gid->gid[0]; 54373b3a8eb9SGleb Smirnoff r->gid.gid[1] = gid->gid[1]; 54383b3a8eb9SGleb Smirnoff r->type = icmp_type->type; 54393b3a8eb9SGleb Smirnoff r->code = icmp_type->code; 54403b3a8eb9SGleb Smirnoff 54413b3a8eb9SGleb Smirnoff if ((keep_state == PF_STATE_MODULATE || 54423b3a8eb9SGleb Smirnoff keep_state == PF_STATE_SYNPROXY) && 54433b3a8eb9SGleb Smirnoff r->proto && r->proto != IPPROTO_TCP) 54443b3a8eb9SGleb Smirnoff r->keep_state = PF_STATE_NORMAL; 54453b3a8eb9SGleb Smirnoff else 54463b3a8eb9SGleb Smirnoff r->keep_state = keep_state; 54473b3a8eb9SGleb Smirnoff 54483b3a8eb9SGleb Smirnoff if (r->proto && r->proto != IPPROTO_TCP) { 54493b3a8eb9SGleb Smirnoff r->flags = 0; 54503b3a8eb9SGleb Smirnoff r->flagset = 0; 54513b3a8eb9SGleb Smirnoff } else { 54523b3a8eb9SGleb Smirnoff r->flags = flags; 54533b3a8eb9SGleb Smirnoff r->flagset = flagset; 54543b3a8eb9SGleb Smirnoff } 54553b3a8eb9SGleb Smirnoff if (icmp_type->proto && r->proto != icmp_type->proto) { 54563b3a8eb9SGleb Smirnoff yyerror("icmp-type mismatch"); 54573b3a8eb9SGleb Smirnoff error++; 54583b3a8eb9SGleb Smirnoff } 54593b3a8eb9SGleb Smirnoff 54603b3a8eb9SGleb Smirnoff if (src_os && src_os->os) { 54613b3a8eb9SGleb Smirnoff r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 54623b3a8eb9SGleb Smirnoff if ((pf->opts & PF_OPT_VERBOSE2) && 54633b3a8eb9SGleb Smirnoff r->os_fingerprint == PF_OSFP_NOMATCH) 54643b3a8eb9SGleb Smirnoff fprintf(stderr, 54653b3a8eb9SGleb Smirnoff "warning: unknown '%s' OS fingerprint\n", 54663b3a8eb9SGleb Smirnoff src_os->os); 54673b3a8eb9SGleb Smirnoff } else { 54683b3a8eb9SGleb Smirnoff r->os_fingerprint = PF_OSFP_ANY; 54693b3a8eb9SGleb Smirnoff } 54703b3a8eb9SGleb Smirnoff 54713b3a8eb9SGleb Smirnoff TAILQ_INIT(&r->rpool.list); 54723b3a8eb9SGleb Smirnoff for (h = rpool_hosts; h != NULL; h = h->next) { 54733b3a8eb9SGleb Smirnoff pa = calloc(1, sizeof(struct pf_pooladdr)); 54743b3a8eb9SGleb Smirnoff if (pa == NULL) 54753b3a8eb9SGleb Smirnoff err(1, "expand_rule: calloc"); 54763b3a8eb9SGleb Smirnoff pa->addr = h->addr; 54773b3a8eb9SGleb Smirnoff if (h->ifname != NULL) { 54783b3a8eb9SGleb Smirnoff if (strlcpy(pa->ifname, h->ifname, 54793b3a8eb9SGleb Smirnoff sizeof(pa->ifname)) >= 54803b3a8eb9SGleb Smirnoff sizeof(pa->ifname)) 54813b3a8eb9SGleb Smirnoff errx(1, "expand_rule: strlcpy"); 54823b3a8eb9SGleb Smirnoff } else 54833b3a8eb9SGleb Smirnoff pa->ifname[0] = 0; 54843b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 54853b3a8eb9SGleb Smirnoff } 54863b3a8eb9SGleb Smirnoff 54873b3a8eb9SGleb Smirnoff if (rule_consistent(r, anchor_call[0]) < 0 || error) 54883b3a8eb9SGleb Smirnoff yyerror("skipping rule due to errors"); 54893b3a8eb9SGleb Smirnoff else { 54903b3a8eb9SGleb Smirnoff r->nr = pf->astack[pf->asd]->match++; 54910d71f9f3SKristof Provost pfctl_append_rule(pf, r, anchor_call); 54923b3a8eb9SGleb Smirnoff added++; 54933b3a8eb9SGleb Smirnoff } 54943b3a8eb9SGleb Smirnoff 54953b3a8eb9SGleb Smirnoff )))))))))); 54963b3a8eb9SGleb Smirnoff 54973b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 54983b3a8eb9SGleb Smirnoff FREE_LIST(struct node_proto, protos); 54993b3a8eb9SGleb Smirnoff FREE_LIST(struct node_host, src_hosts); 55003b3a8eb9SGleb Smirnoff FREE_LIST(struct node_port, src_ports); 55013b3a8eb9SGleb Smirnoff FREE_LIST(struct node_os, src_oses); 55023b3a8eb9SGleb Smirnoff FREE_LIST(struct node_host, dst_hosts); 55033b3a8eb9SGleb Smirnoff FREE_LIST(struct node_port, dst_ports); 55043b3a8eb9SGleb Smirnoff FREE_LIST(struct node_uid, uids); 55053b3a8eb9SGleb Smirnoff FREE_LIST(struct node_gid, gids); 55063b3a8eb9SGleb Smirnoff FREE_LIST(struct node_icmp, icmp_types); 55073b3a8eb9SGleb Smirnoff FREE_LIST(struct node_host, rpool_hosts); 55083b3a8eb9SGleb Smirnoff 55093b3a8eb9SGleb Smirnoff if (!added) 55103b3a8eb9SGleb Smirnoff yyerror("rule expands to no valid combination"); 55113b3a8eb9SGleb Smirnoff } 55123b3a8eb9SGleb Smirnoff 55133b3a8eb9SGleb Smirnoff int 55143b3a8eb9SGleb Smirnoff expand_skip_interface(struct node_if *interfaces) 55153b3a8eb9SGleb Smirnoff { 55163b3a8eb9SGleb Smirnoff int errs = 0; 55173b3a8eb9SGleb Smirnoff 55183b3a8eb9SGleb Smirnoff if (!interfaces || (!interfaces->next && !interfaces->not && 55193b3a8eb9SGleb Smirnoff !strcmp(interfaces->ifname, "none"))) { 55203b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 55213b3a8eb9SGleb Smirnoff printf("set skip on none\n"); 55223b3a8eb9SGleb Smirnoff errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 55233b3a8eb9SGleb Smirnoff return (errs); 55243b3a8eb9SGleb Smirnoff } 55253b3a8eb9SGleb Smirnoff 55263b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 55273b3a8eb9SGleb Smirnoff printf("set skip on {"); 55283b3a8eb9SGleb Smirnoff LOOP_THROUGH(struct node_if, interface, interfaces, 55293b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 55303b3a8eb9SGleb Smirnoff printf(" %s", interface->ifname); 55313b3a8eb9SGleb Smirnoff if (interface->not) { 55323b3a8eb9SGleb Smirnoff yyerror("skip on ! <interface> is not supported"); 55333b3a8eb9SGleb Smirnoff errs++; 55343b3a8eb9SGleb Smirnoff } else 55353b3a8eb9SGleb Smirnoff errs += pfctl_set_interface_flags(pf, 55363b3a8eb9SGleb Smirnoff interface->ifname, PFI_IFLAG_SKIP, 1); 55373b3a8eb9SGleb Smirnoff ); 55383b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 55393b3a8eb9SGleb Smirnoff printf(" }\n"); 55403b3a8eb9SGleb Smirnoff 55413b3a8eb9SGleb Smirnoff FREE_LIST(struct node_if, interfaces); 55423b3a8eb9SGleb Smirnoff 55433b3a8eb9SGleb Smirnoff if (errs) 55443b3a8eb9SGleb Smirnoff return (1); 55453b3a8eb9SGleb Smirnoff else 55463b3a8eb9SGleb Smirnoff return (0); 55473b3a8eb9SGleb Smirnoff } 55483b3a8eb9SGleb Smirnoff 55493b3a8eb9SGleb Smirnoff #undef FREE_LIST 55503b3a8eb9SGleb Smirnoff #undef LOOP_THROUGH 55513b3a8eb9SGleb Smirnoff 55523b3a8eb9SGleb Smirnoff int 55533b3a8eb9SGleb Smirnoff check_rulestate(int desired_state) 55543b3a8eb9SGleb Smirnoff { 55553b3a8eb9SGleb Smirnoff if (require_order && (rulestate > desired_state)) { 55563b3a8eb9SGleb Smirnoff yyerror("Rules must be in order: options, normalization, " 55573b3a8eb9SGleb Smirnoff "queueing, translation, filtering"); 55583b3a8eb9SGleb Smirnoff return (1); 55593b3a8eb9SGleb Smirnoff } 55603b3a8eb9SGleb Smirnoff rulestate = desired_state; 55613b3a8eb9SGleb Smirnoff return (0); 55623b3a8eb9SGleb Smirnoff } 55633b3a8eb9SGleb Smirnoff 55643b3a8eb9SGleb Smirnoff int 55653b3a8eb9SGleb Smirnoff kw_cmp(const void *k, const void *e) 55663b3a8eb9SGleb Smirnoff { 55673b3a8eb9SGleb Smirnoff return (strcmp(k, ((const struct keywords *)e)->k_name)); 55683b3a8eb9SGleb Smirnoff } 55693b3a8eb9SGleb Smirnoff 55703b3a8eb9SGleb Smirnoff int 55713b3a8eb9SGleb Smirnoff lookup(char *s) 55723b3a8eb9SGleb Smirnoff { 55733b3a8eb9SGleb Smirnoff /* this has to be sorted always */ 55743b3a8eb9SGleb Smirnoff static const struct keywords keywords[] = { 55753b3a8eb9SGleb Smirnoff { "all", ALL}, 55763b3a8eb9SGleb Smirnoff { "allow-opts", ALLOWOPTS}, 55773b3a8eb9SGleb Smirnoff { "altq", ALTQ}, 55783b3a8eb9SGleb Smirnoff { "anchor", ANCHOR}, 55793b3a8eb9SGleb Smirnoff { "antispoof", ANTISPOOF}, 55803b3a8eb9SGleb Smirnoff { "any", ANY}, 55813b3a8eb9SGleb Smirnoff { "bandwidth", BANDWIDTH}, 55823b3a8eb9SGleb Smirnoff { "binat", BINAT}, 55833b3a8eb9SGleb Smirnoff { "binat-anchor", BINATANCHOR}, 55843b3a8eb9SGleb Smirnoff { "bitmask", BITMASK}, 55853b3a8eb9SGleb Smirnoff { "block", BLOCK}, 55863b3a8eb9SGleb Smirnoff { "block-policy", BLOCKPOLICY}, 5587a5b789f6SErmal Luçi { "buckets", BUCKETS}, 55883b3a8eb9SGleb Smirnoff { "cbq", CBQ}, 55893b3a8eb9SGleb Smirnoff { "code", CODE}, 55900a70aaf8SLuiz Otavio O Souza { "codelq", CODEL}, 55913b3a8eb9SGleb Smirnoff { "crop", FRAGCROP}, 55923b3a8eb9SGleb Smirnoff { "debug", DEBUG}, 55933b3a8eb9SGleb Smirnoff { "divert-reply", DIVERTREPLY}, 55943b3a8eb9SGleb Smirnoff { "divert-to", DIVERTTO}, 55953b3a8eb9SGleb Smirnoff { "drop", DROP}, 55963b3a8eb9SGleb Smirnoff { "drop-ovl", FRAGDROP}, 55973b3a8eb9SGleb Smirnoff { "dup-to", DUPTO}, 5598150182e3SKristof Provost { "fail-policy", FAILPOLICY}, 5599a5b789f6SErmal Luçi { "fairq", FAIRQ}, 56003b3a8eb9SGleb Smirnoff { "fastroute", FASTROUTE}, 56013b3a8eb9SGleb Smirnoff { "file", FILENAME}, 56023b3a8eb9SGleb Smirnoff { "fingerprints", FINGERPRINTS}, 56033b3a8eb9SGleb Smirnoff { "flags", FLAGS}, 56043b3a8eb9SGleb Smirnoff { "floating", FLOATING}, 56053b3a8eb9SGleb Smirnoff { "flush", FLUSH}, 56063b3a8eb9SGleb Smirnoff { "for", FOR}, 56073b3a8eb9SGleb Smirnoff { "fragment", FRAGMENT}, 56083b3a8eb9SGleb Smirnoff { "from", FROM}, 56093b3a8eb9SGleb Smirnoff { "global", GLOBAL}, 56103b3a8eb9SGleb Smirnoff { "group", GROUP}, 56113b3a8eb9SGleb Smirnoff { "hfsc", HFSC}, 5612a5b789f6SErmal Luçi { "hogs", HOGS}, 56133b3a8eb9SGleb Smirnoff { "hostid", HOSTID}, 56143b3a8eb9SGleb Smirnoff { "icmp-type", ICMPTYPE}, 56153b3a8eb9SGleb Smirnoff { "icmp6-type", ICMP6TYPE}, 56163b3a8eb9SGleb Smirnoff { "if-bound", IFBOUND}, 56173b3a8eb9SGleb Smirnoff { "in", IN}, 56183b3a8eb9SGleb Smirnoff { "include", INCLUDE}, 56193b3a8eb9SGleb Smirnoff { "inet", INET}, 56203b3a8eb9SGleb Smirnoff { "inet6", INET6}, 56210a70aaf8SLuiz Otavio O Souza { "interval", INTERVAL}, 56223b3a8eb9SGleb Smirnoff { "keep", KEEP}, 562342ec75f8SKristof Provost { "keepcounters", KEEPCOUNTERS}, 56243b3a8eb9SGleb Smirnoff { "label", LABEL}, 56253b3a8eb9SGleb Smirnoff { "limit", LIMIT}, 56263b3a8eb9SGleb Smirnoff { "linkshare", LINKSHARE}, 56273b3a8eb9SGleb Smirnoff { "load", LOAD}, 56283b3a8eb9SGleb Smirnoff { "log", LOG}, 56293b3a8eb9SGleb Smirnoff { "loginterface", LOGINTERFACE}, 56302aa21096SKurosawa Takahiro { "map-e-portset", MAPEPORTSET}, 5631ef950daaSKristof Provost { "match", MATCH}, 56323b3a8eb9SGleb Smirnoff { "max", MAXIMUM}, 56333b3a8eb9SGleb Smirnoff { "max-mss", MAXMSS}, 56343b3a8eb9SGleb Smirnoff { "max-src-conn", MAXSRCCONN}, 56353b3a8eb9SGleb Smirnoff { "max-src-conn-rate", MAXSRCCONNRATE}, 56363b3a8eb9SGleb Smirnoff { "max-src-nodes", MAXSRCNODES}, 56373b3a8eb9SGleb Smirnoff { "max-src-states", MAXSRCSTATES}, 56383b3a8eb9SGleb Smirnoff { "min-ttl", MINTTL}, 56393b3a8eb9SGleb Smirnoff { "modulate", MODULATE}, 56403b3a8eb9SGleb Smirnoff { "nat", NAT}, 56413b3a8eb9SGleb Smirnoff { "nat-anchor", NATANCHOR}, 56423b3a8eb9SGleb Smirnoff { "no", NO}, 56433b3a8eb9SGleb Smirnoff { "no-df", NODF}, 56443b3a8eb9SGleb Smirnoff { "no-route", NOROUTE}, 56453b3a8eb9SGleb Smirnoff { "no-sync", NOSYNC}, 56463b3a8eb9SGleb Smirnoff { "on", ON}, 56473b3a8eb9SGleb Smirnoff { "optimization", OPTIMIZATION}, 56483b3a8eb9SGleb Smirnoff { "os", OS}, 56493b3a8eb9SGleb Smirnoff { "out", OUT}, 56503b3a8eb9SGleb Smirnoff { "overload", OVERLOAD}, 56513b3a8eb9SGleb Smirnoff { "pass", PASS}, 56523b3a8eb9SGleb Smirnoff { "port", PORT}, 56533e248e0fSKristof Provost { "prio", PRIO}, 56543b3a8eb9SGleb Smirnoff { "priority", PRIORITY}, 56553b3a8eb9SGleb Smirnoff { "priq", PRIQ}, 56563b3a8eb9SGleb Smirnoff { "probability", PROBABILITY}, 56573b3a8eb9SGleb Smirnoff { "proto", PROTO}, 56583b3a8eb9SGleb Smirnoff { "qlimit", QLIMIT}, 56593b3a8eb9SGleb Smirnoff { "queue", QUEUE}, 56603b3a8eb9SGleb Smirnoff { "quick", QUICK}, 56613b3a8eb9SGleb Smirnoff { "random", RANDOM}, 56623b3a8eb9SGleb Smirnoff { "random-id", RANDOMID}, 56633b3a8eb9SGleb Smirnoff { "rdr", RDR}, 56643b3a8eb9SGleb Smirnoff { "rdr-anchor", RDRANCHOR}, 56653b3a8eb9SGleb Smirnoff { "realtime", REALTIME}, 56663b3a8eb9SGleb Smirnoff { "reassemble", REASSEMBLE}, 56673b3a8eb9SGleb Smirnoff { "reply-to", REPLYTO}, 56683b3a8eb9SGleb Smirnoff { "require-order", REQUIREORDER}, 56693b3a8eb9SGleb Smirnoff { "return", RETURN}, 56703b3a8eb9SGleb Smirnoff { "return-icmp", RETURNICMP}, 56713b3a8eb9SGleb Smirnoff { "return-icmp6", RETURNICMP6}, 56723b3a8eb9SGleb Smirnoff { "return-rst", RETURNRST}, 56733b3a8eb9SGleb Smirnoff { "round-robin", ROUNDROBIN}, 56743b3a8eb9SGleb Smirnoff { "route", ROUTE}, 56753b3a8eb9SGleb Smirnoff { "route-to", ROUTETO}, 56763b3a8eb9SGleb Smirnoff { "rtable", RTABLE}, 56773b3a8eb9SGleb Smirnoff { "rule", RULE}, 56783b3a8eb9SGleb Smirnoff { "ruleset-optimization", RULESET_OPTIMIZATION}, 56793b3a8eb9SGleb Smirnoff { "scrub", SCRUB}, 56803b3a8eb9SGleb Smirnoff { "set", SET}, 56813b3a8eb9SGleb Smirnoff { "set-tos", SETTOS}, 56823b3a8eb9SGleb Smirnoff { "skip", SKIP}, 56833b3a8eb9SGleb Smirnoff { "sloppy", SLOPPY}, 56843b3a8eb9SGleb Smirnoff { "source-hash", SOURCEHASH}, 56853b3a8eb9SGleb Smirnoff { "source-track", SOURCETRACK}, 56863b3a8eb9SGleb Smirnoff { "state", STATE}, 56873b3a8eb9SGleb Smirnoff { "state-defaults", STATEDEFAULTS}, 56883b3a8eb9SGleb Smirnoff { "state-policy", STATEPOLICY}, 56893b3a8eb9SGleb Smirnoff { "static-port", STATICPORT}, 56903b3a8eb9SGleb Smirnoff { "sticky-address", STICKYADDRESS}, 5691*c69121c4SKristof Provost { "syncookies", SYNCOOKIES}, 56923b3a8eb9SGleb Smirnoff { "synproxy", SYNPROXY}, 56933b3a8eb9SGleb Smirnoff { "table", TABLE}, 56943b3a8eb9SGleb Smirnoff { "tag", TAG}, 56953b3a8eb9SGleb Smirnoff { "tagged", TAGGED}, 56960a70aaf8SLuiz Otavio O Souza { "target", TARGET}, 56973b3a8eb9SGleb Smirnoff { "tbrsize", TBRSIZE}, 56983b3a8eb9SGleb Smirnoff { "timeout", TIMEOUT}, 56993b3a8eb9SGleb Smirnoff { "to", TO}, 57003b3a8eb9SGleb Smirnoff { "tos", TOS}, 57013b3a8eb9SGleb Smirnoff { "ttl", TTL}, 57023b3a8eb9SGleb Smirnoff { "upperlimit", UPPERLIMIT}, 57033b3a8eb9SGleb Smirnoff { "urpf-failed", URPFFAILED}, 57043b3a8eb9SGleb Smirnoff { "user", USER}, 57053b3a8eb9SGleb Smirnoff }; 57063b3a8eb9SGleb Smirnoff const struct keywords *p; 57073b3a8eb9SGleb Smirnoff 57083b3a8eb9SGleb Smirnoff p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 57093b3a8eb9SGleb Smirnoff sizeof(keywords[0]), kw_cmp); 57103b3a8eb9SGleb Smirnoff 57113b3a8eb9SGleb Smirnoff if (p) { 57123b3a8eb9SGleb Smirnoff if (debug > 1) 57133b3a8eb9SGleb Smirnoff fprintf(stderr, "%s: %d\n", s, p->k_val); 57143b3a8eb9SGleb Smirnoff return (p->k_val); 57153b3a8eb9SGleb Smirnoff } else { 57163b3a8eb9SGleb Smirnoff if (debug > 1) 57173b3a8eb9SGleb Smirnoff fprintf(stderr, "string: %s\n", s); 57183b3a8eb9SGleb Smirnoff return (STRING); 57193b3a8eb9SGleb Smirnoff } 57203b3a8eb9SGleb Smirnoff } 57213b3a8eb9SGleb Smirnoff 57223b3a8eb9SGleb Smirnoff #define MAXPUSHBACK 128 57233b3a8eb9SGleb Smirnoff 572413cfafabSKristof Provost static char *parsebuf; 572513cfafabSKristof Provost static int parseindex; 572613cfafabSKristof Provost static char pushback_buffer[MAXPUSHBACK]; 572713cfafabSKristof Provost static int pushback_index = 0; 57283b3a8eb9SGleb Smirnoff 57293b3a8eb9SGleb Smirnoff int 57303b3a8eb9SGleb Smirnoff lgetc(int quotec) 57313b3a8eb9SGleb Smirnoff { 57323b3a8eb9SGleb Smirnoff int c, next; 57333b3a8eb9SGleb Smirnoff 57343b3a8eb9SGleb Smirnoff if (parsebuf) { 57353b3a8eb9SGleb Smirnoff /* Read character from the parsebuffer instead of input. */ 57363b3a8eb9SGleb Smirnoff if (parseindex >= 0) { 57373b3a8eb9SGleb Smirnoff c = parsebuf[parseindex++]; 57383b3a8eb9SGleb Smirnoff if (c != '\0') 57393b3a8eb9SGleb Smirnoff return (c); 57403b3a8eb9SGleb Smirnoff parsebuf = NULL; 57413b3a8eb9SGleb Smirnoff } else 57423b3a8eb9SGleb Smirnoff parseindex++; 57433b3a8eb9SGleb Smirnoff } 57443b3a8eb9SGleb Smirnoff 57453b3a8eb9SGleb Smirnoff if (pushback_index) 57463b3a8eb9SGleb Smirnoff return (pushback_buffer[--pushback_index]); 57473b3a8eb9SGleb Smirnoff 57483b3a8eb9SGleb Smirnoff if (quotec) { 57493b3a8eb9SGleb Smirnoff if ((c = getc(file->stream)) == EOF) { 57503b3a8eb9SGleb Smirnoff yyerror("reached end of file while parsing quoted string"); 57513b3a8eb9SGleb Smirnoff if (popfile() == EOF) 57523b3a8eb9SGleb Smirnoff return (EOF); 57533b3a8eb9SGleb Smirnoff return (quotec); 57543b3a8eb9SGleb Smirnoff } 57553b3a8eb9SGleb Smirnoff return (c); 57563b3a8eb9SGleb Smirnoff } 57573b3a8eb9SGleb Smirnoff 57583b3a8eb9SGleb Smirnoff while ((c = getc(file->stream)) == '\\') { 57593b3a8eb9SGleb Smirnoff next = getc(file->stream); 57603b3a8eb9SGleb Smirnoff if (next != '\n') { 57613b3a8eb9SGleb Smirnoff c = next; 57623b3a8eb9SGleb Smirnoff break; 57633b3a8eb9SGleb Smirnoff } 57643b3a8eb9SGleb Smirnoff yylval.lineno = file->lineno; 57653b3a8eb9SGleb Smirnoff file->lineno++; 57663b3a8eb9SGleb Smirnoff } 57673b3a8eb9SGleb Smirnoff 57683b3a8eb9SGleb Smirnoff while (c == EOF) { 57693b3a8eb9SGleb Smirnoff if (popfile() == EOF) 57703b3a8eb9SGleb Smirnoff return (EOF); 57713b3a8eb9SGleb Smirnoff c = getc(file->stream); 57723b3a8eb9SGleb Smirnoff } 57733b3a8eb9SGleb Smirnoff return (c); 57743b3a8eb9SGleb Smirnoff } 57753b3a8eb9SGleb Smirnoff 57763b3a8eb9SGleb Smirnoff int 57773b3a8eb9SGleb Smirnoff lungetc(int c) 57783b3a8eb9SGleb Smirnoff { 57793b3a8eb9SGleb Smirnoff if (c == EOF) 57803b3a8eb9SGleb Smirnoff return (EOF); 57813b3a8eb9SGleb Smirnoff if (parsebuf) { 57823b3a8eb9SGleb Smirnoff parseindex--; 57833b3a8eb9SGleb Smirnoff if (parseindex >= 0) 57843b3a8eb9SGleb Smirnoff return (c); 57853b3a8eb9SGleb Smirnoff } 57863b3a8eb9SGleb Smirnoff if (pushback_index < MAXPUSHBACK-1) 57873b3a8eb9SGleb Smirnoff return (pushback_buffer[pushback_index++] = c); 57883b3a8eb9SGleb Smirnoff else 57893b3a8eb9SGleb Smirnoff return (EOF); 57903b3a8eb9SGleb Smirnoff } 57913b3a8eb9SGleb Smirnoff 57923b3a8eb9SGleb Smirnoff int 57933b3a8eb9SGleb Smirnoff findeol(void) 57943b3a8eb9SGleb Smirnoff { 57953b3a8eb9SGleb Smirnoff int c; 57963b3a8eb9SGleb Smirnoff 57973b3a8eb9SGleb Smirnoff parsebuf = NULL; 57983b3a8eb9SGleb Smirnoff 57993b3a8eb9SGleb Smirnoff /* skip to either EOF or the first real EOL */ 58003b3a8eb9SGleb Smirnoff while (1) { 58013b3a8eb9SGleb Smirnoff if (pushback_index) 58023b3a8eb9SGleb Smirnoff c = pushback_buffer[--pushback_index]; 58033b3a8eb9SGleb Smirnoff else 58043b3a8eb9SGleb Smirnoff c = lgetc(0); 58053b3a8eb9SGleb Smirnoff if (c == '\n') { 58063b3a8eb9SGleb Smirnoff file->lineno++; 58073b3a8eb9SGleb Smirnoff break; 58083b3a8eb9SGleb Smirnoff } 58093b3a8eb9SGleb Smirnoff if (c == EOF) 58103b3a8eb9SGleb Smirnoff break; 58113b3a8eb9SGleb Smirnoff } 58123b3a8eb9SGleb Smirnoff return (ERROR); 58133b3a8eb9SGleb Smirnoff } 58143b3a8eb9SGleb Smirnoff 58153b3a8eb9SGleb Smirnoff int 58163b3a8eb9SGleb Smirnoff yylex(void) 58173b3a8eb9SGleb Smirnoff { 58183b3a8eb9SGleb Smirnoff char buf[8096]; 58193b3a8eb9SGleb Smirnoff char *p, *val; 58203b3a8eb9SGleb Smirnoff int quotec, next, c; 58213b3a8eb9SGleb Smirnoff int token; 58223b3a8eb9SGleb Smirnoff 58233b3a8eb9SGleb Smirnoff top: 58243b3a8eb9SGleb Smirnoff p = buf; 58253b3a8eb9SGleb Smirnoff while ((c = lgetc(0)) == ' ' || c == '\t') 58263b3a8eb9SGleb Smirnoff ; /* nothing */ 58273b3a8eb9SGleb Smirnoff 58283b3a8eb9SGleb Smirnoff yylval.lineno = file->lineno; 58293b3a8eb9SGleb Smirnoff if (c == '#') 58303b3a8eb9SGleb Smirnoff while ((c = lgetc(0)) != '\n' && c != EOF) 58313b3a8eb9SGleb Smirnoff ; /* nothing */ 58323b3a8eb9SGleb Smirnoff if (c == '$' && parsebuf == NULL) { 58333b3a8eb9SGleb Smirnoff while (1) { 58343b3a8eb9SGleb Smirnoff if ((c = lgetc(0)) == EOF) 58353b3a8eb9SGleb Smirnoff return (0); 58363b3a8eb9SGleb Smirnoff 58373b3a8eb9SGleb Smirnoff if (p + 1 >= buf + sizeof(buf) - 1) { 58383b3a8eb9SGleb Smirnoff yyerror("string too long"); 58393b3a8eb9SGleb Smirnoff return (findeol()); 58403b3a8eb9SGleb Smirnoff } 58413b3a8eb9SGleb Smirnoff if (isalnum(c) || c == '_') { 58423b3a8eb9SGleb Smirnoff *p++ = (char)c; 58433b3a8eb9SGleb Smirnoff continue; 58443b3a8eb9SGleb Smirnoff } 58453b3a8eb9SGleb Smirnoff *p = '\0'; 58463b3a8eb9SGleb Smirnoff lungetc(c); 58473b3a8eb9SGleb Smirnoff break; 58483b3a8eb9SGleb Smirnoff } 58493b3a8eb9SGleb Smirnoff val = symget(buf); 58503b3a8eb9SGleb Smirnoff if (val == NULL) { 58513b3a8eb9SGleb Smirnoff yyerror("macro '%s' not defined", buf); 58523b3a8eb9SGleb Smirnoff return (findeol()); 58533b3a8eb9SGleb Smirnoff } 58543b3a8eb9SGleb Smirnoff parsebuf = val; 58553b3a8eb9SGleb Smirnoff parseindex = 0; 58563b3a8eb9SGleb Smirnoff goto top; 58573b3a8eb9SGleb Smirnoff } 58583b3a8eb9SGleb Smirnoff 58593b3a8eb9SGleb Smirnoff switch (c) { 58603b3a8eb9SGleb Smirnoff case '\'': 58613b3a8eb9SGleb Smirnoff case '"': 58623b3a8eb9SGleb Smirnoff quotec = c; 58633b3a8eb9SGleb Smirnoff while (1) { 58643b3a8eb9SGleb Smirnoff if ((c = lgetc(quotec)) == EOF) 58653b3a8eb9SGleb Smirnoff return (0); 58663b3a8eb9SGleb Smirnoff if (c == '\n') { 58673b3a8eb9SGleb Smirnoff file->lineno++; 58683b3a8eb9SGleb Smirnoff continue; 58693b3a8eb9SGleb Smirnoff } else if (c == '\\') { 58703b3a8eb9SGleb Smirnoff if ((next = lgetc(quotec)) == EOF) 58713b3a8eb9SGleb Smirnoff return (0); 58723b3a8eb9SGleb Smirnoff if (next == quotec || c == ' ' || c == '\t') 58733b3a8eb9SGleb Smirnoff c = next; 58744a8e4793SKristof Provost else if (next == '\n') { 58754a8e4793SKristof Provost file->lineno++; 58763b3a8eb9SGleb Smirnoff continue; 58774a8e4793SKristof Provost } 58783b3a8eb9SGleb Smirnoff else 58793b3a8eb9SGleb Smirnoff lungetc(next); 58803b3a8eb9SGleb Smirnoff } else if (c == quotec) { 58813b3a8eb9SGleb Smirnoff *p = '\0'; 58823b3a8eb9SGleb Smirnoff break; 58833b3a8eb9SGleb Smirnoff } 58843b3a8eb9SGleb Smirnoff if (p + 1 >= buf + sizeof(buf) - 1) { 58853b3a8eb9SGleb Smirnoff yyerror("string too long"); 58863b3a8eb9SGleb Smirnoff return (findeol()); 58873b3a8eb9SGleb Smirnoff } 58883b3a8eb9SGleb Smirnoff *p++ = (char)c; 58893b3a8eb9SGleb Smirnoff } 58903b3a8eb9SGleb Smirnoff yylval.v.string = strdup(buf); 58913b3a8eb9SGleb Smirnoff if (yylval.v.string == NULL) 58923b3a8eb9SGleb Smirnoff err(1, "yylex: strdup"); 58933b3a8eb9SGleb Smirnoff return (STRING); 58943b3a8eb9SGleb Smirnoff case '<': 58953b3a8eb9SGleb Smirnoff next = lgetc(0); 58963b3a8eb9SGleb Smirnoff if (next == '>') { 58973b3a8eb9SGleb Smirnoff yylval.v.i = PF_OP_XRG; 58983b3a8eb9SGleb Smirnoff return (PORTBINARY); 58993b3a8eb9SGleb Smirnoff } 59003b3a8eb9SGleb Smirnoff lungetc(next); 59013b3a8eb9SGleb Smirnoff break; 59023b3a8eb9SGleb Smirnoff case '>': 59033b3a8eb9SGleb Smirnoff next = lgetc(0); 59043b3a8eb9SGleb Smirnoff if (next == '<') { 59053b3a8eb9SGleb Smirnoff yylval.v.i = PF_OP_IRG; 59063b3a8eb9SGleb Smirnoff return (PORTBINARY); 59073b3a8eb9SGleb Smirnoff } 59083b3a8eb9SGleb Smirnoff lungetc(next); 59093b3a8eb9SGleb Smirnoff break; 59103b3a8eb9SGleb Smirnoff case '-': 59113b3a8eb9SGleb Smirnoff next = lgetc(0); 59123b3a8eb9SGleb Smirnoff if (next == '>') 59133b3a8eb9SGleb Smirnoff return (ARROW); 59143b3a8eb9SGleb Smirnoff lungetc(next); 59153b3a8eb9SGleb Smirnoff break; 59163b3a8eb9SGleb Smirnoff } 59173b3a8eb9SGleb Smirnoff 59183b3a8eb9SGleb Smirnoff #define allowed_to_end_number(x) \ 59193b3a8eb9SGleb Smirnoff (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 59203b3a8eb9SGleb Smirnoff 59213b3a8eb9SGleb Smirnoff if (c == '-' || isdigit(c)) { 59223b3a8eb9SGleb Smirnoff do { 59233b3a8eb9SGleb Smirnoff *p++ = c; 59243b3a8eb9SGleb Smirnoff if ((unsigned)(p-buf) >= sizeof(buf)) { 59253b3a8eb9SGleb Smirnoff yyerror("string too long"); 59263b3a8eb9SGleb Smirnoff return (findeol()); 59273b3a8eb9SGleb Smirnoff } 59283b3a8eb9SGleb Smirnoff } while ((c = lgetc(0)) != EOF && isdigit(c)); 59293b3a8eb9SGleb Smirnoff lungetc(c); 59303b3a8eb9SGleb Smirnoff if (p == buf + 1 && buf[0] == '-') 59313b3a8eb9SGleb Smirnoff goto nodigits; 59323b3a8eb9SGleb Smirnoff if (c == EOF || allowed_to_end_number(c)) { 59333b3a8eb9SGleb Smirnoff const char *errstr = NULL; 59343b3a8eb9SGleb Smirnoff 59353b3a8eb9SGleb Smirnoff *p = '\0'; 59363b3a8eb9SGleb Smirnoff yylval.v.number = strtonum(buf, LLONG_MIN, 59373b3a8eb9SGleb Smirnoff LLONG_MAX, &errstr); 59383b3a8eb9SGleb Smirnoff if (errstr) { 59393b3a8eb9SGleb Smirnoff yyerror("\"%s\" invalid number: %s", 59403b3a8eb9SGleb Smirnoff buf, errstr); 59413b3a8eb9SGleb Smirnoff return (findeol()); 59423b3a8eb9SGleb Smirnoff } 59433b3a8eb9SGleb Smirnoff return (NUMBER); 59443b3a8eb9SGleb Smirnoff } else { 59453b3a8eb9SGleb Smirnoff nodigits: 59463b3a8eb9SGleb Smirnoff while (p > buf + 1) 59473b3a8eb9SGleb Smirnoff lungetc(*--p); 59483b3a8eb9SGleb Smirnoff c = *--p; 59493b3a8eb9SGleb Smirnoff if (c == '-') 59503b3a8eb9SGleb Smirnoff return (c); 59513b3a8eb9SGleb Smirnoff } 59523b3a8eb9SGleb Smirnoff } 59533b3a8eb9SGleb Smirnoff 59543b3a8eb9SGleb Smirnoff #define allowed_in_string(x) \ 59553b3a8eb9SGleb Smirnoff (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 59563b3a8eb9SGleb Smirnoff x != '{' && x != '}' && x != '<' && x != '>' && \ 59573b3a8eb9SGleb Smirnoff x != '!' && x != '=' && x != '/' && x != '#' && \ 59583b3a8eb9SGleb Smirnoff x != ',')) 59593b3a8eb9SGleb Smirnoff 59603b3a8eb9SGleb Smirnoff if (isalnum(c) || c == ':' || c == '_') { 59613b3a8eb9SGleb Smirnoff do { 59623b3a8eb9SGleb Smirnoff *p++ = c; 59633b3a8eb9SGleb Smirnoff if ((unsigned)(p-buf) >= sizeof(buf)) { 59643b3a8eb9SGleb Smirnoff yyerror("string too long"); 59653b3a8eb9SGleb Smirnoff return (findeol()); 59663b3a8eb9SGleb Smirnoff } 59673b3a8eb9SGleb Smirnoff } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 59683b3a8eb9SGleb Smirnoff lungetc(c); 59693b3a8eb9SGleb Smirnoff *p = '\0'; 59703b3a8eb9SGleb Smirnoff if ((token = lookup(buf)) == STRING) 59713b3a8eb9SGleb Smirnoff if ((yylval.v.string = strdup(buf)) == NULL) 59723b3a8eb9SGleb Smirnoff err(1, "yylex: strdup"); 59733b3a8eb9SGleb Smirnoff return (token); 59743b3a8eb9SGleb Smirnoff } 59753b3a8eb9SGleb Smirnoff if (c == '\n') { 59763b3a8eb9SGleb Smirnoff yylval.lineno = file->lineno; 59773b3a8eb9SGleb Smirnoff file->lineno++; 59783b3a8eb9SGleb Smirnoff } 59793b3a8eb9SGleb Smirnoff if (c == EOF) 59803b3a8eb9SGleb Smirnoff return (0); 59813b3a8eb9SGleb Smirnoff return (c); 59823b3a8eb9SGleb Smirnoff } 59833b3a8eb9SGleb Smirnoff 59843b3a8eb9SGleb Smirnoff int 59853b3a8eb9SGleb Smirnoff check_file_secrecy(int fd, const char *fname) 59863b3a8eb9SGleb Smirnoff { 59873b3a8eb9SGleb Smirnoff struct stat st; 59883b3a8eb9SGleb Smirnoff 59893b3a8eb9SGleb Smirnoff if (fstat(fd, &st)) { 59903b3a8eb9SGleb Smirnoff warn("cannot stat %s", fname); 59913b3a8eb9SGleb Smirnoff return (-1); 59923b3a8eb9SGleb Smirnoff } 59933b3a8eb9SGleb Smirnoff if (st.st_uid != 0 && st.st_uid != getuid()) { 59943b3a8eb9SGleb Smirnoff warnx("%s: owner not root or current user", fname); 59953b3a8eb9SGleb Smirnoff return (-1); 59963b3a8eb9SGleb Smirnoff } 59973b3a8eb9SGleb Smirnoff if (st.st_mode & (S_IRWXG | S_IRWXO)) { 59983b3a8eb9SGleb Smirnoff warnx("%s: group/world readable/writeable", fname); 59993b3a8eb9SGleb Smirnoff return (-1); 60003b3a8eb9SGleb Smirnoff } 60013b3a8eb9SGleb Smirnoff return (0); 60023b3a8eb9SGleb Smirnoff } 60033b3a8eb9SGleb Smirnoff 60043b3a8eb9SGleb Smirnoff struct file * 60053b3a8eb9SGleb Smirnoff pushfile(const char *name, int secret) 60063b3a8eb9SGleb Smirnoff { 60073b3a8eb9SGleb Smirnoff struct file *nfile; 60083b3a8eb9SGleb Smirnoff 60093b3a8eb9SGleb Smirnoff if ((nfile = calloc(1, sizeof(struct file))) == NULL || 60103b3a8eb9SGleb Smirnoff (nfile->name = strdup(name)) == NULL) { 60113b3a8eb9SGleb Smirnoff warn("malloc"); 60123b3a8eb9SGleb Smirnoff return (NULL); 60133b3a8eb9SGleb Smirnoff } 60143b3a8eb9SGleb Smirnoff if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 60153b3a8eb9SGleb Smirnoff nfile->stream = stdin; 60163b3a8eb9SGleb Smirnoff free(nfile->name); 60173b3a8eb9SGleb Smirnoff if ((nfile->name = strdup("stdin")) == NULL) { 60183b3a8eb9SGleb Smirnoff warn("strdup"); 60193b3a8eb9SGleb Smirnoff free(nfile); 60203b3a8eb9SGleb Smirnoff return (NULL); 60213b3a8eb9SGleb Smirnoff } 60223b3a8eb9SGleb Smirnoff } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 60233b3a8eb9SGleb Smirnoff warn("%s", nfile->name); 60243b3a8eb9SGleb Smirnoff free(nfile->name); 60253b3a8eb9SGleb Smirnoff free(nfile); 60263b3a8eb9SGleb Smirnoff return (NULL); 60273b3a8eb9SGleb Smirnoff } else if (secret && 60283b3a8eb9SGleb Smirnoff check_file_secrecy(fileno(nfile->stream), nfile->name)) { 60293b3a8eb9SGleb Smirnoff fclose(nfile->stream); 60303b3a8eb9SGleb Smirnoff free(nfile->name); 60313b3a8eb9SGleb Smirnoff free(nfile); 60323b3a8eb9SGleb Smirnoff return (NULL); 60333b3a8eb9SGleb Smirnoff } 60343b3a8eb9SGleb Smirnoff nfile->lineno = 1; 60353b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&files, nfile, entry); 60363b3a8eb9SGleb Smirnoff return (nfile); 60373b3a8eb9SGleb Smirnoff } 60383b3a8eb9SGleb Smirnoff 60393b3a8eb9SGleb Smirnoff int 60403b3a8eb9SGleb Smirnoff popfile(void) 60413b3a8eb9SGleb Smirnoff { 60423b3a8eb9SGleb Smirnoff struct file *prev; 60433b3a8eb9SGleb Smirnoff 60443b3a8eb9SGleb Smirnoff if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 60453b3a8eb9SGleb Smirnoff prev->errors += file->errors; 60463b3a8eb9SGleb Smirnoff TAILQ_REMOVE(&files, file, entry); 60473b3a8eb9SGleb Smirnoff fclose(file->stream); 60483b3a8eb9SGleb Smirnoff free(file->name); 60493b3a8eb9SGleb Smirnoff free(file); 60503b3a8eb9SGleb Smirnoff file = prev; 60513b3a8eb9SGleb Smirnoff return (0); 60523b3a8eb9SGleb Smirnoff } 60533b3a8eb9SGleb Smirnoff return (EOF); 60543b3a8eb9SGleb Smirnoff } 60553b3a8eb9SGleb Smirnoff 60563b3a8eb9SGleb Smirnoff int 60573b3a8eb9SGleb Smirnoff parse_config(char *filename, struct pfctl *xpf) 60583b3a8eb9SGleb Smirnoff { 60593b3a8eb9SGleb Smirnoff int errors = 0; 60603b3a8eb9SGleb Smirnoff struct sym *sym; 60613b3a8eb9SGleb Smirnoff 60623b3a8eb9SGleb Smirnoff pf = xpf; 60633b3a8eb9SGleb Smirnoff errors = 0; 60643b3a8eb9SGleb Smirnoff rulestate = PFCTL_STATE_NONE; 60653b3a8eb9SGleb Smirnoff returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 60663b3a8eb9SGleb Smirnoff returnicmp6default = 60673b3a8eb9SGleb Smirnoff (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 60683b3a8eb9SGleb Smirnoff blockpolicy = PFRULE_DROP; 6069150182e3SKristof Provost failpolicy = PFRULE_DROP; 60703b3a8eb9SGleb Smirnoff require_order = 1; 60713b3a8eb9SGleb Smirnoff 60723b3a8eb9SGleb Smirnoff if ((file = pushfile(filename, 0)) == NULL) { 60733b3a8eb9SGleb Smirnoff warn("cannot open the main config file!"); 60743b3a8eb9SGleb Smirnoff return (-1); 60753b3a8eb9SGleb Smirnoff } 60763b3a8eb9SGleb Smirnoff 60773b3a8eb9SGleb Smirnoff yyparse(); 60783b3a8eb9SGleb Smirnoff errors = file->errors; 60793b3a8eb9SGleb Smirnoff popfile(); 60803b3a8eb9SGleb Smirnoff 60813b3a8eb9SGleb Smirnoff /* Free macros and check which have not been used. */ 60823b3a8eb9SGleb Smirnoff while ((sym = TAILQ_FIRST(&symhead))) { 60833b3a8eb9SGleb Smirnoff if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 60843b3a8eb9SGleb Smirnoff fprintf(stderr, "warning: macro '%s' not " 60853b3a8eb9SGleb Smirnoff "used\n", sym->nam); 60863b3a8eb9SGleb Smirnoff free(sym->nam); 60873b3a8eb9SGleb Smirnoff free(sym->val); 60883b3a8eb9SGleb Smirnoff TAILQ_REMOVE(&symhead, sym, entry); 60893b3a8eb9SGleb Smirnoff free(sym); 60903b3a8eb9SGleb Smirnoff } 60913b3a8eb9SGleb Smirnoff 60923b3a8eb9SGleb Smirnoff return (errors ? -1 : 0); 60933b3a8eb9SGleb Smirnoff } 60943b3a8eb9SGleb Smirnoff 60953b3a8eb9SGleb Smirnoff int 60963b3a8eb9SGleb Smirnoff symset(const char *nam, const char *val, int persist) 60973b3a8eb9SGleb Smirnoff { 60983b3a8eb9SGleb Smirnoff struct sym *sym; 60993b3a8eb9SGleb Smirnoff 61003b3a8eb9SGleb Smirnoff for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 61013b3a8eb9SGleb Smirnoff sym = TAILQ_NEXT(sym, entry)) 61023b3a8eb9SGleb Smirnoff ; /* nothing */ 61033b3a8eb9SGleb Smirnoff 61043b3a8eb9SGleb Smirnoff if (sym != NULL) { 61053b3a8eb9SGleb Smirnoff if (sym->persist == 1) 61063b3a8eb9SGleb Smirnoff return (0); 61073b3a8eb9SGleb Smirnoff else { 61083b3a8eb9SGleb Smirnoff free(sym->nam); 61093b3a8eb9SGleb Smirnoff free(sym->val); 61103b3a8eb9SGleb Smirnoff TAILQ_REMOVE(&symhead, sym, entry); 61113b3a8eb9SGleb Smirnoff free(sym); 61123b3a8eb9SGleb Smirnoff } 61133b3a8eb9SGleb Smirnoff } 61143b3a8eb9SGleb Smirnoff if ((sym = calloc(1, sizeof(*sym))) == NULL) 61153b3a8eb9SGleb Smirnoff return (-1); 61163b3a8eb9SGleb Smirnoff 61173b3a8eb9SGleb Smirnoff sym->nam = strdup(nam); 61183b3a8eb9SGleb Smirnoff if (sym->nam == NULL) { 61193b3a8eb9SGleb Smirnoff free(sym); 61203b3a8eb9SGleb Smirnoff return (-1); 61213b3a8eb9SGleb Smirnoff } 61223b3a8eb9SGleb Smirnoff sym->val = strdup(val); 61233b3a8eb9SGleb Smirnoff if (sym->val == NULL) { 61243b3a8eb9SGleb Smirnoff free(sym->nam); 61253b3a8eb9SGleb Smirnoff free(sym); 61263b3a8eb9SGleb Smirnoff return (-1); 61273b3a8eb9SGleb Smirnoff } 61283b3a8eb9SGleb Smirnoff sym->used = 0; 61293b3a8eb9SGleb Smirnoff sym->persist = persist; 61303b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(&symhead, sym, entry); 61313b3a8eb9SGleb Smirnoff return (0); 61323b3a8eb9SGleb Smirnoff } 61333b3a8eb9SGleb Smirnoff 61343b3a8eb9SGleb Smirnoff int 61353b3a8eb9SGleb Smirnoff pfctl_cmdline_symset(char *s) 61363b3a8eb9SGleb Smirnoff { 61373b3a8eb9SGleb Smirnoff char *sym, *val; 61383b3a8eb9SGleb Smirnoff int ret; 61393b3a8eb9SGleb Smirnoff 61403b3a8eb9SGleb Smirnoff if ((val = strrchr(s, '=')) == NULL) 61413b3a8eb9SGleb Smirnoff return (-1); 61423b3a8eb9SGleb Smirnoff 61433b3a8eb9SGleb Smirnoff if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 61443b3a8eb9SGleb Smirnoff err(1, "pfctl_cmdline_symset: malloc"); 61453b3a8eb9SGleb Smirnoff 61463b3a8eb9SGleb Smirnoff strlcpy(sym, s, strlen(s) - strlen(val) + 1); 61473b3a8eb9SGleb Smirnoff 61483b3a8eb9SGleb Smirnoff ret = symset(sym, val + 1, 1); 61493b3a8eb9SGleb Smirnoff free(sym); 61503b3a8eb9SGleb Smirnoff 61513b3a8eb9SGleb Smirnoff return (ret); 61523b3a8eb9SGleb Smirnoff } 61533b3a8eb9SGleb Smirnoff 61543b3a8eb9SGleb Smirnoff char * 61553b3a8eb9SGleb Smirnoff symget(const char *nam) 61563b3a8eb9SGleb Smirnoff { 61573b3a8eb9SGleb Smirnoff struct sym *sym; 61583b3a8eb9SGleb Smirnoff 61593b3a8eb9SGleb Smirnoff TAILQ_FOREACH(sym, &symhead, entry) 61603b3a8eb9SGleb Smirnoff if (strcmp(nam, sym->nam) == 0) { 61613b3a8eb9SGleb Smirnoff sym->used = 1; 61623b3a8eb9SGleb Smirnoff return (sym->val); 61633b3a8eb9SGleb Smirnoff } 61643b3a8eb9SGleb Smirnoff return (NULL); 61653b3a8eb9SGleb Smirnoff } 61663b3a8eb9SGleb Smirnoff 61673b3a8eb9SGleb Smirnoff void 6168e9eb0941SKristof Provost mv_rules(struct pfctl_ruleset *src, struct pfctl_ruleset *dst) 61693b3a8eb9SGleb Smirnoff { 61703b3a8eb9SGleb Smirnoff int i; 6171e9eb0941SKristof Provost struct pfctl_rule *r; 61723b3a8eb9SGleb Smirnoff 61733b3a8eb9SGleb Smirnoff for (i = 0; i < PF_RULESET_MAX; ++i) { 61743b3a8eb9SGleb Smirnoff while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 61753b3a8eb9SGleb Smirnoff != NULL) { 61763b3a8eb9SGleb Smirnoff TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 61773b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 61783b3a8eb9SGleb Smirnoff dst->anchor->match++; 61793b3a8eb9SGleb Smirnoff } 61803b3a8eb9SGleb Smirnoff src->anchor->match = 0; 61813b3a8eb9SGleb Smirnoff while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 61823b3a8eb9SGleb Smirnoff != NULL) { 61833b3a8eb9SGleb Smirnoff TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 61843b3a8eb9SGleb Smirnoff TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 61853b3a8eb9SGleb Smirnoff r, entries); 61863b3a8eb9SGleb Smirnoff } 61873b3a8eb9SGleb Smirnoff } 61883b3a8eb9SGleb Smirnoff } 61893b3a8eb9SGleb Smirnoff 61903b3a8eb9SGleb Smirnoff void 61913b3a8eb9SGleb Smirnoff decide_address_family(struct node_host *n, sa_family_t *af) 61923b3a8eb9SGleb Smirnoff { 61933b3a8eb9SGleb Smirnoff if (*af != 0 || n == NULL) 61943b3a8eb9SGleb Smirnoff return; 61953b3a8eb9SGleb Smirnoff *af = n->af; 61963b3a8eb9SGleb Smirnoff while ((n = n->next) != NULL) { 61973b3a8eb9SGleb Smirnoff if (n->af != *af) { 61983b3a8eb9SGleb Smirnoff *af = 0; 61993b3a8eb9SGleb Smirnoff return; 62003b3a8eb9SGleb Smirnoff } 62013b3a8eb9SGleb Smirnoff } 62023b3a8eb9SGleb Smirnoff } 62033b3a8eb9SGleb Smirnoff 62043b3a8eb9SGleb Smirnoff void 62053b3a8eb9SGleb Smirnoff remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 62063b3a8eb9SGleb Smirnoff { 62073b3a8eb9SGleb Smirnoff struct node_host *n = *nh, *prev = NULL; 62083b3a8eb9SGleb Smirnoff 62093b3a8eb9SGleb Smirnoff while (n != NULL) { 62103b3a8eb9SGleb Smirnoff if (*af && n->af && n->af != *af) { 62113b3a8eb9SGleb Smirnoff /* unlink and free n */ 62123b3a8eb9SGleb Smirnoff struct node_host *next = n->next; 62133b3a8eb9SGleb Smirnoff 62143b3a8eb9SGleb Smirnoff /* adjust tail pointer */ 62153b3a8eb9SGleb Smirnoff if (n == (*nh)->tail) 62163b3a8eb9SGleb Smirnoff (*nh)->tail = prev; 62173b3a8eb9SGleb Smirnoff /* adjust previous node's next pointer */ 62183b3a8eb9SGleb Smirnoff if (prev == NULL) 62193b3a8eb9SGleb Smirnoff *nh = next; 62203b3a8eb9SGleb Smirnoff else 62213b3a8eb9SGleb Smirnoff prev->next = next; 62223b3a8eb9SGleb Smirnoff /* free node */ 62233b3a8eb9SGleb Smirnoff if (n->ifname != NULL) 62243b3a8eb9SGleb Smirnoff free(n->ifname); 62253b3a8eb9SGleb Smirnoff free(n); 62263b3a8eb9SGleb Smirnoff n = next; 62273b3a8eb9SGleb Smirnoff } else { 62283b3a8eb9SGleb Smirnoff if (n->af && !*af) 62293b3a8eb9SGleb Smirnoff *af = n->af; 62303b3a8eb9SGleb Smirnoff prev = n; 62313b3a8eb9SGleb Smirnoff n = n->next; 62323b3a8eb9SGleb Smirnoff } 62333b3a8eb9SGleb Smirnoff } 62343b3a8eb9SGleb Smirnoff } 62353b3a8eb9SGleb Smirnoff 62363b3a8eb9SGleb Smirnoff int 62373b3a8eb9SGleb Smirnoff invalid_redirect(struct node_host *nh, sa_family_t af) 62383b3a8eb9SGleb Smirnoff { 62393b3a8eb9SGleb Smirnoff if (!af) { 62403b3a8eb9SGleb Smirnoff struct node_host *n; 62413b3a8eb9SGleb Smirnoff 62423b3a8eb9SGleb Smirnoff /* tables and dyniftl are ok without an address family */ 62433b3a8eb9SGleb Smirnoff for (n = nh; n != NULL; n = n->next) { 62443b3a8eb9SGleb Smirnoff if (n->addr.type != PF_ADDR_TABLE && 62453b3a8eb9SGleb Smirnoff n->addr.type != PF_ADDR_DYNIFTL) { 62463b3a8eb9SGleb Smirnoff yyerror("address family not given and " 62473b3a8eb9SGleb Smirnoff "translation address expands to multiple " 62483b3a8eb9SGleb Smirnoff "address families"); 62493b3a8eb9SGleb Smirnoff return (1); 62503b3a8eb9SGleb Smirnoff } 62513b3a8eb9SGleb Smirnoff } 62523b3a8eb9SGleb Smirnoff } 62533b3a8eb9SGleb Smirnoff if (nh == NULL) { 62543b3a8eb9SGleb Smirnoff yyerror("no translation address with matching address family " 62553b3a8eb9SGleb Smirnoff "found."); 62563b3a8eb9SGleb Smirnoff return (1); 62573b3a8eb9SGleb Smirnoff } 62583b3a8eb9SGleb Smirnoff return (0); 62593b3a8eb9SGleb Smirnoff } 62603b3a8eb9SGleb Smirnoff 62613b3a8eb9SGleb Smirnoff int 62623b3a8eb9SGleb Smirnoff atoul(char *s, u_long *ulvalp) 62633b3a8eb9SGleb Smirnoff { 62643b3a8eb9SGleb Smirnoff u_long ulval; 62653b3a8eb9SGleb Smirnoff char *ep; 62663b3a8eb9SGleb Smirnoff 62673b3a8eb9SGleb Smirnoff errno = 0; 62683b3a8eb9SGleb Smirnoff ulval = strtoul(s, &ep, 0); 62693b3a8eb9SGleb Smirnoff if (s[0] == '\0' || *ep != '\0') 62703b3a8eb9SGleb Smirnoff return (-1); 62713b3a8eb9SGleb Smirnoff if (errno == ERANGE && ulval == ULONG_MAX) 62723b3a8eb9SGleb Smirnoff return (-1); 62733b3a8eb9SGleb Smirnoff *ulvalp = ulval; 62743b3a8eb9SGleb Smirnoff return (0); 62753b3a8eb9SGleb Smirnoff } 62763b3a8eb9SGleb Smirnoff 62773b3a8eb9SGleb Smirnoff int 62783b3a8eb9SGleb Smirnoff getservice(char *n) 62793b3a8eb9SGleb Smirnoff { 62803b3a8eb9SGleb Smirnoff struct servent *s; 62813b3a8eb9SGleb Smirnoff u_long ulval; 62823b3a8eb9SGleb Smirnoff 62833b3a8eb9SGleb Smirnoff if (atoul(n, &ulval) == 0) { 62843b3a8eb9SGleb Smirnoff if (ulval > 65535) { 62853b3a8eb9SGleb Smirnoff yyerror("illegal port value %lu", ulval); 62863b3a8eb9SGleb Smirnoff return (-1); 62873b3a8eb9SGleb Smirnoff } 62883b3a8eb9SGleb Smirnoff return (htons(ulval)); 62893b3a8eb9SGleb Smirnoff } else { 62903b3a8eb9SGleb Smirnoff s = getservbyname(n, "tcp"); 62913b3a8eb9SGleb Smirnoff if (s == NULL) 62923b3a8eb9SGleb Smirnoff s = getservbyname(n, "udp"); 62933b3a8eb9SGleb Smirnoff if (s == NULL) { 62943b3a8eb9SGleb Smirnoff yyerror("unknown port %s", n); 62953b3a8eb9SGleb Smirnoff return (-1); 62963b3a8eb9SGleb Smirnoff } 62973b3a8eb9SGleb Smirnoff return (s->s_port); 62983b3a8eb9SGleb Smirnoff } 62993b3a8eb9SGleb Smirnoff } 63003b3a8eb9SGleb Smirnoff 63013b3a8eb9SGleb Smirnoff int 63026fcc8e04SKristof Provost rule_label(struct pfctl_rule *r, char *s[PF_RULE_MAX_LABEL_COUNT]) 63033b3a8eb9SGleb Smirnoff { 63046fcc8e04SKristof Provost for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) { 63056fcc8e04SKristof Provost if (s[i] == NULL) 63066fcc8e04SKristof Provost return (0); 63076fcc8e04SKristof Provost 63086fcc8e04SKristof Provost if (strlcpy(r->label[i], s[i], sizeof(r->label[0])) >= 63096fcc8e04SKristof Provost sizeof(r->label[0])) { 63103b3a8eb9SGleb Smirnoff yyerror("rule label too long (max %d chars)", 63116fcc8e04SKristof Provost sizeof(r->label[0])-1); 63123b3a8eb9SGleb Smirnoff return (-1); 63133b3a8eb9SGleb Smirnoff } 63143b3a8eb9SGleb Smirnoff } 63153b3a8eb9SGleb Smirnoff return (0); 63163b3a8eb9SGleb Smirnoff } 63173b3a8eb9SGleb Smirnoff 63183b3a8eb9SGleb Smirnoff u_int16_t 63193b3a8eb9SGleb Smirnoff parseicmpspec(char *w, sa_family_t af) 63203b3a8eb9SGleb Smirnoff { 63213b3a8eb9SGleb Smirnoff const struct icmpcodeent *p; 63223b3a8eb9SGleb Smirnoff u_long ulval; 63233b3a8eb9SGleb Smirnoff u_int8_t icmptype; 63243b3a8eb9SGleb Smirnoff 63253b3a8eb9SGleb Smirnoff if (af == AF_INET) 63263b3a8eb9SGleb Smirnoff icmptype = returnicmpdefault >> 8; 63273b3a8eb9SGleb Smirnoff else 63283b3a8eb9SGleb Smirnoff icmptype = returnicmp6default >> 8; 63293b3a8eb9SGleb Smirnoff 63303b3a8eb9SGleb Smirnoff if (atoul(w, &ulval) == -1) { 63313b3a8eb9SGleb Smirnoff if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 63323b3a8eb9SGleb Smirnoff yyerror("unknown icmp code %s", w); 63333b3a8eb9SGleb Smirnoff return (0); 63343b3a8eb9SGleb Smirnoff } 63353b3a8eb9SGleb Smirnoff ulval = p->code; 63363b3a8eb9SGleb Smirnoff } 63373b3a8eb9SGleb Smirnoff if (ulval > 255) { 63383b3a8eb9SGleb Smirnoff yyerror("invalid icmp code %lu", ulval); 63393b3a8eb9SGleb Smirnoff return (0); 63403b3a8eb9SGleb Smirnoff } 63413b3a8eb9SGleb Smirnoff return (icmptype << 8 | ulval); 63423b3a8eb9SGleb Smirnoff } 63433b3a8eb9SGleb Smirnoff 63443b3a8eb9SGleb Smirnoff int 63453b3a8eb9SGleb Smirnoff parseport(char *port, struct range *r, int extensions) 63463b3a8eb9SGleb Smirnoff { 63473b3a8eb9SGleb Smirnoff char *p = strchr(port, ':'); 63483b3a8eb9SGleb Smirnoff 63493b3a8eb9SGleb Smirnoff if (p == NULL) { 63503b3a8eb9SGleb Smirnoff if ((r->a = getservice(port)) == -1) 63513b3a8eb9SGleb Smirnoff return (-1); 63523b3a8eb9SGleb Smirnoff r->b = 0; 63533b3a8eb9SGleb Smirnoff r->t = PF_OP_NONE; 63543b3a8eb9SGleb Smirnoff return (0); 63553b3a8eb9SGleb Smirnoff } 63563b3a8eb9SGleb Smirnoff if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 63573b3a8eb9SGleb Smirnoff *p = 0; 63583b3a8eb9SGleb Smirnoff if ((r->a = getservice(port)) == -1) 63593b3a8eb9SGleb Smirnoff return (-1); 63603b3a8eb9SGleb Smirnoff r->b = 0; 63613b3a8eb9SGleb Smirnoff r->t = PF_OP_IRG; 63623b3a8eb9SGleb Smirnoff return (0); 63633b3a8eb9SGleb Smirnoff } 63643b3a8eb9SGleb Smirnoff if ((extensions & PPORT_RANGE)) { 63653b3a8eb9SGleb Smirnoff *p++ = 0; 63663b3a8eb9SGleb Smirnoff if ((r->a = getservice(port)) == -1 || 63673b3a8eb9SGleb Smirnoff (r->b = getservice(p)) == -1) 63683b3a8eb9SGleb Smirnoff return (-1); 63693b3a8eb9SGleb Smirnoff if (r->a == r->b) { 63703b3a8eb9SGleb Smirnoff r->b = 0; 63713b3a8eb9SGleb Smirnoff r->t = PF_OP_NONE; 63723b3a8eb9SGleb Smirnoff } else 63733b3a8eb9SGleb Smirnoff r->t = PF_OP_RRG; 63743b3a8eb9SGleb Smirnoff return (0); 63753b3a8eb9SGleb Smirnoff } 63763b3a8eb9SGleb Smirnoff return (-1); 63773b3a8eb9SGleb Smirnoff } 63783b3a8eb9SGleb Smirnoff 63793b3a8eb9SGleb Smirnoff int 63803b3a8eb9SGleb Smirnoff pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 63813b3a8eb9SGleb Smirnoff { 63823b3a8eb9SGleb Smirnoff struct loadanchors *la; 63833b3a8eb9SGleb Smirnoff 63843b3a8eb9SGleb Smirnoff TAILQ_FOREACH(la, &loadanchorshead, entries) { 63853b3a8eb9SGleb Smirnoff if (pf->opts & PF_OPT_VERBOSE) 63863b3a8eb9SGleb Smirnoff fprintf(stderr, "\nLoading anchor %s from %s\n", 63873b3a8eb9SGleb Smirnoff la->anchorname, la->filename); 63883b3a8eb9SGleb Smirnoff if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 63893b3a8eb9SGleb Smirnoff la->anchorname, trans) == -1) 63903b3a8eb9SGleb Smirnoff return (-1); 63913b3a8eb9SGleb Smirnoff } 63923b3a8eb9SGleb Smirnoff 63933b3a8eb9SGleb Smirnoff return (0); 63943b3a8eb9SGleb Smirnoff } 63953b3a8eb9SGleb Smirnoff 63963b3a8eb9SGleb Smirnoff int 63971f495578SKristof Provost kw_casecmp(const void *k, const void *e) 63981f495578SKristof Provost { 63991f495578SKristof Provost return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 64001f495578SKristof Provost } 64011f495578SKristof Provost 64021f495578SKristof Provost int 64031f495578SKristof Provost map_tos(char *s, int *val) 64041f495578SKristof Provost { 64051f495578SKristof Provost /* DiffServ Codepoints and other TOS mappings */ 64061f495578SKristof Provost const struct keywords toswords[] = { 64071f495578SKristof Provost { "af11", IPTOS_DSCP_AF11 }, 64081f495578SKristof Provost { "af12", IPTOS_DSCP_AF12 }, 64091f495578SKristof Provost { "af13", IPTOS_DSCP_AF13 }, 64101f495578SKristof Provost { "af21", IPTOS_DSCP_AF21 }, 64111f495578SKristof Provost { "af22", IPTOS_DSCP_AF22 }, 64121f495578SKristof Provost { "af23", IPTOS_DSCP_AF23 }, 64131f495578SKristof Provost { "af31", IPTOS_DSCP_AF31 }, 64141f495578SKristof Provost { "af32", IPTOS_DSCP_AF32 }, 64151f495578SKristof Provost { "af33", IPTOS_DSCP_AF33 }, 64161f495578SKristof Provost { "af41", IPTOS_DSCP_AF41 }, 64171f495578SKristof Provost { "af42", IPTOS_DSCP_AF42 }, 64181f495578SKristof Provost { "af43", IPTOS_DSCP_AF43 }, 64191f495578SKristof Provost { "critical", IPTOS_PREC_CRITIC_ECP }, 64201f495578SKristof Provost { "cs0", IPTOS_DSCP_CS0 }, 64211f495578SKristof Provost { "cs1", IPTOS_DSCP_CS1 }, 64221f495578SKristof Provost { "cs2", IPTOS_DSCP_CS2 }, 64231f495578SKristof Provost { "cs3", IPTOS_DSCP_CS3 }, 64241f495578SKristof Provost { "cs4", IPTOS_DSCP_CS4 }, 64251f495578SKristof Provost { "cs5", IPTOS_DSCP_CS5 }, 64261f495578SKristof Provost { "cs6", IPTOS_DSCP_CS6 }, 64271f495578SKristof Provost { "cs7", IPTOS_DSCP_CS7 }, 64281f495578SKristof Provost { "ef", IPTOS_DSCP_EF }, 64291f495578SKristof Provost { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 64301f495578SKristof Provost { "lowdelay", IPTOS_LOWDELAY }, 64311f495578SKristof Provost { "netcontrol", IPTOS_PREC_NETCONTROL }, 64321f495578SKristof Provost { "reliability", IPTOS_RELIABILITY }, 6433b4e3f3c2SKristof Provost { "throughput", IPTOS_THROUGHPUT }, 6434b4e3f3c2SKristof Provost { "va", IPTOS_DSCP_VA } 64351f495578SKristof Provost }; 64361f495578SKristof Provost const struct keywords *p; 64371f495578SKristof Provost 64381f495578SKristof Provost p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 64391f495578SKristof Provost sizeof(toswords[0]), kw_casecmp); 64401f495578SKristof Provost 64411f495578SKristof Provost if (p) { 64421f495578SKristof Provost *val = p->k_val; 64431f495578SKristof Provost return (1); 64441f495578SKristof Provost } 64451f495578SKristof Provost return (0); 64461f495578SKristof Provost } 64471f495578SKristof Provost 64481f495578SKristof Provost int 64493b3a8eb9SGleb Smirnoff rt_tableid_max(void) 64503b3a8eb9SGleb Smirnoff { 64513b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__ 64523b3a8eb9SGleb Smirnoff int fibs; 64533b3a8eb9SGleb Smirnoff size_t l = sizeof(fibs); 64543b3a8eb9SGleb Smirnoff 64553b3a8eb9SGleb Smirnoff if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1) 64563b3a8eb9SGleb Smirnoff fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */ 64573b3a8eb9SGleb Smirnoff /* 64583b3a8eb9SGleb Smirnoff * As the OpenBSD code only compares > and not >= we need to adjust 64593b3a8eb9SGleb Smirnoff * here given we only accept values of 0..n and want to avoid #ifdefs 6460b68ac800SPedro F. Giffuni * in the grammar. 64613b3a8eb9SGleb Smirnoff */ 64623b3a8eb9SGleb Smirnoff return (fibs - 1); 64633b3a8eb9SGleb Smirnoff #else 64643b3a8eb9SGleb Smirnoff return (RT_TABLEID_MAX); 64653b3a8eb9SGleb Smirnoff #endif 64663b3a8eb9SGleb Smirnoff } 6467