xref: /freebsd/sbin/pfctl/parse.y (revision c69121c473d75abab55f9ade8e8138ac09c0942c)
13b3a8eb9SGleb Smirnoff /*	$OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $	*/
23b3a8eb9SGleb Smirnoff 
31de7b4b8SPedro F. Giffuni /*-
41de7b4b8SPedro F. Giffuni  * SPDX-License-Identifier: BSD-2-Clause
51de7b4b8SPedro F. Giffuni  *
63b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
73b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
83b3a8eb9SGleb Smirnoff  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
93b3a8eb9SGleb Smirnoff  * Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
103b3a8eb9SGleb Smirnoff  *
113b3a8eb9SGleb Smirnoff  * Redistribution and use in source and binary forms, with or without
123b3a8eb9SGleb Smirnoff  * modification, are permitted provided that the following conditions
133b3a8eb9SGleb Smirnoff  * are met:
143b3a8eb9SGleb Smirnoff  * 1. Redistributions of source code must retain the above copyright
153b3a8eb9SGleb Smirnoff  *    notice, this list of conditions and the following disclaimer.
163b3a8eb9SGleb Smirnoff  * 2. Redistributions in binary form must reproduce the above copyright
173b3a8eb9SGleb Smirnoff  *    notice, this list of conditions and the following disclaimer in the
183b3a8eb9SGleb Smirnoff  *    documentation and/or other materials provided with the distribution.
193b3a8eb9SGleb Smirnoff  *
203b3a8eb9SGleb Smirnoff  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
213b3a8eb9SGleb Smirnoff  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
223b3a8eb9SGleb Smirnoff  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
233b3a8eb9SGleb Smirnoff  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
243b3a8eb9SGleb Smirnoff  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
253b3a8eb9SGleb Smirnoff  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
263b3a8eb9SGleb Smirnoff  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
273b3a8eb9SGleb Smirnoff  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
283b3a8eb9SGleb Smirnoff  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
293b3a8eb9SGleb Smirnoff  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
303b3a8eb9SGleb Smirnoff  */
313b3a8eb9SGleb Smirnoff %{
323b3a8eb9SGleb Smirnoff #include <sys/cdefs.h>
333b3a8eb9SGleb Smirnoff __FBSDID("$FreeBSD$");
343b3a8eb9SGleb Smirnoff 
35249cc75fSPatrick Kelsey #define PFIOC_USE_LATEST
36249cc75fSPatrick Kelsey 
373b3a8eb9SGleb Smirnoff #include <sys/types.h>
383b3a8eb9SGleb Smirnoff #include <sys/socket.h>
393b3a8eb9SGleb Smirnoff #include <sys/stat.h>
403b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
413b3a8eb9SGleb Smirnoff #include <sys/sysctl.h>
423b3a8eb9SGleb Smirnoff #endif
433b3a8eb9SGleb Smirnoff #include <net/if.h>
443b3a8eb9SGleb Smirnoff #include <netinet/in.h>
453b3a8eb9SGleb Smirnoff #include <netinet/in_systm.h>
463b3a8eb9SGleb Smirnoff #include <netinet/ip.h>
473b3a8eb9SGleb Smirnoff #include <netinet/ip_icmp.h>
483b3a8eb9SGleb Smirnoff #include <netinet/icmp6.h>
493b3a8eb9SGleb Smirnoff #include <net/pfvar.h>
503b3a8eb9SGleb Smirnoff #include <arpa/inet.h>
51772e66a6SGleb Smirnoff #include <net/altq/altq.h>
52772e66a6SGleb Smirnoff #include <net/altq/altq_cbq.h>
530a70aaf8SLuiz Otavio O Souza #include <net/altq/altq_codel.h>
54772e66a6SGleb Smirnoff #include <net/altq/altq_priq.h>
55772e66a6SGleb Smirnoff #include <net/altq/altq_hfsc.h>
56a5b789f6SErmal Luçi #include <net/altq/altq_fairq.h>
573b3a8eb9SGleb Smirnoff 
586fcc8e04SKristof Provost #include <assert.h>
593b3a8eb9SGleb Smirnoff #include <stdio.h>
603b3a8eb9SGleb Smirnoff #include <unistd.h>
613b3a8eb9SGleb Smirnoff #include <stdlib.h>
623b3a8eb9SGleb Smirnoff #include <netdb.h>
633b3a8eb9SGleb Smirnoff #include <stdarg.h>
643b3a8eb9SGleb Smirnoff #include <errno.h>
653b3a8eb9SGleb Smirnoff #include <string.h>
663b3a8eb9SGleb Smirnoff #include <ctype.h>
673b3a8eb9SGleb Smirnoff #include <math.h>
683b3a8eb9SGleb Smirnoff #include <err.h>
693b3a8eb9SGleb Smirnoff #include <limits.h>
703b3a8eb9SGleb Smirnoff #include <pwd.h>
713b3a8eb9SGleb Smirnoff #include <grp.h>
723b3a8eb9SGleb Smirnoff #include <md5.h>
733b3a8eb9SGleb Smirnoff 
743b3a8eb9SGleb Smirnoff #include "pfctl_parser.h"
753b3a8eb9SGleb Smirnoff #include "pfctl.h"
763b3a8eb9SGleb Smirnoff 
773b3a8eb9SGleb Smirnoff static struct pfctl	*pf = NULL;
783b3a8eb9SGleb Smirnoff static int		 debug = 0;
793b3a8eb9SGleb Smirnoff static int		 rulestate = 0;
803b3a8eb9SGleb Smirnoff static u_int16_t	 returnicmpdefault =
813b3a8eb9SGleb Smirnoff 			    (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
823b3a8eb9SGleb Smirnoff static u_int16_t	 returnicmp6default =
833b3a8eb9SGleb Smirnoff 			    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
843b3a8eb9SGleb Smirnoff static int		 blockpolicy = PFRULE_DROP;
85150182e3SKristof Provost static int		 failpolicy = PFRULE_DROP;
863b3a8eb9SGleb Smirnoff static int		 require_order = 1;
873b3a8eb9SGleb Smirnoff static int		 default_statelock;
883b3a8eb9SGleb Smirnoff 
8913cfafabSKristof Provost static TAILQ_HEAD(files, file)	 files = TAILQ_HEAD_INITIALIZER(files);
903b3a8eb9SGleb Smirnoff static struct file {
913b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(file)	 entry;
923b3a8eb9SGleb Smirnoff 	FILE			*stream;
933b3a8eb9SGleb Smirnoff 	char			*name;
943b3a8eb9SGleb Smirnoff 	int			 lineno;
953b3a8eb9SGleb Smirnoff 	int			 errors;
963b3a8eb9SGleb Smirnoff } *file;
973b3a8eb9SGleb Smirnoff struct file	*pushfile(const char *, int);
983b3a8eb9SGleb Smirnoff int		 popfile(void);
993b3a8eb9SGleb Smirnoff int		 check_file_secrecy(int, const char *);
1003b3a8eb9SGleb Smirnoff int		 yyparse(void);
1013b3a8eb9SGleb Smirnoff int		 yylex(void);
1023b3a8eb9SGleb Smirnoff int		 yyerror(const char *, ...);
1033b3a8eb9SGleb Smirnoff int		 kw_cmp(const void *, const void *);
1043b3a8eb9SGleb Smirnoff int		 lookup(char *);
1053b3a8eb9SGleb Smirnoff int		 lgetc(int);
1063b3a8eb9SGleb Smirnoff int		 lungetc(int);
1073b3a8eb9SGleb Smirnoff int		 findeol(void);
1083b3a8eb9SGleb Smirnoff 
10913cfafabSKristof Provost static TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
1103b3a8eb9SGleb Smirnoff struct sym {
1113b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(sym)	 entry;
1123b3a8eb9SGleb Smirnoff 	int			 used;
1133b3a8eb9SGleb Smirnoff 	int			 persist;
1143b3a8eb9SGleb Smirnoff 	char			*nam;
1153b3a8eb9SGleb Smirnoff 	char			*val;
1163b3a8eb9SGleb Smirnoff };
1173b3a8eb9SGleb Smirnoff int		 symset(const char *, const char *, int);
1183b3a8eb9SGleb Smirnoff char		*symget(const char *);
1193b3a8eb9SGleb Smirnoff 
1203b3a8eb9SGleb Smirnoff int		 atoul(char *, u_long *);
1213b3a8eb9SGleb Smirnoff 
1223b3a8eb9SGleb Smirnoff enum {
1233b3a8eb9SGleb Smirnoff 	PFCTL_STATE_NONE,
1243b3a8eb9SGleb Smirnoff 	PFCTL_STATE_OPTION,
1253b3a8eb9SGleb Smirnoff 	PFCTL_STATE_SCRUB,
1263b3a8eb9SGleb Smirnoff 	PFCTL_STATE_QUEUE,
1273b3a8eb9SGleb Smirnoff 	PFCTL_STATE_NAT,
1283b3a8eb9SGleb Smirnoff 	PFCTL_STATE_FILTER
1293b3a8eb9SGleb Smirnoff };
1303b3a8eb9SGleb Smirnoff 
1313b3a8eb9SGleb Smirnoff struct node_proto {
1323b3a8eb9SGleb Smirnoff 	u_int8_t		 proto;
1333b3a8eb9SGleb Smirnoff 	struct node_proto	*next;
1343b3a8eb9SGleb Smirnoff 	struct node_proto	*tail;
1353b3a8eb9SGleb Smirnoff };
1363b3a8eb9SGleb Smirnoff 
1373b3a8eb9SGleb Smirnoff struct node_port {
1383b3a8eb9SGleb Smirnoff 	u_int16_t		 port[2];
1393b3a8eb9SGleb Smirnoff 	u_int8_t		 op;
1403b3a8eb9SGleb Smirnoff 	struct node_port	*next;
1413b3a8eb9SGleb Smirnoff 	struct node_port	*tail;
1423b3a8eb9SGleb Smirnoff };
1433b3a8eb9SGleb Smirnoff 
1443b3a8eb9SGleb Smirnoff struct node_uid {
1453b3a8eb9SGleb Smirnoff 	uid_t			 uid[2];
1463b3a8eb9SGleb Smirnoff 	u_int8_t		 op;
1473b3a8eb9SGleb Smirnoff 	struct node_uid		*next;
1483b3a8eb9SGleb Smirnoff 	struct node_uid		*tail;
1493b3a8eb9SGleb Smirnoff };
1503b3a8eb9SGleb Smirnoff 
1513b3a8eb9SGleb Smirnoff struct node_gid {
1523b3a8eb9SGleb Smirnoff 	gid_t			 gid[2];
1533b3a8eb9SGleb Smirnoff 	u_int8_t		 op;
1543b3a8eb9SGleb Smirnoff 	struct node_gid		*next;
1553b3a8eb9SGleb Smirnoff 	struct node_gid		*tail;
1563b3a8eb9SGleb Smirnoff };
1573b3a8eb9SGleb Smirnoff 
1583b3a8eb9SGleb Smirnoff struct node_icmp {
1593b3a8eb9SGleb Smirnoff 	u_int8_t		 code;
1603b3a8eb9SGleb Smirnoff 	u_int8_t		 type;
1613b3a8eb9SGleb Smirnoff 	u_int8_t		 proto;
1623b3a8eb9SGleb Smirnoff 	struct node_icmp	*next;
1633b3a8eb9SGleb Smirnoff 	struct node_icmp	*tail;
1643b3a8eb9SGleb Smirnoff };
1653b3a8eb9SGleb Smirnoff 
1663b3a8eb9SGleb Smirnoff enum	{ PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
1673b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
1683b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
1693b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
1703b3a8eb9SGleb Smirnoff 	    PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, };
1713b3a8eb9SGleb Smirnoff 
1723b3a8eb9SGleb Smirnoff enum	{ PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
1733b3a8eb9SGleb Smirnoff 
1743b3a8eb9SGleb Smirnoff struct node_state_opt {
1753b3a8eb9SGleb Smirnoff 	int			 type;
1763b3a8eb9SGleb Smirnoff 	union {
1773b3a8eb9SGleb Smirnoff 		u_int32_t	 max_states;
1783b3a8eb9SGleb Smirnoff 		u_int32_t	 max_src_states;
1793b3a8eb9SGleb Smirnoff 		u_int32_t	 max_src_conn;
1803b3a8eb9SGleb Smirnoff 		struct {
1813b3a8eb9SGleb Smirnoff 			u_int32_t	limit;
1823b3a8eb9SGleb Smirnoff 			u_int32_t	seconds;
1833b3a8eb9SGleb Smirnoff 		}		 max_src_conn_rate;
1843b3a8eb9SGleb Smirnoff 		struct {
1853b3a8eb9SGleb Smirnoff 			u_int8_t	flush;
1863b3a8eb9SGleb Smirnoff 			char		tblname[PF_TABLE_NAME_SIZE];
1873b3a8eb9SGleb Smirnoff 		}		 overload;
1883b3a8eb9SGleb Smirnoff 		u_int32_t	 max_src_nodes;
1893b3a8eb9SGleb Smirnoff 		u_int8_t	 src_track;
1903b3a8eb9SGleb Smirnoff 		u_int32_t	 statelock;
1913b3a8eb9SGleb Smirnoff 		struct {
1923b3a8eb9SGleb Smirnoff 			int		number;
1933b3a8eb9SGleb Smirnoff 			u_int32_t	seconds;
1943b3a8eb9SGleb Smirnoff 		}		 timeout;
1953b3a8eb9SGleb Smirnoff 	}			 data;
1963b3a8eb9SGleb Smirnoff 	struct node_state_opt	*next;
1973b3a8eb9SGleb Smirnoff 	struct node_state_opt	*tail;
1983b3a8eb9SGleb Smirnoff };
1993b3a8eb9SGleb Smirnoff 
2003b3a8eb9SGleb Smirnoff struct peer {
2013b3a8eb9SGleb Smirnoff 	struct node_host	*host;
2023b3a8eb9SGleb Smirnoff 	struct node_port	*port;
2033b3a8eb9SGleb Smirnoff };
2043b3a8eb9SGleb Smirnoff 
20513cfafabSKristof Provost static struct node_queue {
2063b3a8eb9SGleb Smirnoff 	char			 queue[PF_QNAME_SIZE];
2073b3a8eb9SGleb Smirnoff 	char			 parent[PF_QNAME_SIZE];
2083b3a8eb9SGleb Smirnoff 	char			 ifname[IFNAMSIZ];
2093b3a8eb9SGleb Smirnoff 	int			 scheduler;
2103b3a8eb9SGleb Smirnoff 	struct node_queue	*next;
2113b3a8eb9SGleb Smirnoff 	struct node_queue	*tail;
2123b3a8eb9SGleb Smirnoff }	*queues = NULL;
2133b3a8eb9SGleb Smirnoff 
2143b3a8eb9SGleb Smirnoff struct node_qassign {
2153b3a8eb9SGleb Smirnoff 	char		*qname;
2163b3a8eb9SGleb Smirnoff 	char		*pqname;
2173b3a8eb9SGleb Smirnoff };
2183b3a8eb9SGleb Smirnoff 
21913cfafabSKristof Provost static struct filter_opts {
2203b3a8eb9SGleb Smirnoff 	int			 marker;
2213b3a8eb9SGleb Smirnoff #define FOM_FLAGS	0x01
2223b3a8eb9SGleb Smirnoff #define FOM_ICMP	0x02
2233b3a8eb9SGleb Smirnoff #define FOM_TOS		0x04
2243b3a8eb9SGleb Smirnoff #define FOM_KEEP	0x08
2253b3a8eb9SGleb Smirnoff #define FOM_SRCTRACK	0x10
2263e248e0fSKristof Provost #define FOM_SETPRIO	0x0400
2273e248e0fSKristof Provost #define FOM_PRIO	0x2000
2283b3a8eb9SGleb Smirnoff 	struct node_uid		*uid;
2293b3a8eb9SGleb Smirnoff 	struct node_gid		*gid;
2303b3a8eb9SGleb Smirnoff 	struct {
2313b3a8eb9SGleb Smirnoff 		u_int8_t	 b1;
2323b3a8eb9SGleb Smirnoff 		u_int8_t	 b2;
2333b3a8eb9SGleb Smirnoff 		u_int16_t	 w;
2343b3a8eb9SGleb Smirnoff 		u_int16_t	 w2;
2353b3a8eb9SGleb Smirnoff 	} flags;
2363b3a8eb9SGleb Smirnoff 	struct node_icmp	*icmpspec;
2373b3a8eb9SGleb Smirnoff 	u_int32_t		 tos;
2383b3a8eb9SGleb Smirnoff 	u_int32_t		 prob;
2393b3a8eb9SGleb Smirnoff 	struct {
2403b3a8eb9SGleb Smirnoff 		int			 action;
2413b3a8eb9SGleb Smirnoff 		struct node_state_opt	*options;
2423b3a8eb9SGleb Smirnoff 	} keep;
2433b3a8eb9SGleb Smirnoff 	int			 fragment;
2443b3a8eb9SGleb Smirnoff 	int			 allowopts;
2456fcc8e04SKristof Provost 	char			*label[PF_RULE_MAX_LABEL_COUNT];
2466fcc8e04SKristof Provost 	int			 labelcount;
2473b3a8eb9SGleb Smirnoff 	struct node_qassign	 queues;
2483b3a8eb9SGleb Smirnoff 	char			*tag;
2493b3a8eb9SGleb Smirnoff 	char			*match_tag;
2503b3a8eb9SGleb Smirnoff 	u_int8_t		 match_tag_not;
2513b3a8eb9SGleb Smirnoff 	u_int			 rtableid;
2523e248e0fSKristof Provost 	u_int8_t		 prio;
2533e248e0fSKristof Provost 	u_int8_t		 set_prio[2];
2543b3a8eb9SGleb Smirnoff 	struct {
2553b3a8eb9SGleb Smirnoff 		struct node_host	*addr;
2563b3a8eb9SGleb Smirnoff 		u_int16_t		port;
2573b3a8eb9SGleb Smirnoff 	}			 divert;
2583b3a8eb9SGleb Smirnoff } filter_opts;
2593b3a8eb9SGleb Smirnoff 
26013cfafabSKristof Provost static struct antispoof_opts {
2616fcc8e04SKristof Provost 	char			*label[PF_RULE_MAX_LABEL_COUNT];
2626fcc8e04SKristof Provost 	int			 labelcount;
2633b3a8eb9SGleb Smirnoff 	u_int			 rtableid;
2643b3a8eb9SGleb Smirnoff } antispoof_opts;
2653b3a8eb9SGleb Smirnoff 
26613cfafabSKristof Provost static struct scrub_opts {
2673b3a8eb9SGleb Smirnoff 	int			 marker;
2683b3a8eb9SGleb Smirnoff #define SOM_MINTTL	0x01
2693b3a8eb9SGleb Smirnoff #define SOM_MAXMSS	0x02
2703b3a8eb9SGleb Smirnoff #define SOM_FRAGCACHE	0x04
2713b3a8eb9SGleb Smirnoff #define SOM_SETTOS	0x08
2723b3a8eb9SGleb Smirnoff 	int			 nodf;
2733b3a8eb9SGleb Smirnoff 	int			 minttl;
2743b3a8eb9SGleb Smirnoff 	int			 maxmss;
2753b3a8eb9SGleb Smirnoff 	int			 settos;
2763b3a8eb9SGleb Smirnoff 	int			 fragcache;
2773b3a8eb9SGleb Smirnoff 	int			 randomid;
2783b3a8eb9SGleb Smirnoff 	int			 reassemble_tcp;
2793b3a8eb9SGleb Smirnoff 	char			*match_tag;
2803b3a8eb9SGleb Smirnoff 	u_int8_t		 match_tag_not;
2813b3a8eb9SGleb Smirnoff 	u_int			 rtableid;
2823b3a8eb9SGleb Smirnoff } scrub_opts;
2833b3a8eb9SGleb Smirnoff 
28413cfafabSKristof Provost static struct queue_opts {
2853b3a8eb9SGleb Smirnoff 	int			marker;
2863b3a8eb9SGleb Smirnoff #define QOM_BWSPEC	0x01
2873b3a8eb9SGleb Smirnoff #define QOM_SCHEDULER	0x02
2883b3a8eb9SGleb Smirnoff #define QOM_PRIORITY	0x04
2893b3a8eb9SGleb Smirnoff #define QOM_TBRSIZE	0x08
2903b3a8eb9SGleb Smirnoff #define QOM_QLIMIT	0x10
2913b3a8eb9SGleb Smirnoff 	struct node_queue_bw	queue_bwspec;
2923b3a8eb9SGleb Smirnoff 	struct node_queue_opt	scheduler;
2933b3a8eb9SGleb Smirnoff 	int			priority;
294249cc75fSPatrick Kelsey 	unsigned int		tbrsize;
2953b3a8eb9SGleb Smirnoff 	int			qlimit;
2963b3a8eb9SGleb Smirnoff } queue_opts;
2973b3a8eb9SGleb Smirnoff 
29813cfafabSKristof Provost static struct table_opts {
2993b3a8eb9SGleb Smirnoff 	int			flags;
3003b3a8eb9SGleb Smirnoff 	int			init_addr;
3013b3a8eb9SGleb Smirnoff 	struct node_tinithead	init_nodes;
3023b3a8eb9SGleb Smirnoff } table_opts;
3033b3a8eb9SGleb Smirnoff 
30413cfafabSKristof Provost static struct pool_opts {
3053b3a8eb9SGleb Smirnoff 	int			 marker;
3063b3a8eb9SGleb Smirnoff #define POM_TYPE		0x01
3073b3a8eb9SGleb Smirnoff #define POM_STICKYADDRESS	0x02
3083b3a8eb9SGleb Smirnoff 	u_int8_t		 opts;
3093b3a8eb9SGleb Smirnoff 	int			 type;
3103b3a8eb9SGleb Smirnoff 	int			 staticport;
3113b3a8eb9SGleb Smirnoff 	struct pf_poolhashkey	*key;
3122aa21096SKurosawa Takahiro 	struct pf_mape_portset	 mape;
3133b3a8eb9SGleb Smirnoff 
3143b3a8eb9SGleb Smirnoff } pool_opts;
3153b3a8eb9SGleb Smirnoff 
31613cfafabSKristof Provost static struct codel_opts	 codel_opts;
31713cfafabSKristof Provost static struct node_hfsc_opts	 hfsc_opts;
31813cfafabSKristof Provost static struct node_fairq_opts	 fairq_opts;
31913cfafabSKristof Provost static struct node_state_opt	*keep_state_defaults = NULL;
3203b3a8eb9SGleb Smirnoff 
3213b3a8eb9SGleb Smirnoff int		 disallow_table(struct node_host *, const char *);
3223b3a8eb9SGleb Smirnoff int		 disallow_urpf_failed(struct node_host *, const char *);
3233b3a8eb9SGleb Smirnoff int		 disallow_alias(struct node_host *, const char *);
324e9eb0941SKristof Provost int		 rule_consistent(struct pfctl_rule *, int);
325e9eb0941SKristof Provost int		 filter_consistent(struct pfctl_rule *, int);
326e9eb0941SKristof Provost int		 nat_consistent(struct pfctl_rule *);
327e9eb0941SKristof Provost int		 rdr_consistent(struct pfctl_rule *);
3283b3a8eb9SGleb Smirnoff int		 process_tabledef(char *, struct table_opts *);
3293b3a8eb9SGleb Smirnoff void		 expand_label_str(char *, size_t, const char *, const char *);
3303b3a8eb9SGleb Smirnoff void		 expand_label_if(const char *, char *, size_t, const char *);
3313b3a8eb9SGleb Smirnoff void		 expand_label_addr(const char *, char *, size_t, u_int8_t,
3323b3a8eb9SGleb Smirnoff 		    struct node_host *);
3333b3a8eb9SGleb Smirnoff void		 expand_label_port(const char *, char *, size_t,
3343b3a8eb9SGleb Smirnoff 		    struct node_port *);
3353b3a8eb9SGleb Smirnoff void		 expand_label_proto(const char *, char *, size_t, u_int8_t);
3363b3a8eb9SGleb Smirnoff void		 expand_label_nr(const char *, char *, size_t);
3373b3a8eb9SGleb Smirnoff void		 expand_label(char *, size_t, const char *, u_int8_t,
3383b3a8eb9SGleb Smirnoff 		    struct node_host *, struct node_port *, struct node_host *,
3393b3a8eb9SGleb Smirnoff 		    struct node_port *, u_int8_t);
340e9eb0941SKristof Provost void		 expand_rule(struct pfctl_rule *, struct node_if *,
3413b3a8eb9SGleb Smirnoff 		    struct node_host *, struct node_proto *, struct node_os *,
3423b3a8eb9SGleb Smirnoff 		    struct node_host *, struct node_port *, struct node_host *,
3433b3a8eb9SGleb Smirnoff 		    struct node_port *, struct node_uid *, struct node_gid *,
3443b3a8eb9SGleb Smirnoff 		    struct node_icmp *, const char *);
3453b3a8eb9SGleb Smirnoff int		 expand_altq(struct pf_altq *, struct node_if *,
3463b3a8eb9SGleb Smirnoff 		    struct node_queue *, struct node_queue_bw bwspec,
3473b3a8eb9SGleb Smirnoff 		    struct node_queue_opt *);
3483b3a8eb9SGleb Smirnoff int		 expand_queue(struct pf_altq *, struct node_if *,
3493b3a8eb9SGleb Smirnoff 		    struct node_queue *, struct node_queue_bw,
3503b3a8eb9SGleb Smirnoff 		    struct node_queue_opt *);
3513b3a8eb9SGleb Smirnoff int		 expand_skip_interface(struct node_if *);
3523b3a8eb9SGleb Smirnoff 
3533b3a8eb9SGleb Smirnoff int	 check_rulestate(int);
3543b3a8eb9SGleb Smirnoff int	 getservice(char *);
3556fcc8e04SKristof Provost int	 rule_label(struct pfctl_rule *, char *s[PF_RULE_MAX_LABEL_COUNT]);
3563b3a8eb9SGleb Smirnoff int	 rt_tableid_max(void);
3573b3a8eb9SGleb Smirnoff 
358e9eb0941SKristof Provost void	 mv_rules(struct pfctl_ruleset *, struct pfctl_ruleset *);
3593b3a8eb9SGleb Smirnoff void	 decide_address_family(struct node_host *, sa_family_t *);
3603b3a8eb9SGleb Smirnoff void	 remove_invalid_hosts(struct node_host **, sa_family_t *);
3613b3a8eb9SGleb Smirnoff int	 invalid_redirect(struct node_host *, sa_family_t);
3623b3a8eb9SGleb Smirnoff u_int16_t parseicmpspec(char *, sa_family_t);
3631f495578SKristof Provost int	 kw_casecmp(const void *, const void *);
3641f495578SKristof Provost int	 map_tos(char *string, int *);
3653b3a8eb9SGleb Smirnoff 
36613cfafabSKristof Provost static TAILQ_HEAD(loadanchorshead, loadanchors)
3673b3a8eb9SGleb Smirnoff     loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
3683b3a8eb9SGleb Smirnoff 
3693b3a8eb9SGleb Smirnoff struct loadanchors {
3703b3a8eb9SGleb Smirnoff 	TAILQ_ENTRY(loadanchors)	 entries;
3713b3a8eb9SGleb Smirnoff 	char				*anchorname;
3723b3a8eb9SGleb Smirnoff 	char				*filename;
3733b3a8eb9SGleb Smirnoff };
3743b3a8eb9SGleb Smirnoff 
3753b3a8eb9SGleb Smirnoff typedef struct {
3763b3a8eb9SGleb Smirnoff 	union {
3773b3a8eb9SGleb Smirnoff 		int64_t			 number;
3783b3a8eb9SGleb Smirnoff 		double			 probability;
3793b3a8eb9SGleb Smirnoff 		int			 i;
3803b3a8eb9SGleb Smirnoff 		char			*string;
3813b3a8eb9SGleb Smirnoff 		u_int			 rtableid;
3823b3a8eb9SGleb Smirnoff 		struct {
3833b3a8eb9SGleb Smirnoff 			u_int8_t	 b1;
3843b3a8eb9SGleb Smirnoff 			u_int8_t	 b2;
3853b3a8eb9SGleb Smirnoff 			u_int16_t	 w;
3863b3a8eb9SGleb Smirnoff 			u_int16_t	 w2;
3873b3a8eb9SGleb Smirnoff 		}			 b;
3883b3a8eb9SGleb Smirnoff 		struct range {
3893b3a8eb9SGleb Smirnoff 			int		 a;
3903b3a8eb9SGleb Smirnoff 			int		 b;
3913b3a8eb9SGleb Smirnoff 			int		 t;
3923b3a8eb9SGleb Smirnoff 		}			 range;
3933b3a8eb9SGleb Smirnoff 		struct node_if		*interface;
3943b3a8eb9SGleb Smirnoff 		struct node_proto	*proto;
3953b3a8eb9SGleb Smirnoff 		struct node_icmp	*icmp;
3963b3a8eb9SGleb Smirnoff 		struct node_host	*host;
3973b3a8eb9SGleb Smirnoff 		struct node_os		*os;
3983b3a8eb9SGleb Smirnoff 		struct node_port	*port;
3993b3a8eb9SGleb Smirnoff 		struct node_uid		*uid;
4003b3a8eb9SGleb Smirnoff 		struct node_gid		*gid;
4013b3a8eb9SGleb Smirnoff 		struct node_state_opt	*state_opt;
4023b3a8eb9SGleb Smirnoff 		struct peer		 peer;
4033b3a8eb9SGleb Smirnoff 		struct {
4043b3a8eb9SGleb Smirnoff 			struct peer	 src, dst;
4053b3a8eb9SGleb Smirnoff 			struct node_os	*src_os;
4063b3a8eb9SGleb Smirnoff 		}			 fromto;
4073b3a8eb9SGleb Smirnoff 		struct {
4083b3a8eb9SGleb Smirnoff 			struct node_host	*host;
4093b3a8eb9SGleb Smirnoff 			u_int8_t		 rt;
4103b3a8eb9SGleb Smirnoff 			u_int8_t		 pool_opts;
4113b3a8eb9SGleb Smirnoff 			sa_family_t		 af;
4123b3a8eb9SGleb Smirnoff 			struct pf_poolhashkey	*key;
4133b3a8eb9SGleb Smirnoff 		}			 route;
4143b3a8eb9SGleb Smirnoff 		struct redirection {
4153b3a8eb9SGleb Smirnoff 			struct node_host	*host;
4163b3a8eb9SGleb Smirnoff 			struct range		 rport;
4173b3a8eb9SGleb Smirnoff 		}			*redirection;
4183b3a8eb9SGleb Smirnoff 		struct {
4193b3a8eb9SGleb Smirnoff 			int			 action;
4203b3a8eb9SGleb Smirnoff 			struct node_state_opt	*options;
4213b3a8eb9SGleb Smirnoff 		}			 keep_state;
4223b3a8eb9SGleb Smirnoff 		struct {
4233b3a8eb9SGleb Smirnoff 			u_int8_t	 log;
4243b3a8eb9SGleb Smirnoff 			u_int8_t	 logif;
4253b3a8eb9SGleb Smirnoff 			u_int8_t	 quick;
4263b3a8eb9SGleb Smirnoff 		}			 logquick;
4273b3a8eb9SGleb Smirnoff 		struct {
4283b3a8eb9SGleb Smirnoff 			int		 neg;
4293b3a8eb9SGleb Smirnoff 			char		*name;
4303b3a8eb9SGleb Smirnoff 		}			 tagged;
4313b3a8eb9SGleb Smirnoff 		struct pf_poolhashkey	*hashkey;
4323b3a8eb9SGleb Smirnoff 		struct node_queue	*queue;
4333b3a8eb9SGleb Smirnoff 		struct node_queue_opt	 queue_options;
4343b3a8eb9SGleb Smirnoff 		struct node_queue_bw	 queue_bwspec;
4353b3a8eb9SGleb Smirnoff 		struct node_qassign	 qassign;
4363b3a8eb9SGleb Smirnoff 		struct filter_opts	 filter_opts;
4373b3a8eb9SGleb Smirnoff 		struct antispoof_opts	 antispoof_opts;
4383b3a8eb9SGleb Smirnoff 		struct queue_opts	 queue_opts;
4393b3a8eb9SGleb Smirnoff 		struct scrub_opts	 scrub_opts;
4403b3a8eb9SGleb Smirnoff 		struct table_opts	 table_opts;
4413b3a8eb9SGleb Smirnoff 		struct pool_opts	 pool_opts;
4423b3a8eb9SGleb Smirnoff 		struct node_hfsc_opts	 hfsc_opts;
443a5b789f6SErmal Luçi 		struct node_fairq_opts	 fairq_opts;
4440a70aaf8SLuiz Otavio O Souza 		struct codel_opts	 codel_opts;
4453b3a8eb9SGleb Smirnoff 	} v;
4463b3a8eb9SGleb Smirnoff 	int lineno;
4473b3a8eb9SGleb Smirnoff } YYSTYPE;
4483b3a8eb9SGleb Smirnoff 
4493b3a8eb9SGleb Smirnoff #define PPORT_RANGE	1
4503b3a8eb9SGleb Smirnoff #define PPORT_STAR	2
4513b3a8eb9SGleb Smirnoff int	parseport(char *, struct range *r, int);
4523b3a8eb9SGleb Smirnoff 
4533b3a8eb9SGleb Smirnoff #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
4543b3a8eb9SGleb Smirnoff 	(!((addr).iflags & PFI_AFLAG_NOALIAS) ||		 \
4553b3a8eb9SGleb Smirnoff 	!isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
4563b3a8eb9SGleb Smirnoff 
4573b3a8eb9SGleb Smirnoff %}
4583b3a8eb9SGleb Smirnoff 
459ef950daaSKristof Provost %token	PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
4603b3a8eb9SGleb Smirnoff %token	RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
4613b3a8eb9SGleb Smirnoff %token	ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
4623b3a8eb9SGleb Smirnoff %token	MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
4633b3a8eb9SGleb Smirnoff %token	NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
4643b3a8eb9SGleb Smirnoff %token	REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
465150182e3SKristof Provost %token	SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY FAILPOLICY
466150182e3SKristof Provost %token	RANDOMID REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
467*c69121c4SKristof Provost %token	ANTISPOOF FOR INCLUDE KEEPCOUNTERS SYNCOOKIES
4682aa21096SKurosawa Takahiro %token	BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET
4690a70aaf8SLuiz Otavio O Souza %token	ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME
4700a70aaf8SLuiz Otavio O Souza %token	UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL
4713e248e0fSKristof Provost %token	LOAD RULESET_OPTIMIZATION PRIO
4723b3a8eb9SGleb Smirnoff %token	STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
4733b3a8eb9SGleb Smirnoff %token	MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY
4743b3a8eb9SGleb Smirnoff %token	TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS
4753b3a8eb9SGleb Smirnoff %token	DIVERTTO DIVERTREPLY
4763b3a8eb9SGleb Smirnoff %token	<v.string>		STRING
4773b3a8eb9SGleb Smirnoff %token	<v.number>		NUMBER
4783b3a8eb9SGleb Smirnoff %token	<v.i>			PORTBINARY
4793b3a8eb9SGleb Smirnoff %type	<v.interface>		interface if_list if_item_not if_item
4803b3a8eb9SGleb Smirnoff %type	<v.number>		number icmptype icmp6type uid gid
4813b3a8eb9SGleb Smirnoff %type	<v.number>		tos not yesno
4823b3a8eb9SGleb Smirnoff %type	<v.probability>		probability
483*c69121c4SKristof Provost %type	<v.i>			no dir af fragcache optimizer syncookie_val
4843b3a8eb9SGleb Smirnoff %type	<v.i>			sourcetrack flush unaryop statelock
4853b3a8eb9SGleb Smirnoff %type	<v.b>			action nataction natpasslog scrubaction
4863e248e0fSKristof Provost %type	<v.b>			flags flag blockspec prio
4873b3a8eb9SGleb Smirnoff %type	<v.range>		portplain portstar portrange
4883b3a8eb9SGleb Smirnoff %type	<v.hashkey>		hashkey
4893b3a8eb9SGleb Smirnoff %type	<v.proto>		proto proto_list proto_item
4903b3a8eb9SGleb Smirnoff %type	<v.number>		protoval
4913b3a8eb9SGleb Smirnoff %type	<v.icmp>		icmpspec
4923b3a8eb9SGleb Smirnoff %type	<v.icmp>		icmp_list icmp_item
4933b3a8eb9SGleb Smirnoff %type	<v.icmp>		icmp6_list icmp6_item
4943b3a8eb9SGleb Smirnoff %type	<v.number>		reticmpspec reticmp6spec
4953b3a8eb9SGleb Smirnoff %type	<v.fromto>		fromto
4963b3a8eb9SGleb Smirnoff %type	<v.peer>		ipportspec from to
4973b3a8eb9SGleb Smirnoff %type	<v.host>		ipspec toipspec xhost host dynaddr host_list
4983b3a8eb9SGleb Smirnoff %type	<v.host>		redir_host_list redirspec
4993b3a8eb9SGleb Smirnoff %type	<v.host>		route_host route_host_list routespec
5003b3a8eb9SGleb Smirnoff %type	<v.os>			os xos os_list
5013b3a8eb9SGleb Smirnoff %type	<v.port>		portspec port_list port_item
5023b3a8eb9SGleb Smirnoff %type	<v.uid>			uids uid_list uid_item
5033b3a8eb9SGleb Smirnoff %type	<v.gid>			gids gid_list gid_item
5043b3a8eb9SGleb Smirnoff %type	<v.route>		route
5053b3a8eb9SGleb Smirnoff %type	<v.redirection>		redirection redirpool
5063b3a8eb9SGleb Smirnoff %type	<v.string>		label stringall tag anchorname
5073b3a8eb9SGleb Smirnoff %type	<v.string>		string varstring numberstring
5083b3a8eb9SGleb Smirnoff %type	<v.keep_state>		keep
5093b3a8eb9SGleb Smirnoff %type	<v.state_opt>		state_opt_spec state_opt_list state_opt_item
5103b3a8eb9SGleb Smirnoff %type	<v.logquick>		logquick quick log logopts logopt
5113b3a8eb9SGleb Smirnoff %type	<v.interface>		antispoof_ifspc antispoof_iflst antispoof_if
5123b3a8eb9SGleb Smirnoff %type	<v.qassign>		qname
5133b3a8eb9SGleb Smirnoff %type	<v.queue>		qassign qassign_list qassign_item
5143b3a8eb9SGleb Smirnoff %type	<v.queue_options>	scheduler
5153b3a8eb9SGleb Smirnoff %type	<v.number>		cbqflags_list cbqflags_item
5163b3a8eb9SGleb Smirnoff %type	<v.number>		priqflags_list priqflags_item
5173b3a8eb9SGleb Smirnoff %type	<v.hfsc_opts>		hfscopts_list hfscopts_item hfsc_opts
518a5b789f6SErmal Luçi %type	<v.fairq_opts>		fairqopts_list fairqopts_item fairq_opts
5190a70aaf8SLuiz Otavio O Souza %type	<v.codel_opts>		codelopts_list codelopts_item codel_opts
5203b3a8eb9SGleb Smirnoff %type	<v.queue_bwspec>	bandwidth
5213b3a8eb9SGleb Smirnoff %type	<v.filter_opts>		filter_opts filter_opt filter_opts_l
5223e248e0fSKristof Provost %type	<v.filter_opts>		filter_sets filter_set filter_sets_l
5233b3a8eb9SGleb Smirnoff %type	<v.antispoof_opts>	antispoof_opts antispoof_opt antispoof_opts_l
5243b3a8eb9SGleb Smirnoff %type	<v.queue_opts>		queue_opts queue_opt queue_opts_l
5253b3a8eb9SGleb Smirnoff %type	<v.scrub_opts>		scrub_opts scrub_opt scrub_opts_l
5263b3a8eb9SGleb Smirnoff %type	<v.table_opts>		table_opts table_opt table_opts_l
5273b3a8eb9SGleb Smirnoff %type	<v.pool_opts>		pool_opts pool_opt pool_opts_l
5283b3a8eb9SGleb Smirnoff %type	<v.tagged>		tagged
5293b3a8eb9SGleb Smirnoff %type	<v.rtableid>		rtable
5303b3a8eb9SGleb Smirnoff %%
5313b3a8eb9SGleb Smirnoff 
5323b3a8eb9SGleb Smirnoff ruleset		: /* empty */
5333b3a8eb9SGleb Smirnoff 		| ruleset include '\n'
5343b3a8eb9SGleb Smirnoff 		| ruleset '\n'
5353b3a8eb9SGleb Smirnoff 		| ruleset option '\n'
5363b3a8eb9SGleb Smirnoff 		| ruleset scrubrule '\n'
5373b3a8eb9SGleb Smirnoff 		| ruleset natrule '\n'
5383b3a8eb9SGleb Smirnoff 		| ruleset binatrule '\n'
5393b3a8eb9SGleb Smirnoff 		| ruleset pfrule '\n'
5403b3a8eb9SGleb Smirnoff 		| ruleset anchorrule '\n'
5413b3a8eb9SGleb Smirnoff 		| ruleset loadrule '\n'
5423b3a8eb9SGleb Smirnoff 		| ruleset altqif '\n'
5433b3a8eb9SGleb Smirnoff 		| ruleset queuespec '\n'
5443b3a8eb9SGleb Smirnoff 		| ruleset varset '\n'
5453b3a8eb9SGleb Smirnoff 		| ruleset antispoof '\n'
5463b3a8eb9SGleb Smirnoff 		| ruleset tabledef '\n'
5473b3a8eb9SGleb Smirnoff 		| '{' fakeanchor '}' '\n';
5483b3a8eb9SGleb Smirnoff 		| ruleset error '\n'		{ file->errors++; }
5493b3a8eb9SGleb Smirnoff 		;
5503b3a8eb9SGleb Smirnoff 
5513b3a8eb9SGleb Smirnoff include		: INCLUDE STRING		{
5523b3a8eb9SGleb Smirnoff 			struct file	*nfile;
5533b3a8eb9SGleb Smirnoff 
5543b3a8eb9SGleb Smirnoff 			if ((nfile = pushfile($2, 0)) == NULL) {
5553b3a8eb9SGleb Smirnoff 				yyerror("failed to include file %s", $2);
5563b3a8eb9SGleb Smirnoff 				free($2);
5573b3a8eb9SGleb Smirnoff 				YYERROR;
5583b3a8eb9SGleb Smirnoff 			}
5593b3a8eb9SGleb Smirnoff 			free($2);
5603b3a8eb9SGleb Smirnoff 
5613b3a8eb9SGleb Smirnoff 			file = nfile;
5623b3a8eb9SGleb Smirnoff 			lungetc('\n');
5633b3a8eb9SGleb Smirnoff 		}
5643b3a8eb9SGleb Smirnoff 		;
5653b3a8eb9SGleb Smirnoff 
5663b3a8eb9SGleb Smirnoff /*
5673b3a8eb9SGleb Smirnoff  * apply to previouslys specified rule: must be careful to note
5683b3a8eb9SGleb Smirnoff  * what that is: pf or nat or binat or rdr
5693b3a8eb9SGleb Smirnoff  */
5703b3a8eb9SGleb Smirnoff fakeanchor	: fakeanchor '\n'
5713b3a8eb9SGleb Smirnoff 		| fakeanchor anchorrule '\n'
5723b3a8eb9SGleb Smirnoff 		| fakeanchor binatrule '\n'
5733b3a8eb9SGleb Smirnoff 		| fakeanchor natrule '\n'
5743b3a8eb9SGleb Smirnoff 		| fakeanchor pfrule '\n'
5753b3a8eb9SGleb Smirnoff 		| fakeanchor error '\n'
5763b3a8eb9SGleb Smirnoff 		;
5773b3a8eb9SGleb Smirnoff 
5783b3a8eb9SGleb Smirnoff optimizer	: string	{
5793b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "none"))
5803b3a8eb9SGleb Smirnoff 				$$ = 0;
5813b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "basic"))
5823b3a8eb9SGleb Smirnoff 				$$ = PF_OPTIMIZE_BASIC;
5833b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "profile"))
5843b3a8eb9SGleb Smirnoff 				$$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE;
5853b3a8eb9SGleb Smirnoff 			else {
5863b3a8eb9SGleb Smirnoff 				yyerror("unknown ruleset-optimization %s", $1);
5873b3a8eb9SGleb Smirnoff 				YYERROR;
5883b3a8eb9SGleb Smirnoff 			}
5893b3a8eb9SGleb Smirnoff 		}
5903b3a8eb9SGleb Smirnoff 		;
5913b3a8eb9SGleb Smirnoff 
5923b3a8eb9SGleb Smirnoff option		: SET OPTIMIZATION STRING		{
5933b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
5943b3a8eb9SGleb Smirnoff 				free($3);
5953b3a8eb9SGleb Smirnoff 				YYERROR;
5963b3a8eb9SGleb Smirnoff 			}
5973b3a8eb9SGleb Smirnoff 			if (pfctl_set_optimization(pf, $3) != 0) {
5983b3a8eb9SGleb Smirnoff 				yyerror("unknown optimization %s", $3);
5993b3a8eb9SGleb Smirnoff 				free($3);
6003b3a8eb9SGleb Smirnoff 				YYERROR;
6013b3a8eb9SGleb Smirnoff 			}
6023b3a8eb9SGleb Smirnoff 			free($3);
6033b3a8eb9SGleb Smirnoff 		}
6043b3a8eb9SGleb Smirnoff 		| SET RULESET_OPTIMIZATION optimizer {
6053b3a8eb9SGleb Smirnoff 			if (!(pf->opts & PF_OPT_OPTIMIZE)) {
6063b3a8eb9SGleb Smirnoff 				pf->opts |= PF_OPT_OPTIMIZE;
6073b3a8eb9SGleb Smirnoff 				pf->optimize = $3;
6083b3a8eb9SGleb Smirnoff 			}
6093b3a8eb9SGleb Smirnoff 		}
6103b3a8eb9SGleb Smirnoff 		| SET TIMEOUT timeout_spec
6113b3a8eb9SGleb Smirnoff 		| SET TIMEOUT '{' optnl timeout_list '}'
6123b3a8eb9SGleb Smirnoff 		| SET LIMIT limit_spec
6133b3a8eb9SGleb Smirnoff 		| SET LIMIT '{' optnl limit_list '}'
6143b3a8eb9SGleb Smirnoff 		| SET LOGINTERFACE stringall		{
6153b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
6163b3a8eb9SGleb Smirnoff 				free($3);
6173b3a8eb9SGleb Smirnoff 				YYERROR;
6183b3a8eb9SGleb Smirnoff 			}
6193b3a8eb9SGleb Smirnoff 			if (pfctl_set_logif(pf, $3) != 0) {
6203b3a8eb9SGleb Smirnoff 				yyerror("error setting loginterface %s", $3);
6213b3a8eb9SGleb Smirnoff 				free($3);
6223b3a8eb9SGleb Smirnoff 				YYERROR;
6233b3a8eb9SGleb Smirnoff 			}
6243b3a8eb9SGleb Smirnoff 			free($3);
6253b3a8eb9SGleb Smirnoff 		}
6263b3a8eb9SGleb Smirnoff 		| SET HOSTID number {
6273b3a8eb9SGleb Smirnoff 			if ($3 == 0 || $3 > UINT_MAX) {
6283b3a8eb9SGleb Smirnoff 				yyerror("hostid must be non-zero");
6293b3a8eb9SGleb Smirnoff 				YYERROR;
6303b3a8eb9SGleb Smirnoff 			}
6313b3a8eb9SGleb Smirnoff 			if (pfctl_set_hostid(pf, $3) != 0) {
6323b3a8eb9SGleb Smirnoff 				yyerror("error setting hostid %08x", $3);
6333b3a8eb9SGleb Smirnoff 				YYERROR;
6343b3a8eb9SGleb Smirnoff 			}
6353b3a8eb9SGleb Smirnoff 		}
6363b3a8eb9SGleb Smirnoff 		| SET BLOCKPOLICY DROP	{
6373b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6383b3a8eb9SGleb Smirnoff 				printf("set block-policy drop\n");
6393b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION))
6403b3a8eb9SGleb Smirnoff 				YYERROR;
6413b3a8eb9SGleb Smirnoff 			blockpolicy = PFRULE_DROP;
6423b3a8eb9SGleb Smirnoff 		}
6433b3a8eb9SGleb Smirnoff 		| SET BLOCKPOLICY RETURN {
6443b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6453b3a8eb9SGleb Smirnoff 				printf("set block-policy return\n");
6463b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION))
6473b3a8eb9SGleb Smirnoff 				YYERROR;
6483b3a8eb9SGleb Smirnoff 			blockpolicy = PFRULE_RETURN;
6493b3a8eb9SGleb Smirnoff 		}
650150182e3SKristof Provost 		| SET FAILPOLICY DROP	{
651150182e3SKristof Provost 			if (pf->opts & PF_OPT_VERBOSE)
652150182e3SKristof Provost 				printf("set fail-policy drop\n");
653150182e3SKristof Provost 			if (check_rulestate(PFCTL_STATE_OPTION))
654150182e3SKristof Provost 				YYERROR;
655150182e3SKristof Provost 			failpolicy = PFRULE_DROP;
656150182e3SKristof Provost 		}
657150182e3SKristof Provost 		| SET FAILPOLICY RETURN {
658150182e3SKristof Provost 			if (pf->opts & PF_OPT_VERBOSE)
659150182e3SKristof Provost 				printf("set fail-policy return\n");
660150182e3SKristof Provost 			if (check_rulestate(PFCTL_STATE_OPTION))
661150182e3SKristof Provost 				YYERROR;
662150182e3SKristof Provost 			failpolicy = PFRULE_RETURN;
663150182e3SKristof Provost 		}
6643b3a8eb9SGleb Smirnoff 		| SET REQUIREORDER yesno {
6653b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6663b3a8eb9SGleb Smirnoff 				printf("set require-order %s\n",
6673b3a8eb9SGleb Smirnoff 				    $3 == 1 ? "yes" : "no");
6683b3a8eb9SGleb Smirnoff 			require_order = $3;
6693b3a8eb9SGleb Smirnoff 		}
6703b3a8eb9SGleb Smirnoff 		| SET FINGERPRINTS STRING {
6713b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6723b3a8eb9SGleb Smirnoff 				printf("set fingerprints \"%s\"\n", $3);
6733b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
6743b3a8eb9SGleb Smirnoff 				free($3);
6753b3a8eb9SGleb Smirnoff 				YYERROR;
6763b3a8eb9SGleb Smirnoff 			}
6773b3a8eb9SGleb Smirnoff 			if (!pf->anchor->name[0]) {
6783b3a8eb9SGleb Smirnoff 				if (pfctl_file_fingerprints(pf->dev,
6793b3a8eb9SGleb Smirnoff 				    pf->opts, $3)) {
6803b3a8eb9SGleb Smirnoff 					yyerror("error loading "
6813b3a8eb9SGleb Smirnoff 					    "fingerprints %s", $3);
6823b3a8eb9SGleb Smirnoff 					free($3);
6833b3a8eb9SGleb Smirnoff 					YYERROR;
6843b3a8eb9SGleb Smirnoff 				}
6853b3a8eb9SGleb Smirnoff 			}
6863b3a8eb9SGleb Smirnoff 			free($3);
6873b3a8eb9SGleb Smirnoff 		}
6883b3a8eb9SGleb Smirnoff 		| SET STATEPOLICY statelock {
6893b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
6903b3a8eb9SGleb Smirnoff 				switch ($3) {
6913b3a8eb9SGleb Smirnoff 				case 0:
6923b3a8eb9SGleb Smirnoff 					printf("set state-policy floating\n");
6933b3a8eb9SGleb Smirnoff 					break;
6943b3a8eb9SGleb Smirnoff 				case PFRULE_IFBOUND:
6953b3a8eb9SGleb Smirnoff 					printf("set state-policy if-bound\n");
6963b3a8eb9SGleb Smirnoff 					break;
6973b3a8eb9SGleb Smirnoff 				}
6983b3a8eb9SGleb Smirnoff 			default_statelock = $3;
6993b3a8eb9SGleb Smirnoff 		}
7003b3a8eb9SGleb Smirnoff 		| SET DEBUG STRING {
7013b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
7023b3a8eb9SGleb Smirnoff 				free($3);
7033b3a8eb9SGleb Smirnoff 				YYERROR;
7043b3a8eb9SGleb Smirnoff 			}
7053b3a8eb9SGleb Smirnoff 			if (pfctl_set_debug(pf, $3) != 0) {
7063b3a8eb9SGleb Smirnoff 				yyerror("error setting debuglevel %s", $3);
7073b3a8eb9SGleb Smirnoff 				free($3);
7083b3a8eb9SGleb Smirnoff 				YYERROR;
7093b3a8eb9SGleb Smirnoff 			}
7103b3a8eb9SGleb Smirnoff 			free($3);
7113b3a8eb9SGleb Smirnoff 		}
7123b3a8eb9SGleb Smirnoff 		| SET SKIP interface {
7133b3a8eb9SGleb Smirnoff 			if (expand_skip_interface($3) != 0) {
7143b3a8eb9SGleb Smirnoff 				yyerror("error setting skip interface(s)");
7153b3a8eb9SGleb Smirnoff 				YYERROR;
7163b3a8eb9SGleb Smirnoff 			}
7173b3a8eb9SGleb Smirnoff 		}
7183b3a8eb9SGleb Smirnoff 		| SET STATEDEFAULTS state_opt_list {
7193b3a8eb9SGleb Smirnoff 			if (keep_state_defaults != NULL) {
7203b3a8eb9SGleb Smirnoff 				yyerror("cannot redefine state-defaults");
7213b3a8eb9SGleb Smirnoff 				YYERROR;
7223b3a8eb9SGleb Smirnoff 			}
7233b3a8eb9SGleb Smirnoff 			keep_state_defaults = $3;
7243b3a8eb9SGleb Smirnoff 		}
72542ec75f8SKristof Provost 		| SET KEEPCOUNTERS {
72642ec75f8SKristof Provost 			pf->keep_counters = true;
72742ec75f8SKristof Provost 		}
728*c69121c4SKristof Provost 		| SET SYNCOOKIES syncookie_val {
729*c69121c4SKristof Provost 			pf->syncookies = $3;
730*c69121c4SKristof Provost 		}
731*c69121c4SKristof Provost 		;
732*c69121c4SKristof Provost 
733*c69121c4SKristof Provost syncookie_val  : STRING        {
734*c69121c4SKristof Provost 			if (!strcmp($1, "never"))
735*c69121c4SKristof Provost 				$$ = PFCTL_SYNCOOKIES_NEVER;
736*c69121c4SKristof Provost 			else if (!strcmp($1, "always"))
737*c69121c4SKristof Provost 				$$ = PFCTL_SYNCOOKIES_ALWAYS;
738*c69121c4SKristof Provost 			else {
739*c69121c4SKristof Provost 				yyerror("illegal value for syncookies");
740*c69121c4SKristof Provost 				YYERROR;
741*c69121c4SKristof Provost 			}
742*c69121c4SKristof Provost 		}
7433b3a8eb9SGleb Smirnoff 		;
7443b3a8eb9SGleb Smirnoff 
7453b3a8eb9SGleb Smirnoff stringall	: STRING	{ $$ = $1; }
7463b3a8eb9SGleb Smirnoff 		| ALL		{
7473b3a8eb9SGleb Smirnoff 			if (($$ = strdup("all")) == NULL) {
7483b3a8eb9SGleb Smirnoff 				err(1, "stringall: strdup");
7493b3a8eb9SGleb Smirnoff 			}
7503b3a8eb9SGleb Smirnoff 		}
7513b3a8eb9SGleb Smirnoff 		;
7523b3a8eb9SGleb Smirnoff 
7533b3a8eb9SGleb Smirnoff string		: STRING string				{
7543b3a8eb9SGleb Smirnoff 			if (asprintf(&$$, "%s %s", $1, $2) == -1)
7553b3a8eb9SGleb Smirnoff 				err(1, "string: asprintf");
7563b3a8eb9SGleb Smirnoff 			free($1);
7573b3a8eb9SGleb Smirnoff 			free($2);
7583b3a8eb9SGleb Smirnoff 		}
7593b3a8eb9SGleb Smirnoff 		| STRING
7603b3a8eb9SGleb Smirnoff 		;
7613b3a8eb9SGleb Smirnoff 
7623b3a8eb9SGleb Smirnoff varstring	: numberstring varstring 		{
7633b3a8eb9SGleb Smirnoff 			if (asprintf(&$$, "%s %s", $1, $2) == -1)
7643b3a8eb9SGleb Smirnoff 				err(1, "string: asprintf");
7653b3a8eb9SGleb Smirnoff 			free($1);
7663b3a8eb9SGleb Smirnoff 			free($2);
7673b3a8eb9SGleb Smirnoff 		}
7683b3a8eb9SGleb Smirnoff 		| numberstring
7693b3a8eb9SGleb Smirnoff 		;
7703b3a8eb9SGleb Smirnoff 
7713b3a8eb9SGleb Smirnoff numberstring	: NUMBER				{
7723b3a8eb9SGleb Smirnoff 			char	*s;
7733b3a8eb9SGleb Smirnoff 			if (asprintf(&s, "%lld", (long long)$1) == -1) {
7743b3a8eb9SGleb Smirnoff 				yyerror("string: asprintf");
7753b3a8eb9SGleb Smirnoff 				YYERROR;
7763b3a8eb9SGleb Smirnoff 			}
7773b3a8eb9SGleb Smirnoff 			$$ = s;
7783b3a8eb9SGleb Smirnoff 		}
7793b3a8eb9SGleb Smirnoff 		| STRING
7803b3a8eb9SGleb Smirnoff 		;
7813b3a8eb9SGleb Smirnoff 
7823b3a8eb9SGleb Smirnoff varset		: STRING '=' varstring	{
783d3f65324SKristof Provost 			char *s = $1;
7843b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE)
7853b3a8eb9SGleb Smirnoff 				printf("%s = \"%s\"\n", $1, $3);
786d3f65324SKristof Provost 			while (*s++) {
787d3f65324SKristof Provost 				if (isspace((unsigned char)*s)) {
788d3f65324SKristof Provost 					yyerror("macro name cannot contain "
789d3f65324SKristof Provost 					   "whitespace");
790d3f65324SKristof Provost 					YYERROR;
791d3f65324SKristof Provost 				}
792d3f65324SKristof Provost 			}
7933b3a8eb9SGleb Smirnoff 			if (symset($1, $3, 0) == -1)
7943b3a8eb9SGleb Smirnoff 				err(1, "cannot store variable %s", $1);
7953b3a8eb9SGleb Smirnoff 			free($1);
7963b3a8eb9SGleb Smirnoff 			free($3);
7973b3a8eb9SGleb Smirnoff 		}
7983b3a8eb9SGleb Smirnoff 		;
7993b3a8eb9SGleb Smirnoff 
8003b3a8eb9SGleb Smirnoff anchorname	: STRING			{ $$ = $1; }
8013b3a8eb9SGleb Smirnoff 		| /* empty */			{ $$ = NULL; }
8023b3a8eb9SGleb Smirnoff 		;
8033b3a8eb9SGleb Smirnoff 
8043b3a8eb9SGleb Smirnoff pfa_anchorlist	: /* empty */
8053b3a8eb9SGleb Smirnoff 		| pfa_anchorlist '\n'
8063b3a8eb9SGleb Smirnoff 		| pfa_anchorlist pfrule '\n'
8073b3a8eb9SGleb Smirnoff 		| pfa_anchorlist anchorrule '\n'
8083b3a8eb9SGleb Smirnoff 		;
8093b3a8eb9SGleb Smirnoff 
8103b3a8eb9SGleb Smirnoff pfa_anchor	: '{'
8113b3a8eb9SGleb Smirnoff 		{
8123b3a8eb9SGleb Smirnoff 			char ta[PF_ANCHOR_NAME_SIZE];
813e9eb0941SKristof Provost 			struct pfctl_ruleset *rs;
8143b3a8eb9SGleb Smirnoff 
8153b3a8eb9SGleb Smirnoff 			/* steping into a brace anchor */
8163b3a8eb9SGleb Smirnoff 			pf->asd++;
8173b3a8eb9SGleb Smirnoff 			pf->bn++;
8183b3a8eb9SGleb Smirnoff 			pf->brace = 1;
8193b3a8eb9SGleb Smirnoff 
8203b3a8eb9SGleb Smirnoff 			/* create a holding ruleset in the root */
8213b3a8eb9SGleb Smirnoff 			snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn);
8223b3a8eb9SGleb Smirnoff 			rs = pf_find_or_create_ruleset(ta);
8233b3a8eb9SGleb Smirnoff 			if (rs == NULL)
8243b3a8eb9SGleb Smirnoff 				err(1, "pfa_anchor: pf_find_or_create_ruleset");
8253b3a8eb9SGleb Smirnoff 			pf->astack[pf->asd] = rs->anchor;
8263b3a8eb9SGleb Smirnoff 			pf->anchor = rs->anchor;
8273b3a8eb9SGleb Smirnoff 		} '\n' pfa_anchorlist '}'
8283b3a8eb9SGleb Smirnoff 		{
8293b3a8eb9SGleb Smirnoff 			pf->alast = pf->anchor;
8303b3a8eb9SGleb Smirnoff 			pf->asd--;
8313b3a8eb9SGleb Smirnoff 			pf->anchor = pf->astack[pf->asd];
8323b3a8eb9SGleb Smirnoff 		}
8333b3a8eb9SGleb Smirnoff 		| /* empty */
8343b3a8eb9SGleb Smirnoff 		;
8353b3a8eb9SGleb Smirnoff 
8363b3a8eb9SGleb Smirnoff anchorrule	: ANCHOR anchorname dir quick interface af proto fromto
8373b3a8eb9SGleb Smirnoff 		    filter_opts pfa_anchor
8383b3a8eb9SGleb Smirnoff 		{
839e9eb0941SKristof Provost 			struct pfctl_rule	r;
8403b3a8eb9SGleb Smirnoff 			struct node_proto	*proto;
8413b3a8eb9SGleb Smirnoff 
8423b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_FILTER)) {
8433b3a8eb9SGleb Smirnoff 				if ($2)
8443b3a8eb9SGleb Smirnoff 					free($2);
8453b3a8eb9SGleb Smirnoff 				YYERROR;
8463b3a8eb9SGleb Smirnoff 			}
8473b3a8eb9SGleb Smirnoff 
8483b3a8eb9SGleb Smirnoff 			if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) {
8493b3a8eb9SGleb Smirnoff 				free($2);
8503b3a8eb9SGleb Smirnoff 				yyerror("anchor names beginning with '_' "
8513b3a8eb9SGleb Smirnoff 				    "are reserved for internal use");
8523b3a8eb9SGleb Smirnoff 				YYERROR;
8533b3a8eb9SGleb Smirnoff 			}
8543b3a8eb9SGleb Smirnoff 
8553b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
8563b3a8eb9SGleb Smirnoff 			if (pf->astack[pf->asd + 1]) {
8573b3a8eb9SGleb Smirnoff 				/* move inline rules into relative location */
858e9eb0941SKristof Provost 				pfctl_anchor_setup(&r,
8593b3a8eb9SGleb Smirnoff 				    &pf->astack[pf->asd]->ruleset,
8603b3a8eb9SGleb Smirnoff 				    $2 ? $2 : pf->alast->name);
8613b3a8eb9SGleb Smirnoff 
8623b3a8eb9SGleb Smirnoff 				if (r.anchor == NULL)
8633b3a8eb9SGleb Smirnoff 					err(1, "anchorrule: unable to "
8643b3a8eb9SGleb Smirnoff 					    "create ruleset");
8653b3a8eb9SGleb Smirnoff 
8663b3a8eb9SGleb Smirnoff 				if (pf->alast != r.anchor) {
8673b3a8eb9SGleb Smirnoff 					if (r.anchor->match) {
8683b3a8eb9SGleb Smirnoff 						yyerror("inline anchor '%s' "
8693b3a8eb9SGleb Smirnoff 						    "already exists",
8703b3a8eb9SGleb Smirnoff 						    r.anchor->name);
8713b3a8eb9SGleb Smirnoff 						YYERROR;
8723b3a8eb9SGleb Smirnoff 					}
8733b3a8eb9SGleb Smirnoff 					mv_rules(&pf->alast->ruleset,
8743b3a8eb9SGleb Smirnoff 					    &r.anchor->ruleset);
8753b3a8eb9SGleb Smirnoff 				}
8763b3a8eb9SGleb Smirnoff 				pf_remove_if_empty_ruleset(&pf->alast->ruleset);
8773b3a8eb9SGleb Smirnoff 				pf->alast = r.anchor;
8783b3a8eb9SGleb Smirnoff 			} else {
8793b3a8eb9SGleb Smirnoff 				if (!$2) {
8803b3a8eb9SGleb Smirnoff 					yyerror("anchors without explicit "
8813b3a8eb9SGleb Smirnoff 					    "rules must specify a name");
8823b3a8eb9SGleb Smirnoff 					YYERROR;
8833b3a8eb9SGleb Smirnoff 				}
8843b3a8eb9SGleb Smirnoff 			}
8853b3a8eb9SGleb Smirnoff 			r.direction = $3;
8863b3a8eb9SGleb Smirnoff 			r.quick = $4.quick;
8873b3a8eb9SGleb Smirnoff 			r.af = $6;
8883b3a8eb9SGleb Smirnoff 			r.prob = $9.prob;
8893b3a8eb9SGleb Smirnoff 			r.rtableid = $9.rtableid;
8903b3a8eb9SGleb Smirnoff 
8913b3a8eb9SGleb Smirnoff 			if ($9.tag)
8923b3a8eb9SGleb Smirnoff 				if (strlcpy(r.tagname, $9.tag,
8933b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
8943b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
8953b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
8963b3a8eb9SGleb Smirnoff 					YYERROR;
8973b3a8eb9SGleb Smirnoff 				}
8983b3a8eb9SGleb Smirnoff 			if ($9.match_tag)
8993b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $9.match_tag,
9003b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
9013b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
9023b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
9033b3a8eb9SGleb Smirnoff 					YYERROR;
9043b3a8eb9SGleb Smirnoff 				}
9053b3a8eb9SGleb Smirnoff 			r.match_tag_not = $9.match_tag_not;
9063b3a8eb9SGleb Smirnoff 			if (rule_label(&r, $9.label))
9073b3a8eb9SGleb Smirnoff 				YYERROR;
9086fcc8e04SKristof Provost 			for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
9096fcc8e04SKristof Provost 				free($9.label[i]);
9103b3a8eb9SGleb Smirnoff 			r.flags = $9.flags.b1;
9113b3a8eb9SGleb Smirnoff 			r.flagset = $9.flags.b2;
9123b3a8eb9SGleb Smirnoff 			if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
9133b3a8eb9SGleb Smirnoff 				yyerror("flags always false");
9143b3a8eb9SGleb Smirnoff 				YYERROR;
9153b3a8eb9SGleb Smirnoff 			}
9163b3a8eb9SGleb Smirnoff 			if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
9173b3a8eb9SGleb Smirnoff 				for (proto = $7; proto != NULL &&
9183b3a8eb9SGleb Smirnoff 				    proto->proto != IPPROTO_TCP;
9193b3a8eb9SGleb Smirnoff 				    proto = proto->next)
9203b3a8eb9SGleb Smirnoff 					;	/* nothing */
9213b3a8eb9SGleb Smirnoff 				if (proto == NULL && $7 != NULL) {
9223b3a8eb9SGleb Smirnoff 					if ($9.flags.b1 || $9.flags.b2)
9233b3a8eb9SGleb Smirnoff 						yyerror(
9243b3a8eb9SGleb Smirnoff 						    "flags only apply to tcp");
9253b3a8eb9SGleb Smirnoff 					if ($8.src_os)
9263b3a8eb9SGleb Smirnoff 						yyerror(
9273b3a8eb9SGleb Smirnoff 						    "OS fingerprinting only "
9283b3a8eb9SGleb Smirnoff 						    "applies to tcp");
9293b3a8eb9SGleb Smirnoff 					YYERROR;
9303b3a8eb9SGleb Smirnoff 				}
9313b3a8eb9SGleb Smirnoff 			}
9323b3a8eb9SGleb Smirnoff 
9333b3a8eb9SGleb Smirnoff 			r.tos = $9.tos;
9343b3a8eb9SGleb Smirnoff 
9353b3a8eb9SGleb Smirnoff 			if ($9.keep.action) {
9363b3a8eb9SGleb Smirnoff 				yyerror("cannot specify state handling "
9373b3a8eb9SGleb Smirnoff 				    "on anchors");
9383b3a8eb9SGleb Smirnoff 				YYERROR;
9393b3a8eb9SGleb Smirnoff 			}
9403b3a8eb9SGleb Smirnoff 
9413b3a8eb9SGleb Smirnoff 			if ($9.match_tag)
9423b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $9.match_tag,
9433b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
9443b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
9453b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
9463b3a8eb9SGleb Smirnoff 					YYERROR;
9473b3a8eb9SGleb Smirnoff 				}
9483b3a8eb9SGleb Smirnoff 			r.match_tag_not = $9.match_tag_not;
9493e248e0fSKristof Provost 			if ($9.marker & FOM_PRIO) {
9503e248e0fSKristof Provost 				if ($9.prio == 0)
9513e248e0fSKristof Provost 					r.prio = PF_PRIO_ZERO;
9523e248e0fSKristof Provost 				else
9533e248e0fSKristof Provost 					r.prio = $9.prio;
9543e248e0fSKristof Provost 			}
9553e248e0fSKristof Provost 			if ($9.marker & FOM_SETPRIO) {
9563e248e0fSKristof Provost 				r.set_prio[0] = $9.set_prio[0];
9573e248e0fSKristof Provost 				r.set_prio[1] = $9.set_prio[1];
9583e248e0fSKristof Provost 				r.scrub_flags |= PFSTATE_SETPRIO;
9593e248e0fSKristof Provost 			}
9603b3a8eb9SGleb Smirnoff 
9613b3a8eb9SGleb Smirnoff 			decide_address_family($8.src.host, &r.af);
9623b3a8eb9SGleb Smirnoff 			decide_address_family($8.dst.host, &r.af);
9633b3a8eb9SGleb Smirnoff 
9643b3a8eb9SGleb Smirnoff 			expand_rule(&r, $5, NULL, $7, $8.src_os,
9653b3a8eb9SGleb Smirnoff 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
9663b3a8eb9SGleb Smirnoff 			    $9.uid, $9.gid, $9.icmpspec,
9673b3a8eb9SGleb Smirnoff 			    pf->astack[pf->asd + 1] ? pf->alast->name : $2);
9683b3a8eb9SGleb Smirnoff 			free($2);
9693b3a8eb9SGleb Smirnoff 			pf->astack[pf->asd + 1] = NULL;
9703b3a8eb9SGleb Smirnoff 		}
9713b3a8eb9SGleb Smirnoff 		| NATANCHOR string interface af proto fromto rtable {
972e9eb0941SKristof Provost 			struct pfctl_rule	r;
9733b3a8eb9SGleb Smirnoff 
9743b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT)) {
9753b3a8eb9SGleb Smirnoff 				free($2);
9763b3a8eb9SGleb Smirnoff 				YYERROR;
9773b3a8eb9SGleb Smirnoff 			}
9783b3a8eb9SGleb Smirnoff 
9793b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
9803b3a8eb9SGleb Smirnoff 			r.action = PF_NAT;
9813b3a8eb9SGleb Smirnoff 			r.af = $4;
9823b3a8eb9SGleb Smirnoff 			r.rtableid = $7;
9833b3a8eb9SGleb Smirnoff 
9843b3a8eb9SGleb Smirnoff 			decide_address_family($6.src.host, &r.af);
9853b3a8eb9SGleb Smirnoff 			decide_address_family($6.dst.host, &r.af);
9863b3a8eb9SGleb Smirnoff 
9873b3a8eb9SGleb Smirnoff 			expand_rule(&r, $3, NULL, $5, $6.src_os,
9883b3a8eb9SGleb Smirnoff 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
9893b3a8eb9SGleb Smirnoff 			    0, 0, 0, $2);
9903b3a8eb9SGleb Smirnoff 			free($2);
9913b3a8eb9SGleb Smirnoff 		}
9923b3a8eb9SGleb Smirnoff 		| RDRANCHOR string interface af proto fromto rtable {
993e9eb0941SKristof Provost 			struct pfctl_rule	r;
9943b3a8eb9SGleb Smirnoff 
9953b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT)) {
9963b3a8eb9SGleb Smirnoff 				free($2);
9973b3a8eb9SGleb Smirnoff 				YYERROR;
9983b3a8eb9SGleb Smirnoff 			}
9993b3a8eb9SGleb Smirnoff 
10003b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
10013b3a8eb9SGleb Smirnoff 			r.action = PF_RDR;
10023b3a8eb9SGleb Smirnoff 			r.af = $4;
10033b3a8eb9SGleb Smirnoff 			r.rtableid = $7;
10043b3a8eb9SGleb Smirnoff 
10053b3a8eb9SGleb Smirnoff 			decide_address_family($6.src.host, &r.af);
10063b3a8eb9SGleb Smirnoff 			decide_address_family($6.dst.host, &r.af);
10073b3a8eb9SGleb Smirnoff 
10083b3a8eb9SGleb Smirnoff 			if ($6.src.port != NULL) {
10093b3a8eb9SGleb Smirnoff 				yyerror("source port parameter not supported"
10103b3a8eb9SGleb Smirnoff 				    " in rdr-anchor");
10113b3a8eb9SGleb Smirnoff 				YYERROR;
10123b3a8eb9SGleb Smirnoff 			}
10133b3a8eb9SGleb Smirnoff 			if ($6.dst.port != NULL) {
10143b3a8eb9SGleb Smirnoff 				if ($6.dst.port->next != NULL) {
10153b3a8eb9SGleb Smirnoff 					yyerror("destination port list "
10163b3a8eb9SGleb Smirnoff 					    "expansion not supported in "
10173b3a8eb9SGleb Smirnoff 					    "rdr-anchor");
10183b3a8eb9SGleb Smirnoff 					YYERROR;
10193b3a8eb9SGleb Smirnoff 				} else if ($6.dst.port->op != PF_OP_EQ) {
10203b3a8eb9SGleb Smirnoff 					yyerror("destination port operators"
10213b3a8eb9SGleb Smirnoff 					    " not supported in rdr-anchor");
10223b3a8eb9SGleb Smirnoff 					YYERROR;
10233b3a8eb9SGleb Smirnoff 				}
10243b3a8eb9SGleb Smirnoff 				r.dst.port[0] = $6.dst.port->port[0];
10253b3a8eb9SGleb Smirnoff 				r.dst.port[1] = $6.dst.port->port[1];
10263b3a8eb9SGleb Smirnoff 				r.dst.port_op = $6.dst.port->op;
10273b3a8eb9SGleb Smirnoff 			}
10283b3a8eb9SGleb Smirnoff 
10293b3a8eb9SGleb Smirnoff 			expand_rule(&r, $3, NULL, $5, $6.src_os,
10303b3a8eb9SGleb Smirnoff 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
10313b3a8eb9SGleb Smirnoff 			    0, 0, 0, $2);
10323b3a8eb9SGleb Smirnoff 			free($2);
10333b3a8eb9SGleb Smirnoff 		}
10343b3a8eb9SGleb Smirnoff 		| BINATANCHOR string interface af proto fromto rtable {
1035e9eb0941SKristof Provost 			struct pfctl_rule	r;
10363b3a8eb9SGleb Smirnoff 
10373b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT)) {
10383b3a8eb9SGleb Smirnoff 				free($2);
10393b3a8eb9SGleb Smirnoff 				YYERROR;
10403b3a8eb9SGleb Smirnoff 			}
10413b3a8eb9SGleb Smirnoff 
10423b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
10433b3a8eb9SGleb Smirnoff 			r.action = PF_BINAT;
10443b3a8eb9SGleb Smirnoff 			r.af = $4;
10453b3a8eb9SGleb Smirnoff 			r.rtableid = $7;
10463b3a8eb9SGleb Smirnoff 			if ($5 != NULL) {
10473b3a8eb9SGleb Smirnoff 				if ($5->next != NULL) {
10483b3a8eb9SGleb Smirnoff 					yyerror("proto list expansion"
10493b3a8eb9SGleb Smirnoff 					    " not supported in binat-anchor");
10503b3a8eb9SGleb Smirnoff 					YYERROR;
10513b3a8eb9SGleb Smirnoff 				}
10523b3a8eb9SGleb Smirnoff 				r.proto = $5->proto;
10533b3a8eb9SGleb Smirnoff 				free($5);
10543b3a8eb9SGleb Smirnoff 			}
10553b3a8eb9SGleb Smirnoff 
10563b3a8eb9SGleb Smirnoff 			if ($6.src.host != NULL || $6.src.port != NULL ||
10573b3a8eb9SGleb Smirnoff 			    $6.dst.host != NULL || $6.dst.port != NULL) {
10583b3a8eb9SGleb Smirnoff 				yyerror("fromto parameter not supported"
10593b3a8eb9SGleb Smirnoff 				    " in binat-anchor");
10603b3a8eb9SGleb Smirnoff 				YYERROR;
10613b3a8eb9SGleb Smirnoff 			}
10623b3a8eb9SGleb Smirnoff 
10633b3a8eb9SGleb Smirnoff 			decide_address_family($6.src.host, &r.af);
10643b3a8eb9SGleb Smirnoff 			decide_address_family($6.dst.host, &r.af);
10653b3a8eb9SGleb Smirnoff 
10660d71f9f3SKristof Provost 			pfctl_append_rule(pf, &r, $2);
10673b3a8eb9SGleb Smirnoff 			free($2);
10683b3a8eb9SGleb Smirnoff 		}
10693b3a8eb9SGleb Smirnoff 		;
10703b3a8eb9SGleb Smirnoff 
10713b3a8eb9SGleb Smirnoff loadrule	: LOAD ANCHOR string FROM string	{
10723b3a8eb9SGleb Smirnoff 			struct loadanchors	*loadanchor;
10733b3a8eb9SGleb Smirnoff 
10743b3a8eb9SGleb Smirnoff 			if (strlen(pf->anchor->name) + 1 +
10753b3a8eb9SGleb Smirnoff 			    strlen($3) >= MAXPATHLEN) {
10763b3a8eb9SGleb Smirnoff 				yyerror("anchorname %s too long, max %u\n",
10773b3a8eb9SGleb Smirnoff 				    $3, MAXPATHLEN - 1);
10783b3a8eb9SGleb Smirnoff 				free($3);
10793b3a8eb9SGleb Smirnoff 				YYERROR;
10803b3a8eb9SGleb Smirnoff 			}
10813b3a8eb9SGleb Smirnoff 			loadanchor = calloc(1, sizeof(struct loadanchors));
10823b3a8eb9SGleb Smirnoff 			if (loadanchor == NULL)
10833b3a8eb9SGleb Smirnoff 				err(1, "loadrule: calloc");
10843b3a8eb9SGleb Smirnoff 			if ((loadanchor->anchorname = malloc(MAXPATHLEN)) ==
10853b3a8eb9SGleb Smirnoff 			    NULL)
10863b3a8eb9SGleb Smirnoff 				err(1, "loadrule: malloc");
10873b3a8eb9SGleb Smirnoff 			if (pf->anchor->name[0])
10883b3a8eb9SGleb Smirnoff 				snprintf(loadanchor->anchorname, MAXPATHLEN,
10893b3a8eb9SGleb Smirnoff 				    "%s/%s", pf->anchor->name, $3);
10903b3a8eb9SGleb Smirnoff 			else
10913b3a8eb9SGleb Smirnoff 				strlcpy(loadanchor->anchorname, $3, MAXPATHLEN);
10923b3a8eb9SGleb Smirnoff 			if ((loadanchor->filename = strdup($5)) == NULL)
10933b3a8eb9SGleb Smirnoff 				err(1, "loadrule: strdup");
10943b3a8eb9SGleb Smirnoff 
10953b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
10963b3a8eb9SGleb Smirnoff 			    entries);
10973b3a8eb9SGleb Smirnoff 
10983b3a8eb9SGleb Smirnoff 			free($3);
10993b3a8eb9SGleb Smirnoff 			free($5);
11003b3a8eb9SGleb Smirnoff 		};
11013b3a8eb9SGleb Smirnoff 
11023b3a8eb9SGleb Smirnoff scrubaction	: no SCRUB {
11033b3a8eb9SGleb Smirnoff 			$$.b2 = $$.w = 0;
11043b3a8eb9SGleb Smirnoff 			if ($1)
11053b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NOSCRUB;
11063b3a8eb9SGleb Smirnoff 			else
11073b3a8eb9SGleb Smirnoff 				$$.b1 = PF_SCRUB;
11083b3a8eb9SGleb Smirnoff 		}
11093b3a8eb9SGleb Smirnoff 		;
11103b3a8eb9SGleb Smirnoff 
11113b3a8eb9SGleb Smirnoff scrubrule	: scrubaction dir logquick interface af proto fromto scrub_opts
11123b3a8eb9SGleb Smirnoff 		{
1113e9eb0941SKristof Provost 			struct pfctl_rule	r;
11143b3a8eb9SGleb Smirnoff 
11153b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_SCRUB))
11163b3a8eb9SGleb Smirnoff 				YYERROR;
11173b3a8eb9SGleb Smirnoff 
11183b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
11193b3a8eb9SGleb Smirnoff 
11203b3a8eb9SGleb Smirnoff 			r.action = $1.b1;
11213b3a8eb9SGleb Smirnoff 			r.direction = $2;
11223b3a8eb9SGleb Smirnoff 
11233b3a8eb9SGleb Smirnoff 			r.log = $3.log;
11243b3a8eb9SGleb Smirnoff 			r.logif = $3.logif;
11253b3a8eb9SGleb Smirnoff 			if ($3.quick) {
11263b3a8eb9SGleb Smirnoff 				yyerror("scrub rules do not support 'quick'");
11273b3a8eb9SGleb Smirnoff 				YYERROR;
11283b3a8eb9SGleb Smirnoff 			}
11293b3a8eb9SGleb Smirnoff 
11303b3a8eb9SGleb Smirnoff 			r.af = $5;
11313b3a8eb9SGleb Smirnoff 			if ($8.nodf)
11323b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_NODF;
11333b3a8eb9SGleb Smirnoff 			if ($8.randomid)
11343b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RANDOMID;
11353b3a8eb9SGleb Smirnoff 			if ($8.reassemble_tcp) {
11363b3a8eb9SGleb Smirnoff 				if (r.direction != PF_INOUT) {
11373b3a8eb9SGleb Smirnoff 					yyerror("reassemble tcp rules can not "
11383b3a8eb9SGleb Smirnoff 					    "specify direction");
11393b3a8eb9SGleb Smirnoff 					YYERROR;
11403b3a8eb9SGleb Smirnoff 				}
11413b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_REASSEMBLE_TCP;
11423b3a8eb9SGleb Smirnoff 			}
11433b3a8eb9SGleb Smirnoff 			if ($8.minttl)
11443b3a8eb9SGleb Smirnoff 				r.min_ttl = $8.minttl;
11453b3a8eb9SGleb Smirnoff 			if ($8.maxmss)
11463b3a8eb9SGleb Smirnoff 				r.max_mss = $8.maxmss;
11473b3a8eb9SGleb Smirnoff 			if ($8.marker & SOM_SETTOS) {
11483b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_SET_TOS;
11493b3a8eb9SGleb Smirnoff 				r.set_tos = $8.settos;
11503b3a8eb9SGleb Smirnoff 			}
11513b3a8eb9SGleb Smirnoff 			if ($8.fragcache)
11523b3a8eb9SGleb Smirnoff 				r.rule_flag |= $8.fragcache;
11533b3a8eb9SGleb Smirnoff 			if ($8.match_tag)
11543b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $8.match_tag,
11553b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
11563b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
11573b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
11583b3a8eb9SGleb Smirnoff 					YYERROR;
11593b3a8eb9SGleb Smirnoff 				}
11603b3a8eb9SGleb Smirnoff 			r.match_tag_not = $8.match_tag_not;
11613b3a8eb9SGleb Smirnoff 			r.rtableid = $8.rtableid;
11623b3a8eb9SGleb Smirnoff 
11633b3a8eb9SGleb Smirnoff 			expand_rule(&r, $4, NULL, $6, $7.src_os,
11643b3a8eb9SGleb Smirnoff 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
11653b3a8eb9SGleb Smirnoff 			    NULL, NULL, NULL, "");
11663b3a8eb9SGleb Smirnoff 		}
11673b3a8eb9SGleb Smirnoff 		;
11683b3a8eb9SGleb Smirnoff 
11693b3a8eb9SGleb Smirnoff scrub_opts	:	{
11703b3a8eb9SGleb Smirnoff 				bzero(&scrub_opts, sizeof scrub_opts);
11713b3a8eb9SGleb Smirnoff 				scrub_opts.rtableid = -1;
11723b3a8eb9SGleb Smirnoff 			}
11733b3a8eb9SGleb Smirnoff 		    scrub_opts_l
11743b3a8eb9SGleb Smirnoff 			{ $$ = scrub_opts; }
11753b3a8eb9SGleb Smirnoff 		| /* empty */ {
11763b3a8eb9SGleb Smirnoff 			bzero(&scrub_opts, sizeof scrub_opts);
11773b3a8eb9SGleb Smirnoff 			scrub_opts.rtableid = -1;
11783b3a8eb9SGleb Smirnoff 			$$ = scrub_opts;
11793b3a8eb9SGleb Smirnoff 		}
11803b3a8eb9SGleb Smirnoff 		;
11813b3a8eb9SGleb Smirnoff 
11823b3a8eb9SGleb Smirnoff scrub_opts_l	: scrub_opts_l scrub_opt
11833b3a8eb9SGleb Smirnoff 		| scrub_opt
11843b3a8eb9SGleb Smirnoff 		;
11853b3a8eb9SGleb Smirnoff 
11863b3a8eb9SGleb Smirnoff scrub_opt	: NODF	{
11873b3a8eb9SGleb Smirnoff 			if (scrub_opts.nodf) {
11883b3a8eb9SGleb Smirnoff 				yyerror("no-df cannot be respecified");
11893b3a8eb9SGleb Smirnoff 				YYERROR;
11903b3a8eb9SGleb Smirnoff 			}
11913b3a8eb9SGleb Smirnoff 			scrub_opts.nodf = 1;
11923b3a8eb9SGleb Smirnoff 		}
11933b3a8eb9SGleb Smirnoff 		| MINTTL NUMBER {
11943b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_MINTTL) {
11953b3a8eb9SGleb Smirnoff 				yyerror("min-ttl cannot be respecified");
11963b3a8eb9SGleb Smirnoff 				YYERROR;
11973b3a8eb9SGleb Smirnoff 			}
11983b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 255) {
11993b3a8eb9SGleb Smirnoff 				yyerror("illegal min-ttl value %d", $2);
12003b3a8eb9SGleb Smirnoff 				YYERROR;
12013b3a8eb9SGleb Smirnoff 			}
12023b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_MINTTL;
12033b3a8eb9SGleb Smirnoff 			scrub_opts.minttl = $2;
12043b3a8eb9SGleb Smirnoff 		}
12053b3a8eb9SGleb Smirnoff 		| MAXMSS NUMBER {
12063b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_MAXMSS) {
12073b3a8eb9SGleb Smirnoff 				yyerror("max-mss cannot be respecified");
12083b3a8eb9SGleb Smirnoff 				YYERROR;
12093b3a8eb9SGleb Smirnoff 			}
12103b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 65535) {
12113b3a8eb9SGleb Smirnoff 				yyerror("illegal max-mss value %d", $2);
12123b3a8eb9SGleb Smirnoff 				YYERROR;
12133b3a8eb9SGleb Smirnoff 			}
12143b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_MAXMSS;
12153b3a8eb9SGleb Smirnoff 			scrub_opts.maxmss = $2;
12163b3a8eb9SGleb Smirnoff 		}
12173b3a8eb9SGleb Smirnoff 		| SETTOS tos {
12183b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_SETTOS) {
12193b3a8eb9SGleb Smirnoff 				yyerror("set-tos cannot be respecified");
12203b3a8eb9SGleb Smirnoff 				YYERROR;
12213b3a8eb9SGleb Smirnoff 			}
12223b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_SETTOS;
12233b3a8eb9SGleb Smirnoff 			scrub_opts.settos = $2;
12243b3a8eb9SGleb Smirnoff 		}
12253b3a8eb9SGleb Smirnoff 		| fragcache {
12263b3a8eb9SGleb Smirnoff 			if (scrub_opts.marker & SOM_FRAGCACHE) {
12273b3a8eb9SGleb Smirnoff 				yyerror("fragcache cannot be respecified");
12283b3a8eb9SGleb Smirnoff 				YYERROR;
12293b3a8eb9SGleb Smirnoff 			}
12303b3a8eb9SGleb Smirnoff 			scrub_opts.marker |= SOM_FRAGCACHE;
12313b3a8eb9SGleb Smirnoff 			scrub_opts.fragcache = $1;
12323b3a8eb9SGleb Smirnoff 		}
12333b3a8eb9SGleb Smirnoff 		| REASSEMBLE STRING {
12343b3a8eb9SGleb Smirnoff 			if (strcasecmp($2, "tcp") != 0) {
12353b3a8eb9SGleb Smirnoff 				yyerror("scrub reassemble supports only tcp, "
12363b3a8eb9SGleb Smirnoff 				    "not '%s'", $2);
12373b3a8eb9SGleb Smirnoff 				free($2);
12383b3a8eb9SGleb Smirnoff 				YYERROR;
12393b3a8eb9SGleb Smirnoff 			}
12403b3a8eb9SGleb Smirnoff 			free($2);
12413b3a8eb9SGleb Smirnoff 			if (scrub_opts.reassemble_tcp) {
12423b3a8eb9SGleb Smirnoff 				yyerror("reassemble tcp cannot be respecified");
12433b3a8eb9SGleb Smirnoff 				YYERROR;
12443b3a8eb9SGleb Smirnoff 			}
12453b3a8eb9SGleb Smirnoff 			scrub_opts.reassemble_tcp = 1;
12463b3a8eb9SGleb Smirnoff 		}
12473b3a8eb9SGleb Smirnoff 		| RANDOMID {
12483b3a8eb9SGleb Smirnoff 			if (scrub_opts.randomid) {
12493b3a8eb9SGleb Smirnoff 				yyerror("random-id cannot be respecified");
12503b3a8eb9SGleb Smirnoff 				YYERROR;
12513b3a8eb9SGleb Smirnoff 			}
12523b3a8eb9SGleb Smirnoff 			scrub_opts.randomid = 1;
12533b3a8eb9SGleb Smirnoff 		}
12543b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER				{
12553b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
12563b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
12573b3a8eb9SGleb Smirnoff 				YYERROR;
12583b3a8eb9SGleb Smirnoff 			}
12593b3a8eb9SGleb Smirnoff 			scrub_opts.rtableid = $2;
12603b3a8eb9SGleb Smirnoff 		}
12613b3a8eb9SGleb Smirnoff 		| not TAGGED string			{
12623b3a8eb9SGleb Smirnoff 			scrub_opts.match_tag = $3;
12633b3a8eb9SGleb Smirnoff 			scrub_opts.match_tag_not = $1;
12643b3a8eb9SGleb Smirnoff 		}
12653b3a8eb9SGleb Smirnoff 		;
12663b3a8eb9SGleb Smirnoff 
12673b3a8eb9SGleb Smirnoff fragcache	: FRAGMENT REASSEMBLE	{ $$ = 0; /* default */ }
126864b3b4d6SKristof Provost 		| FRAGMENT FRAGCROP	{ $$ = 0; }
126964b3b4d6SKristof Provost 		| FRAGMENT FRAGDROP	{ $$ = 0; }
12703b3a8eb9SGleb Smirnoff 		;
12713b3a8eb9SGleb Smirnoff 
12723b3a8eb9SGleb Smirnoff antispoof	: ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
1273e9eb0941SKristof Provost 			struct pfctl_rule	 r;
12743b3a8eb9SGleb Smirnoff 			struct node_host	*h = NULL, *hh;
12753b3a8eb9SGleb Smirnoff 			struct node_if		*i, *j;
12763b3a8eb9SGleb Smirnoff 
12773b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_FILTER))
12783b3a8eb9SGleb Smirnoff 				YYERROR;
12793b3a8eb9SGleb Smirnoff 
12803b3a8eb9SGleb Smirnoff 			for (i = $3; i; i = i->next) {
12813b3a8eb9SGleb Smirnoff 				bzero(&r, sizeof(r));
12823b3a8eb9SGleb Smirnoff 
12833b3a8eb9SGleb Smirnoff 				r.action = PF_DROP;
12843b3a8eb9SGleb Smirnoff 				r.direction = PF_IN;
12853b3a8eb9SGleb Smirnoff 				r.log = $2.log;
12863b3a8eb9SGleb Smirnoff 				r.logif = $2.logif;
12873b3a8eb9SGleb Smirnoff 				r.quick = $2.quick;
12883b3a8eb9SGleb Smirnoff 				r.af = $4;
12893b3a8eb9SGleb Smirnoff 				if (rule_label(&r, $5.label))
12903b3a8eb9SGleb Smirnoff 					YYERROR;
12913b3a8eb9SGleb Smirnoff 				r.rtableid = $5.rtableid;
12923b3a8eb9SGleb Smirnoff 				j = calloc(1, sizeof(struct node_if));
12933b3a8eb9SGleb Smirnoff 				if (j == NULL)
12943b3a8eb9SGleb Smirnoff 					err(1, "antispoof: calloc");
12953b3a8eb9SGleb Smirnoff 				if (strlcpy(j->ifname, i->ifname,
12963b3a8eb9SGleb Smirnoff 				    sizeof(j->ifname)) >= sizeof(j->ifname)) {
12973b3a8eb9SGleb Smirnoff 					free(j);
12983b3a8eb9SGleb Smirnoff 					yyerror("interface name too long");
12993b3a8eb9SGleb Smirnoff 					YYERROR;
13003b3a8eb9SGleb Smirnoff 				}
13013b3a8eb9SGleb Smirnoff 				j->not = 1;
13023b3a8eb9SGleb Smirnoff 				if (i->dynamic) {
13033b3a8eb9SGleb Smirnoff 					h = calloc(1, sizeof(*h));
13043b3a8eb9SGleb Smirnoff 					if (h == NULL)
13053b3a8eb9SGleb Smirnoff 						err(1, "address: calloc");
13063b3a8eb9SGleb Smirnoff 					h->addr.type = PF_ADDR_DYNIFTL;
13073b3a8eb9SGleb Smirnoff 					set_ipmask(h, 128);
13083b3a8eb9SGleb Smirnoff 					if (strlcpy(h->addr.v.ifname, i->ifname,
13093b3a8eb9SGleb Smirnoff 					    sizeof(h->addr.v.ifname)) >=
13103b3a8eb9SGleb Smirnoff 					    sizeof(h->addr.v.ifname)) {
13113b3a8eb9SGleb Smirnoff 						free(h);
13123b3a8eb9SGleb Smirnoff 						yyerror(
13133b3a8eb9SGleb Smirnoff 						    "interface name too long");
13143b3a8eb9SGleb Smirnoff 						YYERROR;
13153b3a8eb9SGleb Smirnoff 					}
13163b3a8eb9SGleb Smirnoff 					hh = malloc(sizeof(*hh));
13173b3a8eb9SGleb Smirnoff 					if (hh == NULL)
13183b3a8eb9SGleb Smirnoff 						 err(1, "address: malloc");
13193b3a8eb9SGleb Smirnoff 					bcopy(h, hh, sizeof(*hh));
13203b3a8eb9SGleb Smirnoff 					h->addr.iflags = PFI_AFLAG_NETWORK;
13213b3a8eb9SGleb Smirnoff 				} else {
13223b3a8eb9SGleb Smirnoff 					h = ifa_lookup(j->ifname,
13233b3a8eb9SGleb Smirnoff 					    PFI_AFLAG_NETWORK);
13243b3a8eb9SGleb Smirnoff 					hh = NULL;
13253b3a8eb9SGleb Smirnoff 				}
13263b3a8eb9SGleb Smirnoff 
13273b3a8eb9SGleb Smirnoff 				if (h != NULL)
13283b3a8eb9SGleb Smirnoff 					expand_rule(&r, j, NULL, NULL, NULL, h,
13293b3a8eb9SGleb Smirnoff 					    NULL, NULL, NULL, NULL, NULL,
13303b3a8eb9SGleb Smirnoff 					    NULL, "");
13313b3a8eb9SGleb Smirnoff 
13323b3a8eb9SGleb Smirnoff 				if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
13333b3a8eb9SGleb Smirnoff 					bzero(&r, sizeof(r));
13343b3a8eb9SGleb Smirnoff 
13353b3a8eb9SGleb Smirnoff 					r.action = PF_DROP;
13363b3a8eb9SGleb Smirnoff 					r.direction = PF_IN;
13373b3a8eb9SGleb Smirnoff 					r.log = $2.log;
13383b3a8eb9SGleb Smirnoff 					r.logif = $2.logif;
13393b3a8eb9SGleb Smirnoff 					r.quick = $2.quick;
13403b3a8eb9SGleb Smirnoff 					r.af = $4;
13413b3a8eb9SGleb Smirnoff 					if (rule_label(&r, $5.label))
13423b3a8eb9SGleb Smirnoff 						YYERROR;
13433b3a8eb9SGleb Smirnoff 					r.rtableid = $5.rtableid;
13443b3a8eb9SGleb Smirnoff 					if (hh != NULL)
13453b3a8eb9SGleb Smirnoff 						h = hh;
13463b3a8eb9SGleb Smirnoff 					else
13473b3a8eb9SGleb Smirnoff 						h = ifa_lookup(i->ifname, 0);
13483b3a8eb9SGleb Smirnoff 					if (h != NULL)
13493b3a8eb9SGleb Smirnoff 						expand_rule(&r, NULL, NULL,
13503b3a8eb9SGleb Smirnoff 						    NULL, NULL, h, NULL, NULL,
13513b3a8eb9SGleb Smirnoff 						    NULL, NULL, NULL, NULL, "");
13523b3a8eb9SGleb Smirnoff 				} else
13533b3a8eb9SGleb Smirnoff 					free(hh);
13543b3a8eb9SGleb Smirnoff 			}
13556fcc8e04SKristof Provost 			for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
13566fcc8e04SKristof Provost 				free($5.label[i]);
13573b3a8eb9SGleb Smirnoff 		}
13583b3a8eb9SGleb Smirnoff 		;
13593b3a8eb9SGleb Smirnoff 
13603b3a8eb9SGleb Smirnoff antispoof_ifspc	: FOR antispoof_if			{ $$ = $2; }
13613b3a8eb9SGleb Smirnoff 		| FOR '{' optnl antispoof_iflst '}'	{ $$ = $4; }
13623b3a8eb9SGleb Smirnoff 		;
13633b3a8eb9SGleb Smirnoff 
13643b3a8eb9SGleb Smirnoff antispoof_iflst	: antispoof_if optnl			{ $$ = $1; }
13653b3a8eb9SGleb Smirnoff 		| antispoof_iflst comma antispoof_if optnl {
13663b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
13673b3a8eb9SGleb Smirnoff 			$1->tail = $3;
13683b3a8eb9SGleb Smirnoff 			$$ = $1;
13693b3a8eb9SGleb Smirnoff 		}
13703b3a8eb9SGleb Smirnoff 		;
13713b3a8eb9SGleb Smirnoff 
13723b3a8eb9SGleb Smirnoff antispoof_if	: if_item				{ $$ = $1; }
13733b3a8eb9SGleb Smirnoff 		| '(' if_item ')'			{
13743b3a8eb9SGleb Smirnoff 			$2->dynamic = 1;
13753b3a8eb9SGleb Smirnoff 			$$ = $2;
13763b3a8eb9SGleb Smirnoff 		}
13773b3a8eb9SGleb Smirnoff 		;
13783b3a8eb9SGleb Smirnoff 
13793b3a8eb9SGleb Smirnoff antispoof_opts	:	{
13803b3a8eb9SGleb Smirnoff 				bzero(&antispoof_opts, sizeof antispoof_opts);
13813b3a8eb9SGleb Smirnoff 				antispoof_opts.rtableid = -1;
13823b3a8eb9SGleb Smirnoff 			}
13833b3a8eb9SGleb Smirnoff 		    antispoof_opts_l
13843b3a8eb9SGleb Smirnoff 			{ $$ = antispoof_opts; }
13853b3a8eb9SGleb Smirnoff 		| /* empty */	{
13863b3a8eb9SGleb Smirnoff 			bzero(&antispoof_opts, sizeof antispoof_opts);
13873b3a8eb9SGleb Smirnoff 			antispoof_opts.rtableid = -1;
13883b3a8eb9SGleb Smirnoff 			$$ = antispoof_opts;
13893b3a8eb9SGleb Smirnoff 		}
13903b3a8eb9SGleb Smirnoff 		;
13913b3a8eb9SGleb Smirnoff 
13923b3a8eb9SGleb Smirnoff antispoof_opts_l	: antispoof_opts_l antispoof_opt
13933b3a8eb9SGleb Smirnoff 			| antispoof_opt
13943b3a8eb9SGleb Smirnoff 			;
13953b3a8eb9SGleb Smirnoff 
13963b3a8eb9SGleb Smirnoff antispoof_opt	: label	{
13976fcc8e04SKristof Provost 			if (antispoof_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) {
13986fcc8e04SKristof Provost 				yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT);
13993b3a8eb9SGleb Smirnoff 				YYERROR;
14003b3a8eb9SGleb Smirnoff 			}
14016fcc8e04SKristof Provost 			antispoof_opts.label[antispoof_opts.labelcount++] = $1;
14023b3a8eb9SGleb Smirnoff 		}
14033b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER				{
14043b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
14053b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
14063b3a8eb9SGleb Smirnoff 				YYERROR;
14073b3a8eb9SGleb Smirnoff 			}
14083b3a8eb9SGleb Smirnoff 			antispoof_opts.rtableid = $2;
14093b3a8eb9SGleb Smirnoff 		}
14103b3a8eb9SGleb Smirnoff 		;
14113b3a8eb9SGleb Smirnoff 
14123b3a8eb9SGleb Smirnoff not		: '!'		{ $$ = 1; }
14133b3a8eb9SGleb Smirnoff 		| /* empty */	{ $$ = 0; }
14143b3a8eb9SGleb Smirnoff 		;
14153b3a8eb9SGleb Smirnoff 
14163b3a8eb9SGleb Smirnoff tabledef	: TABLE '<' STRING '>' table_opts {
14173b3a8eb9SGleb Smirnoff 			struct node_host	 *h, *nh;
14183b3a8eb9SGleb Smirnoff 			struct node_tinit	 *ti, *nti;
14193b3a8eb9SGleb Smirnoff 
14203b3a8eb9SGleb Smirnoff 			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
14213b3a8eb9SGleb Smirnoff 				yyerror("table name too long, max %d chars",
14223b3a8eb9SGleb Smirnoff 				    PF_TABLE_NAME_SIZE - 1);
14233b3a8eb9SGleb Smirnoff 				free($3);
14243b3a8eb9SGleb Smirnoff 				YYERROR;
14253b3a8eb9SGleb Smirnoff 			}
14263b3a8eb9SGleb Smirnoff 			if (pf->loadopt & PFCTL_FLAG_TABLE)
14273b3a8eb9SGleb Smirnoff 				if (process_tabledef($3, &$5)) {
14283b3a8eb9SGleb Smirnoff 					free($3);
14293b3a8eb9SGleb Smirnoff 					YYERROR;
14303b3a8eb9SGleb Smirnoff 				}
14313b3a8eb9SGleb Smirnoff 			free($3);
14323b3a8eb9SGleb Smirnoff 			for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
14333b3a8eb9SGleb Smirnoff 			    ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
14343b3a8eb9SGleb Smirnoff 				if (ti->file)
14353b3a8eb9SGleb Smirnoff 					free(ti->file);
14363b3a8eb9SGleb Smirnoff 				for (h = ti->host; h != NULL; h = nh) {
14373b3a8eb9SGleb Smirnoff 					nh = h->next;
14383b3a8eb9SGleb Smirnoff 					free(h);
14393b3a8eb9SGleb Smirnoff 				}
14403b3a8eb9SGleb Smirnoff 				nti = SIMPLEQ_NEXT(ti, entries);
14413b3a8eb9SGleb Smirnoff 				free(ti);
14423b3a8eb9SGleb Smirnoff 			}
14433b3a8eb9SGleb Smirnoff 		}
14443b3a8eb9SGleb Smirnoff 		;
14453b3a8eb9SGleb Smirnoff 
14463b3a8eb9SGleb Smirnoff table_opts	:	{
14473b3a8eb9SGleb Smirnoff 			bzero(&table_opts, sizeof table_opts);
14483b3a8eb9SGleb Smirnoff 			SIMPLEQ_INIT(&table_opts.init_nodes);
14493b3a8eb9SGleb Smirnoff 		}
14503b3a8eb9SGleb Smirnoff 		    table_opts_l
14513b3a8eb9SGleb Smirnoff 			{ $$ = table_opts; }
14523b3a8eb9SGleb Smirnoff 		| /* empty */
14533b3a8eb9SGleb Smirnoff 			{
14543b3a8eb9SGleb Smirnoff 			bzero(&table_opts, sizeof table_opts);
14553b3a8eb9SGleb Smirnoff 			SIMPLEQ_INIT(&table_opts.init_nodes);
14563b3a8eb9SGleb Smirnoff 			$$ = table_opts;
14573b3a8eb9SGleb Smirnoff 		}
14583b3a8eb9SGleb Smirnoff 		;
14593b3a8eb9SGleb Smirnoff 
14603b3a8eb9SGleb Smirnoff table_opts_l	: table_opts_l table_opt
14613b3a8eb9SGleb Smirnoff 		| table_opt
14623b3a8eb9SGleb Smirnoff 		;
14633b3a8eb9SGleb Smirnoff 
14643b3a8eb9SGleb Smirnoff table_opt	: STRING		{
14653b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "const"))
14663b3a8eb9SGleb Smirnoff 				table_opts.flags |= PFR_TFLAG_CONST;
14673b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "persist"))
14683b3a8eb9SGleb Smirnoff 				table_opts.flags |= PFR_TFLAG_PERSIST;
14693b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "counters"))
14703b3a8eb9SGleb Smirnoff 				table_opts.flags |= PFR_TFLAG_COUNTERS;
14713b3a8eb9SGleb Smirnoff 			else {
14723b3a8eb9SGleb Smirnoff 				yyerror("invalid table option '%s'", $1);
14733b3a8eb9SGleb Smirnoff 				free($1);
14743b3a8eb9SGleb Smirnoff 				YYERROR;
14753b3a8eb9SGleb Smirnoff 			}
14763b3a8eb9SGleb Smirnoff 			free($1);
14773b3a8eb9SGleb Smirnoff 		}
14783b3a8eb9SGleb Smirnoff 		| '{' optnl '}'		{ table_opts.init_addr = 1; }
14793b3a8eb9SGleb Smirnoff 		| '{' optnl host_list '}'	{
14803b3a8eb9SGleb Smirnoff 			struct node_host	*n;
14813b3a8eb9SGleb Smirnoff 			struct node_tinit	*ti;
14823b3a8eb9SGleb Smirnoff 
14833b3a8eb9SGleb Smirnoff 			for (n = $3; n != NULL; n = n->next) {
14843b3a8eb9SGleb Smirnoff 				switch (n->addr.type) {
14853b3a8eb9SGleb Smirnoff 				case PF_ADDR_ADDRMASK:
14863b3a8eb9SGleb Smirnoff 					continue; /* ok */
14873b3a8eb9SGleb Smirnoff 				case PF_ADDR_RANGE:
14883b3a8eb9SGleb Smirnoff 					yyerror("address ranges are not "
14893b3a8eb9SGleb Smirnoff 					    "permitted inside tables");
14903b3a8eb9SGleb Smirnoff 					break;
14913b3a8eb9SGleb Smirnoff 				case PF_ADDR_DYNIFTL:
14923b3a8eb9SGleb Smirnoff 					yyerror("dynamic addresses are not "
14933b3a8eb9SGleb Smirnoff 					    "permitted inside tables");
14943b3a8eb9SGleb Smirnoff 					break;
14953b3a8eb9SGleb Smirnoff 				case PF_ADDR_TABLE:
14963b3a8eb9SGleb Smirnoff 					yyerror("tables cannot contain tables");
14973b3a8eb9SGleb Smirnoff 					break;
14983b3a8eb9SGleb Smirnoff 				case PF_ADDR_NOROUTE:
14993b3a8eb9SGleb Smirnoff 					yyerror("\"no-route\" is not permitted "
15003b3a8eb9SGleb Smirnoff 					    "inside tables");
15013b3a8eb9SGleb Smirnoff 					break;
15023b3a8eb9SGleb Smirnoff 				case PF_ADDR_URPFFAILED:
15033b3a8eb9SGleb Smirnoff 					yyerror("\"urpf-failed\" is not "
15043b3a8eb9SGleb Smirnoff 					    "permitted inside tables");
15053b3a8eb9SGleb Smirnoff 					break;
15063b3a8eb9SGleb Smirnoff 				default:
15073b3a8eb9SGleb Smirnoff 					yyerror("unknown address type %d",
15083b3a8eb9SGleb Smirnoff 					    n->addr.type);
15093b3a8eb9SGleb Smirnoff 				}
15103b3a8eb9SGleb Smirnoff 				YYERROR;
15113b3a8eb9SGleb Smirnoff 			}
15123b3a8eb9SGleb Smirnoff 			if (!(ti = calloc(1, sizeof(*ti))))
15133b3a8eb9SGleb Smirnoff 				err(1, "table_opt: calloc");
15143b3a8eb9SGleb Smirnoff 			ti->host = $3;
15153b3a8eb9SGleb Smirnoff 			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
15163b3a8eb9SGleb Smirnoff 			    entries);
15173b3a8eb9SGleb Smirnoff 			table_opts.init_addr = 1;
15183b3a8eb9SGleb Smirnoff 		}
15193b3a8eb9SGleb Smirnoff 		| FILENAME STRING	{
15203b3a8eb9SGleb Smirnoff 			struct node_tinit	*ti;
15213b3a8eb9SGleb Smirnoff 
15223b3a8eb9SGleb Smirnoff 			if (!(ti = calloc(1, sizeof(*ti))))
15233b3a8eb9SGleb Smirnoff 				err(1, "table_opt: calloc");
15243b3a8eb9SGleb Smirnoff 			ti->file = $2;
15253b3a8eb9SGleb Smirnoff 			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
15263b3a8eb9SGleb Smirnoff 			    entries);
15273b3a8eb9SGleb Smirnoff 			table_opts.init_addr = 1;
15283b3a8eb9SGleb Smirnoff 		}
15293b3a8eb9SGleb Smirnoff 		;
15303b3a8eb9SGleb Smirnoff 
15313b3a8eb9SGleb Smirnoff altqif		: ALTQ interface queue_opts QUEUE qassign {
15323b3a8eb9SGleb Smirnoff 			struct pf_altq	a;
15333b3a8eb9SGleb Smirnoff 
15343b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_QUEUE))
15353b3a8eb9SGleb Smirnoff 				YYERROR;
15363b3a8eb9SGleb Smirnoff 
15373b3a8eb9SGleb Smirnoff 			memset(&a, 0, sizeof(a));
15383b3a8eb9SGleb Smirnoff 			if ($3.scheduler.qtype == ALTQT_NONE) {
15393b3a8eb9SGleb Smirnoff 				yyerror("no scheduler specified!");
15403b3a8eb9SGleb Smirnoff 				YYERROR;
15413b3a8eb9SGleb Smirnoff 			}
15423b3a8eb9SGleb Smirnoff 			a.scheduler = $3.scheduler.qtype;
15433b3a8eb9SGleb Smirnoff 			a.qlimit = $3.qlimit;
15443b3a8eb9SGleb Smirnoff 			a.tbrsize = $3.tbrsize;
15450a70aaf8SLuiz Otavio O Souza 			if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) {
15463b3a8eb9SGleb Smirnoff 				yyerror("no child queues specified");
15473b3a8eb9SGleb Smirnoff 				YYERROR;
15483b3a8eb9SGleb Smirnoff 			}
15493b3a8eb9SGleb Smirnoff 			if (expand_altq(&a, $2, $5, $3.queue_bwspec,
15503b3a8eb9SGleb Smirnoff 			    &$3.scheduler))
15513b3a8eb9SGleb Smirnoff 				YYERROR;
15523b3a8eb9SGleb Smirnoff 		}
15533b3a8eb9SGleb Smirnoff 		;
15543b3a8eb9SGleb Smirnoff 
15553b3a8eb9SGleb Smirnoff queuespec	: QUEUE STRING interface queue_opts qassign {
15563b3a8eb9SGleb Smirnoff 			struct pf_altq	a;
15573b3a8eb9SGleb Smirnoff 
15583b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_QUEUE)) {
15593b3a8eb9SGleb Smirnoff 				free($2);
15603b3a8eb9SGleb Smirnoff 				YYERROR;
15613b3a8eb9SGleb Smirnoff 			}
15623b3a8eb9SGleb Smirnoff 
15633b3a8eb9SGleb Smirnoff 			memset(&a, 0, sizeof(a));
15643b3a8eb9SGleb Smirnoff 
15653b3a8eb9SGleb Smirnoff 			if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
15663b3a8eb9SGleb Smirnoff 			    sizeof(a.qname)) {
15673b3a8eb9SGleb Smirnoff 				yyerror("queue name too long (max "
15683b3a8eb9SGleb Smirnoff 				    "%d chars)", PF_QNAME_SIZE-1);
15693b3a8eb9SGleb Smirnoff 				free($2);
15703b3a8eb9SGleb Smirnoff 				YYERROR;
15713b3a8eb9SGleb Smirnoff 			}
15723b3a8eb9SGleb Smirnoff 			free($2);
15733b3a8eb9SGleb Smirnoff 			if ($4.tbrsize) {
15743b3a8eb9SGleb Smirnoff 				yyerror("cannot specify tbrsize for queue");
15753b3a8eb9SGleb Smirnoff 				YYERROR;
15763b3a8eb9SGleb Smirnoff 			}
15773b3a8eb9SGleb Smirnoff 			if ($4.priority > 255) {
15783b3a8eb9SGleb Smirnoff 				yyerror("priority out of range: max 255");
15793b3a8eb9SGleb Smirnoff 				YYERROR;
15803b3a8eb9SGleb Smirnoff 			}
15813b3a8eb9SGleb Smirnoff 			a.priority = $4.priority;
15823b3a8eb9SGleb Smirnoff 			a.qlimit = $4.qlimit;
15833b3a8eb9SGleb Smirnoff 			a.scheduler = $4.scheduler.qtype;
15843b3a8eb9SGleb Smirnoff 			if (expand_queue(&a, $3, $5, $4.queue_bwspec,
15853b3a8eb9SGleb Smirnoff 			    &$4.scheduler)) {
15863b3a8eb9SGleb Smirnoff 				yyerror("errors in queue definition");
15873b3a8eb9SGleb Smirnoff 				YYERROR;
15883b3a8eb9SGleb Smirnoff 			}
15893b3a8eb9SGleb Smirnoff 		}
15903b3a8eb9SGleb Smirnoff 		;
15913b3a8eb9SGleb Smirnoff 
15923b3a8eb9SGleb Smirnoff queue_opts	:	{
15933b3a8eb9SGleb Smirnoff 			bzero(&queue_opts, sizeof queue_opts);
15943b3a8eb9SGleb Smirnoff 			queue_opts.priority = DEFAULT_PRIORITY;
15953b3a8eb9SGleb Smirnoff 			queue_opts.qlimit = DEFAULT_QLIMIT;
15963b3a8eb9SGleb Smirnoff 			queue_opts.scheduler.qtype = ALTQT_NONE;
15973b3a8eb9SGleb Smirnoff 			queue_opts.queue_bwspec.bw_percent = 100;
15983b3a8eb9SGleb Smirnoff 		}
15993b3a8eb9SGleb Smirnoff 		    queue_opts_l
16003b3a8eb9SGleb Smirnoff 			{ $$ = queue_opts; }
16013b3a8eb9SGleb Smirnoff 		| /* empty */ {
16023b3a8eb9SGleb Smirnoff 			bzero(&queue_opts, sizeof queue_opts);
16033b3a8eb9SGleb Smirnoff 			queue_opts.priority = DEFAULT_PRIORITY;
16043b3a8eb9SGleb Smirnoff 			queue_opts.qlimit = DEFAULT_QLIMIT;
16053b3a8eb9SGleb Smirnoff 			queue_opts.scheduler.qtype = ALTQT_NONE;
16063b3a8eb9SGleb Smirnoff 			queue_opts.queue_bwspec.bw_percent = 100;
16073b3a8eb9SGleb Smirnoff 			$$ = queue_opts;
16083b3a8eb9SGleb Smirnoff 		}
16093b3a8eb9SGleb Smirnoff 		;
16103b3a8eb9SGleb Smirnoff 
16113b3a8eb9SGleb Smirnoff queue_opts_l	: queue_opts_l queue_opt
16123b3a8eb9SGleb Smirnoff 		| queue_opt
16133b3a8eb9SGleb Smirnoff 		;
16143b3a8eb9SGleb Smirnoff 
16153b3a8eb9SGleb Smirnoff queue_opt	: BANDWIDTH bandwidth	{
16163b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_BWSPEC) {
16173b3a8eb9SGleb Smirnoff 				yyerror("bandwidth cannot be respecified");
16183b3a8eb9SGleb Smirnoff 				YYERROR;
16193b3a8eb9SGleb Smirnoff 			}
16203b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_BWSPEC;
16213b3a8eb9SGleb Smirnoff 			queue_opts.queue_bwspec = $2;
16223b3a8eb9SGleb Smirnoff 		}
16233b3a8eb9SGleb Smirnoff 		| PRIORITY NUMBER	{
16243b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_PRIORITY) {
16253b3a8eb9SGleb Smirnoff 				yyerror("priority cannot be respecified");
16263b3a8eb9SGleb Smirnoff 				YYERROR;
16273b3a8eb9SGleb Smirnoff 			}
16283b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 255) {
16293b3a8eb9SGleb Smirnoff 				yyerror("priority out of range: max 255");
16303b3a8eb9SGleb Smirnoff 				YYERROR;
16313b3a8eb9SGleb Smirnoff 			}
16323b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_PRIORITY;
16333b3a8eb9SGleb Smirnoff 			queue_opts.priority = $2;
16343b3a8eb9SGleb Smirnoff 		}
16353b3a8eb9SGleb Smirnoff 		| QLIMIT NUMBER	{
16363b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_QLIMIT) {
16373b3a8eb9SGleb Smirnoff 				yyerror("qlimit cannot be respecified");
16383b3a8eb9SGleb Smirnoff 				YYERROR;
16393b3a8eb9SGleb Smirnoff 			}
16403b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > 65535) {
16413b3a8eb9SGleb Smirnoff 				yyerror("qlimit out of range: max 65535");
16423b3a8eb9SGleb Smirnoff 				YYERROR;
16433b3a8eb9SGleb Smirnoff 			}
16443b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_QLIMIT;
16453b3a8eb9SGleb Smirnoff 			queue_opts.qlimit = $2;
16463b3a8eb9SGleb Smirnoff 		}
16473b3a8eb9SGleb Smirnoff 		| scheduler	{
16483b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_SCHEDULER) {
16493b3a8eb9SGleb Smirnoff 				yyerror("scheduler cannot be respecified");
16503b3a8eb9SGleb Smirnoff 				YYERROR;
16513b3a8eb9SGleb Smirnoff 			}
16523b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_SCHEDULER;
16533b3a8eb9SGleb Smirnoff 			queue_opts.scheduler = $1;
16543b3a8eb9SGleb Smirnoff 		}
16553b3a8eb9SGleb Smirnoff 		| TBRSIZE NUMBER	{
16563b3a8eb9SGleb Smirnoff 			if (queue_opts.marker & QOM_TBRSIZE) {
16573b3a8eb9SGleb Smirnoff 				yyerror("tbrsize cannot be respecified");
16583b3a8eb9SGleb Smirnoff 				YYERROR;
16593b3a8eb9SGleb Smirnoff 			}
1660249cc75fSPatrick Kelsey 			if ($2 < 0 || $2 > UINT_MAX) {
1661249cc75fSPatrick Kelsey 				yyerror("tbrsize too big: max %u", UINT_MAX);
16623b3a8eb9SGleb Smirnoff 				YYERROR;
16633b3a8eb9SGleb Smirnoff 			}
16643b3a8eb9SGleb Smirnoff 			queue_opts.marker |= QOM_TBRSIZE;
16653b3a8eb9SGleb Smirnoff 			queue_opts.tbrsize = $2;
16663b3a8eb9SGleb Smirnoff 		}
16673b3a8eb9SGleb Smirnoff 		;
16683b3a8eb9SGleb Smirnoff 
16693b3a8eb9SGleb Smirnoff bandwidth	: STRING {
16703b3a8eb9SGleb Smirnoff 			double	 bps;
16713b3a8eb9SGleb Smirnoff 			char	*cp;
16723b3a8eb9SGleb Smirnoff 
16733b3a8eb9SGleb Smirnoff 			$$.bw_percent = 0;
16743b3a8eb9SGleb Smirnoff 
16753b3a8eb9SGleb Smirnoff 			bps = strtod($1, &cp);
16763b3a8eb9SGleb Smirnoff 			if (cp != NULL) {
1677db1bbde6SLuiz Otavio O Souza 				if (strlen(cp) > 1) {
1678db1bbde6SLuiz Otavio O Souza 					char *cu = cp + 1;
1679db1bbde6SLuiz Otavio O Souza 					if (!strcmp(cu, "Bit") ||
1680db1bbde6SLuiz Otavio O Souza 					    !strcmp(cu, "B") ||
1681db1bbde6SLuiz Otavio O Souza 					    !strcmp(cu, "bit") ||
1682db1bbde6SLuiz Otavio O Souza 					    !strcmp(cu, "b")) {
1683db1bbde6SLuiz Otavio O Souza 						*cu = 0;
1684db1bbde6SLuiz Otavio O Souza 					}
1685db1bbde6SLuiz Otavio O Souza 				}
16863b3a8eb9SGleb Smirnoff 				if (!strcmp(cp, "b"))
16873b3a8eb9SGleb Smirnoff 					; /* nothing */
1688db1bbde6SLuiz Otavio O Souza 				else if (!strcmp(cp, "K"))
16893b3a8eb9SGleb Smirnoff 					bps *= 1000;
1690db1bbde6SLuiz Otavio O Souza 				else if (!strcmp(cp, "M"))
16913b3a8eb9SGleb Smirnoff 					bps *= 1000 * 1000;
1692db1bbde6SLuiz Otavio O Souza 				else if (!strcmp(cp, "G"))
16933b3a8eb9SGleb Smirnoff 					bps *= 1000 * 1000 * 1000;
16943b3a8eb9SGleb Smirnoff 				else if (!strcmp(cp, "%")) {
16953b3a8eb9SGleb Smirnoff 					if (bps < 0 || bps > 100) {
16963b3a8eb9SGleb Smirnoff 						yyerror("bandwidth spec "
16973b3a8eb9SGleb Smirnoff 						    "out of range");
16983b3a8eb9SGleb Smirnoff 						free($1);
16993b3a8eb9SGleb Smirnoff 						YYERROR;
17003b3a8eb9SGleb Smirnoff 					}
17013b3a8eb9SGleb Smirnoff 					$$.bw_percent = bps;
17023b3a8eb9SGleb Smirnoff 					bps = 0;
17033b3a8eb9SGleb Smirnoff 				} else {
17043b3a8eb9SGleb Smirnoff 					yyerror("unknown unit %s", cp);
17053b3a8eb9SGleb Smirnoff 					free($1);
17063b3a8eb9SGleb Smirnoff 					YYERROR;
17073b3a8eb9SGleb Smirnoff 				}
17083b3a8eb9SGleb Smirnoff 			}
17093b3a8eb9SGleb Smirnoff 			free($1);
1710249cc75fSPatrick Kelsey 			$$.bw_absolute = (u_int64_t)bps;
17113b3a8eb9SGleb Smirnoff 		}
17123b3a8eb9SGleb Smirnoff 		| NUMBER {
1713249cc75fSPatrick Kelsey 			if ($1 < 0 || $1 >= LLONG_MAX) {
17143b3a8eb9SGleb Smirnoff 				yyerror("bandwidth number too big");
17153b3a8eb9SGleb Smirnoff 				YYERROR;
17163b3a8eb9SGleb Smirnoff 			}
17173b3a8eb9SGleb Smirnoff 			$$.bw_percent = 0;
17183b3a8eb9SGleb Smirnoff 			$$.bw_absolute = $1;
17193b3a8eb9SGleb Smirnoff 		}
17203b3a8eb9SGleb Smirnoff 		;
17213b3a8eb9SGleb Smirnoff 
17223b3a8eb9SGleb Smirnoff scheduler	: CBQ				{
17233b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_CBQ;
17243b3a8eb9SGleb Smirnoff 			$$.data.cbq_opts.flags = 0;
17253b3a8eb9SGleb Smirnoff 		}
17263b3a8eb9SGleb Smirnoff 		| CBQ '(' cbqflags_list ')'	{
17273b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_CBQ;
17283b3a8eb9SGleb Smirnoff 			$$.data.cbq_opts.flags = $3;
17293b3a8eb9SGleb Smirnoff 		}
17303b3a8eb9SGleb Smirnoff 		| PRIQ				{
17313b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_PRIQ;
17323b3a8eb9SGleb Smirnoff 			$$.data.priq_opts.flags = 0;
17333b3a8eb9SGleb Smirnoff 		}
17343b3a8eb9SGleb Smirnoff 		| PRIQ '(' priqflags_list ')'	{
17353b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_PRIQ;
17363b3a8eb9SGleb Smirnoff 			$$.data.priq_opts.flags = $3;
17373b3a8eb9SGleb Smirnoff 		}
17383b3a8eb9SGleb Smirnoff 		| HFSC				{
17393b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_HFSC;
17403b3a8eb9SGleb Smirnoff 			bzero(&$$.data.hfsc_opts,
17413b3a8eb9SGleb Smirnoff 			    sizeof(struct node_hfsc_opts));
17423b3a8eb9SGleb Smirnoff 		}
17433b3a8eb9SGleb Smirnoff 		| HFSC '(' hfsc_opts ')'	{
17443b3a8eb9SGleb Smirnoff 			$$.qtype = ALTQT_HFSC;
17453b3a8eb9SGleb Smirnoff 			$$.data.hfsc_opts = $3;
17463b3a8eb9SGleb Smirnoff 		}
1747a5b789f6SErmal Luçi 		| FAIRQ				{
1748a5b789f6SErmal Luçi 			$$.qtype = ALTQT_FAIRQ;
1749a5b789f6SErmal Luçi 			bzero(&$$.data.fairq_opts,
1750a5b789f6SErmal Luçi 				sizeof(struct node_fairq_opts));
1751a5b789f6SErmal Luçi 		}
1752a5b789f6SErmal Luçi 		| FAIRQ '(' fairq_opts ')'      {
1753a5b789f6SErmal Luçi 			$$.qtype = ALTQT_FAIRQ;
1754a5b789f6SErmal Luçi 			$$.data.fairq_opts = $3;
1755a5b789f6SErmal Luçi 		}
17560a70aaf8SLuiz Otavio O Souza 		| CODEL				{
17570a70aaf8SLuiz Otavio O Souza 			$$.qtype = ALTQT_CODEL;
17580a70aaf8SLuiz Otavio O Souza 			bzero(&$$.data.codel_opts,
17590a70aaf8SLuiz Otavio O Souza 				sizeof(struct codel_opts));
17600a70aaf8SLuiz Otavio O Souza 		}
17610a70aaf8SLuiz Otavio O Souza 		| CODEL '(' codel_opts ')'	{
17620a70aaf8SLuiz Otavio O Souza 			$$.qtype = ALTQT_CODEL;
17630a70aaf8SLuiz Otavio O Souza 			$$.data.codel_opts = $3;
17640a70aaf8SLuiz Otavio O Souza 		}
17653b3a8eb9SGleb Smirnoff 		;
17663b3a8eb9SGleb Smirnoff 
17673b3a8eb9SGleb Smirnoff cbqflags_list	: cbqflags_item				{ $$ |= $1; }
17683b3a8eb9SGleb Smirnoff 		| cbqflags_list comma cbqflags_item	{ $$ |= $3; }
17693b3a8eb9SGleb Smirnoff 		;
17703b3a8eb9SGleb Smirnoff 
17713b3a8eb9SGleb Smirnoff cbqflags_item	: STRING	{
17723b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "default"))
17733b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_DEFCLASS;
17743b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "borrow"))
17753b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_BORROW;
17763b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "red"))
17773b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_RED;
17783b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "ecn"))
17793b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_RED|CBQCLF_ECN;
17803b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "rio"))
17813b3a8eb9SGleb Smirnoff 				$$ = CBQCLF_RIO;
17820a70aaf8SLuiz Otavio O Souza 			else if (!strcmp($1, "codel"))
17830a70aaf8SLuiz Otavio O Souza 				$$ = CBQCLF_CODEL;
17843b3a8eb9SGleb Smirnoff 			else {
17853b3a8eb9SGleb Smirnoff 				yyerror("unknown cbq flag \"%s\"", $1);
17863b3a8eb9SGleb Smirnoff 				free($1);
17873b3a8eb9SGleb Smirnoff 				YYERROR;
17883b3a8eb9SGleb Smirnoff 			}
17893b3a8eb9SGleb Smirnoff 			free($1);
17903b3a8eb9SGleb Smirnoff 		}
17913b3a8eb9SGleb Smirnoff 		;
17923b3a8eb9SGleb Smirnoff 
17933b3a8eb9SGleb Smirnoff priqflags_list	: priqflags_item			{ $$ |= $1; }
17943b3a8eb9SGleb Smirnoff 		| priqflags_list comma priqflags_item	{ $$ |= $3; }
17953b3a8eb9SGleb Smirnoff 		;
17963b3a8eb9SGleb Smirnoff 
17973b3a8eb9SGleb Smirnoff priqflags_item	: STRING	{
17983b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "default"))
17993b3a8eb9SGleb Smirnoff 				$$ = PRCF_DEFAULTCLASS;
18003b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "red"))
18013b3a8eb9SGleb Smirnoff 				$$ = PRCF_RED;
18023b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "ecn"))
18033b3a8eb9SGleb Smirnoff 				$$ = PRCF_RED|PRCF_ECN;
18043b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "rio"))
18053b3a8eb9SGleb Smirnoff 				$$ = PRCF_RIO;
18060a70aaf8SLuiz Otavio O Souza 			else if (!strcmp($1, "codel"))
18070a70aaf8SLuiz Otavio O Souza 				$$ = PRCF_CODEL;
18083b3a8eb9SGleb Smirnoff 			else {
18093b3a8eb9SGleb Smirnoff 				yyerror("unknown priq flag \"%s\"", $1);
18103b3a8eb9SGleb Smirnoff 				free($1);
18113b3a8eb9SGleb Smirnoff 				YYERROR;
18123b3a8eb9SGleb Smirnoff 			}
18133b3a8eb9SGleb Smirnoff 			free($1);
18143b3a8eb9SGleb Smirnoff 		}
18153b3a8eb9SGleb Smirnoff 		;
18163b3a8eb9SGleb Smirnoff 
18173b3a8eb9SGleb Smirnoff hfsc_opts	:	{
18183b3a8eb9SGleb Smirnoff 				bzero(&hfsc_opts,
18193b3a8eb9SGleb Smirnoff 				    sizeof(struct node_hfsc_opts));
18203b3a8eb9SGleb Smirnoff 			}
18213b3a8eb9SGleb Smirnoff 		    hfscopts_list				{
18223b3a8eb9SGleb Smirnoff 			$$ = hfsc_opts;
18233b3a8eb9SGleb Smirnoff 		}
18243b3a8eb9SGleb Smirnoff 		;
18253b3a8eb9SGleb Smirnoff 
18263b3a8eb9SGleb Smirnoff hfscopts_list	: hfscopts_item
18273b3a8eb9SGleb Smirnoff 		| hfscopts_list comma hfscopts_item
18283b3a8eb9SGleb Smirnoff 		;
18293b3a8eb9SGleb Smirnoff 
18303b3a8eb9SGleb Smirnoff hfscopts_item	: LINKSHARE bandwidth				{
18313b3a8eb9SGleb Smirnoff 			if (hfsc_opts.linkshare.used) {
18323b3a8eb9SGleb Smirnoff 				yyerror("linkshare already specified");
18333b3a8eb9SGleb Smirnoff 				YYERROR;
18343b3a8eb9SGleb Smirnoff 			}
18353b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.m2 = $2;
18363b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.used = 1;
18373b3a8eb9SGleb Smirnoff 		}
18383b3a8eb9SGleb Smirnoff 		| LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')'
18393b3a8eb9SGleb Smirnoff 		    {
18403b3a8eb9SGleb Smirnoff 			if ($5 < 0 || $5 > INT_MAX) {
18413b3a8eb9SGleb Smirnoff 				yyerror("timing in curve out of range");
18423b3a8eb9SGleb Smirnoff 				YYERROR;
18433b3a8eb9SGleb Smirnoff 			}
18443b3a8eb9SGleb Smirnoff 			if (hfsc_opts.linkshare.used) {
18453b3a8eb9SGleb Smirnoff 				yyerror("linkshare already specified");
18463b3a8eb9SGleb Smirnoff 				YYERROR;
18473b3a8eb9SGleb Smirnoff 			}
18483b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.m1 = $3;
18493b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.d = $5;
18503b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.m2 = $7;
18513b3a8eb9SGleb Smirnoff 			hfsc_opts.linkshare.used = 1;
18523b3a8eb9SGleb Smirnoff 		}
18533b3a8eb9SGleb Smirnoff 		| REALTIME bandwidth				{
18543b3a8eb9SGleb Smirnoff 			if (hfsc_opts.realtime.used) {
18553b3a8eb9SGleb Smirnoff 				yyerror("realtime already specified");
18563b3a8eb9SGleb Smirnoff 				YYERROR;
18573b3a8eb9SGleb Smirnoff 			}
18583b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.m2 = $2;
18593b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.used = 1;
18603b3a8eb9SGleb Smirnoff 		}
18613b3a8eb9SGleb Smirnoff 		| REALTIME '(' bandwidth comma NUMBER comma bandwidth ')'
18623b3a8eb9SGleb Smirnoff 		    {
18633b3a8eb9SGleb Smirnoff 			if ($5 < 0 || $5 > INT_MAX) {
18643b3a8eb9SGleb Smirnoff 				yyerror("timing in curve out of range");
18653b3a8eb9SGleb Smirnoff 				YYERROR;
18663b3a8eb9SGleb Smirnoff 			}
18673b3a8eb9SGleb Smirnoff 			if (hfsc_opts.realtime.used) {
18683b3a8eb9SGleb Smirnoff 				yyerror("realtime already specified");
18693b3a8eb9SGleb Smirnoff 				YYERROR;
18703b3a8eb9SGleb Smirnoff 			}
18713b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.m1 = $3;
18723b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.d = $5;
18733b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.m2 = $7;
18743b3a8eb9SGleb Smirnoff 			hfsc_opts.realtime.used = 1;
18753b3a8eb9SGleb Smirnoff 		}
18763b3a8eb9SGleb Smirnoff 		| UPPERLIMIT bandwidth				{
18773b3a8eb9SGleb Smirnoff 			if (hfsc_opts.upperlimit.used) {
18783b3a8eb9SGleb Smirnoff 				yyerror("upperlimit already specified");
18793b3a8eb9SGleb Smirnoff 				YYERROR;
18803b3a8eb9SGleb Smirnoff 			}
18813b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.m2 = $2;
18823b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.used = 1;
18833b3a8eb9SGleb Smirnoff 		}
18843b3a8eb9SGleb Smirnoff 		| UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')'
18853b3a8eb9SGleb Smirnoff 		    {
18863b3a8eb9SGleb Smirnoff 			if ($5 < 0 || $5 > INT_MAX) {
18873b3a8eb9SGleb Smirnoff 				yyerror("timing in curve out of range");
18883b3a8eb9SGleb Smirnoff 				YYERROR;
18893b3a8eb9SGleb Smirnoff 			}
18903b3a8eb9SGleb Smirnoff 			if (hfsc_opts.upperlimit.used) {
18913b3a8eb9SGleb Smirnoff 				yyerror("upperlimit already specified");
18923b3a8eb9SGleb Smirnoff 				YYERROR;
18933b3a8eb9SGleb Smirnoff 			}
18943b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.m1 = $3;
18953b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.d = $5;
18963b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.m2 = $7;
18973b3a8eb9SGleb Smirnoff 			hfsc_opts.upperlimit.used = 1;
18983b3a8eb9SGleb Smirnoff 		}
18993b3a8eb9SGleb Smirnoff 		| STRING	{
19003b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "default"))
19013b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_DEFAULTCLASS;
19023b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "red"))
19033b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_RED;
19043b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "ecn"))
19053b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_RED|HFCF_ECN;
19063b3a8eb9SGleb Smirnoff 			else if (!strcmp($1, "rio"))
19073b3a8eb9SGleb Smirnoff 				hfsc_opts.flags |= HFCF_RIO;
19080a70aaf8SLuiz Otavio O Souza 			else if (!strcmp($1, "codel"))
19090a70aaf8SLuiz Otavio O Souza 				hfsc_opts.flags |= HFCF_CODEL;
19103b3a8eb9SGleb Smirnoff 			else {
19113b3a8eb9SGleb Smirnoff 				yyerror("unknown hfsc flag \"%s\"", $1);
19123b3a8eb9SGleb Smirnoff 				free($1);
19133b3a8eb9SGleb Smirnoff 				YYERROR;
19143b3a8eb9SGleb Smirnoff 			}
19153b3a8eb9SGleb Smirnoff 			free($1);
19163b3a8eb9SGleb Smirnoff 		}
19173b3a8eb9SGleb Smirnoff 		;
19183b3a8eb9SGleb Smirnoff 
1919a5b789f6SErmal Luçi fairq_opts	:	{
1920a5b789f6SErmal Luçi 				bzero(&fairq_opts,
1921a5b789f6SErmal Luçi 				    sizeof(struct node_fairq_opts));
1922a5b789f6SErmal Luçi 			}
1923a5b789f6SErmal Luçi 		    fairqopts_list				{
1924a5b789f6SErmal Luçi 			$$ = fairq_opts;
1925a5b789f6SErmal Luçi 		}
1926a5b789f6SErmal Luçi 		;
1927a5b789f6SErmal Luçi 
1928a5b789f6SErmal Luçi fairqopts_list	: fairqopts_item
1929a5b789f6SErmal Luçi 		| fairqopts_list comma fairqopts_item
1930a5b789f6SErmal Luçi 		;
1931a5b789f6SErmal Luçi 
1932a5b789f6SErmal Luçi fairqopts_item	: LINKSHARE bandwidth				{
1933a5b789f6SErmal Luçi 			if (fairq_opts.linkshare.used) {
1934a5b789f6SErmal Luçi 				yyerror("linkshare already specified");
1935a5b789f6SErmal Luçi 				YYERROR;
1936a5b789f6SErmal Luçi 			}
1937a5b789f6SErmal Luçi 			fairq_opts.linkshare.m2 = $2;
1938a5b789f6SErmal Luçi 			fairq_opts.linkshare.used = 1;
1939a5b789f6SErmal Luçi 		}
1940a5b789f6SErmal Luçi 		| LINKSHARE '(' bandwidth number bandwidth ')'	{
1941a5b789f6SErmal Luçi 			if (fairq_opts.linkshare.used) {
1942a5b789f6SErmal Luçi 				yyerror("linkshare already specified");
1943a5b789f6SErmal Luçi 				YYERROR;
1944a5b789f6SErmal Luçi 			}
1945a5b789f6SErmal Luçi 			fairq_opts.linkshare.m1 = $3;
1946a5b789f6SErmal Luçi 			fairq_opts.linkshare.d = $4;
1947a5b789f6SErmal Luçi 			fairq_opts.linkshare.m2 = $5;
1948a5b789f6SErmal Luçi 			fairq_opts.linkshare.used = 1;
1949a5b789f6SErmal Luçi 		}
1950a5b789f6SErmal Luçi 		| HOGS bandwidth {
1951a5b789f6SErmal Luçi 			fairq_opts.hogs_bw = $2;
1952a5b789f6SErmal Luçi 		}
1953a5b789f6SErmal Luçi 		| BUCKETS number {
1954a5b789f6SErmal Luçi 			fairq_opts.nbuckets = $2;
1955a5b789f6SErmal Luçi 		}
1956a5b789f6SErmal Luçi 		| STRING	{
1957a5b789f6SErmal Luçi 			if (!strcmp($1, "default"))
1958a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_DEFAULTCLASS;
1959a5b789f6SErmal Luçi 			else if (!strcmp($1, "red"))
1960a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_RED;
1961a5b789f6SErmal Luçi 			else if (!strcmp($1, "ecn"))
1962a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_RED|FARF_ECN;
1963a5b789f6SErmal Luçi 			else if (!strcmp($1, "rio"))
1964a5b789f6SErmal Luçi 				fairq_opts.flags |= FARF_RIO;
19650a70aaf8SLuiz Otavio O Souza 			else if (!strcmp($1, "codel"))
19660a70aaf8SLuiz Otavio O Souza 				fairq_opts.flags |= FARF_CODEL;
1967a5b789f6SErmal Luçi 			else {
1968a5b789f6SErmal Luçi 				yyerror("unknown fairq flag \"%s\"", $1);
1969a5b789f6SErmal Luçi 				free($1);
1970a5b789f6SErmal Luçi 				YYERROR;
1971a5b789f6SErmal Luçi 			}
1972a5b789f6SErmal Luçi 			free($1);
1973a5b789f6SErmal Luçi 		}
1974a5b789f6SErmal Luçi 		;
1975a5b789f6SErmal Luçi 
19760a70aaf8SLuiz Otavio O Souza codel_opts	:	{
19770a70aaf8SLuiz Otavio O Souza 				bzero(&codel_opts,
19780a70aaf8SLuiz Otavio O Souza 				    sizeof(struct codel_opts));
19790a70aaf8SLuiz Otavio O Souza 			}
19800a70aaf8SLuiz Otavio O Souza 		    codelopts_list				{
19810a70aaf8SLuiz Otavio O Souza 			$$ = codel_opts;
19820a70aaf8SLuiz Otavio O Souza 		}
19830a70aaf8SLuiz Otavio O Souza 		;
19840a70aaf8SLuiz Otavio O Souza 
19850a70aaf8SLuiz Otavio O Souza codelopts_list	: codelopts_item
19860a70aaf8SLuiz Otavio O Souza 		| codelopts_list comma codelopts_item
19870a70aaf8SLuiz Otavio O Souza 		;
19880a70aaf8SLuiz Otavio O Souza 
19890a70aaf8SLuiz Otavio O Souza codelopts_item	: INTERVAL number				{
19900a70aaf8SLuiz Otavio O Souza 			if (codel_opts.interval) {
19910a70aaf8SLuiz Otavio O Souza 				yyerror("interval already specified");
19920a70aaf8SLuiz Otavio O Souza 				YYERROR;
19930a70aaf8SLuiz Otavio O Souza 			}
19940a70aaf8SLuiz Otavio O Souza 			codel_opts.interval = $2;
19950a70aaf8SLuiz Otavio O Souza 		}
19960a70aaf8SLuiz Otavio O Souza 		| TARGET number					{
19970a70aaf8SLuiz Otavio O Souza 			if (codel_opts.target) {
19980a70aaf8SLuiz Otavio O Souza 				yyerror("target already specified");
19990a70aaf8SLuiz Otavio O Souza 				YYERROR;
20000a70aaf8SLuiz Otavio O Souza 			}
20010a70aaf8SLuiz Otavio O Souza 			codel_opts.target = $2;
20020a70aaf8SLuiz Otavio O Souza 		}
20030a70aaf8SLuiz Otavio O Souza 		| STRING					{
20040a70aaf8SLuiz Otavio O Souza 			if (!strcmp($1, "ecn"))
20050a70aaf8SLuiz Otavio O Souza 				codel_opts.ecn = 1;
20060a70aaf8SLuiz Otavio O Souza 			else {
20070a70aaf8SLuiz Otavio O Souza 				yyerror("unknown codel option \"%s\"", $1);
20080a70aaf8SLuiz Otavio O Souza 				free($1);
20090a70aaf8SLuiz Otavio O Souza 				YYERROR;
20100a70aaf8SLuiz Otavio O Souza 			}
20110a70aaf8SLuiz Otavio O Souza 			free($1);
20120a70aaf8SLuiz Otavio O Souza 		}
20130a70aaf8SLuiz Otavio O Souza 		;
20140a70aaf8SLuiz Otavio O Souza 
20153b3a8eb9SGleb Smirnoff qassign		: /* empty */		{ $$ = NULL; }
20163b3a8eb9SGleb Smirnoff 		| qassign_item		{ $$ = $1; }
20173b3a8eb9SGleb Smirnoff 		| '{' optnl qassign_list '}'	{ $$ = $3; }
20183b3a8eb9SGleb Smirnoff 		;
20193b3a8eb9SGleb Smirnoff 
20203b3a8eb9SGleb Smirnoff qassign_list	: qassign_item optnl		{ $$ = $1; }
20213b3a8eb9SGleb Smirnoff 		| qassign_list comma qassign_item optnl	{
20223b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
20233b3a8eb9SGleb Smirnoff 			$1->tail = $3;
20243b3a8eb9SGleb Smirnoff 			$$ = $1;
20253b3a8eb9SGleb Smirnoff 		}
20263b3a8eb9SGleb Smirnoff 		;
20273b3a8eb9SGleb Smirnoff 
20283b3a8eb9SGleb Smirnoff qassign_item	: STRING			{
20293b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_queue));
20303b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
20313b3a8eb9SGleb Smirnoff 				err(1, "qassign_item: calloc");
20323b3a8eb9SGleb Smirnoff 			if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
20333b3a8eb9SGleb Smirnoff 			    sizeof($$->queue)) {
20343b3a8eb9SGleb Smirnoff 				yyerror("queue name '%s' too long (max "
20353b3a8eb9SGleb Smirnoff 				    "%d chars)", $1, sizeof($$->queue)-1);
20363b3a8eb9SGleb Smirnoff 				free($1);
20373b3a8eb9SGleb Smirnoff 				free($$);
20383b3a8eb9SGleb Smirnoff 				YYERROR;
20393b3a8eb9SGleb Smirnoff 			}
20403b3a8eb9SGleb Smirnoff 			free($1);
20413b3a8eb9SGleb Smirnoff 			$$->next = NULL;
20423b3a8eb9SGleb Smirnoff 			$$->tail = $$;
20433b3a8eb9SGleb Smirnoff 		}
20443b3a8eb9SGleb Smirnoff 		;
20453b3a8eb9SGleb Smirnoff 
20463b3a8eb9SGleb Smirnoff pfrule		: action dir logquick interface route af proto fromto
20473b3a8eb9SGleb Smirnoff 		    filter_opts
20483b3a8eb9SGleb Smirnoff 		{
2049e9eb0941SKristof Provost 			struct pfctl_rule	 r;
20503b3a8eb9SGleb Smirnoff 			struct node_state_opt	*o;
20513b3a8eb9SGleb Smirnoff 			struct node_proto	*proto;
20523b3a8eb9SGleb Smirnoff 			int			 srctrack = 0;
20533b3a8eb9SGleb Smirnoff 			int			 statelock = 0;
20543b3a8eb9SGleb Smirnoff 			int			 adaptive = 0;
20553b3a8eb9SGleb Smirnoff 			int			 defaults = 0;
20563b3a8eb9SGleb Smirnoff 
20573b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_FILTER))
20583b3a8eb9SGleb Smirnoff 				YYERROR;
20593b3a8eb9SGleb Smirnoff 
20603b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
20613b3a8eb9SGleb Smirnoff 
20623b3a8eb9SGleb Smirnoff 			r.action = $1.b1;
20633b3a8eb9SGleb Smirnoff 			switch ($1.b2) {
20643b3a8eb9SGleb Smirnoff 			case PFRULE_RETURNRST:
20653b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RETURNRST;
20663b3a8eb9SGleb Smirnoff 				r.return_ttl = $1.w;
20673b3a8eb9SGleb Smirnoff 				break;
20683b3a8eb9SGleb Smirnoff 			case PFRULE_RETURNICMP:
20693b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RETURNICMP;
20703b3a8eb9SGleb Smirnoff 				r.return_icmp = $1.w;
20713b3a8eb9SGleb Smirnoff 				r.return_icmp6 = $1.w2;
20723b3a8eb9SGleb Smirnoff 				break;
20733b3a8eb9SGleb Smirnoff 			case PFRULE_RETURN:
20743b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_RETURN;
20753b3a8eb9SGleb Smirnoff 				r.return_icmp = $1.w;
20763b3a8eb9SGleb Smirnoff 				r.return_icmp6 = $1.w2;
20773b3a8eb9SGleb Smirnoff 				break;
20783b3a8eb9SGleb Smirnoff 			}
20793b3a8eb9SGleb Smirnoff 			r.direction = $2;
20803b3a8eb9SGleb Smirnoff 			r.log = $3.log;
20813b3a8eb9SGleb Smirnoff 			r.logif = $3.logif;
20823b3a8eb9SGleb Smirnoff 			r.quick = $3.quick;
20833b3a8eb9SGleb Smirnoff 			r.prob = $9.prob;
20843b3a8eb9SGleb Smirnoff 			r.rtableid = $9.rtableid;
20853b3a8eb9SGleb Smirnoff 
20863e248e0fSKristof Provost 			if ($9.marker & FOM_PRIO) {
20873e248e0fSKristof Provost 				if ($9.prio == 0)
20883e248e0fSKristof Provost 					r.prio = PF_PRIO_ZERO;
20893e248e0fSKristof Provost 				else
20903e248e0fSKristof Provost 					r.prio = $9.prio;
20913e248e0fSKristof Provost 			}
20923e248e0fSKristof Provost 			if ($9.marker & FOM_SETPRIO) {
20933e248e0fSKristof Provost 				r.set_prio[0] = $9.set_prio[0];
20943e248e0fSKristof Provost 				r.set_prio[1] = $9.set_prio[1];
20953e248e0fSKristof Provost 				r.scrub_flags |= PFSTATE_SETPRIO;
20963e248e0fSKristof Provost 			}
20973e248e0fSKristof Provost 
20983b3a8eb9SGleb Smirnoff 			r.af = $6;
20993b3a8eb9SGleb Smirnoff 			if ($9.tag)
21003b3a8eb9SGleb Smirnoff 				if (strlcpy(r.tagname, $9.tag,
21013b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
21023b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
21033b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
21043b3a8eb9SGleb Smirnoff 					YYERROR;
21053b3a8eb9SGleb Smirnoff 				}
21063b3a8eb9SGleb Smirnoff 			if ($9.match_tag)
21073b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $9.match_tag,
21083b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
21093b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
21103b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
21113b3a8eb9SGleb Smirnoff 					YYERROR;
21123b3a8eb9SGleb Smirnoff 				}
21133b3a8eb9SGleb Smirnoff 			r.match_tag_not = $9.match_tag_not;
21143b3a8eb9SGleb Smirnoff 			if (rule_label(&r, $9.label))
21153b3a8eb9SGleb Smirnoff 				YYERROR;
21166fcc8e04SKristof Provost 			for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
21176fcc8e04SKristof Provost 				free($9.label[i]);
21183b3a8eb9SGleb Smirnoff 			r.flags = $9.flags.b1;
21193b3a8eb9SGleb Smirnoff 			r.flagset = $9.flags.b2;
21203b3a8eb9SGleb Smirnoff 			if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
21213b3a8eb9SGleb Smirnoff 				yyerror("flags always false");
21223b3a8eb9SGleb Smirnoff 				YYERROR;
21233b3a8eb9SGleb Smirnoff 			}
21243b3a8eb9SGleb Smirnoff 			if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
21253b3a8eb9SGleb Smirnoff 				for (proto = $7; proto != NULL &&
21263b3a8eb9SGleb Smirnoff 				    proto->proto != IPPROTO_TCP;
21273b3a8eb9SGleb Smirnoff 				    proto = proto->next)
21283b3a8eb9SGleb Smirnoff 					;	/* nothing */
21293b3a8eb9SGleb Smirnoff 				if (proto == NULL && $7 != NULL) {
21303b3a8eb9SGleb Smirnoff 					if ($9.flags.b1 || $9.flags.b2)
21313b3a8eb9SGleb Smirnoff 						yyerror(
21323b3a8eb9SGleb Smirnoff 						    "flags only apply to tcp");
21333b3a8eb9SGleb Smirnoff 					if ($8.src_os)
21343b3a8eb9SGleb Smirnoff 						yyerror(
21353b3a8eb9SGleb Smirnoff 						    "OS fingerprinting only "
21363b3a8eb9SGleb Smirnoff 						    "apply to tcp");
21373b3a8eb9SGleb Smirnoff 					YYERROR;
21383b3a8eb9SGleb Smirnoff 				}
21393b3a8eb9SGleb Smirnoff #if 0
21403b3a8eb9SGleb Smirnoff 				if (($9.flags.b1 & parse_flags("S")) == 0 &&
21413b3a8eb9SGleb Smirnoff 				    $8.src_os) {
21423b3a8eb9SGleb Smirnoff 					yyerror("OS fingerprinting requires "
21433b3a8eb9SGleb Smirnoff 					    "the SYN TCP flag (flags S/SA)");
21443b3a8eb9SGleb Smirnoff 					YYERROR;
21453b3a8eb9SGleb Smirnoff 				}
21463b3a8eb9SGleb Smirnoff #endif
21473b3a8eb9SGleb Smirnoff 			}
21483b3a8eb9SGleb Smirnoff 
21493b3a8eb9SGleb Smirnoff 			r.tos = $9.tos;
21503b3a8eb9SGleb Smirnoff 			r.keep_state = $9.keep.action;
21513b3a8eb9SGleb Smirnoff 			o = $9.keep.options;
21523b3a8eb9SGleb Smirnoff 
21533b3a8eb9SGleb Smirnoff 			/* 'keep state' by default on pass rules. */
21543b3a8eb9SGleb Smirnoff 			if (!r.keep_state && !r.action &&
21553b3a8eb9SGleb Smirnoff 			    !($9.marker & FOM_KEEP)) {
21563b3a8eb9SGleb Smirnoff 				r.keep_state = PF_STATE_NORMAL;
21573b3a8eb9SGleb Smirnoff 				o = keep_state_defaults;
21583b3a8eb9SGleb Smirnoff 				defaults = 1;
21593b3a8eb9SGleb Smirnoff 			}
21603b3a8eb9SGleb Smirnoff 
21613b3a8eb9SGleb Smirnoff 			while (o) {
21623b3a8eb9SGleb Smirnoff 				struct node_state_opt	*p = o;
21633b3a8eb9SGleb Smirnoff 
21643b3a8eb9SGleb Smirnoff 				switch (o->type) {
21653b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX:
21663b3a8eb9SGleb Smirnoff 					if (r.max_states) {
21673b3a8eb9SGleb Smirnoff 						yyerror("state option 'max' "
21683b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21693b3a8eb9SGleb Smirnoff 						YYERROR;
21703b3a8eb9SGleb Smirnoff 					}
21713b3a8eb9SGleb Smirnoff 					r.max_states = o->data.max_states;
21723b3a8eb9SGleb Smirnoff 					break;
21733b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_NOSYNC:
21743b3a8eb9SGleb Smirnoff 					if (r.rule_flag & PFRULE_NOSYNC) {
21753b3a8eb9SGleb Smirnoff 						yyerror("state option 'sync' "
21763b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21773b3a8eb9SGleb Smirnoff 						YYERROR;
21783b3a8eb9SGleb Smirnoff 					}
21793b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_NOSYNC;
21803b3a8eb9SGleb Smirnoff 					break;
21813b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_SRCTRACK:
21823b3a8eb9SGleb Smirnoff 					if (srctrack) {
21833b3a8eb9SGleb Smirnoff 						yyerror("state option "
21843b3a8eb9SGleb Smirnoff 						    "'source-track' "
21853b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21863b3a8eb9SGleb Smirnoff 						YYERROR;
21873b3a8eb9SGleb Smirnoff 					}
21883b3a8eb9SGleb Smirnoff 					srctrack =  o->data.src_track;
21893b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK;
21903b3a8eb9SGleb Smirnoff 					break;
21913b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_STATES:
21923b3a8eb9SGleb Smirnoff 					if (r.max_src_states) {
21933b3a8eb9SGleb Smirnoff 						yyerror("state option "
21943b3a8eb9SGleb Smirnoff 						    "'max-src-states' "
21953b3a8eb9SGleb Smirnoff 						    "multiple definitions");
21963b3a8eb9SGleb Smirnoff 						YYERROR;
21973b3a8eb9SGleb Smirnoff 					}
21983b3a8eb9SGleb Smirnoff 					if (o->data.max_src_states == 0) {
21993b3a8eb9SGleb Smirnoff 						yyerror("'max-src-states' must "
22003b3a8eb9SGleb Smirnoff 						    "be > 0");
22013b3a8eb9SGleb Smirnoff 						YYERROR;
22023b3a8eb9SGleb Smirnoff 					}
22033b3a8eb9SGleb Smirnoff 					r.max_src_states =
22043b3a8eb9SGleb Smirnoff 					    o->data.max_src_states;
22053b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK;
22063b3a8eb9SGleb Smirnoff 					break;
22073b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_OVERLOAD:
22083b3a8eb9SGleb Smirnoff 					if (r.overload_tblname[0]) {
22093b3a8eb9SGleb Smirnoff 						yyerror("multiple 'overload' "
22103b3a8eb9SGleb Smirnoff 						    "table definitions");
22113b3a8eb9SGleb Smirnoff 						YYERROR;
22123b3a8eb9SGleb Smirnoff 					}
22133b3a8eb9SGleb Smirnoff 					if (strlcpy(r.overload_tblname,
22143b3a8eb9SGleb Smirnoff 					    o->data.overload.tblname,
22153b3a8eb9SGleb Smirnoff 					    PF_TABLE_NAME_SIZE) >=
22163b3a8eb9SGleb Smirnoff 					    PF_TABLE_NAME_SIZE) {
22173b3a8eb9SGleb Smirnoff 						yyerror("state option: "
22183b3a8eb9SGleb Smirnoff 						    "strlcpy");
22193b3a8eb9SGleb Smirnoff 						YYERROR;
22203b3a8eb9SGleb Smirnoff 					}
22213b3a8eb9SGleb Smirnoff 					r.flush = o->data.overload.flush;
22223b3a8eb9SGleb Smirnoff 					break;
22233b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_CONN:
22243b3a8eb9SGleb Smirnoff 					if (r.max_src_conn) {
22253b3a8eb9SGleb Smirnoff 						yyerror("state option "
22263b3a8eb9SGleb Smirnoff 						    "'max-src-conn' "
22273b3a8eb9SGleb Smirnoff 						    "multiple definitions");
22283b3a8eb9SGleb Smirnoff 						YYERROR;
22293b3a8eb9SGleb Smirnoff 					}
22303b3a8eb9SGleb Smirnoff 					if (o->data.max_src_conn == 0) {
22313b3a8eb9SGleb Smirnoff 						yyerror("'max-src-conn' "
22323b3a8eb9SGleb Smirnoff 						    "must be > 0");
22333b3a8eb9SGleb Smirnoff 						YYERROR;
22343b3a8eb9SGleb Smirnoff 					}
22353b3a8eb9SGleb Smirnoff 					r.max_src_conn =
22363b3a8eb9SGleb Smirnoff 					    o->data.max_src_conn;
22373b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK |
22383b3a8eb9SGleb Smirnoff 					    PFRULE_RULESRCTRACK;
22393b3a8eb9SGleb Smirnoff 					break;
22403b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_CONN_RATE:
22413b3a8eb9SGleb Smirnoff 					if (r.max_src_conn_rate.limit) {
22423b3a8eb9SGleb Smirnoff 						yyerror("state option "
22433b3a8eb9SGleb Smirnoff 						    "'max-src-conn-rate' "
22443b3a8eb9SGleb Smirnoff 						    "multiple definitions");
22453b3a8eb9SGleb Smirnoff 						YYERROR;
22463b3a8eb9SGleb Smirnoff 					}
22473b3a8eb9SGleb Smirnoff 					if (!o->data.max_src_conn_rate.limit ||
22483b3a8eb9SGleb Smirnoff 					    !o->data.max_src_conn_rate.seconds) {
22493b3a8eb9SGleb Smirnoff 						yyerror("'max-src-conn-rate' "
22503b3a8eb9SGleb Smirnoff 						    "values must be > 0");
22513b3a8eb9SGleb Smirnoff 						YYERROR;
22523b3a8eb9SGleb Smirnoff 					}
22533b3a8eb9SGleb Smirnoff 					if (o->data.max_src_conn_rate.limit >
22543b3a8eb9SGleb Smirnoff 					    PF_THRESHOLD_MAX) {
22553b3a8eb9SGleb Smirnoff 						yyerror("'max-src-conn-rate' "
22563b3a8eb9SGleb Smirnoff 						    "maximum rate must be < %u",
22573b3a8eb9SGleb Smirnoff 						    PF_THRESHOLD_MAX);
22583b3a8eb9SGleb Smirnoff 						YYERROR;
22593b3a8eb9SGleb Smirnoff 					}
22603b3a8eb9SGleb Smirnoff 					r.max_src_conn_rate.limit =
22613b3a8eb9SGleb Smirnoff 					    o->data.max_src_conn_rate.limit;
22623b3a8eb9SGleb Smirnoff 					r.max_src_conn_rate.seconds =
22633b3a8eb9SGleb Smirnoff 					    o->data.max_src_conn_rate.seconds;
22643b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK |
22653b3a8eb9SGleb Smirnoff 					    PFRULE_RULESRCTRACK;
22663b3a8eb9SGleb Smirnoff 					break;
22673b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_MAX_SRC_NODES:
22683b3a8eb9SGleb Smirnoff 					if (r.max_src_nodes) {
22693b3a8eb9SGleb Smirnoff 						yyerror("state option "
22703b3a8eb9SGleb Smirnoff 						    "'max-src-nodes' "
22713b3a8eb9SGleb Smirnoff 						    "multiple definitions");
22723b3a8eb9SGleb Smirnoff 						YYERROR;
22733b3a8eb9SGleb Smirnoff 					}
22743b3a8eb9SGleb Smirnoff 					if (o->data.max_src_nodes == 0) {
22753b3a8eb9SGleb Smirnoff 						yyerror("'max-src-nodes' must "
22763b3a8eb9SGleb Smirnoff 						    "be > 0");
22773b3a8eb9SGleb Smirnoff 						YYERROR;
22783b3a8eb9SGleb Smirnoff 					}
22793b3a8eb9SGleb Smirnoff 					r.max_src_nodes =
22803b3a8eb9SGleb Smirnoff 					    o->data.max_src_nodes;
22813b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_SRCTRACK |
22823b3a8eb9SGleb Smirnoff 					    PFRULE_RULESRCTRACK;
22833b3a8eb9SGleb Smirnoff 					break;
22843b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_STATELOCK:
22853b3a8eb9SGleb Smirnoff 					if (statelock) {
22863b3a8eb9SGleb Smirnoff 						yyerror("state locking option: "
22873b3a8eb9SGleb Smirnoff 						    "multiple definitions");
22883b3a8eb9SGleb Smirnoff 						YYERROR;
22893b3a8eb9SGleb Smirnoff 					}
22903b3a8eb9SGleb Smirnoff 					statelock = 1;
22913b3a8eb9SGleb Smirnoff 					r.rule_flag |= o->data.statelock;
22923b3a8eb9SGleb Smirnoff 					break;
22933b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_SLOPPY:
22943b3a8eb9SGleb Smirnoff 					if (r.rule_flag & PFRULE_STATESLOPPY) {
22953b3a8eb9SGleb Smirnoff 						yyerror("state sloppy option: "
22963b3a8eb9SGleb Smirnoff 						    "multiple definitions");
22973b3a8eb9SGleb Smirnoff 						YYERROR;
22983b3a8eb9SGleb Smirnoff 					}
22993b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_STATESLOPPY;
23003b3a8eb9SGleb Smirnoff 					break;
23013b3a8eb9SGleb Smirnoff 				case PF_STATE_OPT_TIMEOUT:
23023b3a8eb9SGleb Smirnoff 					if (o->data.timeout.number ==
23033b3a8eb9SGleb Smirnoff 					    PFTM_ADAPTIVE_START ||
23043b3a8eb9SGleb Smirnoff 					    o->data.timeout.number ==
23053b3a8eb9SGleb Smirnoff 					    PFTM_ADAPTIVE_END)
23063b3a8eb9SGleb Smirnoff 						adaptive = 1;
23073b3a8eb9SGleb Smirnoff 					if (r.timeout[o->data.timeout.number]) {
23083b3a8eb9SGleb Smirnoff 						yyerror("state timeout %s "
23093b3a8eb9SGleb Smirnoff 						    "multiple definitions",
23103b3a8eb9SGleb Smirnoff 						    pf_timeouts[o->data.
23113b3a8eb9SGleb Smirnoff 						    timeout.number].name);
23123b3a8eb9SGleb Smirnoff 						YYERROR;
23133b3a8eb9SGleb Smirnoff 					}
23143b3a8eb9SGleb Smirnoff 					r.timeout[o->data.timeout.number] =
23153b3a8eb9SGleb Smirnoff 					    o->data.timeout.seconds;
23163b3a8eb9SGleb Smirnoff 				}
23173b3a8eb9SGleb Smirnoff 				o = o->next;
23183b3a8eb9SGleb Smirnoff 				if (!defaults)
23193b3a8eb9SGleb Smirnoff 					free(p);
23203b3a8eb9SGleb Smirnoff 			}
23213b3a8eb9SGleb Smirnoff 
23223b3a8eb9SGleb Smirnoff 			/* 'flags S/SA' by default on stateful rules */
23233b3a8eb9SGleb Smirnoff 			if (!r.action && !r.flags && !r.flagset &&
23243b3a8eb9SGleb Smirnoff 			    !$9.fragment && !($9.marker & FOM_FLAGS) &&
23253b3a8eb9SGleb Smirnoff 			    r.keep_state) {
23263b3a8eb9SGleb Smirnoff 				r.flags = parse_flags("S");
23273b3a8eb9SGleb Smirnoff 				r.flagset =  parse_flags("SA");
23283b3a8eb9SGleb Smirnoff 			}
23293b3a8eb9SGleb Smirnoff 			if (!adaptive && r.max_states) {
23303b3a8eb9SGleb Smirnoff 				r.timeout[PFTM_ADAPTIVE_START] =
23313b3a8eb9SGleb Smirnoff 				    (r.max_states / 10) * 6;
23323b3a8eb9SGleb Smirnoff 				r.timeout[PFTM_ADAPTIVE_END] =
23333b3a8eb9SGleb Smirnoff 				    (r.max_states / 10) * 12;
23343b3a8eb9SGleb Smirnoff 			}
23353b3a8eb9SGleb Smirnoff 			if (r.rule_flag & PFRULE_SRCTRACK) {
23363b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_GLOBAL &&
23373b3a8eb9SGleb Smirnoff 				    r.max_src_nodes) {
23383b3a8eb9SGleb Smirnoff 					yyerror("'max-src-nodes' is "
23393b3a8eb9SGleb Smirnoff 					    "incompatible with "
23403b3a8eb9SGleb Smirnoff 					    "'source-track global'");
23413b3a8eb9SGleb Smirnoff 					YYERROR;
23423b3a8eb9SGleb Smirnoff 				}
23433b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_GLOBAL &&
23443b3a8eb9SGleb Smirnoff 				    r.max_src_conn) {
23453b3a8eb9SGleb Smirnoff 					yyerror("'max-src-conn' is "
23463b3a8eb9SGleb Smirnoff 					    "incompatible with "
23473b3a8eb9SGleb Smirnoff 					    "'source-track global'");
23483b3a8eb9SGleb Smirnoff 					YYERROR;
23493b3a8eb9SGleb Smirnoff 				}
23503b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_GLOBAL &&
23513b3a8eb9SGleb Smirnoff 				    r.max_src_conn_rate.seconds) {
23523b3a8eb9SGleb Smirnoff 					yyerror("'max-src-conn-rate' is "
23533b3a8eb9SGleb Smirnoff 					    "incompatible with "
23543b3a8eb9SGleb Smirnoff 					    "'source-track global'");
23553b3a8eb9SGleb Smirnoff 					YYERROR;
23563b3a8eb9SGleb Smirnoff 				}
23573b3a8eb9SGleb Smirnoff 				if (r.timeout[PFTM_SRC_NODE] <
23583b3a8eb9SGleb Smirnoff 				    r.max_src_conn_rate.seconds)
23593b3a8eb9SGleb Smirnoff 					r.timeout[PFTM_SRC_NODE] =
23603b3a8eb9SGleb Smirnoff 					    r.max_src_conn_rate.seconds;
23613b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_SRCTRACK;
23623b3a8eb9SGleb Smirnoff 				if (srctrack == PF_SRCTRACK_RULE)
23633b3a8eb9SGleb Smirnoff 					r.rule_flag |= PFRULE_RULESRCTRACK;
23643b3a8eb9SGleb Smirnoff 			}
23653b3a8eb9SGleb Smirnoff 			if (r.keep_state && !statelock)
23663b3a8eb9SGleb Smirnoff 				r.rule_flag |= default_statelock;
23673b3a8eb9SGleb Smirnoff 
23683b3a8eb9SGleb Smirnoff 			if ($9.fragment)
23693b3a8eb9SGleb Smirnoff 				r.rule_flag |= PFRULE_FRAGMENT;
23703b3a8eb9SGleb Smirnoff 			r.allow_opts = $9.allowopts;
23713b3a8eb9SGleb Smirnoff 
23723b3a8eb9SGleb Smirnoff 			decide_address_family($8.src.host, &r.af);
23733b3a8eb9SGleb Smirnoff 			decide_address_family($8.dst.host, &r.af);
23743b3a8eb9SGleb Smirnoff 
23753b3a8eb9SGleb Smirnoff 			if ($5.rt) {
23763b3a8eb9SGleb Smirnoff 				if (!r.direction) {
23773b3a8eb9SGleb Smirnoff 					yyerror("direction must be explicit "
23783b3a8eb9SGleb Smirnoff 					    "with rules that specify routing");
23793b3a8eb9SGleb Smirnoff 					YYERROR;
23803b3a8eb9SGleb Smirnoff 				}
23813b3a8eb9SGleb Smirnoff 				r.rt = $5.rt;
23823b3a8eb9SGleb Smirnoff 				r.rpool.opts = $5.pool_opts;
23833b3a8eb9SGleb Smirnoff 				if ($5.key != NULL)
23843b3a8eb9SGleb Smirnoff 					memcpy(&r.rpool.key, $5.key,
23853b3a8eb9SGleb Smirnoff 					    sizeof(struct pf_poolhashkey));
23863b3a8eb9SGleb Smirnoff 			}
2387813196a1SKristof Provost 			if (r.rt) {
23883b3a8eb9SGleb Smirnoff 				decide_address_family($5.host, &r.af);
23893b3a8eb9SGleb Smirnoff 				remove_invalid_hosts(&$5.host, &r.af);
23903b3a8eb9SGleb Smirnoff 				if ($5.host == NULL) {
23913b3a8eb9SGleb Smirnoff 					yyerror("no routing address with "
23923b3a8eb9SGleb Smirnoff 					    "matching address family found.");
23933b3a8eb9SGleb Smirnoff 					YYERROR;
23943b3a8eb9SGleb Smirnoff 				}
23953b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
23963b3a8eb9SGleb Smirnoff 				    PF_POOL_NONE && ($5.host->next != NULL ||
23973b3a8eb9SGleb Smirnoff 				    $5.host->addr.type == PF_ADDR_TABLE ||
23983b3a8eb9SGleb Smirnoff 				    DYNIF_MULTIADDR($5.host->addr)))
23993b3a8eb9SGleb Smirnoff 					r.rpool.opts |= PF_POOL_ROUNDROBIN;
24003b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
24013b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
24023b3a8eb9SGleb Smirnoff 				    disallow_table($5.host, "tables are only "
24033b3a8eb9SGleb Smirnoff 				    "supported in round-robin routing pools"))
24043b3a8eb9SGleb Smirnoff 					YYERROR;
24053b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
24063b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
24073b3a8eb9SGleb Smirnoff 				    disallow_alias($5.host, "interface (%s) "
24083b3a8eb9SGleb Smirnoff 				    "is only supported in round-robin "
24093b3a8eb9SGleb Smirnoff 				    "routing pools"))
24103b3a8eb9SGleb Smirnoff 					YYERROR;
24113b3a8eb9SGleb Smirnoff 				if ($5.host->next != NULL) {
24123b3a8eb9SGleb Smirnoff 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
24133b3a8eb9SGleb Smirnoff 					    PF_POOL_ROUNDROBIN) {
24143b3a8eb9SGleb Smirnoff 						yyerror("r.rpool.opts must "
24153b3a8eb9SGleb Smirnoff 						    "be PF_POOL_ROUNDROBIN");
24163b3a8eb9SGleb Smirnoff 						YYERROR;
24173b3a8eb9SGleb Smirnoff 					}
24183b3a8eb9SGleb Smirnoff 				}
24193b3a8eb9SGleb Smirnoff 			}
24203b3a8eb9SGleb Smirnoff 			if ($9.queues.qname != NULL) {
24213b3a8eb9SGleb Smirnoff 				if (strlcpy(r.qname, $9.queues.qname,
24223b3a8eb9SGleb Smirnoff 				    sizeof(r.qname)) >= sizeof(r.qname)) {
24233b3a8eb9SGleb Smirnoff 					yyerror("rule qname too long (max "
24243b3a8eb9SGleb Smirnoff 					    "%d chars)", sizeof(r.qname)-1);
24253b3a8eb9SGleb Smirnoff 					YYERROR;
24263b3a8eb9SGleb Smirnoff 				}
24273b3a8eb9SGleb Smirnoff 				free($9.queues.qname);
24283b3a8eb9SGleb Smirnoff 			}
24293b3a8eb9SGleb Smirnoff 			if ($9.queues.pqname != NULL) {
24303b3a8eb9SGleb Smirnoff 				if (strlcpy(r.pqname, $9.queues.pqname,
24313b3a8eb9SGleb Smirnoff 				    sizeof(r.pqname)) >= sizeof(r.pqname)) {
24323b3a8eb9SGleb Smirnoff 					yyerror("rule pqname too long (max "
24333b3a8eb9SGleb Smirnoff 					    "%d chars)", sizeof(r.pqname)-1);
24343b3a8eb9SGleb Smirnoff 					YYERROR;
24353b3a8eb9SGleb Smirnoff 				}
24363b3a8eb9SGleb Smirnoff 				free($9.queues.pqname);
24373b3a8eb9SGleb Smirnoff 			}
24383b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
24393b3a8eb9SGleb Smirnoff 			r.divert.port = $9.divert.port;
24403b3a8eb9SGleb Smirnoff #else
24413b3a8eb9SGleb Smirnoff 			if ((r.divert.port = $9.divert.port)) {
24423b3a8eb9SGleb Smirnoff 				if (r.direction == PF_OUT) {
24433b3a8eb9SGleb Smirnoff 					if ($9.divert.addr) {
24443b3a8eb9SGleb Smirnoff 						yyerror("address specified "
24453b3a8eb9SGleb Smirnoff 						    "for outgoing divert");
24463b3a8eb9SGleb Smirnoff 						YYERROR;
24473b3a8eb9SGleb Smirnoff 					}
24483b3a8eb9SGleb Smirnoff 					bzero(&r.divert.addr,
24493b3a8eb9SGleb Smirnoff 					    sizeof(r.divert.addr));
24503b3a8eb9SGleb Smirnoff 				} else {
24513b3a8eb9SGleb Smirnoff 					if (!$9.divert.addr) {
24523b3a8eb9SGleb Smirnoff 						yyerror("no address specified "
24533b3a8eb9SGleb Smirnoff 						    "for incoming divert");
24543b3a8eb9SGleb Smirnoff 						YYERROR;
24553b3a8eb9SGleb Smirnoff 					}
24563b3a8eb9SGleb Smirnoff 					if ($9.divert.addr->af != r.af) {
24573b3a8eb9SGleb Smirnoff 						yyerror("address family "
24583b3a8eb9SGleb Smirnoff 						    "mismatch for divert");
24593b3a8eb9SGleb Smirnoff 						YYERROR;
24603b3a8eb9SGleb Smirnoff 					}
24613b3a8eb9SGleb Smirnoff 					r.divert.addr =
24623b3a8eb9SGleb Smirnoff 					    $9.divert.addr->addr.v.a.addr;
24633b3a8eb9SGleb Smirnoff 				}
24643b3a8eb9SGleb Smirnoff 			}
24653b3a8eb9SGleb Smirnoff #endif
24663b3a8eb9SGleb Smirnoff 
24673b3a8eb9SGleb Smirnoff 			expand_rule(&r, $4, $5.host, $7, $8.src_os,
24683b3a8eb9SGleb Smirnoff 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
24693b3a8eb9SGleb Smirnoff 			    $9.uid, $9.gid, $9.icmpspec, "");
24703b3a8eb9SGleb Smirnoff 		}
24713b3a8eb9SGleb Smirnoff 		;
24723b3a8eb9SGleb Smirnoff 
24733b3a8eb9SGleb Smirnoff filter_opts	:	{
24743b3a8eb9SGleb Smirnoff 				bzero(&filter_opts, sizeof filter_opts);
24753b3a8eb9SGleb Smirnoff 				filter_opts.rtableid = -1;
24763b3a8eb9SGleb Smirnoff 			}
24773b3a8eb9SGleb Smirnoff 		    filter_opts_l
24783b3a8eb9SGleb Smirnoff 			{ $$ = filter_opts; }
24793b3a8eb9SGleb Smirnoff 		| /* empty */	{
24803b3a8eb9SGleb Smirnoff 			bzero(&filter_opts, sizeof filter_opts);
24813b3a8eb9SGleb Smirnoff 			filter_opts.rtableid = -1;
24823b3a8eb9SGleb Smirnoff 			$$ = filter_opts;
24833b3a8eb9SGleb Smirnoff 		}
24843b3a8eb9SGleb Smirnoff 		;
24853b3a8eb9SGleb Smirnoff 
24863b3a8eb9SGleb Smirnoff filter_opts_l	: filter_opts_l filter_opt
24873b3a8eb9SGleb Smirnoff 		| filter_opt
24883b3a8eb9SGleb Smirnoff 		;
24893b3a8eb9SGleb Smirnoff 
24903b3a8eb9SGleb Smirnoff filter_opt	: USER uids {
24913b3a8eb9SGleb Smirnoff 			if (filter_opts.uid)
24923b3a8eb9SGleb Smirnoff 				$2->tail->next = filter_opts.uid;
24933b3a8eb9SGleb Smirnoff 			filter_opts.uid = $2;
24943b3a8eb9SGleb Smirnoff 		}
24953b3a8eb9SGleb Smirnoff 		| GROUP gids {
24963b3a8eb9SGleb Smirnoff 			if (filter_opts.gid)
24973b3a8eb9SGleb Smirnoff 				$2->tail->next = filter_opts.gid;
24983b3a8eb9SGleb Smirnoff 			filter_opts.gid = $2;
24993b3a8eb9SGleb Smirnoff 		}
25003b3a8eb9SGleb Smirnoff 		| flags {
25013b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_FLAGS) {
25023b3a8eb9SGleb Smirnoff 				yyerror("flags cannot be redefined");
25033b3a8eb9SGleb Smirnoff 				YYERROR;
25043b3a8eb9SGleb Smirnoff 			}
25053b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_FLAGS;
25063b3a8eb9SGleb Smirnoff 			filter_opts.flags.b1 |= $1.b1;
25073b3a8eb9SGleb Smirnoff 			filter_opts.flags.b2 |= $1.b2;
25083b3a8eb9SGleb Smirnoff 			filter_opts.flags.w |= $1.w;
25093b3a8eb9SGleb Smirnoff 			filter_opts.flags.w2 |= $1.w2;
25103b3a8eb9SGleb Smirnoff 		}
25113b3a8eb9SGleb Smirnoff 		| icmpspec {
25123b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_ICMP) {
25133b3a8eb9SGleb Smirnoff 				yyerror("icmp-type cannot be redefined");
25143b3a8eb9SGleb Smirnoff 				YYERROR;
25153b3a8eb9SGleb Smirnoff 			}
25163b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_ICMP;
25173b3a8eb9SGleb Smirnoff 			filter_opts.icmpspec = $1;
25183b3a8eb9SGleb Smirnoff 		}
25193e248e0fSKristof Provost 		| PRIO NUMBER {
25203e248e0fSKristof Provost 			if (filter_opts.marker & FOM_PRIO) {
25213e248e0fSKristof Provost 				yyerror("prio cannot be redefined");
25223e248e0fSKristof Provost 				YYERROR;
25233e248e0fSKristof Provost 			}
25243e248e0fSKristof Provost 			if ($2 < 0 || $2 > PF_PRIO_MAX) {
25253e248e0fSKristof Provost 				yyerror("prio must be 0 - %u", PF_PRIO_MAX);
25263e248e0fSKristof Provost 				YYERROR;
25273e248e0fSKristof Provost 			}
25283e248e0fSKristof Provost 			filter_opts.marker |= FOM_PRIO;
25293e248e0fSKristof Provost 			filter_opts.prio = $2;
25303e248e0fSKristof Provost 		}
25313b3a8eb9SGleb Smirnoff 		| TOS tos {
25323b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_TOS) {
25333b3a8eb9SGleb Smirnoff 				yyerror("tos cannot be redefined");
25343b3a8eb9SGleb Smirnoff 				YYERROR;
25353b3a8eb9SGleb Smirnoff 			}
25363b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_TOS;
25373b3a8eb9SGleb Smirnoff 			filter_opts.tos = $2;
25383b3a8eb9SGleb Smirnoff 		}
25393b3a8eb9SGleb Smirnoff 		| keep {
25403b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & FOM_KEEP) {
25413b3a8eb9SGleb Smirnoff 				yyerror("modulate or keep cannot be redefined");
25423b3a8eb9SGleb Smirnoff 				YYERROR;
25433b3a8eb9SGleb Smirnoff 			}
25443b3a8eb9SGleb Smirnoff 			filter_opts.marker |= FOM_KEEP;
25453b3a8eb9SGleb Smirnoff 			filter_opts.keep.action = $1.action;
25463b3a8eb9SGleb Smirnoff 			filter_opts.keep.options = $1.options;
25473b3a8eb9SGleb Smirnoff 		}
25483b3a8eb9SGleb Smirnoff 		| FRAGMENT {
25493b3a8eb9SGleb Smirnoff 			filter_opts.fragment = 1;
25503b3a8eb9SGleb Smirnoff 		}
25513b3a8eb9SGleb Smirnoff 		| ALLOWOPTS {
25523b3a8eb9SGleb Smirnoff 			filter_opts.allowopts = 1;
25533b3a8eb9SGleb Smirnoff 		}
25543b3a8eb9SGleb Smirnoff 		| label	{
25556fcc8e04SKristof Provost 			if (filter_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) {
25566fcc8e04SKristof Provost 				yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT);
25573b3a8eb9SGleb Smirnoff 				YYERROR;
25583b3a8eb9SGleb Smirnoff 			}
25596fcc8e04SKristof Provost 			filter_opts.label[filter_opts.labelcount++] = $1;
25603b3a8eb9SGleb Smirnoff 		}
25613b3a8eb9SGleb Smirnoff 		| qname	{
25623b3a8eb9SGleb Smirnoff 			if (filter_opts.queues.qname) {
25633b3a8eb9SGleb Smirnoff 				yyerror("queue cannot be redefined");
25643b3a8eb9SGleb Smirnoff 				YYERROR;
25653b3a8eb9SGleb Smirnoff 			}
25663b3a8eb9SGleb Smirnoff 			filter_opts.queues = $1;
25673b3a8eb9SGleb Smirnoff 		}
25683b3a8eb9SGleb Smirnoff 		| TAG string				{
25693b3a8eb9SGleb Smirnoff 			filter_opts.tag = $2;
25703b3a8eb9SGleb Smirnoff 		}
25713b3a8eb9SGleb Smirnoff 		| not TAGGED string			{
25723b3a8eb9SGleb Smirnoff 			filter_opts.match_tag = $3;
25733b3a8eb9SGleb Smirnoff 			filter_opts.match_tag_not = $1;
25743b3a8eb9SGleb Smirnoff 		}
25753b3a8eb9SGleb Smirnoff 		| PROBABILITY probability		{
25763b3a8eb9SGleb Smirnoff 			double	p;
25773b3a8eb9SGleb Smirnoff 
25783b3a8eb9SGleb Smirnoff 			p = floor($2 * UINT_MAX + 0.5);
25793b3a8eb9SGleb Smirnoff 			if (p < 0.0 || p > UINT_MAX) {
25803b3a8eb9SGleb Smirnoff 				yyerror("invalid probability: %lf", p);
25813b3a8eb9SGleb Smirnoff 				YYERROR;
25823b3a8eb9SGleb Smirnoff 			}
25833b3a8eb9SGleb Smirnoff 			filter_opts.prob = (u_int32_t)p;
25843b3a8eb9SGleb Smirnoff 			if (filter_opts.prob == 0)
25853b3a8eb9SGleb Smirnoff 				filter_opts.prob = 1;
25863b3a8eb9SGleb Smirnoff 		}
25873b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER				{
25883b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
25893b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
25903b3a8eb9SGleb Smirnoff 				YYERROR;
25913b3a8eb9SGleb Smirnoff 			}
25923b3a8eb9SGleb Smirnoff 			filter_opts.rtableid = $2;
25933b3a8eb9SGleb Smirnoff 		}
25943b3a8eb9SGleb Smirnoff 		| DIVERTTO portplain {
25953b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
25963b3a8eb9SGleb Smirnoff 			filter_opts.divert.port = $2.a;
25973b3a8eb9SGleb Smirnoff 			if (!filter_opts.divert.port) {
25983b3a8eb9SGleb Smirnoff 				yyerror("invalid divert port: %u", ntohs($2.a));
25993b3a8eb9SGleb Smirnoff 				YYERROR;
26003b3a8eb9SGleb Smirnoff 			}
26013b3a8eb9SGleb Smirnoff #endif
26023b3a8eb9SGleb Smirnoff 		}
26033b3a8eb9SGleb Smirnoff 		| DIVERTTO STRING PORT portplain {
26043b3a8eb9SGleb Smirnoff #ifndef __FreeBSD__
26053b3a8eb9SGleb Smirnoff 			if ((filter_opts.divert.addr = host($2)) == NULL) {
26063b3a8eb9SGleb Smirnoff 				yyerror("could not parse divert address: %s",
26073b3a8eb9SGleb Smirnoff 				    $2);
26083b3a8eb9SGleb Smirnoff 				free($2);
26093b3a8eb9SGleb Smirnoff 				YYERROR;
26103b3a8eb9SGleb Smirnoff 			}
26113b3a8eb9SGleb Smirnoff #else
26123b3a8eb9SGleb Smirnoff 			if ($2)
26133b3a8eb9SGleb Smirnoff #endif
26143b3a8eb9SGleb Smirnoff 			free($2);
26153b3a8eb9SGleb Smirnoff 			filter_opts.divert.port = $4.a;
26163b3a8eb9SGleb Smirnoff 			if (!filter_opts.divert.port) {
26173b3a8eb9SGleb Smirnoff 				yyerror("invalid divert port: %u", ntohs($4.a));
26183b3a8eb9SGleb Smirnoff 				YYERROR;
26193b3a8eb9SGleb Smirnoff 			}
26203b3a8eb9SGleb Smirnoff 		}
26213b3a8eb9SGleb Smirnoff 		| DIVERTREPLY {
26223b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
26233b3a8eb9SGleb Smirnoff 			yyerror("divert-reply has no meaning in FreeBSD pf(4)");
26243b3a8eb9SGleb Smirnoff 			YYERROR;
26253b3a8eb9SGleb Smirnoff #else
26263b3a8eb9SGleb Smirnoff 			filter_opts.divert.port = 1;	/* some random value */
26273b3a8eb9SGleb Smirnoff #endif
26283b3a8eb9SGleb Smirnoff 		}
26293e248e0fSKristof Provost 		| filter_sets
26303e248e0fSKristof Provost 		;
26313e248e0fSKristof Provost 
26323e248e0fSKristof Provost filter_sets	: SET '(' filter_sets_l ')'	{ $$ = filter_opts; }
26333e248e0fSKristof Provost 		| SET filter_set		{ $$ = filter_opts; }
26343e248e0fSKristof Provost 		;
26353e248e0fSKristof Provost 
26363e248e0fSKristof Provost filter_sets_l	: filter_sets_l comma filter_set
26373e248e0fSKristof Provost 		| filter_set
26383e248e0fSKristof Provost 		;
26393e248e0fSKristof Provost 
26403e248e0fSKristof Provost filter_set	: prio {
26413e248e0fSKristof Provost 			if (filter_opts.marker & FOM_SETPRIO) {
26423e248e0fSKristof Provost 				yyerror("prio cannot be redefined");
26433e248e0fSKristof Provost 				YYERROR;
26443e248e0fSKristof Provost 			}
26453e248e0fSKristof Provost 			filter_opts.marker |= FOM_SETPRIO;
26463e248e0fSKristof Provost 			filter_opts.set_prio[0] = $1.b1;
26473e248e0fSKristof Provost 			filter_opts.set_prio[1] = $1.b2;
26483e248e0fSKristof Provost 		}
26493e248e0fSKristof Provost prio		: PRIO NUMBER {
26503e248e0fSKristof Provost 			if ($2 < 0 || $2 > PF_PRIO_MAX) {
26513e248e0fSKristof Provost 				yyerror("prio must be 0 - %u", PF_PRIO_MAX);
26523e248e0fSKristof Provost 				YYERROR;
26533e248e0fSKristof Provost 			}
26543e248e0fSKristof Provost 			$$.b1 = $$.b2 = $2;
26553e248e0fSKristof Provost 		}
26563e248e0fSKristof Provost 		| PRIO '(' NUMBER comma NUMBER ')' {
26573e248e0fSKristof Provost 			if ($3 < 0 || $3 > PF_PRIO_MAX ||
26583e248e0fSKristof Provost 			    $5 < 0 || $5 > PF_PRIO_MAX) {
26593e248e0fSKristof Provost 				yyerror("prio must be 0 - %u", PF_PRIO_MAX);
26603e248e0fSKristof Provost 				YYERROR;
26613e248e0fSKristof Provost 			}
26623e248e0fSKristof Provost 			$$.b1 = $3;
26633e248e0fSKristof Provost 			$$.b2 = $5;
26643e248e0fSKristof Provost 		}
26653b3a8eb9SGleb Smirnoff 		;
26663b3a8eb9SGleb Smirnoff 
26673b3a8eb9SGleb Smirnoff probability	: STRING				{
26683b3a8eb9SGleb Smirnoff 			char	*e;
26693b3a8eb9SGleb Smirnoff 			double	 p = strtod($1, &e);
26703b3a8eb9SGleb Smirnoff 
26713b3a8eb9SGleb Smirnoff 			if (*e == '%') {
26723b3a8eb9SGleb Smirnoff 				p *= 0.01;
26733b3a8eb9SGleb Smirnoff 				e++;
26743b3a8eb9SGleb Smirnoff 			}
26753b3a8eb9SGleb Smirnoff 			if (*e) {
26763b3a8eb9SGleb Smirnoff 				yyerror("invalid probability: %s", $1);
26773b3a8eb9SGleb Smirnoff 				free($1);
26783b3a8eb9SGleb Smirnoff 				YYERROR;
26793b3a8eb9SGleb Smirnoff 			}
26803b3a8eb9SGleb Smirnoff 			free($1);
26813b3a8eb9SGleb Smirnoff 			$$ = p;
26823b3a8eb9SGleb Smirnoff 		}
26833b3a8eb9SGleb Smirnoff 		| NUMBER				{
26843b3a8eb9SGleb Smirnoff 			$$ = (double)$1;
26853b3a8eb9SGleb Smirnoff 		}
26863b3a8eb9SGleb Smirnoff 		;
26873b3a8eb9SGleb Smirnoff 
26883b3a8eb9SGleb Smirnoff 
2689150182e3SKristof Provost action		: PASS 			{
2690150182e3SKristof Provost 			$$.b1 = PF_PASS;
2691150182e3SKristof Provost 			$$.b2 = failpolicy;
2692150182e3SKristof Provost 			$$.w = returnicmpdefault;
2693150182e3SKristof Provost 			$$.w2 = returnicmp6default;
2694150182e3SKristof Provost 		}
2695ef950daaSKristof Provost 		| MATCH			{ $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; }
26963b3a8eb9SGleb Smirnoff 		| BLOCK blockspec	{ $$ = $2; $$.b1 = PF_DROP; }
26973b3a8eb9SGleb Smirnoff 		;
26983b3a8eb9SGleb Smirnoff 
26993b3a8eb9SGleb Smirnoff blockspec	: /* empty */		{
27003b3a8eb9SGleb Smirnoff 			$$.b2 = blockpolicy;
27013b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
27023b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
27033b3a8eb9SGleb Smirnoff 		}
27043b3a8eb9SGleb Smirnoff 		| DROP			{
27053b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_DROP;
27063b3a8eb9SGleb Smirnoff 			$$.w = 0;
27073b3a8eb9SGleb Smirnoff 			$$.w2 = 0;
27083b3a8eb9SGleb Smirnoff 		}
27093b3a8eb9SGleb Smirnoff 		| RETURNRST		{
27103b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNRST;
27113b3a8eb9SGleb Smirnoff 			$$.w = 0;
27123b3a8eb9SGleb Smirnoff 			$$.w2 = 0;
27133b3a8eb9SGleb Smirnoff 		}
27143b3a8eb9SGleb Smirnoff 		| RETURNRST '(' TTL NUMBER ')'	{
27153b3a8eb9SGleb Smirnoff 			if ($4 < 0 || $4 > 255) {
27163b3a8eb9SGleb Smirnoff 				yyerror("illegal ttl value %d", $4);
27173b3a8eb9SGleb Smirnoff 				YYERROR;
27183b3a8eb9SGleb Smirnoff 			}
27193b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNRST;
27203b3a8eb9SGleb Smirnoff 			$$.w = $4;
27213b3a8eb9SGleb Smirnoff 			$$.w2 = 0;
27223b3a8eb9SGleb Smirnoff 		}
27233b3a8eb9SGleb Smirnoff 		| RETURNICMP		{
27243b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
27253b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
27263b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
27273b3a8eb9SGleb Smirnoff 		}
27283b3a8eb9SGleb Smirnoff 		| RETURNICMP6		{
27293b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
27303b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
27313b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
27323b3a8eb9SGleb Smirnoff 		}
27333b3a8eb9SGleb Smirnoff 		| RETURNICMP '(' reticmpspec ')'	{
27343b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
27353b3a8eb9SGleb Smirnoff 			$$.w = $3;
27363b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmpdefault;
27373b3a8eb9SGleb Smirnoff 		}
27383b3a8eb9SGleb Smirnoff 		| RETURNICMP6 '(' reticmp6spec ')'	{
27393b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
27403b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
27413b3a8eb9SGleb Smirnoff 			$$.w2 = $3;
27423b3a8eb9SGleb Smirnoff 		}
27433b3a8eb9SGleb Smirnoff 		| RETURNICMP '(' reticmpspec comma reticmp6spec ')' {
27443b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURNICMP;
27453b3a8eb9SGleb Smirnoff 			$$.w = $3;
27463b3a8eb9SGleb Smirnoff 			$$.w2 = $5;
27473b3a8eb9SGleb Smirnoff 		}
27483b3a8eb9SGleb Smirnoff 		| RETURN {
27493b3a8eb9SGleb Smirnoff 			$$.b2 = PFRULE_RETURN;
27503b3a8eb9SGleb Smirnoff 			$$.w = returnicmpdefault;
27513b3a8eb9SGleb Smirnoff 			$$.w2 = returnicmp6default;
27523b3a8eb9SGleb Smirnoff 		}
27533b3a8eb9SGleb Smirnoff 		;
27543b3a8eb9SGleb Smirnoff 
27553b3a8eb9SGleb Smirnoff reticmpspec	: STRING			{
27563b3a8eb9SGleb Smirnoff 			if (!($$ = parseicmpspec($1, AF_INET))) {
27573b3a8eb9SGleb Smirnoff 				free($1);
27583b3a8eb9SGleb Smirnoff 				YYERROR;
27593b3a8eb9SGleb Smirnoff 			}
27603b3a8eb9SGleb Smirnoff 			free($1);
27613b3a8eb9SGleb Smirnoff 		}
27623b3a8eb9SGleb Smirnoff 		| NUMBER			{
27633b3a8eb9SGleb Smirnoff 			u_int8_t		icmptype;
27643b3a8eb9SGleb Smirnoff 
27653b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
27663b3a8eb9SGleb Smirnoff 				yyerror("invalid icmp code %lu", $1);
27673b3a8eb9SGleb Smirnoff 				YYERROR;
27683b3a8eb9SGleb Smirnoff 			}
27693b3a8eb9SGleb Smirnoff 			icmptype = returnicmpdefault >> 8;
27703b3a8eb9SGleb Smirnoff 			$$ = (icmptype << 8 | $1);
27713b3a8eb9SGleb Smirnoff 		}
27723b3a8eb9SGleb Smirnoff 		;
27733b3a8eb9SGleb Smirnoff 
27743b3a8eb9SGleb Smirnoff reticmp6spec	: STRING			{
27753b3a8eb9SGleb Smirnoff 			if (!($$ = parseicmpspec($1, AF_INET6))) {
27763b3a8eb9SGleb Smirnoff 				free($1);
27773b3a8eb9SGleb Smirnoff 				YYERROR;
27783b3a8eb9SGleb Smirnoff 			}
27793b3a8eb9SGleb Smirnoff 			free($1);
27803b3a8eb9SGleb Smirnoff 		}
27813b3a8eb9SGleb Smirnoff 		| NUMBER			{
27823b3a8eb9SGleb Smirnoff 			u_int8_t		icmptype;
27833b3a8eb9SGleb Smirnoff 
27843b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
27853b3a8eb9SGleb Smirnoff 				yyerror("invalid icmp code %lu", $1);
27863b3a8eb9SGleb Smirnoff 				YYERROR;
27873b3a8eb9SGleb Smirnoff 			}
27883b3a8eb9SGleb Smirnoff 			icmptype = returnicmp6default >> 8;
27893b3a8eb9SGleb Smirnoff 			$$ = (icmptype << 8 | $1);
27903b3a8eb9SGleb Smirnoff 		}
27913b3a8eb9SGleb Smirnoff 		;
27923b3a8eb9SGleb Smirnoff 
27933b3a8eb9SGleb Smirnoff dir		: /* empty */			{ $$ = PF_INOUT; }
27943b3a8eb9SGleb Smirnoff 		| IN				{ $$ = PF_IN; }
27953b3a8eb9SGleb Smirnoff 		| OUT				{ $$ = PF_OUT; }
27963b3a8eb9SGleb Smirnoff 		;
27973b3a8eb9SGleb Smirnoff 
27983b3a8eb9SGleb Smirnoff quick		: /* empty */			{ $$.quick = 0; }
27993b3a8eb9SGleb Smirnoff 		| QUICK				{ $$.quick = 1; }
28003b3a8eb9SGleb Smirnoff 		;
28013b3a8eb9SGleb Smirnoff 
28023b3a8eb9SGleb Smirnoff logquick	: /* empty */	{ $$.log = 0; $$.quick = 0; $$.logif = 0; }
28033b3a8eb9SGleb Smirnoff 		| log		{ $$ = $1; $$.quick = 0; }
28043b3a8eb9SGleb Smirnoff 		| QUICK		{ $$.quick = 1; $$.log = 0; $$.logif = 0; }
28053b3a8eb9SGleb Smirnoff 		| log QUICK	{ $$ = $1; $$.quick = 1; }
28063b3a8eb9SGleb Smirnoff 		| QUICK log	{ $$ = $2; $$.quick = 1; }
28073b3a8eb9SGleb Smirnoff 		;
28083b3a8eb9SGleb Smirnoff 
28093b3a8eb9SGleb Smirnoff log		: LOG			{ $$.log = PF_LOG; $$.logif = 0; }
28103b3a8eb9SGleb Smirnoff 		| LOG '(' logopts ')'	{
28113b3a8eb9SGleb Smirnoff 			$$.log = PF_LOG | $3.log;
28123b3a8eb9SGleb Smirnoff 			$$.logif = $3.logif;
28133b3a8eb9SGleb Smirnoff 		}
28143b3a8eb9SGleb Smirnoff 		;
28153b3a8eb9SGleb Smirnoff 
28163b3a8eb9SGleb Smirnoff logopts		: logopt			{ $$ = $1; }
28173b3a8eb9SGleb Smirnoff 		| logopts comma logopt		{
28183b3a8eb9SGleb Smirnoff 			$$.log = $1.log | $3.log;
28193b3a8eb9SGleb Smirnoff 			$$.logif = $3.logif;
28203b3a8eb9SGleb Smirnoff 			if ($$.logif == 0)
28213b3a8eb9SGleb Smirnoff 				$$.logif = $1.logif;
28223b3a8eb9SGleb Smirnoff 		}
28233b3a8eb9SGleb Smirnoff 		;
28243b3a8eb9SGleb Smirnoff 
28253b3a8eb9SGleb Smirnoff logopt		: ALL		{ $$.log = PF_LOG_ALL; $$.logif = 0; }
28263b3a8eb9SGleb Smirnoff 		| USER		{ $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
28273b3a8eb9SGleb Smirnoff 		| GROUP		{ $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
28283b3a8eb9SGleb Smirnoff 		| TO string	{
28293b3a8eb9SGleb Smirnoff 			const char	*errstr;
28303b3a8eb9SGleb Smirnoff 			u_int		 i;
28313b3a8eb9SGleb Smirnoff 
28323b3a8eb9SGleb Smirnoff 			$$.log = 0;
28333b3a8eb9SGleb Smirnoff 			if (strncmp($2, "pflog", 5)) {
28343b3a8eb9SGleb Smirnoff 				yyerror("%s: should be a pflog interface", $2);
28353b3a8eb9SGleb Smirnoff 				free($2);
28363b3a8eb9SGleb Smirnoff 				YYERROR;
28373b3a8eb9SGleb Smirnoff 			}
28383b3a8eb9SGleb Smirnoff 			i = strtonum($2 + 5, 0, 255, &errstr);
28393b3a8eb9SGleb Smirnoff 			if (errstr) {
28403b3a8eb9SGleb Smirnoff 				yyerror("%s: %s", $2, errstr);
28413b3a8eb9SGleb Smirnoff 				free($2);
28423b3a8eb9SGleb Smirnoff 				YYERROR;
28433b3a8eb9SGleb Smirnoff 			}
28443b3a8eb9SGleb Smirnoff 			free($2);
28453b3a8eb9SGleb Smirnoff 			$$.logif = i;
28463b3a8eb9SGleb Smirnoff 		}
28473b3a8eb9SGleb Smirnoff 		;
28483b3a8eb9SGleb Smirnoff 
28493b3a8eb9SGleb Smirnoff interface	: /* empty */			{ $$ = NULL; }
28503b3a8eb9SGleb Smirnoff 		| ON if_item_not		{ $$ = $2; }
28513b3a8eb9SGleb Smirnoff 		| ON '{' optnl if_list '}'	{ $$ = $4; }
28523b3a8eb9SGleb Smirnoff 		;
28533b3a8eb9SGleb Smirnoff 
28543b3a8eb9SGleb Smirnoff if_list		: if_item_not optnl		{ $$ = $1; }
28553b3a8eb9SGleb Smirnoff 		| if_list comma if_item_not optnl	{
28563b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
28573b3a8eb9SGleb Smirnoff 			$1->tail = $3;
28583b3a8eb9SGleb Smirnoff 			$$ = $1;
28593b3a8eb9SGleb Smirnoff 		}
28603b3a8eb9SGleb Smirnoff 		;
28613b3a8eb9SGleb Smirnoff 
28623b3a8eb9SGleb Smirnoff if_item_not	: not if_item			{ $$ = $2; $$->not = $1; }
28633b3a8eb9SGleb Smirnoff 		;
28643b3a8eb9SGleb Smirnoff 
28653b3a8eb9SGleb Smirnoff if_item		: STRING			{
28663b3a8eb9SGleb Smirnoff 			struct node_host	*n;
28673b3a8eb9SGleb Smirnoff 
28683b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_if));
28693b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
28703b3a8eb9SGleb Smirnoff 				err(1, "if_item: calloc");
28713b3a8eb9SGleb Smirnoff 			if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
28723b3a8eb9SGleb Smirnoff 			    sizeof($$->ifname)) {
28733b3a8eb9SGleb Smirnoff 				free($1);
28743b3a8eb9SGleb Smirnoff 				free($$);
28753b3a8eb9SGleb Smirnoff 				yyerror("interface name too long");
28763b3a8eb9SGleb Smirnoff 				YYERROR;
28773b3a8eb9SGleb Smirnoff 			}
28783b3a8eb9SGleb Smirnoff 
28793b3a8eb9SGleb Smirnoff 			if ((n = ifa_exists($1)) != NULL)
28803b3a8eb9SGleb Smirnoff 				$$->ifa_flags = n->ifa_flags;
28813b3a8eb9SGleb Smirnoff 
28823b3a8eb9SGleb Smirnoff 			free($1);
28833b3a8eb9SGleb Smirnoff 			$$->not = 0;
28843b3a8eb9SGleb Smirnoff 			$$->next = NULL;
28853b3a8eb9SGleb Smirnoff 			$$->tail = $$;
28863b3a8eb9SGleb Smirnoff 		}
28873b3a8eb9SGleb Smirnoff 		;
28883b3a8eb9SGleb Smirnoff 
28893b3a8eb9SGleb Smirnoff af		: /* empty */			{ $$ = 0; }
28903b3a8eb9SGleb Smirnoff 		| INET				{ $$ = AF_INET; }
28913b3a8eb9SGleb Smirnoff 		| INET6				{ $$ = AF_INET6; }
28923b3a8eb9SGleb Smirnoff 		;
28933b3a8eb9SGleb Smirnoff 
28943b3a8eb9SGleb Smirnoff proto		: /* empty */				{ $$ = NULL; }
28953b3a8eb9SGleb Smirnoff 		| PROTO proto_item			{ $$ = $2; }
28963b3a8eb9SGleb Smirnoff 		| PROTO '{' optnl proto_list '}'	{ $$ = $4; }
28973b3a8eb9SGleb Smirnoff 		;
28983b3a8eb9SGleb Smirnoff 
28993b3a8eb9SGleb Smirnoff proto_list	: proto_item optnl		{ $$ = $1; }
29003b3a8eb9SGleb Smirnoff 		| proto_list comma proto_item optnl	{
29013b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
29023b3a8eb9SGleb Smirnoff 			$1->tail = $3;
29033b3a8eb9SGleb Smirnoff 			$$ = $1;
29043b3a8eb9SGleb Smirnoff 		}
29053b3a8eb9SGleb Smirnoff 		;
29063b3a8eb9SGleb Smirnoff 
29073b3a8eb9SGleb Smirnoff proto_item	: protoval			{
29083b3a8eb9SGleb Smirnoff 			u_int8_t	pr;
29093b3a8eb9SGleb Smirnoff 
29103b3a8eb9SGleb Smirnoff 			pr = (u_int8_t)$1;
29113b3a8eb9SGleb Smirnoff 			if (pr == 0) {
29123b3a8eb9SGleb Smirnoff 				yyerror("proto 0 cannot be used");
29133b3a8eb9SGleb Smirnoff 				YYERROR;
29143b3a8eb9SGleb Smirnoff 			}
29153b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_proto));
29163b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
29173b3a8eb9SGleb Smirnoff 				err(1, "proto_item: calloc");
29183b3a8eb9SGleb Smirnoff 			$$->proto = pr;
29193b3a8eb9SGleb Smirnoff 			$$->next = NULL;
29203b3a8eb9SGleb Smirnoff 			$$->tail = $$;
29213b3a8eb9SGleb Smirnoff 		}
29223b3a8eb9SGleb Smirnoff 		;
29233b3a8eb9SGleb Smirnoff 
29243b3a8eb9SGleb Smirnoff protoval	: STRING			{
29253b3a8eb9SGleb Smirnoff 			struct protoent	*p;
29263b3a8eb9SGleb Smirnoff 
29273b3a8eb9SGleb Smirnoff 			p = getprotobyname($1);
29283b3a8eb9SGleb Smirnoff 			if (p == NULL) {
29293b3a8eb9SGleb Smirnoff 				yyerror("unknown protocol %s", $1);
29303b3a8eb9SGleb Smirnoff 				free($1);
29313b3a8eb9SGleb Smirnoff 				YYERROR;
29323b3a8eb9SGleb Smirnoff 			}
29333b3a8eb9SGleb Smirnoff 			$$ = p->p_proto;
29343b3a8eb9SGleb Smirnoff 			free($1);
29353b3a8eb9SGleb Smirnoff 		}
29363b3a8eb9SGleb Smirnoff 		| NUMBER			{
29373b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
29383b3a8eb9SGleb Smirnoff 				yyerror("protocol outside range");
29393b3a8eb9SGleb Smirnoff 				YYERROR;
29403b3a8eb9SGleb Smirnoff 			}
29413b3a8eb9SGleb Smirnoff 		}
29423b3a8eb9SGleb Smirnoff 		;
29433b3a8eb9SGleb Smirnoff 
29443b3a8eb9SGleb Smirnoff fromto		: ALL				{
29453b3a8eb9SGleb Smirnoff 			$$.src.host = NULL;
29463b3a8eb9SGleb Smirnoff 			$$.src.port = NULL;
29473b3a8eb9SGleb Smirnoff 			$$.dst.host = NULL;
29483b3a8eb9SGleb Smirnoff 			$$.dst.port = NULL;
29493b3a8eb9SGleb Smirnoff 			$$.src_os = NULL;
29503b3a8eb9SGleb Smirnoff 		}
29513b3a8eb9SGleb Smirnoff 		| from os to			{
29523b3a8eb9SGleb Smirnoff 			$$.src = $1;
29533b3a8eb9SGleb Smirnoff 			$$.src_os = $2;
29543b3a8eb9SGleb Smirnoff 			$$.dst = $3;
29553b3a8eb9SGleb Smirnoff 		}
29563b3a8eb9SGleb Smirnoff 		;
29573b3a8eb9SGleb Smirnoff 
29583b3a8eb9SGleb Smirnoff os		: /* empty */			{ $$ = NULL; }
29593b3a8eb9SGleb Smirnoff 		| OS xos			{ $$ = $2; }
29603b3a8eb9SGleb Smirnoff 		| OS '{' optnl os_list '}'	{ $$ = $4; }
29613b3a8eb9SGleb Smirnoff 		;
29623b3a8eb9SGleb Smirnoff 
29633b3a8eb9SGleb Smirnoff xos		: STRING {
29643b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_os));
29653b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
29663b3a8eb9SGleb Smirnoff 				err(1, "os: calloc");
29673b3a8eb9SGleb Smirnoff 			$$->os = $1;
29683b3a8eb9SGleb Smirnoff 			$$->tail = $$;
29693b3a8eb9SGleb Smirnoff 		}
29703b3a8eb9SGleb Smirnoff 		;
29713b3a8eb9SGleb Smirnoff 
29723b3a8eb9SGleb Smirnoff os_list		: xos optnl 			{ $$ = $1; }
29733b3a8eb9SGleb Smirnoff 		| os_list comma xos optnl	{
29743b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
29753b3a8eb9SGleb Smirnoff 			$1->tail = $3;
29763b3a8eb9SGleb Smirnoff 			$$ = $1;
29773b3a8eb9SGleb Smirnoff 		}
29783b3a8eb9SGleb Smirnoff 		;
29793b3a8eb9SGleb Smirnoff 
29803b3a8eb9SGleb Smirnoff from		: /* empty */			{
29813b3a8eb9SGleb Smirnoff 			$$.host = NULL;
29823b3a8eb9SGleb Smirnoff 			$$.port = NULL;
29833b3a8eb9SGleb Smirnoff 		}
29843b3a8eb9SGleb Smirnoff 		| FROM ipportspec		{
29853b3a8eb9SGleb Smirnoff 			$$ = $2;
29863b3a8eb9SGleb Smirnoff 		}
29873b3a8eb9SGleb Smirnoff 		;
29883b3a8eb9SGleb Smirnoff 
29893b3a8eb9SGleb Smirnoff to		: /* empty */			{
29903b3a8eb9SGleb Smirnoff 			$$.host = NULL;
29913b3a8eb9SGleb Smirnoff 			$$.port = NULL;
29923b3a8eb9SGleb Smirnoff 		}
29933b3a8eb9SGleb Smirnoff 		| TO ipportspec		{
29943b3a8eb9SGleb Smirnoff 			if (disallow_urpf_failed($2.host, "\"urpf-failed\" is "
29953b3a8eb9SGleb Smirnoff 			    "not permitted in a destination address"))
29963b3a8eb9SGleb Smirnoff 				YYERROR;
29973b3a8eb9SGleb Smirnoff 			$$ = $2;
29983b3a8eb9SGleb Smirnoff 		}
29993b3a8eb9SGleb Smirnoff 		;
30003b3a8eb9SGleb Smirnoff 
30013b3a8eb9SGleb Smirnoff ipportspec	: ipspec			{
30023b3a8eb9SGleb Smirnoff 			$$.host = $1;
30033b3a8eb9SGleb Smirnoff 			$$.port = NULL;
30043b3a8eb9SGleb Smirnoff 		}
30053b3a8eb9SGleb Smirnoff 		| ipspec PORT portspec		{
30063b3a8eb9SGleb Smirnoff 			$$.host = $1;
30073b3a8eb9SGleb Smirnoff 			$$.port = $3;
30083b3a8eb9SGleb Smirnoff 		}
30093b3a8eb9SGleb Smirnoff 		| PORT portspec			{
30103b3a8eb9SGleb Smirnoff 			$$.host = NULL;
30113b3a8eb9SGleb Smirnoff 			$$.port = $2;
30123b3a8eb9SGleb Smirnoff 		}
30133b3a8eb9SGleb Smirnoff 		;
30143b3a8eb9SGleb Smirnoff 
30153b3a8eb9SGleb Smirnoff optnl		: '\n' optnl
30163b3a8eb9SGleb Smirnoff 		|
30173b3a8eb9SGleb Smirnoff 		;
30183b3a8eb9SGleb Smirnoff 
30193b3a8eb9SGleb Smirnoff ipspec		: ANY				{ $$ = NULL; }
30203b3a8eb9SGleb Smirnoff 		| xhost				{ $$ = $1; }
30213b3a8eb9SGleb Smirnoff 		| '{' optnl host_list '}'	{ $$ = $3; }
30223b3a8eb9SGleb Smirnoff 		;
30233b3a8eb9SGleb Smirnoff 
30243b3a8eb9SGleb Smirnoff toipspec	: TO ipspec			{ $$ = $2; }
30253b3a8eb9SGleb Smirnoff 		| /* empty */			{ $$ = NULL; }
30263b3a8eb9SGleb Smirnoff 		;
30273b3a8eb9SGleb Smirnoff 
30283b3a8eb9SGleb Smirnoff host_list	: ipspec optnl			{ $$ = $1; }
30293b3a8eb9SGleb Smirnoff 		| host_list comma ipspec optnl	{
30303b3a8eb9SGleb Smirnoff 			if ($3 == NULL)
30313b3a8eb9SGleb Smirnoff 				$$ = $1;
30323b3a8eb9SGleb Smirnoff 			else if ($1 == NULL)
30333b3a8eb9SGleb Smirnoff 				$$ = $3;
30343b3a8eb9SGleb Smirnoff 			else {
30353b3a8eb9SGleb Smirnoff 				$1->tail->next = $3;
30363b3a8eb9SGleb Smirnoff 				$1->tail = $3->tail;
30373b3a8eb9SGleb Smirnoff 				$$ = $1;
30383b3a8eb9SGleb Smirnoff 			}
30393b3a8eb9SGleb Smirnoff 		}
30403b3a8eb9SGleb Smirnoff 		;
30413b3a8eb9SGleb Smirnoff 
30423b3a8eb9SGleb Smirnoff xhost		: not host			{
30433b3a8eb9SGleb Smirnoff 			struct node_host	*n;
30443b3a8eb9SGleb Smirnoff 
30453b3a8eb9SGleb Smirnoff 			for (n = $2; n != NULL; n = n->next)
30463b3a8eb9SGleb Smirnoff 				n->not = $1;
30473b3a8eb9SGleb Smirnoff 			$$ = $2;
30483b3a8eb9SGleb Smirnoff 		}
30493b3a8eb9SGleb Smirnoff 		| not NOROUTE			{
30503b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
30513b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
30523b3a8eb9SGleb Smirnoff 				err(1, "xhost: calloc");
30533b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_NOROUTE;
30543b3a8eb9SGleb Smirnoff 			$$->next = NULL;
30553b3a8eb9SGleb Smirnoff 			$$->not = $1;
30563b3a8eb9SGleb Smirnoff 			$$->tail = $$;
30573b3a8eb9SGleb Smirnoff 		}
30583b3a8eb9SGleb Smirnoff 		| not URPFFAILED		{
30593b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
30603b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
30613b3a8eb9SGleb Smirnoff 				err(1, "xhost: calloc");
30623b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_URPFFAILED;
30633b3a8eb9SGleb Smirnoff 			$$->next = NULL;
30643b3a8eb9SGleb Smirnoff 			$$->not = $1;
30653b3a8eb9SGleb Smirnoff 			$$->tail = $$;
30663b3a8eb9SGleb Smirnoff 		}
30673b3a8eb9SGleb Smirnoff 		;
30683b3a8eb9SGleb Smirnoff 
30693b3a8eb9SGleb Smirnoff host		: STRING			{
30703b3a8eb9SGleb Smirnoff 			if (($$ = host($1)) == NULL)	{
30713b3a8eb9SGleb Smirnoff 				/* error. "any" is handled elsewhere */
30723b3a8eb9SGleb Smirnoff 				free($1);
30733b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
30743b3a8eb9SGleb Smirnoff 				YYERROR;
30753b3a8eb9SGleb Smirnoff 			}
30763b3a8eb9SGleb Smirnoff 			free($1);
30773b3a8eb9SGleb Smirnoff 
30783b3a8eb9SGleb Smirnoff 		}
30793b3a8eb9SGleb Smirnoff 		| STRING '-' STRING		{
30803b3a8eb9SGleb Smirnoff 			struct node_host *b, *e;
30813b3a8eb9SGleb Smirnoff 
30823b3a8eb9SGleb Smirnoff 			if ((b = host($1)) == NULL || (e = host($3)) == NULL) {
30833b3a8eb9SGleb Smirnoff 				free($1);
30843b3a8eb9SGleb Smirnoff 				free($3);
30853b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
30863b3a8eb9SGleb Smirnoff 				YYERROR;
30873b3a8eb9SGleb Smirnoff 			}
30883b3a8eb9SGleb Smirnoff 			if (b->af != e->af ||
30893b3a8eb9SGleb Smirnoff 			    b->addr.type != PF_ADDR_ADDRMASK ||
30903b3a8eb9SGleb Smirnoff 			    e->addr.type != PF_ADDR_ADDRMASK ||
30913b3a8eb9SGleb Smirnoff 			    unmask(&b->addr.v.a.mask, b->af) !=
30923b3a8eb9SGleb Smirnoff 			    (b->af == AF_INET ? 32 : 128) ||
30933b3a8eb9SGleb Smirnoff 			    unmask(&e->addr.v.a.mask, e->af) !=
30943b3a8eb9SGleb Smirnoff 			    (e->af == AF_INET ? 32 : 128) ||
30953b3a8eb9SGleb Smirnoff 			    b->next != NULL || b->not ||
30963b3a8eb9SGleb Smirnoff 			    e->next != NULL || e->not) {
30973b3a8eb9SGleb Smirnoff 				free(b);
30983b3a8eb9SGleb Smirnoff 				free(e);
30993b3a8eb9SGleb Smirnoff 				free($1);
31003b3a8eb9SGleb Smirnoff 				free($3);
31013b3a8eb9SGleb Smirnoff 				yyerror("invalid address range");
31023b3a8eb9SGleb Smirnoff 				YYERROR;
31033b3a8eb9SGleb Smirnoff 			}
31043b3a8eb9SGleb Smirnoff 			memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr,
31053b3a8eb9SGleb Smirnoff 			    sizeof(b->addr.v.a.mask));
31063b3a8eb9SGleb Smirnoff 			b->addr.type = PF_ADDR_RANGE;
31073b3a8eb9SGleb Smirnoff 			$$ = b;
31083b3a8eb9SGleb Smirnoff 			free(e);
31093b3a8eb9SGleb Smirnoff 			free($1);
31103b3a8eb9SGleb Smirnoff 			free($3);
31113b3a8eb9SGleb Smirnoff 		}
31123b3a8eb9SGleb Smirnoff 		| STRING '/' NUMBER		{
31133b3a8eb9SGleb Smirnoff 			char	*buf;
31143b3a8eb9SGleb Smirnoff 
31153b3a8eb9SGleb Smirnoff 			if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1)
31163b3a8eb9SGleb Smirnoff 				err(1, "host: asprintf");
31173b3a8eb9SGleb Smirnoff 			free($1);
31183b3a8eb9SGleb Smirnoff 			if (($$ = host(buf)) == NULL)	{
31193b3a8eb9SGleb Smirnoff 				/* error. "any" is handled elsewhere */
31203b3a8eb9SGleb Smirnoff 				free(buf);
31213b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
31223b3a8eb9SGleb Smirnoff 				YYERROR;
31233b3a8eb9SGleb Smirnoff 			}
31243b3a8eb9SGleb Smirnoff 			free(buf);
31253b3a8eb9SGleb Smirnoff 		}
31263b3a8eb9SGleb Smirnoff 		| NUMBER '/' NUMBER		{
31273b3a8eb9SGleb Smirnoff 			char	*buf;
31283b3a8eb9SGleb Smirnoff 
31293b3a8eb9SGleb Smirnoff 			/* ie. for 10/8 parsing */
31303b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
31313b3a8eb9SGleb Smirnoff 			if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1)
31323b3a8eb9SGleb Smirnoff #else
31333b3a8eb9SGleb Smirnoff 			if (asprintf(&buf, "%lld/%lld", $1, $3) == -1)
31343b3a8eb9SGleb Smirnoff #endif
31353b3a8eb9SGleb Smirnoff 				err(1, "host: asprintf");
31363b3a8eb9SGleb Smirnoff 			if (($$ = host(buf)) == NULL)	{
31373b3a8eb9SGleb Smirnoff 				/* error. "any" is handled elsewhere */
31383b3a8eb9SGleb Smirnoff 				free(buf);
31393b3a8eb9SGleb Smirnoff 				yyerror("could not parse host specification");
31403b3a8eb9SGleb Smirnoff 				YYERROR;
31413b3a8eb9SGleb Smirnoff 			}
31423b3a8eb9SGleb Smirnoff 			free(buf);
31433b3a8eb9SGleb Smirnoff 		}
31443b3a8eb9SGleb Smirnoff 		| dynaddr
31453b3a8eb9SGleb Smirnoff 		| dynaddr '/' NUMBER		{
31463b3a8eb9SGleb Smirnoff 			struct node_host	*n;
31473b3a8eb9SGleb Smirnoff 
31483b3a8eb9SGleb Smirnoff 			if ($3 < 0 || $3 > 128) {
31493b3a8eb9SGleb Smirnoff 				yyerror("bit number too big");
31503b3a8eb9SGleb Smirnoff 				YYERROR;
31513b3a8eb9SGleb Smirnoff 			}
31523b3a8eb9SGleb Smirnoff 			$$ = $1;
31533b3a8eb9SGleb Smirnoff 			for (n = $1; n != NULL; n = n->next)
31543b3a8eb9SGleb Smirnoff 				set_ipmask(n, $3);
31553b3a8eb9SGleb Smirnoff 		}
31563b3a8eb9SGleb Smirnoff 		| '<' STRING '>'	{
31573b3a8eb9SGleb Smirnoff 			if (strlen($2) >= PF_TABLE_NAME_SIZE) {
31583b3a8eb9SGleb Smirnoff 				yyerror("table name '%s' too long", $2);
31593b3a8eb9SGleb Smirnoff 				free($2);
31603b3a8eb9SGleb Smirnoff 				YYERROR;
31613b3a8eb9SGleb Smirnoff 			}
31623b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
31633b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
31643b3a8eb9SGleb Smirnoff 				err(1, "host: calloc");
31653b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_TABLE;
31663b3a8eb9SGleb Smirnoff 			if (strlcpy($$->addr.v.tblname, $2,
31673b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.tblname)) >=
31683b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.tblname))
31693b3a8eb9SGleb Smirnoff 				errx(1, "host: strlcpy");
31703b3a8eb9SGleb Smirnoff 			free($2);
31713b3a8eb9SGleb Smirnoff 			$$->next = NULL;
31723b3a8eb9SGleb Smirnoff 			$$->tail = $$;
31733b3a8eb9SGleb Smirnoff 		}
31743b3a8eb9SGleb Smirnoff 		;
31753b3a8eb9SGleb Smirnoff 
31763b3a8eb9SGleb Smirnoff number		: NUMBER
31773b3a8eb9SGleb Smirnoff 		| STRING		{
31783b3a8eb9SGleb Smirnoff 			u_long	ulval;
31793b3a8eb9SGleb Smirnoff 
31803b3a8eb9SGleb Smirnoff 			if (atoul($1, &ulval) == -1) {
31813b3a8eb9SGleb Smirnoff 				yyerror("%s is not a number", $1);
31823b3a8eb9SGleb Smirnoff 				free($1);
31833b3a8eb9SGleb Smirnoff 				YYERROR;
31843b3a8eb9SGleb Smirnoff 			} else
31853b3a8eb9SGleb Smirnoff 				$$ = ulval;
31863b3a8eb9SGleb Smirnoff 			free($1);
31873b3a8eb9SGleb Smirnoff 		}
31883b3a8eb9SGleb Smirnoff 		;
31893b3a8eb9SGleb Smirnoff 
31903b3a8eb9SGleb Smirnoff dynaddr		: '(' STRING ')'		{
31913b3a8eb9SGleb Smirnoff 			int	 flags = 0;
31923b3a8eb9SGleb Smirnoff 			char	*p, *op;
31933b3a8eb9SGleb Smirnoff 
31943b3a8eb9SGleb Smirnoff 			op = $2;
31953b3a8eb9SGleb Smirnoff 			if (!isalpha(op[0])) {
31963b3a8eb9SGleb Smirnoff 				yyerror("invalid interface name '%s'", op);
31973b3a8eb9SGleb Smirnoff 				free(op);
31983b3a8eb9SGleb Smirnoff 				YYERROR;
31993b3a8eb9SGleb Smirnoff 			}
32003b3a8eb9SGleb Smirnoff 			while ((p = strrchr($2, ':')) != NULL) {
32013b3a8eb9SGleb Smirnoff 				if (!strcmp(p+1, "network"))
32023b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_NETWORK;
32033b3a8eb9SGleb Smirnoff 				else if (!strcmp(p+1, "broadcast"))
32043b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_BROADCAST;
32053b3a8eb9SGleb Smirnoff 				else if (!strcmp(p+1, "peer"))
32063b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_PEER;
32073b3a8eb9SGleb Smirnoff 				else if (!strcmp(p+1, "0"))
32083b3a8eb9SGleb Smirnoff 					flags |= PFI_AFLAG_NOALIAS;
32093b3a8eb9SGleb Smirnoff 				else {
32103b3a8eb9SGleb Smirnoff 					yyerror("interface %s has bad modifier",
32113b3a8eb9SGleb Smirnoff 					    $2);
32123b3a8eb9SGleb Smirnoff 					free(op);
32133b3a8eb9SGleb Smirnoff 					YYERROR;
32143b3a8eb9SGleb Smirnoff 				}
32153b3a8eb9SGleb Smirnoff 				*p = '\0';
32163b3a8eb9SGleb Smirnoff 			}
32173b3a8eb9SGleb Smirnoff 			if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
32183b3a8eb9SGleb Smirnoff 				free(op);
32193b3a8eb9SGleb Smirnoff 				yyerror("illegal combination of "
32203b3a8eb9SGleb Smirnoff 				    "interface modifiers");
32213b3a8eb9SGleb Smirnoff 				YYERROR;
32223b3a8eb9SGleb Smirnoff 			}
32233b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
32243b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32253b3a8eb9SGleb Smirnoff 				err(1, "address: calloc");
32263b3a8eb9SGleb Smirnoff 			$$->af = 0;
32273b3a8eb9SGleb Smirnoff 			set_ipmask($$, 128);
32283b3a8eb9SGleb Smirnoff 			$$->addr.type = PF_ADDR_DYNIFTL;
32293b3a8eb9SGleb Smirnoff 			$$->addr.iflags = flags;
32303b3a8eb9SGleb Smirnoff 			if (strlcpy($$->addr.v.ifname, $2,
32313b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.ifname)) >=
32323b3a8eb9SGleb Smirnoff 			    sizeof($$->addr.v.ifname)) {
32333b3a8eb9SGleb Smirnoff 				free(op);
32343b3a8eb9SGleb Smirnoff 				free($$);
32353b3a8eb9SGleb Smirnoff 				yyerror("interface name too long");
32363b3a8eb9SGleb Smirnoff 				YYERROR;
32373b3a8eb9SGleb Smirnoff 			}
32383b3a8eb9SGleb Smirnoff 			free(op);
32393b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32403b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32413b3a8eb9SGleb Smirnoff 		}
32423b3a8eb9SGleb Smirnoff 		;
32433b3a8eb9SGleb Smirnoff 
32443b3a8eb9SGleb Smirnoff portspec	: port_item			{ $$ = $1; }
32453b3a8eb9SGleb Smirnoff 		| '{' optnl port_list '}'	{ $$ = $3; }
32463b3a8eb9SGleb Smirnoff 		;
32473b3a8eb9SGleb Smirnoff 
32483b3a8eb9SGleb Smirnoff port_list	: port_item optnl		{ $$ = $1; }
32493b3a8eb9SGleb Smirnoff 		| port_list comma port_item optnl	{
32503b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
32513b3a8eb9SGleb Smirnoff 			$1->tail = $3;
32523b3a8eb9SGleb Smirnoff 			$$ = $1;
32533b3a8eb9SGleb Smirnoff 		}
32543b3a8eb9SGleb Smirnoff 		;
32553b3a8eb9SGleb Smirnoff 
32563b3a8eb9SGleb Smirnoff port_item	: portrange			{
32573b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_port));
32583b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32593b3a8eb9SGleb Smirnoff 				err(1, "port_item: calloc");
32603b3a8eb9SGleb Smirnoff 			$$->port[0] = $1.a;
32613b3a8eb9SGleb Smirnoff 			$$->port[1] = $1.b;
32623b3a8eb9SGleb Smirnoff 			if ($1.t)
32633b3a8eb9SGleb Smirnoff 				$$->op = PF_OP_RRG;
32643b3a8eb9SGleb Smirnoff 			else
32653b3a8eb9SGleb Smirnoff 				$$->op = PF_OP_EQ;
32663b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32673b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32683b3a8eb9SGleb Smirnoff 		}
32693b3a8eb9SGleb Smirnoff 		| unaryop portrange	{
32703b3a8eb9SGleb Smirnoff 			if ($2.t) {
32713b3a8eb9SGleb Smirnoff 				yyerror("':' cannot be used with an other "
32723b3a8eb9SGleb Smirnoff 				    "port operator");
32733b3a8eb9SGleb Smirnoff 				YYERROR;
32743b3a8eb9SGleb Smirnoff 			}
32753b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_port));
32763b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32773b3a8eb9SGleb Smirnoff 				err(1, "port_item: calloc");
32783b3a8eb9SGleb Smirnoff 			$$->port[0] = $2.a;
32793b3a8eb9SGleb Smirnoff 			$$->port[1] = $2.b;
32803b3a8eb9SGleb Smirnoff 			$$->op = $1;
32813b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32823b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32833b3a8eb9SGleb Smirnoff 		}
32843b3a8eb9SGleb Smirnoff 		| portrange PORTBINARY portrange	{
32853b3a8eb9SGleb Smirnoff 			if ($1.t || $3.t) {
32863b3a8eb9SGleb Smirnoff 				yyerror("':' cannot be used with an other "
32873b3a8eb9SGleb Smirnoff 				    "port operator");
32883b3a8eb9SGleb Smirnoff 				YYERROR;
32893b3a8eb9SGleb Smirnoff 			}
32903b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_port));
32913b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
32923b3a8eb9SGleb Smirnoff 				err(1, "port_item: calloc");
32933b3a8eb9SGleb Smirnoff 			$$->port[0] = $1.a;
32943b3a8eb9SGleb Smirnoff 			$$->port[1] = $3.a;
32953b3a8eb9SGleb Smirnoff 			$$->op = $2;
32963b3a8eb9SGleb Smirnoff 			$$->next = NULL;
32973b3a8eb9SGleb Smirnoff 			$$->tail = $$;
32983b3a8eb9SGleb Smirnoff 		}
32993b3a8eb9SGleb Smirnoff 		;
33003b3a8eb9SGleb Smirnoff 
33013b3a8eb9SGleb Smirnoff portplain	: numberstring			{
33023b3a8eb9SGleb Smirnoff 			if (parseport($1, &$$, 0) == -1) {
33033b3a8eb9SGleb Smirnoff 				free($1);
33043b3a8eb9SGleb Smirnoff 				YYERROR;
33053b3a8eb9SGleb Smirnoff 			}
33063b3a8eb9SGleb Smirnoff 			free($1);
33073b3a8eb9SGleb Smirnoff 		}
33083b3a8eb9SGleb Smirnoff 		;
33093b3a8eb9SGleb Smirnoff 
33103b3a8eb9SGleb Smirnoff portrange	: numberstring			{
33113b3a8eb9SGleb Smirnoff 			if (parseport($1, &$$, PPORT_RANGE) == -1) {
33123b3a8eb9SGleb Smirnoff 				free($1);
33133b3a8eb9SGleb Smirnoff 				YYERROR;
33143b3a8eb9SGleb Smirnoff 			}
33153b3a8eb9SGleb Smirnoff 			free($1);
33163b3a8eb9SGleb Smirnoff 		}
33173b3a8eb9SGleb Smirnoff 		;
33183b3a8eb9SGleb Smirnoff 
33193b3a8eb9SGleb Smirnoff uids		: uid_item			{ $$ = $1; }
33203b3a8eb9SGleb Smirnoff 		| '{' optnl uid_list '}'	{ $$ = $3; }
33213b3a8eb9SGleb Smirnoff 		;
33223b3a8eb9SGleb Smirnoff 
33233b3a8eb9SGleb Smirnoff uid_list	: uid_item optnl		{ $$ = $1; }
33243b3a8eb9SGleb Smirnoff 		| uid_list comma uid_item optnl	{
33253b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
33263b3a8eb9SGleb Smirnoff 			$1->tail = $3;
33273b3a8eb9SGleb Smirnoff 			$$ = $1;
33283b3a8eb9SGleb Smirnoff 		}
33293b3a8eb9SGleb Smirnoff 		;
33303b3a8eb9SGleb Smirnoff 
33313b3a8eb9SGleb Smirnoff uid_item	: uid				{
33323b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_uid));
33333b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33343b3a8eb9SGleb Smirnoff 				err(1, "uid_item: calloc");
33353b3a8eb9SGleb Smirnoff 			$$->uid[0] = $1;
33363b3a8eb9SGleb Smirnoff 			$$->uid[1] = $1;
33373b3a8eb9SGleb Smirnoff 			$$->op = PF_OP_EQ;
33383b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33393b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33403b3a8eb9SGleb Smirnoff 		}
33413b3a8eb9SGleb Smirnoff 		| unaryop uid			{
33423b3a8eb9SGleb Smirnoff 			if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
33433b3a8eb9SGleb Smirnoff 				yyerror("user unknown requires operator = or "
33443b3a8eb9SGleb Smirnoff 				    "!=");
33453b3a8eb9SGleb Smirnoff 				YYERROR;
33463b3a8eb9SGleb Smirnoff 			}
33473b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_uid));
33483b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33493b3a8eb9SGleb Smirnoff 				err(1, "uid_item: calloc");
33503b3a8eb9SGleb Smirnoff 			$$->uid[0] = $2;
33513b3a8eb9SGleb Smirnoff 			$$->uid[1] = $2;
33523b3a8eb9SGleb Smirnoff 			$$->op = $1;
33533b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33543b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33553b3a8eb9SGleb Smirnoff 		}
33563b3a8eb9SGleb Smirnoff 		| uid PORTBINARY uid		{
33573b3a8eb9SGleb Smirnoff 			if ($1 == UID_MAX || $3 == UID_MAX) {
33583b3a8eb9SGleb Smirnoff 				yyerror("user unknown requires operator = or "
33593b3a8eb9SGleb Smirnoff 				    "!=");
33603b3a8eb9SGleb Smirnoff 				YYERROR;
33613b3a8eb9SGleb Smirnoff 			}
33623b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_uid));
33633b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
33643b3a8eb9SGleb Smirnoff 				err(1, "uid_item: calloc");
33653b3a8eb9SGleb Smirnoff 			$$->uid[0] = $1;
33663b3a8eb9SGleb Smirnoff 			$$->uid[1] = $3;
33673b3a8eb9SGleb Smirnoff 			$$->op = $2;
33683b3a8eb9SGleb Smirnoff 			$$->next = NULL;
33693b3a8eb9SGleb Smirnoff 			$$->tail = $$;
33703b3a8eb9SGleb Smirnoff 		}
33713b3a8eb9SGleb Smirnoff 		;
33723b3a8eb9SGleb Smirnoff 
33733b3a8eb9SGleb Smirnoff uid		: STRING			{
33743b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "unknown"))
33753b3a8eb9SGleb Smirnoff 				$$ = UID_MAX;
33763b3a8eb9SGleb Smirnoff 			else {
33773b3a8eb9SGleb Smirnoff 				struct passwd	*pw;
33783b3a8eb9SGleb Smirnoff 
33793b3a8eb9SGleb Smirnoff 				if ((pw = getpwnam($1)) == NULL) {
33803b3a8eb9SGleb Smirnoff 					yyerror("unknown user %s", $1);
33813b3a8eb9SGleb Smirnoff 					free($1);
33823b3a8eb9SGleb Smirnoff 					YYERROR;
33833b3a8eb9SGleb Smirnoff 				}
33843b3a8eb9SGleb Smirnoff 				$$ = pw->pw_uid;
33853b3a8eb9SGleb Smirnoff 			}
33863b3a8eb9SGleb Smirnoff 			free($1);
33873b3a8eb9SGleb Smirnoff 		}
33883b3a8eb9SGleb Smirnoff 		| NUMBER			{
33893b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 >= UID_MAX) {
33903b3a8eb9SGleb Smirnoff 				yyerror("illegal uid value %lu", $1);
33913b3a8eb9SGleb Smirnoff 				YYERROR;
33923b3a8eb9SGleb Smirnoff 			}
33933b3a8eb9SGleb Smirnoff 			$$ = $1;
33943b3a8eb9SGleb Smirnoff 		}
33953b3a8eb9SGleb Smirnoff 		;
33963b3a8eb9SGleb Smirnoff 
33973b3a8eb9SGleb Smirnoff gids		: gid_item			{ $$ = $1; }
33983b3a8eb9SGleb Smirnoff 		| '{' optnl gid_list '}'	{ $$ = $3; }
33993b3a8eb9SGleb Smirnoff 		;
34003b3a8eb9SGleb Smirnoff 
34013b3a8eb9SGleb Smirnoff gid_list	: gid_item optnl		{ $$ = $1; }
34023b3a8eb9SGleb Smirnoff 		| gid_list comma gid_item optnl	{
34033b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
34043b3a8eb9SGleb Smirnoff 			$1->tail = $3;
34053b3a8eb9SGleb Smirnoff 			$$ = $1;
34063b3a8eb9SGleb Smirnoff 		}
34073b3a8eb9SGleb Smirnoff 		;
34083b3a8eb9SGleb Smirnoff 
34093b3a8eb9SGleb Smirnoff gid_item	: gid				{
34103b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_gid));
34113b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
34123b3a8eb9SGleb Smirnoff 				err(1, "gid_item: calloc");
34133b3a8eb9SGleb Smirnoff 			$$->gid[0] = $1;
34143b3a8eb9SGleb Smirnoff 			$$->gid[1] = $1;
34153b3a8eb9SGleb Smirnoff 			$$->op = PF_OP_EQ;
34163b3a8eb9SGleb Smirnoff 			$$->next = NULL;
34173b3a8eb9SGleb Smirnoff 			$$->tail = $$;
34183b3a8eb9SGleb Smirnoff 		}
34193b3a8eb9SGleb Smirnoff 		| unaryop gid			{
34203b3a8eb9SGleb Smirnoff 			if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
34213b3a8eb9SGleb Smirnoff 				yyerror("group unknown requires operator = or "
34223b3a8eb9SGleb Smirnoff 				    "!=");
34233b3a8eb9SGleb Smirnoff 				YYERROR;
34243b3a8eb9SGleb Smirnoff 			}
34253b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_gid));
34263b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
34273b3a8eb9SGleb Smirnoff 				err(1, "gid_item: calloc");
34283b3a8eb9SGleb Smirnoff 			$$->gid[0] = $2;
34293b3a8eb9SGleb Smirnoff 			$$->gid[1] = $2;
34303b3a8eb9SGleb Smirnoff 			$$->op = $1;
34313b3a8eb9SGleb Smirnoff 			$$->next = NULL;
34323b3a8eb9SGleb Smirnoff 			$$->tail = $$;
34333b3a8eb9SGleb Smirnoff 		}
34343b3a8eb9SGleb Smirnoff 		| gid PORTBINARY gid		{
34353b3a8eb9SGleb Smirnoff 			if ($1 == GID_MAX || $3 == GID_MAX) {
34363b3a8eb9SGleb Smirnoff 				yyerror("group unknown requires operator = or "
34373b3a8eb9SGleb Smirnoff 				    "!=");
34383b3a8eb9SGleb Smirnoff 				YYERROR;
34393b3a8eb9SGleb Smirnoff 			}
34403b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_gid));
34413b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
34423b3a8eb9SGleb Smirnoff 				err(1, "gid_item: calloc");
34433b3a8eb9SGleb Smirnoff 			$$->gid[0] = $1;
34443b3a8eb9SGleb Smirnoff 			$$->gid[1] = $3;
34453b3a8eb9SGleb Smirnoff 			$$->op = $2;
34463b3a8eb9SGleb Smirnoff 			$$->next = NULL;
34473b3a8eb9SGleb Smirnoff 			$$->tail = $$;
34483b3a8eb9SGleb Smirnoff 		}
34493b3a8eb9SGleb Smirnoff 		;
34503b3a8eb9SGleb Smirnoff 
34513b3a8eb9SGleb Smirnoff gid		: STRING			{
34523b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "unknown"))
34533b3a8eb9SGleb Smirnoff 				$$ = GID_MAX;
34543b3a8eb9SGleb Smirnoff 			else {
34553b3a8eb9SGleb Smirnoff 				struct group	*grp;
34563b3a8eb9SGleb Smirnoff 
34573b3a8eb9SGleb Smirnoff 				if ((grp = getgrnam($1)) == NULL) {
34583b3a8eb9SGleb Smirnoff 					yyerror("unknown group %s", $1);
34593b3a8eb9SGleb Smirnoff 					free($1);
34603b3a8eb9SGleb Smirnoff 					YYERROR;
34613b3a8eb9SGleb Smirnoff 				}
34623b3a8eb9SGleb Smirnoff 				$$ = grp->gr_gid;
34633b3a8eb9SGleb Smirnoff 			}
34643b3a8eb9SGleb Smirnoff 			free($1);
34653b3a8eb9SGleb Smirnoff 		}
34663b3a8eb9SGleb Smirnoff 		| NUMBER			{
34673b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 >= GID_MAX) {
34683b3a8eb9SGleb Smirnoff 				yyerror("illegal gid value %lu", $1);
34693b3a8eb9SGleb Smirnoff 				YYERROR;
34703b3a8eb9SGleb Smirnoff 			}
34713b3a8eb9SGleb Smirnoff 			$$ = $1;
34723b3a8eb9SGleb Smirnoff 		}
34733b3a8eb9SGleb Smirnoff 		;
34743b3a8eb9SGleb Smirnoff 
34753b3a8eb9SGleb Smirnoff flag		: STRING			{
34763b3a8eb9SGleb Smirnoff 			int	f;
34773b3a8eb9SGleb Smirnoff 
34783b3a8eb9SGleb Smirnoff 			if ((f = parse_flags($1)) < 0) {
34793b3a8eb9SGleb Smirnoff 				yyerror("bad flags %s", $1);
34803b3a8eb9SGleb Smirnoff 				free($1);
34813b3a8eb9SGleb Smirnoff 				YYERROR;
34823b3a8eb9SGleb Smirnoff 			}
34833b3a8eb9SGleb Smirnoff 			free($1);
34843b3a8eb9SGleb Smirnoff 			$$.b1 = f;
34853b3a8eb9SGleb Smirnoff 		}
34863b3a8eb9SGleb Smirnoff 		;
34873b3a8eb9SGleb Smirnoff 
34883b3a8eb9SGleb Smirnoff flags		: FLAGS flag '/' flag	{ $$.b1 = $2.b1; $$.b2 = $4.b1; }
34893b3a8eb9SGleb Smirnoff 		| FLAGS '/' flag	{ $$.b1 = 0; $$.b2 = $3.b1; }
34903b3a8eb9SGleb Smirnoff 		| FLAGS ANY		{ $$.b1 = 0; $$.b2 = 0; }
34913b3a8eb9SGleb Smirnoff 		;
34923b3a8eb9SGleb Smirnoff 
34933b3a8eb9SGleb Smirnoff icmpspec	: ICMPTYPE icmp_item			{ $$ = $2; }
34943b3a8eb9SGleb Smirnoff 		| ICMPTYPE '{' optnl icmp_list '}'	{ $$ = $4; }
34953b3a8eb9SGleb Smirnoff 		| ICMP6TYPE icmp6_item			{ $$ = $2; }
34963b3a8eb9SGleb Smirnoff 		| ICMP6TYPE '{' optnl icmp6_list '}'	{ $$ = $4; }
34973b3a8eb9SGleb Smirnoff 		;
34983b3a8eb9SGleb Smirnoff 
34993b3a8eb9SGleb Smirnoff icmp_list	: icmp_item optnl		{ $$ = $1; }
35003b3a8eb9SGleb Smirnoff 		| icmp_list comma icmp_item optnl {
35013b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
35023b3a8eb9SGleb Smirnoff 			$1->tail = $3;
35033b3a8eb9SGleb Smirnoff 			$$ = $1;
35043b3a8eb9SGleb Smirnoff 		}
35053b3a8eb9SGleb Smirnoff 		;
35063b3a8eb9SGleb Smirnoff 
35073b3a8eb9SGleb Smirnoff icmp6_list	: icmp6_item optnl		{ $$ = $1; }
35083b3a8eb9SGleb Smirnoff 		| icmp6_list comma icmp6_item optnl {
35093b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
35103b3a8eb9SGleb Smirnoff 			$1->tail = $3;
35113b3a8eb9SGleb Smirnoff 			$$ = $1;
35123b3a8eb9SGleb Smirnoff 		}
35133b3a8eb9SGleb Smirnoff 		;
35143b3a8eb9SGleb Smirnoff 
35153b3a8eb9SGleb Smirnoff icmp_item	: icmptype		{
35163b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
35173b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35183b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
35193b3a8eb9SGleb Smirnoff 			$$->type = $1;
35203b3a8eb9SGleb Smirnoff 			$$->code = 0;
35213b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMP;
35223b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35233b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35243b3a8eb9SGleb Smirnoff 		}
35253b3a8eb9SGleb Smirnoff 		| icmptype CODE STRING	{
35263b3a8eb9SGleb Smirnoff 			const struct icmpcodeent	*p;
35273b3a8eb9SGleb Smirnoff 
35283b3a8eb9SGleb Smirnoff 			if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) {
35293b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp-code %s", $3);
35303b3a8eb9SGleb Smirnoff 				free($3);
35313b3a8eb9SGleb Smirnoff 				YYERROR;
35323b3a8eb9SGleb Smirnoff 			}
35333b3a8eb9SGleb Smirnoff 
35343b3a8eb9SGleb Smirnoff 			free($3);
35353b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
35363b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35373b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
35383b3a8eb9SGleb Smirnoff 			$$->type = $1;
35393b3a8eb9SGleb Smirnoff 			$$->code = p->code + 1;
35403b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMP;
35413b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35423b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35433b3a8eb9SGleb Smirnoff 		}
35443b3a8eb9SGleb Smirnoff 		| icmptype CODE NUMBER	{
35453b3a8eb9SGleb Smirnoff 			if ($3 < 0 || $3 > 255) {
35463b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp-code %lu", $3);
35473b3a8eb9SGleb Smirnoff 				YYERROR;
35483b3a8eb9SGleb Smirnoff 			}
35493b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
35503b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35513b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
35523b3a8eb9SGleb Smirnoff 			$$->type = $1;
35533b3a8eb9SGleb Smirnoff 			$$->code = $3 + 1;
35543b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMP;
35553b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35563b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35573b3a8eb9SGleb Smirnoff 		}
35583b3a8eb9SGleb Smirnoff 		;
35593b3a8eb9SGleb Smirnoff 
35603b3a8eb9SGleb Smirnoff icmp6_item	: icmp6type		{
35613b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
35623b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35633b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
35643b3a8eb9SGleb Smirnoff 			$$->type = $1;
35653b3a8eb9SGleb Smirnoff 			$$->code = 0;
35663b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMPV6;
35673b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35683b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35693b3a8eb9SGleb Smirnoff 		}
35703b3a8eb9SGleb Smirnoff 		| icmp6type CODE STRING	{
35713b3a8eb9SGleb Smirnoff 			const struct icmpcodeent	*p;
35723b3a8eb9SGleb Smirnoff 
35733b3a8eb9SGleb Smirnoff 			if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) {
35743b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp6-code %s", $3);
35753b3a8eb9SGleb Smirnoff 				free($3);
35763b3a8eb9SGleb Smirnoff 				YYERROR;
35773b3a8eb9SGleb Smirnoff 			}
35783b3a8eb9SGleb Smirnoff 			free($3);
35793b3a8eb9SGleb Smirnoff 
35803b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
35813b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35823b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
35833b3a8eb9SGleb Smirnoff 			$$->type = $1;
35843b3a8eb9SGleb Smirnoff 			$$->code = p->code + 1;
35853b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMPV6;
35863b3a8eb9SGleb Smirnoff 			$$->next = NULL;
35873b3a8eb9SGleb Smirnoff 			$$->tail = $$;
35883b3a8eb9SGleb Smirnoff 		}
35893b3a8eb9SGleb Smirnoff 		| icmp6type CODE NUMBER	{
35903b3a8eb9SGleb Smirnoff 			if ($3 < 0 || $3 > 255) {
35913b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp-code %lu", $3);
35923b3a8eb9SGleb Smirnoff 				YYERROR;
35933b3a8eb9SGleb Smirnoff 			}
35943b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_icmp));
35953b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
35963b3a8eb9SGleb Smirnoff 				err(1, "icmp_item: calloc");
35973b3a8eb9SGleb Smirnoff 			$$->type = $1;
35983b3a8eb9SGleb Smirnoff 			$$->code = $3 + 1;
35993b3a8eb9SGleb Smirnoff 			$$->proto = IPPROTO_ICMPV6;
36003b3a8eb9SGleb Smirnoff 			$$->next = NULL;
36013b3a8eb9SGleb Smirnoff 			$$->tail = $$;
36023b3a8eb9SGleb Smirnoff 		}
36033b3a8eb9SGleb Smirnoff 		;
36043b3a8eb9SGleb Smirnoff 
36053b3a8eb9SGleb Smirnoff icmptype	: STRING			{
36063b3a8eb9SGleb Smirnoff 			const struct icmptypeent	*p;
36073b3a8eb9SGleb Smirnoff 
36083b3a8eb9SGleb Smirnoff 			if ((p = geticmptypebyname($1, AF_INET)) == NULL) {
36093b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp-type %s", $1);
36103b3a8eb9SGleb Smirnoff 				free($1);
36113b3a8eb9SGleb Smirnoff 				YYERROR;
36123b3a8eb9SGleb Smirnoff 			}
36133b3a8eb9SGleb Smirnoff 			$$ = p->type + 1;
36143b3a8eb9SGleb Smirnoff 			free($1);
36153b3a8eb9SGleb Smirnoff 		}
36163b3a8eb9SGleb Smirnoff 		| NUMBER			{
36173b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
36183b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp-type %lu", $1);
36193b3a8eb9SGleb Smirnoff 				YYERROR;
36203b3a8eb9SGleb Smirnoff 			}
36213b3a8eb9SGleb Smirnoff 			$$ = $1 + 1;
36223b3a8eb9SGleb Smirnoff 		}
36233b3a8eb9SGleb Smirnoff 		;
36243b3a8eb9SGleb Smirnoff 
36253b3a8eb9SGleb Smirnoff icmp6type	: STRING			{
36263b3a8eb9SGleb Smirnoff 			const struct icmptypeent	*p;
36273b3a8eb9SGleb Smirnoff 
36283b3a8eb9SGleb Smirnoff 			if ((p = geticmptypebyname($1, AF_INET6)) ==
36293b3a8eb9SGleb Smirnoff 			    NULL) {
36303b3a8eb9SGleb Smirnoff 				yyerror("unknown icmp6-type %s", $1);
36313b3a8eb9SGleb Smirnoff 				free($1);
36323b3a8eb9SGleb Smirnoff 				YYERROR;
36333b3a8eb9SGleb Smirnoff 			}
36343b3a8eb9SGleb Smirnoff 			$$ = p->type + 1;
36353b3a8eb9SGleb Smirnoff 			free($1);
36363b3a8eb9SGleb Smirnoff 		}
36373b3a8eb9SGleb Smirnoff 		| NUMBER			{
36383b3a8eb9SGleb Smirnoff 			if ($1 < 0 || $1 > 255) {
36393b3a8eb9SGleb Smirnoff 				yyerror("illegal icmp6-type %lu", $1);
36403b3a8eb9SGleb Smirnoff 				YYERROR;
36413b3a8eb9SGleb Smirnoff 			}
36423b3a8eb9SGleb Smirnoff 			$$ = $1 + 1;
36433b3a8eb9SGleb Smirnoff 		}
36443b3a8eb9SGleb Smirnoff 		;
36453b3a8eb9SGleb Smirnoff 
36463b3a8eb9SGleb Smirnoff tos	: STRING			{
36471f495578SKristof Provost 			int val;
36481f495578SKristof Provost 			char *end;
36491f495578SKristof Provost 
36501f495578SKristof Provost 			if (map_tos($1, &val))
36511f495578SKristof Provost 				$$ = val;
36521f495578SKristof Provost 			else if ($1[0] == '0' && $1[1] == 'x') {
36531f495578SKristof Provost 				errno = 0;
36541f495578SKristof Provost 				$$ = strtoul($1, &end, 16);
36551f495578SKristof Provost 				if (errno || *end != '\0')
36561f495578SKristof Provost 					$$ = 256;
36571f495578SKristof Provost 			} else
36580cd7a91aSKristof Provost 				$$ = 256;		/* flag bad argument */
36590cd7a91aSKristof Provost 			if ($$ < 0 || $$ > 255) {
36603b3a8eb9SGleb Smirnoff 				yyerror("illegal tos value %s", $1);
36613b3a8eb9SGleb Smirnoff 				free($1);
36623b3a8eb9SGleb Smirnoff 				YYERROR;
36633b3a8eb9SGleb Smirnoff 			}
36643b3a8eb9SGleb Smirnoff 			free($1);
36653b3a8eb9SGleb Smirnoff 		}
36663b3a8eb9SGleb Smirnoff 		| NUMBER			{
36673b3a8eb9SGleb Smirnoff 			$$ = $1;
36680cd7a91aSKristof Provost 			if ($$ < 0 || $$ > 255) {
36693b3a8eb9SGleb Smirnoff 				yyerror("illegal tos value %s", $1);
36703b3a8eb9SGleb Smirnoff 				YYERROR;
36713b3a8eb9SGleb Smirnoff 			}
36723b3a8eb9SGleb Smirnoff 		}
36733b3a8eb9SGleb Smirnoff 		;
36743b3a8eb9SGleb Smirnoff 
36753b3a8eb9SGleb Smirnoff sourcetrack	: SOURCETRACK		{ $$ = PF_SRCTRACK; }
36763b3a8eb9SGleb Smirnoff 		| SOURCETRACK GLOBAL	{ $$ = PF_SRCTRACK_GLOBAL; }
36773b3a8eb9SGleb Smirnoff 		| SOURCETRACK RULE	{ $$ = PF_SRCTRACK_RULE; }
36783b3a8eb9SGleb Smirnoff 		;
36793b3a8eb9SGleb Smirnoff 
36803b3a8eb9SGleb Smirnoff statelock	: IFBOUND {
36813b3a8eb9SGleb Smirnoff 			$$ = PFRULE_IFBOUND;
36823b3a8eb9SGleb Smirnoff 		}
36833b3a8eb9SGleb Smirnoff 		| FLOATING {
36843b3a8eb9SGleb Smirnoff 			$$ = 0;
36853b3a8eb9SGleb Smirnoff 		}
36863b3a8eb9SGleb Smirnoff 		;
36873b3a8eb9SGleb Smirnoff 
36883b3a8eb9SGleb Smirnoff keep		: NO STATE			{
36893b3a8eb9SGleb Smirnoff 			$$.action = 0;
36903b3a8eb9SGleb Smirnoff 			$$.options = NULL;
36913b3a8eb9SGleb Smirnoff 		}
36923b3a8eb9SGleb Smirnoff 		| KEEP STATE state_opt_spec	{
36933b3a8eb9SGleb Smirnoff 			$$.action = PF_STATE_NORMAL;
36943b3a8eb9SGleb Smirnoff 			$$.options = $3;
36953b3a8eb9SGleb Smirnoff 		}
36963b3a8eb9SGleb Smirnoff 		| MODULATE STATE state_opt_spec {
36973b3a8eb9SGleb Smirnoff 			$$.action = PF_STATE_MODULATE;
36983b3a8eb9SGleb Smirnoff 			$$.options = $3;
36993b3a8eb9SGleb Smirnoff 		}
37003b3a8eb9SGleb Smirnoff 		| SYNPROXY STATE state_opt_spec {
37013b3a8eb9SGleb Smirnoff 			$$.action = PF_STATE_SYNPROXY;
37023b3a8eb9SGleb Smirnoff 			$$.options = $3;
37033b3a8eb9SGleb Smirnoff 		}
37043b3a8eb9SGleb Smirnoff 		;
37053b3a8eb9SGleb Smirnoff 
37063b3a8eb9SGleb Smirnoff flush		: /* empty */			{ $$ = 0; }
37073b3a8eb9SGleb Smirnoff 		| FLUSH				{ $$ = PF_FLUSH; }
37083b3a8eb9SGleb Smirnoff 		| FLUSH GLOBAL			{
37093b3a8eb9SGleb Smirnoff 			$$ = PF_FLUSH | PF_FLUSH_GLOBAL;
37103b3a8eb9SGleb Smirnoff 		}
37113b3a8eb9SGleb Smirnoff 		;
37123b3a8eb9SGleb Smirnoff 
37133b3a8eb9SGleb Smirnoff state_opt_spec	: '(' state_opt_list ')'	{ $$ = $2; }
37143b3a8eb9SGleb Smirnoff 		| /* empty */			{ $$ = NULL; }
37153b3a8eb9SGleb Smirnoff 		;
37163b3a8eb9SGleb Smirnoff 
37173b3a8eb9SGleb Smirnoff state_opt_list	: state_opt_item		{ $$ = $1; }
37183b3a8eb9SGleb Smirnoff 		| state_opt_list comma state_opt_item {
37193b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
37203b3a8eb9SGleb Smirnoff 			$1->tail = $3;
37213b3a8eb9SGleb Smirnoff 			$$ = $1;
37223b3a8eb9SGleb Smirnoff 		}
37233b3a8eb9SGleb Smirnoff 		;
37243b3a8eb9SGleb Smirnoff 
37253b3a8eb9SGleb Smirnoff state_opt_item	: MAXIMUM NUMBER		{
37263b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
37273b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
37283b3a8eb9SGleb Smirnoff 				YYERROR;
37293b3a8eb9SGleb Smirnoff 			}
37303b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
37313b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37323b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
37333b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX;
37343b3a8eb9SGleb Smirnoff 			$$->data.max_states = $2;
37353b3a8eb9SGleb Smirnoff 			$$->next = NULL;
37363b3a8eb9SGleb Smirnoff 			$$->tail = $$;
37373b3a8eb9SGleb Smirnoff 		}
37383b3a8eb9SGleb Smirnoff 		| NOSYNC				{
37393b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
37403b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37413b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
37423b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_NOSYNC;
37433b3a8eb9SGleb Smirnoff 			$$->next = NULL;
37443b3a8eb9SGleb Smirnoff 			$$->tail = $$;
37453b3a8eb9SGleb Smirnoff 		}
37463b3a8eb9SGleb Smirnoff 		| MAXSRCSTATES NUMBER			{
37473b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
37483b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
37493b3a8eb9SGleb Smirnoff 				YYERROR;
37503b3a8eb9SGleb Smirnoff 			}
37513b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
37523b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37533b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
37543b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_STATES;
37553b3a8eb9SGleb Smirnoff 			$$->data.max_src_states = $2;
37563b3a8eb9SGleb Smirnoff 			$$->next = NULL;
37573b3a8eb9SGleb Smirnoff 			$$->tail = $$;
37583b3a8eb9SGleb Smirnoff 		}
37593b3a8eb9SGleb Smirnoff 		| MAXSRCCONN NUMBER			{
37603b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
37613b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
37623b3a8eb9SGleb Smirnoff 				YYERROR;
37633b3a8eb9SGleb Smirnoff 			}
37643b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
37653b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37663b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
37673b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_CONN;
37683b3a8eb9SGleb Smirnoff 			$$->data.max_src_conn = $2;
37693b3a8eb9SGleb Smirnoff 			$$->next = NULL;
37703b3a8eb9SGleb Smirnoff 			$$->tail = $$;
37713b3a8eb9SGleb Smirnoff 		}
37723b3a8eb9SGleb Smirnoff 		| MAXSRCCONNRATE NUMBER '/' NUMBER	{
37733b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX ||
37743b3a8eb9SGleb Smirnoff 			    $4 < 0 || $4 > UINT_MAX) {
37753b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
37763b3a8eb9SGleb Smirnoff 				YYERROR;
37773b3a8eb9SGleb Smirnoff 			}
37783b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
37793b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37803b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
37813b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
37823b3a8eb9SGleb Smirnoff 			$$->data.max_src_conn_rate.limit = $2;
37833b3a8eb9SGleb Smirnoff 			$$->data.max_src_conn_rate.seconds = $4;
37843b3a8eb9SGleb Smirnoff 			$$->next = NULL;
37853b3a8eb9SGleb Smirnoff 			$$->tail = $$;
37863b3a8eb9SGleb Smirnoff 		}
37873b3a8eb9SGleb Smirnoff 		| OVERLOAD '<' STRING '>' flush		{
37883b3a8eb9SGleb Smirnoff 			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
37893b3a8eb9SGleb Smirnoff 				yyerror("table name '%s' too long", $3);
37903b3a8eb9SGleb Smirnoff 				free($3);
37913b3a8eb9SGleb Smirnoff 				YYERROR;
37923b3a8eb9SGleb Smirnoff 			}
37933b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
37943b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
37953b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
37963b3a8eb9SGleb Smirnoff 			if (strlcpy($$->data.overload.tblname, $3,
37973b3a8eb9SGleb Smirnoff 			    PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
37983b3a8eb9SGleb Smirnoff 				errx(1, "state_opt_item: strlcpy");
37993b3a8eb9SGleb Smirnoff 			free($3);
38003b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_OVERLOAD;
38013b3a8eb9SGleb Smirnoff 			$$->data.overload.flush = $5;
38023b3a8eb9SGleb Smirnoff 			$$->next = NULL;
38033b3a8eb9SGleb Smirnoff 			$$->tail = $$;
38043b3a8eb9SGleb Smirnoff 		}
38053b3a8eb9SGleb Smirnoff 		| MAXSRCNODES NUMBER			{
38063b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
38073b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
38083b3a8eb9SGleb Smirnoff 				YYERROR;
38093b3a8eb9SGleb Smirnoff 			}
38103b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
38113b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38123b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
38133b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_MAX_SRC_NODES;
38143b3a8eb9SGleb Smirnoff 			$$->data.max_src_nodes = $2;
38153b3a8eb9SGleb Smirnoff 			$$->next = NULL;
38163b3a8eb9SGleb Smirnoff 			$$->tail = $$;
38173b3a8eb9SGleb Smirnoff 		}
38183b3a8eb9SGleb Smirnoff 		| sourcetrack {
38193b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
38203b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38213b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
38223b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_SRCTRACK;
38233b3a8eb9SGleb Smirnoff 			$$->data.src_track = $1;
38243b3a8eb9SGleb Smirnoff 			$$->next = NULL;
38253b3a8eb9SGleb Smirnoff 			$$->tail = $$;
38263b3a8eb9SGleb Smirnoff 		}
38273b3a8eb9SGleb Smirnoff 		| statelock {
38283b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
38293b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38303b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
38313b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_STATELOCK;
38323b3a8eb9SGleb Smirnoff 			$$->data.statelock = $1;
38333b3a8eb9SGleb Smirnoff 			$$->next = NULL;
38343b3a8eb9SGleb Smirnoff 			$$->tail = $$;
38353b3a8eb9SGleb Smirnoff 		}
38363b3a8eb9SGleb Smirnoff 		| SLOPPY {
38373b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
38383b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38393b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
38403b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_SLOPPY;
38413b3a8eb9SGleb Smirnoff 			$$->next = NULL;
38423b3a8eb9SGleb Smirnoff 			$$->tail = $$;
38433b3a8eb9SGleb Smirnoff 		}
38443b3a8eb9SGleb Smirnoff 		| STRING NUMBER			{
38453b3a8eb9SGleb Smirnoff 			int	i;
38463b3a8eb9SGleb Smirnoff 
38473b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
38483b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
38493b3a8eb9SGleb Smirnoff 				YYERROR;
38503b3a8eb9SGleb Smirnoff 			}
38513b3a8eb9SGleb Smirnoff 			for (i = 0; pf_timeouts[i].name &&
38523b3a8eb9SGleb Smirnoff 			    strcmp(pf_timeouts[i].name, $1); ++i)
38533b3a8eb9SGleb Smirnoff 				;	/* nothing */
38543b3a8eb9SGleb Smirnoff 			if (!pf_timeouts[i].name) {
38553b3a8eb9SGleb Smirnoff 				yyerror("illegal timeout name %s", $1);
38563b3a8eb9SGleb Smirnoff 				free($1);
38573b3a8eb9SGleb Smirnoff 				YYERROR;
38583b3a8eb9SGleb Smirnoff 			}
38593b3a8eb9SGleb Smirnoff 			if (strchr(pf_timeouts[i].name, '.') == NULL) {
38603b3a8eb9SGleb Smirnoff 				yyerror("illegal state timeout %s", $1);
38613b3a8eb9SGleb Smirnoff 				free($1);
38623b3a8eb9SGleb Smirnoff 				YYERROR;
38633b3a8eb9SGleb Smirnoff 			}
38643b3a8eb9SGleb Smirnoff 			free($1);
38653b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_state_opt));
38663b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
38673b3a8eb9SGleb Smirnoff 				err(1, "state_opt_item: calloc");
38683b3a8eb9SGleb Smirnoff 			$$->type = PF_STATE_OPT_TIMEOUT;
38693b3a8eb9SGleb Smirnoff 			$$->data.timeout.number = pf_timeouts[i].timeout;
38703b3a8eb9SGleb Smirnoff 			$$->data.timeout.seconds = $2;
38713b3a8eb9SGleb Smirnoff 			$$->next = NULL;
38723b3a8eb9SGleb Smirnoff 			$$->tail = $$;
38733b3a8eb9SGleb Smirnoff 		}
38743b3a8eb9SGleb Smirnoff 		;
38753b3a8eb9SGleb Smirnoff 
38763b3a8eb9SGleb Smirnoff label		: LABEL STRING			{
38773b3a8eb9SGleb Smirnoff 			$$ = $2;
38783b3a8eb9SGleb Smirnoff 		}
38793b3a8eb9SGleb Smirnoff 		;
38803b3a8eb9SGleb Smirnoff 
38813b3a8eb9SGleb Smirnoff qname		: QUEUE STRING				{
38823b3a8eb9SGleb Smirnoff 			$$.qname = $2;
38833b3a8eb9SGleb Smirnoff 			$$.pqname = NULL;
38843b3a8eb9SGleb Smirnoff 		}
38853b3a8eb9SGleb Smirnoff 		| QUEUE '(' STRING ')'			{
38863b3a8eb9SGleb Smirnoff 			$$.qname = $3;
38873b3a8eb9SGleb Smirnoff 			$$.pqname = NULL;
38883b3a8eb9SGleb Smirnoff 		}
38893b3a8eb9SGleb Smirnoff 		| QUEUE '(' STRING comma STRING ')'	{
38903b3a8eb9SGleb Smirnoff 			$$.qname = $3;
38913b3a8eb9SGleb Smirnoff 			$$.pqname = $5;
38923b3a8eb9SGleb Smirnoff 		}
38933b3a8eb9SGleb Smirnoff 		;
38943b3a8eb9SGleb Smirnoff 
38953b3a8eb9SGleb Smirnoff no		: /* empty */			{ $$ = 0; }
38963b3a8eb9SGleb Smirnoff 		| NO				{ $$ = 1; }
38973b3a8eb9SGleb Smirnoff 		;
38983b3a8eb9SGleb Smirnoff 
38993b3a8eb9SGleb Smirnoff portstar	: numberstring			{
39003b3a8eb9SGleb Smirnoff 			if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) {
39013b3a8eb9SGleb Smirnoff 				free($1);
39023b3a8eb9SGleb Smirnoff 				YYERROR;
39033b3a8eb9SGleb Smirnoff 			}
39043b3a8eb9SGleb Smirnoff 			free($1);
39053b3a8eb9SGleb Smirnoff 		}
39063b3a8eb9SGleb Smirnoff 		;
39073b3a8eb9SGleb Smirnoff 
39083b3a8eb9SGleb Smirnoff redirspec	: host				{ $$ = $1; }
39093b3a8eb9SGleb Smirnoff 		| '{' optnl redir_host_list '}'	{ $$ = $3; }
39103b3a8eb9SGleb Smirnoff 		;
39113b3a8eb9SGleb Smirnoff 
39123b3a8eb9SGleb Smirnoff redir_host_list	: host optnl			{ $$ = $1; }
39133b3a8eb9SGleb Smirnoff 		| redir_host_list comma host optnl {
39143b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
39153b3a8eb9SGleb Smirnoff 			$1->tail = $3->tail;
39163b3a8eb9SGleb Smirnoff 			$$ = $1;
39173b3a8eb9SGleb Smirnoff 		}
39183b3a8eb9SGleb Smirnoff 		;
39193b3a8eb9SGleb Smirnoff 
39203b3a8eb9SGleb Smirnoff redirpool	: /* empty */			{ $$ = NULL; }
39213b3a8eb9SGleb Smirnoff 		| ARROW redirspec		{
39223b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
39233b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
39243b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
39253b3a8eb9SGleb Smirnoff 			$$->host = $2;
39263b3a8eb9SGleb Smirnoff 			$$->rport.a = $$->rport.b = $$->rport.t = 0;
39273b3a8eb9SGleb Smirnoff 		}
39283b3a8eb9SGleb Smirnoff 		| ARROW redirspec PORT portstar	{
39293b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
39303b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
39313b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
39323b3a8eb9SGleb Smirnoff 			$$->host = $2;
39333b3a8eb9SGleb Smirnoff 			$$->rport = $4;
39343b3a8eb9SGleb Smirnoff 		}
39353b3a8eb9SGleb Smirnoff 		;
39363b3a8eb9SGleb Smirnoff 
39373b3a8eb9SGleb Smirnoff hashkey		: /* empty */
39383b3a8eb9SGleb Smirnoff 		{
39393b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct pf_poolhashkey));
39403b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
39413b3a8eb9SGleb Smirnoff 				err(1, "hashkey: calloc");
39423b3a8eb9SGleb Smirnoff 			$$->key32[0] = arc4random();
39433b3a8eb9SGleb Smirnoff 			$$->key32[1] = arc4random();
39443b3a8eb9SGleb Smirnoff 			$$->key32[2] = arc4random();
39453b3a8eb9SGleb Smirnoff 			$$->key32[3] = arc4random();
39463b3a8eb9SGleb Smirnoff 		}
39473b3a8eb9SGleb Smirnoff 		| string
39483b3a8eb9SGleb Smirnoff 		{
39493b3a8eb9SGleb Smirnoff 			if (!strncmp($1, "0x", 2)) {
39503b3a8eb9SGleb Smirnoff 				if (strlen($1) != 34) {
39513b3a8eb9SGleb Smirnoff 					free($1);
39523b3a8eb9SGleb Smirnoff 					yyerror("hex key must be 128 bits "
39533b3a8eb9SGleb Smirnoff 						"(32 hex digits) long");
39543b3a8eb9SGleb Smirnoff 					YYERROR;
39553b3a8eb9SGleb Smirnoff 				}
39563b3a8eb9SGleb Smirnoff 				$$ = calloc(1, sizeof(struct pf_poolhashkey));
39573b3a8eb9SGleb Smirnoff 				if ($$ == NULL)
39583b3a8eb9SGleb Smirnoff 					err(1, "hashkey: calloc");
39593b3a8eb9SGleb Smirnoff 
39603b3a8eb9SGleb Smirnoff 				if (sscanf($1, "0x%8x%8x%8x%8x",
39613b3a8eb9SGleb Smirnoff 				    &$$->key32[0], &$$->key32[1],
39623b3a8eb9SGleb Smirnoff 				    &$$->key32[2], &$$->key32[3]) != 4) {
39633b3a8eb9SGleb Smirnoff 					free($$);
39643b3a8eb9SGleb Smirnoff 					free($1);
39653b3a8eb9SGleb Smirnoff 					yyerror("invalid hex key");
39663b3a8eb9SGleb Smirnoff 					YYERROR;
39673b3a8eb9SGleb Smirnoff 				}
39683b3a8eb9SGleb Smirnoff 			} else {
39693b3a8eb9SGleb Smirnoff 				MD5_CTX	context;
39703b3a8eb9SGleb Smirnoff 
39713b3a8eb9SGleb Smirnoff 				$$ = calloc(1, sizeof(struct pf_poolhashkey));
39723b3a8eb9SGleb Smirnoff 				if ($$ == NULL)
39733b3a8eb9SGleb Smirnoff 					err(1, "hashkey: calloc");
39743b3a8eb9SGleb Smirnoff 				MD5Init(&context);
39753b3a8eb9SGleb Smirnoff 				MD5Update(&context, (unsigned char *)$1,
39763b3a8eb9SGleb Smirnoff 				    strlen($1));
39773b3a8eb9SGleb Smirnoff 				MD5Final((unsigned char *)$$, &context);
39783b3a8eb9SGleb Smirnoff 				HTONL($$->key32[0]);
39793b3a8eb9SGleb Smirnoff 				HTONL($$->key32[1]);
39803b3a8eb9SGleb Smirnoff 				HTONL($$->key32[2]);
39813b3a8eb9SGleb Smirnoff 				HTONL($$->key32[3]);
39823b3a8eb9SGleb Smirnoff 			}
39833b3a8eb9SGleb Smirnoff 			free($1);
39843b3a8eb9SGleb Smirnoff 		}
39853b3a8eb9SGleb Smirnoff 		;
39863b3a8eb9SGleb Smirnoff 
39873b3a8eb9SGleb Smirnoff pool_opts	:	{ bzero(&pool_opts, sizeof pool_opts); }
39883b3a8eb9SGleb Smirnoff 		    pool_opts_l
39893b3a8eb9SGleb Smirnoff 			{ $$ = pool_opts; }
39903b3a8eb9SGleb Smirnoff 		| /* empty */	{
39913b3a8eb9SGleb Smirnoff 			bzero(&pool_opts, sizeof pool_opts);
39923b3a8eb9SGleb Smirnoff 			$$ = pool_opts;
39933b3a8eb9SGleb Smirnoff 		}
39943b3a8eb9SGleb Smirnoff 		;
39953b3a8eb9SGleb Smirnoff 
39963b3a8eb9SGleb Smirnoff pool_opts_l	: pool_opts_l pool_opt
39973b3a8eb9SGleb Smirnoff 		| pool_opt
39983b3a8eb9SGleb Smirnoff 		;
39993b3a8eb9SGleb Smirnoff 
40003b3a8eb9SGleb Smirnoff pool_opt	: BITMASK	{
40013b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
40023b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
40033b3a8eb9SGleb Smirnoff 				YYERROR;
40043b3a8eb9SGleb Smirnoff 			}
40053b3a8eb9SGleb Smirnoff 			pool_opts.type =  PF_POOL_BITMASK;
40063b3a8eb9SGleb Smirnoff 		}
40073b3a8eb9SGleb Smirnoff 		| RANDOM	{
40083b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
40093b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
40103b3a8eb9SGleb Smirnoff 				YYERROR;
40113b3a8eb9SGleb Smirnoff 			}
40123b3a8eb9SGleb Smirnoff 			pool_opts.type = PF_POOL_RANDOM;
40133b3a8eb9SGleb Smirnoff 		}
40143b3a8eb9SGleb Smirnoff 		| SOURCEHASH hashkey {
40153b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
40163b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
40173b3a8eb9SGleb Smirnoff 				YYERROR;
40183b3a8eb9SGleb Smirnoff 			}
40193b3a8eb9SGleb Smirnoff 			pool_opts.type = PF_POOL_SRCHASH;
40203b3a8eb9SGleb Smirnoff 			pool_opts.key = $2;
40213b3a8eb9SGleb Smirnoff 		}
40223b3a8eb9SGleb Smirnoff 		| ROUNDROBIN	{
40233b3a8eb9SGleb Smirnoff 			if (pool_opts.type) {
40243b3a8eb9SGleb Smirnoff 				yyerror("pool type cannot be redefined");
40253b3a8eb9SGleb Smirnoff 				YYERROR;
40263b3a8eb9SGleb Smirnoff 			}
40273b3a8eb9SGleb Smirnoff 			pool_opts.type = PF_POOL_ROUNDROBIN;
40283b3a8eb9SGleb Smirnoff 		}
40293b3a8eb9SGleb Smirnoff 		| STATICPORT	{
40303b3a8eb9SGleb Smirnoff 			if (pool_opts.staticport) {
40313b3a8eb9SGleb Smirnoff 				yyerror("static-port cannot be redefined");
40323b3a8eb9SGleb Smirnoff 				YYERROR;
40333b3a8eb9SGleb Smirnoff 			}
40343b3a8eb9SGleb Smirnoff 			pool_opts.staticport = 1;
40353b3a8eb9SGleb Smirnoff 		}
40363b3a8eb9SGleb Smirnoff 		| STICKYADDRESS	{
40373b3a8eb9SGleb Smirnoff 			if (filter_opts.marker & POM_STICKYADDRESS) {
40383b3a8eb9SGleb Smirnoff 				yyerror("sticky-address cannot be redefined");
40393b3a8eb9SGleb Smirnoff 				YYERROR;
40403b3a8eb9SGleb Smirnoff 			}
40413b3a8eb9SGleb Smirnoff 			pool_opts.marker |= POM_STICKYADDRESS;
40423b3a8eb9SGleb Smirnoff 			pool_opts.opts |= PF_POOL_STICKYADDR;
40433b3a8eb9SGleb Smirnoff 		}
40442aa21096SKurosawa Takahiro 		| MAPEPORTSET number '/' number '/' number {
40452aa21096SKurosawa Takahiro 			if (pool_opts.mape.offset) {
40462aa21096SKurosawa Takahiro 				yyerror("map-e-portset cannot be redefined");
40472aa21096SKurosawa Takahiro 				YYERROR;
40482aa21096SKurosawa Takahiro 			}
40492aa21096SKurosawa Takahiro 			if (pool_opts.type) {
40502aa21096SKurosawa Takahiro 				yyerror("map-e-portset cannot be used with "
40512aa21096SKurosawa Takahiro 					"address pools");
40522aa21096SKurosawa Takahiro 				YYERROR;
40532aa21096SKurosawa Takahiro 			}
40542aa21096SKurosawa Takahiro 			if ($2 <= 0 || $2 >= 16) {
40552aa21096SKurosawa Takahiro 				yyerror("MAP-E PSID offset must be 1-15");
40562aa21096SKurosawa Takahiro 				YYERROR;
40572aa21096SKurosawa Takahiro 			}
40582aa21096SKurosawa Takahiro 			if ($4 < 0 || $4 >= 16 || $2 + $4 > 16) {
40592aa21096SKurosawa Takahiro 				yyerror("Invalid MAP-E PSID length");
40602aa21096SKurosawa Takahiro 				YYERROR;
40612aa21096SKurosawa Takahiro 			} else if ($4 == 0) {
40622aa21096SKurosawa Takahiro 				yyerror("PSID Length = 0: this means"
40632aa21096SKurosawa Takahiro 				    " you do not need MAP-E");
40642aa21096SKurosawa Takahiro 				YYERROR;
40652aa21096SKurosawa Takahiro 			}
40662aa21096SKurosawa Takahiro 			if ($6 < 0 || $6 > 65535) {
40672aa21096SKurosawa Takahiro 				yyerror("Invalid MAP-E PSID");
40682aa21096SKurosawa Takahiro 				YYERROR;
40692aa21096SKurosawa Takahiro 			}
40702aa21096SKurosawa Takahiro 			pool_opts.mape.offset = $2;
40712aa21096SKurosawa Takahiro 			pool_opts.mape.psidlen = $4;
40722aa21096SKurosawa Takahiro 			pool_opts.mape.psid = $6;
40732aa21096SKurosawa Takahiro 		}
40743b3a8eb9SGleb Smirnoff 		;
40753b3a8eb9SGleb Smirnoff 
40763b3a8eb9SGleb Smirnoff redirection	: /* empty */			{ $$ = NULL; }
40773b3a8eb9SGleb Smirnoff 		| ARROW host			{
40783b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
40793b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
40803b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
40813b3a8eb9SGleb Smirnoff 			$$->host = $2;
40823b3a8eb9SGleb Smirnoff 			$$->rport.a = $$->rport.b = $$->rport.t = 0;
40833b3a8eb9SGleb Smirnoff 		}
40843b3a8eb9SGleb Smirnoff 		| ARROW host PORT portstar	{
40853b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct redirection));
40863b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
40873b3a8eb9SGleb Smirnoff 				err(1, "redirection: calloc");
40883b3a8eb9SGleb Smirnoff 			$$->host = $2;
40893b3a8eb9SGleb Smirnoff 			$$->rport = $4;
40903b3a8eb9SGleb Smirnoff 		}
40913b3a8eb9SGleb Smirnoff 		;
40923b3a8eb9SGleb Smirnoff 
40933b3a8eb9SGleb Smirnoff natpasslog	: /* empty */	{ $$.b1 = $$.b2 = 0; $$.w2 = 0; }
40943b3a8eb9SGleb Smirnoff 		| PASS		{ $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; }
40953b3a8eb9SGleb Smirnoff 		| PASS log	{ $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; }
40963b3a8eb9SGleb Smirnoff 		| log		{ $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; }
40973b3a8eb9SGleb Smirnoff 		;
40983b3a8eb9SGleb Smirnoff 
40993b3a8eb9SGleb Smirnoff nataction	: no NAT natpasslog {
41003b3a8eb9SGleb Smirnoff 			if ($1 && $3.b1) {
41013b3a8eb9SGleb Smirnoff 				yyerror("\"pass\" not valid with \"no\"");
41023b3a8eb9SGleb Smirnoff 				YYERROR;
41033b3a8eb9SGleb Smirnoff 			}
41043b3a8eb9SGleb Smirnoff 			if ($1)
41053b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NONAT;
41063b3a8eb9SGleb Smirnoff 			else
41073b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NAT;
41083b3a8eb9SGleb Smirnoff 			$$.b2 = $3.b1;
41093b3a8eb9SGleb Smirnoff 			$$.w = $3.b2;
41103b3a8eb9SGleb Smirnoff 			$$.w2 = $3.w2;
41113b3a8eb9SGleb Smirnoff 		}
41123b3a8eb9SGleb Smirnoff 		| no RDR natpasslog {
41133b3a8eb9SGleb Smirnoff 			if ($1 && $3.b1) {
41143b3a8eb9SGleb Smirnoff 				yyerror("\"pass\" not valid with \"no\"");
41153b3a8eb9SGleb Smirnoff 				YYERROR;
41163b3a8eb9SGleb Smirnoff 			}
41173b3a8eb9SGleb Smirnoff 			if ($1)
41183b3a8eb9SGleb Smirnoff 				$$.b1 = PF_NORDR;
41193b3a8eb9SGleb Smirnoff 			else
41203b3a8eb9SGleb Smirnoff 				$$.b1 = PF_RDR;
41213b3a8eb9SGleb Smirnoff 			$$.b2 = $3.b1;
41223b3a8eb9SGleb Smirnoff 			$$.w = $3.b2;
41233b3a8eb9SGleb Smirnoff 			$$.w2 = $3.w2;
41243b3a8eb9SGleb Smirnoff 		}
41253b3a8eb9SGleb Smirnoff 		;
41263b3a8eb9SGleb Smirnoff 
41273b3a8eb9SGleb Smirnoff natrule		: nataction interface af proto fromto tag tagged rtable
41283b3a8eb9SGleb Smirnoff 		    redirpool pool_opts
41293b3a8eb9SGleb Smirnoff 		{
4130e9eb0941SKristof Provost 			struct pfctl_rule	r;
41313b3a8eb9SGleb Smirnoff 
41323b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT))
41333b3a8eb9SGleb Smirnoff 				YYERROR;
41343b3a8eb9SGleb Smirnoff 
41353b3a8eb9SGleb Smirnoff 			memset(&r, 0, sizeof(r));
41363b3a8eb9SGleb Smirnoff 
41373b3a8eb9SGleb Smirnoff 			r.action = $1.b1;
41383b3a8eb9SGleb Smirnoff 			r.natpass = $1.b2;
41393b3a8eb9SGleb Smirnoff 			r.log = $1.w;
41403b3a8eb9SGleb Smirnoff 			r.logif = $1.w2;
41413b3a8eb9SGleb Smirnoff 			r.af = $3;
41423b3a8eb9SGleb Smirnoff 
41433b3a8eb9SGleb Smirnoff 			if (!r.af) {
41443b3a8eb9SGleb Smirnoff 				if ($5.src.host && $5.src.host->af &&
41453b3a8eb9SGleb Smirnoff 				    !$5.src.host->ifindex)
41463b3a8eb9SGleb Smirnoff 					r.af = $5.src.host->af;
41473b3a8eb9SGleb Smirnoff 				else if ($5.dst.host && $5.dst.host->af &&
41483b3a8eb9SGleb Smirnoff 				    !$5.dst.host->ifindex)
41493b3a8eb9SGleb Smirnoff 					r.af = $5.dst.host->af;
41503b3a8eb9SGleb Smirnoff 			}
41513b3a8eb9SGleb Smirnoff 
41523b3a8eb9SGleb Smirnoff 			if ($6 != NULL)
41533b3a8eb9SGleb Smirnoff 				if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
41543b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) {
41553b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
41563b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
41573b3a8eb9SGleb Smirnoff 					YYERROR;
41583b3a8eb9SGleb Smirnoff 				}
41593b3a8eb9SGleb Smirnoff 
41603b3a8eb9SGleb Smirnoff 			if ($7.name)
41613b3a8eb9SGleb Smirnoff 				if (strlcpy(r.match_tagname, $7.name,
41623b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
41633b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
41643b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
41653b3a8eb9SGleb Smirnoff 					YYERROR;
41663b3a8eb9SGleb Smirnoff 				}
41673b3a8eb9SGleb Smirnoff 			r.match_tag_not = $7.neg;
41683b3a8eb9SGleb Smirnoff 			r.rtableid = $8;
41693b3a8eb9SGleb Smirnoff 
41703b3a8eb9SGleb Smirnoff 			if (r.action == PF_NONAT || r.action == PF_NORDR) {
41713b3a8eb9SGleb Smirnoff 				if ($9 != NULL) {
41723b3a8eb9SGleb Smirnoff 					yyerror("translation rule with 'no' "
41733b3a8eb9SGleb Smirnoff 					    "does not need '->'");
41743b3a8eb9SGleb Smirnoff 					YYERROR;
41753b3a8eb9SGleb Smirnoff 				}
41763b3a8eb9SGleb Smirnoff 			} else {
41773b3a8eb9SGleb Smirnoff 				if ($9 == NULL || $9->host == NULL) {
41783b3a8eb9SGleb Smirnoff 					yyerror("translation rule requires '-> "
41793b3a8eb9SGleb Smirnoff 					    "address'");
41803b3a8eb9SGleb Smirnoff 					YYERROR;
41813b3a8eb9SGleb Smirnoff 				}
41823b3a8eb9SGleb Smirnoff 				if (!r.af && ! $9->host->ifindex)
41833b3a8eb9SGleb Smirnoff 					r.af = $9->host->af;
41843b3a8eb9SGleb Smirnoff 
41853b3a8eb9SGleb Smirnoff 				remove_invalid_hosts(&$9->host, &r.af);
41863b3a8eb9SGleb Smirnoff 				if (invalid_redirect($9->host, r.af))
41873b3a8eb9SGleb Smirnoff 					YYERROR;
41883b3a8eb9SGleb Smirnoff 				if (check_netmask($9->host, r.af))
41893b3a8eb9SGleb Smirnoff 					YYERROR;
41903b3a8eb9SGleb Smirnoff 
41913b3a8eb9SGleb Smirnoff 				r.rpool.proxy_port[0] = ntohs($9->rport.a);
41923b3a8eb9SGleb Smirnoff 
41933b3a8eb9SGleb Smirnoff 				switch (r.action) {
41943b3a8eb9SGleb Smirnoff 				case PF_RDR:
41953b3a8eb9SGleb Smirnoff 					if (!$9->rport.b && $9->rport.t &&
41963b3a8eb9SGleb Smirnoff 					    $5.dst.port != NULL) {
41973b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
41983b3a8eb9SGleb Smirnoff 						    ntohs($9->rport.a) +
41993b3a8eb9SGleb Smirnoff 						    (ntohs(
42003b3a8eb9SGleb Smirnoff 						    $5.dst.port->port[1]) -
42013b3a8eb9SGleb Smirnoff 						    ntohs(
42023b3a8eb9SGleb Smirnoff 						    $5.dst.port->port[0]));
42033b3a8eb9SGleb Smirnoff 					} else
42043b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
42053b3a8eb9SGleb Smirnoff 						    ntohs($9->rport.b);
42063b3a8eb9SGleb Smirnoff 					break;
42073b3a8eb9SGleb Smirnoff 				case PF_NAT:
42083b3a8eb9SGleb Smirnoff 					r.rpool.proxy_port[1] =
42093b3a8eb9SGleb Smirnoff 					    ntohs($9->rport.b);
42103b3a8eb9SGleb Smirnoff 					if (!r.rpool.proxy_port[0] &&
42113b3a8eb9SGleb Smirnoff 					    !r.rpool.proxy_port[1]) {
42123b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[0] =
42133b3a8eb9SGleb Smirnoff 						    PF_NAT_PROXY_PORT_LOW;
42143b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
42153b3a8eb9SGleb Smirnoff 						    PF_NAT_PROXY_PORT_HIGH;
42163b3a8eb9SGleb Smirnoff 					} else if (!r.rpool.proxy_port[1])
42173b3a8eb9SGleb Smirnoff 						r.rpool.proxy_port[1] =
42183b3a8eb9SGleb Smirnoff 						    r.rpool.proxy_port[0];
42193b3a8eb9SGleb Smirnoff 					break;
42203b3a8eb9SGleb Smirnoff 				default:
42213b3a8eb9SGleb Smirnoff 					break;
42223b3a8eb9SGleb Smirnoff 				}
42233b3a8eb9SGleb Smirnoff 
42243b3a8eb9SGleb Smirnoff 				r.rpool.opts = $10.type;
42253b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
42263b3a8eb9SGleb Smirnoff 				    PF_POOL_NONE && ($9->host->next != NULL ||
42273b3a8eb9SGleb Smirnoff 				    $9->host->addr.type == PF_ADDR_TABLE ||
42283b3a8eb9SGleb Smirnoff 				    DYNIF_MULTIADDR($9->host->addr)))
42293b3a8eb9SGleb Smirnoff 					r.rpool.opts = PF_POOL_ROUNDROBIN;
42303b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
42313b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
42323b3a8eb9SGleb Smirnoff 				    disallow_table($9->host, "tables are only "
42333b3a8eb9SGleb Smirnoff 				    "supported in round-robin redirection "
42343b3a8eb9SGleb Smirnoff 				    "pools"))
42353b3a8eb9SGleb Smirnoff 					YYERROR;
42363b3a8eb9SGleb Smirnoff 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
42373b3a8eb9SGleb Smirnoff 				    PF_POOL_ROUNDROBIN &&
42383b3a8eb9SGleb Smirnoff 				    disallow_alias($9->host, "interface (%s) "
42393b3a8eb9SGleb Smirnoff 				    "is only supported in round-robin "
42403b3a8eb9SGleb Smirnoff 				    "redirection pools"))
42413b3a8eb9SGleb Smirnoff 					YYERROR;
42423b3a8eb9SGleb Smirnoff 				if ($9->host->next != NULL) {
42433b3a8eb9SGleb Smirnoff 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
42443b3a8eb9SGleb Smirnoff 					    PF_POOL_ROUNDROBIN) {
42453b3a8eb9SGleb Smirnoff 						yyerror("only round-robin "
42463b3a8eb9SGleb Smirnoff 						    "valid for multiple "
42473b3a8eb9SGleb Smirnoff 						    "redirection addresses");
42483b3a8eb9SGleb Smirnoff 						YYERROR;
42493b3a8eb9SGleb Smirnoff 					}
42503b3a8eb9SGleb Smirnoff 				}
42513b3a8eb9SGleb Smirnoff 			}
42523b3a8eb9SGleb Smirnoff 
42533b3a8eb9SGleb Smirnoff 			if ($10.key != NULL)
42543b3a8eb9SGleb Smirnoff 				memcpy(&r.rpool.key, $10.key,
42553b3a8eb9SGleb Smirnoff 				    sizeof(struct pf_poolhashkey));
42563b3a8eb9SGleb Smirnoff 
42573b3a8eb9SGleb Smirnoff 			 if ($10.opts)
42583b3a8eb9SGleb Smirnoff 				r.rpool.opts |= $10.opts;
42593b3a8eb9SGleb Smirnoff 
42603b3a8eb9SGleb Smirnoff 			if ($10.staticport) {
42613b3a8eb9SGleb Smirnoff 				if (r.action != PF_NAT) {
42623b3a8eb9SGleb Smirnoff 					yyerror("the 'static-port' option is "
42633b3a8eb9SGleb Smirnoff 					    "only valid with nat rules");
42643b3a8eb9SGleb Smirnoff 					YYERROR;
42653b3a8eb9SGleb Smirnoff 				}
42663b3a8eb9SGleb Smirnoff 				if (r.rpool.proxy_port[0] !=
42673b3a8eb9SGleb Smirnoff 				    PF_NAT_PROXY_PORT_LOW &&
42683b3a8eb9SGleb Smirnoff 				    r.rpool.proxy_port[1] !=
42693b3a8eb9SGleb Smirnoff 				    PF_NAT_PROXY_PORT_HIGH) {
42703b3a8eb9SGleb Smirnoff 					yyerror("the 'static-port' option can't"
42713b3a8eb9SGleb Smirnoff 					    " be used when specifying a port"
42723b3a8eb9SGleb Smirnoff 					    " range");
42733b3a8eb9SGleb Smirnoff 					YYERROR;
42743b3a8eb9SGleb Smirnoff 				}
42753b3a8eb9SGleb Smirnoff 				r.rpool.proxy_port[0] = 0;
42763b3a8eb9SGleb Smirnoff 				r.rpool.proxy_port[1] = 0;
42773b3a8eb9SGleb Smirnoff 			}
42783b3a8eb9SGleb Smirnoff 
42792aa21096SKurosawa Takahiro 			if ($10.mape.offset) {
42802aa21096SKurosawa Takahiro 				if (r.action != PF_NAT) {
42812aa21096SKurosawa Takahiro 					yyerror("the 'map-e-portset' option is"
42822aa21096SKurosawa Takahiro 					    " only valid with nat rules");
42832aa21096SKurosawa Takahiro 					YYERROR;
42842aa21096SKurosawa Takahiro 				}
42852aa21096SKurosawa Takahiro 				if ($10.staticport) {
42862aa21096SKurosawa Takahiro 					yyerror("the 'map-e-portset' option"
42872aa21096SKurosawa Takahiro 					    " can't be used 'static-port'");
42882aa21096SKurosawa Takahiro 					YYERROR;
42892aa21096SKurosawa Takahiro 				}
42902aa21096SKurosawa Takahiro 				if (r.rpool.proxy_port[0] !=
42912aa21096SKurosawa Takahiro 				    PF_NAT_PROXY_PORT_LOW &&
42922aa21096SKurosawa Takahiro 				    r.rpool.proxy_port[1] !=
42932aa21096SKurosawa Takahiro 				    PF_NAT_PROXY_PORT_HIGH) {
42942aa21096SKurosawa Takahiro 					yyerror("the 'map-e-portset' option"
42952aa21096SKurosawa Takahiro 					    " can't be used when specifying"
42962aa21096SKurosawa Takahiro 					    " a port range");
42972aa21096SKurosawa Takahiro 					YYERROR;
42982aa21096SKurosawa Takahiro 				}
42992aa21096SKurosawa Takahiro 				r.rpool.mape = $10.mape;
43002aa21096SKurosawa Takahiro 			}
43012aa21096SKurosawa Takahiro 
43023b3a8eb9SGleb Smirnoff 			expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4,
43033b3a8eb9SGleb Smirnoff 			    $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
43043b3a8eb9SGleb Smirnoff 			    $5.dst.port, 0, 0, 0, "");
43053b3a8eb9SGleb Smirnoff 			free($9);
43063b3a8eb9SGleb Smirnoff 		}
43073b3a8eb9SGleb Smirnoff 		;
43083b3a8eb9SGleb Smirnoff 
43091e93588bSLuiz Otavio O Souza binatrule	: no BINAT natpasslog interface af proto FROM ipspec toipspec tag
43103b3a8eb9SGleb Smirnoff 		    tagged rtable redirection
43113b3a8eb9SGleb Smirnoff 		{
4312e9eb0941SKristof Provost 			struct pfctl_rule	binat;
43133b3a8eb9SGleb Smirnoff 			struct pf_pooladdr	*pa;
43143b3a8eb9SGleb Smirnoff 
43153b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_NAT))
43163b3a8eb9SGleb Smirnoff 				YYERROR;
43173b3a8eb9SGleb Smirnoff 			if (disallow_urpf_failed($9, "\"urpf-failed\" is not "
43183b3a8eb9SGleb Smirnoff 			    "permitted as a binat destination"))
43193b3a8eb9SGleb Smirnoff 				YYERROR;
43203b3a8eb9SGleb Smirnoff 
43213b3a8eb9SGleb Smirnoff 			memset(&binat, 0, sizeof(binat));
43223b3a8eb9SGleb Smirnoff 
43233b3a8eb9SGleb Smirnoff 			if ($1 && $3.b1) {
43243b3a8eb9SGleb Smirnoff 				yyerror("\"pass\" not valid with \"no\"");
43253b3a8eb9SGleb Smirnoff 				YYERROR;
43263b3a8eb9SGleb Smirnoff 			}
43273b3a8eb9SGleb Smirnoff 			if ($1)
43283b3a8eb9SGleb Smirnoff 				binat.action = PF_NOBINAT;
43293b3a8eb9SGleb Smirnoff 			else
43303b3a8eb9SGleb Smirnoff 				binat.action = PF_BINAT;
43313b3a8eb9SGleb Smirnoff 			binat.natpass = $3.b1;
43323b3a8eb9SGleb Smirnoff 			binat.log = $3.b2;
43333b3a8eb9SGleb Smirnoff 			binat.logif = $3.w2;
43343b3a8eb9SGleb Smirnoff 			binat.af = $5;
43353b3a8eb9SGleb Smirnoff 			if (!binat.af && $8 != NULL && $8->af)
43363b3a8eb9SGleb Smirnoff 				binat.af = $8->af;
43373b3a8eb9SGleb Smirnoff 			if (!binat.af && $9 != NULL && $9->af)
43383b3a8eb9SGleb Smirnoff 				binat.af = $9->af;
43393b3a8eb9SGleb Smirnoff 
43403b3a8eb9SGleb Smirnoff 			if (!binat.af && $13 != NULL && $13->host)
43413b3a8eb9SGleb Smirnoff 				binat.af = $13->host->af;
43423b3a8eb9SGleb Smirnoff 			if (!binat.af) {
43433b3a8eb9SGleb Smirnoff 				yyerror("address family (inet/inet6) "
43443b3a8eb9SGleb Smirnoff 				    "undefined");
43453b3a8eb9SGleb Smirnoff 				YYERROR;
43463b3a8eb9SGleb Smirnoff 			}
43473b3a8eb9SGleb Smirnoff 
43483b3a8eb9SGleb Smirnoff 			if ($4 != NULL) {
43493b3a8eb9SGleb Smirnoff 				memcpy(binat.ifname, $4->ifname,
43503b3a8eb9SGleb Smirnoff 				    sizeof(binat.ifname));
43513b3a8eb9SGleb Smirnoff 				binat.ifnot = $4->not;
43523b3a8eb9SGleb Smirnoff 				free($4);
43533b3a8eb9SGleb Smirnoff 			}
43543b3a8eb9SGleb Smirnoff 
43553b3a8eb9SGleb Smirnoff 			if ($10 != NULL)
43563b3a8eb9SGleb Smirnoff 				if (strlcpy(binat.tagname, $10,
43573b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
43583b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
43593b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
43603b3a8eb9SGleb Smirnoff 					YYERROR;
43613b3a8eb9SGleb Smirnoff 				}
43623b3a8eb9SGleb Smirnoff 			if ($11.name)
43633b3a8eb9SGleb Smirnoff 				if (strlcpy(binat.match_tagname, $11.name,
43643b3a8eb9SGleb Smirnoff 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
43653b3a8eb9SGleb Smirnoff 					yyerror("tag too long, max %u chars",
43663b3a8eb9SGleb Smirnoff 					    PF_TAG_NAME_SIZE - 1);
43673b3a8eb9SGleb Smirnoff 					YYERROR;
43683b3a8eb9SGleb Smirnoff 				}
43693b3a8eb9SGleb Smirnoff 			binat.match_tag_not = $11.neg;
43703b3a8eb9SGleb Smirnoff 			binat.rtableid = $12;
43713b3a8eb9SGleb Smirnoff 
43723b3a8eb9SGleb Smirnoff 			if ($6 != NULL) {
43733b3a8eb9SGleb Smirnoff 				binat.proto = $6->proto;
43743b3a8eb9SGleb Smirnoff 				free($6);
43753b3a8eb9SGleb Smirnoff 			}
43763b3a8eb9SGleb Smirnoff 
43773b3a8eb9SGleb Smirnoff 			if ($8 != NULL && disallow_table($8, "invalid use of "
43783b3a8eb9SGleb Smirnoff 			    "table <%s> as the source address of a binat rule"))
43793b3a8eb9SGleb Smirnoff 				YYERROR;
43803b3a8eb9SGleb Smirnoff 			if ($8 != NULL && disallow_alias($8, "invalid use of "
43813b3a8eb9SGleb Smirnoff 			    "interface (%s) as the source address of a binat "
43823b3a8eb9SGleb Smirnoff 			    "rule"))
43833b3a8eb9SGleb Smirnoff 				YYERROR;
43843b3a8eb9SGleb Smirnoff 			if ($13 != NULL && $13->host != NULL && disallow_table(
43853b3a8eb9SGleb Smirnoff 			    $13->host, "invalid use of table <%s> as the "
43863b3a8eb9SGleb Smirnoff 			    "redirect address of a binat rule"))
43873b3a8eb9SGleb Smirnoff 				YYERROR;
43883b3a8eb9SGleb Smirnoff 			if ($13 != NULL && $13->host != NULL && disallow_alias(
43893b3a8eb9SGleb Smirnoff 			    $13->host, "invalid use of interface (%s) as the "
43903b3a8eb9SGleb Smirnoff 			    "redirect address of a binat rule"))
43913b3a8eb9SGleb Smirnoff 				YYERROR;
43923b3a8eb9SGleb Smirnoff 
43933b3a8eb9SGleb Smirnoff 			if ($8 != NULL) {
43943b3a8eb9SGleb Smirnoff 				if ($8->next) {
43953b3a8eb9SGleb Smirnoff 					yyerror("multiple binat ip addresses");
43963b3a8eb9SGleb Smirnoff 					YYERROR;
43973b3a8eb9SGleb Smirnoff 				}
43983b3a8eb9SGleb Smirnoff 				if ($8->addr.type == PF_ADDR_DYNIFTL)
43993b3a8eb9SGleb Smirnoff 					$8->af = binat.af;
44003b3a8eb9SGleb Smirnoff 				if ($8->af != binat.af) {
44013b3a8eb9SGleb Smirnoff 					yyerror("binat ip versions must match");
44023b3a8eb9SGleb Smirnoff 					YYERROR;
44033b3a8eb9SGleb Smirnoff 				}
44043b3a8eb9SGleb Smirnoff 				if (check_netmask($8, binat.af))
44053b3a8eb9SGleb Smirnoff 					YYERROR;
44063b3a8eb9SGleb Smirnoff 				memcpy(&binat.src.addr, &$8->addr,
44073b3a8eb9SGleb Smirnoff 				    sizeof(binat.src.addr));
44083b3a8eb9SGleb Smirnoff 				free($8);
44093b3a8eb9SGleb Smirnoff 			}
44103b3a8eb9SGleb Smirnoff 			if ($9 != NULL) {
44113b3a8eb9SGleb Smirnoff 				if ($9->next) {
44123b3a8eb9SGleb Smirnoff 					yyerror("multiple binat ip addresses");
44133b3a8eb9SGleb Smirnoff 					YYERROR;
44143b3a8eb9SGleb Smirnoff 				}
44153b3a8eb9SGleb Smirnoff 				if ($9->af != binat.af && $9->af) {
44163b3a8eb9SGleb Smirnoff 					yyerror("binat ip versions must match");
44173b3a8eb9SGleb Smirnoff 					YYERROR;
44183b3a8eb9SGleb Smirnoff 				}
44193b3a8eb9SGleb Smirnoff 				if (check_netmask($9, binat.af))
44203b3a8eb9SGleb Smirnoff 					YYERROR;
44213b3a8eb9SGleb Smirnoff 				memcpy(&binat.dst.addr, &$9->addr,
44223b3a8eb9SGleb Smirnoff 				    sizeof(binat.dst.addr));
44233b3a8eb9SGleb Smirnoff 				binat.dst.neg = $9->not;
44243b3a8eb9SGleb Smirnoff 				free($9);
44253b3a8eb9SGleb Smirnoff 			}
44263b3a8eb9SGleb Smirnoff 
44273b3a8eb9SGleb Smirnoff 			if (binat.action == PF_NOBINAT) {
44283b3a8eb9SGleb Smirnoff 				if ($13 != NULL) {
44293b3a8eb9SGleb Smirnoff 					yyerror("'no binat' rule does not need"
44303b3a8eb9SGleb Smirnoff 					    " '->'");
44313b3a8eb9SGleb Smirnoff 					YYERROR;
44323b3a8eb9SGleb Smirnoff 				}
44333b3a8eb9SGleb Smirnoff 			} else {
44343b3a8eb9SGleb Smirnoff 				if ($13 == NULL || $13->host == NULL) {
44353b3a8eb9SGleb Smirnoff 					yyerror("'binat' rule requires"
44363b3a8eb9SGleb Smirnoff 					    " '-> address'");
44373b3a8eb9SGleb Smirnoff 					YYERROR;
44383b3a8eb9SGleb Smirnoff 				}
44393b3a8eb9SGleb Smirnoff 
44403b3a8eb9SGleb Smirnoff 				remove_invalid_hosts(&$13->host, &binat.af);
44413b3a8eb9SGleb Smirnoff 				if (invalid_redirect($13->host, binat.af))
44423b3a8eb9SGleb Smirnoff 					YYERROR;
44433b3a8eb9SGleb Smirnoff 				if ($13->host->next != NULL) {
44443b3a8eb9SGleb Smirnoff 					yyerror("binat rule must redirect to "
44453b3a8eb9SGleb Smirnoff 					    "a single address");
44463b3a8eb9SGleb Smirnoff 					YYERROR;
44473b3a8eb9SGleb Smirnoff 				}
44483b3a8eb9SGleb Smirnoff 				if (check_netmask($13->host, binat.af))
44493b3a8eb9SGleb Smirnoff 					YYERROR;
44503b3a8eb9SGleb Smirnoff 
44513b3a8eb9SGleb Smirnoff 				if (!PF_AZERO(&binat.src.addr.v.a.mask,
44523b3a8eb9SGleb Smirnoff 				    binat.af) &&
44533b3a8eb9SGleb Smirnoff 				    !PF_AEQ(&binat.src.addr.v.a.mask,
44543b3a8eb9SGleb Smirnoff 				    &$13->host->addr.v.a.mask, binat.af)) {
44553b3a8eb9SGleb Smirnoff 					yyerror("'binat' source mask and "
44563b3a8eb9SGleb Smirnoff 					    "redirect mask must be the same");
44573b3a8eb9SGleb Smirnoff 					YYERROR;
44583b3a8eb9SGleb Smirnoff 				}
44593b3a8eb9SGleb Smirnoff 
44603b3a8eb9SGleb Smirnoff 				TAILQ_INIT(&binat.rpool.list);
44613b3a8eb9SGleb Smirnoff 				pa = calloc(1, sizeof(struct pf_pooladdr));
44623b3a8eb9SGleb Smirnoff 				if (pa == NULL)
44633b3a8eb9SGleb Smirnoff 					err(1, "binat: calloc");
44643b3a8eb9SGleb Smirnoff 				pa->addr = $13->host->addr;
44653b3a8eb9SGleb Smirnoff 				pa->ifname[0] = 0;
44663b3a8eb9SGleb Smirnoff 				TAILQ_INSERT_TAIL(&binat.rpool.list,
44673b3a8eb9SGleb Smirnoff 				    pa, entries);
44683b3a8eb9SGleb Smirnoff 
44693b3a8eb9SGleb Smirnoff 				free($13);
44703b3a8eb9SGleb Smirnoff 			}
44713b3a8eb9SGleb Smirnoff 
44720d71f9f3SKristof Provost 			pfctl_append_rule(pf, &binat, "");
44733b3a8eb9SGleb Smirnoff 		}
44743b3a8eb9SGleb Smirnoff 		;
44753b3a8eb9SGleb Smirnoff 
44763b3a8eb9SGleb Smirnoff tag		: /* empty */		{ $$ = NULL; }
44773b3a8eb9SGleb Smirnoff 		| TAG STRING		{ $$ = $2; }
44783b3a8eb9SGleb Smirnoff 		;
44793b3a8eb9SGleb Smirnoff 
44803b3a8eb9SGleb Smirnoff tagged		: /* empty */		{ $$.neg = 0; $$.name = NULL; }
44813b3a8eb9SGleb Smirnoff 		| not TAGGED string	{ $$.neg = $1; $$.name = $3; }
44823b3a8eb9SGleb Smirnoff 		;
44833b3a8eb9SGleb Smirnoff 
44843b3a8eb9SGleb Smirnoff rtable		: /* empty */		{ $$ = -1; }
44853b3a8eb9SGleb Smirnoff 		| RTABLE NUMBER		{
44863b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > rt_tableid_max()) {
44873b3a8eb9SGleb Smirnoff 				yyerror("invalid rtable id");
44883b3a8eb9SGleb Smirnoff 				YYERROR;
44893b3a8eb9SGleb Smirnoff 			}
44903b3a8eb9SGleb Smirnoff 			$$ = $2;
44913b3a8eb9SGleb Smirnoff 		}
44923b3a8eb9SGleb Smirnoff 		;
44933b3a8eb9SGleb Smirnoff 
44943b3a8eb9SGleb Smirnoff route_host	: STRING			{
44953b3a8eb9SGleb Smirnoff 			$$ = calloc(1, sizeof(struct node_host));
44963b3a8eb9SGleb Smirnoff 			if ($$ == NULL)
44973b3a8eb9SGleb Smirnoff 				err(1, "route_host: calloc");
4498a2a90d6eSKristof Provost 			$$->ifname = strdup($1);
44993b3a8eb9SGleb Smirnoff 			set_ipmask($$, 128);
45003b3a8eb9SGleb Smirnoff 			$$->next = NULL;
45013b3a8eb9SGleb Smirnoff 			$$->tail = $$;
45023b3a8eb9SGleb Smirnoff 		}
45033b3a8eb9SGleb Smirnoff 		| '(' STRING host ')'		{
450458c8430aSKristof Provost 			struct node_host *n;
450558c8430aSKristof Provost 
45063b3a8eb9SGleb Smirnoff 			$$ = $3;
450758c8430aSKristof Provost 			for (n = $3; n != NULL; n = n->next)
4508a2a90d6eSKristof Provost 				n->ifname = strdup($2);
45093b3a8eb9SGleb Smirnoff 		}
45103b3a8eb9SGleb Smirnoff 		;
45113b3a8eb9SGleb Smirnoff 
45123b3a8eb9SGleb Smirnoff route_host_list	: route_host optnl			{ $$ = $1; }
45133b3a8eb9SGleb Smirnoff 		| route_host_list comma route_host optnl {
45143b3a8eb9SGleb Smirnoff 			if ($1->af == 0)
45153b3a8eb9SGleb Smirnoff 				$1->af = $3->af;
45163b3a8eb9SGleb Smirnoff 			if ($1->af != $3->af) {
45173b3a8eb9SGleb Smirnoff 				yyerror("all pool addresses must be in the "
45183b3a8eb9SGleb Smirnoff 				    "same address family");
45193b3a8eb9SGleb Smirnoff 				YYERROR;
45203b3a8eb9SGleb Smirnoff 			}
45213b3a8eb9SGleb Smirnoff 			$1->tail->next = $3;
45223b3a8eb9SGleb Smirnoff 			$1->tail = $3->tail;
45233b3a8eb9SGleb Smirnoff 			$$ = $1;
45243b3a8eb9SGleb Smirnoff 		}
45253b3a8eb9SGleb Smirnoff 		;
45263b3a8eb9SGleb Smirnoff 
45273b3a8eb9SGleb Smirnoff routespec	: route_host			{ $$ = $1; }
45283b3a8eb9SGleb Smirnoff 		| '{' optnl route_host_list '}'	{ $$ = $3; }
45293b3a8eb9SGleb Smirnoff 		;
45303b3a8eb9SGleb Smirnoff 
45313b3a8eb9SGleb Smirnoff route		: /* empty */			{
45323b3a8eb9SGleb Smirnoff 			$$.host = NULL;
45333b3a8eb9SGleb Smirnoff 			$$.rt = 0;
45343b3a8eb9SGleb Smirnoff 			$$.pool_opts = 0;
45353b3a8eb9SGleb Smirnoff 		}
45363b3a8eb9SGleb Smirnoff 		| FASTROUTE {
4537813196a1SKristof Provost 			/* backwards-compat */
45383b3a8eb9SGleb Smirnoff 			$$.host = NULL;
4539813196a1SKristof Provost 			$$.rt = 0;
45403b3a8eb9SGleb Smirnoff 			$$.pool_opts = 0;
45413b3a8eb9SGleb Smirnoff 		}
45423b3a8eb9SGleb Smirnoff 		| ROUTETO routespec pool_opts {
45433b3a8eb9SGleb Smirnoff 			$$.host = $2;
45443b3a8eb9SGleb Smirnoff 			$$.rt = PF_ROUTETO;
45453b3a8eb9SGleb Smirnoff 			$$.pool_opts = $3.type | $3.opts;
45463b3a8eb9SGleb Smirnoff 			if ($3.key != NULL)
45473b3a8eb9SGleb Smirnoff 				$$.key = $3.key;
45483b3a8eb9SGleb Smirnoff 		}
45493b3a8eb9SGleb Smirnoff 		| REPLYTO routespec pool_opts {
45503b3a8eb9SGleb Smirnoff 			$$.host = $2;
45513b3a8eb9SGleb Smirnoff 			$$.rt = PF_REPLYTO;
45523b3a8eb9SGleb Smirnoff 			$$.pool_opts = $3.type | $3.opts;
45533b3a8eb9SGleb Smirnoff 			if ($3.key != NULL)
45543b3a8eb9SGleb Smirnoff 				$$.key = $3.key;
45553b3a8eb9SGleb Smirnoff 		}
45563b3a8eb9SGleb Smirnoff 		| DUPTO routespec pool_opts {
45573b3a8eb9SGleb Smirnoff 			$$.host = $2;
45583b3a8eb9SGleb Smirnoff 			$$.rt = PF_DUPTO;
45593b3a8eb9SGleb Smirnoff 			$$.pool_opts = $3.type | $3.opts;
45603b3a8eb9SGleb Smirnoff 			if ($3.key != NULL)
45613b3a8eb9SGleb Smirnoff 				$$.key = $3.key;
45623b3a8eb9SGleb Smirnoff 		}
45633b3a8eb9SGleb Smirnoff 		;
45643b3a8eb9SGleb Smirnoff 
45653b3a8eb9SGleb Smirnoff timeout_spec	: STRING NUMBER
45663b3a8eb9SGleb Smirnoff 		{
45673b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
45683b3a8eb9SGleb Smirnoff 				free($1);
45693b3a8eb9SGleb Smirnoff 				YYERROR;
45703b3a8eb9SGleb Smirnoff 			}
45713b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
45723b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
45733b3a8eb9SGleb Smirnoff 				YYERROR;
45743b3a8eb9SGleb Smirnoff 			}
45753b3a8eb9SGleb Smirnoff 			if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
45763b3a8eb9SGleb Smirnoff 				yyerror("unknown timeout %s", $1);
45773b3a8eb9SGleb Smirnoff 				free($1);
45783b3a8eb9SGleb Smirnoff 				YYERROR;
45793b3a8eb9SGleb Smirnoff 			}
45803b3a8eb9SGleb Smirnoff 			free($1);
45813b3a8eb9SGleb Smirnoff 		}
45827f8af000SLuiz Otavio O Souza 		| INTERVAL NUMBER		{
45837f8af000SLuiz Otavio O Souza 			if (check_rulestate(PFCTL_STATE_OPTION))
45847f8af000SLuiz Otavio O Souza 				YYERROR;
45857f8af000SLuiz Otavio O Souza 			if ($2 < 0 || $2 > UINT_MAX) {
45867f8af000SLuiz Otavio O Souza 				yyerror("only positive values permitted");
45877f8af000SLuiz Otavio O Souza 				YYERROR;
45887f8af000SLuiz Otavio O Souza 			}
45897f8af000SLuiz Otavio O Souza 			if (pfctl_set_timeout(pf, "interval", $2, 0) != 0)
45907f8af000SLuiz Otavio O Souza 				YYERROR;
45917f8af000SLuiz Otavio O Souza 		}
45923b3a8eb9SGleb Smirnoff 		;
45933b3a8eb9SGleb Smirnoff 
45943b3a8eb9SGleb Smirnoff timeout_list	: timeout_list comma timeout_spec optnl
45953b3a8eb9SGleb Smirnoff 		| timeout_spec optnl
45963b3a8eb9SGleb Smirnoff 		;
45973b3a8eb9SGleb Smirnoff 
45983b3a8eb9SGleb Smirnoff limit_spec	: STRING NUMBER
45993b3a8eb9SGleb Smirnoff 		{
46003b3a8eb9SGleb Smirnoff 			if (check_rulestate(PFCTL_STATE_OPTION)) {
46013b3a8eb9SGleb Smirnoff 				free($1);
46023b3a8eb9SGleb Smirnoff 				YYERROR;
46033b3a8eb9SGleb Smirnoff 			}
46043b3a8eb9SGleb Smirnoff 			if ($2 < 0 || $2 > UINT_MAX) {
46053b3a8eb9SGleb Smirnoff 				yyerror("only positive values permitted");
46063b3a8eb9SGleb Smirnoff 				YYERROR;
46073b3a8eb9SGleb Smirnoff 			}
46083b3a8eb9SGleb Smirnoff 			if (pfctl_set_limit(pf, $1, $2) != 0) {
46093b3a8eb9SGleb Smirnoff 				yyerror("unable to set limit %s %u", $1, $2);
46103b3a8eb9SGleb Smirnoff 				free($1);
46113b3a8eb9SGleb Smirnoff 				YYERROR;
46123b3a8eb9SGleb Smirnoff 			}
46133b3a8eb9SGleb Smirnoff 			free($1);
46143b3a8eb9SGleb Smirnoff 		}
46153b3a8eb9SGleb Smirnoff 		;
46163b3a8eb9SGleb Smirnoff 
46173b3a8eb9SGleb Smirnoff limit_list	: limit_list comma limit_spec optnl
46183b3a8eb9SGleb Smirnoff 		| limit_spec optnl
46193b3a8eb9SGleb Smirnoff 		;
46203b3a8eb9SGleb Smirnoff 
46213b3a8eb9SGleb Smirnoff comma		: ','
46223b3a8eb9SGleb Smirnoff 		| /* empty */
46233b3a8eb9SGleb Smirnoff 		;
46243b3a8eb9SGleb Smirnoff 
46253b3a8eb9SGleb Smirnoff yesno		: NO			{ $$ = 0; }
46263b3a8eb9SGleb Smirnoff 		| STRING		{
46273b3a8eb9SGleb Smirnoff 			if (!strcmp($1, "yes"))
46283b3a8eb9SGleb Smirnoff 				$$ = 1;
46293b3a8eb9SGleb Smirnoff 			else {
46303b3a8eb9SGleb Smirnoff 				yyerror("invalid value '%s', expected 'yes' "
46313b3a8eb9SGleb Smirnoff 				    "or 'no'", $1);
46323b3a8eb9SGleb Smirnoff 				free($1);
46333b3a8eb9SGleb Smirnoff 				YYERROR;
46343b3a8eb9SGleb Smirnoff 			}
46353b3a8eb9SGleb Smirnoff 			free($1);
46363b3a8eb9SGleb Smirnoff 		}
46373b3a8eb9SGleb Smirnoff 		;
46383b3a8eb9SGleb Smirnoff 
46393b3a8eb9SGleb Smirnoff unaryop		: '='		{ $$ = PF_OP_EQ; }
46403b3a8eb9SGleb Smirnoff 		| '!' '='	{ $$ = PF_OP_NE; }
46413b3a8eb9SGleb Smirnoff 		| '<' '='	{ $$ = PF_OP_LE; }
46423b3a8eb9SGleb Smirnoff 		| '<'		{ $$ = PF_OP_LT; }
46433b3a8eb9SGleb Smirnoff 		| '>' '='	{ $$ = PF_OP_GE; }
46443b3a8eb9SGleb Smirnoff 		| '>'		{ $$ = PF_OP_GT; }
46453b3a8eb9SGleb Smirnoff 		;
46463b3a8eb9SGleb Smirnoff 
46473b3a8eb9SGleb Smirnoff %%
46483b3a8eb9SGleb Smirnoff 
46493b3a8eb9SGleb Smirnoff int
46503b3a8eb9SGleb Smirnoff yyerror(const char *fmt, ...)
46513b3a8eb9SGleb Smirnoff {
46523b3a8eb9SGleb Smirnoff 	va_list		 ap;
46533b3a8eb9SGleb Smirnoff 
46543b3a8eb9SGleb Smirnoff 	file->errors++;
46553b3a8eb9SGleb Smirnoff 	va_start(ap, fmt);
46563b3a8eb9SGleb Smirnoff 	fprintf(stderr, "%s:%d: ", file->name, yylval.lineno);
46573b3a8eb9SGleb Smirnoff 	vfprintf(stderr, fmt, ap);
46583b3a8eb9SGleb Smirnoff 	fprintf(stderr, "\n");
46593b3a8eb9SGleb Smirnoff 	va_end(ap);
46603b3a8eb9SGleb Smirnoff 	return (0);
46613b3a8eb9SGleb Smirnoff }
46623b3a8eb9SGleb Smirnoff 
46633b3a8eb9SGleb Smirnoff int
46643b3a8eb9SGleb Smirnoff disallow_table(struct node_host *h, const char *fmt)
46653b3a8eb9SGleb Smirnoff {
46663b3a8eb9SGleb Smirnoff 	for (; h != NULL; h = h->next)
46673b3a8eb9SGleb Smirnoff 		if (h->addr.type == PF_ADDR_TABLE) {
46683b3a8eb9SGleb Smirnoff 			yyerror(fmt, h->addr.v.tblname);
46693b3a8eb9SGleb Smirnoff 			return (1);
46703b3a8eb9SGleb Smirnoff 		}
46713b3a8eb9SGleb Smirnoff 	return (0);
46723b3a8eb9SGleb Smirnoff }
46733b3a8eb9SGleb Smirnoff 
46743b3a8eb9SGleb Smirnoff int
46753b3a8eb9SGleb Smirnoff disallow_urpf_failed(struct node_host *h, const char *fmt)
46763b3a8eb9SGleb Smirnoff {
46773b3a8eb9SGleb Smirnoff 	for (; h != NULL; h = h->next)
46783b3a8eb9SGleb Smirnoff 		if (h->addr.type == PF_ADDR_URPFFAILED) {
46793b3a8eb9SGleb Smirnoff 			yyerror(fmt);
46803b3a8eb9SGleb Smirnoff 			return (1);
46813b3a8eb9SGleb Smirnoff 		}
46823b3a8eb9SGleb Smirnoff 	return (0);
46833b3a8eb9SGleb Smirnoff }
46843b3a8eb9SGleb Smirnoff 
46853b3a8eb9SGleb Smirnoff int
46863b3a8eb9SGleb Smirnoff disallow_alias(struct node_host *h, const char *fmt)
46873b3a8eb9SGleb Smirnoff {
46883b3a8eb9SGleb Smirnoff 	for (; h != NULL; h = h->next)
46893b3a8eb9SGleb Smirnoff 		if (DYNIF_MULTIADDR(h->addr)) {
46903b3a8eb9SGleb Smirnoff 			yyerror(fmt, h->addr.v.tblname);
46913b3a8eb9SGleb Smirnoff 			return (1);
46923b3a8eb9SGleb Smirnoff 		}
46933b3a8eb9SGleb Smirnoff 	return (0);
46943b3a8eb9SGleb Smirnoff }
46953b3a8eb9SGleb Smirnoff 
46963b3a8eb9SGleb Smirnoff int
4697e9eb0941SKristof Provost rule_consistent(struct pfctl_rule *r, int anchor_call)
46983b3a8eb9SGleb Smirnoff {
46993b3a8eb9SGleb Smirnoff 	int	problems = 0;
47003b3a8eb9SGleb Smirnoff 
47013b3a8eb9SGleb Smirnoff 	switch (r->action) {
47023b3a8eb9SGleb Smirnoff 	case PF_PASS:
47033b3a8eb9SGleb Smirnoff 	case PF_DROP:
47043b3a8eb9SGleb Smirnoff 	case PF_SCRUB:
47053b3a8eb9SGleb Smirnoff 	case PF_NOSCRUB:
47063b3a8eb9SGleb Smirnoff 		problems = filter_consistent(r, anchor_call);
47073b3a8eb9SGleb Smirnoff 		break;
47083b3a8eb9SGleb Smirnoff 	case PF_NAT:
47093b3a8eb9SGleb Smirnoff 	case PF_NONAT:
47103b3a8eb9SGleb Smirnoff 		problems = nat_consistent(r);
47113b3a8eb9SGleb Smirnoff 		break;
47123b3a8eb9SGleb Smirnoff 	case PF_RDR:
47133b3a8eb9SGleb Smirnoff 	case PF_NORDR:
47143b3a8eb9SGleb Smirnoff 		problems = rdr_consistent(r);
47153b3a8eb9SGleb Smirnoff 		break;
47163b3a8eb9SGleb Smirnoff 	case PF_BINAT:
47173b3a8eb9SGleb Smirnoff 	case PF_NOBINAT:
47183b3a8eb9SGleb Smirnoff 	default:
47193b3a8eb9SGleb Smirnoff 		break;
47203b3a8eb9SGleb Smirnoff 	}
47213b3a8eb9SGleb Smirnoff 	return (problems);
47223b3a8eb9SGleb Smirnoff }
47233b3a8eb9SGleb Smirnoff 
47243b3a8eb9SGleb Smirnoff int
4725e9eb0941SKristof Provost filter_consistent(struct pfctl_rule *r, int anchor_call)
47263b3a8eb9SGleb Smirnoff {
47273b3a8eb9SGleb Smirnoff 	int	problems = 0;
47283b3a8eb9SGleb Smirnoff 
47293b3a8eb9SGleb Smirnoff 	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
47303b3a8eb9SGleb Smirnoff 	    (r->src.port_op || r->dst.port_op)) {
47313b3a8eb9SGleb Smirnoff 		yyerror("port only applies to tcp/udp");
47323b3a8eb9SGleb Smirnoff 		problems++;
47333b3a8eb9SGleb Smirnoff 	}
47343b3a8eb9SGleb Smirnoff 	if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
47353b3a8eb9SGleb Smirnoff 	    (r->type || r->code)) {
47363b3a8eb9SGleb Smirnoff 		yyerror("icmp-type/code only applies to icmp");
47373b3a8eb9SGleb Smirnoff 		problems++;
47383b3a8eb9SGleb Smirnoff 	}
47393b3a8eb9SGleb Smirnoff 	if (!r->af && (r->type || r->code)) {
47403b3a8eb9SGleb Smirnoff 		yyerror("must indicate address family with icmp-type/code");
47413b3a8eb9SGleb Smirnoff 		problems++;
47423b3a8eb9SGleb Smirnoff 	}
47433b3a8eb9SGleb Smirnoff 	if (r->overload_tblname[0] &&
47443b3a8eb9SGleb Smirnoff 	    r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
47453b3a8eb9SGleb Smirnoff 		yyerror("'overload' requires 'max-src-conn' "
47463b3a8eb9SGleb Smirnoff 		    "or 'max-src-conn-rate'");
47473b3a8eb9SGleb Smirnoff 		problems++;
47483b3a8eb9SGleb Smirnoff 	}
47493b3a8eb9SGleb Smirnoff 	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
47503b3a8eb9SGleb Smirnoff 	    (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
47513b3a8eb9SGleb Smirnoff 		yyerror("proto %s doesn't match address family %s",
47523b3a8eb9SGleb Smirnoff 		    r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
47533b3a8eb9SGleb Smirnoff 		    r->af == AF_INET ? "inet" : "inet6");
47543b3a8eb9SGleb Smirnoff 		problems++;
47553b3a8eb9SGleb Smirnoff 	}
47563b3a8eb9SGleb Smirnoff 	if (r->allow_opts && r->action != PF_PASS) {
47573b3a8eb9SGleb Smirnoff 		yyerror("allow-opts can only be specified for pass rules");
47583b3a8eb9SGleb Smirnoff 		problems++;
47593b3a8eb9SGleb Smirnoff 	}
47603b3a8eb9SGleb Smirnoff 	if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
47613b3a8eb9SGleb Smirnoff 	    r->dst.port_op || r->flagset || r->type || r->code)) {
47623b3a8eb9SGleb Smirnoff 		yyerror("fragments can be filtered only on IP header fields");
47633b3a8eb9SGleb Smirnoff 		problems++;
47643b3a8eb9SGleb Smirnoff 	}
47653b3a8eb9SGleb Smirnoff 	if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
47663b3a8eb9SGleb Smirnoff 		yyerror("return-rst can only be applied to TCP rules");
47673b3a8eb9SGleb Smirnoff 		problems++;
47683b3a8eb9SGleb Smirnoff 	}
47693b3a8eb9SGleb Smirnoff 	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
47703b3a8eb9SGleb Smirnoff 		yyerror("max-src-nodes requires 'source-track rule'");
47713b3a8eb9SGleb Smirnoff 		problems++;
47723b3a8eb9SGleb Smirnoff 	}
47733b3a8eb9SGleb Smirnoff 	if (r->action == PF_DROP && r->keep_state) {
47743b3a8eb9SGleb Smirnoff 		yyerror("keep state on block rules doesn't make sense");
47753b3a8eb9SGleb Smirnoff 		problems++;
47763b3a8eb9SGleb Smirnoff 	}
47773b3a8eb9SGleb Smirnoff 	if (r->rule_flag & PFRULE_STATESLOPPY &&
47783b3a8eb9SGleb Smirnoff 	    (r->keep_state == PF_STATE_MODULATE ||
47793b3a8eb9SGleb Smirnoff 	    r->keep_state == PF_STATE_SYNPROXY)) {
47803b3a8eb9SGleb Smirnoff 		yyerror("sloppy state matching cannot be used with "
47813b3a8eb9SGleb Smirnoff 		    "synproxy state or modulate state");
47823b3a8eb9SGleb Smirnoff 		problems++;
47833b3a8eb9SGleb Smirnoff 	}
47843b3a8eb9SGleb Smirnoff 	return (-problems);
47853b3a8eb9SGleb Smirnoff }
47863b3a8eb9SGleb Smirnoff 
47873b3a8eb9SGleb Smirnoff int
4788e9eb0941SKristof Provost nat_consistent(struct pfctl_rule *r)
47893b3a8eb9SGleb Smirnoff {
47903b3a8eb9SGleb Smirnoff 	return (0);	/* yeah! */
47913b3a8eb9SGleb Smirnoff }
47923b3a8eb9SGleb Smirnoff 
47933b3a8eb9SGleb Smirnoff int
4794e9eb0941SKristof Provost rdr_consistent(struct pfctl_rule *r)
47953b3a8eb9SGleb Smirnoff {
47963b3a8eb9SGleb Smirnoff 	int			 problems = 0;
47973b3a8eb9SGleb Smirnoff 
47983b3a8eb9SGleb Smirnoff 	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
47993b3a8eb9SGleb Smirnoff 		if (r->src.port_op) {
48003b3a8eb9SGleb Smirnoff 			yyerror("src port only applies to tcp/udp");
48013b3a8eb9SGleb Smirnoff 			problems++;
48023b3a8eb9SGleb Smirnoff 		}
48033b3a8eb9SGleb Smirnoff 		if (r->dst.port_op) {
48043b3a8eb9SGleb Smirnoff 			yyerror("dst port only applies to tcp/udp");
48053b3a8eb9SGleb Smirnoff 			problems++;
48063b3a8eb9SGleb Smirnoff 		}
48073b3a8eb9SGleb Smirnoff 		if (r->rpool.proxy_port[0]) {
48083b3a8eb9SGleb Smirnoff 			yyerror("rpool port only applies to tcp/udp");
48093b3a8eb9SGleb Smirnoff 			problems++;
48103b3a8eb9SGleb Smirnoff 		}
48113b3a8eb9SGleb Smirnoff 	}
48123b3a8eb9SGleb Smirnoff 	if (r->dst.port_op &&
48133b3a8eb9SGleb Smirnoff 	    r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
48143b3a8eb9SGleb Smirnoff 		yyerror("invalid port operator for rdr destination port");
48153b3a8eb9SGleb Smirnoff 		problems++;
48163b3a8eb9SGleb Smirnoff 	}
48173b3a8eb9SGleb Smirnoff 	return (-problems);
48183b3a8eb9SGleb Smirnoff }
48193b3a8eb9SGleb Smirnoff 
48203b3a8eb9SGleb Smirnoff int
48213b3a8eb9SGleb Smirnoff process_tabledef(char *name, struct table_opts *opts)
48223b3a8eb9SGleb Smirnoff {
48233b3a8eb9SGleb Smirnoff 	struct pfr_buffer	 ab;
48243b3a8eb9SGleb Smirnoff 	struct node_tinit	*ti;
4825542feeffSKristof Provost 	unsigned long		 maxcount;
4826542feeffSKristof Provost 	size_t			 s = sizeof(maxcount);
48273b3a8eb9SGleb Smirnoff 
48283b3a8eb9SGleb Smirnoff 	bzero(&ab, sizeof(ab));
48293b3a8eb9SGleb Smirnoff 	ab.pfrb_type = PFRB_ADDRS;
48303b3a8eb9SGleb Smirnoff 	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
48313b3a8eb9SGleb Smirnoff 		if (ti->file)
48323b3a8eb9SGleb Smirnoff 			if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
48333b3a8eb9SGleb Smirnoff 				if (errno)
48343b3a8eb9SGleb Smirnoff 					yyerror("cannot load \"%s\": %s",
48353b3a8eb9SGleb Smirnoff 					    ti->file, strerror(errno));
48363b3a8eb9SGleb Smirnoff 				else
48373b3a8eb9SGleb Smirnoff 					yyerror("file \"%s\" contains bad data",
48383b3a8eb9SGleb Smirnoff 					    ti->file);
48393b3a8eb9SGleb Smirnoff 				goto _error;
48403b3a8eb9SGleb Smirnoff 			}
48413b3a8eb9SGleb Smirnoff 		if (ti->host)
48423b3a8eb9SGleb Smirnoff 			if (append_addr_host(&ab, ti->host, 0, 0)) {
48433b3a8eb9SGleb Smirnoff 				yyerror("cannot create address buffer: %s",
48443b3a8eb9SGleb Smirnoff 				    strerror(errno));
48453b3a8eb9SGleb Smirnoff 				goto _error;
48463b3a8eb9SGleb Smirnoff 			}
48473b3a8eb9SGleb Smirnoff 	}
48483b3a8eb9SGleb Smirnoff 	if (pf->opts & PF_OPT_VERBOSE)
48493b3a8eb9SGleb Smirnoff 		print_tabledef(name, opts->flags, opts->init_addr,
48503b3a8eb9SGleb Smirnoff 		    &opts->init_nodes);
48513b3a8eb9SGleb Smirnoff 	if (!(pf->opts & PF_OPT_NOACTION) &&
48523b3a8eb9SGleb Smirnoff 	    pfctl_define_table(name, opts->flags, opts->init_addr,
48533b3a8eb9SGleb Smirnoff 	    pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) {
4854542feeffSKristof Provost 
4855542feeffSKristof Provost 		if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s,
4856542feeffSKristof Provost 		    NULL, 0) == -1)
4857542feeffSKristof Provost 			maxcount = 65535;
4858542feeffSKristof Provost 
4859542feeffSKristof Provost 		if (ab.pfrb_size > maxcount)
4860542feeffSKristof Provost 			yyerror("cannot define table %s: too many elements.\n"
4861542feeffSKristof Provost 			    "Consider increasing net.pf.request_maxcount.",
4862542feeffSKristof Provost 			    name);
4863542feeffSKristof Provost 		else
48643b3a8eb9SGleb Smirnoff 			yyerror("cannot define table %s: %s", name,
48653b3a8eb9SGleb Smirnoff 			    pfr_strerror(errno));
4866542feeffSKristof Provost 
48673b3a8eb9SGleb Smirnoff 		goto _error;
48683b3a8eb9SGleb Smirnoff 	}
48693b3a8eb9SGleb Smirnoff 	pf->tdirty = 1;
48703b3a8eb9SGleb Smirnoff 	pfr_buf_clear(&ab);
48713b3a8eb9SGleb Smirnoff 	return (0);
48723b3a8eb9SGleb Smirnoff _error:
48733b3a8eb9SGleb Smirnoff 	pfr_buf_clear(&ab);
48743b3a8eb9SGleb Smirnoff 	return (-1);
48753b3a8eb9SGleb Smirnoff }
48763b3a8eb9SGleb Smirnoff 
48773b3a8eb9SGleb Smirnoff struct keywords {
48783b3a8eb9SGleb Smirnoff 	const char	*k_name;
48793b3a8eb9SGleb Smirnoff 	int		 k_val;
48803b3a8eb9SGleb Smirnoff };
48813b3a8eb9SGleb Smirnoff 
48823b3a8eb9SGleb Smirnoff /* macro gore, but you should've seen the prior indentation nightmare... */
48833b3a8eb9SGleb Smirnoff 
48843b3a8eb9SGleb Smirnoff #define FREE_LIST(T,r) \
48853b3a8eb9SGleb Smirnoff 	do { \
48863b3a8eb9SGleb Smirnoff 		T *p, *node = r; \
48873b3a8eb9SGleb Smirnoff 		while (node != NULL) { \
48883b3a8eb9SGleb Smirnoff 			p = node; \
48893b3a8eb9SGleb Smirnoff 			node = node->next; \
48903b3a8eb9SGleb Smirnoff 			free(p); \
48913b3a8eb9SGleb Smirnoff 		} \
48923b3a8eb9SGleb Smirnoff 	} while (0)
48933b3a8eb9SGleb Smirnoff 
48943b3a8eb9SGleb Smirnoff #define LOOP_THROUGH(T,n,r,C) \
48953b3a8eb9SGleb Smirnoff 	do { \
48963b3a8eb9SGleb Smirnoff 		T *n; \
48973b3a8eb9SGleb Smirnoff 		if (r == NULL) { \
48983b3a8eb9SGleb Smirnoff 			r = calloc(1, sizeof(T)); \
48993b3a8eb9SGleb Smirnoff 			if (r == NULL) \
49003b3a8eb9SGleb Smirnoff 				err(1, "LOOP: calloc"); \
49013b3a8eb9SGleb Smirnoff 			r->next = NULL; \
49023b3a8eb9SGleb Smirnoff 		} \
49033b3a8eb9SGleb Smirnoff 		n = r; \
49043b3a8eb9SGleb Smirnoff 		while (n != NULL) { \
49053b3a8eb9SGleb Smirnoff 			do { \
49063b3a8eb9SGleb Smirnoff 				C; \
49073b3a8eb9SGleb Smirnoff 			} while (0); \
49083b3a8eb9SGleb Smirnoff 			n = n->next; \
49093b3a8eb9SGleb Smirnoff 		} \
49103b3a8eb9SGleb Smirnoff 	} while (0)
49113b3a8eb9SGleb Smirnoff 
49123b3a8eb9SGleb Smirnoff void
49133b3a8eb9SGleb Smirnoff expand_label_str(char *label, size_t len, const char *srch, const char *repl)
49143b3a8eb9SGleb Smirnoff {
49153b3a8eb9SGleb Smirnoff 	char *tmp;
49163b3a8eb9SGleb Smirnoff 	char *p, *q;
49173b3a8eb9SGleb Smirnoff 
49183b3a8eb9SGleb Smirnoff 	if ((tmp = calloc(1, len)) == NULL)
49193b3a8eb9SGleb Smirnoff 		err(1, "expand_label_str: calloc");
49203b3a8eb9SGleb Smirnoff 	p = q = label;
49213b3a8eb9SGleb Smirnoff 	while ((q = strstr(p, srch)) != NULL) {
49223b3a8eb9SGleb Smirnoff 		*q = '\0';
49233b3a8eb9SGleb Smirnoff 		if ((strlcat(tmp, p, len) >= len) ||
49243b3a8eb9SGleb Smirnoff 		    (strlcat(tmp, repl, len) >= len))
49253b3a8eb9SGleb Smirnoff 			errx(1, "expand_label: label too long");
49263b3a8eb9SGleb Smirnoff 		q += strlen(srch);
49273b3a8eb9SGleb Smirnoff 		p = q;
49283b3a8eb9SGleb Smirnoff 	}
49293b3a8eb9SGleb Smirnoff 	if (strlcat(tmp, p, len) >= len)
49303b3a8eb9SGleb Smirnoff 		errx(1, "expand_label: label too long");
49313b3a8eb9SGleb Smirnoff 	strlcpy(label, tmp, len);	/* always fits */
49323b3a8eb9SGleb Smirnoff 	free(tmp);
49333b3a8eb9SGleb Smirnoff }
49343b3a8eb9SGleb Smirnoff 
49353b3a8eb9SGleb Smirnoff void
49363b3a8eb9SGleb Smirnoff expand_label_if(const char *name, char *label, size_t len, const char *ifname)
49373b3a8eb9SGleb Smirnoff {
49383b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
49393b3a8eb9SGleb Smirnoff 		if (!*ifname)
49403b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, "any");
49413b3a8eb9SGleb Smirnoff 		else
49423b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, ifname);
49433b3a8eb9SGleb Smirnoff 	}
49443b3a8eb9SGleb Smirnoff }
49453b3a8eb9SGleb Smirnoff 
49463b3a8eb9SGleb Smirnoff void
49473b3a8eb9SGleb Smirnoff expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
49483b3a8eb9SGleb Smirnoff     struct node_host *h)
49493b3a8eb9SGleb Smirnoff {
49503b3a8eb9SGleb Smirnoff 	char tmp[64], tmp_not[66];
49513b3a8eb9SGleb Smirnoff 
49523b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
49533b3a8eb9SGleb Smirnoff 		switch (h->addr.type) {
49543b3a8eb9SGleb Smirnoff 		case PF_ADDR_DYNIFTL:
49553b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
49563b3a8eb9SGleb Smirnoff 			break;
49573b3a8eb9SGleb Smirnoff 		case PF_ADDR_TABLE:
49583b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
49593b3a8eb9SGleb Smirnoff 			break;
49603b3a8eb9SGleb Smirnoff 		case PF_ADDR_NOROUTE:
49613b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "no-route");
49623b3a8eb9SGleb Smirnoff 			break;
49633b3a8eb9SGleb Smirnoff 		case PF_ADDR_URPFFAILED:
49643b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "urpf-failed");
49653b3a8eb9SGleb Smirnoff 			break;
49663b3a8eb9SGleb Smirnoff 		case PF_ADDR_ADDRMASK:
49673b3a8eb9SGleb Smirnoff 			if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
49683b3a8eb9SGleb Smirnoff 			    PF_AZERO(&h->addr.v.a.mask, af)))
49693b3a8eb9SGleb Smirnoff 				snprintf(tmp, sizeof(tmp), "any");
49703b3a8eb9SGleb Smirnoff 			else {
49713b3a8eb9SGleb Smirnoff 				char	a[48];
49723b3a8eb9SGleb Smirnoff 				int	bits;
49733b3a8eb9SGleb Smirnoff 
49743b3a8eb9SGleb Smirnoff 				if (inet_ntop(af, &h->addr.v.a.addr, a,
49753b3a8eb9SGleb Smirnoff 				    sizeof(a)) == NULL)
49763b3a8eb9SGleb Smirnoff 					snprintf(tmp, sizeof(tmp), "?");
49773b3a8eb9SGleb Smirnoff 				else {
49783b3a8eb9SGleb Smirnoff 					bits = unmask(&h->addr.v.a.mask, af);
49793b3a8eb9SGleb Smirnoff 					if ((af == AF_INET && bits < 32) ||
49803b3a8eb9SGleb Smirnoff 					    (af == AF_INET6 && bits < 128))
49813b3a8eb9SGleb Smirnoff 						snprintf(tmp, sizeof(tmp),
49823b3a8eb9SGleb Smirnoff 						    "%s/%d", a, bits);
49833b3a8eb9SGleb Smirnoff 					else
49843b3a8eb9SGleb Smirnoff 						snprintf(tmp, sizeof(tmp),
49853b3a8eb9SGleb Smirnoff 						    "%s", a);
49863b3a8eb9SGleb Smirnoff 				}
49873b3a8eb9SGleb Smirnoff 			}
49883b3a8eb9SGleb Smirnoff 			break;
49893b3a8eb9SGleb Smirnoff 		default:
49903b3a8eb9SGleb Smirnoff 			snprintf(tmp, sizeof(tmp), "?");
49913b3a8eb9SGleb Smirnoff 			break;
49923b3a8eb9SGleb Smirnoff 		}
49933b3a8eb9SGleb Smirnoff 
49943b3a8eb9SGleb Smirnoff 		if (h->not) {
49953b3a8eb9SGleb Smirnoff 			snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
49963b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, tmp_not);
49973b3a8eb9SGleb Smirnoff 		} else
49983b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, tmp);
49993b3a8eb9SGleb Smirnoff 	}
50003b3a8eb9SGleb Smirnoff }
50013b3a8eb9SGleb Smirnoff 
50023b3a8eb9SGleb Smirnoff void
50033b3a8eb9SGleb Smirnoff expand_label_port(const char *name, char *label, size_t len,
50043b3a8eb9SGleb Smirnoff     struct node_port *port)
50053b3a8eb9SGleb Smirnoff {
50063b3a8eb9SGleb Smirnoff 	char	 a1[6], a2[6], op[13] = "";
50073b3a8eb9SGleb Smirnoff 
50083b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
50093b3a8eb9SGleb Smirnoff 		snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
50103b3a8eb9SGleb Smirnoff 		snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
50113b3a8eb9SGleb Smirnoff 		if (!port->op)
50123b3a8eb9SGleb Smirnoff 			;
50133b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_IRG)
50143b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "%s><%s", a1, a2);
50153b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_XRG)
50163b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "%s<>%s", a1, a2);
50173b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_EQ)
50183b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "%s", a1);
50193b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_NE)
50203b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "!=%s", a1);
50213b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_LT)
50223b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "<%s", a1);
50233b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_LE)
50243b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), "<=%s", a1);
50253b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_GT)
50263b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), ">%s", a1);
50273b3a8eb9SGleb Smirnoff 		else if (port->op == PF_OP_GE)
50283b3a8eb9SGleb Smirnoff 			snprintf(op, sizeof(op), ">=%s", a1);
50293b3a8eb9SGleb Smirnoff 		expand_label_str(label, len, name, op);
50303b3a8eb9SGleb Smirnoff 	}
50313b3a8eb9SGleb Smirnoff }
50323b3a8eb9SGleb Smirnoff 
50333b3a8eb9SGleb Smirnoff void
50343b3a8eb9SGleb Smirnoff expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
50353b3a8eb9SGleb Smirnoff {
5036858937beSMateusz Guzik 	const char *protoname;
50373b3a8eb9SGleb Smirnoff 	char n[4];
50383b3a8eb9SGleb Smirnoff 
50393b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
5040858937beSMateusz Guzik 		protoname = pfctl_proto2name(proto);
5041858937beSMateusz Guzik 		if (protoname != NULL)
5042858937beSMateusz Guzik 			expand_label_str(label, len, name, protoname);
50433b3a8eb9SGleb Smirnoff 		else {
50443b3a8eb9SGleb Smirnoff 			snprintf(n, sizeof(n), "%u", proto);
50453b3a8eb9SGleb Smirnoff 			expand_label_str(label, len, name, n);
50463b3a8eb9SGleb Smirnoff 		}
50473b3a8eb9SGleb Smirnoff 	}
50483b3a8eb9SGleb Smirnoff }
50493b3a8eb9SGleb Smirnoff 
50503b3a8eb9SGleb Smirnoff void
50513b3a8eb9SGleb Smirnoff expand_label_nr(const char *name, char *label, size_t len)
50523b3a8eb9SGleb Smirnoff {
50533b3a8eb9SGleb Smirnoff 	char n[11];
50543b3a8eb9SGleb Smirnoff 
50553b3a8eb9SGleb Smirnoff 	if (strstr(label, name) != NULL) {
50563b3a8eb9SGleb Smirnoff 		snprintf(n, sizeof(n), "%u", pf->anchor->match);
50573b3a8eb9SGleb Smirnoff 		expand_label_str(label, len, name, n);
50583b3a8eb9SGleb Smirnoff 	}
50593b3a8eb9SGleb Smirnoff }
50603b3a8eb9SGleb Smirnoff 
50613b3a8eb9SGleb Smirnoff void
50623b3a8eb9SGleb Smirnoff expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
50633b3a8eb9SGleb Smirnoff     struct node_host *src_host, struct node_port *src_port,
50643b3a8eb9SGleb Smirnoff     struct node_host *dst_host, struct node_port *dst_port,
50653b3a8eb9SGleb Smirnoff     u_int8_t proto)
50663b3a8eb9SGleb Smirnoff {
50673b3a8eb9SGleb Smirnoff 	expand_label_if("$if", label, len, ifname);
50683b3a8eb9SGleb Smirnoff 	expand_label_addr("$srcaddr", label, len, af, src_host);
50693b3a8eb9SGleb Smirnoff 	expand_label_addr("$dstaddr", label, len, af, dst_host);
50703b3a8eb9SGleb Smirnoff 	expand_label_port("$srcport", label, len, src_port);
50713b3a8eb9SGleb Smirnoff 	expand_label_port("$dstport", label, len, dst_port);
50723b3a8eb9SGleb Smirnoff 	expand_label_proto("$proto", label, len, proto);
50733b3a8eb9SGleb Smirnoff 	expand_label_nr("$nr", label, len);
50743b3a8eb9SGleb Smirnoff }
50753b3a8eb9SGleb Smirnoff 
50763b3a8eb9SGleb Smirnoff int
50773b3a8eb9SGleb Smirnoff expand_altq(struct pf_altq *a, struct node_if *interfaces,
50783b3a8eb9SGleb Smirnoff     struct node_queue *nqueues, struct node_queue_bw bwspec,
50793b3a8eb9SGleb Smirnoff     struct node_queue_opt *opts)
50803b3a8eb9SGleb Smirnoff {
50813b3a8eb9SGleb Smirnoff 	struct pf_altq		 pa, pb;
50823b3a8eb9SGleb Smirnoff 	char			 qname[PF_QNAME_SIZE];
50833b3a8eb9SGleb Smirnoff 	struct node_queue	*n;
50843b3a8eb9SGleb Smirnoff 	struct node_queue_bw	 bw;
50853b3a8eb9SGleb Smirnoff 	int			 errs = 0;
50863b3a8eb9SGleb Smirnoff 
50873b3a8eb9SGleb Smirnoff 	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
50883b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_if, interfaces);
50890a70aaf8SLuiz Otavio O Souza 		if (nqueues)
50903b3a8eb9SGleb Smirnoff 			FREE_LIST(struct node_queue, nqueues);
50913b3a8eb9SGleb Smirnoff 		return (0);
50923b3a8eb9SGleb Smirnoff 	}
50933b3a8eb9SGleb Smirnoff 
50943b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
50953b3a8eb9SGleb Smirnoff 		memcpy(&pa, a, sizeof(struct pf_altq));
50963b3a8eb9SGleb Smirnoff 		if (strlcpy(pa.ifname, interface->ifname,
50973b3a8eb9SGleb Smirnoff 		    sizeof(pa.ifname)) >= sizeof(pa.ifname))
50983b3a8eb9SGleb Smirnoff 			errx(1, "expand_altq: strlcpy");
50993b3a8eb9SGleb Smirnoff 
51003b3a8eb9SGleb Smirnoff 		if (interface->not) {
51013b3a8eb9SGleb Smirnoff 			yyerror("altq on ! <interface> is not supported");
51023b3a8eb9SGleb Smirnoff 			errs++;
51033b3a8eb9SGleb Smirnoff 		} else {
51043b3a8eb9SGleb Smirnoff 			if (eval_pfaltq(pf, &pa, &bwspec, opts))
51053b3a8eb9SGleb Smirnoff 				errs++;
51063b3a8eb9SGleb Smirnoff 			else
51073b3a8eb9SGleb Smirnoff 				if (pfctl_add_altq(pf, &pa))
51083b3a8eb9SGleb Smirnoff 					errs++;
51093b3a8eb9SGleb Smirnoff 
51103b3a8eb9SGleb Smirnoff 			if (pf->opts & PF_OPT_VERBOSE) {
51113b3a8eb9SGleb Smirnoff 				print_altq(&pf->paltq->altq, 0,
51123b3a8eb9SGleb Smirnoff 				    &bwspec, opts);
51133b3a8eb9SGleb Smirnoff 				if (nqueues && nqueues->tail) {
51143b3a8eb9SGleb Smirnoff 					printf("queue { ");
51153b3a8eb9SGleb Smirnoff 					LOOP_THROUGH(struct node_queue, queue,
51163b3a8eb9SGleb Smirnoff 					    nqueues,
51173b3a8eb9SGleb Smirnoff 						printf("%s ",
51183b3a8eb9SGleb Smirnoff 						    queue->queue);
51193b3a8eb9SGleb Smirnoff 					);
51203b3a8eb9SGleb Smirnoff 					printf("}");
51213b3a8eb9SGleb Smirnoff 				}
51223b3a8eb9SGleb Smirnoff 				printf("\n");
51233b3a8eb9SGleb Smirnoff 			}
51243b3a8eb9SGleb Smirnoff 
51253b3a8eb9SGleb Smirnoff 			if (pa.scheduler == ALTQT_CBQ ||
5126dc784287SKristof Provost 			    pa.scheduler == ALTQT_HFSC ||
5127dc784287SKristof Provost 			    pa.scheduler == ALTQT_FAIRQ) {
51283b3a8eb9SGleb Smirnoff 				/* now create a root queue */
51293b3a8eb9SGleb Smirnoff 				memset(&pb, 0, sizeof(struct pf_altq));
51303b3a8eb9SGleb Smirnoff 				if (strlcpy(qname, "root_", sizeof(qname)) >=
51313b3a8eb9SGleb Smirnoff 				    sizeof(qname))
51323b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
51333b3a8eb9SGleb Smirnoff 				if (strlcat(qname, interface->ifname,
51343b3a8eb9SGleb Smirnoff 				    sizeof(qname)) >= sizeof(qname))
51353b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcat");
51363b3a8eb9SGleb Smirnoff 				if (strlcpy(pb.qname, qname,
51373b3a8eb9SGleb Smirnoff 				    sizeof(pb.qname)) >= sizeof(pb.qname))
51383b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
51393b3a8eb9SGleb Smirnoff 				if (strlcpy(pb.ifname, interface->ifname,
51403b3a8eb9SGleb Smirnoff 				    sizeof(pb.ifname)) >= sizeof(pb.ifname))
51413b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
51423b3a8eb9SGleb Smirnoff 				pb.qlimit = pa.qlimit;
51433b3a8eb9SGleb Smirnoff 				pb.scheduler = pa.scheduler;
51443b3a8eb9SGleb Smirnoff 				bw.bw_absolute = pa.ifbandwidth;
51453b3a8eb9SGleb Smirnoff 				bw.bw_percent = 0;
51463b3a8eb9SGleb Smirnoff 				if (eval_pfqueue(pf, &pb, &bw, opts))
51473b3a8eb9SGleb Smirnoff 					errs++;
51483b3a8eb9SGleb Smirnoff 				else
51493b3a8eb9SGleb Smirnoff 					if (pfctl_add_altq(pf, &pb))
51503b3a8eb9SGleb Smirnoff 						errs++;
51513b3a8eb9SGleb Smirnoff 			}
51523b3a8eb9SGleb Smirnoff 
51533b3a8eb9SGleb Smirnoff 			LOOP_THROUGH(struct node_queue, queue, nqueues,
51543b3a8eb9SGleb Smirnoff 				n = calloc(1, sizeof(struct node_queue));
51553b3a8eb9SGleb Smirnoff 				if (n == NULL)
51563b3a8eb9SGleb Smirnoff 					err(1, "expand_altq: calloc");
51573b3a8eb9SGleb Smirnoff 				if (pa.scheduler == ALTQT_CBQ ||
5158dc784287SKristof Provost 				    pa.scheduler == ALTQT_HFSC ||
5159dc784287SKristof Provost 				    pa.scheduler == ALTQT_FAIRQ)
51603b3a8eb9SGleb Smirnoff 					if (strlcpy(n->parent, qname,
51613b3a8eb9SGleb Smirnoff 					    sizeof(n->parent)) >=
51623b3a8eb9SGleb Smirnoff 					    sizeof(n->parent))
51633b3a8eb9SGleb Smirnoff 						errx(1, "expand_altq: strlcpy");
51643b3a8eb9SGleb Smirnoff 				if (strlcpy(n->queue, queue->queue,
51653b3a8eb9SGleb Smirnoff 				    sizeof(n->queue)) >= sizeof(n->queue))
51663b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
51673b3a8eb9SGleb Smirnoff 				if (strlcpy(n->ifname, interface->ifname,
51683b3a8eb9SGleb Smirnoff 				    sizeof(n->ifname)) >= sizeof(n->ifname))
51693b3a8eb9SGleb Smirnoff 					errx(1, "expand_altq: strlcpy");
51703b3a8eb9SGleb Smirnoff 				n->scheduler = pa.scheduler;
51713b3a8eb9SGleb Smirnoff 				n->next = NULL;
51723b3a8eb9SGleb Smirnoff 				n->tail = n;
51733b3a8eb9SGleb Smirnoff 				if (queues == NULL)
51743b3a8eb9SGleb Smirnoff 					queues = n;
51753b3a8eb9SGleb Smirnoff 				else {
51763b3a8eb9SGleb Smirnoff 					queues->tail->next = n;
51773b3a8eb9SGleb Smirnoff 					queues->tail = n;
51783b3a8eb9SGleb Smirnoff 				}
51793b3a8eb9SGleb Smirnoff 			);
51803b3a8eb9SGleb Smirnoff 		}
51813b3a8eb9SGleb Smirnoff 	);
51823b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
51830a70aaf8SLuiz Otavio O Souza 	if (nqueues)
51843b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_queue, nqueues);
51853b3a8eb9SGleb Smirnoff 
51863b3a8eb9SGleb Smirnoff 	return (errs);
51873b3a8eb9SGleb Smirnoff }
51883b3a8eb9SGleb Smirnoff 
51893b3a8eb9SGleb Smirnoff int
51903b3a8eb9SGleb Smirnoff expand_queue(struct pf_altq *a, struct node_if *interfaces,
51913b3a8eb9SGleb Smirnoff     struct node_queue *nqueues, struct node_queue_bw bwspec,
51923b3a8eb9SGleb Smirnoff     struct node_queue_opt *opts)
51933b3a8eb9SGleb Smirnoff {
51943b3a8eb9SGleb Smirnoff 	struct node_queue	*n, *nq;
51953b3a8eb9SGleb Smirnoff 	struct pf_altq		 pa;
51963b3a8eb9SGleb Smirnoff 	u_int8_t		 found = 0;
51973b3a8eb9SGleb Smirnoff 	u_int8_t		 errs = 0;
51983b3a8eb9SGleb Smirnoff 
51993b3a8eb9SGleb Smirnoff 	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
52003b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_queue, nqueues);
52013b3a8eb9SGleb Smirnoff 		return (0);
52023b3a8eb9SGleb Smirnoff 	}
52033b3a8eb9SGleb Smirnoff 
52043b3a8eb9SGleb Smirnoff 	if (queues == NULL) {
52053b3a8eb9SGleb Smirnoff 		yyerror("queue %s has no parent", a->qname);
52063b3a8eb9SGleb Smirnoff 		FREE_LIST(struct node_queue, nqueues);
52073b3a8eb9SGleb Smirnoff 		return (1);
52083b3a8eb9SGleb Smirnoff 	}
52093b3a8eb9SGleb Smirnoff 
52103b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
52113b3a8eb9SGleb Smirnoff 		LOOP_THROUGH(struct node_queue, tqueue, queues,
52123b3a8eb9SGleb Smirnoff 			if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
52133b3a8eb9SGleb Smirnoff 			    (interface->ifname[0] == 0 ||
52143b3a8eb9SGleb Smirnoff 			    (!interface->not && !strncmp(interface->ifname,
52153b3a8eb9SGleb Smirnoff 			    tqueue->ifname, IFNAMSIZ)) ||
52163b3a8eb9SGleb Smirnoff 			    (interface->not && strncmp(interface->ifname,
52173b3a8eb9SGleb Smirnoff 			    tqueue->ifname, IFNAMSIZ)))) {
52183b3a8eb9SGleb Smirnoff 				/* found ourself in queues */
52193b3a8eb9SGleb Smirnoff 				found++;
52203b3a8eb9SGleb Smirnoff 
52213b3a8eb9SGleb Smirnoff 				memcpy(&pa, a, sizeof(struct pf_altq));
52223b3a8eb9SGleb Smirnoff 
52233b3a8eb9SGleb Smirnoff 				if (pa.scheduler != ALTQT_NONE &&
52243b3a8eb9SGleb Smirnoff 				    pa.scheduler != tqueue->scheduler) {
52253b3a8eb9SGleb Smirnoff 					yyerror("exactly one scheduler type "
52263b3a8eb9SGleb Smirnoff 					    "per interface allowed");
52273b3a8eb9SGleb Smirnoff 					return (1);
52283b3a8eb9SGleb Smirnoff 				}
52293b3a8eb9SGleb Smirnoff 				pa.scheduler = tqueue->scheduler;
52303b3a8eb9SGleb Smirnoff 
52313b3a8eb9SGleb Smirnoff 				/* scheduler dependent error checking */
52323b3a8eb9SGleb Smirnoff 				switch (pa.scheduler) {
52333b3a8eb9SGleb Smirnoff 				case ALTQT_PRIQ:
52343b3a8eb9SGleb Smirnoff 					if (nqueues != NULL) {
52353b3a8eb9SGleb Smirnoff 						yyerror("priq queues cannot "
52363b3a8eb9SGleb Smirnoff 						    "have child queues");
52373b3a8eb9SGleb Smirnoff 						return (1);
52383b3a8eb9SGleb Smirnoff 					}
52393b3a8eb9SGleb Smirnoff 					if (bwspec.bw_absolute > 0 ||
52403b3a8eb9SGleb Smirnoff 					    bwspec.bw_percent < 100) {
52413b3a8eb9SGleb Smirnoff 						yyerror("priq doesn't take "
52423b3a8eb9SGleb Smirnoff 						    "bandwidth");
52433b3a8eb9SGleb Smirnoff 						return (1);
52443b3a8eb9SGleb Smirnoff 					}
52453b3a8eb9SGleb Smirnoff 					break;
52463b3a8eb9SGleb Smirnoff 				default:
52473b3a8eb9SGleb Smirnoff 					break;
52483b3a8eb9SGleb Smirnoff 				}
52493b3a8eb9SGleb Smirnoff 
52503b3a8eb9SGleb Smirnoff 				if (strlcpy(pa.ifname, tqueue->ifname,
52513b3a8eb9SGleb Smirnoff 				    sizeof(pa.ifname)) >= sizeof(pa.ifname))
52523b3a8eb9SGleb Smirnoff 					errx(1, "expand_queue: strlcpy");
52533b3a8eb9SGleb Smirnoff 				if (strlcpy(pa.parent, tqueue->parent,
52543b3a8eb9SGleb Smirnoff 				    sizeof(pa.parent)) >= sizeof(pa.parent))
52553b3a8eb9SGleb Smirnoff 					errx(1, "expand_queue: strlcpy");
52563b3a8eb9SGleb Smirnoff 
52573b3a8eb9SGleb Smirnoff 				if (eval_pfqueue(pf, &pa, &bwspec, opts))
52583b3a8eb9SGleb Smirnoff 					errs++;
52593b3a8eb9SGleb Smirnoff 				else
52603b3a8eb9SGleb Smirnoff 					if (pfctl_add_altq(pf, &pa))
52613b3a8eb9SGleb Smirnoff 						errs++;
52623b3a8eb9SGleb Smirnoff 
52633b3a8eb9SGleb Smirnoff 				for (nq = nqueues; nq != NULL; nq = nq->next) {
52643b3a8eb9SGleb Smirnoff 					if (!strcmp(a->qname, nq->queue)) {
52653b3a8eb9SGleb Smirnoff 						yyerror("queue cannot have "
52663b3a8eb9SGleb Smirnoff 						    "itself as child");
52673b3a8eb9SGleb Smirnoff 						errs++;
52683b3a8eb9SGleb Smirnoff 						continue;
52693b3a8eb9SGleb Smirnoff 					}
52703b3a8eb9SGleb Smirnoff 					n = calloc(1,
52713b3a8eb9SGleb Smirnoff 					    sizeof(struct node_queue));
52723b3a8eb9SGleb Smirnoff 					if (n == NULL)
52733b3a8eb9SGleb Smirnoff 						err(1, "expand_queue: calloc");
52743b3a8eb9SGleb Smirnoff 					if (strlcpy(n->parent, a->qname,
52753b3a8eb9SGleb Smirnoff 					    sizeof(n->parent)) >=
52763b3a8eb9SGleb Smirnoff 					    sizeof(n->parent))
52773b3a8eb9SGleb Smirnoff 						errx(1, "expand_queue strlcpy");
52783b3a8eb9SGleb Smirnoff 					if (strlcpy(n->queue, nq->queue,
52793b3a8eb9SGleb Smirnoff 					    sizeof(n->queue)) >=
52803b3a8eb9SGleb Smirnoff 					    sizeof(n->queue))
52813b3a8eb9SGleb Smirnoff 						errx(1, "expand_queue strlcpy");
52823b3a8eb9SGleb Smirnoff 					if (strlcpy(n->ifname, tqueue->ifname,
52833b3a8eb9SGleb Smirnoff 					    sizeof(n->ifname)) >=
52843b3a8eb9SGleb Smirnoff 					    sizeof(n->ifname))
52853b3a8eb9SGleb Smirnoff 						errx(1, "expand_queue strlcpy");
52863b3a8eb9SGleb Smirnoff 					n->scheduler = tqueue->scheduler;
52873b3a8eb9SGleb Smirnoff 					n->next = NULL;
52883b3a8eb9SGleb Smirnoff 					n->tail = n;
52893b3a8eb9SGleb Smirnoff 					if (queues == NULL)
52903b3a8eb9SGleb Smirnoff 						queues = n;
52913b3a8eb9SGleb Smirnoff 					else {
52923b3a8eb9SGleb Smirnoff 						queues->tail->next = n;
52933b3a8eb9SGleb Smirnoff 						queues->tail = n;
52943b3a8eb9SGleb Smirnoff 					}
52953b3a8eb9SGleb Smirnoff 				}
52963b3a8eb9SGleb Smirnoff 				if ((pf->opts & PF_OPT_VERBOSE) && (
52973b3a8eb9SGleb Smirnoff 				    (found == 1 && interface->ifname[0] == 0) ||
52983b3a8eb9SGleb Smirnoff 				    (found > 0 && interface->ifname[0] != 0))) {
52993b3a8eb9SGleb Smirnoff 					print_queue(&pf->paltq->altq, 0,
53003b3a8eb9SGleb Smirnoff 					    &bwspec, interface->ifname[0] != 0,
53013b3a8eb9SGleb Smirnoff 					    opts);
53023b3a8eb9SGleb Smirnoff 					if (nqueues && nqueues->tail) {
53033b3a8eb9SGleb Smirnoff 						printf("{ ");
53043b3a8eb9SGleb Smirnoff 						LOOP_THROUGH(struct node_queue,
53053b3a8eb9SGleb Smirnoff 						    queue, nqueues,
53063b3a8eb9SGleb Smirnoff 							printf("%s ",
53073b3a8eb9SGleb Smirnoff 							    queue->queue);
53083b3a8eb9SGleb Smirnoff 						);
53093b3a8eb9SGleb Smirnoff 						printf("}");
53103b3a8eb9SGleb Smirnoff 					}
53113b3a8eb9SGleb Smirnoff 					printf("\n");
53123b3a8eb9SGleb Smirnoff 				}
53133b3a8eb9SGleb Smirnoff 			}
53143b3a8eb9SGleb Smirnoff 		);
53153b3a8eb9SGleb Smirnoff 	);
53163b3a8eb9SGleb Smirnoff 
53173b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_queue, nqueues);
53183b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
53193b3a8eb9SGleb Smirnoff 
53203b3a8eb9SGleb Smirnoff 	if (!found) {
53213b3a8eb9SGleb Smirnoff 		yyerror("queue %s has no parent", a->qname);
53223b3a8eb9SGleb Smirnoff 		errs++;
53233b3a8eb9SGleb Smirnoff 	}
53243b3a8eb9SGleb Smirnoff 
53253b3a8eb9SGleb Smirnoff 	if (errs)
53263b3a8eb9SGleb Smirnoff 		return (1);
53273b3a8eb9SGleb Smirnoff 	else
53283b3a8eb9SGleb Smirnoff 		return (0);
53293b3a8eb9SGleb Smirnoff }
53303b3a8eb9SGleb Smirnoff 
53313b3a8eb9SGleb Smirnoff void
5332e9eb0941SKristof Provost expand_rule(struct pfctl_rule *r,
53333b3a8eb9SGleb Smirnoff     struct node_if *interfaces, struct node_host *rpool_hosts,
53343b3a8eb9SGleb Smirnoff     struct node_proto *protos, struct node_os *src_oses,
53353b3a8eb9SGleb Smirnoff     struct node_host *src_hosts, struct node_port *src_ports,
53363b3a8eb9SGleb Smirnoff     struct node_host *dst_hosts, struct node_port *dst_ports,
53373b3a8eb9SGleb Smirnoff     struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types,
53383b3a8eb9SGleb Smirnoff     const char *anchor_call)
53393b3a8eb9SGleb Smirnoff {
53403b3a8eb9SGleb Smirnoff 	sa_family_t		 af = r->af;
53413b3a8eb9SGleb Smirnoff 	int			 added = 0, error = 0;
53423b3a8eb9SGleb Smirnoff 	char			 ifname[IF_NAMESIZE];
53436fcc8e04SKristof Provost 	char			 label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE];
53443b3a8eb9SGleb Smirnoff 	char			 tagname[PF_TAG_NAME_SIZE];
53453b3a8eb9SGleb Smirnoff 	char			 match_tagname[PF_TAG_NAME_SIZE];
53463b3a8eb9SGleb Smirnoff 	struct pf_pooladdr	*pa;
53473b3a8eb9SGleb Smirnoff 	struct node_host	*h;
53483b3a8eb9SGleb Smirnoff 	u_int8_t		 flags, flagset, keep_state;
53493b3a8eb9SGleb Smirnoff 
53506fcc8e04SKristof Provost 	memcpy(label, r->label, sizeof(r->label));
53516fcc8e04SKristof Provost 	assert(sizeof(r->label) == sizeof(label));
53523b3a8eb9SGleb Smirnoff 	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
53533b3a8eb9SGleb Smirnoff 		errx(1, "expand_rule: strlcpy");
53543b3a8eb9SGleb Smirnoff 	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
53553b3a8eb9SGleb Smirnoff 	    sizeof(match_tagname))
53563b3a8eb9SGleb Smirnoff 		errx(1, "expand_rule: strlcpy");
53573b3a8eb9SGleb Smirnoff 	flags = r->flags;
53583b3a8eb9SGleb Smirnoff 	flagset = r->flagset;
53593b3a8eb9SGleb Smirnoff 	keep_state = r->keep_state;
53603b3a8eb9SGleb Smirnoff 
53613b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
53623b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_proto, proto, protos,
53633b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
53643b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_host, src_host, src_hosts,
53653b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_port, src_port, src_ports,
53663b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_os, src_os, src_oses,
53673b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
53683b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
53693b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_uid, uid, uids,
53703b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_gid, gid, gids,
53713b3a8eb9SGleb Smirnoff 
53723b3a8eb9SGleb Smirnoff 		r->af = af;
53733b3a8eb9SGleb Smirnoff 		/* for link-local IPv6 address, interface must match up */
53743b3a8eb9SGleb Smirnoff 		if ((r->af && src_host->af && r->af != src_host->af) ||
53753b3a8eb9SGleb Smirnoff 		    (r->af && dst_host->af && r->af != dst_host->af) ||
53763b3a8eb9SGleb Smirnoff 		    (src_host->af && dst_host->af &&
53773b3a8eb9SGleb Smirnoff 		    src_host->af != dst_host->af) ||
53783b3a8eb9SGleb Smirnoff 		    (src_host->ifindex && dst_host->ifindex &&
53793b3a8eb9SGleb Smirnoff 		    src_host->ifindex != dst_host->ifindex) ||
53803b3a8eb9SGleb Smirnoff 		    (src_host->ifindex && *interface->ifname &&
53813b3a8eb9SGleb Smirnoff 		    src_host->ifindex != if_nametoindex(interface->ifname)) ||
53823b3a8eb9SGleb Smirnoff 		    (dst_host->ifindex && *interface->ifname &&
53833b3a8eb9SGleb Smirnoff 		    dst_host->ifindex != if_nametoindex(interface->ifname)))
53843b3a8eb9SGleb Smirnoff 			continue;
53853b3a8eb9SGleb Smirnoff 		if (!r->af && src_host->af)
53863b3a8eb9SGleb Smirnoff 			r->af = src_host->af;
53873b3a8eb9SGleb Smirnoff 		else if (!r->af && dst_host->af)
53883b3a8eb9SGleb Smirnoff 			r->af = dst_host->af;
53893b3a8eb9SGleb Smirnoff 
53903b3a8eb9SGleb Smirnoff 		if (*interface->ifname)
53913b3a8eb9SGleb Smirnoff 			strlcpy(r->ifname, interface->ifname,
53923b3a8eb9SGleb Smirnoff 			    sizeof(r->ifname));
53933b3a8eb9SGleb Smirnoff 		else if (if_indextoname(src_host->ifindex, ifname))
53943b3a8eb9SGleb Smirnoff 			strlcpy(r->ifname, ifname, sizeof(r->ifname));
53953b3a8eb9SGleb Smirnoff 		else if (if_indextoname(dst_host->ifindex, ifname))
53963b3a8eb9SGleb Smirnoff 			strlcpy(r->ifname, ifname, sizeof(r->ifname));
53973b3a8eb9SGleb Smirnoff 		else
53983b3a8eb9SGleb Smirnoff 			memset(r->ifname, '\0', sizeof(r->ifname));
53993b3a8eb9SGleb Smirnoff 
54006fcc8e04SKristof Provost 		memcpy(r->label, label, sizeof(r->label));
54013b3a8eb9SGleb Smirnoff 		if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
54023b3a8eb9SGleb Smirnoff 		    sizeof(r->tagname))
54033b3a8eb9SGleb Smirnoff 			errx(1, "expand_rule: strlcpy");
54043b3a8eb9SGleb Smirnoff 		if (strlcpy(r->match_tagname, match_tagname,
54053b3a8eb9SGleb Smirnoff 		    sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
54063b3a8eb9SGleb Smirnoff 			errx(1, "expand_rule: strlcpy");
54076fcc8e04SKristof Provost 		for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++)
54086fcc8e04SKristof Provost 			expand_label(r->label[i], PF_RULE_LABEL_SIZE,
54096fcc8e04SKristof Provost 			    r->ifname, r->af, src_host, src_port, dst_host,
54106fcc8e04SKristof Provost 			    dst_port, proto->proto);
54113b3a8eb9SGleb Smirnoff 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
54123b3a8eb9SGleb Smirnoff 		    src_host, src_port, dst_host, dst_port, proto->proto);
54133b3a8eb9SGleb Smirnoff 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
54143b3a8eb9SGleb Smirnoff 		    r->af, src_host, src_port, dst_host, dst_port,
54153b3a8eb9SGleb Smirnoff 		    proto->proto);
54163b3a8eb9SGleb Smirnoff 
54173b3a8eb9SGleb Smirnoff 		error += check_netmask(src_host, r->af);
54183b3a8eb9SGleb Smirnoff 		error += check_netmask(dst_host, r->af);
54193b3a8eb9SGleb Smirnoff 
54203b3a8eb9SGleb Smirnoff 		r->ifnot = interface->not;
54213b3a8eb9SGleb Smirnoff 		r->proto = proto->proto;
54223b3a8eb9SGleb Smirnoff 		r->src.addr = src_host->addr;
54233b3a8eb9SGleb Smirnoff 		r->src.neg = src_host->not;
54243b3a8eb9SGleb Smirnoff 		r->src.port[0] = src_port->port[0];
54253b3a8eb9SGleb Smirnoff 		r->src.port[1] = src_port->port[1];
54263b3a8eb9SGleb Smirnoff 		r->src.port_op = src_port->op;
54273b3a8eb9SGleb Smirnoff 		r->dst.addr = dst_host->addr;
54283b3a8eb9SGleb Smirnoff 		r->dst.neg = dst_host->not;
54293b3a8eb9SGleb Smirnoff 		r->dst.port[0] = dst_port->port[0];
54303b3a8eb9SGleb Smirnoff 		r->dst.port[1] = dst_port->port[1];
54313b3a8eb9SGleb Smirnoff 		r->dst.port_op = dst_port->op;
54323b3a8eb9SGleb Smirnoff 		r->uid.op = uid->op;
54333b3a8eb9SGleb Smirnoff 		r->uid.uid[0] = uid->uid[0];
54343b3a8eb9SGleb Smirnoff 		r->uid.uid[1] = uid->uid[1];
54353b3a8eb9SGleb Smirnoff 		r->gid.op = gid->op;
54363b3a8eb9SGleb Smirnoff 		r->gid.gid[0] = gid->gid[0];
54373b3a8eb9SGleb Smirnoff 		r->gid.gid[1] = gid->gid[1];
54383b3a8eb9SGleb Smirnoff 		r->type = icmp_type->type;
54393b3a8eb9SGleb Smirnoff 		r->code = icmp_type->code;
54403b3a8eb9SGleb Smirnoff 
54413b3a8eb9SGleb Smirnoff 		if ((keep_state == PF_STATE_MODULATE ||
54423b3a8eb9SGleb Smirnoff 		    keep_state == PF_STATE_SYNPROXY) &&
54433b3a8eb9SGleb Smirnoff 		    r->proto && r->proto != IPPROTO_TCP)
54443b3a8eb9SGleb Smirnoff 			r->keep_state = PF_STATE_NORMAL;
54453b3a8eb9SGleb Smirnoff 		else
54463b3a8eb9SGleb Smirnoff 			r->keep_state = keep_state;
54473b3a8eb9SGleb Smirnoff 
54483b3a8eb9SGleb Smirnoff 		if (r->proto && r->proto != IPPROTO_TCP) {
54493b3a8eb9SGleb Smirnoff 			r->flags = 0;
54503b3a8eb9SGleb Smirnoff 			r->flagset = 0;
54513b3a8eb9SGleb Smirnoff 		} else {
54523b3a8eb9SGleb Smirnoff 			r->flags = flags;
54533b3a8eb9SGleb Smirnoff 			r->flagset = flagset;
54543b3a8eb9SGleb Smirnoff 		}
54553b3a8eb9SGleb Smirnoff 		if (icmp_type->proto && r->proto != icmp_type->proto) {
54563b3a8eb9SGleb Smirnoff 			yyerror("icmp-type mismatch");
54573b3a8eb9SGleb Smirnoff 			error++;
54583b3a8eb9SGleb Smirnoff 		}
54593b3a8eb9SGleb Smirnoff 
54603b3a8eb9SGleb Smirnoff 		if (src_os && src_os->os) {
54613b3a8eb9SGleb Smirnoff 			r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
54623b3a8eb9SGleb Smirnoff 			if ((pf->opts & PF_OPT_VERBOSE2) &&
54633b3a8eb9SGleb Smirnoff 			    r->os_fingerprint == PF_OSFP_NOMATCH)
54643b3a8eb9SGleb Smirnoff 				fprintf(stderr,
54653b3a8eb9SGleb Smirnoff 				    "warning: unknown '%s' OS fingerprint\n",
54663b3a8eb9SGleb Smirnoff 				    src_os->os);
54673b3a8eb9SGleb Smirnoff 		} else {
54683b3a8eb9SGleb Smirnoff 			r->os_fingerprint = PF_OSFP_ANY;
54693b3a8eb9SGleb Smirnoff 		}
54703b3a8eb9SGleb Smirnoff 
54713b3a8eb9SGleb Smirnoff 		TAILQ_INIT(&r->rpool.list);
54723b3a8eb9SGleb Smirnoff 		for (h = rpool_hosts; h != NULL; h = h->next) {
54733b3a8eb9SGleb Smirnoff 			pa = calloc(1, sizeof(struct pf_pooladdr));
54743b3a8eb9SGleb Smirnoff 			if (pa == NULL)
54753b3a8eb9SGleb Smirnoff 				err(1, "expand_rule: calloc");
54763b3a8eb9SGleb Smirnoff 			pa->addr = h->addr;
54773b3a8eb9SGleb Smirnoff 			if (h->ifname != NULL) {
54783b3a8eb9SGleb Smirnoff 				if (strlcpy(pa->ifname, h->ifname,
54793b3a8eb9SGleb Smirnoff 				    sizeof(pa->ifname)) >=
54803b3a8eb9SGleb Smirnoff 				    sizeof(pa->ifname))
54813b3a8eb9SGleb Smirnoff 					errx(1, "expand_rule: strlcpy");
54823b3a8eb9SGleb Smirnoff 			} else
54833b3a8eb9SGleb Smirnoff 				pa->ifname[0] = 0;
54843b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
54853b3a8eb9SGleb Smirnoff 		}
54863b3a8eb9SGleb Smirnoff 
54873b3a8eb9SGleb Smirnoff 		if (rule_consistent(r, anchor_call[0]) < 0 || error)
54883b3a8eb9SGleb Smirnoff 			yyerror("skipping rule due to errors");
54893b3a8eb9SGleb Smirnoff 		else {
54903b3a8eb9SGleb Smirnoff 			r->nr = pf->astack[pf->asd]->match++;
54910d71f9f3SKristof Provost 			pfctl_append_rule(pf, r, anchor_call);
54923b3a8eb9SGleb Smirnoff 			added++;
54933b3a8eb9SGleb Smirnoff 		}
54943b3a8eb9SGleb Smirnoff 
54953b3a8eb9SGleb Smirnoff 	))))))))));
54963b3a8eb9SGleb Smirnoff 
54973b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
54983b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_proto, protos);
54993b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_host, src_hosts);
55003b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_port, src_ports);
55013b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_os, src_oses);
55023b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_host, dst_hosts);
55033b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_port, dst_ports);
55043b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_uid, uids);
55053b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_gid, gids);
55063b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_icmp, icmp_types);
55073b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_host, rpool_hosts);
55083b3a8eb9SGleb Smirnoff 
55093b3a8eb9SGleb Smirnoff 	if (!added)
55103b3a8eb9SGleb Smirnoff 		yyerror("rule expands to no valid combination");
55113b3a8eb9SGleb Smirnoff }
55123b3a8eb9SGleb Smirnoff 
55133b3a8eb9SGleb Smirnoff int
55143b3a8eb9SGleb Smirnoff expand_skip_interface(struct node_if *interfaces)
55153b3a8eb9SGleb Smirnoff {
55163b3a8eb9SGleb Smirnoff 	int	errs = 0;
55173b3a8eb9SGleb Smirnoff 
55183b3a8eb9SGleb Smirnoff 	if (!interfaces || (!interfaces->next && !interfaces->not &&
55193b3a8eb9SGleb Smirnoff 	    !strcmp(interfaces->ifname, "none"))) {
55203b3a8eb9SGleb Smirnoff 		if (pf->opts & PF_OPT_VERBOSE)
55213b3a8eb9SGleb Smirnoff 			printf("set skip on none\n");
55223b3a8eb9SGleb Smirnoff 		errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
55233b3a8eb9SGleb Smirnoff 		return (errs);
55243b3a8eb9SGleb Smirnoff 	}
55253b3a8eb9SGleb Smirnoff 
55263b3a8eb9SGleb Smirnoff 	if (pf->opts & PF_OPT_VERBOSE)
55273b3a8eb9SGleb Smirnoff 		printf("set skip on {");
55283b3a8eb9SGleb Smirnoff 	LOOP_THROUGH(struct node_if, interface, interfaces,
55293b3a8eb9SGleb Smirnoff 		if (pf->opts & PF_OPT_VERBOSE)
55303b3a8eb9SGleb Smirnoff 			printf(" %s", interface->ifname);
55313b3a8eb9SGleb Smirnoff 		if (interface->not) {
55323b3a8eb9SGleb Smirnoff 			yyerror("skip on ! <interface> is not supported");
55333b3a8eb9SGleb Smirnoff 			errs++;
55343b3a8eb9SGleb Smirnoff 		} else
55353b3a8eb9SGleb Smirnoff 			errs += pfctl_set_interface_flags(pf,
55363b3a8eb9SGleb Smirnoff 			    interface->ifname, PFI_IFLAG_SKIP, 1);
55373b3a8eb9SGleb Smirnoff 	);
55383b3a8eb9SGleb Smirnoff 	if (pf->opts & PF_OPT_VERBOSE)
55393b3a8eb9SGleb Smirnoff 		printf(" }\n");
55403b3a8eb9SGleb Smirnoff 
55413b3a8eb9SGleb Smirnoff 	FREE_LIST(struct node_if, interfaces);
55423b3a8eb9SGleb Smirnoff 
55433b3a8eb9SGleb Smirnoff 	if (errs)
55443b3a8eb9SGleb Smirnoff 		return (1);
55453b3a8eb9SGleb Smirnoff 	else
55463b3a8eb9SGleb Smirnoff 		return (0);
55473b3a8eb9SGleb Smirnoff }
55483b3a8eb9SGleb Smirnoff 
55493b3a8eb9SGleb Smirnoff #undef FREE_LIST
55503b3a8eb9SGleb Smirnoff #undef LOOP_THROUGH
55513b3a8eb9SGleb Smirnoff 
55523b3a8eb9SGleb Smirnoff int
55533b3a8eb9SGleb Smirnoff check_rulestate(int desired_state)
55543b3a8eb9SGleb Smirnoff {
55553b3a8eb9SGleb Smirnoff 	if (require_order && (rulestate > desired_state)) {
55563b3a8eb9SGleb Smirnoff 		yyerror("Rules must be in order: options, normalization, "
55573b3a8eb9SGleb Smirnoff 		    "queueing, translation, filtering");
55583b3a8eb9SGleb Smirnoff 		return (1);
55593b3a8eb9SGleb Smirnoff 	}
55603b3a8eb9SGleb Smirnoff 	rulestate = desired_state;
55613b3a8eb9SGleb Smirnoff 	return (0);
55623b3a8eb9SGleb Smirnoff }
55633b3a8eb9SGleb Smirnoff 
55643b3a8eb9SGleb Smirnoff int
55653b3a8eb9SGleb Smirnoff kw_cmp(const void *k, const void *e)
55663b3a8eb9SGleb Smirnoff {
55673b3a8eb9SGleb Smirnoff 	return (strcmp(k, ((const struct keywords *)e)->k_name));
55683b3a8eb9SGleb Smirnoff }
55693b3a8eb9SGleb Smirnoff 
55703b3a8eb9SGleb Smirnoff int
55713b3a8eb9SGleb Smirnoff lookup(char *s)
55723b3a8eb9SGleb Smirnoff {
55733b3a8eb9SGleb Smirnoff 	/* this has to be sorted always */
55743b3a8eb9SGleb Smirnoff 	static const struct keywords keywords[] = {
55753b3a8eb9SGleb Smirnoff 		{ "all",		ALL},
55763b3a8eb9SGleb Smirnoff 		{ "allow-opts",		ALLOWOPTS},
55773b3a8eb9SGleb Smirnoff 		{ "altq",		ALTQ},
55783b3a8eb9SGleb Smirnoff 		{ "anchor",		ANCHOR},
55793b3a8eb9SGleb Smirnoff 		{ "antispoof",		ANTISPOOF},
55803b3a8eb9SGleb Smirnoff 		{ "any",		ANY},
55813b3a8eb9SGleb Smirnoff 		{ "bandwidth",		BANDWIDTH},
55823b3a8eb9SGleb Smirnoff 		{ "binat",		BINAT},
55833b3a8eb9SGleb Smirnoff 		{ "binat-anchor",	BINATANCHOR},
55843b3a8eb9SGleb Smirnoff 		{ "bitmask",		BITMASK},
55853b3a8eb9SGleb Smirnoff 		{ "block",		BLOCK},
55863b3a8eb9SGleb Smirnoff 		{ "block-policy",	BLOCKPOLICY},
5587a5b789f6SErmal Luçi 		{ "buckets",		BUCKETS},
55883b3a8eb9SGleb Smirnoff 		{ "cbq",		CBQ},
55893b3a8eb9SGleb Smirnoff 		{ "code",		CODE},
55900a70aaf8SLuiz Otavio O Souza 		{ "codelq",		CODEL},
55913b3a8eb9SGleb Smirnoff 		{ "crop",		FRAGCROP},
55923b3a8eb9SGleb Smirnoff 		{ "debug",		DEBUG},
55933b3a8eb9SGleb Smirnoff 		{ "divert-reply",	DIVERTREPLY},
55943b3a8eb9SGleb Smirnoff 		{ "divert-to",		DIVERTTO},
55953b3a8eb9SGleb Smirnoff 		{ "drop",		DROP},
55963b3a8eb9SGleb Smirnoff 		{ "drop-ovl",		FRAGDROP},
55973b3a8eb9SGleb Smirnoff 		{ "dup-to",		DUPTO},
5598150182e3SKristof Provost 		{ "fail-policy",	FAILPOLICY},
5599a5b789f6SErmal Luçi 		{ "fairq",		FAIRQ},
56003b3a8eb9SGleb Smirnoff 		{ "fastroute",		FASTROUTE},
56013b3a8eb9SGleb Smirnoff 		{ "file",		FILENAME},
56023b3a8eb9SGleb Smirnoff 		{ "fingerprints",	FINGERPRINTS},
56033b3a8eb9SGleb Smirnoff 		{ "flags",		FLAGS},
56043b3a8eb9SGleb Smirnoff 		{ "floating",		FLOATING},
56053b3a8eb9SGleb Smirnoff 		{ "flush",		FLUSH},
56063b3a8eb9SGleb Smirnoff 		{ "for",		FOR},
56073b3a8eb9SGleb Smirnoff 		{ "fragment",		FRAGMENT},
56083b3a8eb9SGleb Smirnoff 		{ "from",		FROM},
56093b3a8eb9SGleb Smirnoff 		{ "global",		GLOBAL},
56103b3a8eb9SGleb Smirnoff 		{ "group",		GROUP},
56113b3a8eb9SGleb Smirnoff 		{ "hfsc",		HFSC},
5612a5b789f6SErmal Luçi 		{ "hogs",		HOGS},
56133b3a8eb9SGleb Smirnoff 		{ "hostid",		HOSTID},
56143b3a8eb9SGleb Smirnoff 		{ "icmp-type",		ICMPTYPE},
56153b3a8eb9SGleb Smirnoff 		{ "icmp6-type",		ICMP6TYPE},
56163b3a8eb9SGleb Smirnoff 		{ "if-bound",		IFBOUND},
56173b3a8eb9SGleb Smirnoff 		{ "in",			IN},
56183b3a8eb9SGleb Smirnoff 		{ "include",		INCLUDE},
56193b3a8eb9SGleb Smirnoff 		{ "inet",		INET},
56203b3a8eb9SGleb Smirnoff 		{ "inet6",		INET6},
56210a70aaf8SLuiz Otavio O Souza 		{ "interval",		INTERVAL},
56223b3a8eb9SGleb Smirnoff 		{ "keep",		KEEP},
562342ec75f8SKristof Provost 		{ "keepcounters",	KEEPCOUNTERS},
56243b3a8eb9SGleb Smirnoff 		{ "label",		LABEL},
56253b3a8eb9SGleb Smirnoff 		{ "limit",		LIMIT},
56263b3a8eb9SGleb Smirnoff 		{ "linkshare",		LINKSHARE},
56273b3a8eb9SGleb Smirnoff 		{ "load",		LOAD},
56283b3a8eb9SGleb Smirnoff 		{ "log",		LOG},
56293b3a8eb9SGleb Smirnoff 		{ "loginterface",	LOGINTERFACE},
56302aa21096SKurosawa Takahiro 		{ "map-e-portset",	MAPEPORTSET},
5631ef950daaSKristof Provost 		{ "match",		MATCH},
56323b3a8eb9SGleb Smirnoff 		{ "max",		MAXIMUM},
56333b3a8eb9SGleb Smirnoff 		{ "max-mss",		MAXMSS},
56343b3a8eb9SGleb Smirnoff 		{ "max-src-conn",	MAXSRCCONN},
56353b3a8eb9SGleb Smirnoff 		{ "max-src-conn-rate",	MAXSRCCONNRATE},
56363b3a8eb9SGleb Smirnoff 		{ "max-src-nodes",	MAXSRCNODES},
56373b3a8eb9SGleb Smirnoff 		{ "max-src-states",	MAXSRCSTATES},
56383b3a8eb9SGleb Smirnoff 		{ "min-ttl",		MINTTL},
56393b3a8eb9SGleb Smirnoff 		{ "modulate",		MODULATE},
56403b3a8eb9SGleb Smirnoff 		{ "nat",		NAT},
56413b3a8eb9SGleb Smirnoff 		{ "nat-anchor",		NATANCHOR},
56423b3a8eb9SGleb Smirnoff 		{ "no",			NO},
56433b3a8eb9SGleb Smirnoff 		{ "no-df",		NODF},
56443b3a8eb9SGleb Smirnoff 		{ "no-route",		NOROUTE},
56453b3a8eb9SGleb Smirnoff 		{ "no-sync",		NOSYNC},
56463b3a8eb9SGleb Smirnoff 		{ "on",			ON},
56473b3a8eb9SGleb Smirnoff 		{ "optimization",	OPTIMIZATION},
56483b3a8eb9SGleb Smirnoff 		{ "os",			OS},
56493b3a8eb9SGleb Smirnoff 		{ "out",		OUT},
56503b3a8eb9SGleb Smirnoff 		{ "overload",		OVERLOAD},
56513b3a8eb9SGleb Smirnoff 		{ "pass",		PASS},
56523b3a8eb9SGleb Smirnoff 		{ "port",		PORT},
56533e248e0fSKristof Provost 		{ "prio",		PRIO},
56543b3a8eb9SGleb Smirnoff 		{ "priority",		PRIORITY},
56553b3a8eb9SGleb Smirnoff 		{ "priq",		PRIQ},
56563b3a8eb9SGleb Smirnoff 		{ "probability",	PROBABILITY},
56573b3a8eb9SGleb Smirnoff 		{ "proto",		PROTO},
56583b3a8eb9SGleb Smirnoff 		{ "qlimit",		QLIMIT},
56593b3a8eb9SGleb Smirnoff 		{ "queue",		QUEUE},
56603b3a8eb9SGleb Smirnoff 		{ "quick",		QUICK},
56613b3a8eb9SGleb Smirnoff 		{ "random",		RANDOM},
56623b3a8eb9SGleb Smirnoff 		{ "random-id",		RANDOMID},
56633b3a8eb9SGleb Smirnoff 		{ "rdr",		RDR},
56643b3a8eb9SGleb Smirnoff 		{ "rdr-anchor",		RDRANCHOR},
56653b3a8eb9SGleb Smirnoff 		{ "realtime",		REALTIME},
56663b3a8eb9SGleb Smirnoff 		{ "reassemble",		REASSEMBLE},
56673b3a8eb9SGleb Smirnoff 		{ "reply-to",		REPLYTO},
56683b3a8eb9SGleb Smirnoff 		{ "require-order",	REQUIREORDER},
56693b3a8eb9SGleb Smirnoff 		{ "return",		RETURN},
56703b3a8eb9SGleb Smirnoff 		{ "return-icmp",	RETURNICMP},
56713b3a8eb9SGleb Smirnoff 		{ "return-icmp6",	RETURNICMP6},
56723b3a8eb9SGleb Smirnoff 		{ "return-rst",		RETURNRST},
56733b3a8eb9SGleb Smirnoff 		{ "round-robin",	ROUNDROBIN},
56743b3a8eb9SGleb Smirnoff 		{ "route",		ROUTE},
56753b3a8eb9SGleb Smirnoff 		{ "route-to",		ROUTETO},
56763b3a8eb9SGleb Smirnoff 		{ "rtable",		RTABLE},
56773b3a8eb9SGleb Smirnoff 		{ "rule",		RULE},
56783b3a8eb9SGleb Smirnoff 		{ "ruleset-optimization",	RULESET_OPTIMIZATION},
56793b3a8eb9SGleb Smirnoff 		{ "scrub",		SCRUB},
56803b3a8eb9SGleb Smirnoff 		{ "set",		SET},
56813b3a8eb9SGleb Smirnoff 		{ "set-tos",		SETTOS},
56823b3a8eb9SGleb Smirnoff 		{ "skip",		SKIP},
56833b3a8eb9SGleb Smirnoff 		{ "sloppy",		SLOPPY},
56843b3a8eb9SGleb Smirnoff 		{ "source-hash",	SOURCEHASH},
56853b3a8eb9SGleb Smirnoff 		{ "source-track",	SOURCETRACK},
56863b3a8eb9SGleb Smirnoff 		{ "state",		STATE},
56873b3a8eb9SGleb Smirnoff 		{ "state-defaults",	STATEDEFAULTS},
56883b3a8eb9SGleb Smirnoff 		{ "state-policy",	STATEPOLICY},
56893b3a8eb9SGleb Smirnoff 		{ "static-port",	STATICPORT},
56903b3a8eb9SGleb Smirnoff 		{ "sticky-address",	STICKYADDRESS},
5691*c69121c4SKristof Provost 		{ "syncookies",         SYNCOOKIES},
56923b3a8eb9SGleb Smirnoff 		{ "synproxy",		SYNPROXY},
56933b3a8eb9SGleb Smirnoff 		{ "table",		TABLE},
56943b3a8eb9SGleb Smirnoff 		{ "tag",		TAG},
56953b3a8eb9SGleb Smirnoff 		{ "tagged",		TAGGED},
56960a70aaf8SLuiz Otavio O Souza 		{ "target",		TARGET},
56973b3a8eb9SGleb Smirnoff 		{ "tbrsize",		TBRSIZE},
56983b3a8eb9SGleb Smirnoff 		{ "timeout",		TIMEOUT},
56993b3a8eb9SGleb Smirnoff 		{ "to",			TO},
57003b3a8eb9SGleb Smirnoff 		{ "tos",		TOS},
57013b3a8eb9SGleb Smirnoff 		{ "ttl",		TTL},
57023b3a8eb9SGleb Smirnoff 		{ "upperlimit",		UPPERLIMIT},
57033b3a8eb9SGleb Smirnoff 		{ "urpf-failed",	URPFFAILED},
57043b3a8eb9SGleb Smirnoff 		{ "user",		USER},
57053b3a8eb9SGleb Smirnoff 	};
57063b3a8eb9SGleb Smirnoff 	const struct keywords	*p;
57073b3a8eb9SGleb Smirnoff 
57083b3a8eb9SGleb Smirnoff 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
57093b3a8eb9SGleb Smirnoff 	    sizeof(keywords[0]), kw_cmp);
57103b3a8eb9SGleb Smirnoff 
57113b3a8eb9SGleb Smirnoff 	if (p) {
57123b3a8eb9SGleb Smirnoff 		if (debug > 1)
57133b3a8eb9SGleb Smirnoff 			fprintf(stderr, "%s: %d\n", s, p->k_val);
57143b3a8eb9SGleb Smirnoff 		return (p->k_val);
57153b3a8eb9SGleb Smirnoff 	} else {
57163b3a8eb9SGleb Smirnoff 		if (debug > 1)
57173b3a8eb9SGleb Smirnoff 			fprintf(stderr, "string: %s\n", s);
57183b3a8eb9SGleb Smirnoff 		return (STRING);
57193b3a8eb9SGleb Smirnoff 	}
57203b3a8eb9SGleb Smirnoff }
57213b3a8eb9SGleb Smirnoff 
57223b3a8eb9SGleb Smirnoff #define MAXPUSHBACK	128
57233b3a8eb9SGleb Smirnoff 
572413cfafabSKristof Provost static char	*parsebuf;
572513cfafabSKristof Provost static int	 parseindex;
572613cfafabSKristof Provost static char	 pushback_buffer[MAXPUSHBACK];
572713cfafabSKristof Provost static int	 pushback_index = 0;
57283b3a8eb9SGleb Smirnoff 
57293b3a8eb9SGleb Smirnoff int
57303b3a8eb9SGleb Smirnoff lgetc(int quotec)
57313b3a8eb9SGleb Smirnoff {
57323b3a8eb9SGleb Smirnoff 	int		c, next;
57333b3a8eb9SGleb Smirnoff 
57343b3a8eb9SGleb Smirnoff 	if (parsebuf) {
57353b3a8eb9SGleb Smirnoff 		/* Read character from the parsebuffer instead of input. */
57363b3a8eb9SGleb Smirnoff 		if (parseindex >= 0) {
57373b3a8eb9SGleb Smirnoff 			c = parsebuf[parseindex++];
57383b3a8eb9SGleb Smirnoff 			if (c != '\0')
57393b3a8eb9SGleb Smirnoff 				return (c);
57403b3a8eb9SGleb Smirnoff 			parsebuf = NULL;
57413b3a8eb9SGleb Smirnoff 		} else
57423b3a8eb9SGleb Smirnoff 			parseindex++;
57433b3a8eb9SGleb Smirnoff 	}
57443b3a8eb9SGleb Smirnoff 
57453b3a8eb9SGleb Smirnoff 	if (pushback_index)
57463b3a8eb9SGleb Smirnoff 		return (pushback_buffer[--pushback_index]);
57473b3a8eb9SGleb Smirnoff 
57483b3a8eb9SGleb Smirnoff 	if (quotec) {
57493b3a8eb9SGleb Smirnoff 		if ((c = getc(file->stream)) == EOF) {
57503b3a8eb9SGleb Smirnoff 			yyerror("reached end of file while parsing quoted string");
57513b3a8eb9SGleb Smirnoff 			if (popfile() == EOF)
57523b3a8eb9SGleb Smirnoff 				return (EOF);
57533b3a8eb9SGleb Smirnoff 			return (quotec);
57543b3a8eb9SGleb Smirnoff 		}
57553b3a8eb9SGleb Smirnoff 		return (c);
57563b3a8eb9SGleb Smirnoff 	}
57573b3a8eb9SGleb Smirnoff 
57583b3a8eb9SGleb Smirnoff 	while ((c = getc(file->stream)) == '\\') {
57593b3a8eb9SGleb Smirnoff 		next = getc(file->stream);
57603b3a8eb9SGleb Smirnoff 		if (next != '\n') {
57613b3a8eb9SGleb Smirnoff 			c = next;
57623b3a8eb9SGleb Smirnoff 			break;
57633b3a8eb9SGleb Smirnoff 		}
57643b3a8eb9SGleb Smirnoff 		yylval.lineno = file->lineno;
57653b3a8eb9SGleb Smirnoff 		file->lineno++;
57663b3a8eb9SGleb Smirnoff 	}
57673b3a8eb9SGleb Smirnoff 
57683b3a8eb9SGleb Smirnoff 	while (c == EOF) {
57693b3a8eb9SGleb Smirnoff 		if (popfile() == EOF)
57703b3a8eb9SGleb Smirnoff 			return (EOF);
57713b3a8eb9SGleb Smirnoff 		c = getc(file->stream);
57723b3a8eb9SGleb Smirnoff 	}
57733b3a8eb9SGleb Smirnoff 	return (c);
57743b3a8eb9SGleb Smirnoff }
57753b3a8eb9SGleb Smirnoff 
57763b3a8eb9SGleb Smirnoff int
57773b3a8eb9SGleb Smirnoff lungetc(int c)
57783b3a8eb9SGleb Smirnoff {
57793b3a8eb9SGleb Smirnoff 	if (c == EOF)
57803b3a8eb9SGleb Smirnoff 		return (EOF);
57813b3a8eb9SGleb Smirnoff 	if (parsebuf) {
57823b3a8eb9SGleb Smirnoff 		parseindex--;
57833b3a8eb9SGleb Smirnoff 		if (parseindex >= 0)
57843b3a8eb9SGleb Smirnoff 			return (c);
57853b3a8eb9SGleb Smirnoff 	}
57863b3a8eb9SGleb Smirnoff 	if (pushback_index < MAXPUSHBACK-1)
57873b3a8eb9SGleb Smirnoff 		return (pushback_buffer[pushback_index++] = c);
57883b3a8eb9SGleb Smirnoff 	else
57893b3a8eb9SGleb Smirnoff 		return (EOF);
57903b3a8eb9SGleb Smirnoff }
57913b3a8eb9SGleb Smirnoff 
57923b3a8eb9SGleb Smirnoff int
57933b3a8eb9SGleb Smirnoff findeol(void)
57943b3a8eb9SGleb Smirnoff {
57953b3a8eb9SGleb Smirnoff 	int	c;
57963b3a8eb9SGleb Smirnoff 
57973b3a8eb9SGleb Smirnoff 	parsebuf = NULL;
57983b3a8eb9SGleb Smirnoff 
57993b3a8eb9SGleb Smirnoff 	/* skip to either EOF or the first real EOL */
58003b3a8eb9SGleb Smirnoff 	while (1) {
58013b3a8eb9SGleb Smirnoff 		if (pushback_index)
58023b3a8eb9SGleb Smirnoff 			c = pushback_buffer[--pushback_index];
58033b3a8eb9SGleb Smirnoff 		else
58043b3a8eb9SGleb Smirnoff 			c = lgetc(0);
58053b3a8eb9SGleb Smirnoff 		if (c == '\n') {
58063b3a8eb9SGleb Smirnoff 			file->lineno++;
58073b3a8eb9SGleb Smirnoff 			break;
58083b3a8eb9SGleb Smirnoff 		}
58093b3a8eb9SGleb Smirnoff 		if (c == EOF)
58103b3a8eb9SGleb Smirnoff 			break;
58113b3a8eb9SGleb Smirnoff 	}
58123b3a8eb9SGleb Smirnoff 	return (ERROR);
58133b3a8eb9SGleb Smirnoff }
58143b3a8eb9SGleb Smirnoff 
58153b3a8eb9SGleb Smirnoff int
58163b3a8eb9SGleb Smirnoff yylex(void)
58173b3a8eb9SGleb Smirnoff {
58183b3a8eb9SGleb Smirnoff 	char	 buf[8096];
58193b3a8eb9SGleb Smirnoff 	char	*p, *val;
58203b3a8eb9SGleb Smirnoff 	int	 quotec, next, c;
58213b3a8eb9SGleb Smirnoff 	int	 token;
58223b3a8eb9SGleb Smirnoff 
58233b3a8eb9SGleb Smirnoff top:
58243b3a8eb9SGleb Smirnoff 	p = buf;
58253b3a8eb9SGleb Smirnoff 	while ((c = lgetc(0)) == ' ' || c == '\t')
58263b3a8eb9SGleb Smirnoff 		; /* nothing */
58273b3a8eb9SGleb Smirnoff 
58283b3a8eb9SGleb Smirnoff 	yylval.lineno = file->lineno;
58293b3a8eb9SGleb Smirnoff 	if (c == '#')
58303b3a8eb9SGleb Smirnoff 		while ((c = lgetc(0)) != '\n' && c != EOF)
58313b3a8eb9SGleb Smirnoff 			; /* nothing */
58323b3a8eb9SGleb Smirnoff 	if (c == '$' && parsebuf == NULL) {
58333b3a8eb9SGleb Smirnoff 		while (1) {
58343b3a8eb9SGleb Smirnoff 			if ((c = lgetc(0)) == EOF)
58353b3a8eb9SGleb Smirnoff 				return (0);
58363b3a8eb9SGleb Smirnoff 
58373b3a8eb9SGleb Smirnoff 			if (p + 1 >= buf + sizeof(buf) - 1) {
58383b3a8eb9SGleb Smirnoff 				yyerror("string too long");
58393b3a8eb9SGleb Smirnoff 				return (findeol());
58403b3a8eb9SGleb Smirnoff 			}
58413b3a8eb9SGleb Smirnoff 			if (isalnum(c) || c == '_') {
58423b3a8eb9SGleb Smirnoff 				*p++ = (char)c;
58433b3a8eb9SGleb Smirnoff 				continue;
58443b3a8eb9SGleb Smirnoff 			}
58453b3a8eb9SGleb Smirnoff 			*p = '\0';
58463b3a8eb9SGleb Smirnoff 			lungetc(c);
58473b3a8eb9SGleb Smirnoff 			break;
58483b3a8eb9SGleb Smirnoff 		}
58493b3a8eb9SGleb Smirnoff 		val = symget(buf);
58503b3a8eb9SGleb Smirnoff 		if (val == NULL) {
58513b3a8eb9SGleb Smirnoff 			yyerror("macro '%s' not defined", buf);
58523b3a8eb9SGleb Smirnoff 			return (findeol());
58533b3a8eb9SGleb Smirnoff 		}
58543b3a8eb9SGleb Smirnoff 		parsebuf = val;
58553b3a8eb9SGleb Smirnoff 		parseindex = 0;
58563b3a8eb9SGleb Smirnoff 		goto top;
58573b3a8eb9SGleb Smirnoff 	}
58583b3a8eb9SGleb Smirnoff 
58593b3a8eb9SGleb Smirnoff 	switch (c) {
58603b3a8eb9SGleb Smirnoff 	case '\'':
58613b3a8eb9SGleb Smirnoff 	case '"':
58623b3a8eb9SGleb Smirnoff 		quotec = c;
58633b3a8eb9SGleb Smirnoff 		while (1) {
58643b3a8eb9SGleb Smirnoff 			if ((c = lgetc(quotec)) == EOF)
58653b3a8eb9SGleb Smirnoff 				return (0);
58663b3a8eb9SGleb Smirnoff 			if (c == '\n') {
58673b3a8eb9SGleb Smirnoff 				file->lineno++;
58683b3a8eb9SGleb Smirnoff 				continue;
58693b3a8eb9SGleb Smirnoff 			} else if (c == '\\') {
58703b3a8eb9SGleb Smirnoff 				if ((next = lgetc(quotec)) == EOF)
58713b3a8eb9SGleb Smirnoff 					return (0);
58723b3a8eb9SGleb Smirnoff 				if (next == quotec || c == ' ' || c == '\t')
58733b3a8eb9SGleb Smirnoff 					c = next;
58744a8e4793SKristof Provost 				else if (next == '\n') {
58754a8e4793SKristof Provost 					file->lineno++;
58763b3a8eb9SGleb Smirnoff 					continue;
58774a8e4793SKristof Provost 				}
58783b3a8eb9SGleb Smirnoff 				else
58793b3a8eb9SGleb Smirnoff 					lungetc(next);
58803b3a8eb9SGleb Smirnoff 			} else if (c == quotec) {
58813b3a8eb9SGleb Smirnoff 				*p = '\0';
58823b3a8eb9SGleb Smirnoff 				break;
58833b3a8eb9SGleb Smirnoff 			}
58843b3a8eb9SGleb Smirnoff 			if (p + 1 >= buf + sizeof(buf) - 1) {
58853b3a8eb9SGleb Smirnoff 				yyerror("string too long");
58863b3a8eb9SGleb Smirnoff 				return (findeol());
58873b3a8eb9SGleb Smirnoff 			}
58883b3a8eb9SGleb Smirnoff 			*p++ = (char)c;
58893b3a8eb9SGleb Smirnoff 		}
58903b3a8eb9SGleb Smirnoff 		yylval.v.string = strdup(buf);
58913b3a8eb9SGleb Smirnoff 		if (yylval.v.string == NULL)
58923b3a8eb9SGleb Smirnoff 			err(1, "yylex: strdup");
58933b3a8eb9SGleb Smirnoff 		return (STRING);
58943b3a8eb9SGleb Smirnoff 	case '<':
58953b3a8eb9SGleb Smirnoff 		next = lgetc(0);
58963b3a8eb9SGleb Smirnoff 		if (next == '>') {
58973b3a8eb9SGleb Smirnoff 			yylval.v.i = PF_OP_XRG;
58983b3a8eb9SGleb Smirnoff 			return (PORTBINARY);
58993b3a8eb9SGleb Smirnoff 		}
59003b3a8eb9SGleb Smirnoff 		lungetc(next);
59013b3a8eb9SGleb Smirnoff 		break;
59023b3a8eb9SGleb Smirnoff 	case '>':
59033b3a8eb9SGleb Smirnoff 		next = lgetc(0);
59043b3a8eb9SGleb Smirnoff 		if (next == '<') {
59053b3a8eb9SGleb Smirnoff 			yylval.v.i = PF_OP_IRG;
59063b3a8eb9SGleb Smirnoff 			return (PORTBINARY);
59073b3a8eb9SGleb Smirnoff 		}
59083b3a8eb9SGleb Smirnoff 		lungetc(next);
59093b3a8eb9SGleb Smirnoff 		break;
59103b3a8eb9SGleb Smirnoff 	case '-':
59113b3a8eb9SGleb Smirnoff 		next = lgetc(0);
59123b3a8eb9SGleb Smirnoff 		if (next == '>')
59133b3a8eb9SGleb Smirnoff 			return (ARROW);
59143b3a8eb9SGleb Smirnoff 		lungetc(next);
59153b3a8eb9SGleb Smirnoff 		break;
59163b3a8eb9SGleb Smirnoff 	}
59173b3a8eb9SGleb Smirnoff 
59183b3a8eb9SGleb Smirnoff #define allowed_to_end_number(x) \
59193b3a8eb9SGleb Smirnoff 	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
59203b3a8eb9SGleb Smirnoff 
59213b3a8eb9SGleb Smirnoff 	if (c == '-' || isdigit(c)) {
59223b3a8eb9SGleb Smirnoff 		do {
59233b3a8eb9SGleb Smirnoff 			*p++ = c;
59243b3a8eb9SGleb Smirnoff 			if ((unsigned)(p-buf) >= sizeof(buf)) {
59253b3a8eb9SGleb Smirnoff 				yyerror("string too long");
59263b3a8eb9SGleb Smirnoff 				return (findeol());
59273b3a8eb9SGleb Smirnoff 			}
59283b3a8eb9SGleb Smirnoff 		} while ((c = lgetc(0)) != EOF && isdigit(c));
59293b3a8eb9SGleb Smirnoff 		lungetc(c);
59303b3a8eb9SGleb Smirnoff 		if (p == buf + 1 && buf[0] == '-')
59313b3a8eb9SGleb Smirnoff 			goto nodigits;
59323b3a8eb9SGleb Smirnoff 		if (c == EOF || allowed_to_end_number(c)) {
59333b3a8eb9SGleb Smirnoff 			const char *errstr = NULL;
59343b3a8eb9SGleb Smirnoff 
59353b3a8eb9SGleb Smirnoff 			*p = '\0';
59363b3a8eb9SGleb Smirnoff 			yylval.v.number = strtonum(buf, LLONG_MIN,
59373b3a8eb9SGleb Smirnoff 			    LLONG_MAX, &errstr);
59383b3a8eb9SGleb Smirnoff 			if (errstr) {
59393b3a8eb9SGleb Smirnoff 				yyerror("\"%s\" invalid number: %s",
59403b3a8eb9SGleb Smirnoff 				    buf, errstr);
59413b3a8eb9SGleb Smirnoff 				return (findeol());
59423b3a8eb9SGleb Smirnoff 			}
59433b3a8eb9SGleb Smirnoff 			return (NUMBER);
59443b3a8eb9SGleb Smirnoff 		} else {
59453b3a8eb9SGleb Smirnoff nodigits:
59463b3a8eb9SGleb Smirnoff 			while (p > buf + 1)
59473b3a8eb9SGleb Smirnoff 				lungetc(*--p);
59483b3a8eb9SGleb Smirnoff 			c = *--p;
59493b3a8eb9SGleb Smirnoff 			if (c == '-')
59503b3a8eb9SGleb Smirnoff 				return (c);
59513b3a8eb9SGleb Smirnoff 		}
59523b3a8eb9SGleb Smirnoff 	}
59533b3a8eb9SGleb Smirnoff 
59543b3a8eb9SGleb Smirnoff #define allowed_in_string(x) \
59553b3a8eb9SGleb Smirnoff 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
59563b3a8eb9SGleb Smirnoff 	x != '{' && x != '}' && x != '<' && x != '>' && \
59573b3a8eb9SGleb Smirnoff 	x != '!' && x != '=' && x != '/' && x != '#' && \
59583b3a8eb9SGleb Smirnoff 	x != ','))
59593b3a8eb9SGleb Smirnoff 
59603b3a8eb9SGleb Smirnoff 	if (isalnum(c) || c == ':' || c == '_') {
59613b3a8eb9SGleb Smirnoff 		do {
59623b3a8eb9SGleb Smirnoff 			*p++ = c;
59633b3a8eb9SGleb Smirnoff 			if ((unsigned)(p-buf) >= sizeof(buf)) {
59643b3a8eb9SGleb Smirnoff 				yyerror("string too long");
59653b3a8eb9SGleb Smirnoff 				return (findeol());
59663b3a8eb9SGleb Smirnoff 			}
59673b3a8eb9SGleb Smirnoff 		} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
59683b3a8eb9SGleb Smirnoff 		lungetc(c);
59693b3a8eb9SGleb Smirnoff 		*p = '\0';
59703b3a8eb9SGleb Smirnoff 		if ((token = lookup(buf)) == STRING)
59713b3a8eb9SGleb Smirnoff 			if ((yylval.v.string = strdup(buf)) == NULL)
59723b3a8eb9SGleb Smirnoff 				err(1, "yylex: strdup");
59733b3a8eb9SGleb Smirnoff 		return (token);
59743b3a8eb9SGleb Smirnoff 	}
59753b3a8eb9SGleb Smirnoff 	if (c == '\n') {
59763b3a8eb9SGleb Smirnoff 		yylval.lineno = file->lineno;
59773b3a8eb9SGleb Smirnoff 		file->lineno++;
59783b3a8eb9SGleb Smirnoff 	}
59793b3a8eb9SGleb Smirnoff 	if (c == EOF)
59803b3a8eb9SGleb Smirnoff 		return (0);
59813b3a8eb9SGleb Smirnoff 	return (c);
59823b3a8eb9SGleb Smirnoff }
59833b3a8eb9SGleb Smirnoff 
59843b3a8eb9SGleb Smirnoff int
59853b3a8eb9SGleb Smirnoff check_file_secrecy(int fd, const char *fname)
59863b3a8eb9SGleb Smirnoff {
59873b3a8eb9SGleb Smirnoff 	struct stat	st;
59883b3a8eb9SGleb Smirnoff 
59893b3a8eb9SGleb Smirnoff 	if (fstat(fd, &st)) {
59903b3a8eb9SGleb Smirnoff 		warn("cannot stat %s", fname);
59913b3a8eb9SGleb Smirnoff 		return (-1);
59923b3a8eb9SGleb Smirnoff 	}
59933b3a8eb9SGleb Smirnoff 	if (st.st_uid != 0 && st.st_uid != getuid()) {
59943b3a8eb9SGleb Smirnoff 		warnx("%s: owner not root or current user", fname);
59953b3a8eb9SGleb Smirnoff 		return (-1);
59963b3a8eb9SGleb Smirnoff 	}
59973b3a8eb9SGleb Smirnoff 	if (st.st_mode & (S_IRWXG | S_IRWXO)) {
59983b3a8eb9SGleb Smirnoff 		warnx("%s: group/world readable/writeable", fname);
59993b3a8eb9SGleb Smirnoff 		return (-1);
60003b3a8eb9SGleb Smirnoff 	}
60013b3a8eb9SGleb Smirnoff 	return (0);
60023b3a8eb9SGleb Smirnoff }
60033b3a8eb9SGleb Smirnoff 
60043b3a8eb9SGleb Smirnoff struct file *
60053b3a8eb9SGleb Smirnoff pushfile(const char *name, int secret)
60063b3a8eb9SGleb Smirnoff {
60073b3a8eb9SGleb Smirnoff 	struct file	*nfile;
60083b3a8eb9SGleb Smirnoff 
60093b3a8eb9SGleb Smirnoff 	if ((nfile = calloc(1, sizeof(struct file))) == NULL ||
60103b3a8eb9SGleb Smirnoff 	    (nfile->name = strdup(name)) == NULL) {
60113b3a8eb9SGleb Smirnoff 		warn("malloc");
60123b3a8eb9SGleb Smirnoff 		return (NULL);
60133b3a8eb9SGleb Smirnoff 	}
60143b3a8eb9SGleb Smirnoff 	if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) {
60153b3a8eb9SGleb Smirnoff 		nfile->stream = stdin;
60163b3a8eb9SGleb Smirnoff 		free(nfile->name);
60173b3a8eb9SGleb Smirnoff 		if ((nfile->name = strdup("stdin")) == NULL) {
60183b3a8eb9SGleb Smirnoff 			warn("strdup");
60193b3a8eb9SGleb Smirnoff 			free(nfile);
60203b3a8eb9SGleb Smirnoff 			return (NULL);
60213b3a8eb9SGleb Smirnoff 		}
60223b3a8eb9SGleb Smirnoff 	} else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
60233b3a8eb9SGleb Smirnoff 		warn("%s", nfile->name);
60243b3a8eb9SGleb Smirnoff 		free(nfile->name);
60253b3a8eb9SGleb Smirnoff 		free(nfile);
60263b3a8eb9SGleb Smirnoff 		return (NULL);
60273b3a8eb9SGleb Smirnoff 	} else if (secret &&
60283b3a8eb9SGleb Smirnoff 	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
60293b3a8eb9SGleb Smirnoff 		fclose(nfile->stream);
60303b3a8eb9SGleb Smirnoff 		free(nfile->name);
60313b3a8eb9SGleb Smirnoff 		free(nfile);
60323b3a8eb9SGleb Smirnoff 		return (NULL);
60333b3a8eb9SGleb Smirnoff 	}
60343b3a8eb9SGleb Smirnoff 	nfile->lineno = 1;
60353b3a8eb9SGleb Smirnoff 	TAILQ_INSERT_TAIL(&files, nfile, entry);
60363b3a8eb9SGleb Smirnoff 	return (nfile);
60373b3a8eb9SGleb Smirnoff }
60383b3a8eb9SGleb Smirnoff 
60393b3a8eb9SGleb Smirnoff int
60403b3a8eb9SGleb Smirnoff popfile(void)
60413b3a8eb9SGleb Smirnoff {
60423b3a8eb9SGleb Smirnoff 	struct file	*prev;
60433b3a8eb9SGleb Smirnoff 
60443b3a8eb9SGleb Smirnoff 	if ((prev = TAILQ_PREV(file, files, entry)) != NULL) {
60453b3a8eb9SGleb Smirnoff 		prev->errors += file->errors;
60463b3a8eb9SGleb Smirnoff 		TAILQ_REMOVE(&files, file, entry);
60473b3a8eb9SGleb Smirnoff 		fclose(file->stream);
60483b3a8eb9SGleb Smirnoff 		free(file->name);
60493b3a8eb9SGleb Smirnoff 		free(file);
60503b3a8eb9SGleb Smirnoff 		file = prev;
60513b3a8eb9SGleb Smirnoff 		return (0);
60523b3a8eb9SGleb Smirnoff 	}
60533b3a8eb9SGleb Smirnoff 	return (EOF);
60543b3a8eb9SGleb Smirnoff }
60553b3a8eb9SGleb Smirnoff 
60563b3a8eb9SGleb Smirnoff int
60573b3a8eb9SGleb Smirnoff parse_config(char *filename, struct pfctl *xpf)
60583b3a8eb9SGleb Smirnoff {
60593b3a8eb9SGleb Smirnoff 	int		 errors = 0;
60603b3a8eb9SGleb Smirnoff 	struct sym	*sym;
60613b3a8eb9SGleb Smirnoff 
60623b3a8eb9SGleb Smirnoff 	pf = xpf;
60633b3a8eb9SGleb Smirnoff 	errors = 0;
60643b3a8eb9SGleb Smirnoff 	rulestate = PFCTL_STATE_NONE;
60653b3a8eb9SGleb Smirnoff 	returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
60663b3a8eb9SGleb Smirnoff 	returnicmp6default =
60673b3a8eb9SGleb Smirnoff 	    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
60683b3a8eb9SGleb Smirnoff 	blockpolicy = PFRULE_DROP;
6069150182e3SKristof Provost 	failpolicy = PFRULE_DROP;
60703b3a8eb9SGleb Smirnoff 	require_order = 1;
60713b3a8eb9SGleb Smirnoff 
60723b3a8eb9SGleb Smirnoff 	if ((file = pushfile(filename, 0)) == NULL) {
60733b3a8eb9SGleb Smirnoff 		warn("cannot open the main config file!");
60743b3a8eb9SGleb Smirnoff 		return (-1);
60753b3a8eb9SGleb Smirnoff 	}
60763b3a8eb9SGleb Smirnoff 
60773b3a8eb9SGleb Smirnoff 	yyparse();
60783b3a8eb9SGleb Smirnoff 	errors = file->errors;
60793b3a8eb9SGleb Smirnoff 	popfile();
60803b3a8eb9SGleb Smirnoff 
60813b3a8eb9SGleb Smirnoff 	/* Free macros and check which have not been used. */
60823b3a8eb9SGleb Smirnoff 	while ((sym = TAILQ_FIRST(&symhead))) {
60833b3a8eb9SGleb Smirnoff 		if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
60843b3a8eb9SGleb Smirnoff 			fprintf(stderr, "warning: macro '%s' not "
60853b3a8eb9SGleb Smirnoff 			    "used\n", sym->nam);
60863b3a8eb9SGleb Smirnoff 		free(sym->nam);
60873b3a8eb9SGleb Smirnoff 		free(sym->val);
60883b3a8eb9SGleb Smirnoff 		TAILQ_REMOVE(&symhead, sym, entry);
60893b3a8eb9SGleb Smirnoff 		free(sym);
60903b3a8eb9SGleb Smirnoff 	}
60913b3a8eb9SGleb Smirnoff 
60923b3a8eb9SGleb Smirnoff 	return (errors ? -1 : 0);
60933b3a8eb9SGleb Smirnoff }
60943b3a8eb9SGleb Smirnoff 
60953b3a8eb9SGleb Smirnoff int
60963b3a8eb9SGleb Smirnoff symset(const char *nam, const char *val, int persist)
60973b3a8eb9SGleb Smirnoff {
60983b3a8eb9SGleb Smirnoff 	struct sym	*sym;
60993b3a8eb9SGleb Smirnoff 
61003b3a8eb9SGleb Smirnoff 	for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
61013b3a8eb9SGleb Smirnoff 	    sym = TAILQ_NEXT(sym, entry))
61023b3a8eb9SGleb Smirnoff 		;	/* nothing */
61033b3a8eb9SGleb Smirnoff 
61043b3a8eb9SGleb Smirnoff 	if (sym != NULL) {
61053b3a8eb9SGleb Smirnoff 		if (sym->persist == 1)
61063b3a8eb9SGleb Smirnoff 			return (0);
61073b3a8eb9SGleb Smirnoff 		else {
61083b3a8eb9SGleb Smirnoff 			free(sym->nam);
61093b3a8eb9SGleb Smirnoff 			free(sym->val);
61103b3a8eb9SGleb Smirnoff 			TAILQ_REMOVE(&symhead, sym, entry);
61113b3a8eb9SGleb Smirnoff 			free(sym);
61123b3a8eb9SGleb Smirnoff 		}
61133b3a8eb9SGleb Smirnoff 	}
61143b3a8eb9SGleb Smirnoff 	if ((sym = calloc(1, sizeof(*sym))) == NULL)
61153b3a8eb9SGleb Smirnoff 		return (-1);
61163b3a8eb9SGleb Smirnoff 
61173b3a8eb9SGleb Smirnoff 	sym->nam = strdup(nam);
61183b3a8eb9SGleb Smirnoff 	if (sym->nam == NULL) {
61193b3a8eb9SGleb Smirnoff 		free(sym);
61203b3a8eb9SGleb Smirnoff 		return (-1);
61213b3a8eb9SGleb Smirnoff 	}
61223b3a8eb9SGleb Smirnoff 	sym->val = strdup(val);
61233b3a8eb9SGleb Smirnoff 	if (sym->val == NULL) {
61243b3a8eb9SGleb Smirnoff 		free(sym->nam);
61253b3a8eb9SGleb Smirnoff 		free(sym);
61263b3a8eb9SGleb Smirnoff 		return (-1);
61273b3a8eb9SGleb Smirnoff 	}
61283b3a8eb9SGleb Smirnoff 	sym->used = 0;
61293b3a8eb9SGleb Smirnoff 	sym->persist = persist;
61303b3a8eb9SGleb Smirnoff 	TAILQ_INSERT_TAIL(&symhead, sym, entry);
61313b3a8eb9SGleb Smirnoff 	return (0);
61323b3a8eb9SGleb Smirnoff }
61333b3a8eb9SGleb Smirnoff 
61343b3a8eb9SGleb Smirnoff int
61353b3a8eb9SGleb Smirnoff pfctl_cmdline_symset(char *s)
61363b3a8eb9SGleb Smirnoff {
61373b3a8eb9SGleb Smirnoff 	char	*sym, *val;
61383b3a8eb9SGleb Smirnoff 	int	 ret;
61393b3a8eb9SGleb Smirnoff 
61403b3a8eb9SGleb Smirnoff 	if ((val = strrchr(s, '=')) == NULL)
61413b3a8eb9SGleb Smirnoff 		return (-1);
61423b3a8eb9SGleb Smirnoff 
61433b3a8eb9SGleb Smirnoff 	if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
61443b3a8eb9SGleb Smirnoff 		err(1, "pfctl_cmdline_symset: malloc");
61453b3a8eb9SGleb Smirnoff 
61463b3a8eb9SGleb Smirnoff 	strlcpy(sym, s, strlen(s) - strlen(val) + 1);
61473b3a8eb9SGleb Smirnoff 
61483b3a8eb9SGleb Smirnoff 	ret = symset(sym, val + 1, 1);
61493b3a8eb9SGleb Smirnoff 	free(sym);
61503b3a8eb9SGleb Smirnoff 
61513b3a8eb9SGleb Smirnoff 	return (ret);
61523b3a8eb9SGleb Smirnoff }
61533b3a8eb9SGleb Smirnoff 
61543b3a8eb9SGleb Smirnoff char *
61553b3a8eb9SGleb Smirnoff symget(const char *nam)
61563b3a8eb9SGleb Smirnoff {
61573b3a8eb9SGleb Smirnoff 	struct sym	*sym;
61583b3a8eb9SGleb Smirnoff 
61593b3a8eb9SGleb Smirnoff 	TAILQ_FOREACH(sym, &symhead, entry)
61603b3a8eb9SGleb Smirnoff 		if (strcmp(nam, sym->nam) == 0) {
61613b3a8eb9SGleb Smirnoff 			sym->used = 1;
61623b3a8eb9SGleb Smirnoff 			return (sym->val);
61633b3a8eb9SGleb Smirnoff 		}
61643b3a8eb9SGleb Smirnoff 	return (NULL);
61653b3a8eb9SGleb Smirnoff }
61663b3a8eb9SGleb Smirnoff 
61673b3a8eb9SGleb Smirnoff void
6168e9eb0941SKristof Provost mv_rules(struct pfctl_ruleset *src, struct pfctl_ruleset *dst)
61693b3a8eb9SGleb Smirnoff {
61703b3a8eb9SGleb Smirnoff 	int i;
6171e9eb0941SKristof Provost 	struct pfctl_rule *r;
61723b3a8eb9SGleb Smirnoff 
61733b3a8eb9SGleb Smirnoff 	for (i = 0; i < PF_RULESET_MAX; ++i) {
61743b3a8eb9SGleb Smirnoff 		while ((r = TAILQ_FIRST(src->rules[i].active.ptr))
61753b3a8eb9SGleb Smirnoff 		    != NULL) {
61763b3a8eb9SGleb Smirnoff 			TAILQ_REMOVE(src->rules[i].active.ptr, r, entries);
61773b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries);
61783b3a8eb9SGleb Smirnoff 			dst->anchor->match++;
61793b3a8eb9SGleb Smirnoff 		}
61803b3a8eb9SGleb Smirnoff 		src->anchor->match = 0;
61813b3a8eb9SGleb Smirnoff 		while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr))
61823b3a8eb9SGleb Smirnoff 		    != NULL) {
61833b3a8eb9SGleb Smirnoff 			TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries);
61843b3a8eb9SGleb Smirnoff 			TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr,
61853b3a8eb9SGleb Smirnoff 				r, entries);
61863b3a8eb9SGleb Smirnoff 		}
61873b3a8eb9SGleb Smirnoff 	}
61883b3a8eb9SGleb Smirnoff }
61893b3a8eb9SGleb Smirnoff 
61903b3a8eb9SGleb Smirnoff void
61913b3a8eb9SGleb Smirnoff decide_address_family(struct node_host *n, sa_family_t *af)
61923b3a8eb9SGleb Smirnoff {
61933b3a8eb9SGleb Smirnoff 	if (*af != 0 || n == NULL)
61943b3a8eb9SGleb Smirnoff 		return;
61953b3a8eb9SGleb Smirnoff 	*af = n->af;
61963b3a8eb9SGleb Smirnoff 	while ((n = n->next) != NULL) {
61973b3a8eb9SGleb Smirnoff 		if (n->af != *af) {
61983b3a8eb9SGleb Smirnoff 			*af = 0;
61993b3a8eb9SGleb Smirnoff 			return;
62003b3a8eb9SGleb Smirnoff 		}
62013b3a8eb9SGleb Smirnoff 	}
62023b3a8eb9SGleb Smirnoff }
62033b3a8eb9SGleb Smirnoff 
62043b3a8eb9SGleb Smirnoff void
62053b3a8eb9SGleb Smirnoff remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
62063b3a8eb9SGleb Smirnoff {
62073b3a8eb9SGleb Smirnoff 	struct node_host	*n = *nh, *prev = NULL;
62083b3a8eb9SGleb Smirnoff 
62093b3a8eb9SGleb Smirnoff 	while (n != NULL) {
62103b3a8eb9SGleb Smirnoff 		if (*af && n->af && n->af != *af) {
62113b3a8eb9SGleb Smirnoff 			/* unlink and free n */
62123b3a8eb9SGleb Smirnoff 			struct node_host *next = n->next;
62133b3a8eb9SGleb Smirnoff 
62143b3a8eb9SGleb Smirnoff 			/* adjust tail pointer */
62153b3a8eb9SGleb Smirnoff 			if (n == (*nh)->tail)
62163b3a8eb9SGleb Smirnoff 				(*nh)->tail = prev;
62173b3a8eb9SGleb Smirnoff 			/* adjust previous node's next pointer */
62183b3a8eb9SGleb Smirnoff 			if (prev == NULL)
62193b3a8eb9SGleb Smirnoff 				*nh = next;
62203b3a8eb9SGleb Smirnoff 			else
62213b3a8eb9SGleb Smirnoff 				prev->next = next;
62223b3a8eb9SGleb Smirnoff 			/* free node */
62233b3a8eb9SGleb Smirnoff 			if (n->ifname != NULL)
62243b3a8eb9SGleb Smirnoff 				free(n->ifname);
62253b3a8eb9SGleb Smirnoff 			free(n);
62263b3a8eb9SGleb Smirnoff 			n = next;
62273b3a8eb9SGleb Smirnoff 		} else {
62283b3a8eb9SGleb Smirnoff 			if (n->af && !*af)
62293b3a8eb9SGleb Smirnoff 				*af = n->af;
62303b3a8eb9SGleb Smirnoff 			prev = n;
62313b3a8eb9SGleb Smirnoff 			n = n->next;
62323b3a8eb9SGleb Smirnoff 		}
62333b3a8eb9SGleb Smirnoff 	}
62343b3a8eb9SGleb Smirnoff }
62353b3a8eb9SGleb Smirnoff 
62363b3a8eb9SGleb Smirnoff int
62373b3a8eb9SGleb Smirnoff invalid_redirect(struct node_host *nh, sa_family_t af)
62383b3a8eb9SGleb Smirnoff {
62393b3a8eb9SGleb Smirnoff 	if (!af) {
62403b3a8eb9SGleb Smirnoff 		struct node_host *n;
62413b3a8eb9SGleb Smirnoff 
62423b3a8eb9SGleb Smirnoff 		/* tables and dyniftl are ok without an address family */
62433b3a8eb9SGleb Smirnoff 		for (n = nh; n != NULL; n = n->next) {
62443b3a8eb9SGleb Smirnoff 			if (n->addr.type != PF_ADDR_TABLE &&
62453b3a8eb9SGleb Smirnoff 			    n->addr.type != PF_ADDR_DYNIFTL) {
62463b3a8eb9SGleb Smirnoff 				yyerror("address family not given and "
62473b3a8eb9SGleb Smirnoff 				    "translation address expands to multiple "
62483b3a8eb9SGleb Smirnoff 				    "address families");
62493b3a8eb9SGleb Smirnoff 				return (1);
62503b3a8eb9SGleb Smirnoff 			}
62513b3a8eb9SGleb Smirnoff 		}
62523b3a8eb9SGleb Smirnoff 	}
62533b3a8eb9SGleb Smirnoff 	if (nh == NULL) {
62543b3a8eb9SGleb Smirnoff 		yyerror("no translation address with matching address family "
62553b3a8eb9SGleb Smirnoff 		    "found.");
62563b3a8eb9SGleb Smirnoff 		return (1);
62573b3a8eb9SGleb Smirnoff 	}
62583b3a8eb9SGleb Smirnoff 	return (0);
62593b3a8eb9SGleb Smirnoff }
62603b3a8eb9SGleb Smirnoff 
62613b3a8eb9SGleb Smirnoff int
62623b3a8eb9SGleb Smirnoff atoul(char *s, u_long *ulvalp)
62633b3a8eb9SGleb Smirnoff {
62643b3a8eb9SGleb Smirnoff 	u_long	 ulval;
62653b3a8eb9SGleb Smirnoff 	char	*ep;
62663b3a8eb9SGleb Smirnoff 
62673b3a8eb9SGleb Smirnoff 	errno = 0;
62683b3a8eb9SGleb Smirnoff 	ulval = strtoul(s, &ep, 0);
62693b3a8eb9SGleb Smirnoff 	if (s[0] == '\0' || *ep != '\0')
62703b3a8eb9SGleb Smirnoff 		return (-1);
62713b3a8eb9SGleb Smirnoff 	if (errno == ERANGE && ulval == ULONG_MAX)
62723b3a8eb9SGleb Smirnoff 		return (-1);
62733b3a8eb9SGleb Smirnoff 	*ulvalp = ulval;
62743b3a8eb9SGleb Smirnoff 	return (0);
62753b3a8eb9SGleb Smirnoff }
62763b3a8eb9SGleb Smirnoff 
62773b3a8eb9SGleb Smirnoff int
62783b3a8eb9SGleb Smirnoff getservice(char *n)
62793b3a8eb9SGleb Smirnoff {
62803b3a8eb9SGleb Smirnoff 	struct servent	*s;
62813b3a8eb9SGleb Smirnoff 	u_long		 ulval;
62823b3a8eb9SGleb Smirnoff 
62833b3a8eb9SGleb Smirnoff 	if (atoul(n, &ulval) == 0) {
62843b3a8eb9SGleb Smirnoff 		if (ulval > 65535) {
62853b3a8eb9SGleb Smirnoff 			yyerror("illegal port value %lu", ulval);
62863b3a8eb9SGleb Smirnoff 			return (-1);
62873b3a8eb9SGleb Smirnoff 		}
62883b3a8eb9SGleb Smirnoff 		return (htons(ulval));
62893b3a8eb9SGleb Smirnoff 	} else {
62903b3a8eb9SGleb Smirnoff 		s = getservbyname(n, "tcp");
62913b3a8eb9SGleb Smirnoff 		if (s == NULL)
62923b3a8eb9SGleb Smirnoff 			s = getservbyname(n, "udp");
62933b3a8eb9SGleb Smirnoff 		if (s == NULL) {
62943b3a8eb9SGleb Smirnoff 			yyerror("unknown port %s", n);
62953b3a8eb9SGleb Smirnoff 			return (-1);
62963b3a8eb9SGleb Smirnoff 		}
62973b3a8eb9SGleb Smirnoff 		return (s->s_port);
62983b3a8eb9SGleb Smirnoff 	}
62993b3a8eb9SGleb Smirnoff }
63003b3a8eb9SGleb Smirnoff 
63013b3a8eb9SGleb Smirnoff int
63026fcc8e04SKristof Provost rule_label(struct pfctl_rule *r, char *s[PF_RULE_MAX_LABEL_COUNT])
63033b3a8eb9SGleb Smirnoff {
63046fcc8e04SKristof Provost 	for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) {
63056fcc8e04SKristof Provost 		if (s[i] == NULL)
63066fcc8e04SKristof Provost 			return (0);
63076fcc8e04SKristof Provost 
63086fcc8e04SKristof Provost 		if (strlcpy(r->label[i], s[i], sizeof(r->label[0])) >=
63096fcc8e04SKristof Provost 		    sizeof(r->label[0])) {
63103b3a8eb9SGleb Smirnoff 			yyerror("rule label too long (max %d chars)",
63116fcc8e04SKristof Provost 			    sizeof(r->label[0])-1);
63123b3a8eb9SGleb Smirnoff 			return (-1);
63133b3a8eb9SGleb Smirnoff 		}
63143b3a8eb9SGleb Smirnoff 	}
63153b3a8eb9SGleb Smirnoff 	return (0);
63163b3a8eb9SGleb Smirnoff }
63173b3a8eb9SGleb Smirnoff 
63183b3a8eb9SGleb Smirnoff u_int16_t
63193b3a8eb9SGleb Smirnoff parseicmpspec(char *w, sa_family_t af)
63203b3a8eb9SGleb Smirnoff {
63213b3a8eb9SGleb Smirnoff 	const struct icmpcodeent	*p;
63223b3a8eb9SGleb Smirnoff 	u_long				 ulval;
63233b3a8eb9SGleb Smirnoff 	u_int8_t			 icmptype;
63243b3a8eb9SGleb Smirnoff 
63253b3a8eb9SGleb Smirnoff 	if (af == AF_INET)
63263b3a8eb9SGleb Smirnoff 		icmptype = returnicmpdefault >> 8;
63273b3a8eb9SGleb Smirnoff 	else
63283b3a8eb9SGleb Smirnoff 		icmptype = returnicmp6default >> 8;
63293b3a8eb9SGleb Smirnoff 
63303b3a8eb9SGleb Smirnoff 	if (atoul(w, &ulval) == -1) {
63313b3a8eb9SGleb Smirnoff 		if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
63323b3a8eb9SGleb Smirnoff 			yyerror("unknown icmp code %s", w);
63333b3a8eb9SGleb Smirnoff 			return (0);
63343b3a8eb9SGleb Smirnoff 		}
63353b3a8eb9SGleb Smirnoff 		ulval = p->code;
63363b3a8eb9SGleb Smirnoff 	}
63373b3a8eb9SGleb Smirnoff 	if (ulval > 255) {
63383b3a8eb9SGleb Smirnoff 		yyerror("invalid icmp code %lu", ulval);
63393b3a8eb9SGleb Smirnoff 		return (0);
63403b3a8eb9SGleb Smirnoff 	}
63413b3a8eb9SGleb Smirnoff 	return (icmptype << 8 | ulval);
63423b3a8eb9SGleb Smirnoff }
63433b3a8eb9SGleb Smirnoff 
63443b3a8eb9SGleb Smirnoff int
63453b3a8eb9SGleb Smirnoff parseport(char *port, struct range *r, int extensions)
63463b3a8eb9SGleb Smirnoff {
63473b3a8eb9SGleb Smirnoff 	char	*p = strchr(port, ':');
63483b3a8eb9SGleb Smirnoff 
63493b3a8eb9SGleb Smirnoff 	if (p == NULL) {
63503b3a8eb9SGleb Smirnoff 		if ((r->a = getservice(port)) == -1)
63513b3a8eb9SGleb Smirnoff 			return (-1);
63523b3a8eb9SGleb Smirnoff 		r->b = 0;
63533b3a8eb9SGleb Smirnoff 		r->t = PF_OP_NONE;
63543b3a8eb9SGleb Smirnoff 		return (0);
63553b3a8eb9SGleb Smirnoff 	}
63563b3a8eb9SGleb Smirnoff 	if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) {
63573b3a8eb9SGleb Smirnoff 		*p = 0;
63583b3a8eb9SGleb Smirnoff 		if ((r->a = getservice(port)) == -1)
63593b3a8eb9SGleb Smirnoff 			return (-1);
63603b3a8eb9SGleb Smirnoff 		r->b = 0;
63613b3a8eb9SGleb Smirnoff 		r->t = PF_OP_IRG;
63623b3a8eb9SGleb Smirnoff 		return (0);
63633b3a8eb9SGleb Smirnoff 	}
63643b3a8eb9SGleb Smirnoff 	if ((extensions & PPORT_RANGE)) {
63653b3a8eb9SGleb Smirnoff 		*p++ = 0;
63663b3a8eb9SGleb Smirnoff 		if ((r->a = getservice(port)) == -1 ||
63673b3a8eb9SGleb Smirnoff 		    (r->b = getservice(p)) == -1)
63683b3a8eb9SGleb Smirnoff 			return (-1);
63693b3a8eb9SGleb Smirnoff 		if (r->a == r->b) {
63703b3a8eb9SGleb Smirnoff 			r->b = 0;
63713b3a8eb9SGleb Smirnoff 			r->t = PF_OP_NONE;
63723b3a8eb9SGleb Smirnoff 		} else
63733b3a8eb9SGleb Smirnoff 			r->t = PF_OP_RRG;
63743b3a8eb9SGleb Smirnoff 		return (0);
63753b3a8eb9SGleb Smirnoff 	}
63763b3a8eb9SGleb Smirnoff 	return (-1);
63773b3a8eb9SGleb Smirnoff }
63783b3a8eb9SGleb Smirnoff 
63793b3a8eb9SGleb Smirnoff int
63803b3a8eb9SGleb Smirnoff pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans)
63813b3a8eb9SGleb Smirnoff {
63823b3a8eb9SGleb Smirnoff 	struct loadanchors	*la;
63833b3a8eb9SGleb Smirnoff 
63843b3a8eb9SGleb Smirnoff 	TAILQ_FOREACH(la, &loadanchorshead, entries) {
63853b3a8eb9SGleb Smirnoff 		if (pf->opts & PF_OPT_VERBOSE)
63863b3a8eb9SGleb Smirnoff 			fprintf(stderr, "\nLoading anchor %s from %s\n",
63873b3a8eb9SGleb Smirnoff 			    la->anchorname, la->filename);
63883b3a8eb9SGleb Smirnoff 		if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize,
63893b3a8eb9SGleb Smirnoff 		    la->anchorname, trans) == -1)
63903b3a8eb9SGleb Smirnoff 			return (-1);
63913b3a8eb9SGleb Smirnoff 	}
63923b3a8eb9SGleb Smirnoff 
63933b3a8eb9SGleb Smirnoff 	return (0);
63943b3a8eb9SGleb Smirnoff }
63953b3a8eb9SGleb Smirnoff 
63963b3a8eb9SGleb Smirnoff int
63971f495578SKristof Provost kw_casecmp(const void *k, const void *e)
63981f495578SKristof Provost {
63991f495578SKristof Provost 	return (strcasecmp(k, ((const struct keywords *)e)->k_name));
64001f495578SKristof Provost }
64011f495578SKristof Provost 
64021f495578SKristof Provost int
64031f495578SKristof Provost map_tos(char *s, int *val)
64041f495578SKristof Provost {
64051f495578SKristof Provost 	/* DiffServ Codepoints and other TOS mappings */
64061f495578SKristof Provost 	const struct keywords	 toswords[] = {
64071f495578SKristof Provost 		{ "af11",		IPTOS_DSCP_AF11 },
64081f495578SKristof Provost 		{ "af12",		IPTOS_DSCP_AF12 },
64091f495578SKristof Provost 		{ "af13",		IPTOS_DSCP_AF13 },
64101f495578SKristof Provost 		{ "af21",		IPTOS_DSCP_AF21 },
64111f495578SKristof Provost 		{ "af22",		IPTOS_DSCP_AF22 },
64121f495578SKristof Provost 		{ "af23",		IPTOS_DSCP_AF23 },
64131f495578SKristof Provost 		{ "af31",		IPTOS_DSCP_AF31 },
64141f495578SKristof Provost 		{ "af32",		IPTOS_DSCP_AF32 },
64151f495578SKristof Provost 		{ "af33",		IPTOS_DSCP_AF33 },
64161f495578SKristof Provost 		{ "af41",		IPTOS_DSCP_AF41 },
64171f495578SKristof Provost 		{ "af42",		IPTOS_DSCP_AF42 },
64181f495578SKristof Provost 		{ "af43",		IPTOS_DSCP_AF43 },
64191f495578SKristof Provost 		{ "critical",		IPTOS_PREC_CRITIC_ECP },
64201f495578SKristof Provost 		{ "cs0",		IPTOS_DSCP_CS0 },
64211f495578SKristof Provost 		{ "cs1",		IPTOS_DSCP_CS1 },
64221f495578SKristof Provost 		{ "cs2",		IPTOS_DSCP_CS2 },
64231f495578SKristof Provost 		{ "cs3",		IPTOS_DSCP_CS3 },
64241f495578SKristof Provost 		{ "cs4",		IPTOS_DSCP_CS4 },
64251f495578SKristof Provost 		{ "cs5",		IPTOS_DSCP_CS5 },
64261f495578SKristof Provost 		{ "cs6",		IPTOS_DSCP_CS6 },
64271f495578SKristof Provost 		{ "cs7",		IPTOS_DSCP_CS7 },
64281f495578SKristof Provost 		{ "ef",			IPTOS_DSCP_EF },
64291f495578SKristof Provost 		{ "inetcontrol",	IPTOS_PREC_INTERNETCONTROL },
64301f495578SKristof Provost 		{ "lowdelay",		IPTOS_LOWDELAY },
64311f495578SKristof Provost 		{ "netcontrol",		IPTOS_PREC_NETCONTROL },
64321f495578SKristof Provost 		{ "reliability",	IPTOS_RELIABILITY },
6433b4e3f3c2SKristof Provost 		{ "throughput",		IPTOS_THROUGHPUT },
6434b4e3f3c2SKristof Provost 		{ "va",			IPTOS_DSCP_VA }
64351f495578SKristof Provost 	};
64361f495578SKristof Provost 	const struct keywords	*p;
64371f495578SKristof Provost 
64381f495578SKristof Provost 	p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]),
64391f495578SKristof Provost 	    sizeof(toswords[0]), kw_casecmp);
64401f495578SKristof Provost 
64411f495578SKristof Provost 	if (p) {
64421f495578SKristof Provost 		*val = p->k_val;
64431f495578SKristof Provost 		return (1);
64441f495578SKristof Provost 	}
64451f495578SKristof Provost 	return (0);
64461f495578SKristof Provost }
64471f495578SKristof Provost 
64481f495578SKristof Provost int
64493b3a8eb9SGleb Smirnoff rt_tableid_max(void)
64503b3a8eb9SGleb Smirnoff {
64513b3a8eb9SGleb Smirnoff #ifdef __FreeBSD__
64523b3a8eb9SGleb Smirnoff 	int fibs;
64533b3a8eb9SGleb Smirnoff 	size_t l = sizeof(fibs);
64543b3a8eb9SGleb Smirnoff 
64553b3a8eb9SGleb Smirnoff         if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1)
64563b3a8eb9SGleb Smirnoff 		fibs = 16;	/* XXX RT_MAXFIBS, at least limit it some. */
64573b3a8eb9SGleb Smirnoff 	/*
64583b3a8eb9SGleb Smirnoff 	 * As the OpenBSD code only compares > and not >= we need to adjust
64593b3a8eb9SGleb Smirnoff 	 * here given we only accept values of 0..n and want to avoid #ifdefs
6460b68ac800SPedro F. Giffuni 	 * in the grammar.
64613b3a8eb9SGleb Smirnoff 	 */
64623b3a8eb9SGleb Smirnoff 	return (fibs - 1);
64633b3a8eb9SGleb Smirnoff #else
64643b3a8eb9SGleb Smirnoff 	return (RT_TABLEID_MAX);
64653b3a8eb9SGleb Smirnoff #endif
64663b3a8eb9SGleb Smirnoff }
6467