1 /* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-2-Clause 5 * 6 * Copyright (c) 2001 Markus Friedl. All rights reserved. 7 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 8 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 9 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 %{ 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 #define PFIOC_USE_LATEST 36 37 #include <sys/types.h> 38 #include <sys/socket.h> 39 #include <sys/stat.h> 40 #ifdef __FreeBSD__ 41 #include <sys/sysctl.h> 42 #endif 43 #include <net/if.h> 44 #include <netinet/in.h> 45 #include <netinet/in_systm.h> 46 #include <netinet/ip.h> 47 #include <netinet/ip_icmp.h> 48 #include <netinet/icmp6.h> 49 #include <net/pfvar.h> 50 #include <arpa/inet.h> 51 #include <net/altq/altq.h> 52 #include <net/altq/altq_cbq.h> 53 #include <net/altq/altq_codel.h> 54 #include <net/altq/altq_priq.h> 55 #include <net/altq/altq_hfsc.h> 56 #include <net/altq/altq_fairq.h> 57 58 #include <assert.h> 59 #include <stdio.h> 60 #include <unistd.h> 61 #include <stdlib.h> 62 #include <netdb.h> 63 #include <stdarg.h> 64 #include <errno.h> 65 #include <string.h> 66 #include <ctype.h> 67 #include <math.h> 68 #include <err.h> 69 #include <limits.h> 70 #include <pwd.h> 71 #include <grp.h> 72 #include <md5.h> 73 74 #include "pfctl_parser.h" 75 #include "pfctl.h" 76 77 static struct pfctl *pf = NULL; 78 static int debug = 0; 79 static int rulestate = 0; 80 static u_int16_t returnicmpdefault = 81 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 82 static u_int16_t returnicmp6default = 83 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 84 static int blockpolicy = PFRULE_DROP; 85 static int failpolicy = PFRULE_DROP; 86 static int require_order = 1; 87 static int default_statelock; 88 89 static TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 90 static struct file { 91 TAILQ_ENTRY(file) entry; 92 FILE *stream; 93 char *name; 94 int lineno; 95 int errors; 96 } *file; 97 struct file *pushfile(const char *, int); 98 int popfile(void); 99 int check_file_secrecy(int, const char *); 100 int yyparse(void); 101 int yylex(void); 102 int yyerror(const char *, ...); 103 int kw_cmp(const void *, const void *); 104 int lookup(char *); 105 int lgetc(int); 106 int lungetc(int); 107 int findeol(void); 108 109 static TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 110 struct sym { 111 TAILQ_ENTRY(sym) entry; 112 int used; 113 int persist; 114 char *nam; 115 char *val; 116 }; 117 int symset(const char *, const char *, int); 118 char *symget(const char *); 119 120 int atoul(char *, u_long *); 121 122 enum { 123 PFCTL_STATE_NONE, 124 PFCTL_STATE_OPTION, 125 PFCTL_STATE_SCRUB, 126 PFCTL_STATE_QUEUE, 127 PFCTL_STATE_NAT, 128 PFCTL_STATE_FILTER 129 }; 130 131 struct node_proto { 132 u_int8_t proto; 133 struct node_proto *next; 134 struct node_proto *tail; 135 }; 136 137 struct node_port { 138 u_int16_t port[2]; 139 u_int8_t op; 140 struct node_port *next; 141 struct node_port *tail; 142 }; 143 144 struct node_uid { 145 uid_t uid[2]; 146 u_int8_t op; 147 struct node_uid *next; 148 struct node_uid *tail; 149 }; 150 151 struct node_gid { 152 gid_t gid[2]; 153 u_int8_t op; 154 struct node_gid *next; 155 struct node_gid *tail; 156 }; 157 158 struct node_icmp { 159 u_int8_t code; 160 u_int8_t type; 161 u_int8_t proto; 162 struct node_icmp *next; 163 struct node_icmp *tail; 164 }; 165 166 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 167 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 168 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 169 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 170 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, }; 171 172 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 173 174 struct node_state_opt { 175 int type; 176 union { 177 u_int32_t max_states; 178 u_int32_t max_src_states; 179 u_int32_t max_src_conn; 180 struct { 181 u_int32_t limit; 182 u_int32_t seconds; 183 } max_src_conn_rate; 184 struct { 185 u_int8_t flush; 186 char tblname[PF_TABLE_NAME_SIZE]; 187 } overload; 188 u_int32_t max_src_nodes; 189 u_int8_t src_track; 190 u_int32_t statelock; 191 struct { 192 int number; 193 u_int32_t seconds; 194 } timeout; 195 } data; 196 struct node_state_opt *next; 197 struct node_state_opt *tail; 198 }; 199 200 struct peer { 201 struct node_host *host; 202 struct node_port *port; 203 }; 204 205 static struct node_queue { 206 char queue[PF_QNAME_SIZE]; 207 char parent[PF_QNAME_SIZE]; 208 char ifname[IFNAMSIZ]; 209 int scheduler; 210 struct node_queue *next; 211 struct node_queue *tail; 212 } *queues = NULL; 213 214 struct node_qassign { 215 char *qname; 216 char *pqname; 217 }; 218 219 static struct filter_opts { 220 int marker; 221 #define FOM_FLAGS 0x01 222 #define FOM_ICMP 0x02 223 #define FOM_TOS 0x04 224 #define FOM_KEEP 0x08 225 #define FOM_SRCTRACK 0x10 226 #define FOM_SETPRIO 0x0400 227 #define FOM_PRIO 0x2000 228 struct node_uid *uid; 229 struct node_gid *gid; 230 struct { 231 u_int8_t b1; 232 u_int8_t b2; 233 u_int16_t w; 234 u_int16_t w2; 235 } flags; 236 struct node_icmp *icmpspec; 237 u_int32_t tos; 238 u_int32_t prob; 239 struct { 240 int action; 241 struct node_state_opt *options; 242 } keep; 243 int fragment; 244 int allowopts; 245 char *label[PF_RULE_MAX_LABEL_COUNT]; 246 int labelcount; 247 struct node_qassign queues; 248 char *tag; 249 char *match_tag; 250 u_int8_t match_tag_not; 251 u_int16_t dnpipe; 252 u_int16_t dnrpipe; 253 u_int32_t free_flags; 254 u_int rtableid; 255 u_int8_t prio; 256 u_int8_t set_prio[2]; 257 struct { 258 struct node_host *addr; 259 u_int16_t port; 260 } divert; 261 } filter_opts; 262 263 static struct antispoof_opts { 264 char *label[PF_RULE_MAX_LABEL_COUNT]; 265 int labelcount; 266 u_int rtableid; 267 } antispoof_opts; 268 269 static struct scrub_opts { 270 int marker; 271 #define SOM_MINTTL 0x01 272 #define SOM_MAXMSS 0x02 273 #define SOM_FRAGCACHE 0x04 274 #define SOM_SETTOS 0x08 275 int nodf; 276 int minttl; 277 int maxmss; 278 int settos; 279 int fragcache; 280 int randomid; 281 int reassemble_tcp; 282 char *match_tag; 283 u_int8_t match_tag_not; 284 u_int rtableid; 285 } scrub_opts; 286 287 static struct queue_opts { 288 int marker; 289 #define QOM_BWSPEC 0x01 290 #define QOM_SCHEDULER 0x02 291 #define QOM_PRIORITY 0x04 292 #define QOM_TBRSIZE 0x08 293 #define QOM_QLIMIT 0x10 294 struct node_queue_bw queue_bwspec; 295 struct node_queue_opt scheduler; 296 int priority; 297 unsigned int tbrsize; 298 int qlimit; 299 } queue_opts; 300 301 static struct table_opts { 302 int flags; 303 int init_addr; 304 struct node_tinithead init_nodes; 305 } table_opts; 306 307 static struct pool_opts { 308 int marker; 309 #define POM_TYPE 0x01 310 #define POM_STICKYADDRESS 0x02 311 u_int8_t opts; 312 int type; 313 int staticport; 314 struct pf_poolhashkey *key; 315 struct pf_mape_portset mape; 316 317 } pool_opts; 318 319 static struct codel_opts codel_opts; 320 static struct node_hfsc_opts hfsc_opts; 321 static struct node_fairq_opts fairq_opts; 322 static struct node_state_opt *keep_state_defaults = NULL; 323 324 int disallow_table(struct node_host *, const char *); 325 int disallow_urpf_failed(struct node_host *, const char *); 326 int disallow_alias(struct node_host *, const char *); 327 int rule_consistent(struct pfctl_rule *, int); 328 int filter_consistent(struct pfctl_rule *, int); 329 int nat_consistent(struct pfctl_rule *); 330 int rdr_consistent(struct pfctl_rule *); 331 int process_tabledef(char *, struct table_opts *); 332 void expand_label_str(char *, size_t, const char *, const char *); 333 void expand_label_if(const char *, char *, size_t, const char *); 334 void expand_label_addr(const char *, char *, size_t, u_int8_t, 335 struct node_host *); 336 void expand_label_port(const char *, char *, size_t, 337 struct node_port *); 338 void expand_label_proto(const char *, char *, size_t, u_int8_t); 339 void expand_label_nr(const char *, char *, size_t); 340 void expand_label(char *, size_t, const char *, u_int8_t, 341 struct node_host *, struct node_port *, struct node_host *, 342 struct node_port *, u_int8_t); 343 void expand_rule(struct pfctl_rule *, struct node_if *, 344 struct node_host *, struct node_proto *, struct node_os *, 345 struct node_host *, struct node_port *, struct node_host *, 346 struct node_port *, struct node_uid *, struct node_gid *, 347 struct node_icmp *, const char *); 348 int expand_altq(struct pf_altq *, struct node_if *, 349 struct node_queue *, struct node_queue_bw bwspec, 350 struct node_queue_opt *); 351 int expand_queue(struct pf_altq *, struct node_if *, 352 struct node_queue *, struct node_queue_bw, 353 struct node_queue_opt *); 354 int expand_skip_interface(struct node_if *); 355 356 int check_rulestate(int); 357 int getservice(char *); 358 int rule_label(struct pfctl_rule *, char *s[PF_RULE_MAX_LABEL_COUNT]); 359 int rt_tableid_max(void); 360 361 void mv_rules(struct pfctl_ruleset *, struct pfctl_ruleset *); 362 void decide_address_family(struct node_host *, sa_family_t *); 363 void remove_invalid_hosts(struct node_host **, sa_family_t *); 364 int invalid_redirect(struct node_host *, sa_family_t); 365 u_int16_t parseicmpspec(char *, sa_family_t); 366 int kw_casecmp(const void *, const void *); 367 int map_tos(char *string, int *); 368 369 static TAILQ_HEAD(loadanchorshead, loadanchors) 370 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 371 372 struct loadanchors { 373 TAILQ_ENTRY(loadanchors) entries; 374 char *anchorname; 375 char *filename; 376 }; 377 378 typedef struct { 379 union { 380 int64_t number; 381 double probability; 382 int i; 383 char *string; 384 u_int rtableid; 385 struct { 386 u_int8_t b1; 387 u_int8_t b2; 388 u_int16_t w; 389 u_int16_t w2; 390 } b; 391 struct range { 392 int a; 393 int b; 394 int t; 395 } range; 396 struct node_if *interface; 397 struct node_proto *proto; 398 struct node_icmp *icmp; 399 struct node_host *host; 400 struct node_os *os; 401 struct node_port *port; 402 struct node_uid *uid; 403 struct node_gid *gid; 404 struct node_state_opt *state_opt; 405 struct peer peer; 406 struct { 407 struct peer src, dst; 408 struct node_os *src_os; 409 } fromto; 410 struct { 411 struct node_host *host; 412 u_int8_t rt; 413 u_int8_t pool_opts; 414 sa_family_t af; 415 struct pf_poolhashkey *key; 416 } route; 417 struct redirection { 418 struct node_host *host; 419 struct range rport; 420 } *redirection; 421 struct { 422 int action; 423 struct node_state_opt *options; 424 } keep_state; 425 struct { 426 u_int8_t log; 427 u_int8_t logif; 428 u_int8_t quick; 429 } logquick; 430 struct { 431 int neg; 432 char *name; 433 } tagged; 434 struct pf_poolhashkey *hashkey; 435 struct node_queue *queue; 436 struct node_queue_opt queue_options; 437 struct node_queue_bw queue_bwspec; 438 struct node_qassign qassign; 439 struct filter_opts filter_opts; 440 struct antispoof_opts antispoof_opts; 441 struct queue_opts queue_opts; 442 struct scrub_opts scrub_opts; 443 struct table_opts table_opts; 444 struct pool_opts pool_opts; 445 struct node_hfsc_opts hfsc_opts; 446 struct node_fairq_opts fairq_opts; 447 struct codel_opts codel_opts; 448 } v; 449 int lineno; 450 } YYSTYPE; 451 452 #define PPORT_RANGE 1 453 #define PPORT_STAR 2 454 int parseport(char *, struct range *r, int); 455 456 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 457 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 458 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 459 460 %} 461 462 %token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 463 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 464 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 465 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 466 %token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 467 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 468 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY FAILPOLICY 469 %token RANDOMID REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 470 %token ANTISPOOF FOR INCLUDE KEEPCOUNTERS SYNCOOKIES 471 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET 472 %token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME 473 %token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL 474 %token DNPIPE DNQUEUE 475 %token LOAD RULESET_OPTIMIZATION PRIO 476 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 477 %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY 478 %token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 479 %token DIVERTTO DIVERTREPLY 480 %token <v.string> STRING 481 %token <v.number> NUMBER 482 %token <v.i> PORTBINARY 483 %type <v.interface> interface if_list if_item_not if_item 484 %type <v.number> number icmptype icmp6type uid gid 485 %type <v.number> tos not yesno 486 %type <v.probability> probability 487 %type <v.i> no dir af fragcache optimizer syncookie_val 488 %type <v.i> sourcetrack flush unaryop statelock 489 %type <v.b> action nataction natpasslog scrubaction 490 %type <v.b> flags flag blockspec prio 491 %type <v.range> portplain portstar portrange 492 %type <v.hashkey> hashkey 493 %type <v.proto> proto proto_list proto_item 494 %type <v.number> protoval 495 %type <v.icmp> icmpspec 496 %type <v.icmp> icmp_list icmp_item 497 %type <v.icmp> icmp6_list icmp6_item 498 %type <v.number> reticmpspec reticmp6spec 499 %type <v.fromto> fromto 500 %type <v.peer> ipportspec from to 501 %type <v.host> ipspec toipspec xhost host dynaddr host_list 502 %type <v.host> redir_host_list redirspec 503 %type <v.host> route_host route_host_list routespec 504 %type <v.os> os xos os_list 505 %type <v.port> portspec port_list port_item 506 %type <v.uid> uids uid_list uid_item 507 %type <v.gid> gids gid_list gid_item 508 %type <v.route> route 509 %type <v.redirection> redirection redirpool 510 %type <v.string> label stringall tag anchorname 511 %type <v.string> string varstring numberstring 512 %type <v.keep_state> keep 513 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 514 %type <v.logquick> logquick quick log logopts logopt 515 %type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 516 %type <v.qassign> qname 517 %type <v.queue> qassign qassign_list qassign_item 518 %type <v.queue_options> scheduler 519 %type <v.number> cbqflags_list cbqflags_item 520 %type <v.number> priqflags_list priqflags_item 521 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 522 %type <v.fairq_opts> fairqopts_list fairqopts_item fairq_opts 523 %type <v.codel_opts> codelopts_list codelopts_item codel_opts 524 %type <v.queue_bwspec> bandwidth 525 %type <v.filter_opts> filter_opts filter_opt filter_opts_l 526 %type <v.filter_opts> filter_sets filter_set filter_sets_l 527 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 528 %type <v.queue_opts> queue_opts queue_opt queue_opts_l 529 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 530 %type <v.table_opts> table_opts table_opt table_opts_l 531 %type <v.pool_opts> pool_opts pool_opt pool_opts_l 532 %type <v.tagged> tagged 533 %type <v.rtableid> rtable 534 %% 535 536 ruleset : /* empty */ 537 | ruleset include '\n' 538 | ruleset '\n' 539 | ruleset option '\n' 540 | ruleset scrubrule '\n' 541 | ruleset natrule '\n' 542 | ruleset binatrule '\n' 543 | ruleset pfrule '\n' 544 | ruleset anchorrule '\n' 545 | ruleset loadrule '\n' 546 | ruleset altqif '\n' 547 | ruleset queuespec '\n' 548 | ruleset varset '\n' 549 | ruleset antispoof '\n' 550 | ruleset tabledef '\n' 551 | '{' fakeanchor '}' '\n'; 552 | ruleset error '\n' { file->errors++; } 553 ; 554 555 include : INCLUDE STRING { 556 struct file *nfile; 557 558 if ((nfile = pushfile($2, 0)) == NULL) { 559 yyerror("failed to include file %s", $2); 560 free($2); 561 YYERROR; 562 } 563 free($2); 564 565 file = nfile; 566 lungetc('\n'); 567 } 568 ; 569 570 /* 571 * apply to previouslys specified rule: must be careful to note 572 * what that is: pf or nat or binat or rdr 573 */ 574 fakeanchor : fakeanchor '\n' 575 | fakeanchor anchorrule '\n' 576 | fakeanchor binatrule '\n' 577 | fakeanchor natrule '\n' 578 | fakeanchor pfrule '\n' 579 | fakeanchor error '\n' 580 ; 581 582 optimizer : string { 583 if (!strcmp($1, "none")) 584 $$ = 0; 585 else if (!strcmp($1, "basic")) 586 $$ = PF_OPTIMIZE_BASIC; 587 else if (!strcmp($1, "profile")) 588 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 589 else { 590 yyerror("unknown ruleset-optimization %s", $1); 591 YYERROR; 592 } 593 } 594 ; 595 596 option : SET OPTIMIZATION STRING { 597 if (check_rulestate(PFCTL_STATE_OPTION)) { 598 free($3); 599 YYERROR; 600 } 601 if (pfctl_set_optimization(pf, $3) != 0) { 602 yyerror("unknown optimization %s", $3); 603 free($3); 604 YYERROR; 605 } 606 free($3); 607 } 608 | SET RULESET_OPTIMIZATION optimizer { 609 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 610 pf->opts |= PF_OPT_OPTIMIZE; 611 pf->optimize = $3; 612 } 613 } 614 | SET TIMEOUT timeout_spec 615 | SET TIMEOUT '{' optnl timeout_list '}' 616 | SET LIMIT limit_spec 617 | SET LIMIT '{' optnl limit_list '}' 618 | SET LOGINTERFACE stringall { 619 if (check_rulestate(PFCTL_STATE_OPTION)) { 620 free($3); 621 YYERROR; 622 } 623 if (pfctl_set_logif(pf, $3) != 0) { 624 yyerror("error setting loginterface %s", $3); 625 free($3); 626 YYERROR; 627 } 628 free($3); 629 } 630 | SET HOSTID number { 631 if ($3 == 0 || $3 > UINT_MAX) { 632 yyerror("hostid must be non-zero"); 633 YYERROR; 634 } 635 if (pfctl_set_hostid(pf, $3) != 0) { 636 yyerror("error setting hostid %08x", $3); 637 YYERROR; 638 } 639 } 640 | SET BLOCKPOLICY DROP { 641 if (pf->opts & PF_OPT_VERBOSE) 642 printf("set block-policy drop\n"); 643 if (check_rulestate(PFCTL_STATE_OPTION)) 644 YYERROR; 645 blockpolicy = PFRULE_DROP; 646 } 647 | SET BLOCKPOLICY RETURN { 648 if (pf->opts & PF_OPT_VERBOSE) 649 printf("set block-policy return\n"); 650 if (check_rulestate(PFCTL_STATE_OPTION)) 651 YYERROR; 652 blockpolicy = PFRULE_RETURN; 653 } 654 | SET FAILPOLICY DROP { 655 if (pf->opts & PF_OPT_VERBOSE) 656 printf("set fail-policy drop\n"); 657 if (check_rulestate(PFCTL_STATE_OPTION)) 658 YYERROR; 659 failpolicy = PFRULE_DROP; 660 } 661 | SET FAILPOLICY RETURN { 662 if (pf->opts & PF_OPT_VERBOSE) 663 printf("set fail-policy return\n"); 664 if (check_rulestate(PFCTL_STATE_OPTION)) 665 YYERROR; 666 failpolicy = PFRULE_RETURN; 667 } 668 | SET REQUIREORDER yesno { 669 if (pf->opts & PF_OPT_VERBOSE) 670 printf("set require-order %s\n", 671 $3 == 1 ? "yes" : "no"); 672 require_order = $3; 673 } 674 | SET FINGERPRINTS STRING { 675 if (pf->opts & PF_OPT_VERBOSE) 676 printf("set fingerprints \"%s\"\n", $3); 677 if (check_rulestate(PFCTL_STATE_OPTION)) { 678 free($3); 679 YYERROR; 680 } 681 if (!pf->anchor->name[0]) { 682 if (pfctl_file_fingerprints(pf->dev, 683 pf->opts, $3)) { 684 yyerror("error loading " 685 "fingerprints %s", $3); 686 free($3); 687 YYERROR; 688 } 689 } 690 free($3); 691 } 692 | SET STATEPOLICY statelock { 693 if (pf->opts & PF_OPT_VERBOSE) 694 switch ($3) { 695 case 0: 696 printf("set state-policy floating\n"); 697 break; 698 case PFRULE_IFBOUND: 699 printf("set state-policy if-bound\n"); 700 break; 701 } 702 default_statelock = $3; 703 } 704 | SET DEBUG STRING { 705 if (check_rulestate(PFCTL_STATE_OPTION)) { 706 free($3); 707 YYERROR; 708 } 709 if (pfctl_set_debug(pf, $3) != 0) { 710 yyerror("error setting debuglevel %s", $3); 711 free($3); 712 YYERROR; 713 } 714 free($3); 715 } 716 | SET SKIP interface { 717 if (expand_skip_interface($3) != 0) { 718 yyerror("error setting skip interface(s)"); 719 YYERROR; 720 } 721 } 722 | SET STATEDEFAULTS state_opt_list { 723 if (keep_state_defaults != NULL) { 724 yyerror("cannot redefine state-defaults"); 725 YYERROR; 726 } 727 keep_state_defaults = $3; 728 } 729 | SET KEEPCOUNTERS { 730 pf->keep_counters = true; 731 } 732 | SET SYNCOOKIES syncookie_val { 733 pf->syncookies = $3; 734 } 735 ; 736 737 syncookie_val : STRING { 738 if (!strcmp($1, "never")) 739 $$ = PFCTL_SYNCOOKIES_NEVER; 740 else if (!strcmp($1, "always")) 741 $$ = PFCTL_SYNCOOKIES_ALWAYS; 742 else { 743 yyerror("illegal value for syncookies"); 744 YYERROR; 745 } 746 } 747 ; 748 749 stringall : STRING { $$ = $1; } 750 | ALL { 751 if (($$ = strdup("all")) == NULL) { 752 err(1, "stringall: strdup"); 753 } 754 } 755 ; 756 757 string : STRING string { 758 if (asprintf(&$$, "%s %s", $1, $2) == -1) 759 err(1, "string: asprintf"); 760 free($1); 761 free($2); 762 } 763 | STRING 764 ; 765 766 varstring : numberstring varstring { 767 if (asprintf(&$$, "%s %s", $1, $2) == -1) 768 err(1, "string: asprintf"); 769 free($1); 770 free($2); 771 } 772 | numberstring 773 ; 774 775 numberstring : NUMBER { 776 char *s; 777 if (asprintf(&s, "%lld", (long long)$1) == -1) { 778 yyerror("string: asprintf"); 779 YYERROR; 780 } 781 $$ = s; 782 } 783 | STRING 784 ; 785 786 varset : STRING '=' varstring { 787 char *s = $1; 788 if (pf->opts & PF_OPT_VERBOSE) 789 printf("%s = \"%s\"\n", $1, $3); 790 while (*s++) { 791 if (isspace((unsigned char)*s)) { 792 yyerror("macro name cannot contain " 793 "whitespace"); 794 YYERROR; 795 } 796 } 797 if (symset($1, $3, 0) == -1) 798 err(1, "cannot store variable %s", $1); 799 free($1); 800 free($3); 801 } 802 ; 803 804 anchorname : STRING { $$ = $1; } 805 | /* empty */ { $$ = NULL; } 806 ; 807 808 pfa_anchorlist : /* empty */ 809 | pfa_anchorlist '\n' 810 | pfa_anchorlist pfrule '\n' 811 | pfa_anchorlist anchorrule '\n' 812 ; 813 814 pfa_anchor : '{' 815 { 816 char ta[PF_ANCHOR_NAME_SIZE]; 817 struct pfctl_ruleset *rs; 818 819 /* steping into a brace anchor */ 820 pf->asd++; 821 pf->bn++; 822 pf->brace = 1; 823 824 /* create a holding ruleset in the root */ 825 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 826 rs = pf_find_or_create_ruleset(ta); 827 if (rs == NULL) 828 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 829 pf->astack[pf->asd] = rs->anchor; 830 pf->anchor = rs->anchor; 831 } '\n' pfa_anchorlist '}' 832 { 833 pf->alast = pf->anchor; 834 pf->asd--; 835 pf->anchor = pf->astack[pf->asd]; 836 } 837 | /* empty */ 838 ; 839 840 anchorrule : ANCHOR anchorname dir quick interface af proto fromto 841 filter_opts pfa_anchor 842 { 843 struct pfctl_rule r; 844 struct node_proto *proto; 845 846 if (check_rulestate(PFCTL_STATE_FILTER)) { 847 if ($2) 848 free($2); 849 YYERROR; 850 } 851 852 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 853 free($2); 854 yyerror("anchor names beginning with '_' " 855 "are reserved for internal use"); 856 YYERROR; 857 } 858 859 memset(&r, 0, sizeof(r)); 860 if (pf->astack[pf->asd + 1]) { 861 /* move inline rules into relative location */ 862 pfctl_anchor_setup(&r, 863 &pf->astack[pf->asd]->ruleset, 864 $2 ? $2 : pf->alast->name); 865 866 if (r.anchor == NULL) 867 err(1, "anchorrule: unable to " 868 "create ruleset"); 869 870 if (pf->alast != r.anchor) { 871 if (r.anchor->match) { 872 yyerror("inline anchor '%s' " 873 "already exists", 874 r.anchor->name); 875 YYERROR; 876 } 877 mv_rules(&pf->alast->ruleset, 878 &r.anchor->ruleset); 879 } 880 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 881 pf->alast = r.anchor; 882 } else { 883 if (!$2) { 884 yyerror("anchors without explicit " 885 "rules must specify a name"); 886 YYERROR; 887 } 888 } 889 r.direction = $3; 890 r.quick = $4.quick; 891 r.af = $6; 892 r.prob = $9.prob; 893 r.rtableid = $9.rtableid; 894 895 if ($9.tag) 896 if (strlcpy(r.tagname, $9.tag, 897 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 898 yyerror("tag too long, max %u chars", 899 PF_TAG_NAME_SIZE - 1); 900 YYERROR; 901 } 902 if ($9.match_tag) 903 if (strlcpy(r.match_tagname, $9.match_tag, 904 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 905 yyerror("tag too long, max %u chars", 906 PF_TAG_NAME_SIZE - 1); 907 YYERROR; 908 } 909 r.match_tag_not = $9.match_tag_not; 910 if (rule_label(&r, $9.label)) 911 YYERROR; 912 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 913 free($9.label[i]); 914 r.flags = $9.flags.b1; 915 r.flagset = $9.flags.b2; 916 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 917 yyerror("flags always false"); 918 YYERROR; 919 } 920 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 921 for (proto = $7; proto != NULL && 922 proto->proto != IPPROTO_TCP; 923 proto = proto->next) 924 ; /* nothing */ 925 if (proto == NULL && $7 != NULL) { 926 if ($9.flags.b1 || $9.flags.b2) 927 yyerror( 928 "flags only apply to tcp"); 929 if ($8.src_os) 930 yyerror( 931 "OS fingerprinting only " 932 "applies to tcp"); 933 YYERROR; 934 } 935 } 936 937 r.tos = $9.tos; 938 939 if ($9.keep.action) { 940 yyerror("cannot specify state handling " 941 "on anchors"); 942 YYERROR; 943 } 944 945 if ($9.match_tag) 946 if (strlcpy(r.match_tagname, $9.match_tag, 947 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 948 yyerror("tag too long, max %u chars", 949 PF_TAG_NAME_SIZE - 1); 950 YYERROR; 951 } 952 r.match_tag_not = $9.match_tag_not; 953 if ($9.marker & FOM_PRIO) { 954 if ($9.prio == 0) 955 r.prio = PF_PRIO_ZERO; 956 else 957 r.prio = $9.prio; 958 } 959 if ($9.marker & FOM_SETPRIO) { 960 r.set_prio[0] = $9.set_prio[0]; 961 r.set_prio[1] = $9.set_prio[1]; 962 r.scrub_flags |= PFSTATE_SETPRIO; 963 } 964 965 decide_address_family($8.src.host, &r.af); 966 decide_address_family($8.dst.host, &r.af); 967 968 expand_rule(&r, $5, NULL, $7, $8.src_os, 969 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 970 $9.uid, $9.gid, $9.icmpspec, 971 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 972 free($2); 973 pf->astack[pf->asd + 1] = NULL; 974 } 975 | NATANCHOR string interface af proto fromto rtable { 976 struct pfctl_rule r; 977 978 if (check_rulestate(PFCTL_STATE_NAT)) { 979 free($2); 980 YYERROR; 981 } 982 983 memset(&r, 0, sizeof(r)); 984 r.action = PF_NAT; 985 r.af = $4; 986 r.rtableid = $7; 987 988 decide_address_family($6.src.host, &r.af); 989 decide_address_family($6.dst.host, &r.af); 990 991 expand_rule(&r, $3, NULL, $5, $6.src_os, 992 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 993 0, 0, 0, $2); 994 free($2); 995 } 996 | RDRANCHOR string interface af proto fromto rtable { 997 struct pfctl_rule r; 998 999 if (check_rulestate(PFCTL_STATE_NAT)) { 1000 free($2); 1001 YYERROR; 1002 } 1003 1004 memset(&r, 0, sizeof(r)); 1005 r.action = PF_RDR; 1006 r.af = $4; 1007 r.rtableid = $7; 1008 1009 decide_address_family($6.src.host, &r.af); 1010 decide_address_family($6.dst.host, &r.af); 1011 1012 if ($6.src.port != NULL) { 1013 yyerror("source port parameter not supported" 1014 " in rdr-anchor"); 1015 YYERROR; 1016 } 1017 if ($6.dst.port != NULL) { 1018 if ($6.dst.port->next != NULL) { 1019 yyerror("destination port list " 1020 "expansion not supported in " 1021 "rdr-anchor"); 1022 YYERROR; 1023 } else if ($6.dst.port->op != PF_OP_EQ) { 1024 yyerror("destination port operators" 1025 " not supported in rdr-anchor"); 1026 YYERROR; 1027 } 1028 r.dst.port[0] = $6.dst.port->port[0]; 1029 r.dst.port[1] = $6.dst.port->port[1]; 1030 r.dst.port_op = $6.dst.port->op; 1031 } 1032 1033 expand_rule(&r, $3, NULL, $5, $6.src_os, 1034 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 1035 0, 0, 0, $2); 1036 free($2); 1037 } 1038 | BINATANCHOR string interface af proto fromto rtable { 1039 struct pfctl_rule r; 1040 1041 if (check_rulestate(PFCTL_STATE_NAT)) { 1042 free($2); 1043 YYERROR; 1044 } 1045 1046 memset(&r, 0, sizeof(r)); 1047 r.action = PF_BINAT; 1048 r.af = $4; 1049 r.rtableid = $7; 1050 if ($5 != NULL) { 1051 if ($5->next != NULL) { 1052 yyerror("proto list expansion" 1053 " not supported in binat-anchor"); 1054 YYERROR; 1055 } 1056 r.proto = $5->proto; 1057 free($5); 1058 } 1059 1060 if ($6.src.host != NULL || $6.src.port != NULL || 1061 $6.dst.host != NULL || $6.dst.port != NULL) { 1062 yyerror("fromto parameter not supported" 1063 " in binat-anchor"); 1064 YYERROR; 1065 } 1066 1067 decide_address_family($6.src.host, &r.af); 1068 decide_address_family($6.dst.host, &r.af); 1069 1070 pfctl_append_rule(pf, &r, $2); 1071 free($2); 1072 } 1073 ; 1074 1075 loadrule : LOAD ANCHOR string FROM string { 1076 struct loadanchors *loadanchor; 1077 1078 if (strlen(pf->anchor->name) + 1 + 1079 strlen($3) >= MAXPATHLEN) { 1080 yyerror("anchorname %s too long, max %u\n", 1081 $3, MAXPATHLEN - 1); 1082 free($3); 1083 YYERROR; 1084 } 1085 loadanchor = calloc(1, sizeof(struct loadanchors)); 1086 if (loadanchor == NULL) 1087 err(1, "loadrule: calloc"); 1088 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 1089 NULL) 1090 err(1, "loadrule: malloc"); 1091 if (pf->anchor->name[0]) 1092 snprintf(loadanchor->anchorname, MAXPATHLEN, 1093 "%s/%s", pf->anchor->name, $3); 1094 else 1095 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 1096 if ((loadanchor->filename = strdup($5)) == NULL) 1097 err(1, "loadrule: strdup"); 1098 1099 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 1100 entries); 1101 1102 free($3); 1103 free($5); 1104 }; 1105 1106 scrubaction : no SCRUB { 1107 $$.b2 = $$.w = 0; 1108 if ($1) 1109 $$.b1 = PF_NOSCRUB; 1110 else 1111 $$.b1 = PF_SCRUB; 1112 } 1113 ; 1114 1115 scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 1116 { 1117 struct pfctl_rule r; 1118 1119 if (check_rulestate(PFCTL_STATE_SCRUB)) 1120 YYERROR; 1121 1122 memset(&r, 0, sizeof(r)); 1123 1124 r.action = $1.b1; 1125 r.direction = $2; 1126 1127 r.log = $3.log; 1128 r.logif = $3.logif; 1129 if ($3.quick) { 1130 yyerror("scrub rules do not support 'quick'"); 1131 YYERROR; 1132 } 1133 1134 r.af = $5; 1135 if ($8.nodf) 1136 r.rule_flag |= PFRULE_NODF; 1137 if ($8.randomid) 1138 r.rule_flag |= PFRULE_RANDOMID; 1139 if ($8.reassemble_tcp) { 1140 if (r.direction != PF_INOUT) { 1141 yyerror("reassemble tcp rules can not " 1142 "specify direction"); 1143 YYERROR; 1144 } 1145 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 1146 } 1147 if ($8.minttl) 1148 r.min_ttl = $8.minttl; 1149 if ($8.maxmss) 1150 r.max_mss = $8.maxmss; 1151 if ($8.marker & SOM_SETTOS) { 1152 r.rule_flag |= PFRULE_SET_TOS; 1153 r.set_tos = $8.settos; 1154 } 1155 if ($8.fragcache) 1156 r.rule_flag |= $8.fragcache; 1157 if ($8.match_tag) 1158 if (strlcpy(r.match_tagname, $8.match_tag, 1159 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1160 yyerror("tag too long, max %u chars", 1161 PF_TAG_NAME_SIZE - 1); 1162 YYERROR; 1163 } 1164 r.match_tag_not = $8.match_tag_not; 1165 r.rtableid = $8.rtableid; 1166 1167 expand_rule(&r, $4, NULL, $6, $7.src_os, 1168 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 1169 NULL, NULL, NULL, ""); 1170 } 1171 ; 1172 1173 scrub_opts : { 1174 bzero(&scrub_opts, sizeof scrub_opts); 1175 scrub_opts.rtableid = -1; 1176 } 1177 scrub_opts_l 1178 { $$ = scrub_opts; } 1179 | /* empty */ { 1180 bzero(&scrub_opts, sizeof scrub_opts); 1181 scrub_opts.rtableid = -1; 1182 $$ = scrub_opts; 1183 } 1184 ; 1185 1186 scrub_opts_l : scrub_opts_l scrub_opt 1187 | scrub_opt 1188 ; 1189 1190 scrub_opt : NODF { 1191 if (scrub_opts.nodf) { 1192 yyerror("no-df cannot be respecified"); 1193 YYERROR; 1194 } 1195 scrub_opts.nodf = 1; 1196 } 1197 | MINTTL NUMBER { 1198 if (scrub_opts.marker & SOM_MINTTL) { 1199 yyerror("min-ttl cannot be respecified"); 1200 YYERROR; 1201 } 1202 if ($2 < 0 || $2 > 255) { 1203 yyerror("illegal min-ttl value %d", $2); 1204 YYERROR; 1205 } 1206 scrub_opts.marker |= SOM_MINTTL; 1207 scrub_opts.minttl = $2; 1208 } 1209 | MAXMSS NUMBER { 1210 if (scrub_opts.marker & SOM_MAXMSS) { 1211 yyerror("max-mss cannot be respecified"); 1212 YYERROR; 1213 } 1214 if ($2 < 0 || $2 > 65535) { 1215 yyerror("illegal max-mss value %d", $2); 1216 YYERROR; 1217 } 1218 scrub_opts.marker |= SOM_MAXMSS; 1219 scrub_opts.maxmss = $2; 1220 } 1221 | SETTOS tos { 1222 if (scrub_opts.marker & SOM_SETTOS) { 1223 yyerror("set-tos cannot be respecified"); 1224 YYERROR; 1225 } 1226 scrub_opts.marker |= SOM_SETTOS; 1227 scrub_opts.settos = $2; 1228 } 1229 | fragcache { 1230 if (scrub_opts.marker & SOM_FRAGCACHE) { 1231 yyerror("fragcache cannot be respecified"); 1232 YYERROR; 1233 } 1234 scrub_opts.marker |= SOM_FRAGCACHE; 1235 scrub_opts.fragcache = $1; 1236 } 1237 | REASSEMBLE STRING { 1238 if (strcasecmp($2, "tcp") != 0) { 1239 yyerror("scrub reassemble supports only tcp, " 1240 "not '%s'", $2); 1241 free($2); 1242 YYERROR; 1243 } 1244 free($2); 1245 if (scrub_opts.reassemble_tcp) { 1246 yyerror("reassemble tcp cannot be respecified"); 1247 YYERROR; 1248 } 1249 scrub_opts.reassemble_tcp = 1; 1250 } 1251 | RANDOMID { 1252 if (scrub_opts.randomid) { 1253 yyerror("random-id cannot be respecified"); 1254 YYERROR; 1255 } 1256 scrub_opts.randomid = 1; 1257 } 1258 | RTABLE NUMBER { 1259 if ($2 < 0 || $2 > rt_tableid_max()) { 1260 yyerror("invalid rtable id"); 1261 YYERROR; 1262 } 1263 scrub_opts.rtableid = $2; 1264 } 1265 | not TAGGED string { 1266 scrub_opts.match_tag = $3; 1267 scrub_opts.match_tag_not = $1; 1268 } 1269 ; 1270 1271 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 1272 | FRAGMENT FRAGCROP { $$ = 0; } 1273 | FRAGMENT FRAGDROP { $$ = 0; } 1274 ; 1275 1276 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1277 struct pfctl_rule r; 1278 struct node_host *h = NULL, *hh; 1279 struct node_if *i, *j; 1280 1281 if (check_rulestate(PFCTL_STATE_FILTER)) 1282 YYERROR; 1283 1284 for (i = $3; i; i = i->next) { 1285 bzero(&r, sizeof(r)); 1286 1287 r.action = PF_DROP; 1288 r.direction = PF_IN; 1289 r.log = $2.log; 1290 r.logif = $2.logif; 1291 r.quick = $2.quick; 1292 r.af = $4; 1293 if (rule_label(&r, $5.label)) 1294 YYERROR; 1295 r.rtableid = $5.rtableid; 1296 j = calloc(1, sizeof(struct node_if)); 1297 if (j == NULL) 1298 err(1, "antispoof: calloc"); 1299 if (strlcpy(j->ifname, i->ifname, 1300 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1301 free(j); 1302 yyerror("interface name too long"); 1303 YYERROR; 1304 } 1305 j->not = 1; 1306 if (i->dynamic) { 1307 h = calloc(1, sizeof(*h)); 1308 if (h == NULL) 1309 err(1, "address: calloc"); 1310 h->addr.type = PF_ADDR_DYNIFTL; 1311 set_ipmask(h, 128); 1312 if (strlcpy(h->addr.v.ifname, i->ifname, 1313 sizeof(h->addr.v.ifname)) >= 1314 sizeof(h->addr.v.ifname)) { 1315 free(h); 1316 yyerror( 1317 "interface name too long"); 1318 YYERROR; 1319 } 1320 hh = malloc(sizeof(*hh)); 1321 if (hh == NULL) 1322 err(1, "address: malloc"); 1323 bcopy(h, hh, sizeof(*hh)); 1324 h->addr.iflags = PFI_AFLAG_NETWORK; 1325 } else { 1326 h = ifa_lookup(j->ifname, 1327 PFI_AFLAG_NETWORK); 1328 hh = NULL; 1329 } 1330 1331 if (h != NULL) 1332 expand_rule(&r, j, NULL, NULL, NULL, h, 1333 NULL, NULL, NULL, NULL, NULL, 1334 NULL, ""); 1335 1336 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1337 bzero(&r, sizeof(r)); 1338 1339 r.action = PF_DROP; 1340 r.direction = PF_IN; 1341 r.log = $2.log; 1342 r.logif = $2.logif; 1343 r.quick = $2.quick; 1344 r.af = $4; 1345 if (rule_label(&r, $5.label)) 1346 YYERROR; 1347 r.rtableid = $5.rtableid; 1348 if (hh != NULL) 1349 h = hh; 1350 else 1351 h = ifa_lookup(i->ifname, 0); 1352 if (h != NULL) 1353 expand_rule(&r, NULL, NULL, 1354 NULL, NULL, h, NULL, NULL, 1355 NULL, NULL, NULL, NULL, ""); 1356 } else 1357 free(hh); 1358 } 1359 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 1360 free($5.label[i]); 1361 } 1362 ; 1363 1364 antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1365 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1366 ; 1367 1368 antispoof_iflst : antispoof_if optnl { $$ = $1; } 1369 | antispoof_iflst comma antispoof_if optnl { 1370 $1->tail->next = $3; 1371 $1->tail = $3; 1372 $$ = $1; 1373 } 1374 ; 1375 1376 antispoof_if : if_item { $$ = $1; } 1377 | '(' if_item ')' { 1378 $2->dynamic = 1; 1379 $$ = $2; 1380 } 1381 ; 1382 1383 antispoof_opts : { 1384 bzero(&antispoof_opts, sizeof antispoof_opts); 1385 antispoof_opts.rtableid = -1; 1386 } 1387 antispoof_opts_l 1388 { $$ = antispoof_opts; } 1389 | /* empty */ { 1390 bzero(&antispoof_opts, sizeof antispoof_opts); 1391 antispoof_opts.rtableid = -1; 1392 $$ = antispoof_opts; 1393 } 1394 ; 1395 1396 antispoof_opts_l : antispoof_opts_l antispoof_opt 1397 | antispoof_opt 1398 ; 1399 1400 antispoof_opt : label { 1401 if (antispoof_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 1402 yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 1403 YYERROR; 1404 } 1405 antispoof_opts.label[antispoof_opts.labelcount++] = $1; 1406 } 1407 | RTABLE NUMBER { 1408 if ($2 < 0 || $2 > rt_tableid_max()) { 1409 yyerror("invalid rtable id"); 1410 YYERROR; 1411 } 1412 antispoof_opts.rtableid = $2; 1413 } 1414 ; 1415 1416 not : '!' { $$ = 1; } 1417 | /* empty */ { $$ = 0; } 1418 ; 1419 1420 tabledef : TABLE '<' STRING '>' table_opts { 1421 struct node_host *h, *nh; 1422 struct node_tinit *ti, *nti; 1423 1424 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1425 yyerror("table name too long, max %d chars", 1426 PF_TABLE_NAME_SIZE - 1); 1427 free($3); 1428 YYERROR; 1429 } 1430 if (pf->loadopt & PFCTL_FLAG_TABLE) 1431 if (process_tabledef($3, &$5)) { 1432 free($3); 1433 YYERROR; 1434 } 1435 free($3); 1436 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1437 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1438 if (ti->file) 1439 free(ti->file); 1440 for (h = ti->host; h != NULL; h = nh) { 1441 nh = h->next; 1442 free(h); 1443 } 1444 nti = SIMPLEQ_NEXT(ti, entries); 1445 free(ti); 1446 } 1447 } 1448 ; 1449 1450 table_opts : { 1451 bzero(&table_opts, sizeof table_opts); 1452 SIMPLEQ_INIT(&table_opts.init_nodes); 1453 } 1454 table_opts_l 1455 { $$ = table_opts; } 1456 | /* empty */ 1457 { 1458 bzero(&table_opts, sizeof table_opts); 1459 SIMPLEQ_INIT(&table_opts.init_nodes); 1460 $$ = table_opts; 1461 } 1462 ; 1463 1464 table_opts_l : table_opts_l table_opt 1465 | table_opt 1466 ; 1467 1468 table_opt : STRING { 1469 if (!strcmp($1, "const")) 1470 table_opts.flags |= PFR_TFLAG_CONST; 1471 else if (!strcmp($1, "persist")) 1472 table_opts.flags |= PFR_TFLAG_PERSIST; 1473 else if (!strcmp($1, "counters")) 1474 table_opts.flags |= PFR_TFLAG_COUNTERS; 1475 else { 1476 yyerror("invalid table option '%s'", $1); 1477 free($1); 1478 YYERROR; 1479 } 1480 free($1); 1481 } 1482 | '{' optnl '}' { table_opts.init_addr = 1; } 1483 | '{' optnl host_list '}' { 1484 struct node_host *n; 1485 struct node_tinit *ti; 1486 1487 for (n = $3; n != NULL; n = n->next) { 1488 switch (n->addr.type) { 1489 case PF_ADDR_ADDRMASK: 1490 continue; /* ok */ 1491 case PF_ADDR_RANGE: 1492 yyerror("address ranges are not " 1493 "permitted inside tables"); 1494 break; 1495 case PF_ADDR_DYNIFTL: 1496 yyerror("dynamic addresses are not " 1497 "permitted inside tables"); 1498 break; 1499 case PF_ADDR_TABLE: 1500 yyerror("tables cannot contain tables"); 1501 break; 1502 case PF_ADDR_NOROUTE: 1503 yyerror("\"no-route\" is not permitted " 1504 "inside tables"); 1505 break; 1506 case PF_ADDR_URPFFAILED: 1507 yyerror("\"urpf-failed\" is not " 1508 "permitted inside tables"); 1509 break; 1510 default: 1511 yyerror("unknown address type %d", 1512 n->addr.type); 1513 } 1514 YYERROR; 1515 } 1516 if (!(ti = calloc(1, sizeof(*ti)))) 1517 err(1, "table_opt: calloc"); 1518 ti->host = $3; 1519 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1520 entries); 1521 table_opts.init_addr = 1; 1522 } 1523 | FILENAME STRING { 1524 struct node_tinit *ti; 1525 1526 if (!(ti = calloc(1, sizeof(*ti)))) 1527 err(1, "table_opt: calloc"); 1528 ti->file = $2; 1529 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1530 entries); 1531 table_opts.init_addr = 1; 1532 } 1533 ; 1534 1535 altqif : ALTQ interface queue_opts QUEUE qassign { 1536 struct pf_altq a; 1537 1538 if (check_rulestate(PFCTL_STATE_QUEUE)) 1539 YYERROR; 1540 1541 memset(&a, 0, sizeof(a)); 1542 if ($3.scheduler.qtype == ALTQT_NONE) { 1543 yyerror("no scheduler specified!"); 1544 YYERROR; 1545 } 1546 a.scheduler = $3.scheduler.qtype; 1547 a.qlimit = $3.qlimit; 1548 a.tbrsize = $3.tbrsize; 1549 if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) { 1550 yyerror("no child queues specified"); 1551 YYERROR; 1552 } 1553 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1554 &$3.scheduler)) 1555 YYERROR; 1556 } 1557 ; 1558 1559 queuespec : QUEUE STRING interface queue_opts qassign { 1560 struct pf_altq a; 1561 1562 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1563 free($2); 1564 YYERROR; 1565 } 1566 1567 memset(&a, 0, sizeof(a)); 1568 1569 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1570 sizeof(a.qname)) { 1571 yyerror("queue name too long (max " 1572 "%d chars)", PF_QNAME_SIZE-1); 1573 free($2); 1574 YYERROR; 1575 } 1576 free($2); 1577 if ($4.tbrsize) { 1578 yyerror("cannot specify tbrsize for queue"); 1579 YYERROR; 1580 } 1581 if ($4.priority > 255) { 1582 yyerror("priority out of range: max 255"); 1583 YYERROR; 1584 } 1585 a.priority = $4.priority; 1586 a.qlimit = $4.qlimit; 1587 a.scheduler = $4.scheduler.qtype; 1588 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1589 &$4.scheduler)) { 1590 yyerror("errors in queue definition"); 1591 YYERROR; 1592 } 1593 } 1594 ; 1595 1596 queue_opts : { 1597 bzero(&queue_opts, sizeof queue_opts); 1598 queue_opts.priority = DEFAULT_PRIORITY; 1599 queue_opts.qlimit = DEFAULT_QLIMIT; 1600 queue_opts.scheduler.qtype = ALTQT_NONE; 1601 queue_opts.queue_bwspec.bw_percent = 100; 1602 } 1603 queue_opts_l 1604 { $$ = queue_opts; } 1605 | /* empty */ { 1606 bzero(&queue_opts, sizeof queue_opts); 1607 queue_opts.priority = DEFAULT_PRIORITY; 1608 queue_opts.qlimit = DEFAULT_QLIMIT; 1609 queue_opts.scheduler.qtype = ALTQT_NONE; 1610 queue_opts.queue_bwspec.bw_percent = 100; 1611 $$ = queue_opts; 1612 } 1613 ; 1614 1615 queue_opts_l : queue_opts_l queue_opt 1616 | queue_opt 1617 ; 1618 1619 queue_opt : BANDWIDTH bandwidth { 1620 if (queue_opts.marker & QOM_BWSPEC) { 1621 yyerror("bandwidth cannot be respecified"); 1622 YYERROR; 1623 } 1624 queue_opts.marker |= QOM_BWSPEC; 1625 queue_opts.queue_bwspec = $2; 1626 } 1627 | PRIORITY NUMBER { 1628 if (queue_opts.marker & QOM_PRIORITY) { 1629 yyerror("priority cannot be respecified"); 1630 YYERROR; 1631 } 1632 if ($2 < 0 || $2 > 255) { 1633 yyerror("priority out of range: max 255"); 1634 YYERROR; 1635 } 1636 queue_opts.marker |= QOM_PRIORITY; 1637 queue_opts.priority = $2; 1638 } 1639 | QLIMIT NUMBER { 1640 if (queue_opts.marker & QOM_QLIMIT) { 1641 yyerror("qlimit cannot be respecified"); 1642 YYERROR; 1643 } 1644 if ($2 < 0 || $2 > 65535) { 1645 yyerror("qlimit out of range: max 65535"); 1646 YYERROR; 1647 } 1648 queue_opts.marker |= QOM_QLIMIT; 1649 queue_opts.qlimit = $2; 1650 } 1651 | scheduler { 1652 if (queue_opts.marker & QOM_SCHEDULER) { 1653 yyerror("scheduler cannot be respecified"); 1654 YYERROR; 1655 } 1656 queue_opts.marker |= QOM_SCHEDULER; 1657 queue_opts.scheduler = $1; 1658 } 1659 | TBRSIZE NUMBER { 1660 if (queue_opts.marker & QOM_TBRSIZE) { 1661 yyerror("tbrsize cannot be respecified"); 1662 YYERROR; 1663 } 1664 if ($2 < 0 || $2 > UINT_MAX) { 1665 yyerror("tbrsize too big: max %u", UINT_MAX); 1666 YYERROR; 1667 } 1668 queue_opts.marker |= QOM_TBRSIZE; 1669 queue_opts.tbrsize = $2; 1670 } 1671 ; 1672 1673 bandwidth : STRING { 1674 double bps; 1675 char *cp; 1676 1677 $$.bw_percent = 0; 1678 1679 bps = strtod($1, &cp); 1680 if (cp != NULL) { 1681 if (strlen(cp) > 1) { 1682 char *cu = cp + 1; 1683 if (!strcmp(cu, "Bit") || 1684 !strcmp(cu, "B") || 1685 !strcmp(cu, "bit") || 1686 !strcmp(cu, "b")) { 1687 *cu = 0; 1688 } 1689 } 1690 if (!strcmp(cp, "b")) 1691 ; /* nothing */ 1692 else if (!strcmp(cp, "K")) 1693 bps *= 1000; 1694 else if (!strcmp(cp, "M")) 1695 bps *= 1000 * 1000; 1696 else if (!strcmp(cp, "G")) 1697 bps *= 1000 * 1000 * 1000; 1698 else if (!strcmp(cp, "%")) { 1699 if (bps < 0 || bps > 100) { 1700 yyerror("bandwidth spec " 1701 "out of range"); 1702 free($1); 1703 YYERROR; 1704 } 1705 $$.bw_percent = bps; 1706 bps = 0; 1707 } else { 1708 yyerror("unknown unit %s", cp); 1709 free($1); 1710 YYERROR; 1711 } 1712 } 1713 free($1); 1714 $$.bw_absolute = (u_int64_t)bps; 1715 } 1716 | NUMBER { 1717 if ($1 < 0 || $1 >= LLONG_MAX) { 1718 yyerror("bandwidth number too big"); 1719 YYERROR; 1720 } 1721 $$.bw_percent = 0; 1722 $$.bw_absolute = $1; 1723 } 1724 ; 1725 1726 scheduler : CBQ { 1727 $$.qtype = ALTQT_CBQ; 1728 $$.data.cbq_opts.flags = 0; 1729 } 1730 | CBQ '(' cbqflags_list ')' { 1731 $$.qtype = ALTQT_CBQ; 1732 $$.data.cbq_opts.flags = $3; 1733 } 1734 | PRIQ { 1735 $$.qtype = ALTQT_PRIQ; 1736 $$.data.priq_opts.flags = 0; 1737 } 1738 | PRIQ '(' priqflags_list ')' { 1739 $$.qtype = ALTQT_PRIQ; 1740 $$.data.priq_opts.flags = $3; 1741 } 1742 | HFSC { 1743 $$.qtype = ALTQT_HFSC; 1744 bzero(&$$.data.hfsc_opts, 1745 sizeof(struct node_hfsc_opts)); 1746 } 1747 | HFSC '(' hfsc_opts ')' { 1748 $$.qtype = ALTQT_HFSC; 1749 $$.data.hfsc_opts = $3; 1750 } 1751 | FAIRQ { 1752 $$.qtype = ALTQT_FAIRQ; 1753 bzero(&$$.data.fairq_opts, 1754 sizeof(struct node_fairq_opts)); 1755 } 1756 | FAIRQ '(' fairq_opts ')' { 1757 $$.qtype = ALTQT_FAIRQ; 1758 $$.data.fairq_opts = $3; 1759 } 1760 | CODEL { 1761 $$.qtype = ALTQT_CODEL; 1762 bzero(&$$.data.codel_opts, 1763 sizeof(struct codel_opts)); 1764 } 1765 | CODEL '(' codel_opts ')' { 1766 $$.qtype = ALTQT_CODEL; 1767 $$.data.codel_opts = $3; 1768 } 1769 ; 1770 1771 cbqflags_list : cbqflags_item { $$ |= $1; } 1772 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1773 ; 1774 1775 cbqflags_item : STRING { 1776 if (!strcmp($1, "default")) 1777 $$ = CBQCLF_DEFCLASS; 1778 else if (!strcmp($1, "borrow")) 1779 $$ = CBQCLF_BORROW; 1780 else if (!strcmp($1, "red")) 1781 $$ = CBQCLF_RED; 1782 else if (!strcmp($1, "ecn")) 1783 $$ = CBQCLF_RED|CBQCLF_ECN; 1784 else if (!strcmp($1, "rio")) 1785 $$ = CBQCLF_RIO; 1786 else if (!strcmp($1, "codel")) 1787 $$ = CBQCLF_CODEL; 1788 else { 1789 yyerror("unknown cbq flag \"%s\"", $1); 1790 free($1); 1791 YYERROR; 1792 } 1793 free($1); 1794 } 1795 ; 1796 1797 priqflags_list : priqflags_item { $$ |= $1; } 1798 | priqflags_list comma priqflags_item { $$ |= $3; } 1799 ; 1800 1801 priqflags_item : STRING { 1802 if (!strcmp($1, "default")) 1803 $$ = PRCF_DEFAULTCLASS; 1804 else if (!strcmp($1, "red")) 1805 $$ = PRCF_RED; 1806 else if (!strcmp($1, "ecn")) 1807 $$ = PRCF_RED|PRCF_ECN; 1808 else if (!strcmp($1, "rio")) 1809 $$ = PRCF_RIO; 1810 else if (!strcmp($1, "codel")) 1811 $$ = PRCF_CODEL; 1812 else { 1813 yyerror("unknown priq flag \"%s\"", $1); 1814 free($1); 1815 YYERROR; 1816 } 1817 free($1); 1818 } 1819 ; 1820 1821 hfsc_opts : { 1822 bzero(&hfsc_opts, 1823 sizeof(struct node_hfsc_opts)); 1824 } 1825 hfscopts_list { 1826 $$ = hfsc_opts; 1827 } 1828 ; 1829 1830 hfscopts_list : hfscopts_item 1831 | hfscopts_list comma hfscopts_item 1832 ; 1833 1834 hfscopts_item : LINKSHARE bandwidth { 1835 if (hfsc_opts.linkshare.used) { 1836 yyerror("linkshare already specified"); 1837 YYERROR; 1838 } 1839 hfsc_opts.linkshare.m2 = $2; 1840 hfsc_opts.linkshare.used = 1; 1841 } 1842 | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 1843 { 1844 if ($5 < 0 || $5 > INT_MAX) { 1845 yyerror("timing in curve out of range"); 1846 YYERROR; 1847 } 1848 if (hfsc_opts.linkshare.used) { 1849 yyerror("linkshare already specified"); 1850 YYERROR; 1851 } 1852 hfsc_opts.linkshare.m1 = $3; 1853 hfsc_opts.linkshare.d = $5; 1854 hfsc_opts.linkshare.m2 = $7; 1855 hfsc_opts.linkshare.used = 1; 1856 } 1857 | REALTIME bandwidth { 1858 if (hfsc_opts.realtime.used) { 1859 yyerror("realtime already specified"); 1860 YYERROR; 1861 } 1862 hfsc_opts.realtime.m2 = $2; 1863 hfsc_opts.realtime.used = 1; 1864 } 1865 | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 1866 { 1867 if ($5 < 0 || $5 > INT_MAX) { 1868 yyerror("timing in curve out of range"); 1869 YYERROR; 1870 } 1871 if (hfsc_opts.realtime.used) { 1872 yyerror("realtime already specified"); 1873 YYERROR; 1874 } 1875 hfsc_opts.realtime.m1 = $3; 1876 hfsc_opts.realtime.d = $5; 1877 hfsc_opts.realtime.m2 = $7; 1878 hfsc_opts.realtime.used = 1; 1879 } 1880 | UPPERLIMIT bandwidth { 1881 if (hfsc_opts.upperlimit.used) { 1882 yyerror("upperlimit already specified"); 1883 YYERROR; 1884 } 1885 hfsc_opts.upperlimit.m2 = $2; 1886 hfsc_opts.upperlimit.used = 1; 1887 } 1888 | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 1889 { 1890 if ($5 < 0 || $5 > INT_MAX) { 1891 yyerror("timing in curve out of range"); 1892 YYERROR; 1893 } 1894 if (hfsc_opts.upperlimit.used) { 1895 yyerror("upperlimit already specified"); 1896 YYERROR; 1897 } 1898 hfsc_opts.upperlimit.m1 = $3; 1899 hfsc_opts.upperlimit.d = $5; 1900 hfsc_opts.upperlimit.m2 = $7; 1901 hfsc_opts.upperlimit.used = 1; 1902 } 1903 | STRING { 1904 if (!strcmp($1, "default")) 1905 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1906 else if (!strcmp($1, "red")) 1907 hfsc_opts.flags |= HFCF_RED; 1908 else if (!strcmp($1, "ecn")) 1909 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1910 else if (!strcmp($1, "rio")) 1911 hfsc_opts.flags |= HFCF_RIO; 1912 else if (!strcmp($1, "codel")) 1913 hfsc_opts.flags |= HFCF_CODEL; 1914 else { 1915 yyerror("unknown hfsc flag \"%s\"", $1); 1916 free($1); 1917 YYERROR; 1918 } 1919 free($1); 1920 } 1921 ; 1922 1923 fairq_opts : { 1924 bzero(&fairq_opts, 1925 sizeof(struct node_fairq_opts)); 1926 } 1927 fairqopts_list { 1928 $$ = fairq_opts; 1929 } 1930 ; 1931 1932 fairqopts_list : fairqopts_item 1933 | fairqopts_list comma fairqopts_item 1934 ; 1935 1936 fairqopts_item : LINKSHARE bandwidth { 1937 if (fairq_opts.linkshare.used) { 1938 yyerror("linkshare already specified"); 1939 YYERROR; 1940 } 1941 fairq_opts.linkshare.m2 = $2; 1942 fairq_opts.linkshare.used = 1; 1943 } 1944 | LINKSHARE '(' bandwidth number bandwidth ')' { 1945 if (fairq_opts.linkshare.used) { 1946 yyerror("linkshare already specified"); 1947 YYERROR; 1948 } 1949 fairq_opts.linkshare.m1 = $3; 1950 fairq_opts.linkshare.d = $4; 1951 fairq_opts.linkshare.m2 = $5; 1952 fairq_opts.linkshare.used = 1; 1953 } 1954 | HOGS bandwidth { 1955 fairq_opts.hogs_bw = $2; 1956 } 1957 | BUCKETS number { 1958 fairq_opts.nbuckets = $2; 1959 } 1960 | STRING { 1961 if (!strcmp($1, "default")) 1962 fairq_opts.flags |= FARF_DEFAULTCLASS; 1963 else if (!strcmp($1, "red")) 1964 fairq_opts.flags |= FARF_RED; 1965 else if (!strcmp($1, "ecn")) 1966 fairq_opts.flags |= FARF_RED|FARF_ECN; 1967 else if (!strcmp($1, "rio")) 1968 fairq_opts.flags |= FARF_RIO; 1969 else if (!strcmp($1, "codel")) 1970 fairq_opts.flags |= FARF_CODEL; 1971 else { 1972 yyerror("unknown fairq flag \"%s\"", $1); 1973 free($1); 1974 YYERROR; 1975 } 1976 free($1); 1977 } 1978 ; 1979 1980 codel_opts : { 1981 bzero(&codel_opts, 1982 sizeof(struct codel_opts)); 1983 } 1984 codelopts_list { 1985 $$ = codel_opts; 1986 } 1987 ; 1988 1989 codelopts_list : codelopts_item 1990 | codelopts_list comma codelopts_item 1991 ; 1992 1993 codelopts_item : INTERVAL number { 1994 if (codel_opts.interval) { 1995 yyerror("interval already specified"); 1996 YYERROR; 1997 } 1998 codel_opts.interval = $2; 1999 } 2000 | TARGET number { 2001 if (codel_opts.target) { 2002 yyerror("target already specified"); 2003 YYERROR; 2004 } 2005 codel_opts.target = $2; 2006 } 2007 | STRING { 2008 if (!strcmp($1, "ecn")) 2009 codel_opts.ecn = 1; 2010 else { 2011 yyerror("unknown codel option \"%s\"", $1); 2012 free($1); 2013 YYERROR; 2014 } 2015 free($1); 2016 } 2017 ; 2018 2019 qassign : /* empty */ { $$ = NULL; } 2020 | qassign_item { $$ = $1; } 2021 | '{' optnl qassign_list '}' { $$ = $3; } 2022 ; 2023 2024 qassign_list : qassign_item optnl { $$ = $1; } 2025 | qassign_list comma qassign_item optnl { 2026 $1->tail->next = $3; 2027 $1->tail = $3; 2028 $$ = $1; 2029 } 2030 ; 2031 2032 qassign_item : STRING { 2033 $$ = calloc(1, sizeof(struct node_queue)); 2034 if ($$ == NULL) 2035 err(1, "qassign_item: calloc"); 2036 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 2037 sizeof($$->queue)) { 2038 yyerror("queue name '%s' too long (max " 2039 "%d chars)", $1, sizeof($$->queue)-1); 2040 free($1); 2041 free($$); 2042 YYERROR; 2043 } 2044 free($1); 2045 $$->next = NULL; 2046 $$->tail = $$; 2047 } 2048 ; 2049 2050 pfrule : action dir logquick interface route af proto fromto 2051 filter_opts 2052 { 2053 struct pfctl_rule r; 2054 struct node_state_opt *o; 2055 struct node_proto *proto; 2056 int srctrack = 0; 2057 int statelock = 0; 2058 int adaptive = 0; 2059 int defaults = 0; 2060 2061 if (check_rulestate(PFCTL_STATE_FILTER)) 2062 YYERROR; 2063 2064 memset(&r, 0, sizeof(r)); 2065 2066 r.action = $1.b1; 2067 switch ($1.b2) { 2068 case PFRULE_RETURNRST: 2069 r.rule_flag |= PFRULE_RETURNRST; 2070 r.return_ttl = $1.w; 2071 break; 2072 case PFRULE_RETURNICMP: 2073 r.rule_flag |= PFRULE_RETURNICMP; 2074 r.return_icmp = $1.w; 2075 r.return_icmp6 = $1.w2; 2076 break; 2077 case PFRULE_RETURN: 2078 r.rule_flag |= PFRULE_RETURN; 2079 r.return_icmp = $1.w; 2080 r.return_icmp6 = $1.w2; 2081 break; 2082 } 2083 r.direction = $2; 2084 r.log = $3.log; 2085 r.logif = $3.logif; 2086 r.quick = $3.quick; 2087 r.prob = $9.prob; 2088 r.rtableid = $9.rtableid; 2089 2090 if ($9.marker & FOM_PRIO) { 2091 if ($9.prio == 0) 2092 r.prio = PF_PRIO_ZERO; 2093 else 2094 r.prio = $9.prio; 2095 } 2096 if ($9.marker & FOM_SETPRIO) { 2097 r.set_prio[0] = $9.set_prio[0]; 2098 r.set_prio[1] = $9.set_prio[1]; 2099 r.scrub_flags |= PFSTATE_SETPRIO; 2100 } 2101 2102 r.af = $6; 2103 if ($9.tag) 2104 if (strlcpy(r.tagname, $9.tag, 2105 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 2106 yyerror("tag too long, max %u chars", 2107 PF_TAG_NAME_SIZE - 1); 2108 YYERROR; 2109 } 2110 if ($9.match_tag) 2111 if (strlcpy(r.match_tagname, $9.match_tag, 2112 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 2113 yyerror("tag too long, max %u chars", 2114 PF_TAG_NAME_SIZE - 1); 2115 YYERROR; 2116 } 2117 r.match_tag_not = $9.match_tag_not; 2118 if (rule_label(&r, $9.label)) 2119 YYERROR; 2120 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 2121 free($9.label[i]); 2122 r.flags = $9.flags.b1; 2123 r.flagset = $9.flags.b2; 2124 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 2125 yyerror("flags always false"); 2126 YYERROR; 2127 } 2128 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 2129 for (proto = $7; proto != NULL && 2130 proto->proto != IPPROTO_TCP; 2131 proto = proto->next) 2132 ; /* nothing */ 2133 if (proto == NULL && $7 != NULL) { 2134 if ($9.flags.b1 || $9.flags.b2) 2135 yyerror( 2136 "flags only apply to tcp"); 2137 if ($8.src_os) 2138 yyerror( 2139 "OS fingerprinting only " 2140 "apply to tcp"); 2141 YYERROR; 2142 } 2143 #if 0 2144 if (($9.flags.b1 & parse_flags("S")) == 0 && 2145 $8.src_os) { 2146 yyerror("OS fingerprinting requires " 2147 "the SYN TCP flag (flags S/SA)"); 2148 YYERROR; 2149 } 2150 #endif 2151 } 2152 2153 r.tos = $9.tos; 2154 r.keep_state = $9.keep.action; 2155 o = $9.keep.options; 2156 2157 /* 'keep state' by default on pass rules. */ 2158 if (!r.keep_state && !r.action && 2159 !($9.marker & FOM_KEEP)) { 2160 r.keep_state = PF_STATE_NORMAL; 2161 o = keep_state_defaults; 2162 defaults = 1; 2163 } 2164 2165 while (o) { 2166 struct node_state_opt *p = o; 2167 2168 switch (o->type) { 2169 case PF_STATE_OPT_MAX: 2170 if (r.max_states) { 2171 yyerror("state option 'max' " 2172 "multiple definitions"); 2173 YYERROR; 2174 } 2175 r.max_states = o->data.max_states; 2176 break; 2177 case PF_STATE_OPT_NOSYNC: 2178 if (r.rule_flag & PFRULE_NOSYNC) { 2179 yyerror("state option 'sync' " 2180 "multiple definitions"); 2181 YYERROR; 2182 } 2183 r.rule_flag |= PFRULE_NOSYNC; 2184 break; 2185 case PF_STATE_OPT_SRCTRACK: 2186 if (srctrack) { 2187 yyerror("state option " 2188 "'source-track' " 2189 "multiple definitions"); 2190 YYERROR; 2191 } 2192 srctrack = o->data.src_track; 2193 r.rule_flag |= PFRULE_SRCTRACK; 2194 break; 2195 case PF_STATE_OPT_MAX_SRC_STATES: 2196 if (r.max_src_states) { 2197 yyerror("state option " 2198 "'max-src-states' " 2199 "multiple definitions"); 2200 YYERROR; 2201 } 2202 if (o->data.max_src_states == 0) { 2203 yyerror("'max-src-states' must " 2204 "be > 0"); 2205 YYERROR; 2206 } 2207 r.max_src_states = 2208 o->data.max_src_states; 2209 r.rule_flag |= PFRULE_SRCTRACK; 2210 break; 2211 case PF_STATE_OPT_OVERLOAD: 2212 if (r.overload_tblname[0]) { 2213 yyerror("multiple 'overload' " 2214 "table definitions"); 2215 YYERROR; 2216 } 2217 if (strlcpy(r.overload_tblname, 2218 o->data.overload.tblname, 2219 PF_TABLE_NAME_SIZE) >= 2220 PF_TABLE_NAME_SIZE) { 2221 yyerror("state option: " 2222 "strlcpy"); 2223 YYERROR; 2224 } 2225 r.flush = o->data.overload.flush; 2226 break; 2227 case PF_STATE_OPT_MAX_SRC_CONN: 2228 if (r.max_src_conn) { 2229 yyerror("state option " 2230 "'max-src-conn' " 2231 "multiple definitions"); 2232 YYERROR; 2233 } 2234 if (o->data.max_src_conn == 0) { 2235 yyerror("'max-src-conn' " 2236 "must be > 0"); 2237 YYERROR; 2238 } 2239 r.max_src_conn = 2240 o->data.max_src_conn; 2241 r.rule_flag |= PFRULE_SRCTRACK | 2242 PFRULE_RULESRCTRACK; 2243 break; 2244 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 2245 if (r.max_src_conn_rate.limit) { 2246 yyerror("state option " 2247 "'max-src-conn-rate' " 2248 "multiple definitions"); 2249 YYERROR; 2250 } 2251 if (!o->data.max_src_conn_rate.limit || 2252 !o->data.max_src_conn_rate.seconds) { 2253 yyerror("'max-src-conn-rate' " 2254 "values must be > 0"); 2255 YYERROR; 2256 } 2257 if (o->data.max_src_conn_rate.limit > 2258 PF_THRESHOLD_MAX) { 2259 yyerror("'max-src-conn-rate' " 2260 "maximum rate must be < %u", 2261 PF_THRESHOLD_MAX); 2262 YYERROR; 2263 } 2264 r.max_src_conn_rate.limit = 2265 o->data.max_src_conn_rate.limit; 2266 r.max_src_conn_rate.seconds = 2267 o->data.max_src_conn_rate.seconds; 2268 r.rule_flag |= PFRULE_SRCTRACK | 2269 PFRULE_RULESRCTRACK; 2270 break; 2271 case PF_STATE_OPT_MAX_SRC_NODES: 2272 if (r.max_src_nodes) { 2273 yyerror("state option " 2274 "'max-src-nodes' " 2275 "multiple definitions"); 2276 YYERROR; 2277 } 2278 if (o->data.max_src_nodes == 0) { 2279 yyerror("'max-src-nodes' must " 2280 "be > 0"); 2281 YYERROR; 2282 } 2283 r.max_src_nodes = 2284 o->data.max_src_nodes; 2285 r.rule_flag |= PFRULE_SRCTRACK | 2286 PFRULE_RULESRCTRACK; 2287 break; 2288 case PF_STATE_OPT_STATELOCK: 2289 if (statelock) { 2290 yyerror("state locking option: " 2291 "multiple definitions"); 2292 YYERROR; 2293 } 2294 statelock = 1; 2295 r.rule_flag |= o->data.statelock; 2296 break; 2297 case PF_STATE_OPT_SLOPPY: 2298 if (r.rule_flag & PFRULE_STATESLOPPY) { 2299 yyerror("state sloppy option: " 2300 "multiple definitions"); 2301 YYERROR; 2302 } 2303 r.rule_flag |= PFRULE_STATESLOPPY; 2304 break; 2305 case PF_STATE_OPT_TIMEOUT: 2306 if (o->data.timeout.number == 2307 PFTM_ADAPTIVE_START || 2308 o->data.timeout.number == 2309 PFTM_ADAPTIVE_END) 2310 adaptive = 1; 2311 if (r.timeout[o->data.timeout.number]) { 2312 yyerror("state timeout %s " 2313 "multiple definitions", 2314 pf_timeouts[o->data. 2315 timeout.number].name); 2316 YYERROR; 2317 } 2318 r.timeout[o->data.timeout.number] = 2319 o->data.timeout.seconds; 2320 } 2321 o = o->next; 2322 if (!defaults) 2323 free(p); 2324 } 2325 2326 /* 'flags S/SA' by default on stateful rules */ 2327 if (!r.action && !r.flags && !r.flagset && 2328 !$9.fragment && !($9.marker & FOM_FLAGS) && 2329 r.keep_state) { 2330 r.flags = parse_flags("S"); 2331 r.flagset = parse_flags("SA"); 2332 } 2333 if (!adaptive && r.max_states) { 2334 r.timeout[PFTM_ADAPTIVE_START] = 2335 (r.max_states / 10) * 6; 2336 r.timeout[PFTM_ADAPTIVE_END] = 2337 (r.max_states / 10) * 12; 2338 } 2339 if (r.rule_flag & PFRULE_SRCTRACK) { 2340 if (srctrack == PF_SRCTRACK_GLOBAL && 2341 r.max_src_nodes) { 2342 yyerror("'max-src-nodes' is " 2343 "incompatible with " 2344 "'source-track global'"); 2345 YYERROR; 2346 } 2347 if (srctrack == PF_SRCTRACK_GLOBAL && 2348 r.max_src_conn) { 2349 yyerror("'max-src-conn' is " 2350 "incompatible with " 2351 "'source-track global'"); 2352 YYERROR; 2353 } 2354 if (srctrack == PF_SRCTRACK_GLOBAL && 2355 r.max_src_conn_rate.seconds) { 2356 yyerror("'max-src-conn-rate' is " 2357 "incompatible with " 2358 "'source-track global'"); 2359 YYERROR; 2360 } 2361 if (r.timeout[PFTM_SRC_NODE] < 2362 r.max_src_conn_rate.seconds) 2363 r.timeout[PFTM_SRC_NODE] = 2364 r.max_src_conn_rate.seconds; 2365 r.rule_flag |= PFRULE_SRCTRACK; 2366 if (srctrack == PF_SRCTRACK_RULE) 2367 r.rule_flag |= PFRULE_RULESRCTRACK; 2368 } 2369 if (r.keep_state && !statelock) 2370 r.rule_flag |= default_statelock; 2371 2372 if ($9.fragment) 2373 r.rule_flag |= PFRULE_FRAGMENT; 2374 r.allow_opts = $9.allowopts; 2375 2376 decide_address_family($8.src.host, &r.af); 2377 decide_address_family($8.dst.host, &r.af); 2378 2379 if ($5.rt) { 2380 if (!r.direction) { 2381 yyerror("direction must be explicit " 2382 "with rules that specify routing"); 2383 YYERROR; 2384 } 2385 r.rt = $5.rt; 2386 r.rpool.opts = $5.pool_opts; 2387 if ($5.key != NULL) 2388 memcpy(&r.rpool.key, $5.key, 2389 sizeof(struct pf_poolhashkey)); 2390 } 2391 if (r.rt) { 2392 decide_address_family($5.host, &r.af); 2393 remove_invalid_hosts(&$5.host, &r.af); 2394 if ($5.host == NULL) { 2395 yyerror("no routing address with " 2396 "matching address family found."); 2397 YYERROR; 2398 } 2399 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 2400 PF_POOL_NONE && ($5.host->next != NULL || 2401 $5.host->addr.type == PF_ADDR_TABLE || 2402 DYNIF_MULTIADDR($5.host->addr))) 2403 r.rpool.opts |= PF_POOL_ROUNDROBIN; 2404 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2405 PF_POOL_ROUNDROBIN && 2406 disallow_table($5.host, "tables are only " 2407 "supported in round-robin routing pools")) 2408 YYERROR; 2409 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2410 PF_POOL_ROUNDROBIN && 2411 disallow_alias($5.host, "interface (%s) " 2412 "is only supported in round-robin " 2413 "routing pools")) 2414 YYERROR; 2415 if ($5.host->next != NULL) { 2416 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2417 PF_POOL_ROUNDROBIN) { 2418 yyerror("r.rpool.opts must " 2419 "be PF_POOL_ROUNDROBIN"); 2420 YYERROR; 2421 } 2422 } 2423 } 2424 if ($9.queues.qname != NULL) { 2425 if (strlcpy(r.qname, $9.queues.qname, 2426 sizeof(r.qname)) >= sizeof(r.qname)) { 2427 yyerror("rule qname too long (max " 2428 "%d chars)", sizeof(r.qname)-1); 2429 YYERROR; 2430 } 2431 free($9.queues.qname); 2432 } 2433 if ($9.queues.pqname != NULL) { 2434 if (strlcpy(r.pqname, $9.queues.pqname, 2435 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2436 yyerror("rule pqname too long (max " 2437 "%d chars)", sizeof(r.pqname)-1); 2438 YYERROR; 2439 } 2440 free($9.queues.pqname); 2441 } 2442 #ifdef __FreeBSD__ 2443 r.divert.port = $9.divert.port; 2444 #else 2445 if ((r.divert.port = $9.divert.port)) { 2446 if (r.direction == PF_OUT) { 2447 if ($9.divert.addr) { 2448 yyerror("address specified " 2449 "for outgoing divert"); 2450 YYERROR; 2451 } 2452 bzero(&r.divert.addr, 2453 sizeof(r.divert.addr)); 2454 } else { 2455 if (!$9.divert.addr) { 2456 yyerror("no address specified " 2457 "for incoming divert"); 2458 YYERROR; 2459 } 2460 if ($9.divert.addr->af != r.af) { 2461 yyerror("address family " 2462 "mismatch for divert"); 2463 YYERROR; 2464 } 2465 r.divert.addr = 2466 $9.divert.addr->addr.v.a.addr; 2467 } 2468 } 2469 #endif 2470 2471 if ($9.dnpipe || $9.dnrpipe) { 2472 r.dnpipe = $9.dnpipe; 2473 r.dnrpipe = $9.dnrpipe; 2474 if ($9.free_flags & PFRULE_DN_IS_PIPE) 2475 r.free_flags |= PFRULE_DN_IS_PIPE; 2476 else 2477 r.free_flags |= PFRULE_DN_IS_QUEUE; 2478 } 2479 2480 expand_rule(&r, $4, $5.host, $7, $8.src_os, 2481 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 2482 $9.uid, $9.gid, $9.icmpspec, ""); 2483 } 2484 ; 2485 2486 filter_opts : { 2487 bzero(&filter_opts, sizeof filter_opts); 2488 filter_opts.rtableid = -1; 2489 } 2490 filter_opts_l 2491 { $$ = filter_opts; } 2492 | /* empty */ { 2493 bzero(&filter_opts, sizeof filter_opts); 2494 filter_opts.rtableid = -1; 2495 $$ = filter_opts; 2496 } 2497 ; 2498 2499 filter_opts_l : filter_opts_l filter_opt 2500 | filter_opt 2501 ; 2502 2503 filter_opt : USER uids { 2504 if (filter_opts.uid) 2505 $2->tail->next = filter_opts.uid; 2506 filter_opts.uid = $2; 2507 } 2508 | GROUP gids { 2509 if (filter_opts.gid) 2510 $2->tail->next = filter_opts.gid; 2511 filter_opts.gid = $2; 2512 } 2513 | flags { 2514 if (filter_opts.marker & FOM_FLAGS) { 2515 yyerror("flags cannot be redefined"); 2516 YYERROR; 2517 } 2518 filter_opts.marker |= FOM_FLAGS; 2519 filter_opts.flags.b1 |= $1.b1; 2520 filter_opts.flags.b2 |= $1.b2; 2521 filter_opts.flags.w |= $1.w; 2522 filter_opts.flags.w2 |= $1.w2; 2523 } 2524 | icmpspec { 2525 if (filter_opts.marker & FOM_ICMP) { 2526 yyerror("icmp-type cannot be redefined"); 2527 YYERROR; 2528 } 2529 filter_opts.marker |= FOM_ICMP; 2530 filter_opts.icmpspec = $1; 2531 } 2532 | PRIO NUMBER { 2533 if (filter_opts.marker & FOM_PRIO) { 2534 yyerror("prio cannot be redefined"); 2535 YYERROR; 2536 } 2537 if ($2 < 0 || $2 > PF_PRIO_MAX) { 2538 yyerror("prio must be 0 - %u", PF_PRIO_MAX); 2539 YYERROR; 2540 } 2541 filter_opts.marker |= FOM_PRIO; 2542 filter_opts.prio = $2; 2543 } 2544 | TOS tos { 2545 if (filter_opts.marker & FOM_TOS) { 2546 yyerror("tos cannot be redefined"); 2547 YYERROR; 2548 } 2549 filter_opts.marker |= FOM_TOS; 2550 filter_opts.tos = $2; 2551 } 2552 | keep { 2553 if (filter_opts.marker & FOM_KEEP) { 2554 yyerror("modulate or keep cannot be redefined"); 2555 YYERROR; 2556 } 2557 filter_opts.marker |= FOM_KEEP; 2558 filter_opts.keep.action = $1.action; 2559 filter_opts.keep.options = $1.options; 2560 } 2561 | FRAGMENT { 2562 filter_opts.fragment = 1; 2563 } 2564 | ALLOWOPTS { 2565 filter_opts.allowopts = 1; 2566 } 2567 | label { 2568 if (filter_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 2569 yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 2570 YYERROR; 2571 } 2572 filter_opts.label[filter_opts.labelcount++] = $1; 2573 } 2574 | qname { 2575 if (filter_opts.queues.qname) { 2576 yyerror("queue cannot be redefined"); 2577 YYERROR; 2578 } 2579 filter_opts.queues = $1; 2580 } 2581 | DNPIPE number { 2582 filter_opts.dnpipe = $2; 2583 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 2584 } 2585 | DNPIPE '(' number ')' { 2586 filter_opts.dnpipe = $3; 2587 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 2588 } 2589 | DNPIPE '(' number comma number ')' { 2590 filter_opts.dnrpipe = $5; 2591 filter_opts.dnpipe = $3; 2592 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 2593 } 2594 | DNQUEUE number { 2595 filter_opts.dnpipe = $2; 2596 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 2597 } 2598 | DNQUEUE '(' number comma number ')' { 2599 filter_opts.dnrpipe = $5; 2600 filter_opts.dnpipe = $3; 2601 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 2602 } 2603 | DNQUEUE '(' number ')' { 2604 filter_opts.dnpipe = $3; 2605 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 2606 } 2607 | TAG string { 2608 filter_opts.tag = $2; 2609 } 2610 | not TAGGED string { 2611 filter_opts.match_tag = $3; 2612 filter_opts.match_tag_not = $1; 2613 } 2614 | PROBABILITY probability { 2615 double p; 2616 2617 p = floor($2 * UINT_MAX + 0.5); 2618 if (p < 0.0 || p > UINT_MAX) { 2619 yyerror("invalid probability: %lf", p); 2620 YYERROR; 2621 } 2622 filter_opts.prob = (u_int32_t)p; 2623 if (filter_opts.prob == 0) 2624 filter_opts.prob = 1; 2625 } 2626 | RTABLE NUMBER { 2627 if ($2 < 0 || $2 > rt_tableid_max()) { 2628 yyerror("invalid rtable id"); 2629 YYERROR; 2630 } 2631 filter_opts.rtableid = $2; 2632 } 2633 | DIVERTTO portplain { 2634 #ifdef __FreeBSD__ 2635 filter_opts.divert.port = $2.a; 2636 if (!filter_opts.divert.port) { 2637 yyerror("invalid divert port: %u", ntohs($2.a)); 2638 YYERROR; 2639 } 2640 #endif 2641 } 2642 | DIVERTTO STRING PORT portplain { 2643 #ifndef __FreeBSD__ 2644 if ((filter_opts.divert.addr = host($2)) == NULL) { 2645 yyerror("could not parse divert address: %s", 2646 $2); 2647 free($2); 2648 YYERROR; 2649 } 2650 #else 2651 if ($2) 2652 #endif 2653 free($2); 2654 filter_opts.divert.port = $4.a; 2655 if (!filter_opts.divert.port) { 2656 yyerror("invalid divert port: %u", ntohs($4.a)); 2657 YYERROR; 2658 } 2659 } 2660 | DIVERTREPLY { 2661 #ifdef __FreeBSD__ 2662 yyerror("divert-reply has no meaning in FreeBSD pf(4)"); 2663 YYERROR; 2664 #else 2665 filter_opts.divert.port = 1; /* some random value */ 2666 #endif 2667 } 2668 | filter_sets 2669 ; 2670 2671 filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; } 2672 | SET filter_set { $$ = filter_opts; } 2673 ; 2674 2675 filter_sets_l : filter_sets_l comma filter_set 2676 | filter_set 2677 ; 2678 2679 filter_set : prio { 2680 if (filter_opts.marker & FOM_SETPRIO) { 2681 yyerror("prio cannot be redefined"); 2682 YYERROR; 2683 } 2684 filter_opts.marker |= FOM_SETPRIO; 2685 filter_opts.set_prio[0] = $1.b1; 2686 filter_opts.set_prio[1] = $1.b2; 2687 } 2688 prio : PRIO NUMBER { 2689 if ($2 < 0 || $2 > PF_PRIO_MAX) { 2690 yyerror("prio must be 0 - %u", PF_PRIO_MAX); 2691 YYERROR; 2692 } 2693 $$.b1 = $$.b2 = $2; 2694 } 2695 | PRIO '(' NUMBER comma NUMBER ')' { 2696 if ($3 < 0 || $3 > PF_PRIO_MAX || 2697 $5 < 0 || $5 > PF_PRIO_MAX) { 2698 yyerror("prio must be 0 - %u", PF_PRIO_MAX); 2699 YYERROR; 2700 } 2701 $$.b1 = $3; 2702 $$.b2 = $5; 2703 } 2704 ; 2705 2706 probability : STRING { 2707 char *e; 2708 double p = strtod($1, &e); 2709 2710 if (*e == '%') { 2711 p *= 0.01; 2712 e++; 2713 } 2714 if (*e) { 2715 yyerror("invalid probability: %s", $1); 2716 free($1); 2717 YYERROR; 2718 } 2719 free($1); 2720 $$ = p; 2721 } 2722 | NUMBER { 2723 $$ = (double)$1; 2724 } 2725 ; 2726 2727 2728 action : PASS { 2729 $$.b1 = PF_PASS; 2730 $$.b2 = failpolicy; 2731 $$.w = returnicmpdefault; 2732 $$.w2 = returnicmp6default; 2733 } 2734 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 2735 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2736 ; 2737 2738 blockspec : /* empty */ { 2739 $$.b2 = blockpolicy; 2740 $$.w = returnicmpdefault; 2741 $$.w2 = returnicmp6default; 2742 } 2743 | DROP { 2744 $$.b2 = PFRULE_DROP; 2745 $$.w = 0; 2746 $$.w2 = 0; 2747 } 2748 | RETURNRST { 2749 $$.b2 = PFRULE_RETURNRST; 2750 $$.w = 0; 2751 $$.w2 = 0; 2752 } 2753 | RETURNRST '(' TTL NUMBER ')' { 2754 if ($4 < 0 || $4 > 255) { 2755 yyerror("illegal ttl value %d", $4); 2756 YYERROR; 2757 } 2758 $$.b2 = PFRULE_RETURNRST; 2759 $$.w = $4; 2760 $$.w2 = 0; 2761 } 2762 | RETURNICMP { 2763 $$.b2 = PFRULE_RETURNICMP; 2764 $$.w = returnicmpdefault; 2765 $$.w2 = returnicmp6default; 2766 } 2767 | RETURNICMP6 { 2768 $$.b2 = PFRULE_RETURNICMP; 2769 $$.w = returnicmpdefault; 2770 $$.w2 = returnicmp6default; 2771 } 2772 | RETURNICMP '(' reticmpspec ')' { 2773 $$.b2 = PFRULE_RETURNICMP; 2774 $$.w = $3; 2775 $$.w2 = returnicmpdefault; 2776 } 2777 | RETURNICMP6 '(' reticmp6spec ')' { 2778 $$.b2 = PFRULE_RETURNICMP; 2779 $$.w = returnicmpdefault; 2780 $$.w2 = $3; 2781 } 2782 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 2783 $$.b2 = PFRULE_RETURNICMP; 2784 $$.w = $3; 2785 $$.w2 = $5; 2786 } 2787 | RETURN { 2788 $$.b2 = PFRULE_RETURN; 2789 $$.w = returnicmpdefault; 2790 $$.w2 = returnicmp6default; 2791 } 2792 ; 2793 2794 reticmpspec : STRING { 2795 if (!($$ = parseicmpspec($1, AF_INET))) { 2796 free($1); 2797 YYERROR; 2798 } 2799 free($1); 2800 } 2801 | NUMBER { 2802 u_int8_t icmptype; 2803 2804 if ($1 < 0 || $1 > 255) { 2805 yyerror("invalid icmp code %lu", $1); 2806 YYERROR; 2807 } 2808 icmptype = returnicmpdefault >> 8; 2809 $$ = (icmptype << 8 | $1); 2810 } 2811 ; 2812 2813 reticmp6spec : STRING { 2814 if (!($$ = parseicmpspec($1, AF_INET6))) { 2815 free($1); 2816 YYERROR; 2817 } 2818 free($1); 2819 } 2820 | NUMBER { 2821 u_int8_t icmptype; 2822 2823 if ($1 < 0 || $1 > 255) { 2824 yyerror("invalid icmp code %lu", $1); 2825 YYERROR; 2826 } 2827 icmptype = returnicmp6default >> 8; 2828 $$ = (icmptype << 8 | $1); 2829 } 2830 ; 2831 2832 dir : /* empty */ { $$ = PF_INOUT; } 2833 | IN { $$ = PF_IN; } 2834 | OUT { $$ = PF_OUT; } 2835 ; 2836 2837 quick : /* empty */ { $$.quick = 0; } 2838 | QUICK { $$.quick = 1; } 2839 ; 2840 2841 logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2842 | log { $$ = $1; $$.quick = 0; } 2843 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2844 | log QUICK { $$ = $1; $$.quick = 1; } 2845 | QUICK log { $$ = $2; $$.quick = 1; } 2846 ; 2847 2848 log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2849 | LOG '(' logopts ')' { 2850 $$.log = PF_LOG | $3.log; 2851 $$.logif = $3.logif; 2852 } 2853 ; 2854 2855 logopts : logopt { $$ = $1; } 2856 | logopts comma logopt { 2857 $$.log = $1.log | $3.log; 2858 $$.logif = $3.logif; 2859 if ($$.logif == 0) 2860 $$.logif = $1.logif; 2861 } 2862 ; 2863 2864 logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2865 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2866 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2867 | TO string { 2868 const char *errstr; 2869 u_int i; 2870 2871 $$.log = 0; 2872 if (strncmp($2, "pflog", 5)) { 2873 yyerror("%s: should be a pflog interface", $2); 2874 free($2); 2875 YYERROR; 2876 } 2877 i = strtonum($2 + 5, 0, 255, &errstr); 2878 if (errstr) { 2879 yyerror("%s: %s", $2, errstr); 2880 free($2); 2881 YYERROR; 2882 } 2883 free($2); 2884 $$.logif = i; 2885 } 2886 ; 2887 2888 interface : /* empty */ { $$ = NULL; } 2889 | ON if_item_not { $$ = $2; } 2890 | ON '{' optnl if_list '}' { $$ = $4; } 2891 ; 2892 2893 if_list : if_item_not optnl { $$ = $1; } 2894 | if_list comma if_item_not optnl { 2895 $1->tail->next = $3; 2896 $1->tail = $3; 2897 $$ = $1; 2898 } 2899 ; 2900 2901 if_item_not : not if_item { $$ = $2; $$->not = $1; } 2902 ; 2903 2904 if_item : STRING { 2905 struct node_host *n; 2906 2907 $$ = calloc(1, sizeof(struct node_if)); 2908 if ($$ == NULL) 2909 err(1, "if_item: calloc"); 2910 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2911 sizeof($$->ifname)) { 2912 free($1); 2913 free($$); 2914 yyerror("interface name too long"); 2915 YYERROR; 2916 } 2917 2918 if ((n = ifa_exists($1)) != NULL) 2919 $$->ifa_flags = n->ifa_flags; 2920 2921 free($1); 2922 $$->not = 0; 2923 $$->next = NULL; 2924 $$->tail = $$; 2925 } 2926 ; 2927 2928 af : /* empty */ { $$ = 0; } 2929 | INET { $$ = AF_INET; } 2930 | INET6 { $$ = AF_INET6; } 2931 ; 2932 2933 proto : /* empty */ { $$ = NULL; } 2934 | PROTO proto_item { $$ = $2; } 2935 | PROTO '{' optnl proto_list '}' { $$ = $4; } 2936 ; 2937 2938 proto_list : proto_item optnl { $$ = $1; } 2939 | proto_list comma proto_item optnl { 2940 $1->tail->next = $3; 2941 $1->tail = $3; 2942 $$ = $1; 2943 } 2944 ; 2945 2946 proto_item : protoval { 2947 u_int8_t pr; 2948 2949 pr = (u_int8_t)$1; 2950 if (pr == 0) { 2951 yyerror("proto 0 cannot be used"); 2952 YYERROR; 2953 } 2954 $$ = calloc(1, sizeof(struct node_proto)); 2955 if ($$ == NULL) 2956 err(1, "proto_item: calloc"); 2957 $$->proto = pr; 2958 $$->next = NULL; 2959 $$->tail = $$; 2960 } 2961 ; 2962 2963 protoval : STRING { 2964 struct protoent *p; 2965 2966 p = getprotobyname($1); 2967 if (p == NULL) { 2968 yyerror("unknown protocol %s", $1); 2969 free($1); 2970 YYERROR; 2971 } 2972 $$ = p->p_proto; 2973 free($1); 2974 } 2975 | NUMBER { 2976 if ($1 < 0 || $1 > 255) { 2977 yyerror("protocol outside range"); 2978 YYERROR; 2979 } 2980 } 2981 ; 2982 2983 fromto : ALL { 2984 $$.src.host = NULL; 2985 $$.src.port = NULL; 2986 $$.dst.host = NULL; 2987 $$.dst.port = NULL; 2988 $$.src_os = NULL; 2989 } 2990 | from os to { 2991 $$.src = $1; 2992 $$.src_os = $2; 2993 $$.dst = $3; 2994 } 2995 ; 2996 2997 os : /* empty */ { $$ = NULL; } 2998 | OS xos { $$ = $2; } 2999 | OS '{' optnl os_list '}' { $$ = $4; } 3000 ; 3001 3002 xos : STRING { 3003 $$ = calloc(1, sizeof(struct node_os)); 3004 if ($$ == NULL) 3005 err(1, "os: calloc"); 3006 $$->os = $1; 3007 $$->tail = $$; 3008 } 3009 ; 3010 3011 os_list : xos optnl { $$ = $1; } 3012 | os_list comma xos optnl { 3013 $1->tail->next = $3; 3014 $1->tail = $3; 3015 $$ = $1; 3016 } 3017 ; 3018 3019 from : /* empty */ { 3020 $$.host = NULL; 3021 $$.port = NULL; 3022 } 3023 | FROM ipportspec { 3024 $$ = $2; 3025 } 3026 ; 3027 3028 to : /* empty */ { 3029 $$.host = NULL; 3030 $$.port = NULL; 3031 } 3032 | TO ipportspec { 3033 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 3034 "not permitted in a destination address")) 3035 YYERROR; 3036 $$ = $2; 3037 } 3038 ; 3039 3040 ipportspec : ipspec { 3041 $$.host = $1; 3042 $$.port = NULL; 3043 } 3044 | ipspec PORT portspec { 3045 $$.host = $1; 3046 $$.port = $3; 3047 } 3048 | PORT portspec { 3049 $$.host = NULL; 3050 $$.port = $2; 3051 } 3052 ; 3053 3054 optnl : '\n' optnl 3055 | 3056 ; 3057 3058 ipspec : ANY { $$ = NULL; } 3059 | xhost { $$ = $1; } 3060 | '{' optnl host_list '}' { $$ = $3; } 3061 ; 3062 3063 toipspec : TO ipspec { $$ = $2; } 3064 | /* empty */ { $$ = NULL; } 3065 ; 3066 3067 host_list : ipspec optnl { $$ = $1; } 3068 | host_list comma ipspec optnl { 3069 if ($3 == NULL) 3070 $$ = $1; 3071 else if ($1 == NULL) 3072 $$ = $3; 3073 else { 3074 $1->tail->next = $3; 3075 $1->tail = $3->tail; 3076 $$ = $1; 3077 } 3078 } 3079 ; 3080 3081 xhost : not host { 3082 struct node_host *n; 3083 3084 for (n = $2; n != NULL; n = n->next) 3085 n->not = $1; 3086 $$ = $2; 3087 } 3088 | not NOROUTE { 3089 $$ = calloc(1, sizeof(struct node_host)); 3090 if ($$ == NULL) 3091 err(1, "xhost: calloc"); 3092 $$->addr.type = PF_ADDR_NOROUTE; 3093 $$->next = NULL; 3094 $$->not = $1; 3095 $$->tail = $$; 3096 } 3097 | not URPFFAILED { 3098 $$ = calloc(1, sizeof(struct node_host)); 3099 if ($$ == NULL) 3100 err(1, "xhost: calloc"); 3101 $$->addr.type = PF_ADDR_URPFFAILED; 3102 $$->next = NULL; 3103 $$->not = $1; 3104 $$->tail = $$; 3105 } 3106 ; 3107 3108 host : STRING { 3109 if (($$ = host($1)) == NULL) { 3110 /* error. "any" is handled elsewhere */ 3111 free($1); 3112 yyerror("could not parse host specification"); 3113 YYERROR; 3114 } 3115 free($1); 3116 3117 } 3118 | STRING '-' STRING { 3119 struct node_host *b, *e; 3120 3121 if ((b = host($1)) == NULL || (e = host($3)) == NULL) { 3122 free($1); 3123 free($3); 3124 yyerror("could not parse host specification"); 3125 YYERROR; 3126 } 3127 if (b->af != e->af || 3128 b->addr.type != PF_ADDR_ADDRMASK || 3129 e->addr.type != PF_ADDR_ADDRMASK || 3130 unmask(&b->addr.v.a.mask, b->af) != 3131 (b->af == AF_INET ? 32 : 128) || 3132 unmask(&e->addr.v.a.mask, e->af) != 3133 (e->af == AF_INET ? 32 : 128) || 3134 b->next != NULL || b->not || 3135 e->next != NULL || e->not) { 3136 free(b); 3137 free(e); 3138 free($1); 3139 free($3); 3140 yyerror("invalid address range"); 3141 YYERROR; 3142 } 3143 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 3144 sizeof(b->addr.v.a.mask)); 3145 b->addr.type = PF_ADDR_RANGE; 3146 $$ = b; 3147 free(e); 3148 free($1); 3149 free($3); 3150 } 3151 | STRING '/' NUMBER { 3152 char *buf; 3153 3154 if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1) 3155 err(1, "host: asprintf"); 3156 free($1); 3157 if (($$ = host(buf)) == NULL) { 3158 /* error. "any" is handled elsewhere */ 3159 free(buf); 3160 yyerror("could not parse host specification"); 3161 YYERROR; 3162 } 3163 free(buf); 3164 } 3165 | NUMBER '/' NUMBER { 3166 char *buf; 3167 3168 /* ie. for 10/8 parsing */ 3169 #ifdef __FreeBSD__ 3170 if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1) 3171 #else 3172 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 3173 #endif 3174 err(1, "host: asprintf"); 3175 if (($$ = host(buf)) == NULL) { 3176 /* error. "any" is handled elsewhere */ 3177 free(buf); 3178 yyerror("could not parse host specification"); 3179 YYERROR; 3180 } 3181 free(buf); 3182 } 3183 | dynaddr 3184 | dynaddr '/' NUMBER { 3185 struct node_host *n; 3186 3187 if ($3 < 0 || $3 > 128) { 3188 yyerror("bit number too big"); 3189 YYERROR; 3190 } 3191 $$ = $1; 3192 for (n = $1; n != NULL; n = n->next) 3193 set_ipmask(n, $3); 3194 } 3195 | '<' STRING '>' { 3196 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 3197 yyerror("table name '%s' too long", $2); 3198 free($2); 3199 YYERROR; 3200 } 3201 $$ = calloc(1, sizeof(struct node_host)); 3202 if ($$ == NULL) 3203 err(1, "host: calloc"); 3204 $$->addr.type = PF_ADDR_TABLE; 3205 if (strlcpy($$->addr.v.tblname, $2, 3206 sizeof($$->addr.v.tblname)) >= 3207 sizeof($$->addr.v.tblname)) 3208 errx(1, "host: strlcpy"); 3209 free($2); 3210 $$->next = NULL; 3211 $$->tail = $$; 3212 } 3213 ; 3214 3215 number : NUMBER 3216 | STRING { 3217 u_long ulval; 3218 3219 if (atoul($1, &ulval) == -1) { 3220 yyerror("%s is not a number", $1); 3221 free($1); 3222 YYERROR; 3223 } else 3224 $$ = ulval; 3225 free($1); 3226 } 3227 ; 3228 3229 dynaddr : '(' STRING ')' { 3230 int flags = 0; 3231 char *p, *op; 3232 3233 op = $2; 3234 if (!isalpha(op[0])) { 3235 yyerror("invalid interface name '%s'", op); 3236 free(op); 3237 YYERROR; 3238 } 3239 while ((p = strrchr($2, ':')) != NULL) { 3240 if (!strcmp(p+1, "network")) 3241 flags |= PFI_AFLAG_NETWORK; 3242 else if (!strcmp(p+1, "broadcast")) 3243 flags |= PFI_AFLAG_BROADCAST; 3244 else if (!strcmp(p+1, "peer")) 3245 flags |= PFI_AFLAG_PEER; 3246 else if (!strcmp(p+1, "0")) 3247 flags |= PFI_AFLAG_NOALIAS; 3248 else { 3249 yyerror("interface %s has bad modifier", 3250 $2); 3251 free(op); 3252 YYERROR; 3253 } 3254 *p = '\0'; 3255 } 3256 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 3257 free(op); 3258 yyerror("illegal combination of " 3259 "interface modifiers"); 3260 YYERROR; 3261 } 3262 $$ = calloc(1, sizeof(struct node_host)); 3263 if ($$ == NULL) 3264 err(1, "address: calloc"); 3265 $$->af = 0; 3266 set_ipmask($$, 128); 3267 $$->addr.type = PF_ADDR_DYNIFTL; 3268 $$->addr.iflags = flags; 3269 if (strlcpy($$->addr.v.ifname, $2, 3270 sizeof($$->addr.v.ifname)) >= 3271 sizeof($$->addr.v.ifname)) { 3272 free(op); 3273 free($$); 3274 yyerror("interface name too long"); 3275 YYERROR; 3276 } 3277 free(op); 3278 $$->next = NULL; 3279 $$->tail = $$; 3280 } 3281 ; 3282 3283 portspec : port_item { $$ = $1; } 3284 | '{' optnl port_list '}' { $$ = $3; } 3285 ; 3286 3287 port_list : port_item optnl { $$ = $1; } 3288 | port_list comma port_item optnl { 3289 $1->tail->next = $3; 3290 $1->tail = $3; 3291 $$ = $1; 3292 } 3293 ; 3294 3295 port_item : portrange { 3296 $$ = calloc(1, sizeof(struct node_port)); 3297 if ($$ == NULL) 3298 err(1, "port_item: calloc"); 3299 $$->port[0] = $1.a; 3300 $$->port[1] = $1.b; 3301 if ($1.t) 3302 $$->op = PF_OP_RRG; 3303 else 3304 $$->op = PF_OP_EQ; 3305 $$->next = NULL; 3306 $$->tail = $$; 3307 } 3308 | unaryop portrange { 3309 if ($2.t) { 3310 yyerror("':' cannot be used with an other " 3311 "port operator"); 3312 YYERROR; 3313 } 3314 $$ = calloc(1, sizeof(struct node_port)); 3315 if ($$ == NULL) 3316 err(1, "port_item: calloc"); 3317 $$->port[0] = $2.a; 3318 $$->port[1] = $2.b; 3319 $$->op = $1; 3320 $$->next = NULL; 3321 $$->tail = $$; 3322 } 3323 | portrange PORTBINARY portrange { 3324 if ($1.t || $3.t) { 3325 yyerror("':' cannot be used with an other " 3326 "port operator"); 3327 YYERROR; 3328 } 3329 $$ = calloc(1, sizeof(struct node_port)); 3330 if ($$ == NULL) 3331 err(1, "port_item: calloc"); 3332 $$->port[0] = $1.a; 3333 $$->port[1] = $3.a; 3334 $$->op = $2; 3335 $$->next = NULL; 3336 $$->tail = $$; 3337 } 3338 ; 3339 3340 portplain : numberstring { 3341 if (parseport($1, &$$, 0) == -1) { 3342 free($1); 3343 YYERROR; 3344 } 3345 free($1); 3346 } 3347 ; 3348 3349 portrange : numberstring { 3350 if (parseport($1, &$$, PPORT_RANGE) == -1) { 3351 free($1); 3352 YYERROR; 3353 } 3354 free($1); 3355 } 3356 ; 3357 3358 uids : uid_item { $$ = $1; } 3359 | '{' optnl uid_list '}' { $$ = $3; } 3360 ; 3361 3362 uid_list : uid_item optnl { $$ = $1; } 3363 | uid_list comma uid_item optnl { 3364 $1->tail->next = $3; 3365 $1->tail = $3; 3366 $$ = $1; 3367 } 3368 ; 3369 3370 uid_item : uid { 3371 $$ = calloc(1, sizeof(struct node_uid)); 3372 if ($$ == NULL) 3373 err(1, "uid_item: calloc"); 3374 $$->uid[0] = $1; 3375 $$->uid[1] = $1; 3376 $$->op = PF_OP_EQ; 3377 $$->next = NULL; 3378 $$->tail = $$; 3379 } 3380 | unaryop uid { 3381 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3382 yyerror("user unknown requires operator = or " 3383 "!="); 3384 YYERROR; 3385 } 3386 $$ = calloc(1, sizeof(struct node_uid)); 3387 if ($$ == NULL) 3388 err(1, "uid_item: calloc"); 3389 $$->uid[0] = $2; 3390 $$->uid[1] = $2; 3391 $$->op = $1; 3392 $$->next = NULL; 3393 $$->tail = $$; 3394 } 3395 | uid PORTBINARY uid { 3396 if ($1 == UID_MAX || $3 == UID_MAX) { 3397 yyerror("user unknown requires operator = or " 3398 "!="); 3399 YYERROR; 3400 } 3401 $$ = calloc(1, sizeof(struct node_uid)); 3402 if ($$ == NULL) 3403 err(1, "uid_item: calloc"); 3404 $$->uid[0] = $1; 3405 $$->uid[1] = $3; 3406 $$->op = $2; 3407 $$->next = NULL; 3408 $$->tail = $$; 3409 } 3410 ; 3411 3412 uid : STRING { 3413 if (!strcmp($1, "unknown")) 3414 $$ = UID_MAX; 3415 else { 3416 struct passwd *pw; 3417 3418 if ((pw = getpwnam($1)) == NULL) { 3419 yyerror("unknown user %s", $1); 3420 free($1); 3421 YYERROR; 3422 } 3423 $$ = pw->pw_uid; 3424 } 3425 free($1); 3426 } 3427 | NUMBER { 3428 if ($1 < 0 || $1 >= UID_MAX) { 3429 yyerror("illegal uid value %lu", $1); 3430 YYERROR; 3431 } 3432 $$ = $1; 3433 } 3434 ; 3435 3436 gids : gid_item { $$ = $1; } 3437 | '{' optnl gid_list '}' { $$ = $3; } 3438 ; 3439 3440 gid_list : gid_item optnl { $$ = $1; } 3441 | gid_list comma gid_item optnl { 3442 $1->tail->next = $3; 3443 $1->tail = $3; 3444 $$ = $1; 3445 } 3446 ; 3447 3448 gid_item : gid { 3449 $$ = calloc(1, sizeof(struct node_gid)); 3450 if ($$ == NULL) 3451 err(1, "gid_item: calloc"); 3452 $$->gid[0] = $1; 3453 $$->gid[1] = $1; 3454 $$->op = PF_OP_EQ; 3455 $$->next = NULL; 3456 $$->tail = $$; 3457 } 3458 | unaryop gid { 3459 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3460 yyerror("group unknown requires operator = or " 3461 "!="); 3462 YYERROR; 3463 } 3464 $$ = calloc(1, sizeof(struct node_gid)); 3465 if ($$ == NULL) 3466 err(1, "gid_item: calloc"); 3467 $$->gid[0] = $2; 3468 $$->gid[1] = $2; 3469 $$->op = $1; 3470 $$->next = NULL; 3471 $$->tail = $$; 3472 } 3473 | gid PORTBINARY gid { 3474 if ($1 == GID_MAX || $3 == GID_MAX) { 3475 yyerror("group unknown requires operator = or " 3476 "!="); 3477 YYERROR; 3478 } 3479 $$ = calloc(1, sizeof(struct node_gid)); 3480 if ($$ == NULL) 3481 err(1, "gid_item: calloc"); 3482 $$->gid[0] = $1; 3483 $$->gid[1] = $3; 3484 $$->op = $2; 3485 $$->next = NULL; 3486 $$->tail = $$; 3487 } 3488 ; 3489 3490 gid : STRING { 3491 if (!strcmp($1, "unknown")) 3492 $$ = GID_MAX; 3493 else { 3494 struct group *grp; 3495 3496 if ((grp = getgrnam($1)) == NULL) { 3497 yyerror("unknown group %s", $1); 3498 free($1); 3499 YYERROR; 3500 } 3501 $$ = grp->gr_gid; 3502 } 3503 free($1); 3504 } 3505 | NUMBER { 3506 if ($1 < 0 || $1 >= GID_MAX) { 3507 yyerror("illegal gid value %lu", $1); 3508 YYERROR; 3509 } 3510 $$ = $1; 3511 } 3512 ; 3513 3514 flag : STRING { 3515 int f; 3516 3517 if ((f = parse_flags($1)) < 0) { 3518 yyerror("bad flags %s", $1); 3519 free($1); 3520 YYERROR; 3521 } 3522 free($1); 3523 $$.b1 = f; 3524 } 3525 ; 3526 3527 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 3528 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 3529 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 3530 ; 3531 3532 icmpspec : ICMPTYPE icmp_item { $$ = $2; } 3533 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 3534 | ICMP6TYPE icmp6_item { $$ = $2; } 3535 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 3536 ; 3537 3538 icmp_list : icmp_item optnl { $$ = $1; } 3539 | icmp_list comma icmp_item optnl { 3540 $1->tail->next = $3; 3541 $1->tail = $3; 3542 $$ = $1; 3543 } 3544 ; 3545 3546 icmp6_list : icmp6_item optnl { $$ = $1; } 3547 | icmp6_list comma icmp6_item optnl { 3548 $1->tail->next = $3; 3549 $1->tail = $3; 3550 $$ = $1; 3551 } 3552 ; 3553 3554 icmp_item : icmptype { 3555 $$ = calloc(1, sizeof(struct node_icmp)); 3556 if ($$ == NULL) 3557 err(1, "icmp_item: calloc"); 3558 $$->type = $1; 3559 $$->code = 0; 3560 $$->proto = IPPROTO_ICMP; 3561 $$->next = NULL; 3562 $$->tail = $$; 3563 } 3564 | icmptype CODE STRING { 3565 const struct icmpcodeent *p; 3566 3567 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 3568 yyerror("unknown icmp-code %s", $3); 3569 free($3); 3570 YYERROR; 3571 } 3572 3573 free($3); 3574 $$ = calloc(1, sizeof(struct node_icmp)); 3575 if ($$ == NULL) 3576 err(1, "icmp_item: calloc"); 3577 $$->type = $1; 3578 $$->code = p->code + 1; 3579 $$->proto = IPPROTO_ICMP; 3580 $$->next = NULL; 3581 $$->tail = $$; 3582 } 3583 | icmptype CODE NUMBER { 3584 if ($3 < 0 || $3 > 255) { 3585 yyerror("illegal icmp-code %lu", $3); 3586 YYERROR; 3587 } 3588 $$ = calloc(1, sizeof(struct node_icmp)); 3589 if ($$ == NULL) 3590 err(1, "icmp_item: calloc"); 3591 $$->type = $1; 3592 $$->code = $3 + 1; 3593 $$->proto = IPPROTO_ICMP; 3594 $$->next = NULL; 3595 $$->tail = $$; 3596 } 3597 ; 3598 3599 icmp6_item : icmp6type { 3600 $$ = calloc(1, sizeof(struct node_icmp)); 3601 if ($$ == NULL) 3602 err(1, "icmp_item: calloc"); 3603 $$->type = $1; 3604 $$->code = 0; 3605 $$->proto = IPPROTO_ICMPV6; 3606 $$->next = NULL; 3607 $$->tail = $$; 3608 } 3609 | icmp6type CODE STRING { 3610 const struct icmpcodeent *p; 3611 3612 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 3613 yyerror("unknown icmp6-code %s", $3); 3614 free($3); 3615 YYERROR; 3616 } 3617 free($3); 3618 3619 $$ = calloc(1, sizeof(struct node_icmp)); 3620 if ($$ == NULL) 3621 err(1, "icmp_item: calloc"); 3622 $$->type = $1; 3623 $$->code = p->code + 1; 3624 $$->proto = IPPROTO_ICMPV6; 3625 $$->next = NULL; 3626 $$->tail = $$; 3627 } 3628 | icmp6type CODE NUMBER { 3629 if ($3 < 0 || $3 > 255) { 3630 yyerror("illegal icmp-code %lu", $3); 3631 YYERROR; 3632 } 3633 $$ = calloc(1, sizeof(struct node_icmp)); 3634 if ($$ == NULL) 3635 err(1, "icmp_item: calloc"); 3636 $$->type = $1; 3637 $$->code = $3 + 1; 3638 $$->proto = IPPROTO_ICMPV6; 3639 $$->next = NULL; 3640 $$->tail = $$; 3641 } 3642 ; 3643 3644 icmptype : STRING { 3645 const struct icmptypeent *p; 3646 3647 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 3648 yyerror("unknown icmp-type %s", $1); 3649 free($1); 3650 YYERROR; 3651 } 3652 $$ = p->type + 1; 3653 free($1); 3654 } 3655 | NUMBER { 3656 if ($1 < 0 || $1 > 255) { 3657 yyerror("illegal icmp-type %lu", $1); 3658 YYERROR; 3659 } 3660 $$ = $1 + 1; 3661 } 3662 ; 3663 3664 icmp6type : STRING { 3665 const struct icmptypeent *p; 3666 3667 if ((p = geticmptypebyname($1, AF_INET6)) == 3668 NULL) { 3669 yyerror("unknown icmp6-type %s", $1); 3670 free($1); 3671 YYERROR; 3672 } 3673 $$ = p->type + 1; 3674 free($1); 3675 } 3676 | NUMBER { 3677 if ($1 < 0 || $1 > 255) { 3678 yyerror("illegal icmp6-type %lu", $1); 3679 YYERROR; 3680 } 3681 $$ = $1 + 1; 3682 } 3683 ; 3684 3685 tos : STRING { 3686 int val; 3687 char *end; 3688 3689 if (map_tos($1, &val)) 3690 $$ = val; 3691 else if ($1[0] == '0' && $1[1] == 'x') { 3692 errno = 0; 3693 $$ = strtoul($1, &end, 16); 3694 if (errno || *end != '\0') 3695 $$ = 256; 3696 } else 3697 $$ = 256; /* flag bad argument */ 3698 if ($$ < 0 || $$ > 255) { 3699 yyerror("illegal tos value %s", $1); 3700 free($1); 3701 YYERROR; 3702 } 3703 free($1); 3704 } 3705 | NUMBER { 3706 $$ = $1; 3707 if ($$ < 0 || $$ > 255) { 3708 yyerror("illegal tos value %s", $1); 3709 YYERROR; 3710 } 3711 } 3712 ; 3713 3714 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3715 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3716 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3717 ; 3718 3719 statelock : IFBOUND { 3720 $$ = PFRULE_IFBOUND; 3721 } 3722 | FLOATING { 3723 $$ = 0; 3724 } 3725 ; 3726 3727 keep : NO STATE { 3728 $$.action = 0; 3729 $$.options = NULL; 3730 } 3731 | KEEP STATE state_opt_spec { 3732 $$.action = PF_STATE_NORMAL; 3733 $$.options = $3; 3734 } 3735 | MODULATE STATE state_opt_spec { 3736 $$.action = PF_STATE_MODULATE; 3737 $$.options = $3; 3738 } 3739 | SYNPROXY STATE state_opt_spec { 3740 $$.action = PF_STATE_SYNPROXY; 3741 $$.options = $3; 3742 } 3743 ; 3744 3745 flush : /* empty */ { $$ = 0; } 3746 | FLUSH { $$ = PF_FLUSH; } 3747 | FLUSH GLOBAL { 3748 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3749 } 3750 ; 3751 3752 state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3753 | /* empty */ { $$ = NULL; } 3754 ; 3755 3756 state_opt_list : state_opt_item { $$ = $1; } 3757 | state_opt_list comma state_opt_item { 3758 $1->tail->next = $3; 3759 $1->tail = $3; 3760 $$ = $1; 3761 } 3762 ; 3763 3764 state_opt_item : MAXIMUM NUMBER { 3765 if ($2 < 0 || $2 > UINT_MAX) { 3766 yyerror("only positive values permitted"); 3767 YYERROR; 3768 } 3769 $$ = calloc(1, sizeof(struct node_state_opt)); 3770 if ($$ == NULL) 3771 err(1, "state_opt_item: calloc"); 3772 $$->type = PF_STATE_OPT_MAX; 3773 $$->data.max_states = $2; 3774 $$->next = NULL; 3775 $$->tail = $$; 3776 } 3777 | NOSYNC { 3778 $$ = calloc(1, sizeof(struct node_state_opt)); 3779 if ($$ == NULL) 3780 err(1, "state_opt_item: calloc"); 3781 $$->type = PF_STATE_OPT_NOSYNC; 3782 $$->next = NULL; 3783 $$->tail = $$; 3784 } 3785 | MAXSRCSTATES NUMBER { 3786 if ($2 < 0 || $2 > UINT_MAX) { 3787 yyerror("only positive values permitted"); 3788 YYERROR; 3789 } 3790 $$ = calloc(1, sizeof(struct node_state_opt)); 3791 if ($$ == NULL) 3792 err(1, "state_opt_item: calloc"); 3793 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3794 $$->data.max_src_states = $2; 3795 $$->next = NULL; 3796 $$->tail = $$; 3797 } 3798 | MAXSRCCONN NUMBER { 3799 if ($2 < 0 || $2 > UINT_MAX) { 3800 yyerror("only positive values permitted"); 3801 YYERROR; 3802 } 3803 $$ = calloc(1, sizeof(struct node_state_opt)); 3804 if ($$ == NULL) 3805 err(1, "state_opt_item: calloc"); 3806 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3807 $$->data.max_src_conn = $2; 3808 $$->next = NULL; 3809 $$->tail = $$; 3810 } 3811 | MAXSRCCONNRATE NUMBER '/' NUMBER { 3812 if ($2 < 0 || $2 > UINT_MAX || 3813 $4 < 0 || $4 > UINT_MAX) { 3814 yyerror("only positive values permitted"); 3815 YYERROR; 3816 } 3817 $$ = calloc(1, sizeof(struct node_state_opt)); 3818 if ($$ == NULL) 3819 err(1, "state_opt_item: calloc"); 3820 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3821 $$->data.max_src_conn_rate.limit = $2; 3822 $$->data.max_src_conn_rate.seconds = $4; 3823 $$->next = NULL; 3824 $$->tail = $$; 3825 } 3826 | OVERLOAD '<' STRING '>' flush { 3827 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3828 yyerror("table name '%s' too long", $3); 3829 free($3); 3830 YYERROR; 3831 } 3832 $$ = calloc(1, sizeof(struct node_state_opt)); 3833 if ($$ == NULL) 3834 err(1, "state_opt_item: calloc"); 3835 if (strlcpy($$->data.overload.tblname, $3, 3836 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3837 errx(1, "state_opt_item: strlcpy"); 3838 free($3); 3839 $$->type = PF_STATE_OPT_OVERLOAD; 3840 $$->data.overload.flush = $5; 3841 $$->next = NULL; 3842 $$->tail = $$; 3843 } 3844 | MAXSRCNODES NUMBER { 3845 if ($2 < 0 || $2 > UINT_MAX) { 3846 yyerror("only positive values permitted"); 3847 YYERROR; 3848 } 3849 $$ = calloc(1, sizeof(struct node_state_opt)); 3850 if ($$ == NULL) 3851 err(1, "state_opt_item: calloc"); 3852 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3853 $$->data.max_src_nodes = $2; 3854 $$->next = NULL; 3855 $$->tail = $$; 3856 } 3857 | sourcetrack { 3858 $$ = calloc(1, sizeof(struct node_state_opt)); 3859 if ($$ == NULL) 3860 err(1, "state_opt_item: calloc"); 3861 $$->type = PF_STATE_OPT_SRCTRACK; 3862 $$->data.src_track = $1; 3863 $$->next = NULL; 3864 $$->tail = $$; 3865 } 3866 | statelock { 3867 $$ = calloc(1, sizeof(struct node_state_opt)); 3868 if ($$ == NULL) 3869 err(1, "state_opt_item: calloc"); 3870 $$->type = PF_STATE_OPT_STATELOCK; 3871 $$->data.statelock = $1; 3872 $$->next = NULL; 3873 $$->tail = $$; 3874 } 3875 | SLOPPY { 3876 $$ = calloc(1, sizeof(struct node_state_opt)); 3877 if ($$ == NULL) 3878 err(1, "state_opt_item: calloc"); 3879 $$->type = PF_STATE_OPT_SLOPPY; 3880 $$->next = NULL; 3881 $$->tail = $$; 3882 } 3883 | STRING NUMBER { 3884 int i; 3885 3886 if ($2 < 0 || $2 > UINT_MAX) { 3887 yyerror("only positive values permitted"); 3888 YYERROR; 3889 } 3890 for (i = 0; pf_timeouts[i].name && 3891 strcmp(pf_timeouts[i].name, $1); ++i) 3892 ; /* nothing */ 3893 if (!pf_timeouts[i].name) { 3894 yyerror("illegal timeout name %s", $1); 3895 free($1); 3896 YYERROR; 3897 } 3898 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3899 yyerror("illegal state timeout %s", $1); 3900 free($1); 3901 YYERROR; 3902 } 3903 free($1); 3904 $$ = calloc(1, sizeof(struct node_state_opt)); 3905 if ($$ == NULL) 3906 err(1, "state_opt_item: calloc"); 3907 $$->type = PF_STATE_OPT_TIMEOUT; 3908 $$->data.timeout.number = pf_timeouts[i].timeout; 3909 $$->data.timeout.seconds = $2; 3910 $$->next = NULL; 3911 $$->tail = $$; 3912 } 3913 ; 3914 3915 label : LABEL STRING { 3916 $$ = $2; 3917 } 3918 ; 3919 3920 qname : QUEUE STRING { 3921 $$.qname = $2; 3922 $$.pqname = NULL; 3923 } 3924 | QUEUE '(' STRING ')' { 3925 $$.qname = $3; 3926 $$.pqname = NULL; 3927 } 3928 | QUEUE '(' STRING comma STRING ')' { 3929 $$.qname = $3; 3930 $$.pqname = $5; 3931 } 3932 ; 3933 3934 no : /* empty */ { $$ = 0; } 3935 | NO { $$ = 1; } 3936 ; 3937 3938 portstar : numberstring { 3939 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 3940 free($1); 3941 YYERROR; 3942 } 3943 free($1); 3944 } 3945 ; 3946 3947 redirspec : host { $$ = $1; } 3948 | '{' optnl redir_host_list '}' { $$ = $3; } 3949 ; 3950 3951 redir_host_list : host optnl { $$ = $1; } 3952 | redir_host_list comma host optnl { 3953 $1->tail->next = $3; 3954 $1->tail = $3->tail; 3955 $$ = $1; 3956 } 3957 ; 3958 3959 redirpool : /* empty */ { $$ = NULL; } 3960 | ARROW redirspec { 3961 $$ = calloc(1, sizeof(struct redirection)); 3962 if ($$ == NULL) 3963 err(1, "redirection: calloc"); 3964 $$->host = $2; 3965 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3966 } 3967 | ARROW redirspec PORT portstar { 3968 $$ = calloc(1, sizeof(struct redirection)); 3969 if ($$ == NULL) 3970 err(1, "redirection: calloc"); 3971 $$->host = $2; 3972 $$->rport = $4; 3973 } 3974 ; 3975 3976 hashkey : /* empty */ 3977 { 3978 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3979 if ($$ == NULL) 3980 err(1, "hashkey: calloc"); 3981 $$->key32[0] = arc4random(); 3982 $$->key32[1] = arc4random(); 3983 $$->key32[2] = arc4random(); 3984 $$->key32[3] = arc4random(); 3985 } 3986 | string 3987 { 3988 if (!strncmp($1, "0x", 2)) { 3989 if (strlen($1) != 34) { 3990 free($1); 3991 yyerror("hex key must be 128 bits " 3992 "(32 hex digits) long"); 3993 YYERROR; 3994 } 3995 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3996 if ($$ == NULL) 3997 err(1, "hashkey: calloc"); 3998 3999 if (sscanf($1, "0x%8x%8x%8x%8x", 4000 &$$->key32[0], &$$->key32[1], 4001 &$$->key32[2], &$$->key32[3]) != 4) { 4002 free($$); 4003 free($1); 4004 yyerror("invalid hex key"); 4005 YYERROR; 4006 } 4007 } else { 4008 MD5_CTX context; 4009 4010 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 4011 if ($$ == NULL) 4012 err(1, "hashkey: calloc"); 4013 MD5Init(&context); 4014 MD5Update(&context, (unsigned char *)$1, 4015 strlen($1)); 4016 MD5Final((unsigned char *)$$, &context); 4017 HTONL($$->key32[0]); 4018 HTONL($$->key32[1]); 4019 HTONL($$->key32[2]); 4020 HTONL($$->key32[3]); 4021 } 4022 free($1); 4023 } 4024 ; 4025 4026 pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 4027 pool_opts_l 4028 { $$ = pool_opts; } 4029 | /* empty */ { 4030 bzero(&pool_opts, sizeof pool_opts); 4031 $$ = pool_opts; 4032 } 4033 ; 4034 4035 pool_opts_l : pool_opts_l pool_opt 4036 | pool_opt 4037 ; 4038 4039 pool_opt : BITMASK { 4040 if (pool_opts.type) { 4041 yyerror("pool type cannot be redefined"); 4042 YYERROR; 4043 } 4044 pool_opts.type = PF_POOL_BITMASK; 4045 } 4046 | RANDOM { 4047 if (pool_opts.type) { 4048 yyerror("pool type cannot be redefined"); 4049 YYERROR; 4050 } 4051 pool_opts.type = PF_POOL_RANDOM; 4052 } 4053 | SOURCEHASH hashkey { 4054 if (pool_opts.type) { 4055 yyerror("pool type cannot be redefined"); 4056 YYERROR; 4057 } 4058 pool_opts.type = PF_POOL_SRCHASH; 4059 pool_opts.key = $2; 4060 } 4061 | ROUNDROBIN { 4062 if (pool_opts.type) { 4063 yyerror("pool type cannot be redefined"); 4064 YYERROR; 4065 } 4066 pool_opts.type = PF_POOL_ROUNDROBIN; 4067 } 4068 | STATICPORT { 4069 if (pool_opts.staticport) { 4070 yyerror("static-port cannot be redefined"); 4071 YYERROR; 4072 } 4073 pool_opts.staticport = 1; 4074 } 4075 | STICKYADDRESS { 4076 if (filter_opts.marker & POM_STICKYADDRESS) { 4077 yyerror("sticky-address cannot be redefined"); 4078 YYERROR; 4079 } 4080 pool_opts.marker |= POM_STICKYADDRESS; 4081 pool_opts.opts |= PF_POOL_STICKYADDR; 4082 } 4083 | MAPEPORTSET number '/' number '/' number { 4084 if (pool_opts.mape.offset) { 4085 yyerror("map-e-portset cannot be redefined"); 4086 YYERROR; 4087 } 4088 if (pool_opts.type) { 4089 yyerror("map-e-portset cannot be used with " 4090 "address pools"); 4091 YYERROR; 4092 } 4093 if ($2 <= 0 || $2 >= 16) { 4094 yyerror("MAP-E PSID offset must be 1-15"); 4095 YYERROR; 4096 } 4097 if ($4 < 0 || $4 >= 16 || $2 + $4 > 16) { 4098 yyerror("Invalid MAP-E PSID length"); 4099 YYERROR; 4100 } else if ($4 == 0) { 4101 yyerror("PSID Length = 0: this means" 4102 " you do not need MAP-E"); 4103 YYERROR; 4104 } 4105 if ($6 < 0 || $6 > 65535) { 4106 yyerror("Invalid MAP-E PSID"); 4107 YYERROR; 4108 } 4109 pool_opts.mape.offset = $2; 4110 pool_opts.mape.psidlen = $4; 4111 pool_opts.mape.psid = $6; 4112 } 4113 ; 4114 4115 redirection : /* empty */ { $$ = NULL; } 4116 | ARROW host { 4117 $$ = calloc(1, sizeof(struct redirection)); 4118 if ($$ == NULL) 4119 err(1, "redirection: calloc"); 4120 $$->host = $2; 4121 $$->rport.a = $$->rport.b = $$->rport.t = 0; 4122 } 4123 | ARROW host PORT portstar { 4124 $$ = calloc(1, sizeof(struct redirection)); 4125 if ($$ == NULL) 4126 err(1, "redirection: calloc"); 4127 $$->host = $2; 4128 $$->rport = $4; 4129 } 4130 ; 4131 4132 natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 4133 | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 4134 | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 4135 | log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; } 4136 ; 4137 4138 nataction : no NAT natpasslog { 4139 if ($1 && $3.b1) { 4140 yyerror("\"pass\" not valid with \"no\""); 4141 YYERROR; 4142 } 4143 if ($1) 4144 $$.b1 = PF_NONAT; 4145 else 4146 $$.b1 = PF_NAT; 4147 $$.b2 = $3.b1; 4148 $$.w = $3.b2; 4149 $$.w2 = $3.w2; 4150 } 4151 | no RDR natpasslog { 4152 if ($1 && $3.b1) { 4153 yyerror("\"pass\" not valid with \"no\""); 4154 YYERROR; 4155 } 4156 if ($1) 4157 $$.b1 = PF_NORDR; 4158 else 4159 $$.b1 = PF_RDR; 4160 $$.b2 = $3.b1; 4161 $$.w = $3.b2; 4162 $$.w2 = $3.w2; 4163 } 4164 ; 4165 4166 natrule : nataction interface af proto fromto tag tagged rtable 4167 redirpool pool_opts 4168 { 4169 struct pfctl_rule r; 4170 4171 if (check_rulestate(PFCTL_STATE_NAT)) 4172 YYERROR; 4173 4174 memset(&r, 0, sizeof(r)); 4175 4176 r.action = $1.b1; 4177 r.natpass = $1.b2; 4178 r.log = $1.w; 4179 r.logif = $1.w2; 4180 r.af = $3; 4181 4182 if (!r.af) { 4183 if ($5.src.host && $5.src.host->af && 4184 !$5.src.host->ifindex) 4185 r.af = $5.src.host->af; 4186 else if ($5.dst.host && $5.dst.host->af && 4187 !$5.dst.host->ifindex) 4188 r.af = $5.dst.host->af; 4189 } 4190 4191 if ($6 != NULL) 4192 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 4193 PF_TAG_NAME_SIZE) { 4194 yyerror("tag too long, max %u chars", 4195 PF_TAG_NAME_SIZE - 1); 4196 YYERROR; 4197 } 4198 4199 if ($7.name) 4200 if (strlcpy(r.match_tagname, $7.name, 4201 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4202 yyerror("tag too long, max %u chars", 4203 PF_TAG_NAME_SIZE - 1); 4204 YYERROR; 4205 } 4206 r.match_tag_not = $7.neg; 4207 r.rtableid = $8; 4208 4209 if (r.action == PF_NONAT || r.action == PF_NORDR) { 4210 if ($9 != NULL) { 4211 yyerror("translation rule with 'no' " 4212 "does not need '->'"); 4213 YYERROR; 4214 } 4215 } else { 4216 if ($9 == NULL || $9->host == NULL) { 4217 yyerror("translation rule requires '-> " 4218 "address'"); 4219 YYERROR; 4220 } 4221 if (!r.af && ! $9->host->ifindex) 4222 r.af = $9->host->af; 4223 4224 remove_invalid_hosts(&$9->host, &r.af); 4225 if (invalid_redirect($9->host, r.af)) 4226 YYERROR; 4227 if (check_netmask($9->host, r.af)) 4228 YYERROR; 4229 4230 r.rpool.proxy_port[0] = ntohs($9->rport.a); 4231 4232 switch (r.action) { 4233 case PF_RDR: 4234 if (!$9->rport.b && $9->rport.t && 4235 $5.dst.port != NULL) { 4236 r.rpool.proxy_port[1] = 4237 ntohs($9->rport.a) + 4238 (ntohs( 4239 $5.dst.port->port[1]) - 4240 ntohs( 4241 $5.dst.port->port[0])); 4242 } else 4243 r.rpool.proxy_port[1] = 4244 ntohs($9->rport.b); 4245 break; 4246 case PF_NAT: 4247 r.rpool.proxy_port[1] = 4248 ntohs($9->rport.b); 4249 if (!r.rpool.proxy_port[0] && 4250 !r.rpool.proxy_port[1]) { 4251 r.rpool.proxy_port[0] = 4252 PF_NAT_PROXY_PORT_LOW; 4253 r.rpool.proxy_port[1] = 4254 PF_NAT_PROXY_PORT_HIGH; 4255 } else if (!r.rpool.proxy_port[1]) 4256 r.rpool.proxy_port[1] = 4257 r.rpool.proxy_port[0]; 4258 break; 4259 default: 4260 break; 4261 } 4262 4263 r.rpool.opts = $10.type; 4264 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 4265 PF_POOL_NONE && ($9->host->next != NULL || 4266 $9->host->addr.type == PF_ADDR_TABLE || 4267 DYNIF_MULTIADDR($9->host->addr))) 4268 r.rpool.opts = PF_POOL_ROUNDROBIN; 4269 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 4270 PF_POOL_ROUNDROBIN && 4271 disallow_table($9->host, "tables are only " 4272 "supported in round-robin redirection " 4273 "pools")) 4274 YYERROR; 4275 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 4276 PF_POOL_ROUNDROBIN && 4277 disallow_alias($9->host, "interface (%s) " 4278 "is only supported in round-robin " 4279 "redirection pools")) 4280 YYERROR; 4281 if ($9->host->next != NULL) { 4282 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 4283 PF_POOL_ROUNDROBIN) { 4284 yyerror("only round-robin " 4285 "valid for multiple " 4286 "redirection addresses"); 4287 YYERROR; 4288 } 4289 } 4290 } 4291 4292 if ($10.key != NULL) 4293 memcpy(&r.rpool.key, $10.key, 4294 sizeof(struct pf_poolhashkey)); 4295 4296 if ($10.opts) 4297 r.rpool.opts |= $10.opts; 4298 4299 if ($10.staticport) { 4300 if (r.action != PF_NAT) { 4301 yyerror("the 'static-port' option is " 4302 "only valid with nat rules"); 4303 YYERROR; 4304 } 4305 if (r.rpool.proxy_port[0] != 4306 PF_NAT_PROXY_PORT_LOW && 4307 r.rpool.proxy_port[1] != 4308 PF_NAT_PROXY_PORT_HIGH) { 4309 yyerror("the 'static-port' option can't" 4310 " be used when specifying a port" 4311 " range"); 4312 YYERROR; 4313 } 4314 r.rpool.proxy_port[0] = 0; 4315 r.rpool.proxy_port[1] = 0; 4316 } 4317 4318 if ($10.mape.offset) { 4319 if (r.action != PF_NAT) { 4320 yyerror("the 'map-e-portset' option is" 4321 " only valid with nat rules"); 4322 YYERROR; 4323 } 4324 if ($10.staticport) { 4325 yyerror("the 'map-e-portset' option" 4326 " can't be used 'static-port'"); 4327 YYERROR; 4328 } 4329 if (r.rpool.proxy_port[0] != 4330 PF_NAT_PROXY_PORT_LOW && 4331 r.rpool.proxy_port[1] != 4332 PF_NAT_PROXY_PORT_HIGH) { 4333 yyerror("the 'map-e-portset' option" 4334 " can't be used when specifying" 4335 " a port range"); 4336 YYERROR; 4337 } 4338 r.rpool.mape = $10.mape; 4339 } 4340 4341 expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 4342 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 4343 $5.dst.port, 0, 0, 0, ""); 4344 free($9); 4345 } 4346 ; 4347 4348 binatrule : no BINAT natpasslog interface af proto FROM ipspec toipspec tag 4349 tagged rtable redirection 4350 { 4351 struct pfctl_rule binat; 4352 struct pf_pooladdr *pa; 4353 4354 if (check_rulestate(PFCTL_STATE_NAT)) 4355 YYERROR; 4356 if (disallow_urpf_failed($9, "\"urpf-failed\" is not " 4357 "permitted as a binat destination")) 4358 YYERROR; 4359 4360 memset(&binat, 0, sizeof(binat)); 4361 4362 if ($1 && $3.b1) { 4363 yyerror("\"pass\" not valid with \"no\""); 4364 YYERROR; 4365 } 4366 if ($1) 4367 binat.action = PF_NOBINAT; 4368 else 4369 binat.action = PF_BINAT; 4370 binat.natpass = $3.b1; 4371 binat.log = $3.b2; 4372 binat.logif = $3.w2; 4373 binat.af = $5; 4374 if (!binat.af && $8 != NULL && $8->af) 4375 binat.af = $8->af; 4376 if (!binat.af && $9 != NULL && $9->af) 4377 binat.af = $9->af; 4378 4379 if (!binat.af && $13 != NULL && $13->host) 4380 binat.af = $13->host->af; 4381 if (!binat.af) { 4382 yyerror("address family (inet/inet6) " 4383 "undefined"); 4384 YYERROR; 4385 } 4386 4387 if ($4 != NULL) { 4388 memcpy(binat.ifname, $4->ifname, 4389 sizeof(binat.ifname)); 4390 binat.ifnot = $4->not; 4391 free($4); 4392 } 4393 4394 if ($10 != NULL) 4395 if (strlcpy(binat.tagname, $10, 4396 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4397 yyerror("tag too long, max %u chars", 4398 PF_TAG_NAME_SIZE - 1); 4399 YYERROR; 4400 } 4401 if ($11.name) 4402 if (strlcpy(binat.match_tagname, $11.name, 4403 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4404 yyerror("tag too long, max %u chars", 4405 PF_TAG_NAME_SIZE - 1); 4406 YYERROR; 4407 } 4408 binat.match_tag_not = $11.neg; 4409 binat.rtableid = $12; 4410 4411 if ($6 != NULL) { 4412 binat.proto = $6->proto; 4413 free($6); 4414 } 4415 4416 if ($8 != NULL && disallow_table($8, "invalid use of " 4417 "table <%s> as the source address of a binat rule")) 4418 YYERROR; 4419 if ($8 != NULL && disallow_alias($8, "invalid use of " 4420 "interface (%s) as the source address of a binat " 4421 "rule")) 4422 YYERROR; 4423 if ($13 != NULL && $13->host != NULL && disallow_table( 4424 $13->host, "invalid use of table <%s> as the " 4425 "redirect address of a binat rule")) 4426 YYERROR; 4427 if ($13 != NULL && $13->host != NULL && disallow_alias( 4428 $13->host, "invalid use of interface (%s) as the " 4429 "redirect address of a binat rule")) 4430 YYERROR; 4431 4432 if ($8 != NULL) { 4433 if ($8->next) { 4434 yyerror("multiple binat ip addresses"); 4435 YYERROR; 4436 } 4437 if ($8->addr.type == PF_ADDR_DYNIFTL) 4438 $8->af = binat.af; 4439 if ($8->af != binat.af) { 4440 yyerror("binat ip versions must match"); 4441 YYERROR; 4442 } 4443 if (check_netmask($8, binat.af)) 4444 YYERROR; 4445 memcpy(&binat.src.addr, &$8->addr, 4446 sizeof(binat.src.addr)); 4447 free($8); 4448 } 4449 if ($9 != NULL) { 4450 if ($9->next) { 4451 yyerror("multiple binat ip addresses"); 4452 YYERROR; 4453 } 4454 if ($9->af != binat.af && $9->af) { 4455 yyerror("binat ip versions must match"); 4456 YYERROR; 4457 } 4458 if (check_netmask($9, binat.af)) 4459 YYERROR; 4460 memcpy(&binat.dst.addr, &$9->addr, 4461 sizeof(binat.dst.addr)); 4462 binat.dst.neg = $9->not; 4463 free($9); 4464 } 4465 4466 if (binat.action == PF_NOBINAT) { 4467 if ($13 != NULL) { 4468 yyerror("'no binat' rule does not need" 4469 " '->'"); 4470 YYERROR; 4471 } 4472 } else { 4473 if ($13 == NULL || $13->host == NULL) { 4474 yyerror("'binat' rule requires" 4475 " '-> address'"); 4476 YYERROR; 4477 } 4478 4479 remove_invalid_hosts(&$13->host, &binat.af); 4480 if (invalid_redirect($13->host, binat.af)) 4481 YYERROR; 4482 if ($13->host->next != NULL) { 4483 yyerror("binat rule must redirect to " 4484 "a single address"); 4485 YYERROR; 4486 } 4487 if (check_netmask($13->host, binat.af)) 4488 YYERROR; 4489 4490 if (!PF_AZERO(&binat.src.addr.v.a.mask, 4491 binat.af) && 4492 !PF_AEQ(&binat.src.addr.v.a.mask, 4493 &$13->host->addr.v.a.mask, binat.af)) { 4494 yyerror("'binat' source mask and " 4495 "redirect mask must be the same"); 4496 YYERROR; 4497 } 4498 4499 TAILQ_INIT(&binat.rpool.list); 4500 pa = calloc(1, sizeof(struct pf_pooladdr)); 4501 if (pa == NULL) 4502 err(1, "binat: calloc"); 4503 pa->addr = $13->host->addr; 4504 pa->ifname[0] = 0; 4505 TAILQ_INSERT_TAIL(&binat.rpool.list, 4506 pa, entries); 4507 4508 free($13); 4509 } 4510 4511 pfctl_append_rule(pf, &binat, ""); 4512 } 4513 ; 4514 4515 tag : /* empty */ { $$ = NULL; } 4516 | TAG STRING { $$ = $2; } 4517 ; 4518 4519 tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 4520 | not TAGGED string { $$.neg = $1; $$.name = $3; } 4521 ; 4522 4523 rtable : /* empty */ { $$ = -1; } 4524 | RTABLE NUMBER { 4525 if ($2 < 0 || $2 > rt_tableid_max()) { 4526 yyerror("invalid rtable id"); 4527 YYERROR; 4528 } 4529 $$ = $2; 4530 } 4531 ; 4532 4533 route_host : STRING { 4534 $$ = calloc(1, sizeof(struct node_host)); 4535 if ($$ == NULL) 4536 err(1, "route_host: calloc"); 4537 $$->ifname = strdup($1); 4538 set_ipmask($$, 128); 4539 $$->next = NULL; 4540 $$->tail = $$; 4541 } 4542 | '(' STRING host ')' { 4543 struct node_host *n; 4544 4545 $$ = $3; 4546 for (n = $3; n != NULL; n = n->next) 4547 n->ifname = strdup($2); 4548 } 4549 ; 4550 4551 route_host_list : route_host optnl { $$ = $1; } 4552 | route_host_list comma route_host optnl { 4553 if ($1->af == 0) 4554 $1->af = $3->af; 4555 if ($1->af != $3->af) { 4556 yyerror("all pool addresses must be in the " 4557 "same address family"); 4558 YYERROR; 4559 } 4560 $1->tail->next = $3; 4561 $1->tail = $3->tail; 4562 $$ = $1; 4563 } 4564 ; 4565 4566 routespec : route_host { $$ = $1; } 4567 | '{' optnl route_host_list '}' { $$ = $3; } 4568 ; 4569 4570 route : /* empty */ { 4571 $$.host = NULL; 4572 $$.rt = 0; 4573 $$.pool_opts = 0; 4574 } 4575 | FASTROUTE { 4576 /* backwards-compat */ 4577 $$.host = NULL; 4578 $$.rt = 0; 4579 $$.pool_opts = 0; 4580 } 4581 | ROUTETO routespec pool_opts { 4582 $$.host = $2; 4583 $$.rt = PF_ROUTETO; 4584 $$.pool_opts = $3.type | $3.opts; 4585 if ($3.key != NULL) 4586 $$.key = $3.key; 4587 } 4588 | REPLYTO routespec pool_opts { 4589 $$.host = $2; 4590 $$.rt = PF_REPLYTO; 4591 $$.pool_opts = $3.type | $3.opts; 4592 if ($3.key != NULL) 4593 $$.key = $3.key; 4594 } 4595 | DUPTO routespec pool_opts { 4596 $$.host = $2; 4597 $$.rt = PF_DUPTO; 4598 $$.pool_opts = $3.type | $3.opts; 4599 if ($3.key != NULL) 4600 $$.key = $3.key; 4601 } 4602 ; 4603 4604 timeout_spec : STRING NUMBER 4605 { 4606 if (check_rulestate(PFCTL_STATE_OPTION)) { 4607 free($1); 4608 YYERROR; 4609 } 4610 if ($2 < 0 || $2 > UINT_MAX) { 4611 yyerror("only positive values permitted"); 4612 YYERROR; 4613 } 4614 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 4615 yyerror("unknown timeout %s", $1); 4616 free($1); 4617 YYERROR; 4618 } 4619 free($1); 4620 } 4621 | INTERVAL NUMBER { 4622 if (check_rulestate(PFCTL_STATE_OPTION)) 4623 YYERROR; 4624 if ($2 < 0 || $2 > UINT_MAX) { 4625 yyerror("only positive values permitted"); 4626 YYERROR; 4627 } 4628 if (pfctl_set_timeout(pf, "interval", $2, 0) != 0) 4629 YYERROR; 4630 } 4631 ; 4632 4633 timeout_list : timeout_list comma timeout_spec optnl 4634 | timeout_spec optnl 4635 ; 4636 4637 limit_spec : STRING NUMBER 4638 { 4639 if (check_rulestate(PFCTL_STATE_OPTION)) { 4640 free($1); 4641 YYERROR; 4642 } 4643 if ($2 < 0 || $2 > UINT_MAX) { 4644 yyerror("only positive values permitted"); 4645 YYERROR; 4646 } 4647 if (pfctl_set_limit(pf, $1, $2) != 0) { 4648 yyerror("unable to set limit %s %u", $1, $2); 4649 free($1); 4650 YYERROR; 4651 } 4652 free($1); 4653 } 4654 ; 4655 4656 limit_list : limit_list comma limit_spec optnl 4657 | limit_spec optnl 4658 ; 4659 4660 comma : ',' 4661 | /* empty */ 4662 ; 4663 4664 yesno : NO { $$ = 0; } 4665 | STRING { 4666 if (!strcmp($1, "yes")) 4667 $$ = 1; 4668 else { 4669 yyerror("invalid value '%s', expected 'yes' " 4670 "or 'no'", $1); 4671 free($1); 4672 YYERROR; 4673 } 4674 free($1); 4675 } 4676 ; 4677 4678 unaryop : '=' { $$ = PF_OP_EQ; } 4679 | '!' '=' { $$ = PF_OP_NE; } 4680 | '<' '=' { $$ = PF_OP_LE; } 4681 | '<' { $$ = PF_OP_LT; } 4682 | '>' '=' { $$ = PF_OP_GE; } 4683 | '>' { $$ = PF_OP_GT; } 4684 ; 4685 4686 %% 4687 4688 int 4689 yyerror(const char *fmt, ...) 4690 { 4691 va_list ap; 4692 4693 file->errors++; 4694 va_start(ap, fmt); 4695 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 4696 vfprintf(stderr, fmt, ap); 4697 fprintf(stderr, "\n"); 4698 va_end(ap); 4699 return (0); 4700 } 4701 4702 int 4703 disallow_table(struct node_host *h, const char *fmt) 4704 { 4705 for (; h != NULL; h = h->next) 4706 if (h->addr.type == PF_ADDR_TABLE) { 4707 yyerror(fmt, h->addr.v.tblname); 4708 return (1); 4709 } 4710 return (0); 4711 } 4712 4713 int 4714 disallow_urpf_failed(struct node_host *h, const char *fmt) 4715 { 4716 for (; h != NULL; h = h->next) 4717 if (h->addr.type == PF_ADDR_URPFFAILED) { 4718 yyerror(fmt); 4719 return (1); 4720 } 4721 return (0); 4722 } 4723 4724 int 4725 disallow_alias(struct node_host *h, const char *fmt) 4726 { 4727 for (; h != NULL; h = h->next) 4728 if (DYNIF_MULTIADDR(h->addr)) { 4729 yyerror(fmt, h->addr.v.tblname); 4730 return (1); 4731 } 4732 return (0); 4733 } 4734 4735 int 4736 rule_consistent(struct pfctl_rule *r, int anchor_call) 4737 { 4738 int problems = 0; 4739 4740 switch (r->action) { 4741 case PF_PASS: 4742 case PF_DROP: 4743 case PF_SCRUB: 4744 case PF_NOSCRUB: 4745 problems = filter_consistent(r, anchor_call); 4746 break; 4747 case PF_NAT: 4748 case PF_NONAT: 4749 problems = nat_consistent(r); 4750 break; 4751 case PF_RDR: 4752 case PF_NORDR: 4753 problems = rdr_consistent(r); 4754 break; 4755 case PF_BINAT: 4756 case PF_NOBINAT: 4757 default: 4758 break; 4759 } 4760 return (problems); 4761 } 4762 4763 int 4764 filter_consistent(struct pfctl_rule *r, int anchor_call) 4765 { 4766 int problems = 0; 4767 4768 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 4769 (r->src.port_op || r->dst.port_op)) { 4770 yyerror("port only applies to tcp/udp"); 4771 problems++; 4772 } 4773 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 4774 (r->type || r->code)) { 4775 yyerror("icmp-type/code only applies to icmp"); 4776 problems++; 4777 } 4778 if (!r->af && (r->type || r->code)) { 4779 yyerror("must indicate address family with icmp-type/code"); 4780 problems++; 4781 } 4782 if (r->overload_tblname[0] && 4783 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 4784 yyerror("'overload' requires 'max-src-conn' " 4785 "or 'max-src-conn-rate'"); 4786 problems++; 4787 } 4788 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 4789 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 4790 yyerror("proto %s doesn't match address family %s", 4791 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 4792 r->af == AF_INET ? "inet" : "inet6"); 4793 problems++; 4794 } 4795 if (r->allow_opts && r->action != PF_PASS) { 4796 yyerror("allow-opts can only be specified for pass rules"); 4797 problems++; 4798 } 4799 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 4800 r->dst.port_op || r->flagset || r->type || r->code)) { 4801 yyerror("fragments can be filtered only on IP header fields"); 4802 problems++; 4803 } 4804 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 4805 yyerror("return-rst can only be applied to TCP rules"); 4806 problems++; 4807 } 4808 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 4809 yyerror("max-src-nodes requires 'source-track rule'"); 4810 problems++; 4811 } 4812 if (r->action == PF_DROP && r->keep_state) { 4813 yyerror("keep state on block rules doesn't make sense"); 4814 problems++; 4815 } 4816 if (r->rule_flag & PFRULE_STATESLOPPY && 4817 (r->keep_state == PF_STATE_MODULATE || 4818 r->keep_state == PF_STATE_SYNPROXY)) { 4819 yyerror("sloppy state matching cannot be used with " 4820 "synproxy state or modulate state"); 4821 problems++; 4822 } 4823 return (-problems); 4824 } 4825 4826 int 4827 nat_consistent(struct pfctl_rule *r) 4828 { 4829 return (0); /* yeah! */ 4830 } 4831 4832 int 4833 rdr_consistent(struct pfctl_rule *r) 4834 { 4835 int problems = 0; 4836 4837 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 4838 if (r->src.port_op) { 4839 yyerror("src port only applies to tcp/udp"); 4840 problems++; 4841 } 4842 if (r->dst.port_op) { 4843 yyerror("dst port only applies to tcp/udp"); 4844 problems++; 4845 } 4846 if (r->rpool.proxy_port[0]) { 4847 yyerror("rpool port only applies to tcp/udp"); 4848 problems++; 4849 } 4850 } 4851 if (r->dst.port_op && 4852 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 4853 yyerror("invalid port operator for rdr destination port"); 4854 problems++; 4855 } 4856 return (-problems); 4857 } 4858 4859 int 4860 process_tabledef(char *name, struct table_opts *opts) 4861 { 4862 struct pfr_buffer ab; 4863 struct node_tinit *ti; 4864 unsigned long maxcount; 4865 size_t s = sizeof(maxcount); 4866 4867 bzero(&ab, sizeof(ab)); 4868 ab.pfrb_type = PFRB_ADDRS; 4869 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4870 if (ti->file) 4871 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 4872 if (errno) 4873 yyerror("cannot load \"%s\": %s", 4874 ti->file, strerror(errno)); 4875 else 4876 yyerror("file \"%s\" contains bad data", 4877 ti->file); 4878 goto _error; 4879 } 4880 if (ti->host) 4881 if (append_addr_host(&ab, ti->host, 0, 0)) { 4882 yyerror("cannot create address buffer: %s", 4883 strerror(errno)); 4884 goto _error; 4885 } 4886 } 4887 if (pf->opts & PF_OPT_VERBOSE) 4888 print_tabledef(name, opts->flags, opts->init_addr, 4889 &opts->init_nodes); 4890 if (!(pf->opts & PF_OPT_NOACTION) && 4891 pfctl_define_table(name, opts->flags, opts->init_addr, 4892 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4893 4894 if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, 4895 NULL, 0) == -1) 4896 maxcount = 65535; 4897 4898 if (ab.pfrb_size > maxcount) 4899 yyerror("cannot define table %s: too many elements.\n" 4900 "Consider increasing net.pf.request_maxcount.", 4901 name); 4902 else 4903 yyerror("cannot define table %s: %s", name, 4904 pfr_strerror(errno)); 4905 4906 goto _error; 4907 } 4908 pf->tdirty = 1; 4909 pfr_buf_clear(&ab); 4910 return (0); 4911 _error: 4912 pfr_buf_clear(&ab); 4913 return (-1); 4914 } 4915 4916 struct keywords { 4917 const char *k_name; 4918 int k_val; 4919 }; 4920 4921 /* macro gore, but you should've seen the prior indentation nightmare... */ 4922 4923 #define FREE_LIST(T,r) \ 4924 do { \ 4925 T *p, *node = r; \ 4926 while (node != NULL) { \ 4927 p = node; \ 4928 node = node->next; \ 4929 free(p); \ 4930 } \ 4931 } while (0) 4932 4933 #define LOOP_THROUGH(T,n,r,C) \ 4934 do { \ 4935 T *n; \ 4936 if (r == NULL) { \ 4937 r = calloc(1, sizeof(T)); \ 4938 if (r == NULL) \ 4939 err(1, "LOOP: calloc"); \ 4940 r->next = NULL; \ 4941 } \ 4942 n = r; \ 4943 while (n != NULL) { \ 4944 do { \ 4945 C; \ 4946 } while (0); \ 4947 n = n->next; \ 4948 } \ 4949 } while (0) 4950 4951 void 4952 expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4953 { 4954 char *tmp; 4955 char *p, *q; 4956 4957 if ((tmp = calloc(1, len)) == NULL) 4958 err(1, "expand_label_str: calloc"); 4959 p = q = label; 4960 while ((q = strstr(p, srch)) != NULL) { 4961 *q = '\0'; 4962 if ((strlcat(tmp, p, len) >= len) || 4963 (strlcat(tmp, repl, len) >= len)) 4964 errx(1, "expand_label: label too long"); 4965 q += strlen(srch); 4966 p = q; 4967 } 4968 if (strlcat(tmp, p, len) >= len) 4969 errx(1, "expand_label: label too long"); 4970 strlcpy(label, tmp, len); /* always fits */ 4971 free(tmp); 4972 } 4973 4974 void 4975 expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4976 { 4977 if (strstr(label, name) != NULL) { 4978 if (!*ifname) 4979 expand_label_str(label, len, name, "any"); 4980 else 4981 expand_label_str(label, len, name, ifname); 4982 } 4983 } 4984 4985 void 4986 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4987 struct node_host *h) 4988 { 4989 char tmp[64], tmp_not[66]; 4990 4991 if (strstr(label, name) != NULL) { 4992 switch (h->addr.type) { 4993 case PF_ADDR_DYNIFTL: 4994 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4995 break; 4996 case PF_ADDR_TABLE: 4997 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4998 break; 4999 case PF_ADDR_NOROUTE: 5000 snprintf(tmp, sizeof(tmp), "no-route"); 5001 break; 5002 case PF_ADDR_URPFFAILED: 5003 snprintf(tmp, sizeof(tmp), "urpf-failed"); 5004 break; 5005 case PF_ADDR_ADDRMASK: 5006 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 5007 PF_AZERO(&h->addr.v.a.mask, af))) 5008 snprintf(tmp, sizeof(tmp), "any"); 5009 else { 5010 char a[48]; 5011 int bits; 5012 5013 if (inet_ntop(af, &h->addr.v.a.addr, a, 5014 sizeof(a)) == NULL) 5015 snprintf(tmp, sizeof(tmp), "?"); 5016 else { 5017 bits = unmask(&h->addr.v.a.mask, af); 5018 if ((af == AF_INET && bits < 32) || 5019 (af == AF_INET6 && bits < 128)) 5020 snprintf(tmp, sizeof(tmp), 5021 "%s/%d", a, bits); 5022 else 5023 snprintf(tmp, sizeof(tmp), 5024 "%s", a); 5025 } 5026 } 5027 break; 5028 default: 5029 snprintf(tmp, sizeof(tmp), "?"); 5030 break; 5031 } 5032 5033 if (h->not) { 5034 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 5035 expand_label_str(label, len, name, tmp_not); 5036 } else 5037 expand_label_str(label, len, name, tmp); 5038 } 5039 } 5040 5041 void 5042 expand_label_port(const char *name, char *label, size_t len, 5043 struct node_port *port) 5044 { 5045 char a1[6], a2[6], op[13] = ""; 5046 5047 if (strstr(label, name) != NULL) { 5048 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 5049 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 5050 if (!port->op) 5051 ; 5052 else if (port->op == PF_OP_IRG) 5053 snprintf(op, sizeof(op), "%s><%s", a1, a2); 5054 else if (port->op == PF_OP_XRG) 5055 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 5056 else if (port->op == PF_OP_EQ) 5057 snprintf(op, sizeof(op), "%s", a1); 5058 else if (port->op == PF_OP_NE) 5059 snprintf(op, sizeof(op), "!=%s", a1); 5060 else if (port->op == PF_OP_LT) 5061 snprintf(op, sizeof(op), "<%s", a1); 5062 else if (port->op == PF_OP_LE) 5063 snprintf(op, sizeof(op), "<=%s", a1); 5064 else if (port->op == PF_OP_GT) 5065 snprintf(op, sizeof(op), ">%s", a1); 5066 else if (port->op == PF_OP_GE) 5067 snprintf(op, sizeof(op), ">=%s", a1); 5068 expand_label_str(label, len, name, op); 5069 } 5070 } 5071 5072 void 5073 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 5074 { 5075 const char *protoname; 5076 char n[4]; 5077 5078 if (strstr(label, name) != NULL) { 5079 protoname = pfctl_proto2name(proto); 5080 if (protoname != NULL) 5081 expand_label_str(label, len, name, protoname); 5082 else { 5083 snprintf(n, sizeof(n), "%u", proto); 5084 expand_label_str(label, len, name, n); 5085 } 5086 } 5087 } 5088 5089 void 5090 expand_label_nr(const char *name, char *label, size_t len) 5091 { 5092 char n[11]; 5093 5094 if (strstr(label, name) != NULL) { 5095 snprintf(n, sizeof(n), "%u", pf->anchor->match); 5096 expand_label_str(label, len, name, n); 5097 } 5098 } 5099 5100 void 5101 expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 5102 struct node_host *src_host, struct node_port *src_port, 5103 struct node_host *dst_host, struct node_port *dst_port, 5104 u_int8_t proto) 5105 { 5106 expand_label_if("$if", label, len, ifname); 5107 expand_label_addr("$srcaddr", label, len, af, src_host); 5108 expand_label_addr("$dstaddr", label, len, af, dst_host); 5109 expand_label_port("$srcport", label, len, src_port); 5110 expand_label_port("$dstport", label, len, dst_port); 5111 expand_label_proto("$proto", label, len, proto); 5112 expand_label_nr("$nr", label, len); 5113 } 5114 5115 int 5116 expand_altq(struct pf_altq *a, struct node_if *interfaces, 5117 struct node_queue *nqueues, struct node_queue_bw bwspec, 5118 struct node_queue_opt *opts) 5119 { 5120 struct pf_altq pa, pb; 5121 char qname[PF_QNAME_SIZE]; 5122 struct node_queue *n; 5123 struct node_queue_bw bw; 5124 int errs = 0; 5125 5126 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 5127 FREE_LIST(struct node_if, interfaces); 5128 if (nqueues) 5129 FREE_LIST(struct node_queue, nqueues); 5130 return (0); 5131 } 5132 5133 LOOP_THROUGH(struct node_if, interface, interfaces, 5134 memcpy(&pa, a, sizeof(struct pf_altq)); 5135 if (strlcpy(pa.ifname, interface->ifname, 5136 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 5137 errx(1, "expand_altq: strlcpy"); 5138 5139 if (interface->not) { 5140 yyerror("altq on ! <interface> is not supported"); 5141 errs++; 5142 } else { 5143 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 5144 errs++; 5145 else 5146 if (pfctl_add_altq(pf, &pa)) 5147 errs++; 5148 5149 if (pf->opts & PF_OPT_VERBOSE) { 5150 print_altq(&pf->paltq->altq, 0, 5151 &bwspec, opts); 5152 if (nqueues && nqueues->tail) { 5153 printf("queue { "); 5154 LOOP_THROUGH(struct node_queue, queue, 5155 nqueues, 5156 printf("%s ", 5157 queue->queue); 5158 ); 5159 printf("}"); 5160 } 5161 printf("\n"); 5162 } 5163 5164 if (pa.scheduler == ALTQT_CBQ || 5165 pa.scheduler == ALTQT_HFSC || 5166 pa.scheduler == ALTQT_FAIRQ) { 5167 /* now create a root queue */ 5168 memset(&pb, 0, sizeof(struct pf_altq)); 5169 if (strlcpy(qname, "root_", sizeof(qname)) >= 5170 sizeof(qname)) 5171 errx(1, "expand_altq: strlcpy"); 5172 if (strlcat(qname, interface->ifname, 5173 sizeof(qname)) >= sizeof(qname)) 5174 errx(1, "expand_altq: strlcat"); 5175 if (strlcpy(pb.qname, qname, 5176 sizeof(pb.qname)) >= sizeof(pb.qname)) 5177 errx(1, "expand_altq: strlcpy"); 5178 if (strlcpy(pb.ifname, interface->ifname, 5179 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 5180 errx(1, "expand_altq: strlcpy"); 5181 pb.qlimit = pa.qlimit; 5182 pb.scheduler = pa.scheduler; 5183 bw.bw_absolute = pa.ifbandwidth; 5184 bw.bw_percent = 0; 5185 if (eval_pfqueue(pf, &pb, &bw, opts)) 5186 errs++; 5187 else 5188 if (pfctl_add_altq(pf, &pb)) 5189 errs++; 5190 } 5191 5192 LOOP_THROUGH(struct node_queue, queue, nqueues, 5193 n = calloc(1, sizeof(struct node_queue)); 5194 if (n == NULL) 5195 err(1, "expand_altq: calloc"); 5196 if (pa.scheduler == ALTQT_CBQ || 5197 pa.scheduler == ALTQT_HFSC || 5198 pa.scheduler == ALTQT_FAIRQ) 5199 if (strlcpy(n->parent, qname, 5200 sizeof(n->parent)) >= 5201 sizeof(n->parent)) 5202 errx(1, "expand_altq: strlcpy"); 5203 if (strlcpy(n->queue, queue->queue, 5204 sizeof(n->queue)) >= sizeof(n->queue)) 5205 errx(1, "expand_altq: strlcpy"); 5206 if (strlcpy(n->ifname, interface->ifname, 5207 sizeof(n->ifname)) >= sizeof(n->ifname)) 5208 errx(1, "expand_altq: strlcpy"); 5209 n->scheduler = pa.scheduler; 5210 n->next = NULL; 5211 n->tail = n; 5212 if (queues == NULL) 5213 queues = n; 5214 else { 5215 queues->tail->next = n; 5216 queues->tail = n; 5217 } 5218 ); 5219 } 5220 ); 5221 FREE_LIST(struct node_if, interfaces); 5222 if (nqueues) 5223 FREE_LIST(struct node_queue, nqueues); 5224 5225 return (errs); 5226 } 5227 5228 int 5229 expand_queue(struct pf_altq *a, struct node_if *interfaces, 5230 struct node_queue *nqueues, struct node_queue_bw bwspec, 5231 struct node_queue_opt *opts) 5232 { 5233 struct node_queue *n, *nq; 5234 struct pf_altq pa; 5235 u_int8_t found = 0; 5236 u_int8_t errs = 0; 5237 5238 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 5239 FREE_LIST(struct node_queue, nqueues); 5240 return (0); 5241 } 5242 5243 if (queues == NULL) { 5244 yyerror("queue %s has no parent", a->qname); 5245 FREE_LIST(struct node_queue, nqueues); 5246 return (1); 5247 } 5248 5249 LOOP_THROUGH(struct node_if, interface, interfaces, 5250 LOOP_THROUGH(struct node_queue, tqueue, queues, 5251 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 5252 (interface->ifname[0] == 0 || 5253 (!interface->not && !strncmp(interface->ifname, 5254 tqueue->ifname, IFNAMSIZ)) || 5255 (interface->not && strncmp(interface->ifname, 5256 tqueue->ifname, IFNAMSIZ)))) { 5257 /* found ourself in queues */ 5258 found++; 5259 5260 memcpy(&pa, a, sizeof(struct pf_altq)); 5261 5262 if (pa.scheduler != ALTQT_NONE && 5263 pa.scheduler != tqueue->scheduler) { 5264 yyerror("exactly one scheduler type " 5265 "per interface allowed"); 5266 return (1); 5267 } 5268 pa.scheduler = tqueue->scheduler; 5269 5270 /* scheduler dependent error checking */ 5271 switch (pa.scheduler) { 5272 case ALTQT_PRIQ: 5273 if (nqueues != NULL) { 5274 yyerror("priq queues cannot " 5275 "have child queues"); 5276 return (1); 5277 } 5278 if (bwspec.bw_absolute > 0 || 5279 bwspec.bw_percent < 100) { 5280 yyerror("priq doesn't take " 5281 "bandwidth"); 5282 return (1); 5283 } 5284 break; 5285 default: 5286 break; 5287 } 5288 5289 if (strlcpy(pa.ifname, tqueue->ifname, 5290 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 5291 errx(1, "expand_queue: strlcpy"); 5292 if (strlcpy(pa.parent, tqueue->parent, 5293 sizeof(pa.parent)) >= sizeof(pa.parent)) 5294 errx(1, "expand_queue: strlcpy"); 5295 5296 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 5297 errs++; 5298 else 5299 if (pfctl_add_altq(pf, &pa)) 5300 errs++; 5301 5302 for (nq = nqueues; nq != NULL; nq = nq->next) { 5303 if (!strcmp(a->qname, nq->queue)) { 5304 yyerror("queue cannot have " 5305 "itself as child"); 5306 errs++; 5307 continue; 5308 } 5309 n = calloc(1, 5310 sizeof(struct node_queue)); 5311 if (n == NULL) 5312 err(1, "expand_queue: calloc"); 5313 if (strlcpy(n->parent, a->qname, 5314 sizeof(n->parent)) >= 5315 sizeof(n->parent)) 5316 errx(1, "expand_queue strlcpy"); 5317 if (strlcpy(n->queue, nq->queue, 5318 sizeof(n->queue)) >= 5319 sizeof(n->queue)) 5320 errx(1, "expand_queue strlcpy"); 5321 if (strlcpy(n->ifname, tqueue->ifname, 5322 sizeof(n->ifname)) >= 5323 sizeof(n->ifname)) 5324 errx(1, "expand_queue strlcpy"); 5325 n->scheduler = tqueue->scheduler; 5326 n->next = NULL; 5327 n->tail = n; 5328 if (queues == NULL) 5329 queues = n; 5330 else { 5331 queues->tail->next = n; 5332 queues->tail = n; 5333 } 5334 } 5335 if ((pf->opts & PF_OPT_VERBOSE) && ( 5336 (found == 1 && interface->ifname[0] == 0) || 5337 (found > 0 && interface->ifname[0] != 0))) { 5338 print_queue(&pf->paltq->altq, 0, 5339 &bwspec, interface->ifname[0] != 0, 5340 opts); 5341 if (nqueues && nqueues->tail) { 5342 printf("{ "); 5343 LOOP_THROUGH(struct node_queue, 5344 queue, nqueues, 5345 printf("%s ", 5346 queue->queue); 5347 ); 5348 printf("}"); 5349 } 5350 printf("\n"); 5351 } 5352 } 5353 ); 5354 ); 5355 5356 FREE_LIST(struct node_queue, nqueues); 5357 FREE_LIST(struct node_if, interfaces); 5358 5359 if (!found) { 5360 yyerror("queue %s has no parent", a->qname); 5361 errs++; 5362 } 5363 5364 if (errs) 5365 return (1); 5366 else 5367 return (0); 5368 } 5369 5370 void 5371 expand_rule(struct pfctl_rule *r, 5372 struct node_if *interfaces, struct node_host *rpool_hosts, 5373 struct node_proto *protos, struct node_os *src_oses, 5374 struct node_host *src_hosts, struct node_port *src_ports, 5375 struct node_host *dst_hosts, struct node_port *dst_ports, 5376 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 5377 const char *anchor_call) 5378 { 5379 sa_family_t af = r->af; 5380 int added = 0, error = 0; 5381 char ifname[IF_NAMESIZE]; 5382 char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 5383 char tagname[PF_TAG_NAME_SIZE]; 5384 char match_tagname[PF_TAG_NAME_SIZE]; 5385 struct pf_pooladdr *pa; 5386 struct node_host *h; 5387 u_int8_t flags, flagset, keep_state; 5388 5389 memcpy(label, r->label, sizeof(r->label)); 5390 assert(sizeof(r->label) == sizeof(label)); 5391 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 5392 errx(1, "expand_rule: strlcpy"); 5393 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 5394 sizeof(match_tagname)) 5395 errx(1, "expand_rule: strlcpy"); 5396 flags = r->flags; 5397 flagset = r->flagset; 5398 keep_state = r->keep_state; 5399 5400 LOOP_THROUGH(struct node_if, interface, interfaces, 5401 LOOP_THROUGH(struct node_proto, proto, protos, 5402 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 5403 LOOP_THROUGH(struct node_host, src_host, src_hosts, 5404 LOOP_THROUGH(struct node_port, src_port, src_ports, 5405 LOOP_THROUGH(struct node_os, src_os, src_oses, 5406 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 5407 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 5408 LOOP_THROUGH(struct node_uid, uid, uids, 5409 LOOP_THROUGH(struct node_gid, gid, gids, 5410 5411 r->af = af; 5412 /* for link-local IPv6 address, interface must match up */ 5413 if ((r->af && src_host->af && r->af != src_host->af) || 5414 (r->af && dst_host->af && r->af != dst_host->af) || 5415 (src_host->af && dst_host->af && 5416 src_host->af != dst_host->af) || 5417 (src_host->ifindex && dst_host->ifindex && 5418 src_host->ifindex != dst_host->ifindex) || 5419 (src_host->ifindex && *interface->ifname && 5420 src_host->ifindex != if_nametoindex(interface->ifname)) || 5421 (dst_host->ifindex && *interface->ifname && 5422 dst_host->ifindex != if_nametoindex(interface->ifname))) 5423 continue; 5424 if (!r->af && src_host->af) 5425 r->af = src_host->af; 5426 else if (!r->af && dst_host->af) 5427 r->af = dst_host->af; 5428 5429 if (*interface->ifname) 5430 strlcpy(r->ifname, interface->ifname, 5431 sizeof(r->ifname)); 5432 else if (if_indextoname(src_host->ifindex, ifname)) 5433 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 5434 else if (if_indextoname(dst_host->ifindex, ifname)) 5435 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 5436 else 5437 memset(r->ifname, '\0', sizeof(r->ifname)); 5438 5439 memcpy(r->label, label, sizeof(r->label)); 5440 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 5441 sizeof(r->tagname)) 5442 errx(1, "expand_rule: strlcpy"); 5443 if (strlcpy(r->match_tagname, match_tagname, 5444 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 5445 errx(1, "expand_rule: strlcpy"); 5446 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 5447 expand_label(r->label[i], PF_RULE_LABEL_SIZE, 5448 r->ifname, r->af, src_host, src_port, dst_host, 5449 dst_port, proto->proto); 5450 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 5451 src_host, src_port, dst_host, dst_port, proto->proto); 5452 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 5453 r->af, src_host, src_port, dst_host, dst_port, 5454 proto->proto); 5455 5456 error += check_netmask(src_host, r->af); 5457 error += check_netmask(dst_host, r->af); 5458 5459 r->ifnot = interface->not; 5460 r->proto = proto->proto; 5461 r->src.addr = src_host->addr; 5462 r->src.neg = src_host->not; 5463 r->src.port[0] = src_port->port[0]; 5464 r->src.port[1] = src_port->port[1]; 5465 r->src.port_op = src_port->op; 5466 r->dst.addr = dst_host->addr; 5467 r->dst.neg = dst_host->not; 5468 r->dst.port[0] = dst_port->port[0]; 5469 r->dst.port[1] = dst_port->port[1]; 5470 r->dst.port_op = dst_port->op; 5471 r->uid.op = uid->op; 5472 r->uid.uid[0] = uid->uid[0]; 5473 r->uid.uid[1] = uid->uid[1]; 5474 r->gid.op = gid->op; 5475 r->gid.gid[0] = gid->gid[0]; 5476 r->gid.gid[1] = gid->gid[1]; 5477 r->type = icmp_type->type; 5478 r->code = icmp_type->code; 5479 5480 if ((keep_state == PF_STATE_MODULATE || 5481 keep_state == PF_STATE_SYNPROXY) && 5482 r->proto && r->proto != IPPROTO_TCP) 5483 r->keep_state = PF_STATE_NORMAL; 5484 else 5485 r->keep_state = keep_state; 5486 5487 if (r->proto && r->proto != IPPROTO_TCP) { 5488 r->flags = 0; 5489 r->flagset = 0; 5490 } else { 5491 r->flags = flags; 5492 r->flagset = flagset; 5493 } 5494 if (icmp_type->proto && r->proto != icmp_type->proto) { 5495 yyerror("icmp-type mismatch"); 5496 error++; 5497 } 5498 5499 if (src_os && src_os->os) { 5500 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 5501 if ((pf->opts & PF_OPT_VERBOSE2) && 5502 r->os_fingerprint == PF_OSFP_NOMATCH) 5503 fprintf(stderr, 5504 "warning: unknown '%s' OS fingerprint\n", 5505 src_os->os); 5506 } else { 5507 r->os_fingerprint = PF_OSFP_ANY; 5508 } 5509 5510 TAILQ_INIT(&r->rpool.list); 5511 for (h = rpool_hosts; h != NULL; h = h->next) { 5512 pa = calloc(1, sizeof(struct pf_pooladdr)); 5513 if (pa == NULL) 5514 err(1, "expand_rule: calloc"); 5515 pa->addr = h->addr; 5516 if (h->ifname != NULL) { 5517 if (strlcpy(pa->ifname, h->ifname, 5518 sizeof(pa->ifname)) >= 5519 sizeof(pa->ifname)) 5520 errx(1, "expand_rule: strlcpy"); 5521 } else 5522 pa->ifname[0] = 0; 5523 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 5524 } 5525 5526 if (rule_consistent(r, anchor_call[0]) < 0 || error) 5527 yyerror("skipping rule due to errors"); 5528 else { 5529 r->nr = pf->astack[pf->asd]->match++; 5530 pfctl_append_rule(pf, r, anchor_call); 5531 added++; 5532 } 5533 5534 )))))))))); 5535 5536 FREE_LIST(struct node_if, interfaces); 5537 FREE_LIST(struct node_proto, protos); 5538 FREE_LIST(struct node_host, src_hosts); 5539 FREE_LIST(struct node_port, src_ports); 5540 FREE_LIST(struct node_os, src_oses); 5541 FREE_LIST(struct node_host, dst_hosts); 5542 FREE_LIST(struct node_port, dst_ports); 5543 FREE_LIST(struct node_uid, uids); 5544 FREE_LIST(struct node_gid, gids); 5545 FREE_LIST(struct node_icmp, icmp_types); 5546 FREE_LIST(struct node_host, rpool_hosts); 5547 5548 if (!added) 5549 yyerror("rule expands to no valid combination"); 5550 } 5551 5552 int 5553 expand_skip_interface(struct node_if *interfaces) 5554 { 5555 int errs = 0; 5556 5557 if (!interfaces || (!interfaces->next && !interfaces->not && 5558 !strcmp(interfaces->ifname, "none"))) { 5559 if (pf->opts & PF_OPT_VERBOSE) 5560 printf("set skip on none\n"); 5561 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 5562 return (errs); 5563 } 5564 5565 if (pf->opts & PF_OPT_VERBOSE) 5566 printf("set skip on {"); 5567 LOOP_THROUGH(struct node_if, interface, interfaces, 5568 if (pf->opts & PF_OPT_VERBOSE) 5569 printf(" %s", interface->ifname); 5570 if (interface->not) { 5571 yyerror("skip on ! <interface> is not supported"); 5572 errs++; 5573 } else 5574 errs += pfctl_set_interface_flags(pf, 5575 interface->ifname, PFI_IFLAG_SKIP, 1); 5576 ); 5577 if (pf->opts & PF_OPT_VERBOSE) 5578 printf(" }\n"); 5579 5580 FREE_LIST(struct node_if, interfaces); 5581 5582 if (errs) 5583 return (1); 5584 else 5585 return (0); 5586 } 5587 5588 #undef FREE_LIST 5589 #undef LOOP_THROUGH 5590 5591 int 5592 check_rulestate(int desired_state) 5593 { 5594 if (require_order && (rulestate > desired_state)) { 5595 yyerror("Rules must be in order: options, normalization, " 5596 "queueing, translation, filtering"); 5597 return (1); 5598 } 5599 rulestate = desired_state; 5600 return (0); 5601 } 5602 5603 int 5604 kw_cmp(const void *k, const void *e) 5605 { 5606 return (strcmp(k, ((const struct keywords *)e)->k_name)); 5607 } 5608 5609 int 5610 lookup(char *s) 5611 { 5612 /* this has to be sorted always */ 5613 static const struct keywords keywords[] = { 5614 { "all", ALL}, 5615 { "allow-opts", ALLOWOPTS}, 5616 { "altq", ALTQ}, 5617 { "anchor", ANCHOR}, 5618 { "antispoof", ANTISPOOF}, 5619 { "any", ANY}, 5620 { "bandwidth", BANDWIDTH}, 5621 { "binat", BINAT}, 5622 { "binat-anchor", BINATANCHOR}, 5623 { "bitmask", BITMASK}, 5624 { "block", BLOCK}, 5625 { "block-policy", BLOCKPOLICY}, 5626 { "buckets", BUCKETS}, 5627 { "cbq", CBQ}, 5628 { "code", CODE}, 5629 { "codelq", CODEL}, 5630 { "crop", FRAGCROP}, 5631 { "debug", DEBUG}, 5632 { "divert-reply", DIVERTREPLY}, 5633 { "divert-to", DIVERTTO}, 5634 { "dnpipe", DNPIPE}, 5635 { "dnqueue", DNQUEUE}, 5636 { "drop", DROP}, 5637 { "drop-ovl", FRAGDROP}, 5638 { "dup-to", DUPTO}, 5639 { "fail-policy", FAILPOLICY}, 5640 { "fairq", FAIRQ}, 5641 { "fastroute", FASTROUTE}, 5642 { "file", FILENAME}, 5643 { "fingerprints", FINGERPRINTS}, 5644 { "flags", FLAGS}, 5645 { "floating", FLOATING}, 5646 { "flush", FLUSH}, 5647 { "for", FOR}, 5648 { "fragment", FRAGMENT}, 5649 { "from", FROM}, 5650 { "global", GLOBAL}, 5651 { "group", GROUP}, 5652 { "hfsc", HFSC}, 5653 { "hogs", HOGS}, 5654 { "hostid", HOSTID}, 5655 { "icmp-type", ICMPTYPE}, 5656 { "icmp6-type", ICMP6TYPE}, 5657 { "if-bound", IFBOUND}, 5658 { "in", IN}, 5659 { "include", INCLUDE}, 5660 { "inet", INET}, 5661 { "inet6", INET6}, 5662 { "interval", INTERVAL}, 5663 { "keep", KEEP}, 5664 { "keepcounters", KEEPCOUNTERS}, 5665 { "label", LABEL}, 5666 { "limit", LIMIT}, 5667 { "linkshare", LINKSHARE}, 5668 { "load", LOAD}, 5669 { "log", LOG}, 5670 { "loginterface", LOGINTERFACE}, 5671 { "map-e-portset", MAPEPORTSET}, 5672 { "match", MATCH}, 5673 { "max", MAXIMUM}, 5674 { "max-mss", MAXMSS}, 5675 { "max-src-conn", MAXSRCCONN}, 5676 { "max-src-conn-rate", MAXSRCCONNRATE}, 5677 { "max-src-nodes", MAXSRCNODES}, 5678 { "max-src-states", MAXSRCSTATES}, 5679 { "min-ttl", MINTTL}, 5680 { "modulate", MODULATE}, 5681 { "nat", NAT}, 5682 { "nat-anchor", NATANCHOR}, 5683 { "no", NO}, 5684 { "no-df", NODF}, 5685 { "no-route", NOROUTE}, 5686 { "no-sync", NOSYNC}, 5687 { "on", ON}, 5688 { "optimization", OPTIMIZATION}, 5689 { "os", OS}, 5690 { "out", OUT}, 5691 { "overload", OVERLOAD}, 5692 { "pass", PASS}, 5693 { "port", PORT}, 5694 { "prio", PRIO}, 5695 { "priority", PRIORITY}, 5696 { "priq", PRIQ}, 5697 { "probability", PROBABILITY}, 5698 { "proto", PROTO}, 5699 { "qlimit", QLIMIT}, 5700 { "queue", QUEUE}, 5701 { "quick", QUICK}, 5702 { "random", RANDOM}, 5703 { "random-id", RANDOMID}, 5704 { "rdr", RDR}, 5705 { "rdr-anchor", RDRANCHOR}, 5706 { "realtime", REALTIME}, 5707 { "reassemble", REASSEMBLE}, 5708 { "reply-to", REPLYTO}, 5709 { "require-order", REQUIREORDER}, 5710 { "return", RETURN}, 5711 { "return-icmp", RETURNICMP}, 5712 { "return-icmp6", RETURNICMP6}, 5713 { "return-rst", RETURNRST}, 5714 { "round-robin", ROUNDROBIN}, 5715 { "route", ROUTE}, 5716 { "route-to", ROUTETO}, 5717 { "rtable", RTABLE}, 5718 { "rule", RULE}, 5719 { "ruleset-optimization", RULESET_OPTIMIZATION}, 5720 { "scrub", SCRUB}, 5721 { "set", SET}, 5722 { "set-tos", SETTOS}, 5723 { "skip", SKIP}, 5724 { "sloppy", SLOPPY}, 5725 { "source-hash", SOURCEHASH}, 5726 { "source-track", SOURCETRACK}, 5727 { "state", STATE}, 5728 { "state-defaults", STATEDEFAULTS}, 5729 { "state-policy", STATEPOLICY}, 5730 { "static-port", STATICPORT}, 5731 { "sticky-address", STICKYADDRESS}, 5732 { "syncookies", SYNCOOKIES}, 5733 { "synproxy", SYNPROXY}, 5734 { "table", TABLE}, 5735 { "tag", TAG}, 5736 { "tagged", TAGGED}, 5737 { "target", TARGET}, 5738 { "tbrsize", TBRSIZE}, 5739 { "timeout", TIMEOUT}, 5740 { "to", TO}, 5741 { "tos", TOS}, 5742 { "ttl", TTL}, 5743 { "upperlimit", UPPERLIMIT}, 5744 { "urpf-failed", URPFFAILED}, 5745 { "user", USER}, 5746 }; 5747 const struct keywords *p; 5748 5749 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5750 sizeof(keywords[0]), kw_cmp); 5751 5752 if (p) { 5753 if (debug > 1) 5754 fprintf(stderr, "%s: %d\n", s, p->k_val); 5755 return (p->k_val); 5756 } else { 5757 if (debug > 1) 5758 fprintf(stderr, "string: %s\n", s); 5759 return (STRING); 5760 } 5761 } 5762 5763 #define MAXPUSHBACK 128 5764 5765 static char *parsebuf; 5766 static int parseindex; 5767 static char pushback_buffer[MAXPUSHBACK]; 5768 static int pushback_index = 0; 5769 5770 int 5771 lgetc(int quotec) 5772 { 5773 int c, next; 5774 5775 if (parsebuf) { 5776 /* Read character from the parsebuffer instead of input. */ 5777 if (parseindex >= 0) { 5778 c = parsebuf[parseindex++]; 5779 if (c != '\0') 5780 return (c); 5781 parsebuf = NULL; 5782 } else 5783 parseindex++; 5784 } 5785 5786 if (pushback_index) 5787 return (pushback_buffer[--pushback_index]); 5788 5789 if (quotec) { 5790 if ((c = getc(file->stream)) == EOF) { 5791 yyerror("reached end of file while parsing quoted string"); 5792 if (popfile() == EOF) 5793 return (EOF); 5794 return (quotec); 5795 } 5796 return (c); 5797 } 5798 5799 while ((c = getc(file->stream)) == '\\') { 5800 next = getc(file->stream); 5801 if (next != '\n') { 5802 c = next; 5803 break; 5804 } 5805 yylval.lineno = file->lineno; 5806 file->lineno++; 5807 } 5808 5809 while (c == EOF) { 5810 if (popfile() == EOF) 5811 return (EOF); 5812 c = getc(file->stream); 5813 } 5814 return (c); 5815 } 5816 5817 int 5818 lungetc(int c) 5819 { 5820 if (c == EOF) 5821 return (EOF); 5822 if (parsebuf) { 5823 parseindex--; 5824 if (parseindex >= 0) 5825 return (c); 5826 } 5827 if (pushback_index < MAXPUSHBACK-1) 5828 return (pushback_buffer[pushback_index++] = c); 5829 else 5830 return (EOF); 5831 } 5832 5833 int 5834 findeol(void) 5835 { 5836 int c; 5837 5838 parsebuf = NULL; 5839 5840 /* skip to either EOF or the first real EOL */ 5841 while (1) { 5842 if (pushback_index) 5843 c = pushback_buffer[--pushback_index]; 5844 else 5845 c = lgetc(0); 5846 if (c == '\n') { 5847 file->lineno++; 5848 break; 5849 } 5850 if (c == EOF) 5851 break; 5852 } 5853 return (ERROR); 5854 } 5855 5856 int 5857 yylex(void) 5858 { 5859 char buf[8096]; 5860 char *p, *val; 5861 int quotec, next, c; 5862 int token; 5863 5864 top: 5865 p = buf; 5866 while ((c = lgetc(0)) == ' ' || c == '\t') 5867 ; /* nothing */ 5868 5869 yylval.lineno = file->lineno; 5870 if (c == '#') 5871 while ((c = lgetc(0)) != '\n' && c != EOF) 5872 ; /* nothing */ 5873 if (c == '$' && parsebuf == NULL) { 5874 while (1) { 5875 if ((c = lgetc(0)) == EOF) 5876 return (0); 5877 5878 if (p + 1 >= buf + sizeof(buf) - 1) { 5879 yyerror("string too long"); 5880 return (findeol()); 5881 } 5882 if (isalnum(c) || c == '_') { 5883 *p++ = (char)c; 5884 continue; 5885 } 5886 *p = '\0'; 5887 lungetc(c); 5888 break; 5889 } 5890 val = symget(buf); 5891 if (val == NULL) { 5892 yyerror("macro '%s' not defined", buf); 5893 return (findeol()); 5894 } 5895 parsebuf = val; 5896 parseindex = 0; 5897 goto top; 5898 } 5899 5900 switch (c) { 5901 case '\'': 5902 case '"': 5903 quotec = c; 5904 while (1) { 5905 if ((c = lgetc(quotec)) == EOF) 5906 return (0); 5907 if (c == '\n') { 5908 file->lineno++; 5909 continue; 5910 } else if (c == '\\') { 5911 if ((next = lgetc(quotec)) == EOF) 5912 return (0); 5913 if (next == quotec || c == ' ' || c == '\t') 5914 c = next; 5915 else if (next == '\n') { 5916 file->lineno++; 5917 continue; 5918 } 5919 else 5920 lungetc(next); 5921 } else if (c == quotec) { 5922 *p = '\0'; 5923 break; 5924 } 5925 if (p + 1 >= buf + sizeof(buf) - 1) { 5926 yyerror("string too long"); 5927 return (findeol()); 5928 } 5929 *p++ = (char)c; 5930 } 5931 yylval.v.string = strdup(buf); 5932 if (yylval.v.string == NULL) 5933 err(1, "yylex: strdup"); 5934 return (STRING); 5935 case '<': 5936 next = lgetc(0); 5937 if (next == '>') { 5938 yylval.v.i = PF_OP_XRG; 5939 return (PORTBINARY); 5940 } 5941 lungetc(next); 5942 break; 5943 case '>': 5944 next = lgetc(0); 5945 if (next == '<') { 5946 yylval.v.i = PF_OP_IRG; 5947 return (PORTBINARY); 5948 } 5949 lungetc(next); 5950 break; 5951 case '-': 5952 next = lgetc(0); 5953 if (next == '>') 5954 return (ARROW); 5955 lungetc(next); 5956 break; 5957 } 5958 5959 #define allowed_to_end_number(x) \ 5960 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 5961 5962 if (c == '-' || isdigit(c)) { 5963 do { 5964 *p++ = c; 5965 if ((unsigned)(p-buf) >= sizeof(buf)) { 5966 yyerror("string too long"); 5967 return (findeol()); 5968 } 5969 } while ((c = lgetc(0)) != EOF && isdigit(c)); 5970 lungetc(c); 5971 if (p == buf + 1 && buf[0] == '-') 5972 goto nodigits; 5973 if (c == EOF || allowed_to_end_number(c)) { 5974 const char *errstr = NULL; 5975 5976 *p = '\0'; 5977 yylval.v.number = strtonum(buf, LLONG_MIN, 5978 LLONG_MAX, &errstr); 5979 if (errstr) { 5980 yyerror("\"%s\" invalid number: %s", 5981 buf, errstr); 5982 return (findeol()); 5983 } 5984 return (NUMBER); 5985 } else { 5986 nodigits: 5987 while (p > buf + 1) 5988 lungetc(*--p); 5989 c = *--p; 5990 if (c == '-') 5991 return (c); 5992 } 5993 } 5994 5995 #define allowed_in_string(x) \ 5996 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5997 x != '{' && x != '}' && x != '<' && x != '>' && \ 5998 x != '!' && x != '=' && x != '/' && x != '#' && \ 5999 x != ',')) 6000 6001 if (isalnum(c) || c == ':' || c == '_') { 6002 do { 6003 *p++ = c; 6004 if ((unsigned)(p-buf) >= sizeof(buf)) { 6005 yyerror("string too long"); 6006 return (findeol()); 6007 } 6008 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 6009 lungetc(c); 6010 *p = '\0'; 6011 if ((token = lookup(buf)) == STRING) 6012 if ((yylval.v.string = strdup(buf)) == NULL) 6013 err(1, "yylex: strdup"); 6014 return (token); 6015 } 6016 if (c == '\n') { 6017 yylval.lineno = file->lineno; 6018 file->lineno++; 6019 } 6020 if (c == EOF) 6021 return (0); 6022 return (c); 6023 } 6024 6025 int 6026 check_file_secrecy(int fd, const char *fname) 6027 { 6028 struct stat st; 6029 6030 if (fstat(fd, &st)) { 6031 warn("cannot stat %s", fname); 6032 return (-1); 6033 } 6034 if (st.st_uid != 0 && st.st_uid != getuid()) { 6035 warnx("%s: owner not root or current user", fname); 6036 return (-1); 6037 } 6038 if (st.st_mode & (S_IRWXG | S_IRWXO)) { 6039 warnx("%s: group/world readable/writeable", fname); 6040 return (-1); 6041 } 6042 return (0); 6043 } 6044 6045 struct file * 6046 pushfile(const char *name, int secret) 6047 { 6048 struct file *nfile; 6049 6050 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 6051 (nfile->name = strdup(name)) == NULL) { 6052 warn("malloc"); 6053 return (NULL); 6054 } 6055 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 6056 nfile->stream = stdin; 6057 free(nfile->name); 6058 if ((nfile->name = strdup("stdin")) == NULL) { 6059 warn("strdup"); 6060 free(nfile); 6061 return (NULL); 6062 } 6063 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 6064 warn("%s", nfile->name); 6065 free(nfile->name); 6066 free(nfile); 6067 return (NULL); 6068 } else if (secret && 6069 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 6070 fclose(nfile->stream); 6071 free(nfile->name); 6072 free(nfile); 6073 return (NULL); 6074 } 6075 nfile->lineno = 1; 6076 TAILQ_INSERT_TAIL(&files, nfile, entry); 6077 return (nfile); 6078 } 6079 6080 int 6081 popfile(void) 6082 { 6083 struct file *prev; 6084 6085 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 6086 prev->errors += file->errors; 6087 TAILQ_REMOVE(&files, file, entry); 6088 fclose(file->stream); 6089 free(file->name); 6090 free(file); 6091 file = prev; 6092 return (0); 6093 } 6094 return (EOF); 6095 } 6096 6097 int 6098 parse_config(char *filename, struct pfctl *xpf) 6099 { 6100 int errors = 0; 6101 struct sym *sym; 6102 6103 pf = xpf; 6104 errors = 0; 6105 rulestate = PFCTL_STATE_NONE; 6106 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 6107 returnicmp6default = 6108 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 6109 blockpolicy = PFRULE_DROP; 6110 failpolicy = PFRULE_DROP; 6111 require_order = 1; 6112 6113 if ((file = pushfile(filename, 0)) == NULL) { 6114 warn("cannot open the main config file!"); 6115 return (-1); 6116 } 6117 6118 yyparse(); 6119 errors = file->errors; 6120 popfile(); 6121 6122 /* Free macros and check which have not been used. */ 6123 while ((sym = TAILQ_FIRST(&symhead))) { 6124 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 6125 fprintf(stderr, "warning: macro '%s' not " 6126 "used\n", sym->nam); 6127 free(sym->nam); 6128 free(sym->val); 6129 TAILQ_REMOVE(&symhead, sym, entry); 6130 free(sym); 6131 } 6132 6133 return (errors ? -1 : 0); 6134 } 6135 6136 int 6137 symset(const char *nam, const char *val, int persist) 6138 { 6139 struct sym *sym; 6140 6141 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 6142 sym = TAILQ_NEXT(sym, entry)) 6143 ; /* nothing */ 6144 6145 if (sym != NULL) { 6146 if (sym->persist == 1) 6147 return (0); 6148 else { 6149 free(sym->nam); 6150 free(sym->val); 6151 TAILQ_REMOVE(&symhead, sym, entry); 6152 free(sym); 6153 } 6154 } 6155 if ((sym = calloc(1, sizeof(*sym))) == NULL) 6156 return (-1); 6157 6158 sym->nam = strdup(nam); 6159 if (sym->nam == NULL) { 6160 free(sym); 6161 return (-1); 6162 } 6163 sym->val = strdup(val); 6164 if (sym->val == NULL) { 6165 free(sym->nam); 6166 free(sym); 6167 return (-1); 6168 } 6169 sym->used = 0; 6170 sym->persist = persist; 6171 TAILQ_INSERT_TAIL(&symhead, sym, entry); 6172 return (0); 6173 } 6174 6175 int 6176 pfctl_cmdline_symset(char *s) 6177 { 6178 char *sym, *val; 6179 int ret; 6180 6181 if ((val = strrchr(s, '=')) == NULL) 6182 return (-1); 6183 6184 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 6185 err(1, "pfctl_cmdline_symset: malloc"); 6186 6187 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 6188 6189 ret = symset(sym, val + 1, 1); 6190 free(sym); 6191 6192 return (ret); 6193 } 6194 6195 char * 6196 symget(const char *nam) 6197 { 6198 struct sym *sym; 6199 6200 TAILQ_FOREACH(sym, &symhead, entry) 6201 if (strcmp(nam, sym->nam) == 0) { 6202 sym->used = 1; 6203 return (sym->val); 6204 } 6205 return (NULL); 6206 } 6207 6208 void 6209 mv_rules(struct pfctl_ruleset *src, struct pfctl_ruleset *dst) 6210 { 6211 int i; 6212 struct pfctl_rule *r; 6213 6214 for (i = 0; i < PF_RULESET_MAX; ++i) { 6215 while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 6216 != NULL) { 6217 TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 6218 TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 6219 dst->anchor->match++; 6220 } 6221 src->anchor->match = 0; 6222 while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 6223 != NULL) { 6224 TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 6225 TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 6226 r, entries); 6227 } 6228 } 6229 } 6230 6231 void 6232 decide_address_family(struct node_host *n, sa_family_t *af) 6233 { 6234 if (*af != 0 || n == NULL) 6235 return; 6236 *af = n->af; 6237 while ((n = n->next) != NULL) { 6238 if (n->af != *af) { 6239 *af = 0; 6240 return; 6241 } 6242 } 6243 } 6244 6245 void 6246 remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 6247 { 6248 struct node_host *n = *nh, *prev = NULL; 6249 6250 while (n != NULL) { 6251 if (*af && n->af && n->af != *af) { 6252 /* unlink and free n */ 6253 struct node_host *next = n->next; 6254 6255 /* adjust tail pointer */ 6256 if (n == (*nh)->tail) 6257 (*nh)->tail = prev; 6258 /* adjust previous node's next pointer */ 6259 if (prev == NULL) 6260 *nh = next; 6261 else 6262 prev->next = next; 6263 /* free node */ 6264 if (n->ifname != NULL) 6265 free(n->ifname); 6266 free(n); 6267 n = next; 6268 } else { 6269 if (n->af && !*af) 6270 *af = n->af; 6271 prev = n; 6272 n = n->next; 6273 } 6274 } 6275 } 6276 6277 int 6278 invalid_redirect(struct node_host *nh, sa_family_t af) 6279 { 6280 if (!af) { 6281 struct node_host *n; 6282 6283 /* tables and dyniftl are ok without an address family */ 6284 for (n = nh; n != NULL; n = n->next) { 6285 if (n->addr.type != PF_ADDR_TABLE && 6286 n->addr.type != PF_ADDR_DYNIFTL) { 6287 yyerror("address family not given and " 6288 "translation address expands to multiple " 6289 "address families"); 6290 return (1); 6291 } 6292 } 6293 } 6294 if (nh == NULL) { 6295 yyerror("no translation address with matching address family " 6296 "found."); 6297 return (1); 6298 } 6299 return (0); 6300 } 6301 6302 int 6303 atoul(char *s, u_long *ulvalp) 6304 { 6305 u_long ulval; 6306 char *ep; 6307 6308 errno = 0; 6309 ulval = strtoul(s, &ep, 0); 6310 if (s[0] == '\0' || *ep != '\0') 6311 return (-1); 6312 if (errno == ERANGE && ulval == ULONG_MAX) 6313 return (-1); 6314 *ulvalp = ulval; 6315 return (0); 6316 } 6317 6318 int 6319 getservice(char *n) 6320 { 6321 struct servent *s; 6322 u_long ulval; 6323 6324 if (atoul(n, &ulval) == 0) { 6325 if (ulval > 65535) { 6326 yyerror("illegal port value %lu", ulval); 6327 return (-1); 6328 } 6329 return (htons(ulval)); 6330 } else { 6331 s = getservbyname(n, "tcp"); 6332 if (s == NULL) 6333 s = getservbyname(n, "udp"); 6334 if (s == NULL) { 6335 yyerror("unknown port %s", n); 6336 return (-1); 6337 } 6338 return (s->s_port); 6339 } 6340 } 6341 6342 int 6343 rule_label(struct pfctl_rule *r, char *s[PF_RULE_MAX_LABEL_COUNT]) 6344 { 6345 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) { 6346 if (s[i] == NULL) 6347 return (0); 6348 6349 if (strlcpy(r->label[i], s[i], sizeof(r->label[0])) >= 6350 sizeof(r->label[0])) { 6351 yyerror("rule label too long (max %d chars)", 6352 sizeof(r->label[0])-1); 6353 return (-1); 6354 } 6355 } 6356 return (0); 6357 } 6358 6359 u_int16_t 6360 parseicmpspec(char *w, sa_family_t af) 6361 { 6362 const struct icmpcodeent *p; 6363 u_long ulval; 6364 u_int8_t icmptype; 6365 6366 if (af == AF_INET) 6367 icmptype = returnicmpdefault >> 8; 6368 else 6369 icmptype = returnicmp6default >> 8; 6370 6371 if (atoul(w, &ulval) == -1) { 6372 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 6373 yyerror("unknown icmp code %s", w); 6374 return (0); 6375 } 6376 ulval = p->code; 6377 } 6378 if (ulval > 255) { 6379 yyerror("invalid icmp code %lu", ulval); 6380 return (0); 6381 } 6382 return (icmptype << 8 | ulval); 6383 } 6384 6385 int 6386 parseport(char *port, struct range *r, int extensions) 6387 { 6388 char *p = strchr(port, ':'); 6389 6390 if (p == NULL) { 6391 if ((r->a = getservice(port)) == -1) 6392 return (-1); 6393 r->b = 0; 6394 r->t = PF_OP_NONE; 6395 return (0); 6396 } 6397 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 6398 *p = 0; 6399 if ((r->a = getservice(port)) == -1) 6400 return (-1); 6401 r->b = 0; 6402 r->t = PF_OP_IRG; 6403 return (0); 6404 } 6405 if ((extensions & PPORT_RANGE)) { 6406 *p++ = 0; 6407 if ((r->a = getservice(port)) == -1 || 6408 (r->b = getservice(p)) == -1) 6409 return (-1); 6410 if (r->a == r->b) { 6411 r->b = 0; 6412 r->t = PF_OP_NONE; 6413 } else 6414 r->t = PF_OP_RRG; 6415 return (0); 6416 } 6417 return (-1); 6418 } 6419 6420 int 6421 pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 6422 { 6423 struct loadanchors *la; 6424 6425 TAILQ_FOREACH(la, &loadanchorshead, entries) { 6426 if (pf->opts & PF_OPT_VERBOSE) 6427 fprintf(stderr, "\nLoading anchor %s from %s\n", 6428 la->anchorname, la->filename); 6429 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 6430 la->anchorname, trans) == -1) 6431 return (-1); 6432 } 6433 6434 return (0); 6435 } 6436 6437 int 6438 kw_casecmp(const void *k, const void *e) 6439 { 6440 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 6441 } 6442 6443 int 6444 map_tos(char *s, int *val) 6445 { 6446 /* DiffServ Codepoints and other TOS mappings */ 6447 const struct keywords toswords[] = { 6448 { "af11", IPTOS_DSCP_AF11 }, 6449 { "af12", IPTOS_DSCP_AF12 }, 6450 { "af13", IPTOS_DSCP_AF13 }, 6451 { "af21", IPTOS_DSCP_AF21 }, 6452 { "af22", IPTOS_DSCP_AF22 }, 6453 { "af23", IPTOS_DSCP_AF23 }, 6454 { "af31", IPTOS_DSCP_AF31 }, 6455 { "af32", IPTOS_DSCP_AF32 }, 6456 { "af33", IPTOS_DSCP_AF33 }, 6457 { "af41", IPTOS_DSCP_AF41 }, 6458 { "af42", IPTOS_DSCP_AF42 }, 6459 { "af43", IPTOS_DSCP_AF43 }, 6460 { "critical", IPTOS_PREC_CRITIC_ECP }, 6461 { "cs0", IPTOS_DSCP_CS0 }, 6462 { "cs1", IPTOS_DSCP_CS1 }, 6463 { "cs2", IPTOS_DSCP_CS2 }, 6464 { "cs3", IPTOS_DSCP_CS3 }, 6465 { "cs4", IPTOS_DSCP_CS4 }, 6466 { "cs5", IPTOS_DSCP_CS5 }, 6467 { "cs6", IPTOS_DSCP_CS6 }, 6468 { "cs7", IPTOS_DSCP_CS7 }, 6469 { "ef", IPTOS_DSCP_EF }, 6470 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 6471 { "lowdelay", IPTOS_LOWDELAY }, 6472 { "netcontrol", IPTOS_PREC_NETCONTROL }, 6473 { "reliability", IPTOS_RELIABILITY }, 6474 { "throughput", IPTOS_THROUGHPUT }, 6475 { "va", IPTOS_DSCP_VA } 6476 }; 6477 const struct keywords *p; 6478 6479 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 6480 sizeof(toswords[0]), kw_casecmp); 6481 6482 if (p) { 6483 *val = p->k_val; 6484 return (1); 6485 } 6486 return (0); 6487 } 6488 6489 int 6490 rt_tableid_max(void) 6491 { 6492 #ifdef __FreeBSD__ 6493 int fibs; 6494 size_t l = sizeof(fibs); 6495 6496 if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1) 6497 fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */ 6498 /* 6499 * As the OpenBSD code only compares > and not >= we need to adjust 6500 * here given we only accept values of 0..n and want to avoid #ifdefs 6501 * in the grammar. 6502 */ 6503 return (fibs - 1); 6504 #else 6505 return (RT_TABLEID_MAX); 6506 #endif 6507 } 6508