1 /* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */ 2 3 /*- 4 * SPDX-License-Identifier: BSD-2-Clause 5 * 6 * Copyright (c) 2001 Markus Friedl. All rights reserved. 7 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 8 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 9 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 %{ 32 #include <sys/cdefs.h> 33 #define PFIOC_USE_LATEST 34 35 #include <sys/types.h> 36 #include <sys/socket.h> 37 #include <sys/stat.h> 38 #ifdef __FreeBSD__ 39 #include <sys/sysctl.h> 40 #endif 41 #include <net/if.h> 42 #include <netinet/in.h> 43 #include <netinet/in_systm.h> 44 #include <netinet/ip.h> 45 #include <netinet/ip_icmp.h> 46 #include <netinet/icmp6.h> 47 #include <net/pfvar.h> 48 #include <arpa/inet.h> 49 #include <net/altq/altq.h> 50 #include <net/altq/altq_cbq.h> 51 #include <net/altq/altq_codel.h> 52 #include <net/altq/altq_priq.h> 53 #include <net/altq/altq_hfsc.h> 54 #include <net/altq/altq_fairq.h> 55 56 #include <assert.h> 57 #include <stdio.h> 58 #include <unistd.h> 59 #include <stdlib.h> 60 #include <netdb.h> 61 #include <stdarg.h> 62 #include <errno.h> 63 #include <string.h> 64 #include <ctype.h> 65 #include <math.h> 66 #include <err.h> 67 #include <limits.h> 68 #include <pwd.h> 69 #include <grp.h> 70 #include <md5.h> 71 72 #include "pfctl_parser.h" 73 #include "pfctl.h" 74 75 static struct pfctl *pf = NULL; 76 static int debug = 0; 77 static int rulestate = 0; 78 static u_int16_t returnicmpdefault = 79 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 80 static u_int16_t returnicmp6default = 81 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 82 static int blockpolicy = PFRULE_DROP; 83 static int failpolicy = PFRULE_DROP; 84 static int require_order = 1; 85 static int default_statelock; 86 87 static TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files); 88 static struct file { 89 TAILQ_ENTRY(file) entry; 90 FILE *stream; 91 char *name; 92 int lineno; 93 int errors; 94 } *file; 95 struct file *pushfile(const char *, int); 96 int popfile(void); 97 int check_file_secrecy(int, const char *); 98 int yyparse(void); 99 int yylex(void); 100 int yyerror(const char *, ...); 101 int kw_cmp(const void *, const void *); 102 int lookup(char *); 103 int lgetc(int); 104 int lungetc(int); 105 int findeol(void); 106 107 static TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 108 struct sym { 109 TAILQ_ENTRY(sym) entry; 110 int used; 111 int persist; 112 char *nam; 113 char *val; 114 }; 115 int symset(const char *, const char *, int); 116 char *symget(const char *); 117 118 int atoul(char *, u_long *); 119 120 enum { 121 PFCTL_STATE_NONE, 122 PFCTL_STATE_OPTION, 123 PFCTL_STATE_ETHER, 124 PFCTL_STATE_SCRUB, 125 PFCTL_STATE_QUEUE, 126 PFCTL_STATE_NAT, 127 PFCTL_STATE_FILTER 128 }; 129 130 struct node_etherproto { 131 u_int16_t proto; 132 struct node_etherproto *next; 133 struct node_etherproto *tail; 134 }; 135 136 struct node_proto { 137 u_int8_t proto; 138 struct node_proto *next; 139 struct node_proto *tail; 140 }; 141 142 struct node_port { 143 u_int16_t port[2]; 144 u_int8_t op; 145 struct node_port *next; 146 struct node_port *tail; 147 }; 148 149 struct node_uid { 150 uid_t uid[2]; 151 u_int8_t op; 152 struct node_uid *next; 153 struct node_uid *tail; 154 }; 155 156 struct node_gid { 157 gid_t gid[2]; 158 u_int8_t op; 159 struct node_gid *next; 160 struct node_gid *tail; 161 }; 162 163 struct node_icmp { 164 u_int8_t code; 165 u_int8_t type; 166 u_int8_t proto; 167 struct node_icmp *next; 168 struct node_icmp *tail; 169 }; 170 171 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 172 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 173 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 174 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 175 PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, 176 PF_STATE_OPT_PFLOW, PF_STATE_OPT_ALLOW_RELATED }; 177 178 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 179 180 struct node_state_opt { 181 int type; 182 union { 183 u_int32_t max_states; 184 u_int32_t max_src_states; 185 u_int32_t max_src_conn; 186 struct { 187 u_int32_t limit; 188 u_int32_t seconds; 189 } max_src_conn_rate; 190 struct { 191 u_int8_t flush; 192 char tblname[PF_TABLE_NAME_SIZE]; 193 } overload; 194 u_int32_t max_src_nodes; 195 u_int8_t src_track; 196 u_int32_t statelock; 197 struct { 198 int number; 199 u_int32_t seconds; 200 } timeout; 201 } data; 202 struct node_state_opt *next; 203 struct node_state_opt *tail; 204 }; 205 206 struct peer { 207 struct node_host *host; 208 struct node_port *port; 209 }; 210 211 static struct node_queue { 212 char queue[PF_QNAME_SIZE]; 213 char parent[PF_QNAME_SIZE]; 214 char ifname[IFNAMSIZ]; 215 int scheduler; 216 struct node_queue *next; 217 struct node_queue *tail; 218 } *queues = NULL; 219 220 struct node_qassign { 221 char *qname; 222 char *pqname; 223 }; 224 225 struct range { 226 int a; 227 int b; 228 int t; 229 }; 230 231 static struct pool_opts { 232 int marker; 233 #define POM_TYPE 0x01 234 #define POM_STICKYADDRESS 0x02 235 #define POM_ENDPI 0x04 236 u_int8_t opts; 237 int type; 238 int staticport; 239 struct pf_poolhashkey *key; 240 struct pf_mape_portset mape; 241 } pool_opts; 242 243 struct redirspec { 244 struct node_host *host; 245 struct range rport; 246 struct pool_opts pool_opts; 247 int af; 248 bool binat; 249 }; 250 251 static struct filter_opts { 252 int marker; 253 #define FOM_FLAGS 0x0001 254 #define FOM_ICMP 0x0002 255 #define FOM_TOS 0x0004 256 #define FOM_KEEP 0x0008 257 #define FOM_SRCTRACK 0x0010 258 #define FOM_MINTTL 0x0020 259 #define FOM_MAXMSS 0x0040 260 #define FOM_AFTO 0x0080 261 #define FOM_SETTOS 0x0100 262 #define FOM_SCRUB_TCP 0x0200 263 #define FOM_SETPRIO 0x0400 264 #define FOM_ONCE 0x1000 /* not yet implemmented */ 265 #define FOM_PRIO 0x2000 266 #define FOM_SETDELAY 0x4000 267 #define FOM_FRAGCACHE 0x8000 /* does not exist in OpenBSD */ 268 struct node_uid *uid; 269 struct node_gid *gid; 270 struct node_if *rcv; 271 struct { 272 u_int8_t b1; 273 u_int8_t b2; 274 u_int16_t w; 275 u_int16_t w2; 276 } flags; 277 struct node_icmp *icmpspec; 278 u_int32_t tos; 279 u_int32_t prob; 280 u_int32_t ridentifier; 281 struct { 282 int action; 283 struct node_state_opt *options; 284 } keep; 285 int fragment; 286 int allowopts; 287 char *label[PF_RULE_MAX_LABEL_COUNT]; 288 int labelcount; 289 struct node_qassign queues; 290 char *tag; 291 char *match_tag; 292 u_int8_t match_tag_not; 293 u_int16_t dnpipe; 294 u_int16_t dnrpipe; 295 u_int32_t free_flags; 296 u_int rtableid; 297 u_int8_t prio; 298 u_int8_t set_prio[2]; 299 struct { 300 struct node_host *addr; 301 u_int16_t port; 302 } divert; 303 struct redirspec *nat; 304 struct redirspec *rdr; 305 /* new-style scrub opts */ 306 int nodf; 307 int minttl; 308 int settos; 309 int randomid; 310 int max_mss; 311 } filter_opts; 312 313 static struct antispoof_opts { 314 char *label[PF_RULE_MAX_LABEL_COUNT]; 315 int labelcount; 316 u_int32_t ridentifier; 317 u_int rtableid; 318 } antispoof_opts; 319 320 static struct scrub_opts { 321 int marker; 322 int nodf; 323 int minttl; 324 int maxmss; 325 int settos; 326 int fragcache; 327 int randomid; 328 int reassemble_tcp; 329 char *match_tag; 330 u_int8_t match_tag_not; 331 u_int rtableid; 332 } scrub_opts; 333 334 static struct queue_opts { 335 int marker; 336 #define QOM_BWSPEC 0x01 337 #define QOM_SCHEDULER 0x02 338 #define QOM_PRIORITY 0x04 339 #define QOM_TBRSIZE 0x08 340 #define QOM_QLIMIT 0x10 341 struct node_queue_bw queue_bwspec; 342 struct node_queue_opt scheduler; 343 int priority; 344 unsigned int tbrsize; 345 int qlimit; 346 } queue_opts; 347 348 static struct table_opts { 349 int flags; 350 int init_addr; 351 struct node_tinithead init_nodes; 352 } table_opts; 353 354 static struct codel_opts codel_opts; 355 static struct node_hfsc_opts hfsc_opts; 356 static struct node_fairq_opts fairq_opts; 357 static struct node_state_opt *keep_state_defaults = NULL; 358 static struct pfctl_watermarks syncookie_opts; 359 360 int disallow_table(struct node_host *, const char *); 361 int disallow_urpf_failed(struct node_host *, const char *); 362 int disallow_alias(struct node_host *, const char *); 363 int rule_consistent(struct pfctl_rule *, int); 364 int filter_consistent(struct pfctl_rule *, int); 365 int nat_consistent(struct pfctl_rule *); 366 int rdr_consistent(struct pfctl_rule *); 367 int process_tabledef(char *, struct table_opts *, int); 368 void expand_label_str(char *, size_t, const char *, const char *); 369 void expand_label_if(const char *, char *, size_t, const char *); 370 void expand_label_addr(const char *, char *, size_t, sa_family_t, 371 struct pf_rule_addr *); 372 void expand_label_port(const char *, char *, size_t, 373 struct pf_rule_addr *); 374 void expand_label_proto(const char *, char *, size_t, u_int8_t); 375 void expand_label_nr(const char *, char *, size_t, 376 struct pfctl_rule *); 377 void expand_eth_rule(struct pfctl_eth_rule *, 378 struct node_if *, struct node_etherproto *, 379 struct node_mac *, struct node_mac *, 380 struct node_host *, struct node_host *, const char *, 381 const char *); 382 int apply_rdr_ports(struct pfctl_rule *r, struct pfctl_pool *, struct redirspec *); 383 int apply_nat_ports(struct pfctl_pool *, struct redirspec *); 384 int apply_redirspec(struct pfctl_pool *, struct redirspec *); 385 int check_binat_redirspec(struct node_host *, struct pfctl_rule *, int); 386 void add_binat_rdr_rule(struct pfctl_rule *, struct redirspec *, 387 struct node_host *, struct pfctl_rule *, struct redirspec **, 388 struct node_host **); 389 void expand_rule(struct pfctl_rule *, bool, struct node_if *, 390 struct redirspec *, struct redirspec *, struct redirspec *, 391 struct node_proto *, struct node_os *, struct node_host *, 392 struct node_port *, struct node_host *, struct node_port *, 393 struct node_uid *, struct node_gid *, struct node_if *, 394 struct node_icmp *, const char *); 395 int expand_altq(struct pf_altq *, struct node_if *, 396 struct node_queue *, struct node_queue_bw bwspec, 397 struct node_queue_opt *); 398 int expand_queue(struct pf_altq *, struct node_if *, 399 struct node_queue *, struct node_queue_bw, 400 struct node_queue_opt *); 401 int expand_skip_interface(struct node_if *); 402 403 int check_rulestate(int); 404 int getservice(char *); 405 int rule_label(struct pfctl_rule *, char *s[PF_RULE_MAX_LABEL_COUNT]); 406 int eth_rule_label(struct pfctl_eth_rule *, char *s[PF_RULE_MAX_LABEL_COUNT]); 407 int rt_tableid_max(void); 408 409 void mv_rules(struct pfctl_ruleset *, struct pfctl_ruleset *); 410 void mv_eth_rules(struct pfctl_eth_ruleset *, struct pfctl_eth_ruleset *); 411 void decide_address_family(struct node_host *, sa_family_t *); 412 void remove_invalid_hosts(struct node_host **, sa_family_t *); 413 int invalid_redirect(struct node_host *, sa_family_t); 414 u_int16_t parseicmpspec(char *, sa_family_t); 415 int kw_casecmp(const void *, const void *); 416 int map_tos(char *string, int *); 417 struct node_mac* node_mac_from_string(const char *); 418 struct node_mac* node_mac_from_string_masklen(const char *, int); 419 struct node_mac* node_mac_from_string_mask(const char *, const char *); 420 421 static TAILQ_HEAD(loadanchorshead, loadanchors) 422 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 423 424 struct loadanchors { 425 TAILQ_ENTRY(loadanchors) entries; 426 char *anchorname; 427 char *filename; 428 }; 429 430 typedef struct { 431 union { 432 int64_t number; 433 double probability; 434 int i; 435 char *string; 436 u_int rtableid; 437 struct { 438 u_int8_t b1; 439 u_int8_t b2; 440 u_int16_t w; 441 u_int16_t w2; 442 } b; 443 struct range range; 444 struct node_if *interface; 445 struct node_proto *proto; 446 struct node_etherproto *etherproto; 447 struct node_icmp *icmp; 448 struct node_host *host; 449 struct node_os *os; 450 struct node_port *port; 451 struct node_uid *uid; 452 struct node_gid *gid; 453 struct node_state_opt *state_opt; 454 struct peer peer; 455 struct { 456 struct peer src, dst; 457 struct node_os *src_os; 458 } fromto; 459 struct { 460 struct node_mac *src; 461 struct node_mac *dst; 462 } etherfromto; 463 struct node_mac *mac; 464 struct { 465 struct node_mac *mac; 466 } etheraddr; 467 char *bridge_to; 468 struct { 469 struct redirspec *redirspec; 470 u_int8_t rt; 471 } route; 472 struct redirspec *redirspec; 473 struct { 474 int action; 475 struct node_state_opt *options; 476 } keep_state; 477 struct { 478 u_int8_t log; 479 u_int8_t logif; 480 u_int8_t quick; 481 } logquick; 482 struct { 483 int neg; 484 char *name; 485 } tagged; 486 struct pf_poolhashkey *hashkey; 487 struct node_queue *queue; 488 struct node_queue_opt queue_options; 489 struct node_queue_bw queue_bwspec; 490 struct node_qassign qassign; 491 struct filter_opts filter_opts; 492 struct antispoof_opts antispoof_opts; 493 struct queue_opts queue_opts; 494 struct scrub_opts scrub_opts; 495 struct table_opts table_opts; 496 struct pool_opts pool_opts; 497 struct node_hfsc_opts hfsc_opts; 498 struct node_fairq_opts fairq_opts; 499 struct codel_opts codel_opts; 500 struct pfctl_watermarks *watermarks; 501 } v; 502 int lineno; 503 } YYSTYPE; 504 505 #define PPORT_RANGE 1 506 #define PPORT_STAR 2 507 int parseport(char *, struct range *r, int); 508 509 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 510 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 511 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 512 513 %} 514 515 %token PASS BLOCK MATCH SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 516 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 517 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 518 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 519 %token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 520 %token REASSEMBLE ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 521 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY FAILPOLICY 522 %token RANDOMID REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 523 %token ANTISPOOF FOR INCLUDE KEEPCOUNTERS SYNCOOKIES L3 MATCHES 524 %token ETHER 525 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY MAPEPORTSET 526 %token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME 527 %token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL 528 %token DNPIPE DNQUEUE RIDENTIFIER 529 %token LOAD RULESET_OPTIMIZATION PRIO 530 %token STICKYADDRESS ENDPI MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 531 %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY PFLOW ALLOW_RELATED 532 %token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS 533 %token DIVERTTO DIVERTREPLY BRIDGE_TO RECEIVEDON NE LE GE AFTO NATTO RDRTO 534 %token BINATTO 535 %token <v.string> STRING 536 %token <v.number> NUMBER 537 %token <v.i> PORTBINARY 538 %type <v.interface> interface if_list if_item_not if_item 539 %type <v.number> number icmptype icmp6type uid gid 540 %type <v.number> tos not yesno optnodf 541 %type <v.probability> probability 542 %type <v.i> no dir af fragcache optimizer syncookie_val 543 %type <v.i> sourcetrack flush unaryop statelock 544 %type <v.i> etherprotoval 545 %type <v.b> action nataction natpasslog scrubaction 546 %type <v.b> flags flag blockspec prio 547 %type <v.range> portplain portstar portrange 548 %type <v.hashkey> hashkey 549 %type <v.proto> proto proto_list proto_item 550 %type <v.number> protoval 551 %type <v.icmp> icmpspec 552 %type <v.icmp> icmp_list icmp_item 553 %type <v.icmp> icmp6_list icmp6_item 554 %type <v.number> reticmpspec reticmp6spec 555 %type <v.fromto> fromto l3fromto 556 %type <v.peer> ipportspec from to 557 %type <v.host> ipspec toipspec xhost host dynaddr host_list 558 %type <v.host> redir_host redir_host_list routespec 559 %type <v.host> route_host route_host_list 560 %type <v.os> os xos os_list 561 %type <v.port> portspec port_list port_item 562 %type <v.uid> uids uid_list uid_item 563 %type <v.gid> gids gid_list gid_item 564 %type <v.route> route 565 %type <v.redirspec> no_port_redirspec port_redirspec route_redirspec 566 %type <v.redirspec> binat_redirspec nat_redirspec 567 %type <v.string> label stringall tag anchorname 568 %type <v.string> string varstring numberstring 569 %type <v.keep_state> keep 570 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 571 %type <v.logquick> logquick quick log logopts logopt 572 %type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 573 %type <v.qassign> qname etherqname 574 %type <v.queue> qassign qassign_list qassign_item 575 %type <v.queue_options> scheduler 576 %type <v.number> cbqflags_list cbqflags_item 577 %type <v.number> priqflags_list priqflags_item 578 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 579 %type <v.fairq_opts> fairqopts_list fairqopts_item fairq_opts 580 %type <v.codel_opts> codelopts_list codelopts_item codel_opts 581 %type <v.queue_bwspec> bandwidth 582 %type <v.filter_opts> filter_opts filter_opt filter_opts_l etherfilter_opts etherfilter_opt etherfilter_opts_l 583 %type <v.filter_opts> filter_sets filter_set filter_sets_l 584 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 585 %type <v.queue_opts> queue_opts queue_opt queue_opts_l 586 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 587 %type <v.table_opts> table_opts table_opt table_opts_l 588 %type <v.pool_opts> pool_opts pool_opt pool_opts_l 589 %type <v.tagged> tagged 590 %type <v.rtableid> rtable 591 %type <v.watermarks> syncookie_opts 592 %type <v.etherproto> etherproto etherproto_list etherproto_item 593 %type <v.etherfromto> etherfromto 594 %type <v.etheraddr> etherfrom etherto 595 %type <v.bridge_to> bridge 596 %type <v.mac> xmac mac mac_list macspec 597 %% 598 599 ruleset : /* empty */ 600 | ruleset include '\n' 601 | ruleset '\n' 602 | ruleset option '\n' 603 | ruleset etherrule '\n' 604 | ruleset etheranchorrule '\n' 605 | ruleset scrubrule '\n' 606 | ruleset natrule '\n' 607 | ruleset binatrule '\n' 608 | ruleset pfrule '\n' 609 | ruleset anchorrule '\n' 610 | ruleset loadrule '\n' 611 | ruleset altqif '\n' 612 | ruleset queuespec '\n' 613 | ruleset varset '\n' 614 | ruleset antispoof '\n' 615 | ruleset tabledef '\n' 616 | '{' fakeanchor '}' '\n'; 617 | ruleset error '\n' { file->errors++; } 618 ; 619 620 include : INCLUDE STRING { 621 struct file *nfile; 622 623 if ((nfile = pushfile($2, 0)) == NULL) { 624 yyerror("failed to include file %s", $2); 625 free($2); 626 YYERROR; 627 } 628 free($2); 629 630 file = nfile; 631 lungetc('\n'); 632 } 633 ; 634 635 /* 636 * apply to previouslys specified rule: must be careful to note 637 * what that is: pf or nat or binat or rdr 638 */ 639 fakeanchor : fakeanchor '\n' 640 | fakeanchor anchorrule '\n' 641 | fakeanchor binatrule '\n' 642 | fakeanchor natrule '\n' 643 | fakeanchor pfrule '\n' 644 | fakeanchor error '\n' 645 ; 646 647 optimizer : string { 648 if (!strcmp($1, "none")) 649 $$ = 0; 650 else if (!strcmp($1, "basic")) 651 $$ = PF_OPTIMIZE_BASIC; 652 else if (!strcmp($1, "profile")) 653 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 654 else { 655 yyerror("unknown ruleset-optimization %s", $1); 656 YYERROR; 657 } 658 } 659 ; 660 661 optnodf : /* empty */ { $$ = 0; } 662 | NODF { $$ = 1; } 663 ; 664 665 option : SET REASSEMBLE yesno optnodf { 666 if (check_rulestate(PFCTL_STATE_OPTION)) 667 YYERROR; 668 pfctl_set_reassembly(pf, $3, $4); 669 } 670 | SET OPTIMIZATION STRING { 671 if (check_rulestate(PFCTL_STATE_OPTION)) { 672 free($3); 673 YYERROR; 674 } 675 if (pfctl_set_optimization(pf, $3) != 0) { 676 yyerror("unknown optimization %s", $3); 677 free($3); 678 YYERROR; 679 } 680 free($3); 681 } 682 | SET RULESET_OPTIMIZATION optimizer { 683 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 684 pf->opts |= PF_OPT_OPTIMIZE; 685 pf->optimize = $3; 686 } 687 } 688 | SET TIMEOUT timeout_spec 689 | SET TIMEOUT '{' optnl timeout_list '}' 690 | SET LIMIT limit_spec 691 | SET LIMIT '{' optnl limit_list '}' 692 | SET LOGINTERFACE stringall { 693 if (check_rulestate(PFCTL_STATE_OPTION)) { 694 free($3); 695 YYERROR; 696 } 697 if (pfctl_set_logif(pf, $3) != 0) { 698 yyerror("error setting loginterface %s", $3); 699 free($3); 700 YYERROR; 701 } 702 free($3); 703 } 704 | SET HOSTID number { 705 if ($3 == 0 || $3 > UINT_MAX) { 706 yyerror("hostid must be non-zero"); 707 YYERROR; 708 } 709 pfctl_set_hostid(pf, $3); 710 } 711 | SET BLOCKPOLICY DROP { 712 if (pf->opts & PF_OPT_VERBOSE) 713 printf("set block-policy drop\n"); 714 if (check_rulestate(PFCTL_STATE_OPTION)) 715 YYERROR; 716 blockpolicy = PFRULE_DROP; 717 } 718 | SET BLOCKPOLICY RETURN { 719 if (pf->opts & PF_OPT_VERBOSE) 720 printf("set block-policy return\n"); 721 if (check_rulestate(PFCTL_STATE_OPTION)) 722 YYERROR; 723 blockpolicy = PFRULE_RETURN; 724 } 725 | SET FAILPOLICY DROP { 726 if (pf->opts & PF_OPT_VERBOSE) 727 printf("set fail-policy drop\n"); 728 if (check_rulestate(PFCTL_STATE_OPTION)) 729 YYERROR; 730 failpolicy = PFRULE_DROP; 731 } 732 | SET FAILPOLICY RETURN { 733 if (pf->opts & PF_OPT_VERBOSE) 734 printf("set fail-policy return\n"); 735 if (check_rulestate(PFCTL_STATE_OPTION)) 736 YYERROR; 737 failpolicy = PFRULE_RETURN; 738 } 739 | SET REQUIREORDER yesno { 740 if (pf->opts & PF_OPT_VERBOSE) 741 printf("set require-order %s\n", 742 $3 == 1 ? "yes" : "no"); 743 require_order = $3; 744 } 745 | SET FINGERPRINTS STRING { 746 if (pf->opts & PF_OPT_VERBOSE) 747 printf("set fingerprints \"%s\"\n", $3); 748 if (check_rulestate(PFCTL_STATE_OPTION)) { 749 free($3); 750 YYERROR; 751 } 752 if (!pf->anchor->name[0]) { 753 if (pfctl_file_fingerprints(pf->dev, 754 pf->opts, $3)) { 755 yyerror("error loading " 756 "fingerprints %s", $3); 757 free($3); 758 YYERROR; 759 } 760 } 761 free($3); 762 } 763 | SET STATEPOLICY statelock { 764 if (pf->opts & PF_OPT_VERBOSE) 765 switch ($3) { 766 case 0: 767 printf("set state-policy floating\n"); 768 break; 769 case PFRULE_IFBOUND: 770 printf("set state-policy if-bound\n"); 771 break; 772 } 773 default_statelock = $3; 774 } 775 | SET DEBUG STRING { 776 if (check_rulestate(PFCTL_STATE_OPTION)) { 777 free($3); 778 YYERROR; 779 } 780 if (pfctl_do_set_debug(pf, $3) != 0) { 781 yyerror("error setting debuglevel %s", $3); 782 free($3); 783 YYERROR; 784 } 785 free($3); 786 } 787 | SET SKIP interface { 788 if (expand_skip_interface($3) != 0) { 789 yyerror("error setting skip interface(s)"); 790 YYERROR; 791 } 792 } 793 | SET STATEDEFAULTS state_opt_list { 794 if (keep_state_defaults != NULL) { 795 yyerror("cannot redefine state-defaults"); 796 YYERROR; 797 } 798 keep_state_defaults = $3; 799 } 800 | SET KEEPCOUNTERS { 801 pf->keep_counters = true; 802 } 803 | SET SYNCOOKIES syncookie_val syncookie_opts { 804 if (pfctl_cfg_syncookies(pf, $3, $4)) { 805 yyerror("error setting syncookies"); 806 YYERROR; 807 } 808 } 809 ; 810 811 syncookie_val : STRING { 812 if (!strcmp($1, "never")) 813 $$ = PFCTL_SYNCOOKIES_NEVER; 814 else if (!strcmp($1, "adaptive")) 815 $$ = PFCTL_SYNCOOKIES_ADAPTIVE; 816 else if (!strcmp($1, "always")) 817 $$ = PFCTL_SYNCOOKIES_ALWAYS; 818 else { 819 yyerror("illegal value for syncookies"); 820 YYERROR; 821 } 822 } 823 ; 824 syncookie_opts : /* empty */ { $$ = NULL; } 825 | { 826 memset(&syncookie_opts, 0, sizeof(syncookie_opts)); 827 } '(' syncookie_opt_l ')' { $$ = &syncookie_opts; } 828 ; 829 830 syncookie_opt_l : syncookie_opt_l comma syncookie_opt 831 | syncookie_opt 832 ; 833 834 syncookie_opt : STRING STRING { 835 double val; 836 char *cp; 837 838 val = strtod($2, &cp); 839 if (cp == NULL || strcmp(cp, "%")) 840 YYERROR; 841 if (val <= 0 || val > 100) { 842 yyerror("illegal percentage value"); 843 YYERROR; 844 } 845 if (!strcmp($1, "start")) { 846 syncookie_opts.hi = val; 847 } else if (!strcmp($1, "end")) { 848 syncookie_opts.lo = val; 849 } else { 850 yyerror("illegal syncookie option"); 851 YYERROR; 852 } 853 } 854 ; 855 856 stringall : STRING { $$ = $1; } 857 | ALL { 858 if (($$ = strdup("all")) == NULL) { 859 err(1, "stringall: strdup"); 860 } 861 } 862 ; 863 864 string : STRING string { 865 if (asprintf(&$$, "%s %s", $1, $2) == -1) 866 err(1, "string: asprintf"); 867 free($1); 868 free($2); 869 } 870 | STRING 871 ; 872 873 varstring : numberstring varstring { 874 if (asprintf(&$$, "%s %s", $1, $2) == -1) 875 err(1, "string: asprintf"); 876 free($1); 877 free($2); 878 } 879 | numberstring 880 ; 881 882 numberstring : NUMBER { 883 char *s; 884 if (asprintf(&s, "%lld", (long long)$1) == -1) { 885 yyerror("string: asprintf"); 886 YYERROR; 887 } 888 $$ = s; 889 } 890 | STRING 891 ; 892 893 varset : STRING '=' varstring { 894 char *s = $1; 895 if (pf->opts & PF_OPT_VERBOSE) 896 printf("%s = \"%s\"\n", $1, $3); 897 while (*s++) { 898 if (isspace((unsigned char)*s)) { 899 yyerror("macro name cannot contain " 900 "whitespace"); 901 YYERROR; 902 } 903 } 904 if (symset($1, $3, 0) == -1) 905 err(1, "cannot store variable %s", $1); 906 free($1); 907 free($3); 908 } 909 ; 910 911 anchorname : STRING { $$ = $1; } 912 | /* empty */ { $$ = NULL; } 913 ; 914 915 pfa_anchorlist : /* empty */ 916 | pfa_anchorlist '\n' 917 | pfa_anchorlist pfrule '\n' 918 | pfa_anchorlist anchorrule '\n' 919 | pfa_anchorlist include '\n' 920 ; 921 922 pfa_anchor : '{' 923 { 924 char ta[PF_ANCHOR_NAME_SIZE]; 925 struct pfctl_ruleset *rs; 926 927 /* stepping into a brace anchor */ 928 pf->asd++; 929 pf->bn++; 930 931 /* 932 * Anchor contents are parsed before the anchor rule 933 * production completes, so we don't know the real 934 * location yet. Create a holding ruleset in the root; 935 * contents will be moved afterwards. 936 */ 937 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 938 rs = pf_find_or_create_ruleset(ta); 939 if (rs == NULL) 940 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 941 pf->astack[pf->asd] = rs->anchor; 942 pf->anchor = rs->anchor; 943 } '\n' pfa_anchorlist '}' 944 { 945 pf->alast = pf->anchor; 946 pf->asd--; 947 pf->anchor = pf->astack[pf->asd]; 948 } 949 | /* empty */ 950 ; 951 952 anchorrule : ANCHOR anchorname dir quick interface af proto fromto 953 filter_opts pfa_anchor 954 { 955 struct pfctl_rule r; 956 struct node_proto *proto; 957 958 if (check_rulestate(PFCTL_STATE_FILTER)) { 959 if ($2) 960 free($2); 961 YYERROR; 962 } 963 964 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 965 free($2); 966 yyerror("anchor names beginning with '_' " 967 "are reserved for internal use"); 968 YYERROR; 969 } 970 971 pfctl_init_rule(&r); 972 973 if (pf->astack[pf->asd + 1]) { 974 if ($2 && strchr($2, '/') != NULL) { 975 free($2); 976 yyerror("anchor paths containing '/' " 977 "cannot be used for inline anchors."); 978 YYERROR; 979 } 980 981 /* Move inline rules into relative location. */ 982 pfctl_anchor_setup(&r, 983 &pf->astack[pf->asd]->ruleset, 984 $2 ? $2 : pf->alast->name); 985 986 if (r.anchor == NULL) 987 err(1, "anchorrule: unable to " 988 "create ruleset"); 989 990 if (pf->alast != r.anchor) { 991 if (r.anchor->match) { 992 yyerror("inline anchor '%s' " 993 "already exists", 994 r.anchor->name); 995 YYERROR; 996 } 997 mv_rules(&pf->alast->ruleset, 998 &r.anchor->ruleset); 999 } 1000 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 1001 pf->alast = r.anchor; 1002 } else { 1003 if (!$2) { 1004 yyerror("anchors without explicit " 1005 "rules must specify a name"); 1006 YYERROR; 1007 } 1008 } 1009 r.direction = $3; 1010 r.quick = $4.quick; 1011 r.af = $6; 1012 r.prob = $9.prob; 1013 r.rtableid = $9.rtableid; 1014 r.ridentifier = $9.ridentifier; 1015 1016 if ($9.tag) 1017 if (strlcpy(r.tagname, $9.tag, 1018 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1019 yyerror("tag too long, max %u chars", 1020 PF_TAG_NAME_SIZE - 1); 1021 YYERROR; 1022 } 1023 if ($9.match_tag) 1024 if (strlcpy(r.match_tagname, $9.match_tag, 1025 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1026 yyerror("tag too long, max %u chars", 1027 PF_TAG_NAME_SIZE - 1); 1028 YYERROR; 1029 } 1030 r.match_tag_not = $9.match_tag_not; 1031 if (rule_label(&r, $9.label)) 1032 YYERROR; 1033 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 1034 free($9.label[i]); 1035 r.flags = $9.flags.b1; 1036 r.flagset = $9.flags.b2; 1037 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 1038 yyerror("flags always false"); 1039 YYERROR; 1040 } 1041 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1042 for (proto = $7; proto != NULL && 1043 proto->proto != IPPROTO_TCP; 1044 proto = proto->next) 1045 ; /* nothing */ 1046 if (proto == NULL && $7 != NULL) { 1047 if ($9.flags.b1 || $9.flags.b2) 1048 yyerror( 1049 "flags only apply to tcp"); 1050 if ($8.src_os) 1051 yyerror( 1052 "OS fingerprinting only " 1053 "applies to tcp"); 1054 YYERROR; 1055 } 1056 } 1057 1058 r.tos = $9.tos; 1059 1060 if ($9.keep.action) { 1061 yyerror("cannot specify state handling " 1062 "on anchors"); 1063 YYERROR; 1064 } 1065 1066 if ($9.match_tag) 1067 if (strlcpy(r.match_tagname, $9.match_tag, 1068 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1069 yyerror("tag too long, max %u chars", 1070 PF_TAG_NAME_SIZE - 1); 1071 YYERROR; 1072 } 1073 r.match_tag_not = $9.match_tag_not; 1074 if ($9.marker & FOM_PRIO) { 1075 if ($9.prio == 0) 1076 r.prio = PF_PRIO_ZERO; 1077 else 1078 r.prio = $9.prio; 1079 } 1080 if ($9.marker & FOM_SETPRIO) { 1081 r.set_prio[0] = $9.set_prio[0]; 1082 r.set_prio[1] = $9.set_prio[1]; 1083 r.scrub_flags |= PFSTATE_SETPRIO; 1084 } 1085 1086 decide_address_family($8.src.host, &r.af); 1087 decide_address_family($8.dst.host, &r.af); 1088 1089 expand_rule(&r, false, $5, NULL, NULL, NULL, 1090 $7, $8.src_os, $8.src.host, $8.src.port, $8.dst.host, 1091 $8.dst.port, $9.uid, $9.gid, $9.rcv, $9.icmpspec, 1092 pf->astack[pf->asd + 1] ? pf->alast->name : $2); 1093 free($2); 1094 pf->astack[pf->asd + 1] = NULL; 1095 } 1096 | NATANCHOR string interface af proto fromto rtable { 1097 struct pfctl_rule r; 1098 1099 if (check_rulestate(PFCTL_STATE_NAT)) { 1100 free($2); 1101 YYERROR; 1102 } 1103 1104 pfctl_init_rule(&r); 1105 1106 r.action = PF_NAT; 1107 r.af = $4; 1108 r.rtableid = $7; 1109 1110 decide_address_family($6.src.host, &r.af); 1111 decide_address_family($6.dst.host, &r.af); 1112 1113 expand_rule(&r, false, $3, NULL, NULL, NULL, 1114 $5, $6.src_os, $6.src.host, $6.src.port, $6.dst.host, 1115 $6.dst.port, 0, 0, 0, 0, $2); 1116 free($2); 1117 } 1118 | RDRANCHOR string interface af proto fromto rtable { 1119 struct pfctl_rule r; 1120 1121 if (check_rulestate(PFCTL_STATE_NAT)) { 1122 free($2); 1123 YYERROR; 1124 } 1125 1126 pfctl_init_rule(&r); 1127 1128 r.action = PF_RDR; 1129 r.af = $4; 1130 r.rtableid = $7; 1131 1132 decide_address_family($6.src.host, &r.af); 1133 decide_address_family($6.dst.host, &r.af); 1134 1135 if ($6.src.port != NULL) { 1136 yyerror("source port parameter not supported" 1137 " in rdr-anchor"); 1138 YYERROR; 1139 } 1140 if ($6.dst.port != NULL) { 1141 if ($6.dst.port->next != NULL) { 1142 yyerror("destination port list " 1143 "expansion not supported in " 1144 "rdr-anchor"); 1145 YYERROR; 1146 } else if ($6.dst.port->op != PF_OP_EQ) { 1147 yyerror("destination port operators" 1148 " not supported in rdr-anchor"); 1149 YYERROR; 1150 } 1151 r.dst.port[0] = $6.dst.port->port[0]; 1152 r.dst.port[1] = $6.dst.port->port[1]; 1153 r.dst.port_op = $6.dst.port->op; 1154 } 1155 1156 expand_rule(&r, false, $3, NULL, NULL, NULL, 1157 $5, $6.src_os, $6.src.host, $6.src.port, $6.dst.host, 1158 $6.dst.port, 0, 0, 0, 0, $2); 1159 free($2); 1160 } 1161 | BINATANCHOR string interface af proto fromto rtable { 1162 struct pfctl_rule r; 1163 1164 if (check_rulestate(PFCTL_STATE_NAT)) { 1165 free($2); 1166 YYERROR; 1167 } 1168 1169 pfctl_init_rule(&r); 1170 1171 r.action = PF_BINAT; 1172 r.af = $4; 1173 r.rtableid = $7; 1174 if ($5 != NULL) { 1175 if ($5->next != NULL) { 1176 yyerror("proto list expansion" 1177 " not supported in binat-anchor"); 1178 YYERROR; 1179 } 1180 r.proto = $5->proto; 1181 free($5); 1182 } 1183 1184 if ($6.src.host != NULL || $6.src.port != NULL || 1185 $6.dst.host != NULL || $6.dst.port != NULL) { 1186 yyerror("fromto parameter not supported" 1187 " in binat-anchor"); 1188 YYERROR; 1189 } 1190 1191 decide_address_family($6.src.host, &r.af); 1192 decide_address_family($6.dst.host, &r.af); 1193 1194 pfctl_append_rule(pf, &r, $2); 1195 free($2); 1196 } 1197 ; 1198 1199 loadrule : LOAD ANCHOR string FROM string { 1200 struct loadanchors *loadanchor; 1201 1202 if (strlen(pf->anchor->name) + 1 + 1203 strlen($3) >= MAXPATHLEN) { 1204 yyerror("anchorname %s too long, max %u\n", 1205 $3, MAXPATHLEN - 1); 1206 free($3); 1207 YYERROR; 1208 } 1209 loadanchor = calloc(1, sizeof(struct loadanchors)); 1210 if (loadanchor == NULL) 1211 err(1, "loadrule: calloc"); 1212 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 1213 NULL) 1214 err(1, "loadrule: malloc"); 1215 if (pf->anchor->name[0]) 1216 snprintf(loadanchor->anchorname, MAXPATHLEN, 1217 "%s/%s", pf->anchor->name, $3); 1218 else 1219 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 1220 if ((loadanchor->filename = strdup($5)) == NULL) 1221 err(1, "loadrule: strdup"); 1222 1223 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 1224 entries); 1225 1226 free($3); 1227 free($5); 1228 }; 1229 1230 scrubaction : no SCRUB { 1231 $$.b2 = $$.w = 0; 1232 if ($1) 1233 $$.b1 = PF_NOSCRUB; 1234 else 1235 $$.b1 = PF_SCRUB; 1236 } 1237 ; 1238 1239 etherrule : ETHER action dir quick interface bridge etherproto etherfromto l3fromto etherfilter_opts 1240 { 1241 struct pfctl_eth_rule r; 1242 1243 bzero(&r, sizeof(r)); 1244 1245 if (check_rulestate(PFCTL_STATE_ETHER)) 1246 YYERROR; 1247 1248 r.action = $2.b1; 1249 r.direction = $3; 1250 r.quick = $4.quick; 1251 if ($10.tag != NULL) 1252 strlcpy(r.tagname, $10.tag, sizeof(r.tagname)); 1253 if ($10.match_tag) 1254 if (strlcpy(r.match_tagname, $10.match_tag, 1255 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1256 yyerror("tag too long, max %u chars", 1257 PF_TAG_NAME_SIZE - 1); 1258 YYERROR; 1259 } 1260 r.match_tag_not = $10.match_tag_not; 1261 if ($10.queues.qname != NULL) 1262 strlcpy(r.qname, $10.queues.qname, sizeof(r.qname)); 1263 r.dnpipe = $10.dnpipe; 1264 r.dnflags = $10.free_flags; 1265 if (eth_rule_label(&r, $10.label)) 1266 YYERROR; 1267 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 1268 free($10.label[i]); 1269 r.ridentifier = $10.ridentifier; 1270 1271 expand_eth_rule(&r, $5, $7, $8.src, $8.dst, 1272 $9.src.host, $9.dst.host, $6, ""); 1273 } 1274 ; 1275 1276 etherpfa_anchorlist : /* empty */ 1277 | etherpfa_anchorlist '\n' 1278 | etherpfa_anchorlist etherrule '\n' 1279 | etherpfa_anchorlist etheranchorrule '\n' 1280 ; 1281 1282 etherpfa_anchor : '{' 1283 { 1284 char ta[PF_ANCHOR_NAME_SIZE]; 1285 struct pfctl_eth_ruleset *rs; 1286 1287 /* steping into a brace anchor */ 1288 pf->asd++; 1289 pf->bn++; 1290 1291 /* create a holding ruleset in the root */ 1292 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 1293 rs = pf_find_or_create_eth_ruleset(ta); 1294 if (rs == NULL) 1295 err(1, "etherpfa_anchor: pf_find_or_create_eth_ruleset"); 1296 pf->eastack[pf->asd] = rs->anchor; 1297 pf->eanchor = rs->anchor; 1298 } '\n' etherpfa_anchorlist '}' 1299 { 1300 pf->ealast = pf->eanchor; 1301 pf->asd--; 1302 pf->eanchor = pf->eastack[pf->asd]; 1303 } 1304 | /* empty */ 1305 ; 1306 1307 etheranchorrule : ETHER ANCHOR anchorname dir quick interface etherproto etherfromto l3fromto etherpfa_anchor 1308 { 1309 struct pfctl_eth_rule r; 1310 1311 if (check_rulestate(PFCTL_STATE_ETHER)) { 1312 free($3); 1313 YYERROR; 1314 } 1315 1316 if ($3 && ($3[0] == '_' || strstr($3, "/_") != NULL)) { 1317 free($3); 1318 yyerror("anchor names beginning with '_' " 1319 "are reserved for internal use"); 1320 YYERROR; 1321 } 1322 1323 memset(&r, 0, sizeof(r)); 1324 if (pf->eastack[pf->asd + 1]) { 1325 if ($3 && strchr($3, '/') != NULL) { 1326 free($3); 1327 yyerror("anchor paths containing '/' " 1328 "cannot be used for inline anchors."); 1329 YYERROR; 1330 } 1331 1332 /* Move inline rules into relative location. */ 1333 pfctl_eth_anchor_setup(pf, &r, 1334 &pf->eastack[pf->asd]->ruleset, 1335 $3 ? $3 : pf->ealast->name); 1336 if (r.anchor == NULL) 1337 err(1, "etheranchorrule: unable to " 1338 "create ruleset"); 1339 1340 if (pf->ealast != r.anchor) { 1341 if (r.anchor->match) { 1342 yyerror("inline anchor '%s' " 1343 "already exists", 1344 r.anchor->name); 1345 YYERROR; 1346 } 1347 mv_eth_rules(&pf->ealast->ruleset, 1348 &r.anchor->ruleset); 1349 } 1350 pf_remove_if_empty_eth_ruleset(&pf->ealast->ruleset); 1351 pf->ealast = r.anchor; 1352 } else { 1353 if (!$3) { 1354 yyerror("anchors without explicit " 1355 "rules must specify a name"); 1356 YYERROR; 1357 } 1358 } 1359 1360 r.direction = $4; 1361 r.quick = $5.quick; 1362 1363 expand_eth_rule(&r, $6, $7, $8.src, $8.dst, 1364 $9.src.host, $9.dst.host, NULL, 1365 pf->eastack[pf->asd + 1] ? pf->ealast->name : $3); 1366 1367 free($3); 1368 pf->eastack[pf->asd + 1] = NULL; 1369 } 1370 ; 1371 1372 etherfilter_opts : { 1373 bzero(&filter_opts, sizeof filter_opts); 1374 } 1375 etherfilter_opts_l 1376 { $$ = filter_opts; } 1377 | /* empty */ { 1378 bzero(&filter_opts, sizeof filter_opts); 1379 $$ = filter_opts; 1380 } 1381 ; 1382 1383 etherfilter_opts_l : etherfilter_opts_l etherfilter_opt 1384 | etherfilter_opt 1385 1386 etherfilter_opt : etherqname { 1387 if (filter_opts.queues.qname) { 1388 yyerror("queue cannot be redefined"); 1389 YYERROR; 1390 } 1391 filter_opts.queues = $1; 1392 } 1393 | RIDENTIFIER number { 1394 filter_opts.ridentifier = $2; 1395 } 1396 | label { 1397 if (filter_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 1398 yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 1399 YYERROR; 1400 } 1401 filter_opts.label[filter_opts.labelcount++] = $1; 1402 } 1403 | TAG string { 1404 filter_opts.tag = $2; 1405 } 1406 | not TAGGED string { 1407 filter_opts.match_tag = $3; 1408 filter_opts.match_tag_not = $1; 1409 } 1410 | DNPIPE number { 1411 filter_opts.dnpipe = $2; 1412 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 1413 } 1414 | DNQUEUE number { 1415 filter_opts.dnpipe = $2; 1416 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 1417 } 1418 ; 1419 1420 bridge : /* empty */ { 1421 $$ = NULL; 1422 } 1423 | BRIDGE_TO STRING { 1424 $$ = strdup($2); 1425 } 1426 ; 1427 1428 scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 1429 { 1430 struct pfctl_rule r; 1431 1432 if (check_rulestate(PFCTL_STATE_SCRUB)) 1433 YYERROR; 1434 1435 pfctl_init_rule(&r); 1436 1437 r.action = $1.b1; 1438 r.direction = $2; 1439 1440 r.log = $3.log; 1441 r.logif = $3.logif; 1442 if ($3.quick) { 1443 yyerror("scrub rules do not support 'quick'"); 1444 YYERROR; 1445 } 1446 1447 r.af = $5; 1448 if ($8.nodf) 1449 r.rule_flag |= PFRULE_NODF; 1450 if ($8.randomid) 1451 r.rule_flag |= PFRULE_RANDOMID; 1452 if ($8.reassemble_tcp) { 1453 if (r.direction != PF_INOUT) { 1454 yyerror("reassemble tcp rules can not " 1455 "specify direction"); 1456 YYERROR; 1457 } 1458 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 1459 } 1460 if ($8.minttl) 1461 r.min_ttl = $8.minttl; 1462 if ($8.maxmss) 1463 r.max_mss = $8.maxmss; 1464 if ($8.marker & FOM_SETTOS) { 1465 r.rule_flag |= PFRULE_SET_TOS; 1466 r.set_tos = $8.settos; 1467 } 1468 if ($8.fragcache) 1469 r.rule_flag |= $8.fragcache; 1470 if ($8.match_tag) 1471 if (strlcpy(r.match_tagname, $8.match_tag, 1472 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1473 yyerror("tag too long, max %u chars", 1474 PF_TAG_NAME_SIZE - 1); 1475 YYERROR; 1476 } 1477 r.match_tag_not = $8.match_tag_not; 1478 r.rtableid = $8.rtableid; 1479 1480 expand_rule(&r, false, $4, NULL, NULL, NULL, 1481 $6, $7.src_os, $7.src.host, $7.src.port, $7.dst.host, 1482 $7.dst.port, NULL, NULL, NULL, NULL, ""); 1483 } 1484 ; 1485 1486 scrub_opts : { 1487 bzero(&scrub_opts, sizeof scrub_opts); 1488 scrub_opts.rtableid = -1; 1489 } 1490 scrub_opts_l 1491 { $$ = scrub_opts; } 1492 | /* empty */ { 1493 bzero(&scrub_opts, sizeof scrub_opts); 1494 scrub_opts.rtableid = -1; 1495 $$ = scrub_opts; 1496 } 1497 ; 1498 1499 scrub_opts_l : scrub_opts_l comma scrub_opt 1500 | scrub_opt 1501 ; 1502 1503 scrub_opt : NODF { 1504 if (scrub_opts.nodf) { 1505 yyerror("no-df cannot be respecified"); 1506 YYERROR; 1507 } 1508 scrub_opts.nodf = 1; 1509 } 1510 | MINTTL NUMBER { 1511 if (scrub_opts.marker & FOM_MINTTL) { 1512 yyerror("min-ttl cannot be respecified"); 1513 YYERROR; 1514 } 1515 if ($2 < 0 || $2 > 255) { 1516 yyerror("illegal min-ttl value %d", $2); 1517 YYERROR; 1518 } 1519 scrub_opts.marker |= FOM_MINTTL; 1520 scrub_opts.minttl = $2; 1521 } 1522 | MAXMSS NUMBER { 1523 if (scrub_opts.marker & FOM_MAXMSS) { 1524 yyerror("max-mss cannot be respecified"); 1525 YYERROR; 1526 } 1527 if ($2 < 0 || $2 > 65535) { 1528 yyerror("illegal max-mss value %d", $2); 1529 YYERROR; 1530 } 1531 scrub_opts.marker |= FOM_MAXMSS; 1532 scrub_opts.maxmss = $2; 1533 } 1534 | SETTOS tos { 1535 if (scrub_opts.marker & FOM_SETTOS) { 1536 yyerror("set-tos cannot be respecified"); 1537 YYERROR; 1538 } 1539 scrub_opts.marker |= FOM_SETTOS; 1540 scrub_opts.settos = $2; 1541 } 1542 | fragcache { 1543 if (scrub_opts.marker & FOM_FRAGCACHE) { 1544 yyerror("fragcache cannot be respecified"); 1545 YYERROR; 1546 } 1547 scrub_opts.marker |= FOM_FRAGCACHE; 1548 scrub_opts.fragcache = $1; 1549 } 1550 | REASSEMBLE STRING { 1551 if (strcasecmp($2, "tcp") != 0) { 1552 yyerror("scrub reassemble supports only tcp, " 1553 "not '%s'", $2); 1554 free($2); 1555 YYERROR; 1556 } 1557 free($2); 1558 if (scrub_opts.reassemble_tcp) { 1559 yyerror("reassemble tcp cannot be respecified"); 1560 YYERROR; 1561 } 1562 scrub_opts.reassemble_tcp = 1; 1563 } 1564 | RANDOMID { 1565 if (scrub_opts.randomid) { 1566 yyerror("random-id cannot be respecified"); 1567 YYERROR; 1568 } 1569 scrub_opts.randomid = 1; 1570 } 1571 | RTABLE NUMBER { 1572 if ($2 < 0 || $2 > rt_tableid_max()) { 1573 yyerror("invalid rtable id"); 1574 YYERROR; 1575 } 1576 scrub_opts.rtableid = $2; 1577 } 1578 | not TAGGED string { 1579 scrub_opts.match_tag = $3; 1580 scrub_opts.match_tag_not = $1; 1581 } 1582 ; 1583 1584 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 1585 | FRAGMENT NO REASSEMBLE { $$ = PFRULE_FRAGMENT_NOREASS; } 1586 ; 1587 1588 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1589 struct pfctl_rule r; 1590 struct node_host *h = NULL, *hh; 1591 struct node_if *i, *j; 1592 1593 if (check_rulestate(PFCTL_STATE_FILTER)) 1594 YYERROR; 1595 1596 for (i = $3; i; i = i->next) { 1597 pfctl_init_rule(&r); 1598 1599 r.action = PF_DROP; 1600 r.direction = PF_IN; 1601 r.log = $2.log; 1602 r.logif = $2.logif; 1603 r.quick = $2.quick; 1604 r.af = $4; 1605 r.ridentifier = $5.ridentifier; 1606 if (rule_label(&r, $5.label)) 1607 YYERROR; 1608 r.rtableid = $5.rtableid; 1609 j = calloc(1, sizeof(struct node_if)); 1610 if (j == NULL) 1611 err(1, "antispoof: calloc"); 1612 if (strlcpy(j->ifname, i->ifname, 1613 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1614 free(j); 1615 yyerror("interface name too long"); 1616 YYERROR; 1617 } 1618 j->not = 1; 1619 if (i->dynamic) { 1620 h = calloc(1, sizeof(*h)); 1621 if (h == NULL) 1622 err(1, "address: calloc"); 1623 h->addr.type = PF_ADDR_DYNIFTL; 1624 set_ipmask(h, 128); 1625 if (strlcpy(h->addr.v.ifname, i->ifname, 1626 sizeof(h->addr.v.ifname)) >= 1627 sizeof(h->addr.v.ifname)) { 1628 free(h); 1629 yyerror( 1630 "interface name too long"); 1631 YYERROR; 1632 } 1633 hh = malloc(sizeof(*hh)); 1634 if (hh == NULL) 1635 err(1, "address: malloc"); 1636 bcopy(h, hh, sizeof(*hh)); 1637 h->addr.iflags = PFI_AFLAG_NETWORK; 1638 } else { 1639 h = ifa_lookup(j->ifname, 1640 PFI_AFLAG_NETWORK); 1641 hh = NULL; 1642 } 1643 1644 if (h != NULL) 1645 expand_rule(&r, false, j, NULL, NULL, 1646 NULL, NULL, NULL, h, NULL, NULL, 1647 NULL, NULL, NULL, NULL, NULL, ""); 1648 1649 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1650 bzero(&r, sizeof(r)); 1651 1652 r.action = PF_DROP; 1653 r.direction = PF_IN; 1654 r.log = $2.log; 1655 r.logif = $2.logif; 1656 r.quick = $2.quick; 1657 r.af = $4; 1658 r.ridentifier = $5.ridentifier; 1659 if (rule_label(&r, $5.label)) 1660 YYERROR; 1661 r.rtableid = $5.rtableid; 1662 if (hh != NULL) 1663 h = hh; 1664 else 1665 h = ifa_lookup(i->ifname, 0); 1666 if (h != NULL) 1667 expand_rule(&r, false, NULL, 1668 NULL, NULL, NULL, NULL, 1669 NULL, h, NULL, NULL, NULL, 1670 NULL, NULL, NULL, NULL, ""); 1671 } else 1672 free(hh); 1673 } 1674 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 1675 free($5.label[i]); 1676 } 1677 ; 1678 1679 antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1680 | FOR '{' optnl antispoof_iflst '}' { $$ = $4; } 1681 ; 1682 1683 antispoof_iflst : antispoof_if optnl { $$ = $1; } 1684 | antispoof_iflst comma antispoof_if optnl { 1685 $1->tail->next = $3; 1686 $1->tail = $3; 1687 $$ = $1; 1688 } 1689 ; 1690 1691 antispoof_if : if_item { $$ = $1; } 1692 | '(' if_item ')' { 1693 $2->dynamic = 1; 1694 $$ = $2; 1695 } 1696 ; 1697 1698 antispoof_opts : { 1699 bzero(&antispoof_opts, sizeof antispoof_opts); 1700 antispoof_opts.rtableid = -1; 1701 } 1702 antispoof_opts_l 1703 { $$ = antispoof_opts; } 1704 | /* empty */ { 1705 bzero(&antispoof_opts, sizeof antispoof_opts); 1706 antispoof_opts.rtableid = -1; 1707 $$ = antispoof_opts; 1708 } 1709 ; 1710 1711 antispoof_opts_l : antispoof_opts_l antispoof_opt 1712 | antispoof_opt 1713 ; 1714 1715 antispoof_opt : label { 1716 if (antispoof_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 1717 yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 1718 YYERROR; 1719 } 1720 antispoof_opts.label[antispoof_opts.labelcount++] = $1; 1721 } 1722 | RIDENTIFIER number { 1723 antispoof_opts.ridentifier = $2; 1724 } 1725 | RTABLE NUMBER { 1726 if ($2 < 0 || $2 > rt_tableid_max()) { 1727 yyerror("invalid rtable id"); 1728 YYERROR; 1729 } 1730 antispoof_opts.rtableid = $2; 1731 } 1732 ; 1733 1734 not : '!' { $$ = 1; } 1735 | /* empty */ { $$ = 0; } 1736 ; 1737 1738 tabledef : TABLE '<' STRING '>' table_opts { 1739 struct node_host *h, *nh; 1740 struct node_tinit *ti, *nti; 1741 1742 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1743 yyerror("table name too long, max %d chars", 1744 PF_TABLE_NAME_SIZE - 1); 1745 free($3); 1746 YYERROR; 1747 } 1748 if (pf->loadopt & PFCTL_FLAG_TABLE) 1749 if (process_tabledef($3, &$5, pf->opts)) { 1750 free($3); 1751 YYERROR; 1752 } 1753 free($3); 1754 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1755 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 1756 if (ti->file) 1757 free(ti->file); 1758 for (h = ti->host; h != NULL; h = nh) { 1759 nh = h->next; 1760 free(h); 1761 } 1762 nti = SIMPLEQ_NEXT(ti, entries); 1763 free(ti); 1764 } 1765 } 1766 ; 1767 1768 table_opts : { 1769 bzero(&table_opts, sizeof table_opts); 1770 SIMPLEQ_INIT(&table_opts.init_nodes); 1771 } 1772 table_opts_l 1773 { $$ = table_opts; } 1774 | /* empty */ 1775 { 1776 bzero(&table_opts, sizeof table_opts); 1777 SIMPLEQ_INIT(&table_opts.init_nodes); 1778 $$ = table_opts; 1779 } 1780 ; 1781 1782 table_opts_l : table_opts_l table_opt 1783 | table_opt 1784 ; 1785 1786 table_opt : STRING { 1787 if (!strcmp($1, "const")) 1788 table_opts.flags |= PFR_TFLAG_CONST; 1789 else if (!strcmp($1, "persist")) 1790 table_opts.flags |= PFR_TFLAG_PERSIST; 1791 else if (!strcmp($1, "counters")) 1792 table_opts.flags |= PFR_TFLAG_COUNTERS; 1793 else { 1794 yyerror("invalid table option '%s'", $1); 1795 free($1); 1796 YYERROR; 1797 } 1798 free($1); 1799 } 1800 | '{' optnl '}' { table_opts.init_addr = 1; } 1801 | '{' optnl host_list '}' { 1802 struct node_host *n; 1803 struct node_tinit *ti; 1804 1805 for (n = $3; n != NULL; n = n->next) { 1806 switch (n->addr.type) { 1807 case PF_ADDR_ADDRMASK: 1808 continue; /* ok */ 1809 case PF_ADDR_RANGE: 1810 yyerror("address ranges are not " 1811 "permitted inside tables"); 1812 break; 1813 case PF_ADDR_DYNIFTL: 1814 yyerror("dynamic addresses are not " 1815 "permitted inside tables"); 1816 break; 1817 case PF_ADDR_TABLE: 1818 yyerror("tables cannot contain tables"); 1819 break; 1820 case PF_ADDR_NOROUTE: 1821 yyerror("\"no-route\" is not permitted " 1822 "inside tables"); 1823 break; 1824 case PF_ADDR_URPFFAILED: 1825 yyerror("\"urpf-failed\" is not " 1826 "permitted inside tables"); 1827 break; 1828 default: 1829 yyerror("unknown address type %d", 1830 n->addr.type); 1831 } 1832 YYERROR; 1833 } 1834 if (!(ti = calloc(1, sizeof(*ti)))) 1835 err(1, "table_opt: calloc"); 1836 ti->host = $3; 1837 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1838 entries); 1839 table_opts.init_addr = 1; 1840 } 1841 | FILENAME STRING { 1842 struct node_tinit *ti; 1843 1844 if (!(ti = calloc(1, sizeof(*ti)))) 1845 err(1, "table_opt: calloc"); 1846 ti->file = $2; 1847 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1848 entries); 1849 table_opts.init_addr = 1; 1850 } 1851 ; 1852 1853 altqif : ALTQ interface queue_opts QUEUE qassign { 1854 struct pf_altq a; 1855 1856 if (check_rulestate(PFCTL_STATE_QUEUE)) 1857 YYERROR; 1858 1859 memset(&a, 0, sizeof(a)); 1860 if ($3.scheduler.qtype == ALTQT_NONE) { 1861 yyerror("no scheduler specified!"); 1862 YYERROR; 1863 } 1864 a.scheduler = $3.scheduler.qtype; 1865 a.qlimit = $3.qlimit; 1866 a.tbrsize = $3.tbrsize; 1867 if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) { 1868 yyerror("no child queues specified"); 1869 YYERROR; 1870 } 1871 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1872 &$3.scheduler)) 1873 YYERROR; 1874 } 1875 ; 1876 1877 queuespec : QUEUE STRING interface queue_opts qassign { 1878 struct pf_altq a; 1879 1880 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1881 free($2); 1882 YYERROR; 1883 } 1884 1885 memset(&a, 0, sizeof(a)); 1886 1887 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1888 sizeof(a.qname)) { 1889 yyerror("queue name too long (max " 1890 "%d chars)", PF_QNAME_SIZE-1); 1891 free($2); 1892 YYERROR; 1893 } 1894 free($2); 1895 if ($4.tbrsize) { 1896 yyerror("cannot specify tbrsize for queue"); 1897 YYERROR; 1898 } 1899 if ($4.priority > 255) { 1900 yyerror("priority out of range: max 255"); 1901 YYERROR; 1902 } 1903 a.priority = $4.priority; 1904 a.qlimit = $4.qlimit; 1905 a.scheduler = $4.scheduler.qtype; 1906 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1907 &$4.scheduler)) { 1908 yyerror("errors in queue definition"); 1909 YYERROR; 1910 } 1911 } 1912 ; 1913 1914 queue_opts : { 1915 bzero(&queue_opts, sizeof queue_opts); 1916 queue_opts.priority = DEFAULT_PRIORITY; 1917 queue_opts.qlimit = DEFAULT_QLIMIT; 1918 queue_opts.scheduler.qtype = ALTQT_NONE; 1919 queue_opts.queue_bwspec.bw_percent = 100; 1920 } 1921 queue_opts_l 1922 { $$ = queue_opts; } 1923 | /* empty */ { 1924 bzero(&queue_opts, sizeof queue_opts); 1925 queue_opts.priority = DEFAULT_PRIORITY; 1926 queue_opts.qlimit = DEFAULT_QLIMIT; 1927 queue_opts.scheduler.qtype = ALTQT_NONE; 1928 queue_opts.queue_bwspec.bw_percent = 100; 1929 $$ = queue_opts; 1930 } 1931 ; 1932 1933 queue_opts_l : queue_opts_l queue_opt 1934 | queue_opt 1935 ; 1936 1937 queue_opt : BANDWIDTH bandwidth { 1938 if (queue_opts.marker & QOM_BWSPEC) { 1939 yyerror("bandwidth cannot be respecified"); 1940 YYERROR; 1941 } 1942 queue_opts.marker |= QOM_BWSPEC; 1943 queue_opts.queue_bwspec = $2; 1944 } 1945 | PRIORITY NUMBER { 1946 if (queue_opts.marker & QOM_PRIORITY) { 1947 yyerror("priority cannot be respecified"); 1948 YYERROR; 1949 } 1950 if ($2 < 0 || $2 > 255) { 1951 yyerror("priority out of range: max 255"); 1952 YYERROR; 1953 } 1954 queue_opts.marker |= QOM_PRIORITY; 1955 queue_opts.priority = $2; 1956 } 1957 | QLIMIT NUMBER { 1958 if (queue_opts.marker & QOM_QLIMIT) { 1959 yyerror("qlimit cannot be respecified"); 1960 YYERROR; 1961 } 1962 if ($2 < 0 || $2 > 65535) { 1963 yyerror("qlimit out of range: max 65535"); 1964 YYERROR; 1965 } 1966 queue_opts.marker |= QOM_QLIMIT; 1967 queue_opts.qlimit = $2; 1968 } 1969 | scheduler { 1970 if (queue_opts.marker & QOM_SCHEDULER) { 1971 yyerror("scheduler cannot be respecified"); 1972 YYERROR; 1973 } 1974 queue_opts.marker |= QOM_SCHEDULER; 1975 queue_opts.scheduler = $1; 1976 } 1977 | TBRSIZE NUMBER { 1978 if (queue_opts.marker & QOM_TBRSIZE) { 1979 yyerror("tbrsize cannot be respecified"); 1980 YYERROR; 1981 } 1982 if ($2 < 0 || $2 > UINT_MAX) { 1983 yyerror("tbrsize too big: max %u", UINT_MAX); 1984 YYERROR; 1985 } 1986 queue_opts.marker |= QOM_TBRSIZE; 1987 queue_opts.tbrsize = $2; 1988 } 1989 ; 1990 1991 bandwidth : STRING { 1992 double bps; 1993 char *cp; 1994 1995 $$.bw_percent = 0; 1996 1997 bps = strtod($1, &cp); 1998 if (cp != NULL) { 1999 if (strlen(cp) > 1) { 2000 char *cu = cp + 1; 2001 if (!strcmp(cu, "Bit") || 2002 !strcmp(cu, "B") || 2003 !strcmp(cu, "bit") || 2004 !strcmp(cu, "b")) { 2005 *cu = 0; 2006 } 2007 } 2008 if (!strcmp(cp, "b")) 2009 ; /* nothing */ 2010 else if (!strcmp(cp, "K")) 2011 bps *= 1000; 2012 else if (!strcmp(cp, "M")) 2013 bps *= 1000 * 1000; 2014 else if (!strcmp(cp, "G")) 2015 bps *= 1000 * 1000 * 1000; 2016 else if (!strcmp(cp, "%")) { 2017 if (bps < 0 || bps > 100) { 2018 yyerror("bandwidth spec " 2019 "out of range"); 2020 free($1); 2021 YYERROR; 2022 } 2023 $$.bw_percent = bps; 2024 bps = 0; 2025 } else { 2026 yyerror("unknown unit %s", cp); 2027 free($1); 2028 YYERROR; 2029 } 2030 } 2031 free($1); 2032 $$.bw_absolute = (u_int64_t)bps; 2033 } 2034 | NUMBER { 2035 if ($1 < 0 || $1 >= LLONG_MAX) { 2036 yyerror("bandwidth number too big"); 2037 YYERROR; 2038 } 2039 $$.bw_percent = 0; 2040 $$.bw_absolute = $1; 2041 } 2042 ; 2043 2044 scheduler : CBQ { 2045 $$.qtype = ALTQT_CBQ; 2046 $$.data.cbq_opts.flags = 0; 2047 } 2048 | CBQ '(' cbqflags_list ')' { 2049 $$.qtype = ALTQT_CBQ; 2050 $$.data.cbq_opts.flags = $3; 2051 } 2052 | PRIQ { 2053 $$.qtype = ALTQT_PRIQ; 2054 $$.data.priq_opts.flags = 0; 2055 } 2056 | PRIQ '(' priqflags_list ')' { 2057 $$.qtype = ALTQT_PRIQ; 2058 $$.data.priq_opts.flags = $3; 2059 } 2060 | HFSC { 2061 $$.qtype = ALTQT_HFSC; 2062 bzero(&$$.data.hfsc_opts, 2063 sizeof(struct node_hfsc_opts)); 2064 } 2065 | HFSC '(' hfsc_opts ')' { 2066 $$.qtype = ALTQT_HFSC; 2067 $$.data.hfsc_opts = $3; 2068 } 2069 | FAIRQ { 2070 $$.qtype = ALTQT_FAIRQ; 2071 bzero(&$$.data.fairq_opts, 2072 sizeof(struct node_fairq_opts)); 2073 } 2074 | FAIRQ '(' fairq_opts ')' { 2075 $$.qtype = ALTQT_FAIRQ; 2076 $$.data.fairq_opts = $3; 2077 } 2078 | CODEL { 2079 $$.qtype = ALTQT_CODEL; 2080 bzero(&$$.data.codel_opts, 2081 sizeof(struct codel_opts)); 2082 } 2083 | CODEL '(' codel_opts ')' { 2084 $$.qtype = ALTQT_CODEL; 2085 $$.data.codel_opts = $3; 2086 } 2087 ; 2088 2089 cbqflags_list : cbqflags_item { $$ |= $1; } 2090 | cbqflags_list comma cbqflags_item { $$ |= $3; } 2091 ; 2092 2093 cbqflags_item : STRING { 2094 if (!strcmp($1, "default")) 2095 $$ = CBQCLF_DEFCLASS; 2096 else if (!strcmp($1, "borrow")) 2097 $$ = CBQCLF_BORROW; 2098 else if (!strcmp($1, "red")) 2099 $$ = CBQCLF_RED; 2100 else if (!strcmp($1, "ecn")) 2101 $$ = CBQCLF_RED|CBQCLF_ECN; 2102 else if (!strcmp($1, "rio")) 2103 $$ = CBQCLF_RIO; 2104 else if (!strcmp($1, "codel")) 2105 $$ = CBQCLF_CODEL; 2106 else { 2107 yyerror("unknown cbq flag \"%s\"", $1); 2108 free($1); 2109 YYERROR; 2110 } 2111 free($1); 2112 } 2113 ; 2114 2115 priqflags_list : priqflags_item { $$ |= $1; } 2116 | priqflags_list comma priqflags_item { $$ |= $3; } 2117 ; 2118 2119 priqflags_item : STRING { 2120 if (!strcmp($1, "default")) 2121 $$ = PRCF_DEFAULTCLASS; 2122 else if (!strcmp($1, "red")) 2123 $$ = PRCF_RED; 2124 else if (!strcmp($1, "ecn")) 2125 $$ = PRCF_RED|PRCF_ECN; 2126 else if (!strcmp($1, "rio")) 2127 $$ = PRCF_RIO; 2128 else if (!strcmp($1, "codel")) 2129 $$ = PRCF_CODEL; 2130 else { 2131 yyerror("unknown priq flag \"%s\"", $1); 2132 free($1); 2133 YYERROR; 2134 } 2135 free($1); 2136 } 2137 ; 2138 2139 hfsc_opts : { 2140 bzero(&hfsc_opts, 2141 sizeof(struct node_hfsc_opts)); 2142 } 2143 hfscopts_list { 2144 $$ = hfsc_opts; 2145 } 2146 ; 2147 2148 hfscopts_list : hfscopts_item 2149 | hfscopts_list comma hfscopts_item 2150 ; 2151 2152 hfscopts_item : LINKSHARE bandwidth { 2153 if (hfsc_opts.linkshare.used) { 2154 yyerror("linkshare already specified"); 2155 YYERROR; 2156 } 2157 hfsc_opts.linkshare.m2 = $2; 2158 hfsc_opts.linkshare.used = 1; 2159 } 2160 | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')' 2161 { 2162 if ($5 < 0 || $5 > INT_MAX) { 2163 yyerror("timing in curve out of range"); 2164 YYERROR; 2165 } 2166 if (hfsc_opts.linkshare.used) { 2167 yyerror("linkshare already specified"); 2168 YYERROR; 2169 } 2170 hfsc_opts.linkshare.m1 = $3; 2171 hfsc_opts.linkshare.d = $5; 2172 hfsc_opts.linkshare.m2 = $7; 2173 hfsc_opts.linkshare.used = 1; 2174 } 2175 | REALTIME bandwidth { 2176 if (hfsc_opts.realtime.used) { 2177 yyerror("realtime already specified"); 2178 YYERROR; 2179 } 2180 hfsc_opts.realtime.m2 = $2; 2181 hfsc_opts.realtime.used = 1; 2182 } 2183 | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')' 2184 { 2185 if ($5 < 0 || $5 > INT_MAX) { 2186 yyerror("timing in curve out of range"); 2187 YYERROR; 2188 } 2189 if (hfsc_opts.realtime.used) { 2190 yyerror("realtime already specified"); 2191 YYERROR; 2192 } 2193 hfsc_opts.realtime.m1 = $3; 2194 hfsc_opts.realtime.d = $5; 2195 hfsc_opts.realtime.m2 = $7; 2196 hfsc_opts.realtime.used = 1; 2197 } 2198 | UPPERLIMIT bandwidth { 2199 if (hfsc_opts.upperlimit.used) { 2200 yyerror("upperlimit already specified"); 2201 YYERROR; 2202 } 2203 hfsc_opts.upperlimit.m2 = $2; 2204 hfsc_opts.upperlimit.used = 1; 2205 } 2206 | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')' 2207 { 2208 if ($5 < 0 || $5 > INT_MAX) { 2209 yyerror("timing in curve out of range"); 2210 YYERROR; 2211 } 2212 if (hfsc_opts.upperlimit.used) { 2213 yyerror("upperlimit already specified"); 2214 YYERROR; 2215 } 2216 hfsc_opts.upperlimit.m1 = $3; 2217 hfsc_opts.upperlimit.d = $5; 2218 hfsc_opts.upperlimit.m2 = $7; 2219 hfsc_opts.upperlimit.used = 1; 2220 } 2221 | STRING { 2222 if (!strcmp($1, "default")) 2223 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 2224 else if (!strcmp($1, "red")) 2225 hfsc_opts.flags |= HFCF_RED; 2226 else if (!strcmp($1, "ecn")) 2227 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 2228 else if (!strcmp($1, "rio")) 2229 hfsc_opts.flags |= HFCF_RIO; 2230 else if (!strcmp($1, "codel")) 2231 hfsc_opts.flags |= HFCF_CODEL; 2232 else { 2233 yyerror("unknown hfsc flag \"%s\"", $1); 2234 free($1); 2235 YYERROR; 2236 } 2237 free($1); 2238 } 2239 ; 2240 2241 fairq_opts : { 2242 bzero(&fairq_opts, 2243 sizeof(struct node_fairq_opts)); 2244 } 2245 fairqopts_list { 2246 $$ = fairq_opts; 2247 } 2248 ; 2249 2250 fairqopts_list : fairqopts_item 2251 | fairqopts_list comma fairqopts_item 2252 ; 2253 2254 fairqopts_item : LINKSHARE bandwidth { 2255 if (fairq_opts.linkshare.used) { 2256 yyerror("linkshare already specified"); 2257 YYERROR; 2258 } 2259 fairq_opts.linkshare.m2 = $2; 2260 fairq_opts.linkshare.used = 1; 2261 } 2262 | LINKSHARE '(' bandwidth number bandwidth ')' { 2263 if (fairq_opts.linkshare.used) { 2264 yyerror("linkshare already specified"); 2265 YYERROR; 2266 } 2267 fairq_opts.linkshare.m1 = $3; 2268 fairq_opts.linkshare.d = $4; 2269 fairq_opts.linkshare.m2 = $5; 2270 fairq_opts.linkshare.used = 1; 2271 } 2272 | HOGS bandwidth { 2273 fairq_opts.hogs_bw = $2; 2274 } 2275 | BUCKETS number { 2276 fairq_opts.nbuckets = $2; 2277 } 2278 | STRING { 2279 if (!strcmp($1, "default")) 2280 fairq_opts.flags |= FARF_DEFAULTCLASS; 2281 else if (!strcmp($1, "red")) 2282 fairq_opts.flags |= FARF_RED; 2283 else if (!strcmp($1, "ecn")) 2284 fairq_opts.flags |= FARF_RED|FARF_ECN; 2285 else if (!strcmp($1, "rio")) 2286 fairq_opts.flags |= FARF_RIO; 2287 else if (!strcmp($1, "codel")) 2288 fairq_opts.flags |= FARF_CODEL; 2289 else { 2290 yyerror("unknown fairq flag \"%s\"", $1); 2291 free($1); 2292 YYERROR; 2293 } 2294 free($1); 2295 } 2296 ; 2297 2298 codel_opts : { 2299 bzero(&codel_opts, 2300 sizeof(struct codel_opts)); 2301 } 2302 codelopts_list { 2303 $$ = codel_opts; 2304 } 2305 ; 2306 2307 codelopts_list : codelopts_item 2308 | codelopts_list comma codelopts_item 2309 ; 2310 2311 codelopts_item : INTERVAL number { 2312 if (codel_opts.interval) { 2313 yyerror("interval already specified"); 2314 YYERROR; 2315 } 2316 codel_opts.interval = $2; 2317 } 2318 | TARGET number { 2319 if (codel_opts.target) { 2320 yyerror("target already specified"); 2321 YYERROR; 2322 } 2323 codel_opts.target = $2; 2324 } 2325 | STRING { 2326 if (!strcmp($1, "ecn")) 2327 codel_opts.ecn = 1; 2328 else { 2329 yyerror("unknown codel option \"%s\"", $1); 2330 free($1); 2331 YYERROR; 2332 } 2333 free($1); 2334 } 2335 ; 2336 2337 qassign : /* empty */ { $$ = NULL; } 2338 | qassign_item { $$ = $1; } 2339 | '{' optnl qassign_list '}' { $$ = $3; } 2340 ; 2341 2342 qassign_list : qassign_item optnl { $$ = $1; } 2343 | qassign_list comma qassign_item optnl { 2344 $1->tail->next = $3; 2345 $1->tail = $3; 2346 $$ = $1; 2347 } 2348 ; 2349 2350 qassign_item : STRING { 2351 $$ = calloc(1, sizeof(struct node_queue)); 2352 if ($$ == NULL) 2353 err(1, "qassign_item: calloc"); 2354 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 2355 sizeof($$->queue)) { 2356 yyerror("queue name '%s' too long (max " 2357 "%d chars)", $1, sizeof($$->queue)-1); 2358 free($1); 2359 free($$); 2360 YYERROR; 2361 } 2362 free($1); 2363 $$->next = NULL; 2364 $$->tail = $$; 2365 } 2366 ; 2367 2368 pfrule : action dir logquick interface route af proto fromto 2369 filter_opts 2370 { 2371 struct pfctl_rule r; 2372 struct node_state_opt *o; 2373 struct node_proto *proto; 2374 int srctrack = 0; 2375 int statelock = 0; 2376 int adaptive = 0; 2377 int defaults = 0; 2378 2379 if (check_rulestate(PFCTL_STATE_FILTER)) 2380 YYERROR; 2381 2382 pfctl_init_rule(&r); 2383 2384 r.action = $1.b1; 2385 switch ($1.b2) { 2386 case PFRULE_RETURNRST: 2387 r.rule_flag |= PFRULE_RETURNRST; 2388 r.return_ttl = $1.w; 2389 break; 2390 case PFRULE_RETURNICMP: 2391 r.rule_flag |= PFRULE_RETURNICMP; 2392 r.return_icmp = $1.w; 2393 r.return_icmp6 = $1.w2; 2394 break; 2395 case PFRULE_RETURN: 2396 r.rule_flag |= PFRULE_RETURN; 2397 r.return_icmp = $1.w; 2398 r.return_icmp6 = $1.w2; 2399 break; 2400 } 2401 r.direction = $2; 2402 r.log = $3.log; 2403 r.logif = $3.logif; 2404 r.quick = $3.quick; 2405 r.prob = $9.prob; 2406 r.rtableid = $9.rtableid; 2407 2408 if ($9.nodf) 2409 r.scrub_flags |= PFSTATE_NODF; 2410 if ($9.randomid) 2411 r.scrub_flags |= PFSTATE_RANDOMID; 2412 if ($9.minttl) 2413 r.min_ttl = $9.minttl; 2414 if ($9.max_mss) 2415 r.max_mss = $9.max_mss; 2416 if ($9.marker & FOM_SETTOS) { 2417 r.scrub_flags |= PFSTATE_SETTOS; 2418 r.set_tos = $9.settos; 2419 } 2420 if ($9.marker & FOM_SCRUB_TCP) 2421 r.scrub_flags |= PFSTATE_SCRUB_TCP; 2422 2423 if ($9.marker & FOM_PRIO) { 2424 if ($9.prio == 0) 2425 r.prio = PF_PRIO_ZERO; 2426 else 2427 r.prio = $9.prio; 2428 } 2429 if ($9.marker & FOM_SETPRIO) { 2430 r.set_prio[0] = $9.set_prio[0]; 2431 r.set_prio[1] = $9.set_prio[1]; 2432 r.scrub_flags |= PFSTATE_SETPRIO; 2433 } 2434 2435 if ($9.marker & FOM_AFTO) 2436 r.rule_flag |= PFRULE_AFTO; 2437 2438 r.af = $6; 2439 if ($9.tag) 2440 if (strlcpy(r.tagname, $9.tag, 2441 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 2442 yyerror("tag too long, max %u chars", 2443 PF_TAG_NAME_SIZE - 1); 2444 YYERROR; 2445 } 2446 if ($9.match_tag) 2447 if (strlcpy(r.match_tagname, $9.match_tag, 2448 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 2449 yyerror("tag too long, max %u chars", 2450 PF_TAG_NAME_SIZE - 1); 2451 YYERROR; 2452 } 2453 r.match_tag_not = $9.match_tag_not; 2454 if (rule_label(&r, $9.label)) 2455 YYERROR; 2456 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) 2457 free($9.label[i]); 2458 r.ridentifier = $9.ridentifier; 2459 r.flags = $9.flags.b1; 2460 r.flagset = $9.flags.b2; 2461 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 2462 yyerror("flags always false"); 2463 YYERROR; 2464 } 2465 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 2466 for (proto = $7; proto != NULL && 2467 proto->proto != IPPROTO_TCP; 2468 proto = proto->next) 2469 ; /* nothing */ 2470 if (proto == NULL && $7 != NULL) { 2471 if ($9.flags.b1 || $9.flags.b2) 2472 yyerror( 2473 "flags only apply to tcp"); 2474 if ($8.src_os) 2475 yyerror( 2476 "OS fingerprinting only " 2477 "apply to tcp"); 2478 YYERROR; 2479 } 2480 #if 0 2481 if (($9.flags.b1 & parse_flags("S")) == 0 && 2482 $8.src_os) { 2483 yyerror("OS fingerprinting requires " 2484 "the SYN TCP flag (flags S/SA)"); 2485 YYERROR; 2486 } 2487 #endif 2488 } 2489 2490 r.tos = $9.tos; 2491 r.keep_state = $9.keep.action; 2492 o = $9.keep.options; 2493 2494 /* 'keep state' by default on pass rules. */ 2495 if (!r.keep_state && !r.action && 2496 !($9.marker & FOM_KEEP)) { 2497 r.keep_state = PF_STATE_NORMAL; 2498 o = keep_state_defaults; 2499 defaults = 1; 2500 } 2501 2502 while (o) { 2503 struct node_state_opt *p = o; 2504 2505 switch (o->type) { 2506 case PF_STATE_OPT_MAX: 2507 if (r.max_states) { 2508 yyerror("state option 'max' " 2509 "multiple definitions"); 2510 YYERROR; 2511 } 2512 r.max_states = o->data.max_states; 2513 break; 2514 case PF_STATE_OPT_NOSYNC: 2515 if (r.rule_flag & PFRULE_NOSYNC) { 2516 yyerror("state option 'sync' " 2517 "multiple definitions"); 2518 YYERROR; 2519 } 2520 r.rule_flag |= PFRULE_NOSYNC; 2521 break; 2522 case PF_STATE_OPT_SRCTRACK: 2523 if (srctrack) { 2524 yyerror("state option " 2525 "'source-track' " 2526 "multiple definitions"); 2527 YYERROR; 2528 } 2529 srctrack = o->data.src_track; 2530 r.rule_flag |= PFRULE_SRCTRACK; 2531 break; 2532 case PF_STATE_OPT_MAX_SRC_STATES: 2533 if (r.max_src_states) { 2534 yyerror("state option " 2535 "'max-src-states' " 2536 "multiple definitions"); 2537 YYERROR; 2538 } 2539 if (o->data.max_src_states == 0) { 2540 yyerror("'max-src-states' must " 2541 "be > 0"); 2542 YYERROR; 2543 } 2544 r.max_src_states = 2545 o->data.max_src_states; 2546 r.rule_flag |= PFRULE_SRCTRACK; 2547 break; 2548 case PF_STATE_OPT_OVERLOAD: 2549 if (r.overload_tblname[0]) { 2550 yyerror("multiple 'overload' " 2551 "table definitions"); 2552 YYERROR; 2553 } 2554 if (strlcpy(r.overload_tblname, 2555 o->data.overload.tblname, 2556 PF_TABLE_NAME_SIZE) >= 2557 PF_TABLE_NAME_SIZE) { 2558 yyerror("state option: " 2559 "strlcpy"); 2560 YYERROR; 2561 } 2562 r.flush = o->data.overload.flush; 2563 break; 2564 case PF_STATE_OPT_MAX_SRC_CONN: 2565 if (r.max_src_conn) { 2566 yyerror("state option " 2567 "'max-src-conn' " 2568 "multiple definitions"); 2569 YYERROR; 2570 } 2571 if (o->data.max_src_conn == 0) { 2572 yyerror("'max-src-conn' " 2573 "must be > 0"); 2574 YYERROR; 2575 } 2576 r.max_src_conn = 2577 o->data.max_src_conn; 2578 r.rule_flag |= PFRULE_SRCTRACK | 2579 PFRULE_RULESRCTRACK; 2580 break; 2581 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 2582 if (r.max_src_conn_rate.limit) { 2583 yyerror("state option " 2584 "'max-src-conn-rate' " 2585 "multiple definitions"); 2586 YYERROR; 2587 } 2588 if (!o->data.max_src_conn_rate.limit || 2589 !o->data.max_src_conn_rate.seconds) { 2590 yyerror("'max-src-conn-rate' " 2591 "values must be > 0"); 2592 YYERROR; 2593 } 2594 if (o->data.max_src_conn_rate.limit > 2595 PF_THRESHOLD_MAX) { 2596 yyerror("'max-src-conn-rate' " 2597 "maximum rate must be < %u", 2598 PF_THRESHOLD_MAX); 2599 YYERROR; 2600 } 2601 r.max_src_conn_rate.limit = 2602 o->data.max_src_conn_rate.limit; 2603 r.max_src_conn_rate.seconds = 2604 o->data.max_src_conn_rate.seconds; 2605 r.rule_flag |= PFRULE_SRCTRACK | 2606 PFRULE_RULESRCTRACK; 2607 break; 2608 case PF_STATE_OPT_MAX_SRC_NODES: 2609 if (r.max_src_nodes) { 2610 yyerror("state option " 2611 "'max-src-nodes' " 2612 "multiple definitions"); 2613 YYERROR; 2614 } 2615 if (o->data.max_src_nodes == 0) { 2616 yyerror("'max-src-nodes' must " 2617 "be > 0"); 2618 YYERROR; 2619 } 2620 r.max_src_nodes = 2621 o->data.max_src_nodes; 2622 r.rule_flag |= PFRULE_SRCTRACK | 2623 PFRULE_RULESRCTRACK; 2624 break; 2625 case PF_STATE_OPT_STATELOCK: 2626 if (statelock) { 2627 yyerror("state locking option: " 2628 "multiple definitions"); 2629 YYERROR; 2630 } 2631 statelock = 1; 2632 r.rule_flag |= o->data.statelock; 2633 break; 2634 case PF_STATE_OPT_SLOPPY: 2635 if (r.rule_flag & PFRULE_STATESLOPPY) { 2636 yyerror("state sloppy option: " 2637 "multiple definitions"); 2638 YYERROR; 2639 } 2640 r.rule_flag |= PFRULE_STATESLOPPY; 2641 break; 2642 case PF_STATE_OPT_PFLOW: 2643 if (r.rule_flag & PFRULE_PFLOW) { 2644 yyerror("state pflow option: " 2645 "multiple definitions"); 2646 YYERROR; 2647 } 2648 r.rule_flag |= PFRULE_PFLOW; 2649 break; 2650 case PF_STATE_OPT_ALLOW_RELATED: 2651 if (r.rule_flag & PFRULE_ALLOW_RELATED) { 2652 yyerror("state allow-related option: " 2653 "multiple definitions"); 2654 YYERROR; 2655 } 2656 r.rule_flag |= PFRULE_ALLOW_RELATED; 2657 break; 2658 case PF_STATE_OPT_TIMEOUT: 2659 if (o->data.timeout.number == 2660 PFTM_ADAPTIVE_START || 2661 o->data.timeout.number == 2662 PFTM_ADAPTIVE_END) 2663 adaptive = 1; 2664 if (r.timeout[o->data.timeout.number]) { 2665 yyerror("state timeout %s " 2666 "multiple definitions", 2667 pf_timeouts[o->data. 2668 timeout.number].name); 2669 YYERROR; 2670 } 2671 r.timeout[o->data.timeout.number] = 2672 o->data.timeout.seconds; 2673 } 2674 o = o->next; 2675 if (!defaults) 2676 free(p); 2677 } 2678 2679 /* 'flags S/SA' by default on stateful rules */ 2680 if (!r.action && !r.flags && !r.flagset && 2681 !$9.fragment && !($9.marker & FOM_FLAGS) && 2682 r.keep_state) { 2683 r.flags = parse_flags("S"); 2684 r.flagset = parse_flags("SA"); 2685 } 2686 if (!adaptive && r.max_states) { 2687 r.timeout[PFTM_ADAPTIVE_START] = 2688 (r.max_states / 10) * 6; 2689 r.timeout[PFTM_ADAPTIVE_END] = 2690 (r.max_states / 10) * 12; 2691 } 2692 if (r.rule_flag & PFRULE_SRCTRACK) { 2693 if (srctrack == PF_SRCTRACK_GLOBAL && 2694 r.max_src_nodes) { 2695 yyerror("'max-src-nodes' is " 2696 "incompatible with " 2697 "'source-track global'"); 2698 YYERROR; 2699 } 2700 if (srctrack == PF_SRCTRACK_GLOBAL && 2701 r.max_src_conn) { 2702 yyerror("'max-src-conn' is " 2703 "incompatible with " 2704 "'source-track global'"); 2705 YYERROR; 2706 } 2707 if (srctrack == PF_SRCTRACK_GLOBAL && 2708 r.max_src_conn_rate.seconds) { 2709 yyerror("'max-src-conn-rate' is " 2710 "incompatible with " 2711 "'source-track global'"); 2712 YYERROR; 2713 } 2714 if (r.timeout[PFTM_SRC_NODE] < 2715 r.max_src_conn_rate.seconds) 2716 r.timeout[PFTM_SRC_NODE] = 2717 r.max_src_conn_rate.seconds; 2718 r.rule_flag |= PFRULE_SRCTRACK; 2719 if (srctrack == PF_SRCTRACK_RULE) 2720 r.rule_flag |= PFRULE_RULESRCTRACK; 2721 } 2722 if (r.keep_state && !statelock) 2723 r.rule_flag |= default_statelock; 2724 2725 if ($9.fragment) 2726 r.rule_flag |= PFRULE_FRAGMENT; 2727 r.allow_opts = $9.allowopts; 2728 2729 decide_address_family($8.src.host, &r.af); 2730 decide_address_family($8.dst.host, &r.af); 2731 2732 if ($5.rt) { 2733 if (!r.direction) { 2734 yyerror("direction must be explicit " 2735 "with rules that specify routing"); 2736 YYERROR; 2737 } 2738 r.rt = $5.rt; 2739 decide_address_family($5.redirspec->host, &r.af); 2740 if (!(r.rule_flag & PFRULE_AFTO)) 2741 remove_invalid_hosts(&($5.redirspec->host), &r.af); 2742 if ($5.redirspec->host == NULL) { 2743 yyerror("no routing address with " 2744 "matching address family found."); 2745 YYERROR; 2746 } 2747 } 2748 if ($9.queues.qname != NULL) { 2749 if (strlcpy(r.qname, $9.queues.qname, 2750 sizeof(r.qname)) >= sizeof(r.qname)) { 2751 yyerror("rule qname too long (max " 2752 "%d chars)", sizeof(r.qname)-1); 2753 YYERROR; 2754 } 2755 free($9.queues.qname); 2756 } 2757 if ($9.queues.pqname != NULL) { 2758 if (strlcpy(r.pqname, $9.queues.pqname, 2759 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2760 yyerror("rule pqname too long (max " 2761 "%d chars)", sizeof(r.pqname)-1); 2762 YYERROR; 2763 } 2764 free($9.queues.pqname); 2765 } 2766 #ifdef __FreeBSD__ 2767 r.divert.port = $9.divert.port; 2768 #else 2769 if ((r.divert.port = $9.divert.port)) { 2770 if (r.direction == PF_OUT) { 2771 if ($9.divert.addr) { 2772 yyerror("address specified " 2773 "for outgoing divert"); 2774 YYERROR; 2775 } 2776 bzero(&r.divert.addr, 2777 sizeof(r.divert.addr)); 2778 } else { 2779 if (!$9.divert.addr) { 2780 yyerror("no address specified " 2781 "for incoming divert"); 2782 YYERROR; 2783 } 2784 if ($9.divert.addr->af != r.af) { 2785 yyerror("address family " 2786 "mismatch for divert"); 2787 YYERROR; 2788 } 2789 r.divert.addr = 2790 $9.divert.addr->addr.v.a.addr; 2791 } 2792 } 2793 #endif 2794 2795 if ($9.dnpipe || $9.dnrpipe) { 2796 r.dnpipe = $9.dnpipe; 2797 r.dnrpipe = $9.dnrpipe; 2798 if ($9.free_flags & PFRULE_DN_IS_PIPE) 2799 r.free_flags |= PFRULE_DN_IS_PIPE; 2800 else 2801 r.free_flags |= PFRULE_DN_IS_QUEUE; 2802 } 2803 2804 if ($9.marker & FOM_AFTO) { 2805 r.naf = $9.nat->af; 2806 } else { 2807 if ($9.nat) { 2808 if (!r.af && ! $9.nat->host->ifindex) 2809 r.af = $9.nat->host->af; 2810 remove_invalid_hosts(&($9.nat->host), &r.af); 2811 if (invalid_redirect($9.nat->host, r.af)) 2812 YYERROR; 2813 if ($9.nat->host->addr.type == PF_ADDR_DYNIFTL) { 2814 if (($9.nat->host = gen_dynnode($9.nat->host, r.af)) == NULL) 2815 err(1, "calloc"); 2816 } 2817 if (check_netmask($9.nat->host, r.af)) 2818 YYERROR; 2819 } 2820 if ($9.rdr) { 2821 if (!r.af && ! $9.rdr->host->ifindex) 2822 r.af = $9.rdr->host->af; 2823 remove_invalid_hosts(&($9.rdr->host), &r.af); 2824 if (invalid_redirect($9.rdr->host, r.af)) 2825 YYERROR; 2826 if ($9.rdr->host->addr.type == PF_ADDR_DYNIFTL) { 2827 if (($9.rdr->host = gen_dynnode($9.rdr->host, r.af)) == NULL) 2828 err(1, "calloc"); 2829 } 2830 if (check_netmask($9.rdr->host, r.af)) 2831 YYERROR; 2832 } 2833 } 2834 2835 expand_rule(&r, false, $4, $9.nat, $9.rdr, $5.redirspec, 2836 $7, $8.src_os, $8.src.host, $8.src.port, $8.dst.host, 2837 $8.dst.port, $9.uid, $9.gid, $9.rcv, $9.icmpspec, ""); 2838 } 2839 ; 2840 2841 filter_opts : { 2842 bzero(&filter_opts, sizeof filter_opts); 2843 filter_opts.rtableid = -1; 2844 } 2845 filter_opts_l 2846 { $$ = filter_opts; } 2847 | /* empty */ { 2848 bzero(&filter_opts, sizeof filter_opts); 2849 filter_opts.rtableid = -1; 2850 $$ = filter_opts; 2851 } 2852 ; 2853 2854 filter_opts_l : filter_opts_l filter_opt 2855 | filter_opt 2856 ; 2857 2858 filter_opt : USER uids { 2859 if (filter_opts.uid) 2860 $2->tail->next = filter_opts.uid; 2861 filter_opts.uid = $2; 2862 } 2863 | GROUP gids { 2864 if (filter_opts.gid) 2865 $2->tail->next = filter_opts.gid; 2866 filter_opts.gid = $2; 2867 } 2868 | flags { 2869 if (filter_opts.marker & FOM_FLAGS) { 2870 yyerror("flags cannot be redefined"); 2871 YYERROR; 2872 } 2873 filter_opts.marker |= FOM_FLAGS; 2874 filter_opts.flags.b1 |= $1.b1; 2875 filter_opts.flags.b2 |= $1.b2; 2876 filter_opts.flags.w |= $1.w; 2877 filter_opts.flags.w2 |= $1.w2; 2878 } 2879 | icmpspec { 2880 if (filter_opts.marker & FOM_ICMP) { 2881 yyerror("icmp-type cannot be redefined"); 2882 YYERROR; 2883 } 2884 filter_opts.marker |= FOM_ICMP; 2885 filter_opts.icmpspec = $1; 2886 } 2887 | PRIO NUMBER { 2888 if (filter_opts.marker & FOM_PRIO) { 2889 yyerror("prio cannot be redefined"); 2890 YYERROR; 2891 } 2892 if ($2 < 0 || $2 > PF_PRIO_MAX) { 2893 yyerror("prio must be 0 - %u", PF_PRIO_MAX); 2894 YYERROR; 2895 } 2896 filter_opts.marker |= FOM_PRIO; 2897 filter_opts.prio = $2; 2898 } 2899 | TOS tos { 2900 if (filter_opts.marker & FOM_TOS) { 2901 yyerror("tos cannot be redefined"); 2902 YYERROR; 2903 } 2904 filter_opts.marker |= FOM_TOS; 2905 filter_opts.tos = $2; 2906 } 2907 | keep { 2908 if (filter_opts.marker & FOM_KEEP) { 2909 yyerror("modulate or keep cannot be redefined"); 2910 YYERROR; 2911 } 2912 filter_opts.marker |= FOM_KEEP; 2913 filter_opts.keep.action = $1.action; 2914 filter_opts.keep.options = $1.options; 2915 } 2916 | RIDENTIFIER number { 2917 filter_opts.ridentifier = $2; 2918 } 2919 | FRAGMENT { 2920 filter_opts.fragment = 1; 2921 } 2922 | ALLOWOPTS { 2923 filter_opts.allowopts = 1; 2924 } 2925 | label { 2926 if (filter_opts.labelcount >= PF_RULE_MAX_LABEL_COUNT) { 2927 yyerror("label can only be used %d times", PF_RULE_MAX_LABEL_COUNT); 2928 YYERROR; 2929 } 2930 filter_opts.label[filter_opts.labelcount++] = $1; 2931 } 2932 | qname { 2933 if (filter_opts.queues.qname) { 2934 yyerror("queue cannot be redefined"); 2935 YYERROR; 2936 } 2937 filter_opts.queues = $1; 2938 } 2939 | DNPIPE number { 2940 filter_opts.dnpipe = $2; 2941 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 2942 } 2943 | DNPIPE '(' number ')' { 2944 filter_opts.dnpipe = $3; 2945 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 2946 } 2947 | DNPIPE '(' number comma number ')' { 2948 filter_opts.dnrpipe = $5; 2949 filter_opts.dnpipe = $3; 2950 filter_opts.free_flags |= PFRULE_DN_IS_PIPE; 2951 } 2952 | DNQUEUE number { 2953 filter_opts.dnpipe = $2; 2954 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 2955 } 2956 | DNQUEUE '(' number comma number ')' { 2957 filter_opts.dnrpipe = $5; 2958 filter_opts.dnpipe = $3; 2959 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 2960 } 2961 | DNQUEUE '(' number ')' { 2962 filter_opts.dnpipe = $3; 2963 filter_opts.free_flags |= PFRULE_DN_IS_QUEUE; 2964 } 2965 | TAG string { 2966 filter_opts.tag = $2; 2967 } 2968 | not TAGGED string { 2969 filter_opts.match_tag = $3; 2970 filter_opts.match_tag_not = $1; 2971 } 2972 | not RECEIVEDON if_item { 2973 if (filter_opts.rcv) { 2974 yyerror("cannot respecify received-on"); 2975 YYERROR; 2976 } 2977 filter_opts.rcv = $3; 2978 filter_opts.rcv->not = $1; 2979 } 2980 | PROBABILITY probability { 2981 double p; 2982 2983 p = floor($2 * UINT_MAX + 0.5); 2984 if (p < 0.0 || p > UINT_MAX) { 2985 yyerror("invalid probability: %lf", p); 2986 YYERROR; 2987 } 2988 filter_opts.prob = (u_int32_t)p; 2989 if (filter_opts.prob == 0) 2990 filter_opts.prob = 1; 2991 } 2992 | RTABLE NUMBER { 2993 if ($2 < 0 || $2 > rt_tableid_max()) { 2994 yyerror("invalid rtable id"); 2995 YYERROR; 2996 } 2997 filter_opts.rtableid = $2; 2998 } 2999 | DIVERTTO portplain { 3000 #ifdef __FreeBSD__ 3001 filter_opts.divert.port = $2.a; 3002 if (!filter_opts.divert.port) { 3003 yyerror("invalid divert port: %u", ntohs($2.a)); 3004 YYERROR; 3005 } 3006 #endif 3007 } 3008 | DIVERTTO STRING PORT portplain { 3009 #ifndef __FreeBSD__ 3010 if ((filter_opts.divert.addr = host($2, pf->opts)) == NULL) { 3011 yyerror("could not parse divert address: %s", 3012 $2); 3013 free($2); 3014 YYERROR; 3015 } 3016 #else 3017 if ($2) 3018 #endif 3019 free($2); 3020 filter_opts.divert.port = $4.a; 3021 if (!filter_opts.divert.port) { 3022 yyerror("invalid divert port: %u", ntohs($4.a)); 3023 YYERROR; 3024 } 3025 } 3026 | DIVERTREPLY { 3027 #ifdef __FreeBSD__ 3028 yyerror("divert-reply has no meaning in FreeBSD pf(4)"); 3029 YYERROR; 3030 #else 3031 filter_opts.divert.port = 1; /* some random value */ 3032 #endif 3033 } 3034 | SCRUB '(' scrub_opts ')' { 3035 filter_opts.nodf = $3.nodf; 3036 filter_opts.minttl = $3.minttl; 3037 if ($3.marker & FOM_SETTOS) { 3038 /* Old style rules are "scrub set-tos 0x42" 3039 * New style are "set tos 0x42 scrub (...)" 3040 * What is in "scrub(...)"" is unfortunately the 3041 * original scrub syntax so it would overwrite 3042 * "set tos" of a pass/match rule. 3043 */ 3044 filter_opts.settos = $3.settos; 3045 } 3046 filter_opts.randomid = $3.randomid; 3047 filter_opts.max_mss = $3.maxmss; 3048 if ($3.reassemble_tcp) 3049 filter_opts.marker |= FOM_SCRUB_TCP; 3050 filter_opts.marker |= $3.marker; 3051 } 3052 | NATTO port_redirspec { 3053 if (filter_opts.nat) { 3054 yyerror("cannot respecify nat-to/binat-to"); 3055 YYERROR; 3056 } 3057 filter_opts.nat = $2; 3058 } 3059 | RDRTO port_redirspec { 3060 if (filter_opts.rdr) { 3061 yyerror("cannot respecify rdr-to"); 3062 YYERROR; 3063 } 3064 filter_opts.rdr = $2; 3065 } 3066 | BINATTO port_redirspec { 3067 if (filter_opts.nat) { 3068 yyerror("cannot respecify nat-to/binat-to"); 3069 YYERROR; 3070 } 3071 filter_opts.nat = $2; 3072 filter_opts.nat->binat = 1; 3073 filter_opts.nat->pool_opts.staticport = 1; 3074 } 3075 | AFTO af FROM port_redirspec { 3076 if (filter_opts.nat) { 3077 yyerror("cannot respecify af-to"); 3078 YYERROR; 3079 } 3080 if ($2 == 0) { 3081 yyerror("no address family specified"); 3082 YYERROR; 3083 } 3084 3085 filter_opts.nat = $4; 3086 filter_opts.nat->af = $2; 3087 if ($4->af && $4->af != $2) { 3088 yyerror("af-to addresses must be in the " 3089 "target address family"); 3090 YYERROR; 3091 } 3092 filter_opts.marker |= FOM_AFTO; 3093 } 3094 | AFTO af FROM port_redirspec TO port_redirspec { 3095 if (filter_opts.nat) { 3096 yyerror("cannot respecify af-to"); 3097 YYERROR; 3098 } 3099 if ($2 == 0) { 3100 yyerror("no address family specified"); 3101 YYERROR; 3102 } 3103 filter_opts.nat = $4; 3104 filter_opts.nat->af = $2; 3105 filter_opts.rdr = $6; 3106 filter_opts.rdr->af = $2; 3107 if (($4->af && $4->host->af != $2) || 3108 ($6->af && $6->host->af != $2)) { 3109 yyerror("af-to addresses must be in the " 3110 "target address family"); 3111 YYERROR; 3112 } 3113 filter_opts.marker |= FOM_AFTO; 3114 } 3115 | filter_sets 3116 ; 3117 3118 filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; } 3119 | SET filter_set { $$ = filter_opts; } 3120 ; 3121 3122 filter_sets_l : filter_sets_l comma filter_set 3123 | filter_set 3124 ; 3125 3126 filter_set : prio { 3127 if (filter_opts.marker & FOM_SETPRIO) { 3128 yyerror("prio cannot be redefined"); 3129 YYERROR; 3130 } 3131 filter_opts.marker |= FOM_SETPRIO; 3132 filter_opts.set_prio[0] = $1.b1; 3133 filter_opts.set_prio[1] = $1.b2; 3134 } 3135 | TOS tos { 3136 if (filter_opts.marker & FOM_SETTOS) { 3137 yyerror("tos cannot be respecified"); 3138 YYERROR; 3139 } 3140 filter_opts.marker |= FOM_SETTOS; 3141 filter_opts.settos = $2; 3142 } 3143 prio : PRIO NUMBER { 3144 if ($2 < 0 || $2 > PF_PRIO_MAX) { 3145 yyerror("prio must be 0 - %u", PF_PRIO_MAX); 3146 YYERROR; 3147 } 3148 $$.b1 = $$.b2 = $2; 3149 } 3150 | PRIO '(' NUMBER comma NUMBER ')' { 3151 if ($3 < 0 || $3 > PF_PRIO_MAX || 3152 $5 < 0 || $5 > PF_PRIO_MAX) { 3153 yyerror("prio must be 0 - %u", PF_PRIO_MAX); 3154 YYERROR; 3155 } 3156 $$.b1 = $3; 3157 $$.b2 = $5; 3158 } 3159 ; 3160 3161 probability : STRING { 3162 char *e; 3163 double p = strtod($1, &e); 3164 3165 if (*e == '%') { 3166 p *= 0.01; 3167 e++; 3168 } 3169 if (*e) { 3170 yyerror("invalid probability: %s", $1); 3171 free($1); 3172 YYERROR; 3173 } 3174 free($1); 3175 $$ = p; 3176 } 3177 | NUMBER { 3178 $$ = (double)$1; 3179 } 3180 ; 3181 3182 3183 action : PASS { 3184 $$.b1 = PF_PASS; 3185 $$.b2 = failpolicy; 3186 $$.w = returnicmpdefault; 3187 $$.w2 = returnicmp6default; 3188 } 3189 | MATCH { $$.b1 = PF_MATCH; $$.b2 = $$.w = 0; } 3190 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 3191 ; 3192 3193 blockspec : /* empty */ { 3194 $$.b2 = blockpolicy; 3195 $$.w = returnicmpdefault; 3196 $$.w2 = returnicmp6default; 3197 } 3198 | DROP { 3199 $$.b2 = PFRULE_DROP; 3200 $$.w = 0; 3201 $$.w2 = 0; 3202 } 3203 | RETURNRST { 3204 $$.b2 = PFRULE_RETURNRST; 3205 $$.w = 0; 3206 $$.w2 = 0; 3207 } 3208 | RETURNRST '(' TTL NUMBER ')' { 3209 if ($4 < 0 || $4 > 255) { 3210 yyerror("illegal ttl value %d", $4); 3211 YYERROR; 3212 } 3213 $$.b2 = PFRULE_RETURNRST; 3214 $$.w = $4; 3215 $$.w2 = 0; 3216 } 3217 | RETURNICMP { 3218 $$.b2 = PFRULE_RETURNICMP; 3219 $$.w = returnicmpdefault; 3220 $$.w2 = returnicmp6default; 3221 } 3222 | RETURNICMP6 { 3223 $$.b2 = PFRULE_RETURNICMP; 3224 $$.w = returnicmpdefault; 3225 $$.w2 = returnicmp6default; 3226 } 3227 | RETURNICMP '(' reticmpspec ')' { 3228 $$.b2 = PFRULE_RETURNICMP; 3229 $$.w = $3; 3230 $$.w2 = returnicmpdefault; 3231 } 3232 | RETURNICMP6 '(' reticmp6spec ')' { 3233 $$.b2 = PFRULE_RETURNICMP; 3234 $$.w = returnicmpdefault; 3235 $$.w2 = $3; 3236 } 3237 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' { 3238 $$.b2 = PFRULE_RETURNICMP; 3239 $$.w = $3; 3240 $$.w2 = $5; 3241 } 3242 | RETURN { 3243 $$.b2 = PFRULE_RETURN; 3244 $$.w = returnicmpdefault; 3245 $$.w2 = returnicmp6default; 3246 } 3247 ; 3248 3249 reticmpspec : STRING { 3250 if (!($$ = parseicmpspec($1, AF_INET))) { 3251 free($1); 3252 YYERROR; 3253 } 3254 free($1); 3255 } 3256 | NUMBER { 3257 u_int8_t icmptype; 3258 3259 if ($1 < 0 || $1 > 255) { 3260 yyerror("invalid icmp code %lu", $1); 3261 YYERROR; 3262 } 3263 icmptype = returnicmpdefault >> 8; 3264 $$ = (icmptype << 8 | $1); 3265 } 3266 ; 3267 3268 reticmp6spec : STRING { 3269 if (!($$ = parseicmpspec($1, AF_INET6))) { 3270 free($1); 3271 YYERROR; 3272 } 3273 free($1); 3274 } 3275 | NUMBER { 3276 u_int8_t icmptype; 3277 3278 if ($1 < 0 || $1 > 255) { 3279 yyerror("invalid icmp code %lu", $1); 3280 YYERROR; 3281 } 3282 icmptype = returnicmp6default >> 8; 3283 $$ = (icmptype << 8 | $1); 3284 } 3285 ; 3286 3287 dir : /* empty */ { $$ = PF_INOUT; } 3288 | IN { $$ = PF_IN; } 3289 | OUT { $$ = PF_OUT; } 3290 ; 3291 3292 quick : /* empty */ { $$.quick = 0; } 3293 | QUICK { $$.quick = 1; } 3294 ; 3295 3296 logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 3297 | log { $$ = $1; $$.quick = 0; } 3298 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 3299 | log QUICK { $$ = $1; $$.quick = 1; } 3300 | QUICK log { $$ = $2; $$.quick = 1; } 3301 ; 3302 3303 log : LOG { $$.log = PF_LOG; $$.logif = 0; } 3304 | LOG '(' logopts ')' { 3305 $$.log = PF_LOG | $3.log; 3306 $$.logif = $3.logif; 3307 } 3308 ; 3309 3310 logopts : logopt { $$ = $1; } 3311 | logopts comma logopt { 3312 $$.log = $1.log | $3.log; 3313 $$.logif = $3.logif; 3314 if ($$.logif == 0) 3315 $$.logif = $1.logif; 3316 } 3317 ; 3318 3319 logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 3320 | MATCHES { $$.log = PF_LOG_MATCHES; $$.logif = 0; } 3321 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 3322 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 3323 | TO string { 3324 const char *errstr; 3325 u_int i; 3326 3327 $$.log = 0; 3328 if (strncmp($2, "pflog", 5)) { 3329 yyerror("%s: should be a pflog interface", $2); 3330 free($2); 3331 YYERROR; 3332 } 3333 i = strtonum($2 + 5, 0, 255, &errstr); 3334 if (errstr) { 3335 yyerror("%s: %s", $2, errstr); 3336 free($2); 3337 YYERROR; 3338 } 3339 free($2); 3340 $$.logif = i; 3341 } 3342 ; 3343 3344 interface : /* empty */ { $$ = NULL; } 3345 | ON if_item_not { $$ = $2; } 3346 | ON '{' optnl if_list '}' { $$ = $4; } 3347 ; 3348 3349 if_list : if_item_not optnl { $$ = $1; } 3350 | if_list comma if_item_not optnl { 3351 $1->tail->next = $3; 3352 $1->tail = $3; 3353 $$ = $1; 3354 } 3355 ; 3356 3357 if_item_not : not if_item { $$ = $2; $$->not = $1; } 3358 ; 3359 3360 if_item : STRING { 3361 struct node_host *n; 3362 3363 $$ = calloc(1, sizeof(struct node_if)); 3364 if ($$ == NULL) 3365 err(1, "if_item: calloc"); 3366 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 3367 sizeof($$->ifname)) { 3368 free($1); 3369 free($$); 3370 yyerror("interface name too long"); 3371 YYERROR; 3372 } 3373 3374 if ((n = ifa_exists($1)) != NULL) 3375 $$->ifa_flags = n->ifa_flags; 3376 3377 free($1); 3378 $$->not = 0; 3379 $$->next = NULL; 3380 $$->tail = $$; 3381 } 3382 | ANY { 3383 $$ = calloc(1, sizeof(struct node_if)); 3384 if ($$ == NULL) 3385 err(1, "if_item: calloc"); 3386 strlcpy($$->ifname, "any", sizeof($$->ifname)); 3387 $$->not = 0; 3388 $$->next = NULL; 3389 $$->tail = $$; 3390 } 3391 ; 3392 3393 af : /* empty */ { $$ = 0; } 3394 | INET { $$ = AF_INET; } 3395 | INET6 { $$ = AF_INET6; } 3396 ; 3397 3398 etherproto : /* empty */ { $$ = NULL; } 3399 | PROTO etherproto_item { $$ = $2; } 3400 | PROTO '{' optnl etherproto_list '}' { $$ = $4; } 3401 ; 3402 3403 etherproto_list : etherproto_item optnl { $$ = $1; } 3404 | etherproto_list comma etherproto_item optnl { 3405 $1->tail->next = $3; 3406 $1->tail = $3; 3407 $$ = $1; 3408 } 3409 ; 3410 3411 etherproto_item : etherprotoval { 3412 u_int16_t pr; 3413 3414 pr = (u_int16_t)$1; 3415 if (pr == 0) { 3416 yyerror("proto 0 cannot be used"); 3417 YYERROR; 3418 } 3419 $$ = calloc(1, sizeof(struct node_proto)); 3420 if ($$ == NULL) 3421 err(1, "proto_item: calloc"); 3422 $$->proto = pr; 3423 $$->next = NULL; 3424 $$->tail = $$; 3425 } 3426 ; 3427 3428 etherprotoval : NUMBER { 3429 if ($1 < 0 || $1 > 65565) { 3430 yyerror("protocol outside range"); 3431 YYERROR; 3432 } 3433 } 3434 | STRING 3435 { 3436 if (!strncmp($1, "0x", 2)) { 3437 if (sscanf($1, "0x%4x", &$$) != 1) { 3438 free($1); 3439 yyerror("invalid EtherType hex"); 3440 YYERROR; 3441 } 3442 } else { 3443 yyerror("Symbolic EtherType not yet supported"); 3444 } 3445 } 3446 ; 3447 3448 proto : /* empty */ { $$ = NULL; } 3449 | PROTO proto_item { $$ = $2; } 3450 | PROTO '{' optnl proto_list '}' { $$ = $4; } 3451 ; 3452 3453 proto_list : proto_item optnl { $$ = $1; } 3454 | proto_list comma proto_item optnl { 3455 $1->tail->next = $3; 3456 $1->tail = $3; 3457 $$ = $1; 3458 } 3459 ; 3460 3461 proto_item : protoval { 3462 u_int8_t pr; 3463 3464 pr = (u_int8_t)$1; 3465 if (pr == 0) { 3466 yyerror("proto 0 cannot be used"); 3467 YYERROR; 3468 } 3469 $$ = calloc(1, sizeof(struct node_proto)); 3470 if ($$ == NULL) 3471 err(1, "proto_item: calloc"); 3472 $$->proto = pr; 3473 $$->next = NULL; 3474 $$->tail = $$; 3475 } 3476 ; 3477 3478 protoval : STRING { 3479 struct protoent *p; 3480 3481 p = getprotobyname($1); 3482 if (p == NULL) { 3483 yyerror("unknown protocol %s", $1); 3484 free($1); 3485 YYERROR; 3486 } 3487 $$ = p->p_proto; 3488 free($1); 3489 } 3490 | NUMBER { 3491 if ($1 < 0 || $1 > 255) { 3492 yyerror("protocol outside range"); 3493 YYERROR; 3494 } 3495 } 3496 ; 3497 3498 l3fromto : /* empty */ { 3499 bzero(&$$, sizeof($$)); 3500 } 3501 | L3 fromto { 3502 if ($2.src.host != NULL && 3503 $2.src.host->addr.type != PF_ADDR_ADDRMASK && 3504 $2.src.host->addr.type != PF_ADDR_TABLE) { 3505 yyerror("from must be an address or table"); 3506 YYERROR; 3507 } 3508 if ($2.dst.host != NULL && 3509 $2.dst.host->addr.type != PF_ADDR_ADDRMASK && 3510 $2.dst.host->addr.type != PF_ADDR_TABLE) { 3511 yyerror("to must be an address or table"); 3512 YYERROR; 3513 } 3514 $$ = $2; 3515 } 3516 ; 3517 etherfromto : ALL { 3518 $$.src = NULL; 3519 $$.dst = NULL; 3520 } 3521 | etherfrom etherto { 3522 $$.src = $1.mac; 3523 $$.dst = $2.mac; 3524 } 3525 ; 3526 3527 etherfrom : /* emtpy */ { 3528 bzero(&$$, sizeof($$)); 3529 } 3530 | FROM macspec { 3531 $$.mac = $2; 3532 } 3533 ; 3534 3535 etherto : /* empty */ { 3536 bzero(&$$, sizeof($$)); 3537 } 3538 | TO macspec { 3539 $$.mac = $2; 3540 } 3541 ; 3542 3543 mac : string '/' NUMBER { 3544 $$ = node_mac_from_string_masklen($1, $3); 3545 free($1); 3546 if ($$ == NULL) 3547 YYERROR; 3548 } 3549 | string { 3550 if (strchr($1, '&')) { 3551 /* mac&mask */ 3552 char *mac = strtok($1, "&"); 3553 char *mask = strtok(NULL, "&"); 3554 $$ = node_mac_from_string_mask(mac, mask); 3555 } else { 3556 $$ = node_mac_from_string($1); 3557 } 3558 free($1); 3559 if ($$ == NULL) 3560 YYERROR; 3561 3562 } 3563 xmac : not mac { 3564 struct node_mac *n; 3565 3566 for (n = $2; n != NULL; n = n->next) 3567 n->neg = $1; 3568 $$ = $2; 3569 } 3570 ; 3571 macspec : xmac { 3572 $$ = $1; 3573 } 3574 | '{' optnl mac_list '}' 3575 { 3576 $$ = $3; 3577 } 3578 ; 3579 mac_list : xmac optnl { 3580 $$ = $1; 3581 } 3582 | mac_list comma xmac { 3583 if ($3 == NULL) 3584 $$ = $1; 3585 else if ($1 == NULL) 3586 $$ = $3; 3587 else { 3588 $1->tail->next = $3; 3589 $1->tail = $3->tail; 3590 $$ = $1; 3591 } 3592 } 3593 3594 fromto : ALL { 3595 $$.src.host = NULL; 3596 $$.src.port = NULL; 3597 $$.dst.host = NULL; 3598 $$.dst.port = NULL; 3599 $$.src_os = NULL; 3600 } 3601 | from os to { 3602 $$.src = $1; 3603 $$.src_os = $2; 3604 $$.dst = $3; 3605 } 3606 ; 3607 3608 os : /* empty */ { $$ = NULL; } 3609 | OS xos { $$ = $2; } 3610 | OS '{' optnl os_list '}' { $$ = $4; } 3611 ; 3612 3613 xos : STRING { 3614 $$ = calloc(1, sizeof(struct node_os)); 3615 if ($$ == NULL) 3616 err(1, "os: calloc"); 3617 $$->os = $1; 3618 $$->tail = $$; 3619 } 3620 ; 3621 3622 os_list : xos optnl { $$ = $1; } 3623 | os_list comma xos optnl { 3624 $1->tail->next = $3; 3625 $1->tail = $3; 3626 $$ = $1; 3627 } 3628 ; 3629 3630 from : /* empty */ { 3631 $$.host = NULL; 3632 $$.port = NULL; 3633 } 3634 | FROM ipportspec { 3635 $$ = $2; 3636 } 3637 ; 3638 3639 to : /* empty */ { 3640 $$.host = NULL; 3641 $$.port = NULL; 3642 } 3643 | TO ipportspec { 3644 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 3645 "not permitted in a destination address")) 3646 YYERROR; 3647 $$ = $2; 3648 } 3649 ; 3650 3651 ipportspec : ipspec { 3652 $$.host = $1; 3653 $$.port = NULL; 3654 } 3655 | ipspec PORT portspec { 3656 $$.host = $1; 3657 $$.port = $3; 3658 } 3659 | PORT portspec { 3660 $$.host = NULL; 3661 $$.port = $2; 3662 } 3663 ; 3664 3665 optnl : '\n' optnl 3666 | 3667 ; 3668 3669 ipspec : ANY { $$ = NULL; } 3670 | xhost { $$ = $1; } 3671 | '{' optnl host_list '}' { $$ = $3; } 3672 ; 3673 3674 toipspec : TO ipspec { $$ = $2; } 3675 | /* empty */ { $$ = NULL; } 3676 ; 3677 3678 host_list : ipspec optnl { $$ = $1; } 3679 | host_list comma ipspec optnl { 3680 if ($1 == NULL) { 3681 freehostlist($3); 3682 $$ = $1; 3683 } else if ($3 == NULL) { 3684 freehostlist($1); 3685 $$ = $3; 3686 } else { 3687 $1->tail->next = $3; 3688 $1->tail = $3->tail; 3689 $$ = $1; 3690 } 3691 } 3692 ; 3693 3694 xhost : not host { 3695 struct node_host *n; 3696 3697 for (n = $2; n != NULL; n = n->next) 3698 n->not = $1; 3699 $$ = $2; 3700 } 3701 | not NOROUTE { 3702 $$ = calloc(1, sizeof(struct node_host)); 3703 if ($$ == NULL) 3704 err(1, "xhost: calloc"); 3705 $$->addr.type = PF_ADDR_NOROUTE; 3706 $$->next = NULL; 3707 $$->not = $1; 3708 $$->tail = $$; 3709 } 3710 | not URPFFAILED { 3711 $$ = calloc(1, sizeof(struct node_host)); 3712 if ($$ == NULL) 3713 err(1, "xhost: calloc"); 3714 $$->addr.type = PF_ADDR_URPFFAILED; 3715 $$->next = NULL; 3716 $$->not = $1; 3717 $$->tail = $$; 3718 } 3719 ; 3720 3721 host : STRING { 3722 if (($$ = host($1, pf->opts)) == NULL) { 3723 /* error. "any" is handled elsewhere */ 3724 free($1); 3725 yyerror("could not parse host specification"); 3726 YYERROR; 3727 } 3728 free($1); 3729 3730 } 3731 | STRING '-' STRING { 3732 struct node_host *b, *e; 3733 3734 if ((b = host($1, pf->opts)) == NULL || 3735 (e = host($3, pf->opts)) == NULL) { 3736 free($1); 3737 free($3); 3738 yyerror("could not parse host specification"); 3739 YYERROR; 3740 } 3741 if (b->af != e->af || 3742 b->addr.type != PF_ADDR_ADDRMASK || 3743 e->addr.type != PF_ADDR_ADDRMASK || 3744 unmask(&b->addr.v.a.mask, b->af) != 3745 (b->af == AF_INET ? 32 : 128) || 3746 unmask(&e->addr.v.a.mask, e->af) != 3747 (e->af == AF_INET ? 32 : 128) || 3748 b->next != NULL || b->not || 3749 e->next != NULL || e->not) { 3750 free(b); 3751 free(e); 3752 free($1); 3753 free($3); 3754 yyerror("invalid address range"); 3755 YYERROR; 3756 } 3757 memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, 3758 sizeof(b->addr.v.a.mask)); 3759 b->addr.type = PF_ADDR_RANGE; 3760 $$ = b; 3761 free(e); 3762 free($1); 3763 free($3); 3764 } 3765 | STRING '/' NUMBER { 3766 char *buf; 3767 3768 if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1) 3769 err(1, "host: asprintf"); 3770 free($1); 3771 if (($$ = host(buf, pf->opts)) == NULL) { 3772 /* error. "any" is handled elsewhere */ 3773 free(buf); 3774 yyerror("could not parse host specification"); 3775 YYERROR; 3776 } 3777 free(buf); 3778 } 3779 | NUMBER '/' NUMBER { 3780 char *buf; 3781 3782 /* ie. for 10/8 parsing */ 3783 #ifdef __FreeBSD__ 3784 if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1) 3785 #else 3786 if (asprintf(&buf, "%lld/%lld", $1, $3) == -1) 3787 #endif 3788 err(1, "host: asprintf"); 3789 if (($$ = host(buf, pf->opts)) == NULL) { 3790 /* error. "any" is handled elsewhere */ 3791 free(buf); 3792 yyerror("could not parse host specification"); 3793 YYERROR; 3794 } 3795 free(buf); 3796 } 3797 | dynaddr 3798 | dynaddr '/' NUMBER { 3799 struct node_host *n; 3800 3801 if ($3 < 0 || $3 > 128) { 3802 yyerror("bit number too big"); 3803 YYERROR; 3804 } 3805 $$ = $1; 3806 for (n = $1; n != NULL; n = n->next) 3807 set_ipmask(n, $3); 3808 } 3809 | '<' STRING '>' { 3810 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 3811 yyerror("table name '%s' too long", $2); 3812 free($2); 3813 YYERROR; 3814 } 3815 $$ = calloc(1, sizeof(struct node_host)); 3816 if ($$ == NULL) 3817 err(1, "host: calloc"); 3818 $$->addr.type = PF_ADDR_TABLE; 3819 if (strlcpy($$->addr.v.tblname, $2, 3820 sizeof($$->addr.v.tblname)) >= 3821 sizeof($$->addr.v.tblname)) 3822 errx(1, "host: strlcpy"); 3823 free($2); 3824 $$->next = NULL; 3825 $$->tail = $$; 3826 } 3827 ; 3828 3829 number : NUMBER 3830 | STRING { 3831 u_long ulval; 3832 3833 if (atoul($1, &ulval) == -1) { 3834 yyerror("%s is not a number", $1); 3835 free($1); 3836 YYERROR; 3837 } else 3838 $$ = ulval; 3839 free($1); 3840 } 3841 ; 3842 3843 dynaddr : '(' STRING ')' { 3844 int flags = 0; 3845 char *p, *op; 3846 3847 op = $2; 3848 if (!isalpha(op[0])) { 3849 yyerror("invalid interface name '%s'", op); 3850 free(op); 3851 YYERROR; 3852 } 3853 while ((p = strrchr($2, ':')) != NULL) { 3854 if (!strcmp(p+1, "network")) 3855 flags |= PFI_AFLAG_NETWORK; 3856 else if (!strcmp(p+1, "broadcast")) 3857 flags |= PFI_AFLAG_BROADCAST; 3858 else if (!strcmp(p+1, "peer")) 3859 flags |= PFI_AFLAG_PEER; 3860 else if (!strcmp(p+1, "0")) 3861 flags |= PFI_AFLAG_NOALIAS; 3862 else { 3863 yyerror("interface %s has bad modifier", 3864 $2); 3865 free(op); 3866 YYERROR; 3867 } 3868 *p = '\0'; 3869 } 3870 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 3871 free(op); 3872 yyerror("illegal combination of " 3873 "interface modifiers"); 3874 YYERROR; 3875 } 3876 $$ = calloc(1, sizeof(struct node_host)); 3877 if ($$ == NULL) 3878 err(1, "address: calloc"); 3879 $$->af = 0; 3880 set_ipmask($$, 128); 3881 $$->addr.type = PF_ADDR_DYNIFTL; 3882 $$->addr.iflags = flags; 3883 if (strlcpy($$->addr.v.ifname, $2, 3884 sizeof($$->addr.v.ifname)) >= 3885 sizeof($$->addr.v.ifname)) { 3886 free(op); 3887 free($$); 3888 yyerror("interface name too long"); 3889 YYERROR; 3890 } 3891 free(op); 3892 $$->next = NULL; 3893 $$->tail = $$; 3894 } 3895 ; 3896 3897 portspec : port_item { $$ = $1; } 3898 | '{' optnl port_list '}' { $$ = $3; } 3899 ; 3900 3901 port_list : port_item optnl { $$ = $1; } 3902 | port_list comma port_item optnl { 3903 $1->tail->next = $3; 3904 $1->tail = $3; 3905 $$ = $1; 3906 } 3907 ; 3908 3909 port_item : portrange { 3910 $$ = calloc(1, sizeof(struct node_port)); 3911 if ($$ == NULL) 3912 err(1, "port_item: calloc"); 3913 $$->port[0] = $1.a; 3914 $$->port[1] = $1.b; 3915 if ($1.t) 3916 $$->op = PF_OP_RRG; 3917 else 3918 $$->op = PF_OP_EQ; 3919 $$->next = NULL; 3920 $$->tail = $$; 3921 } 3922 | unaryop portrange { 3923 if ($2.t) { 3924 yyerror("':' cannot be used with an other " 3925 "port operator"); 3926 YYERROR; 3927 } 3928 $$ = calloc(1, sizeof(struct node_port)); 3929 if ($$ == NULL) 3930 err(1, "port_item: calloc"); 3931 $$->port[0] = $2.a; 3932 $$->port[1] = $2.b; 3933 $$->op = $1; 3934 $$->next = NULL; 3935 $$->tail = $$; 3936 } 3937 | portrange PORTBINARY portrange { 3938 if ($1.t || $3.t) { 3939 yyerror("':' cannot be used with an other " 3940 "port operator"); 3941 YYERROR; 3942 } 3943 $$ = calloc(1, sizeof(struct node_port)); 3944 if ($$ == NULL) 3945 err(1, "port_item: calloc"); 3946 $$->port[0] = $1.a; 3947 $$->port[1] = $3.a; 3948 $$->op = $2; 3949 $$->next = NULL; 3950 $$->tail = $$; 3951 } 3952 ; 3953 3954 portplain : numberstring { 3955 if (parseport($1, &$$, 0) == -1) { 3956 free($1); 3957 YYERROR; 3958 } 3959 free($1); 3960 } 3961 ; 3962 3963 portrange : numberstring { 3964 if (parseport($1, &$$, PPORT_RANGE) == -1) { 3965 free($1); 3966 YYERROR; 3967 } 3968 free($1); 3969 } 3970 ; 3971 3972 uids : uid_item { $$ = $1; } 3973 | '{' optnl uid_list '}' { $$ = $3; } 3974 ; 3975 3976 uid_list : uid_item optnl { $$ = $1; } 3977 | uid_list comma uid_item optnl { 3978 $1->tail->next = $3; 3979 $1->tail = $3; 3980 $$ = $1; 3981 } 3982 ; 3983 3984 uid_item : uid { 3985 $$ = calloc(1, sizeof(struct node_uid)); 3986 if ($$ == NULL) 3987 err(1, "uid_item: calloc"); 3988 $$->uid[0] = $1; 3989 $$->uid[1] = $1; 3990 $$->op = PF_OP_EQ; 3991 $$->next = NULL; 3992 $$->tail = $$; 3993 } 3994 | unaryop uid { 3995 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 3996 yyerror("user unknown requires operator = or " 3997 "!="); 3998 YYERROR; 3999 } 4000 $$ = calloc(1, sizeof(struct node_uid)); 4001 if ($$ == NULL) 4002 err(1, "uid_item: calloc"); 4003 $$->uid[0] = $2; 4004 $$->uid[1] = $2; 4005 $$->op = $1; 4006 $$->next = NULL; 4007 $$->tail = $$; 4008 } 4009 | uid PORTBINARY uid { 4010 if ($1 == UID_MAX || $3 == UID_MAX) { 4011 yyerror("user unknown requires operator = or " 4012 "!="); 4013 YYERROR; 4014 } 4015 $$ = calloc(1, sizeof(struct node_uid)); 4016 if ($$ == NULL) 4017 err(1, "uid_item: calloc"); 4018 $$->uid[0] = $1; 4019 $$->uid[1] = $3; 4020 $$->op = $2; 4021 $$->next = NULL; 4022 $$->tail = $$; 4023 } 4024 ; 4025 4026 uid : STRING { 4027 if (!strcmp($1, "unknown")) 4028 $$ = UID_MAX; 4029 else { 4030 struct passwd *pw; 4031 4032 if ((pw = getpwnam($1)) == NULL) { 4033 yyerror("unknown user %s", $1); 4034 free($1); 4035 YYERROR; 4036 } 4037 $$ = pw->pw_uid; 4038 } 4039 free($1); 4040 } 4041 | NUMBER { 4042 if ($1 < 0 || $1 >= UID_MAX) { 4043 yyerror("illegal uid value %lu", $1); 4044 YYERROR; 4045 } 4046 $$ = $1; 4047 } 4048 ; 4049 4050 gids : gid_item { $$ = $1; } 4051 | '{' optnl gid_list '}' { $$ = $3; } 4052 ; 4053 4054 gid_list : gid_item optnl { $$ = $1; } 4055 | gid_list comma gid_item optnl { 4056 $1->tail->next = $3; 4057 $1->tail = $3; 4058 $$ = $1; 4059 } 4060 ; 4061 4062 gid_item : gid { 4063 $$ = calloc(1, sizeof(struct node_gid)); 4064 if ($$ == NULL) 4065 err(1, "gid_item: calloc"); 4066 $$->gid[0] = $1; 4067 $$->gid[1] = $1; 4068 $$->op = PF_OP_EQ; 4069 $$->next = NULL; 4070 $$->tail = $$; 4071 } 4072 | unaryop gid { 4073 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 4074 yyerror("group unknown requires operator = or " 4075 "!="); 4076 YYERROR; 4077 } 4078 $$ = calloc(1, sizeof(struct node_gid)); 4079 if ($$ == NULL) 4080 err(1, "gid_item: calloc"); 4081 $$->gid[0] = $2; 4082 $$->gid[1] = $2; 4083 $$->op = $1; 4084 $$->next = NULL; 4085 $$->tail = $$; 4086 } 4087 | gid PORTBINARY gid { 4088 if ($1 == GID_MAX || $3 == GID_MAX) { 4089 yyerror("group unknown requires operator = or " 4090 "!="); 4091 YYERROR; 4092 } 4093 $$ = calloc(1, sizeof(struct node_gid)); 4094 if ($$ == NULL) 4095 err(1, "gid_item: calloc"); 4096 $$->gid[0] = $1; 4097 $$->gid[1] = $3; 4098 $$->op = $2; 4099 $$->next = NULL; 4100 $$->tail = $$; 4101 } 4102 ; 4103 4104 gid : STRING { 4105 if (!strcmp($1, "unknown")) 4106 $$ = GID_MAX; 4107 else { 4108 struct group *grp; 4109 4110 if ((grp = getgrnam($1)) == NULL) { 4111 yyerror("unknown group %s", $1); 4112 free($1); 4113 YYERROR; 4114 } 4115 $$ = grp->gr_gid; 4116 } 4117 free($1); 4118 } 4119 | NUMBER { 4120 if ($1 < 0 || $1 >= GID_MAX) { 4121 yyerror("illegal gid value %lu", $1); 4122 YYERROR; 4123 } 4124 $$ = $1; 4125 } 4126 ; 4127 4128 flag : STRING { 4129 int f; 4130 4131 if ((f = parse_flags($1)) < 0) { 4132 yyerror("bad flags %s", $1); 4133 free($1); 4134 YYERROR; 4135 } 4136 free($1); 4137 $$.b1 = f; 4138 } 4139 ; 4140 4141 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 4142 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 4143 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 4144 ; 4145 4146 icmpspec : ICMPTYPE icmp_item { $$ = $2; } 4147 | ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; } 4148 | ICMP6TYPE icmp6_item { $$ = $2; } 4149 | ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; } 4150 ; 4151 4152 icmp_list : icmp_item optnl { $$ = $1; } 4153 | icmp_list comma icmp_item optnl { 4154 $1->tail->next = $3; 4155 $1->tail = $3; 4156 $$ = $1; 4157 } 4158 ; 4159 4160 icmp6_list : icmp6_item optnl { $$ = $1; } 4161 | icmp6_list comma icmp6_item optnl { 4162 $1->tail->next = $3; 4163 $1->tail = $3; 4164 $$ = $1; 4165 } 4166 ; 4167 4168 icmp_item : icmptype { 4169 $$ = calloc(1, sizeof(struct node_icmp)); 4170 if ($$ == NULL) 4171 err(1, "icmp_item: calloc"); 4172 $$->type = $1; 4173 $$->code = 0; 4174 $$->proto = IPPROTO_ICMP; 4175 $$->next = NULL; 4176 $$->tail = $$; 4177 } 4178 | icmptype CODE STRING { 4179 const struct icmpcodeent *p; 4180 4181 if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) { 4182 yyerror("unknown icmp-code %s", $3); 4183 free($3); 4184 YYERROR; 4185 } 4186 4187 free($3); 4188 $$ = calloc(1, sizeof(struct node_icmp)); 4189 if ($$ == NULL) 4190 err(1, "icmp_item: calloc"); 4191 $$->type = $1; 4192 $$->code = p->code + 1; 4193 $$->proto = IPPROTO_ICMP; 4194 $$->next = NULL; 4195 $$->tail = $$; 4196 } 4197 | icmptype CODE NUMBER { 4198 if ($3 < 0 || $3 > 255) { 4199 yyerror("illegal icmp-code %lu", $3); 4200 YYERROR; 4201 } 4202 $$ = calloc(1, sizeof(struct node_icmp)); 4203 if ($$ == NULL) 4204 err(1, "icmp_item: calloc"); 4205 $$->type = $1; 4206 $$->code = $3 + 1; 4207 $$->proto = IPPROTO_ICMP; 4208 $$->next = NULL; 4209 $$->tail = $$; 4210 } 4211 ; 4212 4213 icmp6_item : icmp6type { 4214 $$ = calloc(1, sizeof(struct node_icmp)); 4215 if ($$ == NULL) 4216 err(1, "icmp_item: calloc"); 4217 $$->type = $1; 4218 $$->code = 0; 4219 $$->proto = IPPROTO_ICMPV6; 4220 $$->next = NULL; 4221 $$->tail = $$; 4222 } 4223 | icmp6type CODE STRING { 4224 const struct icmpcodeent *p; 4225 4226 if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) { 4227 yyerror("unknown icmp6-code %s", $3); 4228 free($3); 4229 YYERROR; 4230 } 4231 free($3); 4232 4233 $$ = calloc(1, sizeof(struct node_icmp)); 4234 if ($$ == NULL) 4235 err(1, "icmp_item: calloc"); 4236 $$->type = $1; 4237 $$->code = p->code + 1; 4238 $$->proto = IPPROTO_ICMPV6; 4239 $$->next = NULL; 4240 $$->tail = $$; 4241 } 4242 | icmp6type CODE NUMBER { 4243 if ($3 < 0 || $3 > 255) { 4244 yyerror("illegal icmp-code %lu", $3); 4245 YYERROR; 4246 } 4247 $$ = calloc(1, sizeof(struct node_icmp)); 4248 if ($$ == NULL) 4249 err(1, "icmp_item: calloc"); 4250 $$->type = $1; 4251 $$->code = $3 + 1; 4252 $$->proto = IPPROTO_ICMPV6; 4253 $$->next = NULL; 4254 $$->tail = $$; 4255 } 4256 ; 4257 4258 icmptype : STRING { 4259 const struct icmptypeent *p; 4260 4261 if ((p = geticmptypebyname($1, AF_INET)) == NULL) { 4262 yyerror("unknown icmp-type %s", $1); 4263 free($1); 4264 YYERROR; 4265 } 4266 $$ = p->type + 1; 4267 free($1); 4268 } 4269 | NUMBER { 4270 if ($1 < 0 || $1 > 255) { 4271 yyerror("illegal icmp-type %lu", $1); 4272 YYERROR; 4273 } 4274 $$ = $1 + 1; 4275 } 4276 ; 4277 4278 icmp6type : STRING { 4279 const struct icmptypeent *p; 4280 4281 if ((p = geticmptypebyname($1, AF_INET6)) == 4282 NULL) { 4283 yyerror("unknown icmp6-type %s", $1); 4284 free($1); 4285 YYERROR; 4286 } 4287 $$ = p->type + 1; 4288 free($1); 4289 } 4290 | NUMBER { 4291 if ($1 < 0 || $1 > 255) { 4292 yyerror("illegal icmp6-type %lu", $1); 4293 YYERROR; 4294 } 4295 $$ = $1 + 1; 4296 } 4297 ; 4298 4299 tos : STRING { 4300 int val; 4301 char *end; 4302 4303 if (map_tos($1, &val)) 4304 $$ = val; 4305 else if ($1[0] == '0' && $1[1] == 'x') { 4306 errno = 0; 4307 $$ = strtoul($1, &end, 16); 4308 if (errno || *end != '\0') 4309 $$ = 256; 4310 } else 4311 $$ = 256; /* flag bad argument */ 4312 if ($$ < 0 || $$ > 255) { 4313 yyerror("illegal tos value %s", $1); 4314 free($1); 4315 YYERROR; 4316 } 4317 free($1); 4318 } 4319 | NUMBER { 4320 $$ = $1; 4321 if ($$ < 0 || $$ > 255) { 4322 yyerror("illegal tos value %lu", $1); 4323 YYERROR; 4324 } 4325 } 4326 ; 4327 4328 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 4329 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 4330 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 4331 ; 4332 4333 statelock : IFBOUND { 4334 $$ = PFRULE_IFBOUND; 4335 } 4336 | FLOATING { 4337 $$ = 0; 4338 } 4339 ; 4340 4341 keep : NO STATE { 4342 $$.action = 0; 4343 $$.options = NULL; 4344 } 4345 | KEEP STATE state_opt_spec { 4346 $$.action = PF_STATE_NORMAL; 4347 $$.options = $3; 4348 } 4349 | MODULATE STATE state_opt_spec { 4350 $$.action = PF_STATE_MODULATE; 4351 $$.options = $3; 4352 } 4353 | SYNPROXY STATE state_opt_spec { 4354 $$.action = PF_STATE_SYNPROXY; 4355 $$.options = $3; 4356 } 4357 ; 4358 4359 flush : /* empty */ { $$ = 0; } 4360 | FLUSH { $$ = PF_FLUSH; } 4361 | FLUSH GLOBAL { 4362 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 4363 } 4364 ; 4365 4366 state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 4367 | /* empty */ { $$ = NULL; } 4368 ; 4369 4370 state_opt_list : state_opt_item { $$ = $1; } 4371 | state_opt_list comma state_opt_item { 4372 $1->tail->next = $3; 4373 $1->tail = $3; 4374 $$ = $1; 4375 } 4376 ; 4377 4378 state_opt_item : MAXIMUM NUMBER { 4379 if ($2 < 0 || $2 > UINT_MAX) { 4380 yyerror("only positive values permitted"); 4381 YYERROR; 4382 } 4383 $$ = calloc(1, sizeof(struct node_state_opt)); 4384 if ($$ == NULL) 4385 err(1, "state_opt_item: calloc"); 4386 $$->type = PF_STATE_OPT_MAX; 4387 $$->data.max_states = $2; 4388 $$->next = NULL; 4389 $$->tail = $$; 4390 } 4391 | NOSYNC { 4392 $$ = calloc(1, sizeof(struct node_state_opt)); 4393 if ($$ == NULL) 4394 err(1, "state_opt_item: calloc"); 4395 $$->type = PF_STATE_OPT_NOSYNC; 4396 $$->next = NULL; 4397 $$->tail = $$; 4398 } 4399 | MAXSRCSTATES NUMBER { 4400 if ($2 < 0 || $2 > UINT_MAX) { 4401 yyerror("only positive values permitted"); 4402 YYERROR; 4403 } 4404 $$ = calloc(1, sizeof(struct node_state_opt)); 4405 if ($$ == NULL) 4406 err(1, "state_opt_item: calloc"); 4407 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 4408 $$->data.max_src_states = $2; 4409 $$->next = NULL; 4410 $$->tail = $$; 4411 } 4412 | MAXSRCCONN NUMBER { 4413 if ($2 < 0 || $2 > UINT_MAX) { 4414 yyerror("only positive values permitted"); 4415 YYERROR; 4416 } 4417 $$ = calloc(1, sizeof(struct node_state_opt)); 4418 if ($$ == NULL) 4419 err(1, "state_opt_item: calloc"); 4420 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 4421 $$->data.max_src_conn = $2; 4422 $$->next = NULL; 4423 $$->tail = $$; 4424 } 4425 | MAXSRCCONNRATE NUMBER '/' NUMBER { 4426 if ($2 < 0 || $2 > UINT_MAX || 4427 $4 < 0 || $4 > UINT_MAX) { 4428 yyerror("only positive values permitted"); 4429 YYERROR; 4430 } 4431 $$ = calloc(1, sizeof(struct node_state_opt)); 4432 if ($$ == NULL) 4433 err(1, "state_opt_item: calloc"); 4434 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 4435 $$->data.max_src_conn_rate.limit = $2; 4436 $$->data.max_src_conn_rate.seconds = $4; 4437 $$->next = NULL; 4438 $$->tail = $$; 4439 } 4440 | OVERLOAD '<' STRING '>' flush { 4441 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 4442 yyerror("table name '%s' too long", $3); 4443 free($3); 4444 YYERROR; 4445 } 4446 $$ = calloc(1, sizeof(struct node_state_opt)); 4447 if ($$ == NULL) 4448 err(1, "state_opt_item: calloc"); 4449 if (strlcpy($$->data.overload.tblname, $3, 4450 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 4451 errx(1, "state_opt_item: strlcpy"); 4452 free($3); 4453 $$->type = PF_STATE_OPT_OVERLOAD; 4454 $$->data.overload.flush = $5; 4455 $$->next = NULL; 4456 $$->tail = $$; 4457 } 4458 | MAXSRCNODES NUMBER { 4459 if ($2 < 0 || $2 > UINT_MAX) { 4460 yyerror("only positive values permitted"); 4461 YYERROR; 4462 } 4463 $$ = calloc(1, sizeof(struct node_state_opt)); 4464 if ($$ == NULL) 4465 err(1, "state_opt_item: calloc"); 4466 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 4467 $$->data.max_src_nodes = $2; 4468 $$->next = NULL; 4469 $$->tail = $$; 4470 } 4471 | sourcetrack { 4472 $$ = calloc(1, sizeof(struct node_state_opt)); 4473 if ($$ == NULL) 4474 err(1, "state_opt_item: calloc"); 4475 $$->type = PF_STATE_OPT_SRCTRACK; 4476 $$->data.src_track = $1; 4477 $$->next = NULL; 4478 $$->tail = $$; 4479 } 4480 | statelock { 4481 $$ = calloc(1, sizeof(struct node_state_opt)); 4482 if ($$ == NULL) 4483 err(1, "state_opt_item: calloc"); 4484 $$->type = PF_STATE_OPT_STATELOCK; 4485 $$->data.statelock = $1; 4486 $$->next = NULL; 4487 $$->tail = $$; 4488 } 4489 | SLOPPY { 4490 $$ = calloc(1, sizeof(struct node_state_opt)); 4491 if ($$ == NULL) 4492 err(1, "state_opt_item: calloc"); 4493 $$->type = PF_STATE_OPT_SLOPPY; 4494 $$->next = NULL; 4495 $$->tail = $$; 4496 } 4497 | PFLOW { 4498 $$ = calloc(1, sizeof(struct node_state_opt)); 4499 if ($$ == NULL) 4500 err(1, "state_opt_item: calloc"); 4501 $$->type = PF_STATE_OPT_PFLOW; 4502 $$->next = NULL; 4503 $$->tail = $$; 4504 } 4505 | ALLOW_RELATED { 4506 $$ = calloc(1, sizeof(struct node_state_opt)); 4507 if ($$ == NULL) 4508 err(1, "state_opt_item: calloc"); 4509 $$->type = PF_STATE_OPT_ALLOW_RELATED; 4510 $$->next = NULL; 4511 $$->tail = $$; 4512 } 4513 | STRING NUMBER { 4514 int i; 4515 4516 if ($2 < 0 || $2 > UINT_MAX) { 4517 yyerror("only positive values permitted"); 4518 YYERROR; 4519 } 4520 for (i = 0; pf_timeouts[i].name && 4521 strcmp(pf_timeouts[i].name, $1); ++i) 4522 ; /* nothing */ 4523 if (!pf_timeouts[i].name) { 4524 yyerror("illegal timeout name %s", $1); 4525 free($1); 4526 YYERROR; 4527 } 4528 if (strchr(pf_timeouts[i].name, '.') == NULL) { 4529 yyerror("illegal state timeout %s", $1); 4530 free($1); 4531 YYERROR; 4532 } 4533 free($1); 4534 $$ = calloc(1, sizeof(struct node_state_opt)); 4535 if ($$ == NULL) 4536 err(1, "state_opt_item: calloc"); 4537 $$->type = PF_STATE_OPT_TIMEOUT; 4538 $$->data.timeout.number = pf_timeouts[i].timeout; 4539 $$->data.timeout.seconds = $2; 4540 $$->next = NULL; 4541 $$->tail = $$; 4542 } 4543 ; 4544 4545 label : LABEL STRING { 4546 $$ = $2; 4547 } 4548 ; 4549 4550 etherqname : QUEUE STRING { 4551 $$.qname = $2; 4552 } 4553 | QUEUE '(' STRING ')' { 4554 $$.qname = $3; 4555 } 4556 ; 4557 4558 qname : QUEUE STRING { 4559 $$.qname = $2; 4560 $$.pqname = NULL; 4561 } 4562 | QUEUE '(' STRING ')' { 4563 $$.qname = $3; 4564 $$.pqname = NULL; 4565 } 4566 | QUEUE '(' STRING comma STRING ')' { 4567 $$.qname = $3; 4568 $$.pqname = $5; 4569 } 4570 ; 4571 4572 no : /* empty */ { $$ = 0; } 4573 | NO { $$ = 1; } 4574 ; 4575 4576 portstar : numberstring { 4577 if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) { 4578 free($1); 4579 YYERROR; 4580 } 4581 free($1); 4582 } 4583 ; 4584 4585 redir_host : host { $$ = $1; } 4586 | '{' optnl redir_host_list '}' { $$ = $3; } 4587 ; 4588 4589 redir_host_list : host optnl { $$ = $1; } 4590 | redir_host_list comma host optnl { 4591 $1->tail->next = $3; 4592 $1->tail = $3->tail; 4593 $$ = $1; 4594 } 4595 ; 4596 4597 /* Redirection without port */ 4598 no_port_redirspec: redir_host pool_opts { 4599 $$ = calloc(1, sizeof(struct redirspec)); 4600 if ($$ == NULL) 4601 err(1, "redirspec: calloc"); 4602 $$->host = $1; 4603 $$->pool_opts = $2; 4604 $$->rport.a = $$->rport.b = $$->rport.t = 0; 4605 } 4606 ; 4607 4608 /* Redirection with optional port */ 4609 port_redirspec : no_port_redirspec; 4610 | redir_host PORT portstar pool_opts { 4611 $$ = calloc(1, sizeof(struct redirspec)); 4612 if ($$ == NULL) 4613 err(1, "redirspec: calloc"); 4614 $$->host = $1; 4615 $$->rport = $3; 4616 $$->pool_opts = $4; 4617 } 4618 4619 /* Redirection with an arrow and an optional port: FreeBSD NAT rules */ 4620 nat_redirspec : /* empty */ { $$ = NULL; } 4621 | ARROW port_redirspec { 4622 $$ = $2; 4623 } 4624 ; 4625 4626 /* Redirection with interfaces and without ports: route-to rules */ 4627 route_redirspec : routespec pool_opts { 4628 $$ = calloc(1, sizeof(struct redirspec)); 4629 if ($$ == NULL) 4630 err(1, "redirspec: calloc"); 4631 $$->host = $1; 4632 $$->pool_opts = $2; 4633 } 4634 ; 4635 4636 hashkey : /* empty */ 4637 { 4638 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 4639 if ($$ == NULL) 4640 err(1, "hashkey: calloc"); 4641 $$->key32[0] = arc4random(); 4642 $$->key32[1] = arc4random(); 4643 $$->key32[2] = arc4random(); 4644 $$->key32[3] = arc4random(); 4645 } 4646 | string 4647 { 4648 if (!strncmp($1, "0x", 2)) { 4649 if (strlen($1) != 34) { 4650 free($1); 4651 yyerror("hex key must be 128 bits " 4652 "(32 hex digits) long"); 4653 YYERROR; 4654 } 4655 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 4656 if ($$ == NULL) 4657 err(1, "hashkey: calloc"); 4658 4659 if (sscanf($1, "0x%8x%8x%8x%8x", 4660 &$$->key32[0], &$$->key32[1], 4661 &$$->key32[2], &$$->key32[3]) != 4) { 4662 free($$); 4663 free($1); 4664 yyerror("invalid hex key"); 4665 YYERROR; 4666 } 4667 } else { 4668 MD5_CTX context; 4669 4670 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 4671 if ($$ == NULL) 4672 err(1, "hashkey: calloc"); 4673 MD5Init(&context); 4674 MD5Update(&context, (unsigned char *)$1, 4675 strlen($1)); 4676 MD5Final((unsigned char *)$$, &context); 4677 HTONL($$->key32[0]); 4678 HTONL($$->key32[1]); 4679 HTONL($$->key32[2]); 4680 HTONL($$->key32[3]); 4681 } 4682 free($1); 4683 } 4684 ; 4685 4686 pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 4687 pool_opts_l 4688 { $$ = pool_opts; } 4689 | /* empty */ { 4690 bzero(&pool_opts, sizeof pool_opts); 4691 $$ = pool_opts; 4692 } 4693 ; 4694 4695 pool_opts_l : pool_opts_l pool_opt 4696 | pool_opt 4697 ; 4698 4699 pool_opt : BITMASK { 4700 if (pool_opts.type) { 4701 yyerror("pool type cannot be redefined"); 4702 YYERROR; 4703 } 4704 pool_opts.type = PF_POOL_BITMASK; 4705 } 4706 | RANDOM { 4707 if (pool_opts.type) { 4708 yyerror("pool type cannot be redefined"); 4709 YYERROR; 4710 } 4711 pool_opts.type = PF_POOL_RANDOM; 4712 } 4713 | SOURCEHASH hashkey { 4714 if (pool_opts.type) { 4715 yyerror("pool type cannot be redefined"); 4716 YYERROR; 4717 } 4718 pool_opts.type = PF_POOL_SRCHASH; 4719 pool_opts.key = $2; 4720 } 4721 | ROUNDROBIN { 4722 if (pool_opts.type) { 4723 yyerror("pool type cannot be redefined"); 4724 YYERROR; 4725 } 4726 pool_opts.type = PF_POOL_ROUNDROBIN; 4727 } 4728 | STATICPORT { 4729 if (pool_opts.staticport) { 4730 yyerror("static-port cannot be redefined"); 4731 YYERROR; 4732 } 4733 pool_opts.staticport = 1; 4734 } 4735 | STICKYADDRESS { 4736 if (pool_opts.marker & POM_STICKYADDRESS) { 4737 yyerror("sticky-address cannot be redefined"); 4738 YYERROR; 4739 } 4740 pool_opts.marker |= POM_STICKYADDRESS; 4741 pool_opts.opts |= PF_POOL_STICKYADDR; 4742 } 4743 | ENDPI { 4744 if (pool_opts.marker & POM_ENDPI) { 4745 yyerror("endpoint-independent cannot be redefined"); 4746 YYERROR; 4747 } 4748 pool_opts.marker |= POM_ENDPI; 4749 pool_opts.opts |= PF_POOL_ENDPI; 4750 } 4751 | MAPEPORTSET number '/' number '/' number { 4752 if (pool_opts.mape.offset) { 4753 yyerror("map-e-portset cannot be redefined"); 4754 YYERROR; 4755 } 4756 if (pool_opts.type) { 4757 yyerror("map-e-portset cannot be used with " 4758 "address pools"); 4759 YYERROR; 4760 } 4761 if ($2 <= 0 || $2 >= 16) { 4762 yyerror("MAP-E PSID offset must be 1-15"); 4763 YYERROR; 4764 } 4765 if ($4 < 0 || $4 >= 16 || $2 + $4 > 16) { 4766 yyerror("Invalid MAP-E PSID length"); 4767 YYERROR; 4768 } else if ($4 == 0) { 4769 yyerror("PSID Length = 0: this means" 4770 " you do not need MAP-E"); 4771 YYERROR; 4772 } 4773 if ($6 < 0 || $6 > 65535) { 4774 yyerror("Invalid MAP-E PSID"); 4775 YYERROR; 4776 } 4777 pool_opts.mape.offset = $2; 4778 pool_opts.mape.psidlen = $4; 4779 pool_opts.mape.psid = $6; 4780 } 4781 ; 4782 4783 binat_redirspec : /* empty */ { $$ = NULL; } 4784 | ARROW host { 4785 $$ = calloc(1, sizeof(struct redirspec)); 4786 if ($$ == NULL) 4787 err(1, "redirspec: calloc"); 4788 $$->host = $2; 4789 $$->rport.a = $$->rport.b = $$->rport.t = 0; 4790 } 4791 | ARROW host PORT portstar { 4792 $$ = calloc(1, sizeof(struct redirspec)); 4793 if ($$ == NULL) 4794 err(1, "redirspec: calloc"); 4795 $$->host = $2; 4796 $$->rport = $4; 4797 } 4798 ; 4799 4800 natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 4801 | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 4802 | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 4803 | log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; } 4804 ; 4805 4806 nataction : no NAT natpasslog { 4807 if ($1 && $3.b1) { 4808 yyerror("\"pass\" not valid with \"no\""); 4809 YYERROR; 4810 } 4811 if ($1) 4812 $$.b1 = PF_NONAT; 4813 else 4814 $$.b1 = PF_NAT; 4815 $$.b2 = $3.b1; 4816 $$.w = $3.b2; 4817 $$.w2 = $3.w2; 4818 } 4819 | no RDR natpasslog { 4820 if ($1 && $3.b1) { 4821 yyerror("\"pass\" not valid with \"no\""); 4822 YYERROR; 4823 } 4824 if ($1) 4825 $$.b1 = PF_NORDR; 4826 else 4827 $$.b1 = PF_RDR; 4828 $$.b2 = $3.b1; 4829 $$.w = $3.b2; 4830 $$.w2 = $3.w2; 4831 } 4832 ; 4833 4834 natrule : nataction interface af proto fromto tag tagged rtable 4835 nat_redirspec 4836 { 4837 struct pfctl_rule r; 4838 struct node_state_opt *o; 4839 4840 if (check_rulestate(PFCTL_STATE_NAT)) 4841 YYERROR; 4842 4843 pfctl_init_rule(&r); 4844 4845 r.action = $1.b1; 4846 r.natpass = $1.b2; 4847 r.log = $1.w; 4848 r.logif = $1.w2; 4849 r.af = $3; 4850 4851 if (!r.af) { 4852 if ($5.src.host && $5.src.host->af && 4853 !$5.src.host->ifindex) 4854 r.af = $5.src.host->af; 4855 else if ($5.dst.host && $5.dst.host->af && 4856 !$5.dst.host->ifindex) 4857 r.af = $5.dst.host->af; 4858 } 4859 4860 if ($6 != NULL) 4861 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 4862 PF_TAG_NAME_SIZE) { 4863 yyerror("tag too long, max %u chars", 4864 PF_TAG_NAME_SIZE - 1); 4865 YYERROR; 4866 } 4867 4868 if ($7.name) 4869 if (strlcpy(r.match_tagname, $7.name, 4870 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4871 yyerror("tag too long, max %u chars", 4872 PF_TAG_NAME_SIZE - 1); 4873 YYERROR; 4874 } 4875 r.match_tag_not = $7.neg; 4876 r.rtableid = $8; 4877 4878 if (r.action == PF_NONAT || r.action == PF_NORDR) { 4879 if ($9 != NULL) { 4880 yyerror("translation rule with 'no' " 4881 "does not need '->'"); 4882 YYERROR; 4883 } 4884 } else { 4885 if ($9 == NULL || $9->host == NULL) { 4886 yyerror("translation rule requires '-> " 4887 "address'"); 4888 YYERROR; 4889 } 4890 if (!r.af && ! $9->host->ifindex) 4891 r.af = $9->host->af; 4892 4893 remove_invalid_hosts(&$9->host, &r.af); 4894 if (invalid_redirect($9->host, r.af)) 4895 YYERROR; 4896 if ($9->host->addr.type == PF_ADDR_DYNIFTL) { 4897 if (($9->host = gen_dynnode($9->host, r.af)) == NULL) 4898 err(1, "calloc"); 4899 } 4900 if (check_netmask($9->host, r.af)) 4901 YYERROR; 4902 } 4903 4904 o = keep_state_defaults; 4905 while (o) { 4906 switch (o->type) { 4907 case PF_STATE_OPT_PFLOW: 4908 if (r.rule_flag & PFRULE_PFLOW) { 4909 yyerror("state pflow option: " 4910 "multiple definitions"); 4911 YYERROR; 4912 } 4913 r.rule_flag |= PFRULE_PFLOW; 4914 break; 4915 } 4916 o = o->next; 4917 } 4918 4919 expand_rule(&r, false, $2, NULL, $9, NULL, $4, 4920 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 4921 $5.dst.port, 0, 0, 0, 0, ""); 4922 } 4923 ; 4924 4925 binatrule : no BINAT natpasslog interface af proto FROM ipspec toipspec tag 4926 tagged rtable binat_redirspec 4927 { 4928 struct pfctl_rule binat; 4929 struct pf_pooladdr *pa; 4930 4931 if (check_rulestate(PFCTL_STATE_NAT)) 4932 YYERROR; 4933 if (disallow_urpf_failed($9, "\"urpf-failed\" is not " 4934 "permitted as a binat destination")) 4935 YYERROR; 4936 4937 pfctl_init_rule(&binat); 4938 4939 if ($1 && $3.b1) { 4940 yyerror("\"pass\" not valid with \"no\""); 4941 YYERROR; 4942 } 4943 if ($1) 4944 binat.action = PF_NOBINAT; 4945 else 4946 binat.action = PF_BINAT; 4947 binat.natpass = $3.b1; 4948 binat.log = $3.b2; 4949 binat.logif = $3.w2; 4950 binat.af = $5; 4951 if (!binat.af && $8 != NULL && $8->af) 4952 binat.af = $8->af; 4953 if (!binat.af && $9 != NULL && $9->af) 4954 binat.af = $9->af; 4955 4956 if (!binat.af && $13 != NULL && $13->host) 4957 binat.af = $13->host->af; 4958 if (!binat.af) { 4959 yyerror("address family (inet/inet6) " 4960 "undefined"); 4961 YYERROR; 4962 } 4963 4964 if ($4 != NULL) { 4965 memcpy(binat.ifname, $4->ifname, 4966 sizeof(binat.ifname)); 4967 binat.ifnot = $4->not; 4968 free($4); 4969 } 4970 4971 if ($10 != NULL) 4972 if (strlcpy(binat.tagname, $10, 4973 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4974 yyerror("tag too long, max %u chars", 4975 PF_TAG_NAME_SIZE - 1); 4976 YYERROR; 4977 } 4978 if ($11.name) 4979 if (strlcpy(binat.match_tagname, $11.name, 4980 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 4981 yyerror("tag too long, max %u chars", 4982 PF_TAG_NAME_SIZE - 1); 4983 YYERROR; 4984 } 4985 binat.match_tag_not = $11.neg; 4986 binat.rtableid = $12; 4987 4988 if ($6 != NULL) { 4989 binat.proto = $6->proto; 4990 free($6); 4991 } 4992 4993 if ($8 != NULL && disallow_table($8, "invalid use of " 4994 "table <%s> as the source address of a binat rule")) 4995 YYERROR; 4996 if ($8 != NULL && disallow_alias($8, "invalid use of " 4997 "interface (%s) as the source address of a binat " 4998 "rule")) 4999 YYERROR; 5000 if ($13 != NULL && $13->host != NULL && disallow_table( 5001 $13->host, "invalid use of table <%s> as the " 5002 "redirect address of a binat rule")) 5003 YYERROR; 5004 if ($13 != NULL && $13->host != NULL && disallow_alias( 5005 $13->host, "invalid use of interface (%s) as the " 5006 "redirect address of a binat rule")) 5007 YYERROR; 5008 5009 if ($8 != NULL) { 5010 if ($8->next) { 5011 yyerror("multiple binat ip addresses"); 5012 YYERROR; 5013 } 5014 if ($8->addr.type == PF_ADDR_DYNIFTL) 5015 $8->af = binat.af; 5016 if ($8->af != binat.af) { 5017 yyerror("binat ip versions must match"); 5018 YYERROR; 5019 } 5020 if ($8->addr.type == PF_ADDR_DYNIFTL) { 5021 if (($8 = gen_dynnode($8, binat.af)) == NULL) 5022 err(1, "calloc"); 5023 } 5024 if (check_netmask($8, binat.af)) 5025 YYERROR; 5026 memcpy(&binat.src.addr, &$8->addr, 5027 sizeof(binat.src.addr)); 5028 free($8); 5029 } 5030 if ($9 != NULL) { 5031 if ($9->next) { 5032 yyerror("multiple binat ip addresses"); 5033 YYERROR; 5034 } 5035 if ($9->af != binat.af && $9->af) { 5036 yyerror("binat ip versions must match"); 5037 YYERROR; 5038 } 5039 if ($9->addr.type == PF_ADDR_DYNIFTL) { 5040 if (($9 = gen_dynnode($9, binat.af)) == NULL) 5041 err(1, "calloc"); 5042 } 5043 if (check_netmask($9, binat.af)) 5044 YYERROR; 5045 memcpy(&binat.dst.addr, &$9->addr, 5046 sizeof(binat.dst.addr)); 5047 binat.dst.neg = $9->not; 5048 free($9); 5049 } 5050 5051 if (binat.action == PF_NOBINAT) { 5052 if ($13 != NULL) { 5053 yyerror("'no binat' rule does not need" 5054 " '->'"); 5055 YYERROR; 5056 } 5057 } else { 5058 if ($13 == NULL || $13->host == NULL) { 5059 yyerror("'binat' rule requires" 5060 " '-> address'"); 5061 YYERROR; 5062 } 5063 5064 remove_invalid_hosts(&$13->host, &binat.af); 5065 if (invalid_redirect($13->host, binat.af)) 5066 YYERROR; 5067 if ($13->host->next != NULL) { 5068 yyerror("binat rule must redirect to " 5069 "a single address"); 5070 YYERROR; 5071 } 5072 if ($13->host->addr.type == PF_ADDR_DYNIFTL) { 5073 if (($13->host = gen_dynnode($13->host, binat.af)) == NULL) 5074 err(1, "calloc"); 5075 } 5076 if (check_netmask($13->host, binat.af)) 5077 YYERROR; 5078 5079 if (!PF_AZERO(&binat.src.addr.v.a.mask, 5080 binat.af) && 5081 !PF_AEQ(&binat.src.addr.v.a.mask, 5082 &$13->host->addr.v.a.mask, binat.af)) { 5083 yyerror("'binat' source mask and " 5084 "redirect mask must be the same"); 5085 YYERROR; 5086 } 5087 5088 pa = calloc(1, sizeof(struct pf_pooladdr)); 5089 if (pa == NULL) 5090 err(1, "binat: calloc"); 5091 pa->addr = $13->host->addr; 5092 pa->ifname[0] = 0; 5093 TAILQ_INSERT_TAIL(&binat.rdr.list, 5094 pa, entries); 5095 5096 free($13); 5097 } 5098 5099 pfctl_append_rule(pf, &binat, ""); 5100 } 5101 ; 5102 5103 tag : /* empty */ { $$ = NULL; } 5104 | TAG STRING { $$ = $2; } 5105 ; 5106 5107 tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 5108 | not TAGGED string { $$.neg = $1; $$.name = $3; } 5109 ; 5110 5111 rtable : /* empty */ { $$ = -1; } 5112 | RTABLE NUMBER { 5113 if ($2 < 0 || $2 > rt_tableid_max()) { 5114 yyerror("invalid rtable id"); 5115 YYERROR; 5116 } 5117 $$ = $2; 5118 } 5119 ; 5120 5121 route_host : STRING { 5122 $$ = calloc(1, sizeof(struct node_host)); 5123 if ($$ == NULL) 5124 err(1, "route_host: calloc"); 5125 if (strlen($1) >= IFNAMSIZ) { 5126 yyerror("interface name too long"); 5127 YYERROR; 5128 } 5129 $$->ifname = strdup($1); 5130 set_ipmask($$, 128); 5131 $$->next = NULL; 5132 $$->tail = $$; 5133 } 5134 | '(' STRING host ')' { 5135 struct node_host *n; 5136 5137 $$ = $3; 5138 for (n = $3; n != NULL; n = n->next) { 5139 if (strlen($2) >= IFNAMSIZ) { 5140 yyerror("interface name too long"); 5141 YYERROR; 5142 } 5143 n->ifname = strdup($2); 5144 } 5145 } 5146 ; 5147 5148 route_host_list : route_host optnl { $$ = $1; } 5149 | route_host_list comma route_host optnl { 5150 if ($1->af == 0) 5151 $1->af = $3->af; 5152 if ($1->af != $3->af) { 5153 yyerror("all pool addresses must be in the " 5154 "same address family"); 5155 YYERROR; 5156 } 5157 $1->tail->next = $3; 5158 $1->tail = $3->tail; 5159 $$ = $1; 5160 } 5161 ; 5162 5163 routespec : route_host { $$ = $1; } 5164 | '{' optnl route_host_list '}' { $$ = $3; } 5165 ; 5166 5167 route : /* empty */ { 5168 $$.rt = PF_NOPFROUTE; 5169 } 5170 | FASTROUTE { 5171 /* backwards-compat */ 5172 $$.rt = PF_NOPFROUTE; 5173 } 5174 | ROUTETO route_redirspec { 5175 $$.rt = PF_ROUTETO; 5176 $$.redirspec = $2; 5177 } 5178 | REPLYTO route_redirspec { 5179 $$.rt = PF_REPLYTO; 5180 $$.redirspec = $2; 5181 } 5182 | DUPTO route_redirspec { 5183 $$.rt = PF_DUPTO; 5184 $$.redirspec = $2; 5185 } 5186 ; 5187 5188 timeout_spec : STRING NUMBER 5189 { 5190 if (check_rulestate(PFCTL_STATE_OPTION)) { 5191 free($1); 5192 YYERROR; 5193 } 5194 if ($2 < 0 || $2 > UINT_MAX) { 5195 yyerror("only positive values permitted"); 5196 YYERROR; 5197 } 5198 if (pfctl_apply_timeout(pf, $1, $2, 0) != 0) { 5199 yyerror("unknown timeout %s", $1); 5200 free($1); 5201 YYERROR; 5202 } 5203 free($1); 5204 } 5205 | INTERVAL NUMBER { 5206 if (check_rulestate(PFCTL_STATE_OPTION)) 5207 YYERROR; 5208 if ($2 < 0 || $2 > UINT_MAX) { 5209 yyerror("only positive values permitted"); 5210 YYERROR; 5211 } 5212 if (pfctl_apply_timeout(pf, "interval", $2, 0) != 0) 5213 YYERROR; 5214 } 5215 ; 5216 5217 timeout_list : timeout_list comma timeout_spec optnl 5218 | timeout_spec optnl 5219 ; 5220 5221 limit_spec : STRING NUMBER 5222 { 5223 if (check_rulestate(PFCTL_STATE_OPTION)) { 5224 free($1); 5225 YYERROR; 5226 } 5227 if ($2 < 0 || $2 > UINT_MAX) { 5228 yyerror("only positive values permitted"); 5229 YYERROR; 5230 } 5231 if (pfctl_apply_limit(pf, $1, $2) != 0) { 5232 yyerror("unable to set limit %s %u", $1, $2); 5233 free($1); 5234 YYERROR; 5235 } 5236 free($1); 5237 } 5238 ; 5239 5240 limit_list : limit_list comma limit_spec optnl 5241 | limit_spec optnl 5242 ; 5243 5244 comma : ',' 5245 | /* empty */ 5246 ; 5247 5248 yesno : NO { $$ = 0; } 5249 | STRING { 5250 if (!strcmp($1, "yes")) 5251 $$ = 1; 5252 else { 5253 yyerror("invalid value '%s', expected 'yes' " 5254 "or 'no'", $1); 5255 free($1); 5256 YYERROR; 5257 } 5258 free($1); 5259 } 5260 ; 5261 5262 unaryop : '=' { $$ = PF_OP_EQ; } 5263 | NE { $$ = PF_OP_NE; } 5264 | LE { $$ = PF_OP_LE; } 5265 | '<' { $$ = PF_OP_LT; } 5266 | GE { $$ = PF_OP_GE; } 5267 | '>' { $$ = PF_OP_GT; } 5268 ; 5269 5270 %% 5271 5272 int 5273 yyerror(const char *fmt, ...) 5274 { 5275 va_list ap; 5276 5277 file->errors++; 5278 va_start(ap, fmt); 5279 fprintf(stderr, "%s:%d: ", file->name, yylval.lineno); 5280 vfprintf(stderr, fmt, ap); 5281 fprintf(stderr, "\n"); 5282 va_end(ap); 5283 return (0); 5284 } 5285 5286 int 5287 disallow_table(struct node_host *h, const char *fmt) 5288 { 5289 for (; h != NULL; h = h->next) 5290 if (h->addr.type == PF_ADDR_TABLE) { 5291 yyerror(fmt, h->addr.v.tblname); 5292 return (1); 5293 } 5294 return (0); 5295 } 5296 5297 int 5298 disallow_urpf_failed(struct node_host *h, const char *fmt) 5299 { 5300 for (; h != NULL; h = h->next) 5301 if (h->addr.type == PF_ADDR_URPFFAILED) { 5302 yyerror(fmt); 5303 return (1); 5304 } 5305 return (0); 5306 } 5307 5308 int 5309 disallow_alias(struct node_host *h, const char *fmt) 5310 { 5311 for (; h != NULL; h = h->next) 5312 if (DYNIF_MULTIADDR(h->addr)) { 5313 yyerror(fmt, h->addr.v.tblname); 5314 return (1); 5315 } 5316 return (0); 5317 } 5318 5319 int 5320 rule_consistent(struct pfctl_rule *r, int anchor_call) 5321 { 5322 int problems = 0; 5323 5324 switch (r->action) { 5325 case PF_PASS: 5326 case PF_MATCH: 5327 case PF_DROP: 5328 case PF_SCRUB: 5329 case PF_NOSCRUB: 5330 problems = filter_consistent(r, anchor_call); 5331 break; 5332 case PF_NAT: 5333 case PF_NONAT: 5334 problems = nat_consistent(r); 5335 break; 5336 case PF_RDR: 5337 case PF_NORDR: 5338 problems = rdr_consistent(r); 5339 break; 5340 case PF_BINAT: 5341 case PF_NOBINAT: 5342 default: 5343 break; 5344 } 5345 return (problems); 5346 } 5347 5348 int 5349 filter_consistent(struct pfctl_rule *r, int anchor_call) 5350 { 5351 int problems = 0; 5352 5353 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 5354 r->proto != IPPROTO_SCTP && 5355 (r->src.port_op || r->dst.port_op)) { 5356 yyerror("port only applies to tcp/udp/sctp"); 5357 problems++; 5358 } 5359 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 5360 (r->type || r->code)) { 5361 yyerror("icmp-type/code only applies to icmp"); 5362 problems++; 5363 } 5364 if (!r->af && (r->type || r->code)) { 5365 yyerror("must indicate address family with icmp-type/code"); 5366 problems++; 5367 } 5368 if (r->rule_flag & PFRULE_AFTO && r->af == r->naf) { 5369 yyerror("must indicate different address family with af-to"); 5370 problems++; 5371 } 5372 if (r->overload_tblname[0] && 5373 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 5374 yyerror("'overload' requires 'max-src-conn' " 5375 "or 'max-src-conn-rate'"); 5376 problems++; 5377 } 5378 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 5379 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 5380 yyerror("proto %s doesn't match address family %s", 5381 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 5382 r->af == AF_INET ? "inet" : "inet6"); 5383 problems++; 5384 } 5385 if (r->allow_opts && r->action != PF_PASS && r->action != PF_MATCH) { 5386 yyerror("allow-opts can only be specified for pass or " 5387 "match rules"); 5388 problems++; 5389 } 5390 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 5391 r->dst.port_op || r->flagset || r->type || r->code)) { 5392 yyerror("fragments can be filtered only on IP header fields"); 5393 problems++; 5394 } 5395 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 5396 yyerror("return-rst can only be applied to TCP rules"); 5397 problems++; 5398 } 5399 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 5400 yyerror("max-src-nodes requires 'source-track rule'"); 5401 problems++; 5402 } 5403 if (r->action != PF_PASS && r->keep_state) { 5404 yyerror("keep state is great, but only for pass rules"); 5405 problems++; 5406 } 5407 if (r->rule_flag & PFRULE_STATESLOPPY && 5408 (r->keep_state == PF_STATE_MODULATE || 5409 r->keep_state == PF_STATE_SYNPROXY)) { 5410 yyerror("sloppy state matching cannot be used with " 5411 "synproxy state or modulate state"); 5412 problems++; 5413 } 5414 if (r->rule_flag & PFRULE_AFTO && r->rt) { 5415 if (r->rt != PF_ROUTETO && r->rt != PF_REPLYTO) { 5416 yyerror("dup-to " 5417 "must not be used on af-to rules"); 5418 problems++; 5419 } 5420 } 5421 /* Basic rule sanity check. */ 5422 switch (r->action) { 5423 case PF_MATCH: 5424 if (r->divert.port) { 5425 yyerror("divert is not supported on match rules"); 5426 problems++; 5427 } 5428 if (r->rt) { 5429 yyerror("route-to, reply-to, dup-to and fastroute " 5430 "must not be used on match rules"); 5431 problems++; 5432 } 5433 if (r->rule_flag & PFRULE_AFTO) { 5434 yyerror("af-to is not supported on match rules"); 5435 problems++; 5436 } 5437 break; 5438 case PF_DROP: 5439 if (r->rt) { 5440 yyerror("route-to, reply-to and dup-to " 5441 "are not supported on block rules"); 5442 problems++; 5443 } 5444 break; 5445 default:; 5446 } 5447 if (!TAILQ_EMPTY(&(r->nat.list)) || !TAILQ_EMPTY(&(r->rdr.list))) { 5448 if (r->action != PF_MATCH && !r->keep_state) { 5449 yyerror("nat-to and rdr-to require keep state"); 5450 problems++; 5451 } 5452 if (r->direction == PF_INOUT) { 5453 yyerror("nat-to and rdr-to require a direction"); 5454 problems++; 5455 } 5456 } 5457 if (r->route.opts & PF_POOL_STICKYADDR && !r->keep_state) { 5458 yyerror("'sticky-address' requires 'keep state'"); 5459 } 5460 return (-problems); 5461 } 5462 5463 int 5464 nat_consistent(struct pfctl_rule *r) 5465 { 5466 return (0); /* yeah! */ 5467 } 5468 5469 int 5470 rdr_consistent(struct pfctl_rule *r) 5471 { 5472 int problems = 0; 5473 5474 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 5475 r->proto != IPPROTO_SCTP) { 5476 if (r->src.port_op) { 5477 yyerror("src port only applies to tcp/udp/sctp"); 5478 problems++; 5479 } 5480 if (r->dst.port_op) { 5481 yyerror("dst port only applies to tcp/udp/sctp"); 5482 problems++; 5483 } 5484 if (r->rdr.proxy_port[0]) { 5485 yyerror("rdr port only applies to tcp/udp/sctp"); 5486 problems++; 5487 } 5488 } 5489 if (r->dst.port_op && 5490 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 5491 yyerror("invalid port operator for rdr destination port"); 5492 problems++; 5493 } 5494 return (-problems); 5495 } 5496 5497 int 5498 process_tabledef(char *name, struct table_opts *opts, int popts) 5499 { 5500 struct pfr_buffer ab; 5501 struct node_tinit *ti; 5502 unsigned long maxcount; 5503 size_t s = sizeof(maxcount); 5504 5505 bzero(&ab, sizeof(ab)); 5506 ab.pfrb_type = PFRB_ADDRS; 5507 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 5508 if (ti->file) 5509 if (pfr_buf_load(&ab, ti->file, 0, append_addr, popts)) { 5510 if (errno) 5511 yyerror("cannot load \"%s\": %s", 5512 ti->file, strerror(errno)); 5513 else 5514 yyerror("file \"%s\" contains bad data", 5515 ti->file); 5516 goto _error; 5517 } 5518 if (ti->host) 5519 if (append_addr_host(&ab, ti->host, 0, 0)) { 5520 yyerror("cannot create address buffer: %s", 5521 strerror(errno)); 5522 goto _error; 5523 } 5524 } 5525 if (pf->opts & PF_OPT_VERBOSE) 5526 print_tabledef(name, opts->flags, opts->init_addr, 5527 &opts->init_nodes); 5528 if (!(pf->opts & PF_OPT_NOACTION) && 5529 pfctl_define_table(name, opts->flags, opts->init_addr, 5530 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 5531 5532 if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, 5533 NULL, 0) == -1) 5534 maxcount = 65535; 5535 5536 if (ab.pfrb_size > maxcount) 5537 yyerror("cannot define table %s: too many elements.\n" 5538 "Consider increasing net.pf.request_maxcount.", 5539 name); 5540 else 5541 yyerror("cannot define table %s: %s", name, 5542 pfr_strerror(errno)); 5543 5544 goto _error; 5545 } 5546 pf->tdirty = 1; 5547 pfr_buf_clear(&ab); 5548 return (0); 5549 _error: 5550 pfr_buf_clear(&ab); 5551 return (-1); 5552 } 5553 5554 struct keywords { 5555 const char *k_name; 5556 int k_val; 5557 }; 5558 5559 /* macro gore, but you should've seen the prior indentation nightmare... */ 5560 5561 #define FREE_LIST(T,r) \ 5562 do { \ 5563 T *p, *node = r; \ 5564 while (node != NULL) { \ 5565 p = node; \ 5566 node = node->next; \ 5567 free(p); \ 5568 } \ 5569 } while (0) 5570 5571 #define LOOP_THROUGH(T,n,r,C) \ 5572 do { \ 5573 T *n; \ 5574 if (r == NULL) { \ 5575 r = calloc(1, sizeof(T)); \ 5576 if (r == NULL) \ 5577 err(1, "LOOP: calloc"); \ 5578 r->next = NULL; \ 5579 } \ 5580 n = r; \ 5581 while (n != NULL) { \ 5582 do { \ 5583 C; \ 5584 } while (0); \ 5585 n = n->next; \ 5586 } \ 5587 } while (0) 5588 5589 void 5590 expand_label_str(char *label, size_t len, const char *srch, const char *repl) 5591 { 5592 char *tmp; 5593 char *p, *q; 5594 5595 if ((tmp = calloc(1, len)) == NULL) 5596 err(1, "expand_label_str: calloc"); 5597 p = q = label; 5598 while ((q = strstr(p, srch)) != NULL) { 5599 *q = '\0'; 5600 if ((strlcat(tmp, p, len) >= len) || 5601 (strlcat(tmp, repl, len) >= len)) 5602 errx(1, "expand_label: label too long"); 5603 q += strlen(srch); 5604 p = q; 5605 } 5606 if (strlcat(tmp, p, len) >= len) 5607 errx(1, "expand_label: label too long"); 5608 strlcpy(label, tmp, len); /* always fits */ 5609 free(tmp); 5610 } 5611 5612 void 5613 expand_label_if(const char *name, char *label, size_t len, const char *ifname) 5614 { 5615 if (strstr(label, name) != NULL) { 5616 if (!*ifname) 5617 expand_label_str(label, len, name, "any"); 5618 else 5619 expand_label_str(label, len, name, ifname); 5620 } 5621 } 5622 5623 void 5624 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 5625 struct pf_rule_addr *addr) 5626 { 5627 char tmp[64], tmp_not[66]; 5628 5629 if (strstr(label, name) != NULL) { 5630 switch (addr->addr.type) { 5631 case PF_ADDR_DYNIFTL: 5632 snprintf(tmp, sizeof(tmp), "(%s)", addr->addr.v.ifname); 5633 break; 5634 case PF_ADDR_TABLE: 5635 snprintf(tmp, sizeof(tmp), "<%s>", addr->addr.v.tblname); 5636 break; 5637 case PF_ADDR_NOROUTE: 5638 snprintf(tmp, sizeof(tmp), "no-route"); 5639 break; 5640 case PF_ADDR_URPFFAILED: 5641 snprintf(tmp, sizeof(tmp), "urpf-failed"); 5642 break; 5643 case PF_ADDR_ADDRMASK: 5644 if (!af || (PF_AZERO(&addr->addr.v.a.addr, af) && 5645 PF_AZERO(&addr->addr.v.a.mask, af))) 5646 snprintf(tmp, sizeof(tmp), "any"); 5647 else { 5648 char a[48]; 5649 int bits; 5650 5651 if (inet_ntop(af, &addr->addr.v.a.addr, a, 5652 sizeof(a)) == NULL) 5653 snprintf(tmp, sizeof(tmp), "?"); 5654 else { 5655 bits = unmask(&addr->addr.v.a.mask, af); 5656 if ((af == AF_INET && bits < 32) || 5657 (af == AF_INET6 && bits < 128)) 5658 snprintf(tmp, sizeof(tmp), 5659 "%s/%d", a, bits); 5660 else 5661 snprintf(tmp, sizeof(tmp), 5662 "%s", a); 5663 } 5664 } 5665 break; 5666 default: 5667 snprintf(tmp, sizeof(tmp), "?"); 5668 break; 5669 } 5670 5671 if (addr->neg) { 5672 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 5673 expand_label_str(label, len, name, tmp_not); 5674 } else 5675 expand_label_str(label, len, name, tmp); 5676 } 5677 } 5678 5679 void 5680 expand_label_port(const char *name, char *label, size_t len, 5681 struct pf_rule_addr *addr) 5682 { 5683 char a1[6], a2[6], op[13] = ""; 5684 5685 if (strstr(label, name) != NULL) { 5686 snprintf(a1, sizeof(a1), "%u", ntohs(addr->port[0])); 5687 snprintf(a2, sizeof(a2), "%u", ntohs(addr->port[1])); 5688 if (!addr->port_op) 5689 ; 5690 else if (addr->port_op == PF_OP_IRG) 5691 snprintf(op, sizeof(op), "%s><%s", a1, a2); 5692 else if (addr->port_op == PF_OP_XRG) 5693 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 5694 else if (addr->port_op == PF_OP_EQ) 5695 snprintf(op, sizeof(op), "%s", a1); 5696 else if (addr->port_op == PF_OP_NE) 5697 snprintf(op, sizeof(op), "!=%s", a1); 5698 else if (addr->port_op == PF_OP_LT) 5699 snprintf(op, sizeof(op), "<%s", a1); 5700 else if (addr->port_op == PF_OP_LE) 5701 snprintf(op, sizeof(op), "<=%s", a1); 5702 else if (addr->port_op == PF_OP_GT) 5703 snprintf(op, sizeof(op), ">%s", a1); 5704 else if (addr->port_op == PF_OP_GE) 5705 snprintf(op, sizeof(op), ">=%s", a1); 5706 expand_label_str(label, len, name, op); 5707 } 5708 } 5709 5710 void 5711 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 5712 { 5713 const char *protoname; 5714 char n[4]; 5715 5716 if (strstr(label, name) != NULL) { 5717 protoname = pfctl_proto2name(proto); 5718 if (protoname != NULL) 5719 expand_label_str(label, len, name, protoname); 5720 else { 5721 snprintf(n, sizeof(n), "%u", proto); 5722 expand_label_str(label, len, name, n); 5723 } 5724 } 5725 } 5726 5727 void 5728 expand_label_nr(const char *name, char *label, size_t len, 5729 struct pfctl_rule *r) 5730 { 5731 char n[11]; 5732 5733 if (strstr(label, name) != NULL) { 5734 snprintf(n, sizeof(n), "%u", r->nr); 5735 expand_label_str(label, len, name, n); 5736 } 5737 } 5738 5739 void 5740 expand_label(char *label, size_t len, struct pfctl_rule *r) 5741 { 5742 expand_label_if("$if", label, len, r->ifname); 5743 expand_label_addr("$srcaddr", label, len, r->af, &r->src); 5744 expand_label_addr("$dstaddr", label, len, r->af, &r->dst); 5745 expand_label_port("$srcport", label, len, &r->src); 5746 expand_label_port("$dstport", label, len, &r->dst); 5747 expand_label_proto("$proto", label, len, r->proto); 5748 expand_label_nr("$nr", label, len, r); 5749 } 5750 5751 int 5752 expand_altq(struct pf_altq *a, struct node_if *interfaces, 5753 struct node_queue *nqueues, struct node_queue_bw bwspec, 5754 struct node_queue_opt *opts) 5755 { 5756 struct pf_altq pa, pb; 5757 char qname[PF_QNAME_SIZE]; 5758 struct node_queue *n; 5759 struct node_queue_bw bw; 5760 int errs = 0; 5761 5762 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 5763 FREE_LIST(struct node_if, interfaces); 5764 if (nqueues) 5765 FREE_LIST(struct node_queue, nqueues); 5766 return (0); 5767 } 5768 5769 LOOP_THROUGH(struct node_if, interface, interfaces, 5770 memcpy(&pa, a, sizeof(struct pf_altq)); 5771 if (strlcpy(pa.ifname, interface->ifname, 5772 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 5773 errx(1, "expand_altq: strlcpy"); 5774 5775 if (interface->not) { 5776 yyerror("altq on ! <interface> is not supported"); 5777 errs++; 5778 } else { 5779 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 5780 errs++; 5781 else 5782 if (pfctl_add_altq(pf, &pa)) 5783 errs++; 5784 5785 if (pf->opts & PF_OPT_VERBOSE) { 5786 print_altq(&pf->paltq->altq, 0, 5787 &bwspec, opts); 5788 if (nqueues && nqueues->tail) { 5789 printf("queue { "); 5790 LOOP_THROUGH(struct node_queue, queue, 5791 nqueues, 5792 printf("%s ", 5793 queue->queue); 5794 ); 5795 printf("}"); 5796 } 5797 printf("\n"); 5798 } 5799 5800 if (pa.scheduler == ALTQT_CBQ || 5801 pa.scheduler == ALTQT_HFSC || 5802 pa.scheduler == ALTQT_FAIRQ) { 5803 /* now create a root queue */ 5804 memset(&pb, 0, sizeof(struct pf_altq)); 5805 if (strlcpy(qname, "root_", sizeof(qname)) >= 5806 sizeof(qname)) 5807 errx(1, "expand_altq: strlcpy"); 5808 if (strlcat(qname, interface->ifname, 5809 sizeof(qname)) >= sizeof(qname)) 5810 errx(1, "expand_altq: strlcat"); 5811 if (strlcpy(pb.qname, qname, 5812 sizeof(pb.qname)) >= sizeof(pb.qname)) 5813 errx(1, "expand_altq: strlcpy"); 5814 if (strlcpy(pb.ifname, interface->ifname, 5815 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 5816 errx(1, "expand_altq: strlcpy"); 5817 pb.qlimit = pa.qlimit; 5818 pb.scheduler = pa.scheduler; 5819 bw.bw_absolute = pa.ifbandwidth; 5820 bw.bw_percent = 0; 5821 if (eval_pfqueue(pf, &pb, &bw, opts)) 5822 errs++; 5823 else 5824 if (pfctl_add_altq(pf, &pb)) 5825 errs++; 5826 } 5827 5828 LOOP_THROUGH(struct node_queue, queue, nqueues, 5829 n = calloc(1, sizeof(struct node_queue)); 5830 if (n == NULL) 5831 err(1, "expand_altq: calloc"); 5832 if (pa.scheduler == ALTQT_CBQ || 5833 pa.scheduler == ALTQT_HFSC || 5834 pa.scheduler == ALTQT_FAIRQ) 5835 if (strlcpy(n->parent, qname, 5836 sizeof(n->parent)) >= 5837 sizeof(n->parent)) 5838 errx(1, "expand_altq: strlcpy"); 5839 if (strlcpy(n->queue, queue->queue, 5840 sizeof(n->queue)) >= sizeof(n->queue)) 5841 errx(1, "expand_altq: strlcpy"); 5842 if (strlcpy(n->ifname, interface->ifname, 5843 sizeof(n->ifname)) >= sizeof(n->ifname)) 5844 errx(1, "expand_altq: strlcpy"); 5845 n->scheduler = pa.scheduler; 5846 n->next = NULL; 5847 n->tail = n; 5848 if (queues == NULL) 5849 queues = n; 5850 else { 5851 queues->tail->next = n; 5852 queues->tail = n; 5853 } 5854 ); 5855 } 5856 ); 5857 FREE_LIST(struct node_if, interfaces); 5858 if (nqueues) 5859 FREE_LIST(struct node_queue, nqueues); 5860 5861 return (errs); 5862 } 5863 5864 int 5865 expand_queue(struct pf_altq *a, struct node_if *interfaces, 5866 struct node_queue *nqueues, struct node_queue_bw bwspec, 5867 struct node_queue_opt *opts) 5868 { 5869 struct node_queue *n, *nq; 5870 struct pf_altq pa; 5871 u_int8_t found = 0; 5872 u_int8_t errs = 0; 5873 5874 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 5875 FREE_LIST(struct node_queue, nqueues); 5876 return (0); 5877 } 5878 5879 if (queues == NULL) { 5880 yyerror("queue %s has no parent", a->qname); 5881 FREE_LIST(struct node_queue, nqueues); 5882 return (1); 5883 } 5884 5885 LOOP_THROUGH(struct node_if, interface, interfaces, 5886 LOOP_THROUGH(struct node_queue, tqueue, queues, 5887 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 5888 (interface->ifname[0] == 0 || 5889 (!interface->not && !strncmp(interface->ifname, 5890 tqueue->ifname, IFNAMSIZ)) || 5891 (interface->not && strncmp(interface->ifname, 5892 tqueue->ifname, IFNAMSIZ)))) { 5893 /* found ourself in queues */ 5894 found++; 5895 5896 memcpy(&pa, a, sizeof(struct pf_altq)); 5897 5898 if (pa.scheduler != ALTQT_NONE && 5899 pa.scheduler != tqueue->scheduler) { 5900 yyerror("exactly one scheduler type " 5901 "per interface allowed"); 5902 return (1); 5903 } 5904 pa.scheduler = tqueue->scheduler; 5905 5906 /* scheduler dependent error checking */ 5907 switch (pa.scheduler) { 5908 case ALTQT_PRIQ: 5909 if (nqueues != NULL) { 5910 yyerror("priq queues cannot " 5911 "have child queues"); 5912 return (1); 5913 } 5914 if (bwspec.bw_absolute > 0 || 5915 bwspec.bw_percent < 100) { 5916 yyerror("priq doesn't take " 5917 "bandwidth"); 5918 return (1); 5919 } 5920 break; 5921 default: 5922 break; 5923 } 5924 5925 if (strlcpy(pa.ifname, tqueue->ifname, 5926 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 5927 errx(1, "expand_queue: strlcpy"); 5928 if (strlcpy(pa.parent, tqueue->parent, 5929 sizeof(pa.parent)) >= sizeof(pa.parent)) 5930 errx(1, "expand_queue: strlcpy"); 5931 5932 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 5933 errs++; 5934 else 5935 if (pfctl_add_altq(pf, &pa)) 5936 errs++; 5937 5938 for (nq = nqueues; nq != NULL; nq = nq->next) { 5939 if (!strcmp(a->qname, nq->queue)) { 5940 yyerror("queue cannot have " 5941 "itself as child"); 5942 errs++; 5943 continue; 5944 } 5945 n = calloc(1, 5946 sizeof(struct node_queue)); 5947 if (n == NULL) 5948 err(1, "expand_queue: calloc"); 5949 if (strlcpy(n->parent, a->qname, 5950 sizeof(n->parent)) >= 5951 sizeof(n->parent)) 5952 errx(1, "expand_queue strlcpy"); 5953 if (strlcpy(n->queue, nq->queue, 5954 sizeof(n->queue)) >= 5955 sizeof(n->queue)) 5956 errx(1, "expand_queue strlcpy"); 5957 if (strlcpy(n->ifname, tqueue->ifname, 5958 sizeof(n->ifname)) >= 5959 sizeof(n->ifname)) 5960 errx(1, "expand_queue strlcpy"); 5961 n->scheduler = tqueue->scheduler; 5962 n->next = NULL; 5963 n->tail = n; 5964 if (queues == NULL) 5965 queues = n; 5966 else { 5967 queues->tail->next = n; 5968 queues->tail = n; 5969 } 5970 } 5971 if ((pf->opts & PF_OPT_VERBOSE) && ( 5972 (found == 1 && interface->ifname[0] == 0) || 5973 (found > 0 && interface->ifname[0] != 0))) { 5974 print_queue(&pf->paltq->altq, 0, 5975 &bwspec, interface->ifname[0] != 0, 5976 opts); 5977 if (nqueues && nqueues->tail) { 5978 printf("{ "); 5979 LOOP_THROUGH(struct node_queue, 5980 queue, nqueues, 5981 printf("%s ", 5982 queue->queue); 5983 ); 5984 printf("}"); 5985 } 5986 printf("\n"); 5987 } 5988 } 5989 ); 5990 ); 5991 5992 FREE_LIST(struct node_queue, nqueues); 5993 FREE_LIST(struct node_if, interfaces); 5994 5995 if (!found) { 5996 yyerror("queue %s has no parent", a->qname); 5997 errs++; 5998 } 5999 6000 if (errs) 6001 return (1); 6002 else 6003 return (0); 6004 } 6005 6006 static int 6007 pf_af_to_proto(sa_family_t af) 6008 { 6009 if (af == AF_INET) 6010 return (ETHERTYPE_IP); 6011 if (af == AF_INET6) 6012 return (ETHERTYPE_IPV6); 6013 6014 return (0); 6015 } 6016 6017 void 6018 expand_eth_rule(struct pfctl_eth_rule *r, 6019 struct node_if *interfaces, struct node_etherproto *protos, 6020 struct node_mac *srcs, struct node_mac *dsts, 6021 struct node_host *ipsrcs, struct node_host *ipdsts, 6022 const char *bridge_to, const char *anchor_call) 6023 { 6024 char tagname[PF_TAG_NAME_SIZE]; 6025 char match_tagname[PF_TAG_NAME_SIZE]; 6026 char qname[PF_QNAME_SIZE]; 6027 6028 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 6029 errx(1, "expand_eth_rule: tagname"); 6030 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 6031 sizeof(match_tagname)) 6032 errx(1, "expand_eth_rule: match_tagname"); 6033 if (strlcpy(qname, r->qname, sizeof(qname)) >= sizeof(qname)) 6034 errx(1, "expand_eth_rule: qname"); 6035 6036 LOOP_THROUGH(struct node_if, interface, interfaces, 6037 LOOP_THROUGH(struct node_etherproto, proto, protos, 6038 LOOP_THROUGH(struct node_mac, src, srcs, 6039 LOOP_THROUGH(struct node_mac, dst, dsts, 6040 LOOP_THROUGH(struct node_host, ipsrc, ipsrcs, 6041 LOOP_THROUGH(struct node_host, ipdst, ipdsts, 6042 strlcpy(r->ifname, interface->ifname, 6043 sizeof(r->ifname)); 6044 r->ifnot = interface->not; 6045 r->proto = proto->proto; 6046 if (!r->proto && ipsrc->af) 6047 r->proto = pf_af_to_proto(ipsrc->af); 6048 else if (!r->proto && ipdst->af) 6049 r->proto = pf_af_to_proto(ipdst->af); 6050 bcopy(src->mac, r->src.addr, ETHER_ADDR_LEN); 6051 bcopy(src->mask, r->src.mask, ETHER_ADDR_LEN); 6052 r->src.neg = src->neg; 6053 r->src.isset = src->isset; 6054 r->ipsrc.addr = ipsrc->addr; 6055 r->ipsrc.neg = ipsrc->not; 6056 r->ipdst.addr = ipdst->addr; 6057 r->ipdst.neg = ipdst->not; 6058 bcopy(dst->mac, r->dst.addr, ETHER_ADDR_LEN); 6059 bcopy(dst->mask, r->dst.mask, ETHER_ADDR_LEN); 6060 r->dst.neg = dst->neg; 6061 r->dst.isset = dst->isset; 6062 r->nr = pf->eastack[pf->asd]->match++; 6063 6064 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 6065 sizeof(r->tagname)) 6066 errx(1, "expand_eth_rule: r->tagname"); 6067 if (strlcpy(r->match_tagname, match_tagname, 6068 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 6069 errx(1, "expand_eth_rule: r->match_tagname"); 6070 if (strlcpy(r->qname, qname, sizeof(r->qname)) >= sizeof(r->qname)) 6071 errx(1, "expand_eth_rule: r->qname"); 6072 6073 if (bridge_to) 6074 strlcpy(r->bridge_to, bridge_to, sizeof(r->bridge_to)); 6075 6076 pfctl_append_eth_rule(pf, r, anchor_call); 6077 )))))); 6078 6079 FREE_LIST(struct node_if, interfaces); 6080 FREE_LIST(struct node_etherproto, protos); 6081 FREE_LIST(struct node_mac, srcs); 6082 FREE_LIST(struct node_mac, dsts); 6083 FREE_LIST(struct node_host, ipsrcs); 6084 FREE_LIST(struct node_host, ipdsts); 6085 } 6086 6087 int 6088 apply_rdr_ports(struct pfctl_rule *r, struct pfctl_pool *rpool, struct redirspec *rs) 6089 { 6090 if (rs == NULL) 6091 return 0; 6092 6093 rpool->proxy_port[0] = ntohs(rs->rport.a); 6094 6095 if (!rs->rport.b && rs->rport.t) { 6096 rpool->proxy_port[1] = ntohs(rs->rport.a) + 6097 (ntohs(r->dst.port[1]) - ntohs(r->dst.port[0])); 6098 } else 6099 r->rdr.proxy_port[1] = ntohs(rs->rport.b); 6100 6101 if (rs->pool_opts.staticport) { 6102 yyerror("the 'static-port' option is only valid with nat rules"); 6103 return 1; 6104 } 6105 6106 if (rs->pool_opts.mape.offset) { 6107 yyerror("the 'map-e-portset' option is only valid with nat rules"); 6108 return 1; 6109 } 6110 6111 return 0; 6112 } 6113 6114 int 6115 apply_nat_ports(struct pfctl_pool *rpool, struct redirspec *rs) 6116 { 6117 if (rs == NULL) 6118 return 0; 6119 6120 rpool->proxy_port[0] = ntohs(rs->rport.a); 6121 rpool->proxy_port[1] = ntohs(rs->rport.b); 6122 if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { 6123 rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW; 6124 rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH; 6125 } else if (!rpool->proxy_port[1]) 6126 rpool->proxy_port[1] = rpool->proxy_port[0]; 6127 6128 if (rs->pool_opts.staticport) { 6129 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 6130 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 6131 yyerror("the 'static-port' option can't" 6132 " be used when specifying a port" 6133 " range"); 6134 return 1; 6135 } 6136 rpool->proxy_port[0] = 0; 6137 rpool->proxy_port[1] = 0; 6138 } 6139 6140 if (rs->pool_opts.mape.offset) { 6141 if (rs->pool_opts.staticport) { 6142 yyerror("the 'map-e-portset' option" 6143 " can't be used 'static-port'"); 6144 return 1; 6145 } 6146 if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW && 6147 rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH) { 6148 yyerror("the 'map-e-portset' option" 6149 " can't be used when specifying" 6150 " a port range"); 6151 return 1; 6152 } 6153 rpool->mape = rs->pool_opts.mape; 6154 } 6155 6156 return 0; 6157 } 6158 6159 int 6160 apply_redirspec(struct pfctl_pool *rpool, struct redirspec *rs) 6161 { 6162 struct node_host *h; 6163 struct pf_pooladdr *pa; 6164 6165 if (rs == NULL) 6166 return 0; 6167 6168 rpool->opts = rs->pool_opts.type; 6169 6170 if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_NONE && 6171 (rs->host->next != NULL || 6172 rs->host->addr.type == PF_ADDR_TABLE || 6173 DYNIF_MULTIADDR(rs->host->addr))) 6174 rpool->opts = PF_POOL_ROUNDROBIN; 6175 6176 if (!PF_POOL_DYNTYPE(rpool->opts) && 6177 (disallow_table(rs->host, "tables are not supported by pool type") || 6178 disallow_alias(rs->host, "interface (%s) is not supported by pool type"))) 6179 return 1; 6180 6181 if (rs->host->next != NULL && 6182 ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)) { 6183 yyerror("r.route.opts must be PF_POOL_ROUNDROBIN"); 6184 return 1; 6185 } 6186 6187 if (rs->host->next != NULL) { 6188 if ((rpool->opts & PF_POOL_TYPEMASK) != 6189 PF_POOL_ROUNDROBIN) { 6190 yyerror("only round-robin valid for multiple " 6191 "redirection addresses"); 6192 return 1; 6193 } 6194 } 6195 6196 rpool->opts |= rs->pool_opts.opts; 6197 6198 if (rs->pool_opts.key != NULL) 6199 memcpy(&(rpool->key), rs->pool_opts.key, 6200 sizeof(struct pf_poolhashkey)); 6201 6202 for (h = rs->host; h != NULL; h = h->next) { 6203 pa = calloc(1, sizeof(struct pf_pooladdr)); 6204 if (pa == NULL) 6205 err(1, "expand_rule: calloc"); 6206 pa->addr = h->addr; 6207 if (h->ifname != NULL) { 6208 if (strlcpy(pa->ifname, h->ifname, 6209 sizeof(pa->ifname)) >= sizeof(pa->ifname)) 6210 errx(1, "expand_rule: strlcpy"); 6211 } else 6212 pa->ifname[0] = 0; 6213 TAILQ_INSERT_TAIL(&(rpool->list), pa, entries); 6214 } 6215 6216 return 0; 6217 } 6218 6219 int 6220 check_binat_redirspec(struct node_host *src_host, struct pfctl_rule *r, int af) 6221 { 6222 struct pf_pooladdr *nat_pool = TAILQ_FIRST(&(r->nat.list)); 6223 int error = 0; 6224 6225 /* XXX: FreeBSD allows syntax like "{ host1 host2 }" for redirection 6226 * pools but does not covert them to tables automatically, because 6227 * syntax "{ (iface1 host1), (iface2 iface2) }" is allowed for route-to 6228 * redirection. Add a FreeBSD-specific guard against using multiple 6229 * hosts for source and redirection. 6230 */ 6231 if (src_host->next) { 6232 yyerror("invalid use of table as the source address " 6233 "of a binat-to rule"); 6234 error++; 6235 } 6236 if (TAILQ_NEXT(nat_pool, entries)) { 6237 yyerror ("tables cannot be used as the redirect " 6238 "address of a binat-to rule"); 6239 error++; 6240 } 6241 6242 if (disallow_table(src_host, "invalid use of table " 6243 "<%s> as the source address of a binat-to rule") || 6244 disallow_alias(src_host, "invalid use of interface " 6245 "(%s) as the source address of a binat-to rule")) { 6246 error++; 6247 } else if ((r->src.addr.type != PF_ADDR_ADDRMASK && 6248 r->src.addr.type != PF_ADDR_DYNIFTL) || 6249 (nat_pool->addr.type != PF_ADDR_ADDRMASK && 6250 nat_pool->addr.type != PF_ADDR_DYNIFTL)) { 6251 yyerror("binat-to requires a specified " 6252 "source and redirect address"); 6253 error++; 6254 } 6255 if (DYNIF_MULTIADDR(r->src.addr) || 6256 DYNIF_MULTIADDR(nat_pool->addr)) { 6257 yyerror ("dynamic interfaces must be " 6258 "used with:0 in a binat-to rule"); 6259 error++; 6260 } 6261 if (PF_AZERO(&r->src.addr.v.a.mask, af) || 6262 PF_AZERO(&(nat_pool->addr.v.a.mask), af)) { 6263 yyerror ("source and redir addresess must have " 6264 "a matching network mask in binat-rule"); 6265 error++; 6266 } 6267 if (nat_pool->addr.type == PF_ADDR_TABLE) { 6268 yyerror ("tables cannot be used as the redirect " 6269 "address of a binat-to rule"); 6270 error++; 6271 } 6272 if (r->direction != PF_INOUT) { 6273 yyerror("binat-to cannot be specified " 6274 "with a direction"); 6275 error++; 6276 } 6277 6278 /* first specify outbound NAT rule */ 6279 r->direction = PF_OUT; 6280 6281 return (error); 6282 } 6283 6284 void 6285 add_binat_rdr_rule( 6286 struct pfctl_rule *binat_rule, 6287 struct redirspec *binat_nat_redirspec, struct node_host *binat_src_host, 6288 struct pfctl_rule *rdr_rule, struct redirspec **rdr_redirspec, 6289 struct node_host **rdr_dst_host) 6290 { 6291 struct node_host *rdr_src_host; 6292 6293 /* 6294 * We're copying the whole rule, but we must re-init redir pools. 6295 * FreeBSD uses lists of pf_pooladdr, we can't just overwrite them. 6296 */ 6297 bcopy(binat_rule, rdr_rule, sizeof(struct pfctl_rule)); 6298 TAILQ_INIT(&(rdr_rule->rdr.list)); 6299 TAILQ_INIT(&(rdr_rule->nat.list)); 6300 6301 /* now specify inbound rdr rule */ 6302 rdr_rule->direction = PF_IN; 6303 6304 if ((rdr_src_host = calloc(1, sizeof(*rdr_src_host))) == NULL) 6305 err(1, "%s", __func__); 6306 bcopy(binat_src_host, rdr_src_host, sizeof(*rdr_src_host)); 6307 rdr_src_host->ifname = NULL; 6308 rdr_src_host->next = NULL; 6309 rdr_src_host->tail = NULL; 6310 6311 if (((*rdr_dst_host) = calloc(1, sizeof(**rdr_dst_host))) == NULL) 6312 err(1, "%s", __func__); 6313 bcopy(&(binat_nat_redirspec->host->addr), &((*rdr_dst_host)->addr), 6314 sizeof((*rdr_dst_host)->addr)); 6315 (*rdr_dst_host)->ifname = NULL; 6316 (*rdr_dst_host)->next = NULL; 6317 (*rdr_dst_host)->tail = NULL; 6318 6319 if (((*rdr_redirspec) = calloc(1, sizeof(**rdr_redirspec))) == NULL) 6320 err(1, "%s", __func__); 6321 bcopy(binat_nat_redirspec, (*rdr_redirspec), sizeof(**rdr_redirspec)); 6322 (*rdr_redirspec)->pool_opts.staticport = 0; 6323 (*rdr_redirspec)->host = rdr_src_host; 6324 } 6325 6326 void 6327 expand_rule(struct pfctl_rule *r, bool keeprule, 6328 struct node_if *interfaces, struct redirspec *nat, 6329 struct redirspec *rdr, struct redirspec *route, 6330 struct node_proto *protos, 6331 struct node_os *src_oses, struct node_host *src_hosts, 6332 struct node_port *src_ports, struct node_host *dst_hosts, 6333 struct node_port *dst_ports, struct node_uid *uids, struct node_gid *gids, 6334 struct node_if *rcv, struct node_icmp *icmp_types, const char *anchor_call) 6335 { 6336 sa_family_t af = r->af; 6337 int added = 0, error = 0; 6338 char ifname[IF_NAMESIZE]; 6339 char label[PF_RULE_MAX_LABEL_COUNT][PF_RULE_LABEL_SIZE]; 6340 char tagname[PF_TAG_NAME_SIZE]; 6341 char match_tagname[PF_TAG_NAME_SIZE]; 6342 struct node_host *osrch, *odsth; 6343 u_int8_t flags, flagset, keep_state; 6344 6345 memcpy(label, r->label, sizeof(r->label)); 6346 assert(sizeof(r->label) == sizeof(label)); 6347 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 6348 errx(1, "expand_rule: strlcpy"); 6349 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 6350 sizeof(match_tagname)) 6351 errx(1, "expand_rule: strlcpy"); 6352 flags = r->flags; 6353 flagset = r->flagset; 6354 keep_state = r->keep_state; 6355 6356 LOOP_THROUGH(struct node_if, interface, interfaces, 6357 LOOP_THROUGH(struct node_proto, proto, protos, 6358 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 6359 LOOP_THROUGH(struct node_host, src_host, src_hosts, 6360 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 6361 LOOP_THROUGH(struct node_port, src_port, src_ports, 6362 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 6363 LOOP_THROUGH(struct node_os, src_os, src_oses, 6364 LOOP_THROUGH(struct node_uid, uid, uids, 6365 LOOP_THROUGH(struct node_gid, gid, gids, 6366 6367 r->af = af; 6368 6369 if (r->rule_flag & PFRULE_AFTO) { 6370 assert(nat != NULL); 6371 r->naf = nat->af; 6372 } 6373 6374 /* for link-local IPv6 address, interface must match up */ 6375 if ((r->af && src_host->af && r->af != src_host->af) || 6376 (r->af && dst_host->af && r->af != dst_host->af) || 6377 (src_host->af && dst_host->af && 6378 src_host->af != dst_host->af) || 6379 (src_host->ifindex && dst_host->ifindex && 6380 src_host->ifindex != dst_host->ifindex) || 6381 (src_host->ifindex && *interface->ifname && 6382 src_host->ifindex != ifa_nametoindex(interface->ifname)) || 6383 (dst_host->ifindex && *interface->ifname && 6384 dst_host->ifindex != ifa_nametoindex(interface->ifname))) 6385 continue; 6386 if (!r->af && src_host->af) 6387 r->af = src_host->af; 6388 else if (!r->af && dst_host->af) 6389 r->af = dst_host->af; 6390 6391 if (*interface->ifname) 6392 strlcpy(r->ifname, interface->ifname, 6393 sizeof(r->ifname)); 6394 else if (ifa_indextoname(src_host->ifindex, ifname)) 6395 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 6396 else if (ifa_indextoname(dst_host->ifindex, ifname)) 6397 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 6398 else 6399 memset(r->ifname, '\0', sizeof(r->ifname)); 6400 6401 memcpy(r->label, label, sizeof(r->label)); 6402 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 6403 sizeof(r->tagname)) 6404 errx(1, "expand_rule: strlcpy"); 6405 if (strlcpy(r->match_tagname, match_tagname, 6406 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 6407 errx(1, "expand_rule: strlcpy"); 6408 6409 osrch = odsth = NULL; 6410 if (src_host->addr.type == PF_ADDR_DYNIFTL) { 6411 osrch = src_host; 6412 if ((src_host = gen_dynnode(src_host, r->af)) == NULL) 6413 err(1, "expand_rule: calloc"); 6414 } 6415 if (dst_host->addr.type == PF_ADDR_DYNIFTL) { 6416 odsth = dst_host; 6417 if ((dst_host = gen_dynnode(dst_host, r->af)) == NULL) 6418 err(1, "expand_rule: calloc"); 6419 } 6420 6421 error += check_netmask(src_host, r->af); 6422 error += check_netmask(dst_host, r->af); 6423 6424 r->ifnot = interface->not; 6425 r->proto = proto->proto; 6426 r->src.addr = src_host->addr; 6427 r->src.neg = src_host->not; 6428 r->src.port[0] = src_port->port[0]; 6429 r->src.port[1] = src_port->port[1]; 6430 r->src.port_op = src_port->op; 6431 r->dst.addr = dst_host->addr; 6432 r->dst.neg = dst_host->not; 6433 r->dst.port[0] = dst_port->port[0]; 6434 r->dst.port[1] = dst_port->port[1]; 6435 r->dst.port_op = dst_port->op; 6436 r->uid.op = uid->op; 6437 r->uid.uid[0] = uid->uid[0]; 6438 r->uid.uid[1] = uid->uid[1]; 6439 r->gid.op = gid->op; 6440 r->gid.gid[0] = gid->gid[0]; 6441 r->gid.gid[1] = gid->gid[1]; 6442 if (rcv) { 6443 strlcpy(r->rcv_ifname, rcv->ifname, 6444 sizeof(r->rcv_ifname)); 6445 r->rcvifnot = rcv->not; 6446 } 6447 r->type = icmp_type->type; 6448 r->code = icmp_type->code; 6449 6450 if ((keep_state == PF_STATE_MODULATE || 6451 keep_state == PF_STATE_SYNPROXY) && 6452 r->proto && r->proto != IPPROTO_TCP) 6453 r->keep_state = PF_STATE_NORMAL; 6454 else 6455 r->keep_state = keep_state; 6456 6457 if (r->proto && r->proto != IPPROTO_TCP) { 6458 r->flags = 0; 6459 r->flagset = 0; 6460 } else { 6461 r->flags = flags; 6462 r->flagset = flagset; 6463 } 6464 if (icmp_type->proto && r->proto != icmp_type->proto) { 6465 yyerror("icmp-type mismatch"); 6466 error++; 6467 } 6468 6469 if (src_os && src_os->os) { 6470 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 6471 if ((pf->opts & PF_OPT_VERBOSE2) && 6472 r->os_fingerprint == PF_OSFP_NOMATCH) 6473 fprintf(stderr, 6474 "warning: unknown '%s' OS fingerprint\n", 6475 src_os->os); 6476 } else { 6477 r->os_fingerprint = PF_OSFP_ANY; 6478 } 6479 6480 if (r->action == PF_RDR) { 6481 /* Pre-FreeBSD 15 "rdr" rule */ 6482 error += apply_rdr_ports(r, &(r->rdr), rdr); 6483 error += apply_redirspec(&(r->rdr), rdr); 6484 } else if (r->action == PF_NAT) { 6485 /* Pre-FreeBSD 15 "nat" rule */ 6486 error += apply_nat_ports(&(r->rdr), rdr); 6487 error += apply_redirspec(&(r->rdr), rdr); 6488 } else { 6489 /* Modern rule with optional NAT, BINAT, RDR or ROUTE*/ 6490 error += apply_redirspec(&(r->route), route); 6491 6492 error += apply_nat_ports(&(r->nat), nat); 6493 error += apply_redirspec(&(r->nat), nat); 6494 error += apply_rdr_ports(r, &(r->rdr), rdr); 6495 error += apply_redirspec(&(r->rdr), rdr); 6496 6497 if (nat && nat->binat) 6498 error += check_binat_redirspec(src_host, r, af); 6499 } 6500 6501 if (rule_consistent(r, anchor_call[0]) < 0 || error) 6502 yyerror("skipping rule due to errors"); 6503 else { 6504 r->nr = pf->astack[pf->asd]->match++; 6505 pfctl_append_rule(pf, r, anchor_call); 6506 added++; 6507 } 6508 6509 /* Generate binat's matching inbound rule */ 6510 if (!error && nat && nat->binat) { 6511 struct pfctl_rule rdr_rule; 6512 struct redirspec *rdr_redirspec; 6513 struct node_host *rdr_dst_host; 6514 6515 add_binat_rdr_rule( 6516 r, nat, src_hosts, 6517 &rdr_rule, &rdr_redirspec, &rdr_dst_host); 6518 6519 expand_rule(&rdr_rule, true, interface, NULL, rdr_redirspec, 6520 NULL, proto, src_os, dst_host, dst_port, 6521 rdr_dst_host, src_port, uid, gid, rcv, icmp_type, 6522 ""); 6523 } 6524 6525 if (osrch && src_host->addr.type == PF_ADDR_DYNIFTL) { 6526 free(src_host); 6527 src_host = osrch; 6528 } 6529 if (odsth && dst_host->addr.type == PF_ADDR_DYNIFTL) { 6530 free(dst_host); 6531 dst_host = odsth; 6532 } 6533 6534 )))))))))); 6535 6536 if (!keeprule) { 6537 FREE_LIST(struct node_if, interfaces); 6538 FREE_LIST(struct node_proto, protos); 6539 FREE_LIST(struct node_host, src_hosts); 6540 FREE_LIST(struct node_port, src_ports); 6541 FREE_LIST(struct node_os, src_oses); 6542 FREE_LIST(struct node_host, dst_hosts); 6543 FREE_LIST(struct node_port, dst_ports); 6544 FREE_LIST(struct node_uid, uids); 6545 FREE_LIST(struct node_gid, gids); 6546 FREE_LIST(struct node_icmp, icmp_types); 6547 if (nat) { 6548 FREE_LIST(struct node_host, nat->host); 6549 free(nat); 6550 } 6551 if (rdr) { 6552 FREE_LIST(struct node_host, rdr->host); 6553 free(rdr); 6554 } 6555 if (route) { 6556 FREE_LIST(struct node_host, route->host); 6557 free(route); 6558 } 6559 } 6560 6561 if (!added) 6562 yyerror("rule expands to no valid combination"); 6563 } 6564 6565 int 6566 expand_skip_interface(struct node_if *interfaces) 6567 { 6568 int errs = 0; 6569 6570 if (!interfaces || (!interfaces->next && !interfaces->not && 6571 !strcmp(interfaces->ifname, "none"))) { 6572 if (pf->opts & PF_OPT_VERBOSE) 6573 printf("set skip on none\n"); 6574 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 6575 return (errs); 6576 } 6577 6578 if (pf->opts & PF_OPT_VERBOSE) 6579 printf("set skip on {"); 6580 LOOP_THROUGH(struct node_if, interface, interfaces, 6581 if (pf->opts & PF_OPT_VERBOSE) 6582 printf(" %s", interface->ifname); 6583 if (interface->not) { 6584 yyerror("skip on ! <interface> is not supported"); 6585 errs++; 6586 } else 6587 errs += pfctl_set_interface_flags(pf, 6588 interface->ifname, PFI_IFLAG_SKIP, 1); 6589 ); 6590 if (pf->opts & PF_OPT_VERBOSE) 6591 printf(" }\n"); 6592 6593 FREE_LIST(struct node_if, interfaces); 6594 6595 if (errs) 6596 return (1); 6597 else 6598 return (0); 6599 } 6600 6601 void 6602 freehostlist(struct node_host *h) 6603 { 6604 FREE_LIST(struct node_host, h); 6605 } 6606 6607 #undef FREE_LIST 6608 #undef LOOP_THROUGH 6609 6610 int 6611 check_rulestate(int desired_state) 6612 { 6613 if (require_order && (rulestate > desired_state)) { 6614 yyerror("Rules must be in order: options, ethernet, " 6615 "normalization, queueing, translation, filtering"); 6616 return (1); 6617 } 6618 rulestate = desired_state; 6619 return (0); 6620 } 6621 6622 int 6623 kw_cmp(const void *k, const void *e) 6624 { 6625 return (strcmp(k, ((const struct keywords *)e)->k_name)); 6626 } 6627 6628 int 6629 lookup(char *s) 6630 { 6631 /* this has to be sorted always */ 6632 static const struct keywords keywords[] = { 6633 { "af-to", AFTO}, 6634 { "all", ALL}, 6635 { "allow-opts", ALLOWOPTS}, 6636 { "allow-related", ALLOW_RELATED}, 6637 { "altq", ALTQ}, 6638 { "anchor", ANCHOR}, 6639 { "antispoof", ANTISPOOF}, 6640 { "any", ANY}, 6641 { "bandwidth", BANDWIDTH}, 6642 { "binat", BINAT}, 6643 { "binat-anchor", BINATANCHOR}, 6644 { "binat-to", BINATTO}, 6645 { "bitmask", BITMASK}, 6646 { "block", BLOCK}, 6647 { "block-policy", BLOCKPOLICY}, 6648 { "bridge-to", BRIDGE_TO}, 6649 { "buckets", BUCKETS}, 6650 { "cbq", CBQ}, 6651 { "code", CODE}, 6652 { "codelq", CODEL}, 6653 { "debug", DEBUG}, 6654 { "divert-reply", DIVERTREPLY}, 6655 { "divert-to", DIVERTTO}, 6656 { "dnpipe", DNPIPE}, 6657 { "dnqueue", DNQUEUE}, 6658 { "drop", DROP}, 6659 { "dup-to", DUPTO}, 6660 { "endpoint-independent", ENDPI}, 6661 { "ether", ETHER}, 6662 { "fail-policy", FAILPOLICY}, 6663 { "fairq", FAIRQ}, 6664 { "fastroute", FASTROUTE}, 6665 { "file", FILENAME}, 6666 { "fingerprints", FINGERPRINTS}, 6667 { "flags", FLAGS}, 6668 { "floating", FLOATING}, 6669 { "flush", FLUSH}, 6670 { "for", FOR}, 6671 { "fragment", FRAGMENT}, 6672 { "from", FROM}, 6673 { "global", GLOBAL}, 6674 { "group", GROUP}, 6675 { "hfsc", HFSC}, 6676 { "hogs", HOGS}, 6677 { "hostid", HOSTID}, 6678 { "icmp-type", ICMPTYPE}, 6679 { "icmp6-type", ICMP6TYPE}, 6680 { "if-bound", IFBOUND}, 6681 { "in", IN}, 6682 { "include", INCLUDE}, 6683 { "inet", INET}, 6684 { "inet6", INET6}, 6685 { "interval", INTERVAL}, 6686 { "keep", KEEP}, 6687 { "keepcounters", KEEPCOUNTERS}, 6688 { "l3", L3}, 6689 { "label", LABEL}, 6690 { "limit", LIMIT}, 6691 { "linkshare", LINKSHARE}, 6692 { "load", LOAD}, 6693 { "log", LOG}, 6694 { "loginterface", LOGINTERFACE}, 6695 { "map-e-portset", MAPEPORTSET}, 6696 { "match", MATCH}, 6697 { "matches", MATCHES}, 6698 { "max", MAXIMUM}, 6699 { "max-mss", MAXMSS}, 6700 { "max-src-conn", MAXSRCCONN}, 6701 { "max-src-conn-rate", MAXSRCCONNRATE}, 6702 { "max-src-nodes", MAXSRCNODES}, 6703 { "max-src-states", MAXSRCSTATES}, 6704 { "min-ttl", MINTTL}, 6705 { "modulate", MODULATE}, 6706 { "nat", NAT}, 6707 { "nat-anchor", NATANCHOR}, 6708 { "nat-to", NATTO}, 6709 { "no", NO}, 6710 { "no-df", NODF}, 6711 { "no-route", NOROUTE}, 6712 { "no-sync", NOSYNC}, 6713 { "on", ON}, 6714 { "optimization", OPTIMIZATION}, 6715 { "os", OS}, 6716 { "out", OUT}, 6717 { "overload", OVERLOAD}, 6718 { "pass", PASS}, 6719 { "pflow", PFLOW}, 6720 { "port", PORT}, 6721 { "prio", PRIO}, 6722 { "priority", PRIORITY}, 6723 { "priq", PRIQ}, 6724 { "probability", PROBABILITY}, 6725 { "proto", PROTO}, 6726 { "qlimit", QLIMIT}, 6727 { "queue", QUEUE}, 6728 { "quick", QUICK}, 6729 { "random", RANDOM}, 6730 { "random-id", RANDOMID}, 6731 { "rdr", RDR}, 6732 { "rdr-anchor", RDRANCHOR}, 6733 { "rdr-to", RDRTO}, 6734 { "realtime", REALTIME}, 6735 { "reassemble", REASSEMBLE}, 6736 { "received-on", RECEIVEDON}, 6737 { "reply-to", REPLYTO}, 6738 { "require-order", REQUIREORDER}, 6739 { "return", RETURN}, 6740 { "return-icmp", RETURNICMP}, 6741 { "return-icmp6", RETURNICMP6}, 6742 { "return-rst", RETURNRST}, 6743 { "ridentifier", RIDENTIFIER}, 6744 { "round-robin", ROUNDROBIN}, 6745 { "route", ROUTE}, 6746 { "route-to", ROUTETO}, 6747 { "rtable", RTABLE}, 6748 { "rule", RULE}, 6749 { "ruleset-optimization", RULESET_OPTIMIZATION}, 6750 { "scrub", SCRUB}, 6751 { "set", SET}, 6752 { "set-tos", SETTOS}, 6753 { "skip", SKIP}, 6754 { "sloppy", SLOPPY}, 6755 { "source-hash", SOURCEHASH}, 6756 { "source-track", SOURCETRACK}, 6757 { "state", STATE}, 6758 { "state-defaults", STATEDEFAULTS}, 6759 { "state-policy", STATEPOLICY}, 6760 { "static-port", STATICPORT}, 6761 { "sticky-address", STICKYADDRESS}, 6762 { "syncookies", SYNCOOKIES}, 6763 { "synproxy", SYNPROXY}, 6764 { "table", TABLE}, 6765 { "tag", TAG}, 6766 { "tagged", TAGGED}, 6767 { "target", TARGET}, 6768 { "tbrsize", TBRSIZE}, 6769 { "timeout", TIMEOUT}, 6770 { "to", TO}, 6771 { "tos", TOS}, 6772 { "ttl", TTL}, 6773 { "upperlimit", UPPERLIMIT}, 6774 { "urpf-failed", URPFFAILED}, 6775 { "user", USER}, 6776 }; 6777 const struct keywords *p; 6778 6779 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 6780 sizeof(keywords[0]), kw_cmp); 6781 6782 if (p) { 6783 if (debug > 1) 6784 fprintf(stderr, "%s: %d\n", s, p->k_val); 6785 return (p->k_val); 6786 } else { 6787 if (debug > 1) 6788 fprintf(stderr, "string: %s\n", s); 6789 return (STRING); 6790 } 6791 } 6792 6793 #define MAXPUSHBACK 128 6794 6795 static char *parsebuf; 6796 static int parseindex; 6797 static char pushback_buffer[MAXPUSHBACK]; 6798 static int pushback_index = 0; 6799 6800 int 6801 lgetc(int quotec) 6802 { 6803 int c, next; 6804 6805 if (parsebuf) { 6806 /* Read character from the parsebuffer instead of input. */ 6807 if (parseindex >= 0) { 6808 c = parsebuf[parseindex++]; 6809 if (c != '\0') 6810 return (c); 6811 parsebuf = NULL; 6812 } else 6813 parseindex++; 6814 } 6815 6816 if (pushback_index) 6817 return (pushback_buffer[--pushback_index]); 6818 6819 if (quotec) { 6820 if ((c = getc(file->stream)) == EOF) { 6821 yyerror("reached end of file while parsing quoted string"); 6822 if (popfile() == EOF) 6823 return (EOF); 6824 return (quotec); 6825 } 6826 return (c); 6827 } 6828 6829 while ((c = getc(file->stream)) == '\\') { 6830 next = getc(file->stream); 6831 if (next != '\n') { 6832 c = next; 6833 break; 6834 } 6835 yylval.lineno = file->lineno; 6836 file->lineno++; 6837 } 6838 6839 while (c == EOF) { 6840 if (popfile() == EOF) 6841 return (EOF); 6842 c = getc(file->stream); 6843 } 6844 return (c); 6845 } 6846 6847 int 6848 lungetc(int c) 6849 { 6850 if (c == EOF) 6851 return (EOF); 6852 if (parsebuf) { 6853 parseindex--; 6854 if (parseindex >= 0) 6855 return (c); 6856 } 6857 if (pushback_index < MAXPUSHBACK-1) 6858 return (pushback_buffer[pushback_index++] = c); 6859 else 6860 return (EOF); 6861 } 6862 6863 int 6864 findeol(void) 6865 { 6866 int c; 6867 6868 parsebuf = NULL; 6869 6870 /* skip to either EOF or the first real EOL */ 6871 while (1) { 6872 if (pushback_index) 6873 c = pushback_buffer[--pushback_index]; 6874 else 6875 c = lgetc(0); 6876 if (c == '\n') { 6877 file->lineno++; 6878 break; 6879 } 6880 if (c == EOF) 6881 break; 6882 } 6883 return (ERROR); 6884 } 6885 6886 int 6887 yylex(void) 6888 { 6889 char buf[8096]; 6890 char *p, *val; 6891 int quotec, next, c; 6892 int token; 6893 6894 top: 6895 p = buf; 6896 while ((c = lgetc(0)) == ' ' || c == '\t') 6897 ; /* nothing */ 6898 6899 yylval.lineno = file->lineno; 6900 if (c == '#') 6901 while ((c = lgetc(0)) != '\n' && c != EOF) 6902 ; /* nothing */ 6903 if (c == '$' && parsebuf == NULL) { 6904 while (1) { 6905 if ((c = lgetc(0)) == EOF) 6906 return (0); 6907 6908 if (p + 1 >= buf + sizeof(buf) - 1) { 6909 yyerror("string too long"); 6910 return (findeol()); 6911 } 6912 if (isalnum(c) || c == '_') { 6913 *p++ = (char)c; 6914 continue; 6915 } 6916 *p = '\0'; 6917 lungetc(c); 6918 break; 6919 } 6920 val = symget(buf); 6921 if (val == NULL) { 6922 yyerror("macro '%s' not defined", buf); 6923 return (findeol()); 6924 } 6925 parsebuf = val; 6926 parseindex = 0; 6927 goto top; 6928 } 6929 6930 switch (c) { 6931 case '\'': 6932 case '"': 6933 quotec = c; 6934 while (1) { 6935 if ((c = lgetc(quotec)) == EOF) 6936 return (0); 6937 if (c == '\n') { 6938 file->lineno++; 6939 continue; 6940 } else if (c == '\\') { 6941 if ((next = lgetc(quotec)) == EOF) 6942 return (0); 6943 if (next == quotec || c == ' ' || c == '\t') 6944 c = next; 6945 else if (next == '\n') { 6946 file->lineno++; 6947 continue; 6948 } 6949 else 6950 lungetc(next); 6951 } else if (c == quotec) { 6952 *p = '\0'; 6953 break; 6954 } else if (c == '\0') { 6955 yyerror("syntax error"); 6956 return (findeol()); 6957 } 6958 if (p + 1 >= buf + sizeof(buf) - 1) { 6959 yyerror("string too long"); 6960 return (findeol()); 6961 } 6962 *p++ = (char)c; 6963 } 6964 yylval.v.string = strdup(buf); 6965 if (yylval.v.string == NULL) 6966 err(1, "yylex: strdup"); 6967 return (STRING); 6968 case '!': 6969 next = lgetc(0); 6970 if (next == '=') 6971 return (NE); 6972 lungetc(next); 6973 break; 6974 case '<': 6975 next = lgetc(0); 6976 if (next == '>') { 6977 yylval.v.i = PF_OP_XRG; 6978 return (PORTBINARY); 6979 } else if (next == '=') 6980 return (LE); 6981 lungetc(next); 6982 break; 6983 case '>': 6984 next = lgetc(0); 6985 if (next == '<') { 6986 yylval.v.i = PF_OP_IRG; 6987 return (PORTBINARY); 6988 } else if (next == '=') 6989 return (GE); 6990 lungetc(next); 6991 break; 6992 case '-': 6993 next = lgetc(0); 6994 if (next == '>') 6995 return (ARROW); 6996 lungetc(next); 6997 break; 6998 } 6999 7000 #define allowed_to_end_number(x) \ 7001 (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') 7002 7003 if (c == '-' || isdigit(c)) { 7004 do { 7005 *p++ = c; 7006 if ((unsigned)(p-buf) >= sizeof(buf)) { 7007 yyerror("string too long"); 7008 return (findeol()); 7009 } 7010 } while ((c = lgetc(0)) != EOF && isdigit(c)); 7011 lungetc(c); 7012 if (p == buf + 1 && buf[0] == '-') 7013 goto nodigits; 7014 if (c == EOF || allowed_to_end_number(c)) { 7015 const char *errstr = NULL; 7016 7017 *p = '\0'; 7018 yylval.v.number = strtonum(buf, LLONG_MIN, 7019 LLONG_MAX, &errstr); 7020 if (errstr) { 7021 yyerror("\"%s\" invalid number: %s", 7022 buf, errstr); 7023 return (findeol()); 7024 } 7025 return (NUMBER); 7026 } else { 7027 nodigits: 7028 while (p > buf + 1) 7029 lungetc(*--p); 7030 c = *--p; 7031 if (c == '-') 7032 return (c); 7033 } 7034 } 7035 7036 #define allowed_in_string(x) \ 7037 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 7038 x != '{' && x != '}' && x != '<' && x != '>' && \ 7039 x != '!' && x != '=' && x != '/' && x != '#' && \ 7040 x != ',')) 7041 7042 if (isalnum(c) || c == ':' || c == '_') { 7043 do { 7044 *p++ = c; 7045 if ((unsigned)(p-buf) >= sizeof(buf)) { 7046 yyerror("string too long"); 7047 return (findeol()); 7048 } 7049 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c))); 7050 lungetc(c); 7051 *p = '\0'; 7052 if ((token = lookup(buf)) == STRING) 7053 if ((yylval.v.string = strdup(buf)) == NULL) 7054 err(1, "yylex: strdup"); 7055 return (token); 7056 } 7057 if (c == '\n') { 7058 yylval.lineno = file->lineno; 7059 file->lineno++; 7060 } 7061 if (c == EOF) 7062 return (0); 7063 return (c); 7064 } 7065 7066 int 7067 check_file_secrecy(int fd, const char *fname) 7068 { 7069 struct stat st; 7070 7071 if (fstat(fd, &st)) { 7072 warn("cannot stat %s", fname); 7073 return (-1); 7074 } 7075 if (st.st_uid != 0 && st.st_uid != getuid()) { 7076 warnx("%s: owner not root or current user", fname); 7077 return (-1); 7078 } 7079 if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) { 7080 warnx("%s: group writable or world read/writable", fname); 7081 return (-1); 7082 } 7083 return (0); 7084 } 7085 7086 struct file * 7087 pushfile(const char *name, int secret) 7088 { 7089 struct file *nfile; 7090 7091 if ((nfile = calloc(1, sizeof(struct file))) == NULL || 7092 (nfile->name = strdup(name)) == NULL) { 7093 warn("malloc"); 7094 return (NULL); 7095 } 7096 if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) { 7097 nfile->stream = stdin; 7098 free(nfile->name); 7099 if ((nfile->name = strdup("stdin")) == NULL) { 7100 warn("strdup"); 7101 free(nfile); 7102 return (NULL); 7103 } 7104 } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) { 7105 warn("%s", nfile->name); 7106 free(nfile->name); 7107 free(nfile); 7108 return (NULL); 7109 } else if (secret && 7110 check_file_secrecy(fileno(nfile->stream), nfile->name)) { 7111 fclose(nfile->stream); 7112 free(nfile->name); 7113 free(nfile); 7114 return (NULL); 7115 } 7116 nfile->lineno = 1; 7117 TAILQ_INSERT_TAIL(&files, nfile, entry); 7118 return (nfile); 7119 } 7120 7121 int 7122 popfile(void) 7123 { 7124 struct file *prev; 7125 7126 if ((prev = TAILQ_PREV(file, files, entry)) != NULL) { 7127 prev->errors += file->errors; 7128 TAILQ_REMOVE(&files, file, entry); 7129 fclose(file->stream); 7130 free(file->name); 7131 free(file); 7132 file = prev; 7133 return (0); 7134 } 7135 return (EOF); 7136 } 7137 7138 int 7139 parse_config(char *filename, struct pfctl *xpf) 7140 { 7141 int errors = 0; 7142 struct sym *sym; 7143 7144 pf = xpf; 7145 errors = 0; 7146 rulestate = PFCTL_STATE_NONE; 7147 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 7148 returnicmp6default = 7149 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 7150 blockpolicy = PFRULE_DROP; 7151 failpolicy = PFRULE_DROP; 7152 require_order = 1; 7153 7154 if ((file = pushfile(filename, 0)) == NULL) { 7155 warn("cannot open the main config file!"); 7156 return (-1); 7157 } 7158 7159 yyparse(); 7160 errors = file->errors; 7161 popfile(); 7162 7163 /* Free macros and check which have not been used. */ 7164 while ((sym = TAILQ_FIRST(&symhead))) { 7165 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 7166 fprintf(stderr, "warning: macro '%s' not " 7167 "used\n", sym->nam); 7168 free(sym->nam); 7169 free(sym->val); 7170 TAILQ_REMOVE(&symhead, sym, entry); 7171 free(sym); 7172 } 7173 7174 return (errors ? -1 : 0); 7175 } 7176 7177 int 7178 symset(const char *nam, const char *val, int persist) 7179 { 7180 struct sym *sym; 7181 7182 TAILQ_FOREACH(sym, &symhead, entry) { 7183 if (strcmp(nam, sym->nam) == 0) 7184 break; 7185 } 7186 7187 if (sym != NULL) { 7188 if (sym->persist == 1) 7189 return (0); 7190 else { 7191 free(sym->nam); 7192 free(sym->val); 7193 TAILQ_REMOVE(&symhead, sym, entry); 7194 free(sym); 7195 } 7196 } 7197 if ((sym = calloc(1, sizeof(*sym))) == NULL) 7198 return (-1); 7199 7200 sym->nam = strdup(nam); 7201 if (sym->nam == NULL) { 7202 free(sym); 7203 return (-1); 7204 } 7205 sym->val = strdup(val); 7206 if (sym->val == NULL) { 7207 free(sym->nam); 7208 free(sym); 7209 return (-1); 7210 } 7211 sym->used = 0; 7212 sym->persist = persist; 7213 TAILQ_INSERT_TAIL(&symhead, sym, entry); 7214 return (0); 7215 } 7216 7217 int 7218 pfctl_cmdline_symset(char *s) 7219 { 7220 char *sym, *val; 7221 int ret; 7222 7223 if ((val = strrchr(s, '=')) == NULL) 7224 return (-1); 7225 7226 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 7227 err(1, "pfctl_cmdline_symset: malloc"); 7228 7229 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 7230 7231 ret = symset(sym, val + 1, 1); 7232 free(sym); 7233 7234 return (ret); 7235 } 7236 7237 char * 7238 symget(const char *nam) 7239 { 7240 struct sym *sym; 7241 7242 TAILQ_FOREACH(sym, &symhead, entry) { 7243 if (strcmp(nam, sym->nam) == 0) { 7244 sym->used = 1; 7245 return (sym->val); 7246 } 7247 } 7248 return (NULL); 7249 } 7250 7251 void 7252 mv_rules(struct pfctl_ruleset *src, struct pfctl_ruleset *dst) 7253 { 7254 int i; 7255 struct pfctl_rule *r; 7256 7257 for (i = 0; i < PF_RULESET_MAX; ++i) { 7258 while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 7259 != NULL) { 7260 TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 7261 TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 7262 dst->anchor->match++; 7263 } 7264 src->anchor->match = 0; 7265 while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 7266 != NULL) { 7267 TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 7268 TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 7269 r, entries); 7270 } 7271 } 7272 } 7273 7274 void 7275 mv_eth_rules(struct pfctl_eth_ruleset *src, struct pfctl_eth_ruleset *dst) 7276 { 7277 struct pfctl_eth_rule *r; 7278 7279 while ((r = TAILQ_FIRST(&src->rules)) != NULL) { 7280 TAILQ_REMOVE(&src->rules, r, entries); 7281 TAILQ_INSERT_TAIL(&dst->rules, r, entries); 7282 dst->anchor->match++; 7283 } 7284 src->anchor->match = 0; 7285 } 7286 7287 void 7288 decide_address_family(struct node_host *n, sa_family_t *af) 7289 { 7290 if (*af != 0 || n == NULL) 7291 return; 7292 *af = n->af; 7293 while ((n = n->next) != NULL) { 7294 if (n->af != *af) { 7295 *af = 0; 7296 return; 7297 } 7298 } 7299 } 7300 7301 void 7302 remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 7303 { 7304 struct node_host *n = *nh, *prev = NULL; 7305 7306 while (n != NULL) { 7307 if (*af && n->af && n->af != *af) { 7308 /* unlink and free n */ 7309 struct node_host *next = n->next; 7310 7311 /* adjust tail pointer */ 7312 if (n == (*nh)->tail) 7313 (*nh)->tail = prev; 7314 /* adjust previous node's next pointer */ 7315 if (prev == NULL) 7316 *nh = next; 7317 else 7318 prev->next = next; 7319 /* free node */ 7320 if (n->ifname != NULL) 7321 free(n->ifname); 7322 free(n); 7323 n = next; 7324 } else { 7325 if (n->af && !*af) 7326 *af = n->af; 7327 prev = n; 7328 n = n->next; 7329 } 7330 } 7331 } 7332 7333 int 7334 invalid_redirect(struct node_host *nh, sa_family_t af) 7335 { 7336 if (!af) { 7337 struct node_host *n; 7338 7339 /* tables and dyniftl are ok without an address family */ 7340 for (n = nh; n != NULL; n = n->next) { 7341 if (n->addr.type != PF_ADDR_TABLE && 7342 n->addr.type != PF_ADDR_DYNIFTL) { 7343 yyerror("address family not given and " 7344 "translation address expands to multiple " 7345 "address families"); 7346 return (1); 7347 } 7348 } 7349 } 7350 if (nh == NULL) { 7351 yyerror("no translation address with matching address family " 7352 "found."); 7353 return (1); 7354 } 7355 return (0); 7356 } 7357 7358 int 7359 atoul(char *s, u_long *ulvalp) 7360 { 7361 u_long ulval; 7362 char *ep; 7363 7364 errno = 0; 7365 ulval = strtoul(s, &ep, 0); 7366 if (s[0] == '\0' || *ep != '\0') 7367 return (-1); 7368 if (errno == ERANGE && ulval == ULONG_MAX) 7369 return (-1); 7370 *ulvalp = ulval; 7371 return (0); 7372 } 7373 7374 int 7375 getservice(char *n) 7376 { 7377 struct servent *s; 7378 u_long ulval; 7379 7380 if (atoul(n, &ulval) == 0) { 7381 if (ulval > 65535) { 7382 yyerror("illegal port value %lu", ulval); 7383 return (-1); 7384 } 7385 return (htons(ulval)); 7386 } else { 7387 s = getservbyname(n, "tcp"); 7388 if (s == NULL) 7389 s = getservbyname(n, "udp"); 7390 if (s == NULL) 7391 s = getservbyname(n, "sctp"); 7392 if (s == NULL) { 7393 yyerror("unknown port %s", n); 7394 return (-1); 7395 } 7396 return (s->s_port); 7397 } 7398 } 7399 7400 int 7401 rule_label(struct pfctl_rule *r, char *s[PF_RULE_MAX_LABEL_COUNT]) 7402 { 7403 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) { 7404 if (s[i] == NULL) 7405 return (0); 7406 7407 if (strlcpy(r->label[i], s[i], sizeof(r->label[0])) >= 7408 sizeof(r->label[0])) { 7409 yyerror("rule label too long (max %d chars)", 7410 sizeof(r->label[0])-1); 7411 return (-1); 7412 } 7413 } 7414 return (0); 7415 } 7416 7417 int 7418 eth_rule_label(struct pfctl_eth_rule *r, char *s[PF_RULE_MAX_LABEL_COUNT]) 7419 { 7420 for (int i = 0; i < PF_RULE_MAX_LABEL_COUNT; i++) { 7421 if (s[i] == NULL) 7422 return (0); 7423 7424 if (strlcpy(r->label[i], s[i], sizeof(r->label[0])) >= 7425 sizeof(r->label[0])) { 7426 yyerror("rule label too long (max %d chars)", 7427 sizeof(r->label[0])-1); 7428 return (-1); 7429 } 7430 } 7431 return (0); 7432 } 7433 7434 u_int16_t 7435 parseicmpspec(char *w, sa_family_t af) 7436 { 7437 const struct icmpcodeent *p; 7438 u_long ulval; 7439 u_int8_t icmptype; 7440 7441 if (af == AF_INET) 7442 icmptype = returnicmpdefault >> 8; 7443 else 7444 icmptype = returnicmp6default >> 8; 7445 7446 if (atoul(w, &ulval) == -1) { 7447 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 7448 yyerror("unknown icmp code %s", w); 7449 return (0); 7450 } 7451 ulval = p->code; 7452 } 7453 if (ulval > 255) { 7454 yyerror("invalid icmp code %lu", ulval); 7455 return (0); 7456 } 7457 return (icmptype << 8 | ulval); 7458 } 7459 7460 int 7461 parseport(char *port, struct range *r, int extensions) 7462 { 7463 char *p = strchr(port, ':'); 7464 7465 if (p == NULL) { 7466 if ((r->a = getservice(port)) == -1) 7467 return (-1); 7468 r->b = 0; 7469 r->t = PF_OP_NONE; 7470 return (0); 7471 } 7472 if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) { 7473 *p = 0; 7474 if ((r->a = getservice(port)) == -1) 7475 return (-1); 7476 r->b = 0; 7477 r->t = PF_OP_IRG; 7478 return (0); 7479 } 7480 if ((extensions & PPORT_RANGE)) { 7481 *p++ = 0; 7482 if ((r->a = getservice(port)) == -1 || 7483 (r->b = getservice(p)) == -1) 7484 return (-1); 7485 if (r->a == r->b) { 7486 r->b = 0; 7487 r->t = PF_OP_NONE; 7488 } else 7489 r->t = PF_OP_RRG; 7490 return (0); 7491 } 7492 return (-1); 7493 } 7494 7495 int 7496 pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 7497 { 7498 struct loadanchors *la; 7499 7500 TAILQ_FOREACH(la, &loadanchorshead, entries) { 7501 if (pf->opts & PF_OPT_VERBOSE) 7502 fprintf(stderr, "\nLoading anchor %s from %s\n", 7503 la->anchorname, la->filename); 7504 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, 7505 la->anchorname, trans) == -1) 7506 return (-1); 7507 } 7508 7509 return (0); 7510 } 7511 7512 int 7513 kw_casecmp(const void *k, const void *e) 7514 { 7515 return (strcasecmp(k, ((const struct keywords *)e)->k_name)); 7516 } 7517 7518 int 7519 map_tos(char *s, int *val) 7520 { 7521 /* DiffServ Codepoints and other TOS mappings */ 7522 const struct keywords toswords[] = { 7523 { "af11", IPTOS_DSCP_AF11 }, 7524 { "af12", IPTOS_DSCP_AF12 }, 7525 { "af13", IPTOS_DSCP_AF13 }, 7526 { "af21", IPTOS_DSCP_AF21 }, 7527 { "af22", IPTOS_DSCP_AF22 }, 7528 { "af23", IPTOS_DSCP_AF23 }, 7529 { "af31", IPTOS_DSCP_AF31 }, 7530 { "af32", IPTOS_DSCP_AF32 }, 7531 { "af33", IPTOS_DSCP_AF33 }, 7532 { "af41", IPTOS_DSCP_AF41 }, 7533 { "af42", IPTOS_DSCP_AF42 }, 7534 { "af43", IPTOS_DSCP_AF43 }, 7535 { "critical", IPTOS_PREC_CRITIC_ECP }, 7536 { "cs0", IPTOS_DSCP_CS0 }, 7537 { "cs1", IPTOS_DSCP_CS1 }, 7538 { "cs2", IPTOS_DSCP_CS2 }, 7539 { "cs3", IPTOS_DSCP_CS3 }, 7540 { "cs4", IPTOS_DSCP_CS4 }, 7541 { "cs5", IPTOS_DSCP_CS5 }, 7542 { "cs6", IPTOS_DSCP_CS6 }, 7543 { "cs7", IPTOS_DSCP_CS7 }, 7544 { "ef", IPTOS_DSCP_EF }, 7545 { "inetcontrol", IPTOS_PREC_INTERNETCONTROL }, 7546 { "lowdelay", IPTOS_LOWDELAY }, 7547 { "netcontrol", IPTOS_PREC_NETCONTROL }, 7548 { "reliability", IPTOS_RELIABILITY }, 7549 { "throughput", IPTOS_THROUGHPUT }, 7550 { "va", IPTOS_DSCP_VA } 7551 }; 7552 const struct keywords *p; 7553 7554 p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), 7555 sizeof(toswords[0]), kw_casecmp); 7556 7557 if (p) { 7558 *val = p->k_val; 7559 return (1); 7560 } 7561 return (0); 7562 } 7563 7564 int 7565 rt_tableid_max(void) 7566 { 7567 #ifdef __FreeBSD__ 7568 int fibs; 7569 size_t l = sizeof(fibs); 7570 7571 if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1) 7572 fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */ 7573 /* 7574 * As the OpenBSD code only compares > and not >= we need to adjust 7575 * here given we only accept values of 0..n and want to avoid #ifdefs 7576 * in the grammar. 7577 */ 7578 return (fibs - 1); 7579 #else 7580 return (RT_TABLEID_MAX); 7581 #endif 7582 } 7583 7584 struct node_mac* 7585 node_mac_from_string(const char *str) 7586 { 7587 struct node_mac *m; 7588 7589 m = calloc(1, sizeof(struct node_mac)); 7590 if (m == NULL) 7591 err(1, "mac: calloc"); 7592 7593 if (sscanf(str, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx", 7594 &m->mac[0], &m->mac[1], &m->mac[2], &m->mac[3], &m->mac[4], 7595 &m->mac[5]) != 6) { 7596 free(m); 7597 yyerror("invalid MAC address"); 7598 return (NULL); 7599 } 7600 7601 memset(m->mask, 0xff, ETHER_ADDR_LEN); 7602 m->isset = true; 7603 m->next = NULL; 7604 m->tail = m; 7605 7606 return (m); 7607 } 7608 7609 struct node_mac* 7610 node_mac_from_string_masklen(const char *str, int masklen) 7611 { 7612 struct node_mac *m; 7613 7614 if (masklen < 0 || masklen > (ETHER_ADDR_LEN * 8)) { 7615 yyerror("invalid MAC mask length"); 7616 return (NULL); 7617 } 7618 7619 m = node_mac_from_string(str); 7620 if (m == NULL) 7621 return (NULL); 7622 7623 memset(m->mask, 0, ETHER_ADDR_LEN); 7624 for (int i = 0; i < masklen; i++) 7625 m->mask[i / 8] |= 1 << (i % 8); 7626 7627 return (m); 7628 } 7629 7630 struct node_mac* 7631 node_mac_from_string_mask(const char *str, const char *mask) 7632 { 7633 struct node_mac *m; 7634 7635 m = node_mac_from_string(str); 7636 if (m == NULL) 7637 return (NULL); 7638 7639 if (sscanf(mask, "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx", 7640 &m->mask[0], &m->mask[1], &m->mask[2], &m->mask[3], &m->mask[4], 7641 &m->mask[5]) != 6) { 7642 free(m); 7643 yyerror("invalid MAC mask"); 7644 return (NULL); 7645 } 7646 7647 return (m); 7648 } 7649