1 /** $MirOS: src/sbin/pfctl/parse.y,v 1.5 2010/09/21 21:24:19 tg Exp $ */
2 /* $OpenBSD: parse.y,v 1.452 2004/04/24 23:22:54 cedric Exp $ */
3
4 /*
5 * Copyright (c) 2001 Markus Friedl. All rights reserved.
6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved.
7 * Copyright (c) 2001 Theo de Raadt. All rights reserved.
8 * Copyright (c) 2002, 2003, 2004, 2010 Thorsten Glaser.
9 * Copyright (c) 2002, 2003 Henning Brauer. All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 */
31 %{
32 #include <sys/types.h>
33 #include <sys/socket.h>
34 #include <net/if.h>
35 #include <netinet/in.h>
36 #include <netinet/in_systm.h>
37 #include <netinet/ip.h>
38 #include <netinet/ip_icmp.h>
39 #include <netinet/icmp6.h>
40 #include <net/pfvar.h>
41 #include <arpa/inet.h>
42 #include <altq/altq.h>
43 #include <altq/altq_cbq.h>
44 #include <altq/altq_priq.h>
45 #include <altq/altq_hfsc.h>
46
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <netdb.h>
50 #include <stdarg.h>
51 #include <errno.h>
52 #include <string.h>
53 #include <ctype.h>
54 #include <math.h>
55 #include <err.h>
56 #include <limits.h>
57 #include <pwd.h>
58 #include <grp.h>
59 #include <md5.h>
60
61 #include "pfctl_parser.h"
62 #include "pfctl.h"
63
64 __RCSID("$MirOS: src/sbin/pfctl/parse.y,v 1.5 2010/09/21 21:24:19 tg Exp $");
65
66 static struct pfctl *pf = NULL;
67 static FILE *fin = NULL;
68 static int debug = 0;
69 static int lineno = 1;
70 static int errors = 0;
71 static int rulestate = 0;
72 static u_int16_t returnicmpdefault =
73 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
74 static u_int16_t returnicmp6default =
75 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
76 static int blockpolicy = PFRULE_DROP;
77 static int require_order = 1;
78 static int default_statelock;
79
80 enum {
81 PFCTL_STATE_NONE,
82 PFCTL_STATE_OPTION,
83 PFCTL_STATE_SCRUB,
84 PFCTL_STATE_QUEUE,
85 PFCTL_STATE_NAT,
86 PFCTL_STATE_FILTER
87 };
88
89 struct node_proto {
90 u_int8_t proto;
91 struct node_proto *next;
92 struct node_proto *tail;
93 };
94
95 struct node_port {
96 u_int16_t port[2];
97 u_int8_t op;
98 struct node_port *next;
99 struct node_port *tail;
100 };
101
102 struct node_uid {
103 uid_t uid[2];
104 u_int8_t op;
105 struct node_uid *next;
106 struct node_uid *tail;
107 };
108
109 struct node_gid {
110 gid_t gid[2];
111 u_int8_t op;
112 struct node_gid *next;
113 struct node_gid *tail;
114 };
115
116 struct node_icmp {
117 u_int8_t code;
118 u_int8_t type;
119 u_int8_t proto;
120 struct node_icmp *next;
121 struct node_icmp *tail;
122 };
123
124 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
125 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_NODES,
126 PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT };
127
128 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
129
130 struct node_state_opt {
131 int type;
132 union {
133 u_int32_t max_states;
134 u_int32_t max_src_states;
135 u_int32_t max_src_nodes;
136 u_int8_t src_track;
137 u_int32_t statelock;
138 struct {
139 int number;
140 u_int32_t seconds;
141 } timeout;
142 } data;
143 struct node_state_opt *next;
144 struct node_state_opt *tail;
145 };
146
147 struct peer {
148 struct node_host *host;
149 struct node_port *port;
150 };
151
152 struct node_queue {
153 char queue[PF_QNAME_SIZE];
154 char parent[PF_QNAME_SIZE];
155 char ifname[IFNAMSIZ];
156 int scheduler;
157 struct node_queue *next;
158 struct node_queue *tail;
159 } *queues = NULL;
160
161 struct node_qassign {
162 char *qname;
163 char *pqname;
164 };
165
166 struct filter_opts {
167 int marker;
168 #define FOM_FLAGS 0x01
169 #define FOM_ICMP 0x02
170 #define FOM_TOS 0x04
171 #define FOM_KEEP 0x08
172 #define FOM_SRCTRACK 0x10
173 struct node_uid *uid;
174 struct node_gid *gid;
175 struct {
176 u_int8_t b1;
177 u_int8_t b2;
178 u_int16_t w;
179 u_int16_t w2;
180 } flags;
181 struct node_icmp *icmpspec;
182 u_int32_t tos;
183 u_int32_t prob;
184 struct {
185 int action;
186 struct node_state_opt *options;
187 } keep;
188 int fragment;
189 int allowopts;
190 char *label;
191 struct node_qassign queues;
192 char *tag;
193 char *match_tag;
194 u_int8_t match_tag_not;
195 } filter_opts;
196
197 struct scrub_opts {
198 int marker;
199 #define SOM_MINTTL 0x01
200 #define SOM_MAXMSS 0x02
201 #define SOM_FRAGCACHE 0x04
202 int nodf;
203 int minttl;
204 int maxmss;
205 int fragcache;
206 int randomid;
207 int reassemble_tcp;
208 } scrub_opts;
209
210 struct queue_opts {
211 int marker;
212 #define QOM_BWSPEC 0x01
213 #define QOM_SCHEDULER 0x02
214 #define QOM_PRIORITY 0x04
215 #define QOM_TBRSIZE 0x08
216 #define QOM_QLIMIT 0x10
217 struct node_queue_bw queue_bwspec;
218 struct node_queue_opt scheduler;
219 int priority;
220 int tbrsize;
221 int qlimit;
222 } queue_opts;
223
224 struct table_opts {
225 int flags;
226 int init_addr;
227 struct node_tinithead init_nodes;
228 } table_opts;
229
230 struct pool_opts {
231 int marker;
232 #define POM_TYPE 0x01
233 #define POM_STICKYADDRESS 0x02
234 u_int8_t opts;
235 int type;
236 int staticport;
237 struct pf_poolhashkey *key;
238
239 } pool_opts;
240
241
242 struct node_hfsc_opts hfsc_opts;
243
244 int yyerror(const char *, ...);
245 int disallow_table(struct node_host *, const char *);
246 int rule_consistent(struct pf_rule *);
247 int filter_consistent(struct pf_rule *);
248 int nat_consistent(struct pf_rule *);
249 int rdr_consistent(struct pf_rule *);
250 int process_tabledef(char *, struct table_opts *);
251 int yyparse(void);
252 void expand_label_str(char *, size_t, const char *, const char *);
253 void expand_label_if(const char *, char *, size_t, const char *);
254 void expand_label_addr(const char *, char *, size_t, u_int8_t,
255 struct node_host *);
256 void expand_label_port(const char *, char *, size_t, struct node_port *);
257 void expand_label_proto(const char *, char *, size_t, u_int8_t);
258 void expand_label_nr(const char *, char *, size_t);
259 void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *,
260 struct node_port *, struct node_host *, struct node_port *,
261 u_int8_t);
262 void expand_rule(struct pf_rule *, struct node_if *, struct node_host *,
263 struct node_proto *, struct node_os*, struct node_host *,
264 struct node_port *, struct node_host *, struct node_port *,
265 struct node_uid *, struct node_gid *, struct node_icmp *);
266 int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *,
267 struct node_queue_bw bwspec, struct node_queue_opt *);
268 int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *,
269 struct node_queue_bw, struct node_queue_opt *);
270
271 int check_rulestate(int);
272 int kw_cmp(const void *, const void *);
273 int lookup(char *);
274 int lgetc(FILE *);
275 int lungetc(int);
276 int findeol(void);
277 int yylex(void);
278 int atoul(char *, u_long *);
279 int getservice(char *);
280 int rule_label(struct pf_rule *, char *);
281
282 TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead);
283 struct sym {
284 TAILQ_ENTRY(sym) entries;
285 int used;
286 int persist;
287 char *nam;
288 char *val;
289 };
290
291
292 int symset(const char *, const char *, int);
293 char *symget(const char *);
294
295 void decide_address_family(struct node_host *, sa_family_t *);
296 void remove_invalid_hosts(struct node_host **, sa_family_t *);
297 int invalid_redirect(struct node_host *, sa_family_t);
298 u_int16_t parseicmpspec(char *, sa_family_t);
299
300 TAILQ_HEAD(loadanchorshead, loadanchors)
301 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
302
303 struct loadanchors {
304 TAILQ_ENTRY(loadanchors) entries;
305 char *anchorname;
306 char *rulesetname;
307 char *filename;
308 };
309
310 typedef struct {
311 union {
312 u_int32_t number;
313 int i;
314 char *string;
315 struct {
316 u_int8_t b1;
317 u_int8_t b2;
318 u_int16_t w;
319 u_int16_t w2;
320 } b;
321 struct range {
322 int a;
323 int b;
324 int t;
325 } range;
326 struct node_if *interface;
327 struct node_proto *proto;
328 struct node_icmp *icmp;
329 struct node_host *host;
330 struct node_os *os;
331 struct node_port *port;
332 struct node_uid *uid;
333 struct node_gid *gid;
334 struct node_state_opt *state_opt;
335 struct peer peer;
336 struct {
337 struct peer src, dst;
338 struct node_os *src_os;
339 } fromto;
340 struct {
341 struct node_host *host;
342 u_int8_t rt;
343 u_int8_t pool_opts;
344 sa_family_t af;
345 struct pf_poolhashkey *key;
346 } route;
347 struct redirection {
348 struct node_host *host;
349 struct range rport;
350 } *redirection;
351 struct {
352 int action;
353 struct node_state_opt *options;
354 } keep_state;
355 struct {
356 u_int8_t log;
357 u_int8_t quick;
358 } logquick;
359 struct pf_poolhashkey *hashkey;
360 struct node_queue *queue;
361 struct node_queue_opt queue_options;
362 struct node_queue_bw queue_bwspec;
363 struct node_qassign qassign;
364 struct filter_opts filter_opts;
365 struct queue_opts queue_opts;
366 struct scrub_opts scrub_opts;
367 struct table_opts table_opts;
368 struct pool_opts pool_opts;
369 struct node_hfsc_opts hfsc_opts;
370 } v;
371 int lineno;
372 } YYSTYPE;
373
374 #define PREPARE_ANCHOR_RULE(r, a) \
375 do { \
376 memset(&(r), 0, sizeof(r)); \
377 if (strlcpy(r.anchorname, (a), \
378 sizeof(r.anchorname)) >= \
379 sizeof(r.anchorname)) { \
380 yyerror("anchor name '%s' too long", \
381 (a)); \
382 YYERROR; \
383 } \
384 } while (0)
385
386 %}
387
388 %token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS
389 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
390 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
391 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
392 %token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
393 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
394 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
395 %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG HOSTID FUCKOFF
396 %token ANTISPOOF FOR
397 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
398 %token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT
399 %token QUEUE PRIORITY QLIMIT
400 %token LOAD
401 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
402 %token TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY
403 %token <v.string> STRING
404 %token <v.i> PORTBINARY
405 %type <v.interface> interface if_list if_item_not if_item
406 %type <v.number> number icmptype icmp6type uid gid
407 %type <v.number> tos not yesno natpass
408 %type <v.i> no dir log af fragcache sourcetrack
409 %type <v.i> unaryop statelock
410 %type <v.b> action nataction flags flag blockspec
411 %type <v.range> port rport
412 %type <v.hashkey> hashkey
413 %type <v.proto> proto proto_list proto_item
414 %type <v.icmp> icmpspec
415 %type <v.icmp> icmp_list icmp_item
416 %type <v.icmp> icmp6_list icmp6_item
417 %type <v.fromto> fromto
418 %type <v.peer> ipportspec from to
419 %type <v.host> ipspec xhost host host_list
420 %type <v.host> redir_host_list redirspec
421 %type <v.host> route_host route_host_list routespec
422 %type <v.os> os xos os_list
423 %type <v.port> portspec port_list port_item
424 %type <v.uid> uids uid_list uid_item
425 %type <v.gid> gids gid_list gid_item
426 %type <v.route> route
427 %type <v.redirection> redirection redirpool
428 %type <v.string> label string tag
429 %type <v.keep_state> keep
430 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item
431 %type <v.logquick> logquick
432 %type <v.qassign> qname
433 %type <v.queue> qassign qassign_list qassign_item
434 %type <v.queue_options> scheduler
435 %type <v.number> cbqflags_list cbqflags_item
436 %type <v.number> priqflags_list priqflags_item
437 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts
438 %type <v.queue_bwspec> bandwidth
439 %type <v.filter_opts> filter_opts filter_opt filter_opts_l
440 %type <v.queue_opts> queue_opts queue_opt queue_opts_l
441 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l
442 %type <v.table_opts> table_opts table_opt table_opts_l
443 %type <v.pool_opts> pool_opts pool_opt pool_opts_l
444 %%
445
446 ruleset : /* empty */
447 | ruleset '\n'
448 | ruleset option '\n'
449 | ruleset scrubrule '\n'
450 | ruleset natrule '\n'
451 | ruleset binatrule '\n'
452 | ruleset pfrule '\n'
453 | ruleset anchorrule '\n'
454 | ruleset loadrule '\n'
455 | ruleset altqif '\n'
456 | ruleset queuespec '\n'
457 | ruleset varset '\n'
458 | ruleset tabledef '\n'
459 | ruleset error '\n' { errors++; }
460 ;
461
462 option : SET OPTIMIZATION STRING {
463 if (check_rulestate(PFCTL_STATE_OPTION)) {
464 free($3);
465 YYERROR;
466 }
467 if (pfctl_set_optimization(pf, $3) != 0) {
468 yyerror("unknown optimization %s", $3);
469 free($3);
470 YYERROR;
471 }
472 free ($3);
473 }
474 | SET TIMEOUT timeout_spec
475 | SET TIMEOUT '{' timeout_list '}'
476 | SET LIMIT limit_spec
477 | SET LIMIT '{' limit_list '}'
478 | SET LOGINTERFACE STRING {
479 if (check_rulestate(PFCTL_STATE_OPTION)) {
480 free($3);
481 YYERROR;
482 }
483 if ((ifa_exists($3, 0) == NULL) && strcmp($3, "none")) {
484 yyerror("interface %s doesn't exist", $3);
485 free($3);
486 YYERROR;
487 }
488 if (pfctl_set_logif(pf, $3) != 0) {
489 yyerror("error setting loginterface %s", $3);
490 free($3);
491 YYERROR;
492 }
493 free($3);
494 }
495 | SET HOSTID number {
496 if ($3 == 0) {
497 yyerror("hostid must be non-zero");
498 YYERROR;
499 }
500 if (pfctl_set_hostid(pf, $3) != 0) {
501 yyerror("error setting hostid %08x", $3);
502 YYERROR;
503 }
504 }
505 | SET BLOCKPOLICY DROP {
506 if (pf->opts & PF_OPT_VERBOSE)
507 printf("set block-policy drop\n");
508 if (check_rulestate(PFCTL_STATE_OPTION))
509 YYERROR;
510 blockpolicy = PFRULE_DROP;
511 }
512 | SET BLOCKPOLICY RETURN {
513 if (pf->opts & PF_OPT_VERBOSE)
514 printf("set block-policy return\n");
515 if (check_rulestate(PFCTL_STATE_OPTION))
516 YYERROR;
517 blockpolicy = PFRULE_RETURN;
518 }
519 | SET REQUIREORDER yesno {
520 if (pf->opts & PF_OPT_VERBOSE)
521 printf("set require-order %s\n",
522 $3 == 1 ? "yes" : "no");
523 require_order = $3;
524 }
525 | SET FINGERPRINTS STRING {
526 if (pf->opts & PF_OPT_VERBOSE)
527 printf("fingerprints %s\n", $3);
528 if (check_rulestate(PFCTL_STATE_OPTION)) {
529 free($3);
530 YYERROR;
531 }
532 if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) {
533 yyerror("error loading fingerprints %s", $3);
534 free($3);
535 YYERROR;
536 }
537 free($3);
538 }
539 | SET STATEPOLICY statelock {
540 if (pf->opts & PF_OPT_VERBOSE)
541 switch ($3) {
542 case 0:
543 printf("set state-policy floating\n");
544 break;
545 case PFRULE_IFBOUND:
546 printf("set state-policy if-bound\n");
547 break;
548 case PFRULE_GRBOUND:
549 printf("set state-policy "
550 "group-bound\n");
551 break;
552 }
553 default_statelock = $3;
554 }
555 | SET DEBUG STRING {
556 if (check_rulestate(PFCTL_STATE_OPTION)) {
557 free($3);
558 YYERROR;
559 }
560 if (pfctl_set_debug(pf, $3) != 0) {
561 yyerror("error setting debuglevel %s", $3);
562 free($3);
563 YYERROR;
564 }
565 free($3);
566 }
567 ;
568
569 string : string STRING {
570 if (asprintf(&$$, "%s %s", $1, $2) == -1)
571 err(1, "string: asprintf");
572 free($1);
573 free($2);
574 }
575 | STRING
576 ;
577
578 varset : STRING '=' string {
579 if (pf->opts & PF_OPT_VERBOSE)
580 printf("%s = \"%s\"\n", $1, $3);
581 if (symset($1, $3, 0) == -1)
582 err(1, "cannot store variable %s", $1);
583 free($1);
584 free($3);
585 }
586 ;
587
588 anchorrule : ANCHOR string dir interface af proto fromto filter_opts {
589 struct pf_rule r;
590
591 if (check_rulestate(PFCTL_STATE_FILTER)) {
592 free($2);
593 YYERROR;
594 }
595
596 PREPARE_ANCHOR_RULE(r, $2);
597 r.direction = $3;
598 r.af = $5;
599 r.prob = $8.prob;
600
601 if ($8.match_tag)
602 if (strlcpy(r.match_tagname, $8.match_tag,
603 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
604 yyerror("tag too long, max %u chars",
605 PF_TAG_NAME_SIZE - 1);
606 YYERROR;
607 }
608 r.match_tag_not = $8.match_tag_not;
609
610 decide_address_family($7.src.host, &r.af);
611 decide_address_family($7.dst.host, &r.af);
612
613 expand_rule(&r, $4, NULL, $6, $7.src_os,
614 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
615 0, 0, 0);
616 }
617 | NATANCHOR string interface af proto fromto {
618 struct pf_rule r;
619
620 if (check_rulestate(PFCTL_STATE_NAT)) {
621 free($2);
622 YYERROR;
623 }
624
625 PREPARE_ANCHOR_RULE(r, $2);
626 free($2);
627 r.action = PF_NAT;
628 r.af = $4;
629
630 decide_address_family($6.src.host, &r.af);
631 decide_address_family($6.dst.host, &r.af);
632
633 expand_rule(&r, $3, NULL, $5, $6.src_os,
634 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
635 0, 0, 0);
636 }
637 | RDRANCHOR string interface af proto fromto {
638 struct pf_rule r;
639
640 if (check_rulestate(PFCTL_STATE_NAT)) {
641 free($2);
642 YYERROR;
643 }
644
645 PREPARE_ANCHOR_RULE(r, $2);
646 free($2);
647 r.action = PF_RDR;
648 r.af = $4;
649
650 decide_address_family($6.src.host, &r.af);
651 decide_address_family($6.dst.host, &r.af);
652
653 if ($6.src.port != NULL) {
654 yyerror("source port parameter not supported"
655 " in rdr-anchor");
656 YYERROR;
657 }
658 if ($6.dst.port != NULL) {
659 if ($6.dst.port->next != NULL) {
660 yyerror("destination port list "
661 "expansion not supported in "
662 "rdr-anchor");
663 YYERROR;
664 } else if ($6.dst.port->op != PF_OP_EQ) {
665 yyerror("destination port operators"
666 " not supported in rdr-anchor");
667 YYERROR;
668 }
669 r.dst.port[0] = $6.dst.port->port[0];
670 r.dst.port[1] = $6.dst.port->port[1];
671 r.dst.port_op = $6.dst.port->op;
672 }
673
674 expand_rule(&r, $3, NULL, $5, $6.src_os,
675 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
676 0, 0, 0);
677 }
678 | BINATANCHOR string interface af proto fromto {
679 struct pf_rule r;
680
681 if (check_rulestate(PFCTL_STATE_NAT)) {
682 free($2);
683 YYERROR;
684 }
685
686 PREPARE_ANCHOR_RULE(r, $2);
687 free($2);
688 r.action = PF_BINAT;
689 r.af = $4;
690 if ($5 != NULL) {
691 if ($5->next != NULL) {
692 yyerror("proto list expansion"
693 " not supported in binat-anchor");
694 YYERROR;
695 }
696 r.proto = $5->proto;
697 free($5);
698 }
699
700 if ($6.src.host != NULL || $6.src.port != NULL ||
701 $6.dst.host != NULL || $6.dst.port != NULL) {
702 yyerror("fromto parameter not supported"
703 " in binat-anchor");
704 YYERROR;
705 }
706
707 decide_address_family($6.src.host, &r.af);
708 decide_address_family($6.dst.host, &r.af);
709
710 pfctl_add_rule(pf, &r);
711 }
712 ;
713
714 loadrule : LOAD ANCHOR string FROM string {
715 char *t;
716 struct loadanchors *loadanchor;
717
718 t = strsep(&$3, ":");
719 if (*t == '\0' || $3 == NULL || *$3 == '\0') {
720 yyerror("anchor '%s' invalid\n", $3);
721 free(t);
722 YYERROR;
723 }
724 if (strlen(t) >= PF_ANCHOR_NAME_SIZE) {
725 yyerror("anchorname %s too long, max %u\n",
726 t, PF_ANCHOR_NAME_SIZE - 1);
727 free(t);
728 YYERROR;
729 }
730 if (strlen($3) >= PF_RULESET_NAME_SIZE) {
731 yyerror("rulesetname %s too long, max %u\n",
732 $3, PF_RULESET_NAME_SIZE - 1);
733 free(t);
734 YYERROR;
735 }
736
737 loadanchor = calloc(1, sizeof(struct loadanchors));
738 if (loadanchor == NULL)
739 err(1, "loadrule: calloc");
740 if ((loadanchor->anchorname = strdup(t)) == NULL)
741 err(1, "loadrule: strdup");
742 if ((loadanchor->rulesetname = strdup($3)) == NULL)
743 err(1, "loadrule: strdup");
744 if ((loadanchor->filename = strdup($5)) == NULL)
745 err(1, "loadrule: strdup");
746
747 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
748 entries);
749
750 free(t); /* not $3 */
751 free($5);
752 };
753
754 scrubrule : SCRUB dir logquick interface af proto fromto scrub_opts
755 {
756 struct pf_rule r;
757
758 if (check_rulestate(PFCTL_STATE_SCRUB))
759 YYERROR;
760
761 memset(&r, 0, sizeof(r));
762
763 r.action = PF_SCRUB;
764 r.direction = $2;
765
766 r.log = $3.log;
767 if ($3.quick) {
768 yyerror("scrub rules do not support 'quick'");
769 YYERROR;
770 }
771
772 r.af = $5;
773 if ($8.nodf)
774 r.rule_flag |= PFRULE_NODF;
775 if ($8.randomid)
776 r.rule_flag |= PFRULE_RANDOMID;
777 if ($8.reassemble_tcp) {
778 if (r.direction != PF_INOUT) {
779 yyerror("reassemble tcp rules can not "
780 "specify direction");
781 YYERROR;
782 }
783 r.rule_flag |= PFRULE_REASSEMBLE_TCP;
784 }
785 if ($8.minttl)
786 r.min_ttl = $8.minttl;
787 if ($8.maxmss)
788 r.max_mss = $8.maxmss;
789 if ($8.fragcache)
790 r.rule_flag |= $8.fragcache;
791
792 expand_rule(&r, $4, NULL, $6, $7.src_os,
793 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
794 NULL, NULL, NULL);
795 }
796 ;
797
798 scrub_opts : {
799 bzero(&scrub_opts, sizeof scrub_opts);
800 }
801 scrub_opts_l
802 { $$ = scrub_opts; }
803 | /* empty */ {
804 bzero(&scrub_opts, sizeof scrub_opts);
805 $$ = scrub_opts;
806 }
807 ;
808
809 scrub_opts_l : scrub_opts_l scrub_opt
810 | scrub_opt
811 ;
812
813 scrub_opt : NODF {
814 if (scrub_opts.nodf) {
815 yyerror("no-df cannot be respecified");
816 YYERROR;
817 }
818 scrub_opts.nodf = 1;
819 }
820 | MINTTL number {
821 if (scrub_opts.marker & SOM_MINTTL) {
822 yyerror("min-ttl cannot be respecified");
823 YYERROR;
824 }
825 if ($2 > 255) {
826 yyerror("illegal min-ttl value %d", $2);
827 YYERROR;
828 }
829 scrub_opts.marker |= SOM_MINTTL;
830 scrub_opts.minttl = $2;
831 }
832 | MAXMSS number {
833 if (scrub_opts.marker & SOM_MAXMSS) {
834 yyerror("max-mss cannot be respecified");
835 YYERROR;
836 }
837 if ($2 > 65535) {
838 yyerror("illegal max-mss value %d", $2);
839 YYERROR;
840 }
841 scrub_opts.marker |= SOM_MAXMSS;
842 scrub_opts.maxmss = $2;
843 }
844 | fragcache {
845 if (scrub_opts.marker & SOM_FRAGCACHE) {
846 yyerror("fragcache cannot be respecified");
847 YYERROR;
848 }
849 scrub_opts.marker |= SOM_FRAGCACHE;
850 scrub_opts.fragcache = $1;
851 }
852 | REASSEMBLE STRING {
853 if (strcasecmp($2, "tcp") != 0) {
854 free($2);
855 YYERROR;
856 }
857 free($2);
858 if (scrub_opts.reassemble_tcp) {
859 yyerror("reassemble tcp cannot be respecified");
860 YYERROR;
861 }
862 scrub_opts.reassemble_tcp = 1;
863 }
864 | RANDOMID {
865 if (scrub_opts.randomid) {
866 yyerror("random-id cannot be respecified");
867 YYERROR;
868 }
869 scrub_opts.randomid = 1;
870 }
871 ;
872
873 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ }
874 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; }
875 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; }
876 ;
877
878 not : '!' { $$ = 1; }
879 | /* empty */ { $$ = 0; }
880 ;
881
882 tabledef : TABLE '<' STRING '>' table_opts {
883 struct node_host *h, *nh;
884 struct node_tinit *ti, *nti;
885
886 if (strlen($3) >= PF_TABLE_NAME_SIZE) {
887 yyerror("table name too long, max %d chars",
888 PF_TABLE_NAME_SIZE - 1);
889 free($3);
890 YYERROR;
891 }
892 if (pf->loadopt & PFCTL_FLAG_TABLE)
893 if (process_tabledef($3, &$5)) {
894 free($3);
895 YYERROR;
896 }
897 free($3);
898 for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
899 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
900 if (ti->file)
901 free(ti->file);
902 for (h = ti->host; h != NULL; h = nh) {
903 nh = h->next;
904 free(h);
905 }
906 nti = SIMPLEQ_NEXT(ti, entries);
907 free(ti);
908 }
909 }
910 ;
911
912 table_opts : {
913 bzero(&table_opts, sizeof table_opts);
914 SIMPLEQ_INIT(&table_opts.init_nodes);
915 }
916 table_opts_l
917 { $$ = table_opts; }
918 | /* empty */
919 {
920 bzero(&table_opts, sizeof table_opts);
921 SIMPLEQ_INIT(&table_opts.init_nodes);
922 $$ = table_opts;
923 }
924 ;
925
926 table_opts_l : table_opts_l table_opt
927 | table_opt
928 ;
929
930 table_opt : STRING {
931 if (!strcmp($1, "const"))
932 table_opts.flags |= PFR_TFLAG_CONST;
933 else if (!strcmp($1, "persist"))
934 table_opts.flags |= PFR_TFLAG_PERSIST;
935 else {
936 free($1);
937 YYERROR;
938 }
939 free($1);
940 }
941 | '{' '}' { table_opts.init_addr = 1; }
942 | '{' host_list '}' {
943 struct node_host *n;
944 struct node_tinit *ti;
945
946 for (n = $2; n != NULL; n = n->next) {
947 switch (n->addr.type) {
948 case PF_ADDR_ADDRMASK:
949 continue; /* ok */
950 case PF_ADDR_TABLE:
951 yyerror("tables cannot contain tables");
952 break;
953 case PF_ADDR_NOROUTE:
954 yyerror("\"no-route\" is not permitted "
955 "inside tables");
956 break;
957 default:
958 yyerror("unknown address type %d",
959 n->addr.type);
960 }
961 YYERROR;
962 }
963 if (!(ti = calloc(1, sizeof(*ti))))
964 err(1, "table_opt: calloc");
965 ti->host = $2;
966 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
967 entries);
968 table_opts.init_addr = 1;
969 }
970 | FILENAME STRING {
971 struct node_tinit *ti;
972
973 if (!(ti = calloc(1, sizeof(*ti))))
974 err(1, "table_opt: calloc");
975 ti->file = $2;
976 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
977 entries);
978 table_opts.init_addr = 1;
979 }
980 ;
981
982 altqif : ALTQ interface queue_opts QUEUE qassign {
983 struct pf_altq a;
984
985 if (check_rulestate(PFCTL_STATE_QUEUE))
986 YYERROR;
987
988 memset(&a, 0, sizeof(a));
989 if ($3.scheduler.qtype == ALTQT_NONE) {
990 yyerror("no scheduler specified!");
991 YYERROR;
992 }
993 a.scheduler = $3.scheduler.qtype;
994 a.qlimit = $3.qlimit;
995 a.tbrsize = $3.tbrsize;
996 if ($5 == NULL) {
997 yyerror("no child queues specified");
998 YYERROR;
999 }
1000 if (expand_altq(&a, $2, $5, $3.queue_bwspec,
1001 &$3.scheduler))
1002 YYERROR;
1003 }
1004 ;
1005
1006 queuespec : QUEUE STRING interface queue_opts qassign {
1007 struct pf_altq a;
1008
1009 if (check_rulestate(PFCTL_STATE_QUEUE)) {
1010 free($2);
1011 YYERROR;
1012 }
1013
1014 memset(&a, 0, sizeof(a));
1015
1016 if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
1017 sizeof(a.qname)) {
1018 yyerror("queue name too long (max "
1019 "%d chars)", PF_QNAME_SIZE-1);
1020 free($2);
1021 YYERROR;
1022 }
1023 free($2);
1024 if ($4.tbrsize) {
1025 yyerror("cannot specify tbrsize for queue");
1026 YYERROR;
1027 }
1028 if ($4.priority > 255) {
1029 yyerror("priority out of range: max 255");
1030 YYERROR;
1031 }
1032 a.priority = $4.priority;
1033 a.qlimit = $4.qlimit;
1034 a.scheduler = $4.scheduler.qtype;
1035 if (expand_queue(&a, $3, $5, $4.queue_bwspec,
1036 &$4.scheduler)) {
1037 yyerror("errors in queue definition");
1038 YYERROR;
1039 }
1040 }
1041 ;
1042
1043 queue_opts : {
1044 bzero(&queue_opts, sizeof queue_opts);
1045 queue_opts.priority = DEFAULT_PRIORITY;
1046 queue_opts.qlimit = DEFAULT_QLIMIT;
1047 queue_opts.scheduler.qtype = ALTQT_NONE;
1048 queue_opts.queue_bwspec.bw_percent = 100;
1049 }
1050 queue_opts_l
1051 { $$ = queue_opts; }
1052 | /* empty */ {
1053 bzero(&queue_opts, sizeof queue_opts);
1054 queue_opts.priority = DEFAULT_PRIORITY;
1055 queue_opts.qlimit = DEFAULT_QLIMIT;
1056 queue_opts.scheduler.qtype = ALTQT_NONE;
1057 queue_opts.queue_bwspec.bw_percent = 100;
1058 $$ = queue_opts;
1059 }
1060 ;
1061
1062 queue_opts_l : queue_opts_l queue_opt
1063 | queue_opt
1064 ;
1065
1066 queue_opt : BANDWIDTH bandwidth {
1067 if (queue_opts.marker & QOM_BWSPEC) {
1068 yyerror("bandwidth cannot be respecified");
1069 YYERROR;
1070 }
1071 queue_opts.marker |= QOM_BWSPEC;
1072 queue_opts.queue_bwspec = $2;
1073 }
1074 | PRIORITY number {
1075 if (queue_opts.marker & QOM_PRIORITY) {
1076 yyerror("priority cannot be respecified");
1077 YYERROR;
1078 }
1079 if ($2 > 255) {
1080 yyerror("priority out of range: max 255");
1081 YYERROR;
1082 }
1083 queue_opts.marker |= QOM_PRIORITY;
1084 queue_opts.priority = $2;
1085 }
1086 | QLIMIT number {
1087 if (queue_opts.marker & QOM_QLIMIT) {
1088 yyerror("qlimit cannot be respecified");
1089 YYERROR;
1090 }
1091 if ($2 > 65535) {
1092 yyerror("qlimit out of range: max 65535");
1093 YYERROR;
1094 }
1095 queue_opts.marker |= QOM_QLIMIT;
1096 queue_opts.qlimit = $2;
1097 }
1098 | scheduler {
1099 if (queue_opts.marker & QOM_SCHEDULER) {
1100 yyerror("scheduler cannot be respecified");
1101 YYERROR;
1102 }
1103 queue_opts.marker |= QOM_SCHEDULER;
1104 queue_opts.scheduler = $1;
1105 }
1106 | TBRSIZE number {
1107 if (queue_opts.marker & QOM_TBRSIZE) {
1108 yyerror("tbrsize cannot be respecified");
1109 YYERROR;
1110 }
1111 if ($2 > 65535) {
1112 yyerror("tbrsize too big: max 65535");
1113 YYERROR;
1114 }
1115 queue_opts.marker |= QOM_TBRSIZE;
1116 queue_opts.tbrsize = $2;
1117 }
1118 ;
1119
1120 bandwidth : STRING {
1121 double bps;
1122 char *cp;
1123
1124 $$.bw_percent = 0;
1125
1126 bps = strtod($1, &cp);
1127 if (cp != NULL) {
1128 if (!strcmp(cp, "b"))
1129 ; /* nothing */
1130 else if (!strcmp(cp, "Kib"))
1131 bps *= 1024;
1132 else if (!strcmp(cp, "Mib"))
1133 bps *= 1024 * 1024;
1134 else if (!strcmp(cp, "Gib"))
1135 bps *= 1024 * 1024 * 1024;
1136 else if (!strcmp(cp, "%")) {
1137 if (bps < 0 || bps > 100) {
1138 yyerror("bandwidth spec "
1139 "out of range");
1140 free($1);
1141 YYERROR;
1142 }
1143 $$.bw_percent = bps;
1144 bps = 0;
1145 } else {
1146 yyerror("unknown unit %s", cp);
1147 free($1);
1148 YYERROR;
1149 }
1150 }
1151 free($1);
1152 $$.bw_absolute = (u_int32_t)bps;
1153 }
1154 ;
1155
1156 scheduler : CBQ {
1157 $$.qtype = ALTQT_CBQ;
1158 $$.data.cbq_opts.flags = 0;
1159 }
1160 | CBQ '(' cbqflags_list ')' {
1161 $$.qtype = ALTQT_CBQ;
1162 $$.data.cbq_opts.flags = $3;
1163 }
1164 | PRIQ {
1165 $$.qtype = ALTQT_PRIQ;
1166 $$.data.priq_opts.flags = 0;
1167 }
1168 | PRIQ '(' priqflags_list ')' {
1169 $$.qtype = ALTQT_PRIQ;
1170 $$.data.priq_opts.flags = $3;
1171 }
1172 | HFSC {
1173 $$.qtype = ALTQT_HFSC;
1174 bzero(&$$.data.hfsc_opts,
1175 sizeof(struct node_hfsc_opts));
1176 }
1177 | HFSC '(' hfsc_opts ')' {
1178 $$.qtype = ALTQT_HFSC;
1179 $$.data.hfsc_opts = $3;
1180 }
1181 ;
1182
1183 cbqflags_list : cbqflags_item { $$ |= $1; }
1184 | cbqflags_list comma cbqflags_item { $$ |= $3; }
1185 ;
1186
1187 cbqflags_item : STRING {
1188 if (!strcmp($1, "default"))
1189 $$ = CBQCLF_DEFCLASS;
1190 else if (!strcmp($1, "borrow"))
1191 $$ = CBQCLF_BORROW;
1192 else if (!strcmp($1, "red"))
1193 $$ = CBQCLF_RED;
1194 else if (!strcmp($1, "ecn"))
1195 $$ = CBQCLF_RED|CBQCLF_ECN;
1196 else if (!strcmp($1, "rio"))
1197 $$ = CBQCLF_RIO;
1198 else {
1199 yyerror("unknown cbq flag \"%s\"", $1);
1200 free($1);
1201 YYERROR;
1202 }
1203 free($1);
1204 }
1205 ;
1206
1207 priqflags_list : priqflags_item { $$ |= $1; }
1208 | priqflags_list comma priqflags_item { $$ |= $3; }
1209 ;
1210
1211 priqflags_item : STRING {
1212 if (!strcmp($1, "default"))
1213 $$ = PRCF_DEFAULTCLASS;
1214 else if (!strcmp($1, "red"))
1215 $$ = PRCF_RED;
1216 else if (!strcmp($1, "ecn"))
1217 $$ = PRCF_RED|PRCF_ECN;
1218 else if (!strcmp($1, "rio"))
1219 $$ = PRCF_RIO;
1220 else {
1221 yyerror("unknown priq flag \"%s\"", $1);
1222 free($1);
1223 YYERROR;
1224 }
1225 free($1);
1226 }
1227 ;
1228
1229 hfsc_opts : {
1230 bzero(&hfsc_opts,
1231 sizeof(struct node_hfsc_opts));
1232 }
1233 hfscopts_list {
1234 $$ = hfsc_opts;
1235 }
1236 ;
1237
1238 hfscopts_list : hfscopts_item
1239 | hfscopts_list comma hfscopts_item
1240 ;
1241
1242 hfscopts_item : LINKSHARE bandwidth {
1243 if (hfsc_opts.linkshare.used) {
1244 yyerror("linkshare already specified");
1245 YYERROR;
1246 }
1247 hfsc_opts.linkshare.m2 = $2;
1248 hfsc_opts.linkshare.used = 1;
1249 }
1250 | LINKSHARE '(' bandwidth number bandwidth ')' {
1251 if (hfsc_opts.linkshare.used) {
1252 yyerror("linkshare already specified");
1253 YYERROR;
1254 }
1255 hfsc_opts.linkshare.m1 = $3;
1256 hfsc_opts.linkshare.d = $4;
1257 hfsc_opts.linkshare.m2 = $5;
1258 hfsc_opts.linkshare.used = 1;
1259 }
1260 | REALTIME bandwidth {
1261 if (hfsc_opts.realtime.used) {
1262 yyerror("realtime already specified");
1263 YYERROR;
1264 }
1265 hfsc_opts.realtime.m2 = $2;
1266 hfsc_opts.realtime.used = 1;
1267 }
1268 | REALTIME '(' bandwidth number bandwidth ')' {
1269 if (hfsc_opts.realtime.used) {
1270 yyerror("realtime already specified");
1271 YYERROR;
1272 }
1273 hfsc_opts.realtime.m1 = $3;
1274 hfsc_opts.realtime.d = $4;
1275 hfsc_opts.realtime.m2 = $5;
1276 hfsc_opts.realtime.used = 1;
1277 }
1278 | UPPERLIMIT bandwidth {
1279 if (hfsc_opts.upperlimit.used) {
1280 yyerror("upperlimit already specified");
1281 YYERROR;
1282 }
1283 hfsc_opts.upperlimit.m2 = $2;
1284 hfsc_opts.upperlimit.used = 1;
1285 }
1286 | UPPERLIMIT '(' bandwidth number bandwidth ')' {
1287 if (hfsc_opts.upperlimit.used) {
1288 yyerror("upperlimit already specified");
1289 YYERROR;
1290 }
1291 hfsc_opts.upperlimit.m1 = $3;
1292 hfsc_opts.upperlimit.d = $4;
1293 hfsc_opts.upperlimit.m2 = $5;
1294 hfsc_opts.upperlimit.used = 1;
1295 }
1296 | STRING {
1297 if (!strcmp($1, "default"))
1298 hfsc_opts.flags |= HFCF_DEFAULTCLASS;
1299 else if (!strcmp($1, "red"))
1300 hfsc_opts.flags |= HFCF_RED;
1301 else if (!strcmp($1, "ecn"))
1302 hfsc_opts.flags |= HFCF_RED|HFCF_ECN;
1303 else if (!strcmp($1, "rio"))
1304 hfsc_opts.flags |= HFCF_RIO;
1305 else {
1306 yyerror("unknown hfsc flag \"%s\"", $1);
1307 free($1);
1308 YYERROR;
1309 }
1310 free($1);
1311 }
1312 ;
1313
1314 qassign : /* empty */ { $$ = NULL; }
1315 | qassign_item { $$ = $1; }
1316 | '{' qassign_list '}' { $$ = $2; }
1317 ;
1318
1319 qassign_list : qassign_item { $$ = $1; }
1320 | qassign_list comma qassign_item {
1321 $1->tail->next = $3;
1322 $1->tail = $3;
1323 $$ = $1;
1324 }
1325 ;
1326
1327 qassign_item : STRING {
1328 $$ = calloc(1, sizeof(struct node_queue));
1329 if ($$ == NULL)
1330 err(1, "qassign_item: calloc");
1331 if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
1332 sizeof($$->queue)) {
1333 yyerror("queue name '%s' too long (max "
1334 "%d chars)", $1, sizeof($$->queue)-1);
1335 free($1);
1336 free($$);
1337 YYERROR;
1338 }
1339 free($1);
1340 $$->next = NULL;
1341 $$->tail = $$;
1342 }
1343 ;
1344
1345 pfrule : action dir logquick interface route af proto fromto
1346 filter_opts
1347 {
1348 struct pf_rule r;
1349 struct node_state_opt *o;
1350 struct node_proto *proto;
1351 int srctrack = 0;
1352 int statelock = 0;
1353
1354 if (check_rulestate(PFCTL_STATE_FILTER))
1355 YYERROR;
1356
1357 memset(&r, 0, sizeof(r));
1358
1359 r.action = $1.b1;
1360 switch ($1.b2) {
1361 case PFRULE_RETURNRST:
1362 r.rule_flag |= PFRULE_RETURNRST;
1363 r.return_ttl = $1.w;
1364 break;
1365 case PFRULE_RETURNICMP:
1366 r.rule_flag |= PFRULE_RETURNICMP;
1367 r.return_icmp = $1.w;
1368 r.return_icmp6 = $1.w2;
1369 break;
1370 case PFRULE_RETURN:
1371 r.rule_flag |= PFRULE_RETURN;
1372 r.return_icmp = $1.w;
1373 r.return_icmp6 = $1.w2;
1374 break;
1375 }
1376 r.direction = $2;
1377 r.log = $3.log;
1378 r.quick = $3.quick;
1379 r.prob = $9.prob;
1380
1381 r.af = $6;
1382 if ($9.tag)
1383 if (strlcpy(r.tagname, $9.tag,
1384 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1385 yyerror("tag too long, max %u chars",
1386 PF_TAG_NAME_SIZE - 1);
1387 YYERROR;
1388 }
1389 if ($9.match_tag)
1390 if (strlcpy(r.match_tagname, $9.match_tag,
1391 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1392 yyerror("tag too long, max %u chars",
1393 PF_TAG_NAME_SIZE - 1);
1394 YYERROR;
1395 }
1396 r.match_tag_not = $9.match_tag_not;
1397 r.flags = $9.flags.b1;
1398 r.flagset = $9.flags.b2;
1399 if (rule_label(&r, $9.label))
1400 YYERROR;
1401 free($9.label);
1402 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
1403 for (proto = $7; proto != NULL &&
1404 proto->proto != IPPROTO_TCP;
1405 proto = proto->next)
1406 ; /* nothing */
1407 if (proto == NULL && $7 != NULL) {
1408 if ($9.flags.b1 || $9.flags.b2)
1409 yyerror(
1410 "flags only apply to tcp");
1411 if ($8.src_os)
1412 yyerror(
1413 "OS fingerprinting only "
1414 "apply to tcp");
1415 YYERROR;
1416 }
1417 #if 0
1418 if (($9.flags.b1 & parse_flags("S")) == 0 &&
1419 $8.src_os) {
1420 yyerror("OS fingerprinting requires "
1421 "the SYN TCP flag (flags S/SA)");
1422 YYERROR;
1423 }
1424 #endif
1425 }
1426
1427 r.tos = $9.tos;
1428 r.keep_state = $9.keep.action;
1429 o = $9.keep.options;
1430 while (o) {
1431 struct node_state_opt *p = o;
1432
1433 switch (o->type) {
1434 case PF_STATE_OPT_MAX:
1435 if (r.max_states) {
1436 yyerror("state option 'max' "
1437 "multiple definitions");
1438 YYERROR;
1439 }
1440 r.max_states = o->data.max_states;
1441 break;
1442 case PF_STATE_OPT_NOSYNC:
1443 if (r.rule_flag & PFRULE_NOSYNC) {
1444 yyerror("state option 'sync' "
1445 "multiple definitions");
1446 YYERROR;
1447 }
1448 r.rule_flag |= PFRULE_NOSYNC;
1449 break;
1450 case PF_STATE_OPT_SRCTRACK:
1451 if (srctrack) {
1452 yyerror("state option "
1453 "'source-track' "
1454 "multiple definitions");
1455 YYERROR;
1456 }
1457 srctrack = o->data.src_track;
1458 break;
1459 case PF_STATE_OPT_MAX_SRC_STATES:
1460 if (r.max_src_states) {
1461 yyerror("state option "
1462 "'max-src-states' "
1463 "multiple definitions");
1464 YYERROR;
1465 }
1466 if (o->data.max_src_nodes == 0) {
1467 yyerror("'max-src-states' must "
1468 "be > 0");
1469 YYERROR;
1470 }
1471 r.max_src_states =
1472 o->data.max_src_states;
1473 r.rule_flag |= PFRULE_SRCTRACK;
1474 break;
1475 case PF_STATE_OPT_MAX_SRC_NODES:
1476 if (r.max_src_nodes) {
1477 yyerror("state option "
1478 "'max-src-nodes' "
1479 "multiple definitions");
1480 YYERROR;
1481 }
1482 if (o->data.max_src_nodes == 0) {
1483 yyerror("'max-src-nodes' must "
1484 "be > 0");
1485 YYERROR;
1486 }
1487 r.max_src_nodes =
1488 o->data.max_src_nodes;
1489 r.rule_flag |= PFRULE_SRCTRACK |
1490 PFRULE_RULESRCTRACK;
1491 break;
1492 case PF_STATE_OPT_STATELOCK:
1493 if (statelock) {
1494 yyerror("state locking option: "
1495 "multiple definitions");
1496 YYERROR;
1497 }
1498 statelock = 1;
1499 r.rule_flag |= o->data.statelock;
1500 break;
1501 case PF_STATE_OPT_TIMEOUT:
1502 if (r.timeout[o->data.timeout.number]) {
1503 yyerror("state timeout %s "
1504 "multiple definitions",
1505 pf_timeouts[o->data.
1506 timeout.number].name);
1507 YYERROR;
1508 }
1509 r.timeout[o->data.timeout.number] =
1510 o->data.timeout.seconds;
1511 }
1512 o = o->next;
1513 free(p);
1514 }
1515 if (srctrack) {
1516 if (srctrack == PF_SRCTRACK_GLOBAL &&
1517 r.max_src_nodes) {
1518 yyerror("'max-src-nodes' is "
1519 "incompatible with "
1520 "'source-track global'");
1521 YYERROR;
1522 }
1523 r.rule_flag |= PFRULE_SRCTRACK;
1524 if (srctrack == PF_SRCTRACK_RULE)
1525 r.rule_flag |= PFRULE_RULESRCTRACK;
1526 }
1527 if (r.keep_state && !statelock)
1528 r.rule_flag |= default_statelock;
1529
1530 if ($9.fragment)
1531 r.rule_flag |= PFRULE_FRAGMENT;
1532 r.allow_opts = $9.allowopts;
1533
1534 decide_address_family($8.src.host, &r.af);
1535 decide_address_family($8.dst.host, &r.af);
1536
1537 if ($5.rt) {
1538 if (!r.direction) {
1539 yyerror("direction must be explicit "
1540 "with rules that specify routing");
1541 YYERROR;
1542 }
1543 r.rt = $5.rt;
1544 r.rpool.opts = $5.pool_opts;
1545 if ($5.key != NULL)
1546 memcpy(&r.rpool.key, $5.key,
1547 sizeof(struct pf_poolhashkey));
1548 }
1549 if (r.rt && r.rt != PF_FASTROUTE) {
1550 decide_address_family($5.host, &r.af);
1551 remove_invalid_hosts(&$5.host, &r.af);
1552 if ($5.host == NULL) {
1553 yyerror("no routing address with "
1554 "matching address family found.");
1555 YYERROR;
1556 }
1557 if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
1558 PF_POOL_NONE && ($5.host->next != NULL ||
1559 $5.host->addr.type == PF_ADDR_TABLE))
1560 r.rpool.opts |= PF_POOL_ROUNDROBIN;
1561 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1562 PF_POOL_ROUNDROBIN &&
1563 disallow_table($5.host, "tables are only "
1564 "supported in round-robin routing pools"))
1565 YYERROR;
1566 if ($5.host->next != NULL) {
1567 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1568 PF_POOL_ROUNDROBIN) {
1569 yyerror("r.rpool.opts must "
1570 "be PF_POOL_ROUNDROBIN");
1571 YYERROR;
1572 }
1573 }
1574 }
1575 if ($9.queues.qname != NULL) {
1576 if (strlcpy(r.qname, $9.queues.qname,
1577 sizeof(r.qname)) >= sizeof(r.qname)) {
1578 yyerror("rule qname too long (max "
1579 "%d chars)", sizeof(r.qname)-1);
1580 YYERROR;
1581 }
1582 free($9.queues.qname);
1583 }
1584 if ($9.queues.pqname != NULL) {
1585 if (strlcpy(r.pqname, $9.queues.pqname,
1586 sizeof(r.pqname)) >= sizeof(r.pqname)) {
1587 yyerror("rule pqname too long (max "
1588 "%d chars)", sizeof(r.pqname)-1);
1589 YYERROR;
1590 }
1591 free($9.queues.pqname);
1592 }
1593
1594 expand_rule(&r, $4, $5.host, $7, $8.src_os,
1595 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
1596 $9.uid, $9.gid, $9.icmpspec);
1597 }
1598 ;
1599
1600 filter_opts : { bzero(&filter_opts, sizeof filter_opts); }
1601 filter_opts_l
1602 { $$ = filter_opts; }
1603 | /* empty */ {
1604 bzero(&filter_opts, sizeof filter_opts);
1605 $$ = filter_opts;
1606 }
1607 ;
1608
1609 filter_opts_l : filter_opts_l filter_opt
1610 | filter_opt
1611 ;
1612
1613 filter_opt : USER uids {
1614 if (filter_opts.uid)
1615 $2->tail->next = filter_opts.uid;
1616 filter_opts.uid = $2;
1617 }
1618 | GROUP gids {
1619 if (filter_opts.gid)
1620 $2->tail->next = filter_opts.gid;
1621 filter_opts.gid = $2;
1622 }
1623 | flags {
1624 if (filter_opts.marker & FOM_FLAGS) {
1625 yyerror("flags cannot be redefined");
1626 YYERROR;
1627 }
1628 filter_opts.marker |= FOM_FLAGS;
1629 filter_opts.flags.b1 |= $1.b1;
1630 filter_opts.flags.b2 |= $1.b2;
1631 filter_opts.flags.w |= $1.w;
1632 filter_opts.flags.w2 |= $1.w2;
1633 }
1634 | icmpspec {
1635 if (filter_opts.marker & FOM_ICMP) {
1636 yyerror("icmp-type cannot be redefined");
1637 YYERROR;
1638 }
1639 filter_opts.marker |= FOM_ICMP;
1640 filter_opts.icmpspec = $1;
1641 }
1642 | tos {
1643 if (filter_opts.marker & FOM_TOS) {
1644 yyerror("tos cannot be redefined");
1645 YYERROR;
1646 }
1647 filter_opts.marker |= FOM_TOS;
1648 filter_opts.tos = $1;
1649 }
1650 | keep {
1651 if (filter_opts.marker & FOM_KEEP) {
1652 yyerror("modulate or keep cannot be redefined");
1653 YYERROR;
1654 }
1655 filter_opts.marker |= FOM_KEEP;
1656 filter_opts.keep.action = $1.action;
1657 filter_opts.keep.options = $1.options;
1658 }
1659 | FRAGMENT {
1660 filter_opts.fragment = 1;
1661 }
1662 | ALLOWOPTS {
1663 filter_opts.allowopts = 1;
1664 }
1665 | label {
1666 if (filter_opts.label) {
1667 yyerror("label cannot be redefined");
1668 YYERROR;
1669 }
1670 filter_opts.label = $1;
1671 }
1672 | qname {
1673 if (filter_opts.queues.qname) {
1674 yyerror("queue cannot be redefined");
1675 YYERROR;
1676 }
1677 filter_opts.queues = $1;
1678 }
1679 | TAG string {
1680 filter_opts.tag = $2;
1681 }
1682 | not TAGGED string {
1683 filter_opts.match_tag = $3;
1684 filter_opts.match_tag_not = $1;
1685 }
1686 | PROBABILITY STRING {
1687 char *e;
1688 double p = strtod($2, &e);
1689
1690 if (*e == '%') {
1691 p *= 0.01;
1692 e++;
1693 }
1694 if (*e) {
1695 yyerror("invalid probability: %s", $2);
1696 YYERROR;
1697 }
1698 p = floor(p * (UINT_MAX+1.0) + 0.5);
1699 if (p < 1.0 || p >= (UINT_MAX+1.0)) {
1700 yyerror("invalid probability: %s", $2);
1701 YYERROR;
1702 }
1703 filter_opts.prob = (u_int32_t)p;
1704 free($2);
1705 }
1706 ;
1707
1708 action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
1709 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; }
1710 | FUCKOFF {
1711 $$.b1 = PF_DROP;
1712 $$.b2 = PFRULE_RETURN;
1713 $$.w = returnicmpdefault;
1714 $$.w2 = returnicmp6default;
1715 }
1716 ;
1717
1718 blockspec : /* empty */ {
1719 $$.b2 = blockpolicy;
1720 $$.w = returnicmpdefault;
1721 $$.w2 = returnicmp6default;
1722 }
1723 | DROP {
1724 $$.b2 = PFRULE_DROP;
1725 $$.w = 0;
1726 $$.w2 = 0;
1727 }
1728 | RETURNRST {
1729 $$.b2 = PFRULE_RETURNRST;
1730 $$.w = 0;
1731 $$.w2 = 0;
1732 }
1733 | RETURNRST '(' TTL number ')' {
1734 if ($4 > 255) {
1735 yyerror("illegal ttl value %d", $4);
1736 YYERROR;
1737 }
1738 $$.b2 = PFRULE_RETURNRST;
1739 $$.w = $4;
1740 $$.w2 = 0;
1741 }
1742 | RETURNICMP {
1743 $$.b2 = PFRULE_RETURNICMP;
1744 $$.w = returnicmpdefault;
1745 $$.w2 = returnicmp6default;
1746 }
1747 | RETURNICMP6 {
1748 $$.b2 = PFRULE_RETURNICMP;
1749 $$.w = returnicmpdefault;
1750 $$.w2 = returnicmp6default;
1751 }
1752 | RETURNICMP '(' STRING ')' {
1753 $$.b2 = PFRULE_RETURNICMP;
1754 if (!($$.w = parseicmpspec($3, AF_INET))) {
1755 free($3);
1756 YYERROR;
1757 }
1758 free($3);
1759 $$.w2 = returnicmp6default;
1760 }
1761 | RETURNICMP6 '(' STRING ')' {
1762 $$.b2 = PFRULE_RETURNICMP;
1763 $$.w = returnicmpdefault;
1764 if (!($$.w2 = parseicmpspec($3, AF_INET6))) {
1765 free($3);
1766 YYERROR;
1767 }
1768 free($3);
1769 }
1770 | RETURNICMP '(' STRING comma STRING ')' {
1771 $$.b2 = PFRULE_RETURNICMP;
1772 if (!($$.w = parseicmpspec($3, AF_INET)) ||
1773 !($$.w2 = parseicmpspec($5, AF_INET6))) {
1774 free($3);
1775 free($5);
1776 YYERROR;
1777 }
1778 free($3);
1779 free($5);
1780 }
1781 | RETURN {
1782 $$.b2 = PFRULE_RETURN;
1783 $$.w = returnicmpdefault;
1784 $$.w2 = returnicmp6default;
1785 }
1786 ;
1787
1788 dir : /* empty */ { $$ = 0; }
1789 | IN { $$ = PF_IN; }
1790 | OUT { $$ = PF_OUT; }
1791 ;
1792
1793 logquick : /* empty */ { $$.log = 0; $$.quick = 0; }
1794 | log { $$.log = $1; $$.quick = 0; }
1795 | QUICK { $$.log = 0; $$.quick = 1; }
1796 | log QUICK { $$.log = $1; $$.quick = 1; }
1797 | QUICK log { $$.log = $2; $$.quick = 1; }
1798 ;
1799
1800 log : LOG { $$ = 1; }
1801 | LOGALL { $$ = 2; }
1802 ;
1803
1804 interface : /* empty */ { $$ = NULL; }
1805 | ON if_item_not { $$ = $2; }
1806 | ON '{' if_list '}' { $$ = $3; }
1807 ;
1808
1809 if_list : if_item_not { $$ = $1; }
1810 | if_list comma if_item_not {
1811 $1->tail->next = $3;
1812 $1->tail = $3;
1813 $$ = $1;
1814 }
1815 ;
1816
1817 if_item_not : not if_item { $$ = $2; $$->not = $1; }
1818 ;
1819
1820 if_item : STRING {
1821 struct node_host *n;
1822
1823 if ((n = ifa_exists($1, 1)) == NULL) {
1824 yyerror("unknown interface %s", $1);
1825 free($1);
1826 YYERROR;
1827 }
1828 $$ = calloc(1, sizeof(struct node_if));
1829 if ($$ == NULL)
1830 err(1, "if_item: calloc");
1831 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
1832 sizeof($$->ifname)) {
1833 free($1);
1834 free($$);
1835 yyerror("interface name too long");
1836 YYERROR;
1837 }
1838 free($1);
1839 $$->ifa_flags = n->ifa_flags;
1840 $$->not = 0;
1841 $$->next = NULL;
1842 $$->tail = $$;
1843 }
1844 ;
1845
1846 af : /* empty */ { $$ = 0; }
1847 | INET { $$ = AF_INET; }
1848 | INET6 { $$ = AF_INET6; }
1849 ;
1850
1851 proto : /* empty */ { $$ = NULL; }
1852 | PROTO proto_item { $$ = $2; }
1853 | PROTO '{' proto_list '}' { $$ = $3; }
1854 ;
1855
1856 proto_list : proto_item { $$ = $1; }
1857 | proto_list comma proto_item {
1858 $1->tail->next = $3;
1859 $1->tail = $3;
1860 $$ = $1;
1861 }
1862 ;
1863
1864 proto_item : STRING {
1865 u_int8_t pr;
1866 u_long ulval;
1867
1868 if (atoul($1, &ulval) == 0) {
1869 if (ulval > 255) {
1870 yyerror("protocol outside range");
1871 free($1);
1872 YYERROR;
1873 }
1874 pr = (u_int8_t)ulval;
1875 } else {
1876 struct protoent *p;
1877
1878 p = getprotobyname($1);
1879 if (p == NULL) {
1880 yyerror("unknown protocol %s", $1);
1881 free($1);
1882 YYERROR;
1883 }
1884 pr = p->p_proto;
1885 }
1886 free($1);
1887 if (pr == 0) {
1888 yyerror("proto 0 cannot be used");
1889 YYERROR;
1890 }
1891 $$ = calloc(1, sizeof(struct node_proto));
1892 if ($$ == NULL)
1893 err(1, "proto_item: calloc");
1894 $$->proto = pr;
1895 $$->next = NULL;
1896 $$->tail = $$;
1897 }
1898 ;
1899
1900 fromto : ALL {
1901 $$.src.host = NULL;
1902 $$.src.port = NULL;
1903 $$.dst.host = NULL;
1904 $$.dst.port = NULL;
1905 $$.src_os = NULL;
1906 }
1907 | from os to {
1908 $$.src = $1;
1909 $$.src_os = $2;
1910 $$.dst = $3;
1911 }
1912 ;
1913
1914 os : /* empty */ { $$ = NULL; }
1915 | OS xos { $$ = $2; }
1916 | OS '{' os_list '}' { $$ = $3; }
1917 ;
1918
1919 xos : STRING {
1920 $$ = calloc(1, sizeof(struct node_os));
1921 if ($$ == NULL)
1922 err(1, "os: calloc");
1923 $$->os = $1;
1924 $$->tail = $$;
1925 }
1926 ;
1927
1928 os_list : xos { $$ = $1; }
1929 | os_list comma xos {
1930 $1->tail->next = $3;
1931 $1->tail = $3;
1932 $$ = $1;
1933 }
1934 ;
1935
1936 from : /* empty */ {
1937 $$.host = NULL;
1938 $$.port = NULL;
1939 }
1940 | FROM ipportspec {
1941 $$ = $2;
1942 }
1943 ;
1944
1945 to : /* empty */ {
1946 $$.host = NULL;
1947 $$.port = NULL;
1948 }
1949 | TO ipportspec {
1950 $$ = $2;
1951 }
1952 ;
1953
1954 ipportspec : ipspec {
1955 $$.host = $1;
1956 $$.port = NULL;
1957 }
1958 | ipspec PORT portspec {
1959 $$.host = $1;
1960 $$.port = $3;
1961 }
1962 | PORT portspec {
1963 $$.host = NULL;
1964 $$.port = $2;
1965 }
1966 ;
1967
1968 ipspec : ANY { $$ = NULL; }
1969 | xhost { $$ = $1; }
1970 | '{' host_list '}' { $$ = $2; }
1971 ;
1972
1973 host_list : xhost { $$ = $1; }
1974 | host_list comma xhost {
1975 if ($3 == NULL)
1976 $$ = $1;
1977 else if ($1 == NULL)
1978 $$ = $3;
1979 else {
1980 $1->tail->next = $3;
1981 $1->tail = $3->tail;
1982 $$ = $1;
1983 }
1984 }
1985 ;
1986
1987 xhost : not host {
1988 struct node_host *n;
1989
1990 for (n = $2; n != NULL; n = n->next)
1991 n->not = $1;
1992 $$ = $2;
1993 }
1994 | NOROUTE {
1995 $$ = calloc(1, sizeof(struct node_host));
1996 if ($$ == NULL)
1997 err(1, "xhost: calloc");
1998 $$->addr.type = PF_ADDR_NOROUTE;
1999 $$->next = NULL;
2000 $$->tail = $$;
2001 }
2002 ;
2003
2004 host : STRING {
2005 if (($$ = host($1)) == NULL) {
2006 /* error. "any" is handled elsewhere */
2007 free($1);
2008 yyerror("could not parse host specification");
2009 YYERROR;
2010 }
2011 free($1);
2012
2013 }
2014 | STRING '/' number {
2015 char *buf;
2016
2017 if (asprintf(&buf, "%s/%u", $1, $3) == -1)
2018 err(1, "host: asprintf");
2019 free($1);
2020 if (($$ = host(buf)) == NULL) {
2021 /* error. "any" is handled elsewhere */
2022 free(buf);
2023 yyerror("could not parse host specification");
2024 YYERROR;
2025 }
2026 free(buf);
2027 }
2028 | '<' STRING '>' {
2029 if (strlen($2) >= PF_TABLE_NAME_SIZE) {
2030 yyerror("table name '%s' too long", $2);
2031 free($2);
2032 YYERROR;
2033 }
2034 $$ = calloc(1, sizeof(struct node_host));
2035 if ($$ == NULL)
2036 err(1, "host: calloc");
2037 $$->addr.type = PF_ADDR_TABLE;
2038 if (strlcpy($$->addr.v.tblname, $2,
2039 sizeof($$->addr.v.tblname)) >=
2040 sizeof($$->addr.v.tblname))
2041 errx(1, "host: strlcpy");
2042 free($2);
2043 $$->next = NULL;
2044 $$->tail = $$;
2045 }
2046 ;
2047
2048 number : STRING {
2049 u_long ulval;
2050
2051 if (atoul($1, &ulval) == -1) {
2052 yyerror("%s is not a number", $1);
2053 free($1);
2054 YYERROR;
2055 } else
2056 $$ = ulval;
2057 free($1);
2058 }
2059 ;
2060
2061 portspec : port_item { $$ = $1; }
2062 | '{' port_list '}' { $$ = $2; }
2063 ;
2064
2065 port_list : port_item { $$ = $1; }
2066 | port_list comma port_item {
2067 $1->tail->next = $3;
2068 $1->tail = $3;
2069 $$ = $1;
2070 }
2071 ;
2072
2073 port_item : port {
2074 $$ = calloc(1, sizeof(struct node_port));
2075 if ($$ == NULL)
2076 err(1, "port_item: calloc");
2077 $$->port[0] = $1.a;
2078 $$->port[1] = $1.b;
2079 if ($1.t)
2080 $$->op = PF_OP_RRG;
2081 else
2082 $$->op = PF_OP_EQ;
2083 $$->next = NULL;
2084 $$->tail = $$;
2085 }
2086 | unaryop port {
2087 if ($2.t) {
2088 yyerror("':' cannot be used with an other "
2089 "port operator");
2090 YYERROR;
2091 }
2092 $$ = calloc(1, sizeof(struct node_port));
2093 if ($$ == NULL)
2094 err(1, "port_item: calloc");
2095 $$->port[0] = $2.a;
2096 $$->port[1] = $2.b;
2097 $$->op = $1;
2098 $$->next = NULL;
2099 $$->tail = $$;
2100 }
2101 | port PORTBINARY port {
2102 if ($1.t || $3.t) {
2103 yyerror("':' cannot be used with an other "
2104 "port operator");
2105 YYERROR;
2106 }
2107 $$ = calloc(1, sizeof(struct node_port));
2108 if ($$ == NULL)
2109 err(1, "port_item: calloc");
2110 $$->port[0] = $1.a;
2111 $$->port[1] = $3.a;
2112 $$->op = $2;
2113 $$->next = NULL;
2114 $$->tail = $$;
2115 }
2116 ;
2117
2118 port : STRING {
2119 char *p = strchr($1, ':');
2120 struct servent *s = NULL;
2121 u_long ulval;
2122
2123 if (p == NULL) {
2124 if (atoul($1, &ulval) == 0) {
2125 if (ulval > 65535) {
2126 free($1);
2127 yyerror("illegal port value %d",
2128 ulval);
2129 YYERROR;
2130 }
2131 $$.a = htons(ulval);
2132 } else {
2133 s = getservbyname($1, "tcp");
2134 if (s == NULL)
2135 s = getservbyname($1, "udp");
2136 if (s == NULL) {
2137 yyerror("unknown port %s", $1);
2138 free($1);
2139 YYERROR;
2140 }
2141 $$.a = s->s_port;
2142 }
2143 $$.b = 0;
2144 $$.t = 0;
2145 } else {
2146 int port[2];
2147
2148 *p++ = 0;
2149 if ((port[0] = getservice($1)) == -1 ||
2150 (port[1] = getservice(p)) == -1) {
2151 free($1);
2152 YYERROR;
2153 }
2154 $$.a = port[0];
2155 $$.b = port[1];
2156 $$.t = PF_OP_RRG;
2157 }
2158 free($1);
2159 }
2160 ;
2161
2162 uids : uid_item { $$ = $1; }
2163 | '{' uid_list '}' { $$ = $2; }
2164 ;
2165
2166 uid_list : uid_item { $$ = $1; }
2167 | uid_list comma uid_item {
2168 $1->tail->next = $3;
2169 $1->tail = $3;
2170 $$ = $1;
2171 }
2172 ;
2173
2174 uid_item : uid {
2175 $$ = calloc(1, sizeof(struct node_uid));
2176 if ($$ == NULL)
2177 err(1, "uid_item: calloc");
2178 $$->uid[0] = $1;
2179 $$->uid[1] = $1;
2180 $$->op = PF_OP_EQ;
2181 $$->next = NULL;
2182 $$->tail = $$;
2183 }
2184 | unaryop uid {
2185 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2186 yyerror("user unknown requires operator = or "
2187 "!=");
2188 YYERROR;
2189 }
2190 $$ = calloc(1, sizeof(struct node_uid));
2191 if ($$ == NULL)
2192 err(1, "uid_item: calloc");
2193 $$->uid[0] = $2;
2194 $$->uid[1] = $2;
2195 $$->op = $1;
2196 $$->next = NULL;
2197 $$->tail = $$;
2198 }
2199 | uid PORTBINARY uid {
2200 if ($1 == UID_MAX || $3 == UID_MAX) {
2201 yyerror("user unknown requires operator = or "
2202 "!=");
2203 YYERROR;
2204 }
2205 $$ = calloc(1, sizeof(struct node_uid));
2206 if ($$ == NULL)
2207 err(1, "uid_item: calloc");
2208 $$->uid[0] = $1;
2209 $$->uid[1] = $3;
2210 $$->op = $2;
2211 $$->next = NULL;
2212 $$->tail = $$;
2213 }
2214 ;
2215
2216 uid : STRING {
2217 u_long ulval;
2218
2219 if (atoul($1, &ulval) == -1) {
2220 if (!strcmp($1, "unknown"))
2221 $$ = UID_MAX;
2222 else {
2223 struct passwd *pw;
2224
2225 if ((pw = getpwnam($1)) == NULL) {
2226 yyerror("unknown user %s", $1);
2227 free($1);
2228 YYERROR;
2229 }
2230 $$ = pw->pw_uid;
2231 }
2232 } else {
2233 if (ulval >= UID_MAX) {
2234 free($1);
2235 yyerror("illegal uid value %lu", ulval);
2236 YYERROR;
2237 }
2238 $$ = ulval;
2239 }
2240 free($1);
2241 }
2242 ;
2243
2244 gids : gid_item { $$ = $1; }
2245 | '{' gid_list '}' { $$ = $2; }
2246 ;
2247
2248 gid_list : gid_item { $$ = $1; }
2249 | gid_list comma gid_item {
2250 $1->tail->next = $3;
2251 $1->tail = $3;
2252 $$ = $1;
2253 }
2254 ;
2255
2256 gid_item : gid {
2257 $$ = calloc(1, sizeof(struct node_gid));
2258 if ($$ == NULL)
2259 err(1, "gid_item: calloc");
2260 $$->gid[0] = $1;
2261 $$->gid[1] = $1;
2262 $$->op = PF_OP_EQ;
2263 $$->next = NULL;
2264 $$->tail = $$;
2265 }
2266 | unaryop gid {
2267 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2268 yyerror("group unknown requires operator = or "
2269 "!=");
2270 YYERROR;
2271 }
2272 $$ = calloc(1, sizeof(struct node_gid));
2273 if ($$ == NULL)
2274 err(1, "gid_item: calloc");
2275 $$->gid[0] = $2;
2276 $$->gid[1] = $2;
2277 $$->op = $1;
2278 $$->next = NULL;
2279 $$->tail = $$;
2280 }
2281 | gid PORTBINARY gid {
2282 if ($1 == GID_MAX || $3 == GID_MAX) {
2283 yyerror("group unknown requires operator = or "
2284 "!=");
2285 YYERROR;
2286 }
2287 $$ = calloc(1, sizeof(struct node_gid));
2288 if ($$ == NULL)
2289 err(1, "gid_item: calloc");
2290 $$->gid[0] = $1;
2291 $$->gid[1] = $3;
2292 $$->op = $2;
2293 $$->next = NULL;
2294 $$->tail = $$;
2295 }
2296 ;
2297
2298 gid : STRING {
2299 u_long ulval;
2300
2301 if (atoul($1, &ulval) == -1) {
2302 if (!strcmp($1, "unknown"))
2303 $$ = GID_MAX;
2304 else {
2305 struct group *grp;
2306
2307 if ((grp = getgrnam($1)) == NULL) {
2308 yyerror("unknown group %s", $1);
2309 free($1);
2310 YYERROR;
2311 }
2312 $$ = grp->gr_gid;
2313 }
2314 } else {
2315 if (ulval >= GID_MAX) {
2316 yyerror("illegal gid value %lu", ulval);
2317 free($1);
2318 YYERROR;
2319 }
2320 $$ = ulval;
2321 }
2322 free($1);
2323 }
2324 ;
2325
2326 flag : STRING {
2327 int f;
2328
2329 if ((f = parse_flags($1)) < 0) {
2330 yyerror("bad flags %s", $1);
2331 free($1);
2332 YYERROR;
2333 }
2334 free($1);
2335 $$.b1 = f;
2336 }
2337 ;
2338
2339 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; }
2340 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; }
2341 ;
2342
2343 icmpspec : ICMPTYPE icmp_item { $$ = $2; }
2344 | ICMPTYPE '{' icmp_list '}' { $$ = $3; }
2345 | ICMP6TYPE icmp6_item { $$ = $2; }
2346 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; }
2347 ;
2348
2349 icmp_list : icmp_item { $$ = $1; }
2350 | icmp_list comma icmp_item {
2351 $1->tail->next = $3;
2352 $1->tail = $3;
2353 $$ = $1;
2354 }
2355 ;
2356
2357 icmp6_list : icmp6_item { $$ = $1; }
2358 | icmp6_list comma icmp6_item {
2359 $1->tail->next = $3;
2360 $1->tail = $3;
2361 $$ = $1;
2362 }
2363 ;
2364
2365 icmp_item : icmptype {
2366 $$ = calloc(1, sizeof(struct node_icmp));
2367 if ($$ == NULL)
2368 err(1, "icmp_item: calloc");
2369 $$->type = $1;
2370 $$->code = 0;
2371 $$->proto = IPPROTO_ICMP;
2372 $$->next = NULL;
2373 $$->tail = $$;
2374 }
2375 | icmptype CODE STRING {
2376 const struct icmpcodeent *p;
2377 u_long ulval;
2378
2379 if (atoul($3, &ulval) == 0) {
2380 if (ulval > 255) {
2381 free($3);
2382 yyerror("illegal icmp-code %d", ulval);
2383 YYERROR;
2384 }
2385 } else {
2386 if ((p = geticmpcodebyname($1-1, $3,
2387 AF_INET)) == NULL) {
2388 yyerror("unknown icmp-code %s", $3);
2389 free($3);
2390 YYERROR;
2391 }
2392 ulval = p->code;
2393 }
2394 free($3);
2395 $$ = calloc(1, sizeof(struct node_icmp));
2396 if ($$ == NULL)
2397 err(1, "icmp_item: calloc");
2398 $$->type = $1;
2399 $$->code = ulval + 1;
2400 $$->proto = IPPROTO_ICMP;
2401 $$->next = NULL;
2402 $$->tail = $$;
2403 }
2404 ;
2405
2406 icmp6_item : icmp6type {
2407 $$ = calloc(1, sizeof(struct node_icmp));
2408 if ($$ == NULL)
2409 err(1, "icmp_item: calloc");
2410 $$->type = $1;
2411 $$->code = 0;
2412 $$->proto = IPPROTO_ICMPV6;
2413 $$->next = NULL;
2414 $$->tail = $$;
2415 }
2416 | icmp6type CODE STRING {
2417 const struct icmpcodeent *p;
2418 u_long ulval;
2419
2420 if (atoul($3, &ulval) == 0) {
2421 if (ulval > 255) {
2422 yyerror("illegal icmp6-code %ld",
2423 ulval);
2424 free($3);
2425 YYERROR;
2426 }
2427 } else {
2428 if ((p = geticmpcodebyname($1-1, $3,
2429 AF_INET6)) == NULL) {
2430 yyerror("unknown icmp6-code %s", $3);
2431 free($3);
2432 YYERROR;
2433 }
2434 ulval = p->code;
2435 }
2436 free($3);
2437 $$ = calloc(1, sizeof(struct node_icmp));
2438 if ($$ == NULL)
2439 err(1, "icmp_item: calloc");
2440 $$->type = $1;
2441 $$->code = ulval + 1;
2442 $$->proto = IPPROTO_ICMPV6;
2443 $$->next = NULL;
2444 $$->tail = $$;
2445 }
2446 ;
2447
2448 icmptype : STRING {
2449 const struct icmptypeent *p;
2450 u_long ulval;
2451
2452 if (atoul($1, &ulval) == 0) {
2453 if (ulval > 255) {
2454 yyerror("illegal icmp-type %d", ulval);
2455 free($1);
2456 YYERROR;
2457 }
2458 $$ = ulval + 1;
2459 } else {
2460 if ((p = geticmptypebyname($1, AF_INET)) ==
2461 NULL) {
2462 yyerror("unknown icmp-type %s", $1);
2463 free($1);
2464 YYERROR;
2465 }
2466 $$ = p->type + 1;
2467 }
2468 free($1);
2469 }
2470 ;
2471
2472 icmp6type : STRING {
2473 const struct icmptypeent *p;
2474 u_long ulval;
2475
2476 if (atoul($1, &ulval) == 0) {
2477 if (ulval > 255) {
2478 yyerror("illegal icmp6-type %d", ulval);
2479 free($1);
2480 YYERROR;
2481 }
2482 $$ = ulval + 1;
2483 } else {
2484 if ((p = geticmptypebyname($1, AF_INET6)) ==
2485 NULL) {
2486 yyerror("unknown icmp6-type %s", $1);
2487 free($1);
2488 YYERROR;
2489 }
2490 $$ = p->type + 1;
2491 }
2492 free($1);
2493 }
2494 ;
2495
2496 tos : TOS STRING {
2497 if (!strcmp($2, "lowdelay"))
2498 $$ = IPTOS_LOWDELAY;
2499 else if (!strcmp($2, "throughput"))
2500 $$ = IPTOS_THROUGHPUT;
2501 else if (!strcmp($2, "reliability"))
2502 $$ = IPTOS_RELIABILITY;
2503 else if ($2[0] == '0' && $2[1] == 'x')
2504 $$ = strtoul($2, NULL, 16);
2505 else
2506 $$ = strtoul($2, NULL, 10);
2507 if (!$$ || $$ > 255) {
2508 yyerror("illegal tos value %s", $2);
2509 free($2);
2510 YYERROR;
2511 }
2512 free($2);
2513 }
2514 ;
2515
2516 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; }
2517 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; }
2518 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; }
2519 ;
2520
2521 statelock : IFBOUND {
2522 $$ = PFRULE_IFBOUND;
2523 }
2524 | GRBOUND {
2525 $$ = PFRULE_GRBOUND;
2526 }
2527 | FLOATING {
2528 $$ = 0;
2529 }
2530 ;
2531
2532 keep : KEEP STATE state_opt_spec {
2533 $$.action = PF_STATE_NORMAL;
2534 $$.options = $3;
2535 }
2536 | MODULATE STATE state_opt_spec {
2537 $$.action = PF_STATE_MODULATE;
2538 $$.options = $3;
2539 }
2540 | SYNPROXY STATE state_opt_spec {
2541 $$.action = PF_STATE_SYNPROXY;
2542 $$.options = $3;
2543 }
2544 ;
2545
2546 state_opt_spec : '(' state_opt_list ')' { $$ = $2; }
2547 | /* empty */ { $$ = NULL; }
2548 ;
2549
2550 state_opt_list : state_opt_item { $$ = $1; }
2551 | state_opt_list comma state_opt_item {
2552 $1->tail->next = $3;
2553 $1->tail = $3;
2554 $$ = $1;
2555 }
2556 ;
2557
2558 state_opt_item : MAXIMUM number {
2559 $$ = calloc(1, sizeof(struct node_state_opt));
2560 if ($$ == NULL)
2561 err(1, "state_opt_item: calloc");
2562 $$->type = PF_STATE_OPT_MAX;
2563 $$->data.max_states = $2;
2564 $$->next = NULL;
2565 $$->tail = $$;
2566 }
2567 | NOSYNC {
2568 $$ = calloc(1, sizeof(struct node_state_opt));
2569 if ($$ == NULL)
2570 err(1, "state_opt_item: calloc");
2571 $$->type = PF_STATE_OPT_NOSYNC;
2572 $$->next = NULL;
2573 $$->tail = $$;
2574 }
2575 | MAXSRCSTATES number {
2576 $$ = calloc(1, sizeof(struct node_state_opt));
2577 if ($$ == NULL)
2578 err(1, "state_opt_item: calloc");
2579 $$->type = PF_STATE_OPT_MAX_SRC_STATES;
2580 $$->data.max_src_states = $2;
2581 $$->next = NULL;
2582 $$->tail = $$;
2583 }
2584 | MAXSRCNODES number {
2585 $$ = calloc(1, sizeof(struct node_state_opt));
2586 if ($$ == NULL)
2587 err(1, "state_opt_item: calloc");
2588 $$->type = PF_STATE_OPT_MAX_SRC_NODES;
2589 $$->data.max_src_nodes = $2;
2590 $$->next = NULL;
2591 $$->tail = $$;
2592 }
2593 | sourcetrack {
2594 $$ = calloc(1, sizeof(struct node_state_opt));
2595 if ($$ == NULL)
2596 err(1, "state_opt_item: calloc");
2597 $$->type = PF_STATE_OPT_SRCTRACK;
2598 $$->data.src_track = $1;
2599 $$->next = NULL;
2600 $$->tail = $$;
2601 }
2602 | statelock {
2603 $$ = calloc(1, sizeof(struct node_state_opt));
2604 if ($$ == NULL)
2605 err(1, "state_opt_item: calloc");
2606 $$->type = PF_STATE_OPT_STATELOCK;
2607 $$->data.statelock = $1;
2608 $$->next = NULL;
2609 $$->tail = $$;
2610 }
2611 | STRING number {
2612 int i;
2613
2614 for (i = 0; pf_timeouts[i].name &&
2615 strcmp(pf_timeouts[i].name, $1); ++i)
2616 ; /* nothing */
2617 if (!pf_timeouts[i].name) {
2618 yyerror("illegal timeout name %s", $1);
2619 free($1);
2620 YYERROR;
2621 }
2622 if (strchr(pf_timeouts[i].name, '.') == NULL) {
2623 yyerror("illegal state timeout %s", $1);
2624 free($1);
2625 YYERROR;
2626 }
2627 free($1);
2628 $$ = calloc(1, sizeof(struct node_state_opt));
2629 if ($$ == NULL)
2630 err(1, "state_opt_item: calloc");
2631 $$->type = PF_STATE_OPT_TIMEOUT;
2632 $$->data.timeout.number = pf_timeouts[i].timeout;
2633 $$->data.timeout.seconds = $2;
2634 $$->next = NULL;
2635 $$->tail = $$;
2636 }
2637 ;
2638
2639 label : LABEL STRING {
2640 $$ = $2;
2641 }
2642 ;
2643
2644 qname : QUEUE STRING {
2645 $$.qname = $2;
2646 }
2647 | QUEUE '(' STRING ')' {
2648 $$.qname = $3;
2649 }
2650 | QUEUE '(' STRING comma STRING ')' {
2651 $$.qname = $3;
2652 $$.pqname = $5;
2653 }
2654 ;
2655
2656 no : /* empty */ { $$ = 0; }
2657 | NO { $$ = 1; }
2658 ;
2659
2660 rport : STRING {
2661 char *p = strchr($1, ':');
2662
2663 if (p == NULL) {
2664 if (($$.a = getservice($1)) == -1) {
2665 free($1);
2666 YYERROR;
2667 }
2668 $$.b = $$.t = 0;
2669 } else if (!strcmp(p+1, "*")) {
2670 *p = 0;
2671 if (($$.a = getservice($1)) == -1) {
2672 free($1);
2673 YYERROR;
2674 }
2675 $$.b = 0;
2676 $$.t = 1;
2677 } else {
2678 *p++ = 0;
2679 if (($$.a = getservice($1)) == -1 ||
2680 ($$.b = getservice(p)) == -1) {
2681 free($1);
2682 YYERROR;
2683 }
2684 if ($$.a == $$.b)
2685 $$.b = 0;
2686 $$.t = 0;
2687 }
2688 free($1);
2689 }
2690 ;
2691
2692 redirspec : host { $$ = $1; }
2693 | '{' redir_host_list '}' { $$ = $2; }
2694 ;
2695
2696 redir_host_list : host { $$ = $1; }
2697 | redir_host_list comma host {
2698 $1->tail->next = $3;
2699 $1->tail = $3->tail;
2700 $$ = $1;
2701 }
2702 ;
2703
2704 redirpool : /* empty */ { $$ = NULL; }
2705 | ARROW redirspec {
2706 $$ = calloc(1, sizeof(struct redirection));
2707 if ($$ == NULL)
2708 err(1, "redirection: calloc");
2709 $$->host = $2;
2710 $$->rport.a = $$->rport.b = $$->rport.t = 0;
2711 }
2712 | ARROW redirspec PORT rport {
2713 $$ = calloc(1, sizeof(struct redirection));
2714 if ($$ == NULL)
2715 err(1, "redirection: calloc");
2716 $$->host = $2;
2717 $$->rport = $4;
2718 }
2719 ;
2720
2721 hashkey : /* empty */
2722 {
2723 $$ = calloc(1, sizeof(struct pf_poolhashkey));
2724 if ($$ == NULL)
2725 err(1, "hashkey: calloc");
2726 arc4random_buf($$->key32, sizeof($$->key32));
2727 }
2728 | string
2729 {
2730 if (!strncmp($1, "0x", 2)) {
2731 if (strlen($1) != 34) {
2732 free($1);
2733 yyerror("hex key must be 128 bits "
2734 "(32 hex digits) long");
2735 YYERROR;
2736 }
2737 $$ = calloc(1, sizeof(struct pf_poolhashkey));
2738 if ($$ == NULL)
2739 err(1, "hashkey: calloc");
2740
2741 if (sscanf($1, "0x%8x%8x%8x%8x",
2742 &$$->key32[0], &$$->key32[1],
2743 &$$->key32[2], &$$->key32[3]) != 4) {
2744 free($$);
2745 free($1);
2746 yyerror("invalid hex key");
2747 YYERROR;
2748 }
2749 } else {
2750 MD5_CTX context;
2751
2752 $$ = calloc(1, sizeof(struct pf_poolhashkey));
2753 if ($$ == NULL)
2754 err(1, "hashkey: calloc");
2755 MD5Init(&context);
2756 MD5Update(&context, (unsigned char *)$1,
2757 strlen($1));
2758 MD5Final((unsigned char *)$$, &context);
2759 HTONL($$->key32[0]);
2760 HTONL($$->key32[1]);
2761 HTONL($$->key32[2]);
2762 HTONL($$->key32[3]);
2763 }
2764 free($1);
2765 }
2766 ;
2767
2768 pool_opts : { bzero(&pool_opts, sizeof pool_opts); }
2769 pool_opts_l
2770 { $$ = pool_opts; }
2771 | /* empty */ {
2772 bzero(&pool_opts, sizeof pool_opts);
2773 $$ = pool_opts;
2774 }
2775 ;
2776
2777 pool_opts_l : pool_opts_l pool_opt
2778 | pool_opt
2779 ;
2780
2781 pool_opt : BITMASK {
2782 if (pool_opts.type) {
2783 yyerror("pool type cannot be redefined");
2784 YYERROR;
2785 }
2786 pool_opts.type = PF_POOL_BITMASK;
2787 }
2788 | RANDOM {
2789 if (pool_opts.type) {
2790 yyerror("pool type cannot be redefined");
2791 YYERROR;
2792 }
2793 pool_opts.type = PF_POOL_RANDOM;
2794 }
2795 | SOURCEHASH hashkey {
2796 if (pool_opts.type) {
2797 yyerror("pool type cannot be redefined");
2798 YYERROR;
2799 }
2800 pool_opts.type = PF_POOL_SRCHASH;
2801 pool_opts.key = $2;
2802 }
2803 | ROUNDROBIN {
2804 if (pool_opts.type) {
2805 yyerror("pool type cannot be redefined");
2806 YYERROR;
2807 }
2808 pool_opts.type = PF_POOL_ROUNDROBIN;
2809 }
2810 | STATICPORT {
2811 if (pool_opts.staticport) {
2812 yyerror("static-port cannot be redefined");
2813 YYERROR;
2814 }
2815 pool_opts.staticport = 1;
2816 }
2817 | STICKYADDRESS {
2818 if (filter_opts.marker & POM_STICKYADDRESS) {
2819 yyerror("sticky-address cannot be redefined");
2820 YYERROR;
2821 }
2822 pool_opts.marker |= POM_STICKYADDRESS;
2823 pool_opts.opts |= PF_POOL_STICKYADDR;
2824 }
2825 ;
2826
2827 redirection : /* empty */ { $$ = NULL; }
2828 | ARROW host {
2829 $$ = calloc(1, sizeof(struct redirection));
2830 if ($$ == NULL)
2831 err(1, "redirection: calloc");
2832 $$->host = $2;
2833 $$->rport.a = $$->rport.b = $$->rport.t = 0;
2834 }
2835 | ARROW host PORT rport {
2836 $$ = calloc(1, sizeof(struct redirection));
2837 if ($$ == NULL)
2838 err(1, "redirection: calloc");
2839 $$->host = $2;
2840 $$->rport = $4;
2841 }
2842 ;
2843
2844 natpass : /* empty */ { $$ = 0; }
2845 | PASS { $$ = 1; }
2846 ;
2847
2848 nataction : no NAT natpass {
2849 $$.b2 = $$.w = 0;
2850 if ($1)
2851 $$.b1 = PF_NONAT;
2852 else
2853 $$.b1 = PF_NAT;
2854 $$.b2 = $3;
2855 }
2856 | no RDR natpass {
2857 $$.b2 = $$.w = 0;
2858 if ($1)
2859 $$.b1 = PF_NORDR;
2860 else
2861 $$.b1 = PF_RDR;
2862 $$.b2 = $3;
2863 }
2864 ;
2865
2866 natrule : nataction interface af proto fromto tag redirpool pool_opts
2867 {
2868 struct pf_rule r;
2869
2870 if (check_rulestate(PFCTL_STATE_NAT))
2871 YYERROR;
2872
2873 memset(&r, 0, sizeof(r));
2874
2875 r.action = $1.b1;
2876 r.natpass = $1.b2;
2877 r.af = $3;
2878
2879 if (!r.af) {
2880 if ($5.src.host && $5.src.host->af &&
2881 !$5.src.host->ifindex)
2882 r.af = $5.src.host->af;
2883 else if ($5.dst.host && $5.dst.host->af &&
2884 !$5.dst.host->ifindex)
2885 r.af = $5.dst.host->af;
2886 }
2887
2888 if ($6 != NULL)
2889 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
2890 PF_TAG_NAME_SIZE) {
2891 yyerror("tag too long, max %u chars",
2892 PF_TAG_NAME_SIZE - 1);
2893 YYERROR;
2894 }
2895
2896 if (r.action == PF_NONAT || r.action == PF_NORDR) {
2897 if ($7 != NULL) {
2898 yyerror("translation rule with 'no' "
2899 "does not need '->'");
2900 YYERROR;
2901 }
2902 } else {
2903 if ($7 == NULL || $7->host == NULL) {
2904 yyerror("translation rule requires '-> "
2905 "address'");
2906 YYERROR;
2907 }
2908 if (!r.af && ! $7->host->ifindex)
2909 r.af = $7->host->af;
2910
2911 remove_invalid_hosts(&$7->host, &r.af);
2912 if (invalid_redirect($7->host, r.af))
2913 YYERROR;
2914 if (check_netmask($7->host, r.af))
2915 YYERROR;
2916
2917 r.rpool.proxy_port[0] = ntohs($7->rport.a);
2918
2919 switch (r.action) {
2920 case PF_RDR:
2921 if (!$7->rport.b && $7->rport.t &&
2922 $5.dst.port != NULL) {
2923 r.rpool.proxy_port[1] =
2924 ntohs($7->rport.a) +
2925 (ntohs(
2926 $5.dst.port->port[1]) -
2927 ntohs(
2928 $5.dst.port->port[0]));
2929 } else
2930 r.rpool.proxy_port[1] =
2931 ntohs($7->rport.b);
2932 break;
2933 case PF_NAT:
2934 r.rpool.proxy_port[1] =
2935 ntohs($7->rport.b);
2936 if (!r.rpool.proxy_port[0] &&
2937 !r.rpool.proxy_port[1]) {
2938 r.rpool.proxy_port[0] =
2939 PF_NAT_PROXY_PORT_LOW;
2940 r.rpool.proxy_port[1] =
2941 PF_NAT_PROXY_PORT_HIGH;
2942 } else if (!r.rpool.proxy_port[1])
2943 r.rpool.proxy_port[1] =
2944 r.rpool.proxy_port[0];
2945 break;
2946 default:
2947 break;
2948 }
2949
2950 r.rpool.opts = $8.type;
2951 if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
2952 PF_POOL_NONE && ($7->host->next != NULL ||
2953 $7->host->addr.type == PF_ADDR_TABLE))
2954 r.rpool.opts = PF_POOL_ROUNDROBIN;
2955 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2956 PF_POOL_ROUNDROBIN &&
2957 disallow_table($7->host, "tables are only "
2958 "supported in round-robin redirection "
2959 "pools"))
2960 YYERROR;
2961 if ($7->host->next != NULL) {
2962 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2963 PF_POOL_ROUNDROBIN) {
2964 yyerror("only round-robin "
2965 "valid for multiple "
2966 "redirection addresses");
2967 YYERROR;
2968 }
2969 }
2970 }
2971
2972 if ($8.key != NULL)
2973 memcpy(&r.rpool.key, $8.key,
2974 sizeof(struct pf_poolhashkey));
2975
2976 if ($8.opts)
2977 r.rpool.opts |= $8.opts;
2978
2979 if ($8.staticport) {
2980 if (r.action != PF_NAT) {
2981 yyerror("the 'static-port' option is "
2982 "only valid with nat rules");
2983 YYERROR;
2984 }
2985 if (r.rpool.proxy_port[0] !=
2986 PF_NAT_PROXY_PORT_LOW &&
2987 r.rpool.proxy_port[1] !=
2988 PF_NAT_PROXY_PORT_HIGH) {
2989 yyerror("the 'static-port' option can't"
2990 " be used when specifying a port"
2991 " range");
2992 YYERROR;
2993 }
2994 r.rpool.proxy_port[0] = 0;
2995 r.rpool.proxy_port[1] = 0;
2996 }
2997
2998 expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4,
2999 $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
3000 $5.dst.port, 0, 0, 0);
3001 free($7);
3002 }
3003 ;
3004
3005 binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag
3006 redirection
3007 {
3008 struct pf_rule binat;
3009 struct pf_pooladdr *pa;
3010
3011 if (check_rulestate(PFCTL_STATE_NAT))
3012 YYERROR;
3013
3014 memset(&binat, 0, sizeof(binat));
3015
3016 if ($1)
3017 binat.action = PF_NOBINAT;
3018 else
3019 binat.action = PF_BINAT;
3020 binat.natpass = $3;
3021 binat.af = $5;
3022 if (!binat.af && $8 != NULL && $8->af)
3023 binat.af = $8->af;
3024 if (!binat.af && $10 != NULL && $10->af)
3025 binat.af = $10->af;
3026 if (!binat.af && $12 != NULL && $12->host)
3027 binat.af = $12->host->af;
3028 if (!binat.af) {
3029 yyerror("address family (inet/inet6) "
3030 "undefined");
3031 YYERROR;
3032 }
3033
3034 if ($4 != NULL) {
3035 memcpy(binat.ifname, $4->ifname,
3036 sizeof(binat.ifname));
3037 binat.ifnot = $4->not;
3038 free($4);
3039 }
3040 if ($11 != NULL)
3041 if (strlcpy(binat.tagname, $11,
3042 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
3043 yyerror("tag too long, max %u chars",
3044 PF_TAG_NAME_SIZE - 1);
3045 YYERROR;
3046 }
3047
3048 if ($6 != NULL) {
3049 binat.proto = $6->proto;
3050 free($6);
3051 }
3052
3053 if ($8 != NULL && disallow_table($8, "invalid use of "
3054 "table <%s> as the source address of a binat rule"))
3055 YYERROR;
3056 if ($12 != NULL && $12->host != NULL && disallow_table(
3057 $12->host, "invalid use of table <%s> as the "
3058 "redirect address of a binat rule"))
3059 YYERROR;
3060
3061 if ($8 != NULL) {
3062 if ($8->next) {
3063 yyerror("multiple binat ip addresses");
3064 YYERROR;
3065 }
3066 if ($8->af != binat.af) {
3067 yyerror("binat ip versions must match");
3068 YYERROR;
3069 }
3070 if (check_netmask($8, binat.af))
3071 YYERROR;
3072 memcpy(&binat.src.addr, &$8->addr,
3073 sizeof(binat.src.addr));
3074 free($8);
3075 }
3076 if ($10 != NULL) {
3077 if ($10->next) {
3078 yyerror("multiple binat ip addresses");
3079 YYERROR;
3080 }
3081 if ($10->af != binat.af && $10->af) {
3082 yyerror("binat ip versions must match");
3083 YYERROR;
3084 }
3085 if (check_netmask($10, binat.af))
3086 YYERROR;
3087 memcpy(&binat.dst.addr, &$10->addr,
3088 sizeof(binat.dst.addr));
3089 binat.dst.not = $10->not;
3090 free($10);
3091 }
3092
3093 if (binat.action == PF_NOBINAT) {
3094 if ($12 != NULL) {
3095 yyerror("'no binat' rule does not need"
3096 " '->'");
3097 YYERROR;
3098 }
3099 } else {
3100 if ($12 == NULL || $12->host == NULL) {
3101 yyerror("'binat' rule requires"
3102 " '-> address'");
3103 YYERROR;
3104 }
3105
3106 remove_invalid_hosts(&$12->host, &binat.af);
3107 if (invalid_redirect($12->host, binat.af))
3108 YYERROR;
3109 if ($12->host->next != NULL) {
3110 yyerror("binat rule must redirect to "
3111 "a single address");
3112 YYERROR;
3113 }
3114 if (check_netmask($12->host, binat.af))
3115 YYERROR;
3116
3117 if (!PF_AZERO(&binat.src.addr.v.a.mask,
3118 binat.af) &&
3119 !PF_AEQ(&binat.src.addr.v.a.mask,
3120 &$12->host->addr.v.a.mask, binat.af)) {
3121 yyerror("'binat' source mask and "
3122 "redirect mask must be the same");
3123 YYERROR;
3124 }
3125
3126 TAILQ_INIT(&binat.rpool.list);
3127 pa = calloc(1, sizeof(struct pf_pooladdr));
3128 if (pa == NULL)
3129 err(1, "binat: calloc");
3130 pa->addr = $12->host->addr;
3131 pa->ifname[0] = 0;
3132 TAILQ_INSERT_TAIL(&binat.rpool.list,
3133 pa, entries);
3134
3135 free($12);
3136 }
3137
3138 pfctl_add_rule(pf, &binat);
3139 }
3140 ;
3141
3142 tag : /* empty */ { $$ = NULL; }
3143 | TAG STRING { $$ = $2; }
3144 ;
3145
3146 route_host : STRING {
3147 $$ = calloc(1, sizeof(struct node_host));
3148 if ($$ == NULL)
3149 err(1, "route_host: calloc");
3150 $$->ifname = $1;
3151 if (ifa_exists($$->ifname, 0) == NULL) {
3152 yyerror("routeto: unknown interface %s",
3153 $$->ifname);
3154 free($1);
3155 free($$);
3156 YYERROR;
3157 }
3158 set_ipmask($$, 128);
3159 $$->next = NULL;
3160 $$->tail = $$;
3161 }
3162 | '(' STRING host ')' {
3163 $$ = $3;
3164 $$->ifname = $2;
3165 if (ifa_exists($$->ifname, 0) == NULL) {
3166 yyerror("routeto: unknown interface %s",
3167 $$->ifname);
3168 YYERROR;
3169 }
3170 }
3171 ;
3172
3173 route_host_list : route_host { $$ = $1; }
3174 | route_host_list comma route_host {
3175 if ($1->af == 0)
3176 $1->af = $3->af;
3177 if ($1->af != $3->af) {
3178 yyerror("all pool addresses must be in the "
3179 "same address family");
3180 YYERROR;
3181 }
3182 $1->tail->next = $3;
3183 $1->tail = $3->tail;
3184 $$ = $1;
3185 }
3186 ;
3187
3188 routespec : route_host { $$ = $1; }
3189 | '{' route_host_list '}' { $$ = $2; }
3190 ;
3191
3192 route : /* empty */ {
3193 $$.host = NULL;
3194 $$.rt = 0;
3195 $$.pool_opts = 0;
3196 }
3197 | FASTROUTE {
3198 $$.host = NULL;
3199 $$.rt = PF_FASTROUTE;
3200 $$.pool_opts = 0;
3201 }
3202 | ROUTETO routespec pool_opts {
3203 $$.host = $2;
3204 $$.rt = PF_ROUTETO;
3205 $$.pool_opts = $3.type | $3.opts;
3206 if ($3.key != NULL)
3207 $$.key = $3.key;
3208 }
3209 | REPLYTO routespec pool_opts {
3210 $$.host = $2;
3211 $$.rt = PF_REPLYTO;
3212 $$.pool_opts = $3.type | $3.opts;
3213 if ($3.key != NULL)
3214 $$.key = $3.key;
3215 }
3216 | DUPTO routespec pool_opts {
3217 $$.host = $2;
3218 $$.rt = PF_DUPTO;
3219 $$.pool_opts = $3.type | $3.opts;
3220 if ($3.key != NULL)
3221 $$.key = $3.key;
3222 }
3223 ;
3224
3225 timeout_spec : STRING number
3226 {
3227 if (check_rulestate(PFCTL_STATE_OPTION)) {
3228 free($1);
3229 YYERROR;
3230 }
3231 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
3232 yyerror("unknown timeout %s", $1);
3233 free($1);
3234 YYERROR;
3235 }
3236 free($1);
3237 }
3238 ;
3239
3240 timeout_list : timeout_list comma timeout_spec
3241 | timeout_spec
3242 ;
3243
3244 limit_spec : STRING number
3245 {
3246 if (check_rulestate(PFCTL_STATE_OPTION)) {
3247 free($1);
3248 YYERROR;
3249 }
3250 if (pfctl_set_limit(pf, $1, $2) != 0) {
3251 yyerror("unable to set limit %s %u", $1, $2);
3252 free($1);
3253 YYERROR;
3254 }
3255 free($1);
3256 }
3257 ;
3258
3259 limit_list : limit_list comma limit_spec
3260 | limit_spec
3261 ;
3262
3263 comma : ','
3264 | /* empty */
3265 ;
3266
3267 yesno : NO { $$ = 0; }
3268 | STRING {
3269 if (!strcmp($1, "yes"))
3270 $$ = 1;
3271 else {
3272 free($1);
3273 YYERROR;
3274 }
3275 free($1);
3276 }
3277 ;
3278
3279 unaryop : '=' { $$ = PF_OP_EQ; }
3280 | '!' '=' { $$ = PF_OP_NE; }
3281 | '<' '=' { $$ = PF_OP_LE; }
3282 | '<' { $$ = PF_OP_LT; }
3283 | '>' '=' { $$ = PF_OP_GE; }
3284 | '>' { $$ = PF_OP_GT; }
3285 ;
3286
3287 %%
3288
3289 int
3290 yyerror(const char *fmt, ...)
3291 {
3292 va_list ap;
3293 extern char *infile;
3294
3295 errors = 1;
3296 va_start(ap, fmt);
3297 fprintf(stderr, "%s:%d: ", infile, yylval.lineno);
3298 vfprintf(stderr, fmt, ap);
3299 fprintf(stderr, "\n");
3300 va_end(ap);
3301 return (0);
3302 }
3303
3304 int
disallow_table(struct node_host * h,const char * fmt)3305 disallow_table(struct node_host *h, const char *fmt)
3306 {
3307 for (; h != NULL; h = h->next)
3308 if (h->addr.type == PF_ADDR_TABLE) {
3309 yyerror(fmt, h->addr.v.tblname);
3310 return (1);
3311 }
3312 return (0);
3313 }
3314
3315 int
rule_consistent(struct pf_rule * r)3316 rule_consistent(struct pf_rule *r)
3317 {
3318 int problems = 0;
3319
3320 switch (r->action) {
3321 case PF_PASS:
3322 case PF_DROP:
3323 case PF_SCRUB:
3324 problems = filter_consistent(r);
3325 break;
3326 case PF_NAT:
3327 case PF_NONAT:
3328 problems = nat_consistent(r);
3329 break;
3330 case PF_RDR:
3331 case PF_NORDR:
3332 problems = rdr_consistent(r);
3333 break;
3334 case PF_BINAT:
3335 case PF_NOBINAT:
3336 default:
3337 break;
3338 }
3339 return (problems);
3340 }
3341
3342 int
filter_consistent(struct pf_rule * r)3343 filter_consistent(struct pf_rule *r)
3344 {
3345 int problems = 0;
3346
3347 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
3348 (r->src.port_op || r->dst.port_op)) {
3349 yyerror("port only applies to tcp/udp");
3350 problems++;
3351 }
3352 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
3353 (r->type || r->code)) {
3354 yyerror("icmp-type/code only applies to icmp");
3355 problems++;
3356 }
3357 if (!r->af && (r->type || r->code)) {
3358 yyerror("must indicate address family with icmp-type/code");
3359 problems++;
3360 }
3361 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
3362 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
3363 yyerror("proto %s doesn't match address family %s",
3364 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
3365 r->af == AF_INET ? "inet" : "inet6");
3366 problems++;
3367 }
3368 if (r->allow_opts && r->action != PF_PASS) {
3369 yyerror("allow-opts can only be specified for pass rules");
3370 problems++;
3371 }
3372 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
3373 r->dst.port_op || r->flagset || r->type || r->code)) {
3374 yyerror("fragments can be filtered only on IP header fields");
3375 problems++;
3376 }
3377 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
3378 yyerror("return-rst can only be applied to TCP rules");
3379 problems++;
3380 }
3381 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
3382 yyerror("max-src-nodes requires 'source-track rule'");
3383 problems++;
3384 }
3385 if (r->action == PF_DROP && r->keep_state) {
3386 yyerror("keep state on block rules doesn't make sense");
3387 problems++;
3388 }
3389 if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state &&
3390 r->action == PF_PASS && !r->anchorname[0]) {
3391 yyerror("tags cannot be used without keep state");
3392 problems++;
3393 }
3394 return (-problems);
3395 }
3396
3397 int
nat_consistent(struct pf_rule * r)3398 nat_consistent(struct pf_rule *r)
3399 {
3400 return (0); /* yeah! */
3401 }
3402
3403 int
rdr_consistent(struct pf_rule * r)3404 rdr_consistent(struct pf_rule *r)
3405 {
3406 int problems = 0;
3407
3408 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
3409 if (r->src.port_op) {
3410 yyerror("src port only applies to tcp/udp");
3411 problems++;
3412 }
3413 if (r->dst.port_op) {
3414 yyerror("dst port only applies to tcp/udp");
3415 problems++;
3416 }
3417 if (r->rpool.proxy_port[0]) {
3418 yyerror("rpool port only applies to tcp/udp");
3419 problems++;
3420 }
3421 }
3422 if (r->dst.port_op &&
3423 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
3424 yyerror("invalid port operator for rdr destination port");
3425 problems++;
3426 }
3427 return (-problems);
3428 }
3429
3430 int
process_tabledef(char * name,struct table_opts * opts)3431 process_tabledef(char *name, struct table_opts *opts)
3432 {
3433 struct pfr_buffer ab;
3434 struct node_tinit *ti;
3435
3436 bzero(&ab, sizeof(ab));
3437 ab.pfrb_type = PFRB_ADDRS;
3438 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
3439 if (ti->file)
3440 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
3441 if (errno)
3442 yyerror("cannot load \"%s\": %s",
3443 ti->file, strerror(errno));
3444 else
3445 yyerror("file \"%s\" contains bad data",
3446 ti->file);
3447 goto _error;
3448 }
3449 if (ti->host)
3450 if (append_addr_host(&ab, ti->host, 0, 0)) {
3451 yyerror("cannot create address buffer: %s",
3452 strerror(errno));
3453 goto _error;
3454 }
3455 }
3456 if (pf->opts & PF_OPT_VERBOSE)
3457 print_tabledef(name, opts->flags, opts->init_addr,
3458 &opts->init_nodes);
3459 if (!(pf->opts & PF_OPT_NOACTION) &&
3460 pfctl_define_table(name, opts->flags, opts->init_addr,
3461 pf->anchor, pf->ruleset, &ab, pf->tticket)) {
3462 yyerror("cannot define table %s: %s", name,
3463 pfr_strerror(errno));
3464 goto _error;
3465 }
3466 pf->tdirty = 1;
3467 pfr_buf_clear(&ab);
3468 return (0);
3469 _error:
3470 pfr_buf_clear(&ab);
3471 return (-1);
3472 }
3473
3474 struct keywords {
3475 const char *k_name;
3476 int k_val;
3477 };
3478
3479 /* macro gore, but you should've seen the prior indentation nightmare... */
3480
3481 #define FREE_LIST(T,r) \
3482 do { \
3483 T *p, *node = r; \
3484 while (node != NULL) { \
3485 p = node; \
3486 node = node->next; \
3487 free(p); \
3488 } \
3489 } while (0)
3490
3491 #define LOOP_THROUGH(T,n,r,C) \
3492 do { \
3493 T *n; \
3494 if (r == NULL) { \
3495 r = calloc(1, sizeof(T)); \
3496 if (r == NULL) \
3497 err(1, "LOOP: calloc"); \
3498 r->next = NULL; \
3499 } \
3500 n = r; \
3501 while (n != NULL) { \
3502 do { \
3503 C; \
3504 } while (0); \
3505 n = n->next; \
3506 } \
3507 } while (0)
3508
3509 void
expand_label_str(char * label,size_t len,const char * srch,const char * repl)3510 expand_label_str(char *label, size_t len, const char *srch, const char *repl)
3511 {
3512 char *tmp;
3513 char *p, *q;
3514
3515 if ((tmp = calloc(1, len)) == NULL)
3516 err(1, "expand_label_str: calloc");
3517 p = q = label;
3518 while ((q = strstr(p, srch)) != NULL) {
3519 *q = '\0';
3520 if ((strlcat(tmp, p, len) >= len) ||
3521 (strlcat(tmp, repl, len) >= len))
3522 errx(1, "expand_label: label too long");
3523 q += strlen(srch);
3524 p = q;
3525 }
3526 if (strlcat(tmp, p, len) >= len)
3527 errx(1, "expand_label: label too long");
3528 strlcpy(label, tmp, len); /* always fits */
3529 free(tmp);
3530 }
3531
3532 void
expand_label_if(const char * name,char * label,size_t len,const char * ifname)3533 expand_label_if(const char *name, char *label, size_t len, const char *ifname)
3534 {
3535 if (strstr(label, name) != NULL) {
3536 if (!*ifname)
3537 expand_label_str(label, len, name, "any");
3538 else
3539 expand_label_str(label, len, name, ifname);
3540 }
3541 }
3542
3543 void
expand_label_addr(const char * name,char * label,size_t len,sa_family_t af,struct node_host * h)3544 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
3545 struct node_host *h)
3546 {
3547 char tmp[64], tmp_not[66];
3548
3549 if (strstr(label, name) != NULL) {
3550 switch (h->addr.type) {
3551 case PF_ADDR_TABLE:
3552 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
3553 break;
3554 case PF_ADDR_NOROUTE:
3555 snprintf(tmp, sizeof(tmp), "no-route");
3556 break;
3557 case PF_ADDR_ADDRMASK:
3558 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
3559 PF_AZERO(&h->addr.v.a.mask, af)))
3560 snprintf(tmp, sizeof(tmp), "any");
3561 else {
3562 char a[48];
3563 int bits;
3564
3565 if (inet_ntop(af, &h->addr.v.a.addr, a,
3566 sizeof(a)) == NULL)
3567 snprintf(tmp, sizeof(tmp), "?");
3568 else {
3569 bits = unmask(&h->addr.v.a.mask, af);
3570 if ((af == AF_INET && bits < 32) ||
3571 (af == AF_INET6 && bits < 128))
3572 snprintf(tmp, sizeof(tmp),
3573 "%s/%d", a, bits);
3574 else
3575 snprintf(tmp, sizeof(tmp),
3576 "%s", a);
3577 }
3578 }
3579 break;
3580 default:
3581 snprintf(tmp, sizeof(tmp), "?");
3582 break;
3583 }
3584
3585 if (h->not) {
3586 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
3587 expand_label_str(label, len, name, tmp_not);
3588 } else
3589 expand_label_str(label, len, name, tmp);
3590 }
3591 }
3592
3593 void
expand_label_port(const char * name,char * label,size_t len,struct node_port * port)3594 expand_label_port(const char *name, char *label, size_t len,
3595 struct node_port *port)
3596 {
3597 char a1[6], a2[6], op[13] = "";
3598
3599 if (strstr(label, name) != NULL) {
3600 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
3601 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
3602 if (!port->op)
3603 ;
3604 else if (port->op == PF_OP_IRG)
3605 snprintf(op, sizeof(op), "%s><%s", a1, a2);
3606 else if (port->op == PF_OP_XRG)
3607 snprintf(op, sizeof(op), "%s<>%s", a1, a2);
3608 else if (port->op == PF_OP_EQ)
3609 snprintf(op, sizeof(op), "%s", a1);
3610 else if (port->op == PF_OP_NE)
3611 snprintf(op, sizeof(op), "!=%s", a1);
3612 else if (port->op == PF_OP_LT)
3613 snprintf(op, sizeof(op), "<%s", a1);
3614 else if (port->op == PF_OP_LE)
3615 snprintf(op, sizeof(op), "<=%s", a1);
3616 else if (port->op == PF_OP_GT)
3617 snprintf(op, sizeof(op), ">%s", a1);
3618 else if (port->op == PF_OP_GE)
3619 snprintf(op, sizeof(op), ">=%s", a1);
3620 expand_label_str(label, len, name, op);
3621 }
3622 }
3623
3624 void
expand_label_proto(const char * name,char * label,size_t len,u_int8_t proto)3625 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
3626 {
3627 struct protoent *pe;
3628 char n[4];
3629
3630 if (strstr(label, name) != NULL) {
3631 pe = getprotobynumber(proto);
3632 if (pe != NULL)
3633 expand_label_str(label, len, name, pe->p_name);
3634 else {
3635 snprintf(n, sizeof(n), "%u", proto);
3636 expand_label_str(label, len, name, n);
3637 }
3638 }
3639 }
3640
3641 void
expand_label_nr(const char * name,char * label,size_t len)3642 expand_label_nr(const char *name, char *label, size_t len)
3643 {
3644 char n[11];
3645
3646 if (strstr(label, name) != NULL) {
3647 snprintf(n, sizeof(n), "%u", pf->rule_nr);
3648 expand_label_str(label, len, name, n);
3649 }
3650 }
3651
3652 void
expand_label(char * label,size_t len,const char * ifname,sa_family_t af,struct node_host * src_host,struct node_port * src_port,struct node_host * dst_host,struct node_port * dst_port,u_int8_t proto)3653 expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
3654 struct node_host *src_host, struct node_port *src_port,
3655 struct node_host *dst_host, struct node_port *dst_port,
3656 u_int8_t proto)
3657 {
3658 expand_label_if("$if", label, len, ifname);
3659 expand_label_addr("$srcaddr", label, len, af, src_host);
3660 expand_label_addr("$dstaddr", label, len, af, dst_host);
3661 expand_label_port("$srcport", label, len, src_port);
3662 expand_label_port("$dstport", label, len, dst_port);
3663 expand_label_proto("$proto", label, len, proto);
3664 expand_label_nr("$nr", label, len);
3665 }
3666
3667 int
expand_altq(struct pf_altq * a,struct node_if * interfaces,struct node_queue * nqueues,struct node_queue_bw bwspec,struct node_queue_opt * opts)3668 expand_altq(struct pf_altq *a, struct node_if *interfaces,
3669 struct node_queue *nqueues, struct node_queue_bw bwspec,
3670 struct node_queue_opt *opts)
3671 {
3672 struct pf_altq pa, pb;
3673 char qname[PF_QNAME_SIZE];
3674 struct node_queue *n;
3675 struct node_queue_bw bw;
3676 int errs = 0;
3677
3678 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
3679 FREE_LIST(struct node_if, interfaces);
3680 FREE_LIST(struct node_queue, nqueues);
3681 return (0);
3682 }
3683
3684 LOOP_THROUGH(struct node_if, interface, interfaces,
3685 memcpy(&pa, a, sizeof(struct pf_altq));
3686 if (strlcpy(pa.ifname, interface->ifname,
3687 sizeof(pa.ifname)) >= sizeof(pa.ifname))
3688 errx(1, "expand_altq: strlcpy");
3689
3690 if (interface->not) {
3691 yyerror("altq on ! <interface> is not supported");
3692 errs++;
3693 } else {
3694 if (eval_pfaltq(pf, &pa, &bwspec, opts))
3695 errs++;
3696 else
3697 if (pfctl_add_altq(pf, &pa))
3698 errs++;
3699
3700 if (pf->opts & PF_OPT_VERBOSE) {
3701 print_altq(&pf->paltq->altq, 0,
3702 &bwspec, opts);
3703 if (nqueues && nqueues->tail) {
3704 printf("queue { ");
3705 LOOP_THROUGH(struct node_queue, queue,
3706 nqueues,
3707 printf("%s ",
3708 queue->queue);
3709 );
3710 printf("}");
3711 }
3712 printf("\n");
3713 }
3714
3715 if (pa.scheduler == ALTQT_CBQ ||
3716 pa.scheduler == ALTQT_HFSC) {
3717 /* now create a root queue */
3718 memset(&pb, 0, sizeof(struct pf_altq));
3719 if (strlcpy(qname, "root_", sizeof(qname)) >=
3720 sizeof(qname))
3721 errx(1, "expand_altq: strlcpy");
3722 if (strlcat(qname, interface->ifname,
3723 sizeof(qname)) >= sizeof(qname))
3724 errx(1, "expand_altq: strlcat");
3725 if (strlcpy(pb.qname, qname,
3726 sizeof(pb.qname)) >= sizeof(pb.qname))
3727 errx(1, "expand_altq: strlcpy");
3728 if (strlcpy(pb.ifname, interface->ifname,
3729 sizeof(pb.ifname)) >= sizeof(pb.ifname))
3730 errx(1, "expand_altq: strlcpy");
3731 pb.qlimit = pa.qlimit;
3732 pb.scheduler = pa.scheduler;
3733 bw.bw_absolute = pa.ifbandwidth;
3734 bw.bw_percent = 0;
3735 if (eval_pfqueue(pf, &pb, &bw, opts))
3736 errs++;
3737 else
3738 if (pfctl_add_altq(pf, &pb))
3739 errs++;
3740 }
3741
3742 LOOP_THROUGH(struct node_queue, queue, nqueues,
3743 n = calloc(1, sizeof(struct node_queue));
3744 if (n == NULL)
3745 err(1, "expand_altq: calloc");
3746 if (pa.scheduler == ALTQT_CBQ ||
3747 pa.scheduler == ALTQT_HFSC)
3748 if (strlcpy(n->parent, qname,
3749 sizeof(n->parent)) >=
3750 sizeof(n->parent))
3751 errx(1, "expand_altq: strlcpy");
3752 if (strlcpy(n->queue, queue->queue,
3753 sizeof(n->queue)) >= sizeof(n->queue))
3754 errx(1, "expand_altq: strlcpy");
3755 if (strlcpy(n->ifname, interface->ifname,
3756 sizeof(n->ifname)) >= sizeof(n->ifname))
3757 errx(1, "expand_altq: strlcpy");
3758 n->scheduler = pa.scheduler;
3759 n->next = NULL;
3760 n->tail = n;
3761 if (queues == NULL)
3762 queues = n;
3763 else {
3764 queues->tail->next = n;
3765 queues->tail = n;
3766 }
3767 );
3768 }
3769 );
3770 FREE_LIST(struct node_if, interfaces);
3771 FREE_LIST(struct node_queue, nqueues);
3772
3773 return (errs);
3774 }
3775
3776 int
expand_queue(struct pf_altq * a,struct node_if * interfaces,struct node_queue * nqueues,struct node_queue_bw bwspec,struct node_queue_opt * opts)3777 expand_queue(struct pf_altq *a, struct node_if *interfaces,
3778 struct node_queue *nqueues, struct node_queue_bw bwspec,
3779 struct node_queue_opt *opts)
3780 {
3781 struct node_queue *n, *nq;
3782 struct pf_altq pa;
3783 u_int8_t found = 0;
3784 u_int8_t errs = 0;
3785
3786 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
3787 FREE_LIST(struct node_queue, nqueues);
3788 return (0);
3789 }
3790
3791 if (queues == NULL) {
3792 yyerror("queue %s has no parent", a->qname);
3793 FREE_LIST(struct node_queue, nqueues);
3794 return (1);
3795 }
3796
3797 LOOP_THROUGH(struct node_if, interface, interfaces,
3798 LOOP_THROUGH(struct node_queue, tqueue, queues,
3799 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
3800 (interface->ifname[0] == 0 ||
3801 (!interface->not && !strncmp(interface->ifname,
3802 tqueue->ifname, IFNAMSIZ)) ||
3803 (interface->not && strncmp(interface->ifname,
3804 tqueue->ifname, IFNAMSIZ)))) {
3805 /* found ourself in queues */
3806 found++;
3807
3808 memcpy(&pa, a, sizeof(struct pf_altq));
3809
3810 if (pa.scheduler != ALTQT_NONE &&
3811 pa.scheduler != tqueue->scheduler) {
3812 yyerror("exactly one scheduler type "
3813 "per interface allowed");
3814 return (1);
3815 }
3816 pa.scheduler = tqueue->scheduler;
3817
3818 /* scheduler dependent error checking */
3819 switch (pa.scheduler) {
3820 case ALTQT_PRIQ:
3821 if (nqueues != NULL) {
3822 yyerror("priq queues cannot "
3823 "have child queues");
3824 return (1);
3825 }
3826 if (bwspec.bw_absolute > 0 ||
3827 bwspec.bw_percent < 100) {
3828 yyerror("priq doesn't take "
3829 "bandwidth");
3830 return (1);
3831 }
3832 break;
3833 default:
3834 break;
3835 }
3836
3837 if (strlcpy(pa.ifname, tqueue->ifname,
3838 sizeof(pa.ifname)) >= sizeof(pa.ifname))
3839 errx(1, "expand_queue: strlcpy");
3840 if (strlcpy(pa.parent, tqueue->parent,
3841 sizeof(pa.parent)) >= sizeof(pa.parent))
3842 errx(1, "expand_queue: strlcpy");
3843
3844 if (eval_pfqueue(pf, &pa, &bwspec, opts))
3845 errs++;
3846 else
3847 if (pfctl_add_altq(pf, &pa))
3848 errs++;
3849
3850 for (nq = nqueues; nq != NULL; nq = nq->next) {
3851 if (!strcmp(a->qname, nq->queue)) {
3852 yyerror("queue cannot have "
3853 "itself as child");
3854 errs++;
3855 continue;
3856 }
3857 n = calloc(1,
3858 sizeof(struct node_queue));
3859 if (n == NULL)
3860 err(1, "expand_queue: calloc");
3861 if (strlcpy(n->parent, a->qname,
3862 sizeof(n->parent)) >=
3863 sizeof(n->parent))
3864 errx(1, "expand_queue strlcpy");
3865 if (strlcpy(n->queue, nq->queue,
3866 sizeof(n->queue)) >=
3867 sizeof(n->queue))
3868 errx(1, "expand_queue strlcpy");
3869 if (strlcpy(n->ifname, tqueue->ifname,
3870 sizeof(n->ifname)) >=
3871 sizeof(n->ifname))
3872 errx(1, "expand_queue strlcpy");
3873 n->scheduler = tqueue->scheduler;
3874 n->next = NULL;
3875 n->tail = n;
3876 if (queues == NULL)
3877 queues = n;
3878 else {
3879 queues->tail->next = n;
3880 queues->tail = n;
3881 }
3882 }
3883 if ((pf->opts & PF_OPT_VERBOSE) && (
3884 (found == 1 && interface->ifname[0] == 0) ||
3885 (found > 0 && interface->ifname[0] != 0))) {
3886 print_queue(&pf->paltq->altq, 0,
3887 &bwspec, interface->ifname[0] != 0,
3888 opts);
3889 if (nqueues && nqueues->tail) {
3890 printf("{ ");
3891 LOOP_THROUGH(struct node_queue,
3892 queue, nqueues,
3893 printf("%s ",
3894 queue->queue);
3895 );
3896 printf("}");
3897 }
3898 printf("\n");
3899 }
3900 }
3901 );
3902 );
3903
3904 FREE_LIST(struct node_queue, nqueues);
3905 FREE_LIST(struct node_if, interfaces);
3906
3907 if (!found) {
3908 yyerror("queue %s has no parent", a->qname);
3909 errs++;
3910 }
3911
3912 if (errs)
3913 return (1);
3914 else
3915 return (0);
3916 }
3917
3918 void
expand_rule(struct pf_rule * r,struct node_if * interfaces,struct node_host * rpool_hosts,struct node_proto * protos,struct node_os * src_oses,struct node_host * src_hosts,struct node_port * src_ports,struct node_host * dst_hosts,struct node_port * dst_ports,struct node_uid * uids,struct node_gid * gids,struct node_icmp * icmp_types)3919 expand_rule(struct pf_rule *r,
3920 struct node_if *interfaces, struct node_host *rpool_hosts,
3921 struct node_proto *protos, struct node_os *src_oses,
3922 struct node_host *src_hosts, struct node_port *src_ports,
3923 struct node_host *dst_hosts, struct node_port *dst_ports,
3924 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types)
3925 {
3926 sa_family_t af = r->af;
3927 int added = 0, error = 0;
3928 char ifname[IF_NAMESIZE];
3929 char label[PF_RULE_LABEL_SIZE];
3930 char tagname[PF_TAG_NAME_SIZE];
3931 char match_tagname[PF_TAG_NAME_SIZE];
3932 struct pf_pooladdr *pa;
3933 struct node_host *h;
3934 u_int8_t flags, flagset, keep_state;
3935
3936 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
3937 errx(1, "expand_rule: strlcpy");
3938 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
3939 errx(1, "expand_rule: strlcpy");
3940 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
3941 sizeof(match_tagname))
3942 errx(1, "expand_rule: strlcpy");
3943 flags = r->flags;
3944 flagset = r->flagset;
3945 keep_state = r->keep_state;
3946
3947 LOOP_THROUGH(struct node_if, interface, interfaces,
3948 LOOP_THROUGH(struct node_proto, proto, protos,
3949 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
3950 LOOP_THROUGH(struct node_host, src_host, src_hosts,
3951 LOOP_THROUGH(struct node_port, src_port, src_ports,
3952 LOOP_THROUGH(struct node_os, src_os, src_oses,
3953 LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
3954 LOOP_THROUGH(struct node_port, dst_port, dst_ports,
3955 LOOP_THROUGH(struct node_uid, uid, uids,
3956 LOOP_THROUGH(struct node_gid, gid, gids,
3957
3958 r->af = af;
3959 /* for link-local IPv6 address, interface must match up */
3960 if ((r->af && src_host->af && r->af != src_host->af) ||
3961 (r->af && dst_host->af && r->af != dst_host->af) ||
3962 (src_host->af && dst_host->af &&
3963 src_host->af != dst_host->af) ||
3964 (src_host->ifindex && dst_host->ifindex &&
3965 src_host->ifindex != dst_host->ifindex) ||
3966 (src_host->ifindex && *interface->ifname &&
3967 src_host->ifindex != if_nametoindex(interface->ifname)) ||
3968 (dst_host->ifindex && *interface->ifname &&
3969 dst_host->ifindex != if_nametoindex(interface->ifname)))
3970 continue;
3971 if (!r->af && src_host->af)
3972 r->af = src_host->af;
3973 else if (!r->af && dst_host->af)
3974 r->af = dst_host->af;
3975
3976 if (*interface->ifname)
3977 memcpy(r->ifname, interface->ifname, sizeof(r->ifname));
3978 else if (if_indextoname(src_host->ifindex, ifname))
3979 memcpy(r->ifname, ifname, sizeof(r->ifname));
3980 else if (if_indextoname(dst_host->ifindex, ifname))
3981 memcpy(r->ifname, ifname, sizeof(r->ifname));
3982 else
3983 memset(r->ifname, '\0', sizeof(r->ifname));
3984
3985 if (strlcpy(r->label, label, sizeof(r->label)) >=
3986 sizeof(r->label))
3987 errx(1, "expand_rule: strlcpy");
3988 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
3989 sizeof(r->tagname))
3990 errx(1, "expand_rule: strlcpy");
3991 if (strlcpy(r->match_tagname, match_tagname,
3992 sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
3993 errx(1, "expand_rule: strlcpy");
3994 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
3995 src_host, src_port, dst_host, dst_port, proto->proto);
3996 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
3997 src_host, src_port, dst_host, dst_port, proto->proto);
3998 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
3999 r->af, src_host, src_port, dst_host, dst_port,
4000 proto->proto);
4001
4002 error += check_netmask(src_host, r->af);
4003 error += check_netmask(dst_host, r->af);
4004
4005 r->ifnot = interface->not;
4006 r->proto = proto->proto;
4007 r->src.addr = src_host->addr;
4008 r->src.not = src_host->not;
4009 r->src.port[0] = src_port->port[0];
4010 r->src.port[1] = src_port->port[1];
4011 r->src.port_op = src_port->op;
4012 r->dst.addr = dst_host->addr;
4013 r->dst.not = dst_host->not;
4014 r->dst.port[0] = dst_port->port[0];
4015 r->dst.port[1] = dst_port->port[1];
4016 r->dst.port_op = dst_port->op;
4017 r->uid.op = uid->op;
4018 r->uid.uid[0] = uid->uid[0];
4019 r->uid.uid[1] = uid->uid[1];
4020 r->gid.op = gid->op;
4021 r->gid.gid[0] = gid->gid[0];
4022 r->gid.gid[1] = gid->gid[1];
4023 r->type = icmp_type->type;
4024 r->code = icmp_type->code;
4025
4026 if ((keep_state == PF_STATE_MODULATE ||
4027 keep_state == PF_STATE_SYNPROXY) &&
4028 r->proto && r->proto != IPPROTO_TCP)
4029 r->keep_state = PF_STATE_NORMAL;
4030 else
4031 r->keep_state = keep_state;
4032
4033 if (r->proto && r->proto != IPPROTO_TCP) {
4034 r->flags = 0;
4035 r->flagset = 0;
4036 } else {
4037 r->flags = flags;
4038 r->flagset = flagset;
4039 }
4040 if (icmp_type->proto && r->proto != icmp_type->proto) {
4041 yyerror("icmp-type mismatch");
4042 error++;
4043 }
4044
4045 if (src_os && src_os->os) {
4046 r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
4047 if ((pf->opts & PF_OPT_VERBOSE2) &&
4048 r->os_fingerprint == PF_OSFP_NOMATCH)
4049 fprintf(stderr,
4050 "warning: unknown '%s' OS fingerprint\n",
4051 src_os->os);
4052 } else {
4053 r->os_fingerprint = PF_OSFP_ANY;
4054 }
4055
4056 TAILQ_INIT(&r->rpool.list);
4057 for (h = rpool_hosts; h != NULL; h = h->next) {
4058 pa = calloc(1, sizeof(struct pf_pooladdr));
4059 if (pa == NULL)
4060 err(1, "expand_rule: calloc");
4061 pa->addr = h->addr;
4062 if (h->ifname != NULL) {
4063 if (strlcpy(pa->ifname, h->ifname,
4064 sizeof(pa->ifname)) >=
4065 sizeof(pa->ifname))
4066 errx(1, "expand_rule: strlcpy");
4067 } else
4068 pa->ifname[0] = 0;
4069 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
4070 }
4071
4072 if (rule_consistent(r) < 0 || error)
4073 yyerror("skipping rule due to errors");
4074 else {
4075 r->nr = pf->rule_nr++;
4076 pfctl_add_rule(pf, r);
4077 added++;
4078 }
4079
4080 ))))))))));
4081
4082 FREE_LIST(struct node_if, interfaces);
4083 FREE_LIST(struct node_proto, protos);
4084 FREE_LIST(struct node_host, src_hosts);
4085 FREE_LIST(struct node_port, src_ports);
4086 FREE_LIST(struct node_os, src_oses);
4087 FREE_LIST(struct node_host, dst_hosts);
4088 FREE_LIST(struct node_port, dst_ports);
4089 FREE_LIST(struct node_uid, uids);
4090 FREE_LIST(struct node_gid, gids);
4091 FREE_LIST(struct node_icmp, icmp_types);
4092 FREE_LIST(struct node_host, rpool_hosts);
4093
4094 if (!added)
4095 yyerror("rule expands to no valid combination");
4096 }
4097
4098 #undef FREE_LIST
4099 #undef LOOP_THROUGH
4100
4101 int
check_rulestate(int desired_state)4102 check_rulestate(int desired_state)
4103 {
4104 if (require_order && (rulestate > desired_state)) {
4105 yyerror("Rules must be in order: options, normalization, "
4106 "queueing, translation, filtering");
4107 return (1);
4108 }
4109 rulestate = desired_state;
4110 return (0);
4111 }
4112
4113 int
kw_cmp(const void * k,const void * e)4114 kw_cmp(const void *k, const void *e)
4115 {
4116 return (strcmp(k, ((const struct keywords *)e)->k_name));
4117 }
4118
4119 int
lookup(char * s)4120 lookup(char *s)
4121 {
4122 /* this has to be sorted always */
4123 static const struct keywords keywords[] = {
4124 { "all", ALL},
4125 { "allow-opts", ALLOWOPTS},
4126 { "altq", ALTQ},
4127 { "anchor", ANCHOR},
4128 { "any", ANY},
4129 { "bandwidth", BANDWIDTH},
4130 { "binat", BINAT},
4131 { "binat-anchor", BINATANCHOR},
4132 { "bitmask", BITMASK},
4133 { "block", BLOCK},
4134 { "block-policy", BLOCKPOLICY},
4135 { "cbq", CBQ},
4136 { "code", CODE},
4137 { "crop", FRAGCROP},
4138 { "debug", DEBUG},
4139 { "drop", DROP},
4140 { "drop-ovl", FRAGDROP},
4141 { "dup-to", DUPTO},
4142 { "fastroute", FASTROUTE},
4143 { "file", FILENAME},
4144 { "fingerprints", FINGERPRINTS},
4145 { "flags", FLAGS},
4146 { "floating", FLOATING},
4147 { "for", FOR},
4148 { "fragment", FRAGMENT},
4149 { "from", FROM},
4150 { "fuck-off", FUCKOFF},
4151 { "global", GLOBAL},
4152 { "group", GROUP},
4153 { "group-bound", GRBOUND},
4154 { "hfsc", HFSC},
4155 { "hostid", HOSTID},
4156 { "icmp-type", ICMPTYPE},
4157 { "icmp6-type", ICMP6TYPE},
4158 { "if-bound", IFBOUND},
4159 { "in", IN},
4160 { "inet", INET},
4161 { "inet6", INET6},
4162 { "keep", KEEP},
4163 { "label", LABEL},
4164 { "limit", LIMIT},
4165 { "linkshare", LINKSHARE},
4166 { "load", LOAD},
4167 { "log", LOG},
4168 { "log-all", LOGALL},
4169 { "loginterface", LOGINTERFACE},
4170 { "max", MAXIMUM},
4171 { "max-mss", MAXMSS},
4172 { "max-src-nodes", MAXSRCNODES},
4173 { "max-src-states", MAXSRCSTATES},
4174 { "min-ttl", MINTTL},
4175 { "modulate", MODULATE},
4176 { "nat", NAT},
4177 { "nat-anchor", NATANCHOR},
4178 { "no", NO},
4179 { "no-df", NODF},
4180 { "no-route", NOROUTE},
4181 { "no-sync", NOSYNC},
4182 { "on", ON},
4183 { "optimization", OPTIMIZATION},
4184 { "os", OS},
4185 { "out", OUT},
4186 { "pass", PASS},
4187 { "port", PORT},
4188 { "priority", PRIORITY},
4189 { "priq", PRIQ},
4190 { "probability", PROBABILITY},
4191 { "proto", PROTO},
4192 { "qlimit", QLIMIT},
4193 { "queue", QUEUE},
4194 { "quick", QUICK},
4195 { "random", RANDOM},
4196 { "random-id", RANDOMID},
4197 { "rdr", RDR},
4198 { "rdr-anchor", RDRANCHOR},
4199 { "realtime", REALTIME},
4200 { "reassemble", REASSEMBLE},
4201 { "reply-to", REPLYTO},
4202 { "require-order", REQUIREORDER},
4203 { "return", RETURN},
4204 { "return-icmp", RETURNICMP},
4205 { "return-icmp6", RETURNICMP6},
4206 { "return-rst", RETURNRST},
4207 { "round-robin", ROUNDROBIN},
4208 { "route-to", ROUTETO},
4209 { "rule", RULE},
4210 { "scrub", SCRUB},
4211 { "set", SET},
4212 { "source-hash", SOURCEHASH},
4213 { "source-track", SOURCETRACK},
4214 { "state", STATE},
4215 { "state-policy", STATEPOLICY},
4216 { "static-port", STATICPORT},
4217 { "sticky-address", STICKYADDRESS},
4218 { "synproxy", SYNPROXY},
4219 { "table", TABLE},
4220 { "tag", TAG},
4221 { "tagged", TAGGED},
4222 { "tbrsize", TBRSIZE},
4223 { "timeout", TIMEOUT},
4224 { "to", TO},
4225 { "tos", TOS},
4226 { "ttl", TTL},
4227 { "upperlimit", UPPERLIMIT},
4228 { "user", USER},
4229 };
4230 const struct keywords *p;
4231
4232 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
4233 sizeof(keywords[0]), kw_cmp);
4234
4235 if (p) {
4236 if (debug > 1)
4237 fprintf(stderr, "%s: %d\n", s, p->k_val);
4238 return (p->k_val);
4239 } else {
4240 if (debug > 1)
4241 fprintf(stderr, "string: %s\n", s);
4242 return (STRING);
4243 }
4244 }
4245
4246 #define MAXPUSHBACK 128
4247
4248 char *parsebuf;
4249 int parseindex;
4250 char pushback_buffer[MAXPUSHBACK];
4251 int pushback_index = 0;
4252
4253 int
lgetc(FILE * f)4254 lgetc(FILE *f)
4255 {
4256 int c, next;
4257
4258 if (parsebuf) {
4259 /* Read character from the parsebuffer instead of input. */
4260 if (parseindex >= 0) {
4261 c = parsebuf[parseindex++];
4262 if (c != '\0')
4263 return (c);
4264 parsebuf = NULL;
4265 } else
4266 parseindex++;
4267 }
4268
4269 if (pushback_index)
4270 return (pushback_buffer[--pushback_index]);
4271
4272 while ((c = getc(f)) == '\\') {
4273 next = getc(f);
4274 if (next != '\n') {
4275 if (isspace(next))
4276 yyerror("whitespace after \\");
4277 ungetc(next, f);
4278 break;
4279 }
4280 yylval.lineno = lineno;
4281 lineno++;
4282 }
4283 if (c == '\t' || c == ' ') {
4284 /* Compress blanks to a single space. */
4285 do {
4286 c = getc(f);
4287 } while (c == '\t' || c == ' ');
4288 ungetc(c, f);
4289 c = ' ';
4290 }
4291
4292 return (c);
4293 }
4294
4295 int
lungetc(int c)4296 lungetc(int c)
4297 {
4298 if (c == EOF)
4299 return (EOF);
4300 if (parsebuf) {
4301 parseindex--;
4302 if (parseindex >= 0)
4303 return (c);
4304 }
4305 if (pushback_index < MAXPUSHBACK-1)
4306 return (pushback_buffer[pushback_index++] = c);
4307 else
4308 return (EOF);
4309 }
4310
4311 int
findeol(void)4312 findeol(void)
4313 {
4314 int c;
4315
4316 parsebuf = NULL;
4317 pushback_index = 0;
4318
4319 /* skip to either EOF or the first real EOL */
4320 while (1) {
4321 c = lgetc(fin);
4322 if (c == '\n') {
4323 lineno++;
4324 break;
4325 }
4326 if (c == EOF)
4327 break;
4328 }
4329 return (ERROR);
4330 }
4331
4332 int
yylex(void)4333 yylex(void)
4334 {
4335 char buf[8096];
4336 char *p, *val;
4337 int endc, c, next;
4338 int token;
4339
4340 top:
4341 p = buf;
4342 while ((c = lgetc(fin)) == ' ')
4343 ; /* nothing */
4344
4345 yylval.lineno = lineno;
4346 if (c == '#')
4347 while ((c = lgetc(fin)) != '\n' && c != EOF)
4348 ; /* nothing */
4349 if (c == '$' && parsebuf == NULL) {
4350 while (1) {
4351 if ((c = lgetc(fin)) == EOF)
4352 return (0);
4353
4354 if (p + 1 >= buf + sizeof(buf) - 1) {
4355 yyerror("string too long");
4356 return (findeol());
4357 }
4358 if (isalnum(c) || c == '_') {
4359 *p++ = (char)c;
4360 continue;
4361 }
4362 *p = '\0';
4363 lungetc(c);
4364 break;
4365 }
4366 val = symget(buf);
4367 if (val == NULL) {
4368 yyerror("macro '%s' not defined", buf);
4369 return (findeol());
4370 }
4371 parsebuf = val;
4372 parseindex = 0;
4373 goto top;
4374 }
4375
4376 switch (c) {
4377 case '\'':
4378 case '"':
4379 endc = c;
4380 while (1) {
4381 if ((c = lgetc(fin)) == EOF)
4382 return (0);
4383 if (c == endc) {
4384 *p = '\0';
4385 break;
4386 }
4387 if (c == '\n') {
4388 lineno++;
4389 continue;
4390 }
4391 if (p + 1 >= buf + sizeof(buf) - 1) {
4392 yyerror("string too long");
4393 return (findeol());
4394 }
4395 *p++ = (char)c;
4396 }
4397 yylval.v.string = strdup(buf);
4398 if (yylval.v.string == NULL)
4399 err(1, "yylex: strdup");
4400 return (STRING);
4401 case '<':
4402 next = lgetc(fin);
4403 if (next == '>') {
4404 yylval.v.i = PF_OP_XRG;
4405 return (PORTBINARY);
4406 }
4407 lungetc(next);
4408 break;
4409 case '>':
4410 next = lgetc(fin);
4411 if (next == '<') {
4412 yylval.v.i = PF_OP_IRG;
4413 return (PORTBINARY);
4414 }
4415 lungetc(next);
4416 break;
4417 case '-':
4418 next = lgetc(fin);
4419 if (next == '>')
4420 return (ARROW);
4421 lungetc(next);
4422 break;
4423 }
4424
4425 #define allowed_in_string(x) \
4426 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
4427 x != '{' && x != '}' && x != '<' && x != '>' && \
4428 x != '!' && x != '=' && x != '/' && x != '#' && \
4429 x != ','))
4430
4431 if (isalnum(c) || c == ':' || c == '_') {
4432 do {
4433 *p++ = c;
4434 if ((unsigned)(p-buf) >= sizeof(buf)) {
4435 yyerror("string too long");
4436 return (findeol());
4437 }
4438 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c)));
4439 lungetc(c);
4440 *p = '\0';
4441 if ((token = lookup(buf)) == STRING)
4442 if ((yylval.v.string = strdup(buf)) == NULL)
4443 err(1, "yylex: strdup");
4444 return (token);
4445 }
4446 if (c == '\n') {
4447 yylval.lineno = lineno;
4448 lineno++;
4449 }
4450 if (c == EOF)
4451 return (0);
4452 return (c);
4453 }
4454
4455 int
parse_rules(FILE * input,struct pfctl * xpf)4456 parse_rules(FILE *input, struct pfctl *xpf)
4457 {
4458 struct sym *sym, *next;
4459
4460 fin = input;
4461 pf = xpf;
4462 lineno = 1;
4463 errors = 0;
4464 rulestate = PFCTL_STATE_NONE;
4465 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
4466 returnicmp6default =
4467 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
4468 blockpolicy = PFRULE_DROP;
4469 require_order = 1;
4470
4471 yyparse();
4472
4473 /* Free macros and check which have not been used. */
4474 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) {
4475 next = TAILQ_NEXT(sym, entries);
4476 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
4477 fprintf(stderr, "warning: macro '%s' not "
4478 "used\n", sym->nam);
4479 free(sym->nam);
4480 free(sym->val);
4481 TAILQ_REMOVE(&symhead, sym, entries);
4482 free(sym);
4483 }
4484
4485 return (errors ? -1 : 0);
4486 }
4487
4488 /*
4489 * Over-designed efficiency is a French and German concept, so how about
4490 * we wait until they discover this ugliness and make it all fancy.
4491 */
4492 int
symset(const char * nam,const char * val,int persist)4493 symset(const char *nam, const char *val, int persist)
4494 {
4495 struct sym *sym;
4496
4497 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
4498 sym = TAILQ_NEXT(sym, entries))
4499 ; /* nothing */
4500
4501 if (sym != NULL) {
4502 if (sym->persist == 1)
4503 return (0);
4504 else {
4505 free(sym->nam);
4506 free(sym->val);
4507 TAILQ_REMOVE(&symhead, sym, entries);
4508 free(sym);
4509 }
4510 }
4511 if ((sym = calloc(1, sizeof(*sym))) == NULL)
4512 return (-1);
4513
4514 sym->nam = strdup(nam);
4515 if (sym->nam == NULL) {
4516 free(sym);
4517 return (-1);
4518 }
4519 sym->val = strdup(val);
4520 if (sym->val == NULL) {
4521 free(sym->nam);
4522 free(sym);
4523 return (-1);
4524 }
4525 sym->used = 0;
4526 sym->persist = persist;
4527 TAILQ_INSERT_TAIL(&symhead, sym, entries);
4528 return (0);
4529 }
4530
4531 int
pfctl_cmdline_symset(char * s)4532 pfctl_cmdline_symset(char *s)
4533 {
4534 char *sym, *val;
4535 int ret;
4536
4537 if ((val = strrchr(s, '=')) == NULL)
4538 return (-1);
4539
4540 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
4541 err(1, "pfctl_cmdline_symset: malloc");
4542
4543 strlcpy(sym, s, strlen(s) - strlen(val) + 1);
4544
4545 ret = symset(sym, val + 1, 1);
4546 free(sym);
4547
4548 return (ret);
4549 }
4550
4551 char *
symget(const char * nam)4552 symget(const char *nam)
4553 {
4554 struct sym *sym;
4555
4556 TAILQ_FOREACH(sym, &symhead, entries)
4557 if (strcmp(nam, sym->nam) == 0) {
4558 sym->used = 1;
4559 return (sym->val);
4560 }
4561 return (NULL);
4562 }
4563
4564 void
decide_address_family(struct node_host * n,sa_family_t * af)4565 decide_address_family(struct node_host *n, sa_family_t *af)
4566 {
4567 sa_family_t target_af = 0;
4568
4569 while (!*af && n != NULL) {
4570 if (n->af) {
4571 if (target_af == 0)
4572 target_af = n->af;
4573 if (target_af != n->af)
4574 return;
4575 }
4576 n = n->next;
4577 }
4578 if (!*af && target_af)
4579 *af = target_af;
4580 }
4581
4582 void
remove_invalid_hosts(struct node_host ** nh,sa_family_t * af)4583 remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
4584 {
4585 struct node_host *n = *nh, *prev = NULL;
4586
4587 while (n != NULL) {
4588 if (*af && n->af && n->af != *af) {
4589 /* unlink and free n */
4590 struct node_host *next = n->next;
4591
4592 /* adjust tail pointer */
4593 if (n == (*nh)->tail)
4594 (*nh)->tail = prev;
4595 /* adjust previous node's next pointer */
4596 if (prev == NULL)
4597 *nh = next;
4598 else
4599 prev->next = next;
4600 /* free node */
4601 if (n->ifname != NULL)
4602 free(n->ifname);
4603 free(n);
4604 n = next;
4605 } else {
4606 if (n->af && !*af)
4607 *af = n->af;
4608 prev = n;
4609 n = n->next;
4610 }
4611 }
4612 }
4613
4614 int
invalid_redirect(struct node_host * nh,sa_family_t af)4615 invalid_redirect(struct node_host *nh, sa_family_t af)
4616 {
4617 if (!af) {
4618 struct node_host *n;
4619
4620 /* tables and dyniftl are ok without an address family */
4621 for (n = nh; n != NULL; n = n->next) {
4622 if (n->addr.type != PF_ADDR_TABLE) {
4623 yyerror("address family not given and "
4624 "translation address expands to multiple "
4625 "address families");
4626 return (1);
4627 }
4628 }
4629 }
4630 if (nh == NULL) {
4631 yyerror("no translation address with matching address family "
4632 "found.");
4633 return (1);
4634 }
4635 return (0);
4636 }
4637
4638 int
atoul(char * s,u_long * ulvalp)4639 atoul(char *s, u_long *ulvalp)
4640 {
4641 u_long ulval;
4642 char *ep;
4643
4644 errno = 0;
4645 ulval = strtoul(s, &ep, 0);
4646 if (s[0] == '\0' || *ep != '\0')
4647 return (-1);
4648 if (errno == ERANGE && ulval == ULONG_MAX)
4649 return (-1);
4650 *ulvalp = ulval;
4651 return (0);
4652 }
4653
4654 int
getservice(char * n)4655 getservice(char *n)
4656 {
4657 struct servent *s;
4658 u_long ulval;
4659
4660 if (atoul(n, &ulval) == 0) {
4661 if (ulval > 65535) {
4662 yyerror("illegal port value %d", ulval);
4663 return (-1);
4664 }
4665 return (htons(ulval));
4666 } else {
4667 s = getservbyname(n, "tcp");
4668 if (s == NULL)
4669 s = getservbyname(n, "udp");
4670 if (s == NULL) {
4671 yyerror("unknown port %s", n);
4672 return (-1);
4673 }
4674 return (s->s_port);
4675 }
4676 }
4677
4678 int
rule_label(struct pf_rule * r,char * s)4679 rule_label(struct pf_rule *r, char *s)
4680 {
4681 if (s) {
4682 if (strlcpy(r->label, s, sizeof(r->label)) >=
4683 sizeof(r->label)) {
4684 yyerror("rule label too long (max %d chars)",
4685 sizeof(r->label)-1);
4686 return (-1);
4687 }
4688 }
4689 return (0);
4690 }
4691
4692 u_int16_t
parseicmpspec(char * w,sa_family_t af)4693 parseicmpspec(char *w, sa_family_t af)
4694 {
4695 const struct icmpcodeent *p;
4696 u_long ulval;
4697 u_int8_t icmptype;
4698
4699 if (af == AF_INET)
4700 icmptype = returnicmpdefault >> 8;
4701 else
4702 icmptype = returnicmp6default >> 8;
4703
4704 if (atoul(w, &ulval) == -1) {
4705 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
4706 yyerror("unknown icmp code %s", w);
4707 return (0);
4708 }
4709 ulval = p->code;
4710 }
4711 if (ulval > 255) {
4712 yyerror("invalid icmp code %ld", ulval);
4713 return (0);
4714 }
4715 return (icmptype << 8 | ulval);
4716 }
4717
4718 int
pfctl_load_anchors(int dev,int opts,struct pfr_buffer * trans)4719 pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans)
4720 {
4721 struct loadanchors *la;
4722
4723 TAILQ_FOREACH(la, &loadanchorshead, entries) {
4724 if (opts & PF_OPT_VERBOSE)
4725 fprintf(stderr, "\nLoading anchor %s:%s from %s\n",
4726 la->anchorname, la->rulesetname, la->filename);
4727 if (pfctl_rules(dev, la->filename, opts, la->anchorname,
4728 la->rulesetname, trans) == -1)
4729 return (-1);
4730 }
4731
4732 return (0);
4733 }
4734