1 /**	$MirOS: src/sbin/pfctl/parse.y,v 1.5 2010/09/21 21:24:19 tg Exp $ */
2 /*	$OpenBSD: parse.y,v 1.452 2004/04/24 23:22:54 cedric Exp $	*/
3 
4 /*
5  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
6  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
7  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
8  * Copyright (c) 2002, 2003, 2004, 2010 Thorsten Glaser.
9  * Copyright (c) 2002, 2003 Henning Brauer. All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 %{
32 #include <sys/types.h>
33 #include <sys/socket.h>
34 #include <net/if.h>
35 #include <netinet/in.h>
36 #include <netinet/in_systm.h>
37 #include <netinet/ip.h>
38 #include <netinet/ip_icmp.h>
39 #include <netinet/icmp6.h>
40 #include <net/pfvar.h>
41 #include <arpa/inet.h>
42 #include <altq/altq.h>
43 #include <altq/altq_cbq.h>
44 #include <altq/altq_priq.h>
45 #include <altq/altq_hfsc.h>
46 
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <netdb.h>
50 #include <stdarg.h>
51 #include <errno.h>
52 #include <string.h>
53 #include <ctype.h>
54 #include <math.h>
55 #include <err.h>
56 #include <limits.h>
57 #include <pwd.h>
58 #include <grp.h>
59 #include <md5.h>
60 
61 #include "pfctl_parser.h"
62 #include "pfctl.h"
63 
64 __RCSID("$MirOS: src/sbin/pfctl/parse.y,v 1.5 2010/09/21 21:24:19 tg Exp $");
65 
66 static struct pfctl	*pf = NULL;
67 static FILE		*fin = NULL;
68 static int		 debug = 0;
69 static int		 lineno = 1;
70 static int		 errors = 0;
71 static int		 rulestate = 0;
72 static u_int16_t	 returnicmpdefault =
73 			    (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
74 static u_int16_t	 returnicmp6default =
75 			    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
76 static int		 blockpolicy = PFRULE_DROP;
77 static int		 require_order = 1;
78 static int		 default_statelock;
79 
80 enum {
81 	PFCTL_STATE_NONE,
82 	PFCTL_STATE_OPTION,
83 	PFCTL_STATE_SCRUB,
84 	PFCTL_STATE_QUEUE,
85 	PFCTL_STATE_NAT,
86 	PFCTL_STATE_FILTER
87 };
88 
89 struct node_proto {
90 	u_int8_t		 proto;
91 	struct node_proto	*next;
92 	struct node_proto	*tail;
93 };
94 
95 struct node_port {
96 	u_int16_t		 port[2];
97 	u_int8_t		 op;
98 	struct node_port	*next;
99 	struct node_port	*tail;
100 };
101 
102 struct node_uid {
103 	uid_t			 uid[2];
104 	u_int8_t		 op;
105 	struct node_uid		*next;
106 	struct node_uid		*tail;
107 };
108 
109 struct node_gid {
110 	gid_t			 gid[2];
111 	u_int8_t		 op;
112 	struct node_gid		*next;
113 	struct node_gid		*tail;
114 };
115 
116 struct node_icmp {
117 	u_int8_t		 code;
118 	u_int8_t		 type;
119 	u_int8_t		 proto;
120 	struct node_icmp	*next;
121 	struct node_icmp	*tail;
122 };
123 
124 enum	{ PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
125 	    PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_NODES,
126 	    PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT };
127 
128 enum	{ PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
129 
130 struct node_state_opt {
131 	int			 type;
132 	union {
133 		u_int32_t	 max_states;
134 		u_int32_t	 max_src_states;
135 		u_int32_t	 max_src_nodes;
136 		u_int8_t	 src_track;
137 		u_int32_t	 statelock;
138 		struct {
139 			int		number;
140 			u_int32_t	seconds;
141 		}		 timeout;
142 	}			 data;
143 	struct node_state_opt	*next;
144 	struct node_state_opt	*tail;
145 };
146 
147 struct peer {
148 	struct node_host	*host;
149 	struct node_port	*port;
150 };
151 
152 struct node_queue {
153 	char			 queue[PF_QNAME_SIZE];
154 	char			 parent[PF_QNAME_SIZE];
155 	char			 ifname[IFNAMSIZ];
156 	int			 scheduler;
157 	struct node_queue	*next;
158 	struct node_queue	*tail;
159 }	*queues = NULL;
160 
161 struct node_qassign {
162 	char		*qname;
163 	char		*pqname;
164 };
165 
166 struct filter_opts {
167 	int			 marker;
168 #define FOM_FLAGS	0x01
169 #define FOM_ICMP	0x02
170 #define FOM_TOS		0x04
171 #define FOM_KEEP	0x08
172 #define FOM_SRCTRACK	0x10
173 	struct node_uid		*uid;
174 	struct node_gid		*gid;
175 	struct {
176 		u_int8_t	 b1;
177 		u_int8_t	 b2;
178 		u_int16_t	 w;
179 		u_int16_t	 w2;
180 	} flags;
181 	struct node_icmp	*icmpspec;
182 	u_int32_t		 tos;
183 	u_int32_t		 prob;
184 	struct {
185 		int			 action;
186 		struct node_state_opt	*options;
187 	} keep;
188 	int			 fragment;
189 	int			 allowopts;
190 	char			*label;
191 	struct node_qassign	 queues;
192 	char			*tag;
193 	char			*match_tag;
194 	u_int8_t		 match_tag_not;
195 } filter_opts;
196 
197 struct scrub_opts {
198 	int			marker;
199 #define SOM_MINTTL	0x01
200 #define SOM_MAXMSS	0x02
201 #define SOM_FRAGCACHE	0x04
202 	int			nodf;
203 	int			minttl;
204 	int			maxmss;
205 	int			fragcache;
206 	int			randomid;
207 	int			reassemble_tcp;
208 } scrub_opts;
209 
210 struct queue_opts {
211 	int			marker;
212 #define QOM_BWSPEC	0x01
213 #define QOM_SCHEDULER	0x02
214 #define QOM_PRIORITY	0x04
215 #define QOM_TBRSIZE	0x08
216 #define QOM_QLIMIT	0x10
217 	struct node_queue_bw	queue_bwspec;
218 	struct node_queue_opt	scheduler;
219 	int			priority;
220 	int			tbrsize;
221 	int			qlimit;
222 } queue_opts;
223 
224 struct table_opts {
225 	int			flags;
226 	int			init_addr;
227 	struct node_tinithead	init_nodes;
228 } table_opts;
229 
230 struct pool_opts {
231 	int			 marker;
232 #define POM_TYPE		0x01
233 #define POM_STICKYADDRESS	0x02
234 	u_int8_t		 opts;
235 	int			 type;
236 	int			 staticport;
237 	struct pf_poolhashkey	*key;
238 
239 } pool_opts;
240 
241 
242 struct node_hfsc_opts	hfsc_opts;
243 
244 int	yyerror(const char *, ...);
245 int	disallow_table(struct node_host *, const char *);
246 int	rule_consistent(struct pf_rule *);
247 int	filter_consistent(struct pf_rule *);
248 int	nat_consistent(struct pf_rule *);
249 int	rdr_consistent(struct pf_rule *);
250 int	process_tabledef(char *, struct table_opts *);
251 int	yyparse(void);
252 void	expand_label_str(char *, size_t, const char *, const char *);
253 void	expand_label_if(const char *, char *, size_t, const char *);
254 void	expand_label_addr(const char *, char *, size_t, u_int8_t,
255 	    struct node_host *);
256 void	expand_label_port(const char *, char *, size_t, struct node_port *);
257 void	expand_label_proto(const char *, char *, size_t, u_int8_t);
258 void	expand_label_nr(const char *, char *, size_t);
259 void	expand_label(char *, size_t, const char *, u_int8_t, struct node_host *,
260 	    struct node_port *, struct node_host *, struct node_port *,
261 	    u_int8_t);
262 void	expand_rule(struct pf_rule *, struct node_if *, struct node_host *,
263 	    struct node_proto *, struct node_os*, struct node_host *,
264 	    struct node_port *, struct node_host *, struct node_port *,
265 	    struct node_uid *, struct node_gid *, struct node_icmp *);
266 int	expand_altq(struct pf_altq *, struct node_if *, struct node_queue *,
267 	    struct node_queue_bw bwspec, struct node_queue_opt *);
268 int	expand_queue(struct pf_altq *, struct node_if *, struct node_queue *,
269 	    struct node_queue_bw, struct node_queue_opt *);
270 
271 int	 check_rulestate(int);
272 int	 kw_cmp(const void *, const void *);
273 int	 lookup(char *);
274 int	 lgetc(FILE *);
275 int	 lungetc(int);
276 int	 findeol(void);
277 int	 yylex(void);
278 int	 atoul(char *, u_long *);
279 int	 getservice(char *);
280 int	 rule_label(struct pf_rule *, char *);
281 
282 TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
283 struct sym {
284 	TAILQ_ENTRY(sym)	 entries;
285 	int			 used;
286 	int			 persist;
287 	char			*nam;
288 	char			*val;
289 };
290 
291 
292 int	 symset(const char *, const char *, int);
293 char	*symget(const char *);
294 
295 void	 decide_address_family(struct node_host *, sa_family_t *);
296 void	 remove_invalid_hosts(struct node_host **, sa_family_t *);
297 int	 invalid_redirect(struct node_host *, sa_family_t);
298 u_int16_t parseicmpspec(char *, sa_family_t);
299 
300 TAILQ_HEAD(loadanchorshead, loadanchors)
301     loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
302 
303 struct loadanchors {
304 	TAILQ_ENTRY(loadanchors)	 entries;
305 	char				*anchorname;
306 	char				*rulesetname;
307 	char				*filename;
308 };
309 
310 typedef struct {
311 	union {
312 		u_int32_t		 number;
313 		int			 i;
314 		char			*string;
315 		struct {
316 			u_int8_t	 b1;
317 			u_int8_t	 b2;
318 			u_int16_t	 w;
319 			u_int16_t	 w2;
320 		}			 b;
321 		struct range {
322 			int		 a;
323 			int		 b;
324 			int		 t;
325 		}			 range;
326 		struct node_if		*interface;
327 		struct node_proto	*proto;
328 		struct node_icmp	*icmp;
329 		struct node_host	*host;
330 		struct node_os		*os;
331 		struct node_port	*port;
332 		struct node_uid		*uid;
333 		struct node_gid		*gid;
334 		struct node_state_opt	*state_opt;
335 		struct peer		 peer;
336 		struct {
337 			struct peer	 src, dst;
338 			struct node_os	*src_os;
339 		}			 fromto;
340 		struct {
341 			struct node_host	*host;
342 			u_int8_t		 rt;
343 			u_int8_t		 pool_opts;
344 			sa_family_t		 af;
345 			struct pf_poolhashkey	*key;
346 		}			 route;
347 		struct redirection {
348 			struct node_host	*host;
349 			struct range		 rport;
350 		}			*redirection;
351 		struct {
352 			int			 action;
353 			struct node_state_opt	*options;
354 		}			 keep_state;
355 		struct {
356 			u_int8_t	 log;
357 			u_int8_t	 quick;
358 		}			 logquick;
359 		struct pf_poolhashkey	*hashkey;
360 		struct node_queue	*queue;
361 		struct node_queue_opt	 queue_options;
362 		struct node_queue_bw	 queue_bwspec;
363 		struct node_qassign	 qassign;
364 		struct filter_opts	 filter_opts;
365 		struct queue_opts	 queue_opts;
366 		struct scrub_opts	 scrub_opts;
367 		struct table_opts	 table_opts;
368 		struct pool_opts	 pool_opts;
369 		struct node_hfsc_opts	 hfsc_opts;
370 	} v;
371 	int lineno;
372 } YYSTYPE;
373 
374 #define PREPARE_ANCHOR_RULE(r, a)				\
375 	do {							\
376 		memset(&(r), 0, sizeof(r));			\
377 		if (strlcpy(r.anchorname, (a),			\
378 		    sizeof(r.anchorname)) >=			\
379 		    sizeof(r.anchorname)) {			\
380 			yyerror("anchor name '%s' too long",	\
381 			    (a));				\
382 			YYERROR;				\
383 		}						\
384 	} while (0)
385 
386 %}
387 
388 %token	PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS
389 %token	RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
390 %token	ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
391 %token	MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
392 %token	NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
393 %token	REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
394 %token	SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
395 %token	REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG HOSTID FUCKOFF
396 %token	ANTISPOOF FOR
397 %token	BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
398 %token	ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT
399 %token	QUEUE PRIORITY QLIMIT
400 %token	LOAD
401 %token	STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
402 %token	TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY
403 %token	<v.string>		STRING
404 %token	<v.i>			PORTBINARY
405 %type	<v.interface>		interface if_list if_item_not if_item
406 %type	<v.number>		number icmptype icmp6type uid gid
407 %type	<v.number>		tos not yesno natpass
408 %type	<v.i>			no dir log af fragcache sourcetrack
409 %type	<v.i>			unaryop statelock
410 %type	<v.b>			action nataction flags flag blockspec
411 %type	<v.range>		port rport
412 %type	<v.hashkey>		hashkey
413 %type	<v.proto>		proto proto_list proto_item
414 %type	<v.icmp>		icmpspec
415 %type	<v.icmp>		icmp_list icmp_item
416 %type	<v.icmp>		icmp6_list icmp6_item
417 %type	<v.fromto>		fromto
418 %type	<v.peer>		ipportspec from to
419 %type	<v.host>		ipspec xhost host host_list
420 %type	<v.host>		redir_host_list redirspec
421 %type	<v.host>		route_host route_host_list routespec
422 %type	<v.os>			os xos os_list
423 %type	<v.port>		portspec port_list port_item
424 %type	<v.uid>			uids uid_list uid_item
425 %type	<v.gid>			gids gid_list gid_item
426 %type	<v.route>		route
427 %type	<v.redirection>		redirection redirpool
428 %type	<v.string>		label string tag
429 %type	<v.keep_state>		keep
430 %type	<v.state_opt>		state_opt_spec state_opt_list state_opt_item
431 %type	<v.logquick>		logquick
432 %type	<v.qassign>		qname
433 %type	<v.queue>		qassign qassign_list qassign_item
434 %type	<v.queue_options>	scheduler
435 %type	<v.number>		cbqflags_list cbqflags_item
436 %type	<v.number>		priqflags_list priqflags_item
437 %type	<v.hfsc_opts>		hfscopts_list hfscopts_item hfsc_opts
438 %type	<v.queue_bwspec>	bandwidth
439 %type	<v.filter_opts>		filter_opts filter_opt filter_opts_l
440 %type	<v.queue_opts>		queue_opts queue_opt queue_opts_l
441 %type	<v.scrub_opts>		scrub_opts scrub_opt scrub_opts_l
442 %type	<v.table_opts>		table_opts table_opt table_opts_l
443 %type	<v.pool_opts>		pool_opts pool_opt pool_opts_l
444 %%
445 
446 ruleset		: /* empty */
447 		| ruleset '\n'
448 		| ruleset option '\n'
449 		| ruleset scrubrule '\n'
450 		| ruleset natrule '\n'
451 		| ruleset binatrule '\n'
452 		| ruleset pfrule '\n'
453 		| ruleset anchorrule '\n'
454 		| ruleset loadrule '\n'
455 		| ruleset altqif '\n'
456 		| ruleset queuespec '\n'
457 		| ruleset varset '\n'
458 		| ruleset tabledef '\n'
459 		| ruleset error '\n'		{ errors++; }
460 		;
461 
462 option		: SET OPTIMIZATION STRING		{
463 			if (check_rulestate(PFCTL_STATE_OPTION)) {
464 				free($3);
465 				YYERROR;
466 			}
467 			if (pfctl_set_optimization(pf, $3) != 0) {
468 				yyerror("unknown optimization %s", $3);
469 				free($3);
470 				YYERROR;
471 			}
472 			free ($3);
473 		}
474 		| SET TIMEOUT timeout_spec
475 		| SET TIMEOUT '{' timeout_list '}'
476 		| SET LIMIT limit_spec
477 		| SET LIMIT '{' limit_list '}'
478 		| SET LOGINTERFACE STRING		{
479 			if (check_rulestate(PFCTL_STATE_OPTION)) {
480 				free($3);
481 				YYERROR;
482 			}
483 			if ((ifa_exists($3, 0) == NULL) && strcmp($3, "none")) {
484 				yyerror("interface %s doesn't exist", $3);
485 				free($3);
486 				YYERROR;
487 			}
488 			if (pfctl_set_logif(pf, $3) != 0) {
489 				yyerror("error setting loginterface %s", $3);
490 				free($3);
491 				YYERROR;
492 			}
493 			free($3);
494 		}
495 		| SET HOSTID number {
496 			if ($3 == 0) {
497 				yyerror("hostid must be non-zero");
498 				YYERROR;
499 			}
500 			if (pfctl_set_hostid(pf, $3) != 0) {
501 				yyerror("error setting hostid %08x", $3);
502 				YYERROR;
503 			}
504 		}
505 		| SET BLOCKPOLICY DROP	{
506 			if (pf->opts & PF_OPT_VERBOSE)
507 				printf("set block-policy drop\n");
508 			if (check_rulestate(PFCTL_STATE_OPTION))
509 				YYERROR;
510 			blockpolicy = PFRULE_DROP;
511 		}
512 		| SET BLOCKPOLICY RETURN {
513 			if (pf->opts & PF_OPT_VERBOSE)
514 				printf("set block-policy return\n");
515 			if (check_rulestate(PFCTL_STATE_OPTION))
516 				YYERROR;
517 			blockpolicy = PFRULE_RETURN;
518 		}
519 		| SET REQUIREORDER yesno {
520 			if (pf->opts & PF_OPT_VERBOSE)
521 				printf("set require-order %s\n",
522 				    $3 == 1 ? "yes" : "no");
523 			require_order = $3;
524 		}
525 		| SET FINGERPRINTS STRING {
526 			if (pf->opts & PF_OPT_VERBOSE)
527 				printf("fingerprints %s\n", $3);
528 			if (check_rulestate(PFCTL_STATE_OPTION)) {
529 				free($3);
530 				YYERROR;
531 			}
532 			if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) {
533 				yyerror("error loading fingerprints %s", $3);
534 				free($3);
535 				YYERROR;
536 			}
537 			free($3);
538 		}
539 		| SET STATEPOLICY statelock {
540 			if (pf->opts & PF_OPT_VERBOSE)
541 				switch ($3) {
542 				case 0:
543 					printf("set state-policy floating\n");
544 					break;
545 				case PFRULE_IFBOUND:
546 					printf("set state-policy if-bound\n");
547 					break;
548 				case PFRULE_GRBOUND:
549 					printf("set state-policy "
550 					    "group-bound\n");
551 					break;
552 				}
553 			default_statelock = $3;
554 		}
555 		| SET DEBUG STRING {
556 			if (check_rulestate(PFCTL_STATE_OPTION)) {
557 				free($3);
558 				YYERROR;
559 			}
560 			if (pfctl_set_debug(pf, $3) != 0) {
561 				yyerror("error setting debuglevel %s", $3);
562 				free($3);
563 				YYERROR;
564 			}
565 			free($3);
566 		}
567 		;
568 
569 string		: string STRING				{
570 			if (asprintf(&$$, "%s %s", $1, $2) == -1)
571 				err(1, "string: asprintf");
572 			free($1);
573 			free($2);
574 		}
575 		| STRING
576 		;
577 
578 varset		: STRING '=' string		{
579 			if (pf->opts & PF_OPT_VERBOSE)
580 				printf("%s = \"%s\"\n", $1, $3);
581 			if (symset($1, $3, 0) == -1)
582 				err(1, "cannot store variable %s", $1);
583 			free($1);
584 			free($3);
585 		}
586 		;
587 
588 anchorrule	: ANCHOR string	dir interface af proto fromto filter_opts {
589 			struct pf_rule	r;
590 
591 			if (check_rulestate(PFCTL_STATE_FILTER)) {
592 				free($2);
593 				YYERROR;
594 			}
595 
596 			PREPARE_ANCHOR_RULE(r, $2);
597 			r.direction = $3;
598 			r.af = $5;
599 			r.prob = $8.prob;
600 
601 			if ($8.match_tag)
602 				if (strlcpy(r.match_tagname, $8.match_tag,
603 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
604 					yyerror("tag too long, max %u chars",
605 					    PF_TAG_NAME_SIZE - 1);
606 					YYERROR;
607 				}
608 			r.match_tag_not = $8.match_tag_not;
609 
610 			decide_address_family($7.src.host, &r.af);
611 			decide_address_family($7.dst.host, &r.af);
612 
613 			expand_rule(&r, $4, NULL, $6, $7.src_os,
614 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
615 			    0, 0, 0);
616 		}
617 		| NATANCHOR string interface af proto fromto {
618 			struct pf_rule	r;
619 
620 			if (check_rulestate(PFCTL_STATE_NAT)) {
621 				free($2);
622 				YYERROR;
623 			}
624 
625 			PREPARE_ANCHOR_RULE(r, $2);
626 			free($2);
627 			r.action = PF_NAT;
628 			r.af = $4;
629 
630 			decide_address_family($6.src.host, &r.af);
631 			decide_address_family($6.dst.host, &r.af);
632 
633 			expand_rule(&r, $3, NULL, $5, $6.src_os,
634 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
635 			    0, 0, 0);
636 		}
637 		| RDRANCHOR string interface af proto fromto {
638 			struct pf_rule	r;
639 
640 			if (check_rulestate(PFCTL_STATE_NAT)) {
641 				free($2);
642 				YYERROR;
643 			}
644 
645 			PREPARE_ANCHOR_RULE(r, $2);
646 			free($2);
647 			r.action = PF_RDR;
648 			r.af = $4;
649 
650 			decide_address_family($6.src.host, &r.af);
651 			decide_address_family($6.dst.host, &r.af);
652 
653 			if ($6.src.port != NULL) {
654 				yyerror("source port parameter not supported"
655 				    " in rdr-anchor");
656 				YYERROR;
657 			}
658 			if ($6.dst.port != NULL) {
659 				if ($6.dst.port->next != NULL) {
660 					yyerror("destination port list "
661 					    "expansion not supported in "
662 					    "rdr-anchor");
663 					YYERROR;
664 				} else if ($6.dst.port->op != PF_OP_EQ) {
665 					yyerror("destination port operators"
666 					    " not supported in rdr-anchor");
667 					YYERROR;
668 				}
669 				r.dst.port[0] = $6.dst.port->port[0];
670 				r.dst.port[1] = $6.dst.port->port[1];
671 				r.dst.port_op = $6.dst.port->op;
672 			}
673 
674 			expand_rule(&r, $3, NULL, $5, $6.src_os,
675 			    $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
676 			    0, 0, 0);
677 		}
678 		| BINATANCHOR string interface af proto fromto {
679 			struct pf_rule	r;
680 
681 			if (check_rulestate(PFCTL_STATE_NAT)) {
682 				free($2);
683 				YYERROR;
684 			}
685 
686 			PREPARE_ANCHOR_RULE(r, $2);
687 			free($2);
688 			r.action = PF_BINAT;
689 			r.af = $4;
690 			if ($5 != NULL) {
691 				if ($5->next != NULL) {
692 					yyerror("proto list expansion"
693 					    " not supported in binat-anchor");
694 					YYERROR;
695 				}
696 				r.proto = $5->proto;
697 				free($5);
698 			}
699 
700 			if ($6.src.host != NULL || $6.src.port != NULL ||
701 			    $6.dst.host != NULL || $6.dst.port != NULL) {
702 				yyerror("fromto parameter not supported"
703 				    " in binat-anchor");
704 				YYERROR;
705 			}
706 
707 			decide_address_family($6.src.host, &r.af);
708 			decide_address_family($6.dst.host, &r.af);
709 
710 			pfctl_add_rule(pf, &r);
711 		}
712 		;
713 
714 loadrule	: LOAD ANCHOR string FROM string	{
715 			char			*t;
716 			struct loadanchors	*loadanchor;
717 
718 			t = strsep(&$3, ":");
719 			if (*t == '\0' || $3 == NULL || *$3 == '\0') {
720 				yyerror("anchor '%s' invalid\n", $3);
721 				free(t);
722 				YYERROR;
723 			}
724 			if (strlen(t) >= PF_ANCHOR_NAME_SIZE) {
725 				yyerror("anchorname %s too long, max %u\n",
726 				    t, PF_ANCHOR_NAME_SIZE - 1);
727 				free(t);
728 				YYERROR;
729 			}
730 			if (strlen($3) >= PF_RULESET_NAME_SIZE) {
731 				yyerror("rulesetname %s too long, max %u\n",
732 				    $3, PF_RULESET_NAME_SIZE - 1);
733 				free(t);
734 				YYERROR;
735 			}
736 
737 			loadanchor = calloc(1, sizeof(struct loadanchors));
738 			if (loadanchor == NULL)
739 				err(1, "loadrule: calloc");
740 			if ((loadanchor->anchorname = strdup(t)) == NULL)
741 				err(1, "loadrule: strdup");
742 			if ((loadanchor->rulesetname = strdup($3)) == NULL)
743 				err(1, "loadrule: strdup");
744 			if ((loadanchor->filename = strdup($5)) == NULL)
745 				err(1, "loadrule: strdup");
746 
747 			TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
748 			    entries);
749 
750 			free(t); /* not $3 */
751 			free($5);
752 		};
753 
754 scrubrule	: SCRUB dir logquick interface af proto fromto scrub_opts
755 		{
756 			struct pf_rule	r;
757 
758 			if (check_rulestate(PFCTL_STATE_SCRUB))
759 				YYERROR;
760 
761 			memset(&r, 0, sizeof(r));
762 
763 			r.action = PF_SCRUB;
764 			r.direction = $2;
765 
766 			r.log = $3.log;
767 			if ($3.quick) {
768 				yyerror("scrub rules do not support 'quick'");
769 				YYERROR;
770 			}
771 
772 			r.af = $5;
773 			if ($8.nodf)
774 				r.rule_flag |= PFRULE_NODF;
775 			if ($8.randomid)
776 				r.rule_flag |= PFRULE_RANDOMID;
777 			if ($8.reassemble_tcp) {
778 				if (r.direction != PF_INOUT) {
779 					yyerror("reassemble tcp rules can not "
780 					    "specify direction");
781 					YYERROR;
782 				}
783 				r.rule_flag |= PFRULE_REASSEMBLE_TCP;
784 			}
785 			if ($8.minttl)
786 				r.min_ttl = $8.minttl;
787 			if ($8.maxmss)
788 				r.max_mss = $8.maxmss;
789 			if ($8.fragcache)
790 				r.rule_flag |= $8.fragcache;
791 
792 			expand_rule(&r, $4, NULL, $6, $7.src_os,
793 			    $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
794 			    NULL, NULL, NULL);
795 		}
796 		;
797 
798 scrub_opts	:	{
799 			bzero(&scrub_opts, sizeof scrub_opts);
800 		}
801 		    scrub_opts_l
802 			{ $$ = scrub_opts; }
803 		| /* empty */ {
804 			bzero(&scrub_opts, sizeof scrub_opts);
805 			$$ = scrub_opts;
806 		}
807 		;
808 
809 scrub_opts_l	: scrub_opts_l scrub_opt
810 		| scrub_opt
811 		;
812 
813 scrub_opt	: NODF	{
814 			if (scrub_opts.nodf) {
815 				yyerror("no-df cannot be respecified");
816 				YYERROR;
817 			}
818 			scrub_opts.nodf = 1;
819 		}
820 		| MINTTL number {
821 			if (scrub_opts.marker & SOM_MINTTL) {
822 				yyerror("min-ttl cannot be respecified");
823 				YYERROR;
824 			}
825 			if ($2 > 255) {
826 				yyerror("illegal min-ttl value %d", $2);
827 				YYERROR;
828 			}
829 			scrub_opts.marker |= SOM_MINTTL;
830 			scrub_opts.minttl = $2;
831 		}
832 		| MAXMSS number {
833 			if (scrub_opts.marker & SOM_MAXMSS) {
834 				yyerror("max-mss cannot be respecified");
835 				YYERROR;
836 			}
837 			if ($2 > 65535) {
838 				yyerror("illegal max-mss value %d", $2);
839 				YYERROR;
840 			}
841 			scrub_opts.marker |= SOM_MAXMSS;
842 			scrub_opts.maxmss = $2;
843 		}
844 		| fragcache {
845 			if (scrub_opts.marker & SOM_FRAGCACHE) {
846 				yyerror("fragcache cannot be respecified");
847 				YYERROR;
848 			}
849 			scrub_opts.marker |= SOM_FRAGCACHE;
850 			scrub_opts.fragcache = $1;
851 		}
852 		| REASSEMBLE STRING {
853 			if (strcasecmp($2, "tcp") != 0) {
854 				free($2);
855 				YYERROR;
856 			}
857 			free($2);
858 			if (scrub_opts.reassemble_tcp) {
859 				yyerror("reassemble tcp cannot be respecified");
860 				YYERROR;
861 			}
862 			scrub_opts.reassemble_tcp = 1;
863 		}
864 		| RANDOMID {
865 			if (scrub_opts.randomid) {
866 				yyerror("random-id cannot be respecified");
867 				YYERROR;
868 			}
869 			scrub_opts.randomid = 1;
870 		}
871 		;
872 
873 fragcache	: FRAGMENT REASSEMBLE	{ $$ = 0; /* default */ }
874 		| FRAGMENT FRAGCROP	{ $$ = PFRULE_FRAGCROP; }
875 		| FRAGMENT FRAGDROP	{ $$ = PFRULE_FRAGDROP; }
876 		;
877 
878 not		: '!'		{ $$ = 1; }
879 		| /* empty */	{ $$ = 0; }
880 		;
881 
882 tabledef	: TABLE '<' STRING '>' table_opts {
883 			struct node_host	 *h, *nh;
884 			struct node_tinit	 *ti, *nti;
885 
886 			if (strlen($3) >= PF_TABLE_NAME_SIZE) {
887 				yyerror("table name too long, max %d chars",
888 				    PF_TABLE_NAME_SIZE - 1);
889 				free($3);
890 				YYERROR;
891 			}
892 			if (pf->loadopt & PFCTL_FLAG_TABLE)
893 				if (process_tabledef($3, &$5)) {
894 					free($3);
895 					YYERROR;
896 				}
897 			free($3);
898 			for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
899 			    ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
900 				if (ti->file)
901 					free(ti->file);
902 				for (h = ti->host; h != NULL; h = nh) {
903 					nh = h->next;
904 					free(h);
905 				}
906 				nti = SIMPLEQ_NEXT(ti, entries);
907 				free(ti);
908 			}
909 		}
910 		;
911 
912 table_opts	:	{
913 			bzero(&table_opts, sizeof table_opts);
914 			SIMPLEQ_INIT(&table_opts.init_nodes);
915 		}
916 		    table_opts_l
917 			{ $$ = table_opts; }
918 		| /* empty */
919 			{
920 			bzero(&table_opts, sizeof table_opts);
921 			SIMPLEQ_INIT(&table_opts.init_nodes);
922 			$$ = table_opts;
923 		}
924 		;
925 
926 table_opts_l	: table_opts_l table_opt
927 		| table_opt
928 		;
929 
930 table_opt	: STRING		{
931 			if (!strcmp($1, "const"))
932 				table_opts.flags |= PFR_TFLAG_CONST;
933 			else if (!strcmp($1, "persist"))
934 				table_opts.flags |= PFR_TFLAG_PERSIST;
935 			else {
936 				free($1);
937 				YYERROR;
938 			}
939 			free($1);
940 		}
941 		| '{' '}'		{ table_opts.init_addr = 1; }
942 		| '{' host_list '}'	{
943 			struct node_host	*n;
944 			struct node_tinit	*ti;
945 
946 			for (n = $2; n != NULL; n = n->next) {
947 				switch (n->addr.type) {
948 				case PF_ADDR_ADDRMASK:
949 					continue; /* ok */
950 				case PF_ADDR_TABLE:
951 					yyerror("tables cannot contain tables");
952 					break;
953 				case PF_ADDR_NOROUTE:
954 					yyerror("\"no-route\" is not permitted "
955 					    "inside tables");
956 					break;
957 				default:
958 					yyerror("unknown address type %d",
959 					    n->addr.type);
960 				}
961 				YYERROR;
962 			}
963 			if (!(ti = calloc(1, sizeof(*ti))))
964 				err(1, "table_opt: calloc");
965 			ti->host = $2;
966 			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
967 			    entries);
968 			table_opts.init_addr = 1;
969 		}
970 		| FILENAME STRING	{
971 			struct node_tinit	*ti;
972 
973 			if (!(ti = calloc(1, sizeof(*ti))))
974 				err(1, "table_opt: calloc");
975 			ti->file = $2;
976 			SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
977 			    entries);
978 			table_opts.init_addr = 1;
979 		}
980 		;
981 
982 altqif		: ALTQ interface queue_opts QUEUE qassign {
983 			struct pf_altq	a;
984 
985 			if (check_rulestate(PFCTL_STATE_QUEUE))
986 				YYERROR;
987 
988 			memset(&a, 0, sizeof(a));
989 			if ($3.scheduler.qtype == ALTQT_NONE) {
990 				yyerror("no scheduler specified!");
991 				YYERROR;
992 			}
993 			a.scheduler = $3.scheduler.qtype;
994 			a.qlimit = $3.qlimit;
995 			a.tbrsize = $3.tbrsize;
996 			if ($5 == NULL) {
997 				yyerror("no child queues specified");
998 				YYERROR;
999 			}
1000 			if (expand_altq(&a, $2, $5, $3.queue_bwspec,
1001 			    &$3.scheduler))
1002 				YYERROR;
1003 		}
1004 		;
1005 
1006 queuespec	: QUEUE STRING interface queue_opts qassign {
1007 			struct pf_altq	a;
1008 
1009 			if (check_rulestate(PFCTL_STATE_QUEUE)) {
1010 				free($2);
1011 				YYERROR;
1012 			}
1013 
1014 			memset(&a, 0, sizeof(a));
1015 
1016 			if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
1017 			    sizeof(a.qname)) {
1018 				yyerror("queue name too long (max "
1019 				    "%d chars)", PF_QNAME_SIZE-1);
1020 				free($2);
1021 				YYERROR;
1022 			}
1023 			free($2);
1024 			if ($4.tbrsize) {
1025 				yyerror("cannot specify tbrsize for queue");
1026 				YYERROR;
1027 			}
1028 			if ($4.priority > 255) {
1029 				yyerror("priority out of range: max 255");
1030 				YYERROR;
1031 			}
1032 			a.priority = $4.priority;
1033 			a.qlimit = $4.qlimit;
1034 			a.scheduler = $4.scheduler.qtype;
1035 			if (expand_queue(&a, $3, $5, $4.queue_bwspec,
1036 			    &$4.scheduler)) {
1037 				yyerror("errors in queue definition");
1038 				YYERROR;
1039 			}
1040 		}
1041 		;
1042 
1043 queue_opts	:	{
1044 			bzero(&queue_opts, sizeof queue_opts);
1045 			queue_opts.priority = DEFAULT_PRIORITY;
1046 			queue_opts.qlimit = DEFAULT_QLIMIT;
1047 			queue_opts.scheduler.qtype = ALTQT_NONE;
1048 			queue_opts.queue_bwspec.bw_percent = 100;
1049 		}
1050 		    queue_opts_l
1051 			{ $$ = queue_opts; }
1052 		| /* empty */ {
1053 			bzero(&queue_opts, sizeof queue_opts);
1054 			queue_opts.priority = DEFAULT_PRIORITY;
1055 			queue_opts.qlimit = DEFAULT_QLIMIT;
1056 			queue_opts.scheduler.qtype = ALTQT_NONE;
1057 			queue_opts.queue_bwspec.bw_percent = 100;
1058 			$$ = queue_opts;
1059 		}
1060 		;
1061 
1062 queue_opts_l	: queue_opts_l queue_opt
1063 		| queue_opt
1064 		;
1065 
1066 queue_opt	: BANDWIDTH bandwidth	{
1067 			if (queue_opts.marker & QOM_BWSPEC) {
1068 				yyerror("bandwidth cannot be respecified");
1069 				YYERROR;
1070 			}
1071 			queue_opts.marker |= QOM_BWSPEC;
1072 			queue_opts.queue_bwspec = $2;
1073 		}
1074 		| PRIORITY number	{
1075 			if (queue_opts.marker & QOM_PRIORITY) {
1076 				yyerror("priority cannot be respecified");
1077 				YYERROR;
1078 			}
1079 			if ($2 > 255) {
1080 				yyerror("priority out of range: max 255");
1081 				YYERROR;
1082 			}
1083 			queue_opts.marker |= QOM_PRIORITY;
1084 			queue_opts.priority = $2;
1085 		}
1086 		| QLIMIT number	{
1087 			if (queue_opts.marker & QOM_QLIMIT) {
1088 				yyerror("qlimit cannot be respecified");
1089 				YYERROR;
1090 			}
1091 			if ($2 > 65535) {
1092 				yyerror("qlimit out of range: max 65535");
1093 				YYERROR;
1094 			}
1095 			queue_opts.marker |= QOM_QLIMIT;
1096 			queue_opts.qlimit = $2;
1097 		}
1098 		| scheduler	{
1099 			if (queue_opts.marker & QOM_SCHEDULER) {
1100 				yyerror("scheduler cannot be respecified");
1101 				YYERROR;
1102 			}
1103 			queue_opts.marker |= QOM_SCHEDULER;
1104 			queue_opts.scheduler = $1;
1105 		}
1106 		| TBRSIZE number	{
1107 			if (queue_opts.marker & QOM_TBRSIZE) {
1108 				yyerror("tbrsize cannot be respecified");
1109 				YYERROR;
1110 			}
1111 			if ($2 > 65535) {
1112 				yyerror("tbrsize too big: max 65535");
1113 				YYERROR;
1114 			}
1115 			queue_opts.marker |= QOM_TBRSIZE;
1116 			queue_opts.tbrsize = $2;
1117 		}
1118 		;
1119 
1120 bandwidth	: STRING {
1121 			double	 bps;
1122 			char	*cp;
1123 
1124 			$$.bw_percent = 0;
1125 
1126 			bps = strtod($1, &cp);
1127 			if (cp != NULL) {
1128 				if (!strcmp(cp, "b"))
1129 					; /* nothing */
1130 				else if (!strcmp(cp, "Kib"))
1131 					bps *= 1024;
1132 				else if (!strcmp(cp, "Mib"))
1133 					bps *= 1024 * 1024;
1134 				else if (!strcmp(cp, "Gib"))
1135 					bps *= 1024 * 1024 * 1024;
1136 				else if (!strcmp(cp, "%")) {
1137 					if (bps < 0 || bps > 100) {
1138 						yyerror("bandwidth spec "
1139 						    "out of range");
1140 						free($1);
1141 						YYERROR;
1142 					}
1143 					$$.bw_percent = bps;
1144 					bps = 0;
1145 				} else {
1146 					yyerror("unknown unit %s", cp);
1147 					free($1);
1148 					YYERROR;
1149 				}
1150 			}
1151 			free($1);
1152 			$$.bw_absolute = (u_int32_t)bps;
1153 		}
1154 		;
1155 
1156 scheduler	: CBQ				{
1157 			$$.qtype = ALTQT_CBQ;
1158 			$$.data.cbq_opts.flags = 0;
1159 		}
1160 		| CBQ '(' cbqflags_list ')'	{
1161 			$$.qtype = ALTQT_CBQ;
1162 			$$.data.cbq_opts.flags = $3;
1163 		}
1164 		| PRIQ				{
1165 			$$.qtype = ALTQT_PRIQ;
1166 			$$.data.priq_opts.flags = 0;
1167 		}
1168 		| PRIQ '(' priqflags_list ')'	{
1169 			$$.qtype = ALTQT_PRIQ;
1170 			$$.data.priq_opts.flags = $3;
1171 		}
1172 		| HFSC				{
1173 			$$.qtype = ALTQT_HFSC;
1174 			bzero(&$$.data.hfsc_opts,
1175 			    sizeof(struct node_hfsc_opts));
1176 		}
1177 		| HFSC '(' hfsc_opts ')'	{
1178 			$$.qtype = ALTQT_HFSC;
1179 			$$.data.hfsc_opts = $3;
1180 		}
1181 		;
1182 
1183 cbqflags_list	: cbqflags_item				{ $$ |= $1; }
1184 		| cbqflags_list comma cbqflags_item	{ $$ |= $3; }
1185 		;
1186 
1187 cbqflags_item	: STRING	{
1188 			if (!strcmp($1, "default"))
1189 				$$ = CBQCLF_DEFCLASS;
1190 			else if (!strcmp($1, "borrow"))
1191 				$$ = CBQCLF_BORROW;
1192 			else if (!strcmp($1, "red"))
1193 				$$ = CBQCLF_RED;
1194 			else if (!strcmp($1, "ecn"))
1195 				$$ = CBQCLF_RED|CBQCLF_ECN;
1196 			else if (!strcmp($1, "rio"))
1197 				$$ = CBQCLF_RIO;
1198 			else {
1199 				yyerror("unknown cbq flag \"%s\"", $1);
1200 				free($1);
1201 				YYERROR;
1202 			}
1203 			free($1);
1204 		}
1205 		;
1206 
1207 priqflags_list	: priqflags_item			{ $$ |= $1; }
1208 		| priqflags_list comma priqflags_item	{ $$ |= $3; }
1209 		;
1210 
1211 priqflags_item	: STRING	{
1212 			if (!strcmp($1, "default"))
1213 				$$ = PRCF_DEFAULTCLASS;
1214 			else if (!strcmp($1, "red"))
1215 				$$ = PRCF_RED;
1216 			else if (!strcmp($1, "ecn"))
1217 				$$ = PRCF_RED|PRCF_ECN;
1218 			else if (!strcmp($1, "rio"))
1219 				$$ = PRCF_RIO;
1220 			else {
1221 				yyerror("unknown priq flag \"%s\"", $1);
1222 				free($1);
1223 				YYERROR;
1224 			}
1225 			free($1);
1226 		}
1227 		;
1228 
1229 hfsc_opts	:	{
1230 				bzero(&hfsc_opts,
1231 				    sizeof(struct node_hfsc_opts));
1232 			}
1233 		    hfscopts_list				{
1234 			$$ = hfsc_opts;
1235 		}
1236 		;
1237 
1238 hfscopts_list	: hfscopts_item
1239 		| hfscopts_list comma hfscopts_item
1240 		;
1241 
1242 hfscopts_item	: LINKSHARE bandwidth				{
1243 			if (hfsc_opts.linkshare.used) {
1244 				yyerror("linkshare already specified");
1245 				YYERROR;
1246 			}
1247 			hfsc_opts.linkshare.m2 = $2;
1248 			hfsc_opts.linkshare.used = 1;
1249 		}
1250 		| LINKSHARE '(' bandwidth number bandwidth ')'	{
1251 			if (hfsc_opts.linkshare.used) {
1252 				yyerror("linkshare already specified");
1253 				YYERROR;
1254 			}
1255 			hfsc_opts.linkshare.m1 = $3;
1256 			hfsc_opts.linkshare.d = $4;
1257 			hfsc_opts.linkshare.m2 = $5;
1258 			hfsc_opts.linkshare.used = 1;
1259 		}
1260 		| REALTIME bandwidth				{
1261 			if (hfsc_opts.realtime.used) {
1262 				yyerror("realtime already specified");
1263 				YYERROR;
1264 			}
1265 			hfsc_opts.realtime.m2 = $2;
1266 			hfsc_opts.realtime.used = 1;
1267 		}
1268 		| REALTIME '(' bandwidth number bandwidth ')'	{
1269 			if (hfsc_opts.realtime.used) {
1270 				yyerror("realtime already specified");
1271 				YYERROR;
1272 			}
1273 			hfsc_opts.realtime.m1 = $3;
1274 			hfsc_opts.realtime.d = $4;
1275 			hfsc_opts.realtime.m2 = $5;
1276 			hfsc_opts.realtime.used = 1;
1277 		}
1278 		| UPPERLIMIT bandwidth				{
1279 			if (hfsc_opts.upperlimit.used) {
1280 				yyerror("upperlimit already specified");
1281 				YYERROR;
1282 			}
1283 			hfsc_opts.upperlimit.m2 = $2;
1284 			hfsc_opts.upperlimit.used = 1;
1285 		}
1286 		| UPPERLIMIT '(' bandwidth number bandwidth ')'	{
1287 			if (hfsc_opts.upperlimit.used) {
1288 				yyerror("upperlimit already specified");
1289 				YYERROR;
1290 			}
1291 			hfsc_opts.upperlimit.m1 = $3;
1292 			hfsc_opts.upperlimit.d = $4;
1293 			hfsc_opts.upperlimit.m2 = $5;
1294 			hfsc_opts.upperlimit.used = 1;
1295 		}
1296 		| STRING	{
1297 			if (!strcmp($1, "default"))
1298 				hfsc_opts.flags |= HFCF_DEFAULTCLASS;
1299 			else if (!strcmp($1, "red"))
1300 				hfsc_opts.flags |= HFCF_RED;
1301 			else if (!strcmp($1, "ecn"))
1302 				hfsc_opts.flags |= HFCF_RED|HFCF_ECN;
1303 			else if (!strcmp($1, "rio"))
1304 				hfsc_opts.flags |= HFCF_RIO;
1305 			else {
1306 				yyerror("unknown hfsc flag \"%s\"", $1);
1307 				free($1);
1308 				YYERROR;
1309 			}
1310 			free($1);
1311 		}
1312 		;
1313 
1314 qassign		: /* empty */		{ $$ = NULL; }
1315 		| qassign_item		{ $$ = $1; }
1316 		| '{' qassign_list '}'	{ $$ = $2; }
1317 		;
1318 
1319 qassign_list	: qassign_item			{ $$ = $1; }
1320 		| qassign_list comma qassign_item	{
1321 			$1->tail->next = $3;
1322 			$1->tail = $3;
1323 			$$ = $1;
1324 		}
1325 		;
1326 
1327 qassign_item	: STRING			{
1328 			$$ = calloc(1, sizeof(struct node_queue));
1329 			if ($$ == NULL)
1330 				err(1, "qassign_item: calloc");
1331 			if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
1332 			    sizeof($$->queue)) {
1333 				yyerror("queue name '%s' too long (max "
1334 				    "%d chars)", $1, sizeof($$->queue)-1);
1335 				free($1);
1336 				free($$);
1337 				YYERROR;
1338 			}
1339 			free($1);
1340 			$$->next = NULL;
1341 			$$->tail = $$;
1342 		}
1343 		;
1344 
1345 pfrule		: action dir logquick interface route af proto fromto
1346 		    filter_opts
1347 		{
1348 			struct pf_rule		 r;
1349 			struct node_state_opt	*o;
1350 			struct node_proto	*proto;
1351 			int			 srctrack = 0;
1352 			int			 statelock = 0;
1353 
1354 			if (check_rulestate(PFCTL_STATE_FILTER))
1355 				YYERROR;
1356 
1357 			memset(&r, 0, sizeof(r));
1358 
1359 			r.action = $1.b1;
1360 			switch ($1.b2) {
1361 			case PFRULE_RETURNRST:
1362 				r.rule_flag |= PFRULE_RETURNRST;
1363 				r.return_ttl = $1.w;
1364 				break;
1365 			case PFRULE_RETURNICMP:
1366 				r.rule_flag |= PFRULE_RETURNICMP;
1367 				r.return_icmp = $1.w;
1368 				r.return_icmp6 = $1.w2;
1369 				break;
1370 			case PFRULE_RETURN:
1371 				r.rule_flag |= PFRULE_RETURN;
1372 				r.return_icmp = $1.w;
1373 				r.return_icmp6 = $1.w2;
1374 				break;
1375 			}
1376 			r.direction = $2;
1377 			r.log = $3.log;
1378 			r.quick = $3.quick;
1379 			r.prob = $9.prob;
1380 
1381 			r.af = $6;
1382 			if ($9.tag)
1383 				if (strlcpy(r.tagname, $9.tag,
1384 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1385 					yyerror("tag too long, max %u chars",
1386 					    PF_TAG_NAME_SIZE - 1);
1387 					YYERROR;
1388 				}
1389 			if ($9.match_tag)
1390 				if (strlcpy(r.match_tagname, $9.match_tag,
1391 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1392 					yyerror("tag too long, max %u chars",
1393 					    PF_TAG_NAME_SIZE - 1);
1394 					YYERROR;
1395 				}
1396 			r.match_tag_not = $9.match_tag_not;
1397 			r.flags = $9.flags.b1;
1398 			r.flagset = $9.flags.b2;
1399 			if (rule_label(&r, $9.label))
1400 				YYERROR;
1401 			free($9.label);
1402 			if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
1403 				for (proto = $7; proto != NULL &&
1404 				    proto->proto != IPPROTO_TCP;
1405 				    proto = proto->next)
1406 					;	/* nothing */
1407 				if (proto == NULL && $7 != NULL) {
1408 					if ($9.flags.b1 || $9.flags.b2)
1409 						yyerror(
1410 						    "flags only apply to tcp");
1411 					if ($8.src_os)
1412 						yyerror(
1413 						    "OS fingerprinting only "
1414 						    "apply to tcp");
1415 					YYERROR;
1416 				}
1417 #if 0
1418 				if (($9.flags.b1 & parse_flags("S")) == 0 &&
1419 				    $8.src_os) {
1420 					yyerror("OS fingerprinting requires "
1421 					    "the SYN TCP flag (flags S/SA)");
1422 					YYERROR;
1423 				}
1424 #endif
1425 			}
1426 
1427 			r.tos = $9.tos;
1428 			r.keep_state = $9.keep.action;
1429 			o = $9.keep.options;
1430 			while (o) {
1431 				struct node_state_opt	*p = o;
1432 
1433 				switch (o->type) {
1434 				case PF_STATE_OPT_MAX:
1435 					if (r.max_states) {
1436 						yyerror("state option 'max' "
1437 						    "multiple definitions");
1438 						YYERROR;
1439 					}
1440 					r.max_states = o->data.max_states;
1441 					break;
1442 				case PF_STATE_OPT_NOSYNC:
1443 					if (r.rule_flag & PFRULE_NOSYNC) {
1444 						yyerror("state option 'sync' "
1445 						    "multiple definitions");
1446 						YYERROR;
1447 					}
1448 					r.rule_flag |= PFRULE_NOSYNC;
1449 					break;
1450 				case PF_STATE_OPT_SRCTRACK:
1451 					if (srctrack) {
1452 						yyerror("state option "
1453 						    "'source-track' "
1454 						    "multiple definitions");
1455 						YYERROR;
1456 					}
1457 					srctrack =  o->data.src_track;
1458 					break;
1459 				case PF_STATE_OPT_MAX_SRC_STATES:
1460 					if (r.max_src_states) {
1461 						yyerror("state option "
1462 						    "'max-src-states' "
1463 						    "multiple definitions");
1464 						YYERROR;
1465 					}
1466 					if (o->data.max_src_nodes == 0) {
1467 						yyerror("'max-src-states' must "
1468 						    "be > 0");
1469 						YYERROR;
1470 					}
1471 					r.max_src_states =
1472 					    o->data.max_src_states;
1473 					r.rule_flag |= PFRULE_SRCTRACK;
1474 					break;
1475 				case PF_STATE_OPT_MAX_SRC_NODES:
1476 					if (r.max_src_nodes) {
1477 						yyerror("state option "
1478 						    "'max-src-nodes' "
1479 						    "multiple definitions");
1480 						YYERROR;
1481 					}
1482 					if (o->data.max_src_nodes == 0) {
1483 						yyerror("'max-src-nodes' must "
1484 						    "be > 0");
1485 						YYERROR;
1486 					}
1487 					r.max_src_nodes =
1488 					    o->data.max_src_nodes;
1489 					r.rule_flag |= PFRULE_SRCTRACK |
1490 					    PFRULE_RULESRCTRACK;
1491 					break;
1492 				case PF_STATE_OPT_STATELOCK:
1493 					if (statelock) {
1494 						yyerror("state locking option: "
1495 						    "multiple definitions");
1496 						YYERROR;
1497 					}
1498 					statelock = 1;
1499 					r.rule_flag |= o->data.statelock;
1500 					break;
1501 				case PF_STATE_OPT_TIMEOUT:
1502 					if (r.timeout[o->data.timeout.number]) {
1503 						yyerror("state timeout %s "
1504 						    "multiple definitions",
1505 						    pf_timeouts[o->data.
1506 						    timeout.number].name);
1507 						YYERROR;
1508 					}
1509 					r.timeout[o->data.timeout.number] =
1510 					    o->data.timeout.seconds;
1511 				}
1512 				o = o->next;
1513 				free(p);
1514 			}
1515 			if (srctrack) {
1516 				if (srctrack == PF_SRCTRACK_GLOBAL &&
1517 				    r.max_src_nodes) {
1518 					yyerror("'max-src-nodes' is "
1519 					    "incompatible with "
1520 					    "'source-track global'");
1521 					YYERROR;
1522 				}
1523 				r.rule_flag |= PFRULE_SRCTRACK;
1524 				if (srctrack == PF_SRCTRACK_RULE)
1525 					r.rule_flag |= PFRULE_RULESRCTRACK;
1526 			}
1527 			if (r.keep_state && !statelock)
1528 				r.rule_flag |= default_statelock;
1529 
1530 			if ($9.fragment)
1531 				r.rule_flag |= PFRULE_FRAGMENT;
1532 			r.allow_opts = $9.allowopts;
1533 
1534 			decide_address_family($8.src.host, &r.af);
1535 			decide_address_family($8.dst.host, &r.af);
1536 
1537 			if ($5.rt) {
1538 				if (!r.direction) {
1539 					yyerror("direction must be explicit "
1540 					    "with rules that specify routing");
1541 					YYERROR;
1542 				}
1543 				r.rt = $5.rt;
1544 				r.rpool.opts = $5.pool_opts;
1545 				if ($5.key != NULL)
1546 					memcpy(&r.rpool.key, $5.key,
1547 					    sizeof(struct pf_poolhashkey));
1548 			}
1549 			if (r.rt && r.rt != PF_FASTROUTE) {
1550 				decide_address_family($5.host, &r.af);
1551 				remove_invalid_hosts(&$5.host, &r.af);
1552 				if ($5.host == NULL) {
1553 					yyerror("no routing address with "
1554 					    "matching address family found.");
1555 					YYERROR;
1556 				}
1557 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
1558 				    PF_POOL_NONE && ($5.host->next != NULL ||
1559 				    $5.host->addr.type == PF_ADDR_TABLE))
1560 					r.rpool.opts |= PF_POOL_ROUNDROBIN;
1561 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1562 				    PF_POOL_ROUNDROBIN &&
1563 				    disallow_table($5.host, "tables are only "
1564 				    "supported in round-robin routing pools"))
1565 					YYERROR;
1566 				if ($5.host->next != NULL) {
1567 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1568 					    PF_POOL_ROUNDROBIN) {
1569 						yyerror("r.rpool.opts must "
1570 						    "be PF_POOL_ROUNDROBIN");
1571 						YYERROR;
1572 					}
1573 				}
1574 			}
1575 			if ($9.queues.qname != NULL) {
1576 				if (strlcpy(r.qname, $9.queues.qname,
1577 				    sizeof(r.qname)) >= sizeof(r.qname)) {
1578 					yyerror("rule qname too long (max "
1579 					    "%d chars)", sizeof(r.qname)-1);
1580 					YYERROR;
1581 				}
1582 				free($9.queues.qname);
1583 			}
1584 			if ($9.queues.pqname != NULL) {
1585 				if (strlcpy(r.pqname, $9.queues.pqname,
1586 				    sizeof(r.pqname)) >= sizeof(r.pqname)) {
1587 					yyerror("rule pqname too long (max "
1588 					    "%d chars)", sizeof(r.pqname)-1);
1589 					YYERROR;
1590 				}
1591 				free($9.queues.pqname);
1592 			}
1593 
1594 			expand_rule(&r, $4, $5.host, $7, $8.src_os,
1595 			    $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
1596 			    $9.uid, $9.gid, $9.icmpspec);
1597 		}
1598 		;
1599 
1600 filter_opts	:	{ bzero(&filter_opts, sizeof filter_opts); }
1601 		    filter_opts_l
1602 			{ $$ = filter_opts; }
1603 		| /* empty */	{
1604 			bzero(&filter_opts, sizeof filter_opts);
1605 			$$ = filter_opts;
1606 		}
1607 		;
1608 
1609 filter_opts_l	: filter_opts_l filter_opt
1610 		| filter_opt
1611 		;
1612 
1613 filter_opt	: USER uids {
1614 			if (filter_opts.uid)
1615 				$2->tail->next = filter_opts.uid;
1616 			filter_opts.uid = $2;
1617 		}
1618 		| GROUP gids {
1619 			if (filter_opts.gid)
1620 				$2->tail->next = filter_opts.gid;
1621 			filter_opts.gid = $2;
1622 		}
1623 		| flags {
1624 			if (filter_opts.marker & FOM_FLAGS) {
1625 				yyerror("flags cannot be redefined");
1626 				YYERROR;
1627 			}
1628 			filter_opts.marker |= FOM_FLAGS;
1629 			filter_opts.flags.b1 |= $1.b1;
1630 			filter_opts.flags.b2 |= $1.b2;
1631 			filter_opts.flags.w |= $1.w;
1632 			filter_opts.flags.w2 |= $1.w2;
1633 		}
1634 		| icmpspec {
1635 			if (filter_opts.marker & FOM_ICMP) {
1636 				yyerror("icmp-type cannot be redefined");
1637 				YYERROR;
1638 			}
1639 			filter_opts.marker |= FOM_ICMP;
1640 			filter_opts.icmpspec = $1;
1641 		}
1642 		| tos {
1643 			if (filter_opts.marker & FOM_TOS) {
1644 				yyerror("tos cannot be redefined");
1645 				YYERROR;
1646 			}
1647 			filter_opts.marker |= FOM_TOS;
1648 			filter_opts.tos = $1;
1649 		}
1650 		| keep {
1651 			if (filter_opts.marker & FOM_KEEP) {
1652 				yyerror("modulate or keep cannot be redefined");
1653 				YYERROR;
1654 			}
1655 			filter_opts.marker |= FOM_KEEP;
1656 			filter_opts.keep.action = $1.action;
1657 			filter_opts.keep.options = $1.options;
1658 		}
1659 		| FRAGMENT {
1660 			filter_opts.fragment = 1;
1661 		}
1662 		| ALLOWOPTS {
1663 			filter_opts.allowopts = 1;
1664 		}
1665 		| label	{
1666 			if (filter_opts.label) {
1667 				yyerror("label cannot be redefined");
1668 				YYERROR;
1669 			}
1670 			filter_opts.label = $1;
1671 		}
1672 		| qname	{
1673 			if (filter_opts.queues.qname) {
1674 				yyerror("queue cannot be redefined");
1675 				YYERROR;
1676 			}
1677 			filter_opts.queues = $1;
1678 		}
1679 		| TAG string				{
1680 			filter_opts.tag = $2;
1681 		}
1682 		| not TAGGED string			{
1683 			filter_opts.match_tag = $3;
1684 			filter_opts.match_tag_not = $1;
1685 		}
1686 		| PROBABILITY STRING			{
1687 			char	*e;
1688 			double	 p = strtod($2, &e);
1689 
1690 			if (*e == '%') {
1691 				p *= 0.01;
1692 				e++;
1693 			}
1694 			if (*e) {
1695 				yyerror("invalid probability: %s", $2);
1696 				YYERROR;
1697 			}
1698 			p = floor(p * (UINT_MAX+1.0) + 0.5);
1699 			if (p < 1.0 || p >= (UINT_MAX+1.0)) {
1700 				yyerror("invalid probability: %s", $2);
1701 				YYERROR;
1702 			}
1703 			filter_opts.prob = (u_int32_t)p;
1704 			free($2);
1705 		}
1706 		;
1707 
1708 action		: PASS			{ $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
1709 		| BLOCK blockspec	{ $$ = $2; $$.b1 = PF_DROP; }
1710 		| FUCKOFF		{
1711 			$$.b1 = PF_DROP;
1712 			$$.b2 = PFRULE_RETURN;
1713 			$$.w = returnicmpdefault;
1714 			$$.w2 = returnicmp6default;
1715 		}
1716 		;
1717 
1718 blockspec	: /* empty */		{
1719 			$$.b2 = blockpolicy;
1720 			$$.w = returnicmpdefault;
1721 			$$.w2 = returnicmp6default;
1722 		}
1723 		| DROP			{
1724 			$$.b2 = PFRULE_DROP;
1725 			$$.w = 0;
1726 			$$.w2 = 0;
1727 		}
1728 		| RETURNRST		{
1729 			$$.b2 = PFRULE_RETURNRST;
1730 			$$.w = 0;
1731 			$$.w2 = 0;
1732 		}
1733 		| RETURNRST '(' TTL number ')'	{
1734 			if ($4 > 255) {
1735 				yyerror("illegal ttl value %d", $4);
1736 				YYERROR;
1737 			}
1738 			$$.b2 = PFRULE_RETURNRST;
1739 			$$.w = $4;
1740 			$$.w2 = 0;
1741 		}
1742 		| RETURNICMP		{
1743 			$$.b2 = PFRULE_RETURNICMP;
1744 			$$.w = returnicmpdefault;
1745 			$$.w2 = returnicmp6default;
1746 		}
1747 		| RETURNICMP6		{
1748 			$$.b2 = PFRULE_RETURNICMP;
1749 			$$.w = returnicmpdefault;
1750 			$$.w2 = returnicmp6default;
1751 		}
1752 		| RETURNICMP '(' STRING ')'	{
1753 			$$.b2 = PFRULE_RETURNICMP;
1754 			if (!($$.w = parseicmpspec($3, AF_INET))) {
1755 				free($3);
1756 				YYERROR;
1757 			}
1758 			free($3);
1759 			$$.w2 = returnicmp6default;
1760 		}
1761 		| RETURNICMP6 '(' STRING ')'	{
1762 			$$.b2 = PFRULE_RETURNICMP;
1763 			$$.w = returnicmpdefault;
1764 			if (!($$.w2 = parseicmpspec($3, AF_INET6))) {
1765 				free($3);
1766 				YYERROR;
1767 			}
1768 			free($3);
1769 		}
1770 		| RETURNICMP '(' STRING comma STRING ')' {
1771 			$$.b2 = PFRULE_RETURNICMP;
1772 			if (!($$.w = parseicmpspec($3, AF_INET)) ||
1773 			    !($$.w2 = parseicmpspec($5, AF_INET6))) {
1774 				free($3);
1775 				free($5);
1776 				YYERROR;
1777 			}
1778 			free($3);
1779 			free($5);
1780 		}
1781 		| RETURN {
1782 			$$.b2 = PFRULE_RETURN;
1783 			$$.w = returnicmpdefault;
1784 			$$.w2 = returnicmp6default;
1785 		}
1786 		;
1787 
1788 dir		: /* empty */			{ $$ = 0; }
1789 		| IN				{ $$ = PF_IN; }
1790 		| OUT				{ $$ = PF_OUT; }
1791 		;
1792 
1793 logquick	: /* empty */			{ $$.log = 0; $$.quick = 0; }
1794 		| log				{ $$.log = $1; $$.quick = 0; }
1795 		| QUICK				{ $$.log = 0; $$.quick = 1; }
1796 		| log QUICK			{ $$.log = $1; $$.quick = 1; }
1797 		| QUICK log			{ $$.log = $2; $$.quick = 1; }
1798 		;
1799 
1800 log		: LOG				{ $$ = 1; }
1801 		| LOGALL			{ $$ = 2; }
1802 		;
1803 
1804 interface	: /* empty */			{ $$ = NULL; }
1805 		| ON if_item_not		{ $$ = $2; }
1806 		| ON '{' if_list '}'		{ $$ = $3; }
1807 		;
1808 
1809 if_list		: if_item_not			{ $$ = $1; }
1810 		| if_list comma if_item_not	{
1811 			$1->tail->next = $3;
1812 			$1->tail = $3;
1813 			$$ = $1;
1814 		}
1815 		;
1816 
1817 if_item_not	: not if_item			{ $$ = $2; $$->not = $1; }
1818 		;
1819 
1820 if_item		: STRING			{
1821 			struct node_host	*n;
1822 
1823 			if ((n = ifa_exists($1, 1)) == NULL) {
1824 				yyerror("unknown interface %s", $1);
1825 				free($1);
1826 				YYERROR;
1827 			}
1828 			$$ = calloc(1, sizeof(struct node_if));
1829 			if ($$ == NULL)
1830 				err(1, "if_item: calloc");
1831 			if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
1832 			    sizeof($$->ifname)) {
1833 				free($1);
1834 				free($$);
1835 				yyerror("interface name too long");
1836 				YYERROR;
1837 			}
1838 			free($1);
1839 			$$->ifa_flags = n->ifa_flags;
1840 			$$->not = 0;
1841 			$$->next = NULL;
1842 			$$->tail = $$;
1843 		}
1844 		;
1845 
1846 af		: /* empty */			{ $$ = 0; }
1847 		| INET				{ $$ = AF_INET; }
1848 		| INET6				{ $$ = AF_INET6; }
1849 		;
1850 
1851 proto		: /* empty */			{ $$ = NULL; }
1852 		| PROTO proto_item		{ $$ = $2; }
1853 		| PROTO '{' proto_list '}'	{ $$ = $3; }
1854 		;
1855 
1856 proto_list	: proto_item			{ $$ = $1; }
1857 		| proto_list comma proto_item	{
1858 			$1->tail->next = $3;
1859 			$1->tail = $3;
1860 			$$ = $1;
1861 		}
1862 		;
1863 
1864 proto_item	: STRING			{
1865 			u_int8_t	pr;
1866 			u_long		ulval;
1867 
1868 			if (atoul($1, &ulval) == 0) {
1869 				if (ulval > 255) {
1870 					yyerror("protocol outside range");
1871 					free($1);
1872 					YYERROR;
1873 				}
1874 				pr = (u_int8_t)ulval;
1875 			} else {
1876 				struct protoent	*p;
1877 
1878 				p = getprotobyname($1);
1879 				if (p == NULL) {
1880 					yyerror("unknown protocol %s", $1);
1881 					free($1);
1882 					YYERROR;
1883 				}
1884 				pr = p->p_proto;
1885 			}
1886 			free($1);
1887 			if (pr == 0) {
1888 				yyerror("proto 0 cannot be used");
1889 				YYERROR;
1890 			}
1891 			$$ = calloc(1, sizeof(struct node_proto));
1892 			if ($$ == NULL)
1893 				err(1, "proto_item: calloc");
1894 			$$->proto = pr;
1895 			$$->next = NULL;
1896 			$$->tail = $$;
1897 		}
1898 		;
1899 
1900 fromto		: ALL				{
1901 			$$.src.host = NULL;
1902 			$$.src.port = NULL;
1903 			$$.dst.host = NULL;
1904 			$$.dst.port = NULL;
1905 			$$.src_os = NULL;
1906 		}
1907 		| from os to			{
1908 			$$.src = $1;
1909 			$$.src_os = $2;
1910 			$$.dst = $3;
1911 		}
1912 		;
1913 
1914 os		: /* empty */			{ $$ = NULL; }
1915 		| OS xos			{ $$ = $2; }
1916 		| OS '{' os_list '}'		{ $$ = $3; }
1917 		;
1918 
1919 xos		: STRING {
1920 			$$ = calloc(1, sizeof(struct node_os));
1921 			if ($$ == NULL)
1922 				err(1, "os: calloc");
1923 			$$->os = $1;
1924 			$$->tail = $$;
1925 		}
1926 		;
1927 
1928 os_list		: xos				{ $$ = $1; }
1929 		| os_list comma xos		{
1930 			$1->tail->next = $3;
1931 			$1->tail = $3;
1932 			$$ = $1;
1933 		}
1934 		;
1935 
1936 from		: /* empty */			{
1937 			$$.host = NULL;
1938 			$$.port = NULL;
1939 		}
1940 		| FROM ipportspec		{
1941 			$$ = $2;
1942 		}
1943 		;
1944 
1945 to		: /* empty */			{
1946 			$$.host = NULL;
1947 			$$.port = NULL;
1948 		}
1949 		| TO ipportspec		{
1950 			$$ = $2;
1951 		}
1952 		;
1953 
1954 ipportspec	: ipspec			{
1955 			$$.host = $1;
1956 			$$.port = NULL;
1957 		}
1958 		| ipspec PORT portspec		{
1959 			$$.host = $1;
1960 			$$.port = $3;
1961 		}
1962 		| PORT portspec			{
1963 			$$.host = NULL;
1964 			$$.port = $2;
1965 		}
1966 		;
1967 
1968 ipspec		: ANY				{ $$ = NULL; }
1969 		| xhost				{ $$ = $1; }
1970 		| '{' host_list '}'		{ $$ = $2; }
1971 		;
1972 
1973 host_list	: xhost				{ $$ = $1; }
1974 		| host_list comma xhost		{
1975 			if ($3 == NULL)
1976 				$$ = $1;
1977 			else if ($1 == NULL)
1978 				$$ = $3;
1979 			else {
1980 				$1->tail->next = $3;
1981 				$1->tail = $3->tail;
1982 				$$ = $1;
1983 			}
1984 		}
1985 		;
1986 
1987 xhost		: not host			{
1988 			struct node_host	*n;
1989 
1990 			for (n = $2; n != NULL; n = n->next)
1991 				n->not = $1;
1992 			$$ = $2;
1993 		}
1994 		| NOROUTE			{
1995 			$$ = calloc(1, sizeof(struct node_host));
1996 			if ($$ == NULL)
1997 				err(1, "xhost: calloc");
1998 			$$->addr.type = PF_ADDR_NOROUTE;
1999 			$$->next = NULL;
2000 			$$->tail = $$;
2001 		}
2002 		;
2003 
2004 host		: STRING			{
2005 			if (($$ = host($1)) == NULL)	{
2006 				/* error. "any" is handled elsewhere */
2007 				free($1);
2008 				yyerror("could not parse host specification");
2009 				YYERROR;
2010 			}
2011 			free($1);
2012 
2013 		}
2014 		| STRING '/' number		{
2015 			char	*buf;
2016 
2017 			if (asprintf(&buf, "%s/%u", $1, $3) == -1)
2018 				err(1, "host: asprintf");
2019 			free($1);
2020 			if (($$ = host(buf)) == NULL)	{
2021 				/* error. "any" is handled elsewhere */
2022 				free(buf);
2023 				yyerror("could not parse host specification");
2024 				YYERROR;
2025 			}
2026 			free(buf);
2027 		}
2028 		| '<' STRING '>'	{
2029 			if (strlen($2) >= PF_TABLE_NAME_SIZE) {
2030 				yyerror("table name '%s' too long", $2);
2031 				free($2);
2032 				YYERROR;
2033 			}
2034 			$$ = calloc(1, sizeof(struct node_host));
2035 			if ($$ == NULL)
2036 				err(1, "host: calloc");
2037 			$$->addr.type = PF_ADDR_TABLE;
2038 			if (strlcpy($$->addr.v.tblname, $2,
2039 			    sizeof($$->addr.v.tblname)) >=
2040 			    sizeof($$->addr.v.tblname))
2041 				errx(1, "host: strlcpy");
2042 			free($2);
2043 			$$->next = NULL;
2044 			$$->tail = $$;
2045 		}
2046 		;
2047 
2048 number		: STRING			{
2049 			u_long	ulval;
2050 
2051 			if (atoul($1, &ulval) == -1) {
2052 				yyerror("%s is not a number", $1);
2053 				free($1);
2054 				YYERROR;
2055 			} else
2056 				$$ = ulval;
2057 			free($1);
2058 		}
2059 		;
2060 
2061 portspec	: port_item			{ $$ = $1; }
2062 		| '{' port_list '}'		{ $$ = $2; }
2063 		;
2064 
2065 port_list	: port_item			{ $$ = $1; }
2066 		| port_list comma port_item	{
2067 			$1->tail->next = $3;
2068 			$1->tail = $3;
2069 			$$ = $1;
2070 		}
2071 		;
2072 
2073 port_item	: port				{
2074 			$$ = calloc(1, sizeof(struct node_port));
2075 			if ($$ == NULL)
2076 				err(1, "port_item: calloc");
2077 			$$->port[0] = $1.a;
2078 			$$->port[1] = $1.b;
2079 			if ($1.t)
2080 				$$->op = PF_OP_RRG;
2081 			else
2082 				$$->op = PF_OP_EQ;
2083 			$$->next = NULL;
2084 			$$->tail = $$;
2085 		}
2086 		| unaryop port		{
2087 			if ($2.t) {
2088 				yyerror("':' cannot be used with an other "
2089 				    "port operator");
2090 				YYERROR;
2091 			}
2092 			$$ = calloc(1, sizeof(struct node_port));
2093 			if ($$ == NULL)
2094 				err(1, "port_item: calloc");
2095 			$$->port[0] = $2.a;
2096 			$$->port[1] = $2.b;
2097 			$$->op = $1;
2098 			$$->next = NULL;
2099 			$$->tail = $$;
2100 		}
2101 		| port PORTBINARY port		{
2102 			if ($1.t || $3.t) {
2103 				yyerror("':' cannot be used with an other "
2104 				    "port operator");
2105 				YYERROR;
2106 			}
2107 			$$ = calloc(1, sizeof(struct node_port));
2108 			if ($$ == NULL)
2109 				err(1, "port_item: calloc");
2110 			$$->port[0] = $1.a;
2111 			$$->port[1] = $3.a;
2112 			$$->op = $2;
2113 			$$->next = NULL;
2114 			$$->tail = $$;
2115 		}
2116 		;
2117 
2118 port		: STRING			{
2119 			char	*p = strchr($1, ':');
2120 			struct servent	*s = NULL;
2121 			u_long		 ulval;
2122 
2123 			if (p == NULL) {
2124 				if (atoul($1, &ulval) == 0) {
2125 					if (ulval > 65535) {
2126 						free($1);
2127 						yyerror("illegal port value %d",
2128 						    ulval);
2129 						YYERROR;
2130 					}
2131 					$$.a = htons(ulval);
2132 				} else {
2133 					s = getservbyname($1, "tcp");
2134 					if (s == NULL)
2135 						s = getservbyname($1, "udp");
2136 					if (s == NULL) {
2137 						yyerror("unknown port %s", $1);
2138 						free($1);
2139 						YYERROR;
2140 					}
2141 					$$.a = s->s_port;
2142 				}
2143 				$$.b = 0;
2144 				$$.t = 0;
2145 			} else {
2146 				int port[2];
2147 
2148 				*p++ = 0;
2149 				if ((port[0] = getservice($1)) == -1 ||
2150 				    (port[1] = getservice(p)) == -1) {
2151 					free($1);
2152 					YYERROR;
2153 				}
2154 				$$.a = port[0];
2155 				$$.b = port[1];
2156 				$$.t = PF_OP_RRG;
2157 			}
2158 			free($1);
2159 		}
2160 		;
2161 
2162 uids		: uid_item			{ $$ = $1; }
2163 		| '{' uid_list '}'		{ $$ = $2; }
2164 		;
2165 
2166 uid_list	: uid_item			{ $$ = $1; }
2167 		| uid_list comma uid_item	{
2168 			$1->tail->next = $3;
2169 			$1->tail = $3;
2170 			$$ = $1;
2171 		}
2172 		;
2173 
2174 uid_item	: uid				{
2175 			$$ = calloc(1, sizeof(struct node_uid));
2176 			if ($$ == NULL)
2177 				err(1, "uid_item: calloc");
2178 			$$->uid[0] = $1;
2179 			$$->uid[1] = $1;
2180 			$$->op = PF_OP_EQ;
2181 			$$->next = NULL;
2182 			$$->tail = $$;
2183 		}
2184 		| unaryop uid			{
2185 			if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2186 				yyerror("user unknown requires operator = or "
2187 				    "!=");
2188 				YYERROR;
2189 			}
2190 			$$ = calloc(1, sizeof(struct node_uid));
2191 			if ($$ == NULL)
2192 				err(1, "uid_item: calloc");
2193 			$$->uid[0] = $2;
2194 			$$->uid[1] = $2;
2195 			$$->op = $1;
2196 			$$->next = NULL;
2197 			$$->tail = $$;
2198 		}
2199 		| uid PORTBINARY uid		{
2200 			if ($1 == UID_MAX || $3 == UID_MAX) {
2201 				yyerror("user unknown requires operator = or "
2202 				    "!=");
2203 				YYERROR;
2204 			}
2205 			$$ = calloc(1, sizeof(struct node_uid));
2206 			if ($$ == NULL)
2207 				err(1, "uid_item: calloc");
2208 			$$->uid[0] = $1;
2209 			$$->uid[1] = $3;
2210 			$$->op = $2;
2211 			$$->next = NULL;
2212 			$$->tail = $$;
2213 		}
2214 		;
2215 
2216 uid		: STRING			{
2217 			u_long	ulval;
2218 
2219 			if (atoul($1, &ulval) == -1) {
2220 				if (!strcmp($1, "unknown"))
2221 					$$ = UID_MAX;
2222 				else {
2223 					struct passwd	*pw;
2224 
2225 					if ((pw = getpwnam($1)) == NULL) {
2226 						yyerror("unknown user %s", $1);
2227 						free($1);
2228 						YYERROR;
2229 					}
2230 					$$ = pw->pw_uid;
2231 				}
2232 			} else {
2233 				if (ulval >= UID_MAX) {
2234 					free($1);
2235 					yyerror("illegal uid value %lu", ulval);
2236 					YYERROR;
2237 				}
2238 				$$ = ulval;
2239 			}
2240 			free($1);
2241 		}
2242 		;
2243 
2244 gids		: gid_item			{ $$ = $1; }
2245 		| '{' gid_list '}'		{ $$ = $2; }
2246 		;
2247 
2248 gid_list	: gid_item			{ $$ = $1; }
2249 		| gid_list comma gid_item	{
2250 			$1->tail->next = $3;
2251 			$1->tail = $3;
2252 			$$ = $1;
2253 		}
2254 		;
2255 
2256 gid_item	: gid				{
2257 			$$ = calloc(1, sizeof(struct node_gid));
2258 			if ($$ == NULL)
2259 				err(1, "gid_item: calloc");
2260 			$$->gid[0] = $1;
2261 			$$->gid[1] = $1;
2262 			$$->op = PF_OP_EQ;
2263 			$$->next = NULL;
2264 			$$->tail = $$;
2265 		}
2266 		| unaryop gid			{
2267 			if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2268 				yyerror("group unknown requires operator = or "
2269 				    "!=");
2270 				YYERROR;
2271 			}
2272 			$$ = calloc(1, sizeof(struct node_gid));
2273 			if ($$ == NULL)
2274 				err(1, "gid_item: calloc");
2275 			$$->gid[0] = $2;
2276 			$$->gid[1] = $2;
2277 			$$->op = $1;
2278 			$$->next = NULL;
2279 			$$->tail = $$;
2280 		}
2281 		| gid PORTBINARY gid		{
2282 			if ($1 == GID_MAX || $3 == GID_MAX) {
2283 				yyerror("group unknown requires operator = or "
2284 				    "!=");
2285 				YYERROR;
2286 			}
2287 			$$ = calloc(1, sizeof(struct node_gid));
2288 			if ($$ == NULL)
2289 				err(1, "gid_item: calloc");
2290 			$$->gid[0] = $1;
2291 			$$->gid[1] = $3;
2292 			$$->op = $2;
2293 			$$->next = NULL;
2294 			$$->tail = $$;
2295 		}
2296 		;
2297 
2298 gid		: STRING			{
2299 			u_long	ulval;
2300 
2301 			if (atoul($1, &ulval) == -1) {
2302 				if (!strcmp($1, "unknown"))
2303 					$$ = GID_MAX;
2304 				else {
2305 					struct group	*grp;
2306 
2307 					if ((grp = getgrnam($1)) == NULL) {
2308 						yyerror("unknown group %s", $1);
2309 						free($1);
2310 						YYERROR;
2311 					}
2312 					$$ = grp->gr_gid;
2313 				}
2314 			} else {
2315 				if (ulval >= GID_MAX) {
2316 					yyerror("illegal gid value %lu", ulval);
2317 					free($1);
2318 					YYERROR;
2319 				}
2320 				$$ = ulval;
2321 			}
2322 			free($1);
2323 		}
2324 		;
2325 
2326 flag		: STRING			{
2327 			int	f;
2328 
2329 			if ((f = parse_flags($1)) < 0) {
2330 				yyerror("bad flags %s", $1);
2331 				free($1);
2332 				YYERROR;
2333 			}
2334 			free($1);
2335 			$$.b1 = f;
2336 		}
2337 		;
2338 
2339 flags		: FLAGS flag '/' flag	{ $$.b1 = $2.b1; $$.b2 = $4.b1; }
2340 		| FLAGS '/' flag	{ $$.b1 = 0; $$.b2 = $3.b1; }
2341 		;
2342 
2343 icmpspec	: ICMPTYPE icmp_item		{ $$ = $2; }
2344 		| ICMPTYPE '{' icmp_list '}'	{ $$ = $3; }
2345 		| ICMP6TYPE icmp6_item		{ $$ = $2; }
2346 		| ICMP6TYPE '{' icmp6_list '}'	{ $$ = $3; }
2347 		;
2348 
2349 icmp_list	: icmp_item			{ $$ = $1; }
2350 		| icmp_list comma icmp_item	{
2351 			$1->tail->next = $3;
2352 			$1->tail = $3;
2353 			$$ = $1;
2354 		}
2355 		;
2356 
2357 icmp6_list	: icmp6_item			{ $$ = $1; }
2358 		| icmp6_list comma icmp6_item	{
2359 			$1->tail->next = $3;
2360 			$1->tail = $3;
2361 			$$ = $1;
2362 		}
2363 		;
2364 
2365 icmp_item	: icmptype		{
2366 			$$ = calloc(1, sizeof(struct node_icmp));
2367 			if ($$ == NULL)
2368 				err(1, "icmp_item: calloc");
2369 			$$->type = $1;
2370 			$$->code = 0;
2371 			$$->proto = IPPROTO_ICMP;
2372 			$$->next = NULL;
2373 			$$->tail = $$;
2374 		}
2375 		| icmptype CODE STRING	{
2376 			const struct icmpcodeent	*p;
2377 			u_long				 ulval;
2378 
2379 			if (atoul($3, &ulval) == 0) {
2380 				if (ulval > 255) {
2381 					free($3);
2382 					yyerror("illegal icmp-code %d", ulval);
2383 					YYERROR;
2384 				}
2385 			} else {
2386 				if ((p = geticmpcodebyname($1-1, $3,
2387 				    AF_INET)) == NULL) {
2388 					yyerror("unknown icmp-code %s", $3);
2389 					free($3);
2390 					YYERROR;
2391 				}
2392 				ulval = p->code;
2393 			}
2394 			free($3);
2395 			$$ = calloc(1, sizeof(struct node_icmp));
2396 			if ($$ == NULL)
2397 				err(1, "icmp_item: calloc");
2398 			$$->type = $1;
2399 			$$->code = ulval + 1;
2400 			$$->proto = IPPROTO_ICMP;
2401 			$$->next = NULL;
2402 			$$->tail = $$;
2403 		}
2404 		;
2405 
2406 icmp6_item	: icmp6type		{
2407 			$$ = calloc(1, sizeof(struct node_icmp));
2408 			if ($$ == NULL)
2409 				err(1, "icmp_item: calloc");
2410 			$$->type = $1;
2411 			$$->code = 0;
2412 			$$->proto = IPPROTO_ICMPV6;
2413 			$$->next = NULL;
2414 			$$->tail = $$;
2415 		}
2416 		| icmp6type CODE STRING	{
2417 			const struct icmpcodeent	*p;
2418 			u_long				 ulval;
2419 
2420 			if (atoul($3, &ulval) == 0) {
2421 				if (ulval > 255) {
2422 					yyerror("illegal icmp6-code %ld",
2423 					    ulval);
2424 					free($3);
2425 					YYERROR;
2426 				}
2427 			} else {
2428 				if ((p = geticmpcodebyname($1-1, $3,
2429 				    AF_INET6)) == NULL) {
2430 					yyerror("unknown icmp6-code %s", $3);
2431 					free($3);
2432 					YYERROR;
2433 				}
2434 				ulval = p->code;
2435 			}
2436 			free($3);
2437 			$$ = calloc(1, sizeof(struct node_icmp));
2438 			if ($$ == NULL)
2439 				err(1, "icmp_item: calloc");
2440 			$$->type = $1;
2441 			$$->code = ulval + 1;
2442 			$$->proto = IPPROTO_ICMPV6;
2443 			$$->next = NULL;
2444 			$$->tail = $$;
2445 		}
2446 		;
2447 
2448 icmptype	: STRING			{
2449 			const struct icmptypeent	*p;
2450 			u_long				 ulval;
2451 
2452 			if (atoul($1, &ulval) == 0) {
2453 				if (ulval > 255) {
2454 					yyerror("illegal icmp-type %d", ulval);
2455 					free($1);
2456 					YYERROR;
2457 				}
2458 				$$ = ulval + 1;
2459 			} else {
2460 				if ((p = geticmptypebyname($1, AF_INET)) ==
2461 				    NULL) {
2462 					yyerror("unknown icmp-type %s", $1);
2463 					free($1);
2464 					YYERROR;
2465 				}
2466 				$$ = p->type + 1;
2467 			}
2468 			free($1);
2469 		}
2470 		;
2471 
2472 icmp6type	: STRING			{
2473 			const struct icmptypeent	*p;
2474 			u_long				 ulval;
2475 
2476 			if (atoul($1, &ulval) == 0) {
2477 				if (ulval > 255) {
2478 					yyerror("illegal icmp6-type %d", ulval);
2479 					free($1);
2480 					YYERROR;
2481 				}
2482 				$$ = ulval + 1;
2483 			} else {
2484 				if ((p = geticmptypebyname($1, AF_INET6)) ==
2485 				    NULL) {
2486 					yyerror("unknown icmp6-type %s", $1);
2487 					free($1);
2488 					YYERROR;
2489 				}
2490 				$$ = p->type + 1;
2491 			}
2492 			free($1);
2493 		}
2494 		;
2495 
2496 tos		: TOS STRING			{
2497 			if (!strcmp($2, "lowdelay"))
2498 				$$ = IPTOS_LOWDELAY;
2499 			else if (!strcmp($2, "throughput"))
2500 				$$ = IPTOS_THROUGHPUT;
2501 			else if (!strcmp($2, "reliability"))
2502 				$$ = IPTOS_RELIABILITY;
2503 			else if ($2[0] == '0' && $2[1] == 'x')
2504 				$$ = strtoul($2, NULL, 16);
2505 			else
2506 				$$ = strtoul($2, NULL, 10);
2507 			if (!$$ || $$ > 255) {
2508 				yyerror("illegal tos value %s", $2);
2509 				free($2);
2510 				YYERROR;
2511 			}
2512 			free($2);
2513 		}
2514 		;
2515 
2516 sourcetrack	: SOURCETRACK		{ $$ = PF_SRCTRACK; }
2517 		| SOURCETRACK GLOBAL	{ $$ = PF_SRCTRACK_GLOBAL; }
2518 		| SOURCETRACK RULE	{ $$ = PF_SRCTRACK_RULE; }
2519 		;
2520 
2521 statelock	: IFBOUND {
2522 			$$ = PFRULE_IFBOUND;
2523 		}
2524 		| GRBOUND {
2525 			$$ = PFRULE_GRBOUND;
2526 		}
2527 		| FLOATING {
2528 			$$ = 0;
2529 		}
2530 		;
2531 
2532 keep		: KEEP STATE state_opt_spec	{
2533 			$$.action = PF_STATE_NORMAL;
2534 			$$.options = $3;
2535 		}
2536 		| MODULATE STATE state_opt_spec {
2537 			$$.action = PF_STATE_MODULATE;
2538 			$$.options = $3;
2539 		}
2540 		| SYNPROXY STATE state_opt_spec {
2541 			$$.action = PF_STATE_SYNPROXY;
2542 			$$.options = $3;
2543 		}
2544 		;
2545 
2546 state_opt_spec	: '(' state_opt_list ')'	{ $$ = $2; }
2547 		| /* empty */			{ $$ = NULL; }
2548 		;
2549 
2550 state_opt_list	: state_opt_item		{ $$ = $1; }
2551 		| state_opt_list comma state_opt_item {
2552 			$1->tail->next = $3;
2553 			$1->tail = $3;
2554 			$$ = $1;
2555 		}
2556 		;
2557 
2558 state_opt_item	: MAXIMUM number		{
2559 			$$ = calloc(1, sizeof(struct node_state_opt));
2560 			if ($$ == NULL)
2561 				err(1, "state_opt_item: calloc");
2562 			$$->type = PF_STATE_OPT_MAX;
2563 			$$->data.max_states = $2;
2564 			$$->next = NULL;
2565 			$$->tail = $$;
2566 		}
2567 		| NOSYNC				{
2568 			$$ = calloc(1, sizeof(struct node_state_opt));
2569 			if ($$ == NULL)
2570 				err(1, "state_opt_item: calloc");
2571 			$$->type = PF_STATE_OPT_NOSYNC;
2572 			$$->next = NULL;
2573 			$$->tail = $$;
2574 		}
2575 		| MAXSRCSTATES number			{
2576 			$$ = calloc(1, sizeof(struct node_state_opt));
2577 			if ($$ == NULL)
2578 				err(1, "state_opt_item: calloc");
2579 			$$->type = PF_STATE_OPT_MAX_SRC_STATES;
2580 			$$->data.max_src_states = $2;
2581 			$$->next = NULL;
2582 			$$->tail = $$;
2583 		}
2584 		| MAXSRCNODES number			{
2585 			$$ = calloc(1, sizeof(struct node_state_opt));
2586 			if ($$ == NULL)
2587 				err(1, "state_opt_item: calloc");
2588 			$$->type = PF_STATE_OPT_MAX_SRC_NODES;
2589 			$$->data.max_src_nodes = $2;
2590 			$$->next = NULL;
2591 			$$->tail = $$;
2592 		}
2593 		| sourcetrack {
2594 			$$ = calloc(1, sizeof(struct node_state_opt));
2595 			if ($$ == NULL)
2596 				err(1, "state_opt_item: calloc");
2597 			$$->type = PF_STATE_OPT_SRCTRACK;
2598 			$$->data.src_track = $1;
2599 			$$->next = NULL;
2600 			$$->tail = $$;
2601 		}
2602 		| statelock {
2603 			$$ = calloc(1, sizeof(struct node_state_opt));
2604 			if ($$ == NULL)
2605 				err(1, "state_opt_item: calloc");
2606 			$$->type = PF_STATE_OPT_STATELOCK;
2607 			$$->data.statelock = $1;
2608 			$$->next = NULL;
2609 			$$->tail = $$;
2610 		}
2611 		| STRING number			{
2612 			int	i;
2613 
2614 			for (i = 0; pf_timeouts[i].name &&
2615 			    strcmp(pf_timeouts[i].name, $1); ++i)
2616 				;	/* nothing */
2617 			if (!pf_timeouts[i].name) {
2618 				yyerror("illegal timeout name %s", $1);
2619 				free($1);
2620 				YYERROR;
2621 			}
2622 			if (strchr(pf_timeouts[i].name, '.') == NULL) {
2623 				yyerror("illegal state timeout %s", $1);
2624 				free($1);
2625 				YYERROR;
2626 			}
2627 			free($1);
2628 			$$ = calloc(1, sizeof(struct node_state_opt));
2629 			if ($$ == NULL)
2630 				err(1, "state_opt_item: calloc");
2631 			$$->type = PF_STATE_OPT_TIMEOUT;
2632 			$$->data.timeout.number = pf_timeouts[i].timeout;
2633 			$$->data.timeout.seconds = $2;
2634 			$$->next = NULL;
2635 			$$->tail = $$;
2636 		}
2637 		;
2638 
2639 label		: LABEL STRING			{
2640 			$$ = $2;
2641 		}
2642 		;
2643 
2644 qname		: QUEUE STRING				{
2645 			$$.qname = $2;
2646 		}
2647 		| QUEUE '(' STRING ')'			{
2648 			$$.qname = $3;
2649 		}
2650 		| QUEUE '(' STRING comma STRING ')'	{
2651 			$$.qname = $3;
2652 			$$.pqname = $5;
2653 		}
2654 		;
2655 
2656 no		: /* empty */			{ $$ = 0; }
2657 		| NO				{ $$ = 1; }
2658 		;
2659 
2660 rport		: STRING			{
2661 			char	*p = strchr($1, ':');
2662 
2663 			if (p == NULL) {
2664 				if (($$.a = getservice($1)) == -1) {
2665 					free($1);
2666 					YYERROR;
2667 				}
2668 				$$.b = $$.t = 0;
2669 			} else if (!strcmp(p+1, "*")) {
2670 				*p = 0;
2671 				if (($$.a = getservice($1)) == -1) {
2672 					free($1);
2673 					YYERROR;
2674 				}
2675 				$$.b = 0;
2676 				$$.t = 1;
2677 			} else {
2678 				*p++ = 0;
2679 				if (($$.a = getservice($1)) == -1 ||
2680 				    ($$.b = getservice(p)) == -1) {
2681 					free($1);
2682 					YYERROR;
2683 				}
2684 				if ($$.a == $$.b)
2685 					$$.b = 0;
2686 				$$.t = 0;
2687 			}
2688 			free($1);
2689 		}
2690 		;
2691 
2692 redirspec	: host				{ $$ = $1; }
2693 		| '{' redir_host_list '}'	{ $$ = $2; }
2694 		;
2695 
2696 redir_host_list	: host				{ $$ = $1; }
2697 		| redir_host_list comma host	{
2698 			$1->tail->next = $3;
2699 			$1->tail = $3->tail;
2700 			$$ = $1;
2701 		}
2702 		;
2703 
2704 redirpool	: /* empty */			{ $$ = NULL; }
2705 		| ARROW redirspec		{
2706 			$$ = calloc(1, sizeof(struct redirection));
2707 			if ($$ == NULL)
2708 				err(1, "redirection: calloc");
2709 			$$->host = $2;
2710 			$$->rport.a = $$->rport.b = $$->rport.t = 0;
2711 		}
2712 		| ARROW redirspec PORT rport	{
2713 			$$ = calloc(1, sizeof(struct redirection));
2714 			if ($$ == NULL)
2715 				err(1, "redirection: calloc");
2716 			$$->host = $2;
2717 			$$->rport = $4;
2718 		}
2719 		;
2720 
2721 hashkey		: /* empty */
2722 		{
2723 			$$ = calloc(1, sizeof(struct pf_poolhashkey));
2724 			if ($$ == NULL)
2725 				err(1, "hashkey: calloc");
2726 			arc4random_buf($$->key32, sizeof($$->key32));
2727 		}
2728 		| string
2729 		{
2730 			if (!strncmp($1, "0x", 2)) {
2731 				if (strlen($1) != 34) {
2732 					free($1);
2733 					yyerror("hex key must be 128 bits "
2734 						"(32 hex digits) long");
2735 					YYERROR;
2736 				}
2737 				$$ = calloc(1, sizeof(struct pf_poolhashkey));
2738 				if ($$ == NULL)
2739 					err(1, "hashkey: calloc");
2740 
2741 				if (sscanf($1, "0x%8x%8x%8x%8x",
2742 				    &$$->key32[0], &$$->key32[1],
2743 				    &$$->key32[2], &$$->key32[3]) != 4) {
2744 					free($$);
2745 					free($1);
2746 					yyerror("invalid hex key");
2747 					YYERROR;
2748 				}
2749 			} else {
2750 				MD5_CTX	context;
2751 
2752 				$$ = calloc(1, sizeof(struct pf_poolhashkey));
2753 				if ($$ == NULL)
2754 					err(1, "hashkey: calloc");
2755 				MD5Init(&context);
2756 				MD5Update(&context, (unsigned char *)$1,
2757 				    strlen($1));
2758 				MD5Final((unsigned char *)$$, &context);
2759 				HTONL($$->key32[0]);
2760 				HTONL($$->key32[1]);
2761 				HTONL($$->key32[2]);
2762 				HTONL($$->key32[3]);
2763 			}
2764 			free($1);
2765 		}
2766 		;
2767 
2768 pool_opts	:	{ bzero(&pool_opts, sizeof pool_opts); }
2769 		    pool_opts_l
2770 			{ $$ = pool_opts; }
2771 		| /* empty */	{
2772 			bzero(&pool_opts, sizeof pool_opts);
2773 			$$ = pool_opts;
2774 		}
2775 		;
2776 
2777 pool_opts_l	: pool_opts_l pool_opt
2778 		| pool_opt
2779 		;
2780 
2781 pool_opt	: BITMASK	{
2782 			if (pool_opts.type) {
2783 				yyerror("pool type cannot be redefined");
2784 				YYERROR;
2785 			}
2786 			pool_opts.type =  PF_POOL_BITMASK;
2787 		}
2788 		| RANDOM	{
2789 			if (pool_opts.type) {
2790 				yyerror("pool type cannot be redefined");
2791 				YYERROR;
2792 			}
2793 			pool_opts.type = PF_POOL_RANDOM;
2794 		}
2795 		| SOURCEHASH hashkey {
2796 			if (pool_opts.type) {
2797 				yyerror("pool type cannot be redefined");
2798 				YYERROR;
2799 			}
2800 			pool_opts.type = PF_POOL_SRCHASH;
2801 			pool_opts.key = $2;
2802 		}
2803 		| ROUNDROBIN	{
2804 			if (pool_opts.type) {
2805 				yyerror("pool type cannot be redefined");
2806 				YYERROR;
2807 			}
2808 			pool_opts.type = PF_POOL_ROUNDROBIN;
2809 		}
2810 		| STATICPORT	{
2811 			if (pool_opts.staticport) {
2812 				yyerror("static-port cannot be redefined");
2813 				YYERROR;
2814 			}
2815 			pool_opts.staticport = 1;
2816 		}
2817 		| STICKYADDRESS	{
2818 			if (filter_opts.marker & POM_STICKYADDRESS) {
2819 				yyerror("sticky-address cannot be redefined");
2820 				YYERROR;
2821 			}
2822 			pool_opts.marker |= POM_STICKYADDRESS;
2823 			pool_opts.opts |= PF_POOL_STICKYADDR;
2824 		}
2825 		;
2826 
2827 redirection	: /* empty */			{ $$ = NULL; }
2828 		| ARROW host			{
2829 			$$ = calloc(1, sizeof(struct redirection));
2830 			if ($$ == NULL)
2831 				err(1, "redirection: calloc");
2832 			$$->host = $2;
2833 			$$->rport.a = $$->rport.b = $$->rport.t = 0;
2834 		}
2835 		| ARROW host PORT rport	{
2836 			$$ = calloc(1, sizeof(struct redirection));
2837 			if ($$ == NULL)
2838 				err(1, "redirection: calloc");
2839 			$$->host = $2;
2840 			$$->rport = $4;
2841 		}
2842 		;
2843 
2844 natpass		: /* empty */	{ $$ = 0; }
2845 		| PASS		{ $$ = 1; }
2846 		;
2847 
2848 nataction	: no NAT natpass {
2849 			$$.b2 = $$.w = 0;
2850 			if ($1)
2851 				$$.b1 = PF_NONAT;
2852 			else
2853 				$$.b1 = PF_NAT;
2854 			$$.b2 = $3;
2855 		}
2856 		| no RDR natpass {
2857 			$$.b2 = $$.w = 0;
2858 			if ($1)
2859 				$$.b1 = PF_NORDR;
2860 			else
2861 				$$.b1 = PF_RDR;
2862 			$$.b2 = $3;
2863 		}
2864 		;
2865 
2866 natrule		: nataction interface af proto fromto tag redirpool pool_opts
2867 		{
2868 			struct pf_rule	r;
2869 
2870 			if (check_rulestate(PFCTL_STATE_NAT))
2871 				YYERROR;
2872 
2873 			memset(&r, 0, sizeof(r));
2874 
2875 			r.action = $1.b1;
2876 			r.natpass = $1.b2;
2877 			r.af = $3;
2878 
2879 			if (!r.af) {
2880 				if ($5.src.host && $5.src.host->af &&
2881 				    !$5.src.host->ifindex)
2882 					r.af = $5.src.host->af;
2883 				else if ($5.dst.host && $5.dst.host->af &&
2884 				    !$5.dst.host->ifindex)
2885 					r.af = $5.dst.host->af;
2886 			}
2887 
2888 			if ($6 != NULL)
2889 				if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
2890 				    PF_TAG_NAME_SIZE) {
2891 					yyerror("tag too long, max %u chars",
2892 					    PF_TAG_NAME_SIZE - 1);
2893 					YYERROR;
2894 				}
2895 
2896 			if (r.action == PF_NONAT || r.action == PF_NORDR) {
2897 				if ($7 != NULL) {
2898 					yyerror("translation rule with 'no' "
2899 					    "does not need '->'");
2900 					YYERROR;
2901 				}
2902 			} else {
2903 				if ($7 == NULL || $7->host == NULL) {
2904 					yyerror("translation rule requires '-> "
2905 					    "address'");
2906 					YYERROR;
2907 				}
2908 				if (!r.af && ! $7->host->ifindex)
2909 					r.af = $7->host->af;
2910 
2911 				remove_invalid_hosts(&$7->host, &r.af);
2912 				if (invalid_redirect($7->host, r.af))
2913 					YYERROR;
2914 				if (check_netmask($7->host, r.af))
2915 					YYERROR;
2916 
2917 				r.rpool.proxy_port[0] = ntohs($7->rport.a);
2918 
2919 				switch (r.action) {
2920 				case PF_RDR:
2921 					if (!$7->rport.b && $7->rport.t &&
2922 					    $5.dst.port != NULL) {
2923 						r.rpool.proxy_port[1] =
2924 						    ntohs($7->rport.a) +
2925 						    (ntohs(
2926 						    $5.dst.port->port[1]) -
2927 						    ntohs(
2928 						    $5.dst.port->port[0]));
2929 					} else
2930 						r.rpool.proxy_port[1] =
2931 						    ntohs($7->rport.b);
2932 					break;
2933 				case PF_NAT:
2934 					r.rpool.proxy_port[1] =
2935 					    ntohs($7->rport.b);
2936 					if (!r.rpool.proxy_port[0] &&
2937 					    !r.rpool.proxy_port[1]) {
2938 						r.rpool.proxy_port[0] =
2939 						    PF_NAT_PROXY_PORT_LOW;
2940 						r.rpool.proxy_port[1] =
2941 						    PF_NAT_PROXY_PORT_HIGH;
2942 					} else if (!r.rpool.proxy_port[1])
2943 						r.rpool.proxy_port[1] =
2944 						    r.rpool.proxy_port[0];
2945 					break;
2946 				default:
2947 					break;
2948 				}
2949 
2950 				r.rpool.opts = $8.type;
2951 				if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
2952 				    PF_POOL_NONE && ($7->host->next != NULL ||
2953 				    $7->host->addr.type == PF_ADDR_TABLE))
2954 					r.rpool.opts = PF_POOL_ROUNDROBIN;
2955 				if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2956 				    PF_POOL_ROUNDROBIN &&
2957 				    disallow_table($7->host, "tables are only "
2958 				    "supported in round-robin redirection "
2959 				    "pools"))
2960 					YYERROR;
2961 				if ($7->host->next != NULL) {
2962 					if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2963 					    PF_POOL_ROUNDROBIN) {
2964 						yyerror("only round-robin "
2965 						    "valid for multiple "
2966 						    "redirection addresses");
2967 						YYERROR;
2968 					}
2969 				}
2970 			}
2971 
2972 			if ($8.key != NULL)
2973 				memcpy(&r.rpool.key, $8.key,
2974 				    sizeof(struct pf_poolhashkey));
2975 
2976 			 if ($8.opts)
2977 				r.rpool.opts |= $8.opts;
2978 
2979 			if ($8.staticport) {
2980 				if (r.action != PF_NAT) {
2981 					yyerror("the 'static-port' option is "
2982 					    "only valid with nat rules");
2983 					YYERROR;
2984 				}
2985 				if (r.rpool.proxy_port[0] !=
2986 				    PF_NAT_PROXY_PORT_LOW &&
2987 				    r.rpool.proxy_port[1] !=
2988 				    PF_NAT_PROXY_PORT_HIGH) {
2989 					yyerror("the 'static-port' option can't"
2990 					    " be used when specifying a port"
2991 					    " range");
2992 					YYERROR;
2993 				}
2994 				r.rpool.proxy_port[0] = 0;
2995 				r.rpool.proxy_port[1] = 0;
2996 			}
2997 
2998 			expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4,
2999 			    $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
3000 			    $5.dst.port, 0, 0, 0);
3001 			free($7);
3002 		}
3003 		;
3004 
3005 binatrule	: no BINAT natpass interface af proto FROM host TO ipspec tag
3006 		    redirection
3007 		{
3008 			struct pf_rule		binat;
3009 			struct pf_pooladdr	*pa;
3010 
3011 			if (check_rulestate(PFCTL_STATE_NAT))
3012 				YYERROR;
3013 
3014 			memset(&binat, 0, sizeof(binat));
3015 
3016 			if ($1)
3017 				binat.action = PF_NOBINAT;
3018 			else
3019 				binat.action = PF_BINAT;
3020 			binat.natpass = $3;
3021 			binat.af = $5;
3022 			if (!binat.af && $8 != NULL && $8->af)
3023 				binat.af = $8->af;
3024 			if (!binat.af && $10 != NULL && $10->af)
3025 				binat.af = $10->af;
3026 			if (!binat.af && $12 != NULL && $12->host)
3027 				binat.af = $12->host->af;
3028 			if (!binat.af) {
3029 				yyerror("address family (inet/inet6) "
3030 				    "undefined");
3031 				YYERROR;
3032 			}
3033 
3034 			if ($4 != NULL) {
3035 				memcpy(binat.ifname, $4->ifname,
3036 				    sizeof(binat.ifname));
3037 				binat.ifnot = $4->not;
3038 				free($4);
3039 			}
3040 			if ($11 != NULL)
3041 				if (strlcpy(binat.tagname, $11,
3042 				    PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
3043 					yyerror("tag too long, max %u chars",
3044 					    PF_TAG_NAME_SIZE - 1);
3045 					YYERROR;
3046 				}
3047 
3048 			if ($6 != NULL) {
3049 				binat.proto = $6->proto;
3050 				free($6);
3051 			}
3052 
3053 			if ($8 != NULL && disallow_table($8, "invalid use of "
3054 			    "table <%s> as the source address of a binat rule"))
3055 				YYERROR;
3056 			if ($12 != NULL && $12->host != NULL && disallow_table(
3057 			    $12->host, "invalid use of table <%s> as the "
3058 			    "redirect address of a binat rule"))
3059 				YYERROR;
3060 
3061 			if ($8 != NULL) {
3062 				if ($8->next) {
3063 					yyerror("multiple binat ip addresses");
3064 					YYERROR;
3065 				}
3066 				if ($8->af != binat.af) {
3067 					yyerror("binat ip versions must match");
3068 					YYERROR;
3069 				}
3070 				if (check_netmask($8, binat.af))
3071 					YYERROR;
3072 				memcpy(&binat.src.addr, &$8->addr,
3073 				    sizeof(binat.src.addr));
3074 				free($8);
3075 			}
3076 			if ($10 != NULL) {
3077 				if ($10->next) {
3078 					yyerror("multiple binat ip addresses");
3079 					YYERROR;
3080 				}
3081 				if ($10->af != binat.af && $10->af) {
3082 					yyerror("binat ip versions must match");
3083 					YYERROR;
3084 				}
3085 				if (check_netmask($10, binat.af))
3086 					YYERROR;
3087 				memcpy(&binat.dst.addr, &$10->addr,
3088 				    sizeof(binat.dst.addr));
3089 				binat.dst.not = $10->not;
3090 				free($10);
3091 			}
3092 
3093 			if (binat.action == PF_NOBINAT) {
3094 				if ($12 != NULL) {
3095 					yyerror("'no binat' rule does not need"
3096 					    " '->'");
3097 					YYERROR;
3098 				}
3099 			} else {
3100 				if ($12 == NULL || $12->host == NULL) {
3101 					yyerror("'binat' rule requires"
3102 					    " '-> address'");
3103 					YYERROR;
3104 				}
3105 
3106 				remove_invalid_hosts(&$12->host, &binat.af);
3107 				if (invalid_redirect($12->host, binat.af))
3108 					YYERROR;
3109 				if ($12->host->next != NULL) {
3110 					yyerror("binat rule must redirect to "
3111 					    "a single address");
3112 					YYERROR;
3113 				}
3114 				if (check_netmask($12->host, binat.af))
3115 					YYERROR;
3116 
3117 				if (!PF_AZERO(&binat.src.addr.v.a.mask,
3118 				    binat.af) &&
3119 				    !PF_AEQ(&binat.src.addr.v.a.mask,
3120 				    &$12->host->addr.v.a.mask, binat.af)) {
3121 					yyerror("'binat' source mask and "
3122 					    "redirect mask must be the same");
3123 					YYERROR;
3124 				}
3125 
3126 				TAILQ_INIT(&binat.rpool.list);
3127 				pa = calloc(1, sizeof(struct pf_pooladdr));
3128 				if (pa == NULL)
3129 					err(1, "binat: calloc");
3130 				pa->addr = $12->host->addr;
3131 				pa->ifname[0] = 0;
3132 				TAILQ_INSERT_TAIL(&binat.rpool.list,
3133 				    pa, entries);
3134 
3135 				free($12);
3136 			}
3137 
3138 			pfctl_add_rule(pf, &binat);
3139 		}
3140 		;
3141 
3142 tag		: /* empty */		{ $$ = NULL; }
3143 		| TAG STRING		{ $$ = $2; }
3144 		;
3145 
3146 route_host	: STRING			{
3147 			$$ = calloc(1, sizeof(struct node_host));
3148 			if ($$ == NULL)
3149 				err(1, "route_host: calloc");
3150 			$$->ifname = $1;
3151 			if (ifa_exists($$->ifname, 0) == NULL) {
3152 				yyerror("routeto: unknown interface %s",
3153 				    $$->ifname);
3154 				free($1);
3155 				free($$);
3156 				YYERROR;
3157 			}
3158 			set_ipmask($$, 128);
3159 			$$->next = NULL;
3160 			$$->tail = $$;
3161 		}
3162 		| '(' STRING host ')'		{
3163 			$$ = $3;
3164 			$$->ifname = $2;
3165 			if (ifa_exists($$->ifname, 0) == NULL) {
3166 				yyerror("routeto: unknown interface %s",
3167 				    $$->ifname);
3168 				YYERROR;
3169 			}
3170 		}
3171 		;
3172 
3173 route_host_list	: route_host				{ $$ = $1; }
3174 		| route_host_list comma route_host	{
3175 			if ($1->af == 0)
3176 				$1->af = $3->af;
3177 			if ($1->af != $3->af) {
3178 				yyerror("all pool addresses must be in the "
3179 				    "same address family");
3180 				YYERROR;
3181 			}
3182 			$1->tail->next = $3;
3183 			$1->tail = $3->tail;
3184 			$$ = $1;
3185 		}
3186 		;
3187 
3188 routespec	: route_host			{ $$ = $1; }
3189 		| '{' route_host_list '}'	{ $$ = $2; }
3190 		;
3191 
3192 route		: /* empty */			{
3193 			$$.host = NULL;
3194 			$$.rt = 0;
3195 			$$.pool_opts = 0;
3196 		}
3197 		| FASTROUTE {
3198 			$$.host = NULL;
3199 			$$.rt = PF_FASTROUTE;
3200 			$$.pool_opts = 0;
3201 		}
3202 		| ROUTETO routespec pool_opts {
3203 			$$.host = $2;
3204 			$$.rt = PF_ROUTETO;
3205 			$$.pool_opts = $3.type | $3.opts;
3206 			if ($3.key != NULL)
3207 				$$.key = $3.key;
3208 		}
3209 		| REPLYTO routespec pool_opts {
3210 			$$.host = $2;
3211 			$$.rt = PF_REPLYTO;
3212 			$$.pool_opts = $3.type | $3.opts;
3213 			if ($3.key != NULL)
3214 				$$.key = $3.key;
3215 		}
3216 		| DUPTO routespec pool_opts {
3217 			$$.host = $2;
3218 			$$.rt = PF_DUPTO;
3219 			$$.pool_opts = $3.type | $3.opts;
3220 			if ($3.key != NULL)
3221 				$$.key = $3.key;
3222 		}
3223 		;
3224 
3225 timeout_spec	: STRING number
3226 		{
3227 			if (check_rulestate(PFCTL_STATE_OPTION)) {
3228 				free($1);
3229 				YYERROR;
3230 			}
3231 			if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
3232 				yyerror("unknown timeout %s", $1);
3233 				free($1);
3234 				YYERROR;
3235 			}
3236 			free($1);
3237 		}
3238 		;
3239 
3240 timeout_list	: timeout_list comma timeout_spec
3241 		| timeout_spec
3242 		;
3243 
3244 limit_spec	: STRING number
3245 		{
3246 			if (check_rulestate(PFCTL_STATE_OPTION)) {
3247 				free($1);
3248 				YYERROR;
3249 			}
3250 			if (pfctl_set_limit(pf, $1, $2) != 0) {
3251 				yyerror("unable to set limit %s %u", $1, $2);
3252 				free($1);
3253 				YYERROR;
3254 			}
3255 			free($1);
3256 		}
3257 		;
3258 
3259 limit_list	: limit_list comma limit_spec
3260 		| limit_spec
3261 		;
3262 
3263 comma		: ','
3264 		| /* empty */
3265 		;
3266 
3267 yesno		: NO			{ $$ = 0; }
3268 		| STRING		{
3269 			if (!strcmp($1, "yes"))
3270 				$$ = 1;
3271 			else {
3272 				free($1);
3273 				YYERROR;
3274 			}
3275 			free($1);
3276 		}
3277 		;
3278 
3279 unaryop		: '='		{ $$ = PF_OP_EQ; }
3280 		| '!' '='	{ $$ = PF_OP_NE; }
3281 		| '<' '='	{ $$ = PF_OP_LE; }
3282 		| '<'		{ $$ = PF_OP_LT; }
3283 		| '>' '='	{ $$ = PF_OP_GE; }
3284 		| '>'		{ $$ = PF_OP_GT; }
3285 		;
3286 
3287 %%
3288 
3289 int
3290 yyerror(const char *fmt, ...)
3291 {
3292 	va_list		 ap;
3293 	extern char	*infile;
3294 
3295 	errors = 1;
3296 	va_start(ap, fmt);
3297 	fprintf(stderr, "%s:%d: ", infile, yylval.lineno);
3298 	vfprintf(stderr, fmt, ap);
3299 	fprintf(stderr, "\n");
3300 	va_end(ap);
3301 	return (0);
3302 }
3303 
3304 int
disallow_table(struct node_host * h,const char * fmt)3305 disallow_table(struct node_host *h, const char *fmt)
3306 {
3307 	for (; h != NULL; h = h->next)
3308 		if (h->addr.type == PF_ADDR_TABLE) {
3309 			yyerror(fmt, h->addr.v.tblname);
3310 			return (1);
3311 		}
3312 	return (0);
3313 }
3314 
3315 int
rule_consistent(struct pf_rule * r)3316 rule_consistent(struct pf_rule *r)
3317 {
3318 	int	problems = 0;
3319 
3320 	switch (r->action) {
3321 	case PF_PASS:
3322 	case PF_DROP:
3323 	case PF_SCRUB:
3324 		problems = filter_consistent(r);
3325 		break;
3326 	case PF_NAT:
3327 	case PF_NONAT:
3328 		problems = nat_consistent(r);
3329 		break;
3330 	case PF_RDR:
3331 	case PF_NORDR:
3332 		problems = rdr_consistent(r);
3333 		break;
3334 	case PF_BINAT:
3335 	case PF_NOBINAT:
3336 	default:
3337 		break;
3338 	}
3339 	return (problems);
3340 }
3341 
3342 int
filter_consistent(struct pf_rule * r)3343 filter_consistent(struct pf_rule *r)
3344 {
3345 	int	problems = 0;
3346 
3347 	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
3348 	    (r->src.port_op || r->dst.port_op)) {
3349 		yyerror("port only applies to tcp/udp");
3350 		problems++;
3351 	}
3352 	if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
3353 	    (r->type || r->code)) {
3354 		yyerror("icmp-type/code only applies to icmp");
3355 		problems++;
3356 	}
3357 	if (!r->af && (r->type || r->code)) {
3358 		yyerror("must indicate address family with icmp-type/code");
3359 		problems++;
3360 	}
3361 	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
3362 	    (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
3363 		yyerror("proto %s doesn't match address family %s",
3364 		    r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
3365 		    r->af == AF_INET ? "inet" : "inet6");
3366 		problems++;
3367 	}
3368 	if (r->allow_opts && r->action != PF_PASS) {
3369 		yyerror("allow-opts can only be specified for pass rules");
3370 		problems++;
3371 	}
3372 	if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
3373 	    r->dst.port_op || r->flagset || r->type || r->code)) {
3374 		yyerror("fragments can be filtered only on IP header fields");
3375 		problems++;
3376 	}
3377 	if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
3378 		yyerror("return-rst can only be applied to TCP rules");
3379 		problems++;
3380 	}
3381 	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
3382 		yyerror("max-src-nodes requires 'source-track rule'");
3383 		problems++;
3384 	}
3385 	if (r->action == PF_DROP && r->keep_state) {
3386 		yyerror("keep state on block rules doesn't make sense");
3387 		problems++;
3388 	}
3389 	if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state &&
3390 	    r->action == PF_PASS && !r->anchorname[0]) {
3391 		yyerror("tags cannot be used without keep state");
3392 		problems++;
3393 	}
3394 	return (-problems);
3395 }
3396 
3397 int
nat_consistent(struct pf_rule * r)3398 nat_consistent(struct pf_rule *r)
3399 {
3400 	return (0);	/* yeah! */
3401 }
3402 
3403 int
rdr_consistent(struct pf_rule * r)3404 rdr_consistent(struct pf_rule *r)
3405 {
3406 	int			 problems = 0;
3407 
3408 	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
3409 		if (r->src.port_op) {
3410 			yyerror("src port only applies to tcp/udp");
3411 			problems++;
3412 		}
3413 		if (r->dst.port_op) {
3414 			yyerror("dst port only applies to tcp/udp");
3415 			problems++;
3416 		}
3417 		if (r->rpool.proxy_port[0]) {
3418 			yyerror("rpool port only applies to tcp/udp");
3419 			problems++;
3420 		}
3421 	}
3422 	if (r->dst.port_op &&
3423 	    r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
3424 		yyerror("invalid port operator for rdr destination port");
3425 		problems++;
3426 	}
3427 	return (-problems);
3428 }
3429 
3430 int
process_tabledef(char * name,struct table_opts * opts)3431 process_tabledef(char *name, struct table_opts *opts)
3432 {
3433 	struct pfr_buffer	 ab;
3434 	struct node_tinit	*ti;
3435 
3436 	bzero(&ab, sizeof(ab));
3437 	ab.pfrb_type = PFRB_ADDRS;
3438 	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
3439 		if (ti->file)
3440 			if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
3441 				if (errno)
3442 					yyerror("cannot load \"%s\": %s",
3443 					    ti->file, strerror(errno));
3444 				else
3445 					yyerror("file \"%s\" contains bad data",
3446 					    ti->file);
3447 				goto _error;
3448 			}
3449 		if (ti->host)
3450 			if (append_addr_host(&ab, ti->host, 0, 0)) {
3451 				yyerror("cannot create address buffer: %s",
3452 				    strerror(errno));
3453 				goto _error;
3454 			}
3455 	}
3456 	if (pf->opts & PF_OPT_VERBOSE)
3457 		print_tabledef(name, opts->flags, opts->init_addr,
3458 		    &opts->init_nodes);
3459 	if (!(pf->opts & PF_OPT_NOACTION) &&
3460 	    pfctl_define_table(name, opts->flags, opts->init_addr,
3461 	    pf->anchor, pf->ruleset, &ab, pf->tticket)) {
3462 		yyerror("cannot define table %s: %s", name,
3463 		    pfr_strerror(errno));
3464 		goto _error;
3465 	}
3466 	pf->tdirty = 1;
3467 	pfr_buf_clear(&ab);
3468 	return (0);
3469 _error:
3470 	pfr_buf_clear(&ab);
3471 	return (-1);
3472 }
3473 
3474 struct keywords {
3475 	const char	*k_name;
3476 	int		 k_val;
3477 };
3478 
3479 /* macro gore, but you should've seen the prior indentation nightmare... */
3480 
3481 #define FREE_LIST(T,r) \
3482 	do { \
3483 		T *p, *node = r; \
3484 		while (node != NULL) { \
3485 			p = node; \
3486 			node = node->next; \
3487 			free(p); \
3488 		} \
3489 	} while (0)
3490 
3491 #define LOOP_THROUGH(T,n,r,C) \
3492 	do { \
3493 		T *n; \
3494 		if (r == NULL) { \
3495 			r = calloc(1, sizeof(T)); \
3496 			if (r == NULL) \
3497 				err(1, "LOOP: calloc"); \
3498 			r->next = NULL; \
3499 		} \
3500 		n = r; \
3501 		while (n != NULL) { \
3502 			do { \
3503 				C; \
3504 			} while (0); \
3505 			n = n->next; \
3506 		} \
3507 	} while (0)
3508 
3509 void
expand_label_str(char * label,size_t len,const char * srch,const char * repl)3510 expand_label_str(char *label, size_t len, const char *srch, const char *repl)
3511 {
3512 	char *tmp;
3513 	char *p, *q;
3514 
3515 	if ((tmp = calloc(1, len)) == NULL)
3516 		err(1, "expand_label_str: calloc");
3517 	p = q = label;
3518 	while ((q = strstr(p, srch)) != NULL) {
3519 		*q = '\0';
3520 		if ((strlcat(tmp, p, len) >= len) ||
3521 		    (strlcat(tmp, repl, len) >= len))
3522 			errx(1, "expand_label: label too long");
3523 		q += strlen(srch);
3524 		p = q;
3525 	}
3526 	if (strlcat(tmp, p, len) >= len)
3527 		errx(1, "expand_label: label too long");
3528 	strlcpy(label, tmp, len);	/* always fits */
3529 	free(tmp);
3530 }
3531 
3532 void
expand_label_if(const char * name,char * label,size_t len,const char * ifname)3533 expand_label_if(const char *name, char *label, size_t len, const char *ifname)
3534 {
3535 	if (strstr(label, name) != NULL) {
3536 		if (!*ifname)
3537 			expand_label_str(label, len, name, "any");
3538 		else
3539 			expand_label_str(label, len, name, ifname);
3540 	}
3541 }
3542 
3543 void
expand_label_addr(const char * name,char * label,size_t len,sa_family_t af,struct node_host * h)3544 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
3545     struct node_host *h)
3546 {
3547 	char tmp[64], tmp_not[66];
3548 
3549 	if (strstr(label, name) != NULL) {
3550 		switch (h->addr.type) {
3551 		case PF_ADDR_TABLE:
3552 			snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
3553 			break;
3554 		case PF_ADDR_NOROUTE:
3555 			snprintf(tmp, sizeof(tmp), "no-route");
3556 			break;
3557 		case PF_ADDR_ADDRMASK:
3558 			if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
3559 			    PF_AZERO(&h->addr.v.a.mask, af)))
3560 				snprintf(tmp, sizeof(tmp), "any");
3561 			else {
3562 				char	a[48];
3563 				int	bits;
3564 
3565 				if (inet_ntop(af, &h->addr.v.a.addr, a,
3566 				    sizeof(a)) == NULL)
3567 					snprintf(tmp, sizeof(tmp), "?");
3568 				else {
3569 					bits = unmask(&h->addr.v.a.mask, af);
3570 					if ((af == AF_INET && bits < 32) ||
3571 					    (af == AF_INET6 && bits < 128))
3572 						snprintf(tmp, sizeof(tmp),
3573 						    "%s/%d", a, bits);
3574 					else
3575 						snprintf(tmp, sizeof(tmp),
3576 						    "%s", a);
3577 				}
3578 			}
3579 			break;
3580 		default:
3581 			snprintf(tmp, sizeof(tmp), "?");
3582 			break;
3583 		}
3584 
3585 		if (h->not) {
3586 			snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
3587 			expand_label_str(label, len, name, tmp_not);
3588 		} else
3589 			expand_label_str(label, len, name, tmp);
3590 	}
3591 }
3592 
3593 void
expand_label_port(const char * name,char * label,size_t len,struct node_port * port)3594 expand_label_port(const char *name, char *label, size_t len,
3595     struct node_port *port)
3596 {
3597 	char	 a1[6], a2[6], op[13] = "";
3598 
3599 	if (strstr(label, name) != NULL) {
3600 		snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
3601 		snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
3602 		if (!port->op)
3603 			;
3604 		else if (port->op == PF_OP_IRG)
3605 			snprintf(op, sizeof(op), "%s><%s", a1, a2);
3606 		else if (port->op == PF_OP_XRG)
3607 			snprintf(op, sizeof(op), "%s<>%s", a1, a2);
3608 		else if (port->op == PF_OP_EQ)
3609 			snprintf(op, sizeof(op), "%s", a1);
3610 		else if (port->op == PF_OP_NE)
3611 			snprintf(op, sizeof(op), "!=%s", a1);
3612 		else if (port->op == PF_OP_LT)
3613 			snprintf(op, sizeof(op), "<%s", a1);
3614 		else if (port->op == PF_OP_LE)
3615 			snprintf(op, sizeof(op), "<=%s", a1);
3616 		else if (port->op == PF_OP_GT)
3617 			snprintf(op, sizeof(op), ">%s", a1);
3618 		else if (port->op == PF_OP_GE)
3619 			snprintf(op, sizeof(op), ">=%s", a1);
3620 		expand_label_str(label, len, name, op);
3621 	}
3622 }
3623 
3624 void
expand_label_proto(const char * name,char * label,size_t len,u_int8_t proto)3625 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
3626 {
3627 	struct protoent *pe;
3628 	char n[4];
3629 
3630 	if (strstr(label, name) != NULL) {
3631 		pe = getprotobynumber(proto);
3632 		if (pe != NULL)
3633 			expand_label_str(label, len, name, pe->p_name);
3634 		else {
3635 			snprintf(n, sizeof(n), "%u", proto);
3636 			expand_label_str(label, len, name, n);
3637 		}
3638 	}
3639 }
3640 
3641 void
expand_label_nr(const char * name,char * label,size_t len)3642 expand_label_nr(const char *name, char *label, size_t len)
3643 {
3644 	char n[11];
3645 
3646 	if (strstr(label, name) != NULL) {
3647 		snprintf(n, sizeof(n), "%u", pf->rule_nr);
3648 		expand_label_str(label, len, name, n);
3649 	}
3650 }
3651 
3652 void
expand_label(char * label,size_t len,const char * ifname,sa_family_t af,struct node_host * src_host,struct node_port * src_port,struct node_host * dst_host,struct node_port * dst_port,u_int8_t proto)3653 expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
3654     struct node_host *src_host, struct node_port *src_port,
3655     struct node_host *dst_host, struct node_port *dst_port,
3656     u_int8_t proto)
3657 {
3658 	expand_label_if("$if", label, len, ifname);
3659 	expand_label_addr("$srcaddr", label, len, af, src_host);
3660 	expand_label_addr("$dstaddr", label, len, af, dst_host);
3661 	expand_label_port("$srcport", label, len, src_port);
3662 	expand_label_port("$dstport", label, len, dst_port);
3663 	expand_label_proto("$proto", label, len, proto);
3664 	expand_label_nr("$nr", label, len);
3665 }
3666 
3667 int
expand_altq(struct pf_altq * a,struct node_if * interfaces,struct node_queue * nqueues,struct node_queue_bw bwspec,struct node_queue_opt * opts)3668 expand_altq(struct pf_altq *a, struct node_if *interfaces,
3669     struct node_queue *nqueues, struct node_queue_bw bwspec,
3670     struct node_queue_opt *opts)
3671 {
3672 	struct pf_altq		 pa, pb;
3673 	char			 qname[PF_QNAME_SIZE];
3674 	struct node_queue	*n;
3675 	struct node_queue_bw	 bw;
3676 	int			 errs = 0;
3677 
3678 	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
3679 		FREE_LIST(struct node_if, interfaces);
3680 		FREE_LIST(struct node_queue, nqueues);
3681 		return (0);
3682 	}
3683 
3684 	LOOP_THROUGH(struct node_if, interface, interfaces,
3685 		memcpy(&pa, a, sizeof(struct pf_altq));
3686 		if (strlcpy(pa.ifname, interface->ifname,
3687 		    sizeof(pa.ifname)) >= sizeof(pa.ifname))
3688 			errx(1, "expand_altq: strlcpy");
3689 
3690 		if (interface->not) {
3691 			yyerror("altq on ! <interface> is not supported");
3692 			errs++;
3693 		} else {
3694 			if (eval_pfaltq(pf, &pa, &bwspec, opts))
3695 				errs++;
3696 			else
3697 				if (pfctl_add_altq(pf, &pa))
3698 					errs++;
3699 
3700 			if (pf->opts & PF_OPT_VERBOSE) {
3701 				print_altq(&pf->paltq->altq, 0,
3702 				    &bwspec, opts);
3703 				if (nqueues && nqueues->tail) {
3704 					printf("queue { ");
3705 					LOOP_THROUGH(struct node_queue, queue,
3706 					    nqueues,
3707 						printf("%s ",
3708 						    queue->queue);
3709 					);
3710 					printf("}");
3711 				}
3712 				printf("\n");
3713 			}
3714 
3715 			if (pa.scheduler == ALTQT_CBQ ||
3716 			    pa.scheduler == ALTQT_HFSC) {
3717 				/* now create a root queue */
3718 				memset(&pb, 0, sizeof(struct pf_altq));
3719 				if (strlcpy(qname, "root_", sizeof(qname)) >=
3720 				    sizeof(qname))
3721 					errx(1, "expand_altq: strlcpy");
3722 				if (strlcat(qname, interface->ifname,
3723 				    sizeof(qname)) >= sizeof(qname))
3724 					errx(1, "expand_altq: strlcat");
3725 				if (strlcpy(pb.qname, qname,
3726 				    sizeof(pb.qname)) >= sizeof(pb.qname))
3727 					errx(1, "expand_altq: strlcpy");
3728 				if (strlcpy(pb.ifname, interface->ifname,
3729 				    sizeof(pb.ifname)) >= sizeof(pb.ifname))
3730 					errx(1, "expand_altq: strlcpy");
3731 				pb.qlimit = pa.qlimit;
3732 				pb.scheduler = pa.scheduler;
3733 				bw.bw_absolute = pa.ifbandwidth;
3734 				bw.bw_percent = 0;
3735 				if (eval_pfqueue(pf, &pb, &bw, opts))
3736 					errs++;
3737 				else
3738 					if (pfctl_add_altq(pf, &pb))
3739 						errs++;
3740 			}
3741 
3742 			LOOP_THROUGH(struct node_queue, queue, nqueues,
3743 				n = calloc(1, sizeof(struct node_queue));
3744 				if (n == NULL)
3745 					err(1, "expand_altq: calloc");
3746 				if (pa.scheduler == ALTQT_CBQ ||
3747 				    pa.scheduler == ALTQT_HFSC)
3748 					if (strlcpy(n->parent, qname,
3749 					    sizeof(n->parent)) >=
3750 					    sizeof(n->parent))
3751 						errx(1, "expand_altq: strlcpy");
3752 				if (strlcpy(n->queue, queue->queue,
3753 				    sizeof(n->queue)) >= sizeof(n->queue))
3754 					errx(1, "expand_altq: strlcpy");
3755 				if (strlcpy(n->ifname, interface->ifname,
3756 				    sizeof(n->ifname)) >= sizeof(n->ifname))
3757 					errx(1, "expand_altq: strlcpy");
3758 				n->scheduler = pa.scheduler;
3759 				n->next = NULL;
3760 				n->tail = n;
3761 				if (queues == NULL)
3762 					queues = n;
3763 				else {
3764 					queues->tail->next = n;
3765 					queues->tail = n;
3766 				}
3767 			);
3768 		}
3769 	);
3770 	FREE_LIST(struct node_if, interfaces);
3771 	FREE_LIST(struct node_queue, nqueues);
3772 
3773 	return (errs);
3774 }
3775 
3776 int
expand_queue(struct pf_altq * a,struct node_if * interfaces,struct node_queue * nqueues,struct node_queue_bw bwspec,struct node_queue_opt * opts)3777 expand_queue(struct pf_altq *a, struct node_if *interfaces,
3778     struct node_queue *nqueues, struct node_queue_bw bwspec,
3779     struct node_queue_opt *opts)
3780 {
3781 	struct node_queue	*n, *nq;
3782 	struct pf_altq		 pa;
3783 	u_int8_t		 found = 0;
3784 	u_int8_t		 errs = 0;
3785 
3786 	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
3787 		FREE_LIST(struct node_queue, nqueues);
3788 		return (0);
3789 	}
3790 
3791 	if (queues == NULL) {
3792 		yyerror("queue %s has no parent", a->qname);
3793 		FREE_LIST(struct node_queue, nqueues);
3794 		return (1);
3795 	}
3796 
3797 	LOOP_THROUGH(struct node_if, interface, interfaces,
3798 		LOOP_THROUGH(struct node_queue, tqueue, queues,
3799 			if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
3800 			    (interface->ifname[0] == 0 ||
3801 			    (!interface->not && !strncmp(interface->ifname,
3802 			    tqueue->ifname, IFNAMSIZ)) ||
3803 			    (interface->not && strncmp(interface->ifname,
3804 			    tqueue->ifname, IFNAMSIZ)))) {
3805 				/* found ourself in queues */
3806 				found++;
3807 
3808 				memcpy(&pa, a, sizeof(struct pf_altq));
3809 
3810 				if (pa.scheduler != ALTQT_NONE &&
3811 				    pa.scheduler != tqueue->scheduler) {
3812 					yyerror("exactly one scheduler type "
3813 					    "per interface allowed");
3814 					return (1);
3815 				}
3816 				pa.scheduler = tqueue->scheduler;
3817 
3818 				/* scheduler dependent error checking */
3819 				switch (pa.scheduler) {
3820 				case ALTQT_PRIQ:
3821 					if (nqueues != NULL) {
3822 						yyerror("priq queues cannot "
3823 						    "have child queues");
3824 						return (1);
3825 					}
3826 					if (bwspec.bw_absolute > 0 ||
3827 					    bwspec.bw_percent < 100) {
3828 						yyerror("priq doesn't take "
3829 						    "bandwidth");
3830 						return (1);
3831 					}
3832 					break;
3833 				default:
3834 					break;
3835 				}
3836 
3837 				if (strlcpy(pa.ifname, tqueue->ifname,
3838 				    sizeof(pa.ifname)) >= sizeof(pa.ifname))
3839 					errx(1, "expand_queue: strlcpy");
3840 				if (strlcpy(pa.parent, tqueue->parent,
3841 				    sizeof(pa.parent)) >= sizeof(pa.parent))
3842 					errx(1, "expand_queue: strlcpy");
3843 
3844 				if (eval_pfqueue(pf, &pa, &bwspec, opts))
3845 					errs++;
3846 				else
3847 					if (pfctl_add_altq(pf, &pa))
3848 						errs++;
3849 
3850 				for (nq = nqueues; nq != NULL; nq = nq->next) {
3851 					if (!strcmp(a->qname, nq->queue)) {
3852 						yyerror("queue cannot have "
3853 						    "itself as child");
3854 						errs++;
3855 						continue;
3856 					}
3857 					n = calloc(1,
3858 					    sizeof(struct node_queue));
3859 					if (n == NULL)
3860 						err(1, "expand_queue: calloc");
3861 					if (strlcpy(n->parent, a->qname,
3862 					    sizeof(n->parent)) >=
3863 					    sizeof(n->parent))
3864 						errx(1, "expand_queue strlcpy");
3865 					if (strlcpy(n->queue, nq->queue,
3866 					    sizeof(n->queue)) >=
3867 					    sizeof(n->queue))
3868 						errx(1, "expand_queue strlcpy");
3869 					if (strlcpy(n->ifname, tqueue->ifname,
3870 					    sizeof(n->ifname)) >=
3871 					    sizeof(n->ifname))
3872 						errx(1, "expand_queue strlcpy");
3873 					n->scheduler = tqueue->scheduler;
3874 					n->next = NULL;
3875 					n->tail = n;
3876 					if (queues == NULL)
3877 						queues = n;
3878 					else {
3879 						queues->tail->next = n;
3880 						queues->tail = n;
3881 					}
3882 				}
3883 				if ((pf->opts & PF_OPT_VERBOSE) && (
3884 				    (found == 1 && interface->ifname[0] == 0) ||
3885 				    (found > 0 && interface->ifname[0] != 0))) {
3886 					print_queue(&pf->paltq->altq, 0,
3887 					    &bwspec, interface->ifname[0] != 0,
3888 					    opts);
3889 					if (nqueues && nqueues->tail) {
3890 						printf("{ ");
3891 						LOOP_THROUGH(struct node_queue,
3892 						    queue, nqueues,
3893 							printf("%s ",
3894 							    queue->queue);
3895 						);
3896 						printf("}");
3897 					}
3898 					printf("\n");
3899 				}
3900 			}
3901 		);
3902 	);
3903 
3904 	FREE_LIST(struct node_queue, nqueues);
3905 	FREE_LIST(struct node_if, interfaces);
3906 
3907 	if (!found) {
3908 		yyerror("queue %s has no parent", a->qname);
3909 		errs++;
3910 	}
3911 
3912 	if (errs)
3913 		return (1);
3914 	else
3915 		return (0);
3916 }
3917 
3918 void
expand_rule(struct pf_rule * r,struct node_if * interfaces,struct node_host * rpool_hosts,struct node_proto * protos,struct node_os * src_oses,struct node_host * src_hosts,struct node_port * src_ports,struct node_host * dst_hosts,struct node_port * dst_ports,struct node_uid * uids,struct node_gid * gids,struct node_icmp * icmp_types)3919 expand_rule(struct pf_rule *r,
3920     struct node_if *interfaces, struct node_host *rpool_hosts,
3921     struct node_proto *protos, struct node_os *src_oses,
3922     struct node_host *src_hosts, struct node_port *src_ports,
3923     struct node_host *dst_hosts, struct node_port *dst_ports,
3924     struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types)
3925 {
3926 	sa_family_t		 af = r->af;
3927 	int			 added = 0, error = 0;
3928 	char			 ifname[IF_NAMESIZE];
3929 	char			 label[PF_RULE_LABEL_SIZE];
3930 	char			 tagname[PF_TAG_NAME_SIZE];
3931 	char			 match_tagname[PF_TAG_NAME_SIZE];
3932 	struct pf_pooladdr	*pa;
3933 	struct node_host	*h;
3934 	u_int8_t		 flags, flagset, keep_state;
3935 
3936 	if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
3937 		errx(1, "expand_rule: strlcpy");
3938 	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
3939 		errx(1, "expand_rule: strlcpy");
3940 	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
3941 	    sizeof(match_tagname))
3942 		errx(1, "expand_rule: strlcpy");
3943 	flags = r->flags;
3944 	flagset = r->flagset;
3945 	keep_state = r->keep_state;
3946 
3947 	LOOP_THROUGH(struct node_if, interface, interfaces,
3948 	LOOP_THROUGH(struct node_proto, proto, protos,
3949 	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
3950 	LOOP_THROUGH(struct node_host, src_host, src_hosts,
3951 	LOOP_THROUGH(struct node_port, src_port, src_ports,
3952 	LOOP_THROUGH(struct node_os, src_os, src_oses,
3953 	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
3954 	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
3955 	LOOP_THROUGH(struct node_uid, uid, uids,
3956 	LOOP_THROUGH(struct node_gid, gid, gids,
3957 
3958 		r->af = af;
3959 		/* for link-local IPv6 address, interface must match up */
3960 		if ((r->af && src_host->af && r->af != src_host->af) ||
3961 		    (r->af && dst_host->af && r->af != dst_host->af) ||
3962 		    (src_host->af && dst_host->af &&
3963 		    src_host->af != dst_host->af) ||
3964 		    (src_host->ifindex && dst_host->ifindex &&
3965 		    src_host->ifindex != dst_host->ifindex) ||
3966 		    (src_host->ifindex && *interface->ifname &&
3967 		    src_host->ifindex != if_nametoindex(interface->ifname)) ||
3968 		    (dst_host->ifindex && *interface->ifname &&
3969 		    dst_host->ifindex != if_nametoindex(interface->ifname)))
3970 			continue;
3971 		if (!r->af && src_host->af)
3972 			r->af = src_host->af;
3973 		else if (!r->af && dst_host->af)
3974 			r->af = dst_host->af;
3975 
3976 		if (*interface->ifname)
3977 			memcpy(r->ifname, interface->ifname, sizeof(r->ifname));
3978 		else if (if_indextoname(src_host->ifindex, ifname))
3979 			memcpy(r->ifname, ifname, sizeof(r->ifname));
3980 		else if (if_indextoname(dst_host->ifindex, ifname))
3981 			memcpy(r->ifname, ifname, sizeof(r->ifname));
3982 		else
3983 			memset(r->ifname, '\0', sizeof(r->ifname));
3984 
3985 		if (strlcpy(r->label, label, sizeof(r->label)) >=
3986 		    sizeof(r->label))
3987 			errx(1, "expand_rule: strlcpy");
3988 		if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
3989 		    sizeof(r->tagname))
3990 			errx(1, "expand_rule: strlcpy");
3991 		if (strlcpy(r->match_tagname, match_tagname,
3992 		    sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
3993 			errx(1, "expand_rule: strlcpy");
3994 		expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
3995 		    src_host, src_port, dst_host, dst_port, proto->proto);
3996 		expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
3997 		    src_host, src_port, dst_host, dst_port, proto->proto);
3998 		expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
3999 		    r->af, src_host, src_port, dst_host, dst_port,
4000 		    proto->proto);
4001 
4002 		error += check_netmask(src_host, r->af);
4003 		error += check_netmask(dst_host, r->af);
4004 
4005 		r->ifnot = interface->not;
4006 		r->proto = proto->proto;
4007 		r->src.addr = src_host->addr;
4008 		r->src.not = src_host->not;
4009 		r->src.port[0] = src_port->port[0];
4010 		r->src.port[1] = src_port->port[1];
4011 		r->src.port_op = src_port->op;
4012 		r->dst.addr = dst_host->addr;
4013 		r->dst.not = dst_host->not;
4014 		r->dst.port[0] = dst_port->port[0];
4015 		r->dst.port[1] = dst_port->port[1];
4016 		r->dst.port_op = dst_port->op;
4017 		r->uid.op = uid->op;
4018 		r->uid.uid[0] = uid->uid[0];
4019 		r->uid.uid[1] = uid->uid[1];
4020 		r->gid.op = gid->op;
4021 		r->gid.gid[0] = gid->gid[0];
4022 		r->gid.gid[1] = gid->gid[1];
4023 		r->type = icmp_type->type;
4024 		r->code = icmp_type->code;
4025 
4026 		if ((keep_state == PF_STATE_MODULATE ||
4027 		    keep_state == PF_STATE_SYNPROXY) &&
4028 		    r->proto && r->proto != IPPROTO_TCP)
4029 			r->keep_state = PF_STATE_NORMAL;
4030 		else
4031 			r->keep_state = keep_state;
4032 
4033 		if (r->proto && r->proto != IPPROTO_TCP) {
4034 			r->flags = 0;
4035 			r->flagset = 0;
4036 		} else {
4037 			r->flags = flags;
4038 			r->flagset = flagset;
4039 		}
4040 		if (icmp_type->proto && r->proto != icmp_type->proto) {
4041 			yyerror("icmp-type mismatch");
4042 			error++;
4043 		}
4044 
4045 		if (src_os && src_os->os) {
4046 			r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
4047 			if ((pf->opts & PF_OPT_VERBOSE2) &&
4048 			    r->os_fingerprint == PF_OSFP_NOMATCH)
4049 				fprintf(stderr,
4050 				    "warning: unknown '%s' OS fingerprint\n",
4051 				    src_os->os);
4052 		} else {
4053 			r->os_fingerprint = PF_OSFP_ANY;
4054 		}
4055 
4056 		TAILQ_INIT(&r->rpool.list);
4057 		for (h = rpool_hosts; h != NULL; h = h->next) {
4058 			pa = calloc(1, sizeof(struct pf_pooladdr));
4059 			if (pa == NULL)
4060 				err(1, "expand_rule: calloc");
4061 			pa->addr = h->addr;
4062 			if (h->ifname != NULL) {
4063 				if (strlcpy(pa->ifname, h->ifname,
4064 				    sizeof(pa->ifname)) >=
4065 				    sizeof(pa->ifname))
4066 					errx(1, "expand_rule: strlcpy");
4067 			} else
4068 				pa->ifname[0] = 0;
4069 			TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
4070 		}
4071 
4072 		if (rule_consistent(r) < 0 || error)
4073 			yyerror("skipping rule due to errors");
4074 		else {
4075 			r->nr = pf->rule_nr++;
4076 			pfctl_add_rule(pf, r);
4077 			added++;
4078 		}
4079 
4080 	))))))))));
4081 
4082 	FREE_LIST(struct node_if, interfaces);
4083 	FREE_LIST(struct node_proto, protos);
4084 	FREE_LIST(struct node_host, src_hosts);
4085 	FREE_LIST(struct node_port, src_ports);
4086 	FREE_LIST(struct node_os, src_oses);
4087 	FREE_LIST(struct node_host, dst_hosts);
4088 	FREE_LIST(struct node_port, dst_ports);
4089 	FREE_LIST(struct node_uid, uids);
4090 	FREE_LIST(struct node_gid, gids);
4091 	FREE_LIST(struct node_icmp, icmp_types);
4092 	FREE_LIST(struct node_host, rpool_hosts);
4093 
4094 	if (!added)
4095 		yyerror("rule expands to no valid combination");
4096 }
4097 
4098 #undef FREE_LIST
4099 #undef LOOP_THROUGH
4100 
4101 int
check_rulestate(int desired_state)4102 check_rulestate(int desired_state)
4103 {
4104 	if (require_order && (rulestate > desired_state)) {
4105 		yyerror("Rules must be in order: options, normalization, "
4106 		    "queueing, translation, filtering");
4107 		return (1);
4108 	}
4109 	rulestate = desired_state;
4110 	return (0);
4111 }
4112 
4113 int
kw_cmp(const void * k,const void * e)4114 kw_cmp(const void *k, const void *e)
4115 {
4116 	return (strcmp(k, ((const struct keywords *)e)->k_name));
4117 }
4118 
4119 int
lookup(char * s)4120 lookup(char *s)
4121 {
4122 	/* this has to be sorted always */
4123 	static const struct keywords keywords[] = {
4124 		{ "all",		ALL},
4125 		{ "allow-opts",		ALLOWOPTS},
4126 		{ "altq",		ALTQ},
4127 		{ "anchor",		ANCHOR},
4128 		{ "any",		ANY},
4129 		{ "bandwidth",		BANDWIDTH},
4130 		{ "binat",		BINAT},
4131 		{ "binat-anchor",	BINATANCHOR},
4132 		{ "bitmask",		BITMASK},
4133 		{ "block",		BLOCK},
4134 		{ "block-policy",	BLOCKPOLICY},
4135 		{ "cbq",		CBQ},
4136 		{ "code",		CODE},
4137 		{ "crop",		FRAGCROP},
4138 		{ "debug",		DEBUG},
4139 		{ "drop",		DROP},
4140 		{ "drop-ovl",		FRAGDROP},
4141 		{ "dup-to",		DUPTO},
4142 		{ "fastroute",		FASTROUTE},
4143 		{ "file",		FILENAME},
4144 		{ "fingerprints",	FINGERPRINTS},
4145 		{ "flags",		FLAGS},
4146 		{ "floating",		FLOATING},
4147 		{ "for",		FOR},
4148 		{ "fragment",		FRAGMENT},
4149 		{ "from",		FROM},
4150 		{ "fuck-off",		FUCKOFF},
4151 		{ "global",		GLOBAL},
4152 		{ "group",		GROUP},
4153 		{ "group-bound",	GRBOUND},
4154 		{ "hfsc",		HFSC},
4155 		{ "hostid",		HOSTID},
4156 		{ "icmp-type",		ICMPTYPE},
4157 		{ "icmp6-type",		ICMP6TYPE},
4158 		{ "if-bound",		IFBOUND},
4159 		{ "in",			IN},
4160 		{ "inet",		INET},
4161 		{ "inet6",		INET6},
4162 		{ "keep",		KEEP},
4163 		{ "label",		LABEL},
4164 		{ "limit",		LIMIT},
4165 		{ "linkshare",		LINKSHARE},
4166 		{ "load",		LOAD},
4167 		{ "log",		LOG},
4168 		{ "log-all",		LOGALL},
4169 		{ "loginterface",	LOGINTERFACE},
4170 		{ "max",		MAXIMUM},
4171 		{ "max-mss",		MAXMSS},
4172 		{ "max-src-nodes",	MAXSRCNODES},
4173 		{ "max-src-states",	MAXSRCSTATES},
4174 		{ "min-ttl",		MINTTL},
4175 		{ "modulate",		MODULATE},
4176 		{ "nat",		NAT},
4177 		{ "nat-anchor",		NATANCHOR},
4178 		{ "no",			NO},
4179 		{ "no-df",		NODF},
4180 		{ "no-route",		NOROUTE},
4181 		{ "no-sync",		NOSYNC},
4182 		{ "on",			ON},
4183 		{ "optimization",	OPTIMIZATION},
4184 		{ "os",			OS},
4185 		{ "out",		OUT},
4186 		{ "pass",		PASS},
4187 		{ "port",		PORT},
4188 		{ "priority",		PRIORITY},
4189 		{ "priq",		PRIQ},
4190 		{ "probability",	PROBABILITY},
4191 		{ "proto",		PROTO},
4192 		{ "qlimit",		QLIMIT},
4193 		{ "queue",		QUEUE},
4194 		{ "quick",		QUICK},
4195 		{ "random",		RANDOM},
4196 		{ "random-id",		RANDOMID},
4197 		{ "rdr",		RDR},
4198 		{ "rdr-anchor",		RDRANCHOR},
4199 		{ "realtime",		REALTIME},
4200 		{ "reassemble",		REASSEMBLE},
4201 		{ "reply-to",		REPLYTO},
4202 		{ "require-order",	REQUIREORDER},
4203 		{ "return",		RETURN},
4204 		{ "return-icmp",	RETURNICMP},
4205 		{ "return-icmp6",	RETURNICMP6},
4206 		{ "return-rst",		RETURNRST},
4207 		{ "round-robin",	ROUNDROBIN},
4208 		{ "route-to",		ROUTETO},
4209 		{ "rule",		RULE},
4210 		{ "scrub",		SCRUB},
4211 		{ "set",		SET},
4212 		{ "source-hash",	SOURCEHASH},
4213 		{ "source-track",	SOURCETRACK},
4214 		{ "state",		STATE},
4215 		{ "state-policy",	STATEPOLICY},
4216 		{ "static-port",	STATICPORT},
4217 		{ "sticky-address",	STICKYADDRESS},
4218 		{ "synproxy",		SYNPROXY},
4219 		{ "table",		TABLE},
4220 		{ "tag",		TAG},
4221 		{ "tagged",		TAGGED},
4222 		{ "tbrsize",		TBRSIZE},
4223 		{ "timeout",		TIMEOUT},
4224 		{ "to",			TO},
4225 		{ "tos",		TOS},
4226 		{ "ttl",		TTL},
4227 		{ "upperlimit",		UPPERLIMIT},
4228 		{ "user",		USER},
4229 	};
4230 	const struct keywords	*p;
4231 
4232 	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
4233 	    sizeof(keywords[0]), kw_cmp);
4234 
4235 	if (p) {
4236 		if (debug > 1)
4237 			fprintf(stderr, "%s: %d\n", s, p->k_val);
4238 		return (p->k_val);
4239 	} else {
4240 		if (debug > 1)
4241 			fprintf(stderr, "string: %s\n", s);
4242 		return (STRING);
4243 	}
4244 }
4245 
4246 #define MAXPUSHBACK	128
4247 
4248 char	*parsebuf;
4249 int	 parseindex;
4250 char	 pushback_buffer[MAXPUSHBACK];
4251 int	 pushback_index = 0;
4252 
4253 int
lgetc(FILE * f)4254 lgetc(FILE *f)
4255 {
4256 	int	c, next;
4257 
4258 	if (parsebuf) {
4259 		/* Read character from the parsebuffer instead of input. */
4260 		if (parseindex >= 0) {
4261 			c = parsebuf[parseindex++];
4262 			if (c != '\0')
4263 				return (c);
4264 			parsebuf = NULL;
4265 		} else
4266 			parseindex++;
4267 	}
4268 
4269 	if (pushback_index)
4270 		return (pushback_buffer[--pushback_index]);
4271 
4272 	while ((c = getc(f)) == '\\') {
4273 		next = getc(f);
4274 		if (next != '\n') {
4275 			if (isspace(next))
4276 				yyerror("whitespace after \\");
4277 			ungetc(next, f);
4278 			break;
4279 		}
4280 		yylval.lineno = lineno;
4281 		lineno++;
4282 	}
4283 	if (c == '\t' || c == ' ') {
4284 		/* Compress blanks to a single space. */
4285 		do {
4286 			c = getc(f);
4287 		} while (c == '\t' || c == ' ');
4288 		ungetc(c, f);
4289 		c = ' ';
4290 	}
4291 
4292 	return (c);
4293 }
4294 
4295 int
lungetc(int c)4296 lungetc(int c)
4297 {
4298 	if (c == EOF)
4299 		return (EOF);
4300 	if (parsebuf) {
4301 		parseindex--;
4302 		if (parseindex >= 0)
4303 			return (c);
4304 	}
4305 	if (pushback_index < MAXPUSHBACK-1)
4306 		return (pushback_buffer[pushback_index++] = c);
4307 	else
4308 		return (EOF);
4309 }
4310 
4311 int
findeol(void)4312 findeol(void)
4313 {
4314 	int	c;
4315 
4316 	parsebuf = NULL;
4317 	pushback_index = 0;
4318 
4319 	/* skip to either EOF or the first real EOL */
4320 	while (1) {
4321 		c = lgetc(fin);
4322 		if (c == '\n') {
4323 			lineno++;
4324 			break;
4325 		}
4326 		if (c == EOF)
4327 			break;
4328 	}
4329 	return (ERROR);
4330 }
4331 
4332 int
yylex(void)4333 yylex(void)
4334 {
4335 	char	 buf[8096];
4336 	char	*p, *val;
4337 	int	 endc, c, next;
4338 	int	 token;
4339 
4340 top:
4341 	p = buf;
4342 	while ((c = lgetc(fin)) == ' ')
4343 		; /* nothing */
4344 
4345 	yylval.lineno = lineno;
4346 	if (c == '#')
4347 		while ((c = lgetc(fin)) != '\n' && c != EOF)
4348 			; /* nothing */
4349 	if (c == '$' && parsebuf == NULL) {
4350 		while (1) {
4351 			if ((c = lgetc(fin)) == EOF)
4352 				return (0);
4353 
4354 			if (p + 1 >= buf + sizeof(buf) - 1) {
4355 				yyerror("string too long");
4356 				return (findeol());
4357 			}
4358 			if (isalnum(c) || c == '_') {
4359 				*p++ = (char)c;
4360 				continue;
4361 			}
4362 			*p = '\0';
4363 			lungetc(c);
4364 			break;
4365 		}
4366 		val = symget(buf);
4367 		if (val == NULL) {
4368 			yyerror("macro '%s' not defined", buf);
4369 			return (findeol());
4370 		}
4371 		parsebuf = val;
4372 		parseindex = 0;
4373 		goto top;
4374 	}
4375 
4376 	switch (c) {
4377 	case '\'':
4378 	case '"':
4379 		endc = c;
4380 		while (1) {
4381 			if ((c = lgetc(fin)) == EOF)
4382 				return (0);
4383 			if (c == endc) {
4384 				*p = '\0';
4385 				break;
4386 			}
4387 			if (c == '\n') {
4388 				lineno++;
4389 				continue;
4390 			}
4391 			if (p + 1 >= buf + sizeof(buf) - 1) {
4392 				yyerror("string too long");
4393 				return (findeol());
4394 			}
4395 			*p++ = (char)c;
4396 		}
4397 		yylval.v.string = strdup(buf);
4398 		if (yylval.v.string == NULL)
4399 			err(1, "yylex: strdup");
4400 		return (STRING);
4401 	case '<':
4402 		next = lgetc(fin);
4403 		if (next == '>') {
4404 			yylval.v.i = PF_OP_XRG;
4405 			return (PORTBINARY);
4406 		}
4407 		lungetc(next);
4408 		break;
4409 	case '>':
4410 		next = lgetc(fin);
4411 		if (next == '<') {
4412 			yylval.v.i = PF_OP_IRG;
4413 			return (PORTBINARY);
4414 		}
4415 		lungetc(next);
4416 		break;
4417 	case '-':
4418 		next = lgetc(fin);
4419 		if (next == '>')
4420 			return (ARROW);
4421 		lungetc(next);
4422 		break;
4423 	}
4424 
4425 #define allowed_in_string(x) \
4426 	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
4427 	x != '{' && x != '}' && x != '<' && x != '>' && \
4428 	x != '!' && x != '=' && x != '/' && x != '#' && \
4429 	x != ','))
4430 
4431 	if (isalnum(c) || c == ':' || c == '_') {
4432 		do {
4433 			*p++ = c;
4434 			if ((unsigned)(p-buf) >= sizeof(buf)) {
4435 				yyerror("string too long");
4436 				return (findeol());
4437 			}
4438 		} while ((c = lgetc(fin)) != EOF && (allowed_in_string(c)));
4439 		lungetc(c);
4440 		*p = '\0';
4441 		if ((token = lookup(buf)) == STRING)
4442 			if ((yylval.v.string = strdup(buf)) == NULL)
4443 				err(1, "yylex: strdup");
4444 		return (token);
4445 	}
4446 	if (c == '\n') {
4447 		yylval.lineno = lineno;
4448 		lineno++;
4449 	}
4450 	if (c == EOF)
4451 		return (0);
4452 	return (c);
4453 }
4454 
4455 int
parse_rules(FILE * input,struct pfctl * xpf)4456 parse_rules(FILE *input, struct pfctl *xpf)
4457 {
4458 	struct sym	*sym, *next;
4459 
4460 	fin = input;
4461 	pf = xpf;
4462 	lineno = 1;
4463 	errors = 0;
4464 	rulestate = PFCTL_STATE_NONE;
4465 	returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
4466 	returnicmp6default =
4467 	    (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
4468 	blockpolicy = PFRULE_DROP;
4469 	require_order = 1;
4470 
4471 	yyparse();
4472 
4473 	/* Free macros and check which have not been used. */
4474 	for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) {
4475 		next = TAILQ_NEXT(sym, entries);
4476 		if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
4477 			fprintf(stderr, "warning: macro '%s' not "
4478 			    "used\n", sym->nam);
4479 		free(sym->nam);
4480 		free(sym->val);
4481 		TAILQ_REMOVE(&symhead, sym, entries);
4482 		free(sym);
4483 	}
4484 
4485 	return (errors ? -1 : 0);
4486 }
4487 
4488 /*
4489  * Over-designed efficiency is a French and German concept, so how about
4490  * we wait until they discover this ugliness and make it all fancy.
4491  */
4492 int
symset(const char * nam,const char * val,int persist)4493 symset(const char *nam, const char *val, int persist)
4494 {
4495 	struct sym	*sym;
4496 
4497 	for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
4498 	    sym = TAILQ_NEXT(sym, entries))
4499 		;	/* nothing */
4500 
4501 	if (sym != NULL) {
4502 		if (sym->persist == 1)
4503 			return (0);
4504 		else {
4505 			free(sym->nam);
4506 			free(sym->val);
4507 			TAILQ_REMOVE(&symhead, sym, entries);
4508 			free(sym);
4509 		}
4510 	}
4511 	if ((sym = calloc(1, sizeof(*sym))) == NULL)
4512 		return (-1);
4513 
4514 	sym->nam = strdup(nam);
4515 	if (sym->nam == NULL) {
4516 		free(sym);
4517 		return (-1);
4518 	}
4519 	sym->val = strdup(val);
4520 	if (sym->val == NULL) {
4521 		free(sym->nam);
4522 		free(sym);
4523 		return (-1);
4524 	}
4525 	sym->used = 0;
4526 	sym->persist = persist;
4527 	TAILQ_INSERT_TAIL(&symhead, sym, entries);
4528 	return (0);
4529 }
4530 
4531 int
pfctl_cmdline_symset(char * s)4532 pfctl_cmdline_symset(char *s)
4533 {
4534 	char	*sym, *val;
4535 	int	 ret;
4536 
4537 	if ((val = strrchr(s, '=')) == NULL)
4538 		return (-1);
4539 
4540 	if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
4541 		err(1, "pfctl_cmdline_symset: malloc");
4542 
4543 	strlcpy(sym, s, strlen(s) - strlen(val) + 1);
4544 
4545 	ret = symset(sym, val + 1, 1);
4546 	free(sym);
4547 
4548 	return (ret);
4549 }
4550 
4551 char *
symget(const char * nam)4552 symget(const char *nam)
4553 {
4554 	struct sym	*sym;
4555 
4556 	TAILQ_FOREACH(sym, &symhead, entries)
4557 		if (strcmp(nam, sym->nam) == 0) {
4558 			sym->used = 1;
4559 			return (sym->val);
4560 		}
4561 	return (NULL);
4562 }
4563 
4564 void
decide_address_family(struct node_host * n,sa_family_t * af)4565 decide_address_family(struct node_host *n, sa_family_t *af)
4566 {
4567 	sa_family_t	target_af = 0;
4568 
4569 	while (!*af && n != NULL) {
4570 		if (n->af) {
4571 			if (target_af == 0)
4572 				target_af = n->af;
4573 			if (target_af != n->af)
4574 				return;
4575 		}
4576 		n = n->next;
4577 	}
4578 	if (!*af && target_af)
4579 		*af = target_af;
4580 }
4581 
4582 void
remove_invalid_hosts(struct node_host ** nh,sa_family_t * af)4583 remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
4584 {
4585 	struct node_host	*n = *nh, *prev = NULL;
4586 
4587 	while (n != NULL) {
4588 		if (*af && n->af && n->af != *af) {
4589 			/* unlink and free n */
4590 			struct node_host *next = n->next;
4591 
4592 			/* adjust tail pointer */
4593 			if (n == (*nh)->tail)
4594 				(*nh)->tail = prev;
4595 			/* adjust previous node's next pointer */
4596 			if (prev == NULL)
4597 				*nh = next;
4598 			else
4599 				prev->next = next;
4600 			/* free node */
4601 			if (n->ifname != NULL)
4602 				free(n->ifname);
4603 			free(n);
4604 			n = next;
4605 		} else {
4606 			if (n->af && !*af)
4607 				*af = n->af;
4608 			prev = n;
4609 			n = n->next;
4610 		}
4611 	}
4612 }
4613 
4614 int
invalid_redirect(struct node_host * nh,sa_family_t af)4615 invalid_redirect(struct node_host *nh, sa_family_t af)
4616 {
4617 	if (!af) {
4618 		struct node_host *n;
4619 
4620 		/* tables and dyniftl are ok without an address family */
4621 		for (n = nh; n != NULL; n = n->next) {
4622 			if (n->addr.type != PF_ADDR_TABLE) {
4623 				yyerror("address family not given and "
4624 				    "translation address expands to multiple "
4625 				    "address families");
4626 				return (1);
4627 			}
4628 		}
4629 	}
4630 	if (nh == NULL) {
4631 		yyerror("no translation address with matching address family "
4632 		    "found.");
4633 		return (1);
4634 	}
4635 	return (0);
4636 }
4637 
4638 int
atoul(char * s,u_long * ulvalp)4639 atoul(char *s, u_long *ulvalp)
4640 {
4641 	u_long	 ulval;
4642 	char	*ep;
4643 
4644 	errno = 0;
4645 	ulval = strtoul(s, &ep, 0);
4646 	if (s[0] == '\0' || *ep != '\0')
4647 		return (-1);
4648 	if (errno == ERANGE && ulval == ULONG_MAX)
4649 		return (-1);
4650 	*ulvalp = ulval;
4651 	return (0);
4652 }
4653 
4654 int
getservice(char * n)4655 getservice(char *n)
4656 {
4657 	struct servent	*s;
4658 	u_long		 ulval;
4659 
4660 	if (atoul(n, &ulval) == 0) {
4661 		if (ulval > 65535) {
4662 			yyerror("illegal port value %d", ulval);
4663 			return (-1);
4664 		}
4665 		return (htons(ulval));
4666 	} else {
4667 		s = getservbyname(n, "tcp");
4668 		if (s == NULL)
4669 			s = getservbyname(n, "udp");
4670 		if (s == NULL) {
4671 			yyerror("unknown port %s", n);
4672 			return (-1);
4673 		}
4674 		return (s->s_port);
4675 	}
4676 }
4677 
4678 int
rule_label(struct pf_rule * r,char * s)4679 rule_label(struct pf_rule *r, char *s)
4680 {
4681 	if (s) {
4682 		if (strlcpy(r->label, s, sizeof(r->label)) >=
4683 		    sizeof(r->label)) {
4684 			yyerror("rule label too long (max %d chars)",
4685 			    sizeof(r->label)-1);
4686 			return (-1);
4687 		}
4688 	}
4689 	return (0);
4690 }
4691 
4692 u_int16_t
parseicmpspec(char * w,sa_family_t af)4693 parseicmpspec(char *w, sa_family_t af)
4694 {
4695 	const struct icmpcodeent	*p;
4696 	u_long				 ulval;
4697 	u_int8_t			 icmptype;
4698 
4699 	if (af == AF_INET)
4700 		icmptype = returnicmpdefault >> 8;
4701 	else
4702 		icmptype = returnicmp6default >> 8;
4703 
4704 	if (atoul(w, &ulval) == -1) {
4705 		if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
4706 			yyerror("unknown icmp code %s", w);
4707 			return (0);
4708 		}
4709 		ulval = p->code;
4710 	}
4711 	if (ulval > 255) {
4712 		yyerror("invalid icmp code %ld", ulval);
4713 		return (0);
4714 	}
4715 	return (icmptype << 8 | ulval);
4716 }
4717 
4718 int
pfctl_load_anchors(int dev,int opts,struct pfr_buffer * trans)4719 pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans)
4720 {
4721 	struct loadanchors	*la;
4722 
4723 	TAILQ_FOREACH(la, &loadanchorshead, entries) {
4724 		if (opts & PF_OPT_VERBOSE)
4725 			fprintf(stderr, "\nLoading anchor %s:%s from %s\n",
4726 			    la->anchorname, la->rulesetname, la->filename);
4727 		if (pfctl_rules(dev, la->filename, opts, la->anchorname,
4728 		    la->rulesetname, trans) == -1)
4729 			return (-1);
4730 	}
4731 
4732 	return (0);
4733 }
4734