parse.y revision 1.11
1 /* $NetBSD: parse.y,v 1.11 2008/06/18 09:06:26 yamt Exp $ */ 2 /* $OpenBSD: parse.y,v 1.519 2007/06/21 19:30:03 henning Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Markus Friedl. All rights reserved. 6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 7 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 8 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 * 30 * This material is based upon work partially supported by NSF under 31 * Contract No. NSF CNS-0626584. 32 */ 33 %{ 34 #include <sys/types.h> 35 #include <sys/socket.h> 36 #include <net/if.h> 37 #include <netinet/in.h> 38 #include <netinet/in_systm.h> 39 #include <netinet/ip.h> 40 #include <netinet/ip_icmp.h> 41 #include <netinet/icmp6.h> 42 #include <net/pfvar.h> 43 #include <arpa/inet.h> 44 #include <altq/altq.h> 45 #include <altq/altq_cbq.h> 46 #include <altq/altq_priq.h> 47 #include <altq/altq_hfsc.h> 48 49 #include <stdio.h> 50 #include <stdlib.h> 51 #include <netdb.h> 52 #include <stdarg.h> 53 #include <errno.h> 54 #include <string.h> 55 #include <ctype.h> 56 #include <math.h> 57 #include <err.h> 58 #include <limits.h> 59 #include <pwd.h> 60 #include <grp.h> 61 #include <md5.h> 62 63 #include "pfctl_parser.h" 64 #include "pfctl.h" 65 66 #ifndef RT_TABLEID_MAX 67 #define RT_TABLEID_MAX 255 68 #endif /* !RT_TABLEID_MAX */ 69 70 static struct pfctl *pf = NULL; 71 static FILE *fin = NULL; 72 static int debug = 0; 73 static int lineno = 1; 74 static int errors = 0; 75 static int rulestate = 0; 76 static u_int16_t returnicmpdefault = 77 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 78 static u_int16_t returnicmp6default = 79 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 80 static int blockpolicy = PFRULE_DROP; 81 static int require_order = 1; 82 static int default_statelock; 83 84 enum { 85 PFCTL_STATE_NONE, 86 PFCTL_STATE_OPTION, 87 PFCTL_STATE_SCRUB, 88 PFCTL_STATE_QUEUE, 89 PFCTL_STATE_NAT, 90 PFCTL_STATE_FILTER 91 }; 92 93 struct node_proto { 94 u_int8_t proto; 95 struct node_proto *next; 96 struct node_proto *tail; 97 }; 98 99 struct node_port { 100 u_int16_t port[2]; 101 u_int8_t op; 102 struct node_port *next; 103 struct node_port *tail; 104 }; 105 106 struct node_uid { 107 uid_t uid[2]; 108 u_int8_t op; 109 struct node_uid *next; 110 struct node_uid *tail; 111 }; 112 113 struct node_gid { 114 gid_t gid[2]; 115 u_int8_t op; 116 struct node_gid *next; 117 struct node_gid *tail; 118 }; 119 120 struct node_icmp { 121 u_int8_t code; 122 u_int8_t type; 123 u_int8_t proto; 124 struct node_icmp *next; 125 struct node_icmp *tail; 126 }; 127 128 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 129 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 130 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 131 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 132 PF_STATE_OPT_TIMEOUT }; 133 134 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 135 136 struct node_state_opt { 137 int type; 138 union { 139 u_int32_t max_states; 140 u_int32_t max_src_states; 141 u_int32_t max_src_conn; 142 struct { 143 u_int32_t limit; 144 u_int32_t seconds; 145 } max_src_conn_rate; 146 struct { 147 u_int8_t flush; 148 char tblname[PF_TABLE_NAME_SIZE]; 149 } overload; 150 u_int32_t max_src_nodes; 151 u_int8_t src_track; 152 u_int32_t statelock; 153 struct { 154 int number; 155 u_int32_t seconds; 156 } timeout; 157 } data; 158 struct node_state_opt *next; 159 struct node_state_opt *tail; 160 }; 161 162 struct peer { 163 struct node_host *host; 164 struct node_port *port; 165 }; 166 167 struct node_queue { 168 char queue[PF_QNAME_SIZE]; 169 char parent[PF_QNAME_SIZE]; 170 char ifname[IFNAMSIZ]; 171 int scheduler; 172 struct node_queue *next; 173 struct node_queue *tail; 174 } *queues = NULL; 175 176 struct node_qassign { 177 char *qname; 178 char *pqname; 179 }; 180 181 struct filter_opts { 182 int marker; 183 #define FOM_FLAGS 0x01 184 #define FOM_ICMP 0x02 185 #define FOM_TOS 0x04 186 #define FOM_KEEP 0x08 187 #define FOM_SRCTRACK 0x10 188 struct node_uid *uid; 189 struct node_gid *gid; 190 struct { 191 u_int8_t b1; 192 u_int8_t b2; 193 u_int16_t w; 194 u_int16_t w2; 195 } flags; 196 struct node_icmp *icmpspec; 197 u_int32_t tos; 198 u_int32_t prob; 199 struct { 200 int action; 201 struct node_state_opt *options; 202 } keep; 203 int fragment; 204 int allowopts; 205 char *label; 206 struct node_qassign queues; 207 char *tag; 208 char *match_tag; 209 u_int8_t match_tag_not; 210 int rtableid; 211 } filter_opts; 212 213 struct antispoof_opts { 214 char *label; 215 int rtableid; 216 } antispoof_opts; 217 218 struct scrub_opts { 219 int marker; 220 #define SOM_MINTTL 0x01 221 #define SOM_MAXMSS 0x02 222 #define SOM_FRAGCACHE 0x04 223 int nodf; 224 int minttl; 225 int maxmss; 226 int fragcache; 227 int randomid; 228 int reassemble_tcp; 229 int rtableid; 230 } scrub_opts; 231 232 struct queue_opts { 233 int marker; 234 #define QOM_BWSPEC 0x01 235 #define QOM_SCHEDULER 0x02 236 #define QOM_PRIORITY 0x04 237 #define QOM_TBRSIZE 0x08 238 #define QOM_QLIMIT 0x10 239 struct node_queue_bw queue_bwspec; 240 struct node_queue_opt scheduler; 241 int priority; 242 int tbrsize; 243 int qlimit; 244 } queue_opts; 245 246 struct table_opts { 247 int flags; 248 int init_addr; 249 struct node_tinithead init_nodes; 250 } table_opts; 251 252 struct pool_opts { 253 int marker; 254 #define POM_TYPE 0x01 255 #define POM_STICKYADDRESS 0x02 256 u_int8_t opts; 257 int type; 258 int staticport; 259 struct pf_poolhashkey *key; 260 261 } pool_opts; 262 263 264 struct node_hfsc_opts hfsc_opts; 265 266 int yyerror(const char *, ...); 267 int disallow_table(struct node_host *, const char *); 268 int disallow_urpf_failed(struct node_host *, const char *); 269 int disallow_alias(struct node_host *, const char *); 270 int rule_consistent(struct pf_rule *, int); 271 int filter_consistent(struct pf_rule *, int); 272 int nat_consistent(struct pf_rule *); 273 int rdr_consistent(struct pf_rule *); 274 int process_tabledef(char *, struct table_opts *); 275 int yyparse(void); 276 void expand_label_str(char *, size_t, const char *, const char *); 277 void expand_label_if(const char *, char *, size_t, const char *); 278 void expand_label_addr(const char *, char *, size_t, u_int8_t, 279 struct node_host *); 280 void expand_label_port(const char *, char *, size_t, struct node_port *); 281 void expand_label_proto(const char *, char *, size_t, u_int8_t); 282 void expand_label_nr(const char *, char *, size_t); 283 void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 284 struct node_port *, struct node_host *, struct node_port *, 285 u_int8_t); 286 void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 287 struct node_proto *, struct node_os*, struct node_host *, 288 struct node_port *, struct node_host *, struct node_port *, 289 struct node_uid *, struct node_gid *, struct node_icmp *, 290 const char *); 291 int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 292 struct node_queue_bw bwspec, struct node_queue_opt *); 293 int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 294 struct node_queue_bw, struct node_queue_opt *); 295 int expand_skip_interface(struct node_if *); 296 297 int check_rulestate(int); 298 int kw_cmp(const void *, const void *); 299 int lookup(char *); 300 int lgetc(FILE *); 301 int lungetc(int); 302 int findeol(void); 303 int yylex(void); 304 int atoul(char *, u_long *); 305 int getservice(char *); 306 int rule_label(struct pf_rule *, char *); 307 308 TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 309 struct sym { 310 TAILQ_ENTRY(sym) entries; 311 int used; 312 int persist; 313 char *nam; 314 char *val; 315 }; 316 317 318 int symset(const char *, const char *, int); 319 char *symget(const char *); 320 321 void mv_rules(struct pf_ruleset *, struct pf_ruleset *); 322 void decide_address_family(struct node_host *, sa_family_t *); 323 void remove_invalid_hosts(struct node_host **, sa_family_t *); 324 int invalid_redirect(struct node_host *, sa_family_t); 325 u_int16_t parseicmpspec(char *, sa_family_t); 326 327 TAILQ_HEAD(loadanchorshead, loadanchors) 328 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 329 330 struct loadanchors { 331 TAILQ_ENTRY(loadanchors) entries; 332 char *anchorname; 333 char *filename; 334 }; 335 336 typedef struct { 337 union { 338 u_int32_t number; 339 int i; 340 char *string; 341 int rtableid; 342 struct { 343 u_int8_t b1; 344 u_int8_t b2; 345 u_int16_t w; 346 u_int16_t w2; 347 } b; 348 struct range { 349 int a; 350 int b; 351 int t; 352 } range; 353 struct node_if *interface; 354 struct node_proto *proto; 355 struct node_icmp *icmp; 356 struct node_host *host; 357 struct node_os *os; 358 struct node_port *port; 359 struct node_uid *uid; 360 struct node_gid *gid; 361 struct node_state_opt *state_opt; 362 struct peer peer; 363 struct { 364 struct peer src, dst; 365 struct node_os *src_os; 366 } fromto; 367 struct { 368 struct node_host *host; 369 u_int8_t rt; 370 u_int8_t pool_opts; 371 sa_family_t af; 372 struct pf_poolhashkey *key; 373 } route; 374 struct redirection { 375 struct node_host *host; 376 struct range rport; 377 } *redirection; 378 struct { 379 int action; 380 struct node_state_opt *options; 381 } keep_state; 382 struct { 383 u_int8_t log; 384 u_int8_t logif; 385 u_int8_t quick; 386 } logquick; 387 struct { 388 int neg; 389 char *name; 390 } tagged; 391 struct pf_poolhashkey *hashkey; 392 struct node_queue *queue; 393 struct node_queue_opt queue_options; 394 struct node_queue_bw queue_bwspec; 395 struct node_qassign qassign; 396 struct filter_opts filter_opts; 397 struct antispoof_opts antispoof_opts; 398 struct queue_opts queue_opts; 399 struct scrub_opts scrub_opts; 400 struct table_opts table_opts; 401 struct pool_opts pool_opts; 402 struct node_hfsc_opts hfsc_opts; 403 } v; 404 int lineno; 405 } YYSTYPE; 406 407 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 408 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 409 !isdigit((unsigned char)(addr).v.ifname[strlen((addr).v.ifname)-1]))) 410 411 %} 412 413 %token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS 414 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 415 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 416 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 417 %token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 418 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 419 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 420 %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 421 %token ANTISPOOF FOR 422 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 423 %token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 424 %token QUEUE PRIORITY QLIMIT RTABLE 425 %token LOAD RULESET_OPTIMIZATION 426 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 427 %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH 428 %token TAGGED TAG IFBOUND FLOATING STATEPOLICY ROUTE 429 %token <v.string> STRING 430 %token <v.i> PORTBINARY 431 %type <v.interface> interface if_list if_item_not if_item 432 %type <v.number> number icmptype icmp6type uid gid 433 %type <v.number> tos not yesno 434 %type <v.i> no dir af fragcache optimizer 435 %type <v.i> sourcetrack flush unaryop statelock 436 %type <v.b> action nataction natpasslog scrubaction 437 %type <v.b> flags flag blockspec 438 %type <v.range> port rport 439 %type <v.hashkey> hashkey 440 %type <v.proto> proto proto_list proto_item 441 %type <v.icmp> icmpspec 442 %type <v.icmp> icmp_list icmp_item 443 %type <v.icmp> icmp6_list icmp6_item 444 %type <v.fromto> fromto 445 %type <v.peer> ipportspec from to 446 %type <v.host> ipspec xhost host dynaddr host_list 447 %type <v.host> redir_host_list redirspec 448 %type <v.host> route_host route_host_list routespec 449 %type <v.os> os xos os_list 450 %type <v.port> portspec port_list port_item 451 %type <v.uid> uids uid_list uid_item 452 %type <v.gid> gids gid_list gid_item 453 %type <v.route> route 454 %type <v.redirection> redirection redirpool 455 %type <v.string> label string tag anchorname 456 %type <v.keep_state> keep 457 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 458 %type <v.state_opt> opt_statelock 459 %type <v.logquick> logquick quick log logopts logopt 460 %type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 461 %type <v.qassign> qname 462 %type <v.queue> qassign qassign_list qassign_item 463 %type <v.queue_options> scheduler 464 %type <v.number> cbqflags_list cbqflags_item 465 %type <v.number> priqflags_list priqflags_item 466 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 467 %type <v.queue_bwspec> bandwidth 468 %type <v.filter_opts> filter_opts filter_opt filter_opts_l 469 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 470 %type <v.queue_opts> queue_opts queue_opt queue_opts_l 471 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 472 %type <v.table_opts> table_opts table_opt table_opts_l 473 %type <v.pool_opts> pool_opts pool_opt pool_opts_l 474 %type <v.tagged> tagged 475 %type <v.rtableid> rtable 476 %% 477 478 ruleset : /* empty */ 479 | ruleset '\n' 480 | ruleset option '\n' 481 | ruleset scrubrule '\n' 482 | ruleset natrule '\n' 483 | ruleset binatrule '\n' 484 | ruleset pfrule '\n' 485 | ruleset anchorrule '\n' 486 | ruleset loadrule '\n' 487 | ruleset altqif '\n' 488 | ruleset queuespec '\n' 489 | ruleset varset '\n' 490 | ruleset antispoof '\n' 491 | ruleset tabledef '\n' 492 | '{' fakeanchor '}' '\n'; 493 | ruleset error '\n' { errors++; } 494 ; 495 496 /* 497 * apply to previouslys specified rule: must be careful to note 498 * what that is: pf or nat or binat or rdr 499 */ 500 fakeanchor : fakeanchor '\n' 501 | fakeanchor anchorrule '\n' 502 | fakeanchor binatrule '\n' 503 | fakeanchor natrule '\n' 504 | fakeanchor pfrule '\n' 505 | fakeanchor error '\n' 506 ; 507 508 optimizer : string { 509 if (!strcmp($1, "none")) 510 $$ = 0; 511 else if (!strcmp($1, "basic")) 512 $$ = PF_OPTIMIZE_BASIC; 513 else if (!strcmp($1, "profile")) 514 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE; 515 else { 516 yyerror("unknown ruleset-optimization %s", $$); 517 YYERROR; 518 } 519 } 520 ; 521 522 option : SET OPTIMIZATION STRING { 523 if (check_rulestate(PFCTL_STATE_OPTION)) { 524 free($3); 525 YYERROR; 526 } 527 if (pfctl_set_optimization(pf, $3) != 0) { 528 yyerror("unknown optimization %s", $3); 529 free($3); 530 YYERROR; 531 } 532 free($3); 533 } 534 | SET RULESET_OPTIMIZATION optimizer { 535 if (!(pf->opts & PF_OPT_OPTIMIZE)) { 536 pf->opts |= PF_OPT_OPTIMIZE; 537 pf->optimize = $3; 538 } 539 } 540 | SET TIMEOUT timeout_spec 541 | SET TIMEOUT '{' timeout_list '}' 542 | SET LIMIT limit_spec 543 | SET LIMIT '{' limit_list '}' 544 | SET LOGINTERFACE STRING { 545 if (check_rulestate(PFCTL_STATE_OPTION)) { 546 free($3); 547 YYERROR; 548 } 549 if (pfctl_set_logif(pf, $3) != 0) { 550 yyerror("error setting loginterface %s", $3); 551 free($3); 552 YYERROR; 553 } 554 free($3); 555 } 556 | SET HOSTID number { 557 if ($3 == 0) { 558 yyerror("hostid must be non-zero"); 559 YYERROR; 560 } 561 if (pfctl_set_hostid(pf, $3) != 0) { 562 yyerror("error setting hostid %08x", $3); 563 YYERROR; 564 } 565 } 566 | SET BLOCKPOLICY DROP { 567 if (pf->opts & PF_OPT_VERBOSE) 568 printf("set block-policy drop\n"); 569 if (check_rulestate(PFCTL_STATE_OPTION)) 570 YYERROR; 571 blockpolicy = PFRULE_DROP; 572 } 573 | SET BLOCKPOLICY RETURN { 574 if (pf->opts & PF_OPT_VERBOSE) 575 printf("set block-policy return\n"); 576 if (check_rulestate(PFCTL_STATE_OPTION)) 577 YYERROR; 578 blockpolicy = PFRULE_RETURN; 579 } 580 | SET REQUIREORDER yesno { 581 if (pf->opts & PF_OPT_VERBOSE) 582 printf("set require-order %s\n", 583 $3 == 1 ? "yes" : "no"); 584 require_order = $3; 585 } 586 | SET FINGERPRINTS STRING { 587 if (pf->opts & PF_OPT_VERBOSE) 588 printf("set fingerprints \"%s\"\n", $3); 589 if (check_rulestate(PFCTL_STATE_OPTION)) { 590 free($3); 591 YYERROR; 592 } 593 if (!pf->anchor->name[0]) { 594 if (pfctl_file_fingerprints(pf->dev, 595 pf->opts, $3)) { 596 yyerror("error loading " 597 "fingerprints %s", $3); 598 free($3); 599 YYERROR; 600 } 601 } 602 free($3); 603 } 604 | SET STATEPOLICY statelock { 605 if (pf->opts & PF_OPT_VERBOSE) 606 switch ($3) { 607 case 0: 608 printf("set state-policy floating\n"); 609 break; 610 case PFRULE_IFBOUND: 611 printf("set state-policy if-bound\n"); 612 break; 613 } 614 default_statelock = $3; 615 } 616 | SET DEBUG STRING { 617 if (check_rulestate(PFCTL_STATE_OPTION)) { 618 free($3); 619 YYERROR; 620 } 621 if (pfctl_set_debug(pf, $3) != 0) { 622 yyerror("error setting debuglevel %s", $3); 623 free($3); 624 YYERROR; 625 } 626 free($3); 627 } 628 | SET SKIP interface { 629 if (expand_skip_interface($3) != 0) { 630 yyerror("error setting skip interface(s)"); 631 YYERROR; 632 } 633 } 634 ; 635 636 string : string STRING { 637 if (asprintf(&$$, "%s %s", $1, $2) == -1) 638 err(1, "string: asprintf"); 639 free($1); 640 free($2); 641 } 642 | STRING 643 ; 644 645 varset : STRING '=' string { 646 if (pf->opts & PF_OPT_VERBOSE) 647 printf("%s = \"%s\"\n", $1, $3); 648 if (symset($1, $3, 0) == -1) 649 err(1, "cannot store variable %s", $1); 650 free($1); 651 free($3); 652 } 653 ; 654 655 anchorname : STRING { $$ = $1; } 656 | /* empty */ { $$ = NULL; } 657 ; 658 659 optnl : optnl '\n' 660 | 661 ; 662 663 pfa_anchorlist : pfrule optnl 664 | anchorrule optnl 665 | pfa_anchorlist pfrule optnl 666 | pfa_anchorlist anchorrule optnl 667 ; 668 669 pfa_anchor : '{' 670 { 671 char ta[PF_ANCHOR_NAME_SIZE]; 672 struct pf_ruleset *rs; 673 674 /* steping into a brace anchor */ 675 pf->asd++; 676 pf->bn++; 677 pf->brace = 1; 678 679 /* create a holding ruleset in the root */ 680 snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn); 681 rs = pf_find_or_create_ruleset(ta); 682 if (rs == NULL) 683 err(1, "pfa_anchor: pf_find_or_create_ruleset"); 684 pf->astack[pf->asd] = rs->anchor; 685 pf->anchor = rs->anchor; 686 } '\n' pfa_anchorlist '}' 687 { 688 pf->alast = pf->anchor; 689 pf->asd--; 690 pf->anchor = pf->astack[pf->asd]; 691 } 692 | /* empty */ 693 ; 694 695 anchorrule : ANCHOR anchorname dir quick interface af proto fromto 696 filter_opts pfa_anchor 697 { 698 struct pf_rule r; 699 700 if (check_rulestate(PFCTL_STATE_FILTER)) { 701 if ($2) 702 free($2); 703 YYERROR; 704 } 705 706 if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) { 707 free($2); 708 yyerror("anchor names beginning with '_' " 709 "are reserved for internal use"); 710 YYERROR; 711 } 712 713 memset(&r, 0, sizeof(r)); 714 if (pf->astack[pf->asd + 1]) { 715 /* move inline rules into relative location */ 716 pf_anchor_setup(&r, 717 &pf->astack[pf->asd]->ruleset, 718 $2 ? $2 : pf->alast->name); 719 720 if (r.anchor == NULL) 721 err(1, "anchorrule: unable to " 722 "create ruleset"); 723 724 if (pf->alast != r.anchor) { 725 if (r.anchor->match) { 726 yyerror("inline anchor '%s' " 727 "already exists", 728 r.anchor->name); 729 YYERROR; 730 } 731 mv_rules(&pf->alast->ruleset, 732 &r.anchor->ruleset); 733 } 734 pf_remove_if_empty_ruleset(&pf->alast->ruleset); 735 pf->alast = r.anchor; 736 } else { 737 if (!$2) { 738 yyerror("anchors without explicit " 739 "rules must specify a name"); 740 YYERROR; 741 } 742 } 743 r.direction = $3; 744 r.quick = $4.quick; 745 r.af = $6; 746 r.prob = $9.prob; 747 r.rtableid = $9.rtableid; 748 749 if ($9.match_tag) 750 if (strlcpy(r.match_tagname, $9.match_tag, 751 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 752 yyerror("tag too long, max %u chars", 753 PF_TAG_NAME_SIZE - 1); 754 YYERROR; 755 } 756 r.match_tag_not = $9.match_tag_not; 757 758 decide_address_family($8.src.host, &r.af); 759 decide_address_family($8.dst.host, &r.af); 760 761 expand_rule(&r, $5, NULL, $7, $8.src_os, 762 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 763 0, 0, 0, pf->astack[pf->asd + 1] ? 764 pf->alast->name : $2); 765 free($2); 766 pf->astack[pf->asd + 1] = NULL; 767 } 768 | NATANCHOR string interface af proto fromto rtable { 769 struct pf_rule r; 770 771 if (check_rulestate(PFCTL_STATE_NAT)) { 772 free($2); 773 YYERROR; 774 } 775 776 memset(&r, 0, sizeof(r)); 777 r.action = PF_NAT; 778 r.af = $4; 779 r.rtableid = $7; 780 781 decide_address_family($6.src.host, &r.af); 782 decide_address_family($6.dst.host, &r.af); 783 784 expand_rule(&r, $3, NULL, $5, $6.src_os, 785 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 786 0, 0, 0, $2); 787 free($2); 788 } 789 | RDRANCHOR string interface af proto fromto rtable { 790 struct pf_rule r; 791 792 if (check_rulestate(PFCTL_STATE_NAT)) { 793 free($2); 794 YYERROR; 795 } 796 797 memset(&r, 0, sizeof(r)); 798 r.action = PF_RDR; 799 r.af = $4; 800 r.rtableid = $7; 801 802 decide_address_family($6.src.host, &r.af); 803 decide_address_family($6.dst.host, &r.af); 804 805 if ($6.src.port != NULL) { 806 yyerror("source port parameter not supported" 807 " in rdr-anchor"); 808 YYERROR; 809 } 810 if ($6.dst.port != NULL) { 811 if ($6.dst.port->next != NULL) { 812 yyerror("destination port list " 813 "expansion not supported in " 814 "rdr-anchor"); 815 YYERROR; 816 } else if ($6.dst.port->op != PF_OP_EQ) { 817 yyerror("destination port operators" 818 " not supported in rdr-anchor"); 819 YYERROR; 820 } 821 r.dst.port[0] = $6.dst.port->port[0]; 822 r.dst.port[1] = $6.dst.port->port[1]; 823 r.dst.port_op = $6.dst.port->op; 824 } 825 826 expand_rule(&r, $3, NULL, $5, $6.src_os, 827 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 828 0, 0, 0, $2); 829 free($2); 830 } 831 | BINATANCHOR string interface af proto fromto rtable { 832 struct pf_rule r; 833 834 if (check_rulestate(PFCTL_STATE_NAT)) { 835 free($2); 836 YYERROR; 837 } 838 839 memset(&r, 0, sizeof(r)); 840 r.action = PF_BINAT; 841 r.af = $4; 842 r.rtableid = $7; 843 if ($5 != NULL) { 844 if ($5->next != NULL) { 845 yyerror("proto list expansion" 846 " not supported in binat-anchor"); 847 YYERROR; 848 } 849 r.proto = $5->proto; 850 free($5); 851 } 852 853 if ($6.src.host != NULL || $6.src.port != NULL || 854 $6.dst.host != NULL || $6.dst.port != NULL) { 855 yyerror("fromto parameter not supported" 856 " in binat-anchor"); 857 YYERROR; 858 } 859 860 decide_address_family($6.src.host, &r.af); 861 decide_address_family($6.dst.host, &r.af); 862 863 pfctl_add_rule(pf, &r, $2); 864 free($2); 865 } 866 ; 867 868 loadrule : LOAD ANCHOR string FROM string { 869 struct loadanchors *loadanchor; 870 871 if (strlen(pf->anchor->name) + 1 + 872 strlen($3) >= MAXPATHLEN) { 873 yyerror("anchorname %s too long, max %u\n", 874 $3, MAXPATHLEN - 1); 875 free($3); 876 YYERROR; 877 } 878 loadanchor = calloc(1, sizeof(struct loadanchors)); 879 if (loadanchor == NULL) 880 err(1, "loadrule: calloc"); 881 if ((loadanchor->anchorname = malloc(MAXPATHLEN)) == 882 NULL) 883 err(1, "loadrule: malloc"); 884 if (pf->anchor->name[0]) 885 snprintf(loadanchor->anchorname, MAXPATHLEN, 886 "%s/%s", pf->anchor->name, $3); 887 else 888 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN); 889 if ((loadanchor->filename = strdup($5)) == NULL) 890 err(1, "loadrule: strdup"); 891 892 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 893 entries); 894 895 free($3); 896 free($5); 897 }; 898 899 scrubaction : no SCRUB { 900 $$.b2 = $$.w = 0; 901 if ($1) 902 $$.b1 = PF_NOSCRUB; 903 else 904 $$.b1 = PF_SCRUB; 905 } 906 ; 907 908 scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 909 { 910 struct pf_rule r; 911 912 if (check_rulestate(PFCTL_STATE_SCRUB)) 913 YYERROR; 914 915 memset(&r, 0, sizeof(r)); 916 917 r.action = $1.b1; 918 r.direction = $2; 919 920 r.log = $3.log; 921 r.logif = $3.logif; 922 if ($3.quick) { 923 yyerror("scrub rules do not support 'quick'"); 924 YYERROR; 925 } 926 927 r.af = $5; 928 if ($8.nodf) 929 r.rule_flag |= PFRULE_NODF; 930 if ($8.randomid) 931 r.rule_flag |= PFRULE_RANDOMID; 932 if ($8.reassemble_tcp) { 933 if (r.direction != PF_INOUT) { 934 yyerror("reassemble tcp rules can not " 935 "specify direction"); 936 YYERROR; 937 } 938 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 939 } 940 if ($8.minttl) 941 r.min_ttl = $8.minttl; 942 if ($8.maxmss) 943 r.max_mss = $8.maxmss; 944 if ($8.fragcache) 945 r.rule_flag |= $8.fragcache; 946 r.rtableid = $8.rtableid; 947 948 expand_rule(&r, $4, NULL, $6, $7.src_os, 949 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 950 NULL, NULL, NULL, ""); 951 } 952 ; 953 954 scrub_opts : { 955 bzero(&scrub_opts, sizeof scrub_opts); 956 scrub_opts.rtableid = -1; 957 } 958 scrub_opts_l 959 { $$ = scrub_opts; } 960 | /* empty */ { 961 bzero(&scrub_opts, sizeof scrub_opts); 962 scrub_opts.rtableid = -1; 963 $$ = scrub_opts; 964 } 965 ; 966 967 scrub_opts_l : scrub_opts_l scrub_opt 968 | scrub_opt 969 ; 970 971 scrub_opt : NODF { 972 if (scrub_opts.nodf) { 973 yyerror("no-df cannot be respecified"); 974 YYERROR; 975 } 976 scrub_opts.nodf = 1; 977 } 978 | MINTTL number { 979 if (scrub_opts.marker & SOM_MINTTL) { 980 yyerror("min-ttl cannot be respecified"); 981 YYERROR; 982 } 983 if ($2 > 255) { 984 yyerror("illegal min-ttl value %d", $2); 985 YYERROR; 986 } 987 scrub_opts.marker |= SOM_MINTTL; 988 scrub_opts.minttl = $2; 989 } 990 | MAXMSS number { 991 if (scrub_opts.marker & SOM_MAXMSS) { 992 yyerror("max-mss cannot be respecified"); 993 YYERROR; 994 } 995 if ($2 > 65535) { 996 yyerror("illegal max-mss value %d", $2); 997 YYERROR; 998 } 999 scrub_opts.marker |= SOM_MAXMSS; 1000 scrub_opts.maxmss = $2; 1001 } 1002 | fragcache { 1003 if (scrub_opts.marker & SOM_FRAGCACHE) { 1004 yyerror("fragcache cannot be respecified"); 1005 YYERROR; 1006 } 1007 scrub_opts.marker |= SOM_FRAGCACHE; 1008 scrub_opts.fragcache = $1; 1009 } 1010 | REASSEMBLE STRING { 1011 if (strcasecmp($2, "tcp") != 0) { 1012 yyerror("scrub reassemble supports only tcp, " 1013 "not '%s'", $2); 1014 free($2); 1015 YYERROR; 1016 } 1017 free($2); 1018 if (scrub_opts.reassemble_tcp) { 1019 yyerror("reassemble tcp cannot be respecified"); 1020 YYERROR; 1021 } 1022 scrub_opts.reassemble_tcp = 1; 1023 } 1024 | RANDOMID { 1025 if (scrub_opts.randomid) { 1026 yyerror("random-id cannot be respecified"); 1027 YYERROR; 1028 } 1029 scrub_opts.randomid = 1; 1030 } 1031 | RTABLE number { 1032 if ($2 > RT_TABLEID_MAX || $2 < 0) { 1033 yyerror("invalid rtable id"); 1034 YYERROR; 1035 } 1036 scrub_opts.rtableid = $2; 1037 } 1038 ; 1039 1040 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 1041 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 1042 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 1043 ; 1044 1045 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 1046 struct pf_rule r; 1047 struct node_host *h = NULL, *hh; 1048 struct node_if *i, *j; 1049 1050 if (check_rulestate(PFCTL_STATE_FILTER)) 1051 YYERROR; 1052 1053 for (i = $3; i; i = i->next) { 1054 bzero(&r, sizeof(r)); 1055 1056 r.action = PF_DROP; 1057 r.direction = PF_IN; 1058 r.log = $2.log; 1059 r.logif = $2.logif; 1060 r.quick = $2.quick; 1061 r.af = $4; 1062 if (rule_label(&r, $5.label)) 1063 YYERROR; 1064 r.rtableid = $5.rtableid; 1065 j = calloc(1, sizeof(struct node_if)); 1066 if (j == NULL) 1067 err(1, "antispoof: calloc"); 1068 if (strlcpy(j->ifname, i->ifname, 1069 sizeof(j->ifname)) >= sizeof(j->ifname)) { 1070 free(j); 1071 yyerror("interface name too long"); 1072 YYERROR; 1073 } 1074 j->not = 1; 1075 if (i->dynamic) { 1076 h = calloc(1, sizeof(*h)); 1077 if (h == NULL) 1078 err(1, "address: calloc"); 1079 h->addr.type = PF_ADDR_DYNIFTL; 1080 set_ipmask(h, 128); 1081 if (strlcpy(h->addr.v.ifname, i->ifname, 1082 sizeof(h->addr.v.ifname)) >= 1083 sizeof(h->addr.v.ifname)) { 1084 free(h); 1085 yyerror( 1086 "interface name too long"); 1087 YYERROR; 1088 } 1089 hh = malloc(sizeof(*hh)); 1090 if (hh == NULL) 1091 err(1, "address: malloc"); 1092 bcopy(h, hh, sizeof(*hh)); 1093 h->addr.iflags = PFI_AFLAG_NETWORK; 1094 } else { 1095 h = ifa_lookup(j->ifname, 1096 PFI_AFLAG_NETWORK); 1097 hh = NULL; 1098 } 1099 1100 if (h != NULL) 1101 expand_rule(&r, j, NULL, NULL, NULL, h, 1102 NULL, NULL, NULL, NULL, NULL, 1103 NULL, ""); 1104 1105 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 1106 bzero(&r, sizeof(r)); 1107 1108 r.action = PF_DROP; 1109 r.direction = PF_IN; 1110 r.log = $2.log; 1111 r.quick = $2.quick; 1112 r.af = $4; 1113 if (rule_label(&r, $5.label)) 1114 YYERROR; 1115 r.rtableid = $5.rtableid; 1116 if (hh != NULL) 1117 h = hh; 1118 else 1119 h = ifa_lookup(i->ifname, 0); 1120 if (h != NULL) 1121 expand_rule(&r, NULL, NULL, 1122 NULL, NULL, h, NULL, NULL, 1123 NULL, NULL, NULL, NULL, ""); 1124 } else 1125 free(hh); 1126 } 1127 free($5.label); 1128 } 1129 ; 1130 1131 antispoof_ifspc : FOR antispoof_if { $$ = $2; } 1132 | FOR '{' antispoof_iflst '}' { $$ = $3; } 1133 ; 1134 1135 antispoof_iflst : antispoof_if { $$ = $1; } 1136 | antispoof_iflst comma antispoof_if { 1137 $1->tail->next = $3; 1138 $1->tail = $3; 1139 $$ = $1; 1140 } 1141 ; 1142 1143 antispoof_if : if_item { $$ = $1; } 1144 | '(' if_item ')' { 1145 $2->dynamic = 1; 1146 $$ = $2; 1147 } 1148 ; 1149 1150 antispoof_opts : { 1151 bzero(&antispoof_opts, sizeof antispoof_opts); 1152 antispoof_opts.rtableid = -1; 1153 } 1154 antispoof_opts_l 1155 { $$ = antispoof_opts; } 1156 | /* empty */ { 1157 bzero(&antispoof_opts, sizeof antispoof_opts); 1158 antispoof_opts.rtableid = -1; 1159 $$ = antispoof_opts; 1160 } 1161 ; 1162 1163 antispoof_opts_l : antispoof_opts_l antispoof_opt 1164 | antispoof_opt 1165 ; 1166 1167 antispoof_opt : label { 1168 if (antispoof_opts.label) { 1169 yyerror("label cannot be redefined"); 1170 YYERROR; 1171 } 1172 antispoof_opts.label = $1; 1173 } 1174 | RTABLE number { 1175 if ($2 > RT_TABLEID_MAX || $2 < 0) { 1176 yyerror("invalid rtable id"); 1177 YYERROR; 1178 } 1179 antispoof_opts.rtableid = $2; 1180 } 1181 ; 1182 1183 not : '!' { $$ = 1; } 1184 | /* empty */ { $$ = 0; } 1185 ; 1186 1187 tabledef : TABLE '<' STRING '>' table_opts { 1188 struct node_host *h, *nh; 1189 struct node_tinit *ti, *nti; 1190 1191 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1192 yyerror("table name too long, max %d chars", 1193 PF_TABLE_NAME_SIZE - 1); 1194 free($3); 1195 YYERROR; 1196 } 1197 if (pf->loadopt & PFCTL_FLAG_TABLE) 1198 if (process_tabledef($3, &$5)) { 1199 free($3); 1200 YYERROR; 1201 } 1202 free($3); 1203 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1204 ti != NULL; ti = nti) { 1205 if (ti->file) 1206 free(ti->file); 1207 for (h = ti->host; h != NULL; h = nh) { 1208 nh = h->next; 1209 free(h); 1210 } 1211 nti = SIMPLEQ_NEXT(ti, entries); 1212 free(ti); 1213 } 1214 } 1215 ; 1216 1217 table_opts : { 1218 bzero(&table_opts, sizeof table_opts); 1219 SIMPLEQ_INIT(&table_opts.init_nodes); 1220 } 1221 table_opts_l 1222 { $$ = table_opts; } 1223 | /* empty */ 1224 { 1225 bzero(&table_opts, sizeof table_opts); 1226 SIMPLEQ_INIT(&table_opts.init_nodes); 1227 $$ = table_opts; 1228 } 1229 ; 1230 1231 table_opts_l : table_opts_l table_opt 1232 | table_opt 1233 ; 1234 1235 table_opt : STRING { 1236 if (!strcmp($1, "const")) 1237 table_opts.flags |= PFR_TFLAG_CONST; 1238 else if (!strcmp($1, "persist")) 1239 table_opts.flags |= PFR_TFLAG_PERSIST; 1240 else { 1241 yyerror("invalid table option '%s'", $1); 1242 free($1); 1243 YYERROR; 1244 } 1245 free($1); 1246 } 1247 | '{' '}' { table_opts.init_addr = 1; } 1248 | '{' host_list '}' { 1249 struct node_host *n; 1250 struct node_tinit *ti; 1251 1252 for (n = $2; n != NULL; n = n->next) { 1253 switch (n->addr.type) { 1254 case PF_ADDR_ADDRMASK: 1255 continue; /* ok */ 1256 case PF_ADDR_DYNIFTL: 1257 yyerror("dynamic addresses are not " 1258 "permitted inside tables"); 1259 break; 1260 case PF_ADDR_TABLE: 1261 yyerror("tables cannot contain tables"); 1262 break; 1263 case PF_ADDR_NOROUTE: 1264 yyerror("\"no-route\" is not permitted " 1265 "inside tables"); 1266 break; 1267 case PF_ADDR_URPFFAILED: 1268 yyerror("\"urpf-failed\" is not " 1269 "permitted inside tables"); 1270 break; 1271 default: 1272 yyerror("unknown address type %d", 1273 n->addr.type); 1274 } 1275 YYERROR; 1276 } 1277 if (!(ti = calloc(1, sizeof(*ti)))) 1278 err(1, "table_opt: calloc"); 1279 ti->host = $2; 1280 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1281 entries); 1282 table_opts.init_addr = 1; 1283 } 1284 | FILENAME STRING { 1285 struct node_tinit *ti; 1286 1287 if (!(ti = calloc(1, sizeof(*ti)))) 1288 err(1, "table_opt: calloc"); 1289 ti->file = $2; 1290 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1291 entries); 1292 table_opts.init_addr = 1; 1293 } 1294 ; 1295 1296 altqif : ALTQ interface queue_opts QUEUE qassign { 1297 struct pf_altq a; 1298 1299 if (check_rulestate(PFCTL_STATE_QUEUE)) 1300 YYERROR; 1301 1302 memset(&a, 0, sizeof(a)); 1303 if ($3.scheduler.qtype == ALTQT_NONE) { 1304 yyerror("no scheduler specified!"); 1305 YYERROR; 1306 } 1307 a.scheduler = $3.scheduler.qtype; 1308 a.qlimit = $3.qlimit; 1309 a.tbrsize = $3.tbrsize; 1310 if ($5 == NULL) { 1311 yyerror("no child queues specified"); 1312 YYERROR; 1313 } 1314 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1315 &$3.scheduler)) 1316 YYERROR; 1317 } 1318 ; 1319 1320 queuespec : QUEUE STRING interface queue_opts qassign { 1321 struct pf_altq a; 1322 1323 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1324 free($2); 1325 YYERROR; 1326 } 1327 1328 memset(&a, 0, sizeof(a)); 1329 1330 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1331 sizeof(a.qname)) { 1332 yyerror("queue name too long (max " 1333 "%d chars)", PF_QNAME_SIZE-1); 1334 free($2); 1335 YYERROR; 1336 } 1337 free($2); 1338 if ($4.tbrsize) { 1339 yyerror("cannot specify tbrsize for queue"); 1340 YYERROR; 1341 } 1342 if ($4.priority > 255) { 1343 yyerror("priority out of range: max 255"); 1344 YYERROR; 1345 } 1346 a.priority = $4.priority; 1347 a.qlimit = $4.qlimit; 1348 a.scheduler = $4.scheduler.qtype; 1349 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1350 &$4.scheduler)) { 1351 yyerror("errors in queue definition"); 1352 YYERROR; 1353 } 1354 } 1355 ; 1356 1357 queue_opts : { 1358 bzero(&queue_opts, sizeof queue_opts); 1359 queue_opts.priority = DEFAULT_PRIORITY; 1360 queue_opts.qlimit = DEFAULT_QLIMIT; 1361 queue_opts.scheduler.qtype = ALTQT_NONE; 1362 queue_opts.queue_bwspec.bw_percent = 100; 1363 } 1364 queue_opts_l 1365 { $$ = queue_opts; } 1366 | /* empty */ { 1367 bzero(&queue_opts, sizeof queue_opts); 1368 queue_opts.priority = DEFAULT_PRIORITY; 1369 queue_opts.qlimit = DEFAULT_QLIMIT; 1370 queue_opts.scheduler.qtype = ALTQT_NONE; 1371 queue_opts.queue_bwspec.bw_percent = 100; 1372 $$ = queue_opts; 1373 } 1374 ; 1375 1376 queue_opts_l : queue_opts_l queue_opt 1377 | queue_opt 1378 ; 1379 1380 queue_opt : BANDWIDTH bandwidth { 1381 if (queue_opts.marker & QOM_BWSPEC) { 1382 yyerror("bandwidth cannot be respecified"); 1383 YYERROR; 1384 } 1385 queue_opts.marker |= QOM_BWSPEC; 1386 queue_opts.queue_bwspec = $2; 1387 } 1388 | PRIORITY number { 1389 if (queue_opts.marker & QOM_PRIORITY) { 1390 yyerror("priority cannot be respecified"); 1391 YYERROR; 1392 } 1393 if ($2 > 255) { 1394 yyerror("priority out of range: max 255"); 1395 YYERROR; 1396 } 1397 queue_opts.marker |= QOM_PRIORITY; 1398 queue_opts.priority = $2; 1399 } 1400 | QLIMIT number { 1401 if (queue_opts.marker & QOM_QLIMIT) { 1402 yyerror("qlimit cannot be respecified"); 1403 YYERROR; 1404 } 1405 if ($2 > 65535) { 1406 yyerror("qlimit out of range: max 65535"); 1407 YYERROR; 1408 } 1409 queue_opts.marker |= QOM_QLIMIT; 1410 queue_opts.qlimit = $2; 1411 } 1412 | scheduler { 1413 if (queue_opts.marker & QOM_SCHEDULER) { 1414 yyerror("scheduler cannot be respecified"); 1415 YYERROR; 1416 } 1417 queue_opts.marker |= QOM_SCHEDULER; 1418 queue_opts.scheduler = $1; 1419 } 1420 | TBRSIZE number { 1421 if (queue_opts.marker & QOM_TBRSIZE) { 1422 yyerror("tbrsize cannot be respecified"); 1423 YYERROR; 1424 } 1425 if ($2 > 65535) { 1426 yyerror("tbrsize too big: max 65535"); 1427 YYERROR; 1428 } 1429 queue_opts.marker |= QOM_TBRSIZE; 1430 queue_opts.tbrsize = $2; 1431 } 1432 ; 1433 1434 bandwidth : STRING { 1435 double bps; 1436 char *cp; 1437 1438 $$.bw_percent = 0; 1439 1440 bps = strtod($1, &cp); 1441 if (cp != NULL) { 1442 if (!strcmp(cp, "b")) 1443 ; /* nothing */ 1444 else if (!strcmp(cp, "Kb")) 1445 bps *= 1000; 1446 else if (!strcmp(cp, "Mb")) 1447 bps *= 1000 * 1000; 1448 else if (!strcmp(cp, "Gb")) 1449 bps *= 1000 * 1000 * 1000; 1450 else if (!strcmp(cp, "%")) { 1451 if (bps < 0 || bps > 100) { 1452 yyerror("bandwidth spec " 1453 "out of range"); 1454 free($1); 1455 YYERROR; 1456 } 1457 $$.bw_percent = bps; 1458 bps = 0; 1459 } else { 1460 yyerror("unknown unit %s", cp); 1461 free($1); 1462 YYERROR; 1463 } 1464 } 1465 free($1); 1466 $$.bw_absolute = (u_int32_t)bps; 1467 } 1468 ; 1469 1470 scheduler : CBQ { 1471 $$.qtype = ALTQT_CBQ; 1472 $$.data.cbq_opts.flags = 0; 1473 } 1474 | CBQ '(' cbqflags_list ')' { 1475 $$.qtype = ALTQT_CBQ; 1476 $$.data.cbq_opts.flags = $3; 1477 } 1478 | PRIQ { 1479 $$.qtype = ALTQT_PRIQ; 1480 $$.data.priq_opts.flags = 0; 1481 } 1482 | PRIQ '(' priqflags_list ')' { 1483 $$.qtype = ALTQT_PRIQ; 1484 $$.data.priq_opts.flags = $3; 1485 } 1486 | HFSC { 1487 $$.qtype = ALTQT_HFSC; 1488 bzero(&$$.data.hfsc_opts, 1489 sizeof(struct node_hfsc_opts)); 1490 } 1491 | HFSC '(' hfsc_opts ')' { 1492 $$.qtype = ALTQT_HFSC; 1493 $$.data.hfsc_opts = $3; 1494 } 1495 ; 1496 1497 cbqflags_list : cbqflags_item { $$ |= $1; } 1498 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1499 ; 1500 1501 cbqflags_item : STRING { 1502 if (!strcmp($1, "default")) 1503 $$ = CBQCLF_DEFCLASS; 1504 #ifdef CBQCLF_BORROW 1505 else if (!strcmp($1, "borrow")) 1506 $$ = CBQCLF_BORROW; 1507 #endif 1508 else if (!strcmp($1, "red")) 1509 $$ = CBQCLF_RED; 1510 else if (!strcmp($1, "ecn")) 1511 $$ = CBQCLF_RED|CBQCLF_ECN; 1512 else if (!strcmp($1, "rio")) 1513 $$ = CBQCLF_RIO; 1514 else { 1515 yyerror("unknown cbq flag \"%s\"", $1); 1516 free($1); 1517 YYERROR; 1518 } 1519 free($1); 1520 } 1521 ; 1522 1523 priqflags_list : priqflags_item { $$ |= $1; } 1524 | priqflags_list comma priqflags_item { $$ |= $3; } 1525 ; 1526 1527 priqflags_item : STRING { 1528 if (!strcmp($1, "default")) 1529 $$ = PRCF_DEFAULTCLASS; 1530 else if (!strcmp($1, "red")) 1531 $$ = PRCF_RED; 1532 else if (!strcmp($1, "ecn")) 1533 $$ = PRCF_RED|PRCF_ECN; 1534 else if (!strcmp($1, "rio")) 1535 $$ = PRCF_RIO; 1536 else { 1537 yyerror("unknown priq flag \"%s\"", $1); 1538 free($1); 1539 YYERROR; 1540 } 1541 free($1); 1542 } 1543 ; 1544 1545 hfsc_opts : { 1546 bzero(&hfsc_opts, 1547 sizeof(struct node_hfsc_opts)); 1548 } 1549 hfscopts_list { 1550 $$ = hfsc_opts; 1551 } 1552 ; 1553 1554 hfscopts_list : hfscopts_item 1555 | hfscopts_list comma hfscopts_item 1556 ; 1557 1558 hfscopts_item : LINKSHARE bandwidth { 1559 if (hfsc_opts.linkshare.used) { 1560 yyerror("linkshare already specified"); 1561 YYERROR; 1562 } 1563 hfsc_opts.linkshare.m2 = $2; 1564 hfsc_opts.linkshare.used = 1; 1565 } 1566 | LINKSHARE '(' bandwidth comma number comma bandwidth ')' 1567 { 1568 if (hfsc_opts.linkshare.used) { 1569 yyerror("linkshare already specified"); 1570 YYERROR; 1571 } 1572 hfsc_opts.linkshare.m1 = $3; 1573 hfsc_opts.linkshare.d = $5; 1574 hfsc_opts.linkshare.m2 = $7; 1575 hfsc_opts.linkshare.used = 1; 1576 } 1577 | REALTIME bandwidth { 1578 if (hfsc_opts.realtime.used) { 1579 yyerror("realtime already specified"); 1580 YYERROR; 1581 } 1582 hfsc_opts.realtime.m2 = $2; 1583 hfsc_opts.realtime.used = 1; 1584 } 1585 | REALTIME '(' bandwidth comma number comma bandwidth ')' 1586 { 1587 if (hfsc_opts.realtime.used) { 1588 yyerror("realtime already specified"); 1589 YYERROR; 1590 } 1591 hfsc_opts.realtime.m1 = $3; 1592 hfsc_opts.realtime.d = $5; 1593 hfsc_opts.realtime.m2 = $7; 1594 hfsc_opts.realtime.used = 1; 1595 } 1596 | UPPERLIMIT bandwidth { 1597 if (hfsc_opts.upperlimit.used) { 1598 yyerror("upperlimit already specified"); 1599 YYERROR; 1600 } 1601 hfsc_opts.upperlimit.m2 = $2; 1602 hfsc_opts.upperlimit.used = 1; 1603 } 1604 | UPPERLIMIT '(' bandwidth comma number comma bandwidth ')' 1605 { 1606 if (hfsc_opts.upperlimit.used) { 1607 yyerror("upperlimit already specified"); 1608 YYERROR; 1609 } 1610 hfsc_opts.upperlimit.m1 = $3; 1611 hfsc_opts.upperlimit.d = $5; 1612 hfsc_opts.upperlimit.m2 = $7; 1613 hfsc_opts.upperlimit.used = 1; 1614 } 1615 | STRING { 1616 if (!strcmp($1, "default")) 1617 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1618 else if (!strcmp($1, "red")) 1619 hfsc_opts.flags |= HFCF_RED; 1620 else if (!strcmp($1, "ecn")) 1621 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1622 else if (!strcmp($1, "rio")) 1623 hfsc_opts.flags |= HFCF_RIO; 1624 else { 1625 yyerror("unknown hfsc flag \"%s\"", $1); 1626 free($1); 1627 YYERROR; 1628 } 1629 free($1); 1630 } 1631 ; 1632 1633 qassign : /* empty */ { $$ = NULL; } 1634 | qassign_item { $$ = $1; } 1635 | '{' qassign_list '}' { $$ = $2; } 1636 ; 1637 1638 qassign_list : qassign_item { $$ = $1; } 1639 | qassign_list comma qassign_item { 1640 $1->tail->next = $3; 1641 $1->tail = $3; 1642 $$ = $1; 1643 } 1644 ; 1645 1646 qassign_item : STRING { 1647 $$ = calloc(1, sizeof(struct node_queue)); 1648 if ($$ == NULL) 1649 err(1, "qassign_item: calloc"); 1650 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1651 sizeof($$->queue)) { 1652 yyerror("queue name '%s' too long (max " 1653 "%d chars)", $1, sizeof($$->queue)-1); 1654 free($1); 1655 free($$); 1656 YYERROR; 1657 } 1658 free($1); 1659 $$->next = NULL; 1660 $$->tail = $$; 1661 } 1662 ; 1663 1664 pfrule : action dir logquick interface route af proto fromto 1665 filter_opts 1666 { 1667 struct pf_rule r; 1668 struct node_state_opt *o; 1669 struct node_proto *proto; 1670 int srctrack = 0; 1671 int statelock = 0; 1672 int adaptive = 0; 1673 1674 if (check_rulestate(PFCTL_STATE_FILTER)) 1675 YYERROR; 1676 1677 memset(&r, 0, sizeof(r)); 1678 1679 r.action = $1.b1; 1680 switch ($1.b2) { 1681 case PFRULE_RETURNRST: 1682 r.rule_flag |= PFRULE_RETURNRST; 1683 r.return_ttl = $1.w; 1684 break; 1685 case PFRULE_RETURNICMP: 1686 r.rule_flag |= PFRULE_RETURNICMP; 1687 r.return_icmp = $1.w; 1688 r.return_icmp6 = $1.w2; 1689 break; 1690 case PFRULE_RETURN: 1691 r.rule_flag |= PFRULE_RETURN; 1692 r.return_icmp = $1.w; 1693 r.return_icmp6 = $1.w2; 1694 break; 1695 } 1696 r.direction = $2; 1697 r.log = $3.log; 1698 r.logif = $3.logif; 1699 r.quick = $3.quick; 1700 r.prob = $9.prob; 1701 r.rtableid = $9.rtableid; 1702 1703 r.af = $6; 1704 if ($9.tag) 1705 if (strlcpy(r.tagname, $9.tag, 1706 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1707 yyerror("tag too long, max %u chars", 1708 PF_TAG_NAME_SIZE - 1); 1709 YYERROR; 1710 } 1711 if ($9.match_tag) 1712 if (strlcpy(r.match_tagname, $9.match_tag, 1713 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1714 yyerror("tag too long, max %u chars", 1715 PF_TAG_NAME_SIZE - 1); 1716 YYERROR; 1717 } 1718 r.match_tag_not = $9.match_tag_not; 1719 if (rule_label(&r, $9.label)) 1720 YYERROR; 1721 free($9.label); 1722 r.flags = $9.flags.b1; 1723 r.flagset = $9.flags.b2; 1724 if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) { 1725 yyerror("flags always false"); 1726 YYERROR; 1727 } 1728 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1729 for (proto = $7; proto != NULL && 1730 proto->proto != IPPROTO_TCP; 1731 proto = proto->next) 1732 ; /* nothing */ 1733 if (proto == NULL && $7 != NULL) { 1734 if ($9.flags.b1 || $9.flags.b2) 1735 yyerror( 1736 "flags only apply to tcp"); 1737 if ($8.src_os) 1738 yyerror( 1739 "OS fingerprinting only " 1740 "apply to tcp"); 1741 YYERROR; 1742 } 1743 #if 0 1744 if (($9.flags.b1 & parse_flags("S")) == 0 && 1745 $8.src_os) { 1746 yyerror("OS fingerprinting requires " 1747 "the SYN TCP flag (flags S/SA)"); 1748 YYERROR; 1749 } 1750 #endif 1751 } 1752 1753 r.tos = $9.tos; 1754 r.keep_state = $9.keep.action; 1755 1756 /* 'keep state' by default on pass rules. */ 1757 if (!r.keep_state && !r.action && 1758 !($9.marker & FOM_KEEP)) 1759 r.keep_state = PF_STATE_NORMAL; 1760 1761 o = $9.keep.options; 1762 while (o) { 1763 struct node_state_opt *p = o; 1764 1765 switch (o->type) { 1766 case PF_STATE_OPT_MAX: 1767 if (r.max_states) { 1768 yyerror("state option 'max' " 1769 "multiple definitions"); 1770 YYERROR; 1771 } 1772 r.max_states = o->data.max_states; 1773 break; 1774 case PF_STATE_OPT_NOSYNC: 1775 if (r.rule_flag & PFRULE_NOSYNC) { 1776 yyerror("state option 'sync' " 1777 "multiple definitions"); 1778 YYERROR; 1779 } 1780 r.rule_flag |= PFRULE_NOSYNC; 1781 break; 1782 case PF_STATE_OPT_SRCTRACK: 1783 if (srctrack) { 1784 yyerror("state option " 1785 "'source-track' " 1786 "multiple definitions"); 1787 YYERROR; 1788 } 1789 srctrack = o->data.src_track; 1790 r.rule_flag |= PFRULE_SRCTRACK; 1791 break; 1792 case PF_STATE_OPT_MAX_SRC_STATES: 1793 if (r.max_src_states) { 1794 yyerror("state option " 1795 "'max-src-states' " 1796 "multiple definitions"); 1797 YYERROR; 1798 } 1799 if (o->data.max_src_states == 0) { 1800 yyerror("'max-src-states' must " 1801 "be > 0"); 1802 YYERROR; 1803 } 1804 r.max_src_states = 1805 o->data.max_src_states; 1806 r.rule_flag |= PFRULE_SRCTRACK; 1807 break; 1808 case PF_STATE_OPT_OVERLOAD: 1809 if (r.overload_tblname[0]) { 1810 yyerror("multiple 'overload' " 1811 "table definitions"); 1812 YYERROR; 1813 } 1814 if (strlcpy(r.overload_tblname, 1815 o->data.overload.tblname, 1816 PF_TABLE_NAME_SIZE) >= 1817 PF_TABLE_NAME_SIZE) { 1818 yyerror("state option: " 1819 "strlcpy"); 1820 YYERROR; 1821 } 1822 r.flush = o->data.overload.flush; 1823 break; 1824 case PF_STATE_OPT_MAX_SRC_CONN: 1825 if (r.max_src_conn) { 1826 yyerror("state option " 1827 "'max-src-conn' " 1828 "multiple definitions"); 1829 YYERROR; 1830 } 1831 if (o->data.max_src_conn == 0) { 1832 yyerror("'max-src-conn' " 1833 "must be > 0"); 1834 YYERROR; 1835 } 1836 r.max_src_conn = 1837 o->data.max_src_conn; 1838 r.rule_flag |= PFRULE_SRCTRACK | 1839 PFRULE_RULESRCTRACK; 1840 break; 1841 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1842 if (r.max_src_conn_rate.limit) { 1843 yyerror("state option " 1844 "'max-src-conn-rate' " 1845 "multiple definitions"); 1846 YYERROR; 1847 } 1848 if (!o->data.max_src_conn_rate.limit || 1849 !o->data.max_src_conn_rate.seconds) { 1850 yyerror("'max-src-conn-rate' " 1851 "values must be > 0"); 1852 YYERROR; 1853 } 1854 if (o->data.max_src_conn_rate.limit > 1855 PF_THRESHOLD_MAX) { 1856 yyerror("'max-src-conn-rate' " 1857 "maximum rate must be < %u", 1858 PF_THRESHOLD_MAX); 1859 YYERROR; 1860 } 1861 r.max_src_conn_rate.limit = 1862 o->data.max_src_conn_rate.limit; 1863 r.max_src_conn_rate.seconds = 1864 o->data.max_src_conn_rate.seconds; 1865 r.rule_flag |= PFRULE_SRCTRACK | 1866 PFRULE_RULESRCTRACK; 1867 break; 1868 case PF_STATE_OPT_MAX_SRC_NODES: 1869 if (r.max_src_nodes) { 1870 yyerror("state option " 1871 "'max-src-nodes' " 1872 "multiple definitions"); 1873 YYERROR; 1874 } 1875 if (o->data.max_src_nodes == 0) { 1876 yyerror("'max-src-nodes' must " 1877 "be > 0"); 1878 YYERROR; 1879 } 1880 r.max_src_nodes = 1881 o->data.max_src_nodes; 1882 r.rule_flag |= PFRULE_SRCTRACK | 1883 PFRULE_RULESRCTRACK; 1884 break; 1885 case PF_STATE_OPT_STATELOCK: 1886 if (statelock) { 1887 yyerror("state locking option: " 1888 "multiple definitions"); 1889 YYERROR; 1890 } 1891 statelock = 1; 1892 r.rule_flag |= o->data.statelock; 1893 break; 1894 case PF_STATE_OPT_TIMEOUT: 1895 if (o->data.timeout.number == 1896 PFTM_ADAPTIVE_START || 1897 o->data.timeout.number == 1898 PFTM_ADAPTIVE_END) 1899 adaptive = 1; 1900 if (r.timeout[o->data.timeout.number]) { 1901 yyerror("state timeout %s " 1902 "multiple definitions", 1903 pf_timeouts[o->data. 1904 timeout.number].name); 1905 YYERROR; 1906 } 1907 r.timeout[o->data.timeout.number] = 1908 o->data.timeout.seconds; 1909 } 1910 o = o->next; 1911 free(p); 1912 } 1913 1914 /* 'flags S/SA' by default on stateful rules */ 1915 if (!r.action && !r.flags && !r.flagset && 1916 !$9.fragment && !($9.marker & FOM_FLAGS) && 1917 r.keep_state) { 1918 r.flags = parse_flags("S"); 1919 r.flagset = parse_flags("SA"); 1920 } 1921 if (!adaptive && r.max_states) { 1922 r.timeout[PFTM_ADAPTIVE_START] = 1923 (r.max_states / 10) * 6; 1924 r.timeout[PFTM_ADAPTIVE_END] = 1925 (r.max_states / 10) * 12; 1926 } 1927 if (r.rule_flag & PFRULE_SRCTRACK) { 1928 if (srctrack == PF_SRCTRACK_GLOBAL && 1929 r.max_src_nodes) { 1930 yyerror("'max-src-nodes' is " 1931 "incompatible with " 1932 "'source-track global'"); 1933 YYERROR; 1934 } 1935 if (srctrack == PF_SRCTRACK_GLOBAL && 1936 r.max_src_conn) { 1937 yyerror("'max-src-conn' is " 1938 "incompatible with " 1939 "'source-track global'"); 1940 YYERROR; 1941 } 1942 if (srctrack == PF_SRCTRACK_GLOBAL && 1943 r.max_src_conn_rate.seconds) { 1944 yyerror("'max-src-conn-rate' is " 1945 "incompatible with " 1946 "'source-track global'"); 1947 YYERROR; 1948 } 1949 if (r.timeout[PFTM_SRC_NODE] < 1950 r.max_src_conn_rate.seconds) 1951 r.timeout[PFTM_SRC_NODE] = 1952 r.max_src_conn_rate.seconds; 1953 r.rule_flag |= PFRULE_SRCTRACK; 1954 if (srctrack == PF_SRCTRACK_RULE) 1955 r.rule_flag |= PFRULE_RULESRCTRACK; 1956 } 1957 if (r.keep_state && !statelock) 1958 r.rule_flag |= default_statelock; 1959 1960 if ($9.fragment) 1961 r.rule_flag |= PFRULE_FRAGMENT; 1962 r.allow_opts = $9.allowopts; 1963 1964 decide_address_family($8.src.host, &r.af); 1965 decide_address_family($8.dst.host, &r.af); 1966 1967 if ($5.rt) { 1968 if (!r.direction) { 1969 yyerror("direction must be explicit " 1970 "with rules that specify routing"); 1971 YYERROR; 1972 } 1973 r.rt = $5.rt; 1974 r.rpool.opts = $5.pool_opts; 1975 if ($5.key != NULL) 1976 memcpy(&r.rpool.key, $5.key, 1977 sizeof(struct pf_poolhashkey)); 1978 } 1979 if (r.rt && r.rt != PF_FASTROUTE) { 1980 decide_address_family($5.host, &r.af); 1981 remove_invalid_hosts(&$5.host, &r.af); 1982 if ($5.host == NULL) { 1983 yyerror("no routing address with " 1984 "matching address family found."); 1985 YYERROR; 1986 } 1987 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1988 PF_POOL_NONE && ($5.host->next != NULL || 1989 $5.host->addr.type == PF_ADDR_TABLE || 1990 DYNIF_MULTIADDR($5.host->addr))) 1991 r.rpool.opts |= PF_POOL_ROUNDROBIN; 1992 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1993 PF_POOL_ROUNDROBIN && 1994 disallow_table($5.host, "tables are only " 1995 "supported in round-robin routing pools")) 1996 YYERROR; 1997 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1998 PF_POOL_ROUNDROBIN && 1999 disallow_alias($5.host, "interface (%s) " 2000 "is only supported in round-robin " 2001 "routing pools")) 2002 YYERROR; 2003 if ($5.host->next != NULL) { 2004 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 2005 PF_POOL_ROUNDROBIN) { 2006 yyerror("r.rpool.opts must " 2007 "be PF_POOL_ROUNDROBIN"); 2008 YYERROR; 2009 } 2010 } 2011 } 2012 if ($9.queues.qname != NULL) { 2013 if (strlcpy(r.qname, $9.queues.qname, 2014 sizeof(r.qname)) >= sizeof(r.qname)) { 2015 yyerror("rule qname too long (max " 2016 "%d chars)", sizeof(r.qname)-1); 2017 YYERROR; 2018 } 2019 free($9.queues.qname); 2020 } 2021 if ($9.queues.pqname != NULL) { 2022 if (strlcpy(r.pqname, $9.queues.pqname, 2023 sizeof(r.pqname)) >= sizeof(r.pqname)) { 2024 yyerror("rule pqname too long (max " 2025 "%d chars)", sizeof(r.pqname)-1); 2026 YYERROR; 2027 } 2028 free($9.queues.pqname); 2029 } 2030 2031 expand_rule(&r, $4, $5.host, $7, $8.src_os, 2032 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 2033 $9.uid, $9.gid, $9.icmpspec, ""); 2034 } 2035 ; 2036 2037 opt_statelock : statelock 2038 { 2039 $$ = calloc(1, sizeof(struct node_state_opt)); 2040 if ($$ == NULL) 2041 err(EXIT_FAILURE, "opt_statelock: calloc"); 2042 $$->type = PF_STATE_OPT_STATELOCK; 2043 $$->data.statelock = $1; 2044 $$->next = NULL; 2045 $$->tail = $$; 2046 } 2047 | /* empty */ { 2048 $$ = NULL; 2049 } 2050 ; 2051 2052 filter_opts : { 2053 bzero(&filter_opts, sizeof filter_opts); 2054 filter_opts.rtableid = -1; 2055 } 2056 filter_opts_l 2057 { $$ = filter_opts; } 2058 | /* empty */ { 2059 bzero(&filter_opts, sizeof filter_opts); 2060 filter_opts.rtableid = -1; 2061 $$ = filter_opts; 2062 } 2063 ; 2064 2065 filter_opts_l : filter_opts_l filter_opt 2066 | filter_opt 2067 ; 2068 2069 filter_opt : USER uids { 2070 if (filter_opts.uid) 2071 $2->tail->next = filter_opts.uid; 2072 filter_opts.uid = $2; 2073 } 2074 | GROUP gids { 2075 if (filter_opts.gid) 2076 $2->tail->next = filter_opts.gid; 2077 filter_opts.gid = $2; 2078 } 2079 | flags { 2080 if (filter_opts.marker & FOM_FLAGS) { 2081 yyerror("flags cannot be redefined"); 2082 YYERROR; 2083 } 2084 filter_opts.marker |= FOM_FLAGS; 2085 filter_opts.flags.b1 |= $1.b1; 2086 filter_opts.flags.b2 |= $1.b2; 2087 filter_opts.flags.w |= $1.w; 2088 filter_opts.flags.w2 |= $1.w2; 2089 } 2090 | icmpspec { 2091 if (filter_opts.marker & FOM_ICMP) { 2092 yyerror("icmp-type cannot be redefined"); 2093 YYERROR; 2094 } 2095 filter_opts.marker |= FOM_ICMP; 2096 filter_opts.icmpspec = $1; 2097 } 2098 | tos { 2099 if (filter_opts.marker & FOM_TOS) { 2100 yyerror("tos cannot be redefined"); 2101 YYERROR; 2102 } 2103 filter_opts.marker |= FOM_TOS; 2104 filter_opts.tos = $1; 2105 } 2106 | keep { 2107 if (filter_opts.marker & FOM_KEEP) { 2108 yyerror("modulate or keep cannot be redefined"); 2109 YYERROR; 2110 } 2111 filter_opts.marker |= FOM_KEEP; 2112 filter_opts.keep.action = $1.action; 2113 filter_opts.keep.options = $1.options; 2114 } 2115 | FRAGMENT { 2116 filter_opts.fragment = 1; 2117 } 2118 | ALLOWOPTS { 2119 filter_opts.allowopts = 1; 2120 } 2121 | label { 2122 if (filter_opts.label) { 2123 yyerror("label cannot be redefined"); 2124 YYERROR; 2125 } 2126 filter_opts.label = $1; 2127 } 2128 | qname { 2129 if (filter_opts.queues.qname) { 2130 yyerror("queue cannot be redefined"); 2131 YYERROR; 2132 } 2133 filter_opts.queues = $1; 2134 } 2135 | TAG string { 2136 filter_opts.tag = $2; 2137 } 2138 | not TAGGED string { 2139 filter_opts.match_tag = $3; 2140 filter_opts.match_tag_not = $1; 2141 } 2142 | PROBABILITY STRING { 2143 char *e; 2144 double p = strtod($2, &e); 2145 2146 if (*e == '%') { 2147 p *= 0.01; 2148 e++; 2149 } 2150 if (*e) { 2151 yyerror("invalid probability: %s", $2); 2152 free($2); 2153 YYERROR; 2154 } 2155 p = floor(p * (UINT_MAX+1.0) + 0.5); 2156 if (p < 1.0 || p >= (UINT_MAX+1.0)) { 2157 yyerror("invalid probability: %s", $2); 2158 free($2); 2159 YYERROR; 2160 } 2161 filter_opts.prob = (u_int32_t)p; 2162 free($2); 2163 } 2164 | RTABLE number { 2165 if ($2 > RT_TABLEID_MAX || $2 < 0) { 2166 yyerror("invalid rtable id"); 2167 YYERROR; 2168 } 2169 filter_opts.rtableid = $2; 2170 } 2171 ; 2172 2173 action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 2174 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 2175 ; 2176 2177 blockspec : /* empty */ { 2178 $$.b2 = blockpolicy; 2179 $$.w = returnicmpdefault; 2180 $$.w2 = returnicmp6default; 2181 } 2182 | DROP { 2183 $$.b2 = PFRULE_DROP; 2184 $$.w = 0; 2185 $$.w2 = 0; 2186 } 2187 | RETURNRST { 2188 $$.b2 = PFRULE_RETURNRST; 2189 $$.w = 0; 2190 $$.w2 = 0; 2191 } 2192 | RETURNRST '(' TTL number ')' { 2193 if ($4 > 255) { 2194 yyerror("illegal ttl value %d", $4); 2195 YYERROR; 2196 } 2197 $$.b2 = PFRULE_RETURNRST; 2198 $$.w = $4; 2199 $$.w2 = 0; 2200 } 2201 | RETURNICMP { 2202 $$.b2 = PFRULE_RETURNICMP; 2203 $$.w = returnicmpdefault; 2204 $$.w2 = returnicmp6default; 2205 } 2206 | RETURNICMP6 { 2207 $$.b2 = PFRULE_RETURNICMP; 2208 $$.w = returnicmpdefault; 2209 $$.w2 = returnicmp6default; 2210 } 2211 | RETURNICMP '(' STRING ')' { 2212 $$.b2 = PFRULE_RETURNICMP; 2213 if (!($$.w = parseicmpspec($3, AF_INET))) { 2214 free($3); 2215 YYERROR; 2216 } 2217 free($3); 2218 $$.w2 = returnicmp6default; 2219 } 2220 | RETURNICMP6 '(' STRING ')' { 2221 $$.b2 = PFRULE_RETURNICMP; 2222 $$.w = returnicmpdefault; 2223 if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 2224 free($3); 2225 YYERROR; 2226 } 2227 free($3); 2228 } 2229 | RETURNICMP '(' STRING comma STRING ')' { 2230 $$.b2 = PFRULE_RETURNICMP; 2231 if (!($$.w = parseicmpspec($3, AF_INET)) || 2232 !($$.w2 = parseicmpspec($5, AF_INET6))) { 2233 free($3); 2234 free($5); 2235 YYERROR; 2236 } 2237 free($3); 2238 free($5); 2239 } 2240 | RETURN { 2241 $$.b2 = PFRULE_RETURN; 2242 $$.w = returnicmpdefault; 2243 $$.w2 = returnicmp6default; 2244 } 2245 ; 2246 2247 dir : /* empty */ { $$ = 0; } 2248 | IN { $$ = PF_IN; } 2249 | OUT { $$ = PF_OUT; } 2250 ; 2251 2252 quick : /* empty */ { $$.quick = 0; } 2253 | QUICK { $$.quick = 1; } 2254 ; 2255 2256 logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; } 2257 | log { $$ = $1; $$.quick = 0; } 2258 | QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; } 2259 | log QUICK { $$ = $1; $$.quick = 1; } 2260 | QUICK log { $$ = $2; $$.quick = 1; } 2261 ; 2262 2263 log : LOG { $$.log = PF_LOG; $$.logif = 0; } 2264 | LOG '(' logopts ')' { 2265 $$.log = PF_LOG | $3.log; 2266 $$.logif = $3.logif; 2267 } 2268 ; 2269 2270 logopts : logopt { $$ = $1; } 2271 | logopts comma logopt { 2272 $$.log = $1.log | $3.log; 2273 $$.logif = $3.logif; 2274 if ($$.logif == 0) 2275 $$.logif = $1.logif; 2276 } 2277 ; 2278 2279 logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; } 2280 | USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2281 | GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; } 2282 | TO string { 2283 const char *errstr = NULL; /* XXX gcc */ 2284 u_int i; 2285 2286 $$.log = 0; 2287 if (strncmp($2, "pflog", 5)) { 2288 yyerror("%s: should be a pflog interface", $2); 2289 free($2); 2290 YYERROR; 2291 } 2292 i = strtonum($2 + 5, 0, 255, &errstr); 2293 if (errstr) { 2294 yyerror("%s: %s", $2, errstr); 2295 free($2); 2296 YYERROR; 2297 } 2298 free($2); 2299 $$.logif = i; 2300 } 2301 ; 2302 2303 interface : /* empty */ { $$ = NULL; } 2304 | ON if_item_not { $$ = $2; } 2305 | ON '{' if_list '}' { $$ = $3; } 2306 ; 2307 2308 if_list : if_item_not { $$ = $1; } 2309 | if_list comma if_item_not { 2310 $1->tail->next = $3; 2311 $1->tail = $3; 2312 $$ = $1; 2313 } 2314 ; 2315 2316 if_item_not : not if_item { $$ = $2; $$->not = $1; } 2317 ; 2318 2319 if_item : STRING { 2320 struct node_host *n; 2321 2322 $$ = calloc(1, sizeof(struct node_if)); 2323 if ($$ == NULL) 2324 err(1, "if_item: calloc"); 2325 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2326 sizeof($$->ifname)) { 2327 free($1); 2328 free($$); 2329 yyerror("interface name too long"); 2330 YYERROR; 2331 } 2332 2333 if ((n = ifa_exists($1)) != NULL) 2334 $$->ifa_flags = n->ifa_flags; 2335 2336 free($1); 2337 $$->not = 0; 2338 $$->next = NULL; 2339 $$->tail = $$; 2340 } 2341 ; 2342 2343 af : /* empty */ { $$ = 0; } 2344 | INET { $$ = AF_INET; } 2345 | INET6 { $$ = AF_INET6; } 2346 ; 2347 2348 proto : /* empty */ { $$ = NULL; } 2349 | PROTO proto_item { $$ = $2; } 2350 | PROTO '{' proto_list '}' { $$ = $3; } 2351 ; 2352 2353 proto_list : proto_item { $$ = $1; } 2354 | proto_list comma proto_item { 2355 $1->tail->next = $3; 2356 $1->tail = $3; 2357 $$ = $1; 2358 } 2359 ; 2360 2361 proto_item : STRING { 2362 u_int8_t pr; 2363 u_long ulval; 2364 2365 if (atoul($1, &ulval) == 0) { 2366 if (ulval > 255) { 2367 yyerror("protocol outside range"); 2368 free($1); 2369 YYERROR; 2370 } 2371 pr = (u_int8_t)ulval; 2372 } else { 2373 struct protoent *p; 2374 2375 p = getprotobyname($1); 2376 if (p == NULL) { 2377 yyerror("unknown protocol %s", $1); 2378 free($1); 2379 YYERROR; 2380 } 2381 pr = p->p_proto; 2382 } 2383 free($1); 2384 if (pr == 0) { 2385 yyerror("proto 0 cannot be used"); 2386 YYERROR; 2387 } 2388 $$ = calloc(1, sizeof(struct node_proto)); 2389 if ($$ == NULL) 2390 err(1, "proto_item: calloc"); 2391 $$->proto = pr; 2392 $$->next = NULL; 2393 $$->tail = $$; 2394 } 2395 ; 2396 2397 fromto : ALL { 2398 $$.src.host = NULL; 2399 $$.src.port = NULL; 2400 $$.dst.host = NULL; 2401 $$.dst.port = NULL; 2402 $$.src_os = NULL; 2403 } 2404 | from os to { 2405 $$.src = $1; 2406 $$.src_os = $2; 2407 $$.dst = $3; 2408 } 2409 ; 2410 2411 os : /* empty */ { $$ = NULL; } 2412 | OS xos { $$ = $2; } 2413 | OS '{' os_list '}' { $$ = $3; } 2414 ; 2415 2416 xos : STRING { 2417 $$ = calloc(1, sizeof(struct node_os)); 2418 if ($$ == NULL) 2419 err(1, "os: calloc"); 2420 $$->os = $1; 2421 $$->tail = $$; 2422 } 2423 ; 2424 2425 os_list : xos { $$ = $1; } 2426 | os_list comma xos { 2427 $1->tail->next = $3; 2428 $1->tail = $3; 2429 $$ = $1; 2430 } 2431 ; 2432 2433 from : /* empty */ { 2434 $$.host = NULL; 2435 $$.port = NULL; 2436 } 2437 | FROM ipportspec { 2438 $$ = $2; 2439 } 2440 ; 2441 2442 to : /* empty */ { 2443 $$.host = NULL; 2444 $$.port = NULL; 2445 } 2446 | TO ipportspec { 2447 if (disallow_urpf_failed($2.host, "\"urpf-failed\" is " 2448 "not permitted in a destination address")) 2449 YYERROR; 2450 $$ = $2; 2451 } 2452 ; 2453 2454 ipportspec : ipspec { 2455 $$.host = $1; 2456 $$.port = NULL; 2457 } 2458 | ipspec PORT portspec { 2459 $$.host = $1; 2460 $$.port = $3; 2461 } 2462 | PORT portspec { 2463 $$.host = NULL; 2464 $$.port = $2; 2465 } 2466 ; 2467 2468 ipspec : ANY { $$ = NULL; } 2469 | xhost { $$ = $1; } 2470 | '{' host_list '}' { $$ = $2; } 2471 ; 2472 2473 host_list : ipspec { $$ = $1; } 2474 | host_list comma ipspec { 2475 if ($3 == NULL) 2476 $$ = $1; 2477 else if ($1 == NULL) 2478 $$ = $3; 2479 else { 2480 $1->tail->next = $3; 2481 $1->tail = $3->tail; 2482 $$ = $1; 2483 } 2484 } 2485 ; 2486 2487 xhost : not host { 2488 struct node_host *n; 2489 2490 for (n = $2; n != NULL; n = n->next) 2491 n->not = $1; 2492 $$ = $2; 2493 } 2494 | not NOROUTE { 2495 $$ = calloc(1, sizeof(struct node_host)); 2496 if ($$ == NULL) 2497 err(1, "xhost: calloc"); 2498 $$->addr.type = PF_ADDR_NOROUTE; 2499 $$->next = NULL; 2500 $$->not = $1; 2501 $$->tail = $$; 2502 } 2503 | not URPFFAILED { 2504 $$ = calloc(1, sizeof(struct node_host)); 2505 if ($$ == NULL) 2506 err(1, "xhost: calloc"); 2507 $$->addr.type = PF_ADDR_URPFFAILED; 2508 $$->next = NULL; 2509 $$->not = $1; 2510 $$->tail = $$; 2511 } 2512 ; 2513 2514 host : STRING { 2515 if (($$ = host($1)) == NULL) { 2516 /* error. "any" is handled elsewhere */ 2517 free($1); 2518 yyerror("could not parse host specification"); 2519 YYERROR; 2520 } 2521 free($1); 2522 2523 } 2524 | STRING '/' number { 2525 char *buf; 2526 2527 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2528 err(1, "host: asprintf"); 2529 free($1); 2530 if (($$ = host(buf)) == NULL) { 2531 /* error. "any" is handled elsewhere */ 2532 free(buf); 2533 yyerror("could not parse host specification"); 2534 YYERROR; 2535 } 2536 free(buf); 2537 } 2538 | dynaddr 2539 | dynaddr '/' number { 2540 struct node_host *n; 2541 2542 $$ = $1; 2543 for (n = $1; n != NULL; n = n->next) 2544 set_ipmask(n, $3); 2545 } 2546 | '<' STRING '>' { 2547 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2548 yyerror("table name '%s' too long", $2); 2549 free($2); 2550 YYERROR; 2551 } 2552 $$ = calloc(1, sizeof(struct node_host)); 2553 if ($$ == NULL) 2554 err(1, "host: calloc"); 2555 $$->addr.type = PF_ADDR_TABLE; 2556 if (strlcpy($$->addr.v.tblname, $2, 2557 sizeof($$->addr.v.tblname)) >= 2558 sizeof($$->addr.v.tblname)) 2559 errx(1, "host: strlcpy"); 2560 free($2); 2561 $$->next = NULL; 2562 $$->tail = $$; 2563 } 2564 | ROUTE STRING { 2565 $$ = calloc(1, sizeof(struct node_host)); 2566 if ($$ == NULL) { 2567 free($2); 2568 err(1, "host: calloc"); 2569 } 2570 $$->addr.type = PF_ADDR_RTLABEL; 2571 if (strlcpy($$->addr.v.rtlabelname, $2, 2572 sizeof($$->addr.v.rtlabelname)) >= 2573 sizeof($$->addr.v.rtlabelname)) { 2574 yyerror("route label too long, max %u chars", 2575 sizeof($$->addr.v.rtlabelname) - 1); 2576 free($2); 2577 free($$); 2578 YYERROR; 2579 } 2580 $$->next = NULL; 2581 $$->tail = $$; 2582 free($2); 2583 } 2584 ; 2585 2586 number : STRING { 2587 u_long ulval; 2588 2589 if (atoul($1, &ulval) == -1) { 2590 yyerror("%s is not a number", $1); 2591 free($1); 2592 YYERROR; 2593 } else 2594 $$ = ulval; 2595 free($1); 2596 } 2597 ; 2598 2599 dynaddr : '(' STRING ')' { 2600 int flags = 0; 2601 char *p, *op; 2602 2603 op = $2; 2604 if (!isalpha((unsigned char)op[0])) { 2605 yyerror("invalid interface name '%s'", op); 2606 free(op); 2607 YYERROR; 2608 } 2609 while ((p = strrchr($2, ':')) != NULL) { 2610 if (!strcmp(p+1, "network")) 2611 flags |= PFI_AFLAG_NETWORK; 2612 else if (!strcmp(p+1, "broadcast")) 2613 flags |= PFI_AFLAG_BROADCAST; 2614 else if (!strcmp(p+1, "peer")) 2615 flags |= PFI_AFLAG_PEER; 2616 else if (!strcmp(p+1, "0")) 2617 flags |= PFI_AFLAG_NOALIAS; 2618 else { 2619 yyerror("interface %s has bad modifier", 2620 $2); 2621 free(op); 2622 YYERROR; 2623 } 2624 *p = '\0'; 2625 } 2626 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2627 free(op); 2628 yyerror("illegal combination of " 2629 "interface modifiers"); 2630 YYERROR; 2631 } 2632 $$ = calloc(1, sizeof(struct node_host)); 2633 if ($$ == NULL) 2634 err(1, "address: calloc"); 2635 $$->af = 0; 2636 set_ipmask($$, 128); 2637 $$->addr.type = PF_ADDR_DYNIFTL; 2638 $$->addr.iflags = flags; 2639 if (strlcpy($$->addr.v.ifname, $2, 2640 sizeof($$->addr.v.ifname)) >= 2641 sizeof($$->addr.v.ifname)) { 2642 free(op); 2643 free($$); 2644 yyerror("interface name too long"); 2645 YYERROR; 2646 } 2647 free(op); 2648 $$->next = NULL; 2649 $$->tail = $$; 2650 } 2651 ; 2652 2653 portspec : port_item { $$ = $1; } 2654 | '{' port_list '}' { $$ = $2; } 2655 ; 2656 2657 port_list : port_item { $$ = $1; } 2658 | port_list comma port_item { 2659 $1->tail->next = $3; 2660 $1->tail = $3; 2661 $$ = $1; 2662 } 2663 ; 2664 2665 port_item : port { 2666 $$ = calloc(1, sizeof(struct node_port)); 2667 if ($$ == NULL) 2668 err(1, "port_item: calloc"); 2669 $$->port[0] = $1.a; 2670 $$->port[1] = $1.b; 2671 if ($1.t) 2672 $$->op = PF_OP_RRG; 2673 else 2674 $$->op = PF_OP_EQ; 2675 $$->next = NULL; 2676 $$->tail = $$; 2677 } 2678 | unaryop port { 2679 if ($2.t) { 2680 yyerror("':' cannot be used with an other " 2681 "port operator"); 2682 YYERROR; 2683 } 2684 $$ = calloc(1, sizeof(struct node_port)); 2685 if ($$ == NULL) 2686 err(1, "port_item: calloc"); 2687 $$->port[0] = $2.a; 2688 $$->port[1] = $2.b; 2689 $$->op = $1; 2690 $$->next = NULL; 2691 $$->tail = $$; 2692 } 2693 | port PORTBINARY port { 2694 if ($1.t || $3.t) { 2695 yyerror("':' cannot be used with an other " 2696 "port operator"); 2697 YYERROR; 2698 } 2699 $$ = calloc(1, sizeof(struct node_port)); 2700 if ($$ == NULL) 2701 err(1, "port_item: calloc"); 2702 $$->port[0] = $1.a; 2703 $$->port[1] = $3.a; 2704 $$->op = $2; 2705 $$->next = NULL; 2706 $$->tail = $$; 2707 } 2708 ; 2709 2710 port : STRING { 2711 char *p = strchr($1, ':'); 2712 2713 if (p == NULL) { 2714 if (($$.a = getservice($1)) == -1) { 2715 free($1); 2716 YYERROR; 2717 } 2718 $$.b = $$.t = 0; 2719 } else { 2720 int port[2]; 2721 2722 *p++ = 0; 2723 if ((port[0] = getservice($1)) == -1 || 2724 (port[1] = getservice(p)) == -1) { 2725 free($1); 2726 YYERROR; 2727 } 2728 $$.a = port[0]; 2729 $$.b = port[1]; 2730 $$.t = PF_OP_RRG; 2731 } 2732 free($1); 2733 } 2734 ; 2735 2736 uids : uid_item { $$ = $1; } 2737 | '{' uid_list '}' { $$ = $2; } 2738 ; 2739 2740 uid_list : uid_item { $$ = $1; } 2741 | uid_list comma uid_item { 2742 $1->tail->next = $3; 2743 $1->tail = $3; 2744 $$ = $1; 2745 } 2746 ; 2747 2748 uid_item : uid { 2749 $$ = calloc(1, sizeof(struct node_uid)); 2750 if ($$ == NULL) 2751 err(1, "uid_item: calloc"); 2752 $$->uid[0] = $1; 2753 $$->uid[1] = $1; 2754 $$->op = PF_OP_EQ; 2755 $$->next = NULL; 2756 $$->tail = $$; 2757 } 2758 | unaryop uid { 2759 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2760 yyerror("user unknown requires operator = or " 2761 "!="); 2762 YYERROR; 2763 } 2764 $$ = calloc(1, sizeof(struct node_uid)); 2765 if ($$ == NULL) 2766 err(1, "uid_item: calloc"); 2767 $$->uid[0] = $2; 2768 $$->uid[1] = $2; 2769 $$->op = $1; 2770 $$->next = NULL; 2771 $$->tail = $$; 2772 } 2773 | uid PORTBINARY uid { 2774 if ($1 == UID_MAX || $3 == UID_MAX) { 2775 yyerror("user unknown requires operator = or " 2776 "!="); 2777 YYERROR; 2778 } 2779 $$ = calloc(1, sizeof(struct node_uid)); 2780 if ($$ == NULL) 2781 err(1, "uid_item: calloc"); 2782 $$->uid[0] = $1; 2783 $$->uid[1] = $3; 2784 $$->op = $2; 2785 $$->next = NULL; 2786 $$->tail = $$; 2787 } 2788 ; 2789 2790 uid : STRING { 2791 u_long ulval; 2792 2793 if (atoul($1, &ulval) == -1) { 2794 if (!strcmp($1, "unknown")) 2795 $$ = UID_MAX; 2796 else { 2797 struct passwd *pw; 2798 2799 if ((pw = getpwnam($1)) == NULL) { 2800 yyerror("unknown user %s", $1); 2801 free($1); 2802 YYERROR; 2803 } 2804 $$ = pw->pw_uid; 2805 } 2806 } else { 2807 if (ulval >= UID_MAX) { 2808 free($1); 2809 yyerror("illegal uid value %lu", ulval); 2810 YYERROR; 2811 } 2812 $$ = ulval; 2813 } 2814 free($1); 2815 } 2816 ; 2817 2818 gids : gid_item { $$ = $1; } 2819 | '{' gid_list '}' { $$ = $2; } 2820 ; 2821 2822 gid_list : gid_item { $$ = $1; } 2823 | gid_list comma gid_item { 2824 $1->tail->next = $3; 2825 $1->tail = $3; 2826 $$ = $1; 2827 } 2828 ; 2829 2830 gid_item : gid { 2831 $$ = calloc(1, sizeof(struct node_gid)); 2832 if ($$ == NULL) 2833 err(1, "gid_item: calloc"); 2834 $$->gid[0] = $1; 2835 $$->gid[1] = $1; 2836 $$->op = PF_OP_EQ; 2837 $$->next = NULL; 2838 $$->tail = $$; 2839 } 2840 | unaryop gid { 2841 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2842 yyerror("group unknown requires operator = or " 2843 "!="); 2844 YYERROR; 2845 } 2846 $$ = calloc(1, sizeof(struct node_gid)); 2847 if ($$ == NULL) 2848 err(1, "gid_item: calloc"); 2849 $$->gid[0] = $2; 2850 $$->gid[1] = $2; 2851 $$->op = $1; 2852 $$->next = NULL; 2853 $$->tail = $$; 2854 } 2855 | gid PORTBINARY gid { 2856 if ($1 == GID_MAX || $3 == GID_MAX) { 2857 yyerror("group unknown requires operator = or " 2858 "!="); 2859 YYERROR; 2860 } 2861 $$ = calloc(1, sizeof(struct node_gid)); 2862 if ($$ == NULL) 2863 err(1, "gid_item: calloc"); 2864 $$->gid[0] = $1; 2865 $$->gid[1] = $3; 2866 $$->op = $2; 2867 $$->next = NULL; 2868 $$->tail = $$; 2869 } 2870 ; 2871 2872 gid : STRING { 2873 u_long ulval; 2874 2875 if (atoul($1, &ulval) == -1) { 2876 if (!strcmp($1, "unknown")) 2877 $$ = GID_MAX; 2878 else { 2879 struct group *grp; 2880 2881 if ((grp = getgrnam($1)) == NULL) { 2882 yyerror("unknown group %s", $1); 2883 free($1); 2884 YYERROR; 2885 } 2886 $$ = grp->gr_gid; 2887 } 2888 } else { 2889 if (ulval >= GID_MAX) { 2890 yyerror("illegal gid value %lu", ulval); 2891 free($1); 2892 YYERROR; 2893 } 2894 $$ = ulval; 2895 } 2896 free($1); 2897 } 2898 ; 2899 2900 flag : STRING { 2901 int f; 2902 2903 if ((f = parse_flags($1)) < 0) { 2904 yyerror("bad flags %s", $1); 2905 free($1); 2906 YYERROR; 2907 } 2908 free($1); 2909 $$.b1 = f; 2910 } 2911 ; 2912 2913 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2914 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2915 | FLAGS ANY { $$.b1 = 0; $$.b2 = 0; } 2916 ; 2917 2918 icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2919 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2920 | ICMP6TYPE icmp6_item { $$ = $2; } 2921 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2922 ; 2923 2924 icmp_list : icmp_item { $$ = $1; } 2925 | icmp_list comma icmp_item { 2926 $1->tail->next = $3; 2927 $1->tail = $3; 2928 $$ = $1; 2929 } 2930 ; 2931 2932 icmp6_list : icmp6_item { $$ = $1; } 2933 | icmp6_list comma icmp6_item { 2934 $1->tail->next = $3; 2935 $1->tail = $3; 2936 $$ = $1; 2937 } 2938 ; 2939 2940 icmp_item : icmptype { 2941 $$ = calloc(1, sizeof(struct node_icmp)); 2942 if ($$ == NULL) 2943 err(1, "icmp_item: calloc"); 2944 $$->type = $1; 2945 $$->code = 0; 2946 $$->proto = IPPROTO_ICMP; 2947 $$->next = NULL; 2948 $$->tail = $$; 2949 } 2950 | icmptype CODE STRING { 2951 const struct icmpcodeent *p; 2952 u_long ulval; 2953 2954 if (atoul($3, &ulval) == 0) { 2955 if (ulval > 255) { 2956 free($3); 2957 yyerror("illegal icmp-code %lu", ulval); 2958 YYERROR; 2959 } 2960 } else { 2961 if ((p = geticmpcodebyname($1-1, $3, 2962 AF_INET)) == NULL) { 2963 yyerror("unknown icmp-code %s", $3); 2964 free($3); 2965 YYERROR; 2966 } 2967 ulval = p->code; 2968 } 2969 free($3); 2970 $$ = calloc(1, sizeof(struct node_icmp)); 2971 if ($$ == NULL) 2972 err(1, "icmp_item: calloc"); 2973 $$->type = $1; 2974 $$->code = ulval + 1; 2975 $$->proto = IPPROTO_ICMP; 2976 $$->next = NULL; 2977 $$->tail = $$; 2978 } 2979 ; 2980 2981 icmp6_item : icmp6type { 2982 $$ = calloc(1, sizeof(struct node_icmp)); 2983 if ($$ == NULL) 2984 err(1, "icmp_item: calloc"); 2985 $$->type = $1; 2986 $$->code = 0; 2987 $$->proto = IPPROTO_ICMPV6; 2988 $$->next = NULL; 2989 $$->tail = $$; 2990 } 2991 | icmp6type CODE STRING { 2992 const struct icmpcodeent *p; 2993 u_long ulval; 2994 2995 if (atoul($3, &ulval) == 0) { 2996 if (ulval > 255) { 2997 yyerror("illegal icmp6-code %lu", 2998 ulval); 2999 free($3); 3000 YYERROR; 3001 } 3002 } else { 3003 if ((p = geticmpcodebyname($1-1, $3, 3004 AF_INET6)) == NULL) { 3005 yyerror("unknown icmp6-code %s", $3); 3006 free($3); 3007 YYERROR; 3008 } 3009 ulval = p->code; 3010 } 3011 free($3); 3012 $$ = calloc(1, sizeof(struct node_icmp)); 3013 if ($$ == NULL) 3014 err(1, "icmp_item: calloc"); 3015 $$->type = $1; 3016 $$->code = ulval + 1; 3017 $$->proto = IPPROTO_ICMPV6; 3018 $$->next = NULL; 3019 $$->tail = $$; 3020 } 3021 ; 3022 3023 icmptype : STRING { 3024 const struct icmptypeent *p; 3025 u_long ulval; 3026 3027 if (atoul($1, &ulval) == 0) { 3028 if (ulval > 255) { 3029 yyerror("illegal icmp-type %lu", ulval); 3030 free($1); 3031 YYERROR; 3032 } 3033 $$ = ulval + 1; 3034 } else { 3035 if ((p = geticmptypebyname($1, AF_INET)) == 3036 NULL) { 3037 yyerror("unknown icmp-type %s", $1); 3038 free($1); 3039 YYERROR; 3040 } 3041 $$ = p->type + 1; 3042 } 3043 free($1); 3044 } 3045 ; 3046 3047 icmp6type : STRING { 3048 const struct icmptypeent *p; 3049 u_long ulval; 3050 3051 if (atoul($1, &ulval) == 0) { 3052 if (ulval > 255) { 3053 yyerror("illegal icmp6-type %lu", 3054 ulval); 3055 free($1); 3056 YYERROR; 3057 } 3058 $$ = ulval + 1; 3059 } else { 3060 if ((p = geticmptypebyname($1, AF_INET6)) == 3061 NULL) { 3062 yyerror("unknown icmp6-type %s", $1); 3063 free($1); 3064 YYERROR; 3065 } 3066 $$ = p->type + 1; 3067 } 3068 free($1); 3069 } 3070 ; 3071 3072 tos : TOS STRING { 3073 if (!strcmp($2, "lowdelay")) 3074 $$ = IPTOS_LOWDELAY; 3075 else if (!strcmp($2, "throughput")) 3076 $$ = IPTOS_THROUGHPUT; 3077 else if (!strcmp($2, "reliability")) 3078 $$ = IPTOS_RELIABILITY; 3079 else if ($2[0] == '0' && $2[1] == 'x') 3080 $$ = strtoul($2, NULL, 16); 3081 else 3082 $$ = strtoul($2, NULL, 10); 3083 if (!$$ || $$ > 255) { 3084 yyerror("illegal tos value %s", $2); 3085 free($2); 3086 YYERROR; 3087 } 3088 free($2); 3089 } 3090 ; 3091 3092 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 3093 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 3094 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 3095 ; 3096 3097 statelock : IFBOUND { 3098 $$ = PFRULE_IFBOUND; 3099 } 3100 | FLOATING { 3101 $$ = 0; 3102 } 3103 ; 3104 3105 keep : NO STATE { 3106 $$.action = 0; 3107 $$.options = NULL; 3108 } 3109 | KEEP STATE state_opt_spec { 3110 $$.action = PF_STATE_NORMAL; 3111 $$.options = $3; 3112 } 3113 | MODULATE STATE state_opt_spec { 3114 $$.action = PF_STATE_MODULATE; 3115 $$.options = $3; 3116 } 3117 | SYNPROXY STATE state_opt_spec { 3118 $$.action = PF_STATE_SYNPROXY; 3119 $$.options = $3; 3120 } 3121 ; 3122 3123 flush : /* empty */ { $$ = 0; } 3124 | FLUSH { $$ = PF_FLUSH; } 3125 | FLUSH GLOBAL { 3126 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 3127 } 3128 ; 3129 3130 state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 3131 | /* empty */ { $$ = NULL; } 3132 ; 3133 3134 state_opt_list : state_opt_item { $$ = $1; } 3135 | state_opt_list comma state_opt_item { 3136 $1->tail->next = $3; 3137 $1->tail = $3; 3138 $$ = $1; 3139 } 3140 ; 3141 3142 state_opt_item : MAXIMUM number { 3143 $$ = calloc(1, sizeof(struct node_state_opt)); 3144 if ($$ == NULL) 3145 err(1, "state_opt_item: calloc"); 3146 $$->type = PF_STATE_OPT_MAX; 3147 $$->data.max_states = $2; 3148 $$->next = NULL; 3149 $$->tail = $$; 3150 } 3151 | NOSYNC { 3152 $$ = calloc(1, sizeof(struct node_state_opt)); 3153 if ($$ == NULL) 3154 err(1, "state_opt_item: calloc"); 3155 $$->type = PF_STATE_OPT_NOSYNC; 3156 $$->next = NULL; 3157 $$->tail = $$; 3158 } 3159 | MAXSRCSTATES number { 3160 $$ = calloc(1, sizeof(struct node_state_opt)); 3161 if ($$ == NULL) 3162 err(1, "state_opt_item: calloc"); 3163 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 3164 $$->data.max_src_states = $2; 3165 $$->next = NULL; 3166 $$->tail = $$; 3167 } 3168 | MAXSRCCONN number { 3169 $$ = calloc(1, sizeof(struct node_state_opt)); 3170 if ($$ == NULL) 3171 err(1, "state_opt_item: calloc"); 3172 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 3173 $$->data.max_src_conn = $2; 3174 $$->next = NULL; 3175 $$->tail = $$; 3176 } 3177 | MAXSRCCONNRATE number '/' number { 3178 $$ = calloc(1, sizeof(struct node_state_opt)); 3179 if ($$ == NULL) 3180 err(1, "state_opt_item: calloc"); 3181 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 3182 $$->data.max_src_conn_rate.limit = $2; 3183 $$->data.max_src_conn_rate.seconds = $4; 3184 $$->next = NULL; 3185 $$->tail = $$; 3186 } 3187 | OVERLOAD '<' STRING '>' flush { 3188 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 3189 yyerror("table name '%s' too long", $3); 3190 free($3); 3191 YYERROR; 3192 } 3193 $$ = calloc(1, sizeof(struct node_state_opt)); 3194 if ($$ == NULL) 3195 err(1, "state_opt_item: calloc"); 3196 if (strlcpy($$->data.overload.tblname, $3, 3197 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 3198 errx(1, "state_opt_item: strlcpy"); 3199 free($3); 3200 $$->type = PF_STATE_OPT_OVERLOAD; 3201 $$->data.overload.flush = $5; 3202 $$->next = NULL; 3203 $$->tail = $$; 3204 } 3205 | MAXSRCNODES number { 3206 $$ = calloc(1, sizeof(struct node_state_opt)); 3207 if ($$ == NULL) 3208 err(1, "state_opt_item: calloc"); 3209 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 3210 $$->data.max_src_nodes = $2; 3211 $$->next = NULL; 3212 $$->tail = $$; 3213 } 3214 | sourcetrack { 3215 $$ = calloc(1, sizeof(struct node_state_opt)); 3216 if ($$ == NULL) 3217 err(1, "state_opt_item: calloc"); 3218 $$->type = PF_STATE_OPT_SRCTRACK; 3219 $$->data.src_track = $1; 3220 $$->next = NULL; 3221 $$->tail = $$; 3222 } 3223 | statelock { 3224 $$ = calloc(1, sizeof(struct node_state_opt)); 3225 if ($$ == NULL) 3226 err(1, "state_opt_item: calloc"); 3227 $$->type = PF_STATE_OPT_STATELOCK; 3228 $$->data.statelock = $1; 3229 $$->next = NULL; 3230 $$->tail = $$; 3231 } 3232 | STRING number { 3233 int i; 3234 3235 for (i = 0; pf_timeouts[i].name && 3236 strcmp(pf_timeouts[i].name, $1); ++i) 3237 ; /* nothing */ 3238 if (!pf_timeouts[i].name) { 3239 yyerror("illegal timeout name %s", $1); 3240 free($1); 3241 YYERROR; 3242 } 3243 if (strchr(pf_timeouts[i].name, '.') == NULL) { 3244 yyerror("illegal state timeout %s", $1); 3245 free($1); 3246 YYERROR; 3247 } 3248 free($1); 3249 $$ = calloc(1, sizeof(struct node_state_opt)); 3250 if ($$ == NULL) 3251 err(1, "state_opt_item: calloc"); 3252 $$->type = PF_STATE_OPT_TIMEOUT; 3253 $$->data.timeout.number = pf_timeouts[i].timeout; 3254 $$->data.timeout.seconds = $2; 3255 $$->next = NULL; 3256 $$->tail = $$; 3257 } 3258 ; 3259 3260 label : LABEL STRING { 3261 $$ = $2; 3262 } 3263 ; 3264 3265 qname : QUEUE STRING { 3266 $$.qname = $2; 3267 } 3268 | QUEUE '(' STRING ')' { 3269 $$.qname = $3; 3270 } 3271 | QUEUE '(' STRING comma STRING ')' { 3272 $$.qname = $3; 3273 $$.pqname = $5; 3274 } 3275 ; 3276 3277 no : /* empty */ { $$ = 0; } 3278 | NO { $$ = 1; } 3279 ; 3280 3281 rport : STRING { 3282 char *p = strchr($1, ':'); 3283 3284 if (p == NULL) { 3285 if (($$.a = getservice($1)) == -1) { 3286 free($1); 3287 YYERROR; 3288 } 3289 $$.b = $$.t = 0; 3290 } else if (!strcmp(p+1, "*")) { 3291 *p = 0; 3292 if (($$.a = getservice($1)) == -1) { 3293 free($1); 3294 YYERROR; 3295 } 3296 $$.b = 0; 3297 $$.t = 1; 3298 } else { 3299 *p++ = 0; 3300 if (($$.a = getservice($1)) == -1 || 3301 ($$.b = getservice(p)) == -1) { 3302 free($1); 3303 YYERROR; 3304 } 3305 if ($$.a == $$.b) 3306 $$.b = 0; 3307 $$.t = 0; 3308 } 3309 free($1); 3310 } 3311 ; 3312 3313 redirspec : host { $$ = $1; } 3314 | '{' redir_host_list '}' { $$ = $2; } 3315 ; 3316 3317 redir_host_list : host { $$ = $1; } 3318 | redir_host_list comma host { 3319 $1->tail->next = $3; 3320 $1->tail = $3->tail; 3321 $$ = $1; 3322 } 3323 ; 3324 3325 redirpool : /* empty */ { $$ = NULL; } 3326 | ARROW redirspec { 3327 $$ = calloc(1, sizeof(struct redirection)); 3328 if ($$ == NULL) 3329 err(1, "redirection: calloc"); 3330 $$->host = $2; 3331 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3332 } 3333 | ARROW redirspec PORT rport { 3334 $$ = calloc(1, sizeof(struct redirection)); 3335 if ($$ == NULL) 3336 err(1, "redirection: calloc"); 3337 $$->host = $2; 3338 $$->rport = $4; 3339 } 3340 ; 3341 3342 hashkey : /* empty */ 3343 { 3344 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3345 if ($$ == NULL) 3346 err(1, "hashkey: calloc"); 3347 $$->key32[0] = arc4random(); 3348 $$->key32[1] = arc4random(); 3349 $$->key32[2] = arc4random(); 3350 $$->key32[3] = arc4random(); 3351 } 3352 | string 3353 { 3354 if (!strncmp($1, "0x", 2)) { 3355 if (strlen($1) != 34) { 3356 free($1); 3357 yyerror("hex key must be 128 bits " 3358 "(32 hex digits) long"); 3359 YYERROR; 3360 } 3361 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3362 if ($$ == NULL) 3363 err(1, "hashkey: calloc"); 3364 3365 if (sscanf($1, "0x%8x%8x%8x%8x", 3366 &$$->key32[0], &$$->key32[1], 3367 &$$->key32[2], &$$->key32[3]) != 4) { 3368 free($$); 3369 free($1); 3370 yyerror("invalid hex key"); 3371 YYERROR; 3372 } 3373 } else { 3374 MD5_CTX context; 3375 3376 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3377 if ($$ == NULL) 3378 err(1, "hashkey: calloc"); 3379 MD5Init(&context); 3380 MD5Update(&context, (unsigned char *)$1, 3381 strlen($1)); 3382 MD5Final((unsigned char *)$$, &context); 3383 HTONL($$->key32[0]); 3384 HTONL($$->key32[1]); 3385 HTONL($$->key32[2]); 3386 HTONL($$->key32[3]); 3387 } 3388 free($1); 3389 } 3390 ; 3391 3392 pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3393 pool_opts_l 3394 { $$ = pool_opts; } 3395 | /* empty */ { 3396 bzero(&pool_opts, sizeof pool_opts); 3397 $$ = pool_opts; 3398 } 3399 ; 3400 3401 pool_opts_l : pool_opts_l pool_opt 3402 | pool_opt 3403 ; 3404 3405 pool_opt : BITMASK { 3406 if (pool_opts.type) { 3407 yyerror("pool type cannot be redefined"); 3408 YYERROR; 3409 } 3410 pool_opts.type = PF_POOL_BITMASK; 3411 } 3412 | RANDOM { 3413 if (pool_opts.type) { 3414 yyerror("pool type cannot be redefined"); 3415 YYERROR; 3416 } 3417 pool_opts.type = PF_POOL_RANDOM; 3418 } 3419 | SOURCEHASH hashkey { 3420 if (pool_opts.type) { 3421 yyerror("pool type cannot be redefined"); 3422 YYERROR; 3423 } 3424 pool_opts.type = PF_POOL_SRCHASH; 3425 pool_opts.key = $2; 3426 } 3427 | ROUNDROBIN { 3428 if (pool_opts.type) { 3429 yyerror("pool type cannot be redefined"); 3430 YYERROR; 3431 } 3432 pool_opts.type = PF_POOL_ROUNDROBIN; 3433 } 3434 | STATICPORT { 3435 if (pool_opts.staticport) { 3436 yyerror("static-port cannot be redefined"); 3437 YYERROR; 3438 } 3439 pool_opts.staticport = 1; 3440 } 3441 | STICKYADDRESS { 3442 if (filter_opts.marker & POM_STICKYADDRESS) { 3443 yyerror("sticky-address cannot be redefined"); 3444 YYERROR; 3445 } 3446 pool_opts.marker |= POM_STICKYADDRESS; 3447 pool_opts.opts |= PF_POOL_STICKYADDR; 3448 } 3449 ; 3450 3451 redirection : /* empty */ { $$ = NULL; } 3452 | ARROW host { 3453 $$ = calloc(1, sizeof(struct redirection)); 3454 if ($$ == NULL) 3455 err(1, "redirection: calloc"); 3456 $$->host = $2; 3457 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3458 } 3459 | ARROW host PORT rport { 3460 $$ = calloc(1, sizeof(struct redirection)); 3461 if ($$ == NULL) 3462 err(1, "redirection: calloc"); 3463 $$->host = $2; 3464 $$->rport = $4; 3465 } 3466 ; 3467 3468 natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; } 3469 | PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; } 3470 | PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; } 3471 | log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; } 3472 ; 3473 3474 nataction : no NAT natpasslog { 3475 if ($1 && $3.b1) { 3476 yyerror("\"pass\" not valid with \"no\""); 3477 YYERROR; 3478 } 3479 if ($1) 3480 $$.b1 = PF_NONAT; 3481 else 3482 $$.b1 = PF_NAT; 3483 $$.b2 = $3.b1; 3484 $$.w = $3.b2; 3485 $$.w2 = $3.w2; 3486 } 3487 | no RDR natpasslog { 3488 if ($1 && $3.b1) { 3489 yyerror("\"pass\" not valid with \"no\""); 3490 YYERROR; 3491 } 3492 if ($1) 3493 $$.b1 = PF_NORDR; 3494 else 3495 $$.b1 = PF_RDR; 3496 $$.b2 = $3.b1; 3497 $$.w = $3.b2; 3498 $$.w2 = $3.w2; 3499 } 3500 ; 3501 3502 natrule : nataction interface af proto fromto tag tagged rtable 3503 redirpool pool_opts opt_statelock 3504 { 3505 struct pf_rule r; 3506 3507 if (check_rulestate(PFCTL_STATE_NAT)) 3508 YYERROR; 3509 3510 memset(&r, 0, sizeof(r)); 3511 3512 r.action = $1.b1; 3513 r.natpass = $1.b2; 3514 r.log = $1.w; 3515 r.logif = $1.w2; 3516 r.af = $3; 3517 3518 if (!r.af) { 3519 if ($5.src.host && $5.src.host->af && 3520 !$5.src.host->ifindex) 3521 r.af = $5.src.host->af; 3522 else if ($5.dst.host && $5.dst.host->af && 3523 !$5.dst.host->ifindex) 3524 r.af = $5.dst.host->af; 3525 } 3526 3527 if ($6 != NULL) 3528 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3529 PF_TAG_NAME_SIZE) { 3530 yyerror("tag too long, max %u chars", 3531 PF_TAG_NAME_SIZE - 1); 3532 YYERROR; 3533 } 3534 3535 if ($7.name) 3536 if (strlcpy(r.match_tagname, $7.name, 3537 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3538 yyerror("tag too long, max %u chars", 3539 PF_TAG_NAME_SIZE - 1); 3540 YYERROR; 3541 } 3542 r.match_tag_not = $7.neg; 3543 r.rtableid = $8; 3544 3545 if (r.action == PF_NONAT || r.action == PF_NORDR) { 3546 if ($9 != NULL) { 3547 yyerror("translation rule with 'no' " 3548 "does not need '->'"); 3549 YYERROR; 3550 } 3551 } else { 3552 if ($9 == NULL || $9->host == NULL) { 3553 yyerror("translation rule requires '-> " 3554 "address'"); 3555 YYERROR; 3556 } 3557 if (!r.af && ! $9->host->ifindex) 3558 r.af = $9->host->af; 3559 3560 remove_invalid_hosts(&$9->host, &r.af); 3561 if (invalid_redirect($9->host, r.af)) 3562 YYERROR; 3563 if (check_netmask($9->host, r.af)) 3564 YYERROR; 3565 3566 r.rpool.proxy_port[0] = ntohs($9->rport.a); 3567 3568 switch (r.action) { 3569 case PF_RDR: 3570 if (!$9->rport.b && $9->rport.t && 3571 $5.dst.port != NULL) { 3572 r.rpool.proxy_port[1] = 3573 ntohs($9->rport.a) + 3574 (ntohs( 3575 $5.dst.port->port[1]) - 3576 ntohs( 3577 $5.dst.port->port[0])); 3578 } else 3579 r.rpool.proxy_port[1] = 3580 ntohs($9->rport.b); 3581 break; 3582 case PF_NAT: 3583 r.rpool.proxy_port[1] = 3584 ntohs($9->rport.b); 3585 if (!r.rpool.proxy_port[0] && 3586 !r.rpool.proxy_port[1]) { 3587 r.rpool.proxy_port[0] = 3588 PF_NAT_PROXY_PORT_LOW; 3589 r.rpool.proxy_port[1] = 3590 PF_NAT_PROXY_PORT_HIGH; 3591 } else if (!r.rpool.proxy_port[1]) 3592 r.rpool.proxy_port[1] = 3593 r.rpool.proxy_port[0]; 3594 break; 3595 default: 3596 break; 3597 } 3598 3599 r.rpool.opts = $10.type; 3600 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3601 PF_POOL_NONE && ($9->host->next != NULL || 3602 $9->host->addr.type == PF_ADDR_TABLE || 3603 DYNIF_MULTIADDR($9->host->addr))) 3604 r.rpool.opts = PF_POOL_ROUNDROBIN; 3605 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3606 PF_POOL_ROUNDROBIN && 3607 disallow_table($9->host, "tables are only " 3608 "supported in round-robin redirection " 3609 "pools")) 3610 YYERROR; 3611 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3612 PF_POOL_ROUNDROBIN && 3613 disallow_alias($9->host, "interface (%s) " 3614 "is only supported in round-robin " 3615 "redirection pools")) 3616 YYERROR; 3617 if ($9->host->next != NULL) { 3618 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3619 PF_POOL_ROUNDROBIN) { 3620 yyerror("only round-robin " 3621 "valid for multiple " 3622 "redirection addresses"); 3623 YYERROR; 3624 } 3625 } 3626 } 3627 3628 if ($10.key != NULL) 3629 memcpy(&r.rpool.key, $10.key, 3630 sizeof(struct pf_poolhashkey)); 3631 3632 if ($10.opts) 3633 r.rpool.opts |= $10.opts; 3634 3635 if ($10.staticport) { 3636 if (r.action != PF_NAT) { 3637 yyerror("the 'static-port' option is " 3638 "only valid with nat rules"); 3639 YYERROR; 3640 } 3641 if (r.rpool.proxy_port[0] != 3642 PF_NAT_PROXY_PORT_LOW && 3643 r.rpool.proxy_port[1] != 3644 PF_NAT_PROXY_PORT_HIGH) { 3645 yyerror("the 'static-port' option can't" 3646 " be used when specifying a port" 3647 " range"); 3648 YYERROR; 3649 } 3650 r.rpool.proxy_port[0] = 0; 3651 r.rpool.proxy_port[1] = 0; 3652 } 3653 3654 if ($11 == NULL) 3655 r.rule_flag |= default_statelock; 3656 else { 3657 r.rule_flag |= $11->data.statelock; 3658 free($11); 3659 } 3660 3661 expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4, 3662 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3663 $5.dst.port, 0, 0, 0, ""); 3664 free($9); 3665 } 3666 ; 3667 3668 binatrule : no BINAT natpasslog interface af proto FROM host TO ipspec tag 3669 tagged rtable redirection 3670 { 3671 struct pf_rule binat; 3672 struct pf_pooladdr *pa; 3673 3674 if (check_rulestate(PFCTL_STATE_NAT)) 3675 YYERROR; 3676 if (disallow_urpf_failed($10, "\"urpf-failed\" is not " 3677 "permitted as a binat destination")) 3678 YYERROR; 3679 3680 memset(&binat, 0, sizeof(binat)); 3681 3682 if ($1 && $3.b1) { 3683 yyerror("\"pass\" not valid with \"no\""); 3684 YYERROR; 3685 } 3686 if ($1) 3687 binat.action = PF_NOBINAT; 3688 else 3689 binat.action = PF_BINAT; 3690 binat.natpass = $3.b1; 3691 binat.log = $3.b2; 3692 binat.logif = $3.w2; 3693 binat.af = $5; 3694 if (!binat.af && $8 != NULL && $8->af) 3695 binat.af = $8->af; 3696 if (!binat.af && $10 != NULL && $10->af) 3697 binat.af = $10->af; 3698 3699 if (!binat.af && $14 != NULL && $14->host) 3700 binat.af = $14->host->af; 3701 if (!binat.af) { 3702 yyerror("address family (inet/inet6) " 3703 "undefined"); 3704 YYERROR; 3705 } 3706 3707 if ($4 != NULL) { 3708 memcpy(binat.ifname, $4->ifname, 3709 sizeof(binat.ifname)); 3710 binat.ifnot = $4->not; 3711 free($4); 3712 } 3713 3714 if ($11 != NULL) 3715 if (strlcpy(binat.tagname, $11, 3716 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3717 yyerror("tag too long, max %u chars", 3718 PF_TAG_NAME_SIZE - 1); 3719 YYERROR; 3720 } 3721 if ($12.name) 3722 if (strlcpy(binat.match_tagname, $12.name, 3723 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3724 yyerror("tag too long, max %u chars", 3725 PF_TAG_NAME_SIZE - 1); 3726 YYERROR; 3727 } 3728 binat.match_tag_not = $12.neg; 3729 binat.rtableid = $13; 3730 3731 if ($6 != NULL) { 3732 binat.proto = $6->proto; 3733 free($6); 3734 } 3735 3736 if ($8 != NULL && disallow_table($8, "invalid use of " 3737 "table <%s> as the source address of a binat rule")) 3738 YYERROR; 3739 if ($8 != NULL && disallow_alias($8, "invalid use of " 3740 "interface (%s) as the source address of a binat " 3741 "rule")) 3742 YYERROR; 3743 if ($14 != NULL && $14->host != NULL && disallow_table( 3744 $14->host, "invalid use of table <%s> as the " 3745 "redirect address of a binat rule")) 3746 YYERROR; 3747 if ($14 != NULL && $14->host != NULL && disallow_alias( 3748 $14->host, "invalid use of interface (%s) as the " 3749 "redirect address of a binat rule")) 3750 YYERROR; 3751 3752 if ($8 != NULL) { 3753 if ($8->next) { 3754 yyerror("multiple binat ip addresses"); 3755 YYERROR; 3756 } 3757 if ($8->addr.type == PF_ADDR_DYNIFTL) 3758 $8->af = binat.af; 3759 if ($8->af != binat.af) { 3760 yyerror("binat ip versions must match"); 3761 YYERROR; 3762 } 3763 if (check_netmask($8, binat.af)) 3764 YYERROR; 3765 memcpy(&binat.src.addr, &$8->addr, 3766 sizeof(binat.src.addr)); 3767 free($8); 3768 } 3769 if ($10 != NULL) { 3770 if ($10->next) { 3771 yyerror("multiple binat ip addresses"); 3772 YYERROR; 3773 } 3774 if ($10->af != binat.af && $10->af) { 3775 yyerror("binat ip versions must match"); 3776 YYERROR; 3777 } 3778 if (check_netmask($10, binat.af)) 3779 YYERROR; 3780 memcpy(&binat.dst.addr, &$10->addr, 3781 sizeof(binat.dst.addr)); 3782 binat.dst.neg = $10->not; 3783 free($10); 3784 } 3785 3786 if (binat.action == PF_NOBINAT) { 3787 if ($14 != NULL) { 3788 yyerror("'no binat' rule does not need" 3789 " '->'"); 3790 YYERROR; 3791 } 3792 } else { 3793 if ($14 == NULL || $14->host == NULL) { 3794 yyerror("'binat' rule requires" 3795 " '-> address'"); 3796 YYERROR; 3797 } 3798 3799 remove_invalid_hosts(&$14->host, &binat.af); 3800 if (invalid_redirect($14->host, binat.af)) 3801 YYERROR; 3802 if ($14->host->next != NULL) { 3803 yyerror("binat rule must redirect to " 3804 "a single address"); 3805 YYERROR; 3806 } 3807 if (check_netmask($14->host, binat.af)) 3808 YYERROR; 3809 3810 if (!PF_AZERO(&binat.src.addr.v.a.mask, 3811 binat.af) && 3812 !PF_AEQ(&binat.src.addr.v.a.mask, 3813 &$14->host->addr.v.a.mask, binat.af)) { 3814 yyerror("'binat' source mask and " 3815 "redirect mask must be the same"); 3816 YYERROR; 3817 } 3818 3819 TAILQ_INIT(&binat.rpool.list); 3820 pa = calloc(1, sizeof(struct pf_pooladdr)); 3821 if (pa == NULL) 3822 err(1, "binat: calloc"); 3823 pa->addr = $14->host->addr; 3824 pa->ifname[0] = 0; 3825 TAILQ_INSERT_TAIL(&binat.rpool.list, 3826 pa, entries); 3827 3828 free($14); 3829 } 3830 3831 pfctl_add_rule(pf, &binat, ""); 3832 } 3833 ; 3834 3835 tag : /* empty */ { $$ = NULL; } 3836 | TAG STRING { $$ = $2; } 3837 ; 3838 3839 tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 3840 | not TAGGED string { $$.neg = $1; $$.name = $3; } 3841 ; 3842 3843 rtable : /* empty */ { $$ = -1; } 3844 | RTABLE number { 3845 if ($2 > RT_TABLEID_MAX || $2 < 0) { 3846 yyerror("invalid rtable id"); 3847 YYERROR; 3848 } 3849 $$ = $2; 3850 } 3851 ; 3852 3853 route_host : STRING { 3854 $$ = calloc(1, sizeof(struct node_host)); 3855 if ($$ == NULL) 3856 err(1, "route_host: calloc"); 3857 $$->ifname = $1; 3858 set_ipmask($$, 128); 3859 $$->next = NULL; 3860 $$->tail = $$; 3861 } 3862 | '(' STRING host ')' { 3863 $$ = $3; 3864 $$->ifname = $2; 3865 } 3866 ; 3867 3868 route_host_list : route_host { $$ = $1; } 3869 | route_host_list comma route_host { 3870 if ($1->af == 0) 3871 $1->af = $3->af; 3872 if ($1->af != $3->af) { 3873 yyerror("all pool addresses must be in the " 3874 "same address family"); 3875 YYERROR; 3876 } 3877 $1->tail->next = $3; 3878 $1->tail = $3->tail; 3879 $$ = $1; 3880 } 3881 ; 3882 3883 routespec : route_host { $$ = $1; } 3884 | '{' route_host_list '}' { $$ = $2; } 3885 ; 3886 3887 route : /* empty */ { 3888 $$.host = NULL; 3889 $$.rt = 0; 3890 $$.pool_opts = 0; 3891 } 3892 | FASTROUTE { 3893 $$.host = NULL; 3894 $$.rt = PF_FASTROUTE; 3895 $$.pool_opts = 0; 3896 } 3897 | ROUTETO routespec pool_opts { 3898 $$.host = $2; 3899 $$.rt = PF_ROUTETO; 3900 $$.pool_opts = $3.type | $3.opts; 3901 if ($3.key != NULL) 3902 $$.key = $3.key; 3903 } 3904 | REPLYTO routespec pool_opts { 3905 $$.host = $2; 3906 $$.rt = PF_REPLYTO; 3907 $$.pool_opts = $3.type | $3.opts; 3908 if ($3.key != NULL) 3909 $$.key = $3.key; 3910 } 3911 | DUPTO routespec pool_opts { 3912 $$.host = $2; 3913 $$.rt = PF_DUPTO; 3914 $$.pool_opts = $3.type | $3.opts; 3915 if ($3.key != NULL) 3916 $$.key = $3.key; 3917 } 3918 ; 3919 3920 timeout_spec : STRING number 3921 { 3922 if (check_rulestate(PFCTL_STATE_OPTION)) { 3923 free($1); 3924 YYERROR; 3925 } 3926 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3927 yyerror("unknown timeout %s", $1); 3928 free($1); 3929 YYERROR; 3930 } 3931 free($1); 3932 } 3933 ; 3934 3935 timeout_list : timeout_list comma timeout_spec 3936 | timeout_spec 3937 ; 3938 3939 limit_spec : STRING number 3940 { 3941 if (check_rulestate(PFCTL_STATE_OPTION)) { 3942 free($1); 3943 YYERROR; 3944 } 3945 if (pfctl_set_limit(pf, $1, $2) != 0) { 3946 yyerror("unable to set limit %s %u", $1, $2); 3947 free($1); 3948 YYERROR; 3949 } 3950 free($1); 3951 } 3952 ; 3953 3954 limit_list : limit_list comma limit_spec 3955 | limit_spec 3956 ; 3957 3958 comma : ',' 3959 | /* empty */ 3960 ; 3961 3962 yesno : NO { $$ = 0; } 3963 | STRING { 3964 if (!strcmp($1, "yes")) 3965 $$ = 1; 3966 else { 3967 yyerror("invalid value '%s', expected 'yes' " 3968 "or 'no'", $1); 3969 free($1); 3970 YYERROR; 3971 } 3972 free($1); 3973 } 3974 ; 3975 3976 unaryop : '=' { $$ = PF_OP_EQ; } 3977 | '!' '=' { $$ = PF_OP_NE; } 3978 | '<' '=' { $$ = PF_OP_LE; } 3979 | '<' { $$ = PF_OP_LT; } 3980 | '>' '=' { $$ = PF_OP_GE; } 3981 | '>' { $$ = PF_OP_GT; } 3982 ; 3983 3984 %% 3985 3986 int 3987 yyerror(const char *fmt, ...) 3988 { 3989 va_list ap; 3990 extern const char *infile; 3991 3992 errors = 1; 3993 va_start(ap, fmt); 3994 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3995 vfprintf(stderr, fmt, ap); 3996 fprintf(stderr, "\n"); 3997 va_end(ap); 3998 return (0); 3999 } 4000 4001 int 4002 disallow_table(struct node_host *h, const char *fmt) 4003 { 4004 for (; h != NULL; h = h->next) 4005 if (h->addr.type == PF_ADDR_TABLE) { 4006 yyerror(fmt, h->addr.v.tblname); 4007 return (1); 4008 } 4009 return (0); 4010 } 4011 4012 int 4013 disallow_urpf_failed(struct node_host *h, const char *fmt) 4014 { 4015 for (; h != NULL; h = h->next) 4016 if (h->addr.type == PF_ADDR_URPFFAILED) { 4017 yyerror(fmt); 4018 return (1); 4019 } 4020 return (0); 4021 } 4022 4023 int 4024 disallow_alias(struct node_host *h, const char *fmt) 4025 { 4026 for (; h != NULL; h = h->next) 4027 if (DYNIF_MULTIADDR(h->addr)) { 4028 yyerror(fmt, h->addr.v.tblname); 4029 return (1); 4030 } 4031 return (0); 4032 } 4033 4034 int 4035 rule_consistent(struct pf_rule *r, int anchor_call) 4036 { 4037 int problems = 0; 4038 4039 switch (r->action) { 4040 case PF_PASS: 4041 case PF_DROP: 4042 case PF_SCRUB: 4043 case PF_NOSCRUB: 4044 problems = filter_consistent(r, anchor_call); 4045 break; 4046 case PF_NAT: 4047 case PF_NONAT: 4048 problems = nat_consistent(r); 4049 break; 4050 case PF_RDR: 4051 case PF_NORDR: 4052 problems = rdr_consistent(r); 4053 break; 4054 case PF_BINAT: 4055 case PF_NOBINAT: 4056 default: 4057 break; 4058 } 4059 return (problems); 4060 } 4061 4062 int 4063 filter_consistent(struct pf_rule *r, int anchor_call) 4064 { 4065 int problems = 0; 4066 4067 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 4068 (r->src.port_op || r->dst.port_op)) { 4069 yyerror("port only applies to tcp/udp"); 4070 problems++; 4071 } 4072 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 4073 (r->type || r->code)) { 4074 yyerror("icmp-type/code only applies to icmp"); 4075 problems++; 4076 } 4077 if (!r->af && (r->type || r->code)) { 4078 yyerror("must indicate address family with icmp-type/code"); 4079 problems++; 4080 } 4081 if (r->overload_tblname[0] && 4082 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 4083 yyerror("'overload' requires 'max-src-conn' " 4084 "or 'max-src-conn-rate'"); 4085 problems++; 4086 } 4087 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 4088 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 4089 yyerror("proto %s doesn't match address family %s", 4090 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 4091 r->af == AF_INET ? "inet" : "inet6"); 4092 problems++; 4093 } 4094 if (r->allow_opts && r->action != PF_PASS) { 4095 yyerror("allow-opts can only be specified for pass rules"); 4096 problems++; 4097 } 4098 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 4099 r->dst.port_op || r->flagset || r->type || r->code)) { 4100 yyerror("fragments can be filtered only on IP header fields"); 4101 problems++; 4102 } 4103 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 4104 yyerror("return-rst can only be applied to TCP rules"); 4105 problems++; 4106 } 4107 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 4108 yyerror("max-src-nodes requires 'source-track rule'"); 4109 problems++; 4110 } 4111 if (r->action == PF_DROP && r->keep_state) { 4112 yyerror("keep state on block rules doesn't make sense"); 4113 problems++; 4114 } 4115 return (-problems); 4116 } 4117 4118 int 4119 nat_consistent(struct pf_rule *r) 4120 { 4121 return (0); /* yeah! */ 4122 } 4123 4124 int 4125 rdr_consistent(struct pf_rule *r) 4126 { 4127 int problems = 0; 4128 4129 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 4130 if (r->src.port_op) { 4131 yyerror("src port only applies to tcp/udp"); 4132 problems++; 4133 } 4134 if (r->dst.port_op) { 4135 yyerror("dst port only applies to tcp/udp"); 4136 problems++; 4137 } 4138 if (r->rpool.proxy_port[0]) { 4139 yyerror("rpool port only applies to tcp/udp"); 4140 problems++; 4141 } 4142 } 4143 if (r->dst.port_op && 4144 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 4145 yyerror("invalid port operator for rdr destination port"); 4146 problems++; 4147 } 4148 return (-problems); 4149 } 4150 4151 int 4152 process_tabledef(char *name, struct table_opts *opts) 4153 { 4154 struct pfr_buffer ab; 4155 struct node_tinit *ti; 4156 4157 bzero(&ab, sizeof(ab)); 4158 ab.pfrb_type = PFRB_ADDRS; 4159 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 4160 if (ti->file) 4161 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 4162 if (errno) 4163 yyerror("cannot load \"%s\": %s", 4164 ti->file, strerror(errno)); 4165 else 4166 yyerror("file \"%s\" contains bad data", 4167 ti->file); 4168 goto _error; 4169 } 4170 if (ti->host) 4171 if (append_addr_host(&ab, ti->host, 0, 0)) { 4172 yyerror("cannot create address buffer: %s", 4173 strerror(errno)); 4174 goto _error; 4175 } 4176 } 4177 if (pf->opts & PF_OPT_VERBOSE) 4178 print_tabledef(name, opts->flags, opts->init_addr, 4179 &opts->init_nodes); 4180 if (!(pf->opts & PF_OPT_NOACTION) && 4181 pfctl_define_table(name, opts->flags, opts->init_addr, 4182 pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { 4183 yyerror("cannot define table %s: %s", name, 4184 pfr_strerror(errno)); 4185 goto _error; 4186 } 4187 pf->tdirty = 1; 4188 pfr_buf_clear(&ab); 4189 return (0); 4190 _error: 4191 pfr_buf_clear(&ab); 4192 return (-1); 4193 } 4194 4195 struct keywords { 4196 const char *k_name; 4197 int k_val; 4198 }; 4199 4200 /* macro gore, but you should've seen the prior indentation nightmare... */ 4201 4202 #define FREE_LIST(T,r) \ 4203 do { \ 4204 T *p, *node = r; \ 4205 while (node != NULL) { \ 4206 p = node; \ 4207 node = node->next; \ 4208 free(p); \ 4209 } \ 4210 } while (0) 4211 4212 #define LOOP_THROUGH(T,n,r,C) \ 4213 do { \ 4214 T *n; \ 4215 if (r == NULL) { \ 4216 r = calloc(1, sizeof(T)); \ 4217 if (r == NULL) \ 4218 err(1, "LOOP: calloc"); \ 4219 r->next = NULL; \ 4220 } \ 4221 n = r; \ 4222 while (n != NULL) { \ 4223 do { \ 4224 C; \ 4225 } while (0); \ 4226 n = n->next; \ 4227 } \ 4228 } while (0) 4229 4230 void 4231 expand_label_str(char *label, size_t len, const char *srch, const char *repl) 4232 { 4233 char *tmp; 4234 char *p, *q; 4235 4236 if ((tmp = calloc(1, len)) == NULL) 4237 err(1, "expand_label_str: calloc"); 4238 p = q = label; 4239 while ((q = strstr(p, srch)) != NULL) { 4240 *q = '\0'; 4241 if ((strlcat(tmp, p, len) >= len) || 4242 (strlcat(tmp, repl, len) >= len)) 4243 errx(1, "expand_label: label too long"); 4244 q += strlen(srch); 4245 p = q; 4246 } 4247 if (strlcat(tmp, p, len) >= len) 4248 errx(1, "expand_label: label too long"); 4249 strlcpy(label, tmp, len); /* always fits */ 4250 free(tmp); 4251 } 4252 4253 void 4254 expand_label_if(const char *name, char *label, size_t len, const char *ifname) 4255 { 4256 if (strstr(label, name) != NULL) { 4257 if (!*ifname) 4258 expand_label_str(label, len, name, "any"); 4259 else 4260 expand_label_str(label, len, name, ifname); 4261 } 4262 } 4263 4264 void 4265 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 4266 struct node_host *h) 4267 { 4268 char tmp[64], tmp_not[66]; 4269 4270 if (strstr(label, name) != NULL) { 4271 switch (h->addr.type) { 4272 case PF_ADDR_DYNIFTL: 4273 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 4274 break; 4275 case PF_ADDR_TABLE: 4276 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 4277 break; 4278 case PF_ADDR_NOROUTE: 4279 snprintf(tmp, sizeof(tmp), "no-route"); 4280 break; 4281 case PF_ADDR_URPFFAILED: 4282 snprintf(tmp, sizeof(tmp), "urpf-failed"); 4283 break; 4284 case PF_ADDR_ADDRMASK: 4285 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 4286 PF_AZERO(&h->addr.v.a.mask, af))) 4287 snprintf(tmp, sizeof(tmp), "any"); 4288 else { 4289 char a[48]; 4290 int bits; 4291 4292 if (inet_ntop(af, &h->addr.v.a.addr, a, 4293 sizeof(a)) == NULL) 4294 snprintf(tmp, sizeof(tmp), "?"); 4295 else { 4296 bits = unmask(&h->addr.v.a.mask, af); 4297 if ((af == AF_INET && bits < 32) || 4298 (af == AF_INET6 && bits < 128)) 4299 snprintf(tmp, sizeof(tmp), 4300 "%s/%d", a, bits); 4301 else 4302 snprintf(tmp, sizeof(tmp), 4303 "%s", a); 4304 } 4305 } 4306 break; 4307 default: 4308 snprintf(tmp, sizeof(tmp), "?"); 4309 break; 4310 } 4311 4312 if (h->not) { 4313 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4314 expand_label_str(label, len, name, tmp_not); 4315 } else 4316 expand_label_str(label, len, name, tmp); 4317 } 4318 } 4319 4320 void 4321 expand_label_port(const char *name, char *label, size_t len, 4322 struct node_port *port) 4323 { 4324 char a1[6], a2[6], op[13] = ""; 4325 4326 if (strstr(label, name) != NULL) { 4327 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4328 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4329 if (!port->op) 4330 ; 4331 else if (port->op == PF_OP_IRG) 4332 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4333 else if (port->op == PF_OP_XRG) 4334 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4335 else if (port->op == PF_OP_EQ) 4336 snprintf(op, sizeof(op), "%s", a1); 4337 else if (port->op == PF_OP_NE) 4338 snprintf(op, sizeof(op), "!=%s", a1); 4339 else if (port->op == PF_OP_LT) 4340 snprintf(op, sizeof(op), "<%s", a1); 4341 else if (port->op == PF_OP_LE) 4342 snprintf(op, sizeof(op), "<=%s", a1); 4343 else if (port->op == PF_OP_GT) 4344 snprintf(op, sizeof(op), ">%s", a1); 4345 else if (port->op == PF_OP_GE) 4346 snprintf(op, sizeof(op), ">=%s", a1); 4347 expand_label_str(label, len, name, op); 4348 } 4349 } 4350 4351 void 4352 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4353 { 4354 struct protoent *pe; 4355 char n[4]; 4356 4357 if (strstr(label, name) != NULL) { 4358 pe = getprotobynumber(proto); 4359 if (pe != NULL) 4360 expand_label_str(label, len, name, pe->p_name); 4361 else { 4362 snprintf(n, sizeof(n), "%u", proto); 4363 expand_label_str(label, len, name, n); 4364 } 4365 } 4366 } 4367 4368 void 4369 expand_label_nr(const char *name, char *label, size_t len) 4370 { 4371 char n[11]; 4372 4373 if (strstr(label, name) != NULL) { 4374 snprintf(n, sizeof(n), "%u", pf->anchor->match); 4375 expand_label_str(label, len, name, n); 4376 } 4377 } 4378 4379 void 4380 expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4381 struct node_host *src_host, struct node_port *src_port, 4382 struct node_host *dst_host, struct node_port *dst_port, 4383 u_int8_t proto) 4384 { 4385 expand_label_if("$if", label, len, ifname); 4386 expand_label_addr("$srcaddr", label, len, af, src_host); 4387 expand_label_addr("$dstaddr", label, len, af, dst_host); 4388 expand_label_port("$srcport", label, len, src_port); 4389 expand_label_port("$dstport", label, len, dst_port); 4390 expand_label_proto("$proto", label, len, proto); 4391 expand_label_nr("$nr", label, len); 4392 } 4393 4394 int 4395 expand_altq(struct pf_altq *a, struct node_if *interfaces, 4396 struct node_queue *nqueues, struct node_queue_bw bwspec, 4397 struct node_queue_opt *opts) 4398 { 4399 struct pf_altq pa, pb; 4400 char qname[PF_QNAME_SIZE]; 4401 struct node_queue *n; 4402 struct node_queue_bw bw; 4403 int errs = 0; 4404 4405 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4406 FREE_LIST(struct node_if, interfaces); 4407 FREE_LIST(struct node_queue, nqueues); 4408 return (0); 4409 } 4410 4411 LOOP_THROUGH(struct node_if, interface, interfaces, 4412 memcpy(&pa, a, sizeof(struct pf_altq)); 4413 if (strlcpy(pa.ifname, interface->ifname, 4414 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4415 errx(1, "expand_altq: strlcpy"); 4416 4417 if (interface->not) { 4418 yyerror("altq on ! <interface> is not supported"); 4419 errs++; 4420 } else { 4421 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4422 errs++; 4423 else 4424 if (pfctl_add_altq(pf, &pa)) 4425 errs++; 4426 4427 if (pf->opts & PF_OPT_VERBOSE) { 4428 print_altq(&pf->paltq->altq, 0, 4429 &bwspec, opts); 4430 if (nqueues && nqueues->tail) { 4431 printf("queue { "); 4432 LOOP_THROUGH(struct node_queue, queue, 4433 nqueues, 4434 printf("%s ", 4435 queue->queue); 4436 ); 4437 printf("}"); 4438 } 4439 printf("\n"); 4440 } 4441 4442 if (pa.scheduler == ALTQT_CBQ || 4443 pa.scheduler == ALTQT_HFSC) { 4444 /* now create a root queue */ 4445 memset(&pb, 0, sizeof(struct pf_altq)); 4446 if (strlcpy(qname, "root_", sizeof(qname)) >= 4447 sizeof(qname)) 4448 errx(1, "expand_altq: strlcpy"); 4449 if (strlcat(qname, interface->ifname, 4450 sizeof(qname)) >= sizeof(qname)) 4451 errx(1, "expand_altq: strlcat"); 4452 if (strlcpy(pb.qname, qname, 4453 sizeof(pb.qname)) >= sizeof(pb.qname)) 4454 errx(1, "expand_altq: strlcpy"); 4455 if (strlcpy(pb.ifname, interface->ifname, 4456 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4457 errx(1, "expand_altq: strlcpy"); 4458 pb.qlimit = pa.qlimit; 4459 pb.scheduler = pa.scheduler; 4460 bw.bw_absolute = pa.ifbandwidth; 4461 bw.bw_percent = 0; 4462 if (eval_pfqueue(pf, &pb, &bw, opts)) 4463 errs++; 4464 else 4465 if (pfctl_add_altq(pf, &pb)) 4466 errs++; 4467 } 4468 4469 LOOP_THROUGH(struct node_queue, queue, nqueues, 4470 n = calloc(1, sizeof(struct node_queue)); 4471 if (n == NULL) 4472 err(1, "expand_altq: calloc"); 4473 if (pa.scheduler == ALTQT_CBQ || 4474 pa.scheduler == ALTQT_HFSC) 4475 if (strlcpy(n->parent, qname, 4476 sizeof(n->parent)) >= 4477 sizeof(n->parent)) 4478 errx(1, "expand_altq: strlcpy"); 4479 if (strlcpy(n->queue, queue->queue, 4480 sizeof(n->queue)) >= sizeof(n->queue)) 4481 errx(1, "expand_altq: strlcpy"); 4482 if (strlcpy(n->ifname, interface->ifname, 4483 sizeof(n->ifname)) >= sizeof(n->ifname)) 4484 errx(1, "expand_altq: strlcpy"); 4485 n->scheduler = pa.scheduler; 4486 n->next = NULL; 4487 n->tail = n; 4488 if (queues == NULL) 4489 queues = n; 4490 else { 4491 queues->tail->next = n; 4492 queues->tail = n; 4493 } 4494 ); 4495 } 4496 ); 4497 FREE_LIST(struct node_if, interfaces); 4498 FREE_LIST(struct node_queue, nqueues); 4499 4500 return (errs); 4501 } 4502 4503 int 4504 expand_queue(struct pf_altq *a, struct node_if *interfaces, 4505 struct node_queue *nqueues, struct node_queue_bw bwspec, 4506 struct node_queue_opt *opts) 4507 { 4508 struct node_queue *n, *nq; 4509 struct pf_altq pa; 4510 u_int8_t found = 0; 4511 u_int8_t errs = 0; 4512 4513 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4514 FREE_LIST(struct node_queue, nqueues); 4515 return (0); 4516 } 4517 4518 if (queues == NULL) { 4519 yyerror("queue %s has no parent", a->qname); 4520 FREE_LIST(struct node_queue, nqueues); 4521 return (1); 4522 } 4523 4524 LOOP_THROUGH(struct node_if, interface, interfaces, 4525 LOOP_THROUGH(struct node_queue, tqueue, queues, 4526 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4527 (interface->ifname[0] == 0 || 4528 (!interface->not && !strncmp(interface->ifname, 4529 tqueue->ifname, IFNAMSIZ)) || 4530 (interface->not && strncmp(interface->ifname, 4531 tqueue->ifname, IFNAMSIZ)))) { 4532 /* found ourself in queues */ 4533 found++; 4534 4535 memcpy(&pa, a, sizeof(struct pf_altq)); 4536 4537 if (pa.scheduler != ALTQT_NONE && 4538 pa.scheduler != tqueue->scheduler) { 4539 yyerror("exactly one scheduler type " 4540 "per interface allowed"); 4541 errs++; 4542 goto out; 4543 } 4544 pa.scheduler = tqueue->scheduler; 4545 4546 /* scheduler dependent error checking */ 4547 switch (pa.scheduler) { 4548 case ALTQT_PRIQ: 4549 if (nqueues != NULL) { 4550 yyerror("priq queues cannot " 4551 "have child queues"); 4552 errs++; 4553 goto out; 4554 } 4555 if (bwspec.bw_absolute > 0 || 4556 bwspec.bw_percent < 100) { 4557 yyerror("priq doesn't take " 4558 "bandwidth"); 4559 errs++; 4560 goto out; 4561 } 4562 break; 4563 default: 4564 break; 4565 } 4566 4567 if (strlcpy(pa.ifname, tqueue->ifname, 4568 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4569 errx(1, "expand_queue: strlcpy"); 4570 if (strlcpy(pa.parent, tqueue->parent, 4571 sizeof(pa.parent)) >= sizeof(pa.parent)) 4572 errx(1, "expand_queue: strlcpy"); 4573 4574 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4575 errs++; 4576 else 4577 if (pfctl_add_altq(pf, &pa)) 4578 errs++; 4579 4580 for (nq = nqueues; nq != NULL; nq = nq->next) { 4581 if (!strcmp(a->qname, nq->queue)) { 4582 yyerror("queue cannot have " 4583 "itself as child"); 4584 errs++; 4585 continue; 4586 } 4587 n = calloc(1, 4588 sizeof(struct node_queue)); 4589 if (n == NULL) 4590 err(1, "expand_queue: calloc"); 4591 if (strlcpy(n->parent, a->qname, 4592 sizeof(n->parent)) >= 4593 sizeof(n->parent)) 4594 errx(1, "expand_queue strlcpy"); 4595 if (strlcpy(n->queue, nq->queue, 4596 sizeof(n->queue)) >= 4597 sizeof(n->queue)) 4598 errx(1, "expand_queue strlcpy"); 4599 if (strlcpy(n->ifname, tqueue->ifname, 4600 sizeof(n->ifname)) >= 4601 sizeof(n->ifname)) 4602 errx(1, "expand_queue strlcpy"); 4603 n->scheduler = tqueue->scheduler; 4604 n->next = NULL; 4605 n->tail = n; 4606 if (queues == NULL) 4607 queues = n; 4608 else { 4609 queues->tail->next = n; 4610 queues->tail = n; 4611 } 4612 } 4613 if ((pf->opts & PF_OPT_VERBOSE) && ( 4614 (found == 1 && interface->ifname[0] == 0) || 4615 (found > 0 && interface->ifname[0] != 0))) { 4616 print_queue(&pf->paltq->altq, 0, 4617 &bwspec, interface->ifname[0] != 0, 4618 opts); 4619 if (nqueues && nqueues->tail) { 4620 printf("{ "); 4621 LOOP_THROUGH(struct node_queue, 4622 queue, nqueues, 4623 printf("%s ", 4624 queue->queue); 4625 ); 4626 printf("}"); 4627 } 4628 printf("\n"); 4629 } 4630 } 4631 ); 4632 ); 4633 4634 out: 4635 FREE_LIST(struct node_queue, nqueues); 4636 FREE_LIST(struct node_if, interfaces); 4637 4638 if (!found) { 4639 yyerror("queue %s has no parent", a->qname); 4640 errs++; 4641 } 4642 4643 if (errs) 4644 return (1); 4645 else 4646 return (0); 4647 } 4648 4649 void 4650 expand_rule(struct pf_rule *r, 4651 struct node_if *interfaces, struct node_host *rpool_hosts, 4652 struct node_proto *protos, struct node_os *src_oses, 4653 struct node_host *src_hosts, struct node_port *src_ports, 4654 struct node_host *dst_hosts, struct node_port *dst_ports, 4655 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4656 const char *anchor_call) 4657 { 4658 sa_family_t af = r->af; 4659 int added = 0, error = 0; 4660 char ifname[IF_NAMESIZE]; 4661 char label[PF_RULE_LABEL_SIZE]; 4662 char tagname[PF_TAG_NAME_SIZE]; 4663 char match_tagname[PF_TAG_NAME_SIZE]; 4664 struct pf_pooladdr *pa; 4665 struct node_host *h; 4666 u_int8_t flags, flagset, keep_state; 4667 4668 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4669 errx(1, "expand_rule: strlcpy"); 4670 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4671 errx(1, "expand_rule: strlcpy"); 4672 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4673 sizeof(match_tagname)) 4674 errx(1, "expand_rule: strlcpy"); 4675 flags = r->flags; 4676 flagset = r->flagset; 4677 keep_state = r->keep_state; 4678 4679 LOOP_THROUGH(struct node_if, interface, interfaces, 4680 LOOP_THROUGH(struct node_proto, proto, protos, 4681 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4682 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4683 LOOP_THROUGH(struct node_port, src_port, src_ports, 4684 LOOP_THROUGH(struct node_os, src_os, src_oses, 4685 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4686 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4687 LOOP_THROUGH(struct node_uid, uid, uids, 4688 LOOP_THROUGH(struct node_gid, gid, gids, 4689 4690 r->af = af; 4691 /* for link-local IPv6 address, interface must match up */ 4692 if ((r->af && src_host->af && r->af != src_host->af) || 4693 (r->af && dst_host->af && r->af != dst_host->af) || 4694 (src_host->af && dst_host->af && 4695 src_host->af != dst_host->af) || 4696 (src_host->ifindex && dst_host->ifindex && 4697 src_host->ifindex != dst_host->ifindex) || 4698 (src_host->ifindex && *interface->ifname && 4699 src_host->ifindex != if_nametoindex(interface->ifname)) || 4700 (dst_host->ifindex && *interface->ifname && 4701 dst_host->ifindex != if_nametoindex(interface->ifname))) 4702 continue; 4703 if (!r->af && src_host->af) 4704 r->af = src_host->af; 4705 else if (!r->af && dst_host->af) 4706 r->af = dst_host->af; 4707 4708 if (*interface->ifname) 4709 strlcpy(r->ifname, interface->ifname, 4710 sizeof(r->ifname)); 4711 else if (if_indextoname(src_host->ifindex, ifname)) 4712 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4713 else if (if_indextoname(dst_host->ifindex, ifname)) 4714 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4715 else 4716 memset(r->ifname, '\0', sizeof(r->ifname)); 4717 4718 if (strlcpy(r->label, label, sizeof(r->label)) >= 4719 sizeof(r->label)) 4720 errx(1, "expand_rule: strlcpy"); 4721 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4722 sizeof(r->tagname)) 4723 errx(1, "expand_rule: strlcpy"); 4724 if (strlcpy(r->match_tagname, match_tagname, 4725 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4726 errx(1, "expand_rule: strlcpy"); 4727 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4728 src_host, src_port, dst_host, dst_port, proto->proto); 4729 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4730 src_host, src_port, dst_host, dst_port, proto->proto); 4731 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4732 r->af, src_host, src_port, dst_host, dst_port, 4733 proto->proto); 4734 4735 error += check_netmask(src_host, r->af); 4736 error += check_netmask(dst_host, r->af); 4737 4738 r->ifnot = interface->not; 4739 r->proto = proto->proto; 4740 r->src.addr = src_host->addr; 4741 r->src.neg = src_host->not; 4742 r->src.port[0] = src_port->port[0]; 4743 r->src.port[1] = src_port->port[1]; 4744 r->src.port_op = src_port->op; 4745 r->dst.addr = dst_host->addr; 4746 r->dst.neg = dst_host->not; 4747 r->dst.port[0] = dst_port->port[0]; 4748 r->dst.port[1] = dst_port->port[1]; 4749 r->dst.port_op = dst_port->op; 4750 r->uid.op = uid->op; 4751 r->uid.uid[0] = uid->uid[0]; 4752 r->uid.uid[1] = uid->uid[1]; 4753 r->gid.op = gid->op; 4754 r->gid.gid[0] = gid->gid[0]; 4755 r->gid.gid[1] = gid->gid[1]; 4756 r->type = icmp_type->type; 4757 r->code = icmp_type->code; 4758 4759 if ((keep_state == PF_STATE_MODULATE || 4760 keep_state == PF_STATE_SYNPROXY) && 4761 r->proto && r->proto != IPPROTO_TCP) 4762 r->keep_state = PF_STATE_NORMAL; 4763 else 4764 r->keep_state = keep_state; 4765 4766 if (r->proto && r->proto != IPPROTO_TCP) { 4767 r->flags = 0; 4768 r->flagset = 0; 4769 } else { 4770 r->flags = flags; 4771 r->flagset = flagset; 4772 } 4773 if (icmp_type->proto && r->proto != icmp_type->proto) { 4774 yyerror("icmp-type mismatch"); 4775 error++; 4776 } 4777 4778 if (src_os && src_os->os) { 4779 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4780 if ((pf->opts & PF_OPT_VERBOSE2) && 4781 r->os_fingerprint == PF_OSFP_NOMATCH) 4782 fprintf(stderr, 4783 "warning: unknown '%s' OS fingerprint\n", 4784 src_os->os); 4785 } else { 4786 r->os_fingerprint = PF_OSFP_ANY; 4787 } 4788 4789 TAILQ_INIT(&r->rpool.list); 4790 for (h = rpool_hosts; h != NULL; h = h->next) { 4791 pa = calloc(1, sizeof(struct pf_pooladdr)); 4792 if (pa == NULL) 4793 err(1, "expand_rule: calloc"); 4794 pa->addr = h->addr; 4795 if (h->ifname != NULL) { 4796 if (strlcpy(pa->ifname, h->ifname, 4797 sizeof(pa->ifname)) >= 4798 sizeof(pa->ifname)) 4799 errx(1, "expand_rule: strlcpy"); 4800 } else 4801 pa->ifname[0] = 0; 4802 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4803 } 4804 4805 if (rule_consistent(r, anchor_call[0]) < 0 || error) 4806 yyerror("skipping rule due to errors"); 4807 else { 4808 r->nr = pf->astack[pf->asd]->match++; 4809 pfctl_add_rule(pf, r, anchor_call); 4810 added++; 4811 } 4812 4813 )))))))))); 4814 4815 FREE_LIST(struct node_if, interfaces); 4816 FREE_LIST(struct node_proto, protos); 4817 FREE_LIST(struct node_host, src_hosts); 4818 FREE_LIST(struct node_port, src_ports); 4819 FREE_LIST(struct node_os, src_oses); 4820 FREE_LIST(struct node_host, dst_hosts); 4821 FREE_LIST(struct node_port, dst_ports); 4822 FREE_LIST(struct node_uid, uids); 4823 FREE_LIST(struct node_gid, gids); 4824 FREE_LIST(struct node_icmp, icmp_types); 4825 FREE_LIST(struct node_host, rpool_hosts); 4826 4827 if (!added) 4828 yyerror("rule expands to no valid combination"); 4829 } 4830 4831 int 4832 expand_skip_interface(struct node_if *interfaces) 4833 { 4834 int errs = 0; 4835 4836 if (!interfaces || (!interfaces->next && !interfaces->not && 4837 !strcmp(interfaces->ifname, "none"))) { 4838 if (pf->opts & PF_OPT_VERBOSE) 4839 printf("set skip on none\n"); 4840 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4841 return (errs); 4842 } 4843 4844 if (pf->opts & PF_OPT_VERBOSE) 4845 printf("set skip on {"); 4846 LOOP_THROUGH(struct node_if, interface, interfaces, 4847 if (pf->opts & PF_OPT_VERBOSE) 4848 printf(" %s", interface->ifname); 4849 if (interface->not) { 4850 yyerror("skip on ! <interface> is not supported"); 4851 errs++; 4852 } else 4853 errs += pfctl_set_interface_flags(pf, 4854 interface->ifname, PFI_IFLAG_SKIP, 1); 4855 ); 4856 if (pf->opts & PF_OPT_VERBOSE) 4857 printf(" }\n"); 4858 4859 FREE_LIST(struct node_if, interfaces); 4860 4861 if (errs) 4862 return (1); 4863 else 4864 return (0); 4865 } 4866 4867 #undef FREE_LIST 4868 #undef LOOP_THROUGH 4869 4870 int 4871 check_rulestate(int desired_state) 4872 { 4873 if (require_order && (rulestate > desired_state)) { 4874 yyerror("Rules must be in order: options, normalization, " 4875 "queueing, translation, filtering"); 4876 return (1); 4877 } 4878 rulestate = desired_state; 4879 return (0); 4880 } 4881 4882 int 4883 kw_cmp(const void *k, const void *e) 4884 { 4885 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4886 } 4887 4888 int 4889 lookup(char *s) 4890 { 4891 /* this has to be sorted always */ 4892 static const struct keywords keywords[] = { 4893 { "all", ALL}, 4894 { "allow-opts", ALLOWOPTS}, 4895 { "altq", ALTQ}, 4896 { "anchor", ANCHOR}, 4897 { "antispoof", ANTISPOOF}, 4898 { "any", ANY}, 4899 { "bandwidth", BANDWIDTH}, 4900 { "binat", BINAT}, 4901 { "binat-anchor", BINATANCHOR}, 4902 { "bitmask", BITMASK}, 4903 { "block", BLOCK}, 4904 { "block-policy", BLOCKPOLICY}, 4905 { "cbq", CBQ}, 4906 { "code", CODE}, 4907 { "crop", FRAGCROP}, 4908 { "debug", DEBUG}, 4909 { "drop", DROP}, 4910 { "drop-ovl", FRAGDROP}, 4911 { "dup-to", DUPTO}, 4912 { "fastroute", FASTROUTE}, 4913 { "file", FILENAME}, 4914 { "fingerprints", FINGERPRINTS}, 4915 { "flags", FLAGS}, 4916 { "floating", FLOATING}, 4917 { "flush", FLUSH}, 4918 { "for", FOR}, 4919 { "fragment", FRAGMENT}, 4920 { "from", FROM}, 4921 { "global", GLOBAL}, 4922 { "group", GROUP}, 4923 { "hfsc", HFSC}, 4924 { "hostid", HOSTID}, 4925 { "icmp-type", ICMPTYPE}, 4926 { "icmp6-type", ICMP6TYPE}, 4927 { "if-bound", IFBOUND}, 4928 { "in", IN}, 4929 { "inet", INET}, 4930 { "inet6", INET6}, 4931 { "keep", KEEP}, 4932 { "label", LABEL}, 4933 { "limit", LIMIT}, 4934 { "linkshare", LINKSHARE}, 4935 { "load", LOAD}, 4936 { "log", LOG}, 4937 { "loginterface", LOGINTERFACE}, 4938 { "max", MAXIMUM}, 4939 { "max-mss", MAXMSS}, 4940 { "max-src-conn", MAXSRCCONN}, 4941 { "max-src-conn-rate", MAXSRCCONNRATE}, 4942 { "max-src-nodes", MAXSRCNODES}, 4943 { "max-src-states", MAXSRCSTATES}, 4944 { "min-ttl", MINTTL}, 4945 { "modulate", MODULATE}, 4946 { "nat", NAT}, 4947 { "nat-anchor", NATANCHOR}, 4948 { "no", NO}, 4949 { "no-df", NODF}, 4950 { "no-route", NOROUTE}, 4951 { "no-sync", NOSYNC}, 4952 { "on", ON}, 4953 { "optimization", OPTIMIZATION}, 4954 { "os", OS}, 4955 { "out", OUT}, 4956 { "overload", OVERLOAD}, 4957 { "pass", PASS}, 4958 { "port", PORT}, 4959 { "priority", PRIORITY}, 4960 { "priq", PRIQ}, 4961 { "probability", PROBABILITY}, 4962 { "proto", PROTO}, 4963 { "qlimit", QLIMIT}, 4964 { "queue", QUEUE}, 4965 { "quick", QUICK}, 4966 { "random", RANDOM}, 4967 { "random-id", RANDOMID}, 4968 { "rdr", RDR}, 4969 { "rdr-anchor", RDRANCHOR}, 4970 { "realtime", REALTIME}, 4971 { "reassemble", REASSEMBLE}, 4972 { "reply-to", REPLYTO}, 4973 { "require-order", REQUIREORDER}, 4974 { "return", RETURN}, 4975 { "return-icmp", RETURNICMP}, 4976 { "return-icmp6", RETURNICMP6}, 4977 { "return-rst", RETURNRST}, 4978 { "round-robin", ROUNDROBIN}, 4979 { "route", ROUTE}, 4980 { "route-to", ROUTETO}, 4981 { "rtable", RTABLE}, 4982 { "rule", RULE}, 4983 { "ruleset-optimization", RULESET_OPTIMIZATION}, 4984 { "scrub", SCRUB}, 4985 { "set", SET}, 4986 { "skip", SKIP}, 4987 { "source-hash", SOURCEHASH}, 4988 { "source-track", SOURCETRACK}, 4989 { "state", STATE}, 4990 { "state-policy", STATEPOLICY}, 4991 { "static-port", STATICPORT}, 4992 { "sticky-address", STICKYADDRESS}, 4993 { "synproxy", SYNPROXY}, 4994 { "table", TABLE}, 4995 { "tag", TAG}, 4996 { "tagged", TAGGED}, 4997 { "tbrsize", TBRSIZE}, 4998 { "timeout", TIMEOUT}, 4999 { "to", TO}, 5000 { "tos", TOS}, 5001 { "ttl", TTL}, 5002 { "upperlimit", UPPERLIMIT}, 5003 { "urpf-failed", URPFFAILED}, 5004 { "user", USER}, 5005 }; 5006 const struct keywords *p; 5007 5008 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 5009 sizeof(keywords[0]), kw_cmp); 5010 5011 if (p) { 5012 if (debug > 1) 5013 fprintf(stderr, "%s: %d\n", s, p->k_val); 5014 return (p->k_val); 5015 } else { 5016 if (debug > 1) 5017 fprintf(stderr, "string: %s\n", s); 5018 return (STRING); 5019 } 5020 } 5021 5022 #define MAXPUSHBACK 128 5023 5024 char *parsebuf; 5025 int parseindex; 5026 char pushback_buffer[MAXPUSHBACK]; 5027 int pushback_index = 0; 5028 5029 int 5030 lgetc(FILE *f) 5031 { 5032 int c, next; 5033 5034 if (parsebuf) { 5035 /* Read character from the parsebuffer instead of input. */ 5036 if (parseindex >= 0) { 5037 c = parsebuf[parseindex++]; 5038 if (c != '\0') 5039 return (c); 5040 parsebuf = NULL; 5041 } else 5042 parseindex++; 5043 } 5044 5045 if (pushback_index) 5046 return (pushback_buffer[--pushback_index]); 5047 5048 while ((c = getc(f)) == '\\') { 5049 next = getc(f); 5050 if (next != '\n') { 5051 c = next; 5052 break; 5053 } 5054 yylval.lineno = lineno; 5055 lineno++; 5056 } 5057 if (c == '\t' || c == ' ') { 5058 /* Compress blanks to a single space. */ 5059 do { 5060 c = getc(f); 5061 } while (c == '\t' || c == ' '); 5062 ungetc(c, f); 5063 c = ' '; 5064 } 5065 5066 return (c); 5067 } 5068 5069 int 5070 lungetc(int c) 5071 { 5072 if (c == EOF) 5073 return (EOF); 5074 if (parsebuf) { 5075 parseindex--; 5076 if (parseindex >= 0) 5077 return (c); 5078 } 5079 if (pushback_index < MAXPUSHBACK-1) 5080 return (pushback_buffer[pushback_index++] = c); 5081 else 5082 return (EOF); 5083 } 5084 5085 int 5086 findeol(void) 5087 { 5088 int c; 5089 5090 parsebuf = NULL; 5091 pushback_index = 0; 5092 5093 /* skip to either EOF or the first real EOL */ 5094 while (1) { 5095 c = lgetc(fin); 5096 if (c == '\n') { 5097 lineno++; 5098 break; 5099 } 5100 if (c == EOF) 5101 break; 5102 } 5103 return (ERROR); 5104 } 5105 5106 int 5107 yylex(void) 5108 { 5109 char buf[8096]; 5110 char *p, *val; 5111 int endc, c, next; 5112 int token; 5113 5114 top: 5115 p = buf; 5116 while ((c = lgetc(fin)) == ' ') 5117 ; /* nothing */ 5118 5119 yylval.lineno = lineno; 5120 if (c == '#') 5121 while ((c = lgetc(fin)) != '\n' && c != EOF) 5122 ; /* nothing */ 5123 if (c == '$' && parsebuf == NULL) { 5124 while (1) { 5125 if ((c = lgetc(fin)) == EOF) 5126 return (0); 5127 5128 if (p + 1 >= buf + sizeof(buf) - 1) { 5129 yyerror("string too long"); 5130 return (findeol()); 5131 } 5132 if (isalnum(c) || c == '_') { 5133 *p++ = (char)c; 5134 continue; 5135 } 5136 *p = '\0'; 5137 lungetc(c); 5138 break; 5139 } 5140 val = symget(buf); 5141 if (val == NULL) { 5142 yyerror("macro '%s' not defined", buf); 5143 return (findeol()); 5144 } 5145 parsebuf = val; 5146 parseindex = 0; 5147 goto top; 5148 } 5149 5150 switch (c) { 5151 case '\'': 5152 case '"': 5153 endc = c; 5154 while (1) { 5155 if ((c = lgetc(fin)) == EOF) 5156 return (0); 5157 if (c == endc) { 5158 *p = '\0'; 5159 break; 5160 } 5161 if (c == '\n') { 5162 lineno++; 5163 continue; 5164 } 5165 if (p + 1 >= buf + sizeof(buf) - 1) { 5166 yyerror("string too long"); 5167 return (findeol()); 5168 } 5169 *p++ = (char)c; 5170 } 5171 yylval.v.string = strdup(buf); 5172 if (yylval.v.string == NULL) 5173 err(1, "yylex: strdup"); 5174 return (STRING); 5175 case '<': 5176 next = lgetc(fin); 5177 if (next == '>') { 5178 yylval.v.i = PF_OP_XRG; 5179 return (PORTBINARY); 5180 } 5181 lungetc(next); 5182 break; 5183 case '>': 5184 next = lgetc(fin); 5185 if (next == '<') { 5186 yylval.v.i = PF_OP_IRG; 5187 return (PORTBINARY); 5188 } 5189 lungetc(next); 5190 break; 5191 case '-': 5192 next = lgetc(fin); 5193 if (next == '>') 5194 return (ARROW); 5195 lungetc(next); 5196 break; 5197 } 5198 5199 #define allowed_in_string(x) \ 5200 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 5201 x != '{' && x != '}' && x != '<' && x != '>' && \ 5202 x != '!' && x != '=' && x != '/' && x != '#' && \ 5203 x != ',')) 5204 5205 if (isalnum(c) || c == ':' || c == '_') { 5206 do { 5207 *p++ = c; 5208 if ((unsigned)(p-buf) >= sizeof(buf)) { 5209 yyerror("string too long"); 5210 return (findeol()); 5211 } 5212 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 5213 lungetc(c); 5214 *p = '\0'; 5215 if ((token = lookup(buf)) == STRING) 5216 if ((yylval.v.string = strdup(buf)) == NULL) 5217 err(1, "yylex: strdup"); 5218 return (token); 5219 } 5220 if (c == '\n') { 5221 yylval.lineno = lineno; 5222 lineno++; 5223 } 5224 if (c == EOF) 5225 return (0); 5226 return (c); 5227 } 5228 5229 int 5230 parse_rules(FILE *input, struct pfctl *xpf) 5231 { 5232 struct sym *sym, *next; 5233 5234 fin = input; 5235 pf = xpf; 5236 lineno = 1; 5237 errors = 0; 5238 rulestate = PFCTL_STATE_NONE; 5239 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 5240 returnicmp6default = 5241 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 5242 blockpolicy = PFRULE_DROP; 5243 require_order = 1; 5244 5245 yyparse(); 5246 5247 /* Free macros and check which have not been used. */ 5248 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 5249 next = TAILQ_NEXT(sym, entries); 5250 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 5251 fprintf(stderr, "warning: macro '%s' not " 5252 "used\n", sym->nam); 5253 free(sym->nam); 5254 free(sym->val); 5255 TAILQ_REMOVE(&symhead, sym, entries); 5256 free(sym); 5257 } 5258 5259 return (errors ? -1 : 0); 5260 } 5261 5262 /* 5263 * Over-designed efficiency is a French and German concept, so how about 5264 * we wait until they discover this ugliness and make it all fancy. 5265 */ 5266 int 5267 symset(const char *nam, const char *val, int persist) 5268 { 5269 struct sym *sym; 5270 5271 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 5272 sym = TAILQ_NEXT(sym, entries)) 5273 ; /* nothing */ 5274 5275 if (sym != NULL) { 5276 if (sym->persist == 1) 5277 return (0); 5278 else { 5279 free(sym->nam); 5280 free(sym->val); 5281 TAILQ_REMOVE(&symhead, sym, entries); 5282 free(sym); 5283 } 5284 } 5285 if ((sym = calloc(1, sizeof(*sym))) == NULL) 5286 return (-1); 5287 5288 sym->nam = strdup(nam); 5289 if (sym->nam == NULL) { 5290 free(sym); 5291 return (-1); 5292 } 5293 sym->val = strdup(val); 5294 if (sym->val == NULL) { 5295 free(sym->nam); 5296 free(sym); 5297 return (-1); 5298 } 5299 sym->used = 0; 5300 sym->persist = persist; 5301 TAILQ_INSERT_TAIL(&symhead, sym, entries); 5302 return (0); 5303 } 5304 5305 int 5306 pfctl_cmdline_symset(char *s) 5307 { 5308 char *sym, *val; 5309 int ret; 5310 5311 if ((val = strrchr(s, '=')) == NULL) 5312 return (-1); 5313 5314 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5315 err(1, "pfctl_cmdline_symset: malloc"); 5316 5317 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5318 5319 ret = symset(sym, val + 1, 1); 5320 free(sym); 5321 5322 return (ret); 5323 } 5324 5325 char * 5326 symget(const char *nam) 5327 { 5328 struct sym *sym; 5329 5330 TAILQ_FOREACH(sym, &symhead, entries) 5331 if (strcmp(nam, sym->nam) == 0) { 5332 sym->used = 1; 5333 return (sym->val); 5334 } 5335 return (NULL); 5336 } 5337 5338 void 5339 mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) 5340 { 5341 int i; 5342 struct pf_rule *r; 5343 5344 for (i = 0; i < PF_RULESET_MAX; ++i) { 5345 while ((r = TAILQ_FIRST(src->rules[i].active.ptr)) 5346 != NULL) { 5347 TAILQ_REMOVE(src->rules[i].active.ptr, r, entries); 5348 TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries); 5349 dst->anchor->match++; 5350 } 5351 src->anchor->match = 0; 5352 while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr)) 5353 != NULL) { 5354 TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries); 5355 TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr, 5356 r, entries); 5357 } 5358 } 5359 } 5360 5361 void 5362 decide_address_family(struct node_host *n, sa_family_t *af) 5363 { 5364 if (*af != 0 || n == NULL) 5365 return; 5366 *af = n->af; 5367 while ((n = n->next) != NULL) { 5368 if (n->af != *af) { 5369 *af = 0; 5370 return; 5371 } 5372 } 5373 } 5374 5375 void 5376 remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5377 { 5378 struct node_host *n = *nh, *prev = NULL; 5379 5380 while (n != NULL) { 5381 if (*af && n->af && n->af != *af) { 5382 /* unlink and free n */ 5383 struct node_host *next = n->next; 5384 5385 /* adjust tail pointer */ 5386 if (n == (*nh)->tail) 5387 (*nh)->tail = prev; 5388 /* adjust previous node's next pointer */ 5389 if (prev == NULL) 5390 *nh = next; 5391 else 5392 prev->next = next; 5393 /* free node */ 5394 if (n->ifname != NULL) 5395 free(n->ifname); 5396 free(n); 5397 n = next; 5398 } else { 5399 if (n->af && !*af) 5400 *af = n->af; 5401 prev = n; 5402 n = n->next; 5403 } 5404 } 5405 } 5406 5407 int 5408 invalid_redirect(struct node_host *nh, sa_family_t af) 5409 { 5410 if (!af) { 5411 struct node_host *n; 5412 5413 /* tables and dyniftl are ok without an address family */ 5414 for (n = nh; n != NULL; n = n->next) { 5415 if (n->addr.type != PF_ADDR_TABLE && 5416 n->addr.type != PF_ADDR_DYNIFTL) { 5417 yyerror("address family not given and " 5418 "translation address expands to multiple " 5419 "address families"); 5420 return (1); 5421 } 5422 } 5423 } 5424 if (nh == NULL) { 5425 yyerror("no translation address with matching address family " 5426 "found."); 5427 return (1); 5428 } 5429 return (0); 5430 } 5431 5432 int 5433 atoul(char *s, u_long *ulvalp) 5434 { 5435 u_long ulval; 5436 char *ep; 5437 5438 errno = 0; 5439 ulval = strtoul(s, &ep, 0); 5440 if (s[0] == '\0' || *ep != '\0') 5441 return (-1); 5442 if (errno == ERANGE && ulval == ULONG_MAX) 5443 return (-1); 5444 *ulvalp = ulval; 5445 return (0); 5446 } 5447 5448 int 5449 getservice(char *n) 5450 { 5451 struct servent *s; 5452 u_long ulval; 5453 5454 if (atoul(n, &ulval) == 0) { 5455 if (ulval > 65535) { 5456 yyerror("illegal port value %lu", ulval); 5457 return (-1); 5458 } 5459 return (htons(ulval)); 5460 } else { 5461 s = getservbyname(n, "tcp"); 5462 if (s == NULL) 5463 s = getservbyname(n, "udp"); 5464 if (s == NULL) { 5465 yyerror("unknown port %s", n); 5466 return (-1); 5467 } 5468 return (s->s_port); 5469 } 5470 } 5471 5472 int 5473 rule_label(struct pf_rule *r, char *s) 5474 { 5475 if (s) { 5476 if (strlcpy(r->label, s, sizeof(r->label)) >= 5477 sizeof(r->label)) { 5478 yyerror("rule label too long (max %d chars)", 5479 sizeof(r->label)-1); 5480 return (-1); 5481 } 5482 } 5483 return (0); 5484 } 5485 5486 u_int16_t 5487 parseicmpspec(char *w, sa_family_t af) 5488 { 5489 const struct icmpcodeent *p; 5490 u_long ulval; 5491 u_int8_t icmptype; 5492 5493 if (af == AF_INET) 5494 icmptype = returnicmpdefault >> 8; 5495 else 5496 icmptype = returnicmp6default >> 8; 5497 5498 if (atoul(w, &ulval) == -1) { 5499 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5500 yyerror("unknown icmp code %s", w); 5501 return (0); 5502 } 5503 ulval = p->code; 5504 } 5505 if (ulval > 255) { 5506 yyerror("invalid icmp code %lu", ulval); 5507 return (0); 5508 } 5509 return (icmptype << 8 | ulval); 5510 } 5511 5512 int 5513 pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) 5514 { 5515 struct loadanchors *la; 5516 FILE *fin; 5517 5518 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5519 if (pf->opts & PF_OPT_VERBOSE) 5520 fprintf(stderr, "\nLoading anchor %s from %s\n", 5521 la->anchorname, la->filename); 5522 if ((fin = pfctl_fopen(la->filename, "r")) == NULL) { 5523 warn("%s", la->filename); 5524 continue; 5525 } 5526 if (pfctl_rules(dev, la->filename, fin, pf->opts, pf->optimize, 5527 la->anchorname, trans) == -1) 5528 return (-1); 5529 } 5530 5531 return (0); 5532 } 5533
Indexes created Wed Oct 01 07:09:59 GMT 2025