parse.y revision 1.2
1 /* $NetBSD: parse.y,v 1.2 2004/06/22 15:16:30 itojun Exp $ */ 2 /* $OpenBSD: parse.y,v 1.449 2004/03/20 23:20:20 david Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Markus Friedl. All rights reserved. 6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 7 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 8 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 %{ 31 #include <sys/types.h> 32 #include <sys/socket.h> 33 #include <net/if.h> 34 #include <netinet/in.h> 35 #include <netinet/in_systm.h> 36 #include <netinet/ip.h> 37 #include <netinet/ip_icmp.h> 38 #include <netinet/icmp6.h> 39 #include <net/pfvar.h> 40 #include <arpa/inet.h> 41 #include <altq/altq.h> 42 #include <altq/altq_cbq.h> 43 #include <altq/altq_priq.h> 44 #include <altq/altq_hfsc.h> 45 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <netdb.h> 49 #include <stdarg.h> 50 #include <errno.h> 51 #include <string.h> 52 #include <ctype.h> 53 #include <err.h> 54 #include <limits.h> 55 #include <pwd.h> 56 #include <grp.h> 57 #include <md5.h> 58 59 #include "pfctl_parser.h" 60 #include "pfctl.h" 61 62 static struct pfctl *pf = NULL; 63 static FILE *fin = NULL; 64 static int debug = 0; 65 static int lineno = 1; 66 static int errors = 0; 67 static int rulestate = 0; 68 static u_int16_t returnicmpdefault = 69 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 70 static u_int16_t returnicmp6default = 71 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 72 static int blockpolicy = PFRULE_DROP; 73 static int require_order = 1; 74 static int default_statelock; 75 76 enum { 77 PFCTL_STATE_NONE, 78 PFCTL_STATE_OPTION, 79 PFCTL_STATE_SCRUB, 80 PFCTL_STATE_QUEUE, 81 PFCTL_STATE_NAT, 82 PFCTL_STATE_FILTER 83 }; 84 85 struct node_proto { 86 u_int8_t proto; 87 struct node_proto *next; 88 struct node_proto *tail; 89 }; 90 91 struct node_port { 92 u_int16_t port[2]; 93 u_int8_t op; 94 struct node_port *next; 95 struct node_port *tail; 96 }; 97 98 struct node_uid { 99 uid_t uid[2]; 100 u_int8_t op; 101 struct node_uid *next; 102 struct node_uid *tail; 103 }; 104 105 struct node_gid { 106 gid_t gid[2]; 107 u_int8_t op; 108 struct node_gid *next; 109 struct node_gid *tail; 110 }; 111 112 struct node_icmp { 113 u_int8_t code; 114 u_int8_t type; 115 u_int8_t proto; 116 struct node_icmp *next; 117 struct node_icmp *tail; 118 }; 119 120 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 121 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_NODES, 122 PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT }; 123 124 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 125 126 struct node_state_opt { 127 int type; 128 union { 129 u_int32_t max_states; 130 u_int32_t max_src_states; 131 u_int32_t max_src_nodes; 132 u_int8_t src_track; 133 u_int32_t statelock; 134 struct { 135 int number; 136 u_int32_t seconds; 137 } timeout; 138 } data; 139 struct node_state_opt *next; 140 struct node_state_opt *tail; 141 }; 142 143 struct peer { 144 struct node_host *host; 145 struct node_port *port; 146 }; 147 148 struct node_queue { 149 char queue[PF_QNAME_SIZE]; 150 char parent[PF_QNAME_SIZE]; 151 char ifname[IFNAMSIZ]; 152 int scheduler; 153 struct node_queue *next; 154 struct node_queue *tail; 155 } *queues = NULL; 156 157 struct node_qassign { 158 char *qname; 159 char *pqname; 160 }; 161 162 struct filter_opts { 163 int marker; 164 #define FOM_FLAGS 0x01 165 #define FOM_ICMP 0x02 166 #define FOM_TOS 0x04 167 #define FOM_KEEP 0x08 168 #define FOM_SRCTRACK 0x10 169 struct node_uid *uid; 170 struct node_gid *gid; 171 struct { 172 u_int8_t b1; 173 u_int8_t b2; 174 u_int16_t w; 175 u_int16_t w2; 176 } flags; 177 struct node_icmp *icmpspec; 178 u_int32_t tos; 179 struct { 180 int action; 181 struct node_state_opt *options; 182 } keep; 183 int fragment; 184 int allowopts; 185 char *label; 186 struct node_qassign queues; 187 char *tag; 188 char *match_tag; 189 u_int8_t match_tag_not; 190 } filter_opts; 191 192 struct antispoof_opts { 193 char *label; 194 } antispoof_opts; 195 196 struct scrub_opts { 197 int marker; 198 #define SOM_MINTTL 0x01 199 #define SOM_MAXMSS 0x02 200 #define SOM_FRAGCACHE 0x04 201 int nodf; 202 int minttl; 203 int maxmss; 204 int fragcache; 205 int randomid; 206 int reassemble_tcp; 207 } scrub_opts; 208 209 struct queue_opts { 210 int marker; 211 #define QOM_BWSPEC 0x01 212 #define QOM_SCHEDULER 0x02 213 #define QOM_PRIORITY 0x04 214 #define QOM_TBRSIZE 0x08 215 #define QOM_QLIMIT 0x10 216 struct node_queue_bw queue_bwspec; 217 struct node_queue_opt scheduler; 218 int priority; 219 int tbrsize; 220 int qlimit; 221 } queue_opts; 222 223 struct table_opts { 224 int flags; 225 int init_addr; 226 struct node_tinithead init_nodes; 227 } table_opts; 228 229 struct pool_opts { 230 int marker; 231 #define POM_TYPE 0x01 232 #define POM_STICKYADDRESS 0x02 233 u_int8_t opts; 234 int type; 235 int staticport; 236 struct pf_poolhashkey *key; 237 238 } pool_opts; 239 240 241 struct node_hfsc_opts hfsc_opts; 242 243 int yyerror(const char *, ...); 244 int disallow_table(struct node_host *, const char *); 245 int disallow_alias(struct node_host *, const char *); 246 int rule_consistent(struct pf_rule *); 247 int filter_consistent(struct pf_rule *); 248 int nat_consistent(struct pf_rule *); 249 int rdr_consistent(struct pf_rule *); 250 int process_tabledef(char *, struct table_opts *); 251 int yyparse(void); 252 void expand_label_str(char *, size_t, const char *, const char *); 253 void expand_label_if(const char *, char *, size_t, const char *); 254 void expand_label_addr(const char *, char *, size_t, u_int8_t, 255 struct node_host *); 256 void expand_label_port(const char *, char *, size_t, struct node_port *); 257 void expand_label_proto(const char *, char *, size_t, u_int8_t); 258 void expand_label_nr(const char *, char *, size_t); 259 void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 260 struct node_port *, struct node_host *, struct node_port *, 261 u_int8_t); 262 void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 263 struct node_proto *, struct node_os*, struct node_host *, 264 struct node_port *, struct node_host *, struct node_port *, 265 struct node_uid *, struct node_gid *, struct node_icmp *); 266 int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 267 struct node_queue_bw bwspec, struct node_queue_opt *); 268 int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 269 struct node_queue_bw, struct node_queue_opt *); 270 271 int check_rulestate(int); 272 int kw_cmp(const void *, const void *); 273 int lookup(char *); 274 int lgetc(FILE *); 275 int lungetc(int); 276 int findeol(void); 277 int yylex(void); 278 int atoul(char *, u_long *); 279 int getservice(char *); 280 int rule_label(struct pf_rule *, char *); 281 282 TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 283 struct sym { 284 TAILQ_ENTRY(sym) entries; 285 int used; 286 int persist; 287 char *nam; 288 char *val; 289 }; 290 291 292 int symset(const char *, const char *, int); 293 char *symget(const char *); 294 295 void decide_address_family(struct node_host *, sa_family_t *); 296 void remove_invalid_hosts(struct node_host **, sa_family_t *); 297 int invalid_redirect(struct node_host *, sa_family_t); 298 u_int16_t parseicmpspec(char *, sa_family_t); 299 300 TAILQ_HEAD(loadanchorshead, loadanchors) 301 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 302 303 struct loadanchors { 304 TAILQ_ENTRY(loadanchors) entries; 305 char *anchorname; 306 char *rulesetname; 307 char *filename; 308 }; 309 310 typedef struct { 311 union { 312 u_int32_t number; 313 int i; 314 char *string; 315 struct { 316 u_int8_t b1; 317 u_int8_t b2; 318 u_int16_t w; 319 u_int16_t w2; 320 } b; 321 struct range { 322 int a; 323 int b; 324 int t; 325 } range; 326 struct node_if *interface; 327 struct node_proto *proto; 328 struct node_icmp *icmp; 329 struct node_host *host; 330 struct node_os *os; 331 struct node_port *port; 332 struct node_uid *uid; 333 struct node_gid *gid; 334 struct node_state_opt *state_opt; 335 struct peer peer; 336 struct { 337 struct peer src, dst; 338 struct node_os *src_os; 339 } fromto; 340 struct { 341 struct node_host *host; 342 u_int8_t rt; 343 u_int8_t pool_opts; 344 sa_family_t af; 345 struct pf_poolhashkey *key; 346 } route; 347 struct redirection { 348 struct node_host *host; 349 struct range rport; 350 } *redirection; 351 struct { 352 int action; 353 struct node_state_opt *options; 354 } keep_state; 355 struct { 356 u_int8_t log; 357 u_int8_t quick; 358 } logquick; 359 struct pf_poolhashkey *hashkey; 360 struct node_queue *queue; 361 struct node_queue_opt queue_options; 362 struct node_queue_bw queue_bwspec; 363 struct node_qassign qassign; 364 struct filter_opts filter_opts; 365 struct antispoof_opts antispoof_opts; 366 struct queue_opts queue_opts; 367 struct scrub_opts scrub_opts; 368 struct table_opts table_opts; 369 struct pool_opts pool_opts; 370 struct node_hfsc_opts hfsc_opts; 371 } v; 372 int lineno; 373 } YYSTYPE; 374 375 #define PREPARE_ANCHOR_RULE(r, a) \ 376 do { \ 377 memset(&(r), 0, sizeof(r)); \ 378 if (strlcpy(r.anchorname, (a), \ 379 sizeof(r.anchorname)) >= \ 380 sizeof(r.anchorname)) { \ 381 yyerror("anchor name '%s' too long", \ 382 (a)); \ 383 YYERROR; \ 384 } \ 385 } while (0) 386 387 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 388 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 389 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 390 391 %} 392 393 %token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS 394 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 395 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 396 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 397 %token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 398 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 399 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 400 %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG HOSTID 401 %token ANTISPOOF FOR 402 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT 403 %token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 404 %token QUEUE PRIORITY QLIMIT 405 %token LOAD 406 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 407 %token TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY 408 %token <v.string> STRING 409 %token <v.i> PORTBINARY 410 %type <v.interface> interface if_list if_item_not if_item 411 %type <v.number> number icmptype icmp6type uid gid 412 %type <v.number> tos not yesno natpass 413 %type <v.i> no dir log af fragcache sourcetrack 414 %type <v.i> unaryop statelock 415 %type <v.b> action nataction flags flag blockspec 416 %type <v.range> port rport 417 %type <v.hashkey> hashkey 418 %type <v.proto> proto proto_list proto_item 419 %type <v.icmp> icmpspec 420 %type <v.icmp> icmp_list icmp_item 421 %type <v.icmp> icmp6_list icmp6_item 422 %type <v.fromto> fromto 423 %type <v.peer> ipportspec from to 424 %type <v.host> ipspec xhost host dynaddr host_list 425 %type <v.host> redir_host_list redirspec 426 %type <v.host> route_host route_host_list routespec 427 %type <v.os> os xos os_list 428 %type <v.port> portspec port_list port_item 429 %type <v.uid> uids uid_list uid_item 430 %type <v.gid> gids gid_list gid_item 431 %type <v.route> route 432 %type <v.redirection> redirection redirpool 433 %type <v.string> label string tag 434 %type <v.keep_state> keep 435 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 436 %type <v.logquick> logquick 437 %type <v.interface> antispoof_ifspc antispoof_iflst 438 %type <v.qassign> qname 439 %type <v.queue> qassign qassign_list qassign_item 440 %type <v.queue_options> scheduler 441 %type <v.number> cbqflags_list cbqflags_item 442 %type <v.number> priqflags_list priqflags_item 443 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 444 %type <v.queue_bwspec> bandwidth 445 %type <v.filter_opts> filter_opts filter_opt filter_opts_l 446 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 447 %type <v.queue_opts> queue_opts queue_opt queue_opts_l 448 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 449 %type <v.table_opts> table_opts table_opt table_opts_l 450 %type <v.pool_opts> pool_opts pool_opt pool_opts_l 451 %% 452 453 ruleset : /* empty */ 454 | ruleset '\n' 455 | ruleset option '\n' 456 | ruleset scrubrule '\n' 457 | ruleset natrule '\n' 458 | ruleset binatrule '\n' 459 | ruleset pfrule '\n' 460 | ruleset anchorrule '\n' 461 | ruleset loadrule '\n' 462 | ruleset altqif '\n' 463 | ruleset queuespec '\n' 464 | ruleset varset '\n' 465 | ruleset antispoof '\n' 466 | ruleset tabledef '\n' 467 | ruleset error '\n' { errors++; } 468 ; 469 470 option : SET OPTIMIZATION STRING { 471 if (check_rulestate(PFCTL_STATE_OPTION)) { 472 free($3); 473 YYERROR; 474 } 475 if (pfctl_set_optimization(pf, $3) != 0) { 476 yyerror("unknown optimization %s", $3); 477 free($3); 478 YYERROR; 479 } 480 free ($3); 481 } 482 | SET TIMEOUT timeout_spec 483 | SET TIMEOUT '{' timeout_list '}' 484 | SET LIMIT limit_spec 485 | SET LIMIT '{' limit_list '}' 486 | SET LOGINTERFACE STRING { 487 if (check_rulestate(PFCTL_STATE_OPTION)) { 488 free($3); 489 YYERROR; 490 } 491 if ((ifa_exists($3, 0) == NULL) && strcmp($3, "none")) { 492 yyerror("interface %s doesn't exist", $3); 493 free($3); 494 YYERROR; 495 } 496 if (pfctl_set_logif(pf, $3) != 0) { 497 yyerror("error setting loginterface %s", $3); 498 free($3); 499 YYERROR; 500 } 501 free($3); 502 } 503 | SET HOSTID number { 504 if ($3 == 0) { 505 yyerror("hostid must be non-zero"); 506 YYERROR; 507 } 508 if (pfctl_set_hostid(pf, $3) != 0) { 509 yyerror("error setting loginterface %08x", $3); 510 YYERROR; 511 } 512 } 513 | SET BLOCKPOLICY DROP { 514 if (pf->opts & PF_OPT_VERBOSE) 515 printf("set block-policy drop\n"); 516 if (check_rulestate(PFCTL_STATE_OPTION)) 517 YYERROR; 518 blockpolicy = PFRULE_DROP; 519 } 520 | SET BLOCKPOLICY RETURN { 521 if (pf->opts & PF_OPT_VERBOSE) 522 printf("set block-policy return\n"); 523 if (check_rulestate(PFCTL_STATE_OPTION)) 524 YYERROR; 525 blockpolicy = PFRULE_RETURN; 526 } 527 | SET REQUIREORDER yesno { 528 if (pf->opts & PF_OPT_VERBOSE) 529 printf("set require-order %s\n", 530 $3 == 1 ? "yes" : "no"); 531 require_order = $3; 532 } 533 | SET FINGERPRINTS STRING { 534 if (pf->opts & PF_OPT_VERBOSE) 535 printf("fingerprints %s\n", $3); 536 if (check_rulestate(PFCTL_STATE_OPTION)) { 537 free($3); 538 YYERROR; 539 } 540 if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) { 541 yyerror("error loading fingerprints %s", $3); 542 free($3); 543 YYERROR; 544 } 545 free($3); 546 } 547 | SET STATEPOLICY statelock { 548 if (pf->opts & PF_OPT_VERBOSE) 549 switch ($3) { 550 case 0: 551 printf("set state-policy floating\n"); 552 break; 553 case PFRULE_IFBOUND: 554 printf("set state-policy if-bound\n"); 555 break; 556 case PFRULE_GRBOUND: 557 printf("set state-policy " 558 "group-bound\n"); 559 break; 560 } 561 default_statelock = $3; 562 } 563 | SET DEBUG STRING { 564 if (check_rulestate(PFCTL_STATE_OPTION)) { 565 free($3); 566 YYERROR; 567 } 568 if (pfctl_set_debug(pf, $3) != 0) { 569 yyerror("error setting debuglevel %s", $3); 570 free($3); 571 YYERROR; 572 } 573 free($3); 574 } 575 ; 576 577 string : string STRING { 578 if (asprintf(&$$, "%s %s", $1, $2) == -1) 579 err(1, "string: asprintf"); 580 free($1); 581 free($2); 582 } 583 | STRING 584 ; 585 586 varset : STRING '=' string { 587 if (pf->opts & PF_OPT_VERBOSE) 588 printf("%s = \"%s\"\n", $1, $3); 589 if (symset($1, $3, 0) == -1) 590 err(1, "cannot store variable %s", $1); 591 free($1); 592 free($3); 593 } 594 ; 595 596 anchorrule : ANCHOR string dir interface af proto fromto filter_opts { 597 struct pf_rule r; 598 599 if (check_rulestate(PFCTL_STATE_FILTER)) { 600 free($2); 601 YYERROR; 602 } 603 604 PREPARE_ANCHOR_RULE(r, $2); 605 r.direction = $3; 606 r.af = $5; 607 608 if ($8.match_tag) 609 if (strlcpy(r.match_tagname, $8.match_tag, 610 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 611 yyerror("tag too long, max %u chars", 612 PF_TAG_NAME_SIZE - 1); 613 YYERROR; 614 } 615 r.match_tag_not = $8.match_tag_not; 616 617 decide_address_family($7.src.host, &r.af); 618 decide_address_family($7.dst.host, &r.af); 619 620 expand_rule(&r, $4, NULL, $6, $7.src_os, 621 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 622 0, 0, 0); 623 } 624 | NATANCHOR string interface af proto fromto { 625 struct pf_rule r; 626 627 if (check_rulestate(PFCTL_STATE_NAT)) { 628 free($2); 629 YYERROR; 630 } 631 632 PREPARE_ANCHOR_RULE(r, $2); 633 free($2); 634 r.action = PF_NAT; 635 r.af = $4; 636 637 decide_address_family($6.src.host, &r.af); 638 decide_address_family($6.dst.host, &r.af); 639 640 expand_rule(&r, $3, NULL, $5, $6.src_os, 641 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 642 0, 0, 0); 643 } 644 | RDRANCHOR string interface af proto fromto { 645 struct pf_rule r; 646 647 if (check_rulestate(PFCTL_STATE_NAT)) { 648 free($2); 649 YYERROR; 650 } 651 652 PREPARE_ANCHOR_RULE(r, $2); 653 free($2); 654 r.action = PF_RDR; 655 r.af = $4; 656 657 decide_address_family($6.src.host, &r.af); 658 decide_address_family($6.dst.host, &r.af); 659 660 if ($6.src.port != NULL) { 661 yyerror("source port parameter not supported" 662 " in rdr-anchor"); 663 YYERROR; 664 } 665 if ($6.dst.port != NULL) { 666 if ($6.dst.port->next != NULL) { 667 yyerror("destination port list " 668 "expansion not supported in " 669 "rdr-anchor"); 670 YYERROR; 671 } else if ($6.dst.port->op != PF_OP_EQ) { 672 yyerror("destination port operators" 673 " not supported in rdr-anchor"); 674 YYERROR; 675 } 676 r.dst.port[0] = $6.dst.port->port[0]; 677 r.dst.port[1] = $6.dst.port->port[1]; 678 r.dst.port_op = $6.dst.port->op; 679 } 680 681 expand_rule(&r, $3, NULL, $5, $6.src_os, 682 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 683 0, 0, 0); 684 } 685 | BINATANCHOR string interface af proto fromto { 686 struct pf_rule r; 687 688 if (check_rulestate(PFCTL_STATE_NAT)) { 689 free($2); 690 YYERROR; 691 } 692 693 PREPARE_ANCHOR_RULE(r, $2); 694 free($2); 695 r.action = PF_BINAT; 696 r.af = $4; 697 if ($5 != NULL) { 698 if ($5->next != NULL) { 699 yyerror("proto list expansion" 700 " not supported in binat-anchor"); 701 YYERROR; 702 } 703 r.proto = $5->proto; 704 free($5); 705 } 706 707 if ($6.src.host != NULL || $6.src.port != NULL || 708 $6.dst.host != NULL || $6.dst.port != NULL) { 709 yyerror("fromto parameter not supported" 710 " in binat-anchor"); 711 YYERROR; 712 } 713 714 decide_address_family($6.src.host, &r.af); 715 decide_address_family($6.dst.host, &r.af); 716 717 pfctl_add_rule(pf, &r); 718 } 719 ; 720 721 loadrule : LOAD ANCHOR string FROM string { 722 char *t; 723 struct loadanchors *loadanchor; 724 725 t = strsep(&$3, ":"); 726 if (*t == '\0' || $3 == NULL || *$3 == '\0') { 727 yyerror("anchor '%s' invalid\n", $3); 728 free(t); 729 YYERROR; 730 } 731 if (strlen(t) >= PF_ANCHOR_NAME_SIZE) { 732 yyerror("anchorname %s too long, max %u\n", 733 t, PF_ANCHOR_NAME_SIZE - 1); 734 free(t); 735 YYERROR; 736 } 737 if (strlen($3) >= PF_RULESET_NAME_SIZE) { 738 yyerror("rulesetname %s too long, max %u\n", 739 $3, PF_RULESET_NAME_SIZE - 1); 740 free(t); 741 YYERROR; 742 } 743 744 loadanchor = calloc(1, sizeof(struct loadanchors)); 745 if (loadanchor == NULL) 746 err(1, "loadrule: calloc"); 747 if ((loadanchor->anchorname = strdup(t)) == NULL) 748 err(1, "loadrule: strdup"); 749 if ((loadanchor->rulesetname = strdup($3)) == NULL) 750 err(1, "loadrule: strdup"); 751 if ((loadanchor->filename = strdup($5)) == NULL) 752 err(1, "loadrule: strdup"); 753 754 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 755 entries); 756 757 free(t); /* not $3 */ 758 free($5); 759 }; 760 761 scrubrule : SCRUB dir logquick interface af proto fromto scrub_opts 762 { 763 struct pf_rule r; 764 765 if (check_rulestate(PFCTL_STATE_SCRUB)) 766 YYERROR; 767 768 memset(&r, 0, sizeof(r)); 769 770 r.action = PF_SCRUB; 771 r.direction = $2; 772 773 r.log = $3.log; 774 if ($3.quick) { 775 yyerror("scrub rules do not support 'quick'"); 776 YYERROR; 777 } 778 779 r.af = $5; 780 if ($8.nodf) 781 r.rule_flag |= PFRULE_NODF; 782 if ($8.randomid) 783 r.rule_flag |= PFRULE_RANDOMID; 784 if ($8.reassemble_tcp) { 785 if (r.direction != PF_INOUT) { 786 yyerror("reassemble tcp rules can not " 787 "specify direction"); 788 YYERROR; 789 } 790 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 791 } 792 if ($8.minttl) 793 r.min_ttl = $8.minttl; 794 if ($8.maxmss) 795 r.max_mss = $8.maxmss; 796 if ($8.fragcache) 797 r.rule_flag |= $8.fragcache; 798 799 expand_rule(&r, $4, NULL, $6, $7.src_os, 800 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 801 NULL, NULL, NULL); 802 } 803 ; 804 805 scrub_opts : { 806 bzero(&scrub_opts, sizeof scrub_opts); 807 } 808 scrub_opts_l 809 { $$ = scrub_opts; } 810 | /* empty */ { 811 bzero(&scrub_opts, sizeof scrub_opts); 812 $$ = scrub_opts; 813 } 814 ; 815 816 scrub_opts_l : scrub_opts_l scrub_opt 817 | scrub_opt 818 ; 819 820 scrub_opt : NODF { 821 if (scrub_opts.nodf) { 822 yyerror("no-df cannot be respecified"); 823 YYERROR; 824 } 825 scrub_opts.nodf = 1; 826 } 827 | MINTTL number { 828 if (scrub_opts.marker & SOM_MINTTL) { 829 yyerror("min-ttl cannot be respecified"); 830 YYERROR; 831 } 832 if ($2 > 255) { 833 yyerror("illegal min-ttl value %d", $2); 834 YYERROR; 835 } 836 scrub_opts.marker |= SOM_MINTTL; 837 scrub_opts.minttl = $2; 838 } 839 | MAXMSS number { 840 if (scrub_opts.marker & SOM_MAXMSS) { 841 yyerror("max-mss cannot be respecified"); 842 YYERROR; 843 } 844 if ($2 > 65535) { 845 yyerror("illegal max-mss value %d", $2); 846 YYERROR; 847 } 848 scrub_opts.marker |= SOM_MAXMSS; 849 scrub_opts.maxmss = $2; 850 } 851 | fragcache { 852 if (scrub_opts.marker & SOM_FRAGCACHE) { 853 yyerror("fragcache cannot be respecified"); 854 YYERROR; 855 } 856 scrub_opts.marker |= SOM_FRAGCACHE; 857 scrub_opts.fragcache = $1; 858 } 859 | REASSEMBLE STRING { 860 if (strcasecmp($2, "tcp") != 0) { 861 free($2); 862 YYERROR; 863 } 864 free($2); 865 if (scrub_opts.reassemble_tcp) { 866 yyerror("reassemble tcp cannot be respecified"); 867 YYERROR; 868 } 869 scrub_opts.reassemble_tcp = 1; 870 } 871 | RANDOMID { 872 if (scrub_opts.randomid) { 873 yyerror("random-id cannot be respecified"); 874 YYERROR; 875 } 876 scrub_opts.randomid = 1; 877 } 878 ; 879 880 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 881 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 882 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 883 ; 884 885 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 886 struct pf_rule r; 887 struct node_host *h = NULL; 888 struct node_if *i, *j; 889 890 if (check_rulestate(PFCTL_STATE_FILTER)) 891 YYERROR; 892 893 for (i = $3; i; i = i->next) { 894 bzero(&r, sizeof(r)); 895 896 r.action = PF_DROP; 897 r.direction = PF_IN; 898 r.log = $2.log; 899 r.quick = $2.quick; 900 r.af = $4; 901 if (rule_label(&r, $5.label)) 902 YYERROR; 903 j = calloc(1, sizeof(struct node_if)); 904 if (j == NULL) 905 err(1, "antispoof: calloc"); 906 if (strlcpy(j->ifname, i->ifname, 907 sizeof(j->ifname)) >= sizeof(j->ifname)) { 908 free(j); 909 yyerror("interface name too long"); 910 YYERROR; 911 } 912 j->not = 1; 913 h = ifa_lookup(j->ifname, PFI_AFLAG_NETWORK); 914 915 if (h != NULL) 916 expand_rule(&r, j, NULL, NULL, NULL, h, 917 NULL, NULL, NULL, NULL, NULL, NULL); 918 919 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 920 bzero(&r, sizeof(r)); 921 922 r.action = PF_DROP; 923 r.direction = PF_IN; 924 r.log = $2.log; 925 r.quick = $2.quick; 926 r.af = $4; 927 if (rule_label(&r, $5.label)) 928 YYERROR; 929 h = ifa_lookup(i->ifname, 0); 930 if (h != NULL) 931 expand_rule(&r, NULL, NULL, 932 NULL, NULL, h, NULL, NULL, 933 NULL, NULL, NULL, NULL); 934 } 935 } 936 free($5.label); 937 } 938 ; 939 940 antispoof_ifspc : FOR if_item { $$ = $2; } 941 | FOR '{' antispoof_iflst '}' { $$ = $3; } 942 ; 943 944 antispoof_iflst : if_item { $$ = $1; } 945 | antispoof_iflst comma if_item { 946 $1->tail->next = $3; 947 $1->tail = $3; 948 $$ = $1; 949 } 950 ; 951 952 antispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 953 antispoof_opts_l 954 { $$ = antispoof_opts; } 955 | /* empty */ { 956 bzero(&antispoof_opts, sizeof antispoof_opts); 957 $$ = antispoof_opts; 958 } 959 ; 960 961 antispoof_opts_l : antispoof_opts_l antispoof_opt 962 | antispoof_opt 963 ; 964 965 antispoof_opt : label { 966 if (antispoof_opts.label) { 967 yyerror("label cannot be redefined"); 968 YYERROR; 969 } 970 antispoof_opts.label = $1; 971 } 972 ; 973 974 not : '!' { $$ = 1; } 975 | /* empty */ { $$ = 0; } 976 ; 977 978 tabledef : TABLE '<' STRING '>' table_opts { 979 struct node_host *h, *nh; 980 struct node_tinit *ti, *nti; 981 982 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 983 yyerror("table name too long, max %d chars", 984 PF_TABLE_NAME_SIZE - 1); 985 free($3); 986 YYERROR; 987 } 988 if (pf->loadopt & PFCTL_FLAG_TABLE) 989 if (process_tabledef($3, &$5)) { 990 free($3); 991 YYERROR; 992 } 993 free($3); 994 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 995 ti != NULL; ti = nti) { 996 if (ti->file) 997 free(ti->file); 998 for (h = ti->host; h != NULL; h = nh) { 999 nh = h->next; 1000 free(h); 1001 } 1002 nti = SIMPLEQ_NEXT(ti, entries); 1003 free(ti); 1004 } 1005 } 1006 ; 1007 1008 table_opts : { 1009 bzero(&table_opts, sizeof table_opts); 1010 SIMPLEQ_INIT(&table_opts.init_nodes); 1011 } 1012 table_opts_l 1013 { $$ = table_opts; } 1014 | /* empty */ 1015 { 1016 bzero(&table_opts, sizeof table_opts); 1017 SIMPLEQ_INIT(&table_opts.init_nodes); 1018 $$ = table_opts; 1019 } 1020 ; 1021 1022 table_opts_l : table_opts_l table_opt 1023 | table_opt 1024 ; 1025 1026 table_opt : STRING { 1027 if (!strcmp($1, "const")) 1028 table_opts.flags |= PFR_TFLAG_CONST; 1029 else if (!strcmp($1, "persist")) 1030 table_opts.flags |= PFR_TFLAG_PERSIST; 1031 else { 1032 free($1); 1033 YYERROR; 1034 } 1035 free($1); 1036 } 1037 | '{' '}' { table_opts.init_addr = 1; } 1038 | '{' host_list '}' { 1039 struct node_host *n; 1040 struct node_tinit *ti; 1041 1042 for (n = $2; n != NULL; n = n->next) { 1043 switch (n->addr.type) { 1044 case PF_ADDR_ADDRMASK: 1045 continue; /* ok */ 1046 case PF_ADDR_DYNIFTL: 1047 yyerror("dynamic addresses are not " 1048 "permitted inside tables"); 1049 break; 1050 case PF_ADDR_TABLE: 1051 yyerror("tables cannot contain tables"); 1052 break; 1053 case PF_ADDR_NOROUTE: 1054 yyerror("\"no-route\" is not permitted " 1055 "inside tables"); 1056 break; 1057 default: 1058 yyerror("unknown address type %d", 1059 n->addr.type); 1060 } 1061 YYERROR; 1062 } 1063 if (!(ti = calloc(1, sizeof(*ti)))) 1064 err(1, "table_opt: calloc"); 1065 ti->host = $2; 1066 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1067 entries); 1068 table_opts.init_addr = 1; 1069 } 1070 | FILENAME STRING { 1071 struct node_tinit *ti; 1072 1073 if (!(ti = calloc(1, sizeof(*ti)))) 1074 err(1, "table_opt: calloc"); 1075 ti->file = $2; 1076 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1077 entries); 1078 table_opts.init_addr = 1; 1079 } 1080 ; 1081 1082 altqif : ALTQ interface queue_opts QUEUE qassign { 1083 struct pf_altq a; 1084 1085 if (check_rulestate(PFCTL_STATE_QUEUE)) 1086 YYERROR; 1087 1088 memset(&a, 0, sizeof(a)); 1089 if ($3.scheduler.qtype == ALTQT_NONE) { 1090 yyerror("no scheduler specified!"); 1091 YYERROR; 1092 } 1093 a.scheduler = $3.scheduler.qtype; 1094 a.qlimit = $3.qlimit; 1095 a.tbrsize = $3.tbrsize; 1096 if ($5 == NULL) { 1097 yyerror("no child queues specified"); 1098 YYERROR; 1099 } 1100 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1101 &$3.scheduler)) 1102 YYERROR; 1103 } 1104 ; 1105 1106 queuespec : QUEUE STRING interface queue_opts qassign { 1107 struct pf_altq a; 1108 1109 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1110 free($2); 1111 YYERROR; 1112 } 1113 1114 memset(&a, 0, sizeof(a)); 1115 1116 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1117 sizeof(a.qname)) { 1118 yyerror("queue name too long (max " 1119 "%d chars)", PF_QNAME_SIZE-1); 1120 free($2); 1121 YYERROR; 1122 } 1123 free($2); 1124 if ($4.tbrsize) { 1125 yyerror("cannot specify tbrsize for queue"); 1126 YYERROR; 1127 } 1128 if ($4.priority > 255) { 1129 yyerror("priority out of range: max 255"); 1130 YYERROR; 1131 } 1132 a.priority = $4.priority; 1133 a.qlimit = $4.qlimit; 1134 a.scheduler = $4.scheduler.qtype; 1135 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1136 &$4.scheduler)) { 1137 yyerror("errors in queue definition"); 1138 YYERROR; 1139 } 1140 } 1141 ; 1142 1143 queue_opts : { 1144 bzero(&queue_opts, sizeof queue_opts); 1145 queue_opts.priority = DEFAULT_PRIORITY; 1146 queue_opts.qlimit = DEFAULT_QLIMIT; 1147 queue_opts.scheduler.qtype = ALTQT_NONE; 1148 queue_opts.queue_bwspec.bw_percent = 100; 1149 } 1150 queue_opts_l 1151 { $$ = queue_opts; } 1152 | /* empty */ { 1153 bzero(&queue_opts, sizeof queue_opts); 1154 queue_opts.priority = DEFAULT_PRIORITY; 1155 queue_opts.qlimit = DEFAULT_QLIMIT; 1156 queue_opts.scheduler.qtype = ALTQT_NONE; 1157 queue_opts.queue_bwspec.bw_percent = 100; 1158 $$ = queue_opts; 1159 } 1160 ; 1161 1162 queue_opts_l : queue_opts_l queue_opt 1163 | queue_opt 1164 ; 1165 1166 queue_opt : BANDWIDTH bandwidth { 1167 if (queue_opts.marker & QOM_BWSPEC) { 1168 yyerror("bandwidth cannot be respecified"); 1169 YYERROR; 1170 } 1171 queue_opts.marker |= QOM_BWSPEC; 1172 queue_opts.queue_bwspec = $2; 1173 } 1174 | PRIORITY number { 1175 if (queue_opts.marker & QOM_PRIORITY) { 1176 yyerror("priority cannot be respecified"); 1177 YYERROR; 1178 } 1179 if ($2 > 255) { 1180 yyerror("priority out of range: max 255"); 1181 YYERROR; 1182 } 1183 queue_opts.marker |= QOM_PRIORITY; 1184 queue_opts.priority = $2; 1185 } 1186 | QLIMIT number { 1187 if (queue_opts.marker & QOM_QLIMIT) { 1188 yyerror("qlimit cannot be respecified"); 1189 YYERROR; 1190 } 1191 if ($2 > 65535) { 1192 yyerror("qlimit out of range: max 65535"); 1193 YYERROR; 1194 } 1195 queue_opts.marker |= QOM_QLIMIT; 1196 queue_opts.qlimit = $2; 1197 } 1198 | scheduler { 1199 if (queue_opts.marker & QOM_SCHEDULER) { 1200 yyerror("scheduler cannot be respecified"); 1201 YYERROR; 1202 } 1203 queue_opts.marker |= QOM_SCHEDULER; 1204 queue_opts.scheduler = $1; 1205 } 1206 | TBRSIZE number { 1207 if (queue_opts.marker & QOM_TBRSIZE) { 1208 yyerror("tbrsize cannot be respecified"); 1209 YYERROR; 1210 } 1211 if ($2 > 65535) { 1212 yyerror("tbrsize too big: max 65535"); 1213 YYERROR; 1214 } 1215 queue_opts.marker |= QOM_TBRSIZE; 1216 queue_opts.tbrsize = $2; 1217 } 1218 ; 1219 1220 bandwidth : STRING { 1221 double bps; 1222 char *cp; 1223 1224 $$.bw_percent = 0; 1225 1226 bps = strtod($1, &cp); 1227 if (cp != NULL) { 1228 if (!strcmp(cp, "b")) 1229 ; /* nothing */ 1230 else if (!strcmp(cp, "Kb")) 1231 bps *= 1000; 1232 else if (!strcmp(cp, "Mb")) 1233 bps *= 1000 * 1000; 1234 else if (!strcmp(cp, "Gb")) 1235 bps *= 1000 * 1000 * 1000; 1236 else if (!strcmp(cp, "%")) { 1237 if (bps < 0 || bps > 100) { 1238 yyerror("bandwidth spec " 1239 "out of range"); 1240 free($1); 1241 YYERROR; 1242 } 1243 $$.bw_percent = bps; 1244 bps = 0; 1245 } else { 1246 yyerror("unknown unit %s", cp); 1247 free($1); 1248 YYERROR; 1249 } 1250 } 1251 free($1); 1252 $$.bw_absolute = (u_int32_t)bps; 1253 } 1254 ; 1255 1256 scheduler : CBQ { 1257 $$.qtype = ALTQT_CBQ; 1258 $$.data.cbq_opts.flags = 0; 1259 } 1260 | CBQ '(' cbqflags_list ')' { 1261 $$.qtype = ALTQT_CBQ; 1262 $$.data.cbq_opts.flags = $3; 1263 } 1264 | PRIQ { 1265 $$.qtype = ALTQT_PRIQ; 1266 $$.data.priq_opts.flags = 0; 1267 } 1268 | PRIQ '(' priqflags_list ')' { 1269 $$.qtype = ALTQT_PRIQ; 1270 $$.data.priq_opts.flags = $3; 1271 } 1272 | HFSC { 1273 $$.qtype = ALTQT_HFSC; 1274 bzero(&$$.data.hfsc_opts, 1275 sizeof(struct node_hfsc_opts)); 1276 } 1277 | HFSC '(' hfsc_opts ')' { 1278 $$.qtype = ALTQT_HFSC; 1279 $$.data.hfsc_opts = $3; 1280 } 1281 ; 1282 1283 cbqflags_list : cbqflags_item { $$ |= $1; } 1284 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1285 ; 1286 1287 cbqflags_item : STRING { 1288 if (!strcmp($1, "default")) 1289 $$ = CBQCLF_DEFCLASS; 1290 else if (!strcmp($1, "borrow")) 1291 $$ = CBQCLF_BORROW; 1292 else if (!strcmp($1, "red")) 1293 $$ = CBQCLF_RED; 1294 else if (!strcmp($1, "ecn")) 1295 $$ = CBQCLF_RED|CBQCLF_ECN; 1296 else if (!strcmp($1, "rio")) 1297 $$ = CBQCLF_RIO; 1298 else { 1299 yyerror("unknown cbq flag \"%s\"", $1); 1300 free($1); 1301 YYERROR; 1302 } 1303 free($1); 1304 } 1305 ; 1306 1307 priqflags_list : priqflags_item { $$ |= $1; } 1308 | priqflags_list comma priqflags_item { $$ |= $3; } 1309 ; 1310 1311 priqflags_item : STRING { 1312 if (!strcmp($1, "default")) 1313 $$ = PRCF_DEFAULTCLASS; 1314 else if (!strcmp($1, "red")) 1315 $$ = PRCF_RED; 1316 else if (!strcmp($1, "ecn")) 1317 $$ = PRCF_RED|PRCF_ECN; 1318 else if (!strcmp($1, "rio")) 1319 $$ = PRCF_RIO; 1320 else { 1321 yyerror("unknown priq flag \"%s\"", $1); 1322 free($1); 1323 YYERROR; 1324 } 1325 free($1); 1326 } 1327 ; 1328 1329 hfsc_opts : { 1330 bzero(&hfsc_opts, 1331 sizeof(struct node_hfsc_opts)); 1332 } 1333 hfscopts_list { 1334 $$ = hfsc_opts; 1335 } 1336 ; 1337 1338 hfscopts_list : hfscopts_item 1339 | hfscopts_list comma hfscopts_item 1340 ; 1341 1342 hfscopts_item : LINKSHARE bandwidth { 1343 if (hfsc_opts.linkshare.used) { 1344 yyerror("linkshare already specified"); 1345 YYERROR; 1346 } 1347 hfsc_opts.linkshare.m2 = $2; 1348 hfsc_opts.linkshare.used = 1; 1349 } 1350 | LINKSHARE '(' bandwidth number bandwidth ')' { 1351 if (hfsc_opts.linkshare.used) { 1352 yyerror("linkshare already specified"); 1353 YYERROR; 1354 } 1355 hfsc_opts.linkshare.m1 = $3; 1356 hfsc_opts.linkshare.d = $4; 1357 hfsc_opts.linkshare.m2 = $5; 1358 hfsc_opts.linkshare.used = 1; 1359 } 1360 | REALTIME bandwidth { 1361 if (hfsc_opts.realtime.used) { 1362 yyerror("realtime already specified"); 1363 YYERROR; 1364 } 1365 hfsc_opts.realtime.m2 = $2; 1366 hfsc_opts.realtime.used = 1; 1367 } 1368 | REALTIME '(' bandwidth number bandwidth ')' { 1369 if (hfsc_opts.realtime.used) { 1370 yyerror("realtime already specified"); 1371 YYERROR; 1372 } 1373 hfsc_opts.realtime.m1 = $3; 1374 hfsc_opts.realtime.d = $4; 1375 hfsc_opts.realtime.m2 = $5; 1376 hfsc_opts.realtime.used = 1; 1377 } 1378 | UPPERLIMIT bandwidth { 1379 if (hfsc_opts.upperlimit.used) { 1380 yyerror("upperlimit already specified"); 1381 YYERROR; 1382 } 1383 hfsc_opts.upperlimit.m2 = $2; 1384 hfsc_opts.upperlimit.used = 1; 1385 } 1386 | UPPERLIMIT '(' bandwidth number bandwidth ')' { 1387 if (hfsc_opts.upperlimit.used) { 1388 yyerror("upperlimit already specified"); 1389 YYERROR; 1390 } 1391 hfsc_opts.upperlimit.m1 = $3; 1392 hfsc_opts.upperlimit.d = $4; 1393 hfsc_opts.upperlimit.m2 = $5; 1394 hfsc_opts.upperlimit.used = 1; 1395 } 1396 | STRING { 1397 if (!strcmp($1, "default")) 1398 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1399 else if (!strcmp($1, "red")) 1400 hfsc_opts.flags |= HFCF_RED; 1401 else if (!strcmp($1, "ecn")) 1402 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1403 else if (!strcmp($1, "rio")) 1404 hfsc_opts.flags |= HFCF_RIO; 1405 else { 1406 yyerror("unknown hfsc flag \"%s\"", $1); 1407 free($1); 1408 YYERROR; 1409 } 1410 free($1); 1411 } 1412 ; 1413 1414 qassign : /* empty */ { $$ = NULL; } 1415 | qassign_item { $$ = $1; } 1416 | '{' qassign_list '}' { $$ = $2; } 1417 ; 1418 1419 qassign_list : qassign_item { $$ = $1; } 1420 | qassign_list comma qassign_item { 1421 $1->tail->next = $3; 1422 $1->tail = $3; 1423 $$ = $1; 1424 } 1425 ; 1426 1427 qassign_item : STRING { 1428 $$ = calloc(1, sizeof(struct node_queue)); 1429 if ($$ == NULL) 1430 err(1, "qassign_item: calloc"); 1431 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1432 sizeof($$->queue)) { 1433 yyerror("queue name '%s' too long (max " 1434 "%d chars)", $1, sizeof($$->queue)-1); 1435 free($1); 1436 free($$); 1437 YYERROR; 1438 } 1439 free($1); 1440 $$->next = NULL; 1441 $$->tail = $$; 1442 } 1443 ; 1444 1445 pfrule : action dir logquick interface route af proto fromto 1446 filter_opts 1447 { 1448 struct pf_rule r; 1449 struct node_state_opt *o; 1450 struct node_proto *proto; 1451 int srctrack = 0; 1452 int statelock = 0; 1453 1454 if (check_rulestate(PFCTL_STATE_FILTER)) 1455 YYERROR; 1456 1457 memset(&r, 0, sizeof(r)); 1458 1459 r.action = $1.b1; 1460 switch ($1.b2) { 1461 case PFRULE_RETURNRST: 1462 r.rule_flag |= PFRULE_RETURNRST; 1463 r.return_ttl = $1.w; 1464 break; 1465 case PFRULE_RETURNICMP: 1466 r.rule_flag |= PFRULE_RETURNICMP; 1467 r.return_icmp = $1.w; 1468 r.return_icmp6 = $1.w2; 1469 break; 1470 case PFRULE_RETURN: 1471 r.rule_flag |= PFRULE_RETURN; 1472 r.return_icmp = $1.w; 1473 r.return_icmp6 = $1.w2; 1474 break; 1475 } 1476 r.direction = $2; 1477 r.log = $3.log; 1478 r.quick = $3.quick; 1479 1480 r.af = $6; 1481 if ($9.tag) 1482 if (strlcpy(r.tagname, $9.tag, 1483 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1484 yyerror("tag too long, max %u chars", 1485 PF_TAG_NAME_SIZE - 1); 1486 YYERROR; 1487 } 1488 if ($9.match_tag) 1489 if (strlcpy(r.match_tagname, $9.match_tag, 1490 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1491 yyerror("tag too long, max %u chars", 1492 PF_TAG_NAME_SIZE - 1); 1493 YYERROR; 1494 } 1495 r.match_tag_not = $9.match_tag_not; 1496 r.flags = $9.flags.b1; 1497 r.flagset = $9.flags.b2; 1498 if (rule_label(&r, $9.label)) 1499 YYERROR; 1500 free($9.label); 1501 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1502 for (proto = $7; proto != NULL && 1503 proto->proto != IPPROTO_TCP; 1504 proto = proto->next) 1505 ; /* nothing */ 1506 if (proto == NULL && $7 != NULL) { 1507 if ($9.flags.b1 || $9.flags.b2) 1508 yyerror( 1509 "flags only apply to tcp"); 1510 if ($8.src_os) 1511 yyerror( 1512 "OS fingerprinting only " 1513 "apply to tcp"); 1514 YYERROR; 1515 } 1516 #if 0 1517 if (($9.flags.b1 & parse_flags("S")) == 0 && 1518 $8.src_os) { 1519 yyerror("OS fingerprinting requires " 1520 "the SYN TCP flag (flags S/SA)"); 1521 YYERROR; 1522 } 1523 #endif 1524 } 1525 1526 r.tos = $9.tos; 1527 r.keep_state = $9.keep.action; 1528 o = $9.keep.options; 1529 while (o) { 1530 struct node_state_opt *p = o; 1531 1532 switch (o->type) { 1533 case PF_STATE_OPT_MAX: 1534 if (r.max_states) { 1535 yyerror("state option 'max' " 1536 "multiple definitions"); 1537 YYERROR; 1538 } 1539 r.max_states = o->data.max_states; 1540 break; 1541 case PF_STATE_OPT_NOSYNC: 1542 if (r.rule_flag & PFRULE_NOSYNC) { 1543 yyerror("state option 'sync' " 1544 "multiple definitions"); 1545 YYERROR; 1546 } 1547 r.rule_flag |= PFRULE_NOSYNC; 1548 break; 1549 case PF_STATE_OPT_SRCTRACK: 1550 if (srctrack) { 1551 yyerror("state option " 1552 "'source-track' " 1553 "multiple definitions"); 1554 YYERROR; 1555 } 1556 srctrack = o->data.src_track; 1557 break; 1558 case PF_STATE_OPT_MAX_SRC_STATES: 1559 if (r.max_src_states) { 1560 yyerror("state option " 1561 "'max-src-states' " 1562 "multiple definitions"); 1563 YYERROR; 1564 } 1565 if (o->data.max_src_nodes == 0) { 1566 yyerror("'max-src-states' must " 1567 "be > 0"); 1568 YYERROR; 1569 } 1570 r.max_src_states = 1571 o->data.max_src_states; 1572 r.rule_flag |= PFRULE_SRCTRACK; 1573 break; 1574 case PF_STATE_OPT_MAX_SRC_NODES: 1575 if (r.max_src_nodes) { 1576 yyerror("state option " 1577 "'max-src-nodes' " 1578 "multiple definitions"); 1579 YYERROR; 1580 } 1581 if (o->data.max_src_nodes == 0) { 1582 yyerror("'max-src-nodes' must " 1583 "be > 0"); 1584 YYERROR; 1585 } 1586 r.max_src_nodes = 1587 o->data.max_src_nodes; 1588 r.rule_flag |= PFRULE_SRCTRACK | 1589 PFRULE_RULESRCTRACK; 1590 break; 1591 case PF_STATE_OPT_STATELOCK: 1592 if (statelock) { 1593 yyerror("state locking option: " 1594 "multiple definitions"); 1595 YYERROR; 1596 } 1597 statelock = 1; 1598 r.rule_flag |= o->data.statelock; 1599 break; 1600 case PF_STATE_OPT_TIMEOUT: 1601 if (r.timeout[o->data.timeout.number]) { 1602 yyerror("state timeout %s " 1603 "multiple definitions", 1604 pf_timeouts[o->data. 1605 timeout.number].name); 1606 YYERROR; 1607 } 1608 r.timeout[o->data.timeout.number] = 1609 o->data.timeout.seconds; 1610 } 1611 o = o->next; 1612 free(p); 1613 } 1614 if (srctrack) { 1615 if (srctrack == PF_SRCTRACK_GLOBAL && 1616 r.max_src_nodes) { 1617 yyerror("'max-src-nodes' is " 1618 "incompatible with " 1619 "'source-track global'"); 1620 YYERROR; 1621 } 1622 r.rule_flag |= PFRULE_SRCTRACK; 1623 if (srctrack == PF_SRCTRACK_RULE) 1624 r.rule_flag |= PFRULE_RULESRCTRACK; 1625 } 1626 if (r.keep_state && !statelock) 1627 r.rule_flag |= default_statelock; 1628 1629 if ($9.fragment) 1630 r.rule_flag |= PFRULE_FRAGMENT; 1631 r.allow_opts = $9.allowopts; 1632 1633 decide_address_family($8.src.host, &r.af); 1634 decide_address_family($8.dst.host, &r.af); 1635 1636 if ($5.rt) { 1637 if (!r.direction) { 1638 yyerror("direction must be explicit " 1639 "with rules that specify routing"); 1640 YYERROR; 1641 } 1642 r.rt = $5.rt; 1643 r.rpool.opts = $5.pool_opts; 1644 if ($5.key != NULL) 1645 memcpy(&r.rpool.key, $5.key, 1646 sizeof(struct pf_poolhashkey)); 1647 } 1648 if (r.rt && r.rt != PF_FASTROUTE) { 1649 decide_address_family($5.host, &r.af); 1650 remove_invalid_hosts(&$5.host, &r.af); 1651 if ($5.host == NULL) { 1652 yyerror("no routing address with " 1653 "matching address family found."); 1654 YYERROR; 1655 } 1656 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1657 PF_POOL_NONE && ($5.host->next != NULL || 1658 $5.host->addr.type == PF_ADDR_TABLE || 1659 DYNIF_MULTIADDR($5.host->addr))) 1660 r.rpool.opts |= PF_POOL_ROUNDROBIN; 1661 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1662 PF_POOL_ROUNDROBIN && 1663 disallow_table($5.host, "tables are only " 1664 "supported in round-robin routing pools")) 1665 YYERROR; 1666 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1667 PF_POOL_ROUNDROBIN && 1668 disallow_alias($5.host, "interface (%s) " 1669 "is only supported in round-robin " 1670 "routing pools")) 1671 YYERROR; 1672 if ($5.host->next != NULL) { 1673 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1674 PF_POOL_ROUNDROBIN) { 1675 yyerror("r.rpool.opts must " 1676 "be PF_POOL_ROUNDROBIN"); 1677 YYERROR; 1678 } 1679 } 1680 } 1681 if ($9.queues.qname != NULL) { 1682 if (strlcpy(r.qname, $9.queues.qname, 1683 sizeof(r.qname)) >= sizeof(r.qname)) { 1684 yyerror("rule qname too long (max " 1685 "%d chars)", sizeof(r.qname)-1); 1686 YYERROR; 1687 } 1688 free($9.queues.qname); 1689 } 1690 if ($9.queues.pqname != NULL) { 1691 if (strlcpy(r.pqname, $9.queues.pqname, 1692 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1693 yyerror("rule pqname too long (max " 1694 "%d chars)", sizeof(r.pqname)-1); 1695 YYERROR; 1696 } 1697 free($9.queues.pqname); 1698 } 1699 1700 expand_rule(&r, $4, $5.host, $7, $8.src_os, 1701 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1702 $9.uid, $9.gid, $9.icmpspec); 1703 } 1704 ; 1705 1706 filter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1707 filter_opts_l 1708 { $$ = filter_opts; } 1709 | /* empty */ { 1710 bzero(&filter_opts, sizeof filter_opts); 1711 $$ = filter_opts; 1712 } 1713 ; 1714 1715 filter_opts_l : filter_opts_l filter_opt 1716 | filter_opt 1717 ; 1718 1719 filter_opt : USER uids { 1720 if (filter_opts.uid) 1721 $2->tail->next = filter_opts.uid; 1722 filter_opts.uid = $2; 1723 } 1724 | GROUP gids { 1725 if (filter_opts.gid) 1726 $2->tail->next = filter_opts.gid; 1727 filter_opts.gid = $2; 1728 } 1729 | flags { 1730 if (filter_opts.marker & FOM_FLAGS) { 1731 yyerror("flags cannot be redefined"); 1732 YYERROR; 1733 } 1734 filter_opts.marker |= FOM_FLAGS; 1735 filter_opts.flags.b1 |= $1.b1; 1736 filter_opts.flags.b2 |= $1.b2; 1737 filter_opts.flags.w |= $1.w; 1738 filter_opts.flags.w2 |= $1.w2; 1739 } 1740 | icmpspec { 1741 if (filter_opts.marker & FOM_ICMP) { 1742 yyerror("icmp-type cannot be redefined"); 1743 YYERROR; 1744 } 1745 filter_opts.marker |= FOM_ICMP; 1746 filter_opts.icmpspec = $1; 1747 } 1748 | tos { 1749 if (filter_opts.marker & FOM_TOS) { 1750 yyerror("tos cannot be redefined"); 1751 YYERROR; 1752 } 1753 filter_opts.marker |= FOM_TOS; 1754 filter_opts.tos = $1; 1755 } 1756 | keep { 1757 if (filter_opts.marker & FOM_KEEP) { 1758 yyerror("modulate or keep cannot be redefined"); 1759 YYERROR; 1760 } 1761 filter_opts.marker |= FOM_KEEP; 1762 filter_opts.keep.action = $1.action; 1763 filter_opts.keep.options = $1.options; 1764 } 1765 | FRAGMENT { 1766 filter_opts.fragment = 1; 1767 } 1768 | ALLOWOPTS { 1769 filter_opts.allowopts = 1; 1770 } 1771 | label { 1772 if (filter_opts.label) { 1773 yyerror("label cannot be redefined"); 1774 YYERROR; 1775 } 1776 filter_opts.label = $1; 1777 } 1778 | qname { 1779 if (filter_opts.queues.qname) { 1780 yyerror("queue cannot be redefined"); 1781 YYERROR; 1782 } 1783 filter_opts.queues = $1; 1784 } 1785 | TAG string { 1786 filter_opts.tag = $2; 1787 } 1788 | not TAGGED string { 1789 filter_opts.match_tag = $3; 1790 filter_opts.match_tag_not = $1; 1791 } 1792 ; 1793 1794 action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 1795 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 1796 ; 1797 1798 blockspec : /* empty */ { 1799 $$.b2 = blockpolicy; 1800 $$.w = returnicmpdefault; 1801 $$.w2 = returnicmp6default; 1802 } 1803 | DROP { 1804 $$.b2 = PFRULE_DROP; 1805 $$.w = 0; 1806 $$.w2 = 0; 1807 } 1808 | RETURNRST { 1809 $$.b2 = PFRULE_RETURNRST; 1810 $$.w = 0; 1811 $$.w2 = 0; 1812 } 1813 | RETURNRST '(' TTL number ')' { 1814 if ($4 > 255) { 1815 yyerror("illegal ttl value %d", $4); 1816 YYERROR; 1817 } 1818 $$.b2 = PFRULE_RETURNRST; 1819 $$.w = $4; 1820 $$.w2 = 0; 1821 } 1822 | RETURNICMP { 1823 $$.b2 = PFRULE_RETURNICMP; 1824 $$.w = returnicmpdefault; 1825 $$.w2 = returnicmp6default; 1826 } 1827 | RETURNICMP6 { 1828 $$.b2 = PFRULE_RETURNICMP; 1829 $$.w = returnicmpdefault; 1830 $$.w2 = returnicmp6default; 1831 } 1832 | RETURNICMP '(' STRING ')' { 1833 $$.b2 = PFRULE_RETURNICMP; 1834 if (!($$.w = parseicmpspec($3, AF_INET))) { 1835 free($3); 1836 YYERROR; 1837 } 1838 free($3); 1839 $$.w2 = returnicmp6default; 1840 } 1841 | RETURNICMP6 '(' STRING ')' { 1842 $$.b2 = PFRULE_RETURNICMP; 1843 $$.w = returnicmpdefault; 1844 if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 1845 free($3); 1846 YYERROR; 1847 } 1848 free($3); 1849 } 1850 | RETURNICMP '(' STRING comma STRING ')' { 1851 $$.b2 = PFRULE_RETURNICMP; 1852 if (!($$.w = parseicmpspec($3, AF_INET)) || 1853 !($$.w2 = parseicmpspec($5, AF_INET6))) { 1854 free($3); 1855 free($5); 1856 YYERROR; 1857 } 1858 free($3); 1859 free($5); 1860 } 1861 | RETURN { 1862 $$.b2 = PFRULE_RETURN; 1863 $$.w = returnicmpdefault; 1864 $$.w2 = returnicmp6default; 1865 } 1866 ; 1867 1868 dir : /* empty */ { $$ = 0; } 1869 | IN { $$ = PF_IN; } 1870 | OUT { $$ = PF_OUT; } 1871 ; 1872 1873 logquick : /* empty */ { $$.log = 0; $$.quick = 0; } 1874 | log { $$.log = $1; $$.quick = 0; } 1875 | QUICK { $$.log = 0; $$.quick = 1; } 1876 | log QUICK { $$.log = $1; $$.quick = 1; } 1877 | QUICK log { $$.log = $2; $$.quick = 1; } 1878 ; 1879 1880 log : LOG { $$ = 1; } 1881 | LOGALL { $$ = 2; } 1882 ; 1883 1884 interface : /* empty */ { $$ = NULL; } 1885 | ON if_item_not { $$ = $2; } 1886 | ON '{' if_list '}' { $$ = $3; } 1887 ; 1888 1889 if_list : if_item_not { $$ = $1; } 1890 | if_list comma if_item_not { 1891 $1->tail->next = $3; 1892 $1->tail = $3; 1893 $$ = $1; 1894 } 1895 ; 1896 1897 if_item_not : not if_item { $$ = $2; $$->not = $1; } 1898 ; 1899 1900 if_item : STRING { 1901 struct node_host *n; 1902 1903 if ((n = ifa_exists($1, 1)) == NULL) { 1904 yyerror("unknown interface %s", $1); 1905 free($1); 1906 YYERROR; 1907 } 1908 $$ = calloc(1, sizeof(struct node_if)); 1909 if ($$ == NULL) 1910 err(1, "if_item: calloc"); 1911 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 1912 sizeof($$->ifname)) { 1913 free($1); 1914 free($$); 1915 yyerror("interface name too long"); 1916 YYERROR; 1917 } 1918 free($1); 1919 $$->ifa_flags = n->ifa_flags; 1920 $$->not = 0; 1921 $$->next = NULL; 1922 $$->tail = $$; 1923 } 1924 ; 1925 1926 af : /* empty */ { $$ = 0; } 1927 | INET { $$ = AF_INET; } 1928 | INET6 { $$ = AF_INET6; } 1929 ; 1930 1931 proto : /* empty */ { $$ = NULL; } 1932 | PROTO proto_item { $$ = $2; } 1933 | PROTO '{' proto_list '}' { $$ = $3; } 1934 ; 1935 1936 proto_list : proto_item { $$ = $1; } 1937 | proto_list comma proto_item { 1938 $1->tail->next = $3; 1939 $1->tail = $3; 1940 $$ = $1; 1941 } 1942 ; 1943 1944 proto_item : STRING { 1945 u_int8_t pr; 1946 u_long ulval; 1947 1948 if (atoul($1, &ulval) == 0) { 1949 if (ulval > 255) { 1950 yyerror("protocol outside range"); 1951 free($1); 1952 YYERROR; 1953 } 1954 pr = (u_int8_t)ulval; 1955 } else { 1956 struct protoent *p; 1957 1958 p = getprotobyname($1); 1959 if (p == NULL) { 1960 yyerror("unknown protocol %s", $1); 1961 free($1); 1962 YYERROR; 1963 } 1964 pr = p->p_proto; 1965 } 1966 free($1); 1967 if (pr == 0) { 1968 yyerror("proto 0 cannot be used"); 1969 YYERROR; 1970 } 1971 $$ = calloc(1, sizeof(struct node_proto)); 1972 if ($$ == NULL) 1973 err(1, "proto_item: calloc"); 1974 $$->proto = pr; 1975 $$->next = NULL; 1976 $$->tail = $$; 1977 } 1978 ; 1979 1980 fromto : ALL { 1981 $$.src.host = NULL; 1982 $$.src.port = NULL; 1983 $$.dst.host = NULL; 1984 $$.dst.port = NULL; 1985 $$.src_os = NULL; 1986 } 1987 | from os to { 1988 $$.src = $1; 1989 $$.src_os = $2; 1990 $$.dst = $3; 1991 } 1992 ; 1993 1994 os : /* empty */ { $$ = NULL; } 1995 | OS xos { $$ = $2; } 1996 | OS '{' os_list '}' { $$ = $3; } 1997 ; 1998 1999 xos : STRING { 2000 $$ = calloc(1, sizeof(struct node_os)); 2001 if ($$ == NULL) 2002 err(1, "os: calloc"); 2003 $$->os = $1; 2004 $$->tail = $$; 2005 } 2006 ; 2007 2008 os_list : xos { $$ = $1; } 2009 | os_list comma xos { 2010 $1->tail->next = $3; 2011 $1->tail = $3; 2012 $$ = $1; 2013 } 2014 ; 2015 2016 from : /* empty */ { 2017 $$.host = NULL; 2018 $$.port = NULL; 2019 } 2020 | FROM ipportspec { 2021 $$ = $2; 2022 } 2023 ; 2024 2025 to : /* empty */ { 2026 $$.host = NULL; 2027 $$.port = NULL; 2028 } 2029 | TO ipportspec { 2030 $$ = $2; 2031 } 2032 ; 2033 2034 ipportspec : ipspec { 2035 $$.host = $1; 2036 $$.port = NULL; 2037 } 2038 | ipspec PORT portspec { 2039 $$.host = $1; 2040 $$.port = $3; 2041 } 2042 | PORT portspec { 2043 $$.host = NULL; 2044 $$.port = $2; 2045 } 2046 ; 2047 2048 ipspec : ANY { $$ = NULL; } 2049 | xhost { $$ = $1; } 2050 | '{' host_list '}' { $$ = $2; } 2051 ; 2052 2053 host_list : xhost { $$ = $1; } 2054 | host_list comma xhost { 2055 if ($3 == NULL) 2056 $$ = $1; 2057 else if ($1 == NULL) 2058 $$ = $3; 2059 else { 2060 $1->tail->next = $3; 2061 $1->tail = $3->tail; 2062 $$ = $1; 2063 } 2064 } 2065 ; 2066 2067 xhost : not host { 2068 struct node_host *n; 2069 2070 for (n = $2; n != NULL; n = n->next) 2071 n->not = $1; 2072 $$ = $2; 2073 } 2074 | NOROUTE { 2075 $$ = calloc(1, sizeof(struct node_host)); 2076 if ($$ == NULL) 2077 err(1, "xhost: calloc"); 2078 $$->addr.type = PF_ADDR_NOROUTE; 2079 $$->next = NULL; 2080 $$->tail = $$; 2081 } 2082 ; 2083 2084 host : STRING { 2085 if (($$ = host($1)) == NULL) { 2086 /* error. "any" is handled elsewhere */ 2087 free($1); 2088 yyerror("could not parse host specification"); 2089 YYERROR; 2090 } 2091 free($1); 2092 2093 } 2094 | STRING '/' number { 2095 char *buf; 2096 2097 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2098 err(1, "host: asprintf"); 2099 free($1); 2100 if (($$ = host(buf)) == NULL) { 2101 /* error. "any" is handled elsewhere */ 2102 free(buf); 2103 yyerror("could not parse host specification"); 2104 YYERROR; 2105 } 2106 free(buf); 2107 } 2108 | dynaddr 2109 | dynaddr '/' number { 2110 struct node_host *n; 2111 2112 $$ = $1; 2113 for (n = $1; n != NULL; n = n->next) 2114 set_ipmask(n, $3); 2115 } 2116 | '<' STRING '>' { 2117 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2118 yyerror("table name '%s' too long", $2); 2119 free($2); 2120 YYERROR; 2121 } 2122 $$ = calloc(1, sizeof(struct node_host)); 2123 if ($$ == NULL) 2124 err(1, "host: calloc"); 2125 $$->addr.type = PF_ADDR_TABLE; 2126 if (strlcpy($$->addr.v.tblname, $2, 2127 sizeof($$->addr.v.tblname)) >= 2128 sizeof($$->addr.v.tblname)) 2129 errx(1, "host: strlcpy"); 2130 free($2); 2131 $$->next = NULL; 2132 $$->tail = $$; 2133 } 2134 ; 2135 2136 number : STRING { 2137 u_long ulval; 2138 2139 if (atoul($1, &ulval) == -1) { 2140 yyerror("%s is not a number", $1); 2141 free($1); 2142 YYERROR; 2143 } else 2144 $$ = ulval; 2145 free($1); 2146 } 2147 ; 2148 2149 dynaddr : '(' STRING ')' { 2150 int flags = 0; 2151 char *p, *op; 2152 2153 op = $2; 2154 while ((p = strrchr($2, ':')) != NULL) { 2155 if (!strcmp(p+1, "network")) 2156 flags |= PFI_AFLAG_NETWORK; 2157 else if (!strcmp(p+1, "broadcast")) 2158 flags |= PFI_AFLAG_BROADCAST; 2159 else if (!strcmp(p+1, "peer")) 2160 flags |= PFI_AFLAG_PEER; 2161 else if (!strcmp(p+1, "0")) 2162 flags |= PFI_AFLAG_NOALIAS; 2163 else { 2164 yyerror("interface %s has bad modifier", 2165 $2); 2166 free(op); 2167 YYERROR; 2168 } 2169 *p = '\0'; 2170 } 2171 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2172 free(op); 2173 yyerror("illegal combination of " 2174 "interface modifiers"); 2175 YYERROR; 2176 } 2177 if (ifa_exists($2, 1) == NULL && strcmp($2, "self")) { 2178 yyerror("interface %s does not exist", $2); 2179 free(op); 2180 YYERROR; 2181 } 2182 $$ = calloc(1, sizeof(struct node_host)); 2183 if ($$ == NULL) 2184 err(1, "address: calloc"); 2185 $$->af = 0; 2186 set_ipmask($$, 128); 2187 $$->addr.type = PF_ADDR_DYNIFTL; 2188 $$->addr.iflags = flags; 2189 if (strlcpy($$->addr.v.ifname, $2, 2190 sizeof($$->addr.v.ifname)) >= 2191 sizeof($$->addr.v.ifname)) { 2192 free(op); 2193 free($$); 2194 yyerror("interface name too long"); 2195 YYERROR; 2196 } 2197 free(op); 2198 $$->next = NULL; 2199 $$->tail = $$; 2200 } 2201 ; 2202 2203 portspec : port_item { $$ = $1; } 2204 | '{' port_list '}' { $$ = $2; } 2205 ; 2206 2207 port_list : port_item { $$ = $1; } 2208 | port_list comma port_item { 2209 $1->tail->next = $3; 2210 $1->tail = $3; 2211 $$ = $1; 2212 } 2213 ; 2214 2215 port_item : port { 2216 $$ = calloc(1, sizeof(struct node_port)); 2217 if ($$ == NULL) 2218 err(1, "port_item: calloc"); 2219 $$->port[0] = $1.a; 2220 $$->port[1] = $1.b; 2221 if ($1.t) 2222 $$->op = PF_OP_RRG; 2223 else 2224 $$->op = PF_OP_EQ; 2225 $$->next = NULL; 2226 $$->tail = $$; 2227 } 2228 | unaryop port { 2229 if ($2.t) { 2230 yyerror("':' cannot be used with an other " 2231 "port operator"); 2232 YYERROR; 2233 } 2234 $$ = calloc(1, sizeof(struct node_port)); 2235 if ($$ == NULL) 2236 err(1, "port_item: calloc"); 2237 $$->port[0] = $2.a; 2238 $$->port[1] = $2.b; 2239 $$->op = $1; 2240 $$->next = NULL; 2241 $$->tail = $$; 2242 } 2243 | port PORTBINARY port { 2244 if ($1.t || $3.t) { 2245 yyerror("':' cannot be used with an other " 2246 "port operator"); 2247 YYERROR; 2248 } 2249 $$ = calloc(1, sizeof(struct node_port)); 2250 if ($$ == NULL) 2251 err(1, "port_item: calloc"); 2252 $$->port[0] = $1.a; 2253 $$->port[1] = $3.a; 2254 $$->op = $2; 2255 $$->next = NULL; 2256 $$->tail = $$; 2257 } 2258 ; 2259 2260 port : STRING { 2261 char *p = strchr($1, ':'); 2262 struct servent *s = NULL; 2263 u_long ulval; 2264 2265 if (p == NULL) { 2266 if (atoul($1, &ulval) == 0) { 2267 if (ulval > 65535) { 2268 free($1); 2269 yyerror("illegal port value %d", 2270 ulval); 2271 YYERROR; 2272 } 2273 $$.a = htons(ulval); 2274 } else { 2275 s = getservbyname($1, "tcp"); 2276 if (s == NULL) 2277 s = getservbyname($1, "udp"); 2278 if (s == NULL) { 2279 yyerror("unknown port %s", $1); 2280 free($1); 2281 YYERROR; 2282 } 2283 $$.a = s->s_port; 2284 } 2285 $$.b = 0; 2286 $$.t = 0; 2287 } else { 2288 int port[2]; 2289 2290 *p++ = 0; 2291 if ((port[0] = getservice($1)) == -1 || 2292 (port[1] = getservice(p)) == -1) { 2293 free($1); 2294 YYERROR; 2295 } 2296 $$.a = port[0]; 2297 $$.b = port[1]; 2298 $$.t = PF_OP_RRG; 2299 } 2300 free($1); 2301 } 2302 ; 2303 2304 uids : uid_item { $$ = $1; } 2305 | '{' uid_list '}' { $$ = $2; } 2306 ; 2307 2308 uid_list : uid_item { $$ = $1; } 2309 | uid_list comma uid_item { 2310 $1->tail->next = $3; 2311 $1->tail = $3; 2312 $$ = $1; 2313 } 2314 ; 2315 2316 uid_item : uid { 2317 $$ = calloc(1, sizeof(struct node_uid)); 2318 if ($$ == NULL) 2319 err(1, "uid_item: calloc"); 2320 $$->uid[0] = $1; 2321 $$->uid[1] = $1; 2322 $$->op = PF_OP_EQ; 2323 $$->next = NULL; 2324 $$->tail = $$; 2325 } 2326 | unaryop uid { 2327 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2328 yyerror("user unknown requires operator = or " 2329 "!="); 2330 YYERROR; 2331 } 2332 $$ = calloc(1, sizeof(struct node_uid)); 2333 if ($$ == NULL) 2334 err(1, "uid_item: calloc"); 2335 $$->uid[0] = $2; 2336 $$->uid[1] = $2; 2337 $$->op = $1; 2338 $$->next = NULL; 2339 $$->tail = $$; 2340 } 2341 | uid PORTBINARY uid { 2342 if ($1 == UID_MAX || $3 == UID_MAX) { 2343 yyerror("user unknown requires operator = or " 2344 "!="); 2345 YYERROR; 2346 } 2347 $$ = calloc(1, sizeof(struct node_uid)); 2348 if ($$ == NULL) 2349 err(1, "uid_item: calloc"); 2350 $$->uid[0] = $1; 2351 $$->uid[1] = $3; 2352 $$->op = $2; 2353 $$->next = NULL; 2354 $$->tail = $$; 2355 } 2356 ; 2357 2358 uid : STRING { 2359 u_long ulval; 2360 2361 if (atoul($1, &ulval) == -1) { 2362 if (!strcmp($1, "unknown")) 2363 $$ = UID_MAX; 2364 else { 2365 struct passwd *pw; 2366 2367 if ((pw = getpwnam($1)) == NULL) { 2368 yyerror("unknown user %s", $1); 2369 free($1); 2370 YYERROR; 2371 } 2372 $$ = pw->pw_uid; 2373 } 2374 } else { 2375 if (ulval >= UID_MAX) { 2376 free($1); 2377 yyerror("illegal uid value %lu", ulval); 2378 YYERROR; 2379 } 2380 $$ = ulval; 2381 } 2382 free($1); 2383 } 2384 ; 2385 2386 gids : gid_item { $$ = $1; } 2387 | '{' gid_list '}' { $$ = $2; } 2388 ; 2389 2390 gid_list : gid_item { $$ = $1; } 2391 | gid_list comma gid_item { 2392 $1->tail->next = $3; 2393 $1->tail = $3; 2394 $$ = $1; 2395 } 2396 ; 2397 2398 gid_item : gid { 2399 $$ = calloc(1, sizeof(struct node_gid)); 2400 if ($$ == NULL) 2401 err(1, "gid_item: calloc"); 2402 $$->gid[0] = $1; 2403 $$->gid[1] = $1; 2404 $$->op = PF_OP_EQ; 2405 $$->next = NULL; 2406 $$->tail = $$; 2407 } 2408 | unaryop gid { 2409 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2410 yyerror("group unknown requires operator = or " 2411 "!="); 2412 YYERROR; 2413 } 2414 $$ = calloc(1, sizeof(struct node_gid)); 2415 if ($$ == NULL) 2416 err(1, "gid_item: calloc"); 2417 $$->gid[0] = $2; 2418 $$->gid[1] = $2; 2419 $$->op = $1; 2420 $$->next = NULL; 2421 $$->tail = $$; 2422 } 2423 | gid PORTBINARY gid { 2424 if ($1 == GID_MAX || $3 == GID_MAX) { 2425 yyerror("group unknown requires operator = or " 2426 "!="); 2427 YYERROR; 2428 } 2429 $$ = calloc(1, sizeof(struct node_gid)); 2430 if ($$ == NULL) 2431 err(1, "gid_item: calloc"); 2432 $$->gid[0] = $1; 2433 $$->gid[1] = $3; 2434 $$->op = $2; 2435 $$->next = NULL; 2436 $$->tail = $$; 2437 } 2438 ; 2439 2440 gid : STRING { 2441 u_long ulval; 2442 2443 if (atoul($1, &ulval) == -1) { 2444 if (!strcmp($1, "unknown")) 2445 $$ = GID_MAX; 2446 else { 2447 struct group *grp; 2448 2449 if ((grp = getgrnam($1)) == NULL) { 2450 yyerror("unknown group %s", $1); 2451 free($1); 2452 YYERROR; 2453 } 2454 $$ = grp->gr_gid; 2455 } 2456 } else { 2457 if (ulval >= GID_MAX) { 2458 yyerror("illegal gid value %lu", ulval); 2459 free($1); 2460 YYERROR; 2461 } 2462 $$ = ulval; 2463 } 2464 free($1); 2465 } 2466 ; 2467 2468 flag : STRING { 2469 int f; 2470 2471 if ((f = parse_flags($1)) < 0) { 2472 yyerror("bad flags %s", $1); 2473 free($1); 2474 YYERROR; 2475 } 2476 free($1); 2477 $$.b1 = f; 2478 } 2479 ; 2480 2481 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2482 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2483 ; 2484 2485 icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2486 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2487 | ICMP6TYPE icmp6_item { $$ = $2; } 2488 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2489 ; 2490 2491 icmp_list : icmp_item { $$ = $1; } 2492 | icmp_list comma icmp_item { 2493 $1->tail->next = $3; 2494 $1->tail = $3; 2495 $$ = $1; 2496 } 2497 ; 2498 2499 icmp6_list : icmp6_item { $$ = $1; } 2500 | icmp6_list comma icmp6_item { 2501 $1->tail->next = $3; 2502 $1->tail = $3; 2503 $$ = $1; 2504 } 2505 ; 2506 2507 icmp_item : icmptype { 2508 $$ = calloc(1, sizeof(struct node_icmp)); 2509 if ($$ == NULL) 2510 err(1, "icmp_item: calloc"); 2511 $$->type = $1; 2512 $$->code = 0; 2513 $$->proto = IPPROTO_ICMP; 2514 $$->next = NULL; 2515 $$->tail = $$; 2516 } 2517 | icmptype CODE STRING { 2518 const struct icmpcodeent *p; 2519 u_long ulval; 2520 2521 if (atoul($3, &ulval) == 0) { 2522 if (ulval > 255) { 2523 free($3); 2524 yyerror("illegal icmp-code %d", ulval); 2525 YYERROR; 2526 } 2527 } else { 2528 if ((p = geticmpcodebyname($1-1, $3, 2529 AF_INET)) == NULL) { 2530 yyerror("unknown icmp-code %s", $3); 2531 free($3); 2532 YYERROR; 2533 } 2534 ulval = p->code; 2535 } 2536 free($3); 2537 $$ = calloc(1, sizeof(struct node_icmp)); 2538 if ($$ == NULL) 2539 err(1, "icmp_item: calloc"); 2540 $$->type = $1; 2541 $$->code = ulval + 1; 2542 $$->proto = IPPROTO_ICMP; 2543 $$->next = NULL; 2544 $$->tail = $$; 2545 } 2546 ; 2547 2548 icmp6_item : icmp6type { 2549 $$ = calloc(1, sizeof(struct node_icmp)); 2550 if ($$ == NULL) 2551 err(1, "icmp_item: calloc"); 2552 $$->type = $1; 2553 $$->code = 0; 2554 $$->proto = IPPROTO_ICMPV6; 2555 $$->next = NULL; 2556 $$->tail = $$; 2557 } 2558 | icmp6type CODE STRING { 2559 const struct icmpcodeent *p; 2560 u_long ulval; 2561 2562 if (atoul($3, &ulval) == 0) { 2563 if (ulval > 255) { 2564 yyerror("illegal icmp6-code %ld", 2565 ulval); 2566 free($3); 2567 YYERROR; 2568 } 2569 } else { 2570 if ((p = geticmpcodebyname($1-1, $3, 2571 AF_INET6)) == NULL) { 2572 yyerror("unknown icmp6-code %s", $3); 2573 free($3); 2574 YYERROR; 2575 } 2576 ulval = p->code; 2577 } 2578 free($3); 2579 $$ = calloc(1, sizeof(struct node_icmp)); 2580 if ($$ == NULL) 2581 err(1, "icmp_item: calloc"); 2582 $$->type = $1; 2583 $$->code = ulval + 1; 2584 $$->proto = IPPROTO_ICMPV6; 2585 $$->next = NULL; 2586 $$->tail = $$; 2587 } 2588 ; 2589 2590 icmptype : STRING { 2591 const struct icmptypeent *p; 2592 u_long ulval; 2593 2594 if (atoul($1, &ulval) == 0) { 2595 if (ulval > 255) { 2596 yyerror("illegal icmp-type %d", ulval); 2597 free($1); 2598 YYERROR; 2599 } 2600 $$ = ulval + 1; 2601 } else { 2602 if ((p = geticmptypebyname($1, AF_INET)) == 2603 NULL) { 2604 yyerror("unknown icmp-type %s", $1); 2605 free($1); 2606 YYERROR; 2607 } 2608 $$ = p->type + 1; 2609 } 2610 free($1); 2611 } 2612 ; 2613 2614 icmp6type : STRING { 2615 const struct icmptypeent *p; 2616 u_long ulval; 2617 2618 if (atoul($1, &ulval) == 0) { 2619 if (ulval > 255) { 2620 yyerror("illegal icmp6-type %d", ulval); 2621 free($1); 2622 YYERROR; 2623 } 2624 $$ = ulval + 1; 2625 } else { 2626 if ((p = geticmptypebyname($1, AF_INET6)) == 2627 NULL) { 2628 yyerror("unknown icmp6-type %s", $1); 2629 free($1); 2630 YYERROR; 2631 } 2632 $$ = p->type + 1; 2633 } 2634 free($1); 2635 } 2636 ; 2637 2638 tos : TOS STRING { 2639 if (!strcmp($2, "lowdelay")) 2640 $$ = IPTOS_LOWDELAY; 2641 else if (!strcmp($2, "throughput")) 2642 $$ = IPTOS_THROUGHPUT; 2643 else if (!strcmp($2, "reliability")) 2644 $$ = IPTOS_RELIABILITY; 2645 else if ($2[0] == '0' && $2[1] == 'x') 2646 $$ = strtoul($2, NULL, 16); 2647 else 2648 $$ = strtoul($2, NULL, 10); 2649 if (!$$ || $$ > 255) { 2650 yyerror("illegal tos value %s", $2); 2651 free($2); 2652 YYERROR; 2653 } 2654 free($2); 2655 } 2656 ; 2657 2658 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 2659 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 2660 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 2661 ; 2662 2663 statelock : IFBOUND { 2664 $$ = PFRULE_IFBOUND; 2665 } 2666 | GRBOUND { 2667 $$ = PFRULE_GRBOUND; 2668 } 2669 | FLOATING { 2670 $$ = 0; 2671 } 2672 ; 2673 2674 keep : KEEP STATE state_opt_spec { 2675 $$.action = PF_STATE_NORMAL; 2676 $$.options = $3; 2677 } 2678 | MODULATE STATE state_opt_spec { 2679 $$.action = PF_STATE_MODULATE; 2680 $$.options = $3; 2681 } 2682 | SYNPROXY STATE state_opt_spec { 2683 $$.action = PF_STATE_SYNPROXY; 2684 $$.options = $3; 2685 } 2686 ; 2687 2688 state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2689 | /* empty */ { $$ = NULL; } 2690 ; 2691 2692 state_opt_list : state_opt_item { $$ = $1; } 2693 | state_opt_list comma state_opt_item { 2694 $1->tail->next = $3; 2695 $1->tail = $3; 2696 $$ = $1; 2697 } 2698 ; 2699 2700 state_opt_item : MAXIMUM number { 2701 $$ = calloc(1, sizeof(struct node_state_opt)); 2702 if ($$ == NULL) 2703 err(1, "state_opt_item: calloc"); 2704 $$->type = PF_STATE_OPT_MAX; 2705 $$->data.max_states = $2; 2706 $$->next = NULL; 2707 $$->tail = $$; 2708 } 2709 | NOSYNC { 2710 $$ = calloc(1, sizeof(struct node_state_opt)); 2711 if ($$ == NULL) 2712 err(1, "state_opt_item: calloc"); 2713 $$->type = PF_STATE_OPT_NOSYNC; 2714 $$->next = NULL; 2715 $$->tail = $$; 2716 } 2717 | MAXSRCSTATES number { 2718 $$ = calloc(1, sizeof(struct node_state_opt)); 2719 if ($$ == NULL) 2720 err(1, "state_opt_item: calloc"); 2721 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 2722 $$->data.max_src_states = $2; 2723 $$->next = NULL; 2724 $$->tail = $$; 2725 } 2726 | MAXSRCNODES number { 2727 $$ = calloc(1, sizeof(struct node_state_opt)); 2728 if ($$ == NULL) 2729 err(1, "state_opt_item: calloc"); 2730 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 2731 $$->data.max_src_nodes = $2; 2732 $$->next = NULL; 2733 $$->tail = $$; 2734 } 2735 | sourcetrack { 2736 $$ = calloc(1, sizeof(struct node_state_opt)); 2737 if ($$ == NULL) 2738 err(1, "state_opt_item: calloc"); 2739 $$->type = PF_STATE_OPT_SRCTRACK; 2740 $$->data.src_track = $1; 2741 $$->next = NULL; 2742 $$->tail = $$; 2743 } 2744 | statelock { 2745 $$ = calloc(1, sizeof(struct node_state_opt)); 2746 if ($$ == NULL) 2747 err(1, "state_opt_item: calloc"); 2748 $$->type = PF_STATE_OPT_STATELOCK; 2749 $$->data.statelock = $1; 2750 $$->next = NULL; 2751 $$->tail = $$; 2752 } 2753 | STRING number { 2754 int i; 2755 2756 for (i = 0; pf_timeouts[i].name && 2757 strcmp(pf_timeouts[i].name, $1); ++i) 2758 ; /* nothing */ 2759 if (!pf_timeouts[i].name) { 2760 yyerror("illegal timeout name %s", $1); 2761 free($1); 2762 YYERROR; 2763 } 2764 if (strchr(pf_timeouts[i].name, '.') == NULL) { 2765 yyerror("illegal state timeout %s", $1); 2766 free($1); 2767 YYERROR; 2768 } 2769 free($1); 2770 $$ = calloc(1, sizeof(struct node_state_opt)); 2771 if ($$ == NULL) 2772 err(1, "state_opt_item: calloc"); 2773 $$->type = PF_STATE_OPT_TIMEOUT; 2774 $$->data.timeout.number = pf_timeouts[i].timeout; 2775 $$->data.timeout.seconds = $2; 2776 $$->next = NULL; 2777 $$->tail = $$; 2778 } 2779 ; 2780 2781 label : LABEL STRING { 2782 $$ = $2; 2783 } 2784 ; 2785 2786 qname : QUEUE STRING { 2787 $$.qname = $2; 2788 } 2789 | QUEUE '(' STRING ')' { 2790 $$.qname = $3; 2791 } 2792 | QUEUE '(' STRING comma STRING ')' { 2793 $$.qname = $3; 2794 $$.pqname = $5; 2795 } 2796 ; 2797 2798 no : /* empty */ { $$ = 0; } 2799 | NO { $$ = 1; } 2800 ; 2801 2802 rport : STRING { 2803 char *p = strchr($1, ':'); 2804 2805 if (p == NULL) { 2806 if (($$.a = getservice($1)) == -1) { 2807 free($1); 2808 YYERROR; 2809 } 2810 $$.b = $$.t = 0; 2811 } else if (!strcmp(p+1, "*")) { 2812 *p = 0; 2813 if (($$.a = getservice($1)) == -1) { 2814 free($1); 2815 YYERROR; 2816 } 2817 $$.b = 0; 2818 $$.t = 1; 2819 } else { 2820 *p++ = 0; 2821 if (($$.a = getservice($1)) == -1 || 2822 ($$.b = getservice(p)) == -1) { 2823 free($1); 2824 YYERROR; 2825 } 2826 if ($$.a == $$.b) 2827 $$.b = 0; 2828 $$.t = 0; 2829 } 2830 free($1); 2831 } 2832 ; 2833 2834 redirspec : host { $$ = $1; } 2835 | '{' redir_host_list '}' { $$ = $2; } 2836 ; 2837 2838 redir_host_list : host { $$ = $1; } 2839 | redir_host_list comma host { 2840 $1->tail->next = $3; 2841 $1->tail = $3->tail; 2842 $$ = $1; 2843 } 2844 ; 2845 2846 redirpool : /* empty */ { $$ = NULL; } 2847 | ARROW redirspec { 2848 $$ = calloc(1, sizeof(struct redirection)); 2849 if ($$ == NULL) 2850 err(1, "redirection: calloc"); 2851 $$->host = $2; 2852 $$->rport.a = $$->rport.b = $$->rport.t = 0; 2853 } 2854 | ARROW redirspec PORT rport { 2855 $$ = calloc(1, sizeof(struct redirection)); 2856 if ($$ == NULL) 2857 err(1, "redirection: calloc"); 2858 $$->host = $2; 2859 $$->rport = $4; 2860 } 2861 ; 2862 2863 hashkey : /* empty */ 2864 { 2865 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2866 if ($$ == NULL) 2867 err(1, "hashkey: calloc"); 2868 $$->key32[0] = arc4random(); 2869 $$->key32[1] = arc4random(); 2870 $$->key32[2] = arc4random(); 2871 $$->key32[3] = arc4random(); 2872 } 2873 | string 2874 { 2875 if (!strncmp($1, "0x", 2)) { 2876 if (strlen($1) != 34) { 2877 free($1); 2878 yyerror("hex key must be 128 bits " 2879 "(32 hex digits) long"); 2880 YYERROR; 2881 } 2882 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2883 if ($$ == NULL) 2884 err(1, "hashkey: calloc"); 2885 2886 if (sscanf($1, "0x%8x%8x%8x%8x", 2887 &$$->key32[0], &$$->key32[1], 2888 &$$->key32[2], &$$->key32[3]) != 4) { 2889 free($$); 2890 free($1); 2891 yyerror("invalid hex key"); 2892 YYERROR; 2893 } 2894 } else { 2895 MD5_CTX context; 2896 2897 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2898 if ($$ == NULL) 2899 err(1, "hashkey: calloc"); 2900 MD5Init(&context); 2901 MD5Update(&context, (unsigned char *)$1, 2902 strlen($1)); 2903 MD5Final((unsigned char *)$$, &context); 2904 HTONL($$->key32[0]); 2905 HTONL($$->key32[1]); 2906 HTONL($$->key32[2]); 2907 HTONL($$->key32[3]); 2908 } 2909 free($1); 2910 } 2911 ; 2912 2913 pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 2914 pool_opts_l 2915 { $$ = pool_opts; } 2916 | /* empty */ { 2917 bzero(&pool_opts, sizeof pool_opts); 2918 $$ = pool_opts; 2919 } 2920 ; 2921 2922 pool_opts_l : pool_opts_l pool_opt 2923 | pool_opt 2924 ; 2925 2926 pool_opt : BITMASK { 2927 if (pool_opts.type) { 2928 yyerror("pool type cannot be redefined"); 2929 YYERROR; 2930 } 2931 pool_opts.type = PF_POOL_BITMASK; 2932 } 2933 | RANDOM { 2934 if (pool_opts.type) { 2935 yyerror("pool type cannot be redefined"); 2936 YYERROR; 2937 } 2938 pool_opts.type = PF_POOL_RANDOM; 2939 } 2940 | SOURCEHASH hashkey { 2941 if (pool_opts.type) { 2942 yyerror("pool type cannot be redefined"); 2943 YYERROR; 2944 } 2945 pool_opts.type = PF_POOL_SRCHASH; 2946 pool_opts.key = $2; 2947 } 2948 | ROUNDROBIN { 2949 if (pool_opts.type) { 2950 yyerror("pool type cannot be redefined"); 2951 YYERROR; 2952 } 2953 pool_opts.type = PF_POOL_ROUNDROBIN; 2954 } 2955 | STATICPORT { 2956 if (pool_opts.staticport) { 2957 yyerror("static-port cannot be redefined"); 2958 YYERROR; 2959 } 2960 pool_opts.staticport = 1; 2961 } 2962 | STICKYADDRESS { 2963 if (filter_opts.marker & POM_STICKYADDRESS) { 2964 yyerror("sticky-address cannot be redefined"); 2965 YYERROR; 2966 } 2967 pool_opts.marker |= POM_STICKYADDRESS; 2968 pool_opts.opts |= PF_POOL_STICKYADDR; 2969 } 2970 ; 2971 2972 redirection : /* empty */ { $$ = NULL; } 2973 | ARROW host { 2974 $$ = calloc(1, sizeof(struct redirection)); 2975 if ($$ == NULL) 2976 err(1, "redirection: calloc"); 2977 $$->host = $2; 2978 $$->rport.a = $$->rport.b = $$->rport.t = 0; 2979 } 2980 | ARROW host PORT rport { 2981 $$ = calloc(1, sizeof(struct redirection)); 2982 if ($$ == NULL) 2983 err(1, "redirection: calloc"); 2984 $$->host = $2; 2985 $$->rport = $4; 2986 } 2987 ; 2988 2989 natpass : /* empty */ { $$ = 0; } 2990 | PASS { $$ = 1; } 2991 ; 2992 2993 nataction : no NAT natpass { 2994 $$.b2 = $$.w = 0; 2995 if ($1) 2996 $$.b1 = PF_NONAT; 2997 else 2998 $$.b1 = PF_NAT; 2999 $$.b2 = $3; 3000 } 3001 | no RDR natpass { 3002 $$.b2 = $$.w = 0; 3003 if ($1) 3004 $$.b1 = PF_NORDR; 3005 else 3006 $$.b1 = PF_RDR; 3007 $$.b2 = $3; 3008 } 3009 ; 3010 3011 natrule : nataction interface af proto fromto tag redirpool pool_opts 3012 { 3013 struct pf_rule r; 3014 3015 if (check_rulestate(PFCTL_STATE_NAT)) 3016 YYERROR; 3017 3018 memset(&r, 0, sizeof(r)); 3019 3020 r.action = $1.b1; 3021 r.natpass = $1.b2; 3022 r.af = $3; 3023 3024 if (!r.af) { 3025 if ($5.src.host && $5.src.host->af && 3026 !$5.src.host->ifindex) 3027 r.af = $5.src.host->af; 3028 else if ($5.dst.host && $5.dst.host->af && 3029 !$5.dst.host->ifindex) 3030 r.af = $5.dst.host->af; 3031 } 3032 3033 if ($6 != NULL) 3034 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3035 PF_TAG_NAME_SIZE) { 3036 yyerror("tag too long, max %u chars", 3037 PF_TAG_NAME_SIZE - 1); 3038 YYERROR; 3039 } 3040 3041 if (r.action == PF_NONAT || r.action == PF_NORDR) { 3042 if ($7 != NULL) { 3043 yyerror("translation rule with 'no' " 3044 "does not need '->'"); 3045 YYERROR; 3046 } 3047 } else { 3048 if ($7 == NULL || $7->host == NULL) { 3049 yyerror("translation rule requires '-> " 3050 "address'"); 3051 YYERROR; 3052 } 3053 if (!r.af && ! $7->host->ifindex) 3054 r.af = $7->host->af; 3055 3056 remove_invalid_hosts(&$7->host, &r.af); 3057 if (invalid_redirect($7->host, r.af)) 3058 YYERROR; 3059 if (check_netmask($7->host, r.af)) 3060 YYERROR; 3061 3062 r.rpool.proxy_port[0] = ntohs($7->rport.a); 3063 3064 switch (r.action) { 3065 case PF_RDR: 3066 if (!$7->rport.b && $7->rport.t && 3067 $5.dst.port != NULL) { 3068 r.rpool.proxy_port[1] = 3069 ntohs($7->rport.a) + 3070 (ntohs( 3071 $5.dst.port->port[1]) - 3072 ntohs( 3073 $5.dst.port->port[0])); 3074 } else 3075 r.rpool.proxy_port[1] = 3076 ntohs($7->rport.b); 3077 break; 3078 case PF_NAT: 3079 r.rpool.proxy_port[1] = 3080 ntohs($7->rport.b); 3081 if (!r.rpool.proxy_port[0] && 3082 !r.rpool.proxy_port[1]) { 3083 r.rpool.proxy_port[0] = 3084 PF_NAT_PROXY_PORT_LOW; 3085 r.rpool.proxy_port[1] = 3086 PF_NAT_PROXY_PORT_HIGH; 3087 } else if (!r.rpool.proxy_port[1]) 3088 r.rpool.proxy_port[1] = 3089 r.rpool.proxy_port[0]; 3090 break; 3091 default: 3092 break; 3093 } 3094 3095 r.rpool.opts = $8.type; 3096 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3097 PF_POOL_NONE && ($7->host->next != NULL || 3098 $7->host->addr.type == PF_ADDR_TABLE || 3099 DYNIF_MULTIADDR($7->host->addr))) 3100 r.rpool.opts = PF_POOL_ROUNDROBIN; 3101 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3102 PF_POOL_ROUNDROBIN && 3103 disallow_table($7->host, "tables are only " 3104 "supported in round-robin redirection " 3105 "pools")) 3106 YYERROR; 3107 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3108 PF_POOL_ROUNDROBIN && 3109 disallow_alias($7->host, "interface (%s) " 3110 "is only supported in round-robin " 3111 "redirection pools")) 3112 YYERROR; 3113 if ($7->host->next != NULL) { 3114 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3115 PF_POOL_ROUNDROBIN) { 3116 yyerror("only round-robin " 3117 "valid for multiple " 3118 "redirection addresses"); 3119 YYERROR; 3120 } 3121 } 3122 } 3123 3124 if ($8.key != NULL) 3125 memcpy(&r.rpool.key, $8.key, 3126 sizeof(struct pf_poolhashkey)); 3127 3128 if ($8.opts) 3129 r.rpool.opts |= $8.opts; 3130 3131 if ($8.staticport) { 3132 if (r.action != PF_NAT) { 3133 yyerror("the 'static-port' option is " 3134 "only valid with nat rules"); 3135 YYERROR; 3136 } 3137 if (r.rpool.proxy_port[0] != 3138 PF_NAT_PROXY_PORT_LOW && 3139 r.rpool.proxy_port[1] != 3140 PF_NAT_PROXY_PORT_HIGH) { 3141 yyerror("the 'static-port' option can't" 3142 " be used when specifying a port" 3143 " range"); 3144 YYERROR; 3145 } 3146 r.rpool.proxy_port[0] = 0; 3147 r.rpool.proxy_port[1] = 0; 3148 } 3149 3150 expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4, 3151 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3152 $5.dst.port, 0, 0, 0); 3153 free($7); 3154 } 3155 ; 3156 3157 binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag 3158 redirection 3159 { 3160 struct pf_rule binat; 3161 struct pf_pooladdr *pa; 3162 3163 if (check_rulestate(PFCTL_STATE_NAT)) 3164 YYERROR; 3165 3166 memset(&binat, 0, sizeof(binat)); 3167 3168 if ($1) 3169 binat.action = PF_NOBINAT; 3170 else 3171 binat.action = PF_BINAT; 3172 binat.natpass = $3; 3173 binat.af = $5; 3174 if (!binat.af && $8 != NULL && $8->af) 3175 binat.af = $8->af; 3176 if (!binat.af && $10 != NULL && $10->af) 3177 binat.af = $10->af; 3178 if (!binat.af && $12 != NULL && $12->host) 3179 binat.af = $12->host->af; 3180 if (!binat.af) { 3181 yyerror("address family (inet/inet6) " 3182 "undefined"); 3183 YYERROR; 3184 } 3185 3186 if ($4 != NULL) { 3187 memcpy(binat.ifname, $4->ifname, 3188 sizeof(binat.ifname)); 3189 binat.ifnot = $4->not; 3190 free($4); 3191 } 3192 if ($11 != NULL) 3193 if (strlcpy(binat.tagname, $11, 3194 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3195 yyerror("tag too long, max %u chars", 3196 PF_TAG_NAME_SIZE - 1); 3197 YYERROR; 3198 } 3199 3200 if ($6 != NULL) { 3201 binat.proto = $6->proto; 3202 free($6); 3203 } 3204 3205 if ($8 != NULL && disallow_table($8, "invalid use of " 3206 "table <%s> as the source address of a binat rule")) 3207 YYERROR; 3208 if ($8 != NULL && disallow_alias($8, "invalid use of " 3209 "interface (%s) as the source address of a binat " 3210 "rule")) 3211 YYERROR; 3212 if ($12 != NULL && $12->host != NULL && disallow_table( 3213 $12->host, "invalid use of table <%s> as the " 3214 "redirect address of a binat rule")) 3215 YYERROR; 3216 if ($12 != NULL && $12->host != NULL && disallow_alias( 3217 $12->host, "invalid use of interface (%s) as the " 3218 "redirect address of a binat rule")) 3219 YYERROR; 3220 3221 if ($8 != NULL) { 3222 if ($8->next) { 3223 yyerror("multiple binat ip addresses"); 3224 YYERROR; 3225 } 3226 if ($8->addr.type == PF_ADDR_DYNIFTL) 3227 $8->af = binat.af; 3228 if ($8->af != binat.af) { 3229 yyerror("binat ip versions must match"); 3230 YYERROR; 3231 } 3232 if (check_netmask($8, binat.af)) 3233 YYERROR; 3234 memcpy(&binat.src.addr, &$8->addr, 3235 sizeof(binat.src.addr)); 3236 free($8); 3237 } 3238 if ($10 != NULL) { 3239 if ($10->next) { 3240 yyerror("multiple binat ip addresses"); 3241 YYERROR; 3242 } 3243 if ($10->af != binat.af && $10->af) { 3244 yyerror("binat ip versions must match"); 3245 YYERROR; 3246 } 3247 if (check_netmask($10, binat.af)) 3248 YYERROR; 3249 memcpy(&binat.dst.addr, &$10->addr, 3250 sizeof(binat.dst.addr)); 3251 binat.dst.not = $10->not; 3252 free($10); 3253 } 3254 3255 if (binat.action == PF_NOBINAT) { 3256 if ($12 != NULL) { 3257 yyerror("'no binat' rule does not need" 3258 " '->'"); 3259 YYERROR; 3260 } 3261 } else { 3262 if ($12 == NULL || $12->host == NULL) { 3263 yyerror("'binat' rule requires" 3264 " '-> address'"); 3265 YYERROR; 3266 } 3267 3268 remove_invalid_hosts(&$12->host, &binat.af); 3269 if (invalid_redirect($12->host, binat.af)) 3270 YYERROR; 3271 if ($12->host->next != NULL) { 3272 yyerror("binat rule must redirect to " 3273 "a single address"); 3274 YYERROR; 3275 } 3276 if (check_netmask($12->host, binat.af)) 3277 YYERROR; 3278 3279 if (!PF_AZERO(&binat.src.addr.v.a.mask, 3280 binat.af) && 3281 !PF_AEQ(&binat.src.addr.v.a.mask, 3282 &$12->host->addr.v.a.mask, binat.af)) { 3283 yyerror("'binat' source mask and " 3284 "redirect mask must be the same"); 3285 YYERROR; 3286 } 3287 3288 TAILQ_INIT(&binat.rpool.list); 3289 pa = calloc(1, sizeof(struct pf_pooladdr)); 3290 if (pa == NULL) 3291 err(1, "binat: calloc"); 3292 pa->addr = $12->host->addr; 3293 pa->ifname[0] = 0; 3294 TAILQ_INSERT_TAIL(&binat.rpool.list, 3295 pa, entries); 3296 3297 free($12); 3298 } 3299 3300 pfctl_add_rule(pf, &binat); 3301 } 3302 ; 3303 3304 tag : /* empty */ { $$ = NULL; } 3305 | TAG STRING { $$ = $2; } 3306 ; 3307 3308 route_host : STRING { 3309 $$ = calloc(1, sizeof(struct node_host)); 3310 if ($$ == NULL) 3311 err(1, "route_host: calloc"); 3312 $$->ifname = $1; 3313 if (ifa_exists($$->ifname, 0) == NULL) { 3314 yyerror("routeto: unknown interface %s", 3315 $$->ifname); 3316 free($1); 3317 free($$); 3318 YYERROR; 3319 } 3320 set_ipmask($$, 128); 3321 $$->next = NULL; 3322 $$->tail = $$; 3323 } 3324 | '(' STRING host ')' { 3325 $$ = $3; 3326 $$->ifname = $2; 3327 if (ifa_exists($$->ifname, 0) == NULL) { 3328 yyerror("routeto: unknown interface %s", 3329 $$->ifname); 3330 YYERROR; 3331 } 3332 } 3333 ; 3334 3335 route_host_list : route_host { $$ = $1; } 3336 | route_host_list comma route_host { 3337 if ($1->af == 0) 3338 $1->af = $3->af; 3339 if ($1->af != $3->af) { 3340 yyerror("all pool addresses must be in the " 3341 "same address family"); 3342 YYERROR; 3343 } 3344 $1->tail->next = $3; 3345 $1->tail = $3->tail; 3346 $$ = $1; 3347 } 3348 ; 3349 3350 routespec : route_host { $$ = $1; } 3351 | '{' route_host_list '}' { $$ = $2; } 3352 ; 3353 3354 route : /* empty */ { 3355 $$.host = NULL; 3356 $$.rt = 0; 3357 $$.pool_opts = 0; 3358 } 3359 | FASTROUTE { 3360 $$.host = NULL; 3361 $$.rt = PF_FASTROUTE; 3362 $$.pool_opts = 0; 3363 } 3364 | ROUTETO routespec pool_opts { 3365 $$.host = $2; 3366 $$.rt = PF_ROUTETO; 3367 $$.pool_opts = $3.type | $3.opts; 3368 if ($3.key != NULL) 3369 $$.key = $3.key; 3370 } 3371 | REPLYTO routespec pool_opts { 3372 $$.host = $2; 3373 $$.rt = PF_REPLYTO; 3374 $$.pool_opts = $3.type | $3.opts; 3375 if ($3.key != NULL) 3376 $$.key = $3.key; 3377 } 3378 | DUPTO routespec pool_opts { 3379 $$.host = $2; 3380 $$.rt = PF_DUPTO; 3381 $$.pool_opts = $3.type | $3.opts; 3382 if ($3.key != NULL) 3383 $$.key = $3.key; 3384 } 3385 ; 3386 3387 timeout_spec : STRING number 3388 { 3389 if (check_rulestate(PFCTL_STATE_OPTION)) { 3390 free($1); 3391 YYERROR; 3392 } 3393 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3394 yyerror("unknown timeout %s", $1); 3395 free($1); 3396 YYERROR; 3397 } 3398 free($1); 3399 } 3400 ; 3401 3402 timeout_list : timeout_list comma timeout_spec 3403 | timeout_spec 3404 ; 3405 3406 limit_spec : STRING number 3407 { 3408 if (check_rulestate(PFCTL_STATE_OPTION)) { 3409 free($1); 3410 YYERROR; 3411 } 3412 if (pfctl_set_limit(pf, $1, $2) != 0) { 3413 yyerror("unable to set limit %s %u", $1, $2); 3414 free($1); 3415 YYERROR; 3416 } 3417 free($1); 3418 } 3419 ; 3420 3421 limit_list : limit_list comma limit_spec 3422 | limit_spec 3423 ; 3424 3425 comma : ',' 3426 | /* empty */ 3427 ; 3428 3429 yesno : NO { $$ = 0; } 3430 | STRING { 3431 if (!strcmp($1, "yes")) 3432 $$ = 1; 3433 else { 3434 free($1); 3435 YYERROR; 3436 } 3437 free($1); 3438 } 3439 ; 3440 3441 unaryop : '=' { $$ = PF_OP_EQ; } 3442 | '!' '=' { $$ = PF_OP_NE; } 3443 | '<' '=' { $$ = PF_OP_LE; } 3444 | '<' { $$ = PF_OP_LT; } 3445 | '>' '=' { $$ = PF_OP_GE; } 3446 | '>' { $$ = PF_OP_GT; } 3447 ; 3448 3449 %% 3450 3451 int 3452 yyerror(const char *fmt, ...) 3453 { 3454 va_list ap; 3455 extern char *infile; 3456 3457 errors = 1; 3458 va_start(ap, fmt); 3459 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3460 vfprintf(stderr, fmt, ap); 3461 fprintf(stderr, "\n"); 3462 va_end(ap); 3463 return (0); 3464 } 3465 3466 int 3467 disallow_table(struct node_host *h, const char *fmt) 3468 { 3469 for (; h != NULL; h = h->next) 3470 if (h->addr.type == PF_ADDR_TABLE) { 3471 yyerror(fmt, h->addr.v.tblname); 3472 return (1); 3473 } 3474 return (0); 3475 } 3476 3477 int 3478 disallow_alias(struct node_host *h, const char *fmt) 3479 { 3480 for (; h != NULL; h = h->next) 3481 if (DYNIF_MULTIADDR(h->addr)) { 3482 yyerror(fmt, h->addr.v.tblname); 3483 return (1); 3484 } 3485 return (0); 3486 } 3487 3488 int 3489 rule_consistent(struct pf_rule *r) 3490 { 3491 int problems = 0; 3492 3493 switch (r->action) { 3494 case PF_PASS: 3495 case PF_DROP: 3496 case PF_SCRUB: 3497 problems = filter_consistent(r); 3498 break; 3499 case PF_NAT: 3500 case PF_NONAT: 3501 problems = nat_consistent(r); 3502 break; 3503 case PF_RDR: 3504 case PF_NORDR: 3505 problems = rdr_consistent(r); 3506 break; 3507 case PF_BINAT: 3508 case PF_NOBINAT: 3509 default: 3510 break; 3511 } 3512 return (problems); 3513 } 3514 3515 int 3516 filter_consistent(struct pf_rule *r) 3517 { 3518 int problems = 0; 3519 3520 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3521 (r->src.port_op || r->dst.port_op)) { 3522 yyerror("port only applies to tcp/udp"); 3523 problems++; 3524 } 3525 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3526 (r->type || r->code)) { 3527 yyerror("icmp-type/code only applies to icmp"); 3528 problems++; 3529 } 3530 if (!r->af && (r->type || r->code)) { 3531 yyerror("must indicate address family with icmp-type/code"); 3532 problems++; 3533 } 3534 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3535 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3536 yyerror("proto %s doesn't match address family %s", 3537 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3538 r->af == AF_INET ? "inet" : "inet6"); 3539 problems++; 3540 } 3541 if (r->allow_opts && r->action != PF_PASS) { 3542 yyerror("allow-opts can only be specified for pass rules"); 3543 problems++; 3544 } 3545 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3546 r->dst.port_op || r->flagset || r->type || r->code)) { 3547 yyerror("fragments can be filtered only on IP header fields"); 3548 problems++; 3549 } 3550 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3551 yyerror("return-rst can only be applied to TCP rules"); 3552 problems++; 3553 } 3554 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3555 yyerror("max-src-nodes requires 'source-track rule'"); 3556 problems++; 3557 } 3558 if (r->action == PF_DROP && r->keep_state) { 3559 yyerror("keep state on block rules doesn't make sense"); 3560 problems++; 3561 } 3562 if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state && 3563 r->action == PF_PASS && !r->anchorname[0]) { 3564 yyerror("tags cannot be used without keep state"); 3565 problems++; 3566 } 3567 return (-problems); 3568 } 3569 3570 int 3571 nat_consistent(struct pf_rule *r) 3572 { 3573 return (0); /* yeah! */ 3574 } 3575 3576 int 3577 rdr_consistent(struct pf_rule *r) 3578 { 3579 int problems = 0; 3580 3581 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3582 if (r->src.port_op) { 3583 yyerror("src port only applies to tcp/udp"); 3584 problems++; 3585 } 3586 if (r->dst.port_op) { 3587 yyerror("dst port only applies to tcp/udp"); 3588 problems++; 3589 } 3590 if (r->rpool.proxy_port[0]) { 3591 yyerror("rpool port only applies to tcp/udp"); 3592 problems++; 3593 } 3594 } 3595 if (r->dst.port_op && 3596 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3597 yyerror("invalid port operator for rdr destination port"); 3598 problems++; 3599 } 3600 return (-problems); 3601 } 3602 3603 int 3604 process_tabledef(char *name, struct table_opts *opts) 3605 { 3606 struct pfr_buffer ab; 3607 struct node_tinit *ti; 3608 3609 bzero(&ab, sizeof(ab)); 3610 ab.pfrb_type = PFRB_ADDRS; 3611 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3612 if (ti->file) 3613 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3614 if (errno) 3615 yyerror("cannot load \"%s\": %s", 3616 ti->file, strerror(errno)); 3617 else 3618 yyerror("file \"%s\" contains bad data", 3619 ti->file); 3620 goto _error; 3621 } 3622 if (ti->host) 3623 if (append_addr_host(&ab, ti->host, 0, 0)) { 3624 yyerror("cannot create address buffer: %s", 3625 strerror(errno)); 3626 goto _error; 3627 } 3628 } 3629 if (pf->opts & PF_OPT_VERBOSE) 3630 print_tabledef(name, opts->flags, opts->init_addr, 3631 &opts->init_nodes); 3632 if (!(pf->opts & PF_OPT_NOACTION) && 3633 pfctl_define_table(name, opts->flags, opts->init_addr, 3634 pf->anchor, pf->ruleset, &ab, pf->tticket)) { 3635 yyerror("cannot define table %s: %s", name, 3636 pfr_strerror(errno)); 3637 goto _error; 3638 } 3639 pf->tdirty = 1; 3640 pfr_buf_clear(&ab); 3641 return (0); 3642 _error: 3643 pfr_buf_clear(&ab); 3644 return (-1); 3645 } 3646 3647 struct keywords { 3648 const char *k_name; 3649 int k_val; 3650 }; 3651 3652 /* macro gore, but you should've seen the prior indentation nightmare... */ 3653 3654 #define FREE_LIST(T,r) \ 3655 do { \ 3656 T *p, *node = r; \ 3657 while (node != NULL) { \ 3658 p = node; \ 3659 node = node->next; \ 3660 free(p); \ 3661 } \ 3662 } while (0) 3663 3664 #define LOOP_THROUGH(T,n,r,C) \ 3665 do { \ 3666 T *n; \ 3667 if (r == NULL) { \ 3668 r = calloc(1, sizeof(T)); \ 3669 if (r == NULL) \ 3670 err(1, "LOOP: calloc"); \ 3671 r->next = NULL; \ 3672 } \ 3673 n = r; \ 3674 while (n != NULL) { \ 3675 do { \ 3676 C; \ 3677 } while (0); \ 3678 n = n->next; \ 3679 } \ 3680 } while (0) 3681 3682 void 3683 expand_label_str(char *label, size_t len, const char *srch, const char *repl) 3684 { 3685 char *tmp; 3686 char *p, *q; 3687 3688 if ((tmp = calloc(1, len)) == NULL) 3689 err(1, "expand_label_str: calloc"); 3690 p = q = label; 3691 while ((q = strstr(p, srch)) != NULL) { 3692 *q = '\0'; 3693 if ((strlcat(tmp, p, len) >= len) || 3694 (strlcat(tmp, repl, len) >= len)) 3695 errx(1, "expand_label: label too long"); 3696 q += strlen(srch); 3697 p = q; 3698 } 3699 if (strlcat(tmp, p, len) >= len) 3700 errx(1, "expand_label: label too long"); 3701 strlcpy(label, tmp, len); /* always fits */ 3702 free(tmp); 3703 } 3704 3705 void 3706 expand_label_if(const char *name, char *label, size_t len, const char *ifname) 3707 { 3708 if (strstr(label, name) != NULL) { 3709 if (!*ifname) 3710 expand_label_str(label, len, name, "any"); 3711 else 3712 expand_label_str(label, len, name, ifname); 3713 } 3714 } 3715 3716 void 3717 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 3718 struct node_host *h) 3719 { 3720 char tmp[64], tmp_not[66]; 3721 3722 if (strstr(label, name) != NULL) { 3723 switch (h->addr.type) { 3724 case PF_ADDR_DYNIFTL: 3725 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 3726 break; 3727 case PF_ADDR_TABLE: 3728 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 3729 break; 3730 case PF_ADDR_NOROUTE: 3731 snprintf(tmp, sizeof(tmp), "no-route"); 3732 break; 3733 case PF_ADDR_ADDRMASK: 3734 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 3735 PF_AZERO(&h->addr.v.a.mask, af))) 3736 snprintf(tmp, sizeof(tmp), "any"); 3737 else { 3738 char a[48]; 3739 int bits; 3740 3741 if (inet_ntop(af, &h->addr.v.a.addr, a, 3742 sizeof(a)) == NULL) 3743 snprintf(tmp, sizeof(tmp), "?"); 3744 else { 3745 bits = unmask(&h->addr.v.a.mask, af); 3746 if ((af == AF_INET && bits < 32) || 3747 (af == AF_INET6 && bits < 128)) 3748 snprintf(tmp, sizeof(tmp), 3749 "%s/%d", a, bits); 3750 else 3751 snprintf(tmp, sizeof(tmp), 3752 "%s", a); 3753 } 3754 } 3755 break; 3756 default: 3757 snprintf(tmp, sizeof(tmp), "?"); 3758 break; 3759 } 3760 3761 if (h->not) { 3762 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 3763 expand_label_str(label, len, name, tmp_not); 3764 } else 3765 expand_label_str(label, len, name, tmp); 3766 } 3767 } 3768 3769 void 3770 expand_label_port(const char *name, char *label, size_t len, 3771 struct node_port *port) 3772 { 3773 char a1[6], a2[6], op[13] = ""; 3774 3775 if (strstr(label, name) != NULL) { 3776 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 3777 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 3778 if (!port->op) 3779 ; 3780 else if (port->op == PF_OP_IRG) 3781 snprintf(op, sizeof(op), "%s><%s", a1, a2); 3782 else if (port->op == PF_OP_XRG) 3783 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 3784 else if (port->op == PF_OP_EQ) 3785 snprintf(op, sizeof(op), "%s", a1); 3786 else if (port->op == PF_OP_NE) 3787 snprintf(op, sizeof(op), "!=%s", a1); 3788 else if (port->op == PF_OP_LT) 3789 snprintf(op, sizeof(op), "<%s", a1); 3790 else if (port->op == PF_OP_LE) 3791 snprintf(op, sizeof(op), "<=%s", a1); 3792 else if (port->op == PF_OP_GT) 3793 snprintf(op, sizeof(op), ">%s", a1); 3794 else if (port->op == PF_OP_GE) 3795 snprintf(op, sizeof(op), ">=%s", a1); 3796 expand_label_str(label, len, name, op); 3797 } 3798 } 3799 3800 void 3801 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 3802 { 3803 struct protoent *pe; 3804 char n[4]; 3805 3806 if (strstr(label, name) != NULL) { 3807 pe = getprotobynumber(proto); 3808 if (pe != NULL) 3809 expand_label_str(label, len, name, pe->p_name); 3810 else { 3811 snprintf(n, sizeof(n), "%u", proto); 3812 expand_label_str(label, len, name, n); 3813 } 3814 } 3815 } 3816 3817 void 3818 expand_label_nr(const char *name, char *label, size_t len) 3819 { 3820 char n[11]; 3821 3822 if (strstr(label, name) != NULL) { 3823 snprintf(n, sizeof(n), "%u", pf->rule_nr); 3824 expand_label_str(label, len, name, n); 3825 } 3826 } 3827 3828 void 3829 expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 3830 struct node_host *src_host, struct node_port *src_port, 3831 struct node_host *dst_host, struct node_port *dst_port, 3832 u_int8_t proto) 3833 { 3834 expand_label_if("$if", label, len, ifname); 3835 expand_label_addr("$srcaddr", label, len, af, src_host); 3836 expand_label_addr("$dstaddr", label, len, af, dst_host); 3837 expand_label_port("$srcport", label, len, src_port); 3838 expand_label_port("$dstport", label, len, dst_port); 3839 expand_label_proto("$proto", label, len, proto); 3840 expand_label_nr("$nr", label, len); 3841 } 3842 3843 int 3844 expand_altq(struct pf_altq *a, struct node_if *interfaces, 3845 struct node_queue *nqueues, struct node_queue_bw bwspec, 3846 struct node_queue_opt *opts) 3847 { 3848 struct pf_altq pa, pb; 3849 char qname[PF_QNAME_SIZE]; 3850 struct node_queue *n; 3851 struct node_queue_bw bw; 3852 int errs = 0; 3853 3854 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3855 FREE_LIST(struct node_if, interfaces); 3856 FREE_LIST(struct node_queue, nqueues); 3857 return (0); 3858 } 3859 3860 LOOP_THROUGH(struct node_if, interface, interfaces, 3861 memcpy(&pa, a, sizeof(struct pf_altq)); 3862 if (strlcpy(pa.ifname, interface->ifname, 3863 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 3864 errx(1, "expand_altq: strlcpy"); 3865 3866 if (interface->not) { 3867 yyerror("altq on ! <interface> is not supported"); 3868 errs++; 3869 } else { 3870 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 3871 errs++; 3872 else 3873 if (pfctl_add_altq(pf, &pa)) 3874 errs++; 3875 3876 if (pf->opts & PF_OPT_VERBOSE) { 3877 print_altq(&pf->paltq->altq, 0, 3878 &bwspec, opts); 3879 if (nqueues && nqueues->tail) { 3880 printf("queue { "); 3881 LOOP_THROUGH(struct node_queue, queue, 3882 nqueues, 3883 printf("%s ", 3884 queue->queue); 3885 ); 3886 printf("}"); 3887 } 3888 printf("\n"); 3889 } 3890 3891 if (pa.scheduler == ALTQT_CBQ || 3892 pa.scheduler == ALTQT_HFSC) { 3893 /* now create a root queue */ 3894 memset(&pb, 0, sizeof(struct pf_altq)); 3895 if (strlcpy(qname, "root_", sizeof(qname)) >= 3896 sizeof(qname)) 3897 errx(1, "expand_altq: strlcpy"); 3898 if (strlcat(qname, interface->ifname, 3899 sizeof(qname)) >= sizeof(qname)) 3900 errx(1, "expand_altq: strlcat"); 3901 if (strlcpy(pb.qname, qname, 3902 sizeof(pb.qname)) >= sizeof(pb.qname)) 3903 errx(1, "expand_altq: strlcpy"); 3904 if (strlcpy(pb.ifname, interface->ifname, 3905 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 3906 errx(1, "expand_altq: strlcpy"); 3907 pb.qlimit = pa.qlimit; 3908 pb.scheduler = pa.scheduler; 3909 bw.bw_absolute = pa.ifbandwidth; 3910 bw.bw_percent = 0; 3911 if (eval_pfqueue(pf, &pb, &bw, opts)) 3912 errs++; 3913 else 3914 if (pfctl_add_altq(pf, &pb)) 3915 errs++; 3916 } 3917 3918 LOOP_THROUGH(struct node_queue, queue, nqueues, 3919 n = calloc(1, sizeof(struct node_queue)); 3920 if (n == NULL) 3921 err(1, "expand_altq: calloc"); 3922 if (pa.scheduler == ALTQT_CBQ || 3923 pa.scheduler == ALTQT_HFSC) 3924 if (strlcpy(n->parent, qname, 3925 sizeof(n->parent)) >= 3926 sizeof(n->parent)) 3927 errx(1, "expand_altq: strlcpy"); 3928 if (strlcpy(n->queue, queue->queue, 3929 sizeof(n->queue)) >= sizeof(n->queue)) 3930 errx(1, "expand_altq: strlcpy"); 3931 if (strlcpy(n->ifname, interface->ifname, 3932 sizeof(n->ifname)) >= sizeof(n->ifname)) 3933 errx(1, "expand_altq: strlcpy"); 3934 n->scheduler = pa.scheduler; 3935 n->next = NULL; 3936 n->tail = n; 3937 if (queues == NULL) 3938 queues = n; 3939 else { 3940 queues->tail->next = n; 3941 queues->tail = n; 3942 } 3943 ); 3944 } 3945 ); 3946 FREE_LIST(struct node_if, interfaces); 3947 FREE_LIST(struct node_queue, nqueues); 3948 3949 return (errs); 3950 } 3951 3952 int 3953 expand_queue(struct pf_altq *a, struct node_if *interfaces, 3954 struct node_queue *nqueues, struct node_queue_bw bwspec, 3955 struct node_queue_opt *opts) 3956 { 3957 struct node_queue *n, *nq; 3958 struct pf_altq pa; 3959 u_int8_t found = 0; 3960 u_int8_t errs = 0; 3961 3962 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3963 FREE_LIST(struct node_queue, nqueues); 3964 return (0); 3965 } 3966 3967 if (queues == NULL) { 3968 yyerror("queue %s has no parent", a->qname); 3969 FREE_LIST(struct node_queue, nqueues); 3970 return (1); 3971 } 3972 3973 LOOP_THROUGH(struct node_if, interface, interfaces, 3974 LOOP_THROUGH(struct node_queue, tqueue, queues, 3975 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 3976 (interface->ifname[0] == 0 || 3977 (!interface->not && !strncmp(interface->ifname, 3978 tqueue->ifname, IFNAMSIZ)) || 3979 (interface->not && strncmp(interface->ifname, 3980 tqueue->ifname, IFNAMSIZ)))) { 3981 /* found ourself in queues */ 3982 found++; 3983 3984 memcpy(&pa, a, sizeof(struct pf_altq)); 3985 3986 if (pa.scheduler != ALTQT_NONE && 3987 pa.scheduler != tqueue->scheduler) { 3988 yyerror("exactly one scheduler type " 3989 "per interface allowed"); 3990 return (1); 3991 } 3992 pa.scheduler = tqueue->scheduler; 3993 3994 /* scheduler dependent error checking */ 3995 switch (pa.scheduler) { 3996 case ALTQT_PRIQ: 3997 if (nqueues != NULL) { 3998 yyerror("priq queues cannot " 3999 "have child queues"); 4000 return (1); 4001 } 4002 if (bwspec.bw_absolute > 0 || 4003 bwspec.bw_percent < 100) { 4004 yyerror("priq doesn't take " 4005 "bandwidth"); 4006 return (1); 4007 } 4008 break; 4009 default: 4010 break; 4011 } 4012 4013 if (strlcpy(pa.ifname, tqueue->ifname, 4014 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4015 errx(1, "expand_queue: strlcpy"); 4016 if (strlcpy(pa.parent, tqueue->parent, 4017 sizeof(pa.parent)) >= sizeof(pa.parent)) 4018 errx(1, "expand_queue: strlcpy"); 4019 4020 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4021 errs++; 4022 else 4023 if (pfctl_add_altq(pf, &pa)) 4024 errs++; 4025 4026 for (nq = nqueues; nq != NULL; nq = nq->next) { 4027 if (!strcmp(a->qname, nq->queue)) { 4028 yyerror("queue cannot have " 4029 "itself as child"); 4030 errs++; 4031 continue; 4032 } 4033 n = calloc(1, 4034 sizeof(struct node_queue)); 4035 if (n == NULL) 4036 err(1, "expand_queue: calloc"); 4037 if (strlcpy(n->parent, a->qname, 4038 sizeof(n->parent)) >= 4039 sizeof(n->parent)) 4040 errx(1, "expand_queue strlcpy"); 4041 if (strlcpy(n->queue, nq->queue, 4042 sizeof(n->queue)) >= 4043 sizeof(n->queue)) 4044 errx(1, "expand_queue strlcpy"); 4045 if (strlcpy(n->ifname, tqueue->ifname, 4046 sizeof(n->ifname)) >= 4047 sizeof(n->ifname)) 4048 errx(1, "expand_queue strlcpy"); 4049 n->scheduler = tqueue->scheduler; 4050 n->next = NULL; 4051 n->tail = n; 4052 if (queues == NULL) 4053 queues = n; 4054 else { 4055 queues->tail->next = n; 4056 queues->tail = n; 4057 } 4058 } 4059 if ((pf->opts & PF_OPT_VERBOSE) && ( 4060 (found == 1 && interface->ifname[0] == 0) || 4061 (found > 0 && interface->ifname[0] != 0))) { 4062 print_queue(&pf->paltq->altq, 0, 4063 &bwspec, interface->ifname[0] != 0, 4064 opts); 4065 if (nqueues && nqueues->tail) { 4066 printf("{ "); 4067 LOOP_THROUGH(struct node_queue, 4068 queue, nqueues, 4069 printf("%s ", 4070 queue->queue); 4071 ); 4072 printf("}"); 4073 } 4074 printf("\n"); 4075 } 4076 } 4077 ); 4078 ); 4079 4080 FREE_LIST(struct node_queue, nqueues); 4081 FREE_LIST(struct node_if, interfaces); 4082 4083 if (!found) { 4084 yyerror("queue %s has no parent", a->qname); 4085 errs++; 4086 } 4087 4088 if (errs) 4089 return (1); 4090 else 4091 return (0); 4092 } 4093 4094 void 4095 expand_rule(struct pf_rule *r, 4096 struct node_if *interfaces, struct node_host *rpool_hosts, 4097 struct node_proto *protos, struct node_os *src_oses, 4098 struct node_host *src_hosts, struct node_port *src_ports, 4099 struct node_host *dst_hosts, struct node_port *dst_ports, 4100 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types) 4101 { 4102 sa_family_t af = r->af; 4103 int added = 0, error = 0; 4104 char ifname[IF_NAMESIZE]; 4105 char label[PF_RULE_LABEL_SIZE]; 4106 char tagname[PF_TAG_NAME_SIZE]; 4107 char match_tagname[PF_TAG_NAME_SIZE]; 4108 struct pf_pooladdr *pa; 4109 struct node_host *h; 4110 u_int8_t flags, flagset, keep_state; 4111 4112 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4113 errx(1, "expand_rule: strlcpy"); 4114 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4115 errx(1, "expand_rule: strlcpy"); 4116 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4117 sizeof(match_tagname)) 4118 errx(1, "expand_rule: strlcpy"); 4119 flags = r->flags; 4120 flagset = r->flagset; 4121 keep_state = r->keep_state; 4122 4123 LOOP_THROUGH(struct node_if, interface, interfaces, 4124 LOOP_THROUGH(struct node_proto, proto, protos, 4125 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4126 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4127 LOOP_THROUGH(struct node_port, src_port, src_ports, 4128 LOOP_THROUGH(struct node_os, src_os, src_oses, 4129 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4130 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4131 LOOP_THROUGH(struct node_uid, uid, uids, 4132 LOOP_THROUGH(struct node_gid, gid, gids, 4133 4134 r->af = af; 4135 /* for link-local IPv6 address, interface must match up */ 4136 if ((r->af && src_host->af && r->af != src_host->af) || 4137 (r->af && dst_host->af && r->af != dst_host->af) || 4138 (src_host->af && dst_host->af && 4139 src_host->af != dst_host->af) || 4140 (src_host->ifindex && dst_host->ifindex && 4141 src_host->ifindex != dst_host->ifindex) || 4142 (src_host->ifindex && *interface->ifname && 4143 src_host->ifindex != if_nametoindex(interface->ifname)) || 4144 (dst_host->ifindex && *interface->ifname && 4145 dst_host->ifindex != if_nametoindex(interface->ifname))) 4146 continue; 4147 if (!r->af && src_host->af) 4148 r->af = src_host->af; 4149 else if (!r->af && dst_host->af) 4150 r->af = dst_host->af; 4151 4152 if (*interface->ifname) 4153 memcpy(r->ifname, interface->ifname, sizeof(r->ifname)); 4154 else if (if_indextoname(src_host->ifindex, ifname)) 4155 memcpy(r->ifname, ifname, sizeof(r->ifname)); 4156 else if (if_indextoname(dst_host->ifindex, ifname)) 4157 memcpy(r->ifname, ifname, sizeof(r->ifname)); 4158 else 4159 memset(r->ifname, '\0', sizeof(r->ifname)); 4160 4161 if (strlcpy(r->label, label, sizeof(r->label)) >= 4162 sizeof(r->label)) 4163 errx(1, "expand_rule: strlcpy"); 4164 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4165 sizeof(r->tagname)) 4166 errx(1, "expand_rule: strlcpy"); 4167 if (strlcpy(r->match_tagname, match_tagname, 4168 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4169 errx(1, "expand_rule: strlcpy"); 4170 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4171 src_host, src_port, dst_host, dst_port, proto->proto); 4172 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4173 src_host, src_port, dst_host, dst_port, proto->proto); 4174 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4175 r->af, src_host, src_port, dst_host, dst_port, 4176 proto->proto); 4177 4178 error += check_netmask(src_host, r->af); 4179 error += check_netmask(dst_host, r->af); 4180 4181 r->ifnot = interface->not; 4182 r->proto = proto->proto; 4183 r->src.addr = src_host->addr; 4184 r->src.not = src_host->not; 4185 r->src.port[0] = src_port->port[0]; 4186 r->src.port[1] = src_port->port[1]; 4187 r->src.port_op = src_port->op; 4188 r->dst.addr = dst_host->addr; 4189 r->dst.not = dst_host->not; 4190 r->dst.port[0] = dst_port->port[0]; 4191 r->dst.port[1] = dst_port->port[1]; 4192 r->dst.port_op = dst_port->op; 4193 r->uid.op = uid->op; 4194 r->uid.uid[0] = uid->uid[0]; 4195 r->uid.uid[1] = uid->uid[1]; 4196 r->gid.op = gid->op; 4197 r->gid.gid[0] = gid->gid[0]; 4198 r->gid.gid[1] = gid->gid[1]; 4199 r->type = icmp_type->type; 4200 r->code = icmp_type->code; 4201 4202 if ((keep_state == PF_STATE_MODULATE || 4203 keep_state == PF_STATE_SYNPROXY) && 4204 r->proto && r->proto != IPPROTO_TCP) 4205 r->keep_state = PF_STATE_NORMAL; 4206 else 4207 r->keep_state = keep_state; 4208 4209 if (r->proto && r->proto != IPPROTO_TCP) { 4210 r->flags = 0; 4211 r->flagset = 0; 4212 } else { 4213 r->flags = flags; 4214 r->flagset = flagset; 4215 } 4216 if (icmp_type->proto && r->proto != icmp_type->proto) { 4217 yyerror("icmp-type mismatch"); 4218 error++; 4219 } 4220 4221 if (src_os && src_os->os) { 4222 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4223 if ((pf->opts & PF_OPT_VERBOSE2) && 4224 r->os_fingerprint == PF_OSFP_NOMATCH) 4225 fprintf(stderr, 4226 "warning: unknown '%s' OS fingerprint\n", 4227 src_os->os); 4228 } else { 4229 r->os_fingerprint = PF_OSFP_ANY; 4230 } 4231 4232 TAILQ_INIT(&r->rpool.list); 4233 for (h = rpool_hosts; h != NULL; h = h->next) { 4234 pa = calloc(1, sizeof(struct pf_pooladdr)); 4235 if (pa == NULL) 4236 err(1, "expand_rule: calloc"); 4237 pa->addr = h->addr; 4238 if (h->ifname != NULL) { 4239 if (strlcpy(pa->ifname, h->ifname, 4240 sizeof(pa->ifname)) >= 4241 sizeof(pa->ifname)) 4242 errx(1, "expand_rule: strlcpy"); 4243 } else 4244 pa->ifname[0] = 0; 4245 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4246 } 4247 4248 if (rule_consistent(r) < 0 || error) 4249 yyerror("skipping rule due to errors"); 4250 else { 4251 r->nr = pf->rule_nr++; 4252 pfctl_add_rule(pf, r); 4253 added++; 4254 } 4255 4256 )))))))))); 4257 4258 FREE_LIST(struct node_if, interfaces); 4259 FREE_LIST(struct node_proto, protos); 4260 FREE_LIST(struct node_host, src_hosts); 4261 FREE_LIST(struct node_port, src_ports); 4262 FREE_LIST(struct node_os, src_oses); 4263 FREE_LIST(struct node_host, dst_hosts); 4264 FREE_LIST(struct node_port, dst_ports); 4265 FREE_LIST(struct node_uid, uids); 4266 FREE_LIST(struct node_gid, gids); 4267 FREE_LIST(struct node_icmp, icmp_types); 4268 FREE_LIST(struct node_host, rpool_hosts); 4269 4270 if (!added) 4271 yyerror("rule expands to no valid combination"); 4272 } 4273 4274 #undef FREE_LIST 4275 #undef LOOP_THROUGH 4276 4277 int 4278 check_rulestate(int desired_state) 4279 { 4280 if (require_order && (rulestate > desired_state)) { 4281 yyerror("Rules must be in order: options, normalization, " 4282 "queueing, translation, filtering"); 4283 return (1); 4284 } 4285 rulestate = desired_state; 4286 return (0); 4287 } 4288 4289 int 4290 kw_cmp(const void *k, const void *e) 4291 { 4292 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4293 } 4294 4295 int 4296 lookup(char *s) 4297 { 4298 /* this has to be sorted always */ 4299 static const struct keywords keywords[] = { 4300 { "all", ALL}, 4301 { "allow-opts", ALLOWOPTS}, 4302 { "altq", ALTQ}, 4303 { "anchor", ANCHOR}, 4304 { "antispoof", ANTISPOOF}, 4305 { "any", ANY}, 4306 { "bandwidth", BANDWIDTH}, 4307 { "binat", BINAT}, 4308 { "binat-anchor", BINATANCHOR}, 4309 { "bitmask", BITMASK}, 4310 { "block", BLOCK}, 4311 { "block-policy", BLOCKPOLICY}, 4312 { "cbq", CBQ}, 4313 { "code", CODE}, 4314 { "crop", FRAGCROP}, 4315 { "debug", DEBUG}, 4316 { "drop", DROP}, 4317 { "drop-ovl", FRAGDROP}, 4318 { "dup-to", DUPTO}, 4319 { "fastroute", FASTROUTE}, 4320 { "file", FILENAME}, 4321 { "fingerprints", FINGERPRINTS}, 4322 { "flags", FLAGS}, 4323 { "floating", FLOATING}, 4324 { "for", FOR}, 4325 { "fragment", FRAGMENT}, 4326 { "from", FROM}, 4327 { "global", GLOBAL}, 4328 { "group", GROUP}, 4329 { "group-bound", GRBOUND}, 4330 { "hfsc", HFSC}, 4331 { "hostid", HOSTID}, 4332 { "icmp-type", ICMPTYPE}, 4333 { "icmp6-type", ICMP6TYPE}, 4334 { "if-bound", IFBOUND}, 4335 { "in", IN}, 4336 { "inet", INET}, 4337 { "inet6", INET6}, 4338 { "keep", KEEP}, 4339 { "label", LABEL}, 4340 { "limit", LIMIT}, 4341 { "linkshare", LINKSHARE}, 4342 { "load", LOAD}, 4343 { "log", LOG}, 4344 { "log-all", LOGALL}, 4345 { "loginterface", LOGINTERFACE}, 4346 { "max", MAXIMUM}, 4347 { "max-mss", MAXMSS}, 4348 { "max-src-nodes", MAXSRCNODES}, 4349 { "max-src-states", MAXSRCSTATES}, 4350 { "min-ttl", MINTTL}, 4351 { "modulate", MODULATE}, 4352 { "nat", NAT}, 4353 { "nat-anchor", NATANCHOR}, 4354 { "no", NO}, 4355 { "no-df", NODF}, 4356 { "no-route", NOROUTE}, 4357 { "no-sync", NOSYNC}, 4358 { "on", ON}, 4359 { "optimization", OPTIMIZATION}, 4360 { "os", OS}, 4361 { "out", OUT}, 4362 { "pass", PASS}, 4363 { "port", PORT}, 4364 { "priority", PRIORITY}, 4365 { "priq", PRIQ}, 4366 { "proto", PROTO}, 4367 { "qlimit", QLIMIT}, 4368 { "queue", QUEUE}, 4369 { "quick", QUICK}, 4370 { "random", RANDOM}, 4371 { "random-id", RANDOMID}, 4372 { "rdr", RDR}, 4373 { "rdr-anchor", RDRANCHOR}, 4374 { "realtime", REALTIME}, 4375 { "reassemble", REASSEMBLE}, 4376 { "reply-to", REPLYTO}, 4377 { "require-order", REQUIREORDER}, 4378 { "return", RETURN}, 4379 { "return-icmp", RETURNICMP}, 4380 { "return-icmp6", RETURNICMP6}, 4381 { "return-rst", RETURNRST}, 4382 { "round-robin", ROUNDROBIN}, 4383 { "route-to", ROUTETO}, 4384 { "rule", RULE}, 4385 { "scrub", SCRUB}, 4386 { "set", SET}, 4387 { "source-hash", SOURCEHASH}, 4388 { "source-track", SOURCETRACK}, 4389 { "state", STATE}, 4390 { "state-policy", STATEPOLICY}, 4391 { "static-port", STATICPORT}, 4392 { "sticky-address", STICKYADDRESS}, 4393 { "synproxy", SYNPROXY}, 4394 { "table", TABLE}, 4395 { "tag", TAG}, 4396 { "tagged", TAGGED}, 4397 { "tbrsize", TBRSIZE}, 4398 { "timeout", TIMEOUT}, 4399 { "to", TO}, 4400 { "tos", TOS}, 4401 { "ttl", TTL}, 4402 { "upperlimit", UPPERLIMIT}, 4403 { "user", USER}, 4404 }; 4405 const struct keywords *p; 4406 4407 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4408 sizeof(keywords[0]), kw_cmp); 4409 4410 if (p) { 4411 if (debug > 1) 4412 fprintf(stderr, "%s: %d\n", s, p->k_val); 4413 return (p->k_val); 4414 } else { 4415 if (debug > 1) 4416 fprintf(stderr, "string: %s\n", s); 4417 return (STRING); 4418 } 4419 } 4420 4421 #define MAXPUSHBACK 128 4422 4423 char *parsebuf; 4424 int parseindex; 4425 char pushback_buffer[MAXPUSHBACK]; 4426 int pushback_index = 0; 4427 4428 int 4429 lgetc(FILE *f) 4430 { 4431 int c, next; 4432 4433 if (parsebuf) { 4434 /* Read character from the parsebuffer instead of input. */ 4435 if (parseindex >= 0) { 4436 c = parsebuf[parseindex++]; 4437 if (c != '\0') 4438 return (c); 4439 parsebuf = NULL; 4440 } else 4441 parseindex++; 4442 } 4443 4444 if (pushback_index) 4445 return (pushback_buffer[--pushback_index]); 4446 4447 while ((c = getc(f)) == '\\') { 4448 next = getc(f); 4449 if (next != '\n') { 4450 if (isspace(next)) 4451 yyerror("whitespace after \\"); 4452 ungetc(next, f); 4453 break; 4454 } 4455 yylval.lineno = lineno; 4456 lineno++; 4457 } 4458 if (c == '\t' || c == ' ') { 4459 /* Compress blanks to a single space. */ 4460 do { 4461 c = getc(f); 4462 } while (c == '\t' || c == ' '); 4463 ungetc(c, f); 4464 c = ' '; 4465 } 4466 4467 return (c); 4468 } 4469 4470 int 4471 lungetc(int c) 4472 { 4473 if (c == EOF) 4474 return (EOF); 4475 if (parsebuf) { 4476 parseindex--; 4477 if (parseindex >= 0) 4478 return (c); 4479 } 4480 if (pushback_index < MAXPUSHBACK-1) 4481 return (pushback_buffer[pushback_index++] = c); 4482 else 4483 return (EOF); 4484 } 4485 4486 int 4487 findeol(void) 4488 { 4489 int c; 4490 4491 parsebuf = NULL; 4492 pushback_index = 0; 4493 4494 /* skip to either EOF or the first real EOL */ 4495 while (1) { 4496 c = lgetc(fin); 4497 if (c == '\n') { 4498 lineno++; 4499 break; 4500 } 4501 if (c == EOF) 4502 break; 4503 } 4504 return (ERROR); 4505 } 4506 4507 int 4508 yylex(void) 4509 { 4510 char buf[8096]; 4511 char *p, *val; 4512 int endc, c, next; 4513 int token; 4514 4515 top: 4516 p = buf; 4517 while ((c = lgetc(fin)) == ' ') 4518 ; /* nothing */ 4519 4520 yylval.lineno = lineno; 4521 if (c == '#') 4522 while ((c = lgetc(fin)) != '\n' && c != EOF) 4523 ; /* nothing */ 4524 if (c == '$' && parsebuf == NULL) { 4525 while (1) { 4526 if ((c = lgetc(fin)) == EOF) 4527 return (0); 4528 4529 if (p + 1 >= buf + sizeof(buf) - 1) { 4530 yyerror("string too long"); 4531 return (findeol()); 4532 } 4533 if (isalnum(c) || c == '_') { 4534 *p++ = (char)c; 4535 continue; 4536 } 4537 *p = '\0'; 4538 lungetc(c); 4539 break; 4540 } 4541 val = symget(buf); 4542 if (val == NULL) { 4543 yyerror("macro '%s' not defined", buf); 4544 return (findeol()); 4545 } 4546 parsebuf = val; 4547 parseindex = 0; 4548 goto top; 4549 } 4550 4551 switch (c) { 4552 case '\'': 4553 case '"': 4554 endc = c; 4555 while (1) { 4556 if ((c = lgetc(fin)) == EOF) 4557 return (0); 4558 if (c == endc) { 4559 *p = '\0'; 4560 break; 4561 } 4562 if (c == '\n') { 4563 lineno++; 4564 continue; 4565 } 4566 if (p + 1 >= buf + sizeof(buf) - 1) { 4567 yyerror("string too long"); 4568 return (findeol()); 4569 } 4570 *p++ = (char)c; 4571 } 4572 yylval.v.string = strdup(buf); 4573 if (yylval.v.string == NULL) 4574 err(1, "yylex: strdup"); 4575 return (STRING); 4576 case '<': 4577 next = lgetc(fin); 4578 if (next == '>') { 4579 yylval.v.i = PF_OP_XRG; 4580 return (PORTBINARY); 4581 } 4582 lungetc(next); 4583 break; 4584 case '>': 4585 next = lgetc(fin); 4586 if (next == '<') { 4587 yylval.v.i = PF_OP_IRG; 4588 return (PORTBINARY); 4589 } 4590 lungetc(next); 4591 break; 4592 case '-': 4593 next = lgetc(fin); 4594 if (next == '>') 4595 return (ARROW); 4596 lungetc(next); 4597 break; 4598 } 4599 4600 #define allowed_in_string(x) \ 4601 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4602 x != '{' && x != '}' && x != '<' && x != '>' && \ 4603 x != '!' && x != '=' && x != '/' && x != '#' && \ 4604 x != ',')) 4605 4606 if (isalnum(c) || c == ':' || c == '_') { 4607 do { 4608 *p++ = c; 4609 if ((unsigned)(p-buf) >= sizeof(buf)) { 4610 yyerror("string too long"); 4611 return (findeol()); 4612 } 4613 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4614 lungetc(c); 4615 *p = '\0'; 4616 if ((token = lookup(buf)) == STRING) 4617 if ((yylval.v.string = strdup(buf)) == NULL) 4618 err(1, "yylex: strdup"); 4619 return (token); 4620 } 4621 if (c == '\n') { 4622 yylval.lineno = lineno; 4623 lineno++; 4624 } 4625 if (c == EOF) 4626 return (0); 4627 return (c); 4628 } 4629 4630 int 4631 parse_rules(FILE *input, struct pfctl *xpf) 4632 { 4633 struct sym *sym, *next; 4634 4635 fin = input; 4636 pf = xpf; 4637 lineno = 1; 4638 errors = 0; 4639 rulestate = PFCTL_STATE_NONE; 4640 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4641 returnicmp6default = 4642 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4643 blockpolicy = PFRULE_DROP; 4644 require_order = 1; 4645 4646 yyparse(); 4647 4648 /* Free macros and check which have not been used. */ 4649 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 4650 next = TAILQ_NEXT(sym, entries); 4651 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 4652 fprintf(stderr, "warning: macro '%s' not " 4653 "used\n", sym->nam); 4654 free(sym->nam); 4655 free(sym->val); 4656 TAILQ_REMOVE(&symhead, sym, entries); 4657 free(sym); 4658 } 4659 4660 return (errors ? -1 : 0); 4661 } 4662 4663 /* 4664 * Over-designed efficiency is a French and German concept, so how about 4665 * we wait until they discover this ugliness and make it all fancy. 4666 */ 4667 int 4668 symset(const char *nam, const char *val, int persist) 4669 { 4670 struct sym *sym; 4671 4672 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 4673 sym = TAILQ_NEXT(sym, entries)) 4674 ; /* nothing */ 4675 4676 if (sym != NULL) { 4677 if (sym->persist == 1) 4678 return (0); 4679 else { 4680 free(sym->nam); 4681 free(sym->val); 4682 TAILQ_REMOVE(&symhead, sym, entries); 4683 free(sym); 4684 } 4685 } 4686 if ((sym = calloc(1, sizeof(*sym))) == NULL) 4687 return (-1); 4688 4689 sym->nam = strdup(nam); 4690 if (sym->nam == NULL) { 4691 free(sym); 4692 return (-1); 4693 } 4694 sym->val = strdup(val); 4695 if (sym->val == NULL) { 4696 free(sym->nam); 4697 free(sym); 4698 return (-1); 4699 } 4700 sym->used = 0; 4701 sym->persist = persist; 4702 TAILQ_INSERT_TAIL(&symhead, sym, entries); 4703 return (0); 4704 } 4705 4706 int 4707 pfctl_cmdline_symset(char *s) 4708 { 4709 char *sym, *val; 4710 int ret; 4711 4712 if ((val = strrchr(s, '=')) == NULL) 4713 return (-1); 4714 4715 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 4716 err(1, "pfctl_cmdline_symset: malloc"); 4717 4718 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 4719 4720 ret = symset(sym, val + 1, 1); 4721 free(sym); 4722 4723 return (ret); 4724 } 4725 4726 char * 4727 symget(const char *nam) 4728 { 4729 struct sym *sym; 4730 4731 TAILQ_FOREACH(sym, &symhead, entries) 4732 if (strcmp(nam, sym->nam) == 0) { 4733 sym->used = 1; 4734 return (sym->val); 4735 } 4736 return (NULL); 4737 } 4738 4739 void 4740 decide_address_family(struct node_host *n, sa_family_t *af) 4741 { 4742 sa_family_t target_af = 0; 4743 4744 while (!*af && n != NULL) { 4745 if (n->af) { 4746 if (target_af == 0) 4747 target_af = n->af; 4748 if (target_af != n->af) 4749 return; 4750 } 4751 n = n->next; 4752 } 4753 if (!*af && target_af) 4754 *af = target_af; 4755 } 4756 4757 void 4758 remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 4759 { 4760 struct node_host *n = *nh, *prev = NULL; 4761 4762 while (n != NULL) { 4763 if (*af && n->af && n->af != *af) { 4764 /* unlink and free n */ 4765 struct node_host *next = n->next; 4766 4767 /* adjust tail pointer */ 4768 if (n == (*nh)->tail) 4769 (*nh)->tail = prev; 4770 /* adjust previous node's next pointer */ 4771 if (prev == NULL) 4772 *nh = next; 4773 else 4774 prev->next = next; 4775 /* free node */ 4776 if (n->ifname != NULL) 4777 free(n->ifname); 4778 free(n); 4779 n = next; 4780 } else { 4781 if (n->af && !*af) 4782 *af = n->af; 4783 prev = n; 4784 n = n->next; 4785 } 4786 } 4787 } 4788 4789 int 4790 invalid_redirect(struct node_host *nh, sa_family_t af) 4791 { 4792 if (!af) { 4793 struct node_host *n; 4794 4795 /* tables and dyniftl are ok without an address family */ 4796 for (n = nh; n != NULL; n = n->next) { 4797 if (n->addr.type != PF_ADDR_TABLE && 4798 n->addr.type != PF_ADDR_DYNIFTL) { 4799 yyerror("address family not given and " 4800 "translation address expands to multiple " 4801 "address families"); 4802 return (1); 4803 } 4804 } 4805 } 4806 if (nh == NULL) { 4807 yyerror("no translation address with matching address family " 4808 "found."); 4809 return (1); 4810 } 4811 return (0); 4812 } 4813 4814 int 4815 atoul(char *s, u_long *ulvalp) 4816 { 4817 u_long ulval; 4818 char *ep; 4819 4820 errno = 0; 4821 ulval = strtoul(s, &ep, 0); 4822 if (s[0] == '\0' || *ep != '\0') 4823 return (-1); 4824 if (errno == ERANGE && ulval == ULONG_MAX) 4825 return (-1); 4826 *ulvalp = ulval; 4827 return (0); 4828 } 4829 4830 int 4831 getservice(char *n) 4832 { 4833 struct servent *s; 4834 u_long ulval; 4835 4836 if (atoul(n, &ulval) == 0) { 4837 if (ulval > 65535) { 4838 yyerror("illegal port value %d", ulval); 4839 return (-1); 4840 } 4841 return (htons(ulval)); 4842 } else { 4843 s = getservbyname(n, "tcp"); 4844 if (s == NULL) 4845 s = getservbyname(n, "udp"); 4846 if (s == NULL) { 4847 yyerror("unknown port %s", n); 4848 return (-1); 4849 } 4850 return (s->s_port); 4851 } 4852 } 4853 4854 int 4855 rule_label(struct pf_rule *r, char *s) 4856 { 4857 if (s) { 4858 if (strlcpy(r->label, s, sizeof(r->label)) >= 4859 sizeof(r->label)) { 4860 yyerror("rule label too long (max %d chars)", 4861 sizeof(r->label)-1); 4862 return (-1); 4863 } 4864 } 4865 return (0); 4866 } 4867 4868 u_int16_t 4869 parseicmpspec(char *w, sa_family_t af) 4870 { 4871 const struct icmpcodeent *p; 4872 u_long ulval; 4873 u_int8_t icmptype; 4874 4875 if (af == AF_INET) 4876 icmptype = returnicmpdefault >> 8; 4877 else 4878 icmptype = returnicmp6default >> 8; 4879 4880 if (atoul(w, &ulval) == -1) { 4881 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 4882 yyerror("unknown icmp code %s", w); 4883 return (0); 4884 } 4885 ulval = p->code; 4886 } 4887 if (ulval > 255) { 4888 yyerror("invalid icmp code %ld", ulval); 4889 return (0); 4890 } 4891 return (icmptype << 8 | ulval); 4892 } 4893 4894 int 4895 pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans) 4896 { 4897 struct loadanchors *la; 4898 4899 TAILQ_FOREACH(la, &loadanchorshead, entries) { 4900 if (opts & PF_OPT_VERBOSE) 4901 fprintf(stderr, "\nLoading anchor %s:%s from %s\n", 4902 la->anchorname, la->rulesetname, la->filename); 4903 if (pfctl_rules(dev, la->filename, opts, la->anchorname, 4904 la->rulesetname, trans) == -1) 4905 return (-1); 4906 } 4907 4908 return (0); 4909 } 4910 4911
Indexes created Tue Sep 30 11:09:46 GMT 2025