parse.y revision 1.8
1 /* $NetBSD: parse.y,v 1.8 2007/05/10 22:30:54 dyoung Exp $ */ 2 /* $OpenBSD: parse.y,v 1.482 2005/03/07 13:20:03 henning Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Markus Friedl. All rights reserved. 6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 7 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 8 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 %{ 31 #include <sys/types.h> 32 #include <sys/socket.h> 33 #include <net/if.h> 34 #include <netinet/in.h> 35 #include <netinet/in_systm.h> 36 #include <netinet/ip.h> 37 #include <netinet/ip_icmp.h> 38 #include <netinet/icmp6.h> 39 #include <net/pfvar.h> 40 #include <arpa/inet.h> 41 #include <altq/altq.h> 42 #include <altq/altq_cbq.h> 43 #include <altq/altq_priq.h> 44 #include <altq/altq_hfsc.h> 45 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <netdb.h> 49 #include <stdarg.h> 50 #include <errno.h> 51 #include <string.h> 52 #include <ctype.h> 53 #include <math.h> 54 #include <err.h> 55 #include <limits.h> 56 #include <pwd.h> 57 #include <grp.h> 58 #include <md5.h> 59 60 #include "pfctl_parser.h" 61 #include "pfctl.h" 62 63 static struct pfctl *pf = NULL; 64 static FILE *fin = NULL; 65 static int debug = 0; 66 static int lineno = 1; 67 static int errors = 0; 68 static int rulestate = 0; 69 static u_int16_t returnicmpdefault = 70 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 71 static u_int16_t returnicmp6default = 72 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 73 static int blockpolicy = PFRULE_DROP; 74 static int require_order = 1; 75 static int default_statelock; 76 77 enum { 78 PFCTL_STATE_NONE, 79 PFCTL_STATE_OPTION, 80 PFCTL_STATE_SCRUB, 81 PFCTL_STATE_QUEUE, 82 PFCTL_STATE_NAT, 83 PFCTL_STATE_FILTER 84 }; 85 86 struct node_proto { 87 u_int8_t proto; 88 struct node_proto *next; 89 struct node_proto *tail; 90 }; 91 92 struct node_port { 93 u_int16_t port[2]; 94 u_int8_t op; 95 struct node_port *next; 96 struct node_port *tail; 97 }; 98 99 struct node_uid { 100 uid_t uid[2]; 101 u_int8_t op; 102 struct node_uid *next; 103 struct node_uid *tail; 104 }; 105 106 struct node_gid { 107 gid_t gid[2]; 108 u_int8_t op; 109 struct node_gid *next; 110 struct node_gid *tail; 111 }; 112 113 struct node_icmp { 114 u_int8_t code; 115 u_int8_t type; 116 u_int8_t proto; 117 struct node_icmp *next; 118 struct node_icmp *tail; 119 }; 120 121 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 122 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, 123 PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, 124 PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, 125 PF_STATE_OPT_TIMEOUT }; 126 127 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 128 129 struct node_state_opt { 130 int type; 131 union { 132 u_int32_t max_states; 133 u_int32_t max_src_states; 134 u_int32_t max_src_conn; 135 struct { 136 u_int32_t limit; 137 u_int32_t seconds; 138 } max_src_conn_rate; 139 struct { 140 u_int8_t flush; 141 char tblname[PF_TABLE_NAME_SIZE]; 142 } overload; 143 u_int32_t max_src_nodes; 144 u_int8_t src_track; 145 u_int32_t statelock; 146 struct { 147 int number; 148 u_int32_t seconds; 149 } timeout; 150 } data; 151 struct node_state_opt *next; 152 struct node_state_opt *tail; 153 }; 154 155 struct peer { 156 struct node_host *host; 157 struct node_port *port; 158 }; 159 160 struct node_queue { 161 char queue[PF_QNAME_SIZE]; 162 char parent[PF_QNAME_SIZE]; 163 char ifname[IFNAMSIZ]; 164 int scheduler; 165 struct node_queue *next; 166 struct node_queue *tail; 167 } *queues = NULL; 168 169 struct node_qassign { 170 char *qname; 171 char *pqname; 172 }; 173 174 struct filter_opts { 175 int marker; 176 #define FOM_FLAGS 0x01 177 #define FOM_ICMP 0x02 178 #define FOM_TOS 0x04 179 #define FOM_KEEP 0x08 180 #define FOM_SRCTRACK 0x10 181 struct node_uid *uid; 182 struct node_gid *gid; 183 struct { 184 u_int8_t b1; 185 u_int8_t b2; 186 u_int16_t w; 187 u_int16_t w2; 188 } flags; 189 struct node_icmp *icmpspec; 190 u_int32_t tos; 191 u_int32_t prob; 192 struct { 193 int action; 194 struct node_state_opt *options; 195 } keep; 196 int fragment; 197 int allowopts; 198 char *label; 199 struct node_qassign queues; 200 char *tag; 201 char *match_tag; 202 u_int8_t match_tag_not; 203 } filter_opts; 204 205 struct antispoof_opts { 206 char *label; 207 } antispoof_opts; 208 209 struct scrub_opts { 210 int marker; 211 #define SOM_MINTTL 0x01 212 #define SOM_MAXMSS 0x02 213 #define SOM_FRAGCACHE 0x04 214 int nodf; 215 int minttl; 216 int maxmss; 217 int fragcache; 218 int randomid; 219 int reassemble_tcp; 220 } scrub_opts; 221 222 struct queue_opts { 223 int marker; 224 #define QOM_BWSPEC 0x01 225 #define QOM_SCHEDULER 0x02 226 #define QOM_PRIORITY 0x04 227 #define QOM_TBRSIZE 0x08 228 #define QOM_QLIMIT 0x10 229 struct node_queue_bw queue_bwspec; 230 struct node_queue_opt scheduler; 231 int priority; 232 int tbrsize; 233 int qlimit; 234 } queue_opts; 235 236 struct table_opts { 237 int flags; 238 int init_addr; 239 struct node_tinithead init_nodes; 240 } table_opts; 241 242 struct pool_opts { 243 int marker; 244 #define POM_TYPE 0x01 245 #define POM_STICKYADDRESS 0x02 246 u_int8_t opts; 247 int type; 248 int staticport; 249 struct pf_poolhashkey *key; 250 251 } pool_opts; 252 253 254 struct node_hfsc_opts hfsc_opts; 255 256 int yyerror(const char *, ...); 257 int disallow_table(struct node_host *, const char *); 258 int disallow_alias(struct node_host *, const char *); 259 int rule_consistent(struct pf_rule *); 260 int filter_consistent(struct pf_rule *); 261 int nat_consistent(struct pf_rule *); 262 int rdr_consistent(struct pf_rule *); 263 int process_tabledef(char *, struct table_opts *); 264 int yyparse(void); 265 void expand_label_str(char *, size_t, const char *, const char *); 266 void expand_label_if(const char *, char *, size_t, const char *); 267 void expand_label_addr(const char *, char *, size_t, u_int8_t, 268 struct node_host *); 269 void expand_label_port(const char *, char *, size_t, struct node_port *); 270 void expand_label_proto(const char *, char *, size_t, u_int8_t); 271 void expand_label_nr(const char *, char *, size_t); 272 void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 273 struct node_port *, struct node_host *, struct node_port *, 274 u_int8_t); 275 void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 276 struct node_proto *, struct node_os*, struct node_host *, 277 struct node_port *, struct node_host *, struct node_port *, 278 struct node_uid *, struct node_gid *, struct node_icmp *, 279 const char *); 280 int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 281 struct node_queue_bw bwspec, struct node_queue_opt *); 282 int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 283 struct node_queue_bw, struct node_queue_opt *); 284 int expand_skip_interface(struct node_if *); 285 286 int check_rulestate(int); 287 int kw_cmp(const void *, const void *); 288 int lookup(char *); 289 int lgetc(FILE *); 290 int lungetc(int); 291 int findeol(void); 292 int yylex(void); 293 int atoul(char *, u_long *); 294 int getservice(char *); 295 int rule_label(struct pf_rule *, char *); 296 297 TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 298 struct sym { 299 TAILQ_ENTRY(sym) entries; 300 int used; 301 int persist; 302 char *nam; 303 char *val; 304 }; 305 306 307 int symset(const char *, const char *, int); 308 char *symget(const char *); 309 310 void decide_address_family(struct node_host *, sa_family_t *); 311 void remove_invalid_hosts(struct node_host **, sa_family_t *); 312 int invalid_redirect(struct node_host *, sa_family_t); 313 u_int16_t parseicmpspec(char *, sa_family_t); 314 315 TAILQ_HEAD(loadanchorshead, loadanchors) 316 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 317 318 struct loadanchors { 319 TAILQ_ENTRY(loadanchors) entries; 320 char *anchorname; 321 char *filename; 322 }; 323 324 typedef struct { 325 union { 326 u_int32_t number; 327 int i; 328 char *string; 329 struct { 330 u_int8_t b1; 331 u_int8_t b2; 332 u_int16_t w; 333 u_int16_t w2; 334 } b; 335 struct range { 336 int a; 337 int b; 338 int t; 339 } range; 340 struct node_if *interface; 341 struct node_proto *proto; 342 struct node_icmp *icmp; 343 struct node_host *host; 344 struct node_os *os; 345 struct node_port *port; 346 struct node_uid *uid; 347 struct node_gid *gid; 348 struct node_state_opt *state_opt; 349 struct peer peer; 350 struct { 351 struct peer src, dst; 352 struct node_os *src_os; 353 } fromto; 354 struct { 355 struct node_host *host; 356 u_int8_t rt; 357 u_int8_t pool_opts; 358 sa_family_t af; 359 struct pf_poolhashkey *key; 360 } route; 361 struct redirection { 362 struct node_host *host; 363 struct range rport; 364 } *redirection; 365 struct { 366 int action; 367 struct node_state_opt *options; 368 } keep_state; 369 struct { 370 u_int8_t log; 371 u_int8_t quick; 372 } logquick; 373 struct { 374 int neg; 375 char *name; 376 } tagged; 377 struct pf_poolhashkey *hashkey; 378 struct node_queue *queue; 379 struct node_queue_opt queue_options; 380 struct node_queue_bw queue_bwspec; 381 struct node_qassign qassign; 382 struct filter_opts filter_opts; 383 struct antispoof_opts antispoof_opts; 384 struct queue_opts queue_opts; 385 struct scrub_opts scrub_opts; 386 struct table_opts table_opts; 387 struct pool_opts pool_opts; 388 struct node_hfsc_opts hfsc_opts; 389 } v; 390 int lineno; 391 } YYSTYPE; 392 393 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 394 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 395 !isdigit((unsigned char)(addr).v.ifname[strlen((addr).v.ifname)-1]))) 396 397 %} 398 399 %token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS 400 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 401 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 402 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 403 %token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 404 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 405 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 406 %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID 407 %token ANTISPOOF FOR 408 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY 409 %token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 410 %token QUEUE PRIORITY QLIMIT 411 %token LOAD 412 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 413 %token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH 414 %token TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY ROUTE 415 %token <v.string> STRING 416 %token <v.i> PORTBINARY 417 %type <v.interface> interface if_list if_item_not if_item 418 %type <v.number> number icmptype icmp6type uid gid 419 %type <v.number> tos not yesno natpass 420 %type <v.i> no dir log af fragcache sourcetrack flush 421 %type <v.i> unaryop statelock 422 %type <v.b> action nataction scrubaction 423 %type <v.b> flags flag blockspec 424 %type <v.range> port rport 425 %type <v.hashkey> hashkey 426 %type <v.proto> proto proto_list proto_item 427 %type <v.icmp> icmpspec 428 %type <v.icmp> icmp_list icmp_item 429 %type <v.icmp> icmp6_list icmp6_item 430 %type <v.fromto> fromto 431 %type <v.peer> ipportspec from to 432 %type <v.host> ipspec xhost host dynaddr host_list 433 %type <v.host> redir_host_list redirspec 434 %type <v.host> route_host route_host_list routespec 435 %type <v.os> os xos os_list 436 %type <v.port> portspec port_list port_item 437 %type <v.uid> uids uid_list uid_item 438 %type <v.gid> gids gid_list gid_item 439 %type <v.route> route 440 %type <v.redirection> redirection redirpool 441 %type <v.string> label string tag 442 %type <v.keep_state> keep 443 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 444 %type <v.state_opt> opt_statelock 445 %type <v.logquick> logquick 446 %type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if 447 %type <v.qassign> qname 448 %type <v.queue> qassign qassign_list qassign_item 449 %type <v.queue_options> scheduler 450 %type <v.number> cbqflags_list cbqflags_item 451 %type <v.number> priqflags_list priqflags_item 452 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 453 %type <v.queue_bwspec> bandwidth 454 %type <v.filter_opts> filter_opts filter_opt filter_opts_l 455 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 456 %type <v.queue_opts> queue_opts queue_opt queue_opts_l 457 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 458 %type <v.table_opts> table_opts table_opt table_opts_l 459 %type <v.pool_opts> pool_opts pool_opt pool_opts_l 460 %type <v.tagged> tagged 461 %% 462 463 ruleset : /* empty */ 464 | ruleset '\n' 465 | ruleset option '\n' 466 | ruleset scrubrule '\n' 467 | ruleset natrule '\n' 468 | ruleset binatrule '\n' 469 | ruleset pfrule '\n' 470 | ruleset anchorrule '\n' 471 | ruleset loadrule '\n' 472 | ruleset altqif '\n' 473 | ruleset queuespec '\n' 474 | ruleset varset '\n' 475 | ruleset antispoof '\n' 476 | ruleset tabledef '\n' 477 | ruleset error '\n' { errors++; } 478 ; 479 480 option : SET OPTIMIZATION STRING { 481 if (check_rulestate(PFCTL_STATE_OPTION)) { 482 free($3); 483 YYERROR; 484 } 485 if (pfctl_set_optimization(pf, $3) != 0) { 486 yyerror("unknown optimization %s", $3); 487 free($3); 488 YYERROR; 489 } 490 free ($3); 491 } 492 | SET TIMEOUT timeout_spec 493 | SET TIMEOUT '{' timeout_list '}' 494 | SET LIMIT limit_spec 495 | SET LIMIT '{' limit_list '}' 496 | SET LOGINTERFACE STRING { 497 if (check_rulestate(PFCTL_STATE_OPTION)) { 498 free($3); 499 YYERROR; 500 } 501 if (pfctl_set_logif(pf, $3) != 0) { 502 yyerror("error setting loginterface %s", $3); 503 free($3); 504 YYERROR; 505 } 506 free($3); 507 } 508 | SET HOSTID number { 509 if ($3 == 0) { 510 yyerror("hostid must be non-zero"); 511 YYERROR; 512 } 513 if (pfctl_set_hostid(pf, $3) != 0) { 514 yyerror("error setting hostid %08x", $3); 515 YYERROR; 516 } 517 } 518 | SET BLOCKPOLICY DROP { 519 if (pf->opts & PF_OPT_VERBOSE) 520 printf("set block-policy drop\n"); 521 if (check_rulestate(PFCTL_STATE_OPTION)) 522 YYERROR; 523 blockpolicy = PFRULE_DROP; 524 } 525 | SET BLOCKPOLICY RETURN { 526 if (pf->opts & PF_OPT_VERBOSE) 527 printf("set block-policy return\n"); 528 if (check_rulestate(PFCTL_STATE_OPTION)) 529 YYERROR; 530 blockpolicy = PFRULE_RETURN; 531 } 532 | SET REQUIREORDER yesno { 533 if (pf->opts & PF_OPT_VERBOSE) 534 printf("set require-order %s\n", 535 $3 == 1 ? "yes" : "no"); 536 require_order = $3; 537 } 538 | SET FINGERPRINTS STRING { 539 if (pf->opts & PF_OPT_VERBOSE) 540 printf("set fingerprints %s\n", $3); 541 if (check_rulestate(PFCTL_STATE_OPTION)) { 542 free($3); 543 YYERROR; 544 } 545 if (!pf->anchor[0]) { 546 if (pfctl_file_fingerprints(pf->dev, 547 pf->opts, $3)) { 548 yyerror("error loading " 549 "fingerprints %s", $3); 550 free($3); 551 YYERROR; 552 } 553 } 554 free($3); 555 } 556 | SET STATEPOLICY statelock { 557 if (pf->opts & PF_OPT_VERBOSE) 558 switch ($3) { 559 case 0: 560 printf("set state-policy floating\n"); 561 break; 562 case PFRULE_IFBOUND: 563 printf("set state-policy if-bound\n"); 564 break; 565 case PFRULE_GRBOUND: 566 printf("set state-policy " 567 "group-bound\n"); 568 break; 569 } 570 default_statelock = $3; 571 } 572 | SET DEBUG STRING { 573 if (check_rulestate(PFCTL_STATE_OPTION)) { 574 free($3); 575 YYERROR; 576 } 577 if (pfctl_set_debug(pf, $3) != 0) { 578 yyerror("error setting debuglevel %s", $3); 579 free($3); 580 YYERROR; 581 } 582 free($3); 583 } 584 | SET SKIP interface { 585 if (expand_skip_interface($3) != 0) { 586 yyerror("error setting skip interface(s)"); 587 YYERROR; 588 } 589 } 590 ; 591 592 string : string STRING { 593 if (asprintf(&$$, "%s %s", $1, $2) == -1) 594 err(1, "string: asprintf"); 595 free($1); 596 free($2); 597 } 598 | STRING 599 ; 600 601 varset : STRING '=' string { 602 if (pf->opts & PF_OPT_VERBOSE) 603 printf("%s = \"%s\"\n", $1, $3); 604 if (symset($1, $3, 0) == -1) 605 err(1, "cannot store variable %s", $1); 606 free($1); 607 free($3); 608 } 609 ; 610 611 anchorrule : ANCHOR string dir interface af proto fromto filter_opts { 612 struct pf_rule r; 613 614 if (check_rulestate(PFCTL_STATE_FILTER)) { 615 free($2); 616 YYERROR; 617 } 618 619 memset(&r, 0, sizeof(r)); 620 r.direction = $3; 621 r.af = $5; 622 r.prob = $8.prob; 623 624 if ($8.match_tag) 625 if (strlcpy(r.match_tagname, $8.match_tag, 626 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 627 yyerror("tag too long, max %u chars", 628 PF_TAG_NAME_SIZE - 1); 629 YYERROR; 630 } 631 r.match_tag_not = $8.match_tag_not; 632 633 decide_address_family($7.src.host, &r.af); 634 decide_address_family($7.dst.host, &r.af); 635 636 expand_rule(&r, $4, NULL, $6, $7.src_os, 637 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 638 0, 0, 0, $2); 639 free($2); 640 } 641 | NATANCHOR string interface af proto fromto { 642 struct pf_rule r; 643 644 if (check_rulestate(PFCTL_STATE_NAT)) { 645 free($2); 646 YYERROR; 647 } 648 649 memset(&r, 0, sizeof(r)); 650 r.action = PF_NAT; 651 r.af = $4; 652 653 decide_address_family($6.src.host, &r.af); 654 decide_address_family($6.dst.host, &r.af); 655 656 expand_rule(&r, $3, NULL, $5, $6.src_os, 657 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 658 0, 0, 0, $2); 659 free($2); 660 } 661 | RDRANCHOR string interface af proto fromto { 662 struct pf_rule r; 663 664 if (check_rulestate(PFCTL_STATE_NAT)) { 665 free($2); 666 YYERROR; 667 } 668 669 memset(&r, 0, sizeof(r)); 670 r.action = PF_RDR; 671 r.af = $4; 672 673 decide_address_family($6.src.host, &r.af); 674 decide_address_family($6.dst.host, &r.af); 675 676 if ($6.src.port != NULL) { 677 yyerror("source port parameter not supported" 678 " in rdr-anchor"); 679 YYERROR; 680 } 681 if ($6.dst.port != NULL) { 682 if ($6.dst.port->next != NULL) { 683 yyerror("destination port list " 684 "expansion not supported in " 685 "rdr-anchor"); 686 YYERROR; 687 } else if ($6.dst.port->op != PF_OP_EQ) { 688 yyerror("destination port operators" 689 " not supported in rdr-anchor"); 690 YYERROR; 691 } 692 r.dst.port[0] = $6.dst.port->port[0]; 693 r.dst.port[1] = $6.dst.port->port[1]; 694 r.dst.port_op = $6.dst.port->op; 695 } 696 697 expand_rule(&r, $3, NULL, $5, $6.src_os, 698 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 699 0, 0, 0, $2); 700 free($2); 701 } 702 | BINATANCHOR string interface af proto fromto { 703 struct pf_rule r; 704 705 if (check_rulestate(PFCTL_STATE_NAT)) { 706 free($2); 707 YYERROR; 708 } 709 710 memset(&r, 0, sizeof(r)); 711 r.action = PF_BINAT; 712 r.af = $4; 713 if ($5 != NULL) { 714 if ($5->next != NULL) { 715 yyerror("proto list expansion" 716 " not supported in binat-anchor"); 717 YYERROR; 718 } 719 r.proto = $5->proto; 720 free($5); 721 } 722 723 if ($6.src.host != NULL || $6.src.port != NULL || 724 $6.dst.host != NULL || $6.dst.port != NULL) { 725 yyerror("fromto parameter not supported" 726 " in binat-anchor"); 727 YYERROR; 728 } 729 730 decide_address_family($6.src.host, &r.af); 731 decide_address_family($6.dst.host, &r.af); 732 733 pfctl_add_rule(pf, &r, $2); 734 free($2); 735 } 736 ; 737 738 loadrule : LOAD ANCHOR string FROM string { 739 struct loadanchors *loadanchor; 740 741 if (strlen($3) >= MAXPATHLEN) { 742 yyerror("anchorname %s too long, max %u\n", 743 $3, MAXPATHLEN - 1); 744 free($3); 745 YYERROR; 746 } 747 loadanchor = calloc(1, sizeof(struct loadanchors)); 748 if (loadanchor == NULL) 749 err(1, "loadrule: calloc"); 750 if ((loadanchor->anchorname = strdup($3)) == NULL) 751 err(1, "loadrule: strdup"); 752 if ((loadanchor->filename = strdup($5)) == NULL) 753 err(1, "loadrule: strdup"); 754 755 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 756 entries); 757 758 free($3); 759 free($5); 760 }; 761 762 scrubaction : no SCRUB { 763 $$.b2 = $$.w = 0; 764 if ($1) 765 $$.b1 = PF_NOSCRUB; 766 else 767 $$.b1 = PF_SCRUB; 768 } 769 ; 770 771 scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts 772 { 773 struct pf_rule r; 774 775 if (check_rulestate(PFCTL_STATE_SCRUB)) 776 YYERROR; 777 778 memset(&r, 0, sizeof(r)); 779 780 r.action = $1.b1; 781 r.direction = $2; 782 783 r.log = $3.log; 784 if ($3.quick) { 785 yyerror("scrub rules do not support 'quick'"); 786 YYERROR; 787 } 788 789 r.af = $5; 790 if ($8.nodf) 791 r.rule_flag |= PFRULE_NODF; 792 if ($8.randomid) 793 r.rule_flag |= PFRULE_RANDOMID; 794 if ($8.reassemble_tcp) { 795 if (r.direction != PF_INOUT) { 796 yyerror("reassemble tcp rules can not " 797 "specify direction"); 798 YYERROR; 799 } 800 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 801 } 802 if ($8.minttl) 803 r.min_ttl = $8.minttl; 804 if ($8.maxmss) 805 r.max_mss = $8.maxmss; 806 if ($8.fragcache) 807 r.rule_flag |= $8.fragcache; 808 809 expand_rule(&r, $4, NULL, $6, $7.src_os, 810 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 811 NULL, NULL, NULL, ""); 812 } 813 ; 814 815 scrub_opts : { 816 bzero(&scrub_opts, sizeof scrub_opts); 817 } 818 scrub_opts_l 819 { $$ = scrub_opts; } 820 | /* empty */ { 821 bzero(&scrub_opts, sizeof scrub_opts); 822 $$ = scrub_opts; 823 } 824 ; 825 826 scrub_opts_l : scrub_opts_l scrub_opt 827 | scrub_opt 828 ; 829 830 scrub_opt : NODF { 831 if (scrub_opts.nodf) { 832 yyerror("no-df cannot be respecified"); 833 YYERROR; 834 } 835 scrub_opts.nodf = 1; 836 } 837 | MINTTL number { 838 if (scrub_opts.marker & SOM_MINTTL) { 839 yyerror("min-ttl cannot be respecified"); 840 YYERROR; 841 } 842 if ($2 > 255) { 843 yyerror("illegal min-ttl value %d", $2); 844 YYERROR; 845 } 846 scrub_opts.marker |= SOM_MINTTL; 847 scrub_opts.minttl = $2; 848 } 849 | MAXMSS number { 850 if (scrub_opts.marker & SOM_MAXMSS) { 851 yyerror("max-mss cannot be respecified"); 852 YYERROR; 853 } 854 if ($2 > 65535) { 855 yyerror("illegal max-mss value %d", $2); 856 YYERROR; 857 } 858 scrub_opts.marker |= SOM_MAXMSS; 859 scrub_opts.maxmss = $2; 860 } 861 | fragcache { 862 if (scrub_opts.marker & SOM_FRAGCACHE) { 863 yyerror("fragcache cannot be respecified"); 864 YYERROR; 865 } 866 scrub_opts.marker |= SOM_FRAGCACHE; 867 scrub_opts.fragcache = $1; 868 } 869 | REASSEMBLE STRING { 870 if (strcasecmp($2, "tcp") != 0) { 871 yyerror("scrub reassemble supports only tcp, " 872 "not '%s'", $2); 873 free($2); 874 YYERROR; 875 } 876 free($2); 877 if (scrub_opts.reassemble_tcp) { 878 yyerror("reassemble tcp cannot be respecified"); 879 YYERROR; 880 } 881 scrub_opts.reassemble_tcp = 1; 882 } 883 | RANDOMID { 884 if (scrub_opts.randomid) { 885 yyerror("random-id cannot be respecified"); 886 YYERROR; 887 } 888 scrub_opts.randomid = 1; 889 } 890 ; 891 892 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 893 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 894 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 895 ; 896 897 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 898 struct pf_rule r; 899 struct node_host *h = NULL, *hh; 900 struct node_if *i, *j; 901 902 if (check_rulestate(PFCTL_STATE_FILTER)) 903 YYERROR; 904 905 for (i = $3; i; i = i->next) { 906 bzero(&r, sizeof(r)); 907 908 r.action = PF_DROP; 909 r.direction = PF_IN; 910 r.log = $2.log; 911 r.quick = $2.quick; 912 r.af = $4; 913 if (rule_label(&r, $5.label)) 914 YYERROR; 915 j = calloc(1, sizeof(struct node_if)); 916 if (j == NULL) 917 err(1, "antispoof: calloc"); 918 if (strlcpy(j->ifname, i->ifname, 919 sizeof(j->ifname)) >= sizeof(j->ifname)) { 920 free(j); 921 yyerror("interface name too long"); 922 YYERROR; 923 } 924 j->not = 1; 925 if (i->dynamic) { 926 h = calloc(1, sizeof(*h)); 927 if (h == NULL) 928 err(1, "address: calloc"); 929 h->addr.type = PF_ADDR_DYNIFTL; 930 set_ipmask(h, 128); 931 if (strlcpy(h->addr.v.ifname, i->ifname, 932 sizeof(h->addr.v.ifname)) >= 933 sizeof(h->addr.v.ifname)) { 934 free(h); 935 yyerror( 936 "interface name too long"); 937 YYERROR; 938 } 939 hh = malloc(sizeof(*hh)); 940 if (hh == NULL) 941 err(1, "address: malloc"); 942 bcopy(h, hh, sizeof(*hh)); 943 h->addr.iflags = PFI_AFLAG_NETWORK; 944 } else { 945 h = ifa_lookup(j->ifname, 946 PFI_AFLAG_NETWORK); 947 hh = NULL; 948 } 949 950 if (h != NULL) 951 expand_rule(&r, j, NULL, NULL, NULL, h, 952 NULL, NULL, NULL, NULL, NULL, 953 NULL, ""); 954 955 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 956 bzero(&r, sizeof(r)); 957 958 r.action = PF_DROP; 959 r.direction = PF_IN; 960 r.log = $2.log; 961 r.quick = $2.quick; 962 r.af = $4; 963 if (rule_label(&r, $5.label)) 964 YYERROR; 965 if (hh != NULL) 966 h = hh; 967 else 968 h = ifa_lookup(i->ifname, 0); 969 if (h != NULL) 970 expand_rule(&r, NULL, NULL, 971 NULL, NULL, h, NULL, NULL, 972 NULL, NULL, NULL, NULL, ""); 973 } else 974 free(hh); 975 } 976 free($5.label); 977 } 978 ; 979 980 antispoof_ifspc : FOR antispoof_if { $$ = $2; } 981 | FOR '{' antispoof_iflst '}' { $$ = $3; } 982 ; 983 984 antispoof_iflst : antispoof_if { $$ = $1; } 985 | antispoof_iflst comma antispoof_if { 986 $1->tail->next = $3; 987 $1->tail = $3; 988 $$ = $1; 989 } 990 ; 991 992 antispoof_if : if_item { $$ = $1; } 993 | '(' if_item ')' { 994 $2->dynamic = 1; 995 $$ = $2; 996 } 997 ; 998 999 antispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 1000 antispoof_opts_l 1001 { $$ = antispoof_opts; } 1002 | /* empty */ { 1003 bzero(&antispoof_opts, sizeof antispoof_opts); 1004 $$ = antispoof_opts; 1005 } 1006 ; 1007 1008 antispoof_opts_l : antispoof_opts_l antispoof_opt 1009 | antispoof_opt 1010 ; 1011 1012 antispoof_opt : label { 1013 if (antispoof_opts.label) { 1014 yyerror("label cannot be redefined"); 1015 YYERROR; 1016 } 1017 antispoof_opts.label = $1; 1018 } 1019 ; 1020 1021 not : '!' { $$ = 1; } 1022 | /* empty */ { $$ = 0; } 1023 ; 1024 1025 tabledef : TABLE '<' STRING '>' table_opts { 1026 struct node_host *h, *nh; 1027 struct node_tinit *ti, *nti; 1028 1029 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 1030 yyerror("table name too long, max %d chars", 1031 PF_TABLE_NAME_SIZE - 1); 1032 free($3); 1033 YYERROR; 1034 } 1035 if (pf->loadopt & PFCTL_FLAG_TABLE) 1036 if (process_tabledef($3, &$5)) { 1037 free($3); 1038 YYERROR; 1039 } 1040 free($3); 1041 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 1042 ti != NULL; ti = nti) { 1043 if (ti->file) 1044 free(ti->file); 1045 for (h = ti->host; h != NULL; h = nh) { 1046 nh = h->next; 1047 free(h); 1048 } 1049 nti = SIMPLEQ_NEXT(ti, entries); 1050 free(ti); 1051 } 1052 } 1053 ; 1054 1055 table_opts : { 1056 bzero(&table_opts, sizeof table_opts); 1057 SIMPLEQ_INIT(&table_opts.init_nodes); 1058 } 1059 table_opts_l 1060 { $$ = table_opts; } 1061 | /* empty */ 1062 { 1063 bzero(&table_opts, sizeof table_opts); 1064 SIMPLEQ_INIT(&table_opts.init_nodes); 1065 $$ = table_opts; 1066 } 1067 ; 1068 1069 table_opts_l : table_opts_l table_opt 1070 | table_opt 1071 ; 1072 1073 table_opt : STRING { 1074 if (!strcmp($1, "const")) 1075 table_opts.flags |= PFR_TFLAG_CONST; 1076 else if (!strcmp($1, "persist")) 1077 table_opts.flags |= PFR_TFLAG_PERSIST; 1078 else { 1079 yyerror("invalid table option '%s'", $1); 1080 free($1); 1081 YYERROR; 1082 } 1083 free($1); 1084 } 1085 | '{' '}' { table_opts.init_addr = 1; } 1086 | '{' host_list '}' { 1087 struct node_host *n; 1088 struct node_tinit *ti; 1089 1090 for (n = $2; n != NULL; n = n->next) { 1091 switch (n->addr.type) { 1092 case PF_ADDR_ADDRMASK: 1093 continue; /* ok */ 1094 case PF_ADDR_DYNIFTL: 1095 yyerror("dynamic addresses are not " 1096 "permitted inside tables"); 1097 break; 1098 case PF_ADDR_TABLE: 1099 yyerror("tables cannot contain tables"); 1100 break; 1101 case PF_ADDR_NOROUTE: 1102 yyerror("\"no-route\" is not permitted " 1103 "inside tables"); 1104 break; 1105 default: 1106 yyerror("unknown address type %d", 1107 n->addr.type); 1108 } 1109 YYERROR; 1110 } 1111 if (!(ti = calloc(1, sizeof(*ti)))) 1112 err(1, "table_opt: calloc"); 1113 ti->host = $2; 1114 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1115 entries); 1116 table_opts.init_addr = 1; 1117 } 1118 | FILENAME STRING { 1119 struct node_tinit *ti; 1120 1121 if (!(ti = calloc(1, sizeof(*ti)))) 1122 err(1, "table_opt: calloc"); 1123 ti->file = $2; 1124 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1125 entries); 1126 table_opts.init_addr = 1; 1127 } 1128 ; 1129 1130 altqif : ALTQ interface queue_opts QUEUE qassign { 1131 struct pf_altq a; 1132 1133 if (check_rulestate(PFCTL_STATE_QUEUE)) 1134 YYERROR; 1135 1136 memset(&a, 0, sizeof(a)); 1137 if ($3.scheduler.qtype == ALTQT_NONE) { 1138 yyerror("no scheduler specified!"); 1139 YYERROR; 1140 } 1141 a.scheduler = $3.scheduler.qtype; 1142 a.qlimit = $3.qlimit; 1143 a.tbrsize = $3.tbrsize; 1144 if ($5 == NULL) { 1145 yyerror("no child queues specified"); 1146 YYERROR; 1147 } 1148 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1149 &$3.scheduler)) 1150 YYERROR; 1151 } 1152 ; 1153 1154 queuespec : QUEUE STRING interface queue_opts qassign { 1155 struct pf_altq a; 1156 1157 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1158 free($2); 1159 YYERROR; 1160 } 1161 1162 memset(&a, 0, sizeof(a)); 1163 1164 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1165 sizeof(a.qname)) { 1166 yyerror("queue name too long (max " 1167 "%d chars)", PF_QNAME_SIZE-1); 1168 free($2); 1169 YYERROR; 1170 } 1171 free($2); 1172 if ($4.tbrsize) { 1173 yyerror("cannot specify tbrsize for queue"); 1174 YYERROR; 1175 } 1176 if ($4.priority > 255) { 1177 yyerror("priority out of range: max 255"); 1178 YYERROR; 1179 } 1180 a.priority = $4.priority; 1181 a.qlimit = $4.qlimit; 1182 a.scheduler = $4.scheduler.qtype; 1183 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1184 &$4.scheduler)) { 1185 yyerror("errors in queue definition"); 1186 YYERROR; 1187 } 1188 } 1189 ; 1190 1191 queue_opts : { 1192 bzero(&queue_opts, sizeof queue_opts); 1193 queue_opts.priority = DEFAULT_PRIORITY; 1194 queue_opts.qlimit = DEFAULT_QLIMIT; 1195 queue_opts.scheduler.qtype = ALTQT_NONE; 1196 queue_opts.queue_bwspec.bw_percent = 100; 1197 } 1198 queue_opts_l 1199 { $$ = queue_opts; } 1200 | /* empty */ { 1201 bzero(&queue_opts, sizeof queue_opts); 1202 queue_opts.priority = DEFAULT_PRIORITY; 1203 queue_opts.qlimit = DEFAULT_QLIMIT; 1204 queue_opts.scheduler.qtype = ALTQT_NONE; 1205 queue_opts.queue_bwspec.bw_percent = 100; 1206 $$ = queue_opts; 1207 } 1208 ; 1209 1210 queue_opts_l : queue_opts_l queue_opt 1211 | queue_opt 1212 ; 1213 1214 queue_opt : BANDWIDTH bandwidth { 1215 if (queue_opts.marker & QOM_BWSPEC) { 1216 yyerror("bandwidth cannot be respecified"); 1217 YYERROR; 1218 } 1219 queue_opts.marker |= QOM_BWSPEC; 1220 queue_opts.queue_bwspec = $2; 1221 } 1222 | PRIORITY number { 1223 if (queue_opts.marker & QOM_PRIORITY) { 1224 yyerror("priority cannot be respecified"); 1225 YYERROR; 1226 } 1227 if ($2 > 255) { 1228 yyerror("priority out of range: max 255"); 1229 YYERROR; 1230 } 1231 queue_opts.marker |= QOM_PRIORITY; 1232 queue_opts.priority = $2; 1233 } 1234 | QLIMIT number { 1235 if (queue_opts.marker & QOM_QLIMIT) { 1236 yyerror("qlimit cannot be respecified"); 1237 YYERROR; 1238 } 1239 if ($2 > 65535) { 1240 yyerror("qlimit out of range: max 65535"); 1241 YYERROR; 1242 } 1243 queue_opts.marker |= QOM_QLIMIT; 1244 queue_opts.qlimit = $2; 1245 } 1246 | scheduler { 1247 if (queue_opts.marker & QOM_SCHEDULER) { 1248 yyerror("scheduler cannot be respecified"); 1249 YYERROR; 1250 } 1251 queue_opts.marker |= QOM_SCHEDULER; 1252 queue_opts.scheduler = $1; 1253 } 1254 | TBRSIZE number { 1255 if (queue_opts.marker & QOM_TBRSIZE) { 1256 yyerror("tbrsize cannot be respecified"); 1257 YYERROR; 1258 } 1259 if ($2 > 65535) { 1260 yyerror("tbrsize too big: max 65535"); 1261 YYERROR; 1262 } 1263 queue_opts.marker |= QOM_TBRSIZE; 1264 queue_opts.tbrsize = $2; 1265 } 1266 ; 1267 1268 bandwidth : STRING { 1269 double bps; 1270 char *cp; 1271 1272 $$.bw_percent = 0; 1273 1274 bps = strtod($1, &cp); 1275 if (cp != NULL) { 1276 if (!strcmp(cp, "b")) 1277 ; /* nothing */ 1278 else if (!strcmp(cp, "Kb")) 1279 bps *= 1000; 1280 else if (!strcmp(cp, "Mb")) 1281 bps *= 1000 * 1000; 1282 else if (!strcmp(cp, "Gb")) 1283 bps *= 1000 * 1000 * 1000; 1284 else if (!strcmp(cp, "%")) { 1285 if (bps < 0 || bps > 100) { 1286 yyerror("bandwidth spec " 1287 "out of range"); 1288 free($1); 1289 YYERROR; 1290 } 1291 $$.bw_percent = bps; 1292 bps = 0; 1293 } else { 1294 yyerror("unknown unit %s", cp); 1295 free($1); 1296 YYERROR; 1297 } 1298 } 1299 free($1); 1300 $$.bw_absolute = (u_int32_t)bps; 1301 } 1302 ; 1303 1304 scheduler : CBQ { 1305 $$.qtype = ALTQT_CBQ; 1306 $$.data.cbq_opts.flags = 0; 1307 } 1308 | CBQ '(' cbqflags_list ')' { 1309 $$.qtype = ALTQT_CBQ; 1310 $$.data.cbq_opts.flags = $3; 1311 } 1312 | PRIQ { 1313 $$.qtype = ALTQT_PRIQ; 1314 $$.data.priq_opts.flags = 0; 1315 } 1316 | PRIQ '(' priqflags_list ')' { 1317 $$.qtype = ALTQT_PRIQ; 1318 $$.data.priq_opts.flags = $3; 1319 } 1320 | HFSC { 1321 $$.qtype = ALTQT_HFSC; 1322 bzero(&$$.data.hfsc_opts, 1323 sizeof(struct node_hfsc_opts)); 1324 } 1325 | HFSC '(' hfsc_opts ')' { 1326 $$.qtype = ALTQT_HFSC; 1327 $$.data.hfsc_opts = $3; 1328 } 1329 ; 1330 1331 cbqflags_list : cbqflags_item { $$ |= $1; } 1332 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1333 ; 1334 1335 cbqflags_item : STRING { 1336 if (!strcmp($1, "default")) 1337 $$ = CBQCLF_DEFCLASS; 1338 #ifdef CBQCLF_BORROW 1339 else if (!strcmp($1, "borrow")) 1340 $$ = CBQCLF_BORROW; 1341 #endif 1342 else if (!strcmp($1, "red")) 1343 $$ = CBQCLF_RED; 1344 else if (!strcmp($1, "ecn")) 1345 $$ = CBQCLF_RED|CBQCLF_ECN; 1346 else if (!strcmp($1, "rio")) 1347 $$ = CBQCLF_RIO; 1348 else { 1349 yyerror("unknown cbq flag \"%s\"", $1); 1350 free($1); 1351 YYERROR; 1352 } 1353 free($1); 1354 } 1355 ; 1356 1357 priqflags_list : priqflags_item { $$ |= $1; } 1358 | priqflags_list comma priqflags_item { $$ |= $3; } 1359 ; 1360 1361 priqflags_item : STRING { 1362 if (!strcmp($1, "default")) 1363 $$ = PRCF_DEFAULTCLASS; 1364 else if (!strcmp($1, "red")) 1365 $$ = PRCF_RED; 1366 else if (!strcmp($1, "ecn")) 1367 $$ = PRCF_RED|PRCF_ECN; 1368 else if (!strcmp($1, "rio")) 1369 $$ = PRCF_RIO; 1370 else { 1371 yyerror("unknown priq flag \"%s\"", $1); 1372 free($1); 1373 YYERROR; 1374 } 1375 free($1); 1376 } 1377 ; 1378 1379 hfsc_opts : { 1380 bzero(&hfsc_opts, 1381 sizeof(struct node_hfsc_opts)); 1382 } 1383 hfscopts_list { 1384 $$ = hfsc_opts; 1385 } 1386 ; 1387 1388 hfscopts_list : hfscopts_item 1389 | hfscopts_list comma hfscopts_item 1390 ; 1391 1392 hfscopts_item : LINKSHARE bandwidth { 1393 if (hfsc_opts.linkshare.used) { 1394 yyerror("linkshare already specified"); 1395 YYERROR; 1396 } 1397 hfsc_opts.linkshare.m2 = $2; 1398 hfsc_opts.linkshare.used = 1; 1399 } 1400 | LINKSHARE '(' bandwidth comma number comma bandwidth ')' 1401 { 1402 if (hfsc_opts.linkshare.used) { 1403 yyerror("linkshare already specified"); 1404 YYERROR; 1405 } 1406 hfsc_opts.linkshare.m1 = $3; 1407 hfsc_opts.linkshare.d = $5; 1408 hfsc_opts.linkshare.m2 = $7; 1409 hfsc_opts.linkshare.used = 1; 1410 } 1411 | REALTIME bandwidth { 1412 if (hfsc_opts.realtime.used) { 1413 yyerror("realtime already specified"); 1414 YYERROR; 1415 } 1416 hfsc_opts.realtime.m2 = $2; 1417 hfsc_opts.realtime.used = 1; 1418 } 1419 | REALTIME '(' bandwidth comma number comma bandwidth ')' 1420 { 1421 if (hfsc_opts.realtime.used) { 1422 yyerror("realtime already specified"); 1423 YYERROR; 1424 } 1425 hfsc_opts.realtime.m1 = $3; 1426 hfsc_opts.realtime.d = $5; 1427 hfsc_opts.realtime.m2 = $7; 1428 hfsc_opts.realtime.used = 1; 1429 } 1430 | UPPERLIMIT bandwidth { 1431 if (hfsc_opts.upperlimit.used) { 1432 yyerror("upperlimit already specified"); 1433 YYERROR; 1434 } 1435 hfsc_opts.upperlimit.m2 = $2; 1436 hfsc_opts.upperlimit.used = 1; 1437 } 1438 | UPPERLIMIT '(' bandwidth comma number comma bandwidth ')' 1439 { 1440 if (hfsc_opts.upperlimit.used) { 1441 yyerror("upperlimit already specified"); 1442 YYERROR; 1443 } 1444 hfsc_opts.upperlimit.m1 = $3; 1445 hfsc_opts.upperlimit.d = $5; 1446 hfsc_opts.upperlimit.m2 = $7; 1447 hfsc_opts.upperlimit.used = 1; 1448 } 1449 | STRING { 1450 if (!strcmp($1, "default")) 1451 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1452 else if (!strcmp($1, "red")) 1453 hfsc_opts.flags |= HFCF_RED; 1454 else if (!strcmp($1, "ecn")) 1455 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1456 else if (!strcmp($1, "rio")) 1457 hfsc_opts.flags |= HFCF_RIO; 1458 else { 1459 yyerror("unknown hfsc flag \"%s\"", $1); 1460 free($1); 1461 YYERROR; 1462 } 1463 free($1); 1464 } 1465 ; 1466 1467 qassign : /* empty */ { $$ = NULL; } 1468 | qassign_item { $$ = $1; } 1469 | '{' qassign_list '}' { $$ = $2; } 1470 ; 1471 1472 qassign_list : qassign_item { $$ = $1; } 1473 | qassign_list comma qassign_item { 1474 $1->tail->next = $3; 1475 $1->tail = $3; 1476 $$ = $1; 1477 } 1478 ; 1479 1480 qassign_item : STRING { 1481 $$ = calloc(1, sizeof(struct node_queue)); 1482 if ($$ == NULL) 1483 err(1, "qassign_item: calloc"); 1484 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1485 sizeof($$->queue)) { 1486 yyerror("queue name '%s' too long (max " 1487 "%d chars)", $1, sizeof($$->queue)-1); 1488 free($1); 1489 free($$); 1490 YYERROR; 1491 } 1492 free($1); 1493 $$->next = NULL; 1494 $$->tail = $$; 1495 } 1496 ; 1497 1498 pfrule : action dir logquick interface route af proto fromto 1499 filter_opts 1500 { 1501 struct pf_rule r; 1502 struct node_state_opt *o; 1503 struct node_proto *proto; 1504 int srctrack = 0; 1505 int statelock = 0; 1506 1507 if (check_rulestate(PFCTL_STATE_FILTER)) 1508 YYERROR; 1509 1510 memset(&r, 0, sizeof(r)); 1511 1512 r.action = $1.b1; 1513 switch ($1.b2) { 1514 case PFRULE_RETURNRST: 1515 r.rule_flag |= PFRULE_RETURNRST; 1516 r.return_ttl = $1.w; 1517 break; 1518 case PFRULE_RETURNICMP: 1519 r.rule_flag |= PFRULE_RETURNICMP; 1520 r.return_icmp = $1.w; 1521 r.return_icmp6 = $1.w2; 1522 break; 1523 case PFRULE_RETURN: 1524 r.rule_flag |= PFRULE_RETURN; 1525 r.return_icmp = $1.w; 1526 r.return_icmp6 = $1.w2; 1527 break; 1528 } 1529 r.direction = $2; 1530 r.log = $3.log; 1531 r.quick = $3.quick; 1532 r.prob = $9.prob; 1533 1534 r.af = $6; 1535 if ($9.tag) 1536 if (strlcpy(r.tagname, $9.tag, 1537 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1538 yyerror("tag too long, max %u chars", 1539 PF_TAG_NAME_SIZE - 1); 1540 YYERROR; 1541 } 1542 if ($9.match_tag) 1543 if (strlcpy(r.match_tagname, $9.match_tag, 1544 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1545 yyerror("tag too long, max %u chars", 1546 PF_TAG_NAME_SIZE - 1); 1547 YYERROR; 1548 } 1549 r.match_tag_not = $9.match_tag_not; 1550 r.flags = $9.flags.b1; 1551 r.flagset = $9.flags.b2; 1552 if (rule_label(&r, $9.label)) 1553 YYERROR; 1554 free($9.label); 1555 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1556 for (proto = $7; proto != NULL && 1557 proto->proto != IPPROTO_TCP; 1558 proto = proto->next) 1559 ; /* nothing */ 1560 if (proto == NULL && $7 != NULL) { 1561 if ($9.flags.b1 || $9.flags.b2) 1562 yyerror( 1563 "flags only apply to tcp"); 1564 if ($8.src_os) 1565 yyerror( 1566 "OS fingerprinting only " 1567 "apply to tcp"); 1568 YYERROR; 1569 } 1570 #if 0 1571 if (($9.flags.b1 & parse_flags("S")) == 0 && 1572 $8.src_os) { 1573 yyerror("OS fingerprinting requires " 1574 "the SYN TCP flag (flags S/SA)"); 1575 YYERROR; 1576 } 1577 #endif 1578 } 1579 1580 r.tos = $9.tos; 1581 r.keep_state = $9.keep.action; 1582 o = $9.keep.options; 1583 while (o) { 1584 struct node_state_opt *p = o; 1585 1586 switch (o->type) { 1587 case PF_STATE_OPT_MAX: 1588 if (r.max_states) { 1589 yyerror("state option 'max' " 1590 "multiple definitions"); 1591 YYERROR; 1592 } 1593 r.max_states = o->data.max_states; 1594 break; 1595 case PF_STATE_OPT_NOSYNC: 1596 if (r.rule_flag & PFRULE_NOSYNC) { 1597 yyerror("state option 'sync' " 1598 "multiple definitions"); 1599 YYERROR; 1600 } 1601 r.rule_flag |= PFRULE_NOSYNC; 1602 break; 1603 case PF_STATE_OPT_SRCTRACK: 1604 if (srctrack) { 1605 yyerror("state option " 1606 "'source-track' " 1607 "multiple definitions"); 1608 YYERROR; 1609 } 1610 srctrack = o->data.src_track; 1611 r.rule_flag |= PFRULE_SRCTRACK; 1612 break; 1613 case PF_STATE_OPT_MAX_SRC_STATES: 1614 if (r.max_src_states) { 1615 yyerror("state option " 1616 "'max-src-states' " 1617 "multiple definitions"); 1618 YYERROR; 1619 } 1620 if (o->data.max_src_states == 0) { 1621 yyerror("'max-src-states' must " 1622 "be > 0"); 1623 YYERROR; 1624 } 1625 r.max_src_states = 1626 o->data.max_src_states; 1627 r.rule_flag |= PFRULE_SRCTRACK; 1628 break; 1629 case PF_STATE_OPT_OVERLOAD: 1630 if (r.overload_tblname[0]) { 1631 yyerror("multiple 'overload' " 1632 "table definitions"); 1633 YYERROR; 1634 } 1635 if (strlcpy(r.overload_tblname, 1636 o->data.overload.tblname, 1637 PF_TABLE_NAME_SIZE) >= 1638 PF_TABLE_NAME_SIZE) { 1639 yyerror("state option: " 1640 "strlcpy"); 1641 YYERROR; 1642 } 1643 r.flush = o->data.overload.flush; 1644 break; 1645 case PF_STATE_OPT_MAX_SRC_CONN: 1646 if (r.max_src_conn) { 1647 yyerror("state option " 1648 "'max-src-conn' " 1649 "multiple definitions"); 1650 YYERROR; 1651 } 1652 if (o->data.max_src_conn == 0) { 1653 yyerror("'max-src-conn' " 1654 "must be > 0"); 1655 YYERROR; 1656 } 1657 r.max_src_conn = 1658 o->data.max_src_conn; 1659 r.rule_flag |= PFRULE_SRCTRACK | 1660 PFRULE_RULESRCTRACK; 1661 break; 1662 case PF_STATE_OPT_MAX_SRC_CONN_RATE: 1663 if (r.max_src_conn_rate.limit) { 1664 yyerror("state option " 1665 "'max-src-conn-rate' " 1666 "multiple definitions"); 1667 YYERROR; 1668 } 1669 if (!o->data.max_src_conn_rate.limit || 1670 !o->data.max_src_conn_rate.seconds) { 1671 yyerror("'max-src-conn-rate' " 1672 "values must be > 0"); 1673 YYERROR; 1674 } 1675 if (o->data.max_src_conn_rate.limit > 1676 PF_THRESHOLD_MAX) { 1677 yyerror("'max-src-conn-rate' " 1678 "maximum rate must be < %u", 1679 PF_THRESHOLD_MAX); 1680 YYERROR; 1681 } 1682 r.max_src_conn_rate.limit = 1683 o->data.max_src_conn_rate.limit; 1684 r.max_src_conn_rate.seconds = 1685 o->data.max_src_conn_rate.seconds; 1686 r.rule_flag |= PFRULE_SRCTRACK | 1687 PFRULE_RULESRCTRACK; 1688 break; 1689 case PF_STATE_OPT_MAX_SRC_NODES: 1690 if (r.max_src_nodes) { 1691 yyerror("state option " 1692 "'max-src-nodes' " 1693 "multiple definitions"); 1694 YYERROR; 1695 } 1696 if (o->data.max_src_nodes == 0) { 1697 yyerror("'max-src-nodes' must " 1698 "be > 0"); 1699 YYERROR; 1700 } 1701 r.max_src_nodes = 1702 o->data.max_src_nodes; 1703 r.rule_flag |= PFRULE_SRCTRACK | 1704 PFRULE_RULESRCTRACK; 1705 break; 1706 case PF_STATE_OPT_STATELOCK: 1707 if (statelock) { 1708 yyerror("state locking option: " 1709 "multiple definitions"); 1710 YYERROR; 1711 } 1712 statelock = 1; 1713 r.rule_flag |= o->data.statelock; 1714 break; 1715 case PF_STATE_OPT_TIMEOUT: 1716 if (r.timeout[o->data.timeout.number]) { 1717 yyerror("state timeout %s " 1718 "multiple definitions", 1719 pf_timeouts[o->data. 1720 timeout.number].name); 1721 YYERROR; 1722 } 1723 r.timeout[o->data.timeout.number] = 1724 o->data.timeout.seconds; 1725 } 1726 o = o->next; 1727 free(p); 1728 } 1729 if (r.rule_flag & PFRULE_SRCTRACK) { 1730 if (srctrack == PF_SRCTRACK_GLOBAL && 1731 r.max_src_nodes) { 1732 yyerror("'max-src-nodes' is " 1733 "incompatible with " 1734 "'source-track global'"); 1735 YYERROR; 1736 } 1737 if (srctrack == PF_SRCTRACK_GLOBAL && 1738 r.max_src_conn) { 1739 yyerror("'max-src-conn' is " 1740 "incompatible with " 1741 "'source-track global'"); 1742 YYERROR; 1743 } 1744 if (srctrack == PF_SRCTRACK_GLOBAL && 1745 r.max_src_conn_rate.seconds) { 1746 yyerror("'max-src-conn-rate' is " 1747 "incompatible with " 1748 "'source-track global'"); 1749 YYERROR; 1750 } 1751 if (r.timeout[PFTM_SRC_NODE] < 1752 r.max_src_conn_rate.seconds) 1753 r.timeout[PFTM_SRC_NODE] = 1754 r.max_src_conn_rate.seconds; 1755 r.rule_flag |= PFRULE_SRCTRACK; 1756 if (srctrack == PF_SRCTRACK_RULE) 1757 r.rule_flag |= PFRULE_RULESRCTRACK; 1758 } 1759 if (r.keep_state && !statelock) 1760 r.rule_flag |= default_statelock; 1761 1762 if ($9.fragment) 1763 r.rule_flag |= PFRULE_FRAGMENT; 1764 r.allow_opts = $9.allowopts; 1765 1766 decide_address_family($8.src.host, &r.af); 1767 decide_address_family($8.dst.host, &r.af); 1768 1769 if ($5.rt) { 1770 if (!r.direction) { 1771 yyerror("direction must be explicit " 1772 "with rules that specify routing"); 1773 YYERROR; 1774 } 1775 r.rt = $5.rt; 1776 r.rpool.opts = $5.pool_opts; 1777 if ($5.key != NULL) 1778 memcpy(&r.rpool.key, $5.key, 1779 sizeof(struct pf_poolhashkey)); 1780 } 1781 if (r.rt && r.rt != PF_FASTROUTE) { 1782 decide_address_family($5.host, &r.af); 1783 remove_invalid_hosts(&$5.host, &r.af); 1784 if ($5.host == NULL) { 1785 yyerror("no routing address with " 1786 "matching address family found."); 1787 YYERROR; 1788 } 1789 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1790 PF_POOL_NONE && ($5.host->next != NULL || 1791 $5.host->addr.type == PF_ADDR_TABLE || 1792 DYNIF_MULTIADDR($5.host->addr))) 1793 r.rpool.opts |= PF_POOL_ROUNDROBIN; 1794 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1795 PF_POOL_ROUNDROBIN && 1796 disallow_table($5.host, "tables are only " 1797 "supported in round-robin routing pools")) 1798 YYERROR; 1799 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1800 PF_POOL_ROUNDROBIN && 1801 disallow_alias($5.host, "interface (%s) " 1802 "is only supported in round-robin " 1803 "routing pools")) 1804 YYERROR; 1805 if ($5.host->next != NULL) { 1806 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1807 PF_POOL_ROUNDROBIN) { 1808 yyerror("r.rpool.opts must " 1809 "be PF_POOL_ROUNDROBIN"); 1810 YYERROR; 1811 } 1812 } 1813 } 1814 if ($9.queues.qname != NULL) { 1815 if (strlcpy(r.qname, $9.queues.qname, 1816 sizeof(r.qname)) >= sizeof(r.qname)) { 1817 yyerror("rule qname too long (max " 1818 "%d chars)", sizeof(r.qname)-1); 1819 YYERROR; 1820 } 1821 free($9.queues.qname); 1822 } 1823 if ($9.queues.pqname != NULL) { 1824 if (strlcpy(r.pqname, $9.queues.pqname, 1825 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1826 yyerror("rule pqname too long (max " 1827 "%d chars)", sizeof(r.pqname)-1); 1828 YYERROR; 1829 } 1830 free($9.queues.pqname); 1831 } 1832 1833 expand_rule(&r, $4, $5.host, $7, $8.src_os, 1834 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1835 $9.uid, $9.gid, $9.icmpspec, ""); 1836 } 1837 ; 1838 1839 1840 opt_statelock : statelock 1841 { 1842 $$ = calloc(1, sizeof(struct node_state_opt)); 1843 if ($$ == NULL) 1844 err(EXIT_FAILURE, "opt_statelock: calloc"); 1845 $$->type = PF_STATE_OPT_STATELOCK; 1846 $$->data.statelock = $1; 1847 $$->next = NULL; 1848 $$->tail = $$; 1849 } 1850 | /* empty */ { 1851 $$ = NULL; 1852 } 1853 ; 1854 1855 filter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1856 filter_opts_l 1857 { $$ = filter_opts; } 1858 | /* empty */ { 1859 bzero(&filter_opts, sizeof filter_opts); 1860 $$ = filter_opts; 1861 } 1862 ; 1863 1864 filter_opts_l : filter_opts_l filter_opt 1865 | filter_opt 1866 ; 1867 1868 filter_opt : USER uids { 1869 if (filter_opts.uid) 1870 $2->tail->next = filter_opts.uid; 1871 filter_opts.uid = $2; 1872 } 1873 | GROUP gids { 1874 if (filter_opts.gid) 1875 $2->tail->next = filter_opts.gid; 1876 filter_opts.gid = $2; 1877 } 1878 | flags { 1879 if (filter_opts.marker & FOM_FLAGS) { 1880 yyerror("flags cannot be redefined"); 1881 YYERROR; 1882 } 1883 filter_opts.marker |= FOM_FLAGS; 1884 filter_opts.flags.b1 |= $1.b1; 1885 filter_opts.flags.b2 |= $1.b2; 1886 filter_opts.flags.w |= $1.w; 1887 filter_opts.flags.w2 |= $1.w2; 1888 } 1889 | icmpspec { 1890 if (filter_opts.marker & FOM_ICMP) { 1891 yyerror("icmp-type cannot be redefined"); 1892 YYERROR; 1893 } 1894 filter_opts.marker |= FOM_ICMP; 1895 filter_opts.icmpspec = $1; 1896 } 1897 | tos { 1898 if (filter_opts.marker & FOM_TOS) { 1899 yyerror("tos cannot be redefined"); 1900 YYERROR; 1901 } 1902 filter_opts.marker |= FOM_TOS; 1903 filter_opts.tos = $1; 1904 } 1905 | keep { 1906 if (filter_opts.marker & FOM_KEEP) { 1907 yyerror("modulate or keep cannot be redefined"); 1908 YYERROR; 1909 } 1910 filter_opts.marker |= FOM_KEEP; 1911 filter_opts.keep.action = $1.action; 1912 filter_opts.keep.options = $1.options; 1913 } 1914 | FRAGMENT { 1915 filter_opts.fragment = 1; 1916 } 1917 | ALLOWOPTS { 1918 filter_opts.allowopts = 1; 1919 } 1920 | label { 1921 if (filter_opts.label) { 1922 yyerror("label cannot be redefined"); 1923 YYERROR; 1924 } 1925 filter_opts.label = $1; 1926 } 1927 | qname { 1928 if (filter_opts.queues.qname) { 1929 yyerror("queue cannot be redefined"); 1930 YYERROR; 1931 } 1932 filter_opts.queues = $1; 1933 } 1934 | TAG string { 1935 filter_opts.tag = $2; 1936 } 1937 | not TAGGED string { 1938 filter_opts.match_tag = $3; 1939 filter_opts.match_tag_not = $1; 1940 } 1941 | PROBABILITY STRING { 1942 char *e; 1943 double p = strtod($2, &e); 1944 1945 if (*e == '%') { 1946 p *= 0.01; 1947 e++; 1948 } 1949 if (*e) { 1950 yyerror("invalid probability: %s", $2); 1951 free($2); 1952 YYERROR; 1953 } 1954 p = floor(p * (UINT_MAX+1.0) + 0.5); 1955 if (p < 1.0 || p >= (UINT_MAX+1.0)) { 1956 yyerror("invalid probability: %s", $2); 1957 free($2); 1958 YYERROR; 1959 } 1960 filter_opts.prob = (u_int32_t)p; 1961 free($2); 1962 } 1963 ; 1964 1965 action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 1966 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 1967 ; 1968 1969 blockspec : /* empty */ { 1970 $$.b2 = blockpolicy; 1971 $$.w = returnicmpdefault; 1972 $$.w2 = returnicmp6default; 1973 } 1974 | DROP { 1975 $$.b2 = PFRULE_DROP; 1976 $$.w = 0; 1977 $$.w2 = 0; 1978 } 1979 | RETURNRST { 1980 $$.b2 = PFRULE_RETURNRST; 1981 $$.w = 0; 1982 $$.w2 = 0; 1983 } 1984 | RETURNRST '(' TTL number ')' { 1985 if ($4 > 255) { 1986 yyerror("illegal ttl value %d", $4); 1987 YYERROR; 1988 } 1989 $$.b2 = PFRULE_RETURNRST; 1990 $$.w = $4; 1991 $$.w2 = 0; 1992 } 1993 | RETURNICMP { 1994 $$.b2 = PFRULE_RETURNICMP; 1995 $$.w = returnicmpdefault; 1996 $$.w2 = returnicmp6default; 1997 } 1998 | RETURNICMP6 { 1999 $$.b2 = PFRULE_RETURNICMP; 2000 $$.w = returnicmpdefault; 2001 $$.w2 = returnicmp6default; 2002 } 2003 | RETURNICMP '(' STRING ')' { 2004 $$.b2 = PFRULE_RETURNICMP; 2005 if (!($$.w = parseicmpspec($3, AF_INET))) { 2006 free($3); 2007 YYERROR; 2008 } 2009 free($3); 2010 $$.w2 = returnicmp6default; 2011 } 2012 | RETURNICMP6 '(' STRING ')' { 2013 $$.b2 = PFRULE_RETURNICMP; 2014 $$.w = returnicmpdefault; 2015 if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 2016 free($3); 2017 YYERROR; 2018 } 2019 free($3); 2020 } 2021 | RETURNICMP '(' STRING comma STRING ')' { 2022 $$.b2 = PFRULE_RETURNICMP; 2023 if (!($$.w = parseicmpspec($3, AF_INET)) || 2024 !($$.w2 = parseicmpspec($5, AF_INET6))) { 2025 free($3); 2026 free($5); 2027 YYERROR; 2028 } 2029 free($3); 2030 free($5); 2031 } 2032 | RETURN { 2033 $$.b2 = PFRULE_RETURN; 2034 $$.w = returnicmpdefault; 2035 $$.w2 = returnicmp6default; 2036 } 2037 ; 2038 2039 dir : /* empty */ { $$ = 0; } 2040 | IN { $$ = PF_IN; } 2041 | OUT { $$ = PF_OUT; } 2042 ; 2043 2044 logquick : /* empty */ { $$.log = 0; $$.quick = 0; } 2045 | log { $$.log = $1; $$.quick = 0; } 2046 | QUICK { $$.log = 0; $$.quick = 1; } 2047 | log QUICK { $$.log = $1; $$.quick = 1; } 2048 | QUICK log { $$.log = $2; $$.quick = 1; } 2049 ; 2050 2051 log : LOG { $$ = 1; } 2052 | LOGALL { $$ = 2; } 2053 ; 2054 2055 interface : /* empty */ { $$ = NULL; } 2056 | ON if_item_not { $$ = $2; } 2057 | ON '{' if_list '}' { $$ = $3; } 2058 ; 2059 2060 if_list : if_item_not { $$ = $1; } 2061 | if_list comma if_item_not { 2062 $1->tail->next = $3; 2063 $1->tail = $3; 2064 $$ = $1; 2065 } 2066 ; 2067 2068 if_item_not : not if_item { $$ = $2; $$->not = $1; } 2069 ; 2070 2071 if_item : STRING { 2072 struct node_host *n; 2073 2074 $$ = calloc(1, sizeof(struct node_if)); 2075 if ($$ == NULL) 2076 err(1, "if_item: calloc"); 2077 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 2078 sizeof($$->ifname)) { 2079 free($1); 2080 free($$); 2081 yyerror("interface name too long"); 2082 YYERROR; 2083 } 2084 2085 if ((n = ifa_exists($1, 1)) != NULL) 2086 $$->ifa_flags = n->ifa_flags; 2087 2088 free($1); 2089 $$->not = 0; 2090 $$->next = NULL; 2091 $$->tail = $$; 2092 } 2093 ; 2094 2095 af : /* empty */ { $$ = 0; } 2096 | INET { $$ = AF_INET; } 2097 | INET6 { $$ = AF_INET6; } 2098 ; 2099 2100 proto : /* empty */ { $$ = NULL; } 2101 | PROTO proto_item { $$ = $2; } 2102 | PROTO '{' proto_list '}' { $$ = $3; } 2103 ; 2104 2105 proto_list : proto_item { $$ = $1; } 2106 | proto_list comma proto_item { 2107 $1->tail->next = $3; 2108 $1->tail = $3; 2109 $$ = $1; 2110 } 2111 ; 2112 2113 proto_item : STRING { 2114 u_int8_t pr; 2115 u_long ulval; 2116 2117 if (atoul($1, &ulval) == 0) { 2118 if (ulval > 255) { 2119 yyerror("protocol outside range"); 2120 free($1); 2121 YYERROR; 2122 } 2123 pr = (u_int8_t)ulval; 2124 } else { 2125 struct protoent *p; 2126 2127 p = getprotobyname($1); 2128 if (p == NULL) { 2129 yyerror("unknown protocol %s", $1); 2130 free($1); 2131 YYERROR; 2132 } 2133 pr = p->p_proto; 2134 } 2135 free($1); 2136 if (pr == 0) { 2137 yyerror("proto 0 cannot be used"); 2138 YYERROR; 2139 } 2140 $$ = calloc(1, sizeof(struct node_proto)); 2141 if ($$ == NULL) 2142 err(1, "proto_item: calloc"); 2143 $$->proto = pr; 2144 $$->next = NULL; 2145 $$->tail = $$; 2146 } 2147 ; 2148 2149 fromto : ALL { 2150 $$.src.host = NULL; 2151 $$.src.port = NULL; 2152 $$.dst.host = NULL; 2153 $$.dst.port = NULL; 2154 $$.src_os = NULL; 2155 } 2156 | from os to { 2157 $$.src = $1; 2158 $$.src_os = $2; 2159 $$.dst = $3; 2160 } 2161 ; 2162 2163 os : /* empty */ { $$ = NULL; } 2164 | OS xos { $$ = $2; } 2165 | OS '{' os_list '}' { $$ = $3; } 2166 ; 2167 2168 xos : STRING { 2169 $$ = calloc(1, sizeof(struct node_os)); 2170 if ($$ == NULL) 2171 err(1, "os: calloc"); 2172 $$->os = $1; 2173 $$->tail = $$; 2174 } 2175 ; 2176 2177 os_list : xos { $$ = $1; } 2178 | os_list comma xos { 2179 $1->tail->next = $3; 2180 $1->tail = $3; 2181 $$ = $1; 2182 } 2183 ; 2184 2185 from : /* empty */ { 2186 $$.host = NULL; 2187 $$.port = NULL; 2188 } 2189 | FROM ipportspec { 2190 $$ = $2; 2191 } 2192 ; 2193 2194 to : /* empty */ { 2195 $$.host = NULL; 2196 $$.port = NULL; 2197 } 2198 | TO ipportspec { 2199 $$ = $2; 2200 } 2201 ; 2202 2203 ipportspec : ipspec { 2204 $$.host = $1; 2205 $$.port = NULL; 2206 } 2207 | ipspec PORT portspec { 2208 $$.host = $1; 2209 $$.port = $3; 2210 } 2211 | PORT portspec { 2212 $$.host = NULL; 2213 $$.port = $2; 2214 } 2215 ; 2216 2217 ipspec : ANY { $$ = NULL; } 2218 | xhost { $$ = $1; } 2219 | '{' host_list '}' { $$ = $2; } 2220 ; 2221 2222 host_list : xhost { $$ = $1; } 2223 | host_list comma xhost { 2224 if ($3 == NULL) 2225 $$ = $1; 2226 else if ($1 == NULL) 2227 $$ = $3; 2228 else { 2229 $1->tail->next = $3; 2230 $1->tail = $3->tail; 2231 $$ = $1; 2232 } 2233 } 2234 ; 2235 2236 xhost : not host { 2237 struct node_host *n; 2238 2239 for (n = $2; n != NULL; n = n->next) 2240 n->not = $1; 2241 $$ = $2; 2242 } 2243 | NOROUTE { 2244 $$ = calloc(1, sizeof(struct node_host)); 2245 if ($$ == NULL) 2246 err(1, "xhost: calloc"); 2247 $$->addr.type = PF_ADDR_NOROUTE; 2248 $$->next = NULL; 2249 $$->tail = $$; 2250 } 2251 ; 2252 2253 host : STRING { 2254 if (($$ = host($1)) == NULL) { 2255 /* error. "any" is handled elsewhere */ 2256 free($1); 2257 yyerror("could not parse host specification"); 2258 YYERROR; 2259 } 2260 free($1); 2261 2262 } 2263 | STRING '/' number { 2264 char *buf; 2265 2266 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2267 err(1, "host: asprintf"); 2268 free($1); 2269 if (($$ = host(buf)) == NULL) { 2270 /* error. "any" is handled elsewhere */ 2271 free(buf); 2272 yyerror("could not parse host specification"); 2273 YYERROR; 2274 } 2275 free(buf); 2276 } 2277 | dynaddr 2278 | dynaddr '/' number { 2279 struct node_host *n; 2280 2281 $$ = $1; 2282 for (n = $1; n != NULL; n = n->next) 2283 set_ipmask(n, $3); 2284 } 2285 | '<' STRING '>' { 2286 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2287 yyerror("table name '%s' too long", $2); 2288 free($2); 2289 YYERROR; 2290 } 2291 $$ = calloc(1, sizeof(struct node_host)); 2292 if ($$ == NULL) 2293 err(1, "host: calloc"); 2294 $$->addr.type = PF_ADDR_TABLE; 2295 if (strlcpy($$->addr.v.tblname, $2, 2296 sizeof($$->addr.v.tblname)) >= 2297 sizeof($$->addr.v.tblname)) 2298 errx(1, "host: strlcpy"); 2299 free($2); 2300 $$->next = NULL; 2301 $$->tail = $$; 2302 } 2303 | ROUTE STRING { 2304 $$ = calloc(1, sizeof(struct node_host)); 2305 if ($$ == NULL) { 2306 free($2); 2307 err(1, "host: calloc"); 2308 } 2309 $$->addr.type = PF_ADDR_RTLABEL; 2310 if (strlcpy($$->addr.v.rtlabelname, $2, 2311 sizeof($$->addr.v.rtlabelname)) >= 2312 sizeof($$->addr.v.rtlabelname)) { 2313 yyerror("route label too long, max %u chars", 2314 sizeof($$->addr.v.rtlabelname) - 1); 2315 free($2); 2316 free($$); 2317 YYERROR; 2318 } 2319 $$->next = NULL; 2320 $$->tail = $$; 2321 free($2); 2322 } 2323 ; 2324 2325 number : STRING { 2326 u_long ulval; 2327 2328 if (atoul($1, &ulval) == -1) { 2329 yyerror("%s is not a number", $1); 2330 free($1); 2331 YYERROR; 2332 } else 2333 $$ = ulval; 2334 free($1); 2335 } 2336 ; 2337 2338 dynaddr : '(' STRING ')' { 2339 int flags = 0; 2340 char *p, *op; 2341 2342 op = $2; 2343 if (!isalpha((unsigned char)op[0])) { 2344 yyerror("invalid interface name '%s'", op); 2345 free(op); 2346 YYERROR; 2347 } 2348 while ((p = strrchr($2, ':')) != NULL) { 2349 if (!strcmp(p+1, "network")) 2350 flags |= PFI_AFLAG_NETWORK; 2351 else if (!strcmp(p+1, "broadcast")) 2352 flags |= PFI_AFLAG_BROADCAST; 2353 else if (!strcmp(p+1, "peer")) 2354 flags |= PFI_AFLAG_PEER; 2355 else if (!strcmp(p+1, "0")) 2356 flags |= PFI_AFLAG_NOALIAS; 2357 else { 2358 yyerror("interface %s has bad modifier", 2359 $2); 2360 free(op); 2361 YYERROR; 2362 } 2363 *p = '\0'; 2364 } 2365 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2366 free(op); 2367 yyerror("illegal combination of " 2368 "interface modifiers"); 2369 YYERROR; 2370 } 2371 $$ = calloc(1, sizeof(struct node_host)); 2372 if ($$ == NULL) 2373 err(1, "address: calloc"); 2374 $$->af = 0; 2375 set_ipmask($$, 128); 2376 $$->addr.type = PF_ADDR_DYNIFTL; 2377 $$->addr.iflags = flags; 2378 if (strlcpy($$->addr.v.ifname, $2, 2379 sizeof($$->addr.v.ifname)) >= 2380 sizeof($$->addr.v.ifname)) { 2381 free(op); 2382 free($$); 2383 yyerror("interface name too long"); 2384 YYERROR; 2385 } 2386 free(op); 2387 $$->next = NULL; 2388 $$->tail = $$; 2389 } 2390 ; 2391 2392 portspec : port_item { $$ = $1; } 2393 | '{' port_list '}' { $$ = $2; } 2394 ; 2395 2396 port_list : port_item { $$ = $1; } 2397 | port_list comma port_item { 2398 $1->tail->next = $3; 2399 $1->tail = $3; 2400 $$ = $1; 2401 } 2402 ; 2403 2404 port_item : port { 2405 $$ = calloc(1, sizeof(struct node_port)); 2406 if ($$ == NULL) 2407 err(1, "port_item: calloc"); 2408 $$->port[0] = $1.a; 2409 $$->port[1] = $1.b; 2410 if ($1.t) 2411 $$->op = PF_OP_RRG; 2412 else 2413 $$->op = PF_OP_EQ; 2414 $$->next = NULL; 2415 $$->tail = $$; 2416 } 2417 | unaryop port { 2418 if ($2.t) { 2419 yyerror("':' cannot be used with an other " 2420 "port operator"); 2421 YYERROR; 2422 } 2423 $$ = calloc(1, sizeof(struct node_port)); 2424 if ($$ == NULL) 2425 err(1, "port_item: calloc"); 2426 $$->port[0] = $2.a; 2427 $$->port[1] = $2.b; 2428 $$->op = $1; 2429 $$->next = NULL; 2430 $$->tail = $$; 2431 } 2432 | port PORTBINARY port { 2433 if ($1.t || $3.t) { 2434 yyerror("':' cannot be used with an other " 2435 "port operator"); 2436 YYERROR; 2437 } 2438 $$ = calloc(1, sizeof(struct node_port)); 2439 if ($$ == NULL) 2440 err(1, "port_item: calloc"); 2441 $$->port[0] = $1.a; 2442 $$->port[1] = $3.a; 2443 $$->op = $2; 2444 $$->next = NULL; 2445 $$->tail = $$; 2446 } 2447 ; 2448 2449 port : STRING { 2450 char *p = strchr($1, ':'); 2451 struct servent *s = NULL; 2452 u_long ulval; 2453 2454 if (p == NULL) { 2455 if (atoul($1, &ulval) == 0) { 2456 if (ulval > 65535) { 2457 free($1); 2458 yyerror("illegal port value %lu", 2459 ulval); 2460 YYERROR; 2461 } 2462 $$.a = htons(ulval); 2463 } else { 2464 s = getservbyname($1, "tcp"); 2465 if (s == NULL) 2466 s = getservbyname($1, "udp"); 2467 if (s == NULL) { 2468 yyerror("unknown port %s", $1); 2469 free($1); 2470 YYERROR; 2471 } 2472 $$.a = s->s_port; 2473 } 2474 $$.b = 0; 2475 $$.t = 0; 2476 } else { 2477 int port[2]; 2478 2479 *p++ = 0; 2480 if ((port[0] = getservice($1)) == -1 || 2481 (port[1] = getservice(p)) == -1) { 2482 free($1); 2483 YYERROR; 2484 } 2485 $$.a = port[0]; 2486 $$.b = port[1]; 2487 $$.t = PF_OP_RRG; 2488 } 2489 free($1); 2490 } 2491 ; 2492 2493 uids : uid_item { $$ = $1; } 2494 | '{' uid_list '}' { $$ = $2; } 2495 ; 2496 2497 uid_list : uid_item { $$ = $1; } 2498 | uid_list comma uid_item { 2499 $1->tail->next = $3; 2500 $1->tail = $3; 2501 $$ = $1; 2502 } 2503 ; 2504 2505 uid_item : uid { 2506 $$ = calloc(1, sizeof(struct node_uid)); 2507 if ($$ == NULL) 2508 err(1, "uid_item: calloc"); 2509 $$->uid[0] = $1; 2510 $$->uid[1] = $1; 2511 $$->op = PF_OP_EQ; 2512 $$->next = NULL; 2513 $$->tail = $$; 2514 } 2515 | unaryop uid { 2516 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2517 yyerror("user unknown requires operator = or " 2518 "!="); 2519 YYERROR; 2520 } 2521 $$ = calloc(1, sizeof(struct node_uid)); 2522 if ($$ == NULL) 2523 err(1, "uid_item: calloc"); 2524 $$->uid[0] = $2; 2525 $$->uid[1] = $2; 2526 $$->op = $1; 2527 $$->next = NULL; 2528 $$->tail = $$; 2529 } 2530 | uid PORTBINARY uid { 2531 if ($1 == UID_MAX || $3 == UID_MAX) { 2532 yyerror("user unknown requires operator = or " 2533 "!="); 2534 YYERROR; 2535 } 2536 $$ = calloc(1, sizeof(struct node_uid)); 2537 if ($$ == NULL) 2538 err(1, "uid_item: calloc"); 2539 $$->uid[0] = $1; 2540 $$->uid[1] = $3; 2541 $$->op = $2; 2542 $$->next = NULL; 2543 $$->tail = $$; 2544 } 2545 ; 2546 2547 uid : STRING { 2548 u_long ulval; 2549 2550 if (atoul($1, &ulval) == -1) { 2551 if (!strcmp($1, "unknown")) 2552 $$ = UID_MAX; 2553 else { 2554 struct passwd *pw; 2555 2556 if ((pw = getpwnam($1)) == NULL) { 2557 yyerror("unknown user %s", $1); 2558 free($1); 2559 YYERROR; 2560 } 2561 $$ = pw->pw_uid; 2562 } 2563 } else { 2564 if (ulval >= UID_MAX) { 2565 free($1); 2566 yyerror("illegal uid value %lu", ulval); 2567 YYERROR; 2568 } 2569 $$ = ulval; 2570 } 2571 free($1); 2572 } 2573 ; 2574 2575 gids : gid_item { $$ = $1; } 2576 | '{' gid_list '}' { $$ = $2; } 2577 ; 2578 2579 gid_list : gid_item { $$ = $1; } 2580 | gid_list comma gid_item { 2581 $1->tail->next = $3; 2582 $1->tail = $3; 2583 $$ = $1; 2584 } 2585 ; 2586 2587 gid_item : gid { 2588 $$ = calloc(1, sizeof(struct node_gid)); 2589 if ($$ == NULL) 2590 err(1, "gid_item: calloc"); 2591 $$->gid[0] = $1; 2592 $$->gid[1] = $1; 2593 $$->op = PF_OP_EQ; 2594 $$->next = NULL; 2595 $$->tail = $$; 2596 } 2597 | unaryop gid { 2598 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2599 yyerror("group unknown requires operator = or " 2600 "!="); 2601 YYERROR; 2602 } 2603 $$ = calloc(1, sizeof(struct node_gid)); 2604 if ($$ == NULL) 2605 err(1, "gid_item: calloc"); 2606 $$->gid[0] = $2; 2607 $$->gid[1] = $2; 2608 $$->op = $1; 2609 $$->next = NULL; 2610 $$->tail = $$; 2611 } 2612 | gid PORTBINARY gid { 2613 if ($1 == GID_MAX || $3 == GID_MAX) { 2614 yyerror("group unknown requires operator = or " 2615 "!="); 2616 YYERROR; 2617 } 2618 $$ = calloc(1, sizeof(struct node_gid)); 2619 if ($$ == NULL) 2620 err(1, "gid_item: calloc"); 2621 $$->gid[0] = $1; 2622 $$->gid[1] = $3; 2623 $$->op = $2; 2624 $$->next = NULL; 2625 $$->tail = $$; 2626 } 2627 ; 2628 2629 gid : STRING { 2630 u_long ulval; 2631 2632 if (atoul($1, &ulval) == -1) { 2633 if (!strcmp($1, "unknown")) 2634 $$ = GID_MAX; 2635 else { 2636 struct group *grp; 2637 2638 if ((grp = getgrnam($1)) == NULL) { 2639 yyerror("unknown group %s", $1); 2640 free($1); 2641 YYERROR; 2642 } 2643 $$ = grp->gr_gid; 2644 } 2645 } else { 2646 if (ulval >= GID_MAX) { 2647 yyerror("illegal gid value %lu", ulval); 2648 free($1); 2649 YYERROR; 2650 } 2651 $$ = ulval; 2652 } 2653 free($1); 2654 } 2655 ; 2656 2657 flag : STRING { 2658 int f; 2659 2660 if ((f = parse_flags($1)) < 0) { 2661 yyerror("bad flags %s", $1); 2662 free($1); 2663 YYERROR; 2664 } 2665 free($1); 2666 $$.b1 = f; 2667 } 2668 ; 2669 2670 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2671 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2672 ; 2673 2674 icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2675 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2676 | ICMP6TYPE icmp6_item { $$ = $2; } 2677 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2678 ; 2679 2680 icmp_list : icmp_item { $$ = $1; } 2681 | icmp_list comma icmp_item { 2682 $1->tail->next = $3; 2683 $1->tail = $3; 2684 $$ = $1; 2685 } 2686 ; 2687 2688 icmp6_list : icmp6_item { $$ = $1; } 2689 | icmp6_list comma icmp6_item { 2690 $1->tail->next = $3; 2691 $1->tail = $3; 2692 $$ = $1; 2693 } 2694 ; 2695 2696 icmp_item : icmptype { 2697 $$ = calloc(1, sizeof(struct node_icmp)); 2698 if ($$ == NULL) 2699 err(1, "icmp_item: calloc"); 2700 $$->type = $1; 2701 $$->code = 0; 2702 $$->proto = IPPROTO_ICMP; 2703 $$->next = NULL; 2704 $$->tail = $$; 2705 } 2706 | icmptype CODE STRING { 2707 const struct icmpcodeent *p; 2708 u_long ulval; 2709 2710 if (atoul($3, &ulval) == 0) { 2711 if (ulval > 255) { 2712 free($3); 2713 yyerror("illegal icmp-code %lu", ulval); 2714 YYERROR; 2715 } 2716 } else { 2717 if ((p = geticmpcodebyname($1-1, $3, 2718 AF_INET)) == NULL) { 2719 yyerror("unknown icmp-code %s", $3); 2720 free($3); 2721 YYERROR; 2722 } 2723 ulval = p->code; 2724 } 2725 free($3); 2726 $$ = calloc(1, sizeof(struct node_icmp)); 2727 if ($$ == NULL) 2728 err(1, "icmp_item: calloc"); 2729 $$->type = $1; 2730 $$->code = ulval + 1; 2731 $$->proto = IPPROTO_ICMP; 2732 $$->next = NULL; 2733 $$->tail = $$; 2734 } 2735 ; 2736 2737 icmp6_item : icmp6type { 2738 $$ = calloc(1, sizeof(struct node_icmp)); 2739 if ($$ == NULL) 2740 err(1, "icmp_item: calloc"); 2741 $$->type = $1; 2742 $$->code = 0; 2743 $$->proto = IPPROTO_ICMPV6; 2744 $$->next = NULL; 2745 $$->tail = $$; 2746 } 2747 | icmp6type CODE STRING { 2748 const struct icmpcodeent *p; 2749 u_long ulval; 2750 2751 if (atoul($3, &ulval) == 0) { 2752 if (ulval > 255) { 2753 yyerror("illegal icmp6-code %lu", 2754 ulval); 2755 free($3); 2756 YYERROR; 2757 } 2758 } else { 2759 if ((p = geticmpcodebyname($1-1, $3, 2760 AF_INET6)) == NULL) { 2761 yyerror("unknown icmp6-code %s", $3); 2762 free($3); 2763 YYERROR; 2764 } 2765 ulval = p->code; 2766 } 2767 free($3); 2768 $$ = calloc(1, sizeof(struct node_icmp)); 2769 if ($$ == NULL) 2770 err(1, "icmp_item: calloc"); 2771 $$->type = $1; 2772 $$->code = ulval + 1; 2773 $$->proto = IPPROTO_ICMPV6; 2774 $$->next = NULL; 2775 $$->tail = $$; 2776 } 2777 ; 2778 2779 icmptype : STRING { 2780 const struct icmptypeent *p; 2781 u_long ulval; 2782 2783 if (atoul($1, &ulval) == 0) { 2784 if (ulval > 255) { 2785 yyerror("illegal icmp-type %lu", ulval); 2786 free($1); 2787 YYERROR; 2788 } 2789 $$ = ulval + 1; 2790 } else { 2791 if ((p = geticmptypebyname($1, AF_INET)) == 2792 NULL) { 2793 yyerror("unknown icmp-type %s", $1); 2794 free($1); 2795 YYERROR; 2796 } 2797 $$ = p->type + 1; 2798 } 2799 free($1); 2800 } 2801 ; 2802 2803 icmp6type : STRING { 2804 const struct icmptypeent *p; 2805 u_long ulval; 2806 2807 if (atoul($1, &ulval) == 0) { 2808 if (ulval > 255) { 2809 yyerror("illegal icmp6-type %lu", ulval); 2810 free($1); 2811 YYERROR; 2812 } 2813 $$ = ulval + 1; 2814 } else { 2815 if ((p = geticmptypebyname($1, AF_INET6)) == 2816 NULL) { 2817 yyerror("unknown icmp6-type %s", $1); 2818 free($1); 2819 YYERROR; 2820 } 2821 $$ = p->type + 1; 2822 } 2823 free($1); 2824 } 2825 ; 2826 2827 tos : TOS STRING { 2828 if (!strcmp($2, "lowdelay")) 2829 $$ = IPTOS_LOWDELAY; 2830 else if (!strcmp($2, "throughput")) 2831 $$ = IPTOS_THROUGHPUT; 2832 else if (!strcmp($2, "reliability")) 2833 $$ = IPTOS_RELIABILITY; 2834 else if ($2[0] == '0' && $2[1] == 'x') 2835 $$ = strtoul($2, NULL, 16); 2836 else 2837 $$ = strtoul($2, NULL, 10); 2838 if (!$$ || $$ > 255) { 2839 yyerror("illegal tos value %s", $2); 2840 free($2); 2841 YYERROR; 2842 } 2843 free($2); 2844 } 2845 ; 2846 2847 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 2848 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 2849 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 2850 ; 2851 2852 statelock : IFBOUND { 2853 $$ = PFRULE_IFBOUND; 2854 } 2855 | GRBOUND { 2856 $$ = PFRULE_GRBOUND; 2857 } 2858 | FLOATING { 2859 $$ = 0; 2860 } 2861 ; 2862 2863 keep : KEEP STATE state_opt_spec { 2864 $$.action = PF_STATE_NORMAL; 2865 $$.options = $3; 2866 } 2867 | MODULATE STATE state_opt_spec { 2868 $$.action = PF_STATE_MODULATE; 2869 $$.options = $3; 2870 } 2871 | SYNPROXY STATE state_opt_spec { 2872 $$.action = PF_STATE_SYNPROXY; 2873 $$.options = $3; 2874 } 2875 ; 2876 2877 flush : /* empty */ { $$ = 0; } 2878 | FLUSH { $$ = PF_FLUSH; } 2879 | FLUSH GLOBAL { 2880 $$ = PF_FLUSH | PF_FLUSH_GLOBAL; 2881 } 2882 ; 2883 2884 state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2885 | /* empty */ { $$ = NULL; } 2886 ; 2887 2888 state_opt_list : state_opt_item { $$ = $1; } 2889 | state_opt_list comma state_opt_item { 2890 $1->tail->next = $3; 2891 $1->tail = $3; 2892 $$ = $1; 2893 } 2894 ; 2895 2896 state_opt_item : MAXIMUM number { 2897 $$ = calloc(1, sizeof(struct node_state_opt)); 2898 if ($$ == NULL) 2899 err(1, "state_opt_item: calloc"); 2900 $$->type = PF_STATE_OPT_MAX; 2901 $$->data.max_states = $2; 2902 $$->next = NULL; 2903 $$->tail = $$; 2904 } 2905 | NOSYNC { 2906 $$ = calloc(1, sizeof(struct node_state_opt)); 2907 if ($$ == NULL) 2908 err(1, "state_opt_item: calloc"); 2909 $$->type = PF_STATE_OPT_NOSYNC; 2910 $$->next = NULL; 2911 $$->tail = $$; 2912 } 2913 | MAXSRCSTATES number { 2914 $$ = calloc(1, sizeof(struct node_state_opt)); 2915 if ($$ == NULL) 2916 err(1, "state_opt_item: calloc"); 2917 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 2918 $$->data.max_src_states = $2; 2919 $$->next = NULL; 2920 $$->tail = $$; 2921 } 2922 | MAXSRCCONN number { 2923 $$ = calloc(1, sizeof(struct node_state_opt)); 2924 if ($$ == NULL) 2925 err(1, "state_opt_item: calloc"); 2926 $$->type = PF_STATE_OPT_MAX_SRC_CONN; 2927 $$->data.max_src_conn = $2; 2928 $$->next = NULL; 2929 $$->tail = $$; 2930 } 2931 | MAXSRCCONNRATE number '/' number { 2932 $$ = calloc(1, sizeof(struct node_state_opt)); 2933 if ($$ == NULL) 2934 err(1, "state_opt_item: calloc"); 2935 $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; 2936 $$->data.max_src_conn_rate.limit = $2; 2937 $$->data.max_src_conn_rate.seconds = $4; 2938 $$->next = NULL; 2939 $$->tail = $$; 2940 } 2941 | OVERLOAD '<' STRING '>' flush { 2942 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 2943 yyerror("table name '%s' too long", $3); 2944 free($3); 2945 YYERROR; 2946 } 2947 $$ = calloc(1, sizeof(struct node_state_opt)); 2948 if ($$ == NULL) 2949 err(1, "state_opt_item: calloc"); 2950 if (strlcpy($$->data.overload.tblname, $3, 2951 PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE) 2952 errx(1, "state_opt_item: strlcpy"); 2953 free($3); 2954 $$->type = PF_STATE_OPT_OVERLOAD; 2955 $$->data.overload.flush = $5; 2956 $$->next = NULL; 2957 $$->tail = $$; 2958 } 2959 | MAXSRCNODES number { 2960 $$ = calloc(1, sizeof(struct node_state_opt)); 2961 if ($$ == NULL) 2962 err(1, "state_opt_item: calloc"); 2963 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 2964 $$->data.max_src_nodes = $2; 2965 $$->next = NULL; 2966 $$->tail = $$; 2967 } 2968 | sourcetrack { 2969 $$ = calloc(1, sizeof(struct node_state_opt)); 2970 if ($$ == NULL) 2971 err(1, "state_opt_item: calloc"); 2972 $$->type = PF_STATE_OPT_SRCTRACK; 2973 $$->data.src_track = $1; 2974 $$->next = NULL; 2975 $$->tail = $$; 2976 } 2977 | statelock { 2978 $$ = calloc(1, sizeof(struct node_state_opt)); 2979 if ($$ == NULL) 2980 err(1, "state_opt_item: calloc"); 2981 $$->type = PF_STATE_OPT_STATELOCK; 2982 $$->data.statelock = $1; 2983 $$->next = NULL; 2984 $$->tail = $$; 2985 } 2986 | STRING number { 2987 int i; 2988 2989 for (i = 0; pf_timeouts[i].name && 2990 strcmp(pf_timeouts[i].name, $1); ++i) 2991 ; /* nothing */ 2992 if (!pf_timeouts[i].name) { 2993 yyerror("illegal timeout name %s", $1); 2994 free($1); 2995 YYERROR; 2996 } 2997 if (strchr(pf_timeouts[i].name, '.') == NULL) { 2998 yyerror("illegal state timeout %s", $1); 2999 free($1); 3000 YYERROR; 3001 } 3002 free($1); 3003 $$ = calloc(1, sizeof(struct node_state_opt)); 3004 if ($$ == NULL) 3005 err(1, "state_opt_item: calloc"); 3006 $$->type = PF_STATE_OPT_TIMEOUT; 3007 $$->data.timeout.number = pf_timeouts[i].timeout; 3008 $$->data.timeout.seconds = $2; 3009 $$->next = NULL; 3010 $$->tail = $$; 3011 } 3012 ; 3013 3014 label : LABEL STRING { 3015 $$ = $2; 3016 } 3017 ; 3018 3019 qname : QUEUE STRING { 3020 $$.qname = $2; 3021 } 3022 | QUEUE '(' STRING ')' { 3023 $$.qname = $3; 3024 } 3025 | QUEUE '(' STRING comma STRING ')' { 3026 $$.qname = $3; 3027 $$.pqname = $5; 3028 } 3029 ; 3030 3031 no : /* empty */ { $$ = 0; } 3032 | NO { $$ = 1; } 3033 ; 3034 3035 rport : STRING { 3036 char *p = strchr($1, ':'); 3037 3038 if (p == NULL) { 3039 if (($$.a = getservice($1)) == -1) { 3040 free($1); 3041 YYERROR; 3042 } 3043 $$.b = $$.t = 0; 3044 } else if (!strcmp(p+1, "*")) { 3045 *p = 0; 3046 if (($$.a = getservice($1)) == -1) { 3047 free($1); 3048 YYERROR; 3049 } 3050 $$.b = 0; 3051 $$.t = 1; 3052 } else { 3053 *p++ = 0; 3054 if (($$.a = getservice($1)) == -1 || 3055 ($$.b = getservice(p)) == -1) { 3056 free($1); 3057 YYERROR; 3058 } 3059 if ($$.a == $$.b) 3060 $$.b = 0; 3061 $$.t = 0; 3062 } 3063 free($1); 3064 } 3065 ; 3066 3067 redirspec : host { $$ = $1; } 3068 | '{' redir_host_list '}' { $$ = $2; } 3069 ; 3070 3071 redir_host_list : host { $$ = $1; } 3072 | redir_host_list comma host { 3073 $1->tail->next = $3; 3074 $1->tail = $3->tail; 3075 $$ = $1; 3076 } 3077 ; 3078 3079 redirpool : /* empty */ { $$ = NULL; } 3080 | ARROW redirspec { 3081 $$ = calloc(1, sizeof(struct redirection)); 3082 if ($$ == NULL) 3083 err(1, "redirection: calloc"); 3084 $$->host = $2; 3085 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3086 } 3087 | ARROW redirspec PORT rport { 3088 $$ = calloc(1, sizeof(struct redirection)); 3089 if ($$ == NULL) 3090 err(1, "redirection: calloc"); 3091 $$->host = $2; 3092 $$->rport = $4; 3093 } 3094 ; 3095 3096 hashkey : /* empty */ 3097 { 3098 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3099 if ($$ == NULL) 3100 err(1, "hashkey: calloc"); 3101 $$->key32[0] = arc4random(); 3102 $$->key32[1] = arc4random(); 3103 $$->key32[2] = arc4random(); 3104 $$->key32[3] = arc4random(); 3105 } 3106 | string 3107 { 3108 if (!strncmp($1, "0x", 2)) { 3109 if (strlen($1) != 34) { 3110 free($1); 3111 yyerror("hex key must be 128 bits " 3112 "(32 hex digits) long"); 3113 YYERROR; 3114 } 3115 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3116 if ($$ == NULL) 3117 err(1, "hashkey: calloc"); 3118 3119 if (sscanf($1, "0x%8x%8x%8x%8x", 3120 &$$->key32[0], &$$->key32[1], 3121 &$$->key32[2], &$$->key32[3]) != 4) { 3122 free($$); 3123 free($1); 3124 yyerror("invalid hex key"); 3125 YYERROR; 3126 } 3127 } else { 3128 MD5_CTX context; 3129 3130 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 3131 if ($$ == NULL) 3132 err(1, "hashkey: calloc"); 3133 MD5Init(&context); 3134 MD5Update(&context, (unsigned char *)$1, 3135 strlen($1)); 3136 MD5Final((unsigned char *)$$, &context); 3137 HTONL($$->key32[0]); 3138 HTONL($$->key32[1]); 3139 HTONL($$->key32[2]); 3140 HTONL($$->key32[3]); 3141 } 3142 free($1); 3143 } 3144 ; 3145 3146 pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 3147 pool_opts_l 3148 { $$ = pool_opts; } 3149 | /* empty */ { 3150 bzero(&pool_opts, sizeof pool_opts); 3151 $$ = pool_opts; 3152 } 3153 ; 3154 3155 pool_opts_l : pool_opts_l pool_opt 3156 | pool_opt 3157 ; 3158 3159 pool_opt : BITMASK { 3160 if (pool_opts.type) { 3161 yyerror("pool type cannot be redefined"); 3162 YYERROR; 3163 } 3164 pool_opts.type = PF_POOL_BITMASK; 3165 } 3166 | RANDOM { 3167 if (pool_opts.type) { 3168 yyerror("pool type cannot be redefined"); 3169 YYERROR; 3170 } 3171 pool_opts.type = PF_POOL_RANDOM; 3172 } 3173 | SOURCEHASH hashkey { 3174 if (pool_opts.type) { 3175 yyerror("pool type cannot be redefined"); 3176 YYERROR; 3177 } 3178 pool_opts.type = PF_POOL_SRCHASH; 3179 pool_opts.key = $2; 3180 } 3181 | ROUNDROBIN { 3182 if (pool_opts.type) { 3183 yyerror("pool type cannot be redefined"); 3184 YYERROR; 3185 } 3186 pool_opts.type = PF_POOL_ROUNDROBIN; 3187 } 3188 | STATICPORT { 3189 if (pool_opts.staticport) { 3190 yyerror("static-port cannot be redefined"); 3191 YYERROR; 3192 } 3193 pool_opts.staticport = 1; 3194 } 3195 | STICKYADDRESS { 3196 if (filter_opts.marker & POM_STICKYADDRESS) { 3197 yyerror("sticky-address cannot be redefined"); 3198 YYERROR; 3199 } 3200 pool_opts.marker |= POM_STICKYADDRESS; 3201 pool_opts.opts |= PF_POOL_STICKYADDR; 3202 } 3203 ; 3204 3205 redirection : /* empty */ { $$ = NULL; } 3206 | ARROW host { 3207 $$ = calloc(1, sizeof(struct redirection)); 3208 if ($$ == NULL) 3209 err(1, "redirection: calloc"); 3210 $$->host = $2; 3211 $$->rport.a = $$->rport.b = $$->rport.t = 0; 3212 } 3213 | ARROW host PORT rport { 3214 $$ = calloc(1, sizeof(struct redirection)); 3215 if ($$ == NULL) 3216 err(1, "redirection: calloc"); 3217 $$->host = $2; 3218 $$->rport = $4; 3219 } 3220 ; 3221 3222 natpass : /* empty */ { $$ = 0; } 3223 | PASS { $$ = 1; } 3224 ; 3225 3226 nataction : no NAT natpass { 3227 $$.b2 = $$.w = 0; 3228 if ($1) 3229 $$.b1 = PF_NONAT; 3230 else 3231 $$.b1 = PF_NAT; 3232 $$.b2 = $3; 3233 } 3234 | no RDR natpass { 3235 $$.b2 = $$.w = 0; 3236 if ($1) 3237 $$.b1 = PF_NORDR; 3238 else 3239 $$.b1 = PF_RDR; 3240 $$.b2 = $3; 3241 } 3242 ; 3243 3244 natrule : nataction interface af proto fromto tag tagged redirpool pool_opts opt_statelock 3245 { 3246 struct pf_rule r; 3247 3248 if (check_rulestate(PFCTL_STATE_NAT)) 3249 YYERROR; 3250 3251 memset(&r, 0, sizeof(r)); 3252 3253 r.action = $1.b1; 3254 r.natpass = $1.b2; 3255 r.af = $3; 3256 3257 if (!r.af) { 3258 if ($5.src.host && $5.src.host->af && 3259 !$5.src.host->ifindex) 3260 r.af = $5.src.host->af; 3261 else if ($5.dst.host && $5.dst.host->af && 3262 !$5.dst.host->ifindex) 3263 r.af = $5.dst.host->af; 3264 } 3265 3266 if ($6 != NULL) 3267 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3268 PF_TAG_NAME_SIZE) { 3269 yyerror("tag too long, max %u chars", 3270 PF_TAG_NAME_SIZE - 1); 3271 YYERROR; 3272 } 3273 3274 if ($7.name) 3275 if (strlcpy(r.match_tagname, $7.name, 3276 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3277 yyerror("tag too long, max %u chars", 3278 PF_TAG_NAME_SIZE - 1); 3279 YYERROR; 3280 } 3281 r.match_tag_not = $7.neg; 3282 3283 if (r.action == PF_NONAT || r.action == PF_NORDR) { 3284 if ($8 != NULL) { 3285 yyerror("translation rule with 'no' " 3286 "does not need '->'"); 3287 YYERROR; 3288 } 3289 } else { 3290 if ($8 == NULL || $8->host == NULL) { 3291 yyerror("translation rule requires '-> " 3292 "address'"); 3293 YYERROR; 3294 } 3295 if (!r.af && ! $8->host->ifindex) 3296 r.af = $8->host->af; 3297 3298 remove_invalid_hosts(&$8->host, &r.af); 3299 if (invalid_redirect($8->host, r.af)) 3300 YYERROR; 3301 if (check_netmask($8->host, r.af)) 3302 YYERROR; 3303 3304 r.rpool.proxy_port[0] = ntohs($8->rport.a); 3305 3306 switch (r.action) { 3307 case PF_RDR: 3308 if (!$8->rport.b && $8->rport.t && 3309 $5.dst.port != NULL) { 3310 r.rpool.proxy_port[1] = 3311 ntohs($8->rport.a) + 3312 (ntohs( 3313 $5.dst.port->port[1]) - 3314 ntohs( 3315 $5.dst.port->port[0])); 3316 } else 3317 r.rpool.proxy_port[1] = 3318 ntohs($8->rport.b); 3319 break; 3320 case PF_NAT: 3321 r.rpool.proxy_port[1] = 3322 ntohs($8->rport.b); 3323 if (!r.rpool.proxy_port[0] && 3324 !r.rpool.proxy_port[1]) { 3325 r.rpool.proxy_port[0] = 3326 PF_NAT_PROXY_PORT_LOW; 3327 r.rpool.proxy_port[1] = 3328 PF_NAT_PROXY_PORT_HIGH; 3329 } else if (!r.rpool.proxy_port[1]) 3330 r.rpool.proxy_port[1] = 3331 r.rpool.proxy_port[0]; 3332 break; 3333 default: 3334 break; 3335 } 3336 3337 r.rpool.opts = $9.type; 3338 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3339 PF_POOL_NONE && ($8->host->next != NULL || 3340 $8->host->addr.type == PF_ADDR_TABLE || 3341 DYNIF_MULTIADDR($8->host->addr))) 3342 r.rpool.opts = PF_POOL_ROUNDROBIN; 3343 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3344 PF_POOL_ROUNDROBIN && 3345 disallow_table($8->host, "tables are only " 3346 "supported in round-robin redirection " 3347 "pools")) 3348 YYERROR; 3349 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3350 PF_POOL_ROUNDROBIN && 3351 disallow_alias($8->host, "interface (%s) " 3352 "is only supported in round-robin " 3353 "redirection pools")) 3354 YYERROR; 3355 if ($8->host->next != NULL) { 3356 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3357 PF_POOL_ROUNDROBIN) { 3358 yyerror("only round-robin " 3359 "valid for multiple " 3360 "redirection addresses"); 3361 YYERROR; 3362 } 3363 } 3364 } 3365 3366 if ($9.key != NULL) 3367 memcpy(&r.rpool.key, $9.key, 3368 sizeof(struct pf_poolhashkey)); 3369 3370 if ($9.opts) 3371 r.rpool.opts |= $9.opts; 3372 3373 if ($9.staticport) { 3374 if (r.action != PF_NAT) { 3375 yyerror("the 'static-port' option is " 3376 "only valid with nat rules"); 3377 YYERROR; 3378 } 3379 if (r.rpool.proxy_port[0] != 3380 PF_NAT_PROXY_PORT_LOW && 3381 r.rpool.proxy_port[1] != 3382 PF_NAT_PROXY_PORT_HIGH) { 3383 yyerror("the 'static-port' option can't" 3384 " be used when specifying a port" 3385 " range"); 3386 YYERROR; 3387 } 3388 r.rpool.proxy_port[0] = 0; 3389 r.rpool.proxy_port[1] = 0; 3390 } 3391 3392 if ($10 == NULL) 3393 r.rule_flag |= default_statelock; 3394 else { 3395 r.rule_flag |= $10->data.statelock; 3396 free($10); 3397 } 3398 3399 expand_rule(&r, $2, $8 == NULL ? NULL : $8->host, $4, 3400 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3401 $5.dst.port, 0, 0, 0, ""); 3402 free($8); 3403 } 3404 ; 3405 3406 binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag tagged 3407 redirection 3408 { 3409 struct pf_rule binat; 3410 struct pf_pooladdr *pa; 3411 3412 if (check_rulestate(PFCTL_STATE_NAT)) 3413 YYERROR; 3414 3415 memset(&binat, 0, sizeof(binat)); 3416 3417 if ($1) 3418 binat.action = PF_NOBINAT; 3419 else 3420 binat.action = PF_BINAT; 3421 binat.natpass = $3; 3422 binat.af = $5; 3423 if (!binat.af && $8 != NULL && $8->af) 3424 binat.af = $8->af; 3425 if (!binat.af && $10 != NULL && $10->af) 3426 binat.af = $10->af; 3427 3428 if (!binat.af && $13 != NULL && $13->host) 3429 binat.af = $13->host->af; 3430 if (!binat.af) { 3431 yyerror("address family (inet/inet6) " 3432 "undefined"); 3433 YYERROR; 3434 } 3435 3436 if ($4 != NULL) { 3437 memcpy(binat.ifname, $4->ifname, 3438 sizeof(binat.ifname)); 3439 binat.ifnot = $4->not; 3440 free($4); 3441 } 3442 3443 if ($11 != NULL) 3444 if (strlcpy(binat.tagname, $11, 3445 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3446 yyerror("tag too long, max %u chars", 3447 PF_TAG_NAME_SIZE - 1); 3448 YYERROR; 3449 } 3450 if ($12.name) 3451 if (strlcpy(binat.match_tagname, $12.name, 3452 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3453 yyerror("tag too long, max %u chars", 3454 PF_TAG_NAME_SIZE - 1); 3455 YYERROR; 3456 } 3457 binat.match_tag_not = $12.neg; 3458 3459 if ($6 != NULL) { 3460 binat.proto = $6->proto; 3461 free($6); 3462 } 3463 3464 if ($8 != NULL && disallow_table($8, "invalid use of " 3465 "table <%s> as the source address of a binat rule")) 3466 YYERROR; 3467 if ($8 != NULL && disallow_alias($8, "invalid use of " 3468 "interface (%s) as the source address of a binat " 3469 "rule")) 3470 YYERROR; 3471 if ($13 != NULL && $13->host != NULL && disallow_table( 3472 $13->host, "invalid use of table <%s> as the " 3473 "redirect address of a binat rule")) 3474 YYERROR; 3475 if ($13 != NULL && $13->host != NULL && disallow_alias( 3476 $13->host, "invalid use of interface (%s) as the " 3477 "redirect address of a binat rule")) 3478 YYERROR; 3479 3480 if ($8 != NULL) { 3481 if ($8->next) { 3482 yyerror("multiple binat ip addresses"); 3483 YYERROR; 3484 } 3485 if ($8->addr.type == PF_ADDR_DYNIFTL) 3486 $8->af = binat.af; 3487 if ($8->af != binat.af) { 3488 yyerror("binat ip versions must match"); 3489 YYERROR; 3490 } 3491 if (check_netmask($8, binat.af)) 3492 YYERROR; 3493 memcpy(&binat.src.addr, &$8->addr, 3494 sizeof(binat.src.addr)); 3495 free($8); 3496 } 3497 if ($10 != NULL) { 3498 if ($10->next) { 3499 yyerror("multiple binat ip addresses"); 3500 YYERROR; 3501 } 3502 if ($10->af != binat.af && $10->af) { 3503 yyerror("binat ip versions must match"); 3504 YYERROR; 3505 } 3506 if (check_netmask($10, binat.af)) 3507 YYERROR; 3508 memcpy(&binat.dst.addr, &$10->addr, 3509 sizeof(binat.dst.addr)); 3510 binat.dst.neg = $10->not; 3511 free($10); 3512 } 3513 3514 if (binat.action == PF_NOBINAT) { 3515 if ($13 != NULL) { 3516 yyerror("'no binat' rule does not need" 3517 " '->'"); 3518 YYERROR; 3519 } 3520 } else { 3521 if ($13 == NULL || $13->host == NULL) { 3522 yyerror("'binat' rule requires" 3523 " '-> address'"); 3524 YYERROR; 3525 } 3526 3527 remove_invalid_hosts(&$13->host, &binat.af); 3528 if (invalid_redirect($13->host, binat.af)) 3529 YYERROR; 3530 if ($13->host->next != NULL) { 3531 yyerror("binat rule must redirect to " 3532 "a single address"); 3533 YYERROR; 3534 } 3535 if (check_netmask($13->host, binat.af)) 3536 YYERROR; 3537 3538 if (!PF_AZERO(&binat.src.addr.v.a.mask, 3539 binat.af) && 3540 !PF_AEQ(&binat.src.addr.v.a.mask, 3541 &$13->host->addr.v.a.mask, binat.af)) { 3542 yyerror("'binat' source mask and " 3543 "redirect mask must be the same"); 3544 YYERROR; 3545 } 3546 3547 TAILQ_INIT(&binat.rpool.list); 3548 pa = calloc(1, sizeof(struct pf_pooladdr)); 3549 if (pa == NULL) 3550 err(1, "binat: calloc"); 3551 pa->addr = $13->host->addr; 3552 pa->ifname[0] = 0; 3553 TAILQ_INSERT_TAIL(&binat.rpool.list, 3554 pa, entries); 3555 3556 free($13); 3557 } 3558 3559 pfctl_add_rule(pf, &binat, ""); 3560 } 3561 ; 3562 3563 tag : /* empty */ { $$ = NULL; } 3564 | TAG STRING { $$ = $2; } 3565 ; 3566 3567 tagged : /* empty */ { $$.neg = 0; $$.name = NULL; } 3568 | not TAGGED string { $$.neg = $1; $$.name = $3; } 3569 ; 3570 3571 route_host : STRING { 3572 $$ = calloc(1, sizeof(struct node_host)); 3573 if ($$ == NULL) 3574 err(1, "route_host: calloc"); 3575 $$->ifname = $1; 3576 set_ipmask($$, 128); 3577 $$->next = NULL; 3578 $$->tail = $$; 3579 } 3580 | '(' STRING host ')' { 3581 $$ = $3; 3582 $$->ifname = $2; 3583 } 3584 ; 3585 3586 route_host_list : route_host { $$ = $1; } 3587 | route_host_list comma route_host { 3588 if ($1->af == 0) 3589 $1->af = $3->af; 3590 if ($1->af != $3->af) { 3591 yyerror("all pool addresses must be in the " 3592 "same address family"); 3593 YYERROR; 3594 } 3595 $1->tail->next = $3; 3596 $1->tail = $3->tail; 3597 $$ = $1; 3598 } 3599 ; 3600 3601 routespec : route_host { $$ = $1; } 3602 | '{' route_host_list '}' { $$ = $2; } 3603 ; 3604 3605 route : /* empty */ { 3606 $$.host = NULL; 3607 $$.rt = 0; 3608 $$.pool_opts = 0; 3609 } 3610 | FASTROUTE { 3611 $$.host = NULL; 3612 $$.rt = PF_FASTROUTE; 3613 $$.pool_opts = 0; 3614 } 3615 | ROUTETO routespec pool_opts { 3616 $$.host = $2; 3617 $$.rt = PF_ROUTETO; 3618 $$.pool_opts = $3.type | $3.opts; 3619 if ($3.key != NULL) 3620 $$.key = $3.key; 3621 } 3622 | REPLYTO routespec pool_opts { 3623 $$.host = $2; 3624 $$.rt = PF_REPLYTO; 3625 $$.pool_opts = $3.type | $3.opts; 3626 if ($3.key != NULL) 3627 $$.key = $3.key; 3628 } 3629 | DUPTO routespec pool_opts { 3630 $$.host = $2; 3631 $$.rt = PF_DUPTO; 3632 $$.pool_opts = $3.type | $3.opts; 3633 if ($3.key != NULL) 3634 $$.key = $3.key; 3635 } 3636 ; 3637 3638 timeout_spec : STRING number 3639 { 3640 if (check_rulestate(PFCTL_STATE_OPTION)) { 3641 free($1); 3642 YYERROR; 3643 } 3644 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3645 yyerror("unknown timeout %s", $1); 3646 free($1); 3647 YYERROR; 3648 } 3649 free($1); 3650 } 3651 ; 3652 3653 timeout_list : timeout_list comma timeout_spec 3654 | timeout_spec 3655 ; 3656 3657 limit_spec : STRING number 3658 { 3659 if (check_rulestate(PFCTL_STATE_OPTION)) { 3660 free($1); 3661 YYERROR; 3662 } 3663 if (pfctl_set_limit(pf, $1, $2) != 0) { 3664 yyerror("unable to set limit %s %u", $1, $2); 3665 free($1); 3666 YYERROR; 3667 } 3668 free($1); 3669 } 3670 ; 3671 3672 limit_list : limit_list comma limit_spec 3673 | limit_spec 3674 ; 3675 3676 comma : ',' 3677 | /* empty */ 3678 ; 3679 3680 yesno : NO { $$ = 0; } 3681 | STRING { 3682 if (!strcmp($1, "yes")) 3683 $$ = 1; 3684 else { 3685 yyerror("invalid value '%s', expected 'yes' " 3686 "or 'no'", $1); 3687 free($1); 3688 YYERROR; 3689 } 3690 free($1); 3691 } 3692 ; 3693 3694 unaryop : '=' { $$ = PF_OP_EQ; } 3695 | '!' '=' { $$ = PF_OP_NE; } 3696 | '<' '=' { $$ = PF_OP_LE; } 3697 | '<' { $$ = PF_OP_LT; } 3698 | '>' '=' { $$ = PF_OP_GE; } 3699 | '>' { $$ = PF_OP_GT; } 3700 ; 3701 3702 %% 3703 3704 int 3705 yyerror(const char *fmt, ...) 3706 { 3707 va_list ap; 3708 extern char *infile; 3709 3710 errors = 1; 3711 va_start(ap, fmt); 3712 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3713 vfprintf(stderr, fmt, ap); 3714 fprintf(stderr, "\n"); 3715 va_end(ap); 3716 return (0); 3717 } 3718 3719 int 3720 disallow_table(struct node_host *h, const char *fmt) 3721 { 3722 for (; h != NULL; h = h->next) 3723 if (h->addr.type == PF_ADDR_TABLE) { 3724 yyerror(fmt, h->addr.v.tblname); 3725 return (1); 3726 } 3727 return (0); 3728 } 3729 3730 int 3731 disallow_alias(struct node_host *h, const char *fmt) 3732 { 3733 for (; h != NULL; h = h->next) 3734 if (DYNIF_MULTIADDR(h->addr)) { 3735 yyerror(fmt, h->addr.v.tblname); 3736 return (1); 3737 } 3738 return (0); 3739 } 3740 3741 int 3742 rule_consistent(struct pf_rule *r) 3743 { 3744 int problems = 0; 3745 3746 switch (r->action) { 3747 case PF_PASS: 3748 case PF_DROP: 3749 case PF_SCRUB: 3750 case PF_NOSCRUB: 3751 problems = filter_consistent(r); 3752 break; 3753 case PF_NAT: 3754 case PF_NONAT: 3755 problems = nat_consistent(r); 3756 break; 3757 case PF_RDR: 3758 case PF_NORDR: 3759 problems = rdr_consistent(r); 3760 break; 3761 case PF_BINAT: 3762 case PF_NOBINAT: 3763 default: 3764 break; 3765 } 3766 return (problems); 3767 } 3768 3769 int 3770 filter_consistent(struct pf_rule *r) 3771 { 3772 int problems = 0; 3773 3774 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3775 (r->src.port_op || r->dst.port_op)) { 3776 yyerror("port only applies to tcp/udp"); 3777 problems++; 3778 } 3779 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3780 (r->type || r->code)) { 3781 yyerror("icmp-type/code only applies to icmp"); 3782 problems++; 3783 } 3784 if (!r->af && (r->type || r->code)) { 3785 yyerror("must indicate address family with icmp-type/code"); 3786 problems++; 3787 } 3788 if (r->overload_tblname[0] && 3789 r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { 3790 yyerror("'overload' requires 'max-src-conn' " 3791 "or 'max-src-conn-rate'"); 3792 problems++; 3793 } 3794 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3795 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3796 yyerror("proto %s doesn't match address family %s", 3797 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3798 r->af == AF_INET ? "inet" : "inet6"); 3799 problems++; 3800 } 3801 if (r->allow_opts && r->action != PF_PASS) { 3802 yyerror("allow-opts can only be specified for pass rules"); 3803 problems++; 3804 } 3805 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3806 r->dst.port_op || r->flagset || r->type || r->code)) { 3807 yyerror("fragments can be filtered only on IP header fields"); 3808 problems++; 3809 } 3810 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3811 yyerror("return-rst can only be applied to TCP rules"); 3812 problems++; 3813 } 3814 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3815 yyerror("max-src-nodes requires 'source-track rule'"); 3816 problems++; 3817 } 3818 if (r->action == PF_DROP && r->keep_state) { 3819 yyerror("keep state on block rules doesn't make sense"); 3820 problems++; 3821 } 3822 if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state && 3823 r->action == PF_PASS) { 3824 yyerror("tags cannot be used without keep state"); 3825 problems++; 3826 } 3827 return (-problems); 3828 } 3829 3830 int 3831 nat_consistent(struct pf_rule *r) 3832 { 3833 return (0); /* yeah! */ 3834 } 3835 3836 int 3837 rdr_consistent(struct pf_rule *r) 3838 { 3839 int problems = 0; 3840 3841 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3842 if (r->src.port_op) { 3843 yyerror("src port only applies to tcp/udp"); 3844 problems++; 3845 } 3846 if (r->dst.port_op) { 3847 yyerror("dst port only applies to tcp/udp"); 3848 problems++; 3849 } 3850 if (r->rpool.proxy_port[0]) { 3851 yyerror("rpool port only applies to tcp/udp"); 3852 problems++; 3853 } 3854 } 3855 if (r->dst.port_op && 3856 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3857 yyerror("invalid port operator for rdr destination port"); 3858 problems++; 3859 } 3860 return (-problems); 3861 } 3862 3863 int 3864 process_tabledef(char *name, struct table_opts *opts) 3865 { 3866 struct pfr_buffer ab; 3867 struct node_tinit *ti; 3868 3869 bzero(&ab, sizeof(ab)); 3870 ab.pfrb_type = PFRB_ADDRS; 3871 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3872 if (ti->file) 3873 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3874 if (errno) 3875 yyerror("cannot load \"%s\": %s", 3876 ti->file, strerror(errno)); 3877 else 3878 yyerror("file \"%s\" contains bad data", 3879 ti->file); 3880 goto _error; 3881 } 3882 if (ti->host) 3883 if (append_addr_host(&ab, ti->host, 0, 0)) { 3884 yyerror("cannot create address buffer: %s", 3885 strerror(errno)); 3886 goto _error; 3887 } 3888 } 3889 if (pf->opts & PF_OPT_VERBOSE) 3890 print_tabledef(name, opts->flags, opts->init_addr, 3891 &opts->init_nodes); 3892 if (!(pf->opts & PF_OPT_NOACTION) && 3893 pfctl_define_table(name, opts->flags, opts->init_addr, 3894 pf->anchor, &ab, pf->tticket)) { 3895 yyerror("cannot define table %s: %s", name, 3896 pfr_strerror(errno)); 3897 goto _error; 3898 } 3899 pf->tdirty = 1; 3900 pfr_buf_clear(&ab); 3901 return (0); 3902 _error: 3903 pfr_buf_clear(&ab); 3904 return (-1); 3905 } 3906 3907 struct keywords { 3908 const char *k_name; 3909 int k_val; 3910 }; 3911 3912 /* macro gore, but you should've seen the prior indentation nightmare... */ 3913 3914 #define FREE_LIST(T,r) \ 3915 do { \ 3916 T *p, *node = r; \ 3917 while (node != NULL) { \ 3918 p = node; \ 3919 node = node->next; \ 3920 free(p); \ 3921 } \ 3922 } while (0) 3923 3924 #define LOOP_THROUGH(T,n,r,C) \ 3925 do { \ 3926 T *n; \ 3927 if (r == NULL) { \ 3928 r = calloc(1, sizeof(T)); \ 3929 if (r == NULL) \ 3930 err(1, "LOOP: calloc"); \ 3931 r->next = NULL; \ 3932 } \ 3933 n = r; \ 3934 while (n != NULL) { \ 3935 do { \ 3936 C; \ 3937 } while (0); \ 3938 n = n->next; \ 3939 } \ 3940 } while (0) 3941 3942 void 3943 expand_label_str(char *label, size_t len, const char *srch, const char *repl) 3944 { 3945 char *tmp; 3946 char *p, *q; 3947 3948 if ((tmp = calloc(1, len)) == NULL) 3949 err(1, "expand_label_str: calloc"); 3950 p = q = label; 3951 while ((q = strstr(p, srch)) != NULL) { 3952 *q = '\0'; 3953 if ((strlcat(tmp, p, len) >= len) || 3954 (strlcat(tmp, repl, len) >= len)) 3955 errx(1, "expand_label: label too long"); 3956 q += strlen(srch); 3957 p = q; 3958 } 3959 if (strlcat(tmp, p, len) >= len) 3960 errx(1, "expand_label: label too long"); 3961 strlcpy(label, tmp, len); /* always fits */ 3962 free(tmp); 3963 } 3964 3965 void 3966 expand_label_if(const char *name, char *label, size_t len, const char *ifname) 3967 { 3968 if (strstr(label, name) != NULL) { 3969 if (!*ifname) 3970 expand_label_str(label, len, name, "any"); 3971 else 3972 expand_label_str(label, len, name, ifname); 3973 } 3974 } 3975 3976 void 3977 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 3978 struct node_host *h) 3979 { 3980 char tmp[64], tmp_not[66]; 3981 3982 if (strstr(label, name) != NULL) { 3983 switch (h->addr.type) { 3984 case PF_ADDR_DYNIFTL: 3985 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 3986 break; 3987 case PF_ADDR_TABLE: 3988 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 3989 break; 3990 case PF_ADDR_NOROUTE: 3991 snprintf(tmp, sizeof(tmp), "no-route"); 3992 break; 3993 case PF_ADDR_ADDRMASK: 3994 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 3995 PF_AZERO(&h->addr.v.a.mask, af))) 3996 snprintf(tmp, sizeof(tmp), "any"); 3997 else { 3998 char a[48]; 3999 int bits; 4000 4001 if (inet_ntop(af, &h->addr.v.a.addr, a, 4002 sizeof(a)) == NULL) 4003 snprintf(tmp, sizeof(tmp), "?"); 4004 else { 4005 bits = unmask(&h->addr.v.a.mask, af); 4006 if ((af == AF_INET && bits < 32) || 4007 (af == AF_INET6 && bits < 128)) 4008 snprintf(tmp, sizeof(tmp), 4009 "%s/%d", a, bits); 4010 else 4011 snprintf(tmp, sizeof(tmp), 4012 "%s", a); 4013 } 4014 } 4015 break; 4016 default: 4017 snprintf(tmp, sizeof(tmp), "?"); 4018 break; 4019 } 4020 4021 if (h->not) { 4022 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 4023 expand_label_str(label, len, name, tmp_not); 4024 } else 4025 expand_label_str(label, len, name, tmp); 4026 } 4027 } 4028 4029 void 4030 expand_label_port(const char *name, char *label, size_t len, 4031 struct node_port *port) 4032 { 4033 char a1[6], a2[6], op[13] = ""; 4034 4035 if (strstr(label, name) != NULL) { 4036 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 4037 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 4038 if (!port->op) 4039 ; 4040 else if (port->op == PF_OP_IRG) 4041 snprintf(op, sizeof(op), "%s><%s", a1, a2); 4042 else if (port->op == PF_OP_XRG) 4043 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 4044 else if (port->op == PF_OP_EQ) 4045 snprintf(op, sizeof(op), "%s", a1); 4046 else if (port->op == PF_OP_NE) 4047 snprintf(op, sizeof(op), "!=%s", a1); 4048 else if (port->op == PF_OP_LT) 4049 snprintf(op, sizeof(op), "<%s", a1); 4050 else if (port->op == PF_OP_LE) 4051 snprintf(op, sizeof(op), "<=%s", a1); 4052 else if (port->op == PF_OP_GT) 4053 snprintf(op, sizeof(op), ">%s", a1); 4054 else if (port->op == PF_OP_GE) 4055 snprintf(op, sizeof(op), ">=%s", a1); 4056 expand_label_str(label, len, name, op); 4057 } 4058 } 4059 4060 void 4061 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 4062 { 4063 struct protoent *pe; 4064 char n[4]; 4065 4066 if (strstr(label, name) != NULL) { 4067 pe = getprotobynumber(proto); 4068 if (pe != NULL) 4069 expand_label_str(label, len, name, pe->p_name); 4070 else { 4071 snprintf(n, sizeof(n), "%u", proto); 4072 expand_label_str(label, len, name, n); 4073 } 4074 } 4075 } 4076 4077 void 4078 expand_label_nr(const char *name, char *label, size_t len) 4079 { 4080 char n[11]; 4081 4082 if (strstr(label, name) != NULL) { 4083 snprintf(n, sizeof(n), "%u", pf->rule_nr); 4084 expand_label_str(label, len, name, n); 4085 } 4086 } 4087 4088 void 4089 expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 4090 struct node_host *src_host, struct node_port *src_port, 4091 struct node_host *dst_host, struct node_port *dst_port, 4092 u_int8_t proto) 4093 { 4094 expand_label_if("$if", label, len, ifname); 4095 expand_label_addr("$srcaddr", label, len, af, src_host); 4096 expand_label_addr("$dstaddr", label, len, af, dst_host); 4097 expand_label_port("$srcport", label, len, src_port); 4098 expand_label_port("$dstport", label, len, dst_port); 4099 expand_label_proto("$proto", label, len, proto); 4100 expand_label_nr("$nr", label, len); 4101 } 4102 4103 int 4104 expand_altq(struct pf_altq *a, struct node_if *interfaces, 4105 struct node_queue *nqueues, struct node_queue_bw bwspec, 4106 struct node_queue_opt *opts) 4107 { 4108 struct pf_altq pa, pb; 4109 char qname[PF_QNAME_SIZE]; 4110 struct node_queue *n; 4111 struct node_queue_bw bw; 4112 int errs = 0; 4113 4114 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4115 FREE_LIST(struct node_if, interfaces); 4116 FREE_LIST(struct node_queue, nqueues); 4117 return (0); 4118 } 4119 4120 LOOP_THROUGH(struct node_if, interface, interfaces, 4121 memcpy(&pa, a, sizeof(struct pf_altq)); 4122 if (strlcpy(pa.ifname, interface->ifname, 4123 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4124 errx(1, "expand_altq: strlcpy"); 4125 4126 if (interface->not) { 4127 yyerror("altq on ! <interface> is not supported"); 4128 errs++; 4129 } else { 4130 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 4131 errs++; 4132 else 4133 if (pfctl_add_altq(pf, &pa)) 4134 errs++; 4135 4136 if (pf->opts & PF_OPT_VERBOSE) { 4137 print_altq(&pf->paltq->altq, 0, 4138 &bwspec, opts); 4139 if (nqueues && nqueues->tail) { 4140 printf("queue { "); 4141 LOOP_THROUGH(struct node_queue, queue, 4142 nqueues, 4143 printf("%s ", 4144 queue->queue); 4145 ); 4146 printf("}"); 4147 } 4148 printf("\n"); 4149 } 4150 4151 if (pa.scheduler == ALTQT_CBQ || 4152 pa.scheduler == ALTQT_HFSC) { 4153 /* now create a root queue */ 4154 memset(&pb, 0, sizeof(struct pf_altq)); 4155 if (strlcpy(qname, "root_", sizeof(qname)) >= 4156 sizeof(qname)) 4157 errx(1, "expand_altq: strlcpy"); 4158 if (strlcat(qname, interface->ifname, 4159 sizeof(qname)) >= sizeof(qname)) 4160 errx(1, "expand_altq: strlcat"); 4161 if (strlcpy(pb.qname, qname, 4162 sizeof(pb.qname)) >= sizeof(pb.qname)) 4163 errx(1, "expand_altq: strlcpy"); 4164 if (strlcpy(pb.ifname, interface->ifname, 4165 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 4166 errx(1, "expand_altq: strlcpy"); 4167 pb.qlimit = pa.qlimit; 4168 pb.scheduler = pa.scheduler; 4169 bw.bw_absolute = pa.ifbandwidth; 4170 bw.bw_percent = 0; 4171 if (eval_pfqueue(pf, &pb, &bw, opts)) 4172 errs++; 4173 else 4174 if (pfctl_add_altq(pf, &pb)) 4175 errs++; 4176 } 4177 4178 LOOP_THROUGH(struct node_queue, queue, nqueues, 4179 n = calloc(1, sizeof(struct node_queue)); 4180 if (n == NULL) 4181 err(1, "expand_altq: calloc"); 4182 if (pa.scheduler == ALTQT_CBQ || 4183 pa.scheduler == ALTQT_HFSC) 4184 if (strlcpy(n->parent, qname, 4185 sizeof(n->parent)) >= 4186 sizeof(n->parent)) 4187 errx(1, "expand_altq: strlcpy"); 4188 if (strlcpy(n->queue, queue->queue, 4189 sizeof(n->queue)) >= sizeof(n->queue)) 4190 errx(1, "expand_altq: strlcpy"); 4191 if (strlcpy(n->ifname, interface->ifname, 4192 sizeof(n->ifname)) >= sizeof(n->ifname)) 4193 errx(1, "expand_altq: strlcpy"); 4194 n->scheduler = pa.scheduler; 4195 n->next = NULL; 4196 n->tail = n; 4197 if (queues == NULL) 4198 queues = n; 4199 else { 4200 queues->tail->next = n; 4201 queues->tail = n; 4202 } 4203 ); 4204 } 4205 ); 4206 FREE_LIST(struct node_if, interfaces); 4207 FREE_LIST(struct node_queue, nqueues); 4208 4209 return (errs); 4210 } 4211 4212 int 4213 expand_queue(struct pf_altq *a, struct node_if *interfaces, 4214 struct node_queue *nqueues, struct node_queue_bw bwspec, 4215 struct node_queue_opt *opts) 4216 { 4217 struct node_queue *n, *nq; 4218 struct pf_altq pa; 4219 u_int8_t found = 0; 4220 u_int8_t errs = 0; 4221 4222 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 4223 FREE_LIST(struct node_queue, nqueues); 4224 return (0); 4225 } 4226 4227 if (queues == NULL) { 4228 yyerror("queue %s has no parent", a->qname); 4229 FREE_LIST(struct node_queue, nqueues); 4230 return (1); 4231 } 4232 4233 LOOP_THROUGH(struct node_if, interface, interfaces, 4234 LOOP_THROUGH(struct node_queue, tqueue, queues, 4235 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 4236 (interface->ifname[0] == 0 || 4237 (!interface->not && !strncmp(interface->ifname, 4238 tqueue->ifname, IFNAMSIZ)) || 4239 (interface->not && strncmp(interface->ifname, 4240 tqueue->ifname, IFNAMSIZ)))) { 4241 /* found ourself in queues */ 4242 found++; 4243 4244 memcpy(&pa, a, sizeof(struct pf_altq)); 4245 4246 if (pa.scheduler != ALTQT_NONE && 4247 pa.scheduler != tqueue->scheduler) { 4248 yyerror("exactly one scheduler type " 4249 "per interface allowed"); 4250 errs++; 4251 goto out; 4252 } 4253 pa.scheduler = tqueue->scheduler; 4254 4255 /* scheduler dependent error checking */ 4256 switch (pa.scheduler) { 4257 case ALTQT_PRIQ: 4258 if (nqueues != NULL) { 4259 yyerror("priq queues cannot " 4260 "have child queues"); 4261 errs++; 4262 goto out; 4263 } 4264 if (bwspec.bw_absolute > 0 || 4265 bwspec.bw_percent < 100) { 4266 yyerror("priq doesn't take " 4267 "bandwidth"); 4268 errs++; 4269 goto out; 4270 } 4271 break; 4272 default: 4273 break; 4274 } 4275 4276 if (strlcpy(pa.ifname, tqueue->ifname, 4277 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4278 errx(1, "expand_queue: strlcpy"); 4279 if (strlcpy(pa.parent, tqueue->parent, 4280 sizeof(pa.parent)) >= sizeof(pa.parent)) 4281 errx(1, "expand_queue: strlcpy"); 4282 4283 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4284 errs++; 4285 else 4286 if (pfctl_add_altq(pf, &pa)) 4287 errs++; 4288 4289 for (nq = nqueues; nq != NULL; nq = nq->next) { 4290 if (!strcmp(a->qname, nq->queue)) { 4291 yyerror("queue cannot have " 4292 "itself as child"); 4293 errs++; 4294 continue; 4295 } 4296 n = calloc(1, 4297 sizeof(struct node_queue)); 4298 if (n == NULL) 4299 err(1, "expand_queue: calloc"); 4300 if (strlcpy(n->parent, a->qname, 4301 sizeof(n->parent)) >= 4302 sizeof(n->parent)) 4303 errx(1, "expand_queue strlcpy"); 4304 if (strlcpy(n->queue, nq->queue, 4305 sizeof(n->queue)) >= 4306 sizeof(n->queue)) 4307 errx(1, "expand_queue strlcpy"); 4308 if (strlcpy(n->ifname, tqueue->ifname, 4309 sizeof(n->ifname)) >= 4310 sizeof(n->ifname)) 4311 errx(1, "expand_queue strlcpy"); 4312 n->scheduler = tqueue->scheduler; 4313 n->next = NULL; 4314 n->tail = n; 4315 if (queues == NULL) 4316 queues = n; 4317 else { 4318 queues->tail->next = n; 4319 queues->tail = n; 4320 } 4321 } 4322 if ((pf->opts & PF_OPT_VERBOSE) && ( 4323 (found == 1 && interface->ifname[0] == 0) || 4324 (found > 0 && interface->ifname[0] != 0))) { 4325 print_queue(&pf->paltq->altq, 0, 4326 &bwspec, interface->ifname[0] != 0, 4327 opts); 4328 if (nqueues && nqueues->tail) { 4329 printf("{ "); 4330 LOOP_THROUGH(struct node_queue, 4331 queue, nqueues, 4332 printf("%s ", 4333 queue->queue); 4334 ); 4335 printf("}"); 4336 } 4337 printf("\n"); 4338 } 4339 } 4340 ); 4341 ); 4342 4343 out: 4344 FREE_LIST(struct node_queue, nqueues); 4345 FREE_LIST(struct node_if, interfaces); 4346 4347 if (!found) { 4348 yyerror("queue %s has no parent", a->qname); 4349 errs++; 4350 } 4351 4352 if (errs) 4353 return (1); 4354 else 4355 return (0); 4356 } 4357 4358 void 4359 expand_rule(struct pf_rule *r, 4360 struct node_if *interfaces, struct node_host *rpool_hosts, 4361 struct node_proto *protos, struct node_os *src_oses, 4362 struct node_host *src_hosts, struct node_port *src_ports, 4363 struct node_host *dst_hosts, struct node_port *dst_ports, 4364 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types, 4365 const char *anchor_call) 4366 { 4367 sa_family_t af = r->af; 4368 int added = 0, error = 0; 4369 char ifname[IF_NAMESIZE]; 4370 char label[PF_RULE_LABEL_SIZE]; 4371 char tagname[PF_TAG_NAME_SIZE]; 4372 char match_tagname[PF_TAG_NAME_SIZE]; 4373 struct pf_pooladdr *pa; 4374 struct node_host *h; 4375 u_int8_t flags, flagset, keep_state; 4376 4377 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4378 errx(1, "expand_rule: strlcpy"); 4379 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4380 errx(1, "expand_rule: strlcpy"); 4381 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4382 sizeof(match_tagname)) 4383 errx(1, "expand_rule: strlcpy"); 4384 flags = r->flags; 4385 flagset = r->flagset; 4386 keep_state = r->keep_state; 4387 4388 LOOP_THROUGH(struct node_if, interface, interfaces, 4389 LOOP_THROUGH(struct node_proto, proto, protos, 4390 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4391 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4392 LOOP_THROUGH(struct node_port, src_port, src_ports, 4393 LOOP_THROUGH(struct node_os, src_os, src_oses, 4394 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4395 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4396 LOOP_THROUGH(struct node_uid, uid, uids, 4397 LOOP_THROUGH(struct node_gid, gid, gids, 4398 4399 r->af = af; 4400 /* for link-local IPv6 address, interface must match up */ 4401 if ((r->af && src_host->af && r->af != src_host->af) || 4402 (r->af && dst_host->af && r->af != dst_host->af) || 4403 (src_host->af && dst_host->af && 4404 src_host->af != dst_host->af) || 4405 (src_host->ifindex && dst_host->ifindex && 4406 src_host->ifindex != dst_host->ifindex) || 4407 (src_host->ifindex && *interface->ifname && 4408 src_host->ifindex != if_nametoindex(interface->ifname)) || 4409 (dst_host->ifindex && *interface->ifname && 4410 dst_host->ifindex != if_nametoindex(interface->ifname))) 4411 continue; 4412 if (!r->af && src_host->af) 4413 r->af = src_host->af; 4414 else if (!r->af && dst_host->af) 4415 r->af = dst_host->af; 4416 4417 if (*interface->ifname) 4418 strlcpy(r->ifname, interface->ifname, 4419 sizeof(r->ifname)); 4420 else if (if_indextoname(src_host->ifindex, ifname)) 4421 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4422 else if (if_indextoname(dst_host->ifindex, ifname)) 4423 strlcpy(r->ifname, ifname, sizeof(r->ifname)); 4424 else 4425 memset(r->ifname, '\0', sizeof(r->ifname)); 4426 4427 if (strlcpy(r->label, label, sizeof(r->label)) >= 4428 sizeof(r->label)) 4429 errx(1, "expand_rule: strlcpy"); 4430 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4431 sizeof(r->tagname)) 4432 errx(1, "expand_rule: strlcpy"); 4433 if (strlcpy(r->match_tagname, match_tagname, 4434 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4435 errx(1, "expand_rule: strlcpy"); 4436 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4437 src_host, src_port, dst_host, dst_port, proto->proto); 4438 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4439 src_host, src_port, dst_host, dst_port, proto->proto); 4440 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4441 r->af, src_host, src_port, dst_host, dst_port, 4442 proto->proto); 4443 4444 error += check_netmask(src_host, r->af); 4445 error += check_netmask(dst_host, r->af); 4446 4447 r->ifnot = interface->not; 4448 r->proto = proto->proto; 4449 r->src.addr = src_host->addr; 4450 r->src.neg = src_host->not; 4451 r->src.port[0] = src_port->port[0]; 4452 r->src.port[1] = src_port->port[1]; 4453 r->src.port_op = src_port->op; 4454 r->dst.addr = dst_host->addr; 4455 r->dst.neg = dst_host->not; 4456 r->dst.port[0] = dst_port->port[0]; 4457 r->dst.port[1] = dst_port->port[1]; 4458 r->dst.port_op = dst_port->op; 4459 r->uid.op = uid->op; 4460 r->uid.uid[0] = uid->uid[0]; 4461 r->uid.uid[1] = uid->uid[1]; 4462 r->gid.op = gid->op; 4463 r->gid.gid[0] = gid->gid[0]; 4464 r->gid.gid[1] = gid->gid[1]; 4465 r->type = icmp_type->type; 4466 r->code = icmp_type->code; 4467 4468 if ((keep_state == PF_STATE_MODULATE || 4469 keep_state == PF_STATE_SYNPROXY) && 4470 r->proto && r->proto != IPPROTO_TCP) 4471 r->keep_state = PF_STATE_NORMAL; 4472 else 4473 r->keep_state = keep_state; 4474 4475 if (r->proto && r->proto != IPPROTO_TCP) { 4476 r->flags = 0; 4477 r->flagset = 0; 4478 } else { 4479 r->flags = flags; 4480 r->flagset = flagset; 4481 } 4482 if (icmp_type->proto && r->proto != icmp_type->proto) { 4483 yyerror("icmp-type mismatch"); 4484 error++; 4485 } 4486 4487 if (src_os && src_os->os) { 4488 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4489 if ((pf->opts & PF_OPT_VERBOSE2) && 4490 r->os_fingerprint == PF_OSFP_NOMATCH) 4491 fprintf(stderr, 4492 "warning: unknown '%s' OS fingerprint\n", 4493 src_os->os); 4494 } else { 4495 r->os_fingerprint = PF_OSFP_ANY; 4496 } 4497 4498 TAILQ_INIT(&r->rpool.list); 4499 for (h = rpool_hosts; h != NULL; h = h->next) { 4500 pa = calloc(1, sizeof(struct pf_pooladdr)); 4501 if (pa == NULL) 4502 err(1, "expand_rule: calloc"); 4503 pa->addr = h->addr; 4504 if (h->ifname != NULL) { 4505 if (strlcpy(pa->ifname, h->ifname, 4506 sizeof(pa->ifname)) >= 4507 sizeof(pa->ifname)) 4508 errx(1, "expand_rule: strlcpy"); 4509 } else 4510 pa->ifname[0] = 0; 4511 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4512 } 4513 4514 if (rule_consistent(r) < 0 || error) 4515 yyerror("skipping rule due to errors"); 4516 else { 4517 r->nr = pf->rule_nr++; 4518 pfctl_add_rule(pf, r, anchor_call); 4519 added++; 4520 } 4521 4522 )))))))))); 4523 4524 FREE_LIST(struct node_if, interfaces); 4525 FREE_LIST(struct node_proto, protos); 4526 FREE_LIST(struct node_host, src_hosts); 4527 FREE_LIST(struct node_port, src_ports); 4528 FREE_LIST(struct node_os, src_oses); 4529 FREE_LIST(struct node_host, dst_hosts); 4530 FREE_LIST(struct node_port, dst_ports); 4531 FREE_LIST(struct node_uid, uids); 4532 FREE_LIST(struct node_gid, gids); 4533 FREE_LIST(struct node_icmp, icmp_types); 4534 FREE_LIST(struct node_host, rpool_hosts); 4535 4536 if (!added) 4537 yyerror("rule expands to no valid combination"); 4538 } 4539 4540 int 4541 expand_skip_interface(struct node_if *interfaces) 4542 { 4543 int errs = 0; 4544 4545 if (!interfaces || (!interfaces->next && !interfaces->not && 4546 !strcmp(interfaces->ifname, "none"))) { 4547 if (pf->opts & PF_OPT_VERBOSE) 4548 printf("set skip on none\n"); 4549 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0); 4550 return (errs); 4551 } 4552 4553 if (pf->opts & PF_OPT_VERBOSE) 4554 printf("set skip on {"); 4555 LOOP_THROUGH(struct node_if, interface, interfaces, 4556 if (pf->opts & PF_OPT_VERBOSE) 4557 printf(" %s", interface->ifname); 4558 if (interface->not) { 4559 yyerror("skip on ! <interface> is not supported"); 4560 errs++; 4561 } else 4562 errs += pfctl_set_interface_flags(pf, 4563 interface->ifname, PFI_IFLAG_SKIP, 1); 4564 ); 4565 if (pf->opts & PF_OPT_VERBOSE) 4566 printf(" }\n"); 4567 4568 FREE_LIST(struct node_if, interfaces); 4569 4570 if (errs) 4571 return (1); 4572 else 4573 return (0); 4574 } 4575 4576 #undef FREE_LIST 4577 #undef LOOP_THROUGH 4578 4579 int 4580 check_rulestate(int desired_state) 4581 { 4582 if (require_order && (rulestate > desired_state)) { 4583 yyerror("Rules must be in order: options, normalization, " 4584 "queueing, translation, filtering"); 4585 return (1); 4586 } 4587 rulestate = desired_state; 4588 return (0); 4589 } 4590 4591 int 4592 kw_cmp(const void *k, const void *e) 4593 { 4594 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4595 } 4596 4597 int 4598 lookup(char *s) 4599 { 4600 /* this has to be sorted always */ 4601 static const struct keywords keywords[] = { 4602 { "all", ALL}, 4603 { "allow-opts", ALLOWOPTS}, 4604 { "altq", ALTQ}, 4605 { "anchor", ANCHOR}, 4606 { "antispoof", ANTISPOOF}, 4607 { "any", ANY}, 4608 { "bandwidth", BANDWIDTH}, 4609 { "binat", BINAT}, 4610 { "binat-anchor", BINATANCHOR}, 4611 { "bitmask", BITMASK}, 4612 { "block", BLOCK}, 4613 { "block-policy", BLOCKPOLICY}, 4614 { "cbq", CBQ}, 4615 { "code", CODE}, 4616 { "crop", FRAGCROP}, 4617 { "debug", DEBUG}, 4618 { "drop", DROP}, 4619 { "drop-ovl", FRAGDROP}, 4620 { "dup-to", DUPTO}, 4621 { "fastroute", FASTROUTE}, 4622 { "file", FILENAME}, 4623 { "fingerprints", FINGERPRINTS}, 4624 { "flags", FLAGS}, 4625 { "floating", FLOATING}, 4626 { "flush", FLUSH}, 4627 { "for", FOR}, 4628 { "fragment", FRAGMENT}, 4629 { "from", FROM}, 4630 { "global", GLOBAL}, 4631 { "group", GROUP}, 4632 { "group-bound", GRBOUND}, 4633 { "hfsc", HFSC}, 4634 { "hostid", HOSTID}, 4635 { "icmp-type", ICMPTYPE}, 4636 { "icmp6-type", ICMP6TYPE}, 4637 { "if-bound", IFBOUND}, 4638 { "in", IN}, 4639 { "inet", INET}, 4640 { "inet6", INET6}, 4641 { "keep", KEEP}, 4642 { "label", LABEL}, 4643 { "limit", LIMIT}, 4644 { "linkshare", LINKSHARE}, 4645 { "load", LOAD}, 4646 { "log", LOG}, 4647 { "log-all", LOGALL}, 4648 { "loginterface", LOGINTERFACE}, 4649 { "max", MAXIMUM}, 4650 { "max-mss", MAXMSS}, 4651 { "max-src-conn", MAXSRCCONN}, 4652 { "max-src-conn-rate", MAXSRCCONNRATE}, 4653 { "max-src-nodes", MAXSRCNODES}, 4654 { "max-src-states", MAXSRCSTATES}, 4655 { "min-ttl", MINTTL}, 4656 { "modulate", MODULATE}, 4657 { "nat", NAT}, 4658 { "nat-anchor", NATANCHOR}, 4659 { "no", NO}, 4660 { "no-df", NODF}, 4661 { "no-route", NOROUTE}, 4662 { "no-sync", NOSYNC}, 4663 { "on", ON}, 4664 { "optimization", OPTIMIZATION}, 4665 { "os", OS}, 4666 { "out", OUT}, 4667 { "overload", OVERLOAD}, 4668 { "pass", PASS}, 4669 { "port", PORT}, 4670 { "priority", PRIORITY}, 4671 { "priq", PRIQ}, 4672 { "probability", PROBABILITY}, 4673 { "proto", PROTO}, 4674 { "qlimit", QLIMIT}, 4675 { "queue", QUEUE}, 4676 { "quick", QUICK}, 4677 { "random", RANDOM}, 4678 { "random-id", RANDOMID}, 4679 { "rdr", RDR}, 4680 { "rdr-anchor", RDRANCHOR}, 4681 { "realtime", REALTIME}, 4682 { "reassemble", REASSEMBLE}, 4683 { "reply-to", REPLYTO}, 4684 { "require-order", REQUIREORDER}, 4685 { "return", RETURN}, 4686 { "return-icmp", RETURNICMP}, 4687 { "return-icmp6", RETURNICMP6}, 4688 { "return-rst", RETURNRST}, 4689 { "round-robin", ROUNDROBIN}, 4690 { "route", ROUTE}, 4691 { "route-to", ROUTETO}, 4692 { "rule", RULE}, 4693 { "scrub", SCRUB}, 4694 { "set", SET}, 4695 { "skip", SKIP}, 4696 { "source-hash", SOURCEHASH}, 4697 { "source-track", SOURCETRACK}, 4698 { "state", STATE}, 4699 { "state-policy", STATEPOLICY}, 4700 { "static-port", STATICPORT}, 4701 { "sticky-address", STICKYADDRESS}, 4702 { "synproxy", SYNPROXY}, 4703 { "table", TABLE}, 4704 { "tag", TAG}, 4705 { "tagged", TAGGED}, 4706 { "tbrsize", TBRSIZE}, 4707 { "timeout", TIMEOUT}, 4708 { "to", TO}, 4709 { "tos", TOS}, 4710 { "ttl", TTL}, 4711 { "upperlimit", UPPERLIMIT}, 4712 { "user", USER}, 4713 }; 4714 const struct keywords *p; 4715 4716 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4717 sizeof(keywords[0]), kw_cmp); 4718 4719 if (p) { 4720 if (debug > 1) 4721 fprintf(stderr, "%s: %d\n", s, p->k_val); 4722 return (p->k_val); 4723 } else { 4724 if (debug > 1) 4725 fprintf(stderr, "string: %s\n", s); 4726 return (STRING); 4727 } 4728 } 4729 4730 #define MAXPUSHBACK 128 4731 4732 char *parsebuf; 4733 int parseindex; 4734 char pushback_buffer[MAXPUSHBACK]; 4735 int pushback_index = 0; 4736 4737 int 4738 lgetc(FILE *f) 4739 { 4740 int c, next; 4741 4742 if (parsebuf) { 4743 /* Read character from the parsebuffer instead of input. */ 4744 if (parseindex >= 0) { 4745 c = parsebuf[parseindex++]; 4746 if (c != '\0') 4747 return (c); 4748 parsebuf = NULL; 4749 } else 4750 parseindex++; 4751 } 4752 4753 if (pushback_index) 4754 return (pushback_buffer[--pushback_index]); 4755 4756 while ((c = getc(f)) == '\\') { 4757 next = getc(f); 4758 if (next != '\n') { 4759 if (isspace(next)) 4760 yyerror("whitespace after \\"); 4761 ungetc(next, f); 4762 break; 4763 } 4764 yylval.lineno = lineno; 4765 lineno++; 4766 } 4767 if (c == '\t' || c == ' ') { 4768 /* Compress blanks to a single space. */ 4769 do { 4770 c = getc(f); 4771 } while (c == '\t' || c == ' '); 4772 ungetc(c, f); 4773 c = ' '; 4774 } 4775 4776 return (c); 4777 } 4778 4779 int 4780 lungetc(int c) 4781 { 4782 if (c == EOF) 4783 return (EOF); 4784 if (parsebuf) { 4785 parseindex--; 4786 if (parseindex >= 0) 4787 return (c); 4788 } 4789 if (pushback_index < MAXPUSHBACK-1) 4790 return (pushback_buffer[pushback_index++] = c); 4791 else 4792 return (EOF); 4793 } 4794 4795 int 4796 findeol(void) 4797 { 4798 int c; 4799 4800 parsebuf = NULL; 4801 pushback_index = 0; 4802 4803 /* skip to either EOF or the first real EOL */ 4804 while (1) { 4805 c = lgetc(fin); 4806 if (c == '\n') { 4807 lineno++; 4808 break; 4809 } 4810 if (c == EOF) 4811 break; 4812 } 4813 return (ERROR); 4814 } 4815 4816 int 4817 yylex(void) 4818 { 4819 char buf[8096]; 4820 char *p, *val; 4821 int endc, c, next; 4822 int token; 4823 4824 top: 4825 p = buf; 4826 while ((c = lgetc(fin)) == ' ') 4827 ; /* nothing */ 4828 4829 yylval.lineno = lineno; 4830 if (c == '#') 4831 while ((c = lgetc(fin)) != '\n' && c != EOF) 4832 ; /* nothing */ 4833 if (c == '$' && parsebuf == NULL) { 4834 while (1) { 4835 if ((c = lgetc(fin)) == EOF) 4836 return (0); 4837 4838 if (p + 1 >= buf + sizeof(buf) - 1) { 4839 yyerror("string too long"); 4840 return (findeol()); 4841 } 4842 if (isalnum(c) || c == '_') { 4843 *p++ = (char)c; 4844 continue; 4845 } 4846 *p = '\0'; 4847 lungetc(c); 4848 break; 4849 } 4850 val = symget(buf); 4851 if (val == NULL) { 4852 yyerror("macro '%s' not defined", buf); 4853 return (findeol()); 4854 } 4855 parsebuf = val; 4856 parseindex = 0; 4857 goto top; 4858 } 4859 4860 switch (c) { 4861 case '\'': 4862 case '"': 4863 endc = c; 4864 while (1) { 4865 if ((c = lgetc(fin)) == EOF) 4866 return (0); 4867 if (c == endc) { 4868 *p = '\0'; 4869 break; 4870 } 4871 if (c == '\n') { 4872 lineno++; 4873 continue; 4874 } 4875 if (p + 1 >= buf + sizeof(buf) - 1) { 4876 yyerror("string too long"); 4877 return (findeol()); 4878 } 4879 *p++ = (char)c; 4880 } 4881 yylval.v.string = strdup(buf); 4882 if (yylval.v.string == NULL) 4883 err(1, "yylex: strdup"); 4884 return (STRING); 4885 case '<': 4886 next = lgetc(fin); 4887 if (next == '>') { 4888 yylval.v.i = PF_OP_XRG; 4889 return (PORTBINARY); 4890 } 4891 lungetc(next); 4892 break; 4893 case '>': 4894 next = lgetc(fin); 4895 if (next == '<') { 4896 yylval.v.i = PF_OP_IRG; 4897 return (PORTBINARY); 4898 } 4899 lungetc(next); 4900 break; 4901 case '-': 4902 next = lgetc(fin); 4903 if (next == '>') 4904 return (ARROW); 4905 lungetc(next); 4906 break; 4907 } 4908 4909 #define allowed_in_string(x) \ 4910 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4911 x != '{' && x != '}' && x != '<' && x != '>' && \ 4912 x != '!' && x != '=' && x != '/' && x != '#' && \ 4913 x != ',')) 4914 4915 if (isalnum(c) || c == ':' || c == '_') { 4916 do { 4917 *p++ = c; 4918 if ((unsigned)(p-buf) >= sizeof(buf)) { 4919 yyerror("string too long"); 4920 return (findeol()); 4921 } 4922 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4923 lungetc(c); 4924 *p = '\0'; 4925 if ((token = lookup(buf)) == STRING) 4926 if ((yylval.v.string = strdup(buf)) == NULL) 4927 err(1, "yylex: strdup"); 4928 return (token); 4929 } 4930 if (c == '\n') { 4931 yylval.lineno = lineno; 4932 lineno++; 4933 } 4934 if (c == EOF) 4935 return (0); 4936 return (c); 4937 } 4938 4939 int 4940 parse_rules(FILE *input, struct pfctl *xpf) 4941 { 4942 struct sym *sym, *next; 4943 4944 fin = input; 4945 pf = xpf; 4946 lineno = 1; 4947 errors = 0; 4948 rulestate = PFCTL_STATE_NONE; 4949 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4950 returnicmp6default = 4951 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4952 blockpolicy = PFRULE_DROP; 4953 require_order = 1; 4954 4955 yyparse(); 4956 4957 /* Free macros and check which have not been used. */ 4958 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 4959 next = TAILQ_NEXT(sym, entries); 4960 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 4961 fprintf(stderr, "warning: macro '%s' not " 4962 "used\n", sym->nam); 4963 free(sym->nam); 4964 free(sym->val); 4965 TAILQ_REMOVE(&symhead, sym, entries); 4966 free(sym); 4967 } 4968 4969 return (errors ? -1 : 0); 4970 } 4971 4972 /* 4973 * Over-designed efficiency is a French and German concept, so how about 4974 * we wait until they discover this ugliness and make it all fancy. 4975 */ 4976 int 4977 symset(const char *nam, const char *val, int persist) 4978 { 4979 struct sym *sym; 4980 4981 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 4982 sym = TAILQ_NEXT(sym, entries)) 4983 ; /* nothing */ 4984 4985 if (sym != NULL) { 4986 if (sym->persist == 1) 4987 return (0); 4988 else { 4989 free(sym->nam); 4990 free(sym->val); 4991 TAILQ_REMOVE(&symhead, sym, entries); 4992 free(sym); 4993 } 4994 } 4995 if ((sym = calloc(1, sizeof(*sym))) == NULL) 4996 return (-1); 4997 4998 sym->nam = strdup(nam); 4999 if (sym->nam == NULL) { 5000 free(sym); 5001 return (-1); 5002 } 5003 sym->val = strdup(val); 5004 if (sym->val == NULL) { 5005 free(sym->nam); 5006 free(sym); 5007 return (-1); 5008 } 5009 sym->used = 0; 5010 sym->persist = persist; 5011 TAILQ_INSERT_TAIL(&symhead, sym, entries); 5012 return (0); 5013 } 5014 5015 int 5016 pfctl_cmdline_symset(char *s) 5017 { 5018 char *sym, *val; 5019 int ret; 5020 5021 if ((val = strrchr(s, '=')) == NULL) 5022 return (-1); 5023 5024 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 5025 err(1, "pfctl_cmdline_symset: malloc"); 5026 5027 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 5028 5029 ret = symset(sym, val + 1, 1); 5030 free(sym); 5031 5032 return (ret); 5033 } 5034 5035 char * 5036 symget(const char *nam) 5037 { 5038 struct sym *sym; 5039 5040 TAILQ_FOREACH(sym, &symhead, entries) 5041 if (strcmp(nam, sym->nam) == 0) { 5042 sym->used = 1; 5043 return (sym->val); 5044 } 5045 return (NULL); 5046 } 5047 5048 void 5049 decide_address_family(struct node_host *n, sa_family_t *af) 5050 { 5051 sa_family_t target_af = 0; 5052 5053 while (!*af && n != NULL) { 5054 if (n->af) { 5055 if (target_af == 0) 5056 target_af = n->af; 5057 if (target_af != n->af) 5058 return; 5059 } 5060 n = n->next; 5061 } 5062 if (!*af && target_af) 5063 *af = target_af; 5064 } 5065 5066 void 5067 remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 5068 { 5069 struct node_host *n = *nh, *prev = NULL; 5070 5071 while (n != NULL) { 5072 if (*af && n->af && n->af != *af) { 5073 /* unlink and free n */ 5074 struct node_host *next = n->next; 5075 5076 /* adjust tail pointer */ 5077 if (n == (*nh)->tail) 5078 (*nh)->tail = prev; 5079 /* adjust previous node's next pointer */ 5080 if (prev == NULL) 5081 *nh = next; 5082 else 5083 prev->next = next; 5084 /* free node */ 5085 if (n->ifname != NULL) 5086 free(n->ifname); 5087 free(n); 5088 n = next; 5089 } else { 5090 if (n->af && !*af) 5091 *af = n->af; 5092 prev = n; 5093 n = n->next; 5094 } 5095 } 5096 } 5097 5098 int 5099 invalid_redirect(struct node_host *nh, sa_family_t af) 5100 { 5101 if (!af) { 5102 struct node_host *n; 5103 5104 /* tables and dyniftl are ok without an address family */ 5105 for (n = nh; n != NULL; n = n->next) { 5106 if (n->addr.type != PF_ADDR_TABLE && 5107 n->addr.type != PF_ADDR_DYNIFTL) { 5108 yyerror("address family not given and " 5109 "translation address expands to multiple " 5110 "address families"); 5111 return (1); 5112 } 5113 } 5114 } 5115 if (nh == NULL) { 5116 yyerror("no translation address with matching address family " 5117 "found."); 5118 return (1); 5119 } 5120 return (0); 5121 } 5122 5123 int 5124 atoul(char *s, u_long *ulvalp) 5125 { 5126 u_long ulval; 5127 char *ep; 5128 5129 errno = 0; 5130 ulval = strtoul(s, &ep, 0); 5131 if (s[0] == '\0' || *ep != '\0') 5132 return (-1); 5133 if (errno == ERANGE && ulval == ULONG_MAX) 5134 return (-1); 5135 *ulvalp = ulval; 5136 return (0); 5137 } 5138 5139 int 5140 getservice(char *n) 5141 { 5142 struct servent *s; 5143 u_long ulval; 5144 5145 if (atoul(n, &ulval) == 0) { 5146 if (ulval > 65535) { 5147 yyerror("illegal port value %lu", ulval); 5148 return (-1); 5149 } 5150 return (htons(ulval)); 5151 } else { 5152 s = getservbyname(n, "tcp"); 5153 if (s == NULL) 5154 s = getservbyname(n, "udp"); 5155 if (s == NULL) { 5156 yyerror("unknown port %s", n); 5157 return (-1); 5158 } 5159 return (s->s_port); 5160 } 5161 } 5162 5163 int 5164 rule_label(struct pf_rule *r, char *s) 5165 { 5166 if (s) { 5167 if (strlcpy(r->label, s, sizeof(r->label)) >= 5168 sizeof(r->label)) { 5169 yyerror("rule label too long (max %d chars)", 5170 sizeof(r->label)-1); 5171 return (-1); 5172 } 5173 } 5174 return (0); 5175 } 5176 5177 u_int16_t 5178 parseicmpspec(char *w, sa_family_t af) 5179 { 5180 const struct icmpcodeent *p; 5181 u_long ulval; 5182 u_int8_t icmptype; 5183 5184 if (af == AF_INET) 5185 icmptype = returnicmpdefault >> 8; 5186 else 5187 icmptype = returnicmp6default >> 8; 5188 5189 if (atoul(w, &ulval) == -1) { 5190 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 5191 yyerror("unknown icmp code %s", w); 5192 return (0); 5193 } 5194 ulval = p->code; 5195 } 5196 if (ulval > 255) { 5197 yyerror("invalid icmp code %lu", ulval); 5198 return (0); 5199 } 5200 return (icmptype << 8 | ulval); 5201 } 5202 5203 int 5204 pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans) 5205 { 5206 struct loadanchors *la; 5207 5208 TAILQ_FOREACH(la, &loadanchorshead, entries) { 5209 if (opts & PF_OPT_VERBOSE) 5210 fprintf(stderr, "\nLoading anchor %s from %s\n", 5211 la->anchorname, la->filename); 5212 if (pfctl_rules(dev, la->filename, opts, la->anchorname, 5213 trans) == -1) 5214 return (-1); 5215 } 5216 5217 return (0); 5218 } 5219 5220
Indexes created Tue Sep 30 11:09:46 GMT 2025