1 /* $OpenBSD: parse.y,v 1.449 2004/03/20 23:20:20 david Exp $ */ 2 /* $DragonFly: src/usr.sbin/pfctl/parse.y,v 1.2 2005/02/11 22:31:45 joerg Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Markus Friedl. All rights reserved. 6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved. 7 * Copyright (c) 2001 Theo de Raadt. All rights reserved. 8 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 %{ 31 #include <sys/types.h> 32 #include <sys/socket.h> 33 #include <net/if.h> 34 #include <netinet/in.h> 35 #include <netinet/in_systm.h> 36 #include <netinet/ip.h> 37 #include <netinet/ip_icmp.h> 38 #include <netinet/icmp6.h> 39 #include <net/pf/pfvar.h> 40 #include <arpa/inet.h> 41 #include <net/altq/altq.h> 42 #include <net/altq/altq_cbq.h> 43 #include <net/altq/altq_priq.h> 44 #include <net/altq/altq_hfsc.h> 45 46 #include <stdio.h> 47 #include <stdlib.h> 48 #include <netdb.h> 49 #include <stdarg.h> 50 #include <errno.h> 51 #include <string.h> 52 #include <ctype.h> 53 #include <err.h> 54 #include <limits.h> 55 #include <pwd.h> 56 #include <grp.h> 57 #include <md5.h> 58 59 #include "pfctl_parser.h" 60 #include "pfctl.h" 61 62 static struct pfctl *pf = NULL; 63 static FILE *fin = NULL; 64 static int debug = 0; 65 static int lineno = 1; 66 static int errors = 0; 67 static int rulestate = 0; 68 static u_int16_t returnicmpdefault = 69 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 70 static u_int16_t returnicmp6default = 71 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 72 static int blockpolicy = PFRULE_DROP; 73 static int require_order = 1; 74 static int default_statelock; 75 76 enum { 77 PFCTL_STATE_NONE, 78 PFCTL_STATE_OPTION, 79 PFCTL_STATE_SCRUB, 80 PFCTL_STATE_QUEUE, 81 PFCTL_STATE_NAT, 82 PFCTL_STATE_FILTER 83 }; 84 85 struct node_proto { 86 u_int8_t proto; 87 struct node_proto *next; 88 struct node_proto *tail; 89 }; 90 91 struct node_port { 92 u_int16_t port[2]; 93 u_int8_t op; 94 struct node_port *next; 95 struct node_port *tail; 96 }; 97 98 struct node_uid { 99 uid_t uid[2]; 100 u_int8_t op; 101 struct node_uid *next; 102 struct node_uid *tail; 103 }; 104 105 struct node_gid { 106 gid_t gid[2]; 107 u_int8_t op; 108 struct node_gid *next; 109 struct node_gid *tail; 110 }; 111 112 struct node_icmp { 113 u_int8_t code; 114 u_int8_t type; 115 u_int8_t proto; 116 struct node_icmp *next; 117 struct node_icmp *tail; 118 }; 119 120 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, 121 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_NODES, 122 PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT }; 123 124 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; 125 126 struct node_state_opt { 127 int type; 128 union { 129 u_int32_t max_states; 130 u_int32_t max_src_states; 131 u_int32_t max_src_nodes; 132 u_int8_t src_track; 133 u_int32_t statelock; 134 struct { 135 int number; 136 u_int32_t seconds; 137 } timeout; 138 } data; 139 struct node_state_opt *next; 140 struct node_state_opt *tail; 141 }; 142 143 struct peer { 144 struct node_host *host; 145 struct node_port *port; 146 }; 147 148 struct node_queue { 149 char queue[PF_QNAME_SIZE]; 150 char parent[PF_QNAME_SIZE]; 151 char ifname[IFNAMSIZ]; 152 int scheduler; 153 struct node_queue *next; 154 struct node_queue *tail; 155 } *queues = NULL; 156 157 struct node_qassign { 158 char *qname; 159 char *pqname; 160 }; 161 162 struct filter_opts { 163 int marker; 164 #define FOM_FLAGS 0x01 165 #define FOM_ICMP 0x02 166 #define FOM_TOS 0x04 167 #define FOM_KEEP 0x08 168 #define FOM_SRCTRACK 0x10 169 struct node_uid *uid; 170 struct node_gid *gid; 171 struct { 172 u_int8_t b1; 173 u_int8_t b2; 174 u_int16_t w; 175 u_int16_t w2; 176 } flags; 177 struct node_icmp *icmpspec; 178 u_int32_t tos; 179 struct { 180 int action; 181 struct node_state_opt *options; 182 } keep; 183 int fragment; 184 int allowopts; 185 char *label; 186 struct node_qassign queues; 187 char *tag; 188 char *match_tag; 189 u_int8_t match_tag_not; 190 } filter_opts; 191 192 struct antispoof_opts { 193 char *label; 194 } antispoof_opts; 195 196 struct scrub_opts { 197 int marker; 198 #define SOM_MINTTL 0x01 199 #define SOM_MAXMSS 0x02 200 #define SOM_FRAGCACHE 0x04 201 int nodf; 202 int minttl; 203 int maxmss; 204 int fragcache; 205 int randomid; 206 int reassemble_tcp; 207 } scrub_opts; 208 209 struct queue_opts { 210 int marker; 211 #define QOM_BWSPEC 0x01 212 #define QOM_SCHEDULER 0x02 213 #define QOM_PRIORITY 0x04 214 #define QOM_TBRSIZE 0x08 215 #define QOM_QLIMIT 0x10 216 struct node_queue_bw queue_bwspec; 217 struct node_queue_opt scheduler; 218 int priority; 219 int tbrsize; 220 int qlimit; 221 } queue_opts; 222 223 struct table_opts { 224 int flags; 225 int init_addr; 226 struct node_tinithead init_nodes; 227 } table_opts; 228 229 struct pool_opts { 230 int marker; 231 #define POM_TYPE 0x01 232 #define POM_STICKYADDRESS 0x02 233 u_int8_t opts; 234 int type; 235 int staticport; 236 struct pf_poolhashkey *key; 237 238 } pool_opts; 239 240 241 struct node_hfsc_opts hfsc_opts; 242 243 int yyerror(const char *, ...); 244 int disallow_table(struct node_host *, const char *); 245 int disallow_alias(struct node_host *, const char *); 246 int rule_consistent(struct pf_rule *); 247 int filter_consistent(struct pf_rule *); 248 int nat_consistent(struct pf_rule *); 249 int rdr_consistent(struct pf_rule *); 250 int process_tabledef(char *, struct table_opts *); 251 int yyparse(void); 252 void expand_label_str(char *, size_t, const char *, const char *); 253 void expand_label_if(const char *, char *, size_t, const char *); 254 void expand_label_addr(const char *, char *, size_t, u_int8_t, 255 struct node_host *); 256 void expand_label_port(const char *, char *, size_t, struct node_port *); 257 void expand_label_proto(const char *, char *, size_t, u_int8_t); 258 void expand_label_nr(const char *, char *, size_t); 259 void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *, 260 struct node_port *, struct node_host *, struct node_port *, 261 u_int8_t); 262 void expand_rule(struct pf_rule *, struct node_if *, struct node_host *, 263 struct node_proto *, struct node_os*, struct node_host *, 264 struct node_port *, struct node_host *, struct node_port *, 265 struct node_uid *, struct node_gid *, struct node_icmp *); 266 int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *, 267 struct node_queue_bw bwspec, struct node_queue_opt *); 268 int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *, 269 struct node_queue_bw, struct node_queue_opt *); 270 271 int check_rulestate(int); 272 int kw_cmp(const void *, const void *); 273 int lookup(char *); 274 int lgetc(FILE *); 275 int lungetc(int); 276 int findeol(void); 277 int yylex(void); 278 int atoul(char *, u_long *); 279 int getservice(char *); 280 int rule_label(struct pf_rule *, char *); 281 282 TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead); 283 struct sym { 284 TAILQ_ENTRY(sym) entries; 285 int used; 286 int persist; 287 char *nam; 288 char *val; 289 }; 290 291 292 int symset(const char *, const char *, int); 293 char *symget(const char *); 294 295 void decide_address_family(struct node_host *, sa_family_t *); 296 void remove_invalid_hosts(struct node_host **, sa_family_t *); 297 int invalid_redirect(struct node_host *, sa_family_t); 298 u_int16_t parseicmpspec(char *, sa_family_t); 299 300 TAILQ_HEAD(loadanchorshead, loadanchors) 301 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead); 302 303 struct loadanchors { 304 TAILQ_ENTRY(loadanchors) entries; 305 char *anchorname; 306 char *rulesetname; 307 char *filename; 308 }; 309 310 typedef struct { 311 union { 312 u_int32_t number; 313 int i; 314 char *string; 315 struct { 316 u_int8_t b1; 317 u_int8_t b2; 318 u_int16_t w; 319 u_int16_t w2; 320 } b; 321 struct range { 322 int a; 323 int b; 324 int t; 325 } range; 326 struct node_if *interface; 327 struct node_proto *proto; 328 struct node_icmp *icmp; 329 struct node_host *host; 330 struct node_os *os; 331 struct node_port *port; 332 struct node_uid *uid; 333 struct node_gid *gid; 334 struct node_state_opt *state_opt; 335 struct peer peer; 336 struct { 337 struct peer src, dst; 338 struct node_os *src_os; 339 } fromto; 340 struct { 341 struct node_host *host; 342 u_int8_t rt; 343 u_int8_t pool_opts; 344 sa_family_t af; 345 struct pf_poolhashkey *key; 346 } route; 347 struct redirection { 348 struct node_host *host; 349 struct range rport; 350 } *redirection; 351 struct { 352 int action; 353 struct node_state_opt *options; 354 } keep_state; 355 struct { 356 u_int8_t log; 357 u_int8_t quick; 358 } logquick; 359 struct pf_poolhashkey *hashkey; 360 struct node_queue *queue; 361 struct node_queue_opt queue_options; 362 struct node_queue_bw queue_bwspec; 363 struct node_qassign qassign; 364 struct filter_opts filter_opts; 365 struct antispoof_opts antispoof_opts; 366 struct queue_opts queue_opts; 367 struct scrub_opts scrub_opts; 368 struct table_opts table_opts; 369 struct pool_opts pool_opts; 370 struct node_hfsc_opts hfsc_opts; 371 } v; 372 int lineno; 373 } YYSTYPE; 374 375 #define PREPARE_ANCHOR_RULE(r, a) \ 376 do { \ 377 memset(&(r), 0, sizeof(r)); \ 378 if (strlcpy(r.anchorname, (a), \ 379 sizeof(r.anchorname)) >= \ 380 sizeof(r.anchorname)) { \ 381 yyerror("anchor name '%s' too long", \ 382 (a)); \ 383 YYERROR; \ 384 } \ 385 } while (0) 386 387 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \ 388 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \ 389 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1]))) 390 391 extern char *infile; 392 393 %} 394 395 %token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS 396 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE 397 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF 398 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL 399 %token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE 400 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR 401 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID 402 %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG HOSTID 403 %token ANTISPOOF FOR 404 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT 405 %token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT 406 %token QUEUE PRIORITY QLIMIT 407 %token LOAD 408 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE 409 %token TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY 410 %token <v.string> STRING 411 %token <v.i> PORTBINARY 412 %type <v.interface> interface if_list if_item_not if_item 413 %type <v.number> number icmptype icmp6type uid gid 414 %type <v.number> tos not yesno natpass 415 %type <v.i> no dir log af fragcache sourcetrack 416 %type <v.i> unaryop statelock 417 %type <v.b> action nataction flags flag blockspec 418 %type <v.range> port rport 419 %type <v.hashkey> hashkey 420 %type <v.proto> proto proto_list proto_item 421 %type <v.icmp> icmpspec 422 %type <v.icmp> icmp_list icmp_item 423 %type <v.icmp> icmp6_list icmp6_item 424 %type <v.fromto> fromto 425 %type <v.peer> ipportspec from to 426 %type <v.host> ipspec xhost host dynaddr host_list 427 %type <v.host> redir_host_list redirspec 428 %type <v.host> route_host route_host_list routespec 429 %type <v.os> os xos os_list 430 %type <v.port> portspec port_list port_item 431 %type <v.uid> uids uid_list uid_item 432 %type <v.gid> gids gid_list gid_item 433 %type <v.route> route 434 %type <v.redirection> redirection redirpool 435 %type <v.string> label string tag 436 %type <v.keep_state> keep 437 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item 438 %type <v.logquick> logquick 439 %type <v.interface> antispoof_ifspc antispoof_iflst 440 %type <v.qassign> qname 441 %type <v.queue> qassign qassign_list qassign_item 442 %type <v.queue_options> scheduler 443 %type <v.number> cbqflags_list cbqflags_item 444 %type <v.number> priqflags_list priqflags_item 445 %type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts 446 %type <v.queue_bwspec> bandwidth 447 %type <v.filter_opts> filter_opts filter_opt filter_opts_l 448 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l 449 %type <v.queue_opts> queue_opts queue_opt queue_opts_l 450 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l 451 %type <v.table_opts> table_opts table_opt table_opts_l 452 %type <v.pool_opts> pool_opts pool_opt pool_opts_l 453 %% 454 455 ruleset : /* empty */ 456 | ruleset '\n' 457 | ruleset option '\n' 458 | ruleset scrubrule '\n' 459 | ruleset natrule '\n' 460 | ruleset binatrule '\n' 461 | ruleset pfrule '\n' 462 | ruleset anchorrule '\n' 463 | ruleset loadrule '\n' 464 | ruleset altqif '\n' 465 | ruleset queuespec '\n' 466 | ruleset varset '\n' 467 | ruleset antispoof '\n' 468 | ruleset tabledef '\n' 469 | ruleset error '\n' { errors++; } 470 ; 471 472 option : SET OPTIMIZATION STRING { 473 if (check_rulestate(PFCTL_STATE_OPTION)) { 474 free($3); 475 YYERROR; 476 } 477 if (pfctl_set_optimization(pf, $3) != 0) { 478 yyerror("unknown optimization %s", $3); 479 free($3); 480 YYERROR; 481 } 482 free ($3); 483 } 484 | SET TIMEOUT timeout_spec 485 | SET TIMEOUT '{' timeout_list '}' 486 | SET LIMIT limit_spec 487 | SET LIMIT '{' limit_list '}' 488 | SET LOGINTERFACE STRING { 489 if (check_rulestate(PFCTL_STATE_OPTION)) { 490 free($3); 491 YYERROR; 492 } 493 if ((ifa_exists($3, 0) == NULL) && strcmp($3, "none")) { 494 yyerror("interface %s doesn't exist", $3); 495 free($3); 496 YYERROR; 497 } 498 if (pfctl_set_logif(pf, $3) != 0) { 499 yyerror("error setting loginterface %s", $3); 500 free($3); 501 YYERROR; 502 } 503 free($3); 504 } 505 | SET HOSTID number { 506 if ($3 == 0) { 507 yyerror("hostid must be non-zero"); 508 YYERROR; 509 } 510 if (pfctl_set_hostid(pf, $3) != 0) { 511 yyerror("error setting loginterface %08x", $3); 512 YYERROR; 513 } 514 } 515 | SET BLOCKPOLICY DROP { 516 if (pf->opts & PF_OPT_VERBOSE) 517 printf("set block-policy drop\n"); 518 if (check_rulestate(PFCTL_STATE_OPTION)) 519 YYERROR; 520 blockpolicy = PFRULE_DROP; 521 } 522 | SET BLOCKPOLICY RETURN { 523 if (pf->opts & PF_OPT_VERBOSE) 524 printf("set block-policy return\n"); 525 if (check_rulestate(PFCTL_STATE_OPTION)) 526 YYERROR; 527 blockpolicy = PFRULE_RETURN; 528 } 529 | SET REQUIREORDER yesno { 530 if (pf->opts & PF_OPT_VERBOSE) 531 printf("set require-order %s\n", 532 $3 == 1 ? "yes" : "no"); 533 require_order = $3; 534 } 535 | SET FINGERPRINTS STRING { 536 if (pf->opts & PF_OPT_VERBOSE) 537 printf("fingerprints %s\n", $3); 538 if (check_rulestate(PFCTL_STATE_OPTION)) { 539 free($3); 540 YYERROR; 541 } 542 if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) { 543 yyerror("error loading fingerprints %s", $3); 544 free($3); 545 YYERROR; 546 } 547 free($3); 548 } 549 | SET STATEPOLICY statelock { 550 if (pf->opts & PF_OPT_VERBOSE) 551 switch ($3) { 552 case 0: 553 printf("set state-policy floating\n"); 554 break; 555 case PFRULE_IFBOUND: 556 printf("set state-policy if-bound\n"); 557 break; 558 case PFRULE_GRBOUND: 559 printf("set state-policy " 560 "group-bound\n"); 561 break; 562 } 563 default_statelock = $3; 564 } 565 | SET DEBUG STRING { 566 if (check_rulestate(PFCTL_STATE_OPTION)) { 567 free($3); 568 YYERROR; 569 } 570 if (pfctl_set_debug(pf, $3) != 0) { 571 yyerror("error setting debuglevel %s", $3); 572 free($3); 573 YYERROR; 574 } 575 free($3); 576 } 577 ; 578 579 string : string STRING { 580 if (asprintf(&$$, "%s %s", $1, $2) == -1) 581 err(1, "string: asprintf"); 582 free($1); 583 free($2); 584 } 585 | STRING 586 ; 587 588 varset : STRING '=' string { 589 if (pf->opts & PF_OPT_VERBOSE) 590 printf("%s = \"%s\"\n", $1, $3); 591 if (symset($1, $3, 0) == -1) 592 err(1, "cannot store variable %s", $1); 593 free($1); 594 free($3); 595 } 596 ; 597 598 anchorrule : ANCHOR string dir interface af proto fromto filter_opts { 599 struct pf_rule r; 600 601 if (check_rulestate(PFCTL_STATE_FILTER)) { 602 free($2); 603 YYERROR; 604 } 605 606 PREPARE_ANCHOR_RULE(r, $2); 607 r.direction = $3; 608 r.af = $5; 609 610 if ($8.match_tag) 611 if (strlcpy(r.match_tagname, $8.match_tag, 612 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 613 yyerror("tag too long, max %u chars", 614 PF_TAG_NAME_SIZE - 1); 615 YYERROR; 616 } 617 r.match_tag_not = $8.match_tag_not; 618 619 decide_address_family($7.src.host, &r.af); 620 decide_address_family($7.dst.host, &r.af); 621 622 expand_rule(&r, $4, NULL, $6, $7.src_os, 623 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 624 0, 0, 0); 625 } 626 | NATANCHOR string interface af proto fromto { 627 struct pf_rule r; 628 629 if (check_rulestate(PFCTL_STATE_NAT)) { 630 free($2); 631 YYERROR; 632 } 633 634 PREPARE_ANCHOR_RULE(r, $2); 635 free($2); 636 r.action = PF_NAT; 637 r.af = $4; 638 639 decide_address_family($6.src.host, &r.af); 640 decide_address_family($6.dst.host, &r.af); 641 642 expand_rule(&r, $3, NULL, $5, $6.src_os, 643 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 644 0, 0, 0); 645 } 646 | RDRANCHOR string interface af proto fromto { 647 struct pf_rule r; 648 649 if (check_rulestate(PFCTL_STATE_NAT)) { 650 free($2); 651 YYERROR; 652 } 653 654 PREPARE_ANCHOR_RULE(r, $2); 655 free($2); 656 r.action = PF_RDR; 657 r.af = $4; 658 659 decide_address_family($6.src.host, &r.af); 660 decide_address_family($6.dst.host, &r.af); 661 662 if ($6.src.port != NULL) { 663 yyerror("source port parameter not supported" 664 " in rdr-anchor"); 665 YYERROR; 666 } 667 if ($6.dst.port != NULL) { 668 if ($6.dst.port->next != NULL) { 669 yyerror("destination port list " 670 "expansion not supported in " 671 "rdr-anchor"); 672 YYERROR; 673 } else if ($6.dst.port->op != PF_OP_EQ) { 674 yyerror("destination port operators" 675 " not supported in rdr-anchor"); 676 YYERROR; 677 } 678 r.dst.port[0] = $6.dst.port->port[0]; 679 r.dst.port[1] = $6.dst.port->port[1]; 680 r.dst.port_op = $6.dst.port->op; 681 } 682 683 expand_rule(&r, $3, NULL, $5, $6.src_os, 684 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port, 685 0, 0, 0); 686 } 687 | BINATANCHOR string interface af proto fromto { 688 struct pf_rule r; 689 690 if (check_rulestate(PFCTL_STATE_NAT)) { 691 free($2); 692 YYERROR; 693 } 694 695 PREPARE_ANCHOR_RULE(r, $2); 696 free($2); 697 r.action = PF_BINAT; 698 r.af = $4; 699 if ($5 != NULL) { 700 if ($5->next != NULL) { 701 yyerror("proto list expansion" 702 " not supported in binat-anchor"); 703 YYERROR; 704 } 705 r.proto = $5->proto; 706 free($5); 707 } 708 709 if ($6.src.host != NULL || $6.src.port != NULL || 710 $6.dst.host != NULL || $6.dst.port != NULL) { 711 yyerror("fromto parameter not supported" 712 " in binat-anchor"); 713 YYERROR; 714 } 715 716 decide_address_family($6.src.host, &r.af); 717 decide_address_family($6.dst.host, &r.af); 718 719 pfctl_add_rule(pf, &r); 720 } 721 ; 722 723 loadrule : LOAD ANCHOR string FROM string { 724 char *t; 725 struct loadanchors *loadanchor; 726 727 t = strsep(&$3, ":"); 728 if (*t == '\0' || $3 == NULL || *$3 == '\0') { 729 yyerror("anchor '%s' invalid\n", $3); 730 free(t); 731 YYERROR; 732 } 733 if (strlen(t) >= PF_ANCHOR_NAME_SIZE) { 734 yyerror("anchorname %s too long, max %u\n", 735 t, PF_ANCHOR_NAME_SIZE - 1); 736 free(t); 737 YYERROR; 738 } 739 if (strlen($3) >= PF_RULESET_NAME_SIZE) { 740 yyerror("rulesetname %s too long, max %u\n", 741 $3, PF_RULESET_NAME_SIZE - 1); 742 free(t); 743 YYERROR; 744 } 745 746 loadanchor = calloc(1, sizeof(struct loadanchors)); 747 if (loadanchor == NULL) 748 err(1, "loadrule: calloc"); 749 if ((loadanchor->anchorname = strdup(t)) == NULL) 750 err(1, "loadrule: strdup"); 751 if ((loadanchor->rulesetname = strdup($3)) == NULL) 752 err(1, "loadrule: strdup"); 753 if ((loadanchor->filename = strdup($5)) == NULL) 754 err(1, "loadrule: strdup"); 755 756 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor, 757 entries); 758 759 free(t); /* not $3 */ 760 free($5); 761 }; 762 763 scrubrule : SCRUB dir logquick interface af proto fromto scrub_opts 764 { 765 struct pf_rule r; 766 767 if (check_rulestate(PFCTL_STATE_SCRUB)) 768 YYERROR; 769 770 memset(&r, 0, sizeof(r)); 771 772 r.action = PF_SCRUB; 773 r.direction = $2; 774 775 r.log = $3.log; 776 if ($3.quick) { 777 yyerror("scrub rules do not support 'quick'"); 778 YYERROR; 779 } 780 781 r.af = $5; 782 if ($8.nodf) 783 r.rule_flag |= PFRULE_NODF; 784 if ($8.randomid) 785 r.rule_flag |= PFRULE_RANDOMID; 786 if ($8.reassemble_tcp) { 787 if (r.direction != PF_INOUT) { 788 yyerror("reassemble tcp rules can not " 789 "specify direction"); 790 YYERROR; 791 } 792 r.rule_flag |= PFRULE_REASSEMBLE_TCP; 793 } 794 if ($8.minttl) 795 r.min_ttl = $8.minttl; 796 if ($8.maxmss) 797 r.max_mss = $8.maxmss; 798 if ($8.fragcache) 799 r.rule_flag |= $8.fragcache; 800 801 expand_rule(&r, $4, NULL, $6, $7.src_os, 802 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port, 803 NULL, NULL, NULL); 804 } 805 ; 806 807 scrub_opts : { 808 bzero(&scrub_opts, sizeof scrub_opts); 809 } 810 scrub_opts_l 811 { $$ = scrub_opts; } 812 | /* empty */ { 813 bzero(&scrub_opts, sizeof scrub_opts); 814 $$ = scrub_opts; 815 } 816 ; 817 818 scrub_opts_l : scrub_opts_l scrub_opt 819 | scrub_opt 820 ; 821 822 scrub_opt : NODF { 823 if (scrub_opts.nodf) { 824 yyerror("no-df cannot be respecified"); 825 YYERROR; 826 } 827 scrub_opts.nodf = 1; 828 } 829 | MINTTL number { 830 if (scrub_opts.marker & SOM_MINTTL) { 831 yyerror("min-ttl cannot be respecified"); 832 YYERROR; 833 } 834 if ($2 > 255) { 835 yyerror("illegal min-ttl value %d", $2); 836 YYERROR; 837 } 838 scrub_opts.marker |= SOM_MINTTL; 839 scrub_opts.minttl = $2; 840 } 841 | MAXMSS number { 842 if (scrub_opts.marker & SOM_MAXMSS) { 843 yyerror("max-mss cannot be respecified"); 844 YYERROR; 845 } 846 if ($2 > 65535) { 847 yyerror("illegal max-mss value %d", $2); 848 YYERROR; 849 } 850 scrub_opts.marker |= SOM_MAXMSS; 851 scrub_opts.maxmss = $2; 852 } 853 | fragcache { 854 if (scrub_opts.marker & SOM_FRAGCACHE) { 855 yyerror("fragcache cannot be respecified"); 856 YYERROR; 857 } 858 scrub_opts.marker |= SOM_FRAGCACHE; 859 scrub_opts.fragcache = $1; 860 } 861 | REASSEMBLE STRING { 862 if (strcasecmp($2, "tcp") != 0) { 863 free($2); 864 YYERROR; 865 } 866 free($2); 867 if (scrub_opts.reassemble_tcp) { 868 yyerror("reassemble tcp cannot be respecified"); 869 YYERROR; 870 } 871 scrub_opts.reassemble_tcp = 1; 872 } 873 | RANDOMID { 874 if (scrub_opts.randomid) { 875 yyerror("random-id cannot be respecified"); 876 YYERROR; 877 } 878 scrub_opts.randomid = 1; 879 } 880 ; 881 882 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ } 883 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; } 884 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; } 885 ; 886 887 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts { 888 struct pf_rule r; 889 struct node_host *h = NULL; 890 struct node_if *i, *j; 891 892 if (check_rulestate(PFCTL_STATE_FILTER)) 893 YYERROR; 894 895 for (i = $3; i; i = i->next) { 896 bzero(&r, sizeof(r)); 897 898 r.action = PF_DROP; 899 r.direction = PF_IN; 900 r.log = $2.log; 901 r.quick = $2.quick; 902 r.af = $4; 903 if (rule_label(&r, $5.label)) 904 YYERROR; 905 j = calloc(1, sizeof(struct node_if)); 906 if (j == NULL) 907 err(1, "antispoof: calloc"); 908 if (strlcpy(j->ifname, i->ifname, 909 sizeof(j->ifname)) >= sizeof(j->ifname)) { 910 free(j); 911 yyerror("interface name too long"); 912 YYERROR; 913 } 914 j->not = 1; 915 h = ifa_lookup(j->ifname, PFI_AFLAG_NETWORK); 916 917 if (h != NULL) 918 expand_rule(&r, j, NULL, NULL, NULL, h, 919 NULL, NULL, NULL, NULL, NULL, NULL); 920 921 if ((i->ifa_flags & IFF_LOOPBACK) == 0) { 922 bzero(&r, sizeof(r)); 923 924 r.action = PF_DROP; 925 r.direction = PF_IN; 926 r.log = $2.log; 927 r.quick = $2.quick; 928 r.af = $4; 929 if (rule_label(&r, $5.label)) 930 YYERROR; 931 h = ifa_lookup(i->ifname, 0); 932 if (h != NULL) 933 expand_rule(&r, NULL, NULL, 934 NULL, NULL, h, NULL, NULL, 935 NULL, NULL, NULL, NULL); 936 } 937 } 938 free($5.label); 939 } 940 ; 941 942 antispoof_ifspc : FOR if_item { $$ = $2; } 943 | FOR '{' antispoof_iflst '}' { $$ = $3; } 944 ; 945 946 antispoof_iflst : if_item { $$ = $1; } 947 | antispoof_iflst comma if_item { 948 $1->tail->next = $3; 949 $1->tail = $3; 950 $$ = $1; 951 } 952 ; 953 954 antispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); } 955 antispoof_opts_l 956 { $$ = antispoof_opts; } 957 | /* empty */ { 958 bzero(&antispoof_opts, sizeof antispoof_opts); 959 $$ = antispoof_opts; 960 } 961 ; 962 963 antispoof_opts_l : antispoof_opts_l antispoof_opt 964 | antispoof_opt 965 ; 966 967 antispoof_opt : label { 968 if (antispoof_opts.label) { 969 yyerror("label cannot be redefined"); 970 YYERROR; 971 } 972 antispoof_opts.label = $1; 973 } 974 ; 975 976 not : '!' { $$ = 1; } 977 | /* empty */ { $$ = 0; } 978 ; 979 980 tabledef : TABLE '<' STRING '>' table_opts { 981 struct node_host *h, *nh; 982 struct node_tinit *ti, *nti; 983 984 if (strlen($3) >= PF_TABLE_NAME_SIZE) { 985 yyerror("table name too long, max %d chars", 986 PF_TABLE_NAME_SIZE - 1); 987 free($3); 988 YYERROR; 989 } 990 if (pf->loadopt & PFCTL_FLAG_TABLE) 991 if (process_tabledef($3, &$5)) { 992 free($3); 993 YYERROR; 994 } 995 free($3); 996 for (ti = SIMPLEQ_FIRST(&$5.init_nodes); 997 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) { 998 if (ti->file) 999 free(ti->file); 1000 for (h = ti->host; h != NULL; h = nh) { 1001 nh = h->next; 1002 free(h); 1003 } 1004 nti = SIMPLEQ_NEXT(ti, entries); 1005 free(ti); 1006 } 1007 } 1008 ; 1009 1010 table_opts : { 1011 bzero(&table_opts, sizeof table_opts); 1012 SIMPLEQ_INIT(&table_opts.init_nodes); 1013 } 1014 table_opts_l 1015 { $$ = table_opts; } 1016 | /* empty */ 1017 { 1018 bzero(&table_opts, sizeof table_opts); 1019 SIMPLEQ_INIT(&table_opts.init_nodes); 1020 $$ = table_opts; 1021 } 1022 ; 1023 1024 table_opts_l : table_opts_l table_opt 1025 | table_opt 1026 ; 1027 1028 table_opt : STRING { 1029 if (!strcmp($1, "const")) 1030 table_opts.flags |= PFR_TFLAG_CONST; 1031 else if (!strcmp($1, "persist")) 1032 table_opts.flags |= PFR_TFLAG_PERSIST; 1033 else { 1034 free($1); 1035 YYERROR; 1036 } 1037 free($1); 1038 } 1039 | '{' '}' { table_opts.init_addr = 1; } 1040 | '{' host_list '}' { 1041 struct node_host *n; 1042 struct node_tinit *ti; 1043 1044 for (n = $2; n != NULL; n = n->next) { 1045 switch (n->addr.type) { 1046 case PF_ADDR_ADDRMASK: 1047 continue; /* ok */ 1048 case PF_ADDR_DYNIFTL: 1049 yyerror("dynamic addresses are not " 1050 "permitted inside tables"); 1051 break; 1052 case PF_ADDR_TABLE: 1053 yyerror("tables cannot contain tables"); 1054 break; 1055 case PF_ADDR_NOROUTE: 1056 yyerror("\"no-route\" is not permitted " 1057 "inside tables"); 1058 break; 1059 default: 1060 yyerror("unknown address type %d", 1061 n->addr.type); 1062 } 1063 YYERROR; 1064 } 1065 if (!(ti = calloc(1, sizeof(*ti)))) 1066 err(1, "table_opt: calloc"); 1067 ti->host = $2; 1068 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1069 entries); 1070 table_opts.init_addr = 1; 1071 } 1072 | FILENAME STRING { 1073 struct node_tinit *ti; 1074 1075 if (!(ti = calloc(1, sizeof(*ti)))) 1076 err(1, "table_opt: calloc"); 1077 ti->file = $2; 1078 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti, 1079 entries); 1080 table_opts.init_addr = 1; 1081 } 1082 ; 1083 1084 altqif : ALTQ interface queue_opts QUEUE qassign { 1085 struct pf_altq a; 1086 1087 if (check_rulestate(PFCTL_STATE_QUEUE)) 1088 YYERROR; 1089 1090 memset(&a, 0, sizeof(a)); 1091 if ($3.scheduler.qtype == ALTQT_NONE) { 1092 yyerror("no scheduler specified!"); 1093 YYERROR; 1094 } 1095 a.scheduler = $3.scheduler.qtype; 1096 a.qlimit = $3.qlimit; 1097 a.tbrsize = $3.tbrsize; 1098 if ($5 == NULL) { 1099 yyerror("no child queues specified"); 1100 YYERROR; 1101 } 1102 if (expand_altq(&a, $2, $5, $3.queue_bwspec, 1103 &$3.scheduler)) 1104 YYERROR; 1105 } 1106 ; 1107 1108 queuespec : QUEUE STRING interface queue_opts qassign { 1109 struct pf_altq a; 1110 1111 if (check_rulestate(PFCTL_STATE_QUEUE)) { 1112 free($2); 1113 YYERROR; 1114 } 1115 1116 memset(&a, 0, sizeof(a)); 1117 1118 if (strlcpy(a.qname, $2, sizeof(a.qname)) >= 1119 sizeof(a.qname)) { 1120 yyerror("queue name too long (max " 1121 "%d chars)", PF_QNAME_SIZE-1); 1122 free($2); 1123 YYERROR; 1124 } 1125 free($2); 1126 if ($4.tbrsize) { 1127 yyerror("cannot specify tbrsize for queue"); 1128 YYERROR; 1129 } 1130 if ($4.priority > 255) { 1131 yyerror("priority out of range: max 255"); 1132 YYERROR; 1133 } 1134 a.priority = $4.priority; 1135 a.qlimit = $4.qlimit; 1136 a.scheduler = $4.scheduler.qtype; 1137 if (expand_queue(&a, $3, $5, $4.queue_bwspec, 1138 &$4.scheduler)) { 1139 yyerror("errors in queue definition"); 1140 YYERROR; 1141 } 1142 } 1143 ; 1144 1145 queue_opts : { 1146 bzero(&queue_opts, sizeof queue_opts); 1147 queue_opts.priority = DEFAULT_PRIORITY; 1148 queue_opts.qlimit = DEFAULT_QLIMIT; 1149 queue_opts.scheduler.qtype = ALTQT_NONE; 1150 queue_opts.queue_bwspec.bw_percent = 100; 1151 } 1152 queue_opts_l 1153 { $$ = queue_opts; } 1154 | /* empty */ { 1155 bzero(&queue_opts, sizeof queue_opts); 1156 queue_opts.priority = DEFAULT_PRIORITY; 1157 queue_opts.qlimit = DEFAULT_QLIMIT; 1158 queue_opts.scheduler.qtype = ALTQT_NONE; 1159 queue_opts.queue_bwspec.bw_percent = 100; 1160 $$ = queue_opts; 1161 } 1162 ; 1163 1164 queue_opts_l : queue_opts_l queue_opt 1165 | queue_opt 1166 ; 1167 1168 queue_opt : BANDWIDTH bandwidth { 1169 if (queue_opts.marker & QOM_BWSPEC) { 1170 yyerror("bandwidth cannot be respecified"); 1171 YYERROR; 1172 } 1173 queue_opts.marker |= QOM_BWSPEC; 1174 queue_opts.queue_bwspec = $2; 1175 } 1176 | PRIORITY number { 1177 if (queue_opts.marker & QOM_PRIORITY) { 1178 yyerror("priority cannot be respecified"); 1179 YYERROR; 1180 } 1181 if ($2 > 255) { 1182 yyerror("priority out of range: max 255"); 1183 YYERROR; 1184 } 1185 queue_opts.marker |= QOM_PRIORITY; 1186 queue_opts.priority = $2; 1187 } 1188 | QLIMIT number { 1189 if (queue_opts.marker & QOM_QLIMIT) { 1190 yyerror("qlimit cannot be respecified"); 1191 YYERROR; 1192 } 1193 if ($2 > 65535) { 1194 yyerror("qlimit out of range: max 65535"); 1195 YYERROR; 1196 } 1197 queue_opts.marker |= QOM_QLIMIT; 1198 queue_opts.qlimit = $2; 1199 } 1200 | scheduler { 1201 if (queue_opts.marker & QOM_SCHEDULER) { 1202 yyerror("scheduler cannot be respecified"); 1203 YYERROR; 1204 } 1205 queue_opts.marker |= QOM_SCHEDULER; 1206 queue_opts.scheduler = $1; 1207 } 1208 | TBRSIZE number { 1209 if (queue_opts.marker & QOM_TBRSIZE) { 1210 yyerror("tbrsize cannot be respecified"); 1211 YYERROR; 1212 } 1213 if ($2 > 65535) { 1214 yyerror("tbrsize too big: max 65535"); 1215 YYERROR; 1216 } 1217 queue_opts.marker |= QOM_TBRSIZE; 1218 queue_opts.tbrsize = $2; 1219 } 1220 ; 1221 1222 bandwidth : STRING { 1223 double bps; 1224 char *cp; 1225 1226 $$.bw_percent = 0; 1227 1228 bps = strtod($1, &cp); 1229 if (cp != NULL) { 1230 if (!strcmp(cp, "b")) 1231 ; /* nothing */ 1232 else if (!strcmp(cp, "Kb")) 1233 bps *= 1000; 1234 else if (!strcmp(cp, "Mb")) 1235 bps *= 1000 * 1000; 1236 else if (!strcmp(cp, "Gb")) 1237 bps *= 1000 * 1000 * 1000; 1238 else if (!strcmp(cp, "%")) { 1239 if (bps < 0 || bps > 100) { 1240 yyerror("bandwidth spec " 1241 "out of range"); 1242 free($1); 1243 YYERROR; 1244 } 1245 $$.bw_percent = bps; 1246 bps = 0; 1247 } else { 1248 yyerror("unknown unit %s", cp); 1249 free($1); 1250 YYERROR; 1251 } 1252 } 1253 free($1); 1254 $$.bw_absolute = (u_int32_t)bps; 1255 } 1256 ; 1257 1258 scheduler : CBQ { 1259 $$.qtype = ALTQT_CBQ; 1260 $$.data.cbq_opts.flags = 0; 1261 } 1262 | CBQ '(' cbqflags_list ')' { 1263 $$.qtype = ALTQT_CBQ; 1264 $$.data.cbq_opts.flags = $3; 1265 } 1266 | PRIQ { 1267 $$.qtype = ALTQT_PRIQ; 1268 $$.data.priq_opts.flags = 0; 1269 } 1270 | PRIQ '(' priqflags_list ')' { 1271 $$.qtype = ALTQT_PRIQ; 1272 $$.data.priq_opts.flags = $3; 1273 } 1274 | HFSC { 1275 $$.qtype = ALTQT_HFSC; 1276 bzero(&$$.data.hfsc_opts, 1277 sizeof(struct node_hfsc_opts)); 1278 } 1279 | HFSC '(' hfsc_opts ')' { 1280 $$.qtype = ALTQT_HFSC; 1281 $$.data.hfsc_opts = $3; 1282 } 1283 ; 1284 1285 cbqflags_list : cbqflags_item { $$ |= $1; } 1286 | cbqflags_list comma cbqflags_item { $$ |= $3; } 1287 ; 1288 1289 cbqflags_item : STRING { 1290 if (!strcmp($1, "default")) 1291 $$ = CBQCLF_DEFCLASS; 1292 else if (!strcmp($1, "borrow")) 1293 $$ = CBQCLF_BORROW; 1294 else if (!strcmp($1, "red")) 1295 $$ = CBQCLF_RED; 1296 else if (!strcmp($1, "ecn")) 1297 $$ = CBQCLF_RED|CBQCLF_ECN; 1298 else if (!strcmp($1, "rio")) 1299 $$ = CBQCLF_RIO; 1300 else { 1301 yyerror("unknown cbq flag \"%s\"", $1); 1302 free($1); 1303 YYERROR; 1304 } 1305 free($1); 1306 } 1307 ; 1308 1309 priqflags_list : priqflags_item { $$ |= $1; } 1310 | priqflags_list comma priqflags_item { $$ |= $3; } 1311 ; 1312 1313 priqflags_item : STRING { 1314 if (!strcmp($1, "default")) 1315 $$ = PRCF_DEFAULTCLASS; 1316 else if (!strcmp($1, "red")) 1317 $$ = PRCF_RED; 1318 else if (!strcmp($1, "ecn")) 1319 $$ = PRCF_RED|PRCF_ECN; 1320 else if (!strcmp($1, "rio")) 1321 $$ = PRCF_RIO; 1322 else { 1323 yyerror("unknown priq flag \"%s\"", $1); 1324 free($1); 1325 YYERROR; 1326 } 1327 free($1); 1328 } 1329 ; 1330 1331 hfsc_opts : { 1332 bzero(&hfsc_opts, 1333 sizeof(struct node_hfsc_opts)); 1334 } 1335 hfscopts_list { 1336 $$ = hfsc_opts; 1337 } 1338 ; 1339 1340 hfscopts_list : hfscopts_item 1341 | hfscopts_list comma hfscopts_item 1342 ; 1343 1344 hfscopts_item : LINKSHARE bandwidth { 1345 if (hfsc_opts.linkshare.used) { 1346 yyerror("linkshare already specified"); 1347 YYERROR; 1348 } 1349 hfsc_opts.linkshare.m2 = $2; 1350 hfsc_opts.linkshare.used = 1; 1351 } 1352 | LINKSHARE '(' bandwidth number bandwidth ')' { 1353 if (hfsc_opts.linkshare.used) { 1354 yyerror("linkshare already specified"); 1355 YYERROR; 1356 } 1357 hfsc_opts.linkshare.m1 = $3; 1358 hfsc_opts.linkshare.d = $4; 1359 hfsc_opts.linkshare.m2 = $5; 1360 hfsc_opts.linkshare.used = 1; 1361 } 1362 | REALTIME bandwidth { 1363 if (hfsc_opts.realtime.used) { 1364 yyerror("realtime already specified"); 1365 YYERROR; 1366 } 1367 hfsc_opts.realtime.m2 = $2; 1368 hfsc_opts.realtime.used = 1; 1369 } 1370 | REALTIME '(' bandwidth number bandwidth ')' { 1371 if (hfsc_opts.realtime.used) { 1372 yyerror("realtime already specified"); 1373 YYERROR; 1374 } 1375 hfsc_opts.realtime.m1 = $3; 1376 hfsc_opts.realtime.d = $4; 1377 hfsc_opts.realtime.m2 = $5; 1378 hfsc_opts.realtime.used = 1; 1379 } 1380 | UPPERLIMIT bandwidth { 1381 if (hfsc_opts.upperlimit.used) { 1382 yyerror("upperlimit already specified"); 1383 YYERROR; 1384 } 1385 hfsc_opts.upperlimit.m2 = $2; 1386 hfsc_opts.upperlimit.used = 1; 1387 } 1388 | UPPERLIMIT '(' bandwidth number bandwidth ')' { 1389 if (hfsc_opts.upperlimit.used) { 1390 yyerror("upperlimit already specified"); 1391 YYERROR; 1392 } 1393 hfsc_opts.upperlimit.m1 = $3; 1394 hfsc_opts.upperlimit.d = $4; 1395 hfsc_opts.upperlimit.m2 = $5; 1396 hfsc_opts.upperlimit.used = 1; 1397 } 1398 | STRING { 1399 if (!strcmp($1, "default")) 1400 hfsc_opts.flags |= HFCF_DEFAULTCLASS; 1401 else if (!strcmp($1, "red")) 1402 hfsc_opts.flags |= HFCF_RED; 1403 else if (!strcmp($1, "ecn")) 1404 hfsc_opts.flags |= HFCF_RED|HFCF_ECN; 1405 else if (!strcmp($1, "rio")) 1406 hfsc_opts.flags |= HFCF_RIO; 1407 else { 1408 yyerror("unknown hfsc flag \"%s\"", $1); 1409 free($1); 1410 YYERROR; 1411 } 1412 free($1); 1413 } 1414 ; 1415 1416 qassign : /* empty */ { $$ = NULL; } 1417 | qassign_item { $$ = $1; } 1418 | '{' qassign_list '}' { $$ = $2; } 1419 ; 1420 1421 qassign_list : qassign_item { $$ = $1; } 1422 | qassign_list comma qassign_item { 1423 $1->tail->next = $3; 1424 $1->tail = $3; 1425 $$ = $1; 1426 } 1427 ; 1428 1429 qassign_item : STRING { 1430 $$ = calloc(1, sizeof(struct node_queue)); 1431 if ($$ == NULL) 1432 err(1, "qassign_item: calloc"); 1433 if (strlcpy($$->queue, $1, sizeof($$->queue)) >= 1434 sizeof($$->queue)) { 1435 yyerror("queue name '%s' too long (max " 1436 "%d chars)", $1, sizeof($$->queue)-1); 1437 free($1); 1438 free($$); 1439 YYERROR; 1440 } 1441 free($1); 1442 $$->next = NULL; 1443 $$->tail = $$; 1444 } 1445 ; 1446 1447 pfrule : action dir logquick interface route af proto fromto 1448 filter_opts 1449 { 1450 struct pf_rule r; 1451 struct node_state_opt *o; 1452 struct node_proto *proto; 1453 int srctrack = 0; 1454 int statelock = 0; 1455 1456 if (check_rulestate(PFCTL_STATE_FILTER)) 1457 YYERROR; 1458 1459 memset(&r, 0, sizeof(r)); 1460 1461 r.action = $1.b1; 1462 switch ($1.b2) { 1463 case PFRULE_RETURNRST: 1464 r.rule_flag |= PFRULE_RETURNRST; 1465 r.return_ttl = $1.w; 1466 break; 1467 case PFRULE_RETURNICMP: 1468 r.rule_flag |= PFRULE_RETURNICMP; 1469 r.return_icmp = $1.w; 1470 r.return_icmp6 = $1.w2; 1471 break; 1472 case PFRULE_RETURN: 1473 r.rule_flag |= PFRULE_RETURN; 1474 r.return_icmp = $1.w; 1475 r.return_icmp6 = $1.w2; 1476 break; 1477 } 1478 r.direction = $2; 1479 r.log = $3.log; 1480 r.quick = $3.quick; 1481 1482 r.af = $6; 1483 if ($9.tag) 1484 if (strlcpy(r.tagname, $9.tag, 1485 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1486 yyerror("tag too long, max %u chars", 1487 PF_TAG_NAME_SIZE - 1); 1488 YYERROR; 1489 } 1490 if ($9.match_tag) 1491 if (strlcpy(r.match_tagname, $9.match_tag, 1492 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 1493 yyerror("tag too long, max %u chars", 1494 PF_TAG_NAME_SIZE - 1); 1495 YYERROR; 1496 } 1497 r.match_tag_not = $9.match_tag_not; 1498 r.flags = $9.flags.b1; 1499 r.flagset = $9.flags.b2; 1500 if (rule_label(&r, $9.label)) 1501 YYERROR; 1502 free($9.label); 1503 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) { 1504 for (proto = $7; proto != NULL && 1505 proto->proto != IPPROTO_TCP; 1506 proto = proto->next) 1507 ; /* nothing */ 1508 if (proto == NULL && $7 != NULL) { 1509 if ($9.flags.b1 || $9.flags.b2) 1510 yyerror( 1511 "flags only apply to tcp"); 1512 if ($8.src_os) 1513 yyerror( 1514 "OS fingerprinting only " 1515 "apply to tcp"); 1516 YYERROR; 1517 } 1518 #if 0 1519 if (($9.flags.b1 & parse_flags("S")) == 0 && 1520 $8.src_os) { 1521 yyerror("OS fingerprinting requires " 1522 "the SYN TCP flag (flags S/SA)"); 1523 YYERROR; 1524 } 1525 #endif 1526 } 1527 1528 r.tos = $9.tos; 1529 r.keep_state = $9.keep.action; 1530 o = $9.keep.options; 1531 while (o) { 1532 struct node_state_opt *p = o; 1533 1534 switch (o->type) { 1535 case PF_STATE_OPT_MAX: 1536 if (r.max_states) { 1537 yyerror("state option 'max' " 1538 "multiple definitions"); 1539 YYERROR; 1540 } 1541 r.max_states = o->data.max_states; 1542 break; 1543 case PF_STATE_OPT_NOSYNC: 1544 if (r.rule_flag & PFRULE_NOSYNC) { 1545 yyerror("state option 'sync' " 1546 "multiple definitions"); 1547 YYERROR; 1548 } 1549 r.rule_flag |= PFRULE_NOSYNC; 1550 break; 1551 case PF_STATE_OPT_SRCTRACK: 1552 if (srctrack) { 1553 yyerror("state option " 1554 "'source-track' " 1555 "multiple definitions"); 1556 YYERROR; 1557 } 1558 srctrack = o->data.src_track; 1559 break; 1560 case PF_STATE_OPT_MAX_SRC_STATES: 1561 if (r.max_src_states) { 1562 yyerror("state option " 1563 "'max-src-states' " 1564 "multiple definitions"); 1565 YYERROR; 1566 } 1567 if (o->data.max_src_nodes == 0) { 1568 yyerror("'max-src-states' must " 1569 "be > 0"); 1570 YYERROR; 1571 } 1572 r.max_src_states = 1573 o->data.max_src_states; 1574 r.rule_flag |= PFRULE_SRCTRACK; 1575 break; 1576 case PF_STATE_OPT_MAX_SRC_NODES: 1577 if (r.max_src_nodes) { 1578 yyerror("state option " 1579 "'max-src-nodes' " 1580 "multiple definitions"); 1581 YYERROR; 1582 } 1583 if (o->data.max_src_nodes == 0) { 1584 yyerror("'max-src-nodes' must " 1585 "be > 0"); 1586 YYERROR; 1587 } 1588 r.max_src_nodes = 1589 o->data.max_src_nodes; 1590 r.rule_flag |= PFRULE_SRCTRACK | 1591 PFRULE_RULESRCTRACK; 1592 break; 1593 case PF_STATE_OPT_STATELOCK: 1594 if (statelock) { 1595 yyerror("state locking option: " 1596 "multiple definitions"); 1597 YYERROR; 1598 } 1599 statelock = 1; 1600 r.rule_flag |= o->data.statelock; 1601 break; 1602 case PF_STATE_OPT_TIMEOUT: 1603 if (r.timeout[o->data.timeout.number]) { 1604 yyerror("state timeout %s " 1605 "multiple definitions", 1606 pf_timeouts[o->data. 1607 timeout.number].name); 1608 YYERROR; 1609 } 1610 r.timeout[o->data.timeout.number] = 1611 o->data.timeout.seconds; 1612 } 1613 o = o->next; 1614 free(p); 1615 } 1616 if (srctrack) { 1617 if (srctrack == PF_SRCTRACK_GLOBAL && 1618 r.max_src_nodes) { 1619 yyerror("'max-src-nodes' is " 1620 "incompatible with " 1621 "'source-track global'"); 1622 YYERROR; 1623 } 1624 r.rule_flag |= PFRULE_SRCTRACK; 1625 if (srctrack == PF_SRCTRACK_RULE) 1626 r.rule_flag |= PFRULE_RULESRCTRACK; 1627 } 1628 if (r.keep_state && !statelock) 1629 r.rule_flag |= default_statelock; 1630 1631 if ($9.fragment) 1632 r.rule_flag |= PFRULE_FRAGMENT; 1633 r.allow_opts = $9.allowopts; 1634 1635 decide_address_family($8.src.host, &r.af); 1636 decide_address_family($8.dst.host, &r.af); 1637 1638 if ($5.rt) { 1639 if (!r.direction) { 1640 yyerror("direction must be explicit " 1641 "with rules that specify routing"); 1642 YYERROR; 1643 } 1644 r.rt = $5.rt; 1645 r.rpool.opts = $5.pool_opts; 1646 if ($5.key != NULL) 1647 memcpy(&r.rpool.key, $5.key, 1648 sizeof(struct pf_poolhashkey)); 1649 } 1650 if (r.rt && r.rt != PF_FASTROUTE) { 1651 decide_address_family($5.host, &r.af); 1652 remove_invalid_hosts(&$5.host, &r.af); 1653 if ($5.host == NULL) { 1654 yyerror("no routing address with " 1655 "matching address family found."); 1656 YYERROR; 1657 } 1658 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 1659 PF_POOL_NONE && ($5.host->next != NULL || 1660 $5.host->addr.type == PF_ADDR_TABLE || 1661 DYNIF_MULTIADDR($5.host->addr))) 1662 r.rpool.opts |= PF_POOL_ROUNDROBIN; 1663 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1664 PF_POOL_ROUNDROBIN && 1665 disallow_table($5.host, "tables are only " 1666 "supported in round-robin routing pools")) 1667 YYERROR; 1668 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1669 PF_POOL_ROUNDROBIN && 1670 disallow_alias($5.host, "interface (%s) " 1671 "is only supported in round-robin " 1672 "routing pools")) 1673 YYERROR; 1674 if ($5.host->next != NULL) { 1675 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 1676 PF_POOL_ROUNDROBIN) { 1677 yyerror("r.rpool.opts must " 1678 "be PF_POOL_ROUNDROBIN"); 1679 YYERROR; 1680 } 1681 } 1682 } 1683 if ($9.queues.qname != NULL) { 1684 if (strlcpy(r.qname, $9.queues.qname, 1685 sizeof(r.qname)) >= sizeof(r.qname)) { 1686 yyerror("rule qname too long (max " 1687 "%d chars)", sizeof(r.qname)-1); 1688 YYERROR; 1689 } 1690 free($9.queues.qname); 1691 } 1692 if ($9.queues.pqname != NULL) { 1693 if (strlcpy(r.pqname, $9.queues.pqname, 1694 sizeof(r.pqname)) >= sizeof(r.pqname)) { 1695 yyerror("rule pqname too long (max " 1696 "%d chars)", sizeof(r.pqname)-1); 1697 YYERROR; 1698 } 1699 free($9.queues.pqname); 1700 } 1701 1702 expand_rule(&r, $4, $5.host, $7, $8.src_os, 1703 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port, 1704 $9.uid, $9.gid, $9.icmpspec); 1705 } 1706 ; 1707 1708 filter_opts : { bzero(&filter_opts, sizeof filter_opts); } 1709 filter_opts_l 1710 { $$ = filter_opts; } 1711 | /* empty */ { 1712 bzero(&filter_opts, sizeof filter_opts); 1713 $$ = filter_opts; 1714 } 1715 ; 1716 1717 filter_opts_l : filter_opts_l filter_opt 1718 | filter_opt 1719 ; 1720 1721 filter_opt : USER uids { 1722 if (filter_opts.uid) 1723 $2->tail->next = filter_opts.uid; 1724 filter_opts.uid = $2; 1725 } 1726 | GROUP gids { 1727 if (filter_opts.gid) 1728 $2->tail->next = filter_opts.gid; 1729 filter_opts.gid = $2; 1730 } 1731 | flags { 1732 if (filter_opts.marker & FOM_FLAGS) { 1733 yyerror("flags cannot be redefined"); 1734 YYERROR; 1735 } 1736 filter_opts.marker |= FOM_FLAGS; 1737 filter_opts.flags.b1 |= $1.b1; 1738 filter_opts.flags.b2 |= $1.b2; 1739 filter_opts.flags.w |= $1.w; 1740 filter_opts.flags.w2 |= $1.w2; 1741 } 1742 | icmpspec { 1743 if (filter_opts.marker & FOM_ICMP) { 1744 yyerror("icmp-type cannot be redefined"); 1745 YYERROR; 1746 } 1747 filter_opts.marker |= FOM_ICMP; 1748 filter_opts.icmpspec = $1; 1749 } 1750 | tos { 1751 if (filter_opts.marker & FOM_TOS) { 1752 yyerror("tos cannot be redefined"); 1753 YYERROR; 1754 } 1755 filter_opts.marker |= FOM_TOS; 1756 filter_opts.tos = $1; 1757 } 1758 | keep { 1759 if (filter_opts.marker & FOM_KEEP) { 1760 yyerror("modulate or keep cannot be redefined"); 1761 YYERROR; 1762 } 1763 filter_opts.marker |= FOM_KEEP; 1764 filter_opts.keep.action = $1.action; 1765 filter_opts.keep.options = $1.options; 1766 } 1767 | FRAGMENT { 1768 filter_opts.fragment = 1; 1769 } 1770 | ALLOWOPTS { 1771 filter_opts.allowopts = 1; 1772 } 1773 | label { 1774 if (filter_opts.label) { 1775 yyerror("label cannot be redefined"); 1776 YYERROR; 1777 } 1778 filter_opts.label = $1; 1779 } 1780 | qname { 1781 if (filter_opts.queues.qname) { 1782 yyerror("queue cannot be redefined"); 1783 YYERROR; 1784 } 1785 filter_opts.queues = $1; 1786 } 1787 | TAG string { 1788 filter_opts.tag = $2; 1789 } 1790 | not TAGGED string { 1791 filter_opts.match_tag = $3; 1792 filter_opts.match_tag_not = $1; 1793 } 1794 ; 1795 1796 action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; } 1797 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; } 1798 ; 1799 1800 blockspec : /* empty */ { 1801 $$.b2 = blockpolicy; 1802 $$.w = returnicmpdefault; 1803 $$.w2 = returnicmp6default; 1804 } 1805 | DROP { 1806 $$.b2 = PFRULE_DROP; 1807 $$.w = 0; 1808 $$.w2 = 0; 1809 } 1810 | RETURNRST { 1811 $$.b2 = PFRULE_RETURNRST; 1812 $$.w = 0; 1813 $$.w2 = 0; 1814 } 1815 | RETURNRST '(' TTL number ')' { 1816 if ($4 > 255) { 1817 yyerror("illegal ttl value %d", $4); 1818 YYERROR; 1819 } 1820 $$.b2 = PFRULE_RETURNRST; 1821 $$.w = $4; 1822 $$.w2 = 0; 1823 } 1824 | RETURNICMP { 1825 $$.b2 = PFRULE_RETURNICMP; 1826 $$.w = returnicmpdefault; 1827 $$.w2 = returnicmp6default; 1828 } 1829 | RETURNICMP6 { 1830 $$.b2 = PFRULE_RETURNICMP; 1831 $$.w = returnicmpdefault; 1832 $$.w2 = returnicmp6default; 1833 } 1834 | RETURNICMP '(' STRING ')' { 1835 $$.b2 = PFRULE_RETURNICMP; 1836 if (!($$.w = parseicmpspec($3, AF_INET))) { 1837 free($3); 1838 YYERROR; 1839 } 1840 free($3); 1841 $$.w2 = returnicmp6default; 1842 } 1843 | RETURNICMP6 '(' STRING ')' { 1844 $$.b2 = PFRULE_RETURNICMP; 1845 $$.w = returnicmpdefault; 1846 if (!($$.w2 = parseicmpspec($3, AF_INET6))) { 1847 free($3); 1848 YYERROR; 1849 } 1850 free($3); 1851 } 1852 | RETURNICMP '(' STRING comma STRING ')' { 1853 $$.b2 = PFRULE_RETURNICMP; 1854 if (!($$.w = parseicmpspec($3, AF_INET)) || 1855 !($$.w2 = parseicmpspec($5, AF_INET6))) { 1856 free($3); 1857 free($5); 1858 YYERROR; 1859 } 1860 free($3); 1861 free($5); 1862 } 1863 | RETURN { 1864 $$.b2 = PFRULE_RETURN; 1865 $$.w = returnicmpdefault; 1866 $$.w2 = returnicmp6default; 1867 } 1868 ; 1869 1870 dir : /* empty */ { $$ = 0; } 1871 | IN { $$ = PF_IN; } 1872 | OUT { $$ = PF_OUT; } 1873 ; 1874 1875 logquick : /* empty */ { $$.log = 0; $$.quick = 0; } 1876 | log { $$.log = $1; $$.quick = 0; } 1877 | QUICK { $$.log = 0; $$.quick = 1; } 1878 | log QUICK { $$.log = $1; $$.quick = 1; } 1879 | QUICK log { $$.log = $2; $$.quick = 1; } 1880 ; 1881 1882 log : LOG { $$ = 1; } 1883 | LOGALL { $$ = 2; } 1884 ; 1885 1886 interface : /* empty */ { $$ = NULL; } 1887 | ON if_item_not { $$ = $2; } 1888 | ON '{' if_list '}' { $$ = $3; } 1889 ; 1890 1891 if_list : if_item_not { $$ = $1; } 1892 | if_list comma if_item_not { 1893 $1->tail->next = $3; 1894 $1->tail = $3; 1895 $$ = $1; 1896 } 1897 ; 1898 1899 if_item_not : not if_item { $$ = $2; $$->not = $1; } 1900 ; 1901 1902 if_item : STRING { 1903 struct node_host *n; 1904 1905 if ((n = ifa_exists($1, 1)) == NULL) { 1906 yyerror("unknown interface %s", $1); 1907 free($1); 1908 YYERROR; 1909 } 1910 $$ = calloc(1, sizeof(struct node_if)); 1911 if ($$ == NULL) 1912 err(1, "if_item: calloc"); 1913 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >= 1914 sizeof($$->ifname)) { 1915 free($1); 1916 free($$); 1917 yyerror("interface name too long"); 1918 YYERROR; 1919 } 1920 free($1); 1921 $$->ifa_flags = n->ifa_flags; 1922 $$->not = 0; 1923 $$->next = NULL; 1924 $$->tail = $$; 1925 } 1926 ; 1927 1928 af : /* empty */ { $$ = 0; } 1929 | INET { $$ = AF_INET; } 1930 | INET6 { $$ = AF_INET6; } 1931 ; 1932 1933 proto : /* empty */ { $$ = NULL; } 1934 | PROTO proto_item { $$ = $2; } 1935 | PROTO '{' proto_list '}' { $$ = $3; } 1936 ; 1937 1938 proto_list : proto_item { $$ = $1; } 1939 | proto_list comma proto_item { 1940 $1->tail->next = $3; 1941 $1->tail = $3; 1942 $$ = $1; 1943 } 1944 ; 1945 1946 proto_item : STRING { 1947 u_int8_t pr; 1948 u_long ulval; 1949 1950 if (atoul($1, &ulval) == 0) { 1951 if (ulval > 255) { 1952 yyerror("protocol outside range"); 1953 free($1); 1954 YYERROR; 1955 } 1956 pr = (u_int8_t)ulval; 1957 } else { 1958 struct protoent *p; 1959 1960 p = getprotobyname($1); 1961 if (p == NULL) { 1962 yyerror("unknown protocol %s", $1); 1963 free($1); 1964 YYERROR; 1965 } 1966 pr = p->p_proto; 1967 } 1968 free($1); 1969 if (pr == 0) { 1970 yyerror("proto 0 cannot be used"); 1971 YYERROR; 1972 } 1973 $$ = calloc(1, sizeof(struct node_proto)); 1974 if ($$ == NULL) 1975 err(1, "proto_item: calloc"); 1976 $$->proto = pr; 1977 $$->next = NULL; 1978 $$->tail = $$; 1979 } 1980 ; 1981 1982 fromto : ALL { 1983 $$.src.host = NULL; 1984 $$.src.port = NULL; 1985 $$.dst.host = NULL; 1986 $$.dst.port = NULL; 1987 $$.src_os = NULL; 1988 } 1989 | from os to { 1990 $$.src = $1; 1991 $$.src_os = $2; 1992 $$.dst = $3; 1993 } 1994 ; 1995 1996 os : /* empty */ { $$ = NULL; } 1997 | OS xos { $$ = $2; } 1998 | OS '{' os_list '}' { $$ = $3; } 1999 ; 2000 2001 xos : STRING { 2002 $$ = calloc(1, sizeof(struct node_os)); 2003 if ($$ == NULL) 2004 err(1, "os: calloc"); 2005 $$->os = $1; 2006 $$->tail = $$; 2007 } 2008 ; 2009 2010 os_list : xos { $$ = $1; } 2011 | os_list comma xos { 2012 $1->tail->next = $3; 2013 $1->tail = $3; 2014 $$ = $1; 2015 } 2016 ; 2017 2018 from : /* empty */ { 2019 $$.host = NULL; 2020 $$.port = NULL; 2021 } 2022 | FROM ipportspec { 2023 $$ = $2; 2024 } 2025 ; 2026 2027 to : /* empty */ { 2028 $$.host = NULL; 2029 $$.port = NULL; 2030 } 2031 | TO ipportspec { 2032 $$ = $2; 2033 } 2034 ; 2035 2036 ipportspec : ipspec { 2037 $$.host = $1; 2038 $$.port = NULL; 2039 } 2040 | ipspec PORT portspec { 2041 $$.host = $1; 2042 $$.port = $3; 2043 } 2044 | PORT portspec { 2045 $$.host = NULL; 2046 $$.port = $2; 2047 } 2048 ; 2049 2050 ipspec : ANY { $$ = NULL; } 2051 | xhost { $$ = $1; } 2052 | '{' host_list '}' { $$ = $2; } 2053 ; 2054 2055 host_list : xhost { $$ = $1; } 2056 | host_list comma xhost { 2057 if ($3 == NULL) 2058 $$ = $1; 2059 else if ($1 == NULL) 2060 $$ = $3; 2061 else { 2062 $1->tail->next = $3; 2063 $1->tail = $3->tail; 2064 $$ = $1; 2065 } 2066 } 2067 ; 2068 2069 xhost : not host { 2070 struct node_host *n; 2071 2072 for (n = $2; n != NULL; n = n->next) 2073 n->not = $1; 2074 $$ = $2; 2075 } 2076 | NOROUTE { 2077 $$ = calloc(1, sizeof(struct node_host)); 2078 if ($$ == NULL) 2079 err(1, "xhost: calloc"); 2080 $$->addr.type = PF_ADDR_NOROUTE; 2081 $$->next = NULL; 2082 $$->tail = $$; 2083 } 2084 ; 2085 2086 host : STRING { 2087 if (($$ = host($1)) == NULL) { 2088 /* error. "any" is handled elsewhere */ 2089 free($1); 2090 yyerror("could not parse host specification"); 2091 YYERROR; 2092 } 2093 free($1); 2094 2095 } 2096 | STRING '/' number { 2097 char *buf; 2098 2099 if (asprintf(&buf, "%s/%u", $1, $3) == -1) 2100 err(1, "host: asprintf"); 2101 free($1); 2102 if (($$ = host(buf)) == NULL) { 2103 /* error. "any" is handled elsewhere */ 2104 free(buf); 2105 yyerror("could not parse host specification"); 2106 YYERROR; 2107 } 2108 free(buf); 2109 } 2110 | dynaddr 2111 | dynaddr '/' number { 2112 struct node_host *n; 2113 2114 $$ = $1; 2115 for (n = $1; n != NULL; n = n->next) 2116 set_ipmask(n, $3); 2117 } 2118 | '<' STRING '>' { 2119 if (strlen($2) >= PF_TABLE_NAME_SIZE) { 2120 yyerror("table name '%s' too long", $2); 2121 free($2); 2122 YYERROR; 2123 } 2124 $$ = calloc(1, sizeof(struct node_host)); 2125 if ($$ == NULL) 2126 err(1, "host: calloc"); 2127 $$->addr.type = PF_ADDR_TABLE; 2128 if (strlcpy($$->addr.v.tblname, $2, 2129 sizeof($$->addr.v.tblname)) >= 2130 sizeof($$->addr.v.tblname)) 2131 errx(1, "host: strlcpy"); 2132 free($2); 2133 $$->next = NULL; 2134 $$->tail = $$; 2135 } 2136 ; 2137 2138 number : STRING { 2139 u_long ulval; 2140 2141 if (atoul($1, &ulval) == -1) { 2142 yyerror("%s is not a number", $1); 2143 free($1); 2144 YYERROR; 2145 } else 2146 $$ = ulval; 2147 free($1); 2148 } 2149 ; 2150 2151 dynaddr : '(' STRING ')' { 2152 int flags = 0; 2153 char *p, *op; 2154 2155 op = $2; 2156 while ((p = strrchr($2, ':')) != NULL) { 2157 if (!strcmp(p+1, "network")) 2158 flags |= PFI_AFLAG_NETWORK; 2159 else if (!strcmp(p+1, "broadcast")) 2160 flags |= PFI_AFLAG_BROADCAST; 2161 else if (!strcmp(p+1, "peer")) 2162 flags |= PFI_AFLAG_PEER; 2163 else if (!strcmp(p+1, "0")) 2164 flags |= PFI_AFLAG_NOALIAS; 2165 else { 2166 yyerror("interface %s has bad modifier", 2167 $2); 2168 free(op); 2169 YYERROR; 2170 } 2171 *p = '\0'; 2172 } 2173 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) { 2174 free(op); 2175 yyerror("illegal combination of " 2176 "interface modifiers"); 2177 YYERROR; 2178 } 2179 if (ifa_exists($2, 1) == NULL && strcmp($2, "self")) { 2180 yyerror("interface %s does not exist", $2); 2181 free(op); 2182 YYERROR; 2183 } 2184 $$ = calloc(1, sizeof(struct node_host)); 2185 if ($$ == NULL) 2186 err(1, "address: calloc"); 2187 $$->af = 0; 2188 set_ipmask($$, 128); 2189 $$->addr.type = PF_ADDR_DYNIFTL; 2190 $$->addr.iflags = flags; 2191 if (strlcpy($$->addr.v.ifname, $2, 2192 sizeof($$->addr.v.ifname)) >= 2193 sizeof($$->addr.v.ifname)) { 2194 free(op); 2195 free($$); 2196 yyerror("interface name too long"); 2197 YYERROR; 2198 } 2199 free(op); 2200 $$->next = NULL; 2201 $$->tail = $$; 2202 } 2203 ; 2204 2205 portspec : port_item { $$ = $1; } 2206 | '{' port_list '}' { $$ = $2; } 2207 ; 2208 2209 port_list : port_item { $$ = $1; } 2210 | port_list comma port_item { 2211 $1->tail->next = $3; 2212 $1->tail = $3; 2213 $$ = $1; 2214 } 2215 ; 2216 2217 port_item : port { 2218 $$ = calloc(1, sizeof(struct node_port)); 2219 if ($$ == NULL) 2220 err(1, "port_item: calloc"); 2221 $$->port[0] = $1.a; 2222 $$->port[1] = $1.b; 2223 if ($1.t) 2224 $$->op = PF_OP_RRG; 2225 else 2226 $$->op = PF_OP_EQ; 2227 $$->next = NULL; 2228 $$->tail = $$; 2229 } 2230 | unaryop port { 2231 if ($2.t) { 2232 yyerror("':' cannot be used with an other " 2233 "port operator"); 2234 YYERROR; 2235 } 2236 $$ = calloc(1, sizeof(struct node_port)); 2237 if ($$ == NULL) 2238 err(1, "port_item: calloc"); 2239 $$->port[0] = $2.a; 2240 $$->port[1] = $2.b; 2241 $$->op = $1; 2242 $$->next = NULL; 2243 $$->tail = $$; 2244 } 2245 | port PORTBINARY port { 2246 if ($1.t || $3.t) { 2247 yyerror("':' cannot be used with an other " 2248 "port operator"); 2249 YYERROR; 2250 } 2251 $$ = calloc(1, sizeof(struct node_port)); 2252 if ($$ == NULL) 2253 err(1, "port_item: calloc"); 2254 $$->port[0] = $1.a; 2255 $$->port[1] = $3.a; 2256 $$->op = $2; 2257 $$->next = NULL; 2258 $$->tail = $$; 2259 } 2260 ; 2261 2262 port : STRING { 2263 char *p = strchr($1, ':'); 2264 struct servent *s = NULL; 2265 u_long ulval; 2266 2267 if (p == NULL) { 2268 if (atoul($1, &ulval) == 0) { 2269 if (ulval > 65535) { 2270 free($1); 2271 yyerror("illegal port value %d", 2272 ulval); 2273 YYERROR; 2274 } 2275 $$.a = htons(ulval); 2276 } else { 2277 s = getservbyname($1, "tcp"); 2278 if (s == NULL) 2279 s = getservbyname($1, "udp"); 2280 if (s == NULL) { 2281 yyerror("unknown port %s", $1); 2282 free($1); 2283 YYERROR; 2284 } 2285 $$.a = s->s_port; 2286 } 2287 $$.b = 0; 2288 $$.t = 0; 2289 } else { 2290 int port[2]; 2291 2292 *p++ = 0; 2293 if ((port[0] = getservice($1)) == -1 || 2294 (port[1] = getservice(p)) == -1) { 2295 free($1); 2296 YYERROR; 2297 } 2298 $$.a = port[0]; 2299 $$.b = port[1]; 2300 $$.t = PF_OP_RRG; 2301 } 2302 free($1); 2303 } 2304 ; 2305 2306 uids : uid_item { $$ = $1; } 2307 | '{' uid_list '}' { $$ = $2; } 2308 ; 2309 2310 uid_list : uid_item { $$ = $1; } 2311 | uid_list comma uid_item { 2312 $1->tail->next = $3; 2313 $1->tail = $3; 2314 $$ = $1; 2315 } 2316 ; 2317 2318 uid_item : uid { 2319 $$ = calloc(1, sizeof(struct node_uid)); 2320 if ($$ == NULL) 2321 err(1, "uid_item: calloc"); 2322 $$->uid[0] = $1; 2323 $$->uid[1] = $1; 2324 $$->op = PF_OP_EQ; 2325 $$->next = NULL; 2326 $$->tail = $$; 2327 } 2328 | unaryop uid { 2329 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2330 yyerror("user unknown requires operator = or " 2331 "!="); 2332 YYERROR; 2333 } 2334 $$ = calloc(1, sizeof(struct node_uid)); 2335 if ($$ == NULL) 2336 err(1, "uid_item: calloc"); 2337 $$->uid[0] = $2; 2338 $$->uid[1] = $2; 2339 $$->op = $1; 2340 $$->next = NULL; 2341 $$->tail = $$; 2342 } 2343 | uid PORTBINARY uid { 2344 if ($1 == UID_MAX || $3 == UID_MAX) { 2345 yyerror("user unknown requires operator = or " 2346 "!="); 2347 YYERROR; 2348 } 2349 $$ = calloc(1, sizeof(struct node_uid)); 2350 if ($$ == NULL) 2351 err(1, "uid_item: calloc"); 2352 $$->uid[0] = $1; 2353 $$->uid[1] = $3; 2354 $$->op = $2; 2355 $$->next = NULL; 2356 $$->tail = $$; 2357 } 2358 ; 2359 2360 uid : STRING { 2361 u_long ulval; 2362 2363 if (atoul($1, &ulval) == -1) { 2364 if (!strcmp($1, "unknown")) 2365 $$ = UID_MAX; 2366 else { 2367 struct passwd *pw; 2368 2369 if ((pw = getpwnam($1)) == NULL) { 2370 yyerror("unknown user %s", $1); 2371 free($1); 2372 YYERROR; 2373 } 2374 $$ = pw->pw_uid; 2375 } 2376 } else { 2377 if (ulval >= UID_MAX) { 2378 free($1); 2379 yyerror("illegal uid value %lu", ulval); 2380 YYERROR; 2381 } 2382 $$ = ulval; 2383 } 2384 free($1); 2385 } 2386 ; 2387 2388 gids : gid_item { $$ = $1; } 2389 | '{' gid_list '}' { $$ = $2; } 2390 ; 2391 2392 gid_list : gid_item { $$ = $1; } 2393 | gid_list comma gid_item { 2394 $1->tail->next = $3; 2395 $1->tail = $3; 2396 $$ = $1; 2397 } 2398 ; 2399 2400 gid_item : gid { 2401 $$ = calloc(1, sizeof(struct node_gid)); 2402 if ($$ == NULL) 2403 err(1, "gid_item: calloc"); 2404 $$->gid[0] = $1; 2405 $$->gid[1] = $1; 2406 $$->op = PF_OP_EQ; 2407 $$->next = NULL; 2408 $$->tail = $$; 2409 } 2410 | unaryop gid { 2411 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) { 2412 yyerror("group unknown requires operator = or " 2413 "!="); 2414 YYERROR; 2415 } 2416 $$ = calloc(1, sizeof(struct node_gid)); 2417 if ($$ == NULL) 2418 err(1, "gid_item: calloc"); 2419 $$->gid[0] = $2; 2420 $$->gid[1] = $2; 2421 $$->op = $1; 2422 $$->next = NULL; 2423 $$->tail = $$; 2424 } 2425 | gid PORTBINARY gid { 2426 if ($1 == GID_MAX || $3 == GID_MAX) { 2427 yyerror("group unknown requires operator = or " 2428 "!="); 2429 YYERROR; 2430 } 2431 $$ = calloc(1, sizeof(struct node_gid)); 2432 if ($$ == NULL) 2433 err(1, "gid_item: calloc"); 2434 $$->gid[0] = $1; 2435 $$->gid[1] = $3; 2436 $$->op = $2; 2437 $$->next = NULL; 2438 $$->tail = $$; 2439 } 2440 ; 2441 2442 gid : STRING { 2443 u_long ulval; 2444 2445 if (atoul($1, &ulval) == -1) { 2446 if (!strcmp($1, "unknown")) 2447 $$ = GID_MAX; 2448 else { 2449 struct group *grp; 2450 2451 if ((grp = getgrnam($1)) == NULL) { 2452 yyerror("unknown group %s", $1); 2453 free($1); 2454 YYERROR; 2455 } 2456 $$ = grp->gr_gid; 2457 } 2458 } else { 2459 if (ulval >= GID_MAX) { 2460 yyerror("illegal gid value %lu", ulval); 2461 free($1); 2462 YYERROR; 2463 } 2464 $$ = ulval; 2465 } 2466 free($1); 2467 } 2468 ; 2469 2470 flag : STRING { 2471 int f; 2472 2473 if ((f = parse_flags($1)) < 0) { 2474 yyerror("bad flags %s", $1); 2475 free($1); 2476 YYERROR; 2477 } 2478 free($1); 2479 $$.b1 = f; 2480 } 2481 ; 2482 2483 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; } 2484 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; } 2485 ; 2486 2487 icmpspec : ICMPTYPE icmp_item { $$ = $2; } 2488 | ICMPTYPE '{' icmp_list '}' { $$ = $3; } 2489 | ICMP6TYPE icmp6_item { $$ = $2; } 2490 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; } 2491 ; 2492 2493 icmp_list : icmp_item { $$ = $1; } 2494 | icmp_list comma icmp_item { 2495 $1->tail->next = $3; 2496 $1->tail = $3; 2497 $$ = $1; 2498 } 2499 ; 2500 2501 icmp6_list : icmp6_item { $$ = $1; } 2502 | icmp6_list comma icmp6_item { 2503 $1->tail->next = $3; 2504 $1->tail = $3; 2505 $$ = $1; 2506 } 2507 ; 2508 2509 icmp_item : icmptype { 2510 $$ = calloc(1, sizeof(struct node_icmp)); 2511 if ($$ == NULL) 2512 err(1, "icmp_item: calloc"); 2513 $$->type = $1; 2514 $$->code = 0; 2515 $$->proto = IPPROTO_ICMP; 2516 $$->next = NULL; 2517 $$->tail = $$; 2518 } 2519 | icmptype CODE STRING { 2520 const struct icmpcodeent *p; 2521 u_long ulval; 2522 2523 if (atoul($3, &ulval) == 0) { 2524 if (ulval > 255) { 2525 free($3); 2526 yyerror("illegal icmp-code %d", ulval); 2527 YYERROR; 2528 } 2529 } else { 2530 if ((p = geticmpcodebyname($1-1, $3, 2531 AF_INET)) == NULL) { 2532 yyerror("unknown icmp-code %s", $3); 2533 free($3); 2534 YYERROR; 2535 } 2536 ulval = p->code; 2537 } 2538 free($3); 2539 $$ = calloc(1, sizeof(struct node_icmp)); 2540 if ($$ == NULL) 2541 err(1, "icmp_item: calloc"); 2542 $$->type = $1; 2543 $$->code = ulval + 1; 2544 $$->proto = IPPROTO_ICMP; 2545 $$->next = NULL; 2546 $$->tail = $$; 2547 } 2548 ; 2549 2550 icmp6_item : icmp6type { 2551 $$ = calloc(1, sizeof(struct node_icmp)); 2552 if ($$ == NULL) 2553 err(1, "icmp_item: calloc"); 2554 $$->type = $1; 2555 $$->code = 0; 2556 $$->proto = IPPROTO_ICMPV6; 2557 $$->next = NULL; 2558 $$->tail = $$; 2559 } 2560 | icmp6type CODE STRING { 2561 const struct icmpcodeent *p; 2562 u_long ulval; 2563 2564 if (atoul($3, &ulval) == 0) { 2565 if (ulval > 255) { 2566 yyerror("illegal icmp6-code %ld", 2567 ulval); 2568 free($3); 2569 YYERROR; 2570 } 2571 } else { 2572 if ((p = geticmpcodebyname($1-1, $3, 2573 AF_INET6)) == NULL) { 2574 yyerror("unknown icmp6-code %s", $3); 2575 free($3); 2576 YYERROR; 2577 } 2578 ulval = p->code; 2579 } 2580 free($3); 2581 $$ = calloc(1, sizeof(struct node_icmp)); 2582 if ($$ == NULL) 2583 err(1, "icmp_item: calloc"); 2584 $$->type = $1; 2585 $$->code = ulval + 1; 2586 $$->proto = IPPROTO_ICMPV6; 2587 $$->next = NULL; 2588 $$->tail = $$; 2589 } 2590 ; 2591 2592 icmptype : STRING { 2593 const struct icmptypeent *p; 2594 u_long ulval; 2595 2596 if (atoul($1, &ulval) == 0) { 2597 if (ulval > 255) { 2598 yyerror("illegal icmp-type %d", ulval); 2599 free($1); 2600 YYERROR; 2601 } 2602 $$ = ulval + 1; 2603 } else { 2604 if ((p = geticmptypebyname($1, AF_INET)) == 2605 NULL) { 2606 yyerror("unknown icmp-type %s", $1); 2607 free($1); 2608 YYERROR; 2609 } 2610 $$ = p->type + 1; 2611 } 2612 free($1); 2613 } 2614 ; 2615 2616 icmp6type : STRING { 2617 const struct icmptypeent *p; 2618 u_long ulval; 2619 2620 if (atoul($1, &ulval) == 0) { 2621 if (ulval > 255) { 2622 yyerror("illegal icmp6-type %d", ulval); 2623 free($1); 2624 YYERROR; 2625 } 2626 $$ = ulval + 1; 2627 } else { 2628 if ((p = geticmptypebyname($1, AF_INET6)) == 2629 NULL) { 2630 yyerror("unknown icmp6-type %s", $1); 2631 free($1); 2632 YYERROR; 2633 } 2634 $$ = p->type + 1; 2635 } 2636 free($1); 2637 } 2638 ; 2639 2640 tos : TOS STRING { 2641 if (!strcmp($2, "lowdelay")) 2642 $$ = IPTOS_LOWDELAY; 2643 else if (!strcmp($2, "throughput")) 2644 $$ = IPTOS_THROUGHPUT; 2645 else if (!strcmp($2, "reliability")) 2646 $$ = IPTOS_RELIABILITY; 2647 else if ($2[0] == '0' && $2[1] == 'x') 2648 $$ = strtoul($2, NULL, 16); 2649 else 2650 $$ = strtoul($2, NULL, 10); 2651 if (!$$ || $$ > 255) { 2652 yyerror("illegal tos value %s", $2); 2653 free($2); 2654 YYERROR; 2655 } 2656 free($2); 2657 } 2658 ; 2659 2660 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; } 2661 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; } 2662 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; } 2663 ; 2664 2665 statelock : IFBOUND { 2666 $$ = PFRULE_IFBOUND; 2667 } 2668 | GRBOUND { 2669 $$ = PFRULE_GRBOUND; 2670 } 2671 | FLOATING { 2672 $$ = 0; 2673 } 2674 ; 2675 2676 keep : KEEP STATE state_opt_spec { 2677 $$.action = PF_STATE_NORMAL; 2678 $$.options = $3; 2679 } 2680 | MODULATE STATE state_opt_spec { 2681 $$.action = PF_STATE_MODULATE; 2682 $$.options = $3; 2683 } 2684 | SYNPROXY STATE state_opt_spec { 2685 $$.action = PF_STATE_SYNPROXY; 2686 $$.options = $3; 2687 } 2688 ; 2689 2690 state_opt_spec : '(' state_opt_list ')' { $$ = $2; } 2691 | /* empty */ { $$ = NULL; } 2692 ; 2693 2694 state_opt_list : state_opt_item { $$ = $1; } 2695 | state_opt_list comma state_opt_item { 2696 $1->tail->next = $3; 2697 $1->tail = $3; 2698 $$ = $1; 2699 } 2700 ; 2701 2702 state_opt_item : MAXIMUM number { 2703 $$ = calloc(1, sizeof(struct node_state_opt)); 2704 if ($$ == NULL) 2705 err(1, "state_opt_item: calloc"); 2706 $$->type = PF_STATE_OPT_MAX; 2707 $$->data.max_states = $2; 2708 $$->next = NULL; 2709 $$->tail = $$; 2710 } 2711 | NOSYNC { 2712 $$ = calloc(1, sizeof(struct node_state_opt)); 2713 if ($$ == NULL) 2714 err(1, "state_opt_item: calloc"); 2715 $$->type = PF_STATE_OPT_NOSYNC; 2716 $$->next = NULL; 2717 $$->tail = $$; 2718 } 2719 | MAXSRCSTATES number { 2720 $$ = calloc(1, sizeof(struct node_state_opt)); 2721 if ($$ == NULL) 2722 err(1, "state_opt_item: calloc"); 2723 $$->type = PF_STATE_OPT_MAX_SRC_STATES; 2724 $$->data.max_src_states = $2; 2725 $$->next = NULL; 2726 $$->tail = $$; 2727 } 2728 | MAXSRCNODES number { 2729 $$ = calloc(1, sizeof(struct node_state_opt)); 2730 if ($$ == NULL) 2731 err(1, "state_opt_item: calloc"); 2732 $$->type = PF_STATE_OPT_MAX_SRC_NODES; 2733 $$->data.max_src_nodes = $2; 2734 $$->next = NULL; 2735 $$->tail = $$; 2736 } 2737 | sourcetrack { 2738 $$ = calloc(1, sizeof(struct node_state_opt)); 2739 if ($$ == NULL) 2740 err(1, "state_opt_item: calloc"); 2741 $$->type = PF_STATE_OPT_SRCTRACK; 2742 $$->data.src_track = $1; 2743 $$->next = NULL; 2744 $$->tail = $$; 2745 } 2746 | statelock { 2747 $$ = calloc(1, sizeof(struct node_state_opt)); 2748 if ($$ == NULL) 2749 err(1, "state_opt_item: calloc"); 2750 $$->type = PF_STATE_OPT_STATELOCK; 2751 $$->data.statelock = $1; 2752 $$->next = NULL; 2753 $$->tail = $$; 2754 } 2755 | STRING number { 2756 int i; 2757 2758 for (i = 0; pf_timeouts[i].name && 2759 strcmp(pf_timeouts[i].name, $1); ++i) 2760 ; /* nothing */ 2761 if (!pf_timeouts[i].name) { 2762 yyerror("illegal timeout name %s", $1); 2763 free($1); 2764 YYERROR; 2765 } 2766 if (strchr(pf_timeouts[i].name, '.') == NULL) { 2767 yyerror("illegal state timeout %s", $1); 2768 free($1); 2769 YYERROR; 2770 } 2771 free($1); 2772 $$ = calloc(1, sizeof(struct node_state_opt)); 2773 if ($$ == NULL) 2774 err(1, "state_opt_item: calloc"); 2775 $$->type = PF_STATE_OPT_TIMEOUT; 2776 $$->data.timeout.number = pf_timeouts[i].timeout; 2777 $$->data.timeout.seconds = $2; 2778 $$->next = NULL; 2779 $$->tail = $$; 2780 } 2781 ; 2782 2783 label : LABEL STRING { 2784 $$ = $2; 2785 } 2786 ; 2787 2788 qname : QUEUE STRING { 2789 $$.qname = $2; 2790 } 2791 | QUEUE '(' STRING ')' { 2792 $$.qname = $3; 2793 } 2794 | QUEUE '(' STRING comma STRING ')' { 2795 $$.qname = $3; 2796 $$.pqname = $5; 2797 } 2798 ; 2799 2800 no : /* empty */ { $$ = 0; } 2801 | NO { $$ = 1; } 2802 ; 2803 2804 rport : STRING { 2805 char *p = strchr($1, ':'); 2806 2807 if (p == NULL) { 2808 if (($$.a = getservice($1)) == -1) { 2809 free($1); 2810 YYERROR; 2811 } 2812 $$.b = $$.t = 0; 2813 } else if (!strcmp(p+1, "*")) { 2814 *p = 0; 2815 if (($$.a = getservice($1)) == -1) { 2816 free($1); 2817 YYERROR; 2818 } 2819 $$.b = 0; 2820 $$.t = 1; 2821 } else { 2822 *p++ = 0; 2823 if (($$.a = getservice($1)) == -1 || 2824 ($$.b = getservice(p)) == -1) { 2825 free($1); 2826 YYERROR; 2827 } 2828 if ($$.a == $$.b) 2829 $$.b = 0; 2830 $$.t = 0; 2831 } 2832 free($1); 2833 } 2834 ; 2835 2836 redirspec : host { $$ = $1; } 2837 | '{' redir_host_list '}' { $$ = $2; } 2838 ; 2839 2840 redir_host_list : host { $$ = $1; } 2841 | redir_host_list comma host { 2842 $1->tail->next = $3; 2843 $1->tail = $3->tail; 2844 $$ = $1; 2845 } 2846 ; 2847 2848 redirpool : /* empty */ { $$ = NULL; } 2849 | ARROW redirspec { 2850 $$ = calloc(1, sizeof(struct redirection)); 2851 if ($$ == NULL) 2852 err(1, "redirection: calloc"); 2853 $$->host = $2; 2854 $$->rport.a = $$->rport.b = $$->rport.t = 0; 2855 } 2856 | ARROW redirspec PORT rport { 2857 $$ = calloc(1, sizeof(struct redirection)); 2858 if ($$ == NULL) 2859 err(1, "redirection: calloc"); 2860 $$->host = $2; 2861 $$->rport = $4; 2862 } 2863 ; 2864 2865 hashkey : /* empty */ 2866 { 2867 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2868 if ($$ == NULL) 2869 err(1, "hashkey: calloc"); 2870 $$->key32[0] = arc4random(); 2871 $$->key32[1] = arc4random(); 2872 $$->key32[2] = arc4random(); 2873 $$->key32[3] = arc4random(); 2874 } 2875 | string 2876 { 2877 if (!strncmp($1, "0x", 2)) { 2878 if (strlen($1) != 34) { 2879 free($1); 2880 yyerror("hex key must be 128 bits " 2881 "(32 hex digits) long"); 2882 YYERROR; 2883 } 2884 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2885 if ($$ == NULL) 2886 err(1, "hashkey: calloc"); 2887 2888 if (sscanf($1, "0x%8x%8x%8x%8x", 2889 &$$->key32[0], &$$->key32[1], 2890 &$$->key32[2], &$$->key32[3]) != 4) { 2891 free($$); 2892 free($1); 2893 yyerror("invalid hex key"); 2894 YYERROR; 2895 } 2896 } else { 2897 MD5_CTX context; 2898 2899 $$ = calloc(1, sizeof(struct pf_poolhashkey)); 2900 if ($$ == NULL) 2901 err(1, "hashkey: calloc"); 2902 MD5Init(&context); 2903 MD5Update(&context, (unsigned char *)$1, 2904 strlen($1)); 2905 MD5Final((unsigned char *)$$, &context); 2906 $$->key32[0] = htonl($$->key32[0]); 2907 $$->key32[1] = htonl($$->key32[1]); 2908 $$->key32[2] = htonl($$->key32[2]); 2909 $$->key32[3] = htonl($$->key32[3]); 2910 } 2911 free($1); 2912 } 2913 ; 2914 2915 pool_opts : { bzero(&pool_opts, sizeof pool_opts); } 2916 pool_opts_l 2917 { $$ = pool_opts; } 2918 | /* empty */ { 2919 bzero(&pool_opts, sizeof pool_opts); 2920 $$ = pool_opts; 2921 } 2922 ; 2923 2924 pool_opts_l : pool_opts_l pool_opt 2925 | pool_opt 2926 ; 2927 2928 pool_opt : BITMASK { 2929 if (pool_opts.type) { 2930 yyerror("pool type cannot be redefined"); 2931 YYERROR; 2932 } 2933 pool_opts.type = PF_POOL_BITMASK; 2934 } 2935 | RANDOM { 2936 if (pool_opts.type) { 2937 yyerror("pool type cannot be redefined"); 2938 YYERROR; 2939 } 2940 pool_opts.type = PF_POOL_RANDOM; 2941 } 2942 | SOURCEHASH hashkey { 2943 if (pool_opts.type) { 2944 yyerror("pool type cannot be redefined"); 2945 YYERROR; 2946 } 2947 pool_opts.type = PF_POOL_SRCHASH; 2948 pool_opts.key = $2; 2949 } 2950 | ROUNDROBIN { 2951 if (pool_opts.type) { 2952 yyerror("pool type cannot be redefined"); 2953 YYERROR; 2954 } 2955 pool_opts.type = PF_POOL_ROUNDROBIN; 2956 } 2957 | STATICPORT { 2958 if (pool_opts.staticport) { 2959 yyerror("static-port cannot be redefined"); 2960 YYERROR; 2961 } 2962 pool_opts.staticport = 1; 2963 } 2964 | STICKYADDRESS { 2965 if (filter_opts.marker & POM_STICKYADDRESS) { 2966 yyerror("sticky-address cannot be redefined"); 2967 YYERROR; 2968 } 2969 pool_opts.marker |= POM_STICKYADDRESS; 2970 pool_opts.opts |= PF_POOL_STICKYADDR; 2971 } 2972 ; 2973 2974 redirection : /* empty */ { $$ = NULL; } 2975 | ARROW host { 2976 $$ = calloc(1, sizeof(struct redirection)); 2977 if ($$ == NULL) 2978 err(1, "redirection: calloc"); 2979 $$->host = $2; 2980 $$->rport.a = $$->rport.b = $$->rport.t = 0; 2981 } 2982 | ARROW host PORT rport { 2983 $$ = calloc(1, sizeof(struct redirection)); 2984 if ($$ == NULL) 2985 err(1, "redirection: calloc"); 2986 $$->host = $2; 2987 $$->rport = $4; 2988 } 2989 ; 2990 2991 natpass : /* empty */ { $$ = 0; } 2992 | PASS { $$ = 1; } 2993 ; 2994 2995 nataction : no NAT natpass { 2996 $$.b2 = $$.w = 0; 2997 if ($1) 2998 $$.b1 = PF_NONAT; 2999 else 3000 $$.b1 = PF_NAT; 3001 $$.b2 = $3; 3002 } 3003 | no RDR natpass { 3004 $$.b2 = $$.w = 0; 3005 if ($1) 3006 $$.b1 = PF_NORDR; 3007 else 3008 $$.b1 = PF_RDR; 3009 $$.b2 = $3; 3010 } 3011 ; 3012 3013 natrule : nataction interface af proto fromto tag redirpool pool_opts 3014 { 3015 struct pf_rule r; 3016 3017 if (check_rulestate(PFCTL_STATE_NAT)) 3018 YYERROR; 3019 3020 memset(&r, 0, sizeof(r)); 3021 3022 r.action = $1.b1; 3023 r.natpass = $1.b2; 3024 r.af = $3; 3025 3026 if (!r.af) { 3027 if ($5.src.host && $5.src.host->af && 3028 !$5.src.host->ifindex) 3029 r.af = $5.src.host->af; 3030 else if ($5.dst.host && $5.dst.host->af && 3031 !$5.dst.host->ifindex) 3032 r.af = $5.dst.host->af; 3033 } 3034 3035 if ($6 != NULL) 3036 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >= 3037 PF_TAG_NAME_SIZE) { 3038 yyerror("tag too long, max %u chars", 3039 PF_TAG_NAME_SIZE - 1); 3040 YYERROR; 3041 } 3042 3043 if (r.action == PF_NONAT || r.action == PF_NORDR) { 3044 if ($7 != NULL) { 3045 yyerror("translation rule with 'no' " 3046 "does not need '->'"); 3047 YYERROR; 3048 } 3049 } else { 3050 if ($7 == NULL || $7->host == NULL) { 3051 yyerror("translation rule requires '-> " 3052 "address'"); 3053 YYERROR; 3054 } 3055 if (!r.af && ! $7->host->ifindex) 3056 r.af = $7->host->af; 3057 3058 remove_invalid_hosts(&$7->host, &r.af); 3059 if (invalid_redirect($7->host, r.af)) 3060 YYERROR; 3061 if (check_netmask($7->host, r.af)) 3062 YYERROR; 3063 3064 r.rpool.proxy_port[0] = ntohs($7->rport.a); 3065 3066 switch (r.action) { 3067 case PF_RDR: 3068 if (!$7->rport.b && $7->rport.t && 3069 $5.dst.port != NULL) { 3070 r.rpool.proxy_port[1] = 3071 ntohs($7->rport.a) + 3072 (ntohs( 3073 $5.dst.port->port[1]) - 3074 ntohs( 3075 $5.dst.port->port[0])); 3076 } else 3077 r.rpool.proxy_port[1] = 3078 ntohs($7->rport.b); 3079 break; 3080 case PF_NAT: 3081 r.rpool.proxy_port[1] = 3082 ntohs($7->rport.b); 3083 if (!r.rpool.proxy_port[0] && 3084 !r.rpool.proxy_port[1]) { 3085 r.rpool.proxy_port[0] = 3086 PF_NAT_PROXY_PORT_LOW; 3087 r.rpool.proxy_port[1] = 3088 PF_NAT_PROXY_PORT_HIGH; 3089 } else if (!r.rpool.proxy_port[1]) 3090 r.rpool.proxy_port[1] = 3091 r.rpool.proxy_port[0]; 3092 break; 3093 default: 3094 break; 3095 } 3096 3097 r.rpool.opts = $8.type; 3098 if ((r.rpool.opts & PF_POOL_TYPEMASK) == 3099 PF_POOL_NONE && ($7->host->next != NULL || 3100 $7->host->addr.type == PF_ADDR_TABLE || 3101 DYNIF_MULTIADDR($7->host->addr))) 3102 r.rpool.opts = PF_POOL_ROUNDROBIN; 3103 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3104 PF_POOL_ROUNDROBIN && 3105 disallow_table($7->host, "tables are only " 3106 "supported in round-robin redirection " 3107 "pools")) 3108 YYERROR; 3109 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3110 PF_POOL_ROUNDROBIN && 3111 disallow_alias($7->host, "interface (%s) " 3112 "is only supported in round-robin " 3113 "redirection pools")) 3114 YYERROR; 3115 if ($7->host->next != NULL) { 3116 if ((r.rpool.opts & PF_POOL_TYPEMASK) != 3117 PF_POOL_ROUNDROBIN) { 3118 yyerror("only round-robin " 3119 "valid for multiple " 3120 "redirection addresses"); 3121 YYERROR; 3122 } 3123 } 3124 } 3125 3126 if ($8.key != NULL) 3127 memcpy(&r.rpool.key, $8.key, 3128 sizeof(struct pf_poolhashkey)); 3129 3130 if ($8.opts) 3131 r.rpool.opts |= $8.opts; 3132 3133 if ($8.staticport) { 3134 if (r.action != PF_NAT) { 3135 yyerror("the 'static-port' option is " 3136 "only valid with nat rules"); 3137 YYERROR; 3138 } 3139 if (r.rpool.proxy_port[0] != 3140 PF_NAT_PROXY_PORT_LOW && 3141 r.rpool.proxy_port[1] != 3142 PF_NAT_PROXY_PORT_HIGH) { 3143 yyerror("the 'static-port' option can't" 3144 " be used when specifying a port" 3145 " range"); 3146 YYERROR; 3147 } 3148 r.rpool.proxy_port[0] = 0; 3149 r.rpool.proxy_port[1] = 0; 3150 } 3151 3152 expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4, 3153 $5.src_os, $5.src.host, $5.src.port, $5.dst.host, 3154 $5.dst.port, 0, 0, 0); 3155 free($7); 3156 } 3157 ; 3158 3159 binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag 3160 redirection 3161 { 3162 struct pf_rule binat; 3163 struct pf_pooladdr *pa; 3164 3165 if (check_rulestate(PFCTL_STATE_NAT)) 3166 YYERROR; 3167 3168 memset(&binat, 0, sizeof(binat)); 3169 3170 if ($1) 3171 binat.action = PF_NOBINAT; 3172 else 3173 binat.action = PF_BINAT; 3174 binat.natpass = $3; 3175 binat.af = $5; 3176 if (!binat.af && $8 != NULL && $8->af) 3177 binat.af = $8->af; 3178 if (!binat.af && $10 != NULL && $10->af) 3179 binat.af = $10->af; 3180 if (!binat.af && $12 != NULL && $12->host) 3181 binat.af = $12->host->af; 3182 if (!binat.af) { 3183 yyerror("address family (inet/inet6) " 3184 "undefined"); 3185 YYERROR; 3186 } 3187 3188 if ($4 != NULL) { 3189 memcpy(binat.ifname, $4->ifname, 3190 sizeof(binat.ifname)); 3191 binat.ifnot = $4->not; 3192 free($4); 3193 } 3194 if ($11 != NULL) 3195 if (strlcpy(binat.tagname, $11, 3196 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) { 3197 yyerror("tag too long, max %u chars", 3198 PF_TAG_NAME_SIZE - 1); 3199 YYERROR; 3200 } 3201 3202 if ($6 != NULL) { 3203 binat.proto = $6->proto; 3204 free($6); 3205 } 3206 3207 if ($8 != NULL && disallow_table($8, "invalid use of " 3208 "table <%s> as the source address of a binat rule")) 3209 YYERROR; 3210 if ($8 != NULL && disallow_alias($8, "invalid use of " 3211 "interface (%s) as the source address of a binat " 3212 "rule")) 3213 YYERROR; 3214 if ($12 != NULL && $12->host != NULL && disallow_table( 3215 $12->host, "invalid use of table <%s> as the " 3216 "redirect address of a binat rule")) 3217 YYERROR; 3218 if ($12 != NULL && $12->host != NULL && disallow_alias( 3219 $12->host, "invalid use of interface (%s) as the " 3220 "redirect address of a binat rule")) 3221 YYERROR; 3222 3223 if ($8 != NULL) { 3224 if ($8->next) { 3225 yyerror("multiple binat ip addresses"); 3226 YYERROR; 3227 } 3228 if ($8->addr.type == PF_ADDR_DYNIFTL) 3229 $8->af = binat.af; 3230 if ($8->af != binat.af) { 3231 yyerror("binat ip versions must match"); 3232 YYERROR; 3233 } 3234 if (check_netmask($8, binat.af)) 3235 YYERROR; 3236 memcpy(&binat.src.addr, &$8->addr, 3237 sizeof(binat.src.addr)); 3238 free($8); 3239 } 3240 if ($10 != NULL) { 3241 if ($10->next) { 3242 yyerror("multiple binat ip addresses"); 3243 YYERROR; 3244 } 3245 if ($10->af != binat.af && $10->af) { 3246 yyerror("binat ip versions must match"); 3247 YYERROR; 3248 } 3249 if (check_netmask($10, binat.af)) 3250 YYERROR; 3251 memcpy(&binat.dst.addr, &$10->addr, 3252 sizeof(binat.dst.addr)); 3253 binat.dst.not = $10->not; 3254 free($10); 3255 } 3256 3257 if (binat.action == PF_NOBINAT) { 3258 if ($12 != NULL) { 3259 yyerror("'no binat' rule does not need" 3260 " '->'"); 3261 YYERROR; 3262 } 3263 } else { 3264 if ($12 == NULL || $12->host == NULL) { 3265 yyerror("'binat' rule requires" 3266 " '-> address'"); 3267 YYERROR; 3268 } 3269 3270 remove_invalid_hosts(&$12->host, &binat.af); 3271 if (invalid_redirect($12->host, binat.af)) 3272 YYERROR; 3273 if ($12->host->next != NULL) { 3274 yyerror("binat rule must redirect to " 3275 "a single address"); 3276 YYERROR; 3277 } 3278 if (check_netmask($12->host, binat.af)) 3279 YYERROR; 3280 3281 if (!PF_AZERO(&binat.src.addr.v.a.mask, 3282 binat.af) && 3283 !PF_AEQ(&binat.src.addr.v.a.mask, 3284 &$12->host->addr.v.a.mask, binat.af)) { 3285 yyerror("'binat' source mask and " 3286 "redirect mask must be the same"); 3287 YYERROR; 3288 } 3289 3290 TAILQ_INIT(&binat.rpool.list); 3291 pa = calloc(1, sizeof(struct pf_pooladdr)); 3292 if (pa == NULL) 3293 err(1, "binat: calloc"); 3294 pa->addr = $12->host->addr; 3295 pa->ifname[0] = 0; 3296 TAILQ_INSERT_TAIL(&binat.rpool.list, 3297 pa, entries); 3298 3299 free($12); 3300 } 3301 3302 pfctl_add_rule(pf, &binat); 3303 } 3304 ; 3305 3306 tag : /* empty */ { $$ = NULL; } 3307 | TAG STRING { $$ = $2; } 3308 ; 3309 3310 route_host : STRING { 3311 $$ = calloc(1, sizeof(struct node_host)); 3312 if ($$ == NULL) 3313 err(1, "route_host: calloc"); 3314 $$->ifname = $1; 3315 if (ifa_exists($$->ifname, 0) == NULL) { 3316 yyerror("routeto: unknown interface %s", 3317 $$->ifname); 3318 free($1); 3319 free($$); 3320 YYERROR; 3321 } 3322 set_ipmask($$, 128); 3323 $$->next = NULL; 3324 $$->tail = $$; 3325 } 3326 | '(' STRING host ')' { 3327 $$ = $3; 3328 $$->ifname = $2; 3329 if (ifa_exists($$->ifname, 0) == NULL) { 3330 yyerror("routeto: unknown interface %s", 3331 $$->ifname); 3332 YYERROR; 3333 } 3334 } 3335 ; 3336 3337 route_host_list : route_host { $$ = $1; } 3338 | route_host_list comma route_host { 3339 if ($1->af == 0) 3340 $1->af = $3->af; 3341 if ($1->af != $3->af) { 3342 yyerror("all pool addresses must be in the " 3343 "same address family"); 3344 YYERROR; 3345 } 3346 $1->tail->next = $3; 3347 $1->tail = $3->tail; 3348 $$ = $1; 3349 } 3350 ; 3351 3352 routespec : route_host { $$ = $1; } 3353 | '{' route_host_list '}' { $$ = $2; } 3354 ; 3355 3356 route : /* empty */ { 3357 $$.host = NULL; 3358 $$.rt = 0; 3359 $$.pool_opts = 0; 3360 } 3361 | FASTROUTE { 3362 $$.host = NULL; 3363 $$.rt = PF_FASTROUTE; 3364 $$.pool_opts = 0; 3365 } 3366 | ROUTETO routespec pool_opts { 3367 $$.host = $2; 3368 $$.rt = PF_ROUTETO; 3369 $$.pool_opts = $3.type | $3.opts; 3370 if ($3.key != NULL) 3371 $$.key = $3.key; 3372 } 3373 | REPLYTO routespec pool_opts { 3374 $$.host = $2; 3375 $$.rt = PF_REPLYTO; 3376 $$.pool_opts = $3.type | $3.opts; 3377 if ($3.key != NULL) 3378 $$.key = $3.key; 3379 } 3380 | DUPTO routespec pool_opts { 3381 $$.host = $2; 3382 $$.rt = PF_DUPTO; 3383 $$.pool_opts = $3.type | $3.opts; 3384 if ($3.key != NULL) 3385 $$.key = $3.key; 3386 } 3387 ; 3388 3389 timeout_spec : STRING number 3390 { 3391 if (check_rulestate(PFCTL_STATE_OPTION)) { 3392 free($1); 3393 YYERROR; 3394 } 3395 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) { 3396 yyerror("unknown timeout %s", $1); 3397 free($1); 3398 YYERROR; 3399 } 3400 free($1); 3401 } 3402 ; 3403 3404 timeout_list : timeout_list comma timeout_spec 3405 | timeout_spec 3406 ; 3407 3408 limit_spec : STRING number 3409 { 3410 if (check_rulestate(PFCTL_STATE_OPTION)) { 3411 free($1); 3412 YYERROR; 3413 } 3414 if (pfctl_set_limit(pf, $1, $2) != 0) { 3415 yyerror("unable to set limit %s %u", $1, $2); 3416 free($1); 3417 YYERROR; 3418 } 3419 free($1); 3420 } 3421 ; 3422 3423 limit_list : limit_list comma limit_spec 3424 | limit_spec 3425 ; 3426 3427 comma : ',' 3428 | /* empty */ 3429 ; 3430 3431 yesno : NO { $$ = 0; } 3432 | STRING { 3433 if (!strcmp($1, "yes")) 3434 $$ = 1; 3435 else { 3436 free($1); 3437 YYERROR; 3438 } 3439 free($1); 3440 } 3441 ; 3442 3443 unaryop : '=' { $$ = PF_OP_EQ; } 3444 | '!' '=' { $$ = PF_OP_NE; } 3445 | '<' '=' { $$ = PF_OP_LE; } 3446 | '<' { $$ = PF_OP_LT; } 3447 | '>' '=' { $$ = PF_OP_GE; } 3448 | '>' { $$ = PF_OP_GT; } 3449 ; 3450 3451 %% 3452 3453 int 3454 yyerror(const char *fmt, ...) 3455 { 3456 va_list ap; 3457 3458 errors = 1; 3459 va_start(ap, fmt); 3460 fprintf(stderr, "%s:%d: ", infile, yylval.lineno); 3461 vfprintf(stderr, fmt, ap); 3462 fprintf(stderr, "\n"); 3463 va_end(ap); 3464 return (0); 3465 } 3466 3467 int 3468 disallow_table(struct node_host *h, const char *fmt) 3469 { 3470 for (; h != NULL; h = h->next) 3471 if (h->addr.type == PF_ADDR_TABLE) { 3472 yyerror(fmt, h->addr.v.tblname); 3473 return (1); 3474 } 3475 return (0); 3476 } 3477 3478 int 3479 disallow_alias(struct node_host *h, const char *fmt) 3480 { 3481 for (; h != NULL; h = h->next) 3482 if (DYNIF_MULTIADDR(h->addr)) { 3483 yyerror(fmt, h->addr.v.tblname); 3484 return (1); 3485 } 3486 return (0); 3487 } 3488 3489 int 3490 rule_consistent(struct pf_rule *r) 3491 { 3492 int problems = 0; 3493 3494 switch (r->action) { 3495 case PF_PASS: 3496 case PF_DROP: 3497 case PF_SCRUB: 3498 problems = filter_consistent(r); 3499 break; 3500 case PF_NAT: 3501 case PF_NONAT: 3502 problems = nat_consistent(r); 3503 break; 3504 case PF_RDR: 3505 case PF_NORDR: 3506 problems = rdr_consistent(r); 3507 break; 3508 case PF_BINAT: 3509 case PF_NOBINAT: 3510 default: 3511 break; 3512 } 3513 return (problems); 3514 } 3515 3516 int 3517 filter_consistent(struct pf_rule *r) 3518 { 3519 int problems = 0; 3520 3521 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP && 3522 (r->src.port_op || r->dst.port_op)) { 3523 yyerror("port only applies to tcp/udp"); 3524 problems++; 3525 } 3526 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 && 3527 (r->type || r->code)) { 3528 yyerror("icmp-type/code only applies to icmp"); 3529 problems++; 3530 } 3531 if (!r->af && (r->type || r->code)) { 3532 yyerror("must indicate address family with icmp-type/code"); 3533 problems++; 3534 } 3535 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) || 3536 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) { 3537 yyerror("proto %s doesn't match address family %s", 3538 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6", 3539 r->af == AF_INET ? "inet" : "inet6"); 3540 problems++; 3541 } 3542 if (r->allow_opts && r->action != PF_PASS) { 3543 yyerror("allow-opts can only be specified for pass rules"); 3544 problems++; 3545 } 3546 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op || 3547 r->dst.port_op || r->flagset || r->type || r->code)) { 3548 yyerror("fragments can be filtered only on IP header fields"); 3549 problems++; 3550 } 3551 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) { 3552 yyerror("return-rst can only be applied to TCP rules"); 3553 problems++; 3554 } 3555 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) { 3556 yyerror("max-src-nodes requires 'source-track rule'"); 3557 problems++; 3558 } 3559 if (r->action == PF_DROP && r->keep_state) { 3560 yyerror("keep state on block rules doesn't make sense"); 3561 problems++; 3562 } 3563 if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state && 3564 r->action == PF_PASS && !r->anchorname[0]) { 3565 yyerror("tags cannot be used without keep state"); 3566 problems++; 3567 } 3568 return (-problems); 3569 } 3570 3571 int 3572 nat_consistent(struct pf_rule *r __unused) 3573 { 3574 return (0); /* yeah! */ 3575 } 3576 3577 int 3578 rdr_consistent(struct pf_rule *r) 3579 { 3580 int problems = 0; 3581 3582 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) { 3583 if (r->src.port_op) { 3584 yyerror("src port only applies to tcp/udp"); 3585 problems++; 3586 } 3587 if (r->dst.port_op) { 3588 yyerror("dst port only applies to tcp/udp"); 3589 problems++; 3590 } 3591 if (r->rpool.proxy_port[0]) { 3592 yyerror("rpool port only applies to tcp/udp"); 3593 problems++; 3594 } 3595 } 3596 if (r->dst.port_op && 3597 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) { 3598 yyerror("invalid port operator for rdr destination port"); 3599 problems++; 3600 } 3601 return (-problems); 3602 } 3603 3604 int 3605 process_tabledef(char *name, struct table_opts *opts) 3606 { 3607 struct pfr_buffer ab; 3608 struct node_tinit *ti; 3609 3610 bzero(&ab, sizeof(ab)); 3611 ab.pfrb_type = PFRB_ADDRS; 3612 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) { 3613 if (ti->file) 3614 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) { 3615 if (errno) 3616 yyerror("cannot load \"%s\": %s", 3617 ti->file, strerror(errno)); 3618 else 3619 yyerror("file \"%s\" contains bad data", 3620 ti->file); 3621 goto _error; 3622 } 3623 if (ti->host) 3624 if (append_addr_host(&ab, ti->host, 0, 0)) { 3625 yyerror("cannot create address buffer: %s", 3626 strerror(errno)); 3627 goto _error; 3628 } 3629 } 3630 if (pf->opts & PF_OPT_VERBOSE) 3631 print_tabledef(name, opts->flags, opts->init_addr, 3632 &opts->init_nodes); 3633 if (!(pf->opts & PF_OPT_NOACTION) && 3634 pfctl_define_table(name, opts->flags, opts->init_addr, 3635 pf->anchor, pf->ruleset, &ab, pf->tticket)) { 3636 yyerror("cannot define table %s: %s", name, 3637 pfr_strerror(errno)); 3638 goto _error; 3639 } 3640 pf->tdirty = 1; 3641 pfr_buf_clear(&ab); 3642 return (0); 3643 _error: 3644 pfr_buf_clear(&ab); 3645 return (-1); 3646 } 3647 3648 struct keywords { 3649 const char *k_name; 3650 int k_val; 3651 }; 3652 3653 /* macro gore, but you should've seen the prior indentation nightmare... */ 3654 3655 #define FREE_LIST(T,r) \ 3656 do { \ 3657 T *p, *node = r; \ 3658 while (node != NULL) { \ 3659 p = node; \ 3660 node = node->next; \ 3661 free(p); \ 3662 } \ 3663 } while (0) 3664 3665 #define LOOP_THROUGH(T,n,r,C) \ 3666 do { \ 3667 T *n; \ 3668 if (r == NULL) { \ 3669 r = calloc(1, sizeof(T)); \ 3670 if (r == NULL) \ 3671 err(1, "LOOP: calloc"); \ 3672 r->next = NULL; \ 3673 } \ 3674 n = r; \ 3675 while (n != NULL) { \ 3676 do { \ 3677 C; \ 3678 } while (0); \ 3679 n = n->next; \ 3680 } \ 3681 } while (0) 3682 3683 void 3684 expand_label_str(char *label, size_t len, const char *srch, const char *repl) 3685 { 3686 char *tmp; 3687 char *p, *q; 3688 3689 if ((tmp = calloc(1, len)) == NULL) 3690 err(1, "expand_label_str: calloc"); 3691 p = q = label; 3692 while ((q = strstr(p, srch)) != NULL) { 3693 *q = '\0'; 3694 if ((strlcat(tmp, p, len) >= len) || 3695 (strlcat(tmp, repl, len) >= len)) 3696 errx(1, "expand_label: label too long"); 3697 q += strlen(srch); 3698 p = q; 3699 } 3700 if (strlcat(tmp, p, len) >= len) 3701 errx(1, "expand_label: label too long"); 3702 strlcpy(label, tmp, len); /* always fits */ 3703 free(tmp); 3704 } 3705 3706 void 3707 expand_label_if(const char *name, char *label, size_t len, const char *ifname) 3708 { 3709 if (strstr(label, name) != NULL) { 3710 if (!*ifname) 3711 expand_label_str(label, len, name, "any"); 3712 else 3713 expand_label_str(label, len, name, ifname); 3714 } 3715 } 3716 3717 void 3718 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, 3719 struct node_host *h) 3720 { 3721 char tmp[64], tmp_not[66]; 3722 3723 if (strstr(label, name) != NULL) { 3724 switch (h->addr.type) { 3725 case PF_ADDR_DYNIFTL: 3726 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); 3727 break; 3728 case PF_ADDR_TABLE: 3729 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); 3730 break; 3731 case PF_ADDR_NOROUTE: 3732 snprintf(tmp, sizeof(tmp), "no-route"); 3733 break; 3734 case PF_ADDR_ADDRMASK: 3735 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) && 3736 PF_AZERO(&h->addr.v.a.mask, af))) 3737 snprintf(tmp, sizeof(tmp), "any"); 3738 else { 3739 char a[48]; 3740 int bits; 3741 3742 if (inet_ntop(af, &h->addr.v.a.addr, a, 3743 sizeof(a)) == NULL) 3744 snprintf(tmp, sizeof(tmp), "?"); 3745 else { 3746 bits = unmask(&h->addr.v.a.mask, af); 3747 if ((af == AF_INET && bits < 32) || 3748 (af == AF_INET6 && bits < 128)) 3749 snprintf(tmp, sizeof(tmp), 3750 "%s/%d", a, bits); 3751 else 3752 snprintf(tmp, sizeof(tmp), 3753 "%s", a); 3754 } 3755 } 3756 break; 3757 default: 3758 snprintf(tmp, sizeof(tmp), "?"); 3759 break; 3760 } 3761 3762 if (h->not) { 3763 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); 3764 expand_label_str(label, len, name, tmp_not); 3765 } else 3766 expand_label_str(label, len, name, tmp); 3767 } 3768 } 3769 3770 void 3771 expand_label_port(const char *name, char *label, size_t len, 3772 struct node_port *port) 3773 { 3774 char a1[6], a2[6], op[13] = ""; 3775 3776 if (strstr(label, name) != NULL) { 3777 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])); 3778 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])); 3779 if (!port->op) 3780 ; 3781 else if (port->op == PF_OP_IRG) 3782 snprintf(op, sizeof(op), "%s><%s", a1, a2); 3783 else if (port->op == PF_OP_XRG) 3784 snprintf(op, sizeof(op), "%s<>%s", a1, a2); 3785 else if (port->op == PF_OP_EQ) 3786 snprintf(op, sizeof(op), "%s", a1); 3787 else if (port->op == PF_OP_NE) 3788 snprintf(op, sizeof(op), "!=%s", a1); 3789 else if (port->op == PF_OP_LT) 3790 snprintf(op, sizeof(op), "<%s", a1); 3791 else if (port->op == PF_OP_LE) 3792 snprintf(op, sizeof(op), "<=%s", a1); 3793 else if (port->op == PF_OP_GT) 3794 snprintf(op, sizeof(op), ">%s", a1); 3795 else if (port->op == PF_OP_GE) 3796 snprintf(op, sizeof(op), ">=%s", a1); 3797 expand_label_str(label, len, name, op); 3798 } 3799 } 3800 3801 void 3802 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) 3803 { 3804 struct protoent *pe; 3805 char n[4]; 3806 3807 if (strstr(label, name) != NULL) { 3808 pe = getprotobynumber(proto); 3809 if (pe != NULL) 3810 expand_label_str(label, len, name, pe->p_name); 3811 else { 3812 snprintf(n, sizeof(n), "%u", proto); 3813 expand_label_str(label, len, name, n); 3814 } 3815 } 3816 } 3817 3818 void 3819 expand_label_nr(const char *name, char *label, size_t len) 3820 { 3821 char n[11]; 3822 3823 if (strstr(label, name) != NULL) { 3824 snprintf(n, sizeof(n), "%u", pf->rule_nr); 3825 expand_label_str(label, len, name, n); 3826 } 3827 } 3828 3829 void 3830 expand_label(char *label, size_t len, const char *ifname, sa_family_t af, 3831 struct node_host *src_host, struct node_port *src_port, 3832 struct node_host *dst_host, struct node_port *dst_port, 3833 u_int8_t proto) 3834 { 3835 expand_label_if("$if", label, len, ifname); 3836 expand_label_addr("$srcaddr", label, len, af, src_host); 3837 expand_label_addr("$dstaddr", label, len, af, dst_host); 3838 expand_label_port("$srcport", label, len, src_port); 3839 expand_label_port("$dstport", label, len, dst_port); 3840 expand_label_proto("$proto", label, len, proto); 3841 expand_label_nr("$nr", label, len); 3842 } 3843 3844 int 3845 expand_altq(struct pf_altq *a, struct node_if *interfaces, 3846 struct node_queue *nqueues, struct node_queue_bw bwspec, 3847 struct node_queue_opt *opts) 3848 { 3849 struct pf_altq pa, pb; 3850 char qname[PF_QNAME_SIZE]; 3851 struct node_queue *n; 3852 struct node_queue_bw bw; 3853 int errs = 0; 3854 3855 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3856 FREE_LIST(struct node_if, interfaces); 3857 FREE_LIST(struct node_queue, nqueues); 3858 return (0); 3859 } 3860 3861 LOOP_THROUGH(struct node_if, interface, interfaces, 3862 memcpy(&pa, a, sizeof(struct pf_altq)); 3863 if (strlcpy(pa.ifname, interface->ifname, 3864 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 3865 errx(1, "expand_altq: strlcpy"); 3866 3867 if (interface->not) { 3868 yyerror("altq on ! <interface> is not supported"); 3869 errs++; 3870 } else { 3871 if (eval_pfaltq(pf, &pa, &bwspec, opts)) 3872 errs++; 3873 else 3874 if (pfctl_add_altq(pf, &pa)) 3875 errs++; 3876 3877 if (pf->opts & PF_OPT_VERBOSE) { 3878 print_altq(&pf->paltq->altq, 0, 3879 &bwspec, opts); 3880 if (nqueues && nqueues->tail) { 3881 printf("queue { "); 3882 LOOP_THROUGH(struct node_queue, queue, 3883 nqueues, 3884 printf("%s ", 3885 queue->queue); 3886 ); 3887 printf("}"); 3888 } 3889 printf("\n"); 3890 } 3891 3892 if (pa.scheduler == ALTQT_CBQ || 3893 pa.scheduler == ALTQT_HFSC) { 3894 /* now create a root queue */ 3895 memset(&pb, 0, sizeof(struct pf_altq)); 3896 if (strlcpy(qname, "root_", sizeof(qname)) >= 3897 sizeof(qname)) 3898 errx(1, "expand_altq: strlcpy"); 3899 if (strlcat(qname, interface->ifname, 3900 sizeof(qname)) >= sizeof(qname)) 3901 errx(1, "expand_altq: strlcat"); 3902 if (strlcpy(pb.qname, qname, 3903 sizeof(pb.qname)) >= sizeof(pb.qname)) 3904 errx(1, "expand_altq: strlcpy"); 3905 if (strlcpy(pb.ifname, interface->ifname, 3906 sizeof(pb.ifname)) >= sizeof(pb.ifname)) 3907 errx(1, "expand_altq: strlcpy"); 3908 pb.qlimit = pa.qlimit; 3909 pb.scheduler = pa.scheduler; 3910 bw.bw_absolute = pa.ifbandwidth; 3911 bw.bw_percent = 0; 3912 if (eval_pfqueue(pf, &pb, &bw, opts)) 3913 errs++; 3914 else 3915 if (pfctl_add_altq(pf, &pb)) 3916 errs++; 3917 } 3918 3919 LOOP_THROUGH(struct node_queue, queue, nqueues, 3920 n = calloc(1, sizeof(struct node_queue)); 3921 if (n == NULL) 3922 err(1, "expand_altq: calloc"); 3923 if (pa.scheduler == ALTQT_CBQ || 3924 pa.scheduler == ALTQT_HFSC) 3925 if (strlcpy(n->parent, qname, 3926 sizeof(n->parent)) >= 3927 sizeof(n->parent)) 3928 errx(1, "expand_altq: strlcpy"); 3929 if (strlcpy(n->queue, queue->queue, 3930 sizeof(n->queue)) >= sizeof(n->queue)) 3931 errx(1, "expand_altq: strlcpy"); 3932 if (strlcpy(n->ifname, interface->ifname, 3933 sizeof(n->ifname)) >= sizeof(n->ifname)) 3934 errx(1, "expand_altq: strlcpy"); 3935 n->scheduler = pa.scheduler; 3936 n->next = NULL; 3937 n->tail = n; 3938 if (queues == NULL) 3939 queues = n; 3940 else { 3941 queues->tail->next = n; 3942 queues->tail = n; 3943 } 3944 ); 3945 } 3946 ); 3947 FREE_LIST(struct node_if, interfaces); 3948 FREE_LIST(struct node_queue, nqueues); 3949 3950 return (errs); 3951 } 3952 3953 int 3954 expand_queue(struct pf_altq *a, struct node_if *interfaces, 3955 struct node_queue *nqueues, struct node_queue_bw bwspec, 3956 struct node_queue_opt *opts) 3957 { 3958 struct node_queue *n, *nq; 3959 struct pf_altq pa; 3960 u_int8_t found = 0; 3961 u_int8_t errs = 0; 3962 3963 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) { 3964 FREE_LIST(struct node_queue, nqueues); 3965 return (0); 3966 } 3967 3968 if (queues == NULL) { 3969 yyerror("queue %s has no parent", a->qname); 3970 FREE_LIST(struct node_queue, nqueues); 3971 return (1); 3972 } 3973 3974 LOOP_THROUGH(struct node_if, interface, interfaces, 3975 LOOP_THROUGH(struct node_queue, tqueue, queues, 3976 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) && 3977 (interface->ifname[0] == 0 || 3978 (!interface->not && !strncmp(interface->ifname, 3979 tqueue->ifname, IFNAMSIZ)) || 3980 (interface->not && strncmp(interface->ifname, 3981 tqueue->ifname, IFNAMSIZ)))) { 3982 /* found ourself in queues */ 3983 found++; 3984 3985 memcpy(&pa, a, sizeof(struct pf_altq)); 3986 3987 if (pa.scheduler != ALTQT_NONE && 3988 pa.scheduler != tqueue->scheduler) { 3989 yyerror("exactly one scheduler type " 3990 "per interface allowed"); 3991 return (1); 3992 } 3993 pa.scheduler = tqueue->scheduler; 3994 3995 /* scheduler dependent error checking */ 3996 switch (pa.scheduler) { 3997 case ALTQT_PRIQ: 3998 if (nqueues != NULL) { 3999 yyerror("priq queues cannot " 4000 "have child queues"); 4001 return (1); 4002 } 4003 if (bwspec.bw_absolute > 0 || 4004 bwspec.bw_percent < 100) { 4005 yyerror("priq doesn't take " 4006 "bandwidth"); 4007 return (1); 4008 } 4009 break; 4010 default: 4011 break; 4012 } 4013 4014 if (strlcpy(pa.ifname, tqueue->ifname, 4015 sizeof(pa.ifname)) >= sizeof(pa.ifname)) 4016 errx(1, "expand_queue: strlcpy"); 4017 if (strlcpy(pa.parent, tqueue->parent, 4018 sizeof(pa.parent)) >= sizeof(pa.parent)) 4019 errx(1, "expand_queue: strlcpy"); 4020 4021 if (eval_pfqueue(pf, &pa, &bwspec, opts)) 4022 errs++; 4023 else 4024 if (pfctl_add_altq(pf, &pa)) 4025 errs++; 4026 4027 for (nq = nqueues; nq != NULL; nq = nq->next) { 4028 if (!strcmp(a->qname, nq->queue)) { 4029 yyerror("queue cannot have " 4030 "itself as child"); 4031 errs++; 4032 continue; 4033 } 4034 n = calloc(1, 4035 sizeof(struct node_queue)); 4036 if (n == NULL) 4037 err(1, "expand_queue: calloc"); 4038 if (strlcpy(n->parent, a->qname, 4039 sizeof(n->parent)) >= 4040 sizeof(n->parent)) 4041 errx(1, "expand_queue strlcpy"); 4042 if (strlcpy(n->queue, nq->queue, 4043 sizeof(n->queue)) >= 4044 sizeof(n->queue)) 4045 errx(1, "expand_queue strlcpy"); 4046 if (strlcpy(n->ifname, tqueue->ifname, 4047 sizeof(n->ifname)) >= 4048 sizeof(n->ifname)) 4049 errx(1, "expand_queue strlcpy"); 4050 n->scheduler = tqueue->scheduler; 4051 n->next = NULL; 4052 n->tail = n; 4053 if (queues == NULL) 4054 queues = n; 4055 else { 4056 queues->tail->next = n; 4057 queues->tail = n; 4058 } 4059 } 4060 if ((pf->opts & PF_OPT_VERBOSE) && ( 4061 (found == 1 && interface->ifname[0] == 0) || 4062 (found > 0 && interface->ifname[0] != 0))) { 4063 print_queue(&pf->paltq->altq, 0, 4064 &bwspec, interface->ifname[0] != 0, 4065 opts); 4066 if (nqueues && nqueues->tail) { 4067 printf("{ "); 4068 LOOP_THROUGH(struct node_queue, 4069 queue, nqueues, 4070 printf("%s ", 4071 queue->queue); 4072 ); 4073 printf("}"); 4074 } 4075 printf("\n"); 4076 } 4077 } 4078 ); 4079 ); 4080 4081 FREE_LIST(struct node_queue, nqueues); 4082 FREE_LIST(struct node_if, interfaces); 4083 4084 if (!found) { 4085 yyerror("queue %s has no parent", a->qname); 4086 errs++; 4087 } 4088 4089 if (errs) 4090 return (1); 4091 else 4092 return (0); 4093 } 4094 4095 void 4096 expand_rule(struct pf_rule *r, 4097 struct node_if *interfaces, struct node_host *rpool_hosts, 4098 struct node_proto *protos, struct node_os *src_oses, 4099 struct node_host *src_hosts, struct node_port *src_ports, 4100 struct node_host *dst_hosts, struct node_port *dst_ports, 4101 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types) 4102 { 4103 sa_family_t af = r->af; 4104 int added = 0, error = 0; 4105 char ifname[IF_NAMESIZE]; 4106 char label[PF_RULE_LABEL_SIZE]; 4107 char tagname[PF_TAG_NAME_SIZE]; 4108 char match_tagname[PF_TAG_NAME_SIZE]; 4109 struct pf_pooladdr *pa; 4110 struct node_host *h; 4111 u_int8_t flags, flagset, keep_state; 4112 4113 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) 4114 errx(1, "expand_rule: strlcpy"); 4115 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) 4116 errx(1, "expand_rule: strlcpy"); 4117 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= 4118 sizeof(match_tagname)) 4119 errx(1, "expand_rule: strlcpy"); 4120 flags = r->flags; 4121 flagset = r->flagset; 4122 keep_state = r->keep_state; 4123 4124 LOOP_THROUGH(struct node_if, interface, interfaces, 4125 LOOP_THROUGH(struct node_proto, proto, protos, 4126 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, 4127 LOOP_THROUGH(struct node_host, src_host, src_hosts, 4128 LOOP_THROUGH(struct node_port, src_port, src_ports, 4129 LOOP_THROUGH(struct node_os, src_os, src_oses, 4130 LOOP_THROUGH(struct node_host, dst_host, dst_hosts, 4131 LOOP_THROUGH(struct node_port, dst_port, dst_ports, 4132 LOOP_THROUGH(struct node_uid, uid, uids, 4133 LOOP_THROUGH(struct node_gid, gid, gids, 4134 4135 r->af = af; 4136 /* for link-local IPv6 address, interface must match up */ 4137 if ((r->af && src_host->af && r->af != src_host->af) || 4138 (r->af && dst_host->af && r->af != dst_host->af) || 4139 (src_host->af && dst_host->af && 4140 src_host->af != dst_host->af) || 4141 (src_host->ifindex && dst_host->ifindex && 4142 src_host->ifindex != dst_host->ifindex) || 4143 (src_host->ifindex && *interface->ifname && 4144 src_host->ifindex != if_nametoindex(interface->ifname)) || 4145 (dst_host->ifindex && *interface->ifname && 4146 dst_host->ifindex != if_nametoindex(interface->ifname))) 4147 continue; 4148 if (!r->af && src_host->af) 4149 r->af = src_host->af; 4150 else if (!r->af && dst_host->af) 4151 r->af = dst_host->af; 4152 4153 if (*interface->ifname) 4154 memcpy(r->ifname, interface->ifname, sizeof(r->ifname)); 4155 else if (if_indextoname(src_host->ifindex, ifname)) 4156 memcpy(r->ifname, ifname, sizeof(r->ifname)); 4157 else if (if_indextoname(dst_host->ifindex, ifname)) 4158 memcpy(r->ifname, ifname, sizeof(r->ifname)); 4159 else 4160 memset(r->ifname, '\0', sizeof(r->ifname)); 4161 4162 if (strlcpy(r->label, label, sizeof(r->label)) >= 4163 sizeof(r->label)) 4164 errx(1, "expand_rule: strlcpy"); 4165 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= 4166 sizeof(r->tagname)) 4167 errx(1, "expand_rule: strlcpy"); 4168 if (strlcpy(r->match_tagname, match_tagname, 4169 sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) 4170 errx(1, "expand_rule: strlcpy"); 4171 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af, 4172 src_host, src_port, dst_host, dst_port, proto->proto); 4173 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af, 4174 src_host, src_port, dst_host, dst_port, proto->proto); 4175 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname, 4176 r->af, src_host, src_port, dst_host, dst_port, 4177 proto->proto); 4178 4179 error += check_netmask(src_host, r->af); 4180 error += check_netmask(dst_host, r->af); 4181 4182 r->ifnot = interface->not; 4183 r->proto = proto->proto; 4184 r->src.addr = src_host->addr; 4185 r->src.not = src_host->not; 4186 r->src.port[0] = src_port->port[0]; 4187 r->src.port[1] = src_port->port[1]; 4188 r->src.port_op = src_port->op; 4189 r->dst.addr = dst_host->addr; 4190 r->dst.not = dst_host->not; 4191 r->dst.port[0] = dst_port->port[0]; 4192 r->dst.port[1] = dst_port->port[1]; 4193 r->dst.port_op = dst_port->op; 4194 r->uid.op = uid->op; 4195 r->uid.uid[0] = uid->uid[0]; 4196 r->uid.uid[1] = uid->uid[1]; 4197 r->gid.op = gid->op; 4198 r->gid.gid[0] = gid->gid[0]; 4199 r->gid.gid[1] = gid->gid[1]; 4200 r->type = icmp_type->type; 4201 r->code = icmp_type->code; 4202 4203 if ((keep_state == PF_STATE_MODULATE || 4204 keep_state == PF_STATE_SYNPROXY) && 4205 r->proto && r->proto != IPPROTO_TCP) 4206 r->keep_state = PF_STATE_NORMAL; 4207 else 4208 r->keep_state = keep_state; 4209 4210 if (r->proto && r->proto != IPPROTO_TCP) { 4211 r->flags = 0; 4212 r->flagset = 0; 4213 } else { 4214 r->flags = flags; 4215 r->flagset = flagset; 4216 } 4217 if (icmp_type->proto && r->proto != icmp_type->proto) { 4218 yyerror("icmp-type mismatch"); 4219 error++; 4220 } 4221 4222 if (src_os && src_os->os) { 4223 r->os_fingerprint = pfctl_get_fingerprint(src_os->os); 4224 if ((pf->opts & PF_OPT_VERBOSE2) && 4225 r->os_fingerprint == PF_OSFP_NOMATCH) 4226 fprintf(stderr, 4227 "warning: unknown '%s' OS fingerprint\n", 4228 src_os->os); 4229 } else { 4230 r->os_fingerprint = PF_OSFP_ANY; 4231 } 4232 4233 TAILQ_INIT(&r->rpool.list); 4234 for (h = rpool_hosts; h != NULL; h = h->next) { 4235 pa = calloc(1, sizeof(struct pf_pooladdr)); 4236 if (pa == NULL) 4237 err(1, "expand_rule: calloc"); 4238 pa->addr = h->addr; 4239 if (h->ifname != NULL) { 4240 if (strlcpy(pa->ifname, h->ifname, 4241 sizeof(pa->ifname)) >= 4242 sizeof(pa->ifname)) 4243 errx(1, "expand_rule: strlcpy"); 4244 } else 4245 pa->ifname[0] = 0; 4246 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries); 4247 } 4248 4249 if (rule_consistent(r) < 0 || error) 4250 yyerror("skipping rule due to errors"); 4251 else { 4252 r->nr = pf->rule_nr++; 4253 pfctl_add_rule(pf, r); 4254 added++; 4255 } 4256 4257 )))))))))); 4258 4259 FREE_LIST(struct node_if, interfaces); 4260 FREE_LIST(struct node_proto, protos); 4261 FREE_LIST(struct node_host, src_hosts); 4262 FREE_LIST(struct node_port, src_ports); 4263 FREE_LIST(struct node_os, src_oses); 4264 FREE_LIST(struct node_host, dst_hosts); 4265 FREE_LIST(struct node_port, dst_ports); 4266 FREE_LIST(struct node_uid, uids); 4267 FREE_LIST(struct node_gid, gids); 4268 FREE_LIST(struct node_icmp, icmp_types); 4269 FREE_LIST(struct node_host, rpool_hosts); 4270 4271 if (!added) 4272 yyerror("rule expands to no valid combination"); 4273 } 4274 4275 #undef FREE_LIST 4276 #undef LOOP_THROUGH 4277 4278 int 4279 check_rulestate(int desired_state) 4280 { 4281 if (require_order && (rulestate > desired_state)) { 4282 yyerror("Rules must be in order: options, normalization, " 4283 "queueing, translation, filtering"); 4284 return (1); 4285 } 4286 rulestate = desired_state; 4287 return (0); 4288 } 4289 4290 int 4291 kw_cmp(const void *k, const void *e) 4292 { 4293 return (strcmp(k, ((const struct keywords *)e)->k_name)); 4294 } 4295 4296 int 4297 lookup(char *s) 4298 { 4299 /* this has to be sorted always */ 4300 static const struct keywords keywords[] = { 4301 { "all", ALL}, 4302 { "allow-opts", ALLOWOPTS}, 4303 { "altq", ALTQ}, 4304 { "anchor", ANCHOR}, 4305 { "antispoof", ANTISPOOF}, 4306 { "any", ANY}, 4307 { "bandwidth", BANDWIDTH}, 4308 { "binat", BINAT}, 4309 { "binat-anchor", BINATANCHOR}, 4310 { "bitmask", BITMASK}, 4311 { "block", BLOCK}, 4312 { "block-policy", BLOCKPOLICY}, 4313 { "cbq", CBQ}, 4314 { "code", CODE}, 4315 { "crop", FRAGCROP}, 4316 { "debug", DEBUG}, 4317 { "drop", DROP}, 4318 { "drop-ovl", FRAGDROP}, 4319 { "dup-to", DUPTO}, 4320 { "fastroute", FASTROUTE}, 4321 { "file", FILENAME}, 4322 { "fingerprints", FINGERPRINTS}, 4323 { "flags", FLAGS}, 4324 { "floating", FLOATING}, 4325 { "for", FOR}, 4326 { "fragment", FRAGMENT}, 4327 { "from", FROM}, 4328 { "global", GLOBAL}, 4329 { "group", GROUP}, 4330 { "group-bound", GRBOUND}, 4331 { "hfsc", HFSC}, 4332 { "hostid", HOSTID}, 4333 { "icmp-type", ICMPTYPE}, 4334 { "icmp6-type", ICMP6TYPE}, 4335 { "if-bound", IFBOUND}, 4336 { "in", IN}, 4337 { "inet", INET}, 4338 { "inet6", INET6}, 4339 { "keep", KEEP}, 4340 { "label", LABEL}, 4341 { "limit", LIMIT}, 4342 { "linkshare", LINKSHARE}, 4343 { "load", LOAD}, 4344 { "log", LOG}, 4345 { "log-all", LOGALL}, 4346 { "loginterface", LOGINTERFACE}, 4347 { "max", MAXIMUM}, 4348 { "max-mss", MAXMSS}, 4349 { "max-src-nodes", MAXSRCNODES}, 4350 { "max-src-states", MAXSRCSTATES}, 4351 { "min-ttl", MINTTL}, 4352 { "modulate", MODULATE}, 4353 { "nat", NAT}, 4354 { "nat-anchor", NATANCHOR}, 4355 { "no", NO}, 4356 { "no-df", NODF}, 4357 { "no-route", NOROUTE}, 4358 { "no-sync", NOSYNC}, 4359 { "on", ON}, 4360 { "optimization", OPTIMIZATION}, 4361 { "os", OS}, 4362 { "out", OUT}, 4363 { "pass", PASS}, 4364 { "port", PORT}, 4365 { "priority", PRIORITY}, 4366 { "priq", PRIQ}, 4367 { "proto", PROTO}, 4368 { "qlimit", QLIMIT}, 4369 { "queue", QUEUE}, 4370 { "quick", QUICK}, 4371 { "random", RANDOM}, 4372 { "random-id", RANDOMID}, 4373 { "rdr", RDR}, 4374 { "rdr-anchor", RDRANCHOR}, 4375 { "realtime", REALTIME}, 4376 { "reassemble", REASSEMBLE}, 4377 { "reply-to", REPLYTO}, 4378 { "require-order", REQUIREORDER}, 4379 { "return", RETURN}, 4380 { "return-icmp", RETURNICMP}, 4381 { "return-icmp6", RETURNICMP6}, 4382 { "return-rst", RETURNRST}, 4383 { "round-robin", ROUNDROBIN}, 4384 { "route-to", ROUTETO}, 4385 { "rule", RULE}, 4386 { "scrub", SCRUB}, 4387 { "set", SET}, 4388 { "source-hash", SOURCEHASH}, 4389 { "source-track", SOURCETRACK}, 4390 { "state", STATE}, 4391 { "state-policy", STATEPOLICY}, 4392 { "static-port", STATICPORT}, 4393 { "sticky-address", STICKYADDRESS}, 4394 { "synproxy", SYNPROXY}, 4395 { "table", TABLE}, 4396 { "tag", TAG}, 4397 { "tagged", TAGGED}, 4398 { "tbrsize", TBRSIZE}, 4399 { "timeout", TIMEOUT}, 4400 { "to", TO}, 4401 { "tos", TOS}, 4402 { "ttl", TTL}, 4403 { "upperlimit", UPPERLIMIT}, 4404 { "user", USER}, 4405 }; 4406 const struct keywords *p; 4407 4408 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), 4409 sizeof(keywords[0]), kw_cmp); 4410 4411 if (p) { 4412 if (debug > 1) 4413 fprintf(stderr, "%s: %d\n", s, p->k_val); 4414 return (p->k_val); 4415 } else { 4416 if (debug > 1) 4417 fprintf(stderr, "string: %s\n", s); 4418 return (STRING); 4419 } 4420 } 4421 4422 #define MAXPUSHBACK 128 4423 4424 char *parsebuf; 4425 int parseindex; 4426 char pushback_buffer[MAXPUSHBACK]; 4427 int pushback_index = 0; 4428 4429 int 4430 lgetc(FILE *f) 4431 { 4432 int c, next; 4433 4434 if (parsebuf) { 4435 /* Read character from the parsebuffer instead of input. */ 4436 if (parseindex >= 0) { 4437 c = parsebuf[parseindex++]; 4438 if (c != '\0') 4439 return (c); 4440 parsebuf = NULL; 4441 } else 4442 parseindex++; 4443 } 4444 4445 if (pushback_index) 4446 return (pushback_buffer[--pushback_index]); 4447 4448 while ((c = getc(f)) == '\\') { 4449 next = getc(f); 4450 if (next != '\n') { 4451 if (isspace(next)) 4452 yyerror("whitespace after \\"); 4453 ungetc(next, f); 4454 break; 4455 } 4456 yylval.lineno = lineno; 4457 lineno++; 4458 } 4459 if (c == '\t' || c == ' ') { 4460 /* Compress blanks to a single space. */ 4461 do { 4462 c = getc(f); 4463 } while (c == '\t' || c == ' '); 4464 ungetc(c, f); 4465 c = ' '; 4466 } 4467 4468 return (c); 4469 } 4470 4471 int 4472 lungetc(int c) 4473 { 4474 if (c == EOF) 4475 return (EOF); 4476 if (parsebuf) { 4477 parseindex--; 4478 if (parseindex >= 0) 4479 return (c); 4480 } 4481 if (pushback_index < MAXPUSHBACK-1) 4482 return (pushback_buffer[pushback_index++] = c); 4483 else 4484 return (EOF); 4485 } 4486 4487 int 4488 findeol(void) 4489 { 4490 int c; 4491 4492 parsebuf = NULL; 4493 pushback_index = 0; 4494 4495 /* skip to either EOF or the first real EOL */ 4496 while (1) { 4497 c = lgetc(fin); 4498 if (c == '\n') { 4499 lineno++; 4500 break; 4501 } 4502 if (c == EOF) 4503 break; 4504 } 4505 return (ERROR); 4506 } 4507 4508 int 4509 yylex(void) 4510 { 4511 char buf[8096]; 4512 char *p, *val; 4513 int endc, c, next; 4514 int token; 4515 4516 top: 4517 p = buf; 4518 while ((c = lgetc(fin)) == ' ') 4519 ; /* nothing */ 4520 4521 yylval.lineno = lineno; 4522 if (c == '#') 4523 while ((c = lgetc(fin)) != '\n' && c != EOF) 4524 ; /* nothing */ 4525 if (c == '$' && parsebuf == NULL) { 4526 while (1) { 4527 if ((c = lgetc(fin)) == EOF) 4528 return (0); 4529 4530 if (p + 1 >= buf + sizeof(buf) - 1) { 4531 yyerror("string too long"); 4532 return (findeol()); 4533 } 4534 if (isalnum(c) || c == '_') { 4535 *p++ = (char)c; 4536 continue; 4537 } 4538 *p = '\0'; 4539 lungetc(c); 4540 break; 4541 } 4542 val = symget(buf); 4543 if (val == NULL) { 4544 yyerror("macro '%s' not defined", buf); 4545 return (findeol()); 4546 } 4547 parsebuf = val; 4548 parseindex = 0; 4549 goto top; 4550 } 4551 4552 switch (c) { 4553 case '\'': 4554 case '"': 4555 endc = c; 4556 while (1) { 4557 if ((c = lgetc(fin)) == EOF) 4558 return (0); 4559 if (c == endc) { 4560 *p = '\0'; 4561 break; 4562 } 4563 if (c == '\n') { 4564 lineno++; 4565 continue; 4566 } 4567 if (p + 1 >= buf + sizeof(buf) - 1) { 4568 yyerror("string too long"); 4569 return (findeol()); 4570 } 4571 *p++ = (char)c; 4572 } 4573 yylval.v.string = strdup(buf); 4574 if (yylval.v.string == NULL) 4575 err(1, "yylex: strdup"); 4576 return (STRING); 4577 case '<': 4578 next = lgetc(fin); 4579 if (next == '>') { 4580 yylval.v.i = PF_OP_XRG; 4581 return (PORTBINARY); 4582 } 4583 lungetc(next); 4584 break; 4585 case '>': 4586 next = lgetc(fin); 4587 if (next == '<') { 4588 yylval.v.i = PF_OP_IRG; 4589 return (PORTBINARY); 4590 } 4591 lungetc(next); 4592 break; 4593 case '-': 4594 next = lgetc(fin); 4595 if (next == '>') 4596 return (ARROW); 4597 lungetc(next); 4598 break; 4599 } 4600 4601 #define allowed_in_string(x) \ 4602 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ 4603 x != '{' && x != '}' && x != '<' && x != '>' && \ 4604 x != '!' && x != '=' && x != '/' && x != '#' && \ 4605 x != ',')) 4606 4607 if (isalnum(c) || c == ':' || c == '_') { 4608 do { 4609 *p++ = c; 4610 if ((unsigned)(p-buf) >= sizeof(buf)) { 4611 yyerror("string too long"); 4612 return (findeol()); 4613 } 4614 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c))); 4615 lungetc(c); 4616 *p = '\0'; 4617 if ((token = lookup(buf)) == STRING) 4618 if ((yylval.v.string = strdup(buf)) == NULL) 4619 err(1, "yylex: strdup"); 4620 return (token); 4621 } 4622 if (c == '\n') { 4623 yylval.lineno = lineno; 4624 lineno++; 4625 } 4626 if (c == EOF) 4627 return (0); 4628 return (c); 4629 } 4630 4631 int 4632 parse_rules(FILE *input, struct pfctl *xpf) 4633 { 4634 struct sym *sym, *next; 4635 4636 fin = input; 4637 pf = xpf; 4638 lineno = 1; 4639 errors = 0; 4640 rulestate = PFCTL_STATE_NONE; 4641 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT; 4642 returnicmp6default = 4643 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT; 4644 blockpolicy = PFRULE_DROP; 4645 require_order = 1; 4646 4647 yyparse(); 4648 4649 /* Free macros and check which have not been used. */ 4650 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) { 4651 next = TAILQ_NEXT(sym, entries); 4652 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used) 4653 fprintf(stderr, "warning: macro '%s' not " 4654 "used\n", sym->nam); 4655 free(sym->nam); 4656 free(sym->val); 4657 TAILQ_REMOVE(&symhead, sym, entries); 4658 free(sym); 4659 } 4660 4661 return (errors ? -1 : 0); 4662 } 4663 4664 /* 4665 * Over-designed efficiency is a French and German concept, so how about 4666 * we wait until they discover this ugliness and make it all fancy. 4667 */ 4668 int 4669 symset(const char *nam, const char *val, int persist) 4670 { 4671 struct sym *sym; 4672 4673 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam); 4674 sym = TAILQ_NEXT(sym, entries)) 4675 ; /* nothing */ 4676 4677 if (sym != NULL) { 4678 if (sym->persist == 1) 4679 return (0); 4680 else { 4681 free(sym->nam); 4682 free(sym->val); 4683 TAILQ_REMOVE(&symhead, sym, entries); 4684 free(sym); 4685 } 4686 } 4687 if ((sym = calloc(1, sizeof(*sym))) == NULL) 4688 return (-1); 4689 4690 sym->nam = strdup(nam); 4691 if (sym->nam == NULL) { 4692 free(sym); 4693 return (-1); 4694 } 4695 sym->val = strdup(val); 4696 if (sym->val == NULL) { 4697 free(sym->nam); 4698 free(sym); 4699 return (-1); 4700 } 4701 sym->used = 0; 4702 sym->persist = persist; 4703 TAILQ_INSERT_TAIL(&symhead, sym, entries); 4704 return (0); 4705 } 4706 4707 int 4708 pfctl_cmdline_symset(char *s) 4709 { 4710 char *sym, *val; 4711 int ret; 4712 4713 if ((val = strrchr(s, '=')) == NULL) 4714 return (-1); 4715 4716 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL) 4717 err(1, "pfctl_cmdline_symset: malloc"); 4718 4719 strlcpy(sym, s, strlen(s) - strlen(val) + 1); 4720 4721 ret = symset(sym, val + 1, 1); 4722 free(sym); 4723 4724 return (ret); 4725 } 4726 4727 char * 4728 symget(const char *nam) 4729 { 4730 struct sym *sym; 4731 4732 TAILQ_FOREACH(sym, &symhead, entries) 4733 if (strcmp(nam, sym->nam) == 0) { 4734 sym->used = 1; 4735 return (sym->val); 4736 } 4737 return (NULL); 4738 } 4739 4740 void 4741 decide_address_family(struct node_host *n, sa_family_t *af) 4742 { 4743 sa_family_t target_af = 0; 4744 4745 while (!*af && n != NULL) { 4746 if (n->af) { 4747 if (target_af == 0) 4748 target_af = n->af; 4749 if (target_af != n->af) 4750 return; 4751 } 4752 n = n->next; 4753 } 4754 if (!*af && target_af) 4755 *af = target_af; 4756 } 4757 4758 void 4759 remove_invalid_hosts(struct node_host **nh, sa_family_t *af) 4760 { 4761 struct node_host *n = *nh, *prev = NULL; 4762 4763 while (n != NULL) { 4764 if (*af && n->af && n->af != *af) { 4765 /* unlink and free n */ 4766 struct node_host *next = n->next; 4767 4768 /* adjust tail pointer */ 4769 if (n == (*nh)->tail) 4770 (*nh)->tail = prev; 4771 /* adjust previous node's next pointer */ 4772 if (prev == NULL) 4773 *nh = next; 4774 else 4775 prev->next = next; 4776 /* free node */ 4777 if (n->ifname != NULL) 4778 free(n->ifname); 4779 free(n); 4780 n = next; 4781 } else { 4782 if (n->af && !*af) 4783 *af = n->af; 4784 prev = n; 4785 n = n->next; 4786 } 4787 } 4788 } 4789 4790 int 4791 invalid_redirect(struct node_host *nh, sa_family_t af) 4792 { 4793 if (!af) { 4794 struct node_host *n; 4795 4796 /* tables and dyniftl are ok without an address family */ 4797 for (n = nh; n != NULL; n = n->next) { 4798 if (n->addr.type != PF_ADDR_TABLE && 4799 n->addr.type != PF_ADDR_DYNIFTL) { 4800 yyerror("address family not given and " 4801 "translation address expands to multiple " 4802 "address families"); 4803 return (1); 4804 } 4805 } 4806 } 4807 if (nh == NULL) { 4808 yyerror("no translation address with matching address family " 4809 "found."); 4810 return (1); 4811 } 4812 return (0); 4813 } 4814 4815 int 4816 atoul(char *s, u_long *ulvalp) 4817 { 4818 u_long ulval; 4819 char *ep; 4820 4821 errno = 0; 4822 ulval = strtoul(s, &ep, 0); 4823 if (s[0] == '\0' || *ep != '\0') 4824 return (-1); 4825 if (errno == ERANGE && ulval == ULONG_MAX) 4826 return (-1); 4827 *ulvalp = ulval; 4828 return (0); 4829 } 4830 4831 int 4832 getservice(char *n) 4833 { 4834 struct servent *s; 4835 u_long ulval; 4836 4837 if (atoul(n, &ulval) == 0) { 4838 if (ulval > 65535) { 4839 yyerror("illegal port value %d", ulval); 4840 return (-1); 4841 } 4842 return (htons(ulval)); 4843 } else { 4844 s = getservbyname(n, "tcp"); 4845 if (s == NULL) 4846 s = getservbyname(n, "udp"); 4847 if (s == NULL) { 4848 yyerror("unknown port %s", n); 4849 return (-1); 4850 } 4851 return (s->s_port); 4852 } 4853 } 4854 4855 int 4856 rule_label(struct pf_rule *r, char *s) 4857 { 4858 if (s) { 4859 if (strlcpy(r->label, s, sizeof(r->label)) >= 4860 sizeof(r->label)) { 4861 yyerror("rule label too long (max %d chars)", 4862 sizeof(r->label)-1); 4863 return (-1); 4864 } 4865 } 4866 return (0); 4867 } 4868 4869 u_int16_t 4870 parseicmpspec(char *w, sa_family_t af) 4871 { 4872 const struct icmpcodeent *p; 4873 u_long ulval; 4874 u_int8_t icmptype; 4875 4876 if (af == AF_INET) 4877 icmptype = returnicmpdefault >> 8; 4878 else 4879 icmptype = returnicmp6default >> 8; 4880 4881 if (atoul(w, &ulval) == -1) { 4882 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) { 4883 yyerror("unknown icmp code %s", w); 4884 return (0); 4885 } 4886 ulval = p->code; 4887 } 4888 if (ulval > 255) { 4889 yyerror("invalid icmp code %ld", ulval); 4890 return (0); 4891 } 4892 return (icmptype << 8 | ulval); 4893 } 4894 4895 int 4896 pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans) 4897 { 4898 struct loadanchors *la; 4899 4900 TAILQ_FOREACH(la, &loadanchorshead, entries) { 4901 if (opts & PF_OPT_VERBOSE) 4902 fprintf(stderr, "\nLoading anchor %s:%s from %s\n", 4903 la->anchorname, la->rulesetname, la->filename); 4904 if (pfctl_rules(dev, la->filename, opts, la->anchorname, 4905 la->rulesetname, trans) == -1) 4906 return (-1); 4907 } 4908 4909 return (0); 4910 } 4911 4912