1 /* $OpenBSD: parse.y,v 1.449 2004/03/20 23:20:20 david Exp $ */
2 /* $DragonFly: src/usr.sbin/pfctl/parse.y,v 1.1 2004/09/21 21:25:28 joerg Exp $ */
5 * Copyright (c) 2001 Markus Friedl. All rights reserved.
6 * Copyright (c) 2001 Daniel Hartmeier. All rights reserved.
7 * Copyright (c) 2001 Theo de Raadt. All rights reserved.
8 * Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 #include <sys/param.h>
32 #include <sys/socket.h>
34 #include <netinet/in.h>
35 #include <netinet/in_systm.h>
36 #include <netinet/ip.h>
37 #include <netinet/ip_icmp.h>
38 #include <netinet/icmp6.h>
39 #include <net/pf/pfvar.h>
40 #include <arpa/inet.h>
42 #include <altq/altq.h>
43 #include <altq/altq_cbq.h>
44 #include <altq/altq_priq.h>
45 #include <altq/altq_hfsc.h>
60 #include "pfctl_parser.h"
63 static struct pfctl *pf = NULL;
64 static FILE *fin = NULL;
66 static int lineno = 1;
67 static int errors = 0;
68 static int rulestate = 0;
69 static u_int16_t returnicmpdefault =
70 (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
71 static u_int16_t returnicmp6default =
72 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
73 static int blockpolicy = PFRULE_DROP;
74 static int require_order = 1;
75 static int default_statelock;
88 struct node_proto *next;
89 struct node_proto *tail;
95 struct node_port *next;
96 struct node_port *tail;
102 struct node_uid *next;
103 struct node_uid *tail;
109 struct node_gid *next;
110 struct node_gid *tail;
117 struct node_icmp *next;
118 struct node_icmp *tail;
121 enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
122 PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_NODES,
123 PF_STATE_OPT_STATELOCK, PF_STATE_OPT_TIMEOUT };
125 enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
127 struct node_state_opt {
130 u_int32_t max_states;
131 u_int32_t max_src_states;
132 u_int32_t max_src_nodes;
140 struct node_state_opt *next;
141 struct node_state_opt *tail;
145 struct node_host *host;
146 struct node_port *port;
150 char queue[PF_QNAME_SIZE];
151 char parent[PF_QNAME_SIZE];
152 char ifname[IFNAMSIZ];
154 struct node_queue *next;
155 struct node_queue *tail;
158 struct node_qassign {
165 #define FOM_FLAGS 0x01
166 #define FOM_ICMP 0x02
168 #define FOM_KEEP 0x08
169 #define FOM_SRCTRACK 0x10
170 struct node_uid *uid;
171 struct node_gid *gid;
178 struct node_icmp *icmpspec;
182 struct node_state_opt *options;
187 struct node_qassign queues;
190 u_int8_t match_tag_not;
193 struct antispoof_opts {
199 #define SOM_MINTTL 0x01
200 #define SOM_MAXMSS 0x02
201 #define SOM_FRAGCACHE 0x04
212 #define QOM_BWSPEC 0x01
213 #define QOM_SCHEDULER 0x02
214 #define QOM_PRIORITY 0x04
215 #define QOM_TBRSIZE 0x08
216 #define QOM_QLIMIT 0x10
217 struct node_queue_bw queue_bwspec;
218 struct node_queue_opt scheduler;
227 struct node_tinithead init_nodes;
232 #define POM_TYPE 0x01
233 #define POM_STICKYADDRESS 0x02
237 struct pf_poolhashkey *key;
242 struct node_hfsc_opts hfsc_opts;
244 int yyerror(const char *, ...);
245 int disallow_table(struct node_host *, const char *);
246 int disallow_alias(struct node_host *, const char *);
247 int rule_consistent(struct pf_rule *);
248 int filter_consistent(struct pf_rule *);
249 int nat_consistent(struct pf_rule *);
250 int rdr_consistent(struct pf_rule *);
251 int process_tabledef(char *, struct table_opts *);
253 void expand_label_str(char *, size_t, const char *, const char *);
254 void expand_label_if(const char *, char *, size_t, const char *);
255 void expand_label_addr(const char *, char *, size_t, u_int8_t,
257 void expand_label_port(const char *, char *, size_t, struct node_port *);
258 void expand_label_proto(const char *, char *, size_t, u_int8_t);
259 void expand_label_nr(const char *, char *, size_t);
260 void expand_label(char *, size_t, const char *, u_int8_t, struct node_host *,
261 struct node_port *, struct node_host *, struct node_port *,
263 void expand_rule(struct pf_rule *, struct node_if *, struct node_host *,
264 struct node_proto *, struct node_os*, struct node_host *,
265 struct node_port *, struct node_host *, struct node_port *,
266 struct node_uid *, struct node_gid *, struct node_icmp *);
267 int expand_altq(struct pf_altq *, struct node_if *, struct node_queue *,
268 struct node_queue_bw bwspec, struct node_queue_opt *);
269 int expand_queue(struct pf_altq *, struct node_if *, struct node_queue *,
270 struct node_queue_bw, struct node_queue_opt *);
272 int check_rulestate(int);
273 int kw_cmp(const void *, const void *);
279 int atoul(char *, u_long *);
280 int getservice(char *);
281 int rule_label(struct pf_rule *, char *);
283 TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead);
285 TAILQ_ENTRY(sym) entries;
293 int symset(const char *, const char *, int);
294 char *symget(const char *);
296 void decide_address_family(struct node_host *, sa_family_t *);
297 void remove_invalid_hosts(struct node_host **, sa_family_t *);
298 int invalid_redirect(struct node_host *, sa_family_t);
299 u_int16_t parseicmpspec(char *, sa_family_t);
301 TAILQ_HEAD(loadanchorshead, loadanchors)
302 loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
305 TAILQ_ENTRY(loadanchors) entries;
327 struct node_if *interface;
328 struct node_proto *proto;
329 struct node_icmp *icmp;
330 struct node_host *host;
332 struct node_port *port;
333 struct node_uid *uid;
334 struct node_gid *gid;
335 struct node_state_opt *state_opt;
338 struct peer src, dst;
339 struct node_os *src_os;
342 struct node_host *host;
346 struct pf_poolhashkey *key;
349 struct node_host *host;
354 struct node_state_opt *options;
360 struct pf_poolhashkey *hashkey;
361 struct node_queue *queue;
362 struct node_queue_opt queue_options;
363 struct node_queue_bw queue_bwspec;
364 struct node_qassign qassign;
365 struct filter_opts filter_opts;
366 struct antispoof_opts antispoof_opts;
367 struct queue_opts queue_opts;
368 struct scrub_opts scrub_opts;
369 struct table_opts table_opts;
370 struct pool_opts pool_opts;
371 struct node_hfsc_opts hfsc_opts;
376 #define PREPARE_ANCHOR_RULE(r, a) \
378 memset(&(r), 0, sizeof(r)); \
379 if (strlcpy(r.anchorname, (a), \
380 sizeof(r.anchorname)) >= \
381 sizeof(r.anchorname)) { \
382 yyerror("anchor name '%s' too long", \
388 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
389 (!((addr).iflags & PFI_AFLAG_NOALIAS) || \
390 !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
392 extern const char *infile;
396 %token PASS BLOCK SCRUB RETURN IN OS OUT LOG LOGALL QUICK ON FROM TO FLAGS
397 %token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
398 %token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
399 %token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
400 %token NOROUTE FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
401 %token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
402 %token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
403 %token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG HOSTID
405 %token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT
406 %token ALTQ CBQ PRIQ HFSC BANDWIDTH TBRSIZE LINKSHARE REALTIME UPPERLIMIT
407 %token QUEUE PRIORITY QLIMIT
409 %token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
410 %token TAGGED TAG IFBOUND GRBOUND FLOATING STATEPOLICY
411 %token <v.string> STRING
412 %token <v.i> PORTBINARY
413 %type <v.interface> interface if_list if_item_not if_item
414 %type <v.number> number icmptype icmp6type uid gid
415 %type <v.number> tos not yesno natpass
416 %type <v.i> no dir log af fragcache sourcetrack
417 %type <v.i> unaryop statelock
418 %type <v.b> action nataction flags flag blockspec
419 %type <v.range> port rport
420 %type <v.hashkey> hashkey
421 %type <v.proto> proto proto_list proto_item
422 %type <v.icmp> icmpspec
423 %type <v.icmp> icmp_list icmp_item
424 %type <v.icmp> icmp6_list icmp6_item
425 %type <v.fromto> fromto
426 %type <v.peer> ipportspec from to
427 %type <v.host> ipspec xhost host dynaddr host_list
428 %type <v.host> redir_host_list redirspec
429 %type <v.host> route_host route_host_list routespec
430 %type <v.os> os xos os_list
431 %type <v.port> portspec port_list port_item
432 %type <v.uid> uids uid_list uid_item
433 %type <v.gid> gids gid_list gid_item
434 %type <v.route> route
435 %type <v.redirection> redirection redirpool
436 %type <v.string> label string tag
437 %type <v.keep_state> keep
438 %type <v.state_opt> state_opt_spec state_opt_list state_opt_item
439 %type <v.logquick> logquick
440 %type <v.interface> antispoof_ifspc antispoof_iflst
441 %type <v.filter_opts> filter_opts filter_opt filter_opts_l
442 %type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l
443 %type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l
444 %type <v.table_opts> table_opts table_opt table_opts_l
445 %type <v.pool_opts> pool_opts pool_opt pool_opts_l
448 ruleset : /* empty */
450 | ruleset option '\n'
451 | ruleset scrubrule '\n'
452 | ruleset natrule '\n'
453 | ruleset binatrule '\n'
454 | ruleset pfrule '\n'
455 | ruleset anchorrule '\n'
456 | ruleset loadrule '\n'
457 /*| ruleset altqif '\n'
458 | ruleset queuespec '\n'*/
459 | ruleset varset '\n'
460 | ruleset antispoof '\n'
461 | ruleset tabledef '\n'
462 | ruleset error '\n' { errors++; }
465 option : SET OPTIMIZATION STRING {
466 if (check_rulestate(PFCTL_STATE_OPTION)) {
470 if (pfctl_set_optimization(pf, $3) != 0) {
471 yyerror("unknown optimization %s", $3);
477 | SET TIMEOUT timeout_spec
478 | SET TIMEOUT '{' timeout_list '}'
479 | SET LIMIT limit_spec
480 | SET LIMIT '{' limit_list '}'
481 | SET LOGINTERFACE STRING {
482 if (check_rulestate(PFCTL_STATE_OPTION)) {
486 if ((ifa_exists($3, 0) == NULL) && strcmp($3, "none")) {
487 yyerror("interface %s doesn't exist", $3);
491 if (pfctl_set_logif(pf, $3) != 0) {
492 yyerror("error setting loginterface %s", $3);
498 | SET HOSTID number {
500 yyerror("hostid must be non-zero");
503 if (pfctl_set_hostid(pf, $3) != 0) {
504 yyerror("error setting loginterface %08x", $3);
508 | SET BLOCKPOLICY DROP {
509 if (pf->opts & PF_OPT_VERBOSE)
510 printf("set block-policy drop\n");
511 if (check_rulestate(PFCTL_STATE_OPTION))
513 blockpolicy = PFRULE_DROP;
515 | SET BLOCKPOLICY RETURN {
516 if (pf->opts & PF_OPT_VERBOSE)
517 printf("set block-policy return\n");
518 if (check_rulestate(PFCTL_STATE_OPTION))
520 blockpolicy = PFRULE_RETURN;
522 | SET REQUIREORDER yesno {
523 if (pf->opts & PF_OPT_VERBOSE)
524 printf("set require-order %s\n",
525 $3 == 1 ? "yes" : "no");
528 | SET FINGERPRINTS STRING {
529 if (pf->opts & PF_OPT_VERBOSE)
530 printf("fingerprints %s\n", $3);
531 if (check_rulestate(PFCTL_STATE_OPTION)) {
535 if (pfctl_file_fingerprints(pf->dev, pf->opts, $3)) {
536 yyerror("error loading fingerprints %s", $3);
542 | SET STATEPOLICY statelock {
543 if (pf->opts & PF_OPT_VERBOSE)
546 printf("set state-policy floating\n");
549 printf("set state-policy if-bound\n");
552 printf("set state-policy "
556 default_statelock = $3;
559 if (check_rulestate(PFCTL_STATE_OPTION)) {
563 if (pfctl_set_debug(pf, $3) != 0) {
564 yyerror("error setting debuglevel %s", $3);
572 string : string STRING {
573 if (asprintf(&$$, "%s %s", $1, $2) == -1)
574 err(1, "string: asprintf");
581 varset : STRING '=' string {
582 if (pf->opts & PF_OPT_VERBOSE)
583 printf("%s = \"%s\"\n", $1, $3);
584 if (symset($1, $3, 0) == -1)
585 err(1, "cannot store variable %s", $1);
591 anchorrule : ANCHOR string dir interface af proto fromto filter_opts {
594 if (check_rulestate(PFCTL_STATE_FILTER)) {
599 PREPARE_ANCHOR_RULE(r, $2);
604 if (strlcpy(r.match_tagname, $8.match_tag,
605 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
606 yyerror("tag too long, max %u chars",
607 PF_TAG_NAME_SIZE - 1);
610 r.match_tag_not = $8.match_tag_not;
612 decide_address_family($7.src.host, &r.af);
613 decide_address_family($7.dst.host, &r.af);
615 expand_rule(&r, $4, NULL, $6, $7.src_os,
616 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
619 | NATANCHOR string interface af proto fromto {
622 if (check_rulestate(PFCTL_STATE_NAT)) {
627 PREPARE_ANCHOR_RULE(r, $2);
632 decide_address_family($6.src.host, &r.af);
633 decide_address_family($6.dst.host, &r.af);
635 expand_rule(&r, $3, NULL, $5, $6.src_os,
636 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
639 | RDRANCHOR string interface af proto fromto {
642 if (check_rulestate(PFCTL_STATE_NAT)) {
647 PREPARE_ANCHOR_RULE(r, $2);
652 decide_address_family($6.src.host, &r.af);
653 decide_address_family($6.dst.host, &r.af);
655 if ($6.src.port != NULL) {
656 yyerror("source port parameter not supported"
660 if ($6.dst.port != NULL) {
661 if ($6.dst.port->next != NULL) {
662 yyerror("destination port list "
663 "expansion not supported in "
666 } else if ($6.dst.port->op != PF_OP_EQ) {
667 yyerror("destination port operators"
668 " not supported in rdr-anchor");
671 r.dst.port[0] = $6.dst.port->port[0];
672 r.dst.port[1] = $6.dst.port->port[1];
673 r.dst.port_op = $6.dst.port->op;
676 expand_rule(&r, $3, NULL, $5, $6.src_os,
677 $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
680 | BINATANCHOR string interface af proto fromto {
683 if (check_rulestate(PFCTL_STATE_NAT)) {
688 PREPARE_ANCHOR_RULE(r, $2);
693 if ($5->next != NULL) {
694 yyerror("proto list expansion"
695 " not supported in binat-anchor");
702 if ($6.src.host != NULL || $6.src.port != NULL ||
703 $6.dst.host != NULL || $6.dst.port != NULL) {
704 yyerror("fromto parameter not supported"
709 decide_address_family($6.src.host, &r.af);
710 decide_address_family($6.dst.host, &r.af);
712 pfctl_add_rule(pf, &r);
716 loadrule : LOAD ANCHOR string FROM string {
718 struct loadanchors *loadanchor;
720 t = strsep(&$3, ":");
721 if (*t == '\0' || $3 == NULL || *$3 == '\0') {
722 yyerror("anchor '%s' invalid\n", $3);
726 if (strlen(t) >= PF_ANCHOR_NAME_SIZE) {
727 yyerror("anchorname %s too long, max %u\n",
728 t, PF_ANCHOR_NAME_SIZE - 1);
732 if (strlen($3) >= PF_RULESET_NAME_SIZE) {
733 yyerror("rulesetname %s too long, max %u\n",
734 $3, PF_RULESET_NAME_SIZE - 1);
739 loadanchor = calloc(1, sizeof(struct loadanchors));
740 if (loadanchor == NULL)
741 err(1, "loadrule: calloc");
742 if ((loadanchor->anchorname = strdup(t)) == NULL)
743 err(1, "loadrule: strdup");
744 if ((loadanchor->rulesetname = strdup($3)) == NULL)
745 err(1, "loadrule: strdup");
746 if ((loadanchor->filename = strdup($5)) == NULL)
747 err(1, "loadrule: strdup");
749 TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
752 free(t); /* not $3 */
756 scrubrule : SCRUB dir logquick interface af proto fromto scrub_opts
760 if (check_rulestate(PFCTL_STATE_SCRUB))
763 memset(&r, 0, sizeof(r));
770 yyerror("scrub rules do not support 'quick'");
776 r.rule_flag |= PFRULE_NODF;
778 r.rule_flag |= PFRULE_RANDOMID;
779 if ($8.reassemble_tcp) {
780 if (r.direction != PF_INOUT) {
781 yyerror("reassemble tcp rules can not "
782 "specify direction");
785 r.rule_flag |= PFRULE_REASSEMBLE_TCP;
788 r.min_ttl = $8.minttl;
790 r.max_mss = $8.maxmss;
792 r.rule_flag |= $8.fragcache;
794 expand_rule(&r, $4, NULL, $6, $7.src_os,
795 $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
801 bzero(&scrub_opts, sizeof scrub_opts);
806 bzero(&scrub_opts, sizeof scrub_opts);
811 scrub_opts_l : scrub_opts_l scrub_opt
816 if (scrub_opts.nodf) {
817 yyerror("no-df cannot be respecified");
823 if (scrub_opts.marker & SOM_MINTTL) {
824 yyerror("min-ttl cannot be respecified");
828 yyerror("illegal min-ttl value %d", $2);
831 scrub_opts.marker |= SOM_MINTTL;
832 scrub_opts.minttl = $2;
835 if (scrub_opts.marker & SOM_MAXMSS) {
836 yyerror("max-mss cannot be respecified");
840 yyerror("illegal max-mss value %d", $2);
843 scrub_opts.marker |= SOM_MAXMSS;
844 scrub_opts.maxmss = $2;
847 if (scrub_opts.marker & SOM_FRAGCACHE) {
848 yyerror("fragcache cannot be respecified");
851 scrub_opts.marker |= SOM_FRAGCACHE;
852 scrub_opts.fragcache = $1;
854 | REASSEMBLE STRING {
855 if (strcasecmp($2, "tcp") != 0) {
860 if (scrub_opts.reassemble_tcp) {
861 yyerror("reassemble tcp cannot be respecified");
864 scrub_opts.reassemble_tcp = 1;
867 if (scrub_opts.randomid) {
868 yyerror("random-id cannot be respecified");
871 scrub_opts.randomid = 1;
875 fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ }
876 | FRAGMENT FRAGCROP { $$ = PFRULE_FRAGCROP; }
877 | FRAGMENT FRAGDROP { $$ = PFRULE_FRAGDROP; }
880 antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
882 struct node_host *h = NULL;
883 struct node_if *i, *j;
885 if (check_rulestate(PFCTL_STATE_FILTER))
888 for (i = $3; i; i = i->next) {
889 bzero(&r, sizeof(r));
896 if (rule_label(&r, $5.label))
898 j = calloc(1, sizeof(struct node_if));
900 err(1, "antispoof: calloc");
901 if (strlcpy(j->ifname, i->ifname,
902 sizeof(j->ifname)) >= sizeof(j->ifname)) {
904 yyerror("interface name too long");
908 h = ifa_lookup(j->ifname, PFI_AFLAG_NETWORK);
911 expand_rule(&r, j, NULL, NULL, NULL, h,
912 NULL, NULL, NULL, NULL, NULL, NULL);
914 if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
915 bzero(&r, sizeof(r));
922 if (rule_label(&r, $5.label))
924 h = ifa_lookup(i->ifname, 0);
926 expand_rule(&r, NULL, NULL,
927 NULL, NULL, h, NULL, NULL,
928 NULL, NULL, NULL, NULL);
935 antispoof_ifspc : FOR if_item { $$ = $2; }
936 | FOR '{' antispoof_iflst '}' { $$ = $3; }
939 antispoof_iflst : if_item { $$ = $1; }
940 | antispoof_iflst comma if_item {
947 antispoof_opts : { bzero(&antispoof_opts, sizeof antispoof_opts); }
949 { $$ = antispoof_opts; }
951 bzero(&antispoof_opts, sizeof antispoof_opts);
956 antispoof_opts_l : antispoof_opts_l antispoof_opt
960 antispoof_opt : label {
961 if (antispoof_opts.label) {
962 yyerror("label cannot be redefined");
965 antispoof_opts.label = $1;
969 not : '!' { $$ = 1; }
970 | /* empty */ { $$ = 0; }
973 tabledef : TABLE '<' STRING '>' table_opts {
974 struct node_host *h, *nh;
975 struct node_tinit *ti, *nti;
977 if (strlen($3) >= PF_TABLE_NAME_SIZE) {
978 yyerror("table name too long, max %d chars",
979 PF_TABLE_NAME_SIZE - 1);
983 if (pf->loadopt & PFCTL_FLAG_TABLE)
984 if (process_tabledef($3, &$5)) {
989 for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
990 ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
993 for (h = ti->host; h != NULL; h = nh) {
997 nti = SIMPLEQ_NEXT(ti, entries);
1004 bzero(&table_opts, sizeof table_opts);
1005 SIMPLEQ_INIT(&table_opts.init_nodes);
1008 { $$ = table_opts; }
1011 bzero(&table_opts, sizeof table_opts);
1012 SIMPLEQ_INIT(&table_opts.init_nodes);
1017 table_opts_l : table_opts_l table_opt
1021 table_opt : STRING {
1022 if (!strcmp($1, "const"))
1023 table_opts.flags |= PFR_TFLAG_CONST;
1024 else if (!strcmp($1, "persist"))
1025 table_opts.flags |= PFR_TFLAG_PERSIST;
1032 | '{' '}' { table_opts.init_addr = 1; }
1033 | '{' host_list '}' {
1034 struct node_host *n;
1035 struct node_tinit *ti;
1037 for (n = $2; n != NULL; n = n->next) {
1038 switch (n->addr.type) {
1039 case PF_ADDR_ADDRMASK:
1041 case PF_ADDR_DYNIFTL:
1042 yyerror("dynamic addresses are not "
1043 "permitted inside tables");
1046 yyerror("tables cannot contain tables");
1048 case PF_ADDR_NOROUTE:
1049 yyerror("\"no-route\" is not permitted "
1053 yyerror("unknown address type %d",
1058 if (!(ti = calloc(1, sizeof(*ti))))
1059 err(1, "table_opt: calloc");
1061 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1063 table_opts.init_addr = 1;
1066 struct node_tinit *ti;
1068 if (!(ti = calloc(1, sizeof(*ti))))
1069 err(1, "table_opt: calloc");
1071 SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1073 table_opts.init_addr = 1;
1077 pfrule : action dir logquick interface route af proto fromto
1081 struct node_state_opt *o;
1082 struct node_proto *proto;
1086 if (check_rulestate(PFCTL_STATE_FILTER))
1089 memset(&r, 0, sizeof(r));
1093 case PFRULE_RETURNRST:
1094 r.rule_flag |= PFRULE_RETURNRST;
1095 r.return_ttl = $1.w;
1097 case PFRULE_RETURNICMP:
1098 r.rule_flag |= PFRULE_RETURNICMP;
1099 r.return_icmp = $1.w;
1100 r.return_icmp6 = $1.w2;
1103 r.rule_flag |= PFRULE_RETURN;
1104 r.return_icmp = $1.w;
1105 r.return_icmp6 = $1.w2;
1114 if (strlcpy(r.tagname, $9.tag,
1115 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1116 yyerror("tag too long, max %u chars",
1117 PF_TAG_NAME_SIZE - 1);
1121 if (strlcpy(r.match_tagname, $9.match_tag,
1122 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1123 yyerror("tag too long, max %u chars",
1124 PF_TAG_NAME_SIZE - 1);
1127 r.match_tag_not = $9.match_tag_not;
1128 r.flags = $9.flags.b1;
1129 r.flagset = $9.flags.b2;
1130 if (rule_label(&r, $9.label))
1133 if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
1134 for (proto = $7; proto != NULL &&
1135 proto->proto != IPPROTO_TCP;
1136 proto = proto->next)
1138 if (proto == NULL && $7 != NULL) {
1139 if ($9.flags.b1 || $9.flags.b2)
1141 "flags only apply to tcp");
1144 "OS fingerprinting only "
1149 if (($9.flags.b1 & parse_flags("S")) == 0 &&
1151 yyerror("OS fingerprinting requires "
1152 "the SYN TCP flag (flags S/SA)");
1159 r.keep_state = $9.keep.action;
1160 o = $9.keep.options;
1162 struct node_state_opt *p = o;
1165 case PF_STATE_OPT_MAX:
1167 yyerror("state option 'max' "
1168 "multiple definitions");
1171 r.max_states = o->data.max_states;
1173 case PF_STATE_OPT_NOSYNC:
1174 if (r.rule_flag & PFRULE_NOSYNC) {
1175 yyerror("state option 'sync' "
1176 "multiple definitions");
1179 r.rule_flag |= PFRULE_NOSYNC;
1181 case PF_STATE_OPT_SRCTRACK:
1183 yyerror("state option "
1185 "multiple definitions");
1188 srctrack = o->data.src_track;
1190 case PF_STATE_OPT_MAX_SRC_STATES:
1191 if (r.max_src_states) {
1192 yyerror("state option "
1194 "multiple definitions");
1197 if (o->data.max_src_nodes == 0) {
1198 yyerror("'max-src-states' must "
1203 o->data.max_src_states;
1204 r.rule_flag |= PFRULE_SRCTRACK;
1206 case PF_STATE_OPT_MAX_SRC_NODES:
1207 if (r.max_src_nodes) {
1208 yyerror("state option "
1210 "multiple definitions");
1213 if (o->data.max_src_nodes == 0) {
1214 yyerror("'max-src-nodes' must "
1219 o->data.max_src_nodes;
1220 r.rule_flag |= PFRULE_SRCTRACK |
1221 PFRULE_RULESRCTRACK;
1223 case PF_STATE_OPT_STATELOCK:
1225 yyerror("state locking option: "
1226 "multiple definitions");
1230 r.rule_flag |= o->data.statelock;
1232 case PF_STATE_OPT_TIMEOUT:
1233 if (r.timeout[o->data.timeout.number]) {
1234 yyerror("state timeout %s "
1235 "multiple definitions",
1236 pf_timeouts[o->data.
1237 timeout.number].name);
1240 r.timeout[o->data.timeout.number] =
1241 o->data.timeout.seconds;
1247 if (srctrack == PF_SRCTRACK_GLOBAL &&
1249 yyerror("'max-src-nodes' is "
1250 "incompatible with "
1251 "'source-track global'");
1254 r.rule_flag |= PFRULE_SRCTRACK;
1255 if (srctrack == PF_SRCTRACK_RULE)
1256 r.rule_flag |= PFRULE_RULESRCTRACK;
1258 if (r.keep_state && !statelock)
1259 r.rule_flag |= default_statelock;
1262 r.rule_flag |= PFRULE_FRAGMENT;
1263 r.allow_opts = $9.allowopts;
1265 decide_address_family($8.src.host, &r.af);
1266 decide_address_family($8.dst.host, &r.af);
1270 yyerror("direction must be explicit "
1271 "with rules that specify routing");
1275 r.rpool.opts = $5.pool_opts;
1277 memcpy(&r.rpool.key, $5.key,
1278 sizeof(struct pf_poolhashkey));
1280 if (r.rt && r.rt != PF_FASTROUTE) {
1281 decide_address_family($5.host, &r.af);
1282 remove_invalid_hosts(&$5.host, &r.af);
1283 if ($5.host == NULL) {
1284 yyerror("no routing address with "
1285 "matching address family found.");
1288 if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
1289 PF_POOL_NONE && ($5.host->next != NULL ||
1290 $5.host->addr.type == PF_ADDR_TABLE ||
1291 DYNIF_MULTIADDR($5.host->addr)))
1292 r.rpool.opts |= PF_POOL_ROUNDROBIN;
1293 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1294 PF_POOL_ROUNDROBIN &&
1295 disallow_table($5.host, "tables are only "
1296 "supported in round-robin routing pools"))
1298 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1299 PF_POOL_ROUNDROBIN &&
1300 disallow_alias($5.host, "interface (%s) "
1301 "is only supported in round-robin "
1304 if ($5.host->next != NULL) {
1305 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
1306 PF_POOL_ROUNDROBIN) {
1307 yyerror("r.rpool.opts must "
1308 "be PF_POOL_ROUNDROBIN");
1313 if ($9.queues.qname != NULL) {
1314 if (strlcpy(r.qname, $9.queues.qname,
1315 sizeof(r.qname)) >= sizeof(r.qname)) {
1316 yyerror("rule qname too long (max "
1317 "%d chars)", sizeof(r.qname)-1);
1320 free($9.queues.qname);
1322 if ($9.queues.pqname != NULL) {
1323 if (strlcpy(r.pqname, $9.queues.pqname,
1324 sizeof(r.pqname)) >= sizeof(r.pqname)) {
1325 yyerror("rule pqname too long (max "
1326 "%d chars)", sizeof(r.pqname)-1);
1329 free($9.queues.pqname);
1332 expand_rule(&r, $4, $5.host, $7, $8.src_os,
1333 $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
1334 $9.uid, $9.gid, $9.icmpspec);
1338 filter_opts : { bzero(&filter_opts, sizeof filter_opts); }
1340 { $$ = filter_opts; }
1342 bzero(&filter_opts, sizeof filter_opts);
1347 filter_opts_l : filter_opts_l filter_opt
1351 filter_opt : USER uids {
1352 if (filter_opts.uid)
1353 $2->tail->next = filter_opts.uid;
1354 filter_opts.uid = $2;
1357 if (filter_opts.gid)
1358 $2->tail->next = filter_opts.gid;
1359 filter_opts.gid = $2;
1362 if (filter_opts.marker & FOM_FLAGS) {
1363 yyerror("flags cannot be redefined");
1366 filter_opts.marker |= FOM_FLAGS;
1367 filter_opts.flags.b1 |= $1.b1;
1368 filter_opts.flags.b2 |= $1.b2;
1369 filter_opts.flags.w |= $1.w;
1370 filter_opts.flags.w2 |= $1.w2;
1373 if (filter_opts.marker & FOM_ICMP) {
1374 yyerror("icmp-type cannot be redefined");
1377 filter_opts.marker |= FOM_ICMP;
1378 filter_opts.icmpspec = $1;
1381 if (filter_opts.marker & FOM_TOS) {
1382 yyerror("tos cannot be redefined");
1385 filter_opts.marker |= FOM_TOS;
1386 filter_opts.tos = $1;
1389 if (filter_opts.marker & FOM_KEEP) {
1390 yyerror("modulate or keep cannot be redefined");
1393 filter_opts.marker |= FOM_KEEP;
1394 filter_opts.keep.action = $1.action;
1395 filter_opts.keep.options = $1.options;
1398 filter_opts.fragment = 1;
1401 filter_opts.allowopts = 1;
1404 if (filter_opts.label) {
1405 yyerror("label cannot be redefined");
1408 filter_opts.label = $1;
1411 filter_opts.tag = $2;
1413 | not TAGGED string {
1414 filter_opts.match_tag = $3;
1415 filter_opts.match_tag_not = $1;
1419 action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
1420 | BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; }
1423 blockspec : /* empty */ {
1424 $$.b2 = blockpolicy;
1425 $$.w = returnicmpdefault;
1426 $$.w2 = returnicmp6default;
1429 $$.b2 = PFRULE_DROP;
1434 $$.b2 = PFRULE_RETURNRST;
1438 | RETURNRST '(' TTL number ')' {
1440 yyerror("illegal ttl value %d", $4);
1443 $$.b2 = PFRULE_RETURNRST;
1448 $$.b2 = PFRULE_RETURNICMP;
1449 $$.w = returnicmpdefault;
1450 $$.w2 = returnicmp6default;
1453 $$.b2 = PFRULE_RETURNICMP;
1454 $$.w = returnicmpdefault;
1455 $$.w2 = returnicmp6default;
1457 | RETURNICMP '(' STRING ')' {
1458 $$.b2 = PFRULE_RETURNICMP;
1459 if (!($$.w = parseicmpspec($3, AF_INET))) {
1464 $$.w2 = returnicmp6default;
1466 | RETURNICMP6 '(' STRING ')' {
1467 $$.b2 = PFRULE_RETURNICMP;
1468 $$.w = returnicmpdefault;
1469 if (!($$.w2 = parseicmpspec($3, AF_INET6))) {
1475 | RETURNICMP '(' STRING comma STRING ')' {
1476 $$.b2 = PFRULE_RETURNICMP;
1477 if (!($$.w = parseicmpspec($3, AF_INET)) ||
1478 !($$.w2 = parseicmpspec($5, AF_INET6))) {
1487 $$.b2 = PFRULE_RETURN;
1488 $$.w = returnicmpdefault;
1489 $$.w2 = returnicmp6default;
1493 dir : /* empty */ { $$ = 0; }
1494 | IN { $$ = PF_IN; }
1495 | OUT { $$ = PF_OUT; }
1498 logquick : /* empty */ { $$.log = 0; $$.quick = 0; }
1499 | log { $$.log = $1; $$.quick = 0; }
1500 | QUICK { $$.log = 0; $$.quick = 1; }
1501 | log QUICK { $$.log = $1; $$.quick = 1; }
1502 | QUICK log { $$.log = $2; $$.quick = 1; }
1505 log : LOG { $$ = 1; }
1506 | LOGALL { $$ = 2; }
1509 interface : /* empty */ { $$ = NULL; }
1510 | ON if_item_not { $$ = $2; }
1511 | ON '{' if_list '}' { $$ = $3; }
1514 if_list : if_item_not { $$ = $1; }
1515 | if_list comma if_item_not {
1516 $1->tail->next = $3;
1522 if_item_not : not if_item { $$ = $2; $$->not = $1; }
1526 struct node_host *n;
1528 if ((n = ifa_exists($1, 1)) == NULL) {
1529 yyerror("unknown interface %s", $1);
1533 $$ = calloc(1, sizeof(struct node_if));
1535 err(1, "if_item: calloc");
1536 if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
1537 sizeof($$->ifname)) {
1540 yyerror("interface name too long");
1544 $$->ifa_flags = n->ifa_flags;
1551 af : /* empty */ { $$ = 0; }
1552 | INET { $$ = AF_INET; }
1553 | INET6 { $$ = AF_INET6; }
1556 proto : /* empty */ { $$ = NULL; }
1557 | PROTO proto_item { $$ = $2; }
1558 | PROTO '{' proto_list '}' { $$ = $3; }
1561 proto_list : proto_item { $$ = $1; }
1562 | proto_list comma proto_item {
1563 $1->tail->next = $3;
1569 proto_item : STRING {
1573 if (atoul($1, &ulval) == 0) {
1575 yyerror("protocol outside range");
1579 pr = (u_int8_t)ulval;
1583 p = getprotobyname($1);
1585 yyerror("unknown protocol %s", $1);
1593 yyerror("proto 0 cannot be used");
1596 $$ = calloc(1, sizeof(struct node_proto));
1598 err(1, "proto_item: calloc");
1619 os : /* empty */ { $$ = NULL; }
1620 | OS xos { $$ = $2; }
1621 | OS '{' os_list '}' { $$ = $3; }
1625 $$ = calloc(1, sizeof(struct node_os));
1627 err(1, "os: calloc");
1633 os_list : xos { $$ = $1; }
1634 | os_list comma xos {
1635 $1->tail->next = $3;
1641 from : /* empty */ {
1659 ipportspec : ipspec {
1663 | ipspec PORT portspec {
1673 ipspec : ANY { $$ = NULL; }
1674 | xhost { $$ = $1; }
1675 | '{' host_list '}' { $$ = $2; }
1678 host_list : xhost { $$ = $1; }
1679 | host_list comma xhost {
1682 else if ($1 == NULL)
1685 $1->tail->next = $3;
1686 $1->tail = $3->tail;
1693 struct node_host *n;
1695 for (n = $2; n != NULL; n = n->next)
1700 $$ = calloc(1, sizeof(struct node_host));
1702 err(1, "xhost: calloc");
1703 $$->addr.type = PF_ADDR_NOROUTE;
1710 if (($$ = host($1)) == NULL) {
1711 /* error. "any" is handled elsewhere */
1713 yyerror("could not parse host specification");
1719 | STRING '/' number {
1722 if (asprintf(&buf, "%s/%u", $1, $3) == -1)
1723 err(1, "host: asprintf");
1725 if (($$ = host(buf)) == NULL) {
1726 /* error. "any" is handled elsewhere */
1728 yyerror("could not parse host specification");
1734 | dynaddr '/' number {
1735 struct node_host *n;
1738 for (n = $1; n != NULL; n = n->next)
1742 if (strlen($2) >= PF_TABLE_NAME_SIZE) {
1743 yyerror("table name '%s' too long", $2);
1747 $$ = calloc(1, sizeof(struct node_host));
1749 err(1, "host: calloc");
1750 $$->addr.type = PF_ADDR_TABLE;
1751 if (strlcpy($$->addr.v.tblname, $2,
1752 sizeof($$->addr.v.tblname)) >=
1753 sizeof($$->addr.v.tblname))
1754 errx(1, "host: strlcpy");
1764 if (atoul($1, &ulval) == -1) {
1765 yyerror("%s is not a number", $1);
1774 dynaddr : '(' STRING ')' {
1779 while ((p = strrchr($2, ':')) != NULL) {
1780 if (!strcmp(p+1, "network"))
1781 flags |= PFI_AFLAG_NETWORK;
1782 else if (!strcmp(p+1, "broadcast"))
1783 flags |= PFI_AFLAG_BROADCAST;
1784 else if (!strcmp(p+1, "peer"))
1785 flags |= PFI_AFLAG_PEER;
1786 else if (!strcmp(p+1, "0"))
1787 flags |= PFI_AFLAG_NOALIAS;
1789 yyerror("interface %s has bad modifier",
1796 if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
1798 yyerror("illegal combination of "
1799 "interface modifiers");
1802 if (ifa_exists($2, 1) == NULL && strcmp($2, "self")) {
1803 yyerror("interface %s does not exist", $2);
1807 $$ = calloc(1, sizeof(struct node_host));
1809 err(1, "address: calloc");
1811 set_ipmask($$, 128);
1812 $$->addr.type = PF_ADDR_DYNIFTL;
1813 $$->addr.iflags = flags;
1814 if (strlcpy($$->addr.v.ifname, $2,
1815 sizeof($$->addr.v.ifname)) >=
1816 sizeof($$->addr.v.ifname)) {
1819 yyerror("interface name too long");
1828 portspec : port_item { $$ = $1; }
1829 | '{' port_list '}' { $$ = $2; }
1832 port_list : port_item { $$ = $1; }
1833 | port_list comma port_item {
1834 $1->tail->next = $3;
1841 $$ = calloc(1, sizeof(struct node_port));
1843 err(1, "port_item: calloc");
1855 yyerror("':' cannot be used with an other "
1859 $$ = calloc(1, sizeof(struct node_port));
1861 err(1, "port_item: calloc");
1868 | port PORTBINARY port {
1870 yyerror("':' cannot be used with an other "
1874 $$ = calloc(1, sizeof(struct node_port));
1876 err(1, "port_item: calloc");
1886 char *p = strchr($1, ':');
1887 struct servent *s = NULL;
1891 if (atoul($1, &ulval) == 0) {
1892 if (ulval > 65535) {
1894 yyerror("illegal port value %d",
1898 $$.a = htons(ulval);
1900 s = getservbyname($1, "tcp");
1902 s = getservbyname($1, "udp");
1904 yyerror("unknown port %s", $1);
1916 if ((port[0] = getservice($1)) == -1 ||
1917 (port[1] = getservice(p)) == -1) {
1929 uids : uid_item { $$ = $1; }
1930 | '{' uid_list '}' { $$ = $2; }
1933 uid_list : uid_item { $$ = $1; }
1934 | uid_list comma uid_item {
1935 $1->tail->next = $3;
1942 $$ = calloc(1, sizeof(struct node_uid));
1944 err(1, "uid_item: calloc");
1952 if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
1953 yyerror("user unknown requires operator = or "
1957 $$ = calloc(1, sizeof(struct node_uid));
1959 err(1, "uid_item: calloc");
1966 | uid PORTBINARY uid {
1967 if ($1 == UID_MAX || $3 == UID_MAX) {
1968 yyerror("user unknown requires operator = or "
1972 $$ = calloc(1, sizeof(struct node_uid));
1974 err(1, "uid_item: calloc");
1986 if (atoul($1, &ulval) == -1) {
1987 if (!strcmp($1, "unknown"))
1992 if ((pw = getpwnam($1)) == NULL) {
1993 yyerror("unknown user %s", $1);
2000 if (ulval >= UID_MAX) {
2002 yyerror("illegal uid value %lu", ulval);
2011 gids : gid_item { $$ = $1; }
2012 | '{' gid_list '}' { $$ = $2; }
2015 gid_list : gid_item { $$ = $1; }
2016 | gid_list comma gid_item {
2017 $1->tail->next = $3;
2024 $$ = calloc(1, sizeof(struct node_gid));
2026 err(1, "gid_item: calloc");
2034 if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
2035 yyerror("group unknown requires operator = or "
2039 $$ = calloc(1, sizeof(struct node_gid));
2041 err(1, "gid_item: calloc");
2048 | gid PORTBINARY gid {
2049 if ($1 == GID_MAX || $3 == GID_MAX) {
2050 yyerror("group unknown requires operator = or "
2054 $$ = calloc(1, sizeof(struct node_gid));
2056 err(1, "gid_item: calloc");
2068 if (atoul($1, &ulval) == -1) {
2069 if (!strcmp($1, "unknown"))
2074 if ((grp = getgrnam($1)) == NULL) {
2075 yyerror("unknown group %s", $1);
2082 if (ulval >= GID_MAX) {
2083 yyerror("illegal gid value %lu", ulval);
2096 if ((f = parse_flags($1)) < 0) {
2097 yyerror("bad flags %s", $1);
2106 flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; }
2107 | FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; }
2110 icmpspec : ICMPTYPE icmp_item { $$ = $2; }
2111 | ICMPTYPE '{' icmp_list '}' { $$ = $3; }
2112 | ICMP6TYPE icmp6_item { $$ = $2; }
2113 | ICMP6TYPE '{' icmp6_list '}' { $$ = $3; }
2116 icmp_list : icmp_item { $$ = $1; }
2117 | icmp_list comma icmp_item {
2118 $1->tail->next = $3;
2124 icmp6_list : icmp6_item { $$ = $1; }
2125 | icmp6_list comma icmp6_item {
2126 $1->tail->next = $3;
2132 icmp_item : icmptype {
2133 $$ = calloc(1, sizeof(struct node_icmp));
2135 err(1, "icmp_item: calloc");
2138 $$->proto = IPPROTO_ICMP;
2142 | icmptype CODE STRING {
2143 const struct icmpcodeent *p;
2146 if (atoul($3, &ulval) == 0) {
2149 yyerror("illegal icmp-code %d", ulval);
2153 if ((p = geticmpcodebyname($1-1, $3,
2154 AF_INET)) == NULL) {
2155 yyerror("unknown icmp-code %s", $3);
2162 $$ = calloc(1, sizeof(struct node_icmp));
2164 err(1, "icmp_item: calloc");
2166 $$->code = ulval + 1;
2167 $$->proto = IPPROTO_ICMP;
2173 icmp6_item : icmp6type {
2174 $$ = calloc(1, sizeof(struct node_icmp));
2176 err(1, "icmp_item: calloc");
2179 $$->proto = IPPROTO_ICMPV6;
2183 | icmp6type CODE STRING {
2184 const struct icmpcodeent *p;
2187 if (atoul($3, &ulval) == 0) {
2189 yyerror("illegal icmp6-code %ld",
2195 if ((p = geticmpcodebyname($1-1, $3,
2196 AF_INET6)) == NULL) {
2197 yyerror("unknown icmp6-code %s", $3);
2204 $$ = calloc(1, sizeof(struct node_icmp));
2206 err(1, "icmp_item: calloc");
2208 $$->code = ulval + 1;
2209 $$->proto = IPPROTO_ICMPV6;
2216 const struct icmptypeent *p;
2219 if (atoul($1, &ulval) == 0) {
2221 yyerror("illegal icmp-type %d", ulval);
2227 if ((p = geticmptypebyname($1, AF_INET)) ==
2229 yyerror("unknown icmp-type %s", $1);
2239 icmp6type : STRING {
2240 const struct icmptypeent *p;
2243 if (atoul($1, &ulval) == 0) {
2245 yyerror("illegal icmp6-type %d", ulval);
2251 if ((p = geticmptypebyname($1, AF_INET6)) ==
2253 yyerror("unknown icmp6-type %s", $1);
2264 if (!strcmp($2, "lowdelay"))
2265 $$ = IPTOS_LOWDELAY;
2266 else if (!strcmp($2, "throughput"))
2267 $$ = IPTOS_THROUGHPUT;
2268 else if (!strcmp($2, "reliability"))
2269 $$ = IPTOS_RELIABILITY;
2270 else if ($2[0] == '0' && $2[1] == 'x')
2271 $$ = strtoul($2, NULL, 16);
2273 $$ = strtoul($2, NULL, 10);
2274 if (!$$ || $$ > 255) {
2275 yyerror("illegal tos value %s", $2);
2283 sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; }
2284 | SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; }
2285 | SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; }
2288 statelock : IFBOUND {
2289 $$ = PFRULE_IFBOUND;
2292 $$ = PFRULE_GRBOUND;
2299 keep : KEEP STATE state_opt_spec {
2300 $$.action = PF_STATE_NORMAL;
2303 | MODULATE STATE state_opt_spec {
2304 $$.action = PF_STATE_MODULATE;
2307 | SYNPROXY STATE state_opt_spec {
2308 $$.action = PF_STATE_SYNPROXY;
2313 state_opt_spec : '(' state_opt_list ')' { $$ = $2; }
2314 | /* empty */ { $$ = NULL; }
2317 state_opt_list : state_opt_item { $$ = $1; }
2318 | state_opt_list comma state_opt_item {
2319 $1->tail->next = $3;
2325 state_opt_item : MAXIMUM number {
2326 $$ = calloc(1, sizeof(struct node_state_opt));
2328 err(1, "state_opt_item: calloc");
2329 $$->type = PF_STATE_OPT_MAX;
2330 $$->data.max_states = $2;
2335 $$ = calloc(1, sizeof(struct node_state_opt));
2337 err(1, "state_opt_item: calloc");
2338 $$->type = PF_STATE_OPT_NOSYNC;
2342 | MAXSRCSTATES number {
2343 $$ = calloc(1, sizeof(struct node_state_opt));
2345 err(1, "state_opt_item: calloc");
2346 $$->type = PF_STATE_OPT_MAX_SRC_STATES;
2347 $$->data.max_src_states = $2;
2351 | MAXSRCNODES number {
2352 $$ = calloc(1, sizeof(struct node_state_opt));
2354 err(1, "state_opt_item: calloc");
2355 $$->type = PF_STATE_OPT_MAX_SRC_NODES;
2356 $$->data.max_src_nodes = $2;
2361 $$ = calloc(1, sizeof(struct node_state_opt));
2363 err(1, "state_opt_item: calloc");
2364 $$->type = PF_STATE_OPT_SRCTRACK;
2365 $$->data.src_track = $1;
2370 $$ = calloc(1, sizeof(struct node_state_opt));
2372 err(1, "state_opt_item: calloc");
2373 $$->type = PF_STATE_OPT_STATELOCK;
2374 $$->data.statelock = $1;
2381 for (i = 0; pf_timeouts[i].name &&
2382 strcmp(pf_timeouts[i].name, $1); ++i)
2384 if (!pf_timeouts[i].name) {
2385 yyerror("illegal timeout name %s", $1);
2389 if (strchr(pf_timeouts[i].name, '.') == NULL) {
2390 yyerror("illegal state timeout %s", $1);
2395 $$ = calloc(1, sizeof(struct node_state_opt));
2397 err(1, "state_opt_item: calloc");
2398 $$->type = PF_STATE_OPT_TIMEOUT;
2399 $$->data.timeout.number = pf_timeouts[i].timeout;
2400 $$->data.timeout.seconds = $2;
2406 label : LABEL STRING {
2411 no : /* empty */ { $$ = 0; }
2416 char *p = strchr($1, ':');
2419 if (($$.a = getservice($1)) == -1) {
2424 } else if (!strcmp(p+1, "*")) {
2426 if (($$.a = getservice($1)) == -1) {
2434 if (($$.a = getservice($1)) == -1 ||
2435 ($$.b = getservice(p)) == -1) {
2447 redirspec : host { $$ = $1; }
2448 | '{' redir_host_list '}' { $$ = $2; }
2451 redir_host_list : host { $$ = $1; }
2452 | redir_host_list comma host {
2453 $1->tail->next = $3;
2454 $1->tail = $3->tail;
2459 redirpool : /* empty */ { $$ = NULL; }
2461 $$ = calloc(1, sizeof(struct redirection));
2463 err(1, "redirection: calloc");
2465 $$->rport.a = $$->rport.b = $$->rport.t = 0;
2467 | ARROW redirspec PORT rport {
2468 $$ = calloc(1, sizeof(struct redirection));
2470 err(1, "redirection: calloc");
2476 hashkey : /* empty */
2478 $$ = calloc(1, sizeof(struct pf_poolhashkey));
2480 err(1, "hashkey: calloc");
2481 $$->key32[0] = arc4random();
2482 $$->key32[1] = arc4random();
2483 $$->key32[2] = arc4random();
2484 $$->key32[3] = arc4random();
2488 if (!strncmp($1, "0x", 2)) {
2489 if (strlen($1) != 34) {
2491 yyerror("hex key must be 128 bits "
2492 "(32 hex digits) long");
2495 $$ = calloc(1, sizeof(struct pf_poolhashkey));
2497 err(1, "hashkey: calloc");
2499 if (sscanf($1, "0x%8x%8x%8x%8x",
2500 &$$->key32[0], &$$->key32[1],
2501 &$$->key32[2], &$$->key32[3]) != 4) {
2504 yyerror("invalid hex key");
2510 $$ = calloc(1, sizeof(struct pf_poolhashkey));
2512 err(1, "hashkey: calloc");
2514 MD5Update(&context, (unsigned char *)$1,
2516 MD5Final((unsigned char *)$$, &context);
2517 $$->key32[0] = htonl($$->key32[0]);
2518 $$->key32[1] = htonl($$->key32[1]);
2519 $$->key32[2] = htonl($$->key32[2]);
2520 $$->key32[3] = htonl($$->key32[3]);
2526 pool_opts : { bzero(&pool_opts, sizeof pool_opts); }
2530 bzero(&pool_opts, sizeof pool_opts);
2535 pool_opts_l : pool_opts_l pool_opt
2539 pool_opt : BITMASK {
2540 if (pool_opts.type) {
2541 yyerror("pool type cannot be redefined");
2544 pool_opts.type = PF_POOL_BITMASK;
2547 if (pool_opts.type) {
2548 yyerror("pool type cannot be redefined");
2551 pool_opts.type = PF_POOL_RANDOM;
2553 | SOURCEHASH hashkey {
2554 if (pool_opts.type) {
2555 yyerror("pool type cannot be redefined");
2558 pool_opts.type = PF_POOL_SRCHASH;
2562 if (pool_opts.type) {
2563 yyerror("pool type cannot be redefined");
2566 pool_opts.type = PF_POOL_ROUNDROBIN;
2569 if (pool_opts.staticport) {
2570 yyerror("static-port cannot be redefined");
2573 pool_opts.staticport = 1;
2576 if (filter_opts.marker & POM_STICKYADDRESS) {
2577 yyerror("sticky-address cannot be redefined");
2580 pool_opts.marker |= POM_STICKYADDRESS;
2581 pool_opts.opts |= PF_POOL_STICKYADDR;
2585 redirection : /* empty */ { $$ = NULL; }
2587 $$ = calloc(1, sizeof(struct redirection));
2589 err(1, "redirection: calloc");
2591 $$->rport.a = $$->rport.b = $$->rport.t = 0;
2593 | ARROW host PORT rport {
2594 $$ = calloc(1, sizeof(struct redirection));
2596 err(1, "redirection: calloc");
2602 natpass : /* empty */ { $$ = 0; }
2606 nataction : no NAT natpass {
2624 natrule : nataction interface af proto fromto tag redirpool pool_opts
2628 if (check_rulestate(PFCTL_STATE_NAT))
2631 memset(&r, 0, sizeof(r));
2638 if ($5.src.host && $5.src.host->af &&
2639 !$5.src.host->ifindex)
2640 r.af = $5.src.host->af;
2641 else if ($5.dst.host && $5.dst.host->af &&
2642 !$5.dst.host->ifindex)
2643 r.af = $5.dst.host->af;
2647 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
2649 yyerror("tag too long, max %u chars",
2650 PF_TAG_NAME_SIZE - 1);
2654 if (r.action == PF_NONAT || r.action == PF_NORDR) {
2656 yyerror("translation rule with 'no' "
2657 "does not need '->'");
2661 if ($7 == NULL || $7->host == NULL) {
2662 yyerror("translation rule requires '-> "
2666 if (!r.af && ! $7->host->ifindex)
2667 r.af = $7->host->af;
2669 remove_invalid_hosts(&$7->host, &r.af);
2670 if (invalid_redirect($7->host, r.af))
2672 if (check_netmask($7->host, r.af))
2675 r.rpool.proxy_port[0] = ntohs($7->rport.a);
2679 if (!$7->rport.b && $7->rport.t &&
2680 $5.dst.port != NULL) {
2681 r.rpool.proxy_port[1] =
2682 ntohs($7->rport.a) +
2684 $5.dst.port->port[1]) -
2686 $5.dst.port->port[0]));
2688 r.rpool.proxy_port[1] =
2692 r.rpool.proxy_port[1] =
2694 if (!r.rpool.proxy_port[0] &&
2695 !r.rpool.proxy_port[1]) {
2696 r.rpool.proxy_port[0] =
2697 PF_NAT_PROXY_PORT_LOW;
2698 r.rpool.proxy_port[1] =
2699 PF_NAT_PROXY_PORT_HIGH;
2700 } else if (!r.rpool.proxy_port[1])
2701 r.rpool.proxy_port[1] =
2702 r.rpool.proxy_port[0];
2708 r.rpool.opts = $8.type;
2709 if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
2710 PF_POOL_NONE && ($7->host->next != NULL ||
2711 $7->host->addr.type == PF_ADDR_TABLE ||
2712 DYNIF_MULTIADDR($7->host->addr)))
2713 r.rpool.opts = PF_POOL_ROUNDROBIN;
2714 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2715 PF_POOL_ROUNDROBIN &&
2716 disallow_table($7->host, "tables are only "
2717 "supported in round-robin redirection "
2720 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2721 PF_POOL_ROUNDROBIN &&
2722 disallow_alias($7->host, "interface (%s) "
2723 "is only supported in round-robin "
2724 "redirection pools"))
2726 if ($7->host->next != NULL) {
2727 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2728 PF_POOL_ROUNDROBIN) {
2729 yyerror("only round-robin "
2730 "valid for multiple "
2731 "redirection addresses");
2738 memcpy(&r.rpool.key, $8.key,
2739 sizeof(struct pf_poolhashkey));
2742 r.rpool.opts |= $8.opts;
2744 if ($8.staticport) {
2745 if (r.action != PF_NAT) {
2746 yyerror("the 'static-port' option is "
2747 "only valid with nat rules");
2750 if (r.rpool.proxy_port[0] !=
2751 PF_NAT_PROXY_PORT_LOW &&
2752 r.rpool.proxy_port[1] !=
2753 PF_NAT_PROXY_PORT_HIGH) {
2754 yyerror("the 'static-port' option can't"
2755 " be used when specifying a port"
2759 r.rpool.proxy_port[0] = 0;
2760 r.rpool.proxy_port[1] = 0;
2763 expand_rule(&r, $2, $7 == NULL ? NULL : $7->host, $4,
2764 $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
2765 $5.dst.port, 0, 0, 0);
2770 binatrule : no BINAT natpass interface af proto FROM host TO ipspec tag
2773 struct pf_rule binat;
2774 struct pf_pooladdr *pa;
2776 if (check_rulestate(PFCTL_STATE_NAT))
2779 memset(&binat, 0, sizeof(binat));
2782 binat.action = PF_NOBINAT;
2784 binat.action = PF_BINAT;
2787 if (!binat.af && $8 != NULL && $8->af)
2789 if (!binat.af && $10 != NULL && $10->af)
2791 if (!binat.af && $12 != NULL && $12->host)
2792 binat.af = $12->host->af;
2794 yyerror("address family (inet/inet6) "
2800 memcpy(binat.ifname, $4->ifname,
2801 sizeof(binat.ifname));
2802 binat.ifnot = $4->not;
2806 if (strlcpy(binat.tagname, $11,
2807 PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2808 yyerror("tag too long, max %u chars",
2809 PF_TAG_NAME_SIZE - 1);
2814 binat.proto = $6->proto;
2818 if ($8 != NULL && disallow_table($8, "invalid use of "
2819 "table <%s> as the source address of a binat rule"))
2821 if ($8 != NULL && disallow_alias($8, "invalid use of "
2822 "interface (%s) as the source address of a binat "
2825 if ($12 != NULL && $12->host != NULL && disallow_table(
2826 $12->host, "invalid use of table <%s> as the "
2827 "redirect address of a binat rule"))
2829 if ($12 != NULL && $12->host != NULL && disallow_alias(
2830 $12->host, "invalid use of interface (%s) as the "
2831 "redirect address of a binat rule"))
2836 yyerror("multiple binat ip addresses");
2839 if ($8->addr.type == PF_ADDR_DYNIFTL)
2841 if ($8->af != binat.af) {
2842 yyerror("binat ip versions must match");
2845 if (check_netmask($8, binat.af))
2847 memcpy(&binat.src.addr, &$8->addr,
2848 sizeof(binat.src.addr));
2853 yyerror("multiple binat ip addresses");
2856 if ($10->af != binat.af && $10->af) {
2857 yyerror("binat ip versions must match");
2860 if (check_netmask($10, binat.af))
2862 memcpy(&binat.dst.addr, &$10->addr,
2863 sizeof(binat.dst.addr));
2864 binat.dst.not = $10->not;
2868 if (binat.action == PF_NOBINAT) {
2870 yyerror("'no binat' rule does not need"
2875 if ($12 == NULL || $12->host == NULL) {
2876 yyerror("'binat' rule requires"
2881 remove_invalid_hosts(&$12->host, &binat.af);
2882 if (invalid_redirect($12->host, binat.af))
2884 if ($12->host->next != NULL) {
2885 yyerror("binat rule must redirect to "
2886 "a single address");
2889 if (check_netmask($12->host, binat.af))
2892 if (!PF_AZERO(&binat.src.addr.v.a.mask,
2894 !PF_AEQ(&binat.src.addr.v.a.mask,
2895 &$12->host->addr.v.a.mask, binat.af)) {
2896 yyerror("'binat' source mask and "
2897 "redirect mask must be the same");
2901 TAILQ_INIT(&binat.rpool.list);
2902 pa = calloc(1, sizeof(struct pf_pooladdr));
2904 err(1, "binat: calloc");
2905 pa->addr = $12->host->addr;
2907 TAILQ_INSERT_TAIL(&binat.rpool.list,
2913 pfctl_add_rule(pf, &binat);
2917 tag : /* empty */ { $$ = NULL; }
2918 | TAG STRING { $$ = $2; }
2921 route_host : STRING {
2922 $$ = calloc(1, sizeof(struct node_host));
2924 err(1, "route_host: calloc");
2926 if (ifa_exists($$->ifname, 0) == NULL) {
2927 yyerror("routeto: unknown interface %s",
2933 set_ipmask($$, 128);
2937 | '(' STRING host ')' {
2940 if (ifa_exists($$->ifname, 0) == NULL) {
2941 yyerror("routeto: unknown interface %s",
2948 route_host_list : route_host { $$ = $1; }
2949 | route_host_list comma route_host {
2952 if ($1->af != $3->af) {
2953 yyerror("all pool addresses must be in the "
2954 "same address family");
2957 $1->tail->next = $3;
2958 $1->tail = $3->tail;
2963 routespec : route_host { $$ = $1; }
2964 | '{' route_host_list '}' { $$ = $2; }
2967 route : /* empty */ {
2974 $$.rt = PF_FASTROUTE;
2977 | ROUTETO routespec pool_opts {
2980 $$.pool_opts = $3.type | $3.opts;
2984 | REPLYTO routespec pool_opts {
2987 $$.pool_opts = $3.type | $3.opts;
2991 | DUPTO routespec pool_opts {
2994 $$.pool_opts = $3.type | $3.opts;
3000 timeout_spec : STRING number
3002 if (check_rulestate(PFCTL_STATE_OPTION)) {
3006 if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
3007 yyerror("unknown timeout %s", $1);
3015 timeout_list : timeout_list comma timeout_spec
3019 limit_spec : STRING number
3021 if (check_rulestate(PFCTL_STATE_OPTION)) {
3025 if (pfctl_set_limit(pf, $1, $2) != 0) {
3026 yyerror("unable to set limit %s %u", $1, $2);
3034 limit_list : limit_list comma limit_spec
3042 yesno : NO { $$ = 0; }
3044 if (!strcmp($1, "yes"))
3054 unaryop : '=' { $$ = PF_OP_EQ; }
3055 | '!' '=' { $$ = PF_OP_NE; }
3056 | '<' '=' { $$ = PF_OP_LE; }
3057 | '<' { $$ = PF_OP_LT; }
3058 | '>' '=' { $$ = PF_OP_GE; }
3059 | '>' { $$ = PF_OP_GT; }
3065 yyerror(const char *fmt, ...)
3071 fprintf(stderr, "%s:%d: ", infile, yylval.lineno);
3072 vfprintf(stderr, fmt, ap);
3073 fprintf(stderr, "\n");
3079 disallow_table(struct node_host *h, const char *fmt)
3081 for (; h != NULL; h = h->next)
3082 if (h->addr.type == PF_ADDR_TABLE) {
3083 yyerror(fmt, h->addr.v.tblname);
3090 disallow_alias(struct node_host *h, const char *fmt)
3092 for (; h != NULL; h = h->next)
3093 if (DYNIF_MULTIADDR(h->addr)) {
3094 yyerror(fmt, h->addr.v.tblname);
3101 rule_consistent(struct pf_rule *r)
3105 switch (r->action) {
3109 problems = filter_consistent(r);
3113 problems = nat_consistent(r);
3117 problems = rdr_consistent(r);
3128 filter_consistent(struct pf_rule *r)
3132 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
3133 (r->src.port_op || r->dst.port_op)) {
3134 yyerror("port only applies to tcp/udp");
3137 if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
3138 (r->type || r->code)) {
3139 yyerror("icmp-type/code only applies to icmp");
3142 if (!r->af && (r->type || r->code)) {
3143 yyerror("must indicate address family with icmp-type/code");
3146 if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
3147 (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
3148 yyerror("proto %s doesn't match address family %s",
3149 r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
3150 r->af == AF_INET ? "inet" : "inet6");
3153 if (r->allow_opts && r->action != PF_PASS) {
3154 yyerror("allow-opts can only be specified for pass rules");
3157 if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
3158 r->dst.port_op || r->flagset || r->type || r->code)) {
3159 yyerror("fragments can be filtered only on IP header fields");
3162 if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
3163 yyerror("return-rst can only be applied to TCP rules");
3166 if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
3167 yyerror("max-src-nodes requires 'source-track rule'");
3170 if (r->action == PF_DROP && r->keep_state) {
3171 yyerror("keep state on block rules doesn't make sense");
3174 if ((r->tagname[0] || r->match_tagname[0]) && !r->keep_state &&
3175 r->action == PF_PASS && !r->anchorname[0]) {
3176 yyerror("tags cannot be used without keep state");
3183 nat_consistent(struct pf_rule *r __unused)
3185 return (0); /* yeah! */
3189 rdr_consistent(struct pf_rule *r)
3193 if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
3194 if (r->src.port_op) {
3195 yyerror("src port only applies to tcp/udp");
3198 if (r->dst.port_op) {
3199 yyerror("dst port only applies to tcp/udp");
3202 if (r->rpool.proxy_port[0]) {
3203 yyerror("rpool port only applies to tcp/udp");
3207 if (r->dst.port_op &&
3208 r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
3209 yyerror("invalid port operator for rdr destination port");
3216 process_tabledef(char *name, struct table_opts *opts)
3218 struct pfr_buffer ab;
3219 struct node_tinit *ti;
3221 bzero(&ab, sizeof(ab));
3222 ab.pfrb_type = PFRB_ADDRS;
3223 SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
3225 if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
3227 yyerror("cannot load \"%s\": %s",
3228 ti->file, strerror(errno));
3230 yyerror("file \"%s\" contains bad data",
3235 if (append_addr_host(&ab, ti->host, 0, 0)) {
3236 yyerror("cannot create address buffer: %s",
3241 if (pf->opts & PF_OPT_VERBOSE)
3242 print_tabledef(name, opts->flags, opts->init_addr,
3244 if (!(pf->opts & PF_OPT_NOACTION) &&
3245 pfctl_define_table(name, opts->flags, opts->init_addr,
3246 pf->anchor, pf->ruleset, &ab, pf->tticket)) {
3247 yyerror("cannot define table %s: %s", name,
3248 pfr_strerror(errno));
3264 /* macro gore, but you should've seen the prior indentation nightmare... */
3266 #define FREE_LIST(T,r) \
3269 while (node != NULL) { \
3271 node = node->next; \
3276 #define LOOP_THROUGH(T,n,r,C) \
3280 r = calloc(1, sizeof(T)); \
3282 err(1, "LOOP: calloc"); \
3286 while (n != NULL) { \
3295 expand_label_str(char *label, size_t len, const char *srch, const char *repl)
3300 if ((tmp = calloc(1, len)) == NULL)
3301 err(1, "expand_label_str: calloc");
3303 while ((q = strstr(p, srch)) != NULL) {
3305 if ((strlcat(tmp, p, len) >= len) ||
3306 (strlcat(tmp, repl, len) >= len))
3307 errx(1, "expand_label: label too long");
3311 if (strlcat(tmp, p, len) >= len)
3312 errx(1, "expand_label: label too long");
3313 strlcpy(label, tmp, len); /* always fits */
3318 expand_label_if(const char *name, char *label, size_t len, const char *ifname)
3320 if (strstr(label, name) != NULL) {
3322 expand_label_str(label, len, name, "any");
3324 expand_label_str(label, len, name, ifname);
3329 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
3330 struct node_host *h)
3332 char tmp[64], tmp_not[66];
3334 if (strstr(label, name) != NULL) {
3335 switch (h->addr.type) {
3336 case PF_ADDR_DYNIFTL:
3337 snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
3340 snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
3342 case PF_ADDR_NOROUTE:
3343 snprintf(tmp, sizeof(tmp), "no-route");
3345 case PF_ADDR_ADDRMASK:
3346 if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
3347 PF_AZERO(&h->addr.v.a.mask, af)))
3348 snprintf(tmp, sizeof(tmp), "any");
3353 if (inet_ntop(af, &h->addr.v.a.addr, a,
3355 snprintf(tmp, sizeof(tmp), "?");
3357 bits = unmask(&h->addr.v.a.mask, af);
3358 if ((af == AF_INET && bits < 32) ||
3359 (af == AF_INET6 && bits < 128))
3360 snprintf(tmp, sizeof(tmp),
3363 snprintf(tmp, sizeof(tmp),
3369 snprintf(tmp, sizeof(tmp), "?");
3374 snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
3375 expand_label_str(label, len, name, tmp_not);
3377 expand_label_str(label, len, name, tmp);
3382 expand_label_port(const char *name, char *label, size_t len,
3383 struct node_port *port)
3385 char a1[6], a2[6], op[13] = "";
3387 if (strstr(label, name) != NULL) {
3388 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
3389 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
3392 else if (port->op == PF_OP_IRG)
3393 snprintf(op, sizeof(op), "%s><%s", a1, a2);
3394 else if (port->op == PF_OP_XRG)
3395 snprintf(op, sizeof(op), "%s<>%s", a1, a2);
3396 else if (port->op == PF_OP_EQ)
3397 snprintf(op, sizeof(op), "%s", a1);
3398 else if (port->op == PF_OP_NE)
3399 snprintf(op, sizeof(op), "!=%s", a1);
3400 else if (port->op == PF_OP_LT)
3401 snprintf(op, sizeof(op), "<%s", a1);
3402 else if (port->op == PF_OP_LE)
3403 snprintf(op, sizeof(op), "<=%s", a1);
3404 else if (port->op == PF_OP_GT)
3405 snprintf(op, sizeof(op), ">%s", a1);
3406 else if (port->op == PF_OP_GE)
3407 snprintf(op, sizeof(op), ">=%s", a1);
3408 expand_label_str(label, len, name, op);
3413 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
3415 struct protoent *pe;
3418 if (strstr(label, name) != NULL) {
3419 pe = getprotobynumber(proto);
3421 expand_label_str(label, len, name, pe->p_name);
3423 snprintf(n, sizeof(n), "%u", proto);
3424 expand_label_str(label, len, name, n);
3430 expand_label_nr(const char *name, char *label, size_t len)
3434 if (strstr(label, name) != NULL) {
3435 snprintf(n, sizeof(n), "%u", pf->rule_nr);
3436 expand_label_str(label, len, name, n);
3441 expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
3442 struct node_host *src_host, struct node_port *src_port,
3443 struct node_host *dst_host, struct node_port *dst_port,
3446 expand_label_if("$if", label, len, ifname);
3447 expand_label_addr("$srcaddr", label, len, af, src_host);
3448 expand_label_addr("$dstaddr", label, len, af, dst_host);
3449 expand_label_port("$srcport", label, len, src_port);
3450 expand_label_port("$dstport", label, len, dst_port);
3451 expand_label_proto("$proto", label, len, proto);
3452 expand_label_nr("$nr", label, len);
3455 #ifndef __DragonFly__
3457 expand_altq(struct pf_altq *a, struct node_if *interfaces,
3458 struct node_queue *nqueues, struct node_queue_bw bwspec,
3459 struct node_queue_opt *opts)
3461 struct pf_altq pa, pb;
3462 char qname[PF_QNAME_SIZE];
3463 struct node_queue *n;
3464 struct node_queue_bw bw;
3467 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
3468 FREE_LIST(struct node_if, interfaces);
3469 FREE_LIST(struct node_queue, nqueues);
3473 LOOP_THROUGH(struct node_if, interface, interfaces,
3474 memcpy(&pa, a, sizeof(struct pf_altq));
3475 if (strlcpy(pa.ifname, interface->ifname,
3476 sizeof(pa.ifname)) >= sizeof(pa.ifname))
3477 errx(1, "expand_altq: strlcpy");
3479 if (interface->not) {
3480 yyerror("altq on ! <interface> is not supported");
3483 if (eval_pfaltq(pf, &pa, &bwspec, opts))
3486 if (pfctl_add_altq(pf, &pa))
3489 if (pf->opts & PF_OPT_VERBOSE) {
3490 print_altq(&pf->paltq->altq, 0,
3492 if (nqueues && nqueues->tail) {
3494 LOOP_THROUGH(struct node_queue, queue,
3504 if (pa.scheduler == ALTQT_CBQ ||
3505 pa.scheduler == ALTQT_HFSC) {
3506 /* now create a root queue */
3507 memset(&pb, 0, sizeof(struct pf_altq));
3508 if (strlcpy(qname, "root_", sizeof(qname)) >=
3510 errx(1, "expand_altq: strlcpy");
3511 if (strlcat(qname, interface->ifname,
3512 sizeof(qname)) >= sizeof(qname))
3513 errx(1, "expand_altq: strlcat");
3514 if (strlcpy(pb.qname, qname,
3515 sizeof(pb.qname)) >= sizeof(pb.qname))
3516 errx(1, "expand_altq: strlcpy");
3517 if (strlcpy(pb.ifname, interface->ifname,
3518 sizeof(pb.ifname)) >= sizeof(pb.ifname))
3519 errx(1, "expand_altq: strlcpy");
3520 pb.qlimit = pa.qlimit;
3521 pb.scheduler = pa.scheduler;
3522 bw.bw_absolute = pa.ifbandwidth;
3524 if (eval_pfqueue(pf, &pb, &bw, opts))
3527 if (pfctl_add_altq(pf, &pb))
3531 LOOP_THROUGH(struct node_queue, queue, nqueues,
3532 n = calloc(1, sizeof(struct node_queue));
3534 err(1, "expand_altq: calloc");
3535 if (pa.scheduler == ALTQT_CBQ ||
3536 pa.scheduler == ALTQT_HFSC)
3537 if (strlcpy(n->parent, qname,
3538 sizeof(n->parent)) >=
3540 errx(1, "expand_altq: strlcpy");
3541 if (strlcpy(n->queue, queue->queue,
3542 sizeof(n->queue)) >= sizeof(n->queue))
3543 errx(1, "expand_altq: strlcpy");
3544 if (strlcpy(n->ifname, interface->ifname,
3545 sizeof(n->ifname)) >= sizeof(n->ifname))
3546 errx(1, "expand_altq: strlcpy");
3547 n->scheduler = pa.scheduler;
3553 queues->tail->next = n;
3559 FREE_LIST(struct node_if, interfaces);
3560 FREE_LIST(struct node_queue, nqueues);
3566 expand_queue(struct pf_altq *a, struct node_if *interfaces,
3567 struct node_queue *nqueues, struct node_queue_bw bwspec,
3568 struct node_queue_opt *opts)
3570 struct node_queue *n, *nq;
3575 if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
3576 FREE_LIST(struct node_queue, nqueues);
3580 if (queues == NULL) {
3581 yyerror("queue %s has no parent", a->qname);
3582 FREE_LIST(struct node_queue, nqueues);
3586 LOOP_THROUGH(struct node_if, interface, interfaces,
3587 LOOP_THROUGH(struct node_queue, tqueue, queues,
3588 if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
3589 (interface->ifname[0] == 0 ||
3590 (!interface->not && !strncmp(interface->ifname,
3591 tqueue->ifname, IFNAMSIZ)) ||
3592 (interface->not && strncmp(interface->ifname,
3593 tqueue->ifname, IFNAMSIZ)))) {
3594 /* found ourself in queues */
3597 memcpy(&pa, a, sizeof(struct pf_altq));
3599 if (pa.scheduler != ALTQT_NONE &&
3600 pa.scheduler != tqueue->scheduler) {
3601 yyerror("exactly one scheduler type "
3602 "per interface allowed");
3605 pa.scheduler = tqueue->scheduler;
3607 /* scheduler dependent error checking */
3608 switch (pa.scheduler) {
3610 if (nqueues != NULL) {
3611 yyerror("priq queues cannot "
3612 "have child queues");
3615 if (bwspec.bw_absolute > 0 ||
3616 bwspec.bw_percent < 100) {
3617 yyerror("priq doesn't take "
3626 if (strlcpy(pa.ifname, tqueue->ifname,
3627 sizeof(pa.ifname)) >= sizeof(pa.ifname))
3628 errx(1, "expand_queue: strlcpy");
3629 if (strlcpy(pa.parent, tqueue->parent,
3630 sizeof(pa.parent)) >= sizeof(pa.parent))
3631 errx(1, "expand_queue: strlcpy");
3633 if (eval_pfqueue(pf, &pa, &bwspec, opts))
3636 if (pfctl_add_altq(pf, &pa))
3639 for (nq = nqueues; nq != NULL; nq = nq->next) {
3640 if (!strcmp(a->qname, nq->queue)) {
3641 yyerror("queue cannot have "
3647 sizeof(struct node_queue));
3649 err(1, "expand_queue: calloc");
3650 if (strlcpy(n->parent, a->qname,
3651 sizeof(n->parent)) >=
3653 errx(1, "expand_queue strlcpy");
3654 if (strlcpy(n->queue, nq->queue,
3655 sizeof(n->queue)) >=
3657 errx(1, "expand_queue strlcpy");
3658 if (strlcpy(n->ifname, tqueue->ifname,
3659 sizeof(n->ifname)) >=
3661 errx(1, "expand_queue strlcpy");
3662 n->scheduler = tqueue->scheduler;
3668 queues->tail->next = n;
3672 if ((pf->opts & PF_OPT_VERBOSE) && (
3673 (found == 1 && interface->ifname[0] == 0) ||
3674 (found > 0 && interface->ifname[0] != 0))) {
3675 print_queue(&pf->paltq->altq, 0,
3676 &bwspec, interface->ifname[0] != 0,
3678 if (nqueues && nqueues->tail) {
3680 LOOP_THROUGH(struct node_queue,
3693 FREE_LIST(struct node_queue, nqueues);
3694 FREE_LIST(struct node_if, interfaces);
3697 yyerror("queue %s has no parent", a->qname);
3709 expand_rule(struct pf_rule *r,
3710 struct node_if *interfaces, struct node_host *rpool_hosts,
3711 struct node_proto *protos, struct node_os *src_oses,
3712 struct node_host *src_hosts, struct node_port *src_ports,
3713 struct node_host *dst_hosts, struct node_port *dst_ports,
3714 struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types)
3716 sa_family_t af = r->af;
3717 int added = 0, error = 0;
3718 char ifname[IF_NAMESIZE];
3719 char label[PF_RULE_LABEL_SIZE];
3720 char tagname[PF_TAG_NAME_SIZE];
3721 char match_tagname[PF_TAG_NAME_SIZE];
3722 struct pf_pooladdr *pa;
3723 struct node_host *h;
3724 u_int8_t flags, flagset, keep_state;
3726 if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
3727 errx(1, "expand_rule: strlcpy");
3728 if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
3729 errx(1, "expand_rule: strlcpy");
3730 if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
3731 sizeof(match_tagname))
3732 errx(1, "expand_rule: strlcpy");
3734 flagset = r->flagset;
3735 keep_state = r->keep_state;
3737 LOOP_THROUGH(struct node_if, interface, interfaces,
3738 LOOP_THROUGH(struct node_proto, proto, protos,
3739 LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
3740 LOOP_THROUGH(struct node_host, src_host, src_hosts,
3741 LOOP_THROUGH(struct node_port, src_port, src_ports,
3742 LOOP_THROUGH(struct node_os, src_os, src_oses,
3743 LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
3744 LOOP_THROUGH(struct node_port, dst_port, dst_ports,
3745 LOOP_THROUGH(struct node_uid, uid, uids,
3746 LOOP_THROUGH(struct node_gid, gid, gids,
3749 /* for link-local IPv6 address, interface must match up */
3750 if ((r->af && src_host->af && r->af != src_host->af) ||
3751 (r->af && dst_host->af && r->af != dst_host->af) ||
3752 (src_host->af && dst_host->af &&
3753 src_host->af != dst_host->af) ||
3754 (src_host->ifindex && dst_host->ifindex &&
3755 src_host->ifindex != dst_host->ifindex) ||
3756 (src_host->ifindex && *interface->ifname &&
3757 src_host->ifindex != if_nametoindex(interface->ifname)) ||
3758 (dst_host->ifindex && *interface->ifname &&
3759 dst_host->ifindex != if_nametoindex(interface->ifname)))
3761 if (!r->af && src_host->af)
3762 r->af = src_host->af;
3763 else if (!r->af && dst_host->af)
3764 r->af = dst_host->af;
3766 if (*interface->ifname)
3767 memcpy(r->ifname, interface->ifname, sizeof(r->ifname));
3768 else if (if_indextoname(src_host->ifindex, ifname))
3769 memcpy(r->ifname, ifname, sizeof(r->ifname));
3770 else if (if_indextoname(dst_host->ifindex, ifname))
3771 memcpy(r->ifname, ifname, sizeof(r->ifname));
3773 memset(r->ifname, '\0', sizeof(r->ifname));
3775 if (strlcpy(r->label, label, sizeof(r->label)) >=
3777 errx(1, "expand_rule: strlcpy");
3778 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
3780 errx(1, "expand_rule: strlcpy");
3781 if (strlcpy(r->match_tagname, match_tagname,
3782 sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
3783 errx(1, "expand_rule: strlcpy");
3784 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
3785 src_host, src_port, dst_host, dst_port, proto->proto);
3786 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
3787 src_host, src_port, dst_host, dst_port, proto->proto);
3788 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
3789 r->af, src_host, src_port, dst_host, dst_port,
3792 error += check_netmask(src_host, r->af);
3793 error += check_netmask(dst_host, r->af);
3795 r->ifnot = interface->not;
3796 r->proto = proto->proto;
3797 r->src.addr = src_host->addr;
3798 r->src.not = src_host->not;
3799 r->src.port[0] = src_port->port[0];
3800 r->src.port[1] = src_port->port[1];
3801 r->src.port_op = src_port->op;
3802 r->dst.addr = dst_host->addr;
3803 r->dst.not = dst_host->not;
3804 r->dst.port[0] = dst_port->port[0];
3805 r->dst.port[1] = dst_port->port[1];
3806 r->dst.port_op = dst_port->op;
3807 r->uid.op = uid->op;
3808 r->uid.uid[0] = uid->uid[0];
3809 r->uid.uid[1] = uid->uid[1];
3810 r->gid.op = gid->op;
3811 r->gid.gid[0] = gid->gid[0];
3812 r->gid.gid[1] = gid->gid[1];
3813 r->type = icmp_type->type;
3814 r->code = icmp_type->code;
3816 if ((keep_state == PF_STATE_MODULATE ||
3817 keep_state == PF_STATE_SYNPROXY) &&
3818 r->proto && r->proto != IPPROTO_TCP)
3819 r->keep_state = PF_STATE_NORMAL;
3821 r->keep_state = keep_state;
3823 if (r->proto && r->proto != IPPROTO_TCP) {
3828 r->flagset = flagset;
3830 if (icmp_type->proto && r->proto != icmp_type->proto) {
3831 yyerror("icmp-type mismatch");
3835 if (src_os && src_os->os) {
3836 r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
3837 if ((pf->opts & PF_OPT_VERBOSE2) &&
3838 r->os_fingerprint == PF_OSFP_NOMATCH)
3840 "warning: unknown '%s' OS fingerprint\n",
3843 r->os_fingerprint = PF_OSFP_ANY;
3846 TAILQ_INIT(&r->rpool.list);
3847 for (h = rpool_hosts; h != NULL; h = h->next) {
3848 pa = calloc(1, sizeof(struct pf_pooladdr));
3850 err(1, "expand_rule: calloc");
3852 if (h->ifname != NULL) {
3853 if (strlcpy(pa->ifname, h->ifname,
3854 sizeof(pa->ifname)) >=
3856 errx(1, "expand_rule: strlcpy");
3859 TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
3862 if (rule_consistent(r) < 0 || error)
3863 yyerror("skipping rule due to errors");
3865 r->nr = pf->rule_nr++;
3866 pfctl_add_rule(pf, r);
3872 FREE_LIST(struct node_if, interfaces);
3873 FREE_LIST(struct node_proto, protos);
3874 FREE_LIST(struct node_host, src_hosts);
3875 FREE_LIST(struct node_port, src_ports);
3876 FREE_LIST(struct node_os, src_oses);
3877 FREE_LIST(struct node_host, dst_hosts);
3878 FREE_LIST(struct node_port, dst_ports);
3879 FREE_LIST(struct node_uid, uids);
3880 FREE_LIST(struct node_gid, gids);
3881 FREE_LIST(struct node_icmp, icmp_types);
3882 FREE_LIST(struct node_host, rpool_hosts);
3885 yyerror("rule expands to no valid combination");
3892 check_rulestate(int desired_state)
3894 if (require_order && (rulestate > desired_state)) {
3895 yyerror("Rules must be in order: options, normalization, "
3896 "queueing, translation, filtering");
3899 rulestate = desired_state;
3904 kw_cmp(const void *k, const void *e)
3906 return (strcmp(k, ((const struct keywords *)e)->k_name));
3912 /* this has to be sorted always */
3913 static const struct keywords keywords[] = {
3915 { "allow-opts", ALLOWOPTS},
3917 { "anchor", ANCHOR},
3918 { "antispoof", ANTISPOOF},
3920 { "bandwidth", BANDWIDTH},
3922 { "binat-anchor", BINATANCHOR},
3923 { "bitmask", BITMASK},
3925 { "block-policy", BLOCKPOLICY},
3928 { "crop", FRAGCROP},
3931 { "drop-ovl", FRAGDROP},
3933 { "fastroute", FASTROUTE},
3934 { "file", FILENAME},
3935 { "fingerprints", FINGERPRINTS},
3937 { "floating", FLOATING},
3939 { "fragment", FRAGMENT},
3941 { "global", GLOBAL},
3943 { "group-bound", GRBOUND},
3945 { "hostid", HOSTID},
3946 { "icmp-type", ICMPTYPE},
3947 { "icmp6-type", ICMP6TYPE},
3948 { "if-bound", IFBOUND},
3955 { "linkshare", LINKSHARE},
3958 { "log-all", LOGALL},
3959 { "loginterface", LOGINTERFACE},
3961 { "max-mss", MAXMSS},
3962 { "max-src-nodes", MAXSRCNODES},
3963 { "max-src-states", MAXSRCSTATES},
3964 { "min-ttl", MINTTL},
3965 { "modulate", MODULATE},
3967 { "nat-anchor", NATANCHOR},
3970 { "no-route", NOROUTE},
3971 { "no-sync", NOSYNC},
3973 { "optimization", OPTIMIZATION},
3978 { "priority", PRIORITY},
3981 { "qlimit", QLIMIT},
3984 { "random", RANDOM},
3985 { "random-id", RANDOMID},
3987 { "rdr-anchor", RDRANCHOR},
3988 { "realtime", REALTIME},
3989 { "reassemble", REASSEMBLE},
3990 { "reply-to", REPLYTO},
3991 { "require-order", REQUIREORDER},
3992 { "return", RETURN},
3993 { "return-icmp", RETURNICMP},
3994 { "return-icmp6", RETURNICMP6},
3995 { "return-rst", RETURNRST},
3996 { "round-robin", ROUNDROBIN},
3997 { "route-to", ROUTETO},
4001 { "source-hash", SOURCEHASH},
4002 { "source-track", SOURCETRACK},
4004 { "state-policy", STATEPOLICY},
4005 { "static-port", STATICPORT},
4006 { "sticky-address", STICKYADDRESS},
4007 { "synproxy", SYNPROXY},
4010 { "tagged", TAGGED},
4011 { "tbrsize", TBRSIZE},
4012 { "timeout", TIMEOUT},
4016 { "upperlimit", UPPERLIMIT},
4019 const struct keywords *p;
4021 p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
4022 sizeof(keywords[0]), kw_cmp);
4026 fprintf(stderr, "%s: %d\n", s, p->k_val);
4030 fprintf(stderr, "string: %s\n", s);
4035 #define MAXPUSHBACK 128
4039 char pushback_buffer[MAXPUSHBACK];
4040 int pushback_index = 0;
4048 /* Read character from the parsebuffer instead of input. */
4049 if (parseindex >= 0) {
4050 c = parsebuf[parseindex++];
4059 return (pushback_buffer[--pushback_index]);
4061 while ((c = getc(f)) == '\\') {
4065 yyerror("whitespace after \\");
4069 yylval.lineno = lineno;
4072 if (c == '\t' || c == ' ') {
4073 /* Compress blanks to a single space. */
4076 } while (c == '\t' || c == ' ');
4091 if (parseindex >= 0)
4094 if (pushback_index < MAXPUSHBACK-1)
4095 return (pushback_buffer[pushback_index++] = c);
4108 /* skip to either EOF or the first real EOL */
4131 while ((c = lgetc(fin)) == ' ')
4134 yylval.lineno = lineno;
4136 while ((c = lgetc(fin)) != '\n' && c != EOF)
4138 if (c == '$' && parsebuf == NULL) {
4140 if ((c = lgetc(fin)) == EOF)
4143 if (p + 1 >= buf + sizeof(buf) - 1) {
4144 yyerror("string too long");
4147 if (isalnum(c) || c == '_') {
4157 yyerror("macro '%s' not defined", buf);
4170 if ((c = lgetc(fin)) == EOF)
4180 if (p + 1 >= buf + sizeof(buf) - 1) {
4181 yyerror("string too long");
4186 yylval.v.string = strdup(buf);
4187 if (yylval.v.string == NULL)
4188 err(1, "yylex: strdup");
4193 yylval.v.i = PF_OP_XRG;
4194 return (PORTBINARY);
4201 yylval.v.i = PF_OP_IRG;
4202 return (PORTBINARY);
4214 #define allowed_in_string(x) \
4215 (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
4216 x != '{' && x != '}' && x != '<' && x != '>' && \
4217 x != '!' && x != '=' && x != '/' && x != '#' && \
4220 if (isalnum(c) || c == ':' || c == '_') {
4223 if ((unsigned)(p-buf) >= sizeof(buf)) {
4224 yyerror("string too long");
4227 } while ((c = lgetc(fin)) != EOF && (allowed_in_string(c)));
4230 if ((token = lookup(buf)) == STRING)
4231 if ((yylval.v.string = strdup(buf)) == NULL)
4232 err(1, "yylex: strdup");
4236 yylval.lineno = lineno;
4245 parse_rules(FILE *input, struct pfctl *xpf)
4247 struct sym *sym, *next;
4253 rulestate = PFCTL_STATE_NONE;
4254 returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
4255 returnicmp6default =
4256 (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
4257 blockpolicy = PFRULE_DROP;
4262 /* Free macros and check which have not been used. */
4263 for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) {
4264 next = TAILQ_NEXT(sym, entries);
4265 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
4266 fprintf(stderr, "warning: macro '%s' not "
4267 "used\n", sym->nam);
4270 TAILQ_REMOVE(&symhead, sym, entries);
4274 return (errors ? -1 : 0);
4278 * Over-designed efficiency is a French and German concept, so how about
4279 * we wait until they discover this ugliness and make it all fancy.
4282 symset(const char *nam, const char *val, int persist)
4286 for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
4287 sym = TAILQ_NEXT(sym, entries))
4291 if (sym->persist == 1)
4296 TAILQ_REMOVE(&symhead, sym, entries);
4300 if ((sym = calloc(1, sizeof(*sym))) == NULL)
4303 sym->nam = strdup(nam);
4304 if (sym->nam == NULL) {
4308 sym->val = strdup(val);
4309 if (sym->val == NULL) {
4315 sym->persist = persist;
4316 TAILQ_INSERT_TAIL(&symhead, sym, entries);
4321 pfctl_cmdline_symset(char *s)
4326 if ((val = strrchr(s, '=')) == NULL)
4329 if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
4330 err(1, "pfctl_cmdline_symset: malloc");
4332 strlcpy(sym, s, strlen(s) - strlen(val) + 1);
4334 ret = symset(sym, val + 1, 1);
4341 symget(const char *nam)
4345 TAILQ_FOREACH(sym, &symhead, entries)
4346 if (strcmp(nam, sym->nam) == 0) {
4354 decide_address_family(struct node_host *n, sa_family_t *af)
4356 sa_family_t target_af = 0;
4358 while (!*af && n != NULL) {
4362 if (target_af != n->af)
4367 if (!*af && target_af)
4372 remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
4374 struct node_host *n = *nh, *prev = NULL;
4377 if (*af && n->af && n->af != *af) {
4378 /* unlink and free n */
4379 struct node_host *next = n->next;
4381 /* adjust tail pointer */
4382 if (n == (*nh)->tail)
4384 /* adjust previous node's next pointer */
4390 if (n->ifname != NULL)
4404 invalid_redirect(struct node_host *nh, sa_family_t af)
4407 struct node_host *n;
4409 /* tables and dyniftl are ok without an address family */
4410 for (n = nh; n != NULL; n = n->next) {
4411 if (n->addr.type != PF_ADDR_TABLE &&
4412 n->addr.type != PF_ADDR_DYNIFTL) {
4413 yyerror("address family not given and "
4414 "translation address expands to multiple "
4415 "address families");
4421 yyerror("no translation address with matching address family "
4429 atoul(char *s, u_long *ulvalp)
4435 ulval = strtoul(s, &ep, 0);
4436 if (s[0] == '\0' || *ep != '\0')
4438 if (errno == ERANGE && ulval == ULONG_MAX)
4450 if (atoul(n, &ulval) == 0) {
4451 if (ulval > 65535) {
4452 yyerror("illegal port value %d", ulval);
4455 return (htons(ulval));
4457 s = getservbyname(n, "tcp");
4459 s = getservbyname(n, "udp");
4461 yyerror("unknown port %s", n);
4469 rule_label(struct pf_rule *r, char *s)
4472 if (strlcpy(r->label, s, sizeof(r->label)) >=
4474 yyerror("rule label too long (max %d chars)",
4475 sizeof(r->label)-1);
4483 parseicmpspec(char *w, sa_family_t af)
4485 const struct icmpcodeent *p;
4490 icmptype = returnicmpdefault >> 8;
4492 icmptype = returnicmp6default >> 8;
4494 if (atoul(w, &ulval) == -1) {
4495 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
4496 yyerror("unknown icmp code %s", w);
4502 yyerror("invalid icmp code %ld", ulval);
4505 return (icmptype << 8 | ulval);
4509 pfctl_load_anchors(int dev, int opts, struct pfr_buffer *trans)
4511 struct loadanchors *la;
4513 TAILQ_FOREACH(la, &loadanchorshead, entries) {
4514 if (opts & PF_OPT_VERBOSE)
4515 fprintf(stderr, "\nLoading anchor %s:%s from %s\n",
4516 la->anchorname, la->rulesetname, la->filename);
4517 if (pfctl_rules(dev, la->filename, opts, la->anchorname,
4518 la->rulesetname, trans) == -1)