Context Navigation

parse.y @ 0577772

55-freebsd-126-freebsd-12

Last change on this file since 0577772 was 0577772, checked in by Sebastian Huber <sebastian.huber@…>, on 01/09/17 at 13:47:04

Update to FreeBSD head 2017-01-09

Git mirror commit 1f8e4a995a6ede4bdb24e6d335ccda2bdb0175ab.

Property mode set to 100644

File size: 143.9 KB

Line
1	/* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */
2
3	/*
4	* Copyright (c) 2001 Markus Friedl. All rights reserved.
5	* Copyright (c) 2001 Daniel Hartmeier. All rights reserved.
6	* Copyright (c) 2001 Theo de Raadt. All rights reserved.
7	* Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
8	*
9	* Redistribution and use in source and binary forms, with or without
10	* modification, are permitted provided that the following conditions
11	* are met:
12	* 1. Redistributions of source code must retain the above copyright
13	* notice, this list of conditions and the following disclaimer.
14	* 2. Redistributions in binary form must reproduce the above copyright
15	* notice, this list of conditions and the following disclaimer in the
16	* documentation and/or other materials provided with the distribution.
17	*
18	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28	*/
29	%{
30	#ifdef __rtems__
31	#include <machine/rtems-bsd-user-space.h>
32	#endif /* __rtems__ */
33
34	#ifdef __rtems__
35	#include "rtems-bsd-pfctl-namespace.h"
36	#endif /* __rtems__ */
37	#include <sys/cdefs.h>
38	__FBSDID("$FreeBSD$");
39
40	#ifdef __rtems__
41	#include <machine/rtems-bsd-program.h>
42	#define pf_find_or_create_ruleset _bsd_pf_find_or_create_ruleset
43	#define pf_anchor_setup _bsd_pf_anchor_setup
44	#define pf_remove_if_empty_ruleset _bsd_pf_remove_if_empty_ruleset
45	#endif /* __rtems__ */
46	#include <sys/types.h>
47	#include <sys/socket.h>
48	#include <sys/stat.h>
49	#ifdef __FreeBSD__
50	#include <sys/sysctl.h>
51	#endif
52	#include <net/if.h>
53	#include <netinet/in.h>
54	#include <netinet/in_systm.h>
55	#include <netinet/ip.h>
56	#include <netinet/ip_icmp.h>
57	#include <netinet/icmp6.h>
58	#include <net/pfvar.h>
59	#include <arpa/inet.h>
60	#include <net/altq/altq.h>
61	#include <net/altq/altq_cbq.h>
62	#include <net/altq/altq_codel.h>
63	#include <net/altq/altq_priq.h>
64	#include <net/altq/altq_hfsc.h>
65	#include <net/altq/altq_fairq.h>
66
67	#include <stdio.h>
68	#include <unistd.h>
69	#include <stdlib.h>
70	#include <netdb.h>
71	#include <stdarg.h>
72	#include <errno.h>
73	#include <string.h>
74	#include <ctype.h>
75	#include <math.h>
76	#include <err.h>
77	#include <limits.h>
78	#include <pwd.h>
79	#include <grp.h>
80	#include <md5.h>
81
82	#include "pfctl_parser.h"
83	#include "pfctl.h"
84	#ifdef __rtems__
85	#include "rtems-bsd-pfctl-parse-data.h"
86	#endif /* __rtems__ */
87
88	static struct pfctl *pf = NULL;
89	static int debug = 0;
90	static int rulestate = 0;
91	static u_int16_t returnicmpdefault =
92	(ICMP_UNREACH << 8) \| ICMP_UNREACH_PORT;
93	static u_int16_t returnicmp6default =
94	(ICMP6_DST_UNREACH << 8) \| ICMP6_DST_UNREACH_NOPORT;
95	static int blockpolicy = PFRULE_DROP;
96	static int require_order = 1;
97	static int default_statelock;
98
99	static TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files);
100	static struct file {
101	TAILQ_ENTRY(file) entry;
102	FILE *stream;
103	char *name;
104	int lineno;
105	int errors;
106	} *file;
107	struct file pushfile(const char , int);
108	int popfile(void);
109	int check_file_secrecy(int, const char *);
110	int yyparse(void);
111	int yylex(void);
112	int yyerror(const char *, ...);
113	int kw_cmp(const void , const void );
114	int lookup(char *);
115	int lgetc(int);
116	int lungetc(int);
117	int findeol(void);
118
119	static TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead);
120	struct sym {
121	TAILQ_ENTRY(sym) entry;
122	int used;
123	int persist;
124	char *nam;
125	char *val;
126	};
127	int symset(const char , const char , int);
128	char symget(const char );
129
130	int atoul(char , u_long );
131
132	enum {
133	PFCTL_STATE_NONE,
134	PFCTL_STATE_OPTION,
135	PFCTL_STATE_SCRUB,
136	PFCTL_STATE_QUEUE,
137	PFCTL_STATE_NAT,
138	PFCTL_STATE_FILTER
139	};
140
141	struct node_proto {
142	u_int8_t proto;
143	struct node_proto *next;
144	struct node_proto *tail;
145	};
146
147	struct node_port {
148	u_int16_t port[2];
149	u_int8_t op;
150	struct node_port *next;
151	struct node_port *tail;
152	};
153
154	struct node_uid {
155	uid_t uid[2];
156	u_int8_t op;
157	struct node_uid *next;
158	struct node_uid *tail;
159	};
160
161	struct node_gid {
162	gid_t gid[2];
163	u_int8_t op;
164	struct node_gid *next;
165	struct node_gid *tail;
166	};
167
168	struct node_icmp {
169	u_int8_t code;
170	u_int8_t type;
171	u_int8_t proto;
172	struct node_icmp *next;
173	struct node_icmp *tail;
174	};
175
176	enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
177	PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
178	PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
179	PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
180	PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, };
181
182	enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
183
184	struct node_state_opt {
185	int type;
186	union {
187	u_int32_t max_states;
188	u_int32_t max_src_states;
189	u_int32_t max_src_conn;
190	struct {
191	u_int32_t limit;
192	u_int32_t seconds;
193	} max_src_conn_rate;
194	struct {
195	u_int8_t flush;
196	char tblname[PF_TABLE_NAME_SIZE];
197	} overload;
198	u_int32_t max_src_nodes;
199	u_int8_t src_track;
200	u_int32_t statelock;
201	struct {
202	int number;
203	u_int32_t seconds;
204	} timeout;
205	} data;
206	struct node_state_opt *next;
207	struct node_state_opt *tail;
208	};
209
210	struct peer {
211	struct node_host *host;
212	struct node_port *port;
213	};
214
215	static struct node_queue {
216	char queue[PF_QNAME_SIZE];
217	char parent[PF_QNAME_SIZE];
218	char ifname[IFNAMSIZ];
219	int scheduler;
220	struct node_queue *next;
221	struct node_queue *tail;
222	} *queues = NULL;
223
224	struct node_qassign {
225	char *qname;
226	char *pqname;
227	};
228
229	static struct filter_opts {
230	int marker;
231	#define FOM_FLAGS 0x01
232	#define FOM_ICMP 0x02
233	#define FOM_TOS 0x04
234	#define FOM_KEEP 0x08
235	#define FOM_SRCTRACK 0x10
236	#define FOM_SETPRIO 0x0400
237	#define FOM_PRIO 0x2000
238	struct node_uid *uid;
239	struct node_gid *gid;
240	struct {
241	u_int8_t b1;
242	u_int8_t b2;
243	u_int16_t w;
244	u_int16_t w2;
245	} flags;
246	struct node_icmp *icmpspec;
247	u_int32_t tos;
248	u_int32_t prob;
249	struct {
250	int action;
251	struct node_state_opt *options;
252	} keep;
253	int fragment;
254	int allowopts;
255	char *label;
256	struct node_qassign queues;
257	char *tag;
258	char *match_tag;
259	u_int8_t match_tag_not;
260	u_int rtableid;
261	u_int8_t prio;
262	u_int8_t set_prio[2];
263	struct {
264	struct node_host *addr;
265	u_int16_t port;
266	} divert;
267	} filter_opts;
268
269	static struct antispoof_opts {
270	char *label;
271	u_int rtableid;
272	} antispoof_opts;
273
274	static struct scrub_opts {
275	int marker;
276	#define SOM_MINTTL 0x01
277	#define SOM_MAXMSS 0x02
278	#define SOM_FRAGCACHE 0x04
279	#define SOM_SETTOS 0x08
280	int nodf;
281	int minttl;
282	int maxmss;
283	int settos;
284	int fragcache;
285	int randomid;
286	int reassemble_tcp;
287	char *match_tag;
288	u_int8_t match_tag_not;
289	u_int rtableid;
290	} scrub_opts;
291
292	static struct queue_opts {
293	int marker;
294	#define QOM_BWSPEC 0x01
295	#define QOM_SCHEDULER 0x02
296	#define QOM_PRIORITY 0x04
297	#define QOM_TBRSIZE 0x08
298	#define QOM_QLIMIT 0x10
299	struct node_queue_bw queue_bwspec;
300	struct node_queue_opt scheduler;
301	int priority;
302	int tbrsize;
303	int qlimit;
304	} queue_opts;
305
306	static struct table_opts {
307	int flags;
308	int init_addr;
309	struct node_tinithead init_nodes;
310	} table_opts;
311
312	static struct pool_opts {
313	int marker;
314	#define POM_TYPE 0x01
315	#define POM_STICKYADDRESS 0x02
316	u_int8_t opts;
317	int type;
318	int staticport;
319	struct pf_poolhashkey *key;
320
321	} pool_opts;
322
323	static struct codel_opts codel_opts;
324	static struct node_hfsc_opts hfsc_opts;
325	static struct node_fairq_opts fairq_opts;
326	static struct node_state_opt *keep_state_defaults = NULL;
327
328	int disallow_table(struct node_host , const char );
329	int disallow_urpf_failed(struct node_host , const char );
330	int disallow_alias(struct node_host , const char );
331	int rule_consistent(struct pf_rule *, int);
332	int filter_consistent(struct pf_rule *, int);
333	int nat_consistent(struct pf_rule *);
334	int rdr_consistent(struct pf_rule *);
335	int process_tabledef(char , struct table_opts );
336	void expand_label_str(char , size_t, const char , const char *);
337	void expand_label_if(const char , char , size_t, const char *);
338	void expand_label_addr(const char , char , size_t, u_int8_t,
339	struct node_host *);
340	void expand_label_port(const char , char , size_t,
341	struct node_port *);
342	void expand_label_proto(const char , char , size_t, u_int8_t);
343	void expand_label_nr(const char , char , size_t);
344	void expand_label(char , size_t, const char , u_int8_t,
345	struct node_host , struct node_port , struct node_host *,
346	struct node_port *, u_int8_t);
347	void expand_rule(struct pf_rule , struct node_if ,
348	struct node_host , struct node_proto , struct node_os *,
349	struct node_host , struct node_port , struct node_host *,
350	struct node_port , struct node_uid , struct node_gid *,
351	struct node_icmp , const char );
352	int expand_altq(struct pf_altq , struct node_if ,
353	struct node_queue *, struct node_queue_bw bwspec,
354	struct node_queue_opt *);
355	int expand_queue(struct pf_altq , struct node_if ,
356	struct node_queue *, struct node_queue_bw,
357	struct node_queue_opt *);
358	int expand_skip_interface(struct node_if *);
359
360	int check_rulestate(int);
361	int getservice(char *);
362	int rule_label(struct pf_rule , char );
363	int rt_tableid_max(void);
364
365	void mv_rules(struct pf_ruleset , struct pf_ruleset );
366	void decide_address_family(struct node_host , sa_family_t );
367	void remove_invalid_hosts(struct node_host *, sa_family_t );
368	int invalid_redirect(struct node_host *, sa_family_t);
369	u_int16_t parseicmpspec(char *, sa_family_t);
370	int kw_casecmp(const void , const void );
371	int map_tos(char string, int );
372
373	static TAILQ_HEAD(loadanchorshead, loadanchors)
374	loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
375
376	struct loadanchors {
377	TAILQ_ENTRY(loadanchors) entries;
378	char *anchorname;
379	char *filename;
380	};
381
382	typedef struct {
383	union {
384	int64_t number;
385	double probability;
386	int i;
387	char *string;
388	u_int rtableid;
389	struct {
390	u_int8_t b1;
391	u_int8_t b2;
392	u_int16_t w;
393	u_int16_t w2;
394	} b;
395	struct range {
396	int a;
397	int b;
398	int t;
399	} range;
400	struct node_if *interface;
401	struct node_proto *proto;
402	struct node_icmp *icmp;
403	struct node_host *host;
404	struct node_os *os;
405	struct node_port *port;
406	struct node_uid *uid;
407	struct node_gid *gid;
408	struct node_state_opt *state_opt;
409	struct peer peer;
410	struct {
411	struct peer src, dst;
412	struct node_os *src_os;
413	} fromto;
414	struct {
415	struct node_host *host;
416	u_int8_t rt;
417	u_int8_t pool_opts;
418	sa_family_t af;
419	struct pf_poolhashkey *key;
420	} route;
421	struct redirection {
422	struct node_host *host;
423	struct range rport;
424	} *redirection;
425	struct {
426	int action;
427	struct node_state_opt *options;
428	} keep_state;
429	struct {
430	u_int8_t log;
431	u_int8_t logif;
432	u_int8_t quick;
433	} logquick;
434	struct {
435	int neg;
436	char *name;
437	} tagged;
438	struct pf_poolhashkey *hashkey;
439	struct node_queue *queue;
440	struct node_queue_opt queue_options;
441	struct node_queue_bw queue_bwspec;
442	struct node_qassign qassign;
443	struct filter_opts filter_opts;
444	struct antispoof_opts antispoof_opts;
445	struct queue_opts queue_opts;
446	struct scrub_opts scrub_opts;
447	struct table_opts table_opts;
448	struct pool_opts pool_opts;
449	struct node_hfsc_opts hfsc_opts;
450	struct node_fairq_opts fairq_opts;
451	struct codel_opts codel_opts;
452	} v;
453	int lineno;
454	} YYSTYPE;
455
456	#define PPORT_RANGE 1
457	#define PPORT_STAR 2
458	int parseport(char , struct range r, int);
459
460	#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
461	(!((addr).iflags & PFI_AFLAG_NOALIAS) \|\| \
462	!isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
463
464	%}
465
466	%token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
467	%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
468	%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
469	%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
470	%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
471	%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
472	%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
473	%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
474	%token ANTISPOOF FOR INCLUDE
475	%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
476	%token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME
477	%token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL
478	%token LOAD RULESET_OPTIMIZATION PRIO
479	%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
480	%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY
481	%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS
482	%token DIVERTTO DIVERTREPLY
483	%token <v.string> STRING
484	%token <v.number> NUMBER
485	%token <v.i> PORTBINARY
486	%type <v.interface> interface if_list if_item_not if_item
487	%type <v.number> number icmptype icmp6type uid gid
488	%type <v.number> tos not yesno
489	%type <v.probability> probability
490	%type <v.i> no dir af fragcache optimizer
491	%type <v.i> sourcetrack flush unaryop statelock
492	%type <v.b> action nataction natpasslog scrubaction
493	%type <v.b> flags flag blockspec prio
494	%type <v.range> portplain portstar portrange
495	%type <v.hashkey> hashkey
496	%type <v.proto> proto proto_list proto_item
497	%type <v.number> protoval
498	%type <v.icmp> icmpspec
499	%type <v.icmp> icmp_list icmp_item
500	%type <v.icmp> icmp6_list icmp6_item
501	%type <v.number> reticmpspec reticmp6spec
502	%type <v.fromto> fromto
503	%type <v.peer> ipportspec from to
504	%type <v.host> ipspec toipspec xhost host dynaddr host_list
505	%type <v.host> redir_host_list redirspec
506	%type <v.host> route_host route_host_list routespec
507	%type <v.os> os xos os_list
508	%type <v.port> portspec port_list port_item
509	%type <v.uid> uids uid_list uid_item
510	%type <v.gid> gids gid_list gid_item
511	%type <v.route> route
512	%type <v.redirection> redirection redirpool
513	%type <v.string> label stringall tag anchorname
514	%type <v.string> string varstring numberstring
515	%type <v.keep_state> keep
516	%type <v.state_opt> state_opt_spec state_opt_list state_opt_item
517	%type <v.logquick> logquick quick log logopts logopt
518	%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if
519	%type <v.qassign> qname
520	%type <v.queue> qassign qassign_list qassign_item
521	%type <v.queue_options> scheduler
522	%type <v.number> cbqflags_list cbqflags_item
523	%type <v.number> priqflags_list priqflags_item
524	%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts
525	%type <v.fairq_opts> fairqopts_list fairqopts_item fairq_opts
526	%type <v.codel_opts> codelopts_list codelopts_item codel_opts
527	%type <v.queue_bwspec> bandwidth
528	%type <v.filter_opts> filter_opts filter_opt filter_opts_l
529	%type <v.filter_opts> filter_sets filter_set filter_sets_l
530	%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l
531	%type <v.queue_opts> queue_opts queue_opt queue_opts_l
532	%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l
533	%type <v.table_opts> table_opts table_opt table_opts_l
534	%type <v.pool_opts> pool_opts pool_opt pool_opts_l
535	%type <v.tagged> tagged
536	%type <v.rtableid> rtable
537	%%
538
539	ruleset : /* empty */
540	\| ruleset include '\n'
541	\| ruleset '\n'
542	\| ruleset option '\n'
543	\| ruleset scrubrule '\n'
544	\| ruleset natrule '\n'
545	\| ruleset binatrule '\n'
546	\| ruleset pfrule '\n'
547	\| ruleset anchorrule '\n'
548	\| ruleset loadrule '\n'
549	\| ruleset altqif '\n'
550	\| ruleset queuespec '\n'
551	\| ruleset varset '\n'
552	\| ruleset antispoof '\n'
553	\| ruleset tabledef '\n'
554	\| '{' fakeanchor '}' '\n';
555	\| ruleset error '\n' { file->errors++; }
556	;
557
558	include : INCLUDE STRING {
559	struct file *nfile;
560
561	if ((nfile = pushfile($2, 0)) == NULL) {
562	yyerror("failed to include file %s", $2);
563	free($2);
564	YYERROR;
565	}
566	free($2);
567
568	file = nfile;
569	lungetc('\n');
570	}
571	;
572
573	/*
574	* apply to previouslys specified rule: must be careful to note
575	* what that is: pf or nat or binat or rdr
576	*/
577	fakeanchor : fakeanchor '\n'
578	\| fakeanchor anchorrule '\n'
579	\| fakeanchor binatrule '\n'
580	\| fakeanchor natrule '\n'
581	\| fakeanchor pfrule '\n'
582	\| fakeanchor error '\n'
583	;
584
585	optimizer : string {
586	if (!strcmp($1, "none"))
587	$$ = 0;
588	else if (!strcmp($1, "basic"))
589	$$ = PF_OPTIMIZE_BASIC;
590	else if (!strcmp($1, "profile"))
591	$$ = PF_OPTIMIZE_BASIC \| PF_OPTIMIZE_PROFILE;
592	else {
593	yyerror("unknown ruleset-optimization %s", $1);
594	YYERROR;
595	}
596	}
597	;
598
599	option : SET OPTIMIZATION STRING {
600	if (check_rulestate(PFCTL_STATE_OPTION)) {
601	free($3);
602	YYERROR;
603	}
604	if (pfctl_set_optimization(pf, $3) != 0) {
605	yyerror("unknown optimization %s", $3);
606	free($3);
607	YYERROR;
608	}
609	free($3);
610	}
611	\| SET RULESET_OPTIMIZATION optimizer {
612	if (!(pf->opts & PF_OPT_OPTIMIZE)) {
613	pf->opts \|= PF_OPT_OPTIMIZE;
614	pf->optimize = $3;
615	}
616	}
617	\| SET TIMEOUT timeout_spec
618	\| SET TIMEOUT '{' optnl timeout_list '}'
619	\| SET LIMIT limit_spec
620	\| SET LIMIT '{' optnl limit_list '}'
621	\| SET LOGINTERFACE stringall {
622	if (check_rulestate(PFCTL_STATE_OPTION)) {
623	free($3);
624	YYERROR;
625	}
626	if (pfctl_set_logif(pf, $3) != 0) {
627	yyerror("error setting loginterface %s", $3);
628	free($3);
629	YYERROR;
630	}
631	free($3);
632	}
633	\| SET HOSTID number {
634	if ($3 == 0 \|\| $3 > UINT_MAX) {
635	yyerror("hostid must be non-zero");
636	YYERROR;
637	}
638	if (pfctl_set_hostid(pf, $3) != 0) {
639	yyerror("error setting hostid %08x", $3);
640	YYERROR;
641	}
642	}
643	\| SET BLOCKPOLICY DROP {
644	if (pf->opts & PF_OPT_VERBOSE)
645	printf("set block-policy drop\n");
646	if (check_rulestate(PFCTL_STATE_OPTION))
647	YYERROR;
648	blockpolicy = PFRULE_DROP;
649	}
650	\| SET BLOCKPOLICY RETURN {
651	if (pf->opts & PF_OPT_VERBOSE)
652	printf("set block-policy return\n");
653	if (check_rulestate(PFCTL_STATE_OPTION))
654	YYERROR;
655	blockpolicy = PFRULE_RETURN;
656	}
657	\| SET REQUIREORDER yesno {
658	if (pf->opts & PF_OPT_VERBOSE)
659	printf("set require-order %s\n",
660	$3 == 1 ? "yes" : "no");
661	require_order = $3;
662	}
663	\| SET FINGERPRINTS STRING {
664	if (pf->opts & PF_OPT_VERBOSE)
665	printf("set fingerprints \"%s\"\n", $3);
666	if (check_rulestate(PFCTL_STATE_OPTION)) {
667	free($3);
668	YYERROR;
669	}
670	if (!pf->anchor->name[0]) {
671	if (pfctl_file_fingerprints(pf->dev,
672	pf->opts, $3)) {
673	yyerror("error loading "
674	"fingerprints %s", $3);
675	free($3);
676	YYERROR;
677	}
678	}
679	free($3);
680	}
681	\| SET STATEPOLICY statelock {
682	if (pf->opts & PF_OPT_VERBOSE)
683	switch ($3) {
684	case 0:
685	printf("set state-policy floating\n");
686	break;
687	case PFRULE_IFBOUND:
688	printf("set state-policy if-bound\n");
689	break;
690	}
691	default_statelock = $3;
692	}
693	\| SET DEBUG STRING {
694	if (check_rulestate(PFCTL_STATE_OPTION)) {
695	free($3);
696	YYERROR;
697	}
698	if (pfctl_set_debug(pf, $3) != 0) {
699	yyerror("error setting debuglevel %s", $3);
700	free($3);
701	YYERROR;
702	}
703	free($3);
704	}
705	\| SET SKIP interface {
706	if (expand_skip_interface($3) != 0) {
707	yyerror("error setting skip interface(s)");
708	YYERROR;
709	}
710	}
711	\| SET STATEDEFAULTS state_opt_list {
712	if (keep_state_defaults != NULL) {
713	yyerror("cannot redefine state-defaults");
714	YYERROR;
715	}
716	keep_state_defaults = $3;
717	}
718	;
719
720	stringall : STRING { $$ = $1; }
721	\| ALL {
722	if (($$ = strdup("all")) == NULL) {
723	err(1, "stringall: strdup");
724	}
725	}
726	;
727
728	string : STRING string {
729	if (asprintf(&$$, "%s %s", $1, $2) == -1)
730	err(1, "string: asprintf");
731	free($1);
732	free($2);
733	}
734	\| STRING
735	;
736
737	varstring : numberstring varstring {
738	if (asprintf(&$$, "%s %s", $1, $2) == -1)
739	err(1, "string: asprintf");
740	free($1);
741	free($2);
742	}
743	\| numberstring
744	;
745
746	numberstring : NUMBER {
747	char *s;
748	if (asprintf(&s, "%lld", (long long)$1) == -1) {
749	yyerror("string: asprintf");
750	YYERROR;
751	}
752	$$ = s;
753	}
754	\| STRING
755	;
756
757	varset : STRING '=' varstring {
758	if (pf->opts & PF_OPT_VERBOSE)
759	printf("%s = \"%s\"\n", $1, $3);
760	if (symset($1, $3, 0) == -1)
761	err(1, "cannot store variable %s", $1);
762	free($1);
763	free($3);
764	}
765	;
766
767	anchorname : STRING { $$ = $1; }
768	\| /* empty */ { $$ = NULL; }
769	;
770
771	pfa_anchorlist : /* empty */
772	\| pfa_anchorlist '\n'
773	\| pfa_anchorlist pfrule '\n'
774	\| pfa_anchorlist anchorrule '\n'
775	;
776
777	pfa_anchor : '{'
778	{
779	char ta[PF_ANCHOR_NAME_SIZE];
780	struct pf_ruleset *rs;
781
782	/* steping into a brace anchor */
783	pf->asd++;
784	pf->bn++;
785	pf->brace = 1;
786
787	/* create a holding ruleset in the root */
788	snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn);
789	rs = pf_find_or_create_ruleset(ta);
790	if (rs == NULL)
791	err(1, "pfa_anchor: pf_find_or_create_ruleset");
792	pf->astack[pf->asd] = rs->anchor;
793	pf->anchor = rs->anchor;
794	} '\n' pfa_anchorlist '}'
795	{
796	pf->alast = pf->anchor;
797	pf->asd--;
798	pf->anchor = pf->astack[pf->asd];
799	}
800	\| /* empty */
801	;
802
803	anchorrule : ANCHOR anchorname dir quick interface af proto fromto
804	filter_opts pfa_anchor
805	{
806	struct pf_rule r;
807	struct node_proto *proto;
808
809	if (check_rulestate(PFCTL_STATE_FILTER)) {
810	if ($2)
811	free($2);
812	YYERROR;
813	}
814
815	if ($2 && ($2[0] == '_' \|\| strstr($2, "/_") != NULL)) {
816	free($2);
817	yyerror("anchor names beginning with '_' "
818	"are reserved for internal use");
819	YYERROR;
820	}
821
822	memset(&r, 0, sizeof(r));
823	if (pf->astack[pf->asd + 1]) {
824	/* move inline rules into relative location */
825	pf_anchor_setup(&r,
826	&pf->astack[pf->asd]->ruleset,
827	$2 ? $2 : pf->alast->name);
828
829	if (r.anchor == NULL)
830	err(1, "anchorrule: unable to "
831	"create ruleset");
832
833	if (pf->alast != r.anchor) {
834	if (r.anchor->match) {
835	yyerror("inline anchor '%s' "
836	"already exists",
837	r.anchor->name);
838	YYERROR;
839	}
840	mv_rules(&pf->alast->ruleset,
841	&r.anchor->ruleset);
842	}
843	pf_remove_if_empty_ruleset(&pf->alast->ruleset);
844	pf->alast = r.anchor;
845	} else {
846	if (!$2) {
847	yyerror("anchors without explicit "
848	"rules must specify a name");
849	YYERROR;
850	}
851	}
852	r.direction = $3;
853	r.quick = $4.quick;
854	r.af = $6;
855	r.prob = $9.prob;
856	r.rtableid = $9.rtableid;
857
858	if ($9.tag)
859	if (strlcpy(r.tagname, $9.tag,
860	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
861	yyerror("tag too long, max %u chars",
862	PF_TAG_NAME_SIZE - 1);
863	YYERROR;
864	}
865	if ($9.match_tag)
866	if (strlcpy(r.match_tagname, $9.match_tag,
867	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
868	yyerror("tag too long, max %u chars",
869	PF_TAG_NAME_SIZE - 1);
870	YYERROR;
871	}
872	r.match_tag_not = $9.match_tag_not;
873	if (rule_label(&r, $9.label))
874	YYERROR;
875	free($9.label);
876	r.flags = $9.flags.b1;
877	r.flagset = $9.flags.b2;
878	if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
879	yyerror("flags always false");
880	YYERROR;
881	}
882	if ($9.flags.b1 \|\| $9.flags.b2 \|\| $8.src_os) {
883	for (proto = $7; proto != NULL &&
884	proto->proto != IPPROTO_TCP;
885	proto = proto->next)
886	; /* nothing */
887	if (proto == NULL && $7 != NULL) {
888	if ($9.flags.b1 \|\| $9.flags.b2)
889	yyerror(
890	"flags only apply to tcp");
891	if ($8.src_os)
892	yyerror(
893	"OS fingerprinting only "
894	"applies to tcp");
895	YYERROR;
896	}
897	}
898
899	r.tos = $9.tos;
900
901	if ($9.keep.action) {
902	yyerror("cannot specify state handling "
903	"on anchors");
904	YYERROR;
905	}
906
907	if ($9.match_tag)
908	if (strlcpy(r.match_tagname, $9.match_tag,
909	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
910	yyerror("tag too long, max %u chars",
911	PF_TAG_NAME_SIZE - 1);
912	YYERROR;
913	}
914	r.match_tag_not = $9.match_tag_not;
915	if ($9.marker & FOM_PRIO) {
916	if ($9.prio == 0)
917	r.prio = PF_PRIO_ZERO;
918	else
919	r.prio = $9.prio;
920	}
921	if ($9.marker & FOM_SETPRIO) {
922	r.set_prio[0] = $9.set_prio[0];
923	r.set_prio[1] = $9.set_prio[1];
924	r.scrub_flags \|= PFSTATE_SETPRIO;
925	}
926
927	decide_address_family($8.src.host, &r.af);
928	decide_address_family($8.dst.host, &r.af);
929
930	expand_rule(&r, $5, NULL, $7, $8.src_os,
931	$8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
932	$9.uid, $9.gid, $9.icmpspec,
933	pf->astack[pf->asd + 1] ? pf->alast->name : $2);
934	free($2);
935	pf->astack[pf->asd + 1] = NULL;
936	}
937	\| NATANCHOR string interface af proto fromto rtable {
938	struct pf_rule r;
939
940	if (check_rulestate(PFCTL_STATE_NAT)) {
941	free($2);
942	YYERROR;
943	}
944
945	memset(&r, 0, sizeof(r));
946	r.action = PF_NAT;
947	r.af = $4;
948	r.rtableid = $7;
949
950	decide_address_family($6.src.host, &r.af);
951	decide_address_family($6.dst.host, &r.af);
952
953	expand_rule(&r, $3, NULL, $5, $6.src_os,
954	$6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
955	0, 0, 0, $2);
956	free($2);
957	}
958	\| RDRANCHOR string interface af proto fromto rtable {
959	struct pf_rule r;
960
961	if (check_rulestate(PFCTL_STATE_NAT)) {
962	free($2);
963	YYERROR;
964	}
965
966	memset(&r, 0, sizeof(r));
967	r.action = PF_RDR;
968	r.af = $4;
969	r.rtableid = $7;
970
971	decide_address_family($6.src.host, &r.af);
972	decide_address_family($6.dst.host, &r.af);
973
974	if ($6.src.port != NULL) {
975	yyerror("source port parameter not supported"
976	" in rdr-anchor");
977	YYERROR;
978	}
979	if ($6.dst.port != NULL) {
980	if ($6.dst.port->next != NULL) {
981	yyerror("destination port list "
982	"expansion not supported in "
983	"rdr-anchor");
984	YYERROR;
985	} else if ($6.dst.port->op != PF_OP_EQ) {
986	yyerror("destination port operators"
987	" not supported in rdr-anchor");
988	YYERROR;
989	}
990	r.dst.port[0] = $6.dst.port->port[0];
991	r.dst.port[1] = $6.dst.port->port[1];
992	r.dst.port_op = $6.dst.port->op;
993	}
994
995	expand_rule(&r, $3, NULL, $5, $6.src_os,
996	$6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
997	0, 0, 0, $2);
998	free($2);
999	}
1000	\| BINATANCHOR string interface af proto fromto rtable {
1001	struct pf_rule r;
1002
1003	if (check_rulestate(PFCTL_STATE_NAT)) {
1004	free($2);
1005	YYERROR;
1006	}
1007
1008	memset(&r, 0, sizeof(r));
1009	r.action = PF_BINAT;
1010	r.af = $4;
1011	r.rtableid = $7;
1012	if ($5 != NULL) {
1013	if ($5->next != NULL) {
1014	yyerror("proto list expansion"
1015	" not supported in binat-anchor");
1016	YYERROR;
1017	}
1018	r.proto = $5->proto;
1019	free($5);
1020	}
1021
1022	if ($6.src.host != NULL \|\| $6.src.port != NULL \|\|
1023	$6.dst.host != NULL \|\| $6.dst.port != NULL) {
1024	yyerror("fromto parameter not supported"
1025	" in binat-anchor");
1026	YYERROR;
1027	}
1028
1029	decide_address_family($6.src.host, &r.af);
1030	decide_address_family($6.dst.host, &r.af);
1031
1032	pfctl_add_rule(pf, &r, $2);
1033	free($2);
1034	}
1035	;
1036
1037	loadrule : LOAD ANCHOR string FROM string {
1038	struct loadanchors *loadanchor;
1039
1040	if (strlen(pf->anchor->name) + 1 +
1041	strlen($3) >= MAXPATHLEN) {
1042	yyerror("anchorname %s too long, max %u\n",
1043	$3, MAXPATHLEN - 1);
1044	free($3);
1045	YYERROR;
1046	}
1047	loadanchor = calloc(1, sizeof(struct loadanchors));
1048	if (loadanchor == NULL)
1049	err(1, "loadrule: calloc");
1050	if ((loadanchor->anchorname = malloc(MAXPATHLEN)) ==
1051	NULL)
1052	err(1, "loadrule: malloc");
1053	if (pf->anchor->name[0])
1054	snprintf(loadanchor->anchorname, MAXPATHLEN,
1055	"%s/%s", pf->anchor->name, $3);
1056	else
1057	strlcpy(loadanchor->anchorname, $3, MAXPATHLEN);
1058	if ((loadanchor->filename = strdup($5)) == NULL)
1059	err(1, "loadrule: strdup");
1060
1061	TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
1062	entries);
1063
1064	free($3);
1065	free($5);
1066	};
1067
1068	scrubaction : no SCRUB {
1069	$$.b2 = $$.w = 0;
1070	if ($1)
1071	$$.b1 = PF_NOSCRUB;
1072	else
1073	$$.b1 = PF_SCRUB;
1074	}
1075	;
1076
1077	scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts
1078	{
1079	struct pf_rule r;
1080
1081	if (check_rulestate(PFCTL_STATE_SCRUB))
1082	YYERROR;
1083
1084	memset(&r, 0, sizeof(r));
1085
1086	r.action = $1.b1;
1087	r.direction = $2;
1088
1089	r.log = $3.log;
1090	r.logif = $3.logif;
1091	if ($3.quick) {
1092	yyerror("scrub rules do not support 'quick'");
1093	YYERROR;
1094	}
1095
1096	r.af = $5;
1097	if ($8.nodf)
1098	r.rule_flag \|= PFRULE_NODF;
1099	if ($8.randomid)
1100	r.rule_flag \|= PFRULE_RANDOMID;
1101	if ($8.reassemble_tcp) {
1102	if (r.direction != PF_INOUT) {
1103	yyerror("reassemble tcp rules can not "
1104	"specify direction");
1105	YYERROR;
1106	}
1107	r.rule_flag \|= PFRULE_REASSEMBLE_TCP;
1108	}
1109	if ($8.minttl)
1110	r.min_ttl = $8.minttl;
1111	if ($8.maxmss)
1112	r.max_mss = $8.maxmss;
1113	if ($8.marker & SOM_SETTOS) {
1114	r.rule_flag \|= PFRULE_SET_TOS;
1115	r.set_tos = $8.settos;
1116	}
1117	if ($8.fragcache)
1118	r.rule_flag \|= $8.fragcache;
1119	if ($8.match_tag)
1120	if (strlcpy(r.match_tagname, $8.match_tag,
1121	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1122	yyerror("tag too long, max %u chars",
1123	PF_TAG_NAME_SIZE - 1);
1124	YYERROR;
1125	}
1126	r.match_tag_not = $8.match_tag_not;
1127	r.rtableid = $8.rtableid;
1128
1129	expand_rule(&r, $4, NULL, $6, $7.src_os,
1130	$7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
1131	NULL, NULL, NULL, "");
1132	}
1133	;
1134
1135	scrub_opts : {
1136	bzero(&scrub_opts, sizeof scrub_opts);
1137	scrub_opts.rtableid = -1;
1138	}
1139	scrub_opts_l
1140	{ $$ = scrub_opts; }
1141	\| /* empty */ {
1142	bzero(&scrub_opts, sizeof scrub_opts);
1143	scrub_opts.rtableid = -1;
1144	$$ = scrub_opts;
1145	}
1146	;
1147
1148	scrub_opts_l : scrub_opts_l scrub_opt
1149	\| scrub_opt
1150	;
1151
1152	scrub_opt : NODF {
1153	if (scrub_opts.nodf) {
1154	yyerror("no-df cannot be respecified");
1155	YYERROR;
1156	}
1157	scrub_opts.nodf = 1;
1158	}
1159	\| MINTTL NUMBER {
1160	if (scrub_opts.marker & SOM_MINTTL) {
1161	yyerror("min-ttl cannot be respecified");
1162	YYERROR;
1163	}
1164	if ($2 < 0 \|\| $2 > 255) {
1165	yyerror("illegal min-ttl value %d", $2);
1166	YYERROR;
1167	}
1168	scrub_opts.marker \|= SOM_MINTTL;
1169	scrub_opts.minttl = $2;
1170	}
1171	\| MAXMSS NUMBER {
1172	if (scrub_opts.marker & SOM_MAXMSS) {
1173	yyerror("max-mss cannot be respecified");
1174	YYERROR;
1175	}
1176	if ($2 < 0 \|\| $2 > 65535) {
1177	yyerror("illegal max-mss value %d", $2);
1178	YYERROR;
1179	}
1180	scrub_opts.marker \|= SOM_MAXMSS;
1181	scrub_opts.maxmss = $2;
1182	}
1183	\| SETTOS tos {
1184	if (scrub_opts.marker & SOM_SETTOS) {
1185	yyerror("set-tos cannot be respecified");
1186	YYERROR;
1187	}
1188	scrub_opts.marker \|= SOM_SETTOS;
1189	scrub_opts.settos = $2;
1190	}
1191	\| fragcache {
1192	if (scrub_opts.marker & SOM_FRAGCACHE) {
1193	yyerror("fragcache cannot be respecified");
1194	YYERROR;
1195	}
1196	scrub_opts.marker \|= SOM_FRAGCACHE;
1197	scrub_opts.fragcache = $1;
1198	}
1199	\| REASSEMBLE STRING {
1200	if (strcasecmp($2, "tcp") != 0) {
1201	yyerror("scrub reassemble supports only tcp, "
1202	"not '%s'", $2);
1203	free($2);
1204	YYERROR;
1205	}
1206	free($2);
1207	if (scrub_opts.reassemble_tcp) {
1208	yyerror("reassemble tcp cannot be respecified");
1209	YYERROR;
1210	}
1211	scrub_opts.reassemble_tcp = 1;
1212	}
1213	\| RANDOMID {
1214	if (scrub_opts.randomid) {
1215	yyerror("random-id cannot be respecified");
1216	YYERROR;
1217	}
1218	scrub_opts.randomid = 1;
1219	}
1220	\| RTABLE NUMBER {
1221	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
1222	yyerror("invalid rtable id");
1223	YYERROR;
1224	}
1225	scrub_opts.rtableid = $2;
1226	}
1227	\| not TAGGED string {
1228	scrub_opts.match_tag = $3;
1229	scrub_opts.match_tag_not = $1;
1230	}
1231	;
1232
1233	fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ }
1234	\| FRAGMENT FRAGCROP { $$ = 0; }
1235	\| FRAGMENT FRAGDROP { $$ = 0; }
1236	;
1237
1238	antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
1239	struct pf_rule r;
1240	struct node_host h = NULL, hh;
1241	struct node_if i, j;
1242
1243	if (check_rulestate(PFCTL_STATE_FILTER))
1244	YYERROR;
1245
1246	for (i = $3; i; i = i->next) {
1247	bzero(&r, sizeof(r));
1248
1249	r.action = PF_DROP;
1250	r.direction = PF_IN;
1251	r.log = $2.log;
1252	r.logif = $2.logif;
1253	r.quick = $2.quick;
1254	r.af = $4;
1255	if (rule_label(&r, $5.label))
1256	YYERROR;
1257	r.rtableid = $5.rtableid;
1258	j = calloc(1, sizeof(struct node_if));
1259	if (j == NULL)
1260	err(1, "antispoof: calloc");
1261	if (strlcpy(j->ifname, i->ifname,
1262	sizeof(j->ifname)) >= sizeof(j->ifname)) {
1263	free(j);
1264	yyerror("interface name too long");
1265	YYERROR;
1266	}
1267	j->not = 1;
1268	if (i->dynamic) {
1269	h = calloc(1, sizeof(*h));
1270	if (h == NULL)
1271	err(1, "address: calloc");
1272	h->addr.type = PF_ADDR_DYNIFTL;
1273	set_ipmask(h, 128);
1274	if (strlcpy(h->addr.v.ifname, i->ifname,
1275	sizeof(h->addr.v.ifname)) >=
1276	sizeof(h->addr.v.ifname)) {
1277	free(h);
1278	yyerror(
1279	"interface name too long");
1280	YYERROR;
1281	}
1282	hh = malloc(sizeof(*hh));
1283	if (hh == NULL)
1284	err(1, "address: malloc");
1285	bcopy(h, hh, sizeof(*hh));
1286	h->addr.iflags = PFI_AFLAG_NETWORK;
1287	} else {
1288	h = ifa_lookup(j->ifname,
1289	PFI_AFLAG_NETWORK);
1290	hh = NULL;
1291	}
1292
1293	if (h != NULL)
1294	expand_rule(&r, j, NULL, NULL, NULL, h,
1295	NULL, NULL, NULL, NULL, NULL,
1296	NULL, "");
1297
1298	if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
1299	bzero(&r, sizeof(r));
1300
1301	r.action = PF_DROP;
1302	r.direction = PF_IN;
1303	r.log = $2.log;
1304	r.logif = $2.logif;
1305	r.quick = $2.quick;
1306	r.af = $4;
1307	if (rule_label(&r, $5.label))
1308	YYERROR;
1309	r.rtableid = $5.rtableid;
1310	if (hh != NULL)
1311	h = hh;
1312	else
1313	h = ifa_lookup(i->ifname, 0);
1314	if (h != NULL)
1315	expand_rule(&r, NULL, NULL,
1316	NULL, NULL, h, NULL, NULL,
1317	NULL, NULL, NULL, NULL, "");
1318	} else
1319	free(hh);
1320	}
1321	free($5.label);
1322	}
1323	;
1324
1325	antispoof_ifspc : FOR antispoof_if { $$ = $2; }
1326	\| FOR '{' optnl antispoof_iflst '}' { $$ = $4; }
1327	;
1328
1329	antispoof_iflst : antispoof_if optnl { $$ = $1; }
1330	\| antispoof_iflst comma antispoof_if optnl {
1331	$1->tail->next = $3;
1332	$1->tail = $3;
1333	$$ = $1;
1334	}
1335	;
1336
1337	antispoof_if : if_item { $$ = $1; }
1338	\| '(' if_item ')' {
1339	$2->dynamic = 1;
1340	$$ = $2;
1341	}
1342	;
1343
1344	antispoof_opts : {
1345	bzero(&antispoof_opts, sizeof antispoof_opts);
1346	antispoof_opts.rtableid = -1;
1347	}
1348	antispoof_opts_l
1349	{ $$ = antispoof_opts; }
1350	\| /* empty */ {
1351	bzero(&antispoof_opts, sizeof antispoof_opts);
1352	antispoof_opts.rtableid = -1;
1353	$$ = antispoof_opts;
1354	}
1355	;
1356
1357	antispoof_opts_l : antispoof_opts_l antispoof_opt
1358	\| antispoof_opt
1359	;
1360
1361	antispoof_opt : label {
1362	if (antispoof_opts.label) {
1363	yyerror("label cannot be redefined");
1364	YYERROR;
1365	}
1366	antispoof_opts.label = $1;
1367	}
1368	\| RTABLE NUMBER {
1369	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
1370	yyerror("invalid rtable id");
1371	YYERROR;
1372	}
1373	antispoof_opts.rtableid = $2;
1374	}
1375	;
1376
1377	not : '!' { $$ = 1; }
1378	\| /* empty */ { $$ = 0; }
1379	;
1380
1381	tabledef : TABLE '<' STRING '>' table_opts {
1382	struct node_host h, nh;
1383	struct node_tinit ti, nti;
1384
1385	if (strlen($3) >= PF_TABLE_NAME_SIZE) {
1386	yyerror("table name too long, max %d chars",
1387	PF_TABLE_NAME_SIZE - 1);
1388	free($3);
1389	YYERROR;
1390	}
1391	if (pf->loadopt & PFCTL_FLAG_TABLE)
1392	if (process_tabledef($3, &$5)) {
1393	free($3);
1394	YYERROR;
1395	}
1396	free($3);
1397	for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
1398	ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
1399	if (ti->file)
1400	free(ti->file);
1401	for (h = ti->host; h != NULL; h = nh) {
1402	nh = h->next;
1403	free(h);
1404	}
1405	nti = SIMPLEQ_NEXT(ti, entries);
1406	free(ti);
1407	}
1408	}
1409	;
1410
1411	table_opts : {
1412	bzero(&table_opts, sizeof table_opts);
1413	SIMPLEQ_INIT(&table_opts.init_nodes);
1414	}
1415	table_opts_l
1416	{ $$ = table_opts; }
1417	\| /* empty */
1418	{
1419	bzero(&table_opts, sizeof table_opts);
1420	SIMPLEQ_INIT(&table_opts.init_nodes);
1421	$$ = table_opts;
1422	}
1423	;
1424
1425	table_opts_l : table_opts_l table_opt
1426	\| table_opt
1427	;
1428
1429	table_opt : STRING {
1430	if (!strcmp($1, "const"))
1431	table_opts.flags \|= PFR_TFLAG_CONST;
1432	else if (!strcmp($1, "persist"))
1433	table_opts.flags \|= PFR_TFLAG_PERSIST;
1434	else if (!strcmp($1, "counters"))
1435	table_opts.flags \|= PFR_TFLAG_COUNTERS;
1436	else {
1437	yyerror("invalid table option '%s'", $1);
1438	free($1);
1439	YYERROR;
1440	}
1441	free($1);
1442	}
1443	\| '{' optnl '}' { table_opts.init_addr = 1; }
1444	\| '{' optnl host_list '}' {
1445	struct node_host *n;
1446	struct node_tinit *ti;
1447
1448	for (n = $3; n != NULL; n = n->next) {
1449	switch (n->addr.type) {
1450	case PF_ADDR_ADDRMASK:
1451	continue; /* ok */
1452	case PF_ADDR_RANGE:
1453	yyerror("address ranges are not "
1454	"permitted inside tables");
1455	break;
1456	case PF_ADDR_DYNIFTL:
1457	yyerror("dynamic addresses are not "
1458	"permitted inside tables");
1459	break;
1460	case PF_ADDR_TABLE:
1461	yyerror("tables cannot contain tables");
1462	break;
1463	case PF_ADDR_NOROUTE:
1464	yyerror("\"no-route\" is not permitted "
1465	"inside tables");
1466	break;
1467	case PF_ADDR_URPFFAILED:
1468	yyerror("\"urpf-failed\" is not "
1469	"permitted inside tables");
1470	break;
1471	default:
1472	yyerror("unknown address type %d",
1473	n->addr.type);
1474	}
1475	YYERROR;
1476	}
1477	if (!(ti = calloc(1, sizeof(*ti))))
1478	err(1, "table_opt: calloc");
1479	ti->host = $3;
1480	SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1481	entries);
1482	table_opts.init_addr = 1;
1483	}
1484	\| FILENAME STRING {
1485	struct node_tinit *ti;
1486
1487	if (!(ti = calloc(1, sizeof(*ti))))
1488	err(1, "table_opt: calloc");
1489	ti->file = $2;
1490	SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1491	entries);
1492	table_opts.init_addr = 1;
1493	}
1494	;
1495
1496	altqif : ALTQ interface queue_opts QUEUE qassign {
1497	struct pf_altq a;
1498
1499	if (check_rulestate(PFCTL_STATE_QUEUE))
1500	YYERROR;
1501
1502	memset(&a, 0, sizeof(a));
1503	if ($3.scheduler.qtype == ALTQT_NONE) {
1504	yyerror("no scheduler specified!");
1505	YYERROR;
1506	}
1507	a.scheduler = $3.scheduler.qtype;
1508	a.qlimit = $3.qlimit;
1509	a.tbrsize = $3.tbrsize;
1510	if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) {
1511	yyerror("no child queues specified");
1512	YYERROR;
1513	}
1514	if (expand_altq(&a, $2, $5, $3.queue_bwspec,
1515	&$3.scheduler))
1516	YYERROR;
1517	}
1518	;
1519
1520	queuespec : QUEUE STRING interface queue_opts qassign {
1521	struct pf_altq a;
1522
1523	if (check_rulestate(PFCTL_STATE_QUEUE)) {
1524	free($2);
1525	YYERROR;
1526	}
1527
1528	memset(&a, 0, sizeof(a));
1529
1530	if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
1531	sizeof(a.qname)) {
1532	yyerror("queue name too long (max "
1533	"%d chars)", PF_QNAME_SIZE-1);
1534	free($2);
1535	YYERROR;
1536	}
1537	free($2);
1538	if ($4.tbrsize) {
1539	yyerror("cannot specify tbrsize for queue");
1540	YYERROR;
1541	}
1542	if ($4.priority > 255) {
1543	yyerror("priority out of range: max 255");
1544	YYERROR;
1545	}
1546	a.priority = $4.priority;
1547	a.qlimit = $4.qlimit;
1548	a.scheduler = $4.scheduler.qtype;
1549	if (expand_queue(&a, $3, $5, $4.queue_bwspec,
1550	&$4.scheduler)) {
1551	yyerror("errors in queue definition");
1552	YYERROR;
1553	}
1554	}
1555	;
1556
1557	queue_opts : {
1558	bzero(&queue_opts, sizeof queue_opts);
1559	queue_opts.priority = DEFAULT_PRIORITY;
1560	queue_opts.qlimit = DEFAULT_QLIMIT;
1561	queue_opts.scheduler.qtype = ALTQT_NONE;
1562	queue_opts.queue_bwspec.bw_percent = 100;
1563	}
1564	queue_opts_l
1565	{ $$ = queue_opts; }
1566	\| /* empty */ {
1567	bzero(&queue_opts, sizeof queue_opts);
1568	queue_opts.priority = DEFAULT_PRIORITY;
1569	queue_opts.qlimit = DEFAULT_QLIMIT;
1570	queue_opts.scheduler.qtype = ALTQT_NONE;
1571	queue_opts.queue_bwspec.bw_percent = 100;
1572	$$ = queue_opts;
1573	}
1574	;
1575
1576	queue_opts_l : queue_opts_l queue_opt
1577	\| queue_opt
1578	;
1579
1580	queue_opt : BANDWIDTH bandwidth {
1581	if (queue_opts.marker & QOM_BWSPEC) {
1582	yyerror("bandwidth cannot be respecified");
1583	YYERROR;
1584	}
1585	queue_opts.marker \|= QOM_BWSPEC;
1586	queue_opts.queue_bwspec = $2;
1587	}
1588	\| PRIORITY NUMBER {
1589	if (queue_opts.marker & QOM_PRIORITY) {
1590	yyerror("priority cannot be respecified");
1591	YYERROR;
1592	}
1593	if ($2 < 0 \|\| $2 > 255) {
1594	yyerror("priority out of range: max 255");
1595	YYERROR;
1596	}
1597	queue_opts.marker \|= QOM_PRIORITY;
1598	queue_opts.priority = $2;
1599	}
1600	\| QLIMIT NUMBER {
1601	if (queue_opts.marker & QOM_QLIMIT) {
1602	yyerror("qlimit cannot be respecified");
1603	YYERROR;
1604	}
1605	if ($2 < 0 \|\| $2 > 65535) {
1606	yyerror("qlimit out of range: max 65535");
1607	YYERROR;
1608	}
1609	queue_opts.marker \|= QOM_QLIMIT;
1610	queue_opts.qlimit = $2;
1611	}
1612	\| scheduler {
1613	if (queue_opts.marker & QOM_SCHEDULER) {
1614	yyerror("scheduler cannot be respecified");
1615	YYERROR;
1616	}
1617	queue_opts.marker \|= QOM_SCHEDULER;
1618	queue_opts.scheduler = $1;
1619	}
1620	\| TBRSIZE NUMBER {
1621	if (queue_opts.marker & QOM_TBRSIZE) {
1622	yyerror("tbrsize cannot be respecified");
1623	YYERROR;
1624	}
1625	if ($2 < 0 \|\| $2 > 65535) {
1626	yyerror("tbrsize too big: max 65535");
1627	YYERROR;
1628	}
1629	queue_opts.marker \|= QOM_TBRSIZE;
1630	queue_opts.tbrsize = $2;
1631	}
1632	;
1633
1634	bandwidth : STRING {
1635	double bps;
1636	char *cp;
1637
1638	$$.bw_percent = 0;
1639
1640	bps = strtod($1, &cp);
1641	if (cp != NULL) {
1642	if (strlen(cp) > 1) {
1643	char *cu = cp + 1;
1644	if (!strcmp(cu, "Bit") \|\|
1645	!strcmp(cu, "B") \|\|
1646	!strcmp(cu, "bit") \|\|
1647	!strcmp(cu, "b")) {
1648	*cu = 0;
1649	}
1650	}
1651	if (!strcmp(cp, "b"))
1652	; /* nothing */
1653	else if (!strcmp(cp, "K"))
1654	bps *= 1000;
1655	else if (!strcmp(cp, "M"))
1656	bps = 1000 1000;
1657	else if (!strcmp(cp, "G"))
1658	bps = 1000 1000 * 1000;
1659	else if (!strcmp(cp, "%")) {
1660	if (bps < 0 \|\| bps > 100) {
1661	yyerror("bandwidth spec "
1662	"out of range");
1663	free($1);
1664	YYERROR;
1665	}
1666	$$.bw_percent = bps;
1667	bps = 0;
1668	} else {
1669	yyerror("unknown unit %s", cp);
1670	free($1);
1671	YYERROR;
1672	}
1673	}
1674	free($1);
1675	$$.bw_absolute = (u_int32_t)bps;
1676	}
1677	\| NUMBER {
1678	if ($1 < 0 \|\| $1 > UINT_MAX) {
1679	yyerror("bandwidth number too big");
1680	YYERROR;
1681	}
1682	$$.bw_percent = 0;
1683	$$.bw_absolute = $1;
1684	}
1685	;
1686
1687	scheduler : CBQ {
1688	$$.qtype = ALTQT_CBQ;
1689	$$.data.cbq_opts.flags = 0;
1690	}
1691	\| CBQ '(' cbqflags_list ')' {
1692	$$.qtype = ALTQT_CBQ;
1693	$$.data.cbq_opts.flags = $3;
1694	}
1695	\| PRIQ {
1696	$$.qtype = ALTQT_PRIQ;
1697	$$.data.priq_opts.flags = 0;
1698	}
1699	\| PRIQ '(' priqflags_list ')' {
1700	$$.qtype = ALTQT_PRIQ;
1701	$$.data.priq_opts.flags = $3;
1702	}
1703	\| HFSC {
1704	$$.qtype = ALTQT_HFSC;
1705	bzero(&$$.data.hfsc_opts,
1706	sizeof(struct node_hfsc_opts));
1707	}
1708	\| HFSC '(' hfsc_opts ')' {
1709	$$.qtype = ALTQT_HFSC;
1710	$$.data.hfsc_opts = $3;
1711	}
1712	\| FAIRQ {
1713	$$.qtype = ALTQT_FAIRQ;
1714	bzero(&$$.data.fairq_opts,
1715	sizeof(struct node_fairq_opts));
1716	}
1717	\| FAIRQ '(' fairq_opts ')' {
1718	$$.qtype = ALTQT_FAIRQ;
1719	$$.data.fairq_opts = $3;
1720	}
1721	\| CODEL {
1722	$$.qtype = ALTQT_CODEL;
1723	bzero(&$$.data.codel_opts,
1724	sizeof(struct codel_opts));
1725	}
1726	\| CODEL '(' codel_opts ')' {
1727	$$.qtype = ALTQT_CODEL;
1728	$$.data.codel_opts = $3;
1729	}
1730	;
1731
1732	cbqflags_list : cbqflags_item { $$ \|= $1; }
1733	\| cbqflags_list comma cbqflags_item { $$ \|= $3; }
1734	;
1735
1736	cbqflags_item : STRING {
1737	if (!strcmp($1, "default"))
1738	$$ = CBQCLF_DEFCLASS;
1739	else if (!strcmp($1, "borrow"))
1740	$$ = CBQCLF_BORROW;
1741	else if (!strcmp($1, "red"))
1742	$$ = CBQCLF_RED;
1743	else if (!strcmp($1, "ecn"))
1744	$$ = CBQCLF_RED\|CBQCLF_ECN;
1745	else if (!strcmp($1, "rio"))
1746	$$ = CBQCLF_RIO;
1747	else if (!strcmp($1, "codel"))
1748	$$ = CBQCLF_CODEL;
1749	else {
1750	yyerror("unknown cbq flag \"%s\"", $1);
1751	free($1);
1752	YYERROR;
1753	}
1754	free($1);
1755	}
1756	;
1757
1758	priqflags_list : priqflags_item { $$ \|= $1; }
1759	\| priqflags_list comma priqflags_item { $$ \|= $3; }
1760	;
1761
1762	priqflags_item : STRING {
1763	if (!strcmp($1, "default"))
1764	$$ = PRCF_DEFAULTCLASS;
1765	else if (!strcmp($1, "red"))
1766	$$ = PRCF_RED;
1767	else if (!strcmp($1, "ecn"))
1768	$$ = PRCF_RED\|PRCF_ECN;
1769	else if (!strcmp($1, "rio"))
1770	$$ = PRCF_RIO;
1771	else if (!strcmp($1, "codel"))
1772	$$ = PRCF_CODEL;
1773	else {
1774	yyerror("unknown priq flag \"%s\"", $1);
1775	free($1);
1776	YYERROR;
1777	}
1778	free($1);
1779	}
1780	;
1781
1782	hfsc_opts : {
1783	bzero(&hfsc_opts,
1784	sizeof(struct node_hfsc_opts));
1785	}
1786	hfscopts_list {
1787	$$ = hfsc_opts;
1788	}
1789	;
1790
1791	hfscopts_list : hfscopts_item
1792	\| hfscopts_list comma hfscopts_item
1793	;
1794
1795	hfscopts_item : LINKSHARE bandwidth {
1796	if (hfsc_opts.linkshare.used) {
1797	yyerror("linkshare already specified");
1798	YYERROR;
1799	}
1800	hfsc_opts.linkshare.m2 = $2;
1801	hfsc_opts.linkshare.used = 1;
1802	}
1803	\| LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')'
1804	{
1805	if ($5 < 0 \|\| $5 > INT_MAX) {
1806	yyerror("timing in curve out of range");
1807	YYERROR;
1808	}
1809	if (hfsc_opts.linkshare.used) {
1810	yyerror("linkshare already specified");
1811	YYERROR;
1812	}
1813	hfsc_opts.linkshare.m1 = $3;
1814	hfsc_opts.linkshare.d = $5;
1815	hfsc_opts.linkshare.m2 = $7;
1816	hfsc_opts.linkshare.used = 1;
1817	}
1818	\| REALTIME bandwidth {
1819	if (hfsc_opts.realtime.used) {
1820	yyerror("realtime already specified");
1821	YYERROR;
1822	}
1823	hfsc_opts.realtime.m2 = $2;
1824	hfsc_opts.realtime.used = 1;
1825	}
1826	\| REALTIME '(' bandwidth comma NUMBER comma bandwidth ')'
1827	{
1828	if ($5 < 0 \|\| $5 > INT_MAX) {
1829	yyerror("timing in curve out of range");
1830	YYERROR;
1831	}
1832	if (hfsc_opts.realtime.used) {
1833	yyerror("realtime already specified");
1834	YYERROR;
1835	}
1836	hfsc_opts.realtime.m1 = $3;
1837	hfsc_opts.realtime.d = $5;
1838	hfsc_opts.realtime.m2 = $7;
1839	hfsc_opts.realtime.used = 1;
1840	}
1841	\| UPPERLIMIT bandwidth {
1842	if (hfsc_opts.upperlimit.used) {
1843	yyerror("upperlimit already specified");
1844	YYERROR;
1845	}
1846	hfsc_opts.upperlimit.m2 = $2;
1847	hfsc_opts.upperlimit.used = 1;
1848	}
1849	\| UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')'
1850	{
1851	if ($5 < 0 \|\| $5 > INT_MAX) {
1852	yyerror("timing in curve out of range");
1853	YYERROR;
1854	}
1855	if (hfsc_opts.upperlimit.used) {
1856	yyerror("upperlimit already specified");
1857	YYERROR;
1858	}
1859	hfsc_opts.upperlimit.m1 = $3;
1860	hfsc_opts.upperlimit.d = $5;
1861	hfsc_opts.upperlimit.m2 = $7;
1862	hfsc_opts.upperlimit.used = 1;
1863	}
1864	\| STRING {
1865	if (!strcmp($1, "default"))
1866	hfsc_opts.flags \|= HFCF_DEFAULTCLASS;
1867	else if (!strcmp($1, "red"))
1868	hfsc_opts.flags \|= HFCF_RED;
1869	else if (!strcmp($1, "ecn"))
1870	hfsc_opts.flags \|= HFCF_RED\|HFCF_ECN;
1871	else if (!strcmp($1, "rio"))
1872	hfsc_opts.flags \|= HFCF_RIO;
1873	else if (!strcmp($1, "codel"))
1874	hfsc_opts.flags \|= HFCF_CODEL;
1875	else {
1876	yyerror("unknown hfsc flag \"%s\"", $1);
1877	free($1);
1878	YYERROR;
1879	}
1880	free($1);
1881	}
1882	;
1883
1884	fairq_opts : {
1885	bzero(&fairq_opts,
1886	sizeof(struct node_fairq_opts));
1887	}
1888	fairqopts_list {
1889	$$ = fairq_opts;
1890	}
1891	;
1892
1893	fairqopts_list : fairqopts_item
1894	\| fairqopts_list comma fairqopts_item
1895	;
1896
1897	fairqopts_item : LINKSHARE bandwidth {
1898	if (fairq_opts.linkshare.used) {
1899	yyerror("linkshare already specified");
1900	YYERROR;
1901	}
1902	fairq_opts.linkshare.m2 = $2;
1903	fairq_opts.linkshare.used = 1;
1904	}
1905	\| LINKSHARE '(' bandwidth number bandwidth ')' {
1906	if (fairq_opts.linkshare.used) {
1907	yyerror("linkshare already specified");
1908	YYERROR;
1909	}
1910	fairq_opts.linkshare.m1 = $3;
1911	fairq_opts.linkshare.d = $4;
1912	fairq_opts.linkshare.m2 = $5;
1913	fairq_opts.linkshare.used = 1;
1914	}
1915	\| HOGS bandwidth {
1916	fairq_opts.hogs_bw = $2;
1917	}
1918	\| BUCKETS number {
1919	fairq_opts.nbuckets = $2;
1920	}
1921	\| STRING {
1922	if (!strcmp($1, "default"))
1923	fairq_opts.flags \|= FARF_DEFAULTCLASS;
1924	else if (!strcmp($1, "red"))
1925	fairq_opts.flags \|= FARF_RED;
1926	else if (!strcmp($1, "ecn"))
1927	fairq_opts.flags \|= FARF_RED\|FARF_ECN;
1928	else if (!strcmp($1, "rio"))
1929	fairq_opts.flags \|= FARF_RIO;
1930	else if (!strcmp($1, "codel"))
1931	fairq_opts.flags \|= FARF_CODEL;
1932	else {
1933	yyerror("unknown fairq flag \"%s\"", $1);
1934	free($1);
1935	YYERROR;
1936	}
1937	free($1);
1938	}
1939	;
1940
1941	codel_opts : {
1942	bzero(&codel_opts,
1943	sizeof(struct codel_opts));
1944	}
1945	codelopts_list {
1946	$$ = codel_opts;
1947	}
1948	;
1949
1950	codelopts_list : codelopts_item
1951	\| codelopts_list comma codelopts_item
1952	;
1953
1954	codelopts_item : INTERVAL number {
1955	if (codel_opts.interval) {
1956	yyerror("interval already specified");
1957	YYERROR;
1958	}
1959	codel_opts.interval = $2;
1960	}
1961	\| TARGET number {
1962	if (codel_opts.target) {
1963	yyerror("target already specified");
1964	YYERROR;
1965	}
1966	codel_opts.target = $2;
1967	}
1968	\| STRING {
1969	if (!strcmp($1, "ecn"))
1970	codel_opts.ecn = 1;
1971	else {
1972	yyerror("unknown codel option \"%s\"", $1);
1973	free($1);
1974	YYERROR;
1975	}
1976	free($1);
1977	}
1978	;
1979
1980	qassign : /* empty */ { $$ = NULL; }
1981	\| qassign_item { $$ = $1; }
1982	\| '{' optnl qassign_list '}' { $$ = $3; }
1983	;
1984
1985	qassign_list : qassign_item optnl { $$ = $1; }
1986	\| qassign_list comma qassign_item optnl {
1987	$1->tail->next = $3;
1988	$1->tail = $3;
1989	$$ = $1;
1990	}
1991	;
1992
1993	qassign_item : STRING {
1994	$$ = calloc(1, sizeof(struct node_queue));
1995	if ($$ == NULL)
1996	err(1, "qassign_item: calloc");
1997	if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
1998	sizeof($$->queue)) {
1999	yyerror("queue name '%s' too long (max "
2000	"%d chars)", $1, sizeof($$->queue)-1);
2001	free($1);
2002	free($$);
2003	YYERROR;
2004	}
2005	free($1);
2006	$$->next = NULL;
2007	$$->tail = $$;
2008	}
2009	;
2010
2011	pfrule : action dir logquick interface route af proto fromto
2012	filter_opts
2013	{
2014	struct pf_rule r;
2015	struct node_state_opt *o;
2016	struct node_proto *proto;
2017	int srctrack = 0;
2018	int statelock = 0;
2019	int adaptive = 0;
2020	int defaults = 0;
2021
2022	if (check_rulestate(PFCTL_STATE_FILTER))
2023	YYERROR;
2024
2025	memset(&r, 0, sizeof(r));
2026
2027	r.action = $1.b1;
2028	switch ($1.b2) {
2029	case PFRULE_RETURNRST:
2030	r.rule_flag \|= PFRULE_RETURNRST;
2031	r.return_ttl = $1.w;
2032	break;
2033	case PFRULE_RETURNICMP:
2034	r.rule_flag \|= PFRULE_RETURNICMP;
2035	r.return_icmp = $1.w;
2036	r.return_icmp6 = $1.w2;
2037	break;
2038	case PFRULE_RETURN:
2039	r.rule_flag \|= PFRULE_RETURN;
2040	r.return_icmp = $1.w;
2041	r.return_icmp6 = $1.w2;
2042	break;
2043	}
2044	r.direction = $2;
2045	r.log = $3.log;
2046	r.logif = $3.logif;
2047	r.quick = $3.quick;
2048	r.prob = $9.prob;
2049	r.rtableid = $9.rtableid;
2050
2051	if ($9.marker & FOM_PRIO) {
2052	if ($9.prio == 0)
2053	r.prio = PF_PRIO_ZERO;
2054	else
2055	r.prio = $9.prio;
2056	}
2057	if ($9.marker & FOM_SETPRIO) {
2058	r.set_prio[0] = $9.set_prio[0];
2059	r.set_prio[1] = $9.set_prio[1];
2060	r.scrub_flags \|= PFSTATE_SETPRIO;
2061	}
2062
2063	r.af = $6;
2064	if ($9.tag)
2065	if (strlcpy(r.tagname, $9.tag,
2066	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2067	yyerror("tag too long, max %u chars",
2068	PF_TAG_NAME_SIZE - 1);
2069	YYERROR;
2070	}
2071	if ($9.match_tag)
2072	if (strlcpy(r.match_tagname, $9.match_tag,
2073	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2074	yyerror("tag too long, max %u chars",
2075	PF_TAG_NAME_SIZE - 1);
2076	YYERROR;
2077	}
2078	r.match_tag_not = $9.match_tag_not;
2079	if (rule_label(&r, $9.label))
2080	YYERROR;
2081	free($9.label);
2082	r.flags = $9.flags.b1;
2083	r.flagset = $9.flags.b2;
2084	if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
2085	yyerror("flags always false");
2086	YYERROR;
2087	}
2088	if ($9.flags.b1 \|\| $9.flags.b2 \|\| $8.src_os) {
2089	for (proto = $7; proto != NULL &&
2090	proto->proto != IPPROTO_TCP;
2091	proto = proto->next)
2092	; /* nothing */
2093	if (proto == NULL && $7 != NULL) {
2094	if ($9.flags.b1 \|\| $9.flags.b2)
2095	yyerror(
2096	"flags only apply to tcp");
2097	if ($8.src_os)
2098	yyerror(
2099	"OS fingerprinting only "
2100	"apply to tcp");
2101	YYERROR;
2102	}
2103	#if 0
2104	if (($9.flags.b1 & parse_flags("S")) == 0 &&
2105	$8.src_os) {
2106	yyerror("OS fingerprinting requires "
2107	"the SYN TCP flag (flags S/SA)");
2108	YYERROR;
2109	}
2110	#endif
2111	}
2112
2113	r.tos = $9.tos;
2114	r.keep_state = $9.keep.action;
2115	o = $9.keep.options;
2116
2117	/* 'keep state' by default on pass rules. */
2118	if (!r.keep_state && !r.action &&
2119	!($9.marker & FOM_KEEP)) {
2120	r.keep_state = PF_STATE_NORMAL;
2121	o = keep_state_defaults;
2122	defaults = 1;
2123	}
2124
2125	while (o) {
2126	struct node_state_opt *p = o;
2127
2128	switch (o->type) {
2129	case PF_STATE_OPT_MAX:
2130	if (r.max_states) {
2131	yyerror("state option 'max' "
2132	"multiple definitions");
2133	YYERROR;
2134	}
2135	r.max_states = o->data.max_states;
2136	break;
2137	case PF_STATE_OPT_NOSYNC:
2138	if (r.rule_flag & PFRULE_NOSYNC) {
2139	yyerror("state option 'sync' "
2140	"multiple definitions");
2141	YYERROR;
2142	}
2143	r.rule_flag \|= PFRULE_NOSYNC;
2144	break;
2145	case PF_STATE_OPT_SRCTRACK:
2146	if (srctrack) {
2147	yyerror("state option "
2148	"'source-track' "
2149	"multiple definitions");
2150	YYERROR;
2151	}
2152	srctrack = o->data.src_track;
2153	r.rule_flag \|= PFRULE_SRCTRACK;
2154	break;
2155	case PF_STATE_OPT_MAX_SRC_STATES:
2156	if (r.max_src_states) {
2157	yyerror("state option "
2158	"'max-src-states' "
2159	"multiple definitions");
2160	YYERROR;
2161	}
2162	if (o->data.max_src_states == 0) {
2163	yyerror("'max-src-states' must "
2164	"be > 0");
2165	YYERROR;
2166	}
2167	r.max_src_states =
2168	o->data.max_src_states;
2169	r.rule_flag \|= PFRULE_SRCTRACK;
2170	break;
2171	case PF_STATE_OPT_OVERLOAD:
2172	if (r.overload_tblname[0]) {
2173	yyerror("multiple 'overload' "
2174	"table definitions");
2175	YYERROR;
2176	}
2177	if (strlcpy(r.overload_tblname,
2178	o->data.overload.tblname,
2179	PF_TABLE_NAME_SIZE) >=
2180	PF_TABLE_NAME_SIZE) {
2181	yyerror("state option: "
2182	"strlcpy");
2183	YYERROR;
2184	}
2185	r.flush = o->data.overload.flush;
2186	break;
2187	case PF_STATE_OPT_MAX_SRC_CONN:
2188	if (r.max_src_conn) {
2189	yyerror("state option "
2190	"'max-src-conn' "
2191	"multiple definitions");
2192	YYERROR;
2193	}
2194	if (o->data.max_src_conn == 0) {
2195	yyerror("'max-src-conn' "
2196	"must be > 0");
2197	YYERROR;
2198	}
2199	r.max_src_conn =
2200	o->data.max_src_conn;
2201	r.rule_flag \|= PFRULE_SRCTRACK \|
2202	PFRULE_RULESRCTRACK;
2203	break;
2204	case PF_STATE_OPT_MAX_SRC_CONN_RATE:
2205	if (r.max_src_conn_rate.limit) {
2206	yyerror("state option "
2207	"'max-src-conn-rate' "
2208	"multiple definitions");
2209	YYERROR;
2210	}
2211	if (!o->data.max_src_conn_rate.limit \|\|
2212	!o->data.max_src_conn_rate.seconds) {
2213	yyerror("'max-src-conn-rate' "
2214	"values must be > 0");
2215	YYERROR;
2216	}
2217	if (o->data.max_src_conn_rate.limit >
2218	PF_THRESHOLD_MAX) {
2219	yyerror("'max-src-conn-rate' "
2220	"maximum rate must be < %u",
2221	PF_THRESHOLD_MAX);
2222	YYERROR;
2223	}
2224	r.max_src_conn_rate.limit =
2225	o->data.max_src_conn_rate.limit;
2226	r.max_src_conn_rate.seconds =
2227	o->data.max_src_conn_rate.seconds;
2228	r.rule_flag \|= PFRULE_SRCTRACK \|
2229	PFRULE_RULESRCTRACK;
2230	break;
2231	case PF_STATE_OPT_MAX_SRC_NODES:
2232	if (r.max_src_nodes) {
2233	yyerror("state option "
2234	"'max-src-nodes' "
2235	"multiple definitions");
2236	YYERROR;
2237	}
2238	if (o->data.max_src_nodes == 0) {
2239	yyerror("'max-src-nodes' must "
2240	"be > 0");
2241	YYERROR;
2242	}
2243	r.max_src_nodes =
2244	o->data.max_src_nodes;
2245	r.rule_flag \|= PFRULE_SRCTRACK \|
2246	PFRULE_RULESRCTRACK;
2247	break;
2248	case PF_STATE_OPT_STATELOCK:
2249	if (statelock) {
2250	yyerror("state locking option: "
2251	"multiple definitions");
2252	YYERROR;
2253	}
2254	statelock = 1;
2255	r.rule_flag \|= o->data.statelock;
2256	break;
2257	case PF_STATE_OPT_SLOPPY:
2258	if (r.rule_flag & PFRULE_STATESLOPPY) {
2259	yyerror("state sloppy option: "
2260	"multiple definitions");
2261	YYERROR;
2262	}
2263	r.rule_flag \|= PFRULE_STATESLOPPY;
2264	break;
2265	case PF_STATE_OPT_TIMEOUT:
2266	if (o->data.timeout.number ==
2267	PFTM_ADAPTIVE_START \|\|
2268	o->data.timeout.number ==
2269	PFTM_ADAPTIVE_END)
2270	adaptive = 1;
2271	if (r.timeout[o->data.timeout.number]) {
2272	yyerror("state timeout %s "
2273	"multiple definitions",
2274	pf_timeouts[o->data.
2275	timeout.number].name);
2276	YYERROR;
2277	}
2278	r.timeout[o->data.timeout.number] =
2279	o->data.timeout.seconds;
2280	}
2281	o = o->next;
2282	if (!defaults)
2283	free(p);
2284	}
2285
2286	/* 'flags S/SA' by default on stateful rules */
2287	if (!r.action && !r.flags && !r.flagset &&
2288	!$9.fragment && !($9.marker & FOM_FLAGS) &&
2289	r.keep_state) {
2290	r.flags = parse_flags("S");
2291	r.flagset = parse_flags("SA");
2292	}
2293	if (!adaptive && r.max_states) {
2294	r.timeout[PFTM_ADAPTIVE_START] =
2295	(r.max_states / 10) * 6;
2296	r.timeout[PFTM_ADAPTIVE_END] =
2297	(r.max_states / 10) * 12;
2298	}
2299	if (r.rule_flag & PFRULE_SRCTRACK) {
2300	if (srctrack == PF_SRCTRACK_GLOBAL &&
2301	r.max_src_nodes) {
2302	yyerror("'max-src-nodes' is "
2303	"incompatible with "
2304	"'source-track global'");
2305	YYERROR;
2306	}
2307	if (srctrack == PF_SRCTRACK_GLOBAL &&
2308	r.max_src_conn) {
2309	yyerror("'max-src-conn' is "
2310	"incompatible with "
2311	"'source-track global'");
2312	YYERROR;
2313	}
2314	if (srctrack == PF_SRCTRACK_GLOBAL &&
2315	r.max_src_conn_rate.seconds) {
2316	yyerror("'max-src-conn-rate' is "
2317	"incompatible with "
2318	"'source-track global'");
2319	YYERROR;
2320	}
2321	if (r.timeout[PFTM_SRC_NODE] <
2322	r.max_src_conn_rate.seconds)
2323	r.timeout[PFTM_SRC_NODE] =
2324	r.max_src_conn_rate.seconds;
2325	r.rule_flag \|= PFRULE_SRCTRACK;
2326	if (srctrack == PF_SRCTRACK_RULE)
2327	r.rule_flag \|= PFRULE_RULESRCTRACK;
2328	}
2329	if (r.keep_state && !statelock)
2330	r.rule_flag \|= default_statelock;
2331
2332	if ($9.fragment)
2333	r.rule_flag \|= PFRULE_FRAGMENT;
2334	r.allow_opts = $9.allowopts;
2335
2336	decide_address_family($8.src.host, &r.af);
2337	decide_address_family($8.dst.host, &r.af);
2338
2339	if ($5.rt) {
2340	if (!r.direction) {
2341	yyerror("direction must be explicit "
2342	"with rules that specify routing");
2343	YYERROR;
2344	}
2345	r.rt = $5.rt;
2346	r.rpool.opts = $5.pool_opts;
2347	if ($5.key != NULL)
2348	memcpy(&r.rpool.key, $5.key,
2349	sizeof(struct pf_poolhashkey));
2350	}
2351	if (r.rt) {
2352	decide_address_family($5.host, &r.af);
2353	remove_invalid_hosts(&$5.host, &r.af);
2354	if ($5.host == NULL) {
2355	yyerror("no routing address with "
2356	"matching address family found.");
2357	YYERROR;
2358	}
2359	if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
2360	PF_POOL_NONE && ($5.host->next != NULL \|\|
2361	$5.host->addr.type == PF_ADDR_TABLE \|\|
2362	DYNIF_MULTIADDR($5.host->addr)))
2363	r.rpool.opts \|= PF_POOL_ROUNDROBIN;
2364	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2365	PF_POOL_ROUNDROBIN &&
2366	disallow_table($5.host, "tables are only "
2367	"supported in round-robin routing pools"))
2368	YYERROR;
2369	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2370	PF_POOL_ROUNDROBIN &&
2371	disallow_alias($5.host, "interface (%s) "
2372	"is only supported in round-robin "
2373	"routing pools"))
2374	YYERROR;
2375	if ($5.host->next != NULL) {
2376	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2377	PF_POOL_ROUNDROBIN) {
2378	yyerror("r.rpool.opts must "
2379	"be PF_POOL_ROUNDROBIN");
2380	YYERROR;
2381	}
2382	}
2383	}
2384	if ($9.queues.qname != NULL) {
2385	if (strlcpy(r.qname, $9.queues.qname,
2386	sizeof(r.qname)) >= sizeof(r.qname)) {
2387	yyerror("rule qname too long (max "
2388	"%d chars)", sizeof(r.qname)-1);
2389	YYERROR;
2390	}
2391	free($9.queues.qname);
2392	}
2393	if ($9.queues.pqname != NULL) {
2394	if (strlcpy(r.pqname, $9.queues.pqname,
2395	sizeof(r.pqname)) >= sizeof(r.pqname)) {
2396	yyerror("rule pqname too long (max "
2397	"%d chars)", sizeof(r.pqname)-1);
2398	YYERROR;
2399	}
2400	free($9.queues.pqname);
2401	}
2402	#ifdef __FreeBSD__
2403	r.divert.port = $9.divert.port;
2404	#else
2405	if ((r.divert.port = $9.divert.port)) {
2406	if (r.direction == PF_OUT) {
2407	if ($9.divert.addr) {
2408	yyerror("address specified "
2409	"for outgoing divert");
2410	YYERROR;
2411	}
2412	bzero(&r.divert.addr,
2413	sizeof(r.divert.addr));
2414	} else {
2415	if (!$9.divert.addr) {
2416	yyerror("no address specified "
2417	"for incoming divert");
2418	YYERROR;
2419	}
2420	if ($9.divert.addr->af != r.af) {
2421	yyerror("address family "
2422	"mismatch for divert");
2423	YYERROR;
2424	}
2425	r.divert.addr =
2426	$9.divert.addr->addr.v.a.addr;
2427	}
2428	}
2429	#endif
2430
2431	expand_rule(&r, $4, $5.host, $7, $8.src_os,
2432	$8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
2433	$9.uid, $9.gid, $9.icmpspec, "");
2434	}
2435	;
2436
2437	filter_opts : {
2438	bzero(&filter_opts, sizeof filter_opts);
2439	filter_opts.rtableid = -1;
2440	}
2441	filter_opts_l
2442	{ $$ = filter_opts; }
2443	\| /* empty */ {
2444	bzero(&filter_opts, sizeof filter_opts);
2445	filter_opts.rtableid = -1;
2446	$$ = filter_opts;
2447	}
2448	;
2449
2450	filter_opts_l : filter_opts_l filter_opt
2451	\| filter_opt
2452	;
2453
2454	filter_opt : USER uids {
2455	if (filter_opts.uid)
2456	$2->tail->next = filter_opts.uid;
2457	filter_opts.uid = $2;
2458	}
2459	\| GROUP gids {
2460	if (filter_opts.gid)
2461	$2->tail->next = filter_opts.gid;
2462	filter_opts.gid = $2;
2463	}
2464	\| flags {
2465	if (filter_opts.marker & FOM_FLAGS) {
2466	yyerror("flags cannot be redefined");
2467	YYERROR;
2468	}
2469	filter_opts.marker \|= FOM_FLAGS;
2470	filter_opts.flags.b1 \|= $1.b1;
2471	filter_opts.flags.b2 \|= $1.b2;
2472	filter_opts.flags.w \|= $1.w;
2473	filter_opts.flags.w2 \|= $1.w2;
2474	}
2475	\| icmpspec {
2476	if (filter_opts.marker & FOM_ICMP) {
2477	yyerror("icmp-type cannot be redefined");
2478	YYERROR;
2479	}
2480	filter_opts.marker \|= FOM_ICMP;
2481	filter_opts.icmpspec = $1;
2482	}
2483	\| PRIO NUMBER {
2484	if (filter_opts.marker & FOM_PRIO) {
2485	yyerror("prio cannot be redefined");
2486	YYERROR;
2487	}
2488	if ($2 < 0 \|\| $2 > PF_PRIO_MAX) {
2489	yyerror("prio must be 0 - %u", PF_PRIO_MAX);
2490	YYERROR;
2491	}
2492	filter_opts.marker \|= FOM_PRIO;
2493	filter_opts.prio = $2;
2494	}
2495	\| TOS tos {
2496	if (filter_opts.marker & FOM_TOS) {
2497	yyerror("tos cannot be redefined");
2498	YYERROR;
2499	}
2500	filter_opts.marker \|= FOM_TOS;
2501	filter_opts.tos = $2;
2502	}
2503	\| keep {
2504	if (filter_opts.marker & FOM_KEEP) {
2505	yyerror("modulate or keep cannot be redefined");
2506	YYERROR;
2507	}
2508	filter_opts.marker \|= FOM_KEEP;
2509	filter_opts.keep.action = $1.action;
2510	filter_opts.keep.options = $1.options;
2511	}
2512	\| FRAGMENT {
2513	filter_opts.fragment = 1;
2514	}
2515	\| ALLOWOPTS {
2516	filter_opts.allowopts = 1;
2517	}
2518	\| label {
2519	if (filter_opts.label) {
2520	yyerror("label cannot be redefined");
2521	YYERROR;
2522	}
2523	filter_opts.label = $1;
2524	}
2525	\| qname {
2526	if (filter_opts.queues.qname) {
2527	yyerror("queue cannot be redefined");
2528	YYERROR;
2529	}
2530	filter_opts.queues = $1;
2531	}
2532	\| TAG string {
2533	filter_opts.tag = $2;
2534	}
2535	\| not TAGGED string {
2536	filter_opts.match_tag = $3;
2537	filter_opts.match_tag_not = $1;
2538	}
2539	\| PROBABILITY probability {
2540	double p;
2541
2542	p = floor($2 * UINT_MAX + 0.5);
2543	if (p < 0.0 \|\| p > UINT_MAX) {
2544	yyerror("invalid probability: %lf", p);
2545	YYERROR;
2546	}
2547	filter_opts.prob = (u_int32_t)p;
2548	if (filter_opts.prob == 0)
2549	filter_opts.prob = 1;
2550	}
2551	\| RTABLE NUMBER {
2552	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
2553	yyerror("invalid rtable id");
2554	YYERROR;
2555	}
2556	filter_opts.rtableid = $2;
2557	}
2558	\| DIVERTTO portplain {
2559	#ifdef __FreeBSD__
2560	filter_opts.divert.port = $2.a;
2561	if (!filter_opts.divert.port) {
2562	yyerror("invalid divert port: %u", ntohs($2.a));
2563	YYERROR;
2564	}
2565	#endif
2566	}
2567	\| DIVERTTO STRING PORT portplain {
2568	#ifndef __FreeBSD__
2569	if ((filter_opts.divert.addr = host($2)) == NULL) {
2570	yyerror("could not parse divert address: %s",
2571	$2);
2572	free($2);
2573	YYERROR;
2574	}
2575	#else
2576	if ($2)
2577	#endif
2578	free($2);
2579	filter_opts.divert.port = $4.a;
2580	if (!filter_opts.divert.port) {
2581	yyerror("invalid divert port: %u", ntohs($4.a));
2582	YYERROR;
2583	}
2584	}
2585	\| DIVERTREPLY {
2586	#ifdef __FreeBSD__
2587	yyerror("divert-reply has no meaning in FreeBSD pf(4)");
2588	YYERROR;
2589	#else
2590	filter_opts.divert.port = 1; /* some random value */
2591	#endif
2592	}
2593	\| filter_sets
2594	;
2595
2596	filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; }
2597	\| SET filter_set { $$ = filter_opts; }
2598	;
2599
2600	filter_sets_l : filter_sets_l comma filter_set
2601	\| filter_set
2602	;
2603
2604	filter_set : prio {
2605	if (filter_opts.marker & FOM_SETPRIO) {
2606	yyerror("prio cannot be redefined");
2607	YYERROR;
2608	}
2609	filter_opts.marker \|= FOM_SETPRIO;
2610	filter_opts.set_prio[0] = $1.b1;
2611	filter_opts.set_prio[1] = $1.b2;
2612	}
2613	prio : PRIO NUMBER {
2614	if ($2 < 0 \|\| $2 > PF_PRIO_MAX) {
2615	yyerror("prio must be 0 - %u", PF_PRIO_MAX);
2616	YYERROR;
2617	}
2618	$$.b1 = $$.b2 = $2;
2619	}
2620	\| PRIO '(' NUMBER comma NUMBER ')' {
2621	if ($3 < 0 \|\| $3 > PF_PRIO_MAX \|\|
2622	$5 < 0 \|\| $5 > PF_PRIO_MAX) {
2623	yyerror("prio must be 0 - %u", PF_PRIO_MAX);
2624	YYERROR;
2625	}
2626	$$.b1 = $3;
2627	$$.b2 = $5;
2628	}
2629	;
2630
2631	probability : STRING {
2632	char *e;
2633	double p = strtod($1, &e);
2634
2635	if (*e == '%') {
2636	p *= 0.01;
2637	e++;
2638	}
2639	if (*e) {
2640	yyerror("invalid probability: %s", $1);
2641	free($1);
2642	YYERROR;
2643	}
2644	free($1);
2645	$$ = p;
2646	}
2647	\| NUMBER {
2648	$$ = (double)$1;
2649	}
2650	;
2651
2652
2653	action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
2654	\| BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; }
2655	;
2656
2657	blockspec : /* empty */ {
2658	$$.b2 = blockpolicy;
2659	$$.w = returnicmpdefault;
2660	$$.w2 = returnicmp6default;
2661	}
2662	\| DROP {
2663	$$.b2 = PFRULE_DROP;
2664	$$.w = 0;
2665	$$.w2 = 0;
2666	}
2667	\| RETURNRST {
2668	$$.b2 = PFRULE_RETURNRST;
2669	$$.w = 0;
2670	$$.w2 = 0;
2671	}
2672	\| RETURNRST '(' TTL NUMBER ')' {
2673	if ($4 < 0 \|\| $4 > 255) {
2674	yyerror("illegal ttl value %d", $4);
2675	YYERROR;
2676	}
2677	$$.b2 = PFRULE_RETURNRST;
2678	$$.w = $4;
2679	$$.w2 = 0;
2680	}
2681	\| RETURNICMP {
2682	$$.b2 = PFRULE_RETURNICMP;
2683	$$.w = returnicmpdefault;
2684	$$.w2 = returnicmp6default;
2685	}
2686	\| RETURNICMP6 {
2687	$$.b2 = PFRULE_RETURNICMP;
2688	$$.w = returnicmpdefault;
2689	$$.w2 = returnicmp6default;
2690	}
2691	\| RETURNICMP '(' reticmpspec ')' {
2692	$$.b2 = PFRULE_RETURNICMP;
2693	$$.w = $3;
2694	$$.w2 = returnicmpdefault;
2695	}
2696	\| RETURNICMP6 '(' reticmp6spec ')' {
2697	$$.b2 = PFRULE_RETURNICMP;
2698	$$.w = returnicmpdefault;
2699	$$.w2 = $3;
2700	}
2701	\| RETURNICMP '(' reticmpspec comma reticmp6spec ')' {
2702	$$.b2 = PFRULE_RETURNICMP;
2703	$$.w = $3;
2704	$$.w2 = $5;
2705	}
2706	\| RETURN {
2707	$$.b2 = PFRULE_RETURN;
2708	$$.w = returnicmpdefault;
2709	$$.w2 = returnicmp6default;
2710	}
2711	;
2712
2713	reticmpspec : STRING {
2714	if (!($$ = parseicmpspec($1, AF_INET))) {
2715	free($1);
2716	YYERROR;
2717	}
2718	free($1);
2719	}
2720	\| NUMBER {
2721	u_int8_t icmptype;
2722
2723	if ($1 < 0 \|\| $1 > 255) {
2724	yyerror("invalid icmp code %lu", $1);
2725	YYERROR;
2726	}
2727	icmptype = returnicmpdefault >> 8;
2728	$$ = (icmptype << 8 \| $1);
2729	}
2730	;
2731
2732	reticmp6spec : STRING {
2733	if (!($$ = parseicmpspec($1, AF_INET6))) {
2734	free($1);
2735	YYERROR;
2736	}
2737	free($1);
2738	}
2739	\| NUMBER {
2740	u_int8_t icmptype;
2741
2742	if ($1 < 0 \|\| $1 > 255) {
2743	yyerror("invalid icmp code %lu", $1);
2744	YYERROR;
2745	}
2746	icmptype = returnicmp6default >> 8;
2747	$$ = (icmptype << 8 \| $1);
2748	}
2749	;
2750
2751	dir : /* empty */ { $$ = PF_INOUT; }
2752	\| IN { $$ = PF_IN; }
2753	\| OUT { $$ = PF_OUT; }
2754	;
2755
2756	quick : /* empty */ { $$.quick = 0; }
2757	\| QUICK { $$.quick = 1; }
2758	;
2759
2760	logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; }
2761	\| log { $$ = $1; $$.quick = 0; }
2762	\| QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; }
2763	\| log QUICK { $$ = $1; $$.quick = 1; }
2764	\| QUICK log { $$ = $2; $$.quick = 1; }
2765	;
2766
2767	log : LOG { $$.log = PF_LOG; $$.logif = 0; }
2768	\| LOG '(' logopts ')' {
2769	$$.log = PF_LOG \| $3.log;
2770	$$.logif = $3.logif;
2771	}
2772	;
2773
2774	logopts : logopt { $$ = $1; }
2775	\| logopts comma logopt {
2776	$$.log = $1.log \| $3.log;
2777	$$.logif = $3.logif;
2778	if ($$.logif == 0)
2779	$$.logif = $1.logif;
2780	}
2781	;
2782
2783	logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; }
2784	\| USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2785	\| GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2786	\| TO string {
2787	const char *errstr;
2788	u_int i;
2789
2790	$$.log = 0;
2791	if (strncmp($2, "pflog", 5)) {
2792	yyerror("%s: should be a pflog interface", $2);
2793	free($2);
2794	YYERROR;
2795	}
2796	i = strtonum($2 + 5, 0, 255, &errstr);
2797	if (errstr) {
2798	yyerror("%s: %s", $2, errstr);
2799	free($2);
2800	YYERROR;
2801	}
2802	free($2);
2803	$$.logif = i;
2804	}
2805	;
2806
2807	interface : /* empty */ { $$ = NULL; }
2808	\| ON if_item_not { $$ = $2; }
2809	\| ON '{' optnl if_list '}' { $$ = $4; }
2810	;
2811
2812	if_list : if_item_not optnl { $$ = $1; }
2813	\| if_list comma if_item_not optnl {
2814	$1->tail->next = $3;
2815	$1->tail = $3;
2816	$$ = $1;
2817	}
2818	;
2819
2820	if_item_not : not if_item { $$ = $2; $$->not = $1; }
2821	;
2822
2823	if_item : STRING {
2824	struct node_host *n;
2825
2826	$$ = calloc(1, sizeof(struct node_if));
2827	if ($$ == NULL)
2828	err(1, "if_item: calloc");
2829	if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
2830	sizeof($$->ifname)) {
2831	free($1);
2832	free($$);
2833	yyerror("interface name too long");
2834	YYERROR;
2835	}
2836
2837	if ((n = ifa_exists($1)) != NULL)
2838	$$->ifa_flags = n->ifa_flags;
2839
2840	free($1);
2841	$$->not = 0;
2842	$$->next = NULL;
2843	$$->tail = $$;
2844	}
2845	;
2846
2847	af : /* empty */ { $$ = 0; }
2848	\| INET { $$ = AF_INET; }
2849	\| INET6 { $$ = AF_INET6; }
2850	;
2851
2852	proto : /* empty */ { $$ = NULL; }
2853	\| PROTO proto_item { $$ = $2; }
2854	\| PROTO '{' optnl proto_list '}' { $$ = $4; }
2855	;
2856
2857	proto_list : proto_item optnl { $$ = $1; }
2858	\| proto_list comma proto_item optnl {
2859	$1->tail->next = $3;
2860	$1->tail = $3;
2861	$$ = $1;
2862	}
2863	;
2864
2865	proto_item : protoval {
2866	u_int8_t pr;
2867
2868	pr = (u_int8_t)$1;
2869	if (pr == 0) {
2870	yyerror("proto 0 cannot be used");
2871	YYERROR;
2872	}
2873	$$ = calloc(1, sizeof(struct node_proto));
2874	if ($$ == NULL)
2875	err(1, "proto_item: calloc");
2876	$$->proto = pr;
2877	$$->next = NULL;
2878	$$->tail = $$;
2879	}
2880	;
2881
2882	protoval : STRING {
2883	struct protoent *p;
2884
2885	p = getprotobyname($1);
2886	if (p == NULL) {
2887	yyerror("unknown protocol %s", $1);
2888	free($1);
2889	YYERROR;
2890	}
2891	$$ = p->p_proto;
2892	free($1);
2893	}
2894	\| NUMBER {
2895	if ($1 < 0 \|\| $1 > 255) {
2896	yyerror("protocol outside range");
2897	YYERROR;
2898	}
2899	}
2900	;
2901
2902	fromto : ALL {
2903	$$.src.host = NULL;
2904	$$.src.port = NULL;
2905	$$.dst.host = NULL;
2906	$$.dst.port = NULL;
2907	$$.src_os = NULL;
2908	}
2909	\| from os to {
2910	$$.src = $1;
2911	$$.src_os = $2;
2912	$$.dst = $3;
2913	}
2914	;
2915
2916	os : /* empty */ { $$ = NULL; }
2917	\| OS xos { $$ = $2; }
2918	\| OS '{' optnl os_list '}' { $$ = $4; }
2919	;
2920
2921	xos : STRING {
2922	$$ = calloc(1, sizeof(struct node_os));
2923	if ($$ == NULL)
2924	err(1, "os: calloc");
2925	$$->os = $1;
2926	$$->tail = $$;
2927	}
2928	;
2929
2930	os_list : xos optnl { $$ = $1; }
2931	\| os_list comma xos optnl {
2932	$1->tail->next = $3;
2933	$1->tail = $3;
2934	$$ = $1;
2935	}
2936	;
2937
2938	from : /* empty */ {
2939	$$.host = NULL;
2940	$$.port = NULL;
2941	}
2942	\| FROM ipportspec {
2943	$$ = $2;
2944	}
2945	;
2946
2947	to : /* empty */ {
2948	$$.host = NULL;
2949	$$.port = NULL;
2950	}
2951	\| TO ipportspec {
2952	if (disallow_urpf_failed($2.host, "\"urpf-failed\" is "
2953	"not permitted in a destination address"))
2954	YYERROR;
2955	$$ = $2;
2956	}
2957	;
2958
2959	ipportspec : ipspec {
2960	$$.host = $1;
2961	$$.port = NULL;
2962	}
2963	\| ipspec PORT portspec {
2964	$$.host = $1;
2965	$$.port = $3;
2966	}
2967	\| PORT portspec {
2968	$$.host = NULL;
2969	$$.port = $2;
2970	}
2971	;
2972
2973	optnl : '\n' optnl
2974	\|
2975	;
2976
2977	ipspec : ANY { $$ = NULL; }
2978	\| xhost { $$ = $1; }
2979	\| '{' optnl host_list '}' { $$ = $3; }
2980	;
2981
2982	toipspec : TO ipspec { $$ = $2; }
2983	\| /* empty */ { $$ = NULL; }
2984	;
2985
2986	host_list : ipspec optnl { $$ = $1; }
2987	\| host_list comma ipspec optnl {
2988	if ($3 == NULL)
2989	$$ = $1;
2990	else if ($1 == NULL)
2991	$$ = $3;
2992	else {
2993	$1->tail->next = $3;
2994	$1->tail = $3->tail;
2995	$$ = $1;
2996	}
2997	}
2998	;
2999
3000	xhost : not host {
3001	struct node_host *n;
3002
3003	for (n = $2; n != NULL; n = n->next)
3004	n->not = $1;
3005	$$ = $2;
3006	}
3007	\| not NOROUTE {
3008	$$ = calloc(1, sizeof(struct node_host));
3009	if ($$ == NULL)
3010	err(1, "xhost: calloc");
3011	$$->addr.type = PF_ADDR_NOROUTE;
3012	$$->next = NULL;
3013	$$->not = $1;
3014	$$->tail = $$;
3015	}
3016	\| not URPFFAILED {
3017	$$ = calloc(1, sizeof(struct node_host));
3018	if ($$ == NULL)
3019	err(1, "xhost: calloc");
3020	$$->addr.type = PF_ADDR_URPFFAILED;
3021	$$->next = NULL;
3022	$$->not = $1;
3023	$$->tail = $$;
3024	}
3025	;
3026
3027	host : STRING {
3028	if (($$ = host($1)) == NULL) {
3029	/* error. "any" is handled elsewhere */
3030	free($1);
3031	yyerror("could not parse host specification");
3032	YYERROR;
3033	}
3034	free($1);
3035
3036	}
3037	\| STRING '-' STRING {
3038	struct node_host b, e;
3039
3040	if ((b = host($1)) == NULL \|\| (e = host($3)) == NULL) {
3041	free($1);
3042	free($3);
3043	yyerror("could not parse host specification");
3044	YYERROR;
3045	}
3046	if (b->af != e->af \|\|
3047	b->addr.type != PF_ADDR_ADDRMASK \|\|
3048	e->addr.type != PF_ADDR_ADDRMASK \|\|
3049	unmask(&b->addr.v.a.mask, b->af) !=
3050	(b->af == AF_INET ? 32 : 128) \|\|
3051	unmask(&e->addr.v.a.mask, e->af) !=
3052	(e->af == AF_INET ? 32 : 128) \|\|
3053	b->next != NULL \|\| b->not \|\|
3054	e->next != NULL \|\| e->not) {
3055	free(b);
3056	free(e);
3057	free($1);
3058	free($3);
3059	yyerror("invalid address range");
3060	YYERROR;
3061	}
3062	memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr,
3063	sizeof(b->addr.v.a.mask));
3064	b->addr.type = PF_ADDR_RANGE;
3065	$$ = b;
3066	free(e);
3067	free($1);
3068	free($3);
3069	}
3070	\| STRING '/' NUMBER {
3071	char *buf;
3072
3073	if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1)
3074	err(1, "host: asprintf");
3075	free($1);
3076	if (($$ = host(buf)) == NULL) {
3077	/* error. "any" is handled elsewhere */
3078	free(buf);
3079	yyerror("could not parse host specification");
3080	YYERROR;
3081	}
3082	free(buf);
3083	}
3084	\| NUMBER '/' NUMBER {
3085	char *buf;
3086
3087	/* ie. for 10/8 parsing */
3088	#ifdef __FreeBSD__
3089	if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1)
3090	#else
3091	if (asprintf(&buf, "%lld/%lld", $1, $3) == -1)
3092	#endif
3093	err(1, "host: asprintf");
3094	if (($$ = host(buf)) == NULL) {
3095	/* error. "any" is handled elsewhere */
3096	free(buf);
3097	yyerror("could not parse host specification");
3098	YYERROR;
3099	}
3100	free(buf);
3101	}
3102	\| dynaddr
3103	\| dynaddr '/' NUMBER {
3104	struct node_host *n;
3105
3106	if ($3 < 0 \|\| $3 > 128) {
3107	yyerror("bit number too big");
3108	YYERROR;
3109	}
3110	$$ = $1;
3111	for (n = $1; n != NULL; n = n->next)
3112	set_ipmask(n, $3);
3113	}
3114	\| '<' STRING '>' {
3115	if (strlen($2) >= PF_TABLE_NAME_SIZE) {
3116	yyerror("table name '%s' too long", $2);
3117	free($2);
3118	YYERROR;
3119	}
3120	$$ = calloc(1, sizeof(struct node_host));
3121	if ($$ == NULL)
3122	err(1, "host: calloc");
3123	$$->addr.type = PF_ADDR_TABLE;
3124	if (strlcpy($$->addr.v.tblname, $2,
3125	sizeof($$->addr.v.tblname)) >=
3126	sizeof($$->addr.v.tblname))
3127	errx(1, "host: strlcpy");
3128	free($2);
3129	$$->next = NULL;
3130	$$->tail = $$;
3131	}
3132	;
3133
3134	number : NUMBER
3135	\| STRING {
3136	u_long ulval;
3137
3138	if (atoul($1, &ulval) == -1) {
3139	yyerror("%s is not a number", $1);
3140	free($1);
3141	YYERROR;
3142	} else
3143	$$ = ulval;
3144	free($1);
3145	}
3146	;
3147
3148	dynaddr : '(' STRING ')' {
3149	int flags = 0;
3150	char p, op;
3151
3152	op = $2;
3153	if (!isalpha(op[0])) {
3154	yyerror("invalid interface name '%s'", op);
3155	free(op);
3156	YYERROR;
3157	}
3158	while ((p = strrchr($2, ':')) != NULL) {
3159	if (!strcmp(p+1, "network"))
3160	flags \|= PFI_AFLAG_NETWORK;
3161	else if (!strcmp(p+1, "broadcast"))
3162	flags \|= PFI_AFLAG_BROADCAST;
3163	else if (!strcmp(p+1, "peer"))
3164	flags \|= PFI_AFLAG_PEER;
3165	else if (!strcmp(p+1, "0"))
3166	flags \|= PFI_AFLAG_NOALIAS;
3167	else {
3168	yyerror("interface %s has bad modifier",
3169	$2);
3170	free(op);
3171	YYERROR;
3172	}
3173	*p = '\0';
3174	}
3175	if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
3176	free(op);
3177	yyerror("illegal combination of "
3178	"interface modifiers");
3179	YYERROR;
3180	}
3181	$$ = calloc(1, sizeof(struct node_host));
3182	if ($$ == NULL)
3183	err(1, "address: calloc");
3184	$$->af = 0;
3185	set_ipmask($$, 128);
3186	$$->addr.type = PF_ADDR_DYNIFTL;
3187	$$->addr.iflags = flags;
3188	if (strlcpy($$->addr.v.ifname, $2,
3189	sizeof($$->addr.v.ifname)) >=
3190	sizeof($$->addr.v.ifname)) {
3191	free(op);
3192	free($$);
3193	yyerror("interface name too long");
3194	YYERROR;
3195	}
3196	free(op);
3197	$$->next = NULL;
3198	$$->tail = $$;
3199	}
3200	;
3201
3202	portspec : port_item { $$ = $1; }
3203	\| '{' optnl port_list '}' { $$ = $3; }
3204	;
3205
3206	port_list : port_item optnl { $$ = $1; }
3207	\| port_list comma port_item optnl {
3208	$1->tail->next = $3;
3209	$1->tail = $3;
3210	$$ = $1;
3211	}
3212	;
3213
3214	port_item : portrange {
3215	$$ = calloc(1, sizeof(struct node_port));
3216	if ($$ == NULL)
3217	err(1, "port_item: calloc");
3218	$$->port[0] = $1.a;
3219	$$->port[1] = $1.b;
3220	if ($1.t)
3221	$$->op = PF_OP_RRG;
3222	else
3223	$$->op = PF_OP_EQ;
3224	$$->next = NULL;
3225	$$->tail = $$;
3226	}
3227	\| unaryop portrange {
3228	if ($2.t) {
3229	yyerror("':' cannot be used with an other "
3230	"port operator");
3231	YYERROR;
3232	}
3233	$$ = calloc(1, sizeof(struct node_port));
3234	if ($$ == NULL)
3235	err(1, "port_item: calloc");
3236	$$->port[0] = $2.a;
3237	$$->port[1] = $2.b;
3238	$$->op = $1;
3239	$$->next = NULL;
3240	$$->tail = $$;
3241	}
3242	\| portrange PORTBINARY portrange {
3243	if ($1.t \|\| $3.t) {
3244	yyerror("':' cannot be used with an other "
3245	"port operator");
3246	YYERROR;
3247	}
3248	$$ = calloc(1, sizeof(struct node_port));
3249	if ($$ == NULL)
3250	err(1, "port_item: calloc");
3251	$$->port[0] = $1.a;
3252	$$->port[1] = $3.a;
3253	$$->op = $2;
3254	$$->next = NULL;
3255	$$->tail = $$;
3256	}
3257	;
3258
3259	portplain : numberstring {
3260	if (parseport($1, &$$, 0) == -1) {
3261	free($1);
3262	YYERROR;
3263	}
3264	free($1);
3265	}
3266	;
3267
3268	portrange : numberstring {
3269	if (parseport($1, &$$, PPORT_RANGE) == -1) {
3270	free($1);
3271	YYERROR;
3272	}
3273	free($1);
3274	}
3275	;
3276
3277	uids : uid_item { $$ = $1; }
3278	\| '{' optnl uid_list '}' { $$ = $3; }
3279	;
3280
3281	uid_list : uid_item optnl { $$ = $1; }
3282	\| uid_list comma uid_item optnl {
3283	$1->tail->next = $3;
3284	$1->tail = $3;
3285	$$ = $1;
3286	}
3287	;
3288
3289	uid_item : uid {
3290	$$ = calloc(1, sizeof(struct node_uid));
3291	if ($$ == NULL)
3292	err(1, "uid_item: calloc");
3293	$$->uid[0] = $1;
3294	$$->uid[1] = $1;
3295	$$->op = PF_OP_EQ;
3296	$$->next = NULL;
3297	$$->tail = $$;
3298	}
3299	\| unaryop uid {
3300	if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
3301	yyerror("user unknown requires operator = or "
3302	"!=");
3303	YYERROR;
3304	}
3305	$$ = calloc(1, sizeof(struct node_uid));
3306	if ($$ == NULL)
3307	err(1, "uid_item: calloc");
3308	$$->uid[0] = $2;
3309	$$->uid[1] = $2;
3310	$$->op = $1;
3311	$$->next = NULL;
3312	$$->tail = $$;
3313	}
3314	\| uid PORTBINARY uid {
3315	if ($1 == UID_MAX \|\| $3 == UID_MAX) {
3316	yyerror("user unknown requires operator = or "
3317	"!=");
3318	YYERROR;
3319	}
3320	$$ = calloc(1, sizeof(struct node_uid));
3321	if ($$ == NULL)
3322	err(1, "uid_item: calloc");
3323	$$->uid[0] = $1;
3324	$$->uid[1] = $3;
3325	$$->op = $2;
3326	$$->next = NULL;
3327	$$->tail = $$;
3328	}
3329	;
3330
3331	uid : STRING {
3332	if (!strcmp($1, "unknown"))
3333	$$ = UID_MAX;
3334	else {
3335	struct passwd *pw;
3336
3337	if ((pw = getpwnam($1)) == NULL) {
3338	yyerror("unknown user %s", $1);
3339	free($1);
3340	YYERROR;
3341	}
3342	$$ = pw->pw_uid;
3343	}
3344	free($1);
3345	}
3346	\| NUMBER {
3347	if ($1 < 0 \|\| $1 >= UID_MAX) {
3348	yyerror("illegal uid value %lu", $1);
3349	YYERROR;
3350	}
3351	$$ = $1;
3352	}
3353	;
3354
3355	gids : gid_item { $$ = $1; }
3356	\| '{' optnl gid_list '}' { $$ = $3; }
3357	;
3358
3359	gid_list : gid_item optnl { $$ = $1; }
3360	\| gid_list comma gid_item optnl {
3361	$1->tail->next = $3;
3362	$1->tail = $3;
3363	$$ = $1;
3364	}
3365	;
3366
3367	gid_item : gid {
3368	$$ = calloc(1, sizeof(struct node_gid));
3369	if ($$ == NULL)
3370	err(1, "gid_item: calloc");
3371	$$->gid[0] = $1;
3372	$$->gid[1] = $1;
3373	$$->op = PF_OP_EQ;
3374	$$->next = NULL;
3375	$$->tail = $$;
3376	}
3377	\| unaryop gid {
3378	if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
3379	yyerror("group unknown requires operator = or "
3380	"!=");
3381	YYERROR;
3382	}
3383	$$ = calloc(1, sizeof(struct node_gid));
3384	if ($$ == NULL)
3385	err(1, "gid_item: calloc");
3386	$$->gid[0] = $2;
3387	$$->gid[1] = $2;
3388	$$->op = $1;
3389	$$->next = NULL;
3390	$$->tail = $$;
3391	}
3392	\| gid PORTBINARY gid {
3393	if ($1 == GID_MAX \|\| $3 == GID_MAX) {
3394	yyerror("group unknown requires operator = or "
3395	"!=");
3396	YYERROR;
3397	}
3398	$$ = calloc(1, sizeof(struct node_gid));
3399	if ($$ == NULL)
3400	err(1, "gid_item: calloc");
3401	$$->gid[0] = $1;
3402	$$->gid[1] = $3;
3403	$$->op = $2;
3404	$$->next = NULL;
3405	$$->tail = $$;
3406	}
3407	;
3408
3409	gid : STRING {
3410	if (!strcmp($1, "unknown"))
3411	$$ = GID_MAX;
3412	else {
3413	struct group *grp;
3414
3415	if ((grp = getgrnam($1)) == NULL) {
3416	yyerror("unknown group %s", $1);
3417	free($1);
3418	YYERROR;
3419	}
3420	$$ = grp->gr_gid;
3421	}
3422	free($1);
3423	}
3424	\| NUMBER {
3425	if ($1 < 0 \|\| $1 >= GID_MAX) {
3426	yyerror("illegal gid value %lu", $1);
3427	YYERROR;
3428	}
3429	$$ = $1;
3430	}
3431	;
3432
3433	flag : STRING {
3434	int f;
3435
3436	if ((f = parse_flags($1)) < 0) {
3437	yyerror("bad flags %s", $1);
3438	free($1);
3439	YYERROR;
3440	}
3441	free($1);
3442	$$.b1 = f;
3443	}
3444	;
3445
3446	flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; }
3447	\| FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; }
3448	\| FLAGS ANY { $$.b1 = 0; $$.b2 = 0; }
3449	;
3450
3451	icmpspec : ICMPTYPE icmp_item { $$ = $2; }
3452	\| ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; }
3453	\| ICMP6TYPE icmp6_item { $$ = $2; }
3454	\| ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; }
3455	;
3456
3457	icmp_list : icmp_item optnl { $$ = $1; }
3458	\| icmp_list comma icmp_item optnl {
3459	$1->tail->next = $3;
3460	$1->tail = $3;
3461	$$ = $1;
3462	}
3463	;
3464
3465	icmp6_list : icmp6_item optnl { $$ = $1; }
3466	\| icmp6_list comma icmp6_item optnl {
3467	$1->tail->next = $3;
3468	$1->tail = $3;
3469	$$ = $1;
3470	}
3471	;
3472
3473	icmp_item : icmptype {
3474	$$ = calloc(1, sizeof(struct node_icmp));
3475	if ($$ == NULL)
3476	err(1, "icmp_item: calloc");
3477	$$->type = $1;
3478	$$->code = 0;
3479	$$->proto = IPPROTO_ICMP;
3480	$$->next = NULL;
3481	$$->tail = $$;
3482	}
3483	\| icmptype CODE STRING {
3484	const struct icmpcodeent *p;
3485
3486	if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) {
3487	yyerror("unknown icmp-code %s", $3);
3488	free($3);
3489	YYERROR;
3490	}
3491
3492	free($3);
3493	$$ = calloc(1, sizeof(struct node_icmp));
3494	if ($$ == NULL)
3495	err(1, "icmp_item: calloc");
3496	$$->type = $1;
3497	$$->code = p->code + 1;
3498	$$->proto = IPPROTO_ICMP;
3499	$$->next = NULL;
3500	$$->tail = $$;
3501	}
3502	\| icmptype CODE NUMBER {
3503	if ($3 < 0 \|\| $3 > 255) {
3504	yyerror("illegal icmp-code %lu", $3);
3505	YYERROR;
3506	}
3507	$$ = calloc(1, sizeof(struct node_icmp));
3508	if ($$ == NULL)
3509	err(1, "icmp_item: calloc");
3510	$$->type = $1;
3511	$$->code = $3 + 1;
3512	$$->proto = IPPROTO_ICMP;
3513	$$->next = NULL;
3514	$$->tail = $$;
3515	}
3516	;
3517
3518	icmp6_item : icmp6type {
3519	$$ = calloc(1, sizeof(struct node_icmp));
3520	if ($$ == NULL)
3521	err(1, "icmp_item: calloc");
3522	$$->type = $1;
3523	$$->code = 0;
3524	$$->proto = IPPROTO_ICMPV6;
3525	$$->next = NULL;
3526	$$->tail = $$;
3527	}
3528	\| icmp6type CODE STRING {
3529	const struct icmpcodeent *p;
3530
3531	if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) {
3532	yyerror("unknown icmp6-code %s", $3);
3533	free($3);
3534	YYERROR;
3535	}
3536	free($3);
3537
3538	$$ = calloc(1, sizeof(struct node_icmp));
3539	if ($$ == NULL)
3540	err(1, "icmp_item: calloc");
3541	$$->type = $1;
3542	$$->code = p->code + 1;
3543	$$->proto = IPPROTO_ICMPV6;
3544	$$->next = NULL;
3545	$$->tail = $$;
3546	}
3547	\| icmp6type CODE NUMBER {
3548	if ($3 < 0 \|\| $3 > 255) {
3549	yyerror("illegal icmp-code %lu", $3);
3550	YYERROR;
3551	}
3552	$$ = calloc(1, sizeof(struct node_icmp));
3553	if ($$ == NULL)
3554	err(1, "icmp_item: calloc");
3555	$$->type = $1;
3556	$$->code = $3 + 1;
3557	$$->proto = IPPROTO_ICMPV6;
3558	$$->next = NULL;
3559	$$->tail = $$;
3560	}
3561	;
3562
3563	icmptype : STRING {
3564	const struct icmptypeent *p;
3565
3566	if ((p = geticmptypebyname($1, AF_INET)) == NULL) {
3567	yyerror("unknown icmp-type %s", $1);
3568	free($1);
3569	YYERROR;
3570	}
3571	$$ = p->type + 1;
3572	free($1);
3573	}
3574	\| NUMBER {
3575	if ($1 < 0 \|\| $1 > 255) {
3576	yyerror("illegal icmp-type %lu", $1);
3577	YYERROR;
3578	}
3579	$$ = $1 + 1;
3580	}
3581	;
3582
3583	icmp6type : STRING {
3584	const struct icmptypeent *p;
3585
3586	if ((p = geticmptypebyname($1, AF_INET6)) ==
3587	NULL) {
3588	yyerror("unknown icmp6-type %s", $1);
3589	free($1);
3590	YYERROR;
3591	}
3592	$$ = p->type + 1;
3593	free($1);
3594	}
3595	\| NUMBER {
3596	if ($1 < 0 \|\| $1 > 255) {
3597	yyerror("illegal icmp6-type %lu", $1);
3598	YYERROR;
3599	}
3600	$$ = $1 + 1;
3601	}
3602	;
3603
3604	tos : STRING {
3605	int val;
3606	char *end;
3607
3608	if (map_tos($1, &val))
3609	$$ = val;
3610	else if ($1[0] == '0' && $1[1] == 'x') {
3611	errno = 0;
3612	$$ = strtoul($1, &end, 16);
3613	if (errno \|\| *end != '\0')
3614	$$ = 256;
3615	} else
3616	$$ = 256; /* flag bad argument */
3617	if ($$ < 0 \|\| $$ > 255) {
3618	yyerror("illegal tos value %s", $1);
3619	free($1);
3620	YYERROR;
3621	}
3622	free($1);
3623	}
3624	\| NUMBER {
3625	$$ = $1;
3626	if ($$ < 0 \|\| $$ > 255) {
3627	yyerror("illegal tos value %s", $1);
3628	YYERROR;
3629	}
3630	}
3631	;
3632
3633	sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; }
3634	\| SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; }
3635	\| SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; }
3636	;
3637
3638	statelock : IFBOUND {
3639	$$ = PFRULE_IFBOUND;
3640	}
3641	\| FLOATING {
3642	$$ = 0;
3643	}
3644	;
3645
3646	keep : NO STATE {
3647	$$.action = 0;
3648	$$.options = NULL;
3649	}
3650	\| KEEP STATE state_opt_spec {
3651	$$.action = PF_STATE_NORMAL;
3652	$$.options = $3;
3653	}
3654	\| MODULATE STATE state_opt_spec {
3655	$$.action = PF_STATE_MODULATE;
3656	$$.options = $3;
3657	}
3658	\| SYNPROXY STATE state_opt_spec {
3659	$$.action = PF_STATE_SYNPROXY;
3660	$$.options = $3;
3661	}
3662	;
3663
3664	flush : /* empty */ { $$ = 0; }
3665	\| FLUSH { $$ = PF_FLUSH; }
3666	\| FLUSH GLOBAL {
3667	$$ = PF_FLUSH \| PF_FLUSH_GLOBAL;
3668	}
3669	;
3670
3671	state_opt_spec : '(' state_opt_list ')' { $$ = $2; }
3672	\| /* empty */ { $$ = NULL; }
3673	;
3674
3675	state_opt_list : state_opt_item { $$ = $1; }
3676	\| state_opt_list comma state_opt_item {
3677	$1->tail->next = $3;
3678	$1->tail = $3;
3679	$$ = $1;
3680	}
3681	;
3682
3683	state_opt_item : MAXIMUM NUMBER {
3684	if ($2 < 0 \|\| $2 > UINT_MAX) {
3685	yyerror("only positive values permitted");
3686	YYERROR;
3687	}
3688	$$ = calloc(1, sizeof(struct node_state_opt));
3689	if ($$ == NULL)
3690	err(1, "state_opt_item: calloc");
3691	$$->type = PF_STATE_OPT_MAX;
3692	$$->data.max_states = $2;
3693	$$->next = NULL;
3694	$$->tail = $$;
3695	}
3696	\| NOSYNC {
3697	$$ = calloc(1, sizeof(struct node_state_opt));
3698	if ($$ == NULL)
3699	err(1, "state_opt_item: calloc");
3700	$$->type = PF_STATE_OPT_NOSYNC;
3701	$$->next = NULL;
3702	$$->tail = $$;
3703	}
3704	\| MAXSRCSTATES NUMBER {
3705	if ($2 < 0 \|\| $2 > UINT_MAX) {
3706	yyerror("only positive values permitted");
3707	YYERROR;
3708	}
3709	$$ = calloc(1, sizeof(struct node_state_opt));
3710	if ($$ == NULL)
3711	err(1, "state_opt_item: calloc");
3712	$$->type = PF_STATE_OPT_MAX_SRC_STATES;
3713	$$->data.max_src_states = $2;
3714	$$->next = NULL;
3715	$$->tail = $$;
3716	}
3717	\| MAXSRCCONN NUMBER {
3718	if ($2 < 0 \|\| $2 > UINT_MAX) {
3719	yyerror("only positive values permitted");
3720	YYERROR;
3721	}
3722	$$ = calloc(1, sizeof(struct node_state_opt));
3723	if ($$ == NULL)
3724	err(1, "state_opt_item: calloc");
3725	$$->type = PF_STATE_OPT_MAX_SRC_CONN;
3726	$$->data.max_src_conn = $2;
3727	$$->next = NULL;
3728	$$->tail = $$;
3729	}
3730	\| MAXSRCCONNRATE NUMBER '/' NUMBER {
3731	if ($2 < 0 \|\| $2 > UINT_MAX \|\|
3732	$4 < 0 \|\| $4 > UINT_MAX) {
3733	yyerror("only positive values permitted");
3734	YYERROR;
3735	}
3736	$$ = calloc(1, sizeof(struct node_state_opt));
3737	if ($$ == NULL)
3738	err(1, "state_opt_item: calloc");
3739	$$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
3740	$$->data.max_src_conn_rate.limit = $2;
3741	$$->data.max_src_conn_rate.seconds = $4;
3742	$$->next = NULL;
3743	$$->tail = $$;
3744	}
3745	\| OVERLOAD '<' STRING '>' flush {
3746	if (strlen($3) >= PF_TABLE_NAME_SIZE) {
3747	yyerror("table name '%s' too long", $3);
3748	free($3);
3749	YYERROR;
3750	}
3751	$$ = calloc(1, sizeof(struct node_state_opt));
3752	if ($$ == NULL)
3753	err(1, "state_opt_item: calloc");
3754	if (strlcpy($$->data.overload.tblname, $3,
3755	PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
3756	errx(1, "state_opt_item: strlcpy");
3757	free($3);
3758	$$->type = PF_STATE_OPT_OVERLOAD;
3759	$$->data.overload.flush = $5;
3760	$$->next = NULL;
3761	$$->tail = $$;
3762	}
3763	\| MAXSRCNODES NUMBER {
3764	if ($2 < 0 \|\| $2 > UINT_MAX) {
3765	yyerror("only positive values permitted");
3766	YYERROR;
3767	}
3768	$$ = calloc(1, sizeof(struct node_state_opt));
3769	if ($$ == NULL)
3770	err(1, "state_opt_item: calloc");
3771	$$->type = PF_STATE_OPT_MAX_SRC_NODES;
3772	$$->data.max_src_nodes = $2;
3773	$$->next = NULL;
3774	$$->tail = $$;
3775	}
3776	\| sourcetrack {
3777	$$ = calloc(1, sizeof(struct node_state_opt));
3778	if ($$ == NULL)
3779	err(1, "state_opt_item: calloc");
3780	$$->type = PF_STATE_OPT_SRCTRACK;
3781	$$->data.src_track = $1;
3782	$$->next = NULL;
3783	$$->tail = $$;
3784	}
3785	\| statelock {
3786	$$ = calloc(1, sizeof(struct node_state_opt));
3787	if ($$ == NULL)
3788	err(1, "state_opt_item: calloc");
3789	$$->type = PF_STATE_OPT_STATELOCK;
3790	$$->data.statelock = $1;
3791	$$->next = NULL;
3792	$$->tail = $$;
3793	}
3794	\| SLOPPY {
3795	$$ = calloc(1, sizeof(struct node_state_opt));
3796	if ($$ == NULL)
3797	err(1, "state_opt_item: calloc");
3798	$$->type = PF_STATE_OPT_SLOPPY;
3799	$$->next = NULL;
3800	$$->tail = $$;
3801	}
3802	\| STRING NUMBER {
3803	int i;
3804
3805	if ($2 < 0 \|\| $2 > UINT_MAX) {
3806	yyerror("only positive values permitted");
3807	YYERROR;
3808	}
3809	for (i = 0; pf_timeouts[i].name &&
3810	strcmp(pf_timeouts[i].name, $1); ++i)
3811	; /* nothing */
3812	if (!pf_timeouts[i].name) {
3813	yyerror("illegal timeout name %s", $1);
3814	free($1);
3815	YYERROR;
3816	}
3817	if (strchr(pf_timeouts[i].name, '.') == NULL) {
3818	yyerror("illegal state timeout %s", $1);
3819	free($1);
3820	YYERROR;
3821	}
3822	free($1);
3823	$$ = calloc(1, sizeof(struct node_state_opt));
3824	if ($$ == NULL)
3825	err(1, "state_opt_item: calloc");
3826	$$->type = PF_STATE_OPT_TIMEOUT;
3827	$$->data.timeout.number = pf_timeouts[i].timeout;
3828	$$->data.timeout.seconds = $2;
3829	$$->next = NULL;
3830	$$->tail = $$;
3831	}
3832	;
3833
3834	label : LABEL STRING {
3835	$$ = $2;
3836	}
3837	;
3838
3839	qname : QUEUE STRING {
3840	$$.qname = $2;
3841	$$.pqname = NULL;
3842	}
3843	\| QUEUE '(' STRING ')' {
3844	$$.qname = $3;
3845	$$.pqname = NULL;
3846	}
3847	\| QUEUE '(' STRING comma STRING ')' {
3848	$$.qname = $3;
3849	$$.pqname = $5;
3850	}
3851	;
3852
3853	no : /* empty */ { $$ = 0; }
3854	\| NO { $$ = 1; }
3855	;
3856
3857	portstar : numberstring {
3858	if (parseport($1, &$$, PPORT_RANGE\|PPORT_STAR) == -1) {
3859	free($1);
3860	YYERROR;
3861	}
3862	free($1);
3863	}
3864	;
3865
3866	redirspec : host { $$ = $1; }
3867	\| '{' optnl redir_host_list '}' { $$ = $3; }
3868	;
3869
3870	redir_host_list : host optnl { $$ = $1; }
3871	\| redir_host_list comma host optnl {
3872	$1->tail->next = $3;
3873	$1->tail = $3->tail;
3874	$$ = $1;
3875	}
3876	;
3877
3878	redirpool : /* empty */ { $$ = NULL; }
3879	\| ARROW redirspec {
3880	$$ = calloc(1, sizeof(struct redirection));
3881	if ($$ == NULL)
3882	err(1, "redirection: calloc");
3883	$$->host = $2;
3884	$$->rport.a = $$->rport.b = $$->rport.t = 0;
3885	}
3886	\| ARROW redirspec PORT portstar {
3887	$$ = calloc(1, sizeof(struct redirection));
3888	if ($$ == NULL)
3889	err(1, "redirection: calloc");
3890	$$->host = $2;
3891	$$->rport = $4;
3892	}
3893	;
3894
3895	hashkey : /* empty */
3896	{
3897	$$ = calloc(1, sizeof(struct pf_poolhashkey));
3898	if ($$ == NULL)
3899	err(1, "hashkey: calloc");
3900	$$->key32[0] = arc4random();
3901	$$->key32[1] = arc4random();
3902	$$->key32[2] = arc4random();
3903	$$->key32[3] = arc4random();
3904	}
3905	\| string
3906	{
3907	if (!strncmp($1, "0x", 2)) {
3908	if (strlen($1) != 34) {
3909	free($1);
3910	yyerror("hex key must be 128 bits "
3911	"(32 hex digits) long");
3912	YYERROR;
3913	}
3914	$$ = calloc(1, sizeof(struct pf_poolhashkey));
3915	if ($$ == NULL)
3916	err(1, "hashkey: calloc");
3917
3918	if (sscanf($1, "0x%8x%8x%8x%8x",
3919	&$$->key32[0], &$$->key32[1],
3920	&$$->key32[2], &$$->key32[3]) != 4) {
3921	free($$);
3922	free($1);
3923	yyerror("invalid hex key");
3924	YYERROR;
3925	}
3926	} else {
3927	MD5_CTX context;
3928
3929	$$ = calloc(1, sizeof(struct pf_poolhashkey));
3930	if ($$ == NULL)
3931	err(1, "hashkey: calloc");
3932	MD5Init(&context);
3933	MD5Update(&context, (unsigned char *)$1,
3934	strlen($1));
3935	MD5Final((unsigned char *)$$, &context);
3936	HTONL($$->key32[0]);
3937	HTONL($$->key32[1]);
3938	HTONL($$->key32[2]);
3939	HTONL($$->key32[3]);
3940	}
3941	free($1);
3942	}
3943	;
3944
3945	pool_opts : { bzero(&pool_opts, sizeof pool_opts); }
3946	pool_opts_l
3947	{ $$ = pool_opts; }
3948	\| /* empty */ {
3949	bzero(&pool_opts, sizeof pool_opts);
3950	$$ = pool_opts;
3951	}
3952	;
3953
3954	pool_opts_l : pool_opts_l pool_opt
3955	\| pool_opt
3956	;
3957
3958	pool_opt : BITMASK {
3959	if (pool_opts.type) {
3960	yyerror("pool type cannot be redefined");
3961	YYERROR;
3962	}
3963	pool_opts.type = PF_POOL_BITMASK;
3964	}
3965	\| RANDOM {
3966	if (pool_opts.type) {
3967	yyerror("pool type cannot be redefined");
3968	YYERROR;
3969	}
3970	pool_opts.type = PF_POOL_RANDOM;
3971	}
3972	\| SOURCEHASH hashkey {
3973	if (pool_opts.type) {
3974	yyerror("pool type cannot be redefined");
3975	YYERROR;
3976	}
3977	pool_opts.type = PF_POOL_SRCHASH;
3978	pool_opts.key = $2;
3979	}
3980	\| ROUNDROBIN {
3981	if (pool_opts.type) {
3982	yyerror("pool type cannot be redefined");
3983	YYERROR;
3984	}
3985	pool_opts.type = PF_POOL_ROUNDROBIN;
3986	}
3987	\| STATICPORT {
3988	if (pool_opts.staticport) {
3989	yyerror("static-port cannot be redefined");
3990	YYERROR;
3991	}
3992	pool_opts.staticport = 1;
3993	}
3994	\| STICKYADDRESS {
3995	if (filter_opts.marker & POM_STICKYADDRESS) {
3996	yyerror("sticky-address cannot be redefined");
3997	YYERROR;
3998	}
3999	pool_opts.marker \|= POM_STICKYADDRESS;
4000	pool_opts.opts \|= PF_POOL_STICKYADDR;
4001	}
4002	;
4003
4004	redirection : /* empty */ { $$ = NULL; }
4005	\| ARROW host {
4006	$$ = calloc(1, sizeof(struct redirection));
4007	if ($$ == NULL)
4008	err(1, "redirection: calloc");
4009	$$->host = $2;
4010	$$->rport.a = $$->rport.b = $$->rport.t = 0;
4011	}
4012	\| ARROW host PORT portstar {
4013	$$ = calloc(1, sizeof(struct redirection));
4014	if ($$ == NULL)
4015	err(1, "redirection: calloc");
4016	$$->host = $2;
4017	$$->rport = $4;
4018	}
4019	;
4020
4021	natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; }
4022	\| PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; }
4023	\| PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; }
4024	\| log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; }
4025	;
4026
4027	nataction : no NAT natpasslog {
4028	if ($1 && $3.b1) {
4029	yyerror("\"pass\" not valid with \"no\"");
4030	YYERROR;
4031	}
4032	if ($1)
4033	$$.b1 = PF_NONAT;
4034	else
4035	$$.b1 = PF_NAT;
4036	$$.b2 = $3.b1;
4037	$$.w = $3.b2;
4038	$$.w2 = $3.w2;
4039	}
4040	\| no RDR natpasslog {
4041	if ($1 && $3.b1) {
4042	yyerror("\"pass\" not valid with \"no\"");
4043	YYERROR;
4044	}
4045	if ($1)
4046	$$.b1 = PF_NORDR;
4047	else
4048	$$.b1 = PF_RDR;
4049	$$.b2 = $3.b1;
4050	$$.w = $3.b2;
4051	$$.w2 = $3.w2;
4052	}
4053	;
4054
4055	natrule : nataction interface af proto fromto tag tagged rtable
4056	redirpool pool_opts
4057	{
4058	struct pf_rule r;
4059
4060	if (check_rulestate(PFCTL_STATE_NAT))
4061	YYERROR;
4062
4063	memset(&r, 0, sizeof(r));
4064
4065	r.action = $1.b1;
4066	r.natpass = $1.b2;
4067	r.log = $1.w;
4068	r.logif = $1.w2;
4069	r.af = $3;
4070
4071	if (!r.af) {
4072	if ($5.src.host && $5.src.host->af &&
4073	!$5.src.host->ifindex)
4074	r.af = $5.src.host->af;
4075	else if ($5.dst.host && $5.dst.host->af &&
4076	!$5.dst.host->ifindex)
4077	r.af = $5.dst.host->af;
4078	}
4079
4080	if ($6 != NULL)
4081	if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
4082	PF_TAG_NAME_SIZE) {
4083	yyerror("tag too long, max %u chars",
4084	PF_TAG_NAME_SIZE - 1);
4085	YYERROR;
4086	}
4087
4088	if ($7.name)
4089	if (strlcpy(r.match_tagname, $7.name,
4090	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4091	yyerror("tag too long, max %u chars",
4092	PF_TAG_NAME_SIZE - 1);
4093	YYERROR;
4094	}
4095	r.match_tag_not = $7.neg;
4096	r.rtableid = $8;
4097
4098	if (r.action == PF_NONAT \|\| r.action == PF_NORDR) {
4099	if ($9 != NULL) {
4100	yyerror("translation rule with 'no' "
4101	"does not need '->'");
4102	YYERROR;
4103	}
4104	} else {
4105	if ($9 == NULL \|\| $9->host == NULL) {
4106	yyerror("translation rule requires '-> "
4107	"address'");
4108	YYERROR;
4109	}
4110	if (!r.af && ! $9->host->ifindex)
4111	r.af = $9->host->af;
4112
4113	remove_invalid_hosts(&$9->host, &r.af);
4114	if (invalid_redirect($9->host, r.af))
4115	YYERROR;
4116	if (check_netmask($9->host, r.af))
4117	YYERROR;
4118
4119	r.rpool.proxy_port[0] = ntohs($9->rport.a);
4120
4121	switch (r.action) {
4122	case PF_RDR:
4123	if (!$9->rport.b && $9->rport.t &&
4124	$5.dst.port != NULL) {
4125	r.rpool.proxy_port[1] =
4126	ntohs($9->rport.a) +
4127	(ntohs(
4128	$5.dst.port->port[1]) -
4129	ntohs(
4130	$5.dst.port->port[0]));
4131	} else
4132	r.rpool.proxy_port[1] =
4133	ntohs($9->rport.b);
4134	break;
4135	case PF_NAT:
4136	r.rpool.proxy_port[1] =
4137	ntohs($9->rport.b);
4138	if (!r.rpool.proxy_port[0] &&
4139	!r.rpool.proxy_port[1]) {
4140	r.rpool.proxy_port[0] =
4141	PF_NAT_PROXY_PORT_LOW;
4142	r.rpool.proxy_port[1] =
4143	PF_NAT_PROXY_PORT_HIGH;
4144	} else if (!r.rpool.proxy_port[1])
4145	r.rpool.proxy_port[1] =
4146	r.rpool.proxy_port[0];
4147	break;
4148	default:
4149	break;
4150	}
4151
4152	r.rpool.opts = $10.type;
4153	if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
4154	PF_POOL_NONE && ($9->host->next != NULL \|\|
4155	$9->host->addr.type == PF_ADDR_TABLE \|\|
4156	DYNIF_MULTIADDR($9->host->addr)))
4157	r.rpool.opts = PF_POOL_ROUNDROBIN;
4158	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4159	PF_POOL_ROUNDROBIN &&
4160	disallow_table($9->host, "tables are only "
4161	"supported in round-robin redirection "
4162	"pools"))
4163	YYERROR;
4164	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4165	PF_POOL_ROUNDROBIN &&
4166	disallow_alias($9->host, "interface (%s) "
4167	"is only supported in round-robin "
4168	"redirection pools"))
4169	YYERROR;
4170	if ($9->host->next != NULL) {
4171	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4172	PF_POOL_ROUNDROBIN) {
4173	yyerror("only round-robin "
4174	"valid for multiple "
4175	"redirection addresses");
4176	YYERROR;
4177	}
4178	}
4179	}
4180
4181	if ($10.key != NULL)
4182	memcpy(&r.rpool.key, $10.key,
4183	sizeof(struct pf_poolhashkey));
4184
4185	if ($10.opts)
4186	r.rpool.opts \|= $10.opts;
4187
4188	if ($10.staticport) {
4189	if (r.action != PF_NAT) {
4190	yyerror("the 'static-port' option is "
4191	"only valid with nat rules");
4192	YYERROR;
4193	}
4194	if (r.rpool.proxy_port[0] !=
4195	PF_NAT_PROXY_PORT_LOW &&
4196	r.rpool.proxy_port[1] !=
4197	PF_NAT_PROXY_PORT_HIGH) {
4198	yyerror("the 'static-port' option can't"
4199	" be used when specifying a port"
4200	" range");
4201	YYERROR;
4202	}
4203	r.rpool.proxy_port[0] = 0;
4204	r.rpool.proxy_port[1] = 0;
4205	}
4206
4207	expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4,
4208	$5.src_os, $5.src.host, $5.src.port, $5.dst.host,
4209	$5.dst.port, 0, 0, 0, "");
4210	free($9);
4211	}
4212	;
4213
4214	binatrule : no BINAT natpasslog interface af proto FROM ipspec toipspec tag
4215	tagged rtable redirection
4216	{
4217	struct pf_rule binat;
4218	struct pf_pooladdr *pa;
4219
4220	if (check_rulestate(PFCTL_STATE_NAT))
4221	YYERROR;
4222	if (disallow_urpf_failed($9, "\"urpf-failed\" is not "
4223	"permitted as a binat destination"))
4224	YYERROR;
4225
4226	memset(&binat, 0, sizeof(binat));
4227
4228	if ($1 && $3.b1) {
4229	yyerror("\"pass\" not valid with \"no\"");
4230	YYERROR;
4231	}
4232	if ($1)
4233	binat.action = PF_NOBINAT;
4234	else
4235	binat.action = PF_BINAT;
4236	binat.natpass = $3.b1;
4237	binat.log = $3.b2;
4238	binat.logif = $3.w2;
4239	binat.af = $5;
4240	if (!binat.af && $8 != NULL && $8->af)
4241	binat.af = $8->af;
4242	if (!binat.af && $9 != NULL && $9->af)
4243	binat.af = $9->af;
4244
4245	if (!binat.af && $13 != NULL && $13->host)
4246	binat.af = $13->host->af;
4247	if (!binat.af) {
4248	yyerror("address family (inet/inet6) "
4249	"undefined");
4250	YYERROR;
4251	}
4252
4253	if ($4 != NULL) {
4254	memcpy(binat.ifname, $4->ifname,
4255	sizeof(binat.ifname));
4256	binat.ifnot = $4->not;
4257	free($4);
4258	}
4259
4260	if ($10 != NULL)
4261	if (strlcpy(binat.tagname, $10,
4262	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4263	yyerror("tag too long, max %u chars",
4264	PF_TAG_NAME_SIZE - 1);
4265	YYERROR;
4266	}
4267	if ($11.name)
4268	if (strlcpy(binat.match_tagname, $11.name,
4269	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4270	yyerror("tag too long, max %u chars",
4271	PF_TAG_NAME_SIZE - 1);
4272	YYERROR;
4273	}
4274	binat.match_tag_not = $11.neg;
4275	binat.rtableid = $12;
4276
4277	if ($6 != NULL) {
4278	binat.proto = $6->proto;
4279	free($6);
4280	}
4281
4282	if ($8 != NULL && disallow_table($8, "invalid use of "
4283	"table <%s> as the source address of a binat rule"))
4284	YYERROR;
4285	if ($8 != NULL && disallow_alias($8, "invalid use of "
4286	"interface (%s) as the source address of a binat "
4287	"rule"))
4288	YYERROR;
4289	if ($13 != NULL && $13->host != NULL && disallow_table(
4290	$13->host, "invalid use of table <%s> as the "
4291	"redirect address of a binat rule"))
4292	YYERROR;
4293	if ($13 != NULL && $13->host != NULL && disallow_alias(
4294	$13->host, "invalid use of interface (%s) as the "
4295	"redirect address of a binat rule"))
4296	YYERROR;
4297
4298	if ($8 != NULL) {
4299	if ($8->next) {
4300	yyerror("multiple binat ip addresses");
4301	YYERROR;
4302	}
4303	if ($8->addr.type == PF_ADDR_DYNIFTL)
4304	$8->af = binat.af;
4305	if ($8->af != binat.af) {
4306	yyerror("binat ip versions must match");
4307	YYERROR;
4308	}
4309	if (check_netmask($8, binat.af))
4310	YYERROR;
4311	memcpy(&binat.src.addr, &$8->addr,
4312	sizeof(binat.src.addr));
4313	free($8);
4314	}
4315	if ($9 != NULL) {
4316	if ($9->next) {
4317	yyerror("multiple binat ip addresses");
4318	YYERROR;
4319	}
4320	if ($9->af != binat.af && $9->af) {
4321	yyerror("binat ip versions must match");
4322	YYERROR;
4323	}
4324	if (check_netmask($9, binat.af))
4325	YYERROR;
4326	memcpy(&binat.dst.addr, &$9->addr,
4327	sizeof(binat.dst.addr));
4328	binat.dst.neg = $9->not;
4329	free($9);
4330	}
4331
4332	if (binat.action == PF_NOBINAT) {
4333	if ($13 != NULL) {
4334	yyerror("'no binat' rule does not need"
4335	" '->'");
4336	YYERROR;
4337	}
4338	} else {
4339	if ($13 == NULL \|\| $13->host == NULL) {
4340	yyerror("'binat' rule requires"
4341	" '-> address'");
4342	YYERROR;
4343	}
4344
4345	remove_invalid_hosts(&$13->host, &binat.af);
4346	if (invalid_redirect($13->host, binat.af))
4347	YYERROR;
4348	if ($13->host->next != NULL) {
4349	yyerror("binat rule must redirect to "
4350	"a single address");
4351	YYERROR;
4352	}
4353	if (check_netmask($13->host, binat.af))
4354	YYERROR;
4355
4356	if (!PF_AZERO(&binat.src.addr.v.a.mask,
4357	binat.af) &&
4358	!PF_AEQ(&binat.src.addr.v.a.mask,
4359	&$13->host->addr.v.a.mask, binat.af)) {
4360	yyerror("'binat' source mask and "
4361	"redirect mask must be the same");
4362	YYERROR;
4363	}
4364
4365	TAILQ_INIT(&binat.rpool.list);
4366	pa = calloc(1, sizeof(struct pf_pooladdr));
4367	if (pa == NULL)
4368	err(1, "binat: calloc");
4369	pa->addr = $13->host->addr;
4370	pa->ifname[0] = 0;
4371	TAILQ_INSERT_TAIL(&binat.rpool.list,
4372	pa, entries);
4373
4374	free($13);
4375	}
4376
4377	pfctl_add_rule(pf, &binat, "");
4378	}
4379	;
4380
4381	tag : /* empty */ { $$ = NULL; }
4382	\| TAG STRING { $$ = $2; }
4383	;
4384
4385	tagged : /* empty */ { $$.neg = 0; $$.name = NULL; }
4386	\| not TAGGED string { $$.neg = $1; $$.name = $3; }
4387	;
4388
4389	rtable : /* empty */ { $$ = -1; }
4390	\| RTABLE NUMBER {
4391	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
4392	yyerror("invalid rtable id");
4393	YYERROR;
4394	}
4395	$$ = $2;
4396	}
4397	;
4398
4399	route_host : STRING {
4400	$$ = calloc(1, sizeof(struct node_host));
4401	if ($$ == NULL)
4402	err(1, "route_host: calloc");
4403	$$->ifname = $1;
4404	set_ipmask($$, 128);
4405	$$->next = NULL;
4406	$$->tail = $$;
4407	}
4408	\| '(' STRING host ')' {
4409	$$ = $3;
4410	$$->ifname = $2;
4411	}
4412	;
4413
4414	route_host_list : route_host optnl { $$ = $1; }
4415	\| route_host_list comma route_host optnl {
4416	if ($1->af == 0)
4417	$1->af = $3->af;
4418	if ($1->af != $3->af) {
4419	yyerror("all pool addresses must be in the "
4420	"same address family");
4421	YYERROR;
4422	}
4423	$1->tail->next = $3;
4424	$1->tail = $3->tail;
4425	$$ = $1;
4426	}
4427	;
4428
4429	routespec : route_host { $$ = $1; }
4430	\| '{' optnl route_host_list '}' { $$ = $3; }
4431	;
4432
4433	route : /* empty */ {
4434	$$.host = NULL;
4435	$$.rt = 0;
4436	$$.pool_opts = 0;
4437	}
4438	\| FASTROUTE {
4439	/* backwards-compat */
4440	$$.host = NULL;
4441	$$.rt = 0;
4442	$$.pool_opts = 0;
4443	}
4444	\| ROUTETO routespec pool_opts {
4445	$$.host = $2;
4446	$$.rt = PF_ROUTETO;
4447	$$.pool_opts = $3.type \| $3.opts;
4448	if ($3.key != NULL)
4449	$$.key = $3.key;
4450	}
4451	\| REPLYTO routespec pool_opts {
4452	$$.host = $2;
4453	$$.rt = PF_REPLYTO;
4454	$$.pool_opts = $3.type \| $3.opts;
4455	if ($3.key != NULL)
4456	$$.key = $3.key;
4457	}
4458	\| DUPTO routespec pool_opts {
4459	$$.host = $2;
4460	$$.rt = PF_DUPTO;
4461	$$.pool_opts = $3.type \| $3.opts;
4462	if ($3.key != NULL)
4463	$$.key = $3.key;
4464	}
4465	;
4466
4467	timeout_spec : STRING NUMBER
4468	{
4469	if (check_rulestate(PFCTL_STATE_OPTION)) {
4470	free($1);
4471	YYERROR;
4472	}
4473	if ($2 < 0 \|\| $2 > UINT_MAX) {
4474	yyerror("only positive values permitted");
4475	YYERROR;
4476	}
4477	if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
4478	yyerror("unknown timeout %s", $1);
4479	free($1);
4480	YYERROR;
4481	}
4482	free($1);
4483	}
4484	\| INTERVAL NUMBER {
4485	if (check_rulestate(PFCTL_STATE_OPTION))
4486	YYERROR;
4487	if ($2 < 0 \|\| $2 > UINT_MAX) {
4488	yyerror("only positive values permitted");
4489	YYERROR;
4490	}
4491	if (pfctl_set_timeout(pf, "interval", $2, 0) != 0)
4492	YYERROR;
4493	}
4494	;
4495
4496	timeout_list : timeout_list comma timeout_spec optnl
4497	\| timeout_spec optnl
4498	;
4499
4500	limit_spec : STRING NUMBER
4501	{
4502	if (check_rulestate(PFCTL_STATE_OPTION)) {
4503	free($1);
4504	YYERROR;
4505	}
4506	if ($2 < 0 \|\| $2 > UINT_MAX) {
4507	yyerror("only positive values permitted");
4508	YYERROR;
4509	}
4510	if (pfctl_set_limit(pf, $1, $2) != 0) {
4511	yyerror("unable to set limit %s %u", $1, $2);
4512	free($1);
4513	YYERROR;
4514	}
4515	free($1);
4516	}
4517	;
4518
4519	limit_list : limit_list comma limit_spec optnl
4520	\| limit_spec optnl
4521	;
4522
4523	comma : ','
4524	\| /* empty */
4525	;
4526
4527	yesno : NO { $$ = 0; }
4528	\| STRING {
4529	if (!strcmp($1, "yes"))
4530	$$ = 1;
4531	else {
4532	yyerror("invalid value '%s', expected 'yes' "
4533	"or 'no'", $1);
4534	free($1);
4535	YYERROR;
4536	}
4537	free($1);
4538	}
4539	;
4540
4541	unaryop : '=' { $$ = PF_OP_EQ; }
4542	\| '!' '=' { $$ = PF_OP_NE; }
4543	\| '<' '=' { $$ = PF_OP_LE; }
4544	\| '<' { $$ = PF_OP_LT; }
4545	\| '>' '=' { $$ = PF_OP_GE; }
4546	\| '>' { $$ = PF_OP_GT; }
4547	;
4548
4549	%%
4550	#ifdef __rtems__
4551	RTEMS_LINKER_RWSET_CONTENT(bsd_prog_pfctl, extern YYSTYPE pfctlyval);
4552	RTEMS_LINKER_RWSET_CONTENT(bsd_prog_pfctl, extern YYSTYPE pfctlylval);
4553	RTEMS_LINKER_RWSET_CONTENT(bsd_prog_pfctl, static YYSTACKDATA yystack);
4554	#endif /* __rtems__ */
4555
4556	int
4557	yyerror(const char *fmt, ...)
4558	{
4559	va_list ap;
4560
4561	file->errors++;
4562	va_start(ap, fmt);
4563	fprintf(stderr, "%s:%d: ", file->name, yylval.lineno);
4564	vfprintf(stderr, fmt, ap);
4565	fprintf(stderr, "\n");
4566	va_end(ap);
4567	return (0);
4568	}
4569
4570	int
4571	disallow_table(struct node_host h, const char fmt)
4572	{
4573	for (; h != NULL; h = h->next)
4574	if (h->addr.type == PF_ADDR_TABLE) {
4575	yyerror(fmt, h->addr.v.tblname);
4576	return (1);
4577	}
4578	return (0);
4579	}
4580
4581	int
4582	disallow_urpf_failed(struct node_host h, const char fmt)
4583	{
4584	for (; h != NULL; h = h->next)
4585	if (h->addr.type == PF_ADDR_URPFFAILED) {
4586	yyerror(fmt);
4587	return (1);
4588	}
4589	return (0);
4590	}
4591
4592	int
4593	disallow_alias(struct node_host h, const char fmt)
4594	{
4595	for (; h != NULL; h = h->next)
4596	if (DYNIF_MULTIADDR(h->addr)) {
4597	yyerror(fmt, h->addr.v.tblname);
4598	return (1);
4599	}
4600	return (0);
4601	}
4602
4603	int
4604	rule_consistent(struct pf_rule *r, int anchor_call)
4605	{
4606	int problems = 0;
4607
4608	switch (r->action) {
4609	case PF_PASS:
4610	case PF_DROP:
4611	case PF_SCRUB:
4612	case PF_NOSCRUB:
4613	problems = filter_consistent(r, anchor_call);
4614	break;
4615	case PF_NAT:
4616	case PF_NONAT:
4617	problems = nat_consistent(r);
4618	break;
4619	case PF_RDR:
4620	case PF_NORDR:
4621	problems = rdr_consistent(r);
4622	break;
4623	case PF_BINAT:
4624	case PF_NOBINAT:
4625	default:
4626	break;
4627	}
4628	return (problems);
4629	}
4630
4631	int
4632	filter_consistent(struct pf_rule *r, int anchor_call)
4633	{
4634	int problems = 0;
4635
4636	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
4637	(r->src.port_op \|\| r->dst.port_op)) {
4638	yyerror("port only applies to tcp/udp");
4639	problems++;
4640	}
4641	if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
4642	(r->type \|\| r->code)) {
4643	yyerror("icmp-type/code only applies to icmp");
4644	problems++;
4645	}
4646	if (!r->af && (r->type \|\| r->code)) {
4647	yyerror("must indicate address family with icmp-type/code");
4648	problems++;
4649	}
4650	if (r->overload_tblname[0] &&
4651	r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
4652	yyerror("'overload' requires 'max-src-conn' "
4653	"or 'max-src-conn-rate'");
4654	problems++;
4655	}
4656	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) \|\|
4657	(r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
4658	yyerror("proto %s doesn't match address family %s",
4659	r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
4660	r->af == AF_INET ? "inet" : "inet6");
4661	problems++;
4662	}
4663	if (r->allow_opts && r->action != PF_PASS) {
4664	yyerror("allow-opts can only be specified for pass rules");
4665	problems++;
4666	}
4667	if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op \|\|
4668	r->dst.port_op \|\| r->flagset \|\| r->type \|\| r->code)) {
4669	yyerror("fragments can be filtered only on IP header fields");
4670	problems++;
4671	}
4672	if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
4673	yyerror("return-rst can only be applied to TCP rules");
4674	problems++;
4675	}
4676	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
4677	yyerror("max-src-nodes requires 'source-track rule'");
4678	problems++;
4679	}
4680	if (r->action == PF_DROP && r->keep_state) {
4681	yyerror("keep state on block rules doesn't make sense");
4682	problems++;
4683	}
4684	if (r->rule_flag & PFRULE_STATESLOPPY &&
4685	(r->keep_state == PF_STATE_MODULATE \|\|
4686	r->keep_state == PF_STATE_SYNPROXY)) {
4687	yyerror("sloppy state matching cannot be used with "
4688	"synproxy state or modulate state");
4689	problems++;
4690	}
4691	return (-problems);
4692	}
4693
4694	int
4695	nat_consistent(struct pf_rule *r)
4696	{
4697	return (0); /* yeah! */
4698	}
4699
4700	int
4701	rdr_consistent(struct pf_rule *r)
4702	{
4703	int problems = 0;
4704
4705	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
4706	if (r->src.port_op) {
4707	yyerror("src port only applies to tcp/udp");
4708	problems++;
4709	}
4710	if (r->dst.port_op) {
4711	yyerror("dst port only applies to tcp/udp");
4712	problems++;
4713	}
4714	if (r->rpool.proxy_port[0]) {
4715	yyerror("rpool port only applies to tcp/udp");
4716	problems++;
4717	}
4718	}
4719	if (r->dst.port_op &&
4720	r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
4721	yyerror("invalid port operator for rdr destination port");
4722	problems++;
4723	}
4724	return (-problems);
4725	}
4726
4727	int
4728	process_tabledef(char name, struct table_opts opts)
4729	{
4730	struct pfr_buffer ab;
4731	struct node_tinit *ti;
4732
4733	bzero(&ab, sizeof(ab));
4734	ab.pfrb_type = PFRB_ADDRS;
4735	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
4736	if (ti->file)
4737	if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
4738	if (errno)
4739	yyerror("cannot load \"%s\": %s",
4740	ti->file, strerror(errno));
4741	else
4742	yyerror("file \"%s\" contains bad data",
4743	ti->file);
4744	goto _error;
4745	}
4746	if (ti->host)
4747	if (append_addr_host(&ab, ti->host, 0, 0)) {
4748	yyerror("cannot create address buffer: %s",
4749	strerror(errno));
4750	goto _error;
4751	}
4752	}
4753	if (pf->opts & PF_OPT_VERBOSE)
4754	print_tabledef(name, opts->flags, opts->init_addr,
4755	&opts->init_nodes);
4756	if (!(pf->opts & PF_OPT_NOACTION) &&
4757	pfctl_define_table(name, opts->flags, opts->init_addr,
4758	pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) {
4759	yyerror("cannot define table %s: %s", name,
4760	pfr_strerror(errno));
4761	goto _error;
4762	}
4763	pf->tdirty = 1;
4764	pfr_buf_clear(&ab);
4765	return (0);
4766	_error:
4767	pfr_buf_clear(&ab);
4768	return (-1);
4769	}
4770
4771	struct keywords {
4772	const char *k_name;
4773	int k_val;
4774	};
4775
4776	/* macro gore, but you should've seen the prior indentation nightmare... */
4777
4778	#define FREE_LIST(T,r) \
4779	do { \
4780	T p, node = r; \
4781	while (node != NULL) { \
4782	p = node; \
4783	node = node->next; \
4784	free(p); \
4785	} \
4786	} while (0)
4787
4788	#define LOOP_THROUGH(T,n,r,C) \
4789	do { \
4790	T *n; \
4791	if (r == NULL) { \
4792	r = calloc(1, sizeof(T)); \
4793	if (r == NULL) \
4794	err(1, "LOOP: calloc"); \
4795	r->next = NULL; \
4796	} \
4797	n = r; \
4798	while (n != NULL) { \
4799	do { \
4800	C; \
4801	} while (0); \
4802	n = n->next; \
4803	} \
4804	} while (0)
4805
4806	void
4807	expand_label_str(char label, size_t len, const char srch, const char *repl)
4808	{
4809	char *tmp;
4810	char p, q;
4811
4812	if ((tmp = calloc(1, len)) == NULL)
4813	err(1, "expand_label_str: calloc");
4814	p = q = label;
4815	while ((q = strstr(p, srch)) != NULL) {
4816	*q = '\0';
4817	if ((strlcat(tmp, p, len) >= len) \|\|
4818	(strlcat(tmp, repl, len) >= len))
4819	errx(1, "expand_label: label too long");
4820	q += strlen(srch);
4821	p = q;
4822	}
4823	if (strlcat(tmp, p, len) >= len)
4824	errx(1, "expand_label: label too long");
4825	strlcpy(label, tmp, len); /* always fits */
4826	free(tmp);
4827	}
4828
4829	void
4830	expand_label_if(const char name, char label, size_t len, const char *ifname)
4831	{
4832	if (strstr(label, name) != NULL) {
4833	if (!*ifname)
4834	expand_label_str(label, len, name, "any");
4835	else
4836	expand_label_str(label, len, name, ifname);
4837	}
4838	}
4839
4840	void
4841	expand_label_addr(const char name, char label, size_t len, sa_family_t af,
4842	struct node_host *h)
4843	{
4844	char tmp[64], tmp_not[66];
4845
4846	if (strstr(label, name) != NULL) {
4847	switch (h->addr.type) {
4848	case PF_ADDR_DYNIFTL:
4849	snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
4850	break;
4851	case PF_ADDR_TABLE:
4852	snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
4853	break;
4854	case PF_ADDR_NOROUTE:
4855	snprintf(tmp, sizeof(tmp), "no-route");
4856	break;
4857	case PF_ADDR_URPFFAILED:
4858	snprintf(tmp, sizeof(tmp), "urpf-failed");
4859	break;
4860	case PF_ADDR_ADDRMASK:
4861	if (!af \|\| (PF_AZERO(&h->addr.v.a.addr, af) &&
4862	PF_AZERO(&h->addr.v.a.mask, af)))
4863	snprintf(tmp, sizeof(tmp), "any");
4864	else {
4865	char a[48];
4866	int bits;
4867
4868	if (inet_ntop(af, &h->addr.v.a.addr, a,
4869	sizeof(a)) == NULL)
4870	snprintf(tmp, sizeof(tmp), "?");
4871	else {
4872	bits = unmask(&h->addr.v.a.mask, af);
4873	if ((af == AF_INET && bits < 32) \|\|
4874	(af == AF_INET6 && bits < 128))
4875	snprintf(tmp, sizeof(tmp),
4876	"%s/%d", a, bits);
4877	else
4878	snprintf(tmp, sizeof(tmp),
4879	"%s", a);
4880	}
4881	}
4882	break;
4883	default:
4884	snprintf(tmp, sizeof(tmp), "?");
4885	break;
4886	}
4887
4888	if (h->not) {
4889	snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
4890	expand_label_str(label, len, name, tmp_not);
4891	} else
4892	expand_label_str(label, len, name, tmp);
4893	}
4894	}
4895
4896	void
4897	expand_label_port(const char name, char label, size_t len,
4898	struct node_port *port)
4899	{
4900	char a1[6], a2[6], op[13] = "";
4901
4902	if (strstr(label, name) != NULL) {
4903	snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
4904	snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
4905	if (!port->op)
4906	;
4907	else if (port->op == PF_OP_IRG)
4908	snprintf(op, sizeof(op), "%s><%s", a1, a2);
4909	else if (port->op == PF_OP_XRG)
4910	snprintf(op, sizeof(op), "%s<>%s", a1, a2);
4911	else if (port->op == PF_OP_EQ)
4912	snprintf(op, sizeof(op), "%s", a1);
4913	else if (port->op == PF_OP_NE)
4914	snprintf(op, sizeof(op), "!=%s", a1);
4915	else if (port->op == PF_OP_LT)
4916	snprintf(op, sizeof(op), "<%s", a1);
4917	else if (port->op == PF_OP_LE)
4918	snprintf(op, sizeof(op), "<=%s", a1);
4919	else if (port->op == PF_OP_GT)
4920	snprintf(op, sizeof(op), ">%s", a1);
4921	else if (port->op == PF_OP_GE)
4922	snprintf(op, sizeof(op), ">=%s", a1);
4923	expand_label_str(label, len, name, op);
4924	}
4925	}
4926
4927	void
4928	expand_label_proto(const char name, char label, size_t len, u_int8_t proto)
4929	{
4930	struct protoent *pe;
4931	char n[4];
4932
4933	if (strstr(label, name) != NULL) {
4934	pe = getprotobynumber(proto);
4935	if (pe != NULL)
4936	expand_label_str(label, len, name, pe->p_name);
4937	else {
4938	snprintf(n, sizeof(n), "%u", proto);
4939	expand_label_str(label, len, name, n);
4940	}
4941	}
4942	}
4943
4944	void
4945	expand_label_nr(const char name, char label, size_t len)
4946	{
4947	char n[11];
4948
4949	if (strstr(label, name) != NULL) {
4950	snprintf(n, sizeof(n), "%u", pf->anchor->match);
4951	expand_label_str(label, len, name, n);
4952	}
4953	}
4954
4955	void
4956	expand_label(char label, size_t len, const char ifname, sa_family_t af,
4957	struct node_host src_host, struct node_port src_port,
4958	struct node_host dst_host, struct node_port dst_port,
4959	u_int8_t proto)
4960	{
4961	expand_label_if("$if", label, len, ifname);
4962	expand_label_addr("$srcaddr", label, len, af, src_host);
4963	expand_label_addr("$dstaddr", label, len, af, dst_host);
4964	expand_label_port("$srcport", label, len, src_port);
4965	expand_label_port("$dstport", label, len, dst_port);
4966	expand_label_proto("$proto", label, len, proto);
4967	expand_label_nr("$nr", label, len);
4968	}
4969
4970	int
4971	expand_altq(struct pf_altq a, struct node_if interfaces,
4972	struct node_queue *nqueues, struct node_queue_bw bwspec,
4973	struct node_queue_opt *opts)
4974	{
4975	struct pf_altq pa, pb;
4976	char qname[PF_QNAME_SIZE];
4977	struct node_queue *n;
4978	struct node_queue_bw bw;
4979	int errs = 0;
4980
4981	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
4982	FREE_LIST(struct node_if, interfaces);
4983	if (nqueues)
4984	FREE_LIST(struct node_queue, nqueues);
4985	return (0);
4986	}
4987
4988	LOOP_THROUGH(struct node_if, interface, interfaces,
4989	memcpy(&pa, a, sizeof(struct pf_altq));
4990	if (strlcpy(pa.ifname, interface->ifname,
4991	sizeof(pa.ifname)) >= sizeof(pa.ifname))
4992	errx(1, "expand_altq: strlcpy");
4993
4994	if (interface->not) {
4995	yyerror("altq on ! <interface> is not supported");
4996	errs++;
4997	} else {
4998	if (eval_pfaltq(pf, &pa, &bwspec, opts))
4999	errs++;
5000	else
5001	if (pfctl_add_altq(pf, &pa))
5002	errs++;
5003
5004	if (pf->opts & PF_OPT_VERBOSE) {
5005	print_altq(&pf->paltq->altq, 0,
5006	&bwspec, opts);
5007	if (nqueues && nqueues->tail) {
5008	printf("queue { ");
5009	LOOP_THROUGH(struct node_queue, queue,
5010	nqueues,
5011	printf("%s ",
5012	queue->queue);
5013	);
5014	printf("}");
5015	}
5016	printf("\n");
5017	}
5018
5019	if (pa.scheduler == ALTQT_CBQ \|\|
5020	pa.scheduler == ALTQT_HFSC) {
5021	/* now create a root queue */
5022	memset(&pb, 0, sizeof(struct pf_altq));
5023	if (strlcpy(qname, "root_", sizeof(qname)) >=
5024	sizeof(qname))
5025	errx(1, "expand_altq: strlcpy");
5026	if (strlcat(qname, interface->ifname,
5027	sizeof(qname)) >= sizeof(qname))
5028	errx(1, "expand_altq: strlcat");
5029	if (strlcpy(pb.qname, qname,
5030	sizeof(pb.qname)) >= sizeof(pb.qname))
5031	errx(1, "expand_altq: strlcpy");
5032	if (strlcpy(pb.ifname, interface->ifname,
5033	sizeof(pb.ifname)) >= sizeof(pb.ifname))
5034	errx(1, "expand_altq: strlcpy");
5035	pb.qlimit = pa.qlimit;
5036	pb.scheduler = pa.scheduler;
5037	bw.bw_absolute = pa.ifbandwidth;
5038	bw.bw_percent = 0;
5039	if (eval_pfqueue(pf, &pb, &bw, opts))
5040	errs++;
5041	else
5042	if (pfctl_add_altq(pf, &pb))
5043	errs++;
5044	}
5045
5046	LOOP_THROUGH(struct node_queue, queue, nqueues,
5047	n = calloc(1, sizeof(struct node_queue));
5048	if (n == NULL)
5049	err(1, "expand_altq: calloc");
5050	if (pa.scheduler == ALTQT_CBQ \|\|
5051	pa.scheduler == ALTQT_HFSC)
5052	if (strlcpy(n->parent, qname,
5053	sizeof(n->parent)) >=
5054	sizeof(n->parent))
5055	errx(1, "expand_altq: strlcpy");
5056	if (strlcpy(n->queue, queue->queue,
5057	sizeof(n->queue)) >= sizeof(n->queue))
5058	errx(1, "expand_altq: strlcpy");
5059	if (strlcpy(n->ifname, interface->ifname,
5060	sizeof(n->ifname)) >= sizeof(n->ifname))
5061	errx(1, "expand_altq: strlcpy");
5062	n->scheduler = pa.scheduler;
5063	n->next = NULL;
5064	n->tail = n;
5065	if (queues == NULL)
5066	queues = n;
5067	else {
5068	queues->tail->next = n;
5069	queues->tail = n;
5070	}
5071	);
5072	}
5073	);
5074	FREE_LIST(struct node_if, interfaces);
5075	if (nqueues)
5076	FREE_LIST(struct node_queue, nqueues);
5077
5078	return (errs);
5079	}
5080
5081	int
5082	expand_queue(struct pf_altq a, struct node_if interfaces,
5083	struct node_queue *nqueues, struct node_queue_bw bwspec,
5084	struct node_queue_opt *opts)
5085	{
5086	struct node_queue n, nq;
5087	struct pf_altq pa;
5088	u_int8_t found = 0;
5089	u_int8_t errs = 0;
5090
5091	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
5092	FREE_LIST(struct node_queue, nqueues);
5093	return (0);
5094	}
5095
5096	if (queues == NULL) {
5097	yyerror("queue %s has no parent", a->qname);
5098	FREE_LIST(struct node_queue, nqueues);
5099	return (1);
5100	}
5101
5102	LOOP_THROUGH(struct node_if, interface, interfaces,
5103	LOOP_THROUGH(struct node_queue, tqueue, queues,
5104	if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
5105	(interface->ifname[0] == 0 \|\|
5106	(!interface->not && !strncmp(interface->ifname,
5107	tqueue->ifname, IFNAMSIZ)) \|\|
5108	(interface->not && strncmp(interface->ifname,
5109	tqueue->ifname, IFNAMSIZ)))) {
5110	/* found ourself in queues */
5111	found++;
5112
5113	memcpy(&pa, a, sizeof(struct pf_altq));
5114
5115	if (pa.scheduler != ALTQT_NONE &&
5116	pa.scheduler != tqueue->scheduler) {
5117	yyerror("exactly one scheduler type "
5118	"per interface allowed");
5119	return (1);
5120	}
5121	pa.scheduler = tqueue->scheduler;
5122
5123	/* scheduler dependent error checking */
5124	switch (pa.scheduler) {
5125	case ALTQT_PRIQ:
5126	if (nqueues != NULL) {
5127	yyerror("priq queues cannot "
5128	"have child queues");
5129	return (1);
5130	}
5131	if (bwspec.bw_absolute > 0 \|\|
5132	bwspec.bw_percent < 100) {
5133	yyerror("priq doesn't take "
5134	"bandwidth");
5135	return (1);
5136	}
5137	break;
5138	default:
5139	break;
5140	}
5141
5142	if (strlcpy(pa.ifname, tqueue->ifname,
5143	sizeof(pa.ifname)) >= sizeof(pa.ifname))
5144	errx(1, "expand_queue: strlcpy");
5145	if (strlcpy(pa.parent, tqueue->parent,
5146	sizeof(pa.parent)) >= sizeof(pa.parent))
5147	errx(1, "expand_queue: strlcpy");
5148
5149	if (eval_pfqueue(pf, &pa, &bwspec, opts))
5150	errs++;
5151	else
5152	if (pfctl_add_altq(pf, &pa))
5153	errs++;
5154
5155	for (nq = nqueues; nq != NULL; nq = nq->next) {
5156	if (!strcmp(a->qname, nq->queue)) {
5157	yyerror("queue cannot have "
5158	"itself as child");
5159	errs++;
5160	continue;
5161	}
5162	n = calloc(1,
5163	sizeof(struct node_queue));
5164	if (n == NULL)
5165	err(1, "expand_queue: calloc");
5166	if (strlcpy(n->parent, a->qname,
5167	sizeof(n->parent)) >=
5168	sizeof(n->parent))
5169	errx(1, "expand_queue strlcpy");
5170	if (strlcpy(n->queue, nq->queue,
5171	sizeof(n->queue)) >=
5172	sizeof(n->queue))
5173	errx(1, "expand_queue strlcpy");
5174	if (strlcpy(n->ifname, tqueue->ifname,
5175	sizeof(n->ifname)) >=
5176	sizeof(n->ifname))
5177	errx(1, "expand_queue strlcpy");
5178	n->scheduler = tqueue->scheduler;
5179	n->next = NULL;
5180	n->tail = n;
5181	if (queues == NULL)
5182	queues = n;
5183	else {
5184	queues->tail->next = n;
5185	queues->tail = n;
5186	}
5187	}
5188	if ((pf->opts & PF_OPT_VERBOSE) && (
5189	(found == 1 && interface->ifname[0] == 0) \|\|
5190	(found > 0 && interface->ifname[0] != 0))) {
5191	print_queue(&pf->paltq->altq, 0,
5192	&bwspec, interface->ifname[0] != 0,
5193	opts);
5194	if (nqueues && nqueues->tail) {
5195	printf("{ ");
5196	LOOP_THROUGH(struct node_queue,
5197	queue, nqueues,
5198	printf("%s ",
5199	queue->queue);
5200	);
5201	printf("}");
5202	}
5203	printf("\n");
5204	}
5205	}
5206	);
5207	);
5208
5209	FREE_LIST(struct node_queue, nqueues);
5210	FREE_LIST(struct node_if, interfaces);
5211
5212	if (!found) {
5213	yyerror("queue %s has no parent", a->qname);
5214	errs++;
5215	}
5216
5217	if (errs)
5218	return (1);
5219	else
5220	return (0);
5221	}
5222
5223	void
5224	expand_rule(struct pf_rule *r,
5225	struct node_if interfaces, struct node_host rpool_hosts,
5226	struct node_proto protos, struct node_os src_oses,
5227	struct node_host src_hosts, struct node_port src_ports,
5228	struct node_host dst_hosts, struct node_port dst_ports,
5229	struct node_uid uids, struct node_gid gids, struct node_icmp *icmp_types,
5230	const char *anchor_call)
5231	{
5232	sa_family_t af = r->af;
5233	int added = 0, error = 0;
5234	char ifname[IF_NAMESIZE];
5235	char label[PF_RULE_LABEL_SIZE];
5236	char tagname[PF_TAG_NAME_SIZE];
5237	char match_tagname[PF_TAG_NAME_SIZE];
5238	struct pf_pooladdr *pa;
5239	struct node_host *h;
5240	u_int8_t flags, flagset, keep_state;
5241
5242	if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
5243	errx(1, "expand_rule: strlcpy");
5244	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
5245	errx(1, "expand_rule: strlcpy");
5246	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
5247	sizeof(match_tagname))
5248	errx(1, "expand_rule: strlcpy");
5249	flags = r->flags;
5250	flagset = r->flagset;
5251	keep_state = r->keep_state;
5252
5253	LOOP_THROUGH(struct node_if, interface, interfaces,
5254	LOOP_THROUGH(struct node_proto, proto, protos,
5255	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
5256	LOOP_THROUGH(struct node_host, src_host, src_hosts,
5257	LOOP_THROUGH(struct node_port, src_port, src_ports,
5258	LOOP_THROUGH(struct node_os, src_os, src_oses,
5259	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
5260	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
5261	LOOP_THROUGH(struct node_uid, uid, uids,
5262	LOOP_THROUGH(struct node_gid, gid, gids,
5263
5264	r->af = af;
5265	/* for link-local IPv6 address, interface must match up */
5266	if ((r->af && src_host->af && r->af != src_host->af) \|\|
5267	(r->af && dst_host->af && r->af != dst_host->af) \|\|
5268	(src_host->af && dst_host->af &&
5269	src_host->af != dst_host->af) \|\|
5270	(src_host->ifindex && dst_host->ifindex &&
5271	src_host->ifindex != dst_host->ifindex) \|\|
5272	(src_host->ifindex && *interface->ifname &&
5273	src_host->ifindex != if_nametoindex(interface->ifname)) \|\|
5274	(dst_host->ifindex && *interface->ifname &&
5275	dst_host->ifindex != if_nametoindex(interface->ifname)))
5276	continue;
5277	if (!r->af && src_host->af)
5278	r->af = src_host->af;
5279	else if (!r->af && dst_host->af)
5280	r->af = dst_host->af;
5281
5282	if (*interface->ifname)
5283	strlcpy(r->ifname, interface->ifname,
5284	sizeof(r->ifname));
5285	else if (if_indextoname(src_host->ifindex, ifname))
5286	strlcpy(r->ifname, ifname, sizeof(r->ifname));
5287	else if (if_indextoname(dst_host->ifindex, ifname))
5288	strlcpy(r->ifname, ifname, sizeof(r->ifname));
5289	else
5290	memset(r->ifname, '\0', sizeof(r->ifname));
5291
5292	if (strlcpy(r->label, label, sizeof(r->label)) >=
5293	sizeof(r->label))
5294	errx(1, "expand_rule: strlcpy");
5295	if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
5296	sizeof(r->tagname))
5297	errx(1, "expand_rule: strlcpy");
5298	if (strlcpy(r->match_tagname, match_tagname,
5299	sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
5300	errx(1, "expand_rule: strlcpy");
5301	expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
5302	src_host, src_port, dst_host, dst_port, proto->proto);
5303	expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
5304	src_host, src_port, dst_host, dst_port, proto->proto);
5305	expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
5306	r->af, src_host, src_port, dst_host, dst_port,
5307	proto->proto);
5308
5309	error += check_netmask(src_host, r->af);
5310	error += check_netmask(dst_host, r->af);
5311
5312	r->ifnot = interface->not;
5313	r->proto = proto->proto;
5314	r->src.addr = src_host->addr;
5315	r->src.neg = src_host->not;
5316	r->src.port[0] = src_port->port[0];
5317	r->src.port[1] = src_port->port[1];
5318	r->src.port_op = src_port->op;
5319	r->dst.addr = dst_host->addr;
5320	r->dst.neg = dst_host->not;
5321	r->dst.port[0] = dst_port->port[0];
5322	r->dst.port[1] = dst_port->port[1];
5323	r->dst.port_op = dst_port->op;
5324	r->uid.op = uid->op;
5325	r->uid.uid[0] = uid->uid[0];
5326	r->uid.uid[1] = uid->uid[1];
5327	r->gid.op = gid->op;
5328	r->gid.gid[0] = gid->gid[0];
5329	r->gid.gid[1] = gid->gid[1];
5330	r->type = icmp_type->type;
5331	r->code = icmp_type->code;
5332
5333	if ((keep_state == PF_STATE_MODULATE \|\|
5334	keep_state == PF_STATE_SYNPROXY) &&
5335	r->proto && r->proto != IPPROTO_TCP)
5336	r->keep_state = PF_STATE_NORMAL;
5337	else
5338	r->keep_state = keep_state;
5339
5340	if (r->proto && r->proto != IPPROTO_TCP) {
5341	r->flags = 0;
5342	r->flagset = 0;
5343	} else {
5344	r->flags = flags;
5345	r->flagset = flagset;
5346	}
5347	if (icmp_type->proto && r->proto != icmp_type->proto) {
5348	yyerror("icmp-type mismatch");
5349	error++;
5350	}
5351
5352	if (src_os && src_os->os) {
5353	r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
5354	if ((pf->opts & PF_OPT_VERBOSE2) &&
5355	r->os_fingerprint == PF_OSFP_NOMATCH)
5356	fprintf(stderr,
5357	"warning: unknown '%s' OS fingerprint\n",
5358	src_os->os);
5359	} else {
5360	r->os_fingerprint = PF_OSFP_ANY;
5361	}
5362
5363	TAILQ_INIT(&r->rpool.list);
5364	for (h = rpool_hosts; h != NULL; h = h->next) {
5365	pa = calloc(1, sizeof(struct pf_pooladdr));
5366	if (pa == NULL)
5367	err(1, "expand_rule: calloc");
5368	pa->addr = h->addr;
5369	if (h->ifname != NULL) {
5370	if (strlcpy(pa->ifname, h->ifname,
5371	sizeof(pa->ifname)) >=
5372	sizeof(pa->ifname))
5373	errx(1, "expand_rule: strlcpy");
5374	} else
5375	pa->ifname[0] = 0;
5376	TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
5377	}
5378
5379	if (rule_consistent(r, anchor_call[0]) < 0 \|\| error)
5380	yyerror("skipping rule due to errors");
5381	else {
5382	r->nr = pf->astack[pf->asd]->match++;
5383	pfctl_add_rule(pf, r, anchor_call);
5384	added++;
5385	}
5386
5387	))))))))));
5388
5389	FREE_LIST(struct node_if, interfaces);
5390	FREE_LIST(struct node_proto, protos);
5391	FREE_LIST(struct node_host, src_hosts);
5392	FREE_LIST(struct node_port, src_ports);
5393	FREE_LIST(struct node_os, src_oses);
5394	FREE_LIST(struct node_host, dst_hosts);
5395	FREE_LIST(struct node_port, dst_ports);
5396	FREE_LIST(struct node_uid, uids);
5397	FREE_LIST(struct node_gid, gids);
5398	FREE_LIST(struct node_icmp, icmp_types);
5399	FREE_LIST(struct node_host, rpool_hosts);
5400
5401	if (!added)
5402	yyerror("rule expands to no valid combination");
5403	}
5404
5405	int
5406	expand_skip_interface(struct node_if *interfaces)
5407	{
5408	int errs = 0;
5409
5410	if (!interfaces \|\| (!interfaces->next && !interfaces->not &&
5411	!strcmp(interfaces->ifname, "none"))) {
5412	if (pf->opts & PF_OPT_VERBOSE)
5413	printf("set skip on none\n");
5414	errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
5415	return (errs);
5416	}
5417
5418	if (pf->opts & PF_OPT_VERBOSE)
5419	printf("set skip on {");
5420	LOOP_THROUGH(struct node_if, interface, interfaces,
5421	if (pf->opts & PF_OPT_VERBOSE)
5422	printf(" %s", interface->ifname);
5423	if (interface->not) {
5424	yyerror("skip on ! <interface> is not supported");
5425	errs++;
5426	} else
5427	errs += pfctl_set_interface_flags(pf,
5428	interface->ifname, PFI_IFLAG_SKIP, 1);
5429	);
5430	if (pf->opts & PF_OPT_VERBOSE)
5431	printf(" }\n");
5432
5433	FREE_LIST(struct node_if, interfaces);
5434
5435	if (errs)
5436	return (1);
5437	else
5438	return (0);
5439	}
5440
5441	#undef FREE_LIST
5442	#undef LOOP_THROUGH
5443
5444	int
5445	check_rulestate(int desired_state)
5446	{
5447	if (require_order && (rulestate > desired_state)) {
5448	yyerror("Rules must be in order: options, normalization, "
5449	"queueing, translation, filtering");
5450	return (1);
5451	}
5452	rulestate = desired_state;
5453	return (0);
5454	}
5455
5456	int
5457	kw_cmp(const void k, const void e)
5458	{
5459	return (strcmp(k, ((const struct keywords *)e)->k_name));
5460	}
5461
5462	int
5463	lookup(char *s)
5464	{
5465	/* this has to be sorted always */
5466	static const struct keywords keywords[] = {
5467	{ "all", ALL},
5468	{ "allow-opts", ALLOWOPTS},
5469	{ "altq", ALTQ},
5470	{ "anchor", ANCHOR},
5471	{ "antispoof", ANTISPOOF},
5472	{ "any", ANY},
5473	{ "bandwidth", BANDWIDTH},
5474	{ "binat", BINAT},
5475	{ "binat-anchor", BINATANCHOR},
5476	{ "bitmask", BITMASK},
5477	{ "block", BLOCK},
5478	{ "block-policy", BLOCKPOLICY},
5479	{ "buckets", BUCKETS},
5480	{ "cbq", CBQ},
5481	{ "code", CODE},
5482	{ "codelq", CODEL},
5483	{ "crop", FRAGCROP},
5484	{ "debug", DEBUG},
5485	{ "divert-reply", DIVERTREPLY},
5486	{ "divert-to", DIVERTTO},
5487	{ "drop", DROP},
5488	{ "drop-ovl", FRAGDROP},
5489	{ "dup-to", DUPTO},
5490	{ "fairq", FAIRQ},
5491	{ "fastroute", FASTROUTE},
5492	{ "file", FILENAME},
5493	{ "fingerprints", FINGERPRINTS},
5494	{ "flags", FLAGS},
5495	{ "floating", FLOATING},
5496	{ "flush", FLUSH},
5497	{ "for", FOR},
5498	{ "fragment", FRAGMENT},
5499	{ "from", FROM},
5500	{ "global", GLOBAL},
5501	{ "group", GROUP},
5502	{ "hfsc", HFSC},
5503	{ "hogs", HOGS},
5504	{ "hostid", HOSTID},
5505	{ "icmp-type", ICMPTYPE},
5506	{ "icmp6-type", ICMP6TYPE},
5507	{ "if-bound", IFBOUND},
5508	{ "in", IN},
5509	{ "include", INCLUDE},
5510	{ "inet", INET},
5511	{ "inet6", INET6},
5512	{ "interval", INTERVAL},
5513	{ "keep", KEEP},
5514	{ "label", LABEL},
5515	{ "limit", LIMIT},
5516	{ "linkshare", LINKSHARE},
5517	{ "load", LOAD},
5518	{ "log", LOG},
5519	{ "loginterface", LOGINTERFACE},
5520	{ "max", MAXIMUM},
5521	{ "max-mss", MAXMSS},
5522	{ "max-src-conn", MAXSRCCONN},
5523	{ "max-src-conn-rate", MAXSRCCONNRATE},
5524	{ "max-src-nodes", MAXSRCNODES},
5525	{ "max-src-states", MAXSRCSTATES},
5526	{ "min-ttl", MINTTL},
5527	{ "modulate", MODULATE},
5528	{ "nat", NAT},
5529	{ "nat-anchor", NATANCHOR},
5530	{ "no", NO},
5531	{ "no-df", NODF},
5532	{ "no-route", NOROUTE},
5533	{ "no-sync", NOSYNC},
5534	{ "on", ON},
5535	{ "optimization", OPTIMIZATION},
5536	{ "os", OS},
5537	{ "out", OUT},
5538	{ "overload", OVERLOAD},
5539	{ "pass", PASS},
5540	{ "port", PORT},
5541	{ "prio", PRIO},
5542	{ "priority", PRIORITY},
5543	{ "priq", PRIQ},
5544	{ "probability", PROBABILITY},
5545	{ "proto", PROTO},
5546	{ "qlimit", QLIMIT},
5547	{ "queue", QUEUE},
5548	{ "quick", QUICK},
5549	{ "random", RANDOM},
5550	{ "random-id", RANDOMID},
5551	{ "rdr", RDR},
5552	{ "rdr-anchor", RDRANCHOR},
5553	{ "realtime", REALTIME},
5554	{ "reassemble", REASSEMBLE},
5555	{ "reply-to", REPLYTO},
5556	{ "require-order", REQUIREORDER},
5557	{ "return", RETURN},
5558	{ "return-icmp", RETURNICMP},
5559	{ "return-icmp6", RETURNICMP6},
5560	{ "return-rst", RETURNRST},
5561	{ "round-robin", ROUNDROBIN},
5562	{ "route", ROUTE},
5563	{ "route-to", ROUTETO},
5564	{ "rtable", RTABLE},
5565	{ "rule", RULE},
5566	{ "ruleset-optimization", RULESET_OPTIMIZATION},
5567	{ "scrub", SCRUB},
5568	{ "set", SET},
5569	{ "set-tos", SETTOS},
5570	{ "skip", SKIP},
5571	{ "sloppy", SLOPPY},
5572	{ "source-hash", SOURCEHASH},
5573	{ "source-track", SOURCETRACK},
5574	{ "state", STATE},
5575	{ "state-defaults", STATEDEFAULTS},
5576	{ "state-policy", STATEPOLICY},
5577	{ "static-port", STATICPORT},
5578	{ "sticky-address", STICKYADDRESS},
5579	{ "synproxy", SYNPROXY},
5580	{ "table", TABLE},
5581	{ "tag", TAG},
5582	{ "tagged", TAGGED},
5583	{ "target", TARGET},
5584	{ "tbrsize", TBRSIZE},
5585	{ "timeout", TIMEOUT},
5586	{ "to", TO},
5587	{ "tos", TOS},
5588	{ "ttl", TTL},
5589	{ "upperlimit", UPPERLIMIT},
5590	{ "urpf-failed", URPFFAILED},
5591	{ "user", USER},
5592	};
5593	const struct keywords *p;
5594
5595	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
5596	sizeof(keywords[0]), kw_cmp);
5597
5598	if (p) {
5599	if (debug > 1)
5600	fprintf(stderr, "%s: %d\n", s, p->k_val);
5601	return (p->k_val);
5602	} else {
5603	if (debug > 1)
5604	fprintf(stderr, "string: %s\n", s);
5605	return (STRING);
5606	}
5607	}
5608
5609	#define MAXPUSHBACK 128
5610
5611	static char *parsebuf;
5612	static int parseindex;
5613	static char pushback_buffer[MAXPUSHBACK];
5614	static int pushback_index = 0;
5615
5616	int
5617	lgetc(int quotec)
5618	{
5619	int c, next;
5620
5621	if (parsebuf) {
5622	/* Read character from the parsebuffer instead of input. */
5623	if (parseindex >= 0) {
5624	c = parsebuf[parseindex++];
5625	if (c != '\0')
5626	return (c);
5627	parsebuf = NULL;
5628	} else
5629	parseindex++;
5630	}
5631
5632	if (pushback_index)
5633	return (pushback_buffer[--pushback_index]);
5634
5635	if (quotec) {
5636	if ((c = getc(file->stream)) == EOF) {
5637	yyerror("reached end of file while parsing quoted string");
5638	if (popfile() == EOF)
5639	return (EOF);
5640	return (quotec);
5641	}
5642	return (c);
5643	}
5644
5645	while ((c = getc(file->stream)) == '\\') {
5646	next = getc(file->stream);
5647	if (next != '\n') {
5648	c = next;
5649	break;
5650	}
5651	yylval.lineno = file->lineno;
5652	file->lineno++;
5653	}
5654
5655	while (c == EOF) {
5656	if (popfile() == EOF)
5657	return (EOF);
5658	c = getc(file->stream);
5659	}
5660	return (c);
5661	}
5662
5663	int
5664	lungetc(int c)
5665	{
5666	if (c == EOF)
5667	return (EOF);
5668	if (parsebuf) {
5669	parseindex--;
5670	if (parseindex >= 0)
5671	return (c);
5672	}
5673	if (pushback_index < MAXPUSHBACK-1)
5674	return (pushback_buffer[pushback_index++] = c);
5675	else
5676	return (EOF);
5677	}
5678
5679	int
5680	findeol(void)
5681	{
5682	int c;
5683
5684	parsebuf = NULL;
5685
5686	/* skip to either EOF or the first real EOL */
5687	while (1) {
5688	if (pushback_index)
5689	c = pushback_buffer[--pushback_index];
5690	else
5691	c = lgetc(0);
5692	if (c == '\n') {
5693	file->lineno++;
5694	break;
5695	}
5696	if (c == EOF)
5697	break;
5698	}
5699	return (ERROR);
5700	}
5701
5702	int
5703	yylex(void)
5704	{
5705	char buf[8096];
5706	char p, val;
5707	int quotec, next, c;
5708	int token;
5709
5710	top:
5711	p = buf;
5712	while ((c = lgetc(0)) == ' ' \|\| c == '\t')
5713	; /* nothing */
5714
5715	yylval.lineno = file->lineno;
5716	if (c == '#')
5717	while ((c = lgetc(0)) != '\n' && c != EOF)
5718	; /* nothing */
5719	if (c == '$' && parsebuf == NULL) {
5720	while (1) {
5721	if ((c = lgetc(0)) == EOF)
5722	return (0);
5723
5724	if (p + 1 >= buf + sizeof(buf) - 1) {
5725	yyerror("string too long");
5726	return (findeol());
5727	}
5728	if (isalnum(c) \|\| c == '_') {
5729	*p++ = (char)c;
5730	continue;
5731	}
5732	*p = '\0';
5733	lungetc(c);
5734	break;
5735	}
5736	val = symget(buf);
5737	if (val == NULL) {
5738	yyerror("macro '%s' not defined", buf);
5739	return (findeol());
5740	}
5741	parsebuf = val;
5742	parseindex = 0;
5743	goto top;
5744	}
5745
5746	switch (c) {
5747	case '\'':
5748	case '"':
5749	quotec = c;
5750	while (1) {
5751	if ((c = lgetc(quotec)) == EOF)
5752	return (0);
5753	if (c == '\n') {
5754	file->lineno++;
5755	continue;
5756	} else if (c == '\\') {
5757	if ((next = lgetc(quotec)) == EOF)
5758	return (0);
5759	if (next == quotec \|\| c == ' ' \|\| c == '\t')
5760	c = next;
5761	else if (next == '\n')
5762	continue;
5763	else
5764	lungetc(next);
5765	} else if (c == quotec) {
5766	*p = '\0';
5767	break;
5768	}
5769	if (p + 1 >= buf + sizeof(buf) - 1) {
5770	yyerror("string too long");
5771	return (findeol());
5772	}
5773	*p++ = (char)c;
5774	}
5775	yylval.v.string = strdup(buf);
5776	if (yylval.v.string == NULL)
5777	err(1, "yylex: strdup");
5778	return (STRING);
5779	case '<':
5780	next = lgetc(0);
5781	if (next == '>') {
5782	yylval.v.i = PF_OP_XRG;
5783	return (PORTBINARY);
5784	}
5785	lungetc(next);
5786	break;
5787	case '>':
5788	next = lgetc(0);
5789	if (next == '<') {
5790	yylval.v.i = PF_OP_IRG;
5791	return (PORTBINARY);
5792	}
5793	lungetc(next);
5794	break;
5795	case '-':
5796	next = lgetc(0);
5797	if (next == '>')
5798	return (ARROW);
5799	lungetc(next);
5800	break;
5801	}
5802
5803	#define allowed_to_end_number(x) \
5804	(isspace(x) \|\| x == ')' \|\| x ==',' \|\| x == '/' \|\| x == '}' \|\| x == '=')
5805
5806	if (c == '-' \|\| isdigit(c)) {
5807	do {
5808	*p++ = c;
5809	if ((unsigned)(p-buf) >= sizeof(buf)) {
5810	yyerror("string too long");
5811	return (findeol());
5812	}
5813	} while ((c = lgetc(0)) != EOF && isdigit(c));
5814	lungetc(c);
5815	if (p == buf + 1 && buf[0] == '-')
5816	goto nodigits;
5817	if (c == EOF \|\| allowed_to_end_number(c)) {
5818	const char *errstr = NULL;
5819
5820	*p = '\0';
5821	yylval.v.number = strtonum(buf, LLONG_MIN,
5822	LLONG_MAX, &errstr);
5823	if (errstr) {
5824	yyerror("\"%s\" invalid number: %s",
5825	buf, errstr);
5826	return (findeol());
5827	}
5828	return (NUMBER);
5829	} else {
5830	nodigits:
5831	while (p > buf + 1)
5832	lungetc(*--p);
5833	c = *--p;
5834	if (c == '-')
5835	return (c);
5836	}
5837	}
5838
5839	#define allowed_in_string(x) \
5840	(isalnum(x) \|\| (ispunct(x) && x != '(' && x != ')' && \
5841	x != '{' && x != '}' && x != '<' && x != '>' && \
5842	x != '!' && x != '=' && x != '/' && x != '#' && \
5843	x != ','))
5844
5845	if (isalnum(c) \|\| c == ':' \|\| c == '_') {
5846	do {
5847	*p++ = c;
5848	if ((unsigned)(p-buf) >= sizeof(buf)) {
5849	yyerror("string too long");
5850	return (findeol());
5851	}
5852	} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
5853	lungetc(c);
5854	*p = '\0';
5855	if ((token = lookup(buf)) == STRING)
5856	if ((yylval.v.string = strdup(buf)) == NULL)
5857	err(1, "yylex: strdup");
5858	return (token);
5859	}
5860	if (c == '\n') {
5861	yylval.lineno = file->lineno;
5862	file->lineno++;
5863	}
5864	if (c == EOF)
5865	return (0);
5866	return (c);
5867	}
5868
5869	int
5870	check_file_secrecy(int fd, const char *fname)
5871	{
5872	struct stat st;
5873
5874	if (fstat(fd, &st)) {
5875	warn("cannot stat %s", fname);
5876	return (-1);
5877	}
5878	if (st.st_uid != 0 && st.st_uid != getuid()) {
5879	warnx("%s: owner not root or current user", fname);
5880	return (-1);
5881	}
5882	if (st.st_mode & (S_IRWXG \| S_IRWXO)) {
5883	warnx("%s: group/world readable/writeable", fname);
5884	return (-1);
5885	}
5886	return (0);
5887	}
5888
5889	struct file *
5890	pushfile(const char *name, int secret)
5891	{
5892	struct file *nfile;
5893
5894	if ((nfile = calloc(1, sizeof(struct file))) == NULL \|\|
5895	(nfile->name = strdup(name)) == NULL) {
5896	warn("malloc");
5897	return (NULL);
5898	}
5899	if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) {
5900	nfile->stream = stdin;
5901	free(nfile->name);
5902	if ((nfile->name = strdup("stdin")) == NULL) {
5903	warn("strdup");
5904	free(nfile);
5905	return (NULL);
5906	}
5907	} else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
5908	warn("%s", nfile->name);
5909	free(nfile->name);
5910	free(nfile);
5911	return (NULL);
5912	} else if (secret &&
5913	check_file_secrecy(fileno(nfile->stream), nfile->name)) {
5914	fclose(nfile->stream);
5915	free(nfile->name);
5916	free(nfile);
5917	return (NULL);
5918	}
5919	nfile->lineno = 1;
5920	TAILQ_INSERT_TAIL(&files, nfile, entry);
5921	return (nfile);
5922	}
5923
5924	int
5925	popfile(void)
5926	{
5927	struct file *prev;
5928
5929	if ((prev = TAILQ_PREV(file, files, entry)) != NULL) {
5930	prev->errors += file->errors;
5931	TAILQ_REMOVE(&files, file, entry);
5932	fclose(file->stream);
5933	free(file->name);
5934	free(file);
5935	file = prev;
5936	return (0);
5937	}
5938	return (EOF);
5939	}
5940
5941	int
5942	parse_config(char filename, struct pfctl xpf)
5943	{
5944	int errors = 0;
5945	struct sym *sym;
5946
5947	pf = xpf;
5948	errors = 0;
5949	rulestate = PFCTL_STATE_NONE;
5950	returnicmpdefault = (ICMP_UNREACH << 8) \| ICMP_UNREACH_PORT;
5951	returnicmp6default =
5952	(ICMP6_DST_UNREACH << 8) \| ICMP6_DST_UNREACH_NOPORT;
5953	blockpolicy = PFRULE_DROP;
5954	require_order = 1;
5955
5956	if ((file = pushfile(filename, 0)) == NULL) {
5957	warn("cannot open the main config file!");
5958	return (-1);
5959	}
5960
5961	yyparse();
5962	errors = file->errors;
5963	popfile();
5964
5965	/* Free macros and check which have not been used. */
5966	while ((sym = TAILQ_FIRST(&symhead))) {
5967	if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
5968	fprintf(stderr, "warning: macro '%s' not "
5969	"used\n", sym->nam);
5970	free(sym->nam);
5971	free(sym->val);
5972	TAILQ_REMOVE(&symhead, sym, entry);
5973	free(sym);
5974	}
5975
5976	return (errors ? -1 : 0);
5977	}
5978
5979	int
5980	symset(const char nam, const char val, int persist)
5981	{
5982	struct sym *sym;
5983
5984	for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
5985	sym = TAILQ_NEXT(sym, entry))
5986	; /* nothing */
5987
5988	if (sym != NULL) {
5989	if (sym->persist == 1)
5990	return (0);
5991	else {
5992	free(sym->nam);
5993	free(sym->val);
5994	TAILQ_REMOVE(&symhead, sym, entry);
5995	free(sym);
5996	}
5997	}
5998	if ((sym = calloc(1, sizeof(*sym))) == NULL)
5999	return (-1);
6000
6001	sym->nam = strdup(nam);
6002	if (sym->nam == NULL) {
6003	free(sym);
6004	return (-1);
6005	}
6006	sym->val = strdup(val);
6007	if (sym->val == NULL) {
6008	free(sym->nam);
6009	free(sym);
6010	return (-1);
6011	}
6012	sym->used = 0;
6013	sym->persist = persist;
6014	TAILQ_INSERT_TAIL(&symhead, sym, entry);
6015	return (0);
6016	}
6017
6018	int
6019	pfctl_cmdline_symset(char *s)
6020	{
6021	char sym, val;
6022	int ret;
6023
6024	if ((val = strrchr(s, '=')) == NULL)
6025	return (-1);
6026
6027	if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
6028	err(1, "pfctl_cmdline_symset: malloc");
6029
6030	strlcpy(sym, s, strlen(s) - strlen(val) + 1);
6031
6032	ret = symset(sym, val + 1, 1);
6033	free(sym);
6034
6035	return (ret);
6036	}
6037
6038	char *
6039	symget(const char *nam)
6040	{
6041	struct sym *sym;
6042
6043	TAILQ_FOREACH(sym, &symhead, entry)
6044	if (strcmp(nam, sym->nam) == 0) {
6045	sym->used = 1;
6046	return (sym->val);
6047	}
6048	return (NULL);
6049	}
6050
6051	void
6052	mv_rules(struct pf_ruleset src, struct pf_ruleset dst)
6053	{
6054	int i;
6055	struct pf_rule *r;
6056
6057	for (i = 0; i < PF_RULESET_MAX; ++i) {
6058	while ((r = TAILQ_FIRST(src->rules[i].active.ptr))
6059	!= NULL) {
6060	TAILQ_REMOVE(src->rules[i].active.ptr, r, entries);
6061	TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries);
6062	dst->anchor->match++;
6063	}
6064	src->anchor->match = 0;
6065	while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr))
6066	!= NULL) {
6067	TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries);
6068	TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr,
6069	r, entries);
6070	}
6071	}
6072	}
6073
6074	void
6075	decide_address_family(struct node_host n, sa_family_t af)
6076	{
6077	if (*af != 0 \|\| n == NULL)
6078	return;
6079	*af = n->af;
6080	while ((n = n->next) != NULL) {
6081	if (n->af != *af) {
6082	*af = 0;
6083	return;
6084	}
6085	}
6086	}
6087
6088	void
6089	remove_invalid_hosts(struct node_host *nh, sa_family_t af)
6090	{
6091	struct node_host n = nh, *prev = NULL;
6092
6093	while (n != NULL) {
6094	if (af && n->af && n->af != af) {
6095	/* unlink and free n */
6096	struct node_host *next = n->next;
6097
6098	/* adjust tail pointer */
6099	if (n == (*nh)->tail)
6100	(*nh)->tail = prev;
6101	/* adjust previous node's next pointer */
6102	if (prev == NULL)
6103	*nh = next;
6104	else
6105	prev->next = next;
6106	/* free node */
6107	if (n->ifname != NULL)
6108	free(n->ifname);
6109	free(n);
6110	n = next;
6111	} else {
6112	if (n->af && !*af)
6113	*af = n->af;
6114	prev = n;
6115	n = n->next;
6116	}
6117	}
6118	}
6119
6120	int
6121	invalid_redirect(struct node_host *nh, sa_family_t af)
6122	{
6123	if (!af) {
6124	struct node_host *n;
6125
6126	/* tables and dyniftl are ok without an address family */
6127	for (n = nh; n != NULL; n = n->next) {
6128	if (n->addr.type != PF_ADDR_TABLE &&
6129	n->addr.type != PF_ADDR_DYNIFTL) {
6130	yyerror("address family not given and "
6131	"translation address expands to multiple "
6132	"address families");
6133	return (1);
6134	}
6135	}
6136	}
6137	if (nh == NULL) {
6138	yyerror("no translation address with matching address family "
6139	"found.");
6140	return (1);
6141	}
6142	return (0);
6143	}
6144
6145	int
6146	atoul(char s, u_long ulvalp)
6147	{
6148	u_long ulval;
6149	char *ep;
6150
6151	errno = 0;
6152	ulval = strtoul(s, &ep, 0);
6153	if (s[0] == '\0' \|\| *ep != '\0')
6154	return (-1);
6155	if (errno == ERANGE && ulval == ULONG_MAX)
6156	return (-1);
6157	*ulvalp = ulval;
6158	return (0);
6159	}
6160
6161	int
6162	getservice(char *n)
6163	{
6164	struct servent *s;
6165	u_long ulval;
6166
6167	if (atoul(n, &ulval) == 0) {
6168	if (ulval > 65535) {
6169	yyerror("illegal port value %lu", ulval);
6170	return (-1);
6171	}
6172	return (htons(ulval));
6173	} else {
6174	s = getservbyname(n, "tcp");
6175	if (s == NULL)
6176	s = getservbyname(n, "udp");
6177	if (s == NULL) {
6178	yyerror("unknown port %s", n);
6179	return (-1);
6180	}
6181	return (s->s_port);
6182	}
6183	}
6184
6185	int
6186	rule_label(struct pf_rule r, char s)
6187	{
6188	if (s) {
6189	if (strlcpy(r->label, s, sizeof(r->label)) >=
6190	sizeof(r->label)) {
6191	yyerror("rule label too long (max %d chars)",
6192	sizeof(r->label)-1);
6193	return (-1);
6194	}
6195	}
6196	return (0);
6197	}
6198
6199	u_int16_t
6200	parseicmpspec(char *w, sa_family_t af)
6201	{
6202	const struct icmpcodeent *p;
6203	u_long ulval;
6204	u_int8_t icmptype;
6205
6206	if (af == AF_INET)
6207	icmptype = returnicmpdefault >> 8;
6208	else
6209	icmptype = returnicmp6default >> 8;
6210
6211	if (atoul(w, &ulval) == -1) {
6212	if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
6213	yyerror("unknown icmp code %s", w);
6214	return (0);
6215	}
6216	ulval = p->code;
6217	}
6218	if (ulval > 255) {
6219	yyerror("invalid icmp code %lu", ulval);
6220	return (0);
6221	}
6222	return (icmptype << 8 \| ulval);
6223	}
6224
6225	int
6226	parseport(char port, struct range r, int extensions)
6227	{
6228	char *p = strchr(port, ':');
6229
6230	if (p == NULL) {
6231	if ((r->a = getservice(port)) == -1)
6232	return (-1);
6233	r->b = 0;
6234	r->t = PF_OP_NONE;
6235	return (0);
6236	}
6237	if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) {
6238	*p = 0;
6239	if ((r->a = getservice(port)) == -1)
6240	return (-1);
6241	r->b = 0;
6242	r->t = PF_OP_IRG;
6243	return (0);
6244	}
6245	if ((extensions & PPORT_RANGE)) {
6246	*p++ = 0;
6247	if ((r->a = getservice(port)) == -1 \|\|
6248	(r->b = getservice(p)) == -1)
6249	return (-1);
6250	if (r->a == r->b) {
6251	r->b = 0;
6252	r->t = PF_OP_NONE;
6253	} else
6254	r->t = PF_OP_RRG;
6255	return (0);
6256	}
6257	return (-1);
6258	}
6259
6260	int
6261	pfctl_load_anchors(int dev, struct pfctl pf, struct pfr_buffer trans)
6262	{
6263	struct loadanchors *la;
6264
6265	TAILQ_FOREACH(la, &loadanchorshead, entries) {
6266	if (pf->opts & PF_OPT_VERBOSE)
6267	fprintf(stderr, "\nLoading anchor %s from %s\n",
6268	la->anchorname, la->filename);
6269	if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize,
6270	la->anchorname, trans) == -1)
6271	return (-1);
6272	}
6273
6274	return (0);
6275	}
6276
6277	int
6278	kw_casecmp(const void k, const void e)
6279	{
6280	return (strcasecmp(k, ((const struct keywords *)e)->k_name));
6281	}
6282
6283	int
6284	map_tos(char s, int val)
6285	{
6286	/* DiffServ Codepoints and other TOS mappings */
6287	const struct keywords toswords[] = {
6288	{ "af11", IPTOS_DSCP_AF11 },
6289	{ "af12", IPTOS_DSCP_AF12 },
6290	{ "af13", IPTOS_DSCP_AF13 },
6291	{ "af21", IPTOS_DSCP_AF21 },
6292	{ "af22", IPTOS_DSCP_AF22 },
6293	{ "af23", IPTOS_DSCP_AF23 },
6294	{ "af31", IPTOS_DSCP_AF31 },
6295	{ "af32", IPTOS_DSCP_AF32 },
6296	{ "af33", IPTOS_DSCP_AF33 },
6297	{ "af41", IPTOS_DSCP_AF41 },
6298	{ "af42", IPTOS_DSCP_AF42 },
6299	{ "af43", IPTOS_DSCP_AF43 },
6300	{ "critical", IPTOS_PREC_CRITIC_ECP },
6301	{ "cs0", IPTOS_DSCP_CS0 },
6302	{ "cs1", IPTOS_DSCP_CS1 },
6303	{ "cs2", IPTOS_DSCP_CS2 },
6304	{ "cs3", IPTOS_DSCP_CS3 },
6305	{ "cs4", IPTOS_DSCP_CS4 },
6306	{ "cs5", IPTOS_DSCP_CS5 },
6307	{ "cs6", IPTOS_DSCP_CS6 },
6308	{ "cs7", IPTOS_DSCP_CS7 },
6309	{ "ef", IPTOS_DSCP_EF },
6310	{ "inetcontrol", IPTOS_PREC_INTERNETCONTROL },
6311	{ "lowdelay", IPTOS_LOWDELAY },
6312	{ "netcontrol", IPTOS_PREC_NETCONTROL },
6313	{ "reliability", IPTOS_RELIABILITY },
6314	{ "throughput", IPTOS_THROUGHPUT }
6315	};
6316	const struct keywords *p;
6317
6318	p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]),
6319	sizeof(toswords[0]), kw_casecmp);
6320
6321	if (p) {
6322	*val = p->k_val;
6323	return (1);
6324	}
6325	return (0);
6326	}
6327
6328	int
6329	rt_tableid_max(void)
6330	{
6331	#ifdef __FreeBSD__
6332	int fibs;
6333	size_t l = sizeof(fibs);
6334
6335	if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1)
6336	fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */
6337	/*
6338	* As the OpenBSD code only compares > and not >= we need to adjust
6339	* here given we only accept values of 0..n and want to avoid #ifdefs
6340	* in the grammar.
6341	*/
6342	return (fibs - 1);
6343	#else
6344	return (RT_TABLEID_MAX);
6345	#endif
6346	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats:

Original Format