Context Navigation

parse.y @ b6c64e1

55-freebsd-126-freebsd-12

Last change on this file since b6c64e1 was b6c64e1, checked in by Sebastian Huber <sebastian.huber@…>, on 08/28/18 at 12:15:47
Regenerate program header files
Property mode set to `100644`
File size: 143.8 KB

Line
1	/* $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $ */
2
3	/*
4	* Copyright (c) 2001 Markus Friedl. All rights reserved.
5	* Copyright (c) 2001 Daniel Hartmeier. All rights reserved.
6	* Copyright (c) 2001 Theo de Raadt. All rights reserved.
7	* Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
8	*
9	* Redistribution and use in source and binary forms, with or without
10	* modification, are permitted provided that the following conditions
11	* are met:
12	* 1. Redistributions of source code must retain the above copyright
13	* notice, this list of conditions and the following disclaimer.
14	* 2. Redistributions in binary form must reproduce the above copyright
15	* notice, this list of conditions and the following disclaimer in the
16	* documentation and/or other materials provided with the distribution.
17	*
18	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28	*/
29	%{
30	#ifdef __rtems__
31	#include <machine/rtems-bsd-user-space.h>
32	#undef INET6
33	#endif /* __rtems__ */
34
35	#ifdef __rtems__
36	#include "rtems-bsd-pfctl-namespace.h"
37	#endif /* __rtems__ */
38	#include <sys/cdefs.h>
39	__FBSDID("$FreeBSD$");
40
41	#ifdef __rtems__
42	#include <machine/rtems-bsd-program.h>
43	#define pf_find_or_create_ruleset _bsd_pf_find_or_create_ruleset
44	#define pf_anchor_setup _bsd_pf_anchor_setup
45	#define pf_remove_if_empty_ruleset _bsd_pf_remove_if_empty_ruleset
46	#endif /* __rtems__ */
47	#include <sys/types.h>
48	#include <sys/socket.h>
49	#include <sys/stat.h>
50	#ifdef __FreeBSD__
51	#include <sys/sysctl.h>
52	#endif
53	#include <net/if.h>
54	#include <netinet/in.h>
55	#include <netinet/in_systm.h>
56	#include <netinet/ip.h>
57	#include <netinet/ip_icmp.h>
58	#include <netinet/icmp6.h>
59	#include <net/pfvar.h>
60	#include <arpa/inet.h>
61	#include <net/altq/altq.h>
62	#include <net/altq/altq_cbq.h>
63	#include <net/altq/altq_codel.h>
64	#include <net/altq/altq_priq.h>
65	#include <net/altq/altq_hfsc.h>
66	#include <net/altq/altq_fairq.h>
67
68	#include <stdio.h>
69	#include <unistd.h>
70	#include <stdlib.h>
71	#include <netdb.h>
72	#include <stdarg.h>
73	#include <errno.h>
74	#include <string.h>
75	#include <ctype.h>
76	#include <math.h>
77	#include <err.h>
78	#include <limits.h>
79	#include <pwd.h>
80	#include <grp.h>
81	#include <md5.h>
82
83	#include "pfctl_parser.h"
84	#include "pfctl.h"
85	#ifdef __rtems__
86	#include "rtems-bsd-pfctl-parse-data.h"
87	#endif /* __rtems__ */
88
89	static struct pfctl *pf = NULL;
90	static int debug = 0;
91	static int rulestate = 0;
92	static u_int16_t returnicmpdefault =
93	(ICMP_UNREACH << 8) \| ICMP_UNREACH_PORT;
94	static u_int16_t returnicmp6default =
95	(ICMP6_DST_UNREACH << 8) \| ICMP6_DST_UNREACH_NOPORT;
96	static int blockpolicy = PFRULE_DROP;
97	static int require_order = 1;
98	static int default_statelock;
99
100	static TAILQ_HEAD(files, file) files = TAILQ_HEAD_INITIALIZER(files);
101	static struct file {
102	TAILQ_ENTRY(file) entry;
103	FILE *stream;
104	char *name;
105	int lineno;
106	int errors;
107	} *file;
108	struct file pushfile(const char , int);
109	int popfile(void);
110	int check_file_secrecy(int, const char *);
111	int yyparse(void);
112	int yylex(void);
113	int yyerror(const char *, ...);
114	int kw_cmp(const void , const void );
115	int lookup(char *);
116	int lgetc(int);
117	int lungetc(int);
118	int findeol(void);
119
120	static TAILQ_HEAD(symhead, sym) symhead = TAILQ_HEAD_INITIALIZER(symhead);
121	struct sym {
122	TAILQ_ENTRY(sym) entry;
123	int used;
124	int persist;
125	char *nam;
126	char *val;
127	};
128	int symset(const char , const char , int);
129	char symget(const char );
130
131	int atoul(char , u_long );
132
133	enum {
134	PFCTL_STATE_NONE,
135	PFCTL_STATE_OPTION,
136	PFCTL_STATE_SCRUB,
137	PFCTL_STATE_QUEUE,
138	PFCTL_STATE_NAT,
139	PFCTL_STATE_FILTER
140	};
141
142	struct node_proto {
143	u_int8_t proto;
144	struct node_proto *next;
145	struct node_proto *tail;
146	};
147
148	struct node_port {
149	u_int16_t port[2];
150	u_int8_t op;
151	struct node_port *next;
152	struct node_port *tail;
153	};
154
155	struct node_uid {
156	uid_t uid[2];
157	u_int8_t op;
158	struct node_uid *next;
159	struct node_uid *tail;
160	};
161
162	struct node_gid {
163	gid_t gid[2];
164	u_int8_t op;
165	struct node_gid *next;
166	struct node_gid *tail;
167	};
168
169	struct node_icmp {
170	u_int8_t code;
171	u_int8_t type;
172	u_int8_t proto;
173	struct node_icmp *next;
174	struct node_icmp *tail;
175	};
176
177	enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
178	PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
179	PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
180	PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
181	PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, };
182
183	enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
184
185	struct node_state_opt {
186	int type;
187	union {
188	u_int32_t max_states;
189	u_int32_t max_src_states;
190	u_int32_t max_src_conn;
191	struct {
192	u_int32_t limit;
193	u_int32_t seconds;
194	} max_src_conn_rate;
195	struct {
196	u_int8_t flush;
197	char tblname[PF_TABLE_NAME_SIZE];
198	} overload;
199	u_int32_t max_src_nodes;
200	u_int8_t src_track;
201	u_int32_t statelock;
202	struct {
203	int number;
204	u_int32_t seconds;
205	} timeout;
206	} data;
207	struct node_state_opt *next;
208	struct node_state_opt *tail;
209	};
210
211	struct peer {
212	struct node_host *host;
213	struct node_port *port;
214	};
215
216	static struct node_queue {
217	char queue[PF_QNAME_SIZE];
218	char parent[PF_QNAME_SIZE];
219	char ifname[IFNAMSIZ];
220	int scheduler;
221	struct node_queue *next;
222	struct node_queue *tail;
223	} *queues = NULL;
224
225	struct node_qassign {
226	char *qname;
227	char *pqname;
228	};
229
230	static struct filter_opts {
231	int marker;
232	#define FOM_FLAGS 0x01
233	#define FOM_ICMP 0x02
234	#define FOM_TOS 0x04
235	#define FOM_KEEP 0x08
236	#define FOM_SRCTRACK 0x10
237	#define FOM_SETPRIO 0x0400
238	#define FOM_PRIO 0x2000
239	struct node_uid *uid;
240	struct node_gid *gid;
241	struct {
242	u_int8_t b1;
243	u_int8_t b2;
244	u_int16_t w;
245	u_int16_t w2;
246	} flags;
247	struct node_icmp *icmpspec;
248	u_int32_t tos;
249	u_int32_t prob;
250	struct {
251	int action;
252	struct node_state_opt *options;
253	} keep;
254	int fragment;
255	int allowopts;
256	char *label;
257	struct node_qassign queues;
258	char *tag;
259	char *match_tag;
260	u_int8_t match_tag_not;
261	u_int rtableid;
262	u_int8_t prio;
263	u_int8_t set_prio[2];
264	struct {
265	struct node_host *addr;
266	u_int16_t port;
267	} divert;
268	} filter_opts;
269
270	static struct antispoof_opts {
271	char *label;
272	u_int rtableid;
273	} antispoof_opts;
274
275	static struct scrub_opts {
276	int marker;
277	#define SOM_MINTTL 0x01
278	#define SOM_MAXMSS 0x02
279	#define SOM_FRAGCACHE 0x04
280	#define SOM_SETTOS 0x08
281	int nodf;
282	int minttl;
283	int maxmss;
284	int settos;
285	int fragcache;
286	int randomid;
287	int reassemble_tcp;
288	char *match_tag;
289	u_int8_t match_tag_not;
290	u_int rtableid;
291	} scrub_opts;
292
293	static struct queue_opts {
294	int marker;
295	#define QOM_BWSPEC 0x01
296	#define QOM_SCHEDULER 0x02
297	#define QOM_PRIORITY 0x04
298	#define QOM_TBRSIZE 0x08
299	#define QOM_QLIMIT 0x10
300	struct node_queue_bw queue_bwspec;
301	struct node_queue_opt scheduler;
302	int priority;
303	int tbrsize;
304	int qlimit;
305	} queue_opts;
306
307	static struct table_opts {
308	int flags;
309	int init_addr;
310	struct node_tinithead init_nodes;
311	} table_opts;
312
313	static struct pool_opts {
314	int marker;
315	#define POM_TYPE 0x01
316	#define POM_STICKYADDRESS 0x02
317	u_int8_t opts;
318	int type;
319	int staticport;
320	struct pf_poolhashkey *key;
321
322	} pool_opts;
323
324	static struct codel_opts codel_opts;
325	static struct node_hfsc_opts hfsc_opts;
326	static struct node_fairq_opts fairq_opts;
327	static struct node_state_opt *keep_state_defaults = NULL;
328
329	int disallow_table(struct node_host , const char );
330	int disallow_urpf_failed(struct node_host , const char );
331	int disallow_alias(struct node_host , const char );
332	int rule_consistent(struct pf_rule *, int);
333	int filter_consistent(struct pf_rule *, int);
334	int nat_consistent(struct pf_rule *);
335	int rdr_consistent(struct pf_rule *);
336	int process_tabledef(char , struct table_opts );
337	void expand_label_str(char , size_t, const char , const char *);
338	void expand_label_if(const char , char , size_t, const char *);
339	void expand_label_addr(const char , char , size_t, u_int8_t,
340	struct node_host *);
341	void expand_label_port(const char , char , size_t,
342	struct node_port *);
343	void expand_label_proto(const char , char , size_t, u_int8_t);
344	void expand_label_nr(const char , char , size_t);
345	void expand_label(char , size_t, const char , u_int8_t,
346	struct node_host , struct node_port , struct node_host *,
347	struct node_port *, u_int8_t);
348	void expand_rule(struct pf_rule , struct node_if ,
349	struct node_host , struct node_proto , struct node_os *,
350	struct node_host , struct node_port , struct node_host *,
351	struct node_port , struct node_uid , struct node_gid *,
352	struct node_icmp , const char );
353	int expand_altq(struct pf_altq , struct node_if ,
354	struct node_queue *, struct node_queue_bw bwspec,
355	struct node_queue_opt *);
356	int expand_queue(struct pf_altq , struct node_if ,
357	struct node_queue *, struct node_queue_bw,
358	struct node_queue_opt *);
359	int expand_skip_interface(struct node_if *);
360
361	int check_rulestate(int);
362	int getservice(char *);
363	int rule_label(struct pf_rule , char );
364	int rt_tableid_max(void);
365
366	void mv_rules(struct pf_ruleset , struct pf_ruleset );
367	void decide_address_family(struct node_host , sa_family_t );
368	void remove_invalid_hosts(struct node_host *, sa_family_t );
369	int invalid_redirect(struct node_host *, sa_family_t);
370	u_int16_t parseicmpspec(char *, sa_family_t);
371	int kw_casecmp(const void , const void );
372	int map_tos(char string, int );
373
374	static TAILQ_HEAD(loadanchorshead, loadanchors)
375	loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
376
377	struct loadanchors {
378	TAILQ_ENTRY(loadanchors) entries;
379	char *anchorname;
380	char *filename;
381	};
382
383	typedef struct {
384	union {
385	int64_t number;
386	double probability;
387	int i;
388	char *string;
389	u_int rtableid;
390	struct {
391	u_int8_t b1;
392	u_int8_t b2;
393	u_int16_t w;
394	u_int16_t w2;
395	} b;
396	struct range {
397	int a;
398	int b;
399	int t;
400	} range;
401	struct node_if *interface;
402	struct node_proto *proto;
403	struct node_icmp *icmp;
404	struct node_host *host;
405	struct node_os *os;
406	struct node_port *port;
407	struct node_uid *uid;
408	struct node_gid *gid;
409	struct node_state_opt *state_opt;
410	struct peer peer;
411	struct {
412	struct peer src, dst;
413	struct node_os *src_os;
414	} fromto;
415	struct {
416	struct node_host *host;
417	u_int8_t rt;
418	u_int8_t pool_opts;
419	sa_family_t af;
420	struct pf_poolhashkey *key;
421	} route;
422	struct redirection {
423	struct node_host *host;
424	struct range rport;
425	} *redirection;
426	struct {
427	int action;
428	struct node_state_opt *options;
429	} keep_state;
430	struct {
431	u_int8_t log;
432	u_int8_t logif;
433	u_int8_t quick;
434	} logquick;
435	struct {
436	int neg;
437	char *name;
438	} tagged;
439	struct pf_poolhashkey *hashkey;
440	struct node_queue *queue;
441	struct node_queue_opt queue_options;
442	struct node_queue_bw queue_bwspec;
443	struct node_qassign qassign;
444	struct filter_opts filter_opts;
445	struct antispoof_opts antispoof_opts;
446	struct queue_opts queue_opts;
447	struct scrub_opts scrub_opts;
448	struct table_opts table_opts;
449	struct pool_opts pool_opts;
450	struct node_hfsc_opts hfsc_opts;
451	struct node_fairq_opts fairq_opts;
452	struct codel_opts codel_opts;
453	} v;
454	int lineno;
455	} YYSTYPE;
456
457	#define PPORT_RANGE 1
458	#define PPORT_STAR 2
459	int parseport(char , struct range r, int);
460
461	#define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
462	(!((addr).iflags & PFI_AFLAG_NOALIAS) \|\| \
463	!isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
464
465	%}
466
467	%token PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
468	%token RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
469	%token ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
470	%token MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
471	%token NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
472	%token REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
473	%token SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
474	%token REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
475	%token ANTISPOOF FOR INCLUDE
476	%token BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
477	%token ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME
478	%token UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL
479	%token LOAD RULESET_OPTIMIZATION PRIO
480	%token STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
481	%token MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY
482	%token TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS
483	%token DIVERTTO DIVERTREPLY
484	%token <v.string> STRING
485	%token <v.number> NUMBER
486	%token <v.i> PORTBINARY
487	%type <v.interface> interface if_list if_item_not if_item
488	%type <v.number> number icmptype icmp6type uid gid
489	%type <v.number> tos not yesno
490	%type <v.probability> probability
491	%type <v.i> no dir af fragcache optimizer
492	%type <v.i> sourcetrack flush unaryop statelock
493	%type <v.b> action nataction natpasslog scrubaction
494	%type <v.b> flags flag blockspec prio
495	%type <v.range> portplain portstar portrange
496	%type <v.hashkey> hashkey
497	%type <v.proto> proto proto_list proto_item
498	%type <v.number> protoval
499	%type <v.icmp> icmpspec
500	%type <v.icmp> icmp_list icmp_item
501	%type <v.icmp> icmp6_list icmp6_item
502	%type <v.number> reticmpspec reticmp6spec
503	%type <v.fromto> fromto
504	%type <v.peer> ipportspec from to
505	%type <v.host> ipspec toipspec xhost host dynaddr host_list
506	%type <v.host> redir_host_list redirspec
507	%type <v.host> route_host route_host_list routespec
508	%type <v.os> os xos os_list
509	%type <v.port> portspec port_list port_item
510	%type <v.uid> uids uid_list uid_item
511	%type <v.gid> gids gid_list gid_item
512	%type <v.route> route
513	%type <v.redirection> redirection redirpool
514	%type <v.string> label stringall tag anchorname
515	%type <v.string> string varstring numberstring
516	%type <v.keep_state> keep
517	%type <v.state_opt> state_opt_spec state_opt_list state_opt_item
518	%type <v.logquick> logquick quick log logopts logopt
519	%type <v.interface> antispoof_ifspc antispoof_iflst antispoof_if
520	%type <v.qassign> qname
521	%type <v.queue> qassign qassign_list qassign_item
522	%type <v.queue_options> scheduler
523	%type <v.number> cbqflags_list cbqflags_item
524	%type <v.number> priqflags_list priqflags_item
525	%type <v.hfsc_opts> hfscopts_list hfscopts_item hfsc_opts
526	%type <v.fairq_opts> fairqopts_list fairqopts_item fairq_opts
527	%type <v.codel_opts> codelopts_list codelopts_item codel_opts
528	%type <v.queue_bwspec> bandwidth
529	%type <v.filter_opts> filter_opts filter_opt filter_opts_l
530	%type <v.filter_opts> filter_sets filter_set filter_sets_l
531	%type <v.antispoof_opts> antispoof_opts antispoof_opt antispoof_opts_l
532	%type <v.queue_opts> queue_opts queue_opt queue_opts_l
533	%type <v.scrub_opts> scrub_opts scrub_opt scrub_opts_l
534	%type <v.table_opts> table_opts table_opt table_opts_l
535	%type <v.pool_opts> pool_opts pool_opt pool_opts_l
536	%type <v.tagged> tagged
537	%type <v.rtableid> rtable
538	%%
539
540	ruleset : /* empty */
541	\| ruleset include '\n'
542	\| ruleset '\n'
543	\| ruleset option '\n'
544	\| ruleset scrubrule '\n'
545	\| ruleset natrule '\n'
546	\| ruleset binatrule '\n'
547	\| ruleset pfrule '\n'
548	\| ruleset anchorrule '\n'
549	\| ruleset loadrule '\n'
550	\| ruleset altqif '\n'
551	\| ruleset queuespec '\n'
552	\| ruleset varset '\n'
553	\| ruleset antispoof '\n'
554	\| ruleset tabledef '\n'
555	\| '{' fakeanchor '}' '\n';
556	\| ruleset error '\n' { file->errors++; }
557	;
558
559	include : INCLUDE STRING {
560	struct file *nfile;
561
562	if ((nfile = pushfile($2, 0)) == NULL) {
563	yyerror("failed to include file %s", $2);
564	free($2);
565	YYERROR;
566	}
567	free($2);
568
569	file = nfile;
570	lungetc('\n');
571	}
572	;
573
574	/*
575	* apply to previouslys specified rule: must be careful to note
576	* what that is: pf or nat or binat or rdr
577	*/
578	fakeanchor : fakeanchor '\n'
579	\| fakeanchor anchorrule '\n'
580	\| fakeanchor binatrule '\n'
581	\| fakeanchor natrule '\n'
582	\| fakeanchor pfrule '\n'
583	\| fakeanchor error '\n'
584	;
585
586	optimizer : string {
587	if (!strcmp($1, "none"))
588	$$ = 0;
589	else if (!strcmp($1, "basic"))
590	$$ = PF_OPTIMIZE_BASIC;
591	else if (!strcmp($1, "profile"))
592	$$ = PF_OPTIMIZE_BASIC \| PF_OPTIMIZE_PROFILE;
593	else {
594	yyerror("unknown ruleset-optimization %s", $1);
595	YYERROR;
596	}
597	}
598	;
599
600	option : SET OPTIMIZATION STRING {
601	if (check_rulestate(PFCTL_STATE_OPTION)) {
602	free($3);
603	YYERROR;
604	}
605	if (pfctl_set_optimization(pf, $3) != 0) {
606	yyerror("unknown optimization %s", $3);
607	free($3);
608	YYERROR;
609	}
610	free($3);
611	}
612	\| SET RULESET_OPTIMIZATION optimizer {
613	if (!(pf->opts & PF_OPT_OPTIMIZE)) {
614	pf->opts \|= PF_OPT_OPTIMIZE;
615	pf->optimize = $3;
616	}
617	}
618	\| SET TIMEOUT timeout_spec
619	\| SET TIMEOUT '{' optnl timeout_list '}'
620	\| SET LIMIT limit_spec
621	\| SET LIMIT '{' optnl limit_list '}'
622	\| SET LOGINTERFACE stringall {
623	if (check_rulestate(PFCTL_STATE_OPTION)) {
624	free($3);
625	YYERROR;
626	}
627	if (pfctl_set_logif(pf, $3) != 0) {
628	yyerror("error setting loginterface %s", $3);
629	free($3);
630	YYERROR;
631	}
632	free($3);
633	}
634	\| SET HOSTID number {
635	if ($3 == 0 \|\| $3 > UINT_MAX) {
636	yyerror("hostid must be non-zero");
637	YYERROR;
638	}
639	if (pfctl_set_hostid(pf, $3) != 0) {
640	yyerror("error setting hostid %08x", $3);
641	YYERROR;
642	}
643	}
644	\| SET BLOCKPOLICY DROP {
645	if (pf->opts & PF_OPT_VERBOSE)
646	printf("set block-policy drop\n");
647	if (check_rulestate(PFCTL_STATE_OPTION))
648	YYERROR;
649	blockpolicy = PFRULE_DROP;
650	}
651	\| SET BLOCKPOLICY RETURN {
652	if (pf->opts & PF_OPT_VERBOSE)
653	printf("set block-policy return\n");
654	if (check_rulestate(PFCTL_STATE_OPTION))
655	YYERROR;
656	blockpolicy = PFRULE_RETURN;
657	}
658	\| SET REQUIREORDER yesno {
659	if (pf->opts & PF_OPT_VERBOSE)
660	printf("set require-order %s\n",
661	$3 == 1 ? "yes" : "no");
662	require_order = $3;
663	}
664	\| SET FINGERPRINTS STRING {
665	if (pf->opts & PF_OPT_VERBOSE)
666	printf("set fingerprints \"%s\"\n", $3);
667	if (check_rulestate(PFCTL_STATE_OPTION)) {
668	free($3);
669	YYERROR;
670	}
671	if (!pf->anchor->name[0]) {
672	if (pfctl_file_fingerprints(pf->dev,
673	pf->opts, $3)) {
674	yyerror("error loading "
675	"fingerprints %s", $3);
676	free($3);
677	YYERROR;
678	}
679	}
680	free($3);
681	}
682	\| SET STATEPOLICY statelock {
683	if (pf->opts & PF_OPT_VERBOSE)
684	switch ($3) {
685	case 0:
686	printf("set state-policy floating\n");
687	break;
688	case PFRULE_IFBOUND:
689	printf("set state-policy if-bound\n");
690	break;
691	}
692	default_statelock = $3;
693	}
694	\| SET DEBUG STRING {
695	if (check_rulestate(PFCTL_STATE_OPTION)) {
696	free($3);
697	YYERROR;
698	}
699	if (pfctl_set_debug(pf, $3) != 0) {
700	yyerror("error setting debuglevel %s", $3);
701	free($3);
702	YYERROR;
703	}
704	free($3);
705	}
706	\| SET SKIP interface {
707	if (expand_skip_interface($3) != 0) {
708	yyerror("error setting skip interface(s)");
709	YYERROR;
710	}
711	}
712	\| SET STATEDEFAULTS state_opt_list {
713	if (keep_state_defaults != NULL) {
714	yyerror("cannot redefine state-defaults");
715	YYERROR;
716	}
717	keep_state_defaults = $3;
718	}
719	;
720
721	stringall : STRING { $$ = $1; }
722	\| ALL {
723	if (($$ = strdup("all")) == NULL) {
724	err(1, "stringall: strdup");
725	}
726	}
727	;
728
729	string : STRING string {
730	if (asprintf(&$$, "%s %s", $1, $2) == -1)
731	err(1, "string: asprintf");
732	free($1);
733	free($2);
734	}
735	\| STRING
736	;
737
738	varstring : numberstring varstring {
739	if (asprintf(&$$, "%s %s", $1, $2) == -1)
740	err(1, "string: asprintf");
741	free($1);
742	free($2);
743	}
744	\| numberstring
745	;
746
747	numberstring : NUMBER {
748	char *s;
749	if (asprintf(&s, "%lld", (long long)$1) == -1) {
750	yyerror("string: asprintf");
751	YYERROR;
752	}
753	$$ = s;
754	}
755	\| STRING
756	;
757
758	varset : STRING '=' varstring {
759	if (pf->opts & PF_OPT_VERBOSE)
760	printf("%s = \"%s\"\n", $1, $3);
761	if (symset($1, $3, 0) == -1)
762	err(1, "cannot store variable %s", $1);
763	free($1);
764	free($3);
765	}
766	;
767
768	anchorname : STRING { $$ = $1; }
769	\| /* empty */ { $$ = NULL; }
770	;
771
772	pfa_anchorlist : /* empty */
773	\| pfa_anchorlist '\n'
774	\| pfa_anchorlist pfrule '\n'
775	\| pfa_anchorlist anchorrule '\n'
776	;
777
778	pfa_anchor : '{'
779	{
780	char ta[PF_ANCHOR_NAME_SIZE];
781	struct pf_ruleset *rs;
782
783	/* steping into a brace anchor */
784	pf->asd++;
785	pf->bn++;
786	pf->brace = 1;
787
788	/* create a holding ruleset in the root */
789	snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn);
790	rs = pf_find_or_create_ruleset(ta);
791	if (rs == NULL)
792	err(1, "pfa_anchor: pf_find_or_create_ruleset");
793	pf->astack[pf->asd] = rs->anchor;
794	pf->anchor = rs->anchor;
795	} '\n' pfa_anchorlist '}'
796	{
797	pf->alast = pf->anchor;
798	pf->asd--;
799	pf->anchor = pf->astack[pf->asd];
800	}
801	\| /* empty */
802	;
803
804	anchorrule : ANCHOR anchorname dir quick interface af proto fromto
805	filter_opts pfa_anchor
806	{
807	struct pf_rule r;
808	struct node_proto *proto;
809
810	if (check_rulestate(PFCTL_STATE_FILTER)) {
811	if ($2)
812	free($2);
813	YYERROR;
814	}
815
816	if ($2 && ($2[0] == '_' \|\| strstr($2, "/_") != NULL)) {
817	free($2);
818	yyerror("anchor names beginning with '_' "
819	"are reserved for internal use");
820	YYERROR;
821	}
822
823	memset(&r, 0, sizeof(r));
824	if (pf->astack[pf->asd + 1]) {
825	/* move inline rules into relative location */
826	pf_anchor_setup(&r,
827	&pf->astack[pf->asd]->ruleset,
828	$2 ? $2 : pf->alast->name);
829
830	if (r.anchor == NULL)
831	err(1, "anchorrule: unable to "
832	"create ruleset");
833
834	if (pf->alast != r.anchor) {
835	if (r.anchor->match) {
836	yyerror("inline anchor '%s' "
837	"already exists",
838	r.anchor->name);
839	YYERROR;
840	}
841	mv_rules(&pf->alast->ruleset,
842	&r.anchor->ruleset);
843	}
844	pf_remove_if_empty_ruleset(&pf->alast->ruleset);
845	pf->alast = r.anchor;
846	} else {
847	if (!$2) {
848	yyerror("anchors without explicit "
849	"rules must specify a name");
850	YYERROR;
851	}
852	}
853	r.direction = $3;
854	r.quick = $4.quick;
855	r.af = $6;
856	r.prob = $9.prob;
857	r.rtableid = $9.rtableid;
858
859	if ($9.tag)
860	if (strlcpy(r.tagname, $9.tag,
861	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
862	yyerror("tag too long, max %u chars",
863	PF_TAG_NAME_SIZE - 1);
864	YYERROR;
865	}
866	if ($9.match_tag)
867	if (strlcpy(r.match_tagname, $9.match_tag,
868	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
869	yyerror("tag too long, max %u chars",
870	PF_TAG_NAME_SIZE - 1);
871	YYERROR;
872	}
873	r.match_tag_not = $9.match_tag_not;
874	if (rule_label(&r, $9.label))
875	YYERROR;
876	free($9.label);
877	r.flags = $9.flags.b1;
878	r.flagset = $9.flags.b2;
879	if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
880	yyerror("flags always false");
881	YYERROR;
882	}
883	if ($9.flags.b1 \|\| $9.flags.b2 \|\| $8.src_os) {
884	for (proto = $7; proto != NULL &&
885	proto->proto != IPPROTO_TCP;
886	proto = proto->next)
887	; /* nothing */
888	if (proto == NULL && $7 != NULL) {
889	if ($9.flags.b1 \|\| $9.flags.b2)
890	yyerror(
891	"flags only apply to tcp");
892	if ($8.src_os)
893	yyerror(
894	"OS fingerprinting only "
895	"applies to tcp");
896	YYERROR;
897	}
898	}
899
900	r.tos = $9.tos;
901
902	if ($9.keep.action) {
903	yyerror("cannot specify state handling "
904	"on anchors");
905	YYERROR;
906	}
907
908	if ($9.match_tag)
909	if (strlcpy(r.match_tagname, $9.match_tag,
910	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
911	yyerror("tag too long, max %u chars",
912	PF_TAG_NAME_SIZE - 1);
913	YYERROR;
914	}
915	r.match_tag_not = $9.match_tag_not;
916	if ($9.marker & FOM_PRIO) {
917	if ($9.prio == 0)
918	r.prio = PF_PRIO_ZERO;
919	else
920	r.prio = $9.prio;
921	}
922	if ($9.marker & FOM_SETPRIO) {
923	r.set_prio[0] = $9.set_prio[0];
924	r.set_prio[1] = $9.set_prio[1];
925	r.scrub_flags \|= PFSTATE_SETPRIO;
926	}
927
928	decide_address_family($8.src.host, &r.af);
929	decide_address_family($8.dst.host, &r.af);
930
931	expand_rule(&r, $5, NULL, $7, $8.src_os,
932	$8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
933	$9.uid, $9.gid, $9.icmpspec,
934	pf->astack[pf->asd + 1] ? pf->alast->name : $2);
935	free($2);
936	pf->astack[pf->asd + 1] = NULL;
937	}
938	\| NATANCHOR string interface af proto fromto rtable {
939	struct pf_rule r;
940
941	if (check_rulestate(PFCTL_STATE_NAT)) {
942	free($2);
943	YYERROR;
944	}
945
946	memset(&r, 0, sizeof(r));
947	r.action = PF_NAT;
948	r.af = $4;
949	r.rtableid = $7;
950
951	decide_address_family($6.src.host, &r.af);
952	decide_address_family($6.dst.host, &r.af);
953
954	expand_rule(&r, $3, NULL, $5, $6.src_os,
955	$6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
956	0, 0, 0, $2);
957	free($2);
958	}
959	\| RDRANCHOR string interface af proto fromto rtable {
960	struct pf_rule r;
961
962	if (check_rulestate(PFCTL_STATE_NAT)) {
963	free($2);
964	YYERROR;
965	}
966
967	memset(&r, 0, sizeof(r));
968	r.action = PF_RDR;
969	r.af = $4;
970	r.rtableid = $7;
971
972	decide_address_family($6.src.host, &r.af);
973	decide_address_family($6.dst.host, &r.af);
974
975	if ($6.src.port != NULL) {
976	yyerror("source port parameter not supported"
977	" in rdr-anchor");
978	YYERROR;
979	}
980	if ($6.dst.port != NULL) {
981	if ($6.dst.port->next != NULL) {
982	yyerror("destination port list "
983	"expansion not supported in "
984	"rdr-anchor");
985	YYERROR;
986	} else if ($6.dst.port->op != PF_OP_EQ) {
987	yyerror("destination port operators"
988	" not supported in rdr-anchor");
989	YYERROR;
990	}
991	r.dst.port[0] = $6.dst.port->port[0];
992	r.dst.port[1] = $6.dst.port->port[1];
993	r.dst.port_op = $6.dst.port->op;
994	}
995
996	expand_rule(&r, $3, NULL, $5, $6.src_os,
997	$6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
998	0, 0, 0, $2);
999	free($2);
1000	}
1001	\| BINATANCHOR string interface af proto fromto rtable {
1002	struct pf_rule r;
1003
1004	if (check_rulestate(PFCTL_STATE_NAT)) {
1005	free($2);
1006	YYERROR;
1007	}
1008
1009	memset(&r, 0, sizeof(r));
1010	r.action = PF_BINAT;
1011	r.af = $4;
1012	r.rtableid = $7;
1013	if ($5 != NULL) {
1014	if ($5->next != NULL) {
1015	yyerror("proto list expansion"
1016	" not supported in binat-anchor");
1017	YYERROR;
1018	}
1019	r.proto = $5->proto;
1020	free($5);
1021	}
1022
1023	if ($6.src.host != NULL \|\| $6.src.port != NULL \|\|
1024	$6.dst.host != NULL \|\| $6.dst.port != NULL) {
1025	yyerror("fromto parameter not supported"
1026	" in binat-anchor");
1027	YYERROR;
1028	}
1029
1030	decide_address_family($6.src.host, &r.af);
1031	decide_address_family($6.dst.host, &r.af);
1032
1033	pfctl_add_rule(pf, &r, $2);
1034	free($2);
1035	}
1036	;
1037
1038	loadrule : LOAD ANCHOR string FROM string {
1039	struct loadanchors *loadanchor;
1040
1041	if (strlen(pf->anchor->name) + 1 +
1042	strlen($3) >= MAXPATHLEN) {
1043	yyerror("anchorname %s too long, max %u\n",
1044	$3, MAXPATHLEN - 1);
1045	free($3);
1046	YYERROR;
1047	}
1048	loadanchor = calloc(1, sizeof(struct loadanchors));
1049	if (loadanchor == NULL)
1050	err(1, "loadrule: calloc");
1051	if ((loadanchor->anchorname = malloc(MAXPATHLEN)) ==
1052	NULL)
1053	err(1, "loadrule: malloc");
1054	if (pf->anchor->name[0])
1055	snprintf(loadanchor->anchorname, MAXPATHLEN,
1056	"%s/%s", pf->anchor->name, $3);
1057	else
1058	strlcpy(loadanchor->anchorname, $3, MAXPATHLEN);
1059	if ((loadanchor->filename = strdup($5)) == NULL)
1060	err(1, "loadrule: strdup");
1061
1062	TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
1063	entries);
1064
1065	free($3);
1066	free($5);
1067	};
1068
1069	scrubaction : no SCRUB {
1070	$$.b2 = $$.w = 0;
1071	if ($1)
1072	$$.b1 = PF_NOSCRUB;
1073	else
1074	$$.b1 = PF_SCRUB;
1075	}
1076	;
1077
1078	scrubrule : scrubaction dir logquick interface af proto fromto scrub_opts
1079	{
1080	struct pf_rule r;
1081
1082	if (check_rulestate(PFCTL_STATE_SCRUB))
1083	YYERROR;
1084
1085	memset(&r, 0, sizeof(r));
1086
1087	r.action = $1.b1;
1088	r.direction = $2;
1089
1090	r.log = $3.log;
1091	r.logif = $3.logif;
1092	if ($3.quick) {
1093	yyerror("scrub rules do not support 'quick'");
1094	YYERROR;
1095	}
1096
1097	r.af = $5;
1098	if ($8.nodf)
1099	r.rule_flag \|= PFRULE_NODF;
1100	if ($8.randomid)
1101	r.rule_flag \|= PFRULE_RANDOMID;
1102	if ($8.reassemble_tcp) {
1103	if (r.direction != PF_INOUT) {
1104	yyerror("reassemble tcp rules can not "
1105	"specify direction");
1106	YYERROR;
1107	}
1108	r.rule_flag \|= PFRULE_REASSEMBLE_TCP;
1109	}
1110	if ($8.minttl)
1111	r.min_ttl = $8.minttl;
1112	if ($8.maxmss)
1113	r.max_mss = $8.maxmss;
1114	if ($8.marker & SOM_SETTOS) {
1115	r.rule_flag \|= PFRULE_SET_TOS;
1116	r.set_tos = $8.settos;
1117	}
1118	if ($8.fragcache)
1119	r.rule_flag \|= $8.fragcache;
1120	if ($8.match_tag)
1121	if (strlcpy(r.match_tagname, $8.match_tag,
1122	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1123	yyerror("tag too long, max %u chars",
1124	PF_TAG_NAME_SIZE - 1);
1125	YYERROR;
1126	}
1127	r.match_tag_not = $8.match_tag_not;
1128	r.rtableid = $8.rtableid;
1129
1130	expand_rule(&r, $4, NULL, $6, $7.src_os,
1131	$7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
1132	NULL, NULL, NULL, "");
1133	}
1134	;
1135
1136	scrub_opts : {
1137	bzero(&scrub_opts, sizeof scrub_opts);
1138	scrub_opts.rtableid = -1;
1139	}
1140	scrub_opts_l
1141	{ $$ = scrub_opts; }
1142	\| /* empty */ {
1143	bzero(&scrub_opts, sizeof scrub_opts);
1144	scrub_opts.rtableid = -1;
1145	$$ = scrub_opts;
1146	}
1147	;
1148
1149	scrub_opts_l : scrub_opts_l scrub_opt
1150	\| scrub_opt
1151	;
1152
1153	scrub_opt : NODF {
1154	if (scrub_opts.nodf) {
1155	yyerror("no-df cannot be respecified");
1156	YYERROR;
1157	}
1158	scrub_opts.nodf = 1;
1159	}
1160	\| MINTTL NUMBER {
1161	if (scrub_opts.marker & SOM_MINTTL) {
1162	yyerror("min-ttl cannot be respecified");
1163	YYERROR;
1164	}
1165	if ($2 < 0 \|\| $2 > 255) {
1166	yyerror("illegal min-ttl value %d", $2);
1167	YYERROR;
1168	}
1169	scrub_opts.marker \|= SOM_MINTTL;
1170	scrub_opts.minttl = $2;
1171	}
1172	\| MAXMSS NUMBER {
1173	if (scrub_opts.marker & SOM_MAXMSS) {
1174	yyerror("max-mss cannot be respecified");
1175	YYERROR;
1176	}
1177	if ($2 < 0 \|\| $2 > 65535) {
1178	yyerror("illegal max-mss value %d", $2);
1179	YYERROR;
1180	}
1181	scrub_opts.marker \|= SOM_MAXMSS;
1182	scrub_opts.maxmss = $2;
1183	}
1184	\| SETTOS tos {
1185	if (scrub_opts.marker & SOM_SETTOS) {
1186	yyerror("set-tos cannot be respecified");
1187	YYERROR;
1188	}
1189	scrub_opts.marker \|= SOM_SETTOS;
1190	scrub_opts.settos = $2;
1191	}
1192	\| fragcache {
1193	if (scrub_opts.marker & SOM_FRAGCACHE) {
1194	yyerror("fragcache cannot be respecified");
1195	YYERROR;
1196	}
1197	scrub_opts.marker \|= SOM_FRAGCACHE;
1198	scrub_opts.fragcache = $1;
1199	}
1200	\| REASSEMBLE STRING {
1201	if (strcasecmp($2, "tcp") != 0) {
1202	yyerror("scrub reassemble supports only tcp, "
1203	"not '%s'", $2);
1204	free($2);
1205	YYERROR;
1206	}
1207	free($2);
1208	if (scrub_opts.reassemble_tcp) {
1209	yyerror("reassemble tcp cannot be respecified");
1210	YYERROR;
1211	}
1212	scrub_opts.reassemble_tcp = 1;
1213	}
1214	\| RANDOMID {
1215	if (scrub_opts.randomid) {
1216	yyerror("random-id cannot be respecified");
1217	YYERROR;
1218	}
1219	scrub_opts.randomid = 1;
1220	}
1221	\| RTABLE NUMBER {
1222	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
1223	yyerror("invalid rtable id");
1224	YYERROR;
1225	}
1226	scrub_opts.rtableid = $2;
1227	}
1228	\| not TAGGED string {
1229	scrub_opts.match_tag = $3;
1230	scrub_opts.match_tag_not = $1;
1231	}
1232	;
1233
1234	fragcache : FRAGMENT REASSEMBLE { $$ = 0; /* default */ }
1235	\| FRAGMENT FRAGCROP { $$ = 0; }
1236	\| FRAGMENT FRAGDROP { $$ = 0; }
1237	;
1238
1239	antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
1240	struct pf_rule r;
1241	struct node_host h = NULL, hh;
1242	struct node_if i, j;
1243
1244	if (check_rulestate(PFCTL_STATE_FILTER))
1245	YYERROR;
1246
1247	for (i = $3; i; i = i->next) {
1248	bzero(&r, sizeof(r));
1249
1250	r.action = PF_DROP;
1251	r.direction = PF_IN;
1252	r.log = $2.log;
1253	r.logif = $2.logif;
1254	r.quick = $2.quick;
1255	r.af = $4;
1256	if (rule_label(&r, $5.label))
1257	YYERROR;
1258	r.rtableid = $5.rtableid;
1259	j = calloc(1, sizeof(struct node_if));
1260	if (j == NULL)
1261	err(1, "antispoof: calloc");
1262	if (strlcpy(j->ifname, i->ifname,
1263	sizeof(j->ifname)) >= sizeof(j->ifname)) {
1264	free(j);
1265	yyerror("interface name too long");
1266	YYERROR;
1267	}
1268	j->not = 1;
1269	if (i->dynamic) {
1270	h = calloc(1, sizeof(*h));
1271	if (h == NULL)
1272	err(1, "address: calloc");
1273	h->addr.type = PF_ADDR_DYNIFTL;
1274	set_ipmask(h, 128);
1275	if (strlcpy(h->addr.v.ifname, i->ifname,
1276	sizeof(h->addr.v.ifname)) >=
1277	sizeof(h->addr.v.ifname)) {
1278	free(h);
1279	yyerror(
1280	"interface name too long");
1281	YYERROR;
1282	}
1283	hh = malloc(sizeof(*hh));
1284	if (hh == NULL)
1285	err(1, "address: malloc");
1286	bcopy(h, hh, sizeof(*hh));
1287	h->addr.iflags = PFI_AFLAG_NETWORK;
1288	} else {
1289	h = ifa_lookup(j->ifname,
1290	PFI_AFLAG_NETWORK);
1291	hh = NULL;
1292	}
1293
1294	if (h != NULL)
1295	expand_rule(&r, j, NULL, NULL, NULL, h,
1296	NULL, NULL, NULL, NULL, NULL,
1297	NULL, "");
1298
1299	if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
1300	bzero(&r, sizeof(r));
1301
1302	r.action = PF_DROP;
1303	r.direction = PF_IN;
1304	r.log = $2.log;
1305	r.logif = $2.logif;
1306	r.quick = $2.quick;
1307	r.af = $4;
1308	if (rule_label(&r, $5.label))
1309	YYERROR;
1310	r.rtableid = $5.rtableid;
1311	if (hh != NULL)
1312	h = hh;
1313	else
1314	h = ifa_lookup(i->ifname, 0);
1315	if (h != NULL)
1316	expand_rule(&r, NULL, NULL,
1317	NULL, NULL, h, NULL, NULL,
1318	NULL, NULL, NULL, NULL, "");
1319	} else
1320	free(hh);
1321	}
1322	free($5.label);
1323	}
1324	;
1325
1326	antispoof_ifspc : FOR antispoof_if { $$ = $2; }
1327	\| FOR '{' optnl antispoof_iflst '}' { $$ = $4; }
1328	;
1329
1330	antispoof_iflst : antispoof_if optnl { $$ = $1; }
1331	\| antispoof_iflst comma antispoof_if optnl {
1332	$1->tail->next = $3;
1333	$1->tail = $3;
1334	$$ = $1;
1335	}
1336	;
1337
1338	antispoof_if : if_item { $$ = $1; }
1339	\| '(' if_item ')' {
1340	$2->dynamic = 1;
1341	$$ = $2;
1342	}
1343	;
1344
1345	antispoof_opts : {
1346	bzero(&antispoof_opts, sizeof antispoof_opts);
1347	antispoof_opts.rtableid = -1;
1348	}
1349	antispoof_opts_l
1350	{ $$ = antispoof_opts; }
1351	\| /* empty */ {
1352	bzero(&antispoof_opts, sizeof antispoof_opts);
1353	antispoof_opts.rtableid = -1;
1354	$$ = antispoof_opts;
1355	}
1356	;
1357
1358	antispoof_opts_l : antispoof_opts_l antispoof_opt
1359	\| antispoof_opt
1360	;
1361
1362	antispoof_opt : label {
1363	if (antispoof_opts.label) {
1364	yyerror("label cannot be redefined");
1365	YYERROR;
1366	}
1367	antispoof_opts.label = $1;
1368	}
1369	\| RTABLE NUMBER {
1370	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
1371	yyerror("invalid rtable id");
1372	YYERROR;
1373	}
1374	antispoof_opts.rtableid = $2;
1375	}
1376	;
1377
1378	not : '!' { $$ = 1; }
1379	\| /* empty */ { $$ = 0; }
1380	;
1381
1382	tabledef : TABLE '<' STRING '>' table_opts {
1383	struct node_host h, nh;
1384	struct node_tinit ti, nti;
1385
1386	if (strlen($3) >= PF_TABLE_NAME_SIZE) {
1387	yyerror("table name too long, max %d chars",
1388	PF_TABLE_NAME_SIZE - 1);
1389	free($3);
1390	YYERROR;
1391	}
1392	if (pf->loadopt & PFCTL_FLAG_TABLE)
1393	if (process_tabledef($3, &$5)) {
1394	free($3);
1395	YYERROR;
1396	}
1397	free($3);
1398	for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
1399	ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
1400	if (ti->file)
1401	free(ti->file);
1402	for (h = ti->host; h != NULL; h = nh) {
1403	nh = h->next;
1404	free(h);
1405	}
1406	nti = SIMPLEQ_NEXT(ti, entries);
1407	free(ti);
1408	}
1409	}
1410	;
1411
1412	table_opts : {
1413	bzero(&table_opts, sizeof table_opts);
1414	SIMPLEQ_INIT(&table_opts.init_nodes);
1415	}
1416	table_opts_l
1417	{ $$ = table_opts; }
1418	\| /* empty */
1419	{
1420	bzero(&table_opts, sizeof table_opts);
1421	SIMPLEQ_INIT(&table_opts.init_nodes);
1422	$$ = table_opts;
1423	}
1424	;
1425
1426	table_opts_l : table_opts_l table_opt
1427	\| table_opt
1428	;
1429
1430	table_opt : STRING {
1431	if (!strcmp($1, "const"))
1432	table_opts.flags \|= PFR_TFLAG_CONST;
1433	else if (!strcmp($1, "persist"))
1434	table_opts.flags \|= PFR_TFLAG_PERSIST;
1435	else if (!strcmp($1, "counters"))
1436	table_opts.flags \|= PFR_TFLAG_COUNTERS;
1437	else {
1438	yyerror("invalid table option '%s'", $1);
1439	free($1);
1440	YYERROR;
1441	}
1442	free($1);
1443	}
1444	\| '{' optnl '}' { table_opts.init_addr = 1; }
1445	\| '{' optnl host_list '}' {
1446	struct node_host *n;
1447	struct node_tinit *ti;
1448
1449	for (n = $3; n != NULL; n = n->next) {
1450	switch (n->addr.type) {
1451	case PF_ADDR_ADDRMASK:
1452	continue; /* ok */
1453	case PF_ADDR_RANGE:
1454	yyerror("address ranges are not "
1455	"permitted inside tables");
1456	break;
1457	case PF_ADDR_DYNIFTL:
1458	yyerror("dynamic addresses are not "
1459	"permitted inside tables");
1460	break;
1461	case PF_ADDR_TABLE:
1462	yyerror("tables cannot contain tables");
1463	break;
1464	case PF_ADDR_NOROUTE:
1465	yyerror("\"no-route\" is not permitted "
1466	"inside tables");
1467	break;
1468	case PF_ADDR_URPFFAILED:
1469	yyerror("\"urpf-failed\" is not "
1470	"permitted inside tables");
1471	break;
1472	default:
1473	yyerror("unknown address type %d",
1474	n->addr.type);
1475	}
1476	YYERROR;
1477	}
1478	if (!(ti = calloc(1, sizeof(*ti))))
1479	err(1, "table_opt: calloc");
1480	ti->host = $3;
1481	SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1482	entries);
1483	table_opts.init_addr = 1;
1484	}
1485	\| FILENAME STRING {
1486	struct node_tinit *ti;
1487
1488	if (!(ti = calloc(1, sizeof(*ti))))
1489	err(1, "table_opt: calloc");
1490	ti->file = $2;
1491	SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1492	entries);
1493	table_opts.init_addr = 1;
1494	}
1495	;
1496
1497	altqif : ALTQ interface queue_opts QUEUE qassign {
1498	struct pf_altq a;
1499
1500	if (check_rulestate(PFCTL_STATE_QUEUE))
1501	YYERROR;
1502
1503	memset(&a, 0, sizeof(a));
1504	if ($3.scheduler.qtype == ALTQT_NONE) {
1505	yyerror("no scheduler specified!");
1506	YYERROR;
1507	}
1508	a.scheduler = $3.scheduler.qtype;
1509	a.qlimit = $3.qlimit;
1510	a.tbrsize = $3.tbrsize;
1511	if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) {
1512	yyerror("no child queues specified");
1513	YYERROR;
1514	}
1515	if (expand_altq(&a, $2, $5, $3.queue_bwspec,
1516	&$3.scheduler))
1517	YYERROR;
1518	}
1519	;
1520
1521	queuespec : QUEUE STRING interface queue_opts qassign {
1522	struct pf_altq a;
1523
1524	if (check_rulestate(PFCTL_STATE_QUEUE)) {
1525	free($2);
1526	YYERROR;
1527	}
1528
1529	memset(&a, 0, sizeof(a));
1530
1531	if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
1532	sizeof(a.qname)) {
1533	yyerror("queue name too long (max "
1534	"%d chars)", PF_QNAME_SIZE-1);
1535	free($2);
1536	YYERROR;
1537	}
1538	free($2);
1539	if ($4.tbrsize) {
1540	yyerror("cannot specify tbrsize for queue");
1541	YYERROR;
1542	}
1543	if ($4.priority > 255) {
1544	yyerror("priority out of range: max 255");
1545	YYERROR;
1546	}
1547	a.priority = $4.priority;
1548	a.qlimit = $4.qlimit;
1549	a.scheduler = $4.scheduler.qtype;
1550	if (expand_queue(&a, $3, $5, $4.queue_bwspec,
1551	&$4.scheduler)) {
1552	yyerror("errors in queue definition");
1553	YYERROR;
1554	}
1555	}
1556	;
1557
1558	queue_opts : {
1559	bzero(&queue_opts, sizeof queue_opts);
1560	queue_opts.priority = DEFAULT_PRIORITY;
1561	queue_opts.qlimit = DEFAULT_QLIMIT;
1562	queue_opts.scheduler.qtype = ALTQT_NONE;
1563	queue_opts.queue_bwspec.bw_percent = 100;
1564	}
1565	queue_opts_l
1566	{ $$ = queue_opts; }
1567	\| /* empty */ {
1568	bzero(&queue_opts, sizeof queue_opts);
1569	queue_opts.priority = DEFAULT_PRIORITY;
1570	queue_opts.qlimit = DEFAULT_QLIMIT;
1571	queue_opts.scheduler.qtype = ALTQT_NONE;
1572	queue_opts.queue_bwspec.bw_percent = 100;
1573	$$ = queue_opts;
1574	}
1575	;
1576
1577	queue_opts_l : queue_opts_l queue_opt
1578	\| queue_opt
1579	;
1580
1581	queue_opt : BANDWIDTH bandwidth {
1582	if (queue_opts.marker & QOM_BWSPEC) {
1583	yyerror("bandwidth cannot be respecified");
1584	YYERROR;
1585	}
1586	queue_opts.marker \|= QOM_BWSPEC;
1587	queue_opts.queue_bwspec = $2;
1588	}
1589	\| PRIORITY NUMBER {
1590	if (queue_opts.marker & QOM_PRIORITY) {
1591	yyerror("priority cannot be respecified");
1592	YYERROR;
1593	}
1594	if ($2 < 0 \|\| $2 > 255) {
1595	yyerror("priority out of range: max 255");
1596	YYERROR;
1597	}
1598	queue_opts.marker \|= QOM_PRIORITY;
1599	queue_opts.priority = $2;
1600	}
1601	\| QLIMIT NUMBER {
1602	if (queue_opts.marker & QOM_QLIMIT) {
1603	yyerror("qlimit cannot be respecified");
1604	YYERROR;
1605	}
1606	if ($2 < 0 \|\| $2 > 65535) {
1607	yyerror("qlimit out of range: max 65535");
1608	YYERROR;
1609	}
1610	queue_opts.marker \|= QOM_QLIMIT;
1611	queue_opts.qlimit = $2;
1612	}
1613	\| scheduler {
1614	if (queue_opts.marker & QOM_SCHEDULER) {
1615	yyerror("scheduler cannot be respecified");
1616	YYERROR;
1617	}
1618	queue_opts.marker \|= QOM_SCHEDULER;
1619	queue_opts.scheduler = $1;
1620	}
1621	\| TBRSIZE NUMBER {
1622	if (queue_opts.marker & QOM_TBRSIZE) {
1623	yyerror("tbrsize cannot be respecified");
1624	YYERROR;
1625	}
1626	if ($2 < 0 \|\| $2 > 65535) {
1627	yyerror("tbrsize too big: max 65535");
1628	YYERROR;
1629	}
1630	queue_opts.marker \|= QOM_TBRSIZE;
1631	queue_opts.tbrsize = $2;
1632	}
1633	;
1634
1635	bandwidth : STRING {
1636	double bps;
1637	char *cp;
1638
1639	$$.bw_percent = 0;
1640
1641	bps = strtod($1, &cp);
1642	if (cp != NULL) {
1643	if (strlen(cp) > 1) {
1644	char *cu = cp + 1;
1645	if (!strcmp(cu, "Bit") \|\|
1646	!strcmp(cu, "B") \|\|
1647	!strcmp(cu, "bit") \|\|
1648	!strcmp(cu, "b")) {
1649	*cu = 0;
1650	}
1651	}
1652	if (!strcmp(cp, "b"))
1653	; /* nothing */
1654	else if (!strcmp(cp, "K"))
1655	bps *= 1000;
1656	else if (!strcmp(cp, "M"))
1657	bps = 1000 1000;
1658	else if (!strcmp(cp, "G"))
1659	bps = 1000 1000 * 1000;
1660	else if (!strcmp(cp, "%")) {
1661	if (bps < 0 \|\| bps > 100) {
1662	yyerror("bandwidth spec "
1663	"out of range");
1664	free($1);
1665	YYERROR;
1666	}
1667	$$.bw_percent = bps;
1668	bps = 0;
1669	} else {
1670	yyerror("unknown unit %s", cp);
1671	free($1);
1672	YYERROR;
1673	}
1674	}
1675	free($1);
1676	$$.bw_absolute = (u_int32_t)bps;
1677	}
1678	\| NUMBER {
1679	if ($1 < 0 \|\| $1 > UINT_MAX) {
1680	yyerror("bandwidth number too big");
1681	YYERROR;
1682	}
1683	$$.bw_percent = 0;
1684	$$.bw_absolute = $1;
1685	}
1686	;
1687
1688	scheduler : CBQ {
1689	$$.qtype = ALTQT_CBQ;
1690	$$.data.cbq_opts.flags = 0;
1691	}
1692	\| CBQ '(' cbqflags_list ')' {
1693	$$.qtype = ALTQT_CBQ;
1694	$$.data.cbq_opts.flags = $3;
1695	}
1696	\| PRIQ {
1697	$$.qtype = ALTQT_PRIQ;
1698	$$.data.priq_opts.flags = 0;
1699	}
1700	\| PRIQ '(' priqflags_list ')' {
1701	$$.qtype = ALTQT_PRIQ;
1702	$$.data.priq_opts.flags = $3;
1703	}
1704	\| HFSC {
1705	$$.qtype = ALTQT_HFSC;
1706	bzero(&$$.data.hfsc_opts,
1707	sizeof(struct node_hfsc_opts));
1708	}
1709	\| HFSC '(' hfsc_opts ')' {
1710	$$.qtype = ALTQT_HFSC;
1711	$$.data.hfsc_opts = $3;
1712	}
1713	\| FAIRQ {
1714	$$.qtype = ALTQT_FAIRQ;
1715	bzero(&$$.data.fairq_opts,
1716	sizeof(struct node_fairq_opts));
1717	}
1718	\| FAIRQ '(' fairq_opts ')' {
1719	$$.qtype = ALTQT_FAIRQ;
1720	$$.data.fairq_opts = $3;
1721	}
1722	\| CODEL {
1723	$$.qtype = ALTQT_CODEL;
1724	bzero(&$$.data.codel_opts,
1725	sizeof(struct codel_opts));
1726	}
1727	\| CODEL '(' codel_opts ')' {
1728	$$.qtype = ALTQT_CODEL;
1729	$$.data.codel_opts = $3;
1730	}
1731	;
1732
1733	cbqflags_list : cbqflags_item { $$ \|= $1; }
1734	\| cbqflags_list comma cbqflags_item { $$ \|= $3; }
1735	;
1736
1737	cbqflags_item : STRING {
1738	if (!strcmp($1, "default"))
1739	$$ = CBQCLF_DEFCLASS;
1740	else if (!strcmp($1, "borrow"))
1741	$$ = CBQCLF_BORROW;
1742	else if (!strcmp($1, "red"))
1743	$$ = CBQCLF_RED;
1744	else if (!strcmp($1, "ecn"))
1745	$$ = CBQCLF_RED\|CBQCLF_ECN;
1746	else if (!strcmp($1, "rio"))
1747	$$ = CBQCLF_RIO;
1748	else if (!strcmp($1, "codel"))
1749	$$ = CBQCLF_CODEL;
1750	else {
1751	yyerror("unknown cbq flag \"%s\"", $1);
1752	free($1);
1753	YYERROR;
1754	}
1755	free($1);
1756	}
1757	;
1758
1759	priqflags_list : priqflags_item { $$ \|= $1; }
1760	\| priqflags_list comma priqflags_item { $$ \|= $3; }
1761	;
1762
1763	priqflags_item : STRING {
1764	if (!strcmp($1, "default"))
1765	$$ = PRCF_DEFAULTCLASS;
1766	else if (!strcmp($1, "red"))
1767	$$ = PRCF_RED;
1768	else if (!strcmp($1, "ecn"))
1769	$$ = PRCF_RED\|PRCF_ECN;
1770	else if (!strcmp($1, "rio"))
1771	$$ = PRCF_RIO;
1772	else if (!strcmp($1, "codel"))
1773	$$ = PRCF_CODEL;
1774	else {
1775	yyerror("unknown priq flag \"%s\"", $1);
1776	free($1);
1777	YYERROR;
1778	}
1779	free($1);
1780	}
1781	;
1782
1783	hfsc_opts : {
1784	bzero(&hfsc_opts,
1785	sizeof(struct node_hfsc_opts));
1786	}
1787	hfscopts_list {
1788	$$ = hfsc_opts;
1789	}
1790	;
1791
1792	hfscopts_list : hfscopts_item
1793	\| hfscopts_list comma hfscopts_item
1794	;
1795
1796	hfscopts_item : LINKSHARE bandwidth {
1797	if (hfsc_opts.linkshare.used) {
1798	yyerror("linkshare already specified");
1799	YYERROR;
1800	}
1801	hfsc_opts.linkshare.m2 = $2;
1802	hfsc_opts.linkshare.used = 1;
1803	}
1804	\| LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')'
1805	{
1806	if ($5 < 0 \|\| $5 > INT_MAX) {
1807	yyerror("timing in curve out of range");
1808	YYERROR;
1809	}
1810	if (hfsc_opts.linkshare.used) {
1811	yyerror("linkshare already specified");
1812	YYERROR;
1813	}
1814	hfsc_opts.linkshare.m1 = $3;
1815	hfsc_opts.linkshare.d = $5;
1816	hfsc_opts.linkshare.m2 = $7;
1817	hfsc_opts.linkshare.used = 1;
1818	}
1819	\| REALTIME bandwidth {
1820	if (hfsc_opts.realtime.used) {
1821	yyerror("realtime already specified");
1822	YYERROR;
1823	}
1824	hfsc_opts.realtime.m2 = $2;
1825	hfsc_opts.realtime.used = 1;
1826	}
1827	\| REALTIME '(' bandwidth comma NUMBER comma bandwidth ')'
1828	{
1829	if ($5 < 0 \|\| $5 > INT_MAX) {
1830	yyerror("timing in curve out of range");
1831	YYERROR;
1832	}
1833	if (hfsc_opts.realtime.used) {
1834	yyerror("realtime already specified");
1835	YYERROR;
1836	}
1837	hfsc_opts.realtime.m1 = $3;
1838	hfsc_opts.realtime.d = $5;
1839	hfsc_opts.realtime.m2 = $7;
1840	hfsc_opts.realtime.used = 1;
1841	}
1842	\| UPPERLIMIT bandwidth {
1843	if (hfsc_opts.upperlimit.used) {
1844	yyerror("upperlimit already specified");
1845	YYERROR;
1846	}
1847	hfsc_opts.upperlimit.m2 = $2;
1848	hfsc_opts.upperlimit.used = 1;
1849	}
1850	\| UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')'
1851	{
1852	if ($5 < 0 \|\| $5 > INT_MAX) {
1853	yyerror("timing in curve out of range");
1854	YYERROR;
1855	}
1856	if (hfsc_opts.upperlimit.used) {
1857	yyerror("upperlimit already specified");
1858	YYERROR;
1859	}
1860	hfsc_opts.upperlimit.m1 = $3;
1861	hfsc_opts.upperlimit.d = $5;
1862	hfsc_opts.upperlimit.m2 = $7;
1863	hfsc_opts.upperlimit.used = 1;
1864	}
1865	\| STRING {
1866	if (!strcmp($1, "default"))
1867	hfsc_opts.flags \|= HFCF_DEFAULTCLASS;
1868	else if (!strcmp($1, "red"))
1869	hfsc_opts.flags \|= HFCF_RED;
1870	else if (!strcmp($1, "ecn"))
1871	hfsc_opts.flags \|= HFCF_RED\|HFCF_ECN;
1872	else if (!strcmp($1, "rio"))
1873	hfsc_opts.flags \|= HFCF_RIO;
1874	else if (!strcmp($1, "codel"))
1875	hfsc_opts.flags \|= HFCF_CODEL;
1876	else {
1877	yyerror("unknown hfsc flag \"%s\"", $1);
1878	free($1);
1879	YYERROR;
1880	}
1881	free($1);
1882	}
1883	;
1884
1885	fairq_opts : {
1886	bzero(&fairq_opts,
1887	sizeof(struct node_fairq_opts));
1888	}
1889	fairqopts_list {
1890	$$ = fairq_opts;
1891	}
1892	;
1893
1894	fairqopts_list : fairqopts_item
1895	\| fairqopts_list comma fairqopts_item
1896	;
1897
1898	fairqopts_item : LINKSHARE bandwidth {
1899	if (fairq_opts.linkshare.used) {
1900	yyerror("linkshare already specified");
1901	YYERROR;
1902	}
1903	fairq_opts.linkshare.m2 = $2;
1904	fairq_opts.linkshare.used = 1;
1905	}
1906	\| LINKSHARE '(' bandwidth number bandwidth ')' {
1907	if (fairq_opts.linkshare.used) {
1908	yyerror("linkshare already specified");
1909	YYERROR;
1910	}
1911	fairq_opts.linkshare.m1 = $3;
1912	fairq_opts.linkshare.d = $4;
1913	fairq_opts.linkshare.m2 = $5;
1914	fairq_opts.linkshare.used = 1;
1915	}
1916	\| HOGS bandwidth {
1917	fairq_opts.hogs_bw = $2;
1918	}
1919	\| BUCKETS number {
1920	fairq_opts.nbuckets = $2;
1921	}
1922	\| STRING {
1923	if (!strcmp($1, "default"))
1924	fairq_opts.flags \|= FARF_DEFAULTCLASS;
1925	else if (!strcmp($1, "red"))
1926	fairq_opts.flags \|= FARF_RED;
1927	else if (!strcmp($1, "ecn"))
1928	fairq_opts.flags \|= FARF_RED\|FARF_ECN;
1929	else if (!strcmp($1, "rio"))
1930	fairq_opts.flags \|= FARF_RIO;
1931	else if (!strcmp($1, "codel"))
1932	fairq_opts.flags \|= FARF_CODEL;
1933	else {
1934	yyerror("unknown fairq flag \"%s\"", $1);
1935	free($1);
1936	YYERROR;
1937	}
1938	free($1);
1939	}
1940	;
1941
1942	codel_opts : {
1943	bzero(&codel_opts,
1944	sizeof(struct codel_opts));
1945	}
1946	codelopts_list {
1947	$$ = codel_opts;
1948	}
1949	;
1950
1951	codelopts_list : codelopts_item
1952	\| codelopts_list comma codelopts_item
1953	;
1954
1955	codelopts_item : INTERVAL number {
1956	if (codel_opts.interval) {
1957	yyerror("interval already specified");
1958	YYERROR;
1959	}
1960	codel_opts.interval = $2;
1961	}
1962	\| TARGET number {
1963	if (codel_opts.target) {
1964	yyerror("target already specified");
1965	YYERROR;
1966	}
1967	codel_opts.target = $2;
1968	}
1969	\| STRING {
1970	if (!strcmp($1, "ecn"))
1971	codel_opts.ecn = 1;
1972	else {
1973	yyerror("unknown codel option \"%s\"", $1);
1974	free($1);
1975	YYERROR;
1976	}
1977	free($1);
1978	}
1979	;
1980
1981	qassign : /* empty */ { $$ = NULL; }
1982	\| qassign_item { $$ = $1; }
1983	\| '{' optnl qassign_list '}' { $$ = $3; }
1984	;
1985
1986	qassign_list : qassign_item optnl { $$ = $1; }
1987	\| qassign_list comma qassign_item optnl {
1988	$1->tail->next = $3;
1989	$1->tail = $3;
1990	$$ = $1;
1991	}
1992	;
1993
1994	qassign_item : STRING {
1995	$$ = calloc(1, sizeof(struct node_queue));
1996	if ($$ == NULL)
1997	err(1, "qassign_item: calloc");
1998	if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
1999	sizeof($$->queue)) {
2000	yyerror("queue name '%s' too long (max "
2001	"%d chars)", $1, sizeof($$->queue)-1);
2002	free($1);
2003	free($$);
2004	YYERROR;
2005	}
2006	free($1);
2007	$$->next = NULL;
2008	$$->tail = $$;
2009	}
2010	;
2011
2012	pfrule : action dir logquick interface route af proto fromto
2013	filter_opts
2014	{
2015	struct pf_rule r;
2016	struct node_state_opt *o;
2017	struct node_proto *proto;
2018	int srctrack = 0;
2019	int statelock = 0;
2020	int adaptive = 0;
2021	int defaults = 0;
2022
2023	if (check_rulestate(PFCTL_STATE_FILTER))
2024	YYERROR;
2025
2026	memset(&r, 0, sizeof(r));
2027
2028	r.action = $1.b1;
2029	switch ($1.b2) {
2030	case PFRULE_RETURNRST:
2031	r.rule_flag \|= PFRULE_RETURNRST;
2032	r.return_ttl = $1.w;
2033	break;
2034	case PFRULE_RETURNICMP:
2035	r.rule_flag \|= PFRULE_RETURNICMP;
2036	r.return_icmp = $1.w;
2037	r.return_icmp6 = $1.w2;
2038	break;
2039	case PFRULE_RETURN:
2040	r.rule_flag \|= PFRULE_RETURN;
2041	r.return_icmp = $1.w;
2042	r.return_icmp6 = $1.w2;
2043	break;
2044	}
2045	r.direction = $2;
2046	r.log = $3.log;
2047	r.logif = $3.logif;
2048	r.quick = $3.quick;
2049	r.prob = $9.prob;
2050	r.rtableid = $9.rtableid;
2051
2052	if ($9.marker & FOM_PRIO) {
2053	if ($9.prio == 0)
2054	r.prio = PF_PRIO_ZERO;
2055	else
2056	r.prio = $9.prio;
2057	}
2058	if ($9.marker & FOM_SETPRIO) {
2059	r.set_prio[0] = $9.set_prio[0];
2060	r.set_prio[1] = $9.set_prio[1];
2061	r.scrub_flags \|= PFSTATE_SETPRIO;
2062	}
2063
2064	r.af = $6;
2065	if ($9.tag)
2066	if (strlcpy(r.tagname, $9.tag,
2067	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2068	yyerror("tag too long, max %u chars",
2069	PF_TAG_NAME_SIZE - 1);
2070	YYERROR;
2071	}
2072	if ($9.match_tag)
2073	if (strlcpy(r.match_tagname, $9.match_tag,
2074	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2075	yyerror("tag too long, max %u chars",
2076	PF_TAG_NAME_SIZE - 1);
2077	YYERROR;
2078	}
2079	r.match_tag_not = $9.match_tag_not;
2080	if (rule_label(&r, $9.label))
2081	YYERROR;
2082	free($9.label);
2083	r.flags = $9.flags.b1;
2084	r.flagset = $9.flags.b2;
2085	if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
2086	yyerror("flags always false");
2087	YYERROR;
2088	}
2089	if ($9.flags.b1 \|\| $9.flags.b2 \|\| $8.src_os) {
2090	for (proto = $7; proto != NULL &&
2091	proto->proto != IPPROTO_TCP;
2092	proto = proto->next)
2093	; /* nothing */
2094	if (proto == NULL && $7 != NULL) {
2095	if ($9.flags.b1 \|\| $9.flags.b2)
2096	yyerror(
2097	"flags only apply to tcp");
2098	if ($8.src_os)
2099	yyerror(
2100	"OS fingerprinting only "
2101	"apply to tcp");
2102	YYERROR;
2103	}
2104	#if 0
2105	if (($9.flags.b1 & parse_flags("S")) == 0 &&
2106	$8.src_os) {
2107	yyerror("OS fingerprinting requires "
2108	"the SYN TCP flag (flags S/SA)");
2109	YYERROR;
2110	}
2111	#endif
2112	}
2113
2114	r.tos = $9.tos;
2115	r.keep_state = $9.keep.action;
2116	o = $9.keep.options;
2117
2118	/* 'keep state' by default on pass rules. */
2119	if (!r.keep_state && !r.action &&
2120	!($9.marker & FOM_KEEP)) {
2121	r.keep_state = PF_STATE_NORMAL;
2122	o = keep_state_defaults;
2123	defaults = 1;
2124	}
2125
2126	while (o) {
2127	struct node_state_opt *p = o;
2128
2129	switch (o->type) {
2130	case PF_STATE_OPT_MAX:
2131	if (r.max_states) {
2132	yyerror("state option 'max' "
2133	"multiple definitions");
2134	YYERROR;
2135	}
2136	r.max_states = o->data.max_states;
2137	break;
2138	case PF_STATE_OPT_NOSYNC:
2139	if (r.rule_flag & PFRULE_NOSYNC) {
2140	yyerror("state option 'sync' "
2141	"multiple definitions");
2142	YYERROR;
2143	}
2144	r.rule_flag \|= PFRULE_NOSYNC;
2145	break;
2146	case PF_STATE_OPT_SRCTRACK:
2147	if (srctrack) {
2148	yyerror("state option "
2149	"'source-track' "
2150	"multiple definitions");
2151	YYERROR;
2152	}
2153	srctrack = o->data.src_track;
2154	r.rule_flag \|= PFRULE_SRCTRACK;
2155	break;
2156	case PF_STATE_OPT_MAX_SRC_STATES:
2157	if (r.max_src_states) {
2158	yyerror("state option "
2159	"'max-src-states' "
2160	"multiple definitions");
2161	YYERROR;
2162	}
2163	if (o->data.max_src_states == 0) {
2164	yyerror("'max-src-states' must "
2165	"be > 0");
2166	YYERROR;
2167	}
2168	r.max_src_states =
2169	o->data.max_src_states;
2170	r.rule_flag \|= PFRULE_SRCTRACK;
2171	break;
2172	case PF_STATE_OPT_OVERLOAD:
2173	if (r.overload_tblname[0]) {
2174	yyerror("multiple 'overload' "
2175	"table definitions");
2176	YYERROR;
2177	}
2178	if (strlcpy(r.overload_tblname,
2179	o->data.overload.tblname,
2180	PF_TABLE_NAME_SIZE) >=
2181	PF_TABLE_NAME_SIZE) {
2182	yyerror("state option: "
2183	"strlcpy");
2184	YYERROR;
2185	}
2186	r.flush = o->data.overload.flush;
2187	break;
2188	case PF_STATE_OPT_MAX_SRC_CONN:
2189	if (r.max_src_conn) {
2190	yyerror("state option "
2191	"'max-src-conn' "
2192	"multiple definitions");
2193	YYERROR;
2194	}
2195	if (o->data.max_src_conn == 0) {
2196	yyerror("'max-src-conn' "
2197	"must be > 0");
2198	YYERROR;
2199	}
2200	r.max_src_conn =
2201	o->data.max_src_conn;
2202	r.rule_flag \|= PFRULE_SRCTRACK \|
2203	PFRULE_RULESRCTRACK;
2204	break;
2205	case PF_STATE_OPT_MAX_SRC_CONN_RATE:
2206	if (r.max_src_conn_rate.limit) {
2207	yyerror("state option "
2208	"'max-src-conn-rate' "
2209	"multiple definitions");
2210	YYERROR;
2211	}
2212	if (!o->data.max_src_conn_rate.limit \|\|
2213	!o->data.max_src_conn_rate.seconds) {
2214	yyerror("'max-src-conn-rate' "
2215	"values must be > 0");
2216	YYERROR;
2217	}
2218	if (o->data.max_src_conn_rate.limit >
2219	PF_THRESHOLD_MAX) {
2220	yyerror("'max-src-conn-rate' "
2221	"maximum rate must be < %u",
2222	PF_THRESHOLD_MAX);
2223	YYERROR;
2224	}
2225	r.max_src_conn_rate.limit =
2226	o->data.max_src_conn_rate.limit;
2227	r.max_src_conn_rate.seconds =
2228	o->data.max_src_conn_rate.seconds;
2229	r.rule_flag \|= PFRULE_SRCTRACK \|
2230	PFRULE_RULESRCTRACK;
2231	break;
2232	case PF_STATE_OPT_MAX_SRC_NODES:
2233	if (r.max_src_nodes) {
2234	yyerror("state option "
2235	"'max-src-nodes' "
2236	"multiple definitions");
2237	YYERROR;
2238	}
2239	if (o->data.max_src_nodes == 0) {
2240	yyerror("'max-src-nodes' must "
2241	"be > 0");
2242	YYERROR;
2243	}
2244	r.max_src_nodes =
2245	o->data.max_src_nodes;
2246	r.rule_flag \|= PFRULE_SRCTRACK \|
2247	PFRULE_RULESRCTRACK;
2248	break;
2249	case PF_STATE_OPT_STATELOCK:
2250	if (statelock) {
2251	yyerror("state locking option: "
2252	"multiple definitions");
2253	YYERROR;
2254	}
2255	statelock = 1;
2256	r.rule_flag \|= o->data.statelock;
2257	break;
2258	case PF_STATE_OPT_SLOPPY:
2259	if (r.rule_flag & PFRULE_STATESLOPPY) {
2260	yyerror("state sloppy option: "
2261	"multiple definitions");
2262	YYERROR;
2263	}
2264	r.rule_flag \|= PFRULE_STATESLOPPY;
2265	break;
2266	case PF_STATE_OPT_TIMEOUT:
2267	if (o->data.timeout.number ==
2268	PFTM_ADAPTIVE_START \|\|
2269	o->data.timeout.number ==
2270	PFTM_ADAPTIVE_END)
2271	adaptive = 1;
2272	if (r.timeout[o->data.timeout.number]) {
2273	yyerror("state timeout %s "
2274	"multiple definitions",
2275	pf_timeouts[o->data.
2276	timeout.number].name);
2277	YYERROR;
2278	}
2279	r.timeout[o->data.timeout.number] =
2280	o->data.timeout.seconds;
2281	}
2282	o = o->next;
2283	if (!defaults)
2284	free(p);
2285	}
2286
2287	/* 'flags S/SA' by default on stateful rules */
2288	if (!r.action && !r.flags && !r.flagset &&
2289	!$9.fragment && !($9.marker & FOM_FLAGS) &&
2290	r.keep_state) {
2291	r.flags = parse_flags("S");
2292	r.flagset = parse_flags("SA");
2293	}
2294	if (!adaptive && r.max_states) {
2295	r.timeout[PFTM_ADAPTIVE_START] =
2296	(r.max_states / 10) * 6;
2297	r.timeout[PFTM_ADAPTIVE_END] =
2298	(r.max_states / 10) * 12;
2299	}
2300	if (r.rule_flag & PFRULE_SRCTRACK) {
2301	if (srctrack == PF_SRCTRACK_GLOBAL &&
2302	r.max_src_nodes) {
2303	yyerror("'max-src-nodes' is "
2304	"incompatible with "
2305	"'source-track global'");
2306	YYERROR;
2307	}
2308	if (srctrack == PF_SRCTRACK_GLOBAL &&
2309	r.max_src_conn) {
2310	yyerror("'max-src-conn' is "
2311	"incompatible with "
2312	"'source-track global'");
2313	YYERROR;
2314	}
2315	if (srctrack == PF_SRCTRACK_GLOBAL &&
2316	r.max_src_conn_rate.seconds) {
2317	yyerror("'max-src-conn-rate' is "
2318	"incompatible with "
2319	"'source-track global'");
2320	YYERROR;
2321	}
2322	if (r.timeout[PFTM_SRC_NODE] <
2323	r.max_src_conn_rate.seconds)
2324	r.timeout[PFTM_SRC_NODE] =
2325	r.max_src_conn_rate.seconds;
2326	r.rule_flag \|= PFRULE_SRCTRACK;
2327	if (srctrack == PF_SRCTRACK_RULE)
2328	r.rule_flag \|= PFRULE_RULESRCTRACK;
2329	}
2330	if (r.keep_state && !statelock)
2331	r.rule_flag \|= default_statelock;
2332
2333	if ($9.fragment)
2334	r.rule_flag \|= PFRULE_FRAGMENT;
2335	r.allow_opts = $9.allowopts;
2336
2337	decide_address_family($8.src.host, &r.af);
2338	decide_address_family($8.dst.host, &r.af);
2339
2340	if ($5.rt) {
2341	if (!r.direction) {
2342	yyerror("direction must be explicit "
2343	"with rules that specify routing");
2344	YYERROR;
2345	}
2346	r.rt = $5.rt;
2347	r.rpool.opts = $5.pool_opts;
2348	if ($5.key != NULL)
2349	memcpy(&r.rpool.key, $5.key,
2350	sizeof(struct pf_poolhashkey));
2351	}
2352	if (r.rt) {
2353	decide_address_family($5.host, &r.af);
2354	remove_invalid_hosts(&$5.host, &r.af);
2355	if ($5.host == NULL) {
2356	yyerror("no routing address with "
2357	"matching address family found.");
2358	YYERROR;
2359	}
2360	if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
2361	PF_POOL_NONE && ($5.host->next != NULL \|\|
2362	$5.host->addr.type == PF_ADDR_TABLE \|\|
2363	DYNIF_MULTIADDR($5.host->addr)))
2364	r.rpool.opts \|= PF_POOL_ROUNDROBIN;
2365	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2366	PF_POOL_ROUNDROBIN &&
2367	disallow_table($5.host, "tables are only "
2368	"supported in round-robin routing pools"))
2369	YYERROR;
2370	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2371	PF_POOL_ROUNDROBIN &&
2372	disallow_alias($5.host, "interface (%s) "
2373	"is only supported in round-robin "
2374	"routing pools"))
2375	YYERROR;
2376	if ($5.host->next != NULL) {
2377	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2378	PF_POOL_ROUNDROBIN) {
2379	yyerror("r.rpool.opts must "
2380	"be PF_POOL_ROUNDROBIN");
2381	YYERROR;
2382	}
2383	}
2384	}
2385	if ($9.queues.qname != NULL) {
2386	if (strlcpy(r.qname, $9.queues.qname,
2387	sizeof(r.qname)) >= sizeof(r.qname)) {
2388	yyerror("rule qname too long (max "
2389	"%d chars)", sizeof(r.qname)-1);
2390	YYERROR;
2391	}
2392	free($9.queues.qname);
2393	}
2394	if ($9.queues.pqname != NULL) {
2395	if (strlcpy(r.pqname, $9.queues.pqname,
2396	sizeof(r.pqname)) >= sizeof(r.pqname)) {
2397	yyerror("rule pqname too long (max "
2398	"%d chars)", sizeof(r.pqname)-1);
2399	YYERROR;
2400	}
2401	free($9.queues.pqname);
2402	}
2403	#ifdef __FreeBSD__
2404	r.divert.port = $9.divert.port;
2405	#else
2406	if ((r.divert.port = $9.divert.port)) {
2407	if (r.direction == PF_OUT) {
2408	if ($9.divert.addr) {
2409	yyerror("address specified "
2410	"for outgoing divert");
2411	YYERROR;
2412	}
2413	bzero(&r.divert.addr,
2414	sizeof(r.divert.addr));
2415	} else {
2416	if (!$9.divert.addr) {
2417	yyerror("no address specified "
2418	"for incoming divert");
2419	YYERROR;
2420	}
2421	if ($9.divert.addr->af != r.af) {
2422	yyerror("address family "
2423	"mismatch for divert");
2424	YYERROR;
2425	}
2426	r.divert.addr =
2427	$9.divert.addr->addr.v.a.addr;
2428	}
2429	}
2430	#endif
2431
2432	expand_rule(&r, $4, $5.host, $7, $8.src_os,
2433	$8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
2434	$9.uid, $9.gid, $9.icmpspec, "");
2435	}
2436	;
2437
2438	filter_opts : {
2439	bzero(&filter_opts, sizeof filter_opts);
2440	filter_opts.rtableid = -1;
2441	}
2442	filter_opts_l
2443	{ $$ = filter_opts; }
2444	\| /* empty */ {
2445	bzero(&filter_opts, sizeof filter_opts);
2446	filter_opts.rtableid = -1;
2447	$$ = filter_opts;
2448	}
2449	;
2450
2451	filter_opts_l : filter_opts_l filter_opt
2452	\| filter_opt
2453	;
2454
2455	filter_opt : USER uids {
2456	if (filter_opts.uid)
2457	$2->tail->next = filter_opts.uid;
2458	filter_opts.uid = $2;
2459	}
2460	\| GROUP gids {
2461	if (filter_opts.gid)
2462	$2->tail->next = filter_opts.gid;
2463	filter_opts.gid = $2;
2464	}
2465	\| flags {
2466	if (filter_opts.marker & FOM_FLAGS) {
2467	yyerror("flags cannot be redefined");
2468	YYERROR;
2469	}
2470	filter_opts.marker \|= FOM_FLAGS;
2471	filter_opts.flags.b1 \|= $1.b1;
2472	filter_opts.flags.b2 \|= $1.b2;
2473	filter_opts.flags.w \|= $1.w;
2474	filter_opts.flags.w2 \|= $1.w2;
2475	}
2476	\| icmpspec {
2477	if (filter_opts.marker & FOM_ICMP) {
2478	yyerror("icmp-type cannot be redefined");
2479	YYERROR;
2480	}
2481	filter_opts.marker \|= FOM_ICMP;
2482	filter_opts.icmpspec = $1;
2483	}
2484	\| PRIO NUMBER {
2485	if (filter_opts.marker & FOM_PRIO) {
2486	yyerror("prio cannot be redefined");
2487	YYERROR;
2488	}
2489	if ($2 < 0 \|\| $2 > PF_PRIO_MAX) {
2490	yyerror("prio must be 0 - %u", PF_PRIO_MAX);
2491	YYERROR;
2492	}
2493	filter_opts.marker \|= FOM_PRIO;
2494	filter_opts.prio = $2;
2495	}
2496	\| TOS tos {
2497	if (filter_opts.marker & FOM_TOS) {
2498	yyerror("tos cannot be redefined");
2499	YYERROR;
2500	}
2501	filter_opts.marker \|= FOM_TOS;
2502	filter_opts.tos = $2;
2503	}
2504	\| keep {
2505	if (filter_opts.marker & FOM_KEEP) {
2506	yyerror("modulate or keep cannot be redefined");
2507	YYERROR;
2508	}
2509	filter_opts.marker \|= FOM_KEEP;
2510	filter_opts.keep.action = $1.action;
2511	filter_opts.keep.options = $1.options;
2512	}
2513	\| FRAGMENT {
2514	filter_opts.fragment = 1;
2515	}
2516	\| ALLOWOPTS {
2517	filter_opts.allowopts = 1;
2518	}
2519	\| label {
2520	if (filter_opts.label) {
2521	yyerror("label cannot be redefined");
2522	YYERROR;
2523	}
2524	filter_opts.label = $1;
2525	}
2526	\| qname {
2527	if (filter_opts.queues.qname) {
2528	yyerror("queue cannot be redefined");
2529	YYERROR;
2530	}
2531	filter_opts.queues = $1;
2532	}
2533	\| TAG string {
2534	filter_opts.tag = $2;
2535	}
2536	\| not TAGGED string {
2537	filter_opts.match_tag = $3;
2538	filter_opts.match_tag_not = $1;
2539	}
2540	\| PROBABILITY probability {
2541	double p;
2542
2543	p = floor($2 * UINT_MAX + 0.5);
2544	if (p < 0.0 \|\| p > UINT_MAX) {
2545	yyerror("invalid probability: %lf", p);
2546	YYERROR;
2547	}
2548	filter_opts.prob = (u_int32_t)p;
2549	if (filter_opts.prob == 0)
2550	filter_opts.prob = 1;
2551	}
2552	\| RTABLE NUMBER {
2553	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
2554	yyerror("invalid rtable id");
2555	YYERROR;
2556	}
2557	filter_opts.rtableid = $2;
2558	}
2559	\| DIVERTTO portplain {
2560	#ifdef __FreeBSD__
2561	filter_opts.divert.port = $2.a;
2562	if (!filter_opts.divert.port) {
2563	yyerror("invalid divert port: %u", ntohs($2.a));
2564	YYERROR;
2565	}
2566	#endif
2567	}
2568	\| DIVERTTO STRING PORT portplain {
2569	#ifndef __FreeBSD__
2570	if ((filter_opts.divert.addr = host($2)) == NULL) {
2571	yyerror("could not parse divert address: %s",
2572	$2);
2573	free($2);
2574	YYERROR;
2575	}
2576	#else
2577	if ($2)
2578	#endif
2579	free($2);
2580	filter_opts.divert.port = $4.a;
2581	if (!filter_opts.divert.port) {
2582	yyerror("invalid divert port: %u", ntohs($4.a));
2583	YYERROR;
2584	}
2585	}
2586	\| DIVERTREPLY {
2587	#ifdef __FreeBSD__
2588	yyerror("divert-reply has no meaning in FreeBSD pf(4)");
2589	YYERROR;
2590	#else
2591	filter_opts.divert.port = 1; /* some random value */
2592	#endif
2593	}
2594	\| filter_sets
2595	;
2596
2597	filter_sets : SET '(' filter_sets_l ')' { $$ = filter_opts; }
2598	\| SET filter_set { $$ = filter_opts; }
2599	;
2600
2601	filter_sets_l : filter_sets_l comma filter_set
2602	\| filter_set
2603	;
2604
2605	filter_set : prio {
2606	if (filter_opts.marker & FOM_SETPRIO) {
2607	yyerror("prio cannot be redefined");
2608	YYERROR;
2609	}
2610	filter_opts.marker \|= FOM_SETPRIO;
2611	filter_opts.set_prio[0] = $1.b1;
2612	filter_opts.set_prio[1] = $1.b2;
2613	}
2614	prio : PRIO NUMBER {
2615	if ($2 < 0 \|\| $2 > PF_PRIO_MAX) {
2616	yyerror("prio must be 0 - %u", PF_PRIO_MAX);
2617	YYERROR;
2618	}
2619	$$.b1 = $$.b2 = $2;
2620	}
2621	\| PRIO '(' NUMBER comma NUMBER ')' {
2622	if ($3 < 0 \|\| $3 > PF_PRIO_MAX \|\|
2623	$5 < 0 \|\| $5 > PF_PRIO_MAX) {
2624	yyerror("prio must be 0 - %u", PF_PRIO_MAX);
2625	YYERROR;
2626	}
2627	$$.b1 = $3;
2628	$$.b2 = $5;
2629	}
2630	;
2631
2632	probability : STRING {
2633	char *e;
2634	double p = strtod($1, &e);
2635
2636	if (*e == '%') {
2637	p *= 0.01;
2638	e++;
2639	}
2640	if (*e) {
2641	yyerror("invalid probability: %s", $1);
2642	free($1);
2643	YYERROR;
2644	}
2645	free($1);
2646	$$ = p;
2647	}
2648	\| NUMBER {
2649	$$ = (double)$1;
2650	}
2651	;
2652
2653
2654	action : PASS { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
2655	\| BLOCK blockspec { $$ = $2; $$.b1 = PF_DROP; }
2656	;
2657
2658	blockspec : /* empty */ {
2659	$$.b2 = blockpolicy;
2660	$$.w = returnicmpdefault;
2661	$$.w2 = returnicmp6default;
2662	}
2663	\| DROP {
2664	$$.b2 = PFRULE_DROP;
2665	$$.w = 0;
2666	$$.w2 = 0;
2667	}
2668	\| RETURNRST {
2669	$$.b2 = PFRULE_RETURNRST;
2670	$$.w = 0;
2671	$$.w2 = 0;
2672	}
2673	\| RETURNRST '(' TTL NUMBER ')' {
2674	if ($4 < 0 \|\| $4 > 255) {
2675	yyerror("illegal ttl value %d", $4);
2676	YYERROR;
2677	}
2678	$$.b2 = PFRULE_RETURNRST;
2679	$$.w = $4;
2680	$$.w2 = 0;
2681	}
2682	\| RETURNICMP {
2683	$$.b2 = PFRULE_RETURNICMP;
2684	$$.w = returnicmpdefault;
2685	$$.w2 = returnicmp6default;
2686	}
2687	\| RETURNICMP6 {
2688	$$.b2 = PFRULE_RETURNICMP;
2689	$$.w = returnicmpdefault;
2690	$$.w2 = returnicmp6default;
2691	}
2692	\| RETURNICMP '(' reticmpspec ')' {
2693	$$.b2 = PFRULE_RETURNICMP;
2694	$$.w = $3;
2695	$$.w2 = returnicmpdefault;
2696	}
2697	\| RETURNICMP6 '(' reticmp6spec ')' {
2698	$$.b2 = PFRULE_RETURNICMP;
2699	$$.w = returnicmpdefault;
2700	$$.w2 = $3;
2701	}
2702	\| RETURNICMP '(' reticmpspec comma reticmp6spec ')' {
2703	$$.b2 = PFRULE_RETURNICMP;
2704	$$.w = $3;
2705	$$.w2 = $5;
2706	}
2707	\| RETURN {
2708	$$.b2 = PFRULE_RETURN;
2709	$$.w = returnicmpdefault;
2710	$$.w2 = returnicmp6default;
2711	}
2712	;
2713
2714	reticmpspec : STRING {
2715	if (!($$ = parseicmpspec($1, AF_INET))) {
2716	free($1);
2717	YYERROR;
2718	}
2719	free($1);
2720	}
2721	\| NUMBER {
2722	u_int8_t icmptype;
2723
2724	if ($1 < 0 \|\| $1 > 255) {
2725	yyerror("invalid icmp code %lu", $1);
2726	YYERROR;
2727	}
2728	icmptype = returnicmpdefault >> 8;
2729	$$ = (icmptype << 8 \| $1);
2730	}
2731	;
2732
2733	reticmp6spec : STRING {
2734	if (!($$ = parseicmpspec($1, AF_INET6))) {
2735	free($1);
2736	YYERROR;
2737	}
2738	free($1);
2739	}
2740	\| NUMBER {
2741	u_int8_t icmptype;
2742
2743	if ($1 < 0 \|\| $1 > 255) {
2744	yyerror("invalid icmp code %lu", $1);
2745	YYERROR;
2746	}
2747	icmptype = returnicmp6default >> 8;
2748	$$ = (icmptype << 8 \| $1);
2749	}
2750	;
2751
2752	dir : /* empty */ { $$ = PF_INOUT; }
2753	\| IN { $$ = PF_IN; }
2754	\| OUT { $$ = PF_OUT; }
2755	;
2756
2757	quick : /* empty */ { $$.quick = 0; }
2758	\| QUICK { $$.quick = 1; }
2759	;
2760
2761	logquick : /* empty */ { $$.log = 0; $$.quick = 0; $$.logif = 0; }
2762	\| log { $$ = $1; $$.quick = 0; }
2763	\| QUICK { $$.quick = 1; $$.log = 0; $$.logif = 0; }
2764	\| log QUICK { $$ = $1; $$.quick = 1; }
2765	\| QUICK log { $$ = $2; $$.quick = 1; }
2766	;
2767
2768	log : LOG { $$.log = PF_LOG; $$.logif = 0; }
2769	\| LOG '(' logopts ')' {
2770	$$.log = PF_LOG \| $3.log;
2771	$$.logif = $3.logif;
2772	}
2773	;
2774
2775	logopts : logopt { $$ = $1; }
2776	\| logopts comma logopt {
2777	$$.log = $1.log \| $3.log;
2778	$$.logif = $3.logif;
2779	if ($$.logif == 0)
2780	$$.logif = $1.logif;
2781	}
2782	;
2783
2784	logopt : ALL { $$.log = PF_LOG_ALL; $$.logif = 0; }
2785	\| USER { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2786	\| GROUP { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2787	\| TO string {
2788	const char *errstr;
2789	u_int i;
2790
2791	$$.log = 0;
2792	if (strncmp($2, "pflog", 5)) {
2793	yyerror("%s: should be a pflog interface", $2);
2794	free($2);
2795	YYERROR;
2796	}
2797	i = strtonum($2 + 5, 0, 255, &errstr);
2798	if (errstr) {
2799	yyerror("%s: %s", $2, errstr);
2800	free($2);
2801	YYERROR;
2802	}
2803	free($2);
2804	$$.logif = i;
2805	}
2806	;
2807
2808	interface : /* empty */ { $$ = NULL; }
2809	\| ON if_item_not { $$ = $2; }
2810	\| ON '{' optnl if_list '}' { $$ = $4; }
2811	;
2812
2813	if_list : if_item_not optnl { $$ = $1; }
2814	\| if_list comma if_item_not optnl {
2815	$1->tail->next = $3;
2816	$1->tail = $3;
2817	$$ = $1;
2818	}
2819	;
2820
2821	if_item_not : not if_item { $$ = $2; $$->not = $1; }
2822	;
2823
2824	if_item : STRING {
2825	struct node_host *n;
2826
2827	$$ = calloc(1, sizeof(struct node_if));
2828	if ($$ == NULL)
2829	err(1, "if_item: calloc");
2830	if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
2831	sizeof($$->ifname)) {
2832	free($1);
2833	free($$);
2834	yyerror("interface name too long");
2835	YYERROR;
2836	}
2837
2838	if ((n = ifa_exists($1)) != NULL)
2839	$$->ifa_flags = n->ifa_flags;
2840
2841	free($1);
2842	$$->not = 0;
2843	$$->next = NULL;
2844	$$->tail = $$;
2845	}
2846	;
2847
2848	af : /* empty */ { $$ = 0; }
2849	\| INET { $$ = AF_INET; }
2850	\| INET6 { $$ = AF_INET6; }
2851	;
2852
2853	proto : /* empty */ { $$ = NULL; }
2854	\| PROTO proto_item { $$ = $2; }
2855	\| PROTO '{' optnl proto_list '}' { $$ = $4; }
2856	;
2857
2858	proto_list : proto_item optnl { $$ = $1; }
2859	\| proto_list comma proto_item optnl {
2860	$1->tail->next = $3;
2861	$1->tail = $3;
2862	$$ = $1;
2863	}
2864	;
2865
2866	proto_item : protoval {
2867	u_int8_t pr;
2868
2869	pr = (u_int8_t)$1;
2870	if (pr == 0) {
2871	yyerror("proto 0 cannot be used");
2872	YYERROR;
2873	}
2874	$$ = calloc(1, sizeof(struct node_proto));
2875	if ($$ == NULL)
2876	err(1, "proto_item: calloc");
2877	$$->proto = pr;
2878	$$->next = NULL;
2879	$$->tail = $$;
2880	}
2881	;
2882
2883	protoval : STRING {
2884	struct protoent *p;
2885
2886	p = getprotobyname($1);
2887	if (p == NULL) {
2888	yyerror("unknown protocol %s", $1);
2889	free($1);
2890	YYERROR;
2891	}
2892	$$ = p->p_proto;
2893	free($1);
2894	}
2895	\| NUMBER {
2896	if ($1 < 0 \|\| $1 > 255) {
2897	yyerror("protocol outside range");
2898	YYERROR;
2899	}
2900	}
2901	;
2902
2903	fromto : ALL {
2904	$$.src.host = NULL;
2905	$$.src.port = NULL;
2906	$$.dst.host = NULL;
2907	$$.dst.port = NULL;
2908	$$.src_os = NULL;
2909	}
2910	\| from os to {
2911	$$.src = $1;
2912	$$.src_os = $2;
2913	$$.dst = $3;
2914	}
2915	;
2916
2917	os : /* empty */ { $$ = NULL; }
2918	\| OS xos { $$ = $2; }
2919	\| OS '{' optnl os_list '}' { $$ = $4; }
2920	;
2921
2922	xos : STRING {
2923	$$ = calloc(1, sizeof(struct node_os));
2924	if ($$ == NULL)
2925	err(1, "os: calloc");
2926	$$->os = $1;
2927	$$->tail = $$;
2928	}
2929	;
2930
2931	os_list : xos optnl { $$ = $1; }
2932	\| os_list comma xos optnl {
2933	$1->tail->next = $3;
2934	$1->tail = $3;
2935	$$ = $1;
2936	}
2937	;
2938
2939	from : /* empty */ {
2940	$$.host = NULL;
2941	$$.port = NULL;
2942	}
2943	\| FROM ipportspec {
2944	$$ = $2;
2945	}
2946	;
2947
2948	to : /* empty */ {
2949	$$.host = NULL;
2950	$$.port = NULL;
2951	}
2952	\| TO ipportspec {
2953	if (disallow_urpf_failed($2.host, "\"urpf-failed\" is "
2954	"not permitted in a destination address"))
2955	YYERROR;
2956	$$ = $2;
2957	}
2958	;
2959
2960	ipportspec : ipspec {
2961	$$.host = $1;
2962	$$.port = NULL;
2963	}
2964	\| ipspec PORT portspec {
2965	$$.host = $1;
2966	$$.port = $3;
2967	}
2968	\| PORT portspec {
2969	$$.host = NULL;
2970	$$.port = $2;
2971	}
2972	;
2973
2974	optnl : '\n' optnl
2975	\|
2976	;
2977
2978	ipspec : ANY { $$ = NULL; }
2979	\| xhost { $$ = $1; }
2980	\| '{' optnl host_list '}' { $$ = $3; }
2981	;
2982
2983	toipspec : TO ipspec { $$ = $2; }
2984	\| /* empty */ { $$ = NULL; }
2985	;
2986
2987	host_list : ipspec optnl { $$ = $1; }
2988	\| host_list comma ipspec optnl {
2989	if ($3 == NULL)
2990	$$ = $1;
2991	else if ($1 == NULL)
2992	$$ = $3;
2993	else {
2994	$1->tail->next = $3;
2995	$1->tail = $3->tail;
2996	$$ = $1;
2997	}
2998	}
2999	;
3000
3001	xhost : not host {
3002	struct node_host *n;
3003
3004	for (n = $2; n != NULL; n = n->next)
3005	n->not = $1;
3006	$$ = $2;
3007	}
3008	\| not NOROUTE {
3009	$$ = calloc(1, sizeof(struct node_host));
3010	if ($$ == NULL)
3011	err(1, "xhost: calloc");
3012	$$->addr.type = PF_ADDR_NOROUTE;
3013	$$->next = NULL;
3014	$$->not = $1;
3015	$$->tail = $$;
3016	}
3017	\| not URPFFAILED {
3018	$$ = calloc(1, sizeof(struct node_host));
3019	if ($$ == NULL)
3020	err(1, "xhost: calloc");
3021	$$->addr.type = PF_ADDR_URPFFAILED;
3022	$$->next = NULL;
3023	$$->not = $1;
3024	$$->tail = $$;
3025	}
3026	;
3027
3028	host : STRING {
3029	if (($$ = host($1)) == NULL) {
3030	/* error. "any" is handled elsewhere */
3031	free($1);
3032	yyerror("could not parse host specification");
3033	YYERROR;
3034	}
3035	free($1);
3036
3037	}
3038	\| STRING '-' STRING {
3039	struct node_host b, e;
3040
3041	if ((b = host($1)) == NULL \|\| (e = host($3)) == NULL) {
3042	free($1);
3043	free($3);
3044	yyerror("could not parse host specification");
3045	YYERROR;
3046	}
3047	if (b->af != e->af \|\|
3048	b->addr.type != PF_ADDR_ADDRMASK \|\|
3049	e->addr.type != PF_ADDR_ADDRMASK \|\|
3050	unmask(&b->addr.v.a.mask, b->af) !=
3051	(b->af == AF_INET ? 32 : 128) \|\|
3052	unmask(&e->addr.v.a.mask, e->af) !=
3053	(e->af == AF_INET ? 32 : 128) \|\|
3054	b->next != NULL \|\| b->not \|\|
3055	e->next != NULL \|\| e->not) {
3056	free(b);
3057	free(e);
3058	free($1);
3059	free($3);
3060	yyerror("invalid address range");
3061	YYERROR;
3062	}
3063	memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr,
3064	sizeof(b->addr.v.a.mask));
3065	b->addr.type = PF_ADDR_RANGE;
3066	$$ = b;
3067	free(e);
3068	free($1);
3069	free($3);
3070	}
3071	\| STRING '/' NUMBER {
3072	char *buf;
3073
3074	if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1)
3075	err(1, "host: asprintf");
3076	free($1);
3077	if (($$ = host(buf)) == NULL) {
3078	/* error. "any" is handled elsewhere */
3079	free(buf);
3080	yyerror("could not parse host specification");
3081	YYERROR;
3082	}
3083	free(buf);
3084	}
3085	\| NUMBER '/' NUMBER {
3086	char *buf;
3087
3088	/* ie. for 10/8 parsing */
3089	#ifdef __FreeBSD__
3090	if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1)
3091	#else
3092	if (asprintf(&buf, "%lld/%lld", $1, $3) == -1)
3093	#endif
3094	err(1, "host: asprintf");
3095	if (($$ = host(buf)) == NULL) {
3096	/* error. "any" is handled elsewhere */
3097	free(buf);
3098	yyerror("could not parse host specification");
3099	YYERROR;
3100	}
3101	free(buf);
3102	}
3103	\| dynaddr
3104	\| dynaddr '/' NUMBER {
3105	struct node_host *n;
3106
3107	if ($3 < 0 \|\| $3 > 128) {
3108	yyerror("bit number too big");
3109	YYERROR;
3110	}
3111	$$ = $1;
3112	for (n = $1; n != NULL; n = n->next)
3113	set_ipmask(n, $3);
3114	}
3115	\| '<' STRING '>' {
3116	if (strlen($2) >= PF_TABLE_NAME_SIZE) {
3117	yyerror("table name '%s' too long", $2);
3118	free($2);
3119	YYERROR;
3120	}
3121	$$ = calloc(1, sizeof(struct node_host));
3122	if ($$ == NULL)
3123	err(1, "host: calloc");
3124	$$->addr.type = PF_ADDR_TABLE;
3125	if (strlcpy($$->addr.v.tblname, $2,
3126	sizeof($$->addr.v.tblname)) >=
3127	sizeof($$->addr.v.tblname))
3128	errx(1, "host: strlcpy");
3129	free($2);
3130	$$->next = NULL;
3131	$$->tail = $$;
3132	}
3133	;
3134
3135	number : NUMBER
3136	\| STRING {
3137	u_long ulval;
3138
3139	if (atoul($1, &ulval) == -1) {
3140	yyerror("%s is not a number", $1);
3141	free($1);
3142	YYERROR;
3143	} else
3144	$$ = ulval;
3145	free($1);
3146	}
3147	;
3148
3149	dynaddr : '(' STRING ')' {
3150	int flags = 0;
3151	char p, op;
3152
3153	op = $2;
3154	if (!isalpha(op[0])) {
3155	yyerror("invalid interface name '%s'", op);
3156	free(op);
3157	YYERROR;
3158	}
3159	while ((p = strrchr($2, ':')) != NULL) {
3160	if (!strcmp(p+1, "network"))
3161	flags \|= PFI_AFLAG_NETWORK;
3162	else if (!strcmp(p+1, "broadcast"))
3163	flags \|= PFI_AFLAG_BROADCAST;
3164	else if (!strcmp(p+1, "peer"))
3165	flags \|= PFI_AFLAG_PEER;
3166	else if (!strcmp(p+1, "0"))
3167	flags \|= PFI_AFLAG_NOALIAS;
3168	else {
3169	yyerror("interface %s has bad modifier",
3170	$2);
3171	free(op);
3172	YYERROR;
3173	}
3174	*p = '\0';
3175	}
3176	if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
3177	free(op);
3178	yyerror("illegal combination of "
3179	"interface modifiers");
3180	YYERROR;
3181	}
3182	$$ = calloc(1, sizeof(struct node_host));
3183	if ($$ == NULL)
3184	err(1, "address: calloc");
3185	$$->af = 0;
3186	set_ipmask($$, 128);
3187	$$->addr.type = PF_ADDR_DYNIFTL;
3188	$$->addr.iflags = flags;
3189	if (strlcpy($$->addr.v.ifname, $2,
3190	sizeof($$->addr.v.ifname)) >=
3191	sizeof($$->addr.v.ifname)) {
3192	free(op);
3193	free($$);
3194	yyerror("interface name too long");
3195	YYERROR;
3196	}
3197	free(op);
3198	$$->next = NULL;
3199	$$->tail = $$;
3200	}
3201	;
3202
3203	portspec : port_item { $$ = $1; }
3204	\| '{' optnl port_list '}' { $$ = $3; }
3205	;
3206
3207	port_list : port_item optnl { $$ = $1; }
3208	\| port_list comma port_item optnl {
3209	$1->tail->next = $3;
3210	$1->tail = $3;
3211	$$ = $1;
3212	}
3213	;
3214
3215	port_item : portrange {
3216	$$ = calloc(1, sizeof(struct node_port));
3217	if ($$ == NULL)
3218	err(1, "port_item: calloc");
3219	$$->port[0] = $1.a;
3220	$$->port[1] = $1.b;
3221	if ($1.t)
3222	$$->op = PF_OP_RRG;
3223	else
3224	$$->op = PF_OP_EQ;
3225	$$->next = NULL;
3226	$$->tail = $$;
3227	}
3228	\| unaryop portrange {
3229	if ($2.t) {
3230	yyerror("':' cannot be used with an other "
3231	"port operator");
3232	YYERROR;
3233	}
3234	$$ = calloc(1, sizeof(struct node_port));
3235	if ($$ == NULL)
3236	err(1, "port_item: calloc");
3237	$$->port[0] = $2.a;
3238	$$->port[1] = $2.b;
3239	$$->op = $1;
3240	$$->next = NULL;
3241	$$->tail = $$;
3242	}
3243	\| portrange PORTBINARY portrange {
3244	if ($1.t \|\| $3.t) {
3245	yyerror("':' cannot be used with an other "
3246	"port operator");
3247	YYERROR;
3248	}
3249	$$ = calloc(1, sizeof(struct node_port));
3250	if ($$ == NULL)
3251	err(1, "port_item: calloc");
3252	$$->port[0] = $1.a;
3253	$$->port[1] = $3.a;
3254	$$->op = $2;
3255	$$->next = NULL;
3256	$$->tail = $$;
3257	}
3258	;
3259
3260	portplain : numberstring {
3261	if (parseport($1, &$$, 0) == -1) {
3262	free($1);
3263	YYERROR;
3264	}
3265	free($1);
3266	}
3267	;
3268
3269	portrange : numberstring {
3270	if (parseport($1, &$$, PPORT_RANGE) == -1) {
3271	free($1);
3272	YYERROR;
3273	}
3274	free($1);
3275	}
3276	;
3277
3278	uids : uid_item { $$ = $1; }
3279	\| '{' optnl uid_list '}' { $$ = $3; }
3280	;
3281
3282	uid_list : uid_item optnl { $$ = $1; }
3283	\| uid_list comma uid_item optnl {
3284	$1->tail->next = $3;
3285	$1->tail = $3;
3286	$$ = $1;
3287	}
3288	;
3289
3290	uid_item : uid {
3291	$$ = calloc(1, sizeof(struct node_uid));
3292	if ($$ == NULL)
3293	err(1, "uid_item: calloc");
3294	$$->uid[0] = $1;
3295	$$->uid[1] = $1;
3296	$$->op = PF_OP_EQ;
3297	$$->next = NULL;
3298	$$->tail = $$;
3299	}
3300	\| unaryop uid {
3301	if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
3302	yyerror("user unknown requires operator = or "
3303	"!=");
3304	YYERROR;
3305	}
3306	$$ = calloc(1, sizeof(struct node_uid));
3307	if ($$ == NULL)
3308	err(1, "uid_item: calloc");
3309	$$->uid[0] = $2;
3310	$$->uid[1] = $2;
3311	$$->op = $1;
3312	$$->next = NULL;
3313	$$->tail = $$;
3314	}
3315	\| uid PORTBINARY uid {
3316	if ($1 == UID_MAX \|\| $3 == UID_MAX) {
3317	yyerror("user unknown requires operator = or "
3318	"!=");
3319	YYERROR;
3320	}
3321	$$ = calloc(1, sizeof(struct node_uid));
3322	if ($$ == NULL)
3323	err(1, "uid_item: calloc");
3324	$$->uid[0] = $1;
3325	$$->uid[1] = $3;
3326	$$->op = $2;
3327	$$->next = NULL;
3328	$$->tail = $$;
3329	}
3330	;
3331
3332	uid : STRING {
3333	if (!strcmp($1, "unknown"))
3334	$$ = UID_MAX;
3335	else {
3336	struct passwd *pw;
3337
3338	if ((pw = getpwnam($1)) == NULL) {
3339	yyerror("unknown user %s", $1);
3340	free($1);
3341	YYERROR;
3342	}
3343	$$ = pw->pw_uid;
3344	}
3345	free($1);
3346	}
3347	\| NUMBER {
3348	if ($1 < 0 \|\| $1 >= UID_MAX) {
3349	yyerror("illegal uid value %lu", $1);
3350	YYERROR;
3351	}
3352	$$ = $1;
3353	}
3354	;
3355
3356	gids : gid_item { $$ = $1; }
3357	\| '{' optnl gid_list '}' { $$ = $3; }
3358	;
3359
3360	gid_list : gid_item optnl { $$ = $1; }
3361	\| gid_list comma gid_item optnl {
3362	$1->tail->next = $3;
3363	$1->tail = $3;
3364	$$ = $1;
3365	}
3366	;
3367
3368	gid_item : gid {
3369	$$ = calloc(1, sizeof(struct node_gid));
3370	if ($$ == NULL)
3371	err(1, "gid_item: calloc");
3372	$$->gid[0] = $1;
3373	$$->gid[1] = $1;
3374	$$->op = PF_OP_EQ;
3375	$$->next = NULL;
3376	$$->tail = $$;
3377	}
3378	\| unaryop gid {
3379	if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
3380	yyerror("group unknown requires operator = or "
3381	"!=");
3382	YYERROR;
3383	}
3384	$$ = calloc(1, sizeof(struct node_gid));
3385	if ($$ == NULL)
3386	err(1, "gid_item: calloc");
3387	$$->gid[0] = $2;
3388	$$->gid[1] = $2;
3389	$$->op = $1;
3390	$$->next = NULL;
3391	$$->tail = $$;
3392	}
3393	\| gid PORTBINARY gid {
3394	if ($1 == GID_MAX \|\| $3 == GID_MAX) {
3395	yyerror("group unknown requires operator = or "
3396	"!=");
3397	YYERROR;
3398	}
3399	$$ = calloc(1, sizeof(struct node_gid));
3400	if ($$ == NULL)
3401	err(1, "gid_item: calloc");
3402	$$->gid[0] = $1;
3403	$$->gid[1] = $3;
3404	$$->op = $2;
3405	$$->next = NULL;
3406	$$->tail = $$;
3407	}
3408	;
3409
3410	gid : STRING {
3411	if (!strcmp($1, "unknown"))
3412	$$ = GID_MAX;
3413	else {
3414	struct group *grp;
3415
3416	if ((grp = getgrnam($1)) == NULL) {
3417	yyerror("unknown group %s", $1);
3418	free($1);
3419	YYERROR;
3420	}
3421	$$ = grp->gr_gid;
3422	}
3423	free($1);
3424	}
3425	\| NUMBER {
3426	if ($1 < 0 \|\| $1 >= GID_MAX) {
3427	yyerror("illegal gid value %lu", $1);
3428	YYERROR;
3429	}
3430	$$ = $1;
3431	}
3432	;
3433
3434	flag : STRING {
3435	int f;
3436
3437	if ((f = parse_flags($1)) < 0) {
3438	yyerror("bad flags %s", $1);
3439	free($1);
3440	YYERROR;
3441	}
3442	free($1);
3443	$$.b1 = f;
3444	}
3445	;
3446
3447	flags : FLAGS flag '/' flag { $$.b1 = $2.b1; $$.b2 = $4.b1; }
3448	\| FLAGS '/' flag { $$.b1 = 0; $$.b2 = $3.b1; }
3449	\| FLAGS ANY { $$.b1 = 0; $$.b2 = 0; }
3450	;
3451
3452	icmpspec : ICMPTYPE icmp_item { $$ = $2; }
3453	\| ICMPTYPE '{' optnl icmp_list '}' { $$ = $4; }
3454	\| ICMP6TYPE icmp6_item { $$ = $2; }
3455	\| ICMP6TYPE '{' optnl icmp6_list '}' { $$ = $4; }
3456	;
3457
3458	icmp_list : icmp_item optnl { $$ = $1; }
3459	\| icmp_list comma icmp_item optnl {
3460	$1->tail->next = $3;
3461	$1->tail = $3;
3462	$$ = $1;
3463	}
3464	;
3465
3466	icmp6_list : icmp6_item optnl { $$ = $1; }
3467	\| icmp6_list comma icmp6_item optnl {
3468	$1->tail->next = $3;
3469	$1->tail = $3;
3470	$$ = $1;
3471	}
3472	;
3473
3474	icmp_item : icmptype {
3475	$$ = calloc(1, sizeof(struct node_icmp));
3476	if ($$ == NULL)
3477	err(1, "icmp_item: calloc");
3478	$$->type = $1;
3479	$$->code = 0;
3480	$$->proto = IPPROTO_ICMP;
3481	$$->next = NULL;
3482	$$->tail = $$;
3483	}
3484	\| icmptype CODE STRING {
3485	const struct icmpcodeent *p;
3486
3487	if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) {
3488	yyerror("unknown icmp-code %s", $3);
3489	free($3);
3490	YYERROR;
3491	}
3492
3493	free($3);
3494	$$ = calloc(1, sizeof(struct node_icmp));
3495	if ($$ == NULL)
3496	err(1, "icmp_item: calloc");
3497	$$->type = $1;
3498	$$->code = p->code + 1;
3499	$$->proto = IPPROTO_ICMP;
3500	$$->next = NULL;
3501	$$->tail = $$;
3502	}
3503	\| icmptype CODE NUMBER {
3504	if ($3 < 0 \|\| $3 > 255) {
3505	yyerror("illegal icmp-code %lu", $3);
3506	YYERROR;
3507	}
3508	$$ = calloc(1, sizeof(struct node_icmp));
3509	if ($$ == NULL)
3510	err(1, "icmp_item: calloc");
3511	$$->type = $1;
3512	$$->code = $3 + 1;
3513	$$->proto = IPPROTO_ICMP;
3514	$$->next = NULL;
3515	$$->tail = $$;
3516	}
3517	;
3518
3519	icmp6_item : icmp6type {
3520	$$ = calloc(1, sizeof(struct node_icmp));
3521	if ($$ == NULL)
3522	err(1, "icmp_item: calloc");
3523	$$->type = $1;
3524	$$->code = 0;
3525	$$->proto = IPPROTO_ICMPV6;
3526	$$->next = NULL;
3527	$$->tail = $$;
3528	}
3529	\| icmp6type CODE STRING {
3530	const struct icmpcodeent *p;
3531
3532	if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) {
3533	yyerror("unknown icmp6-code %s", $3);
3534	free($3);
3535	YYERROR;
3536	}
3537	free($3);
3538
3539	$$ = calloc(1, sizeof(struct node_icmp));
3540	if ($$ == NULL)
3541	err(1, "icmp_item: calloc");
3542	$$->type = $1;
3543	$$->code = p->code + 1;
3544	$$->proto = IPPROTO_ICMPV6;
3545	$$->next = NULL;
3546	$$->tail = $$;
3547	}
3548	\| icmp6type CODE NUMBER {
3549	if ($3 < 0 \|\| $3 > 255) {
3550	yyerror("illegal icmp-code %lu", $3);
3551	YYERROR;
3552	}
3553	$$ = calloc(1, sizeof(struct node_icmp));
3554	if ($$ == NULL)
3555	err(1, "icmp_item: calloc");
3556	$$->type = $1;
3557	$$->code = $3 + 1;
3558	$$->proto = IPPROTO_ICMPV6;
3559	$$->next = NULL;
3560	$$->tail = $$;
3561	}
3562	;
3563
3564	icmptype : STRING {
3565	const struct icmptypeent *p;
3566
3567	if ((p = geticmptypebyname($1, AF_INET)) == NULL) {
3568	yyerror("unknown icmp-type %s", $1);
3569	free($1);
3570	YYERROR;
3571	}
3572	$$ = p->type + 1;
3573	free($1);
3574	}
3575	\| NUMBER {
3576	if ($1 < 0 \|\| $1 > 255) {
3577	yyerror("illegal icmp-type %lu", $1);
3578	YYERROR;
3579	}
3580	$$ = $1 + 1;
3581	}
3582	;
3583
3584	icmp6type : STRING {
3585	const struct icmptypeent *p;
3586
3587	if ((p = geticmptypebyname($1, AF_INET6)) ==
3588	NULL) {
3589	yyerror("unknown icmp6-type %s", $1);
3590	free($1);
3591	YYERROR;
3592	}
3593	$$ = p->type + 1;
3594	free($1);
3595	}
3596	\| NUMBER {
3597	if ($1 < 0 \|\| $1 > 255) {
3598	yyerror("illegal icmp6-type %lu", $1);
3599	YYERROR;
3600	}
3601	$$ = $1 + 1;
3602	}
3603	;
3604
3605	tos : STRING {
3606	int val;
3607	char *end;
3608
3609	if (map_tos($1, &val))
3610	$$ = val;
3611	else if ($1[0] == '0' && $1[1] == 'x') {
3612	errno = 0;
3613	$$ = strtoul($1, &end, 16);
3614	if (errno \|\| *end != '\0')
3615	$$ = 256;
3616	} else
3617	$$ = 256; /* flag bad argument */
3618	if ($$ < 0 \|\| $$ > 255) {
3619	yyerror("illegal tos value %s", $1);
3620	free($1);
3621	YYERROR;
3622	}
3623	free($1);
3624	}
3625	\| NUMBER {
3626	$$ = $1;
3627	if ($$ < 0 \|\| $$ > 255) {
3628	yyerror("illegal tos value %s", $1);
3629	YYERROR;
3630	}
3631	}
3632	;
3633
3634	sourcetrack : SOURCETRACK { $$ = PF_SRCTRACK; }
3635	\| SOURCETRACK GLOBAL { $$ = PF_SRCTRACK_GLOBAL; }
3636	\| SOURCETRACK RULE { $$ = PF_SRCTRACK_RULE; }
3637	;
3638
3639	statelock : IFBOUND {
3640	$$ = PFRULE_IFBOUND;
3641	}
3642	\| FLOATING {
3643	$$ = 0;
3644	}
3645	;
3646
3647	keep : NO STATE {
3648	$$.action = 0;
3649	$$.options = NULL;
3650	}
3651	\| KEEP STATE state_opt_spec {
3652	$$.action = PF_STATE_NORMAL;
3653	$$.options = $3;
3654	}
3655	\| MODULATE STATE state_opt_spec {
3656	$$.action = PF_STATE_MODULATE;
3657	$$.options = $3;
3658	}
3659	\| SYNPROXY STATE state_opt_spec {
3660	$$.action = PF_STATE_SYNPROXY;
3661	$$.options = $3;
3662	}
3663	;
3664
3665	flush : /* empty */ { $$ = 0; }
3666	\| FLUSH { $$ = PF_FLUSH; }
3667	\| FLUSH GLOBAL {
3668	$$ = PF_FLUSH \| PF_FLUSH_GLOBAL;
3669	}
3670	;
3671
3672	state_opt_spec : '(' state_opt_list ')' { $$ = $2; }
3673	\| /* empty */ { $$ = NULL; }
3674	;
3675
3676	state_opt_list : state_opt_item { $$ = $1; }
3677	\| state_opt_list comma state_opt_item {
3678	$1->tail->next = $3;
3679	$1->tail = $3;
3680	$$ = $1;
3681	}
3682	;
3683
3684	state_opt_item : MAXIMUM NUMBER {
3685	if ($2 < 0 \|\| $2 > UINT_MAX) {
3686	yyerror("only positive values permitted");
3687	YYERROR;
3688	}
3689	$$ = calloc(1, sizeof(struct node_state_opt));
3690	if ($$ == NULL)
3691	err(1, "state_opt_item: calloc");
3692	$$->type = PF_STATE_OPT_MAX;
3693	$$->data.max_states = $2;
3694	$$->next = NULL;
3695	$$->tail = $$;
3696	}
3697	\| NOSYNC {
3698	$$ = calloc(1, sizeof(struct node_state_opt));
3699	if ($$ == NULL)
3700	err(1, "state_opt_item: calloc");
3701	$$->type = PF_STATE_OPT_NOSYNC;
3702	$$->next = NULL;
3703	$$->tail = $$;
3704	}
3705	\| MAXSRCSTATES NUMBER {
3706	if ($2 < 0 \|\| $2 > UINT_MAX) {
3707	yyerror("only positive values permitted");
3708	YYERROR;
3709	}
3710	$$ = calloc(1, sizeof(struct node_state_opt));
3711	if ($$ == NULL)
3712	err(1, "state_opt_item: calloc");
3713	$$->type = PF_STATE_OPT_MAX_SRC_STATES;
3714	$$->data.max_src_states = $2;
3715	$$->next = NULL;
3716	$$->tail = $$;
3717	}
3718	\| MAXSRCCONN NUMBER {
3719	if ($2 < 0 \|\| $2 > UINT_MAX) {
3720	yyerror("only positive values permitted");
3721	YYERROR;
3722	}
3723	$$ = calloc(1, sizeof(struct node_state_opt));
3724	if ($$ == NULL)
3725	err(1, "state_opt_item: calloc");
3726	$$->type = PF_STATE_OPT_MAX_SRC_CONN;
3727	$$->data.max_src_conn = $2;
3728	$$->next = NULL;
3729	$$->tail = $$;
3730	}
3731	\| MAXSRCCONNRATE NUMBER '/' NUMBER {
3732	if ($2 < 0 \|\| $2 > UINT_MAX \|\|
3733	$4 < 0 \|\| $4 > UINT_MAX) {
3734	yyerror("only positive values permitted");
3735	YYERROR;
3736	}
3737	$$ = calloc(1, sizeof(struct node_state_opt));
3738	if ($$ == NULL)
3739	err(1, "state_opt_item: calloc");
3740	$$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
3741	$$->data.max_src_conn_rate.limit = $2;
3742	$$->data.max_src_conn_rate.seconds = $4;
3743	$$->next = NULL;
3744	$$->tail = $$;
3745	}
3746	\| OVERLOAD '<' STRING '>' flush {
3747	if (strlen($3) >= PF_TABLE_NAME_SIZE) {
3748	yyerror("table name '%s' too long", $3);
3749	free($3);
3750	YYERROR;
3751	}
3752	$$ = calloc(1, sizeof(struct node_state_opt));
3753	if ($$ == NULL)
3754	err(1, "state_opt_item: calloc");
3755	if (strlcpy($$->data.overload.tblname, $3,
3756	PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
3757	errx(1, "state_opt_item: strlcpy");
3758	free($3);
3759	$$->type = PF_STATE_OPT_OVERLOAD;
3760	$$->data.overload.flush = $5;
3761	$$->next = NULL;
3762	$$->tail = $$;
3763	}
3764	\| MAXSRCNODES NUMBER {
3765	if ($2 < 0 \|\| $2 > UINT_MAX) {
3766	yyerror("only positive values permitted");
3767	YYERROR;
3768	}
3769	$$ = calloc(1, sizeof(struct node_state_opt));
3770	if ($$ == NULL)
3771	err(1, "state_opt_item: calloc");
3772	$$->type = PF_STATE_OPT_MAX_SRC_NODES;
3773	$$->data.max_src_nodes = $2;
3774	$$->next = NULL;
3775	$$->tail = $$;
3776	}
3777	\| sourcetrack {
3778	$$ = calloc(1, sizeof(struct node_state_opt));
3779	if ($$ == NULL)
3780	err(1, "state_opt_item: calloc");
3781	$$->type = PF_STATE_OPT_SRCTRACK;
3782	$$->data.src_track = $1;
3783	$$->next = NULL;
3784	$$->tail = $$;
3785	}
3786	\| statelock {
3787	$$ = calloc(1, sizeof(struct node_state_opt));
3788	if ($$ == NULL)
3789	err(1, "state_opt_item: calloc");
3790	$$->type = PF_STATE_OPT_STATELOCK;
3791	$$->data.statelock = $1;
3792	$$->next = NULL;
3793	$$->tail = $$;
3794	}
3795	\| SLOPPY {
3796	$$ = calloc(1, sizeof(struct node_state_opt));
3797	if ($$ == NULL)
3798	err(1, "state_opt_item: calloc");
3799	$$->type = PF_STATE_OPT_SLOPPY;
3800	$$->next = NULL;
3801	$$->tail = $$;
3802	}
3803	\| STRING NUMBER {
3804	int i;
3805
3806	if ($2 < 0 \|\| $2 > UINT_MAX) {
3807	yyerror("only positive values permitted");
3808	YYERROR;
3809	}
3810	for (i = 0; pf_timeouts[i].name &&
3811	strcmp(pf_timeouts[i].name, $1); ++i)
3812	; /* nothing */
3813	if (!pf_timeouts[i].name) {
3814	yyerror("illegal timeout name %s", $1);
3815	free($1);
3816	YYERROR;
3817	}
3818	if (strchr(pf_timeouts[i].name, '.') == NULL) {
3819	yyerror("illegal state timeout %s", $1);
3820	free($1);
3821	YYERROR;
3822	}
3823	free($1);
3824	$$ = calloc(1, sizeof(struct node_state_opt));
3825	if ($$ == NULL)
3826	err(1, "state_opt_item: calloc");
3827	$$->type = PF_STATE_OPT_TIMEOUT;
3828	$$->data.timeout.number = pf_timeouts[i].timeout;
3829	$$->data.timeout.seconds = $2;
3830	$$->next = NULL;
3831	$$->tail = $$;
3832	}
3833	;
3834
3835	label : LABEL STRING {
3836	$$ = $2;
3837	}
3838	;
3839
3840	qname : QUEUE STRING {
3841	$$.qname = $2;
3842	$$.pqname = NULL;
3843	}
3844	\| QUEUE '(' STRING ')' {
3845	$$.qname = $3;
3846	$$.pqname = NULL;
3847	}
3848	\| QUEUE '(' STRING comma STRING ')' {
3849	$$.qname = $3;
3850	$$.pqname = $5;
3851	}
3852	;
3853
3854	no : /* empty */ { $$ = 0; }
3855	\| NO { $$ = 1; }
3856	;
3857
3858	portstar : numberstring {
3859	if (parseport($1, &$$, PPORT_RANGE\|PPORT_STAR) == -1) {
3860	free($1);
3861	YYERROR;
3862	}
3863	free($1);
3864	}
3865	;
3866
3867	redirspec : host { $$ = $1; }
3868	\| '{' optnl redir_host_list '}' { $$ = $3; }
3869	;
3870
3871	redir_host_list : host optnl { $$ = $1; }
3872	\| redir_host_list comma host optnl {
3873	$1->tail->next = $3;
3874	$1->tail = $3->tail;
3875	$$ = $1;
3876	}
3877	;
3878
3879	redirpool : /* empty */ { $$ = NULL; }
3880	\| ARROW redirspec {
3881	$$ = calloc(1, sizeof(struct redirection));
3882	if ($$ == NULL)
3883	err(1, "redirection: calloc");
3884	$$->host = $2;
3885	$$->rport.a = $$->rport.b = $$->rport.t = 0;
3886	}
3887	\| ARROW redirspec PORT portstar {
3888	$$ = calloc(1, sizeof(struct redirection));
3889	if ($$ == NULL)
3890	err(1, "redirection: calloc");
3891	$$->host = $2;
3892	$$->rport = $4;
3893	}
3894	;
3895
3896	hashkey : /* empty */
3897	{
3898	$$ = calloc(1, sizeof(struct pf_poolhashkey));
3899	if ($$ == NULL)
3900	err(1, "hashkey: calloc");
3901	$$->key32[0] = arc4random();
3902	$$->key32[1] = arc4random();
3903	$$->key32[2] = arc4random();
3904	$$->key32[3] = arc4random();
3905	}
3906	\| string
3907	{
3908	if (!strncmp($1, "0x", 2)) {
3909	if (strlen($1) != 34) {
3910	free($1);
3911	yyerror("hex key must be 128 bits "
3912	"(32 hex digits) long");
3913	YYERROR;
3914	}
3915	$$ = calloc(1, sizeof(struct pf_poolhashkey));
3916	if ($$ == NULL)
3917	err(1, "hashkey: calloc");
3918
3919	if (sscanf($1, "0x%8x%8x%8x%8x",
3920	&$$->key32[0], &$$->key32[1],
3921	&$$->key32[2], &$$->key32[3]) != 4) {
3922	free($$);
3923	free($1);
3924	yyerror("invalid hex key");
3925	YYERROR;
3926	}
3927	} else {
3928	MD5_CTX context;
3929
3930	$$ = calloc(1, sizeof(struct pf_poolhashkey));
3931	if ($$ == NULL)
3932	err(1, "hashkey: calloc");
3933	MD5Init(&context);
3934	MD5Update(&context, (unsigned char *)$1,
3935	strlen($1));
3936	MD5Final((unsigned char *)$$, &context);
3937	HTONL($$->key32[0]);
3938	HTONL($$->key32[1]);
3939	HTONL($$->key32[2]);
3940	HTONL($$->key32[3]);
3941	}
3942	free($1);
3943	}
3944	;
3945
3946	pool_opts : { bzero(&pool_opts, sizeof pool_opts); }
3947	pool_opts_l
3948	{ $$ = pool_opts; }
3949	\| /* empty */ {
3950	bzero(&pool_opts, sizeof pool_opts);
3951	$$ = pool_opts;
3952	}
3953	;
3954
3955	pool_opts_l : pool_opts_l pool_opt
3956	\| pool_opt
3957	;
3958
3959	pool_opt : BITMASK {
3960	if (pool_opts.type) {
3961	yyerror("pool type cannot be redefined");
3962	YYERROR;
3963	}
3964	pool_opts.type = PF_POOL_BITMASK;
3965	}
3966	\| RANDOM {
3967	if (pool_opts.type) {
3968	yyerror("pool type cannot be redefined");
3969	YYERROR;
3970	}
3971	pool_opts.type = PF_POOL_RANDOM;
3972	}
3973	\| SOURCEHASH hashkey {
3974	if (pool_opts.type) {
3975	yyerror("pool type cannot be redefined");
3976	YYERROR;
3977	}
3978	pool_opts.type = PF_POOL_SRCHASH;
3979	pool_opts.key = $2;
3980	}
3981	\| ROUNDROBIN {
3982	if (pool_opts.type) {
3983	yyerror("pool type cannot be redefined");
3984	YYERROR;
3985	}
3986	pool_opts.type = PF_POOL_ROUNDROBIN;
3987	}
3988	\| STATICPORT {
3989	if (pool_opts.staticport) {
3990	yyerror("static-port cannot be redefined");
3991	YYERROR;
3992	}
3993	pool_opts.staticport = 1;
3994	}
3995	\| STICKYADDRESS {
3996	if (filter_opts.marker & POM_STICKYADDRESS) {
3997	yyerror("sticky-address cannot be redefined");
3998	YYERROR;
3999	}
4000	pool_opts.marker \|= POM_STICKYADDRESS;
4001	pool_opts.opts \|= PF_POOL_STICKYADDR;
4002	}
4003	;
4004
4005	redirection : /* empty */ { $$ = NULL; }
4006	\| ARROW host {
4007	$$ = calloc(1, sizeof(struct redirection));
4008	if ($$ == NULL)
4009	err(1, "redirection: calloc");
4010	$$->host = $2;
4011	$$->rport.a = $$->rport.b = $$->rport.t = 0;
4012	}
4013	\| ARROW host PORT portstar {
4014	$$ = calloc(1, sizeof(struct redirection));
4015	if ($$ == NULL)
4016	err(1, "redirection: calloc");
4017	$$->host = $2;
4018	$$->rport = $4;
4019	}
4020	;
4021
4022	natpasslog : /* empty */ { $$.b1 = $$.b2 = 0; $$.w2 = 0; }
4023	\| PASS { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; }
4024	\| PASS log { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; }
4025	\| log { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; }
4026	;
4027
4028	nataction : no NAT natpasslog {
4029	if ($1 && $3.b1) {
4030	yyerror("\"pass\" not valid with \"no\"");
4031	YYERROR;
4032	}
4033	if ($1)
4034	$$.b1 = PF_NONAT;
4035	else
4036	$$.b1 = PF_NAT;
4037	$$.b2 = $3.b1;
4038	$$.w = $3.b2;
4039	$$.w2 = $3.w2;
4040	}
4041	\| no RDR natpasslog {
4042	if ($1 && $3.b1) {
4043	yyerror("\"pass\" not valid with \"no\"");
4044	YYERROR;
4045	}
4046	if ($1)
4047	$$.b1 = PF_NORDR;
4048	else
4049	$$.b1 = PF_RDR;
4050	$$.b2 = $3.b1;
4051	$$.w = $3.b2;
4052	$$.w2 = $3.w2;
4053	}
4054	;
4055
4056	natrule : nataction interface af proto fromto tag tagged rtable
4057	redirpool pool_opts
4058	{
4059	struct pf_rule r;
4060
4061	if (check_rulestate(PFCTL_STATE_NAT))
4062	YYERROR;
4063
4064	memset(&r, 0, sizeof(r));
4065
4066	r.action = $1.b1;
4067	r.natpass = $1.b2;
4068	r.log = $1.w;
4069	r.logif = $1.w2;
4070	r.af = $3;
4071
4072	if (!r.af) {
4073	if ($5.src.host && $5.src.host->af &&
4074	!$5.src.host->ifindex)
4075	r.af = $5.src.host->af;
4076	else if ($5.dst.host && $5.dst.host->af &&
4077	!$5.dst.host->ifindex)
4078	r.af = $5.dst.host->af;
4079	}
4080
4081	if ($6 != NULL)
4082	if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
4083	PF_TAG_NAME_SIZE) {
4084	yyerror("tag too long, max %u chars",
4085	PF_TAG_NAME_SIZE - 1);
4086	YYERROR;
4087	}
4088
4089	if ($7.name)
4090	if (strlcpy(r.match_tagname, $7.name,
4091	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4092	yyerror("tag too long, max %u chars",
4093	PF_TAG_NAME_SIZE - 1);
4094	YYERROR;
4095	}
4096	r.match_tag_not = $7.neg;
4097	r.rtableid = $8;
4098
4099	if (r.action == PF_NONAT \|\| r.action == PF_NORDR) {
4100	if ($9 != NULL) {
4101	yyerror("translation rule with 'no' "
4102	"does not need '->'");
4103	YYERROR;
4104	}
4105	} else {
4106	if ($9 == NULL \|\| $9->host == NULL) {
4107	yyerror("translation rule requires '-> "
4108	"address'");
4109	YYERROR;
4110	}
4111	if (!r.af && ! $9->host->ifindex)
4112	r.af = $9->host->af;
4113
4114	remove_invalid_hosts(&$9->host, &r.af);
4115	if (invalid_redirect($9->host, r.af))
4116	YYERROR;
4117	if (check_netmask($9->host, r.af))
4118	YYERROR;
4119
4120	r.rpool.proxy_port[0] = ntohs($9->rport.a);
4121
4122	switch (r.action) {
4123	case PF_RDR:
4124	if (!$9->rport.b && $9->rport.t &&
4125	$5.dst.port != NULL) {
4126	r.rpool.proxy_port[1] =
4127	ntohs($9->rport.a) +
4128	(ntohs(
4129	$5.dst.port->port[1]) -
4130	ntohs(
4131	$5.dst.port->port[0]));
4132	} else
4133	r.rpool.proxy_port[1] =
4134	ntohs($9->rport.b);
4135	break;
4136	case PF_NAT:
4137	r.rpool.proxy_port[1] =
4138	ntohs($9->rport.b);
4139	if (!r.rpool.proxy_port[0] &&
4140	!r.rpool.proxy_port[1]) {
4141	r.rpool.proxy_port[0] =
4142	PF_NAT_PROXY_PORT_LOW;
4143	r.rpool.proxy_port[1] =
4144	PF_NAT_PROXY_PORT_HIGH;
4145	} else if (!r.rpool.proxy_port[1])
4146	r.rpool.proxy_port[1] =
4147	r.rpool.proxy_port[0];
4148	break;
4149	default:
4150	break;
4151	}
4152
4153	r.rpool.opts = $10.type;
4154	if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
4155	PF_POOL_NONE && ($9->host->next != NULL \|\|
4156	$9->host->addr.type == PF_ADDR_TABLE \|\|
4157	DYNIF_MULTIADDR($9->host->addr)))
4158	r.rpool.opts = PF_POOL_ROUNDROBIN;
4159	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4160	PF_POOL_ROUNDROBIN &&
4161	disallow_table($9->host, "tables are only "
4162	"supported in round-robin redirection "
4163	"pools"))
4164	YYERROR;
4165	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4166	PF_POOL_ROUNDROBIN &&
4167	disallow_alias($9->host, "interface (%s) "
4168	"is only supported in round-robin "
4169	"redirection pools"))
4170	YYERROR;
4171	if ($9->host->next != NULL) {
4172	if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4173	PF_POOL_ROUNDROBIN) {
4174	yyerror("only round-robin "
4175	"valid for multiple "
4176	"redirection addresses");
4177	YYERROR;
4178	}
4179	}
4180	}
4181
4182	if ($10.key != NULL)
4183	memcpy(&r.rpool.key, $10.key,
4184	sizeof(struct pf_poolhashkey));
4185
4186	if ($10.opts)
4187	r.rpool.opts \|= $10.opts;
4188
4189	if ($10.staticport) {
4190	if (r.action != PF_NAT) {
4191	yyerror("the 'static-port' option is "
4192	"only valid with nat rules");
4193	YYERROR;
4194	}
4195	if (r.rpool.proxy_port[0] !=
4196	PF_NAT_PROXY_PORT_LOW &&
4197	r.rpool.proxy_port[1] !=
4198	PF_NAT_PROXY_PORT_HIGH) {
4199	yyerror("the 'static-port' option can't"
4200	" be used when specifying a port"
4201	" range");
4202	YYERROR;
4203	}
4204	r.rpool.proxy_port[0] = 0;
4205	r.rpool.proxy_port[1] = 0;
4206	}
4207
4208	expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4,
4209	$5.src_os, $5.src.host, $5.src.port, $5.dst.host,
4210	$5.dst.port, 0, 0, 0, "");
4211	free($9);
4212	}
4213	;
4214
4215	binatrule : no BINAT natpasslog interface af proto FROM ipspec toipspec tag
4216	tagged rtable redirection
4217	{
4218	struct pf_rule binat;
4219	struct pf_pooladdr *pa;
4220
4221	if (check_rulestate(PFCTL_STATE_NAT))
4222	YYERROR;
4223	if (disallow_urpf_failed($9, "\"urpf-failed\" is not "
4224	"permitted as a binat destination"))
4225	YYERROR;
4226
4227	memset(&binat, 0, sizeof(binat));
4228
4229	if ($1 && $3.b1) {
4230	yyerror("\"pass\" not valid with \"no\"");
4231	YYERROR;
4232	}
4233	if ($1)
4234	binat.action = PF_NOBINAT;
4235	else
4236	binat.action = PF_BINAT;
4237	binat.natpass = $3.b1;
4238	binat.log = $3.b2;
4239	binat.logif = $3.w2;
4240	binat.af = $5;
4241	if (!binat.af && $8 != NULL && $8->af)
4242	binat.af = $8->af;
4243	if (!binat.af && $9 != NULL && $9->af)
4244	binat.af = $9->af;
4245
4246	if (!binat.af && $13 != NULL && $13->host)
4247	binat.af = $13->host->af;
4248	if (!binat.af) {
4249	yyerror("address family (inet/inet6) "
4250	"undefined");
4251	YYERROR;
4252	}
4253
4254	if ($4 != NULL) {
4255	memcpy(binat.ifname, $4->ifname,
4256	sizeof(binat.ifname));
4257	binat.ifnot = $4->not;
4258	free($4);
4259	}
4260
4261	if ($10 != NULL)
4262	if (strlcpy(binat.tagname, $10,
4263	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4264	yyerror("tag too long, max %u chars",
4265	PF_TAG_NAME_SIZE - 1);
4266	YYERROR;
4267	}
4268	if ($11.name)
4269	if (strlcpy(binat.match_tagname, $11.name,
4270	PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4271	yyerror("tag too long, max %u chars",
4272	PF_TAG_NAME_SIZE - 1);
4273	YYERROR;
4274	}
4275	binat.match_tag_not = $11.neg;
4276	binat.rtableid = $12;
4277
4278	if ($6 != NULL) {
4279	binat.proto = $6->proto;
4280	free($6);
4281	}
4282
4283	if ($8 != NULL && disallow_table($8, "invalid use of "
4284	"table <%s> as the source address of a binat rule"))
4285	YYERROR;
4286	if ($8 != NULL && disallow_alias($8, "invalid use of "
4287	"interface (%s) as the source address of a binat "
4288	"rule"))
4289	YYERROR;
4290	if ($13 != NULL && $13->host != NULL && disallow_table(
4291	$13->host, "invalid use of table <%s> as the "
4292	"redirect address of a binat rule"))
4293	YYERROR;
4294	if ($13 != NULL && $13->host != NULL && disallow_alias(
4295	$13->host, "invalid use of interface (%s) as the "
4296	"redirect address of a binat rule"))
4297	YYERROR;
4298
4299	if ($8 != NULL) {
4300	if ($8->next) {
4301	yyerror("multiple binat ip addresses");
4302	YYERROR;
4303	}
4304	if ($8->addr.type == PF_ADDR_DYNIFTL)
4305	$8->af = binat.af;
4306	if ($8->af != binat.af) {
4307	yyerror("binat ip versions must match");
4308	YYERROR;
4309	}
4310	if (check_netmask($8, binat.af))
4311	YYERROR;
4312	memcpy(&binat.src.addr, &$8->addr,
4313	sizeof(binat.src.addr));
4314	free($8);
4315	}
4316	if ($9 != NULL) {
4317	if ($9->next) {
4318	yyerror("multiple binat ip addresses");
4319	YYERROR;
4320	}
4321	if ($9->af != binat.af && $9->af) {
4322	yyerror("binat ip versions must match");
4323	YYERROR;
4324	}
4325	if (check_netmask($9, binat.af))
4326	YYERROR;
4327	memcpy(&binat.dst.addr, &$9->addr,
4328	sizeof(binat.dst.addr));
4329	binat.dst.neg = $9->not;
4330	free($9);
4331	}
4332
4333	if (binat.action == PF_NOBINAT) {
4334	if ($13 != NULL) {
4335	yyerror("'no binat' rule does not need"
4336	" '->'");
4337	YYERROR;
4338	}
4339	} else {
4340	if ($13 == NULL \|\| $13->host == NULL) {
4341	yyerror("'binat' rule requires"
4342	" '-> address'");
4343	YYERROR;
4344	}
4345
4346	remove_invalid_hosts(&$13->host, &binat.af);
4347	if (invalid_redirect($13->host, binat.af))
4348	YYERROR;
4349	if ($13->host->next != NULL) {
4350	yyerror("binat rule must redirect to "
4351	"a single address");
4352	YYERROR;
4353	}
4354	if (check_netmask($13->host, binat.af))
4355	YYERROR;
4356
4357	if (!PF_AZERO(&binat.src.addr.v.a.mask,
4358	binat.af) &&
4359	!PF_AEQ(&binat.src.addr.v.a.mask,
4360	&$13->host->addr.v.a.mask, binat.af)) {
4361	yyerror("'binat' source mask and "
4362	"redirect mask must be the same");
4363	YYERROR;
4364	}
4365
4366	TAILQ_INIT(&binat.rpool.list);
4367	pa = calloc(1, sizeof(struct pf_pooladdr));
4368	if (pa == NULL)
4369	err(1, "binat: calloc");
4370	pa->addr = $13->host->addr;
4371	pa->ifname[0] = 0;
4372	TAILQ_INSERT_TAIL(&binat.rpool.list,
4373	pa, entries);
4374
4375	free($13);
4376	}
4377
4378	pfctl_add_rule(pf, &binat, "");
4379	}
4380	;
4381
4382	tag : /* empty */ { $$ = NULL; }
4383	\| TAG STRING { $$ = $2; }
4384	;
4385
4386	tagged : /* empty */ { $$.neg = 0; $$.name = NULL; }
4387	\| not TAGGED string { $$.neg = $1; $$.name = $3; }
4388	;
4389
4390	rtable : /* empty */ { $$ = -1; }
4391	\| RTABLE NUMBER {
4392	if ($2 < 0 \|\| $2 > rt_tableid_max()) {
4393	yyerror("invalid rtable id");
4394	YYERROR;
4395	}
4396	$$ = $2;
4397	}
4398	;
4399
4400	route_host : STRING {
4401	$$ = calloc(1, sizeof(struct node_host));
4402	if ($$ == NULL)
4403	err(1, "route_host: calloc");
4404	$$->ifname = $1;
4405	set_ipmask($$, 128);
4406	$$->next = NULL;
4407	$$->tail = $$;
4408	}
4409	\| '(' STRING host ')' {
4410	$$ = $3;
4411	$$->ifname = $2;
4412	}
4413	;
4414
4415	route_host_list : route_host optnl { $$ = $1; }
4416	\| route_host_list comma route_host optnl {
4417	if ($1->af == 0)
4418	$1->af = $3->af;
4419	if ($1->af != $3->af) {
4420	yyerror("all pool addresses must be in the "
4421	"same address family");
4422	YYERROR;
4423	}
4424	$1->tail->next = $3;
4425	$1->tail = $3->tail;
4426	$$ = $1;
4427	}
4428	;
4429
4430	routespec : route_host { $$ = $1; }
4431	\| '{' optnl route_host_list '}' { $$ = $3; }
4432	;
4433
4434	route : /* empty */ {
4435	$$.host = NULL;
4436	$$.rt = 0;
4437	$$.pool_opts = 0;
4438	}
4439	\| FASTROUTE {
4440	/* backwards-compat */
4441	$$.host = NULL;
4442	$$.rt = 0;
4443	$$.pool_opts = 0;
4444	}
4445	\| ROUTETO routespec pool_opts {
4446	$$.host = $2;
4447	$$.rt = PF_ROUTETO;
4448	$$.pool_opts = $3.type \| $3.opts;
4449	if ($3.key != NULL)
4450	$$.key = $3.key;
4451	}
4452	\| REPLYTO routespec pool_opts {
4453	$$.host = $2;
4454	$$.rt = PF_REPLYTO;
4455	$$.pool_opts = $3.type \| $3.opts;
4456	if ($3.key != NULL)
4457	$$.key = $3.key;
4458	}
4459	\| DUPTO routespec pool_opts {
4460	$$.host = $2;
4461	$$.rt = PF_DUPTO;
4462	$$.pool_opts = $3.type \| $3.opts;
4463	if ($3.key != NULL)
4464	$$.key = $3.key;
4465	}
4466	;
4467
4468	timeout_spec : STRING NUMBER
4469	{
4470	if (check_rulestate(PFCTL_STATE_OPTION)) {
4471	free($1);
4472	YYERROR;
4473	}
4474	if ($2 < 0 \|\| $2 > UINT_MAX) {
4475	yyerror("only positive values permitted");
4476	YYERROR;
4477	}
4478	if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
4479	yyerror("unknown timeout %s", $1);
4480	free($1);
4481	YYERROR;
4482	}
4483	free($1);
4484	}
4485	\| INTERVAL NUMBER {
4486	if (check_rulestate(PFCTL_STATE_OPTION))
4487	YYERROR;
4488	if ($2 < 0 \|\| $2 > UINT_MAX) {
4489	yyerror("only positive values permitted");
4490	YYERROR;
4491	}
4492	if (pfctl_set_timeout(pf, "interval", $2, 0) != 0)
4493	YYERROR;
4494	}
4495	;
4496
4497	timeout_list : timeout_list comma timeout_spec optnl
4498	\| timeout_spec optnl
4499	;
4500
4501	limit_spec : STRING NUMBER
4502	{
4503	if (check_rulestate(PFCTL_STATE_OPTION)) {
4504	free($1);
4505	YYERROR;
4506	}
4507	if ($2 < 0 \|\| $2 > UINT_MAX) {
4508	yyerror("only positive values permitted");
4509	YYERROR;
4510	}
4511	if (pfctl_set_limit(pf, $1, $2) != 0) {
4512	yyerror("unable to set limit %s %u", $1, $2);
4513	free($1);
4514	YYERROR;
4515	}
4516	free($1);
4517	}
4518	;
4519
4520	limit_list : limit_list comma limit_spec optnl
4521	\| limit_spec optnl
4522	;
4523
4524	comma : ','
4525	\| /* empty */
4526	;
4527
4528	yesno : NO { $$ = 0; }
4529	\| STRING {
4530	if (!strcmp($1, "yes"))
4531	$$ = 1;
4532	else {
4533	yyerror("invalid value '%s', expected 'yes' "
4534	"or 'no'", $1);
4535	free($1);
4536	YYERROR;
4537	}
4538	free($1);
4539	}
4540	;
4541
4542	unaryop : '=' { $$ = PF_OP_EQ; }
4543	\| '!' '=' { $$ = PF_OP_NE; }
4544	\| '<' '=' { $$ = PF_OP_LE; }
4545	\| '<' { $$ = PF_OP_LT; }
4546	\| '>' '=' { $$ = PF_OP_GE; }
4547	\| '>' { $$ = PF_OP_GT; }
4548	;
4549
4550	%%
4551	#ifdef __rtems__
4552	RTEMS_LINKER_RWSET_CONTENT(bsd_prog_pfctl, static YYSTACKDATA yystack);
4553	#endif /* __rtems__ */
4554
4555	int
4556	yyerror(const char *fmt, ...)
4557	{
4558	va_list ap;
4559
4560	file->errors++;
4561	va_start(ap, fmt);
4562	fprintf(stderr, "%s:%d: ", file->name, yylval.lineno);
4563	vfprintf(stderr, fmt, ap);
4564	fprintf(stderr, "\n");
4565	va_end(ap);
4566	return (0);
4567	}
4568
4569	int
4570	disallow_table(struct node_host h, const char fmt)
4571	{
4572	for (; h != NULL; h = h->next)
4573	if (h->addr.type == PF_ADDR_TABLE) {
4574	yyerror(fmt, h->addr.v.tblname);
4575	return (1);
4576	}
4577	return (0);
4578	}
4579
4580	int
4581	disallow_urpf_failed(struct node_host h, const char fmt)
4582	{
4583	for (; h != NULL; h = h->next)
4584	if (h->addr.type == PF_ADDR_URPFFAILED) {
4585	yyerror(fmt);
4586	return (1);
4587	}
4588	return (0);
4589	}
4590
4591	int
4592	disallow_alias(struct node_host h, const char fmt)
4593	{
4594	for (; h != NULL; h = h->next)
4595	if (DYNIF_MULTIADDR(h->addr)) {
4596	yyerror(fmt, h->addr.v.tblname);
4597	return (1);
4598	}
4599	return (0);
4600	}
4601
4602	int
4603	rule_consistent(struct pf_rule *r, int anchor_call)
4604	{
4605	int problems = 0;
4606
4607	switch (r->action) {
4608	case PF_PASS:
4609	case PF_DROP:
4610	case PF_SCRUB:
4611	case PF_NOSCRUB:
4612	problems = filter_consistent(r, anchor_call);
4613	break;
4614	case PF_NAT:
4615	case PF_NONAT:
4616	problems = nat_consistent(r);
4617	break;
4618	case PF_RDR:
4619	case PF_NORDR:
4620	problems = rdr_consistent(r);
4621	break;
4622	case PF_BINAT:
4623	case PF_NOBINAT:
4624	default:
4625	break;
4626	}
4627	return (problems);
4628	}
4629
4630	int
4631	filter_consistent(struct pf_rule *r, int anchor_call)
4632	{
4633	int problems = 0;
4634
4635	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
4636	(r->src.port_op \|\| r->dst.port_op)) {
4637	yyerror("port only applies to tcp/udp");
4638	problems++;
4639	}
4640	if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
4641	(r->type \|\| r->code)) {
4642	yyerror("icmp-type/code only applies to icmp");
4643	problems++;
4644	}
4645	if (!r->af && (r->type \|\| r->code)) {
4646	yyerror("must indicate address family with icmp-type/code");
4647	problems++;
4648	}
4649	if (r->overload_tblname[0] &&
4650	r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
4651	yyerror("'overload' requires 'max-src-conn' "
4652	"or 'max-src-conn-rate'");
4653	problems++;
4654	}
4655	if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) \|\|
4656	(r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
4657	yyerror("proto %s doesn't match address family %s",
4658	r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
4659	r->af == AF_INET ? "inet" : "inet6");
4660	problems++;
4661	}
4662	if (r->allow_opts && r->action != PF_PASS) {
4663	yyerror("allow-opts can only be specified for pass rules");
4664	problems++;
4665	}
4666	if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op \|\|
4667	r->dst.port_op \|\| r->flagset \|\| r->type \|\| r->code)) {
4668	yyerror("fragments can be filtered only on IP header fields");
4669	problems++;
4670	}
4671	if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
4672	yyerror("return-rst can only be applied to TCP rules");
4673	problems++;
4674	}
4675	if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
4676	yyerror("max-src-nodes requires 'source-track rule'");
4677	problems++;
4678	}
4679	if (r->action == PF_DROP && r->keep_state) {
4680	yyerror("keep state on block rules doesn't make sense");
4681	problems++;
4682	}
4683	if (r->rule_flag & PFRULE_STATESLOPPY &&
4684	(r->keep_state == PF_STATE_MODULATE \|\|
4685	r->keep_state == PF_STATE_SYNPROXY)) {
4686	yyerror("sloppy state matching cannot be used with "
4687	"synproxy state or modulate state");
4688	problems++;
4689	}
4690	return (-problems);
4691	}
4692
4693	int
4694	nat_consistent(struct pf_rule *r)
4695	{
4696	return (0); /* yeah! */
4697	}
4698
4699	int
4700	rdr_consistent(struct pf_rule *r)
4701	{
4702	int problems = 0;
4703
4704	if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
4705	if (r->src.port_op) {
4706	yyerror("src port only applies to tcp/udp");
4707	problems++;
4708	}
4709	if (r->dst.port_op) {
4710	yyerror("dst port only applies to tcp/udp");
4711	problems++;
4712	}
4713	if (r->rpool.proxy_port[0]) {
4714	yyerror("rpool port only applies to tcp/udp");
4715	problems++;
4716	}
4717	}
4718	if (r->dst.port_op &&
4719	r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
4720	yyerror("invalid port operator for rdr destination port");
4721	problems++;
4722	}
4723	return (-problems);
4724	}
4725
4726	int
4727	process_tabledef(char name, struct table_opts opts)
4728	{
4729	struct pfr_buffer ab;
4730	struct node_tinit *ti;
4731
4732	bzero(&ab, sizeof(ab));
4733	ab.pfrb_type = PFRB_ADDRS;
4734	SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
4735	if (ti->file)
4736	if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
4737	if (errno)
4738	yyerror("cannot load \"%s\": %s",
4739	ti->file, strerror(errno));
4740	else
4741	yyerror("file \"%s\" contains bad data",
4742	ti->file);
4743	goto _error;
4744	}
4745	if (ti->host)
4746	if (append_addr_host(&ab, ti->host, 0, 0)) {
4747	yyerror("cannot create address buffer: %s",
4748	strerror(errno));
4749	goto _error;
4750	}
4751	}
4752	if (pf->opts & PF_OPT_VERBOSE)
4753	print_tabledef(name, opts->flags, opts->init_addr,
4754	&opts->init_nodes);
4755	if (!(pf->opts & PF_OPT_NOACTION) &&
4756	pfctl_define_table(name, opts->flags, opts->init_addr,
4757	pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) {
4758	yyerror("cannot define table %s: %s", name,
4759	pfr_strerror(errno));
4760	goto _error;
4761	}
4762	pf->tdirty = 1;
4763	pfr_buf_clear(&ab);
4764	return (0);
4765	_error:
4766	pfr_buf_clear(&ab);
4767	return (-1);
4768	}
4769
4770	struct keywords {
4771	const char *k_name;
4772	int k_val;
4773	};
4774
4775	/* macro gore, but you should've seen the prior indentation nightmare... */
4776
4777	#define FREE_LIST(T,r) \
4778	do { \
4779	T p, node = r; \
4780	while (node != NULL) { \
4781	p = node; \
4782	node = node->next; \
4783	free(p); \
4784	} \
4785	} while (0)
4786
4787	#define LOOP_THROUGH(T,n,r,C) \
4788	do { \
4789	T *n; \
4790	if (r == NULL) { \
4791	r = calloc(1, sizeof(T)); \
4792	if (r == NULL) \
4793	err(1, "LOOP: calloc"); \
4794	r->next = NULL; \
4795	} \
4796	n = r; \
4797	while (n != NULL) { \
4798	do { \
4799	C; \
4800	} while (0); \
4801	n = n->next; \
4802	} \
4803	} while (0)
4804
4805	void
4806	expand_label_str(char label, size_t len, const char srch, const char *repl)
4807	{
4808	char *tmp;
4809	char p, q;
4810
4811	if ((tmp = calloc(1, len)) == NULL)
4812	err(1, "expand_label_str: calloc");
4813	p = q = label;
4814	while ((q = strstr(p, srch)) != NULL) {
4815	*q = '\0';
4816	if ((strlcat(tmp, p, len) >= len) \|\|
4817	(strlcat(tmp, repl, len) >= len))
4818	errx(1, "expand_label: label too long");
4819	q += strlen(srch);
4820	p = q;
4821	}
4822	if (strlcat(tmp, p, len) >= len)
4823	errx(1, "expand_label: label too long");
4824	strlcpy(label, tmp, len); /* always fits */
4825	free(tmp);
4826	}
4827
4828	void
4829	expand_label_if(const char name, char label, size_t len, const char *ifname)
4830	{
4831	if (strstr(label, name) != NULL) {
4832	if (!*ifname)
4833	expand_label_str(label, len, name, "any");
4834	else
4835	expand_label_str(label, len, name, ifname);
4836	}
4837	}
4838
4839	void
4840	expand_label_addr(const char name, char label, size_t len, sa_family_t af,
4841	struct node_host *h)
4842	{
4843	char tmp[64], tmp_not[66];
4844
4845	if (strstr(label, name) != NULL) {
4846	switch (h->addr.type) {
4847	case PF_ADDR_DYNIFTL:
4848	snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
4849	break;
4850	case PF_ADDR_TABLE:
4851	snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
4852	break;
4853	case PF_ADDR_NOROUTE:
4854	snprintf(tmp, sizeof(tmp), "no-route");
4855	break;
4856	case PF_ADDR_URPFFAILED:
4857	snprintf(tmp, sizeof(tmp), "urpf-failed");
4858	break;
4859	case PF_ADDR_ADDRMASK:
4860	if (!af \|\| (PF_AZERO(&h->addr.v.a.addr, af) &&
4861	PF_AZERO(&h->addr.v.a.mask, af)))
4862	snprintf(tmp, sizeof(tmp), "any");
4863	else {
4864	char a[48];
4865	int bits;
4866
4867	if (inet_ntop(af, &h->addr.v.a.addr, a,
4868	sizeof(a)) == NULL)
4869	snprintf(tmp, sizeof(tmp), "?");
4870	else {
4871	bits = unmask(&h->addr.v.a.mask, af);
4872	if ((af == AF_INET && bits < 32) \|\|
4873	(af == AF_INET6 && bits < 128))
4874	snprintf(tmp, sizeof(tmp),
4875	"%s/%d", a, bits);
4876	else
4877	snprintf(tmp, sizeof(tmp),
4878	"%s", a);
4879	}
4880	}
4881	break;
4882	default:
4883	snprintf(tmp, sizeof(tmp), "?");
4884	break;
4885	}
4886
4887	if (h->not) {
4888	snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
4889	expand_label_str(label, len, name, tmp_not);
4890	} else
4891	expand_label_str(label, len, name, tmp);
4892	}
4893	}
4894
4895	void
4896	expand_label_port(const char name, char label, size_t len,
4897	struct node_port *port)
4898	{
4899	char a1[6], a2[6], op[13] = "";
4900
4901	if (strstr(label, name) != NULL) {
4902	snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
4903	snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
4904	if (!port->op)
4905	;
4906	else if (port->op == PF_OP_IRG)
4907	snprintf(op, sizeof(op), "%s><%s", a1, a2);
4908	else if (port->op == PF_OP_XRG)
4909	snprintf(op, sizeof(op), "%s<>%s", a1, a2);
4910	else if (port->op == PF_OP_EQ)
4911	snprintf(op, sizeof(op), "%s", a1);
4912	else if (port->op == PF_OP_NE)
4913	snprintf(op, sizeof(op), "!=%s", a1);
4914	else if (port->op == PF_OP_LT)
4915	snprintf(op, sizeof(op), "<%s", a1);
4916	else if (port->op == PF_OP_LE)
4917	snprintf(op, sizeof(op), "<=%s", a1);
4918	else if (port->op == PF_OP_GT)
4919	snprintf(op, sizeof(op), ">%s", a1);
4920	else if (port->op == PF_OP_GE)
4921	snprintf(op, sizeof(op), ">=%s", a1);
4922	expand_label_str(label, len, name, op);
4923	}
4924	}
4925
4926	void
4927	expand_label_proto(const char name, char label, size_t len, u_int8_t proto)
4928	{
4929	struct protoent *pe;
4930	char n[4];
4931
4932	if (strstr(label, name) != NULL) {
4933	pe = getprotobynumber(proto);
4934	if (pe != NULL)
4935	expand_label_str(label, len, name, pe->p_name);
4936	else {
4937	snprintf(n, sizeof(n), "%u", proto);
4938	expand_label_str(label, len, name, n);
4939	}
4940	}
4941	}
4942
4943	void
4944	expand_label_nr(const char name, char label, size_t len)
4945	{
4946	char n[11];
4947
4948	if (strstr(label, name) != NULL) {
4949	snprintf(n, sizeof(n), "%u", pf->anchor->match);
4950	expand_label_str(label, len, name, n);
4951	}
4952	}
4953
4954	void
4955	expand_label(char label, size_t len, const char ifname, sa_family_t af,
4956	struct node_host src_host, struct node_port src_port,
4957	struct node_host dst_host, struct node_port dst_port,
4958	u_int8_t proto)
4959	{
4960	expand_label_if("$if", label, len, ifname);
4961	expand_label_addr("$srcaddr", label, len, af, src_host);
4962	expand_label_addr("$dstaddr", label, len, af, dst_host);
4963	expand_label_port("$srcport", label, len, src_port);
4964	expand_label_port("$dstport", label, len, dst_port);
4965	expand_label_proto("$proto", label, len, proto);
4966	expand_label_nr("$nr", label, len);
4967	}
4968
4969	int
4970	expand_altq(struct pf_altq a, struct node_if interfaces,
4971	struct node_queue *nqueues, struct node_queue_bw bwspec,
4972	struct node_queue_opt *opts)
4973	{
4974	struct pf_altq pa, pb;
4975	char qname[PF_QNAME_SIZE];
4976	struct node_queue *n;
4977	struct node_queue_bw bw;
4978	int errs = 0;
4979
4980	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
4981	FREE_LIST(struct node_if, interfaces);
4982	if (nqueues)
4983	FREE_LIST(struct node_queue, nqueues);
4984	return (0);
4985	}
4986
4987	LOOP_THROUGH(struct node_if, interface, interfaces,
4988	memcpy(&pa, a, sizeof(struct pf_altq));
4989	if (strlcpy(pa.ifname, interface->ifname,
4990	sizeof(pa.ifname)) >= sizeof(pa.ifname))
4991	errx(1, "expand_altq: strlcpy");
4992
4993	if (interface->not) {
4994	yyerror("altq on ! <interface> is not supported");
4995	errs++;
4996	} else {
4997	if (eval_pfaltq(pf, &pa, &bwspec, opts))
4998	errs++;
4999	else
5000	if (pfctl_add_altq(pf, &pa))
5001	errs++;
5002
5003	if (pf->opts & PF_OPT_VERBOSE) {
5004	print_altq(&pf->paltq->altq, 0,
5005	&bwspec, opts);
5006	if (nqueues && nqueues->tail) {
5007	printf("queue { ");
5008	LOOP_THROUGH(struct node_queue, queue,
5009	nqueues,
5010	printf("%s ",
5011	queue->queue);
5012	);
5013	printf("}");
5014	}
5015	printf("\n");
5016	}
5017
5018	if (pa.scheduler == ALTQT_CBQ \|\|
5019	pa.scheduler == ALTQT_HFSC) {
5020	/* now create a root queue */
5021	memset(&pb, 0, sizeof(struct pf_altq));
5022	if (strlcpy(qname, "root_", sizeof(qname)) >=
5023	sizeof(qname))
5024	errx(1, "expand_altq: strlcpy");
5025	if (strlcat(qname, interface->ifname,
5026	sizeof(qname)) >= sizeof(qname))
5027	errx(1, "expand_altq: strlcat");
5028	if (strlcpy(pb.qname, qname,
5029	sizeof(pb.qname)) >= sizeof(pb.qname))
5030	errx(1, "expand_altq: strlcpy");
5031	if (strlcpy(pb.ifname, interface->ifname,
5032	sizeof(pb.ifname)) >= sizeof(pb.ifname))
5033	errx(1, "expand_altq: strlcpy");
5034	pb.qlimit = pa.qlimit;
5035	pb.scheduler = pa.scheduler;
5036	bw.bw_absolute = pa.ifbandwidth;
5037	bw.bw_percent = 0;
5038	if (eval_pfqueue(pf, &pb, &bw, opts))
5039	errs++;
5040	else
5041	if (pfctl_add_altq(pf, &pb))
5042	errs++;
5043	}
5044
5045	LOOP_THROUGH(struct node_queue, queue, nqueues,
5046	n = calloc(1, sizeof(struct node_queue));
5047	if (n == NULL)
5048	err(1, "expand_altq: calloc");
5049	if (pa.scheduler == ALTQT_CBQ \|\|
5050	pa.scheduler == ALTQT_HFSC)
5051	if (strlcpy(n->parent, qname,
5052	sizeof(n->parent)) >=
5053	sizeof(n->parent))
5054	errx(1, "expand_altq: strlcpy");
5055	if (strlcpy(n->queue, queue->queue,
5056	sizeof(n->queue)) >= sizeof(n->queue))
5057	errx(1, "expand_altq: strlcpy");
5058	if (strlcpy(n->ifname, interface->ifname,
5059	sizeof(n->ifname)) >= sizeof(n->ifname))
5060	errx(1, "expand_altq: strlcpy");
5061	n->scheduler = pa.scheduler;
5062	n->next = NULL;
5063	n->tail = n;
5064	if (queues == NULL)
5065	queues = n;
5066	else {
5067	queues->tail->next = n;
5068	queues->tail = n;
5069	}
5070	);
5071	}
5072	);
5073	FREE_LIST(struct node_if, interfaces);
5074	if (nqueues)
5075	FREE_LIST(struct node_queue, nqueues);
5076
5077	return (errs);
5078	}
5079
5080	int
5081	expand_queue(struct pf_altq a, struct node_if interfaces,
5082	struct node_queue *nqueues, struct node_queue_bw bwspec,
5083	struct node_queue_opt *opts)
5084	{
5085	struct node_queue n, nq;
5086	struct pf_altq pa;
5087	u_int8_t found = 0;
5088	u_int8_t errs = 0;
5089
5090	if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
5091	FREE_LIST(struct node_queue, nqueues);
5092	return (0);
5093	}
5094
5095	if (queues == NULL) {
5096	yyerror("queue %s has no parent", a->qname);
5097	FREE_LIST(struct node_queue, nqueues);
5098	return (1);
5099	}
5100
5101	LOOP_THROUGH(struct node_if, interface, interfaces,
5102	LOOP_THROUGH(struct node_queue, tqueue, queues,
5103	if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
5104	(interface->ifname[0] == 0 \|\|
5105	(!interface->not && !strncmp(interface->ifname,
5106	tqueue->ifname, IFNAMSIZ)) \|\|
5107	(interface->not && strncmp(interface->ifname,
5108	tqueue->ifname, IFNAMSIZ)))) {
5109	/* found ourself in queues */
5110	found++;
5111
5112	memcpy(&pa, a, sizeof(struct pf_altq));
5113
5114	if (pa.scheduler != ALTQT_NONE &&
5115	pa.scheduler != tqueue->scheduler) {
5116	yyerror("exactly one scheduler type "
5117	"per interface allowed");
5118	return (1);
5119	}
5120	pa.scheduler = tqueue->scheduler;
5121
5122	/* scheduler dependent error checking */
5123	switch (pa.scheduler) {
5124	case ALTQT_PRIQ:
5125	if (nqueues != NULL) {
5126	yyerror("priq queues cannot "
5127	"have child queues");
5128	return (1);
5129	}
5130	if (bwspec.bw_absolute > 0 \|\|
5131	bwspec.bw_percent < 100) {
5132	yyerror("priq doesn't take "
5133	"bandwidth");
5134	return (1);
5135	}
5136	break;
5137	default:
5138	break;
5139	}
5140
5141	if (strlcpy(pa.ifname, tqueue->ifname,
5142	sizeof(pa.ifname)) >= sizeof(pa.ifname))
5143	errx(1, "expand_queue: strlcpy");
5144	if (strlcpy(pa.parent, tqueue->parent,
5145	sizeof(pa.parent)) >= sizeof(pa.parent))
5146	errx(1, "expand_queue: strlcpy");
5147
5148	if (eval_pfqueue(pf, &pa, &bwspec, opts))
5149	errs++;
5150	else
5151	if (pfctl_add_altq(pf, &pa))
5152	errs++;
5153
5154	for (nq = nqueues; nq != NULL; nq = nq->next) {
5155	if (!strcmp(a->qname, nq->queue)) {
5156	yyerror("queue cannot have "
5157	"itself as child");
5158	errs++;
5159	continue;
5160	}
5161	n = calloc(1,
5162	sizeof(struct node_queue));
5163	if (n == NULL)
5164	err(1, "expand_queue: calloc");
5165	if (strlcpy(n->parent, a->qname,
5166	sizeof(n->parent)) >=
5167	sizeof(n->parent))
5168	errx(1, "expand_queue strlcpy");
5169	if (strlcpy(n->queue, nq->queue,
5170	sizeof(n->queue)) >=
5171	sizeof(n->queue))
5172	errx(1, "expand_queue strlcpy");
5173	if (strlcpy(n->ifname, tqueue->ifname,
5174	sizeof(n->ifname)) >=
5175	sizeof(n->ifname))
5176	errx(1, "expand_queue strlcpy");
5177	n->scheduler = tqueue->scheduler;
5178	n->next = NULL;
5179	n->tail = n;
5180	if (queues == NULL)
5181	queues = n;
5182	else {
5183	queues->tail->next = n;
5184	queues->tail = n;
5185	}
5186	}
5187	if ((pf->opts & PF_OPT_VERBOSE) && (
5188	(found == 1 && interface->ifname[0] == 0) \|\|
5189	(found > 0 && interface->ifname[0] != 0))) {
5190	print_queue(&pf->paltq->altq, 0,
5191	&bwspec, interface->ifname[0] != 0,
5192	opts);
5193	if (nqueues && nqueues->tail) {
5194	printf("{ ");
5195	LOOP_THROUGH(struct node_queue,
5196	queue, nqueues,
5197	printf("%s ",
5198	queue->queue);
5199	);
5200	printf("}");
5201	}
5202	printf("\n");
5203	}
5204	}
5205	);
5206	);
5207
5208	FREE_LIST(struct node_queue, nqueues);
5209	FREE_LIST(struct node_if, interfaces);
5210
5211	if (!found) {
5212	yyerror("queue %s has no parent", a->qname);
5213	errs++;
5214	}
5215
5216	if (errs)
5217	return (1);
5218	else
5219	return (0);
5220	}
5221
5222	void
5223	expand_rule(struct pf_rule *r,
5224	struct node_if interfaces, struct node_host rpool_hosts,
5225	struct node_proto protos, struct node_os src_oses,
5226	struct node_host src_hosts, struct node_port src_ports,
5227	struct node_host dst_hosts, struct node_port dst_ports,
5228	struct node_uid uids, struct node_gid gids, struct node_icmp *icmp_types,
5229	const char *anchor_call)
5230	{
5231	sa_family_t af = r->af;
5232	int added = 0, error = 0;
5233	char ifname[IF_NAMESIZE];
5234	char label[PF_RULE_LABEL_SIZE];
5235	char tagname[PF_TAG_NAME_SIZE];
5236	char match_tagname[PF_TAG_NAME_SIZE];
5237	struct pf_pooladdr *pa;
5238	struct node_host *h;
5239	u_int8_t flags, flagset, keep_state;
5240
5241	if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
5242	errx(1, "expand_rule: strlcpy");
5243	if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
5244	errx(1, "expand_rule: strlcpy");
5245	if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
5246	sizeof(match_tagname))
5247	errx(1, "expand_rule: strlcpy");
5248	flags = r->flags;
5249	flagset = r->flagset;
5250	keep_state = r->keep_state;
5251
5252	LOOP_THROUGH(struct node_if, interface, interfaces,
5253	LOOP_THROUGH(struct node_proto, proto, protos,
5254	LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
5255	LOOP_THROUGH(struct node_host, src_host, src_hosts,
5256	LOOP_THROUGH(struct node_port, src_port, src_ports,
5257	LOOP_THROUGH(struct node_os, src_os, src_oses,
5258	LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
5259	LOOP_THROUGH(struct node_port, dst_port, dst_ports,
5260	LOOP_THROUGH(struct node_uid, uid, uids,
5261	LOOP_THROUGH(struct node_gid, gid, gids,
5262
5263	r->af = af;
5264	/* for link-local IPv6 address, interface must match up */
5265	if ((r->af && src_host->af && r->af != src_host->af) \|\|
5266	(r->af && dst_host->af && r->af != dst_host->af) \|\|
5267	(src_host->af && dst_host->af &&
5268	src_host->af != dst_host->af) \|\|
5269	(src_host->ifindex && dst_host->ifindex &&
5270	src_host->ifindex != dst_host->ifindex) \|\|
5271	(src_host->ifindex && *interface->ifname &&
5272	src_host->ifindex != if_nametoindex(interface->ifname)) \|\|
5273	(dst_host->ifindex && *interface->ifname &&
5274	dst_host->ifindex != if_nametoindex(interface->ifname)))
5275	continue;
5276	if (!r->af && src_host->af)
5277	r->af = src_host->af;
5278	else if (!r->af && dst_host->af)
5279	r->af = dst_host->af;
5280
5281	if (*interface->ifname)
5282	strlcpy(r->ifname, interface->ifname,
5283	sizeof(r->ifname));
5284	else if (if_indextoname(src_host->ifindex, ifname))
5285	strlcpy(r->ifname, ifname, sizeof(r->ifname));
5286	else if (if_indextoname(dst_host->ifindex, ifname))
5287	strlcpy(r->ifname, ifname, sizeof(r->ifname));
5288	else
5289	memset(r->ifname, '\0', sizeof(r->ifname));
5290
5291	if (strlcpy(r->label, label, sizeof(r->label)) >=
5292	sizeof(r->label))
5293	errx(1, "expand_rule: strlcpy");
5294	if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
5295	sizeof(r->tagname))
5296	errx(1, "expand_rule: strlcpy");
5297	if (strlcpy(r->match_tagname, match_tagname,
5298	sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
5299	errx(1, "expand_rule: strlcpy");
5300	expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
5301	src_host, src_port, dst_host, dst_port, proto->proto);
5302	expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
5303	src_host, src_port, dst_host, dst_port, proto->proto);
5304	expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
5305	r->af, src_host, src_port, dst_host, dst_port,
5306	proto->proto);
5307
5308	error += check_netmask(src_host, r->af);
5309	error += check_netmask(dst_host, r->af);
5310
5311	r->ifnot = interface->not;
5312	r->proto = proto->proto;
5313	r->src.addr = src_host->addr;
5314	r->src.neg = src_host->not;
5315	r->src.port[0] = src_port->port[0];
5316	r->src.port[1] = src_port->port[1];
5317	r->src.port_op = src_port->op;
5318	r->dst.addr = dst_host->addr;
5319	r->dst.neg = dst_host->not;
5320	r->dst.port[0] = dst_port->port[0];
5321	r->dst.port[1] = dst_port->port[1];
5322	r->dst.port_op = dst_port->op;
5323	r->uid.op = uid->op;
5324	r->uid.uid[0] = uid->uid[0];
5325	r->uid.uid[1] = uid->uid[1];
5326	r->gid.op = gid->op;
5327	r->gid.gid[0] = gid->gid[0];
5328	r->gid.gid[1] = gid->gid[1];
5329	r->type = icmp_type->type;
5330	r->code = icmp_type->code;
5331
5332	if ((keep_state == PF_STATE_MODULATE \|\|
5333	keep_state == PF_STATE_SYNPROXY) &&
5334	r->proto && r->proto != IPPROTO_TCP)
5335	r->keep_state = PF_STATE_NORMAL;
5336	else
5337	r->keep_state = keep_state;
5338
5339	if (r->proto && r->proto != IPPROTO_TCP) {
5340	r->flags = 0;
5341	r->flagset = 0;
5342	} else {
5343	r->flags = flags;
5344	r->flagset = flagset;
5345	}
5346	if (icmp_type->proto && r->proto != icmp_type->proto) {
5347	yyerror("icmp-type mismatch");
5348	error++;
5349	}
5350
5351	if (src_os && src_os->os) {
5352	r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
5353	if ((pf->opts & PF_OPT_VERBOSE2) &&
5354	r->os_fingerprint == PF_OSFP_NOMATCH)
5355	fprintf(stderr,
5356	"warning: unknown '%s' OS fingerprint\n",
5357	src_os->os);
5358	} else {
5359	r->os_fingerprint = PF_OSFP_ANY;
5360	}
5361
5362	TAILQ_INIT(&r->rpool.list);
5363	for (h = rpool_hosts; h != NULL; h = h->next) {
5364	pa = calloc(1, sizeof(struct pf_pooladdr));
5365	if (pa == NULL)
5366	err(1, "expand_rule: calloc");
5367	pa->addr = h->addr;
5368	if (h->ifname != NULL) {
5369	if (strlcpy(pa->ifname, h->ifname,
5370	sizeof(pa->ifname)) >=
5371	sizeof(pa->ifname))
5372	errx(1, "expand_rule: strlcpy");
5373	} else
5374	pa->ifname[0] = 0;
5375	TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
5376	}
5377
5378	if (rule_consistent(r, anchor_call[0]) < 0 \|\| error)
5379	yyerror("skipping rule due to errors");
5380	else {
5381	r->nr = pf->astack[pf->asd]->match++;
5382	pfctl_add_rule(pf, r, anchor_call);
5383	added++;
5384	}
5385
5386	))))))))));
5387
5388	FREE_LIST(struct node_if, interfaces);
5389	FREE_LIST(struct node_proto, protos);
5390	FREE_LIST(struct node_host, src_hosts);
5391	FREE_LIST(struct node_port, src_ports);
5392	FREE_LIST(struct node_os, src_oses);
5393	FREE_LIST(struct node_host, dst_hosts);
5394	FREE_LIST(struct node_port, dst_ports);
5395	FREE_LIST(struct node_uid, uids);
5396	FREE_LIST(struct node_gid, gids);
5397	FREE_LIST(struct node_icmp, icmp_types);
5398	FREE_LIST(struct node_host, rpool_hosts);
5399
5400	if (!added)
5401	yyerror("rule expands to no valid combination");
5402	}
5403
5404	int
5405	expand_skip_interface(struct node_if *interfaces)
5406	{
5407	int errs = 0;
5408
5409	if (!interfaces \|\| (!interfaces->next && !interfaces->not &&
5410	!strcmp(interfaces->ifname, "none"))) {
5411	if (pf->opts & PF_OPT_VERBOSE)
5412	printf("set skip on none\n");
5413	errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
5414	return (errs);
5415	}
5416
5417	if (pf->opts & PF_OPT_VERBOSE)
5418	printf("set skip on {");
5419	LOOP_THROUGH(struct node_if, interface, interfaces,
5420	if (pf->opts & PF_OPT_VERBOSE)
5421	printf(" %s", interface->ifname);
5422	if (interface->not) {
5423	yyerror("skip on ! <interface> is not supported");
5424	errs++;
5425	} else
5426	errs += pfctl_set_interface_flags(pf,
5427	interface->ifname, PFI_IFLAG_SKIP, 1);
5428	);
5429	if (pf->opts & PF_OPT_VERBOSE)
5430	printf(" }\n");
5431
5432	FREE_LIST(struct node_if, interfaces);
5433
5434	if (errs)
5435	return (1);
5436	else
5437	return (0);
5438	}
5439
5440	#undef FREE_LIST
5441	#undef LOOP_THROUGH
5442
5443	int
5444	check_rulestate(int desired_state)
5445	{
5446	if (require_order && (rulestate > desired_state)) {
5447	yyerror("Rules must be in order: options, normalization, "
5448	"queueing, translation, filtering");
5449	return (1);
5450	}
5451	rulestate = desired_state;
5452	return (0);
5453	}
5454
5455	int
5456	kw_cmp(const void k, const void e)
5457	{
5458	return (strcmp(k, ((const struct keywords *)e)->k_name));
5459	}
5460
5461	int
5462	lookup(char *s)
5463	{
5464	/* this has to be sorted always */
5465	static const struct keywords keywords[] = {
5466	{ "all", ALL},
5467	{ "allow-opts", ALLOWOPTS},
5468	{ "altq", ALTQ},
5469	{ "anchor", ANCHOR},
5470	{ "antispoof", ANTISPOOF},
5471	{ "any", ANY},
5472	{ "bandwidth", BANDWIDTH},
5473	{ "binat", BINAT},
5474	{ "binat-anchor", BINATANCHOR},
5475	{ "bitmask", BITMASK},
5476	{ "block", BLOCK},
5477	{ "block-policy", BLOCKPOLICY},
5478	{ "buckets", BUCKETS},
5479	{ "cbq", CBQ},
5480	{ "code", CODE},
5481	{ "codelq", CODEL},
5482	{ "crop", FRAGCROP},
5483	{ "debug", DEBUG},
5484	{ "divert-reply", DIVERTREPLY},
5485	{ "divert-to", DIVERTTO},
5486	{ "drop", DROP},
5487	{ "drop-ovl", FRAGDROP},
5488	{ "dup-to", DUPTO},
5489	{ "fairq", FAIRQ},
5490	{ "fastroute", FASTROUTE},
5491	{ "file", FILENAME},
5492	{ "fingerprints", FINGERPRINTS},
5493	{ "flags", FLAGS},
5494	{ "floating", FLOATING},
5495	{ "flush", FLUSH},
5496	{ "for", FOR},
5497	{ "fragment", FRAGMENT},
5498	{ "from", FROM},
5499	{ "global", GLOBAL},
5500	{ "group", GROUP},
5501	{ "hfsc", HFSC},
5502	{ "hogs", HOGS},
5503	{ "hostid", HOSTID},
5504	{ "icmp-type", ICMPTYPE},
5505	{ "icmp6-type", ICMP6TYPE},
5506	{ "if-bound", IFBOUND},
5507	{ "in", IN},
5508	{ "include", INCLUDE},
5509	{ "inet", INET},
5510	{ "inet6", INET6},
5511	{ "interval", INTERVAL},
5512	{ "keep", KEEP},
5513	{ "label", LABEL},
5514	{ "limit", LIMIT},
5515	{ "linkshare", LINKSHARE},
5516	{ "load", LOAD},
5517	{ "log", LOG},
5518	{ "loginterface", LOGINTERFACE},
5519	{ "max", MAXIMUM},
5520	{ "max-mss", MAXMSS},
5521	{ "max-src-conn", MAXSRCCONN},
5522	{ "max-src-conn-rate", MAXSRCCONNRATE},
5523	{ "max-src-nodes", MAXSRCNODES},
5524	{ "max-src-states", MAXSRCSTATES},
5525	{ "min-ttl", MINTTL},
5526	{ "modulate", MODULATE},
5527	{ "nat", NAT},
5528	{ "nat-anchor", NATANCHOR},
5529	{ "no", NO},
5530	{ "no-df", NODF},
5531	{ "no-route", NOROUTE},
5532	{ "no-sync", NOSYNC},
5533	{ "on", ON},
5534	{ "optimization", OPTIMIZATION},
5535	{ "os", OS},
5536	{ "out", OUT},
5537	{ "overload", OVERLOAD},
5538	{ "pass", PASS},
5539	{ "port", PORT},
5540	{ "prio", PRIO},
5541	{ "priority", PRIORITY},
5542	{ "priq", PRIQ},
5543	{ "probability", PROBABILITY},
5544	{ "proto", PROTO},
5545	{ "qlimit", QLIMIT},
5546	{ "queue", QUEUE},
5547	{ "quick", QUICK},
5548	{ "random", RANDOM},
5549	{ "random-id", RANDOMID},
5550	{ "rdr", RDR},
5551	{ "rdr-anchor", RDRANCHOR},
5552	{ "realtime", REALTIME},
5553	{ "reassemble", REASSEMBLE},
5554	{ "reply-to", REPLYTO},
5555	{ "require-order", REQUIREORDER},
5556	{ "return", RETURN},
5557	{ "return-icmp", RETURNICMP},
5558	{ "return-icmp6", RETURNICMP6},
5559	{ "return-rst", RETURNRST},
5560	{ "round-robin", ROUNDROBIN},
5561	{ "route", ROUTE},
5562	{ "route-to", ROUTETO},
5563	{ "rtable", RTABLE},
5564	{ "rule", RULE},
5565	{ "ruleset-optimization", RULESET_OPTIMIZATION},
5566	{ "scrub", SCRUB},
5567	{ "set", SET},
5568	{ "set-tos", SETTOS},
5569	{ "skip", SKIP},
5570	{ "sloppy", SLOPPY},
5571	{ "source-hash", SOURCEHASH},
5572	{ "source-track", SOURCETRACK},
5573	{ "state", STATE},
5574	{ "state-defaults", STATEDEFAULTS},
5575	{ "state-policy", STATEPOLICY},
5576	{ "static-port", STATICPORT},
5577	{ "sticky-address", STICKYADDRESS},
5578	{ "synproxy", SYNPROXY},
5579	{ "table", TABLE},
5580	{ "tag", TAG},
5581	{ "tagged", TAGGED},
5582	{ "target", TARGET},
5583	{ "tbrsize", TBRSIZE},
5584	{ "timeout", TIMEOUT},
5585	{ "to", TO},
5586	{ "tos", TOS},
5587	{ "ttl", TTL},
5588	{ "upperlimit", UPPERLIMIT},
5589	{ "urpf-failed", URPFFAILED},
5590	{ "user", USER},
5591	};
5592	const struct keywords *p;
5593
5594	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
5595	sizeof(keywords[0]), kw_cmp);
5596
5597	if (p) {
5598	if (debug > 1)
5599	fprintf(stderr, "%s: %d\n", s, p->k_val);
5600	return (p->k_val);
5601	} else {
5602	if (debug > 1)
5603	fprintf(stderr, "string: %s\n", s);
5604	return (STRING);
5605	}
5606	}
5607
5608	#define MAXPUSHBACK 128
5609
5610	static char *parsebuf;
5611	static int parseindex;
5612	static char pushback_buffer[MAXPUSHBACK];
5613	static int pushback_index = 0;
5614
5615	int
5616	lgetc(int quotec)
5617	{
5618	int c, next;
5619
5620	if (parsebuf) {
5621	/* Read character from the parsebuffer instead of input. */
5622	if (parseindex >= 0) {
5623	c = parsebuf[parseindex++];
5624	if (c != '\0')
5625	return (c);
5626	parsebuf = NULL;
5627	} else
5628	parseindex++;
5629	}
5630
5631	if (pushback_index)
5632	return (pushback_buffer[--pushback_index]);
5633
5634	if (quotec) {
5635	if ((c = getc(file->stream)) == EOF) {
5636	yyerror("reached end of file while parsing quoted string");
5637	if (popfile() == EOF)
5638	return (EOF);
5639	return (quotec);
5640	}
5641	return (c);
5642	}
5643
5644	while ((c = getc(file->stream)) == '\\') {
5645	next = getc(file->stream);
5646	if (next != '\n') {
5647	c = next;
5648	break;
5649	}
5650	yylval.lineno = file->lineno;
5651	file->lineno++;
5652	}
5653
5654	while (c == EOF) {
5655	if (popfile() == EOF)
5656	return (EOF);
5657	c = getc(file->stream);
5658	}
5659	return (c);
5660	}
5661
5662	int
5663	lungetc(int c)
5664	{
5665	if (c == EOF)
5666	return (EOF);
5667	if (parsebuf) {
5668	parseindex--;
5669	if (parseindex >= 0)
5670	return (c);
5671	}
5672	if (pushback_index < MAXPUSHBACK-1)
5673	return (pushback_buffer[pushback_index++] = c);
5674	else
5675	return (EOF);
5676	}
5677
5678	int
5679	findeol(void)
5680	{
5681	int c;
5682
5683	parsebuf = NULL;
5684
5685	/* skip to either EOF or the first real EOL */
5686	while (1) {
5687	if (pushback_index)
5688	c = pushback_buffer[--pushback_index];
5689	else
5690	c = lgetc(0);
5691	if (c == '\n') {
5692	file->lineno++;
5693	break;
5694	}
5695	if (c == EOF)
5696	break;
5697	}
5698	return (ERROR);
5699	}
5700
5701	int
5702	yylex(void)
5703	{
5704	char buf[8096];
5705	char p, val;
5706	int quotec, next, c;
5707	int token;
5708
5709	top:
5710	p = buf;
5711	while ((c = lgetc(0)) == ' ' \|\| c == '\t')
5712	; /* nothing */
5713
5714	yylval.lineno = file->lineno;
5715	if (c == '#')
5716	while ((c = lgetc(0)) != '\n' && c != EOF)
5717	; /* nothing */
5718	if (c == '$' && parsebuf == NULL) {
5719	while (1) {
5720	if ((c = lgetc(0)) == EOF)
5721	return (0);
5722
5723	if (p + 1 >= buf + sizeof(buf) - 1) {
5724	yyerror("string too long");
5725	return (findeol());
5726	}
5727	if (isalnum(c) \|\| c == '_') {
5728	*p++ = (char)c;
5729	continue;
5730	}
5731	*p = '\0';
5732	lungetc(c);
5733	break;
5734	}
5735	val = symget(buf);
5736	if (val == NULL) {
5737	yyerror("macro '%s' not defined", buf);
5738	return (findeol());
5739	}
5740	parsebuf = val;
5741	parseindex = 0;
5742	goto top;
5743	}
5744
5745	switch (c) {
5746	case '\'':
5747	case '"':
5748	quotec = c;
5749	while (1) {
5750	if ((c = lgetc(quotec)) == EOF)
5751	return (0);
5752	if (c == '\n') {
5753	file->lineno++;
5754	continue;
5755	} else if (c == '\\') {
5756	if ((next = lgetc(quotec)) == EOF)
5757	return (0);
5758	if (next == quotec \|\| c == ' ' \|\| c == '\t')
5759	c = next;
5760	else if (next == '\n')
5761	continue;
5762	else
5763	lungetc(next);
5764	} else if (c == quotec) {
5765	*p = '\0';
5766	break;
5767	}
5768	if (p + 1 >= buf + sizeof(buf) - 1) {
5769	yyerror("string too long");
5770	return (findeol());
5771	}
5772	*p++ = (char)c;
5773	}
5774	yylval.v.string = strdup(buf);
5775	if (yylval.v.string == NULL)
5776	err(1, "yylex: strdup");
5777	return (STRING);
5778	case '<':
5779	next = lgetc(0);
5780	if (next == '>') {
5781	yylval.v.i = PF_OP_XRG;
5782	return (PORTBINARY);
5783	}
5784	lungetc(next);
5785	break;
5786	case '>':
5787	next = lgetc(0);
5788	if (next == '<') {
5789	yylval.v.i = PF_OP_IRG;
5790	return (PORTBINARY);
5791	}
5792	lungetc(next);
5793	break;
5794	case '-':
5795	next = lgetc(0);
5796	if (next == '>')
5797	return (ARROW);
5798	lungetc(next);
5799	break;
5800	}
5801
5802	#define allowed_to_end_number(x) \
5803	(isspace(x) \|\| x == ')' \|\| x ==',' \|\| x == '/' \|\| x == '}' \|\| x == '=')
5804
5805	if (c == '-' \|\| isdigit(c)) {
5806	do {
5807	*p++ = c;
5808	if ((unsigned)(p-buf) >= sizeof(buf)) {
5809	yyerror("string too long");
5810	return (findeol());
5811	}
5812	} while ((c = lgetc(0)) != EOF && isdigit(c));
5813	lungetc(c);
5814	if (p == buf + 1 && buf[0] == '-')
5815	goto nodigits;
5816	if (c == EOF \|\| allowed_to_end_number(c)) {
5817	const char *errstr = NULL;
5818
5819	*p = '\0';
5820	yylval.v.number = strtonum(buf, LLONG_MIN,
5821	LLONG_MAX, &errstr);
5822	if (errstr) {
5823	yyerror("\"%s\" invalid number: %s",
5824	buf, errstr);
5825	return (findeol());
5826	}
5827	return (NUMBER);
5828	} else {
5829	nodigits:
5830	while (p > buf + 1)
5831	lungetc(*--p);
5832	c = *--p;
5833	if (c == '-')
5834	return (c);
5835	}
5836	}
5837
5838	#define allowed_in_string(x) \
5839	(isalnum(x) \|\| (ispunct(x) && x != '(' && x != ')' && \
5840	x != '{' && x != '}' && x != '<' && x != '>' && \
5841	x != '!' && x != '=' && x != '/' && x != '#' && \
5842	x != ','))
5843
5844	if (isalnum(c) \|\| c == ':' \|\| c == '_') {
5845	do {
5846	*p++ = c;
5847	if ((unsigned)(p-buf) >= sizeof(buf)) {
5848	yyerror("string too long");
5849	return (findeol());
5850	}
5851	} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
5852	lungetc(c);
5853	*p = '\0';
5854	if ((token = lookup(buf)) == STRING)
5855	if ((yylval.v.string = strdup(buf)) == NULL)
5856	err(1, "yylex: strdup");
5857	return (token);
5858	}
5859	if (c == '\n') {
5860	yylval.lineno = file->lineno;
5861	file->lineno++;
5862	}
5863	if (c == EOF)
5864	return (0);
5865	return (c);
5866	}
5867
5868	int
5869	check_file_secrecy(int fd, const char *fname)
5870	{
5871	struct stat st;
5872
5873	if (fstat(fd, &st)) {
5874	warn("cannot stat %s", fname);
5875	return (-1);
5876	}
5877	if (st.st_uid != 0 && st.st_uid != getuid()) {
5878	warnx("%s: owner not root or current user", fname);
5879	return (-1);
5880	}
5881	if (st.st_mode & (S_IRWXG \| S_IRWXO)) {
5882	warnx("%s: group/world readable/writeable", fname);
5883	return (-1);
5884	}
5885	return (0);
5886	}
5887
5888	struct file *
5889	pushfile(const char *name, int secret)
5890	{
5891	struct file *nfile;
5892
5893	if ((nfile = calloc(1, sizeof(struct file))) == NULL \|\|
5894	(nfile->name = strdup(name)) == NULL) {
5895	warn("malloc");
5896	return (NULL);
5897	}
5898	if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) {
5899	nfile->stream = stdin;
5900	free(nfile->name);
5901	if ((nfile->name = strdup("stdin")) == NULL) {
5902	warn("strdup");
5903	free(nfile);
5904	return (NULL);
5905	}
5906	} else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
5907	warn("%s", nfile->name);
5908	free(nfile->name);
5909	free(nfile);
5910	return (NULL);
5911	} else if (secret &&
5912	check_file_secrecy(fileno(nfile->stream), nfile->name)) {
5913	fclose(nfile->stream);
5914	free(nfile->name);
5915	free(nfile);
5916	return (NULL);
5917	}
5918	nfile->lineno = 1;
5919	TAILQ_INSERT_TAIL(&files, nfile, entry);
5920	return (nfile);
5921	}
5922
5923	int
5924	popfile(void)
5925	{
5926	struct file *prev;
5927
5928	if ((prev = TAILQ_PREV(file, files, entry)) != NULL) {
5929	prev->errors += file->errors;
5930	TAILQ_REMOVE(&files, file, entry);
5931	fclose(file->stream);
5932	free(file->name);
5933	free(file);
5934	file = prev;
5935	return (0);
5936	}
5937	return (EOF);
5938	}
5939
5940	int
5941	parse_config(char filename, struct pfctl xpf)
5942	{
5943	int errors = 0;
5944	struct sym *sym;
5945
5946	pf = xpf;
5947	errors = 0;
5948	rulestate = PFCTL_STATE_NONE;
5949	returnicmpdefault = (ICMP_UNREACH << 8) \| ICMP_UNREACH_PORT;
5950	returnicmp6default =
5951	(ICMP6_DST_UNREACH << 8) \| ICMP6_DST_UNREACH_NOPORT;
5952	blockpolicy = PFRULE_DROP;
5953	require_order = 1;
5954
5955	if ((file = pushfile(filename, 0)) == NULL) {
5956	warn("cannot open the main config file!");
5957	return (-1);
5958	}
5959
5960	yyparse();
5961	errors = file->errors;
5962	popfile();
5963
5964	/* Free macros and check which have not been used. */
5965	while ((sym = TAILQ_FIRST(&symhead))) {
5966	if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
5967	fprintf(stderr, "warning: macro '%s' not "
5968	"used\n", sym->nam);
5969	free(sym->nam);
5970	free(sym->val);
5971	TAILQ_REMOVE(&symhead, sym, entry);
5972	free(sym);
5973	}
5974
5975	return (errors ? -1 : 0);
5976	}
5977
5978	int
5979	symset(const char nam, const char val, int persist)
5980	{
5981	struct sym *sym;
5982
5983	for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
5984	sym = TAILQ_NEXT(sym, entry))
5985	; /* nothing */
5986
5987	if (sym != NULL) {
5988	if (sym->persist == 1)
5989	return (0);
5990	else {
5991	free(sym->nam);
5992	free(sym->val);
5993	TAILQ_REMOVE(&symhead, sym, entry);
5994	free(sym);
5995	}
5996	}
5997	if ((sym = calloc(1, sizeof(*sym))) == NULL)
5998	return (-1);
5999
6000	sym->nam = strdup(nam);
6001	if (sym->nam == NULL) {
6002	free(sym);
6003	return (-1);
6004	}
6005	sym->val = strdup(val);
6006	if (sym->val == NULL) {
6007	free(sym->nam);
6008	free(sym);
6009	return (-1);
6010	}
6011	sym->used = 0;
6012	sym->persist = persist;
6013	TAILQ_INSERT_TAIL(&symhead, sym, entry);
6014	return (0);
6015	}
6016
6017	int
6018	pfctl_cmdline_symset(char *s)
6019	{
6020	char sym, val;
6021	int ret;
6022
6023	if ((val = strrchr(s, '=')) == NULL)
6024	return (-1);
6025
6026	if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
6027	err(1, "pfctl_cmdline_symset: malloc");
6028
6029	strlcpy(sym, s, strlen(s) - strlen(val) + 1);
6030
6031	ret = symset(sym, val + 1, 1);
6032	free(sym);
6033
6034	return (ret);
6035	}
6036
6037	char *
6038	symget(const char *nam)
6039	{
6040	struct sym *sym;
6041
6042	TAILQ_FOREACH(sym, &symhead, entry)
6043	if (strcmp(nam, sym->nam) == 0) {
6044	sym->used = 1;
6045	return (sym->val);
6046	}
6047	return (NULL);
6048	}
6049
6050	void
6051	mv_rules(struct pf_ruleset src, struct pf_ruleset dst)
6052	{
6053	int i;
6054	struct pf_rule *r;
6055
6056	for (i = 0; i < PF_RULESET_MAX; ++i) {
6057	while ((r = TAILQ_FIRST(src->rules[i].active.ptr))
6058	!= NULL) {
6059	TAILQ_REMOVE(src->rules[i].active.ptr, r, entries);
6060	TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries);
6061	dst->anchor->match++;
6062	}
6063	src->anchor->match = 0;
6064	while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr))
6065	!= NULL) {
6066	TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries);
6067	TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr,
6068	r, entries);
6069	}
6070	}
6071	}
6072
6073	void
6074	decide_address_family(struct node_host n, sa_family_t af)
6075	{
6076	if (*af != 0 \|\| n == NULL)
6077	return;
6078	*af = n->af;
6079	while ((n = n->next) != NULL) {
6080	if (n->af != *af) {
6081	*af = 0;
6082	return;
6083	}
6084	}
6085	}
6086
6087	void
6088	remove_invalid_hosts(struct node_host *nh, sa_family_t af)
6089	{
6090	struct node_host n = nh, *prev = NULL;
6091
6092	while (n != NULL) {
6093	if (af && n->af && n->af != af) {
6094	/* unlink and free n */
6095	struct node_host *next = n->next;
6096
6097	/* adjust tail pointer */
6098	if (n == (*nh)->tail)
6099	(*nh)->tail = prev;
6100	/* adjust previous node's next pointer */
6101	if (prev == NULL)
6102	*nh = next;
6103	else
6104	prev->next = next;
6105	/* free node */
6106	if (n->ifname != NULL)
6107	free(n->ifname);
6108	free(n);
6109	n = next;
6110	} else {
6111	if (n->af && !*af)
6112	*af = n->af;
6113	prev = n;
6114	n = n->next;
6115	}
6116	}
6117	}
6118
6119	int
6120	invalid_redirect(struct node_host *nh, sa_family_t af)
6121	{
6122	if (!af) {
6123	struct node_host *n;
6124
6125	/* tables and dyniftl are ok without an address family */
6126	for (n = nh; n != NULL; n = n->next) {
6127	if (n->addr.type != PF_ADDR_TABLE &&
6128	n->addr.type != PF_ADDR_DYNIFTL) {
6129	yyerror("address family not given and "
6130	"translation address expands to multiple "
6131	"address families");
6132	return (1);
6133	}
6134	}
6135	}
6136	if (nh == NULL) {
6137	yyerror("no translation address with matching address family "
6138	"found.");
6139	return (1);
6140	}
6141	return (0);
6142	}
6143
6144	int
6145	atoul(char s, u_long ulvalp)
6146	{
6147	u_long ulval;
6148	char *ep;
6149
6150	errno = 0;
6151	ulval = strtoul(s, &ep, 0);
6152	if (s[0] == '\0' \|\| *ep != '\0')
6153	return (-1);
6154	if (errno == ERANGE && ulval == ULONG_MAX)
6155	return (-1);
6156	*ulvalp = ulval;
6157	return (0);
6158	}
6159
6160	int
6161	getservice(char *n)
6162	{
6163	struct servent *s;
6164	u_long ulval;
6165
6166	if (atoul(n, &ulval) == 0) {
6167	if (ulval > 65535) {
6168	yyerror("illegal port value %lu", ulval);
6169	return (-1);
6170	}
6171	return (htons(ulval));
6172	} else {
6173	s = getservbyname(n, "tcp");
6174	if (s == NULL)
6175	s = getservbyname(n, "udp");
6176	if (s == NULL) {
6177	yyerror("unknown port %s", n);
6178	return (-1);
6179	}
6180	return (s->s_port);
6181	}
6182	}
6183
6184	int
6185	rule_label(struct pf_rule r, char s)
6186	{
6187	if (s) {
6188	if (strlcpy(r->label, s, sizeof(r->label)) >=
6189	sizeof(r->label)) {
6190	yyerror("rule label too long (max %d chars)",
6191	sizeof(r->label)-1);
6192	return (-1);
6193	}
6194	}
6195	return (0);
6196	}
6197
6198	u_int16_t
6199	parseicmpspec(char *w, sa_family_t af)
6200	{
6201	const struct icmpcodeent *p;
6202	u_long ulval;
6203	u_int8_t icmptype;
6204
6205	if (af == AF_INET)
6206	icmptype = returnicmpdefault >> 8;
6207	else
6208	icmptype = returnicmp6default >> 8;
6209
6210	if (atoul(w, &ulval) == -1) {
6211	if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
6212	yyerror("unknown icmp code %s", w);
6213	return (0);
6214	}
6215	ulval = p->code;
6216	}
6217	if (ulval > 255) {
6218	yyerror("invalid icmp code %lu", ulval);
6219	return (0);
6220	}
6221	return (icmptype << 8 \| ulval);
6222	}
6223
6224	int
6225	parseport(char port, struct range r, int extensions)
6226	{
6227	char *p = strchr(port, ':');
6228
6229	if (p == NULL) {
6230	if ((r->a = getservice(port)) == -1)
6231	return (-1);
6232	r->b = 0;
6233	r->t = PF_OP_NONE;
6234	return (0);
6235	}
6236	if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) {
6237	*p = 0;
6238	if ((r->a = getservice(port)) == -1)
6239	return (-1);
6240	r->b = 0;
6241	r->t = PF_OP_IRG;
6242	return (0);
6243	}
6244	if ((extensions & PPORT_RANGE)) {
6245	*p++ = 0;
6246	if ((r->a = getservice(port)) == -1 \|\|
6247	(r->b = getservice(p)) == -1)
6248	return (-1);
6249	if (r->a == r->b) {
6250	r->b = 0;
6251	r->t = PF_OP_NONE;
6252	} else
6253	r->t = PF_OP_RRG;
6254	return (0);
6255	}
6256	return (-1);
6257	}
6258
6259	int
6260	pfctl_load_anchors(int dev, struct pfctl pf, struct pfr_buffer trans)
6261	{
6262	struct loadanchors *la;
6263
6264	TAILQ_FOREACH(la, &loadanchorshead, entries) {
6265	if (pf->opts & PF_OPT_VERBOSE)
6266	fprintf(stderr, "\nLoading anchor %s from %s\n",
6267	la->anchorname, la->filename);
6268	if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize,
6269	la->anchorname, trans) == -1)
6270	return (-1);
6271	}
6272
6273	return (0);
6274	}
6275
6276	int
6277	kw_casecmp(const void k, const void e)
6278	{
6279	return (strcasecmp(k, ((const struct keywords *)e)->k_name));
6280	}
6281
6282	int
6283	map_tos(char s, int val)
6284	{
6285	/* DiffServ Codepoints and other TOS mappings */
6286	const struct keywords toswords[] = {
6287	{ "af11", IPTOS_DSCP_AF11 },
6288	{ "af12", IPTOS_DSCP_AF12 },
6289	{ "af13", IPTOS_DSCP_AF13 },
6290	{ "af21", IPTOS_DSCP_AF21 },
6291	{ "af22", IPTOS_DSCP_AF22 },
6292	{ "af23", IPTOS_DSCP_AF23 },
6293	{ "af31", IPTOS_DSCP_AF31 },
6294	{ "af32", IPTOS_DSCP_AF32 },
6295	{ "af33", IPTOS_DSCP_AF33 },
6296	{ "af41", IPTOS_DSCP_AF41 },
6297	{ "af42", IPTOS_DSCP_AF42 },
6298	{ "af43", IPTOS_DSCP_AF43 },
6299	{ "critical", IPTOS_PREC_CRITIC_ECP },
6300	{ "cs0", IPTOS_DSCP_CS0 },
6301	{ "cs1", IPTOS_DSCP_CS1 },
6302	{ "cs2", IPTOS_DSCP_CS2 },
6303	{ "cs3", IPTOS_DSCP_CS3 },
6304	{ "cs4", IPTOS_DSCP_CS4 },
6305	{ "cs5", IPTOS_DSCP_CS5 },
6306	{ "cs6", IPTOS_DSCP_CS6 },
6307	{ "cs7", IPTOS_DSCP_CS7 },
6308	{ "ef", IPTOS_DSCP_EF },
6309	{ "inetcontrol", IPTOS_PREC_INTERNETCONTROL },
6310	{ "lowdelay", IPTOS_LOWDELAY },
6311	{ "netcontrol", IPTOS_PREC_NETCONTROL },
6312	{ "reliability", IPTOS_RELIABILITY },
6313	{ "throughput", IPTOS_THROUGHPUT }
6314	};
6315	const struct keywords *p;
6316
6317	p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]),
6318	sizeof(toswords[0]), kw_casecmp);
6319
6320	if (p) {
6321	*val = p->k_val;
6322	return (1);
6323	}
6324	return (0);
6325	}
6326
6327	int
6328	rt_tableid_max(void)
6329	{
6330	#ifdef __FreeBSD__
6331	int fibs;
6332	size_t l = sizeof(fibs);
6333
6334	if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1)
6335	fibs = 16; /* XXX RT_MAXFIBS, at least limit it some. */
6336	/*
6337	* As the OpenBSD code only compares > and not >= we need to adjust
6338	* here given we only accept values of 0..n and want to avoid #ifdefs
6339	* in the grammar.
6340	*/
6341	return (fibs - 1);
6342	#else
6343	return (RT_TABLEID_MAX);
6344	#endif
6345	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats:

Original Format