contrib/ipfilter/tools/ipf_y.y

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  */
   8 %{
   9 #include "ipf.h"
  10 #include <sys/ioctl.h>
  11 #include <syslog.h>
  12 #ifdef IPFILTER_BPF
  13 # include <pcap.h>
  14 #endif
  15 #include "netinet/ip_pool.h"
  16 #include "netinet/ip_htable.h"
  17 #include "netinet/ipl.h"
  18 #include "ipf_l.h"
  19
  20 #define YYDEBUG 1
  21 #define DOALL(x)        for (fr = frc; fr != NULL; fr = fr->fr_next) { x }
  22 #define DOREM(x)        for (; fr != NULL; fr = fr->fr_next) { x }
  23
  24 extern  void    yyerror __P((char *));
  25 extern  int     yyparse __P((void));
  26 extern  int     yylex __P((void));
  27 extern  int     yydebug;
  28 extern  FILE    *yyin;
  29 extern  int     yylineNum;
  30
  31 static  int     addname __P((frentry_t **, char *));
  32 static  frentry_t *addrule __P((void));
  33 static frentry_t *allocfr __P((void));
  34 static  void    build_dstaddr_af __P((frentry_t *, void *));
  35 static  void    build_srcaddr_af __P((frentry_t *, void *));
  36 static  void    dobpf __P((int, char *));
  37 static  void    doipfexpr __P((char *));
  38 static  void    do_tuneint __P((char *, int));
  39 static  void    do_tunestr __P((char *, char *));
  40 static  void    fillgroup __P((frentry_t *));
  41 static  int     lookuphost __P((char *, i6addr_t *));
  42 static  u_int   makehash __P((struct alist_s *));
  43 static  int     makepool __P((struct alist_s *));
  44 static  struct  alist_s *newalist __P((struct alist_s *));
  45 static  void    newrule __P((void));
  46 static  void    resetaddr __P((void));
  47 static  void    setgroup __P((frentry_t **, char *));
  48 static  void    setgrhead __P((frentry_t **, char *));
  49 static  void    seticmphead __P((frentry_t **, char *));
  50 static  void    setifname __P((frentry_t **, int, char *));
  51 static  void    setipftype __P((void));
  52 static  void    setsyslog __P((void));
  53 static  void    unsetsyslog __P((void));
  54
  55 frentry_t       *fr = NULL, *frc = NULL, *frtop = NULL, *frold = NULL;
  56
  57 static  int             ifpflag = 0;
  58 static  int             nowith = 0;
  59 static  int             dynamic = -1;
  60 static  int             pooled = 0;
  61 static  int             hashed = 0;
  62 static  int             nrules = 0;
  63 static  int             newlist = 0;
  64 static  int             added = 0;
  65 static  int             ipffd = -1;
  66 static  int             *yycont = NULL;
  67 static  ioctlfunc_t     ipfioctls[IPL_LOGSIZE];
  68 static  addfunc_t       ipfaddfunc = NULL;
  69
  70 %}
  71 %union  {
  72         char    *str;
  73         u_32_t  num;
  74         frentry_t       fr;
  75         frtuc_t *frt;
  76         struct  alist_s *alist;
  77         u_short port;
  78         struct  in_addr ip4;
  79         struct  {
  80                 u_short p1;
  81                 u_short p2;
  82                 int     pc;
  83         } pc;
  84         struct ipp_s {
  85                 int             type;
  86                 int             ifpos;
  87                 int             f;
  88                 int             v;
  89                 int             lif;
  90                 union   i6addr  a;
  91                 union   i6addr  m;
  92                 char            *name;
  93         } ipp;
  94         struct  {
  95                 i6addr_t        adr;
  96                 int             f;
  97         } adr;
  98         i6addr_t        ip6;
  99         struct  {
 100                 char    *if1;
 101                 char    *if2;
 102         } ifs;
 103         char    gname[FR_GROUPLEN];
 104 };
 105
 106 %type   <port>  portnum
 107 %type   <num>   facility priority icmpcode seclevel secname icmptype
 108 %type   <num>   opt compare range opttype flagset optlist ipv6hdrlist ipv6hdr
 109 %type   <num>   portc porteq ipmask maskopts
 110 %type   <ip4>   ipv4 ipv4_16 ipv4_24
 111 %type   <adr>   hostname
 112 %type   <ipp>   addr ipaddr
 113 %type   <str>   servicename name interfacename groupname
 114 %type   <pc>    portrange portcomp
 115 %type   <alist> addrlist poollist
 116 %type   <ifs>   onname
 117
 118 %token  <num>   YY_NUMBER YY_HEX
 119 %token  <str>   YY_STR
 120 %token          YY_COMMENT
 121 %token          YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT
 122 %token          YY_RANGE_OUT YY_RANGE_IN
 123 %token  <ip6>   YY_IPV6
 124
 125 %token  IPFY_SET
 126 %token  IPFY_PASS IPFY_BLOCK IPFY_COUNT IPFY_CALL IPFY_NOMATCH
 127 %token  IPFY_RETICMP IPFY_RETRST IPFY_RETICMPASDST
 128 %token  IPFY_IN IPFY_OUT
 129 %token  IPFY_QUICK IPFY_ON IPFY_OUTVIA IPFY_INVIA
 130 %token  IPFY_DUPTO IPFY_TO IPFY_FROUTE IPFY_REPLY_TO IPFY_ROUTETO
 131 %token  IPFY_TOS IPFY_TTL IPFY_PROTO IPFY_INET IPFY_INET6
 132 %token  IPFY_HEAD IPFY_GROUP
 133 %token  IPFY_AUTH IPFY_PREAUTH
 134 %token  IPFY_LOG IPFY_BODY IPFY_FIRST IPFY_LEVEL IPFY_ORBLOCK IPFY_L5AS
 135 %token  IPFY_LOGTAG IPFY_MATCHTAG IPFY_SETTAG IPFY_SKIP IPFY_DECAPS
 136 %token  IPFY_FROM IPFY_ALL IPFY_ANY IPFY_BPFV4 IPFY_BPFV6 IPFY_POOL IPFY_HASH
 137 %token  IPFY_IPFEXPR IPFY_PPS IPFY_FAMILY IPFY_DSTLIST
 138 %token  IPFY_ESP IPFY_AH
 139 %token  IPFY_WITH IPFY_AND IPFY_NOT IPFY_NO IPFY_OPT
 140 %token  IPFY_TCPUDP IPFY_TCP IPFY_UDP
 141 %token  IPFY_FLAGS IPFY_MULTICAST
 142 %token  IPFY_MASK IPFY_BROADCAST IPFY_NETWORK IPFY_NETMASKED IPFY_PEER
 143 %token  IPFY_RPC IPFY_PORT
 144 %token  IPFY_NOW IPFY_COMMENT IPFY_RULETTL
 145 %token  IPFY_ICMP IPFY_ICMPTYPE IPFY_ICMPCODE
 146 %token  IPFY_IPOPTS IPFY_SHORT IPFY_NAT IPFY_BADSRC IPFY_LOWTTL IPFY_FRAG
 147 %token  IPFY_MBCAST IPFY_BAD IPFY_BADNAT IPFY_OOW IPFY_NEWISN IPFY_NOICMPERR
 148 %token  IPFY_KEEP IPFY_STATE IPFY_FRAGS IPFY_LIMIT IPFY_STRICT IPFY_AGE
 149 %token  IPFY_SYNC IPFY_FRAGBODY IPFY_ICMPHEAD IPFY_NOLOG IPFY_LOOSE
 150 %token  IPFY_MAX_SRCS IPFY_MAX_PER_SRC
 151 %token  IPFY_IPOPT_NOP IPFY_IPOPT_RR IPFY_IPOPT_ZSU IPFY_IPOPT_MTUP
 152 %token  IPFY_IPOPT_MTUR IPFY_IPOPT_ENCODE IPFY_IPOPT_TS IPFY_IPOPT_TR
 153 %token  IPFY_IPOPT_SEC IPFY_IPOPT_LSRR IPFY_IPOPT_ESEC IPFY_IPOPT_CIPSO
 154 %token  IPFY_IPOPT_SATID IPFY_IPOPT_SSRR IPFY_IPOPT_ADDEXT IPFY_IPOPT_VISA
 155 %token  IPFY_IPOPT_IMITD IPFY_IPOPT_EIP IPFY_IPOPT_FINN IPFY_IPOPT_DPS
 156 %token  IPFY_IPOPT_SDB IPFY_IPOPT_NSAPA IPFY_IPOPT_RTRALRT IPFY_IPOPT_UMP
 157 %token  IPFY_SECCLASS IPFY_SEC_UNC IPFY_SEC_CONF IPFY_SEC_RSV1 IPFY_SEC_RSV2
 158 %token  IPFY_SEC_RSV4 IPFY_SEC_SEC IPFY_SEC_TS IPFY_SEC_RSV3 IPFY_DOI
 159
 160 %token  IPFY_V6HDRS IPFY_IPV6OPT IPFY_IPV6OPT_DSTOPTS IPFY_IPV6OPT_HOPOPTS
 161 %token  IPFY_IPV6OPT_IPV6 IPFY_IPV6OPT_NONE IPFY_IPV6OPT_ROUTING IPFY_V6HDR
 162 %token  IPFY_IPV6OPT_MOBILITY IPFY_IPV6OPT_ESP IPFY_IPV6OPT_FRAG
 163
 164 %token  IPFY_ICMPT_UNR IPFY_ICMPT_ECHO IPFY_ICMPT_ECHOR IPFY_ICMPT_SQUENCH
 165 %token  IPFY_ICMPT_REDIR IPFY_ICMPT_TIMEX IPFY_ICMPT_PARAMP IPFY_ICMPT_TIMEST
 166 %token  IPFY_ICMPT_TIMESTREP IPFY_ICMPT_INFOREQ IPFY_ICMPT_INFOREP
 167 %token  IPFY_ICMPT_MASKREQ IPFY_ICMPT_MASKREP IPFY_ICMPT_ROUTERAD
 168 %token  IPFY_ICMPT_ROUTERSOL
 169
 170 %token  IPFY_ICMPC_NETUNR IPFY_ICMPC_HSTUNR IPFY_ICMPC_PROUNR IPFY_ICMPC_PORUNR
 171 %token  IPFY_ICMPC_NEEDF IPFY_ICMPC_SRCFAIL IPFY_ICMPC_NETUNK IPFY_ICMPC_HSTUNK
 172 %token  IPFY_ICMPC_ISOLATE IPFY_ICMPC_NETPRO IPFY_ICMPC_HSTPRO
 173 %token  IPFY_ICMPC_NETTOS IPFY_ICMPC_HSTTOS IPFY_ICMPC_FLTPRO IPFY_ICMPC_HSTPRE
 174 %token  IPFY_ICMPC_CUTPRE
 175
 176 %token  IPFY_FAC_KERN IPFY_FAC_USER IPFY_FAC_MAIL IPFY_FAC_DAEMON IPFY_FAC_AUTH
 177 %token  IPFY_FAC_SYSLOG IPFY_FAC_LPR IPFY_FAC_NEWS IPFY_FAC_UUCP IPFY_FAC_CRON
 178 %token  IPFY_FAC_LOCAL0 IPFY_FAC_LOCAL1 IPFY_FAC_LOCAL2 IPFY_FAC_LOCAL3
 179 %token  IPFY_FAC_LOCAL4 IPFY_FAC_LOCAL5 IPFY_FAC_LOCAL6 IPFY_FAC_LOCAL7
 180 %token  IPFY_FAC_SECURITY IPFY_FAC_FTP IPFY_FAC_AUTHPRIV IPFY_FAC_AUDIT
 181 %token  IPFY_FAC_LFMT IPFY_FAC_CONSOLE
 182
 183 %token  IPFY_PRI_EMERG IPFY_PRI_ALERT IPFY_PRI_CRIT IPFY_PRI_ERR IPFY_PRI_WARN
 184 %token  IPFY_PRI_NOTICE IPFY_PRI_INFO IPFY_PRI_DEBUG
 185 %%
 186 file:   settings rules
 187         | rules
 188         ;
 189
 190 settings:
 191         YY_COMMENT
 192         | setting
 193         | settings setting
 194         ;
 195
 196 rules:  line
 197         | assign
 198         | rules line
 199         | rules assign
 200         ;
 201
 202 setting:
 203         IPFY_SET YY_STR YY_NUMBER ';'   { do_tuneint($2, $3); }
 204         | IPFY_SET YY_STR YY_HEX ';'    { do_tuneint($2, $3); }
 205         | IPFY_SET YY_STR YY_STR ';'    { do_tunestr($2, $3); }
 206         ;
 207
 208 line:   rule            { while ((fr = frtop) != NULL) {
 209                                 frtop = fr->fr_next;
 210                                 fr->fr_next = NULL;
 211                                 if ((fr->fr_type == FR_T_IPF) &&
 212                                     (fr->fr_ip.fi_v == 0))
 213                                         fr->fr_mip.fi_v = 0;
 214                                 /* XXX validate ? */
 215                                 (*ipfaddfunc)(ipffd, ipfioctls[IPL_LOGIPF], fr);
 216                                 fr->fr_next = frold;
 217                                 frold = fr;
 218                           }
 219                           resetlexer();
 220                         }
 221         | YY_COMMENT
 222         ;
 223
 224 xx:                                     { newrule(); }
 225         ;
 226
 227 assign: YY_STR assigning YY_STR ';'     { set_variable($1, $3);
 228                                           resetlexer();
 229                                           free($1);
 230                                           free($3);
 231                                           yyvarnext = 0;
 232                                         }
 233         ;
 234
 235 assigning:
 236         '='                             { yyvarnext = 1; }
 237         ;
 238
 239 rule:   inrule eol
 240         | outrule eol
 241         ;
 242
 243 eol:    | ';'
 244         ;
 245
 246 inrule:
 247         rulehead markin inopts rulemain ruletail intag ruletail2
 248         ;
 249
 250 outrule:
 251         rulehead markout outopts rulemain ruletail outtag ruletail2
 252         ;
 253
 254 rulehead:
 255         xx collection action
 256         | xx insert collection action
 257         ;
 258
 259 markin: IPFY_IN                         { fr->fr_flags |= FR_INQUE; }
 260         ;
 261
 262 markout:
 263         IPFY_OUT                        { fr->fr_flags |= FR_OUTQUE; }
 264         ;
 265
 266 rulemain:
 267         ipfrule
 268         | bpfrule
 269         | exprrule
 270         ;
 271
 272 ipfrule:
 273         family tos ttl proto ip
 274         ;
 275
 276 family: | IPFY_FAMILY IPFY_INET         { if (use_inet6 == 1) {
 277                                                 YYERROR;
 278                                           } else {
 279                                                 frc->fr_family = AF_INET;
 280                                           }
 281                                         }
 282         | IPFY_INET                     { if (use_inet6 == 1) {
 283                                                 YYERROR;
 284                                           } else {
 285                                                 frc->fr_family = AF_INET;
 286                                           }
 287                                         }
 288         | IPFY_FAMILY IPFY_INET6        { if (use_inet6 == -1) {
 289                                                 YYERROR;
 290                                           } else {
 291                                                 frc->fr_family = AF_INET6;
 292                                           }
 293                                         }
 294         | IPFY_INET6                    { if (use_inet6 == -1) {
 295                                                 YYERROR;
 296                                           } else {
 297                                                 frc->fr_family = AF_INET6;
 298                                           }
 299                                         }
 300         ;
 301
 302 bpfrule:
 303         IPFY_BPFV4 '{' YY_STR '}'       { dobpf(4, $3); free($3); }
 304         | IPFY_BPFV6 '{' YY_STR '}'     { dobpf(6, $3); free($3); }
 305         ;
 306
 307 exprrule:
 308         IPFY_IPFEXPR '{' YY_STR '}'     { doipfexpr($3); }
 309         ;
 310
 311 ruletail:
 312         with keep head group
 313         ;
 314
 315 ruletail2:
 316         pps age new rulettl comment
 317         ;
 318
 319 intag:  settagin matchtagin
 320         ;
 321
 322 outtag: settagout matchtagout
 323         ;
 324
 325 insert:
 326         '@' YY_NUMBER                   { fr->fr_hits = (U_QUAD_T)$2 + 1; }
 327         ;
 328
 329 collection:
 330         | YY_NUMBER                     { fr->fr_collect = $1; }
 331         ;
 332
 333 action: block
 334         | IPFY_PASS                     { fr->fr_flags |= FR_PASS; }
 335         | IPFY_NOMATCH                  { fr->fr_flags |= FR_NOMATCH; }
 336         | log
 337         | IPFY_COUNT                    { fr->fr_flags |= FR_ACCOUNT; }
 338         | decaps                        { fr->fr_flags |= FR_DECAPSULATE; }
 339         | auth
 340         | IPFY_SKIP YY_NUMBER           { fr->fr_flags |= FR_SKIP;
 341                                           fr->fr_arg = $2; }
 342         | IPFY_CALL func
 343         | IPFY_CALL IPFY_NOW func       { fr->fr_flags |= FR_CALLNOW; }
 344         ;
 345
 346 block:  blocked
 347         | blocked blockreturn
 348         ;
 349
 350 blocked:
 351         IPFY_BLOCK                      { fr->fr_flags = FR_BLOCK; }
 352         ;
 353 blockreturn:
 354         IPFY_RETICMP                    { fr->fr_flags |= FR_RETICMP; }
 355         | IPFY_RETICMP returncode       { fr->fr_flags |= FR_RETICMP; }
 356         | IPFY_RETICMPASDST             { fr->fr_flags |= FR_FAKEICMP; }
 357         | IPFY_RETICMPASDST returncode  { fr->fr_flags |= FR_FAKEICMP; }
 358         | IPFY_RETRST                   { fr->fr_flags |= FR_RETRST; }
 359         ;
 360
 361 decaps: IPFY_DECAPS
 362         | IPFY_DECAPS IPFY_L5AS '(' YY_STR ')'
 363                                         { fr->fr_icode = atoi($4); }
 364         ;
 365
 366 log:    IPFY_LOG                        { fr->fr_flags |= FR_LOG; }
 367         | IPFY_LOG logoptions           { fr->fr_flags |= FR_LOG; }
 368         ;
 369
 370 auth:   IPFY_AUTH                       { fr->fr_flags |= FR_AUTH; }
 371         | IPFY_AUTH blockreturn         { fr->fr_flags |= FR_AUTH;}
 372         | IPFY_PREAUTH                  { fr->fr_flags |= FR_PREAUTH; }
 373         ;
 374
 375 func:   YY_STR '/' YY_NUMBER
 376                         { fr->fr_func = nametokva($1, ipfioctls[IPL_LOGIPF]);
 377                           fr->fr_arg = $3;
 378                           free($1);
 379                         }
 380         ;
 381
 382 inopts:
 383         | inopts inopt
 384         ;
 385
 386 inopt:
 387         logopt
 388         | quick
 389         | on
 390         | dup
 391         | froute
 392         | proute
 393         | replyto
 394         ;
 395
 396 outopts:
 397         | outopts outopt
 398         ;
 399
 400 outopt:
 401         logopt
 402         | quick
 403         | on
 404         | dup
 405         | proute
 406         | froute
 407         | replyto
 408         ;
 409
 410 tos:    | settos YY_NUMBER      { DOALL(fr->fr_tos = $2; fr->fr_mtos = 0xff;) }
 411         | settos YY_HEX { DOALL(fr->fr_tos = $2; fr->fr_mtos = 0xff;) }
 412         | settos lstart toslist lend
 413         ;
 414
 415 settos: IPFY_TOS                        { setipftype(); }
 416         ;
 417
 418 toslist:
 419         YY_NUMBER       { DOALL(fr->fr_tos = $1; fr->fr_mtos = 0xff;) }
 420         | YY_HEX        { DOREM(fr->fr_tos = $1; fr->fr_mtos = 0xff;) }
 421         | toslist lmore YY_NUMBER
 422                         { DOREM(fr->fr_tos = $3; fr->fr_mtos = 0xff;) }
 423         | toslist lmore YY_HEX
 424                         { DOREM(fr->fr_tos = $3; fr->fr_mtos = 0xff;) }
 425         ;
 426
 427 ttl:    | setttl YY_NUMBER
 428                         { DOALL(fr->fr_ttl = $2; fr->fr_mttl = 0xff;) }
 429         | setttl lstart ttllist lend
 430         ;
 431
 432 lstart: '{'                             { newlist = 1; fr = frc; added = 0; }
 433         ;
 434
 435 lend:   '}'                             { nrules += added; }
 436         ;
 437
 438 lmore:  lanother                        { if (newlist == 1) {
 439                                                 newlist = 0;
 440                                           }
 441                                           fr = addrule();
 442                                           if (yycont != NULL)
 443                                                 *yycont = 1;
 444                                         }
 445         ;
 446
 447 lanother:
 448         | ','
 449         ;
 450
 451 setttl: IPFY_TTL                        { setipftype(); }
 452         ;
 453
 454 ttllist:
 455         YY_NUMBER       { DOREM(fr->fr_ttl = $1; fr->fr_mttl = 0xff;) }
 456         | ttllist lmore YY_NUMBER
 457                         { DOREM(fr->fr_ttl = $3; fr->fr_mttl = 0xff;) }
 458         ;
 459
 460 proto:  | protox protocol               { yyresetdict(); }
 461         ;
 462
 463 protox: IPFY_PROTO                      { setipftype();
 464                                           fr = frc;
 465                                           yysetdict(NULL); }
 466         ;
 467
 468 ip:     srcdst flags icmp
 469         ;
 470
 471 group:  | IPFY_GROUP groupname          { DOALL(setgroup(&fr, $2); \
 472                                                 fillgroup(fr););
 473                                           free($2);
 474                                         }
 475         ;
 476
 477 head:   | IPFY_HEAD groupname           { DOALL(setgrhead(&fr, $2););
 478                                           free($2);
 479                                         }
 480         ;
 481
 482 groupname:
 483         YY_STR                          { $$ = $1;
 484                                           if (strlen($$) >= FR_GROUPLEN)
 485                                                 $$[FR_GROUPLEN - 1] = '\0';
 486                                         }
 487         | YY_NUMBER                     { $$ = malloc(16);
 488                                           sprintf($$, "%d", $1);
 489                                         }
 490         ;
 491
 492 settagin:
 493         | IPFY_SETTAG '(' taginlist ')'
 494         ;
 495
 496 taginlist:
 497         taginspec
 498         | taginlist ',' taginspec
 499         ;
 500
 501 taginspec:
 502         logtag
 503         ;
 504
 505 nattag: IPFY_NAT '=' YY_STR             { DOALL(strncpy(fr->fr_nattag.ipt_tag,\
 506                                                 $3, IPFTAG_LEN););
 507                                           free($3); }
 508         | IPFY_NAT '=' YY_NUMBER        { DOALL(sprintf(fr->fr_nattag.ipt_tag,\
 509                                                 "%d", $3 & 0xffffffff);) }
 510         ;
 511
 512 logtag: IPFY_LOG '=' YY_NUMBER          { DOALL(fr->fr_logtag = $3;) }
 513         ;
 514
 515 settagout:
 516         | IPFY_SETTAG '(' tagoutlist ')'
 517         ;
 518
 519 tagoutlist:
 520         tagoutspec
 521         | tagoutlist ',' tagoutspec
 522         ;
 523
 524 tagoutspec:
 525         logtag
 526         | nattag
 527         ;
 528
 529 matchtagin:
 530         | IPFY_MATCHTAG '(' tagoutlist ')'
 531         ;
 532
 533 matchtagout:
 534         | IPFY_MATCHTAG '(' taginlist ')'
 535         ;
 536
 537 pps:    | IPFY_PPS YY_NUMBER            { DOALL(fr->fr_pps = $2;) }
 538         ;
 539
 540 new:    | savegroup file restoregroup
 541         ;
 542
 543 rulettl:
 544         | IPFY_RULETTL YY_NUMBER        { DOALL(fr->fr_die = $2;) }
 545         ;
 546
 547 comment:
 548         | IPFY_COMMENT YY_STR           { DOALL(fr->fr_comment = addname(&fr, \
 549                                                 $2);) }
 550         ;
 551
 552 savegroup:
 553         '{'
 554         ;
 555
 556 restoregroup:
 557         '}'
 558         ;
 559
 560 logopt: log
 561         ;
 562
 563 quick:  IPFY_QUICK                              { fr->fr_flags |= FR_QUICK; }
 564         ;
 565
 566 on:     IPFY_ON onname                          { setifname(&fr, 0, $2.if1);
 567                                                   free($2.if1);
 568                                                   if ($2.if2 != NULL) {
 569                                                         setifname(&fr, 1,
 570                                                                   $2.if2);
 571                                                         free($2.if2);
 572                                                   }
 573                                                 }
 574         | IPFY_ON lstart onlist lend
 575         | IPFY_ON onname IPFY_INVIA vianame     { setifname(&fr, 0, $2.if1);
 576                                                   free($2.if1);
 577                                                   if ($2.if2 != NULL) {
 578                                                         setifname(&fr, 1,
 579                                                                   $2.if2);
 580                                                         free($2.if2);
 581                                                   }
 582                                                 }
 583         | IPFY_ON onname IPFY_OUTVIA vianame    { setifname(&fr, 0, $2.if1);
 584                                                   free($2.if1);
 585                                                   if ($2.if2 != NULL) {
 586                                                         setifname(&fr, 1,
 587                                                                   $2.if2);
 588                                                         free($2.if2);
 589                                                   }
 590                                                 }
 591         ;
 592
 593 onlist: onname                  { DOREM(setifname(&fr, 0, $1.if1);         \
 594                                         if ($1.if2 != NULL)                \
 595                                                 setifname(&fr, 1, $1.if2); \
 596                                         )
 597                                   free($1.if1);
 598                                   if ($1.if2 != NULL)
 599                                         free($1.if2);
 600                                 }
 601         | onlist lmore onname   { DOREM(setifname(&fr, 0, $3.if1);         \
 602                                         if ($3.if2 != NULL)                \
 603                                                 setifname(&fr, 1, $3.if2); \
 604                                         )
 605                                   free($3.if1);
 606                                   if ($3.if2 != NULL)
 607                                         free($3.if2);
 608                                 }
 609         ;
 610
 611 onname: interfacename           { $$.if1 = $1;
 612                                   $$.if2 = NULL;
 613                                 }
 614         | interfacename ',' interfacename
 615                                 { $$.if1 = $1;
 616                                   $$.if2 = $3;
 617                                 }
 618         ;
 619
 620 vianame:
 621         name                    { setifname(&fr, 2, $1);
 622                                   free($1);
 623                                 }
 624         | name ',' name         { setifname(&fr, 2, $1);
 625                                   free($1);
 626                                   setifname(&fr, 3, $3);
 627                                   free($3);
 628                                 }
 629         ;
 630
 631 dup:    IPFY_DUPTO name
 632         { int idx = addname(&fr, $2);
 633           fr->fr_dif.fd_name = idx;
 634           free($2);
 635         }
 636         | IPFY_DUPTO IPFY_DSTLIST '/' name
 637         { int idx = addname(&fr, $4);
 638           fr->fr_dif.fd_name = idx;
 639           fr->fr_dif.fd_type = FRD_DSTLIST;
 640           free($4);
 641         }
 642         | IPFY_DUPTO name duptoseparator hostname
 643         { int idx = addname(&fr, $2);
 644           fr->fr_dif.fd_name = idx;
 645           fr->fr_dif.fd_ptr = (void *)-1;
 646           fr->fr_dif.fd_ip6 = $4.adr;
 647           if (fr->fr_family == AF_UNSPEC && $4.f != AF_UNSPEC)
 648                 fr->fr_family = $4.f;
 649           yyexpectaddr = 0;
 650           free($2);
 651         }
 652         ;
 653
 654 duptoseparator:
 655         ':'     { yyexpectaddr = 1; yycont = &yyexpectaddr; resetaddr(); }
 656         ;
 657
 658 froute: IPFY_FROUTE                     { fr->fr_flags |= FR_FASTROUTE; }
 659         ;
 660
 661 proute: routeto name
 662         { int idx = addname(&fr, $2);
 663           fr->fr_tif.fd_name = idx;
 664           free($2);
 665         }
 666         | routeto IPFY_DSTLIST '/' name
 667         { int idx = addname(&fr, $4);
 668           fr->fr_tif.fd_name = idx;
 669           fr->fr_tif.fd_type = FRD_DSTLIST;
 670           free($4);
 671         }
 672         | routeto name duptoseparator hostname
 673         { int idx = addname(&fr, $2);
 674           fr->fr_tif.fd_name = idx;
 675           fr->fr_tif.fd_ptr = (void *)-1;
 676           fr->fr_tif.fd_ip6 = $4.adr;
 677           if (fr->fr_family == AF_UNSPEC && $4.f != AF_UNSPEC)
 678                 fr->fr_family = $4.f;
 679           yyexpectaddr = 0;
 680           free($2);
 681         }
 682         ;
 683
 684 routeto:
 685         IPFY_TO
 686         | IPFY_ROUTETO
 687         ;
 688
 689 replyto:
 690         IPFY_REPLY_TO name
 691         { int idx = addname(&fr, $2);
 692           fr->fr_rif.fd_name = idx;
 693           free($2);
 694         }
 695         | IPFY_REPLY_TO IPFY_DSTLIST '/' name
 696         { fr->fr_rif.fd_name = addname(&fr, $4);
 697           fr->fr_rif.fd_type = FRD_DSTLIST;
 698           free($4);
 699         }
 700         | IPFY_REPLY_TO name duptoseparator hostname
 701         { int idx = addname(&fr, $2);
 702           fr->fr_rif.fd_name = idx;
 703           fr->fr_rif.fd_ptr = (void *)-1;
 704           fr->fr_rif.fd_ip6 = $4.adr;
 705           if (fr->fr_family == AF_UNSPEC && $4.f != AF_UNSPEC)
 706                 fr->fr_family = $4.f;
 707           free($2);
 708         }
 709         ;
 710
 711 logoptions:
 712         logoption
 713         | logoptions logoption
 714         ;
 715
 716 logoption:
 717         IPFY_BODY                       { fr->fr_flags |= FR_LOGBODY; }
 718         | IPFY_FIRST                    { fr->fr_flags |= FR_LOGFIRST; }
 719         | IPFY_ORBLOCK                  { fr->fr_flags |= FR_LOGORBLOCK; }
 720         | level loglevel                { unsetsyslog(); }
 721         ;
 722
 723 returncode:
 724         starticmpcode icmpcode ')'      { fr->fr_icode = $2; yyresetdict(); }
 725         ;
 726
 727 starticmpcode:
 728         '('                             { yysetdict(icmpcodewords); }
 729         ;
 730
 731 srcdst: | IPFY_ALL
 732         | fromto
 733         ;
 734
 735 protocol:
 736         YY_NUMBER               { DOALL(fr->fr_proto = $1; \
 737                                         fr->fr_mproto = 0xff;)
 738                                 }
 739         | YY_STR                { if (!strcmp($1, "tcp-udp")) {
 740                                         DOALL(fr->fr_flx |= FI_TCPUDP; \
 741                                               fr->fr_mflx |= FI_TCPUDP;)
 742                                   } else {
 743                                         int p = getproto($1);
 744                                         if (p == -1)
 745                                                 yyerror("protocol unknown");
 746                                         DOALL(fr->fr_proto = p; \
 747                                                 fr->fr_mproto = 0xff;)
 748                                   }
 749                                   free($1);
 750                                 }
 751         | YY_STR nextstring YY_STR
 752                                 { if (!strcmp($1, "tcp") &&
 753                                       !strcmp($3, "udp")) {
 754                                         DOREM(fr->fr_flx |= FI_TCPUDP; \
 755                                               fr->fr_mflx |= FI_TCPUDP;)
 756                                   } else {
 757                                         YYERROR;
 758                                   }
 759                                   free($1);
 760                                   free($3);
 761                                 }
 762         ;
 763
 764 nextstring:
 765         '/'                     { yysetdict(NULL); }
 766         ;
 767
 768 fromto: from srcobject to dstobject     { yyexpectaddr = 0; yycont = NULL; }
 769         | to dstobject                  { yyexpectaddr = 0; yycont = NULL; }
 770         | from srcobject                { yyexpectaddr = 0; yycont = NULL; }
 771         ;
 772
 773 from:   IPFY_FROM                       { setipftype();
 774                                           if (fr == NULL)
 775                                                 fr = frc;
 776                                           yyexpectaddr = 1;
 777                                           if (yydebug)
 778                                                 printf("set yyexpectaddr\n");
 779                                           yycont = &yyexpectaddr;
 780                                           yysetdict(addrwords);
 781                                           resetaddr(); }
 782         ;
 783
 784 to:     IPFY_TO                         { if (fr == NULL)
 785                                                 fr = frc;
 786                                           yyexpectaddr = 1;
 787                                           if (yydebug)
 788                                                 printf("set yyexpectaddr\n");
 789                                           yycont = &yyexpectaddr;
 790                                           yysetdict(addrwords);
 791                                           resetaddr();
 792                                         }
 793         ;
 794
 795 with:   | andwith withlist
 796         ;
 797
 798 andwith:
 799         IPFY_WITH                       { nowith = 0; setipftype(); }
 800         | IPFY_AND                      { nowith = 0; setipftype(); }
 801         ;
 802
 803 flags:  | startflags flagset
 804                 { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = FR_TCPFMAX;) }
 805         | startflags flagset '/' flagset
 806                 { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
 807         | startflags '/' flagset
 808                 { DOALL(fr->fr_tcpf = 0; fr->fr_tcpfm = $3;) }
 809         | startflags YY_NUMBER
 810                 { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = FR_TCPFMAX;) }
 811         | startflags '/' YY_NUMBER
 812                 { DOALL(fr->fr_tcpf = 0; fr->fr_tcpfm = $3;) }
 813         | startflags YY_NUMBER '/' YY_NUMBER
 814                 { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
 815         | startflags flagset '/' YY_NUMBER
 816                 { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
 817         | startflags YY_NUMBER '/' flagset
 818                 { DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
 819         ;
 820
 821 startflags:
 822         IPFY_FLAGS      { if (frc->fr_type != FR_T_IPF)
 823                                 yyerror("flags with non-ipf type rule");
 824                           if (frc->fr_proto != IPPROTO_TCP)
 825                                 yyerror("flags with non-TCP rule");
 826                         }
 827         ;
 828
 829 flagset:
 830         YY_STR                          { $$ = tcpflags($1); free($1); }
 831         | YY_HEX                        { $$ = $1; }
 832         ;
 833
 834 srcobject:
 835         { yyresetdict(); } fromport
 836         | srcaddr srcport
 837         | '!' srcaddr srcport
 838                 { DOALL(fr->fr_flags |= FR_NOTSRCIP;) }
 839         ;
 840
 841 srcaddr:
 842         addr    { build_srcaddr_af(fr, &$1); }
 843         | lstart srcaddrlist lend
 844         ;
 845
 846 srcaddrlist:
 847         addr    { build_srcaddr_af(fr, &$1); }
 848         | srcaddrlist lmore addr
 849                 { build_srcaddr_af(fr, &$3); }
 850         ;
 851
 852 srcport:
 853         | portcomp
 854                 { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1;) }
 855         | portrange
 856                 { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1; \
 857                         fr->fr_stop = $1.p2;) }
 858         | porteq lstart srcportlist lend
 859                 { yyresetdict(); }
 860         ;
 861
 862 fromport:
 863         portcomp
 864                 { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1;) }
 865         | portrange
 866                 { DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1; \
 867                         fr->fr_stop = $1.p2;) }
 868         | porteq lstart srcportlist lend
 869                 { yyresetdict(); }
 870         ;
 871
 872 srcportlist:
 873         portnum         { DOREM(fr->fr_scmp = FR_EQUAL; fr->fr_sport = $1;) }
 874         | portnum ':' portnum
 875                         { DOREM(fr->fr_scmp = FR_INCRANGE; fr->fr_sport = $1; \
 876                                 fr->fr_stop = $3;) }
 877         | portnum YY_RANGE_IN portnum
 878                         { DOREM(fr->fr_scmp = FR_INRANGE; fr->fr_sport = $1; \
 879                                 fr->fr_stop = $3;) }
 880         | srcportlist lmore portnum
 881                         { DOREM(fr->fr_scmp = FR_EQUAL; fr->fr_sport = $3;) }
 882         | srcportlist lmore portnum ':' portnum
 883                         { DOREM(fr->fr_scmp = FR_INCRANGE; fr->fr_sport = $3; \
 884                                 fr->fr_stop = $5;) }
 885         | srcportlist lmore portnum YY_RANGE_IN portnum
 886                         { DOREM(fr->fr_scmp = FR_INRANGE; fr->fr_sport = $3; \
 887                                 fr->fr_stop = $5;) }
 888         ;
 889
 890 dstobject:
 891         { yyresetdict(); } toport
 892         | dstaddr dstport
 893         | '!' dstaddr dstport
 894                         { DOALL(fr->fr_flags |= FR_NOTDSTIP;) }
 895         ;
 896
 897 dstaddr:
 898         addr    { if (($1.f != AF_UNSPEC) && (frc->fr_family != AF_UNSPEC) &&
 899                       ($1.f != frc->fr_family))
 900                         yyerror("1.src/dst address family mismatch");
 901                   build_dstaddr_af(fr, &$1);
 902                 }
 903         | lstart dstaddrlist lend
 904         ;
 905
 906 dstaddrlist:
 907         addr    { if (($1.f != AF_UNSPEC) && (frc->fr_family != AF_UNSPEC) &&
 908                       ($1.f != frc->fr_family))
 909                         yyerror("2.src/dst address family mismatch");
 910                   build_dstaddr_af(fr, &$1);
 911                 }
 912         | dstaddrlist lmore addr
 913                 { if (($3.f != AF_UNSPEC) && (frc->fr_family != AF_UNSPEC) &&
 914                       ($3.f != frc->fr_family))
 915                         yyerror("3.src/dst address family mismatch");
 916                   build_dstaddr_af(fr, &$3);
 917                 }
 918         ;
 919
 920
 921 dstport:
 922         | portcomp
 923                 { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1;) }
 924         | portrange
 925                 { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1; \
 926                         fr->fr_dtop = $1.p2;) }
 927         | porteq lstart dstportlist lend
 928                 { yyresetdict(); }
 929         ;
 930
 931 toport:
 932         portcomp
 933                 { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1;) }
 934         | portrange
 935                 { DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1; \
 936                         fr->fr_dtop = $1.p2;) }
 937         | porteq lstart dstportlist lend
 938                 { yyresetdict(); }
 939         ;
 940
 941 dstportlist:
 942         portnum         { DOREM(fr->fr_dcmp = FR_EQUAL; fr->fr_dport = $1;) }
 943         | portnum ':' portnum
 944                         { DOREM(fr->fr_dcmp = FR_INCRANGE; fr->fr_dport = $1; \
 945                                 fr->fr_dtop = $3;) }
 946         | portnum YY_RANGE_IN portnum
 947                         { DOREM(fr->fr_dcmp = FR_INRANGE; fr->fr_dport = $1; \
 948                                 fr->fr_dtop = $3;) }
 949         | dstportlist lmore portnum
 950                         { DOREM(fr->fr_dcmp = FR_EQUAL; fr->fr_dport = $3;) }
 951         | dstportlist lmore portnum ':' portnum
 952                         { DOREM(fr->fr_dcmp = FR_INCRANGE; fr->fr_dport = $3; \
 953                                 fr->fr_dtop = $5;) }
 954         | dstportlist lmore portnum YY_RANGE_IN portnum
 955                         { DOREM(fr->fr_dcmp = FR_INRANGE; fr->fr_dport = $3; \
 956                                 fr->fr_dtop = $5;) }
 957         ;
 958
 959 addr:   pool '/' YY_NUMBER              { pooled = 1;
 960                                           yyexpectaddr = 0;
 961                                           $$.type = FRI_LOOKUP;
 962                                           $$.v = 0;
 963                                           $$.ifpos = -1;
 964                                           $$.f = AF_UNSPEC;
 965                                           $$.a.iplookuptype = IPLT_POOL;
 966                                           $$.a.iplookupsubtype = 0;
 967                                           $$.a.iplookupnum = $3; }
 968         | pool '/' YY_STR               { pooled = 1;
 969                                           $$.ifpos = -1;
 970                                           $$.f = AF_UNSPEC;
 971                                           $$.type = FRI_LOOKUP;
 972                                           $$.a.iplookuptype = IPLT_POOL;
 973                                           $$.a.iplookupsubtype = 1;
 974                                           $$.a.iplookupname = addname(&fr, $3);
 975                                         }
 976         | pool '=' '('                  { yyexpectaddr = 1;
 977                                           pooled = 1;
 978                                         }
 979                         poollist ')'    { yyexpectaddr = 0;
 980                                           $$.v = 0;
 981                                           $$.ifpos = -1;
 982                                           $$.f = AF_UNSPEC;
 983                                           $$.type = FRI_LOOKUP;
 984                                           $$.a.iplookuptype = IPLT_POOL;
 985                                           $$.a.iplookupsubtype = 0;
 986                                           $$.a.iplookupnum = makepool($5);
 987                                         }
 988         | hash '/' YY_NUMBER            { hashed = 1;
 989                                           yyexpectaddr = 0;
 990                                           $$.v = 0;
 991                                           $$.ifpos = -1;
 992                                           $$.f = AF_UNSPEC;
 993                                           $$.type = FRI_LOOKUP;
 994                                           $$.a.iplookuptype = IPLT_HASH;
 995                                           $$.a.iplookupsubtype = 0;
 996                                           $$.a.iplookupnum = $3;
 997                                         }
 998         | hash '/' YY_STR               { hashed = 1;
 999                                           $$.type = FRI_LOOKUP;
1000                                           $$.v = 0;
1001                                           $$.ifpos = -1;
1002                                           $$.f = AF_UNSPEC;
1003                                           $$.a.iplookuptype = IPLT_HASH;
1004                                           $$.a.iplookupsubtype = 1;
1005                                           $$.a.iplookupname = addname(&fr, $3);
1006                                         }
1007         | hash '=' '('                  { hashed = 1;
1008                                           yyexpectaddr = 1;
1009                                         }
1010                         addrlist ')'    { yyexpectaddr = 0;
1011                                           $$.v = 0;
1012                                           $$.ifpos = -1;
1013                                           $$.f = AF_UNSPEC;
1014                                           $$.type = FRI_LOOKUP;
1015                                           $$.a.iplookuptype = IPLT_HASH;
1016                                           $$.a.iplookupsubtype = 0;
1017                                           $$.a.iplookupnum = makehash($5);
1018                                         }
1019         | ipaddr                        { $$ = $1;
1020                                           yyexpectaddr = 0; }
1021         ;
1022
1023 ipaddr: IPFY_ANY                        { bzero(&($$), sizeof($$));
1024                                           $$.type = FRI_NORMAL;
1025                                           $$.ifpos = -1;
1026                                           yyexpectaddr = 0;
1027                                         }
1028         | hostname                      { $$.a = $1.adr;
1029                                           $$.f = $1.f;
1030                                           if ($1.f == AF_INET6)
1031                                                   fill6bits(128, $$.m.i6);
1032                                           else if ($1.f == AF_INET)
1033                                                   fill6bits(32, $$.m.i6);
1034                                           $$.v = ftov($1.f);
1035                                           $$.ifpos = dynamic;
1036                                           $$.type = FRI_NORMAL;
1037                                         }
1038         | hostname                      { yyresetdict(); }
1039                 maskspace               { yysetdict(maskwords);
1040                                           yyexpectaddr = 2; }
1041                 ipmask                  { ntomask($1.f, $5, $$.m.i6);
1042                                           $$.a = $1.adr;
1043                                           $$.a.i6[0] &= $$.m.i6[0];
1044                                           $$.a.i6[1] &= $$.m.i6[1];
1045                                           $$.a.i6[2] &= $$.m.i6[2];
1046                                           $$.a.i6[3] &= $$.m.i6[3];
1047                                           $$.f = $1.f;
1048                                           $$.v = ftov($1.f);
1049                                           $$.type = ifpflag;
1050                                           $$.ifpos = dynamic;
1051                                           if (ifpflag != 0 && $$.v == 0) {
1052                                                 if (frc->fr_family == AF_INET6){
1053                                                         $$.v = 6;
1054                                                         $$.f = AF_INET6;
1055                                                 } else {
1056                                                         $$.v = 4;
1057                                                         $$.f = AF_INET;
1058                                                 }
1059                                           }
1060                                           yyresetdict();
1061                                           yyexpectaddr = 0;
1062                                         }
1063         | '(' YY_STR ')'                { $$.type = FRI_DYNAMIC;
1064                                           ifpflag = FRI_DYNAMIC;
1065                                           $$.ifpos = addname(&fr, $2);
1066                                           $$.lif = 0;
1067                                         }
1068         | '(' YY_STR ')' '/'
1069           { ifpflag = FRI_DYNAMIC; yysetdict(maskwords); }
1070           maskopts
1071                                         { $$.type = ifpflag;
1072                                           $$.ifpos = addname(&fr, $2);
1073                                           $$.lif = 0;
1074                                           if (frc->fr_family == AF_UNSPEC)
1075                                                 frc->fr_family = AF_INET;
1076                                           if (ifpflag == FRI_DYNAMIC) {
1077                                                 ntomask(frc->fr_family,
1078                                                         $6, $$.m.i6);
1079                                           }
1080                                           yyresetdict();
1081                                           yyexpectaddr = 0;
1082                                         }
1083         | '(' YY_STR ':' YY_NUMBER ')' '/'
1084           { ifpflag = FRI_DYNAMIC; yysetdict(maskwords); }
1085           maskopts
1086                                         { $$.type = ifpflag;
1087                                           $$.ifpos = addname(&fr, $2);
1088                                           $$.lif = $4;
1089                                           if (frc->fr_family == AF_UNSPEC)
1090                                                 frc->fr_family = AF_INET;
1091                                           if (ifpflag == FRI_DYNAMIC) {
1092                                                 ntomask(frc->fr_family,
1093                                                         $8, $$.m.i6);
1094                                           }
1095                                           yyresetdict();
1096                                           yyexpectaddr = 0;
1097                                         }
1098         ;
1099
1100 maskspace:
1101         '/'
1102         | IPFY_MASK
1103         ;
1104
1105 ipmask: ipv4                            { $$ = count4bits($1.s_addr); }
1106         | YY_HEX                        { $$ = count4bits(htonl($1)); }
1107         | YY_NUMBER                     { $$ = $1; }
1108         | YY_IPV6                       { $$ = count6bits($1.i6); }
1109         | maskopts                      { $$ = $1; }
1110         ;
1111
1112 maskopts:
1113         IPFY_BROADCAST                  { if (ifpflag == FRI_DYNAMIC) {
1114                                                 ifpflag = FRI_BROADCAST;
1115                                           } else {
1116                                                 YYERROR;
1117                                           }
1118                                           $$ = 0;
1119                                         }
1120         | IPFY_NETWORK                  { if (ifpflag == FRI_DYNAMIC) {
1121                                                 ifpflag = FRI_NETWORK;
1122                                           } else {
1123                                                 YYERROR;
1124                                           }
1125                                           $$ = 0;
1126                                         }
1127         | IPFY_NETMASKED                { if (ifpflag == FRI_DYNAMIC) {
1128                                                 ifpflag = FRI_NETMASKED;
1129                                           } else {
1130                                                 YYERROR;
1131                                           }
1132                                           $$ = 0;
1133                                         }
1134         | IPFY_PEER                     { if (ifpflag == FRI_DYNAMIC) {
1135                                                 ifpflag = FRI_PEERADDR;
1136                                           } else {
1137                                                 YYERROR;
1138                                           }
1139                                           $$ = 0;
1140                                         }
1141         | YY_NUMBER                     { $$ = $1; }
1142         ;
1143
1144 hostname:
1145         ipv4                            { $$.adr.in4 = $1;
1146                                           if (frc->fr_family == AF_INET6)
1147                                                 YYERROR;
1148                                           $$.f = AF_INET;
1149                                           yyexpectaddr = 2;
1150                                         }
1151         | YY_NUMBER                     { if (frc->fr_family == AF_INET6)
1152                                                 YYERROR;
1153                                           $$.adr.in4_addr = $1;
1154                                           $$.f = AF_INET;
1155                                           yyexpectaddr = 2;
1156                                         }
1157         | YY_HEX                        { if (frc->fr_family == AF_INET6)
1158                                                 YYERROR;
1159                                           $$.adr.in4_addr = $1;
1160                                           $$.f = AF_INET;
1161                                           yyexpectaddr = 2;
1162                                         }
1163         | YY_STR                        { if (lookuphost($1, &$$.adr) == 0)
1164                                                   $$.f = AF_INET;
1165                                           free($1);
1166                                           yyexpectaddr = 2;
1167                                         }
1168         | YY_IPV6                       { if (frc->fr_family == AF_INET)
1169                                                 YYERROR;
1170                                           $$.adr = $1;
1171                                           $$.f = AF_INET6;
1172                                           yyexpectaddr = 2;
1173                                         }
1174         ;
1175
1176 addrlist:
1177         ipaddr          { $$ = newalist(NULL);
1178                           $$->al_family = $1.f;
1179                           $$->al_i6addr = $1.a;
1180                           $$->al_i6mask = $1.m;
1181                         }
1182         | ipaddr ',' { yyexpectaddr = 1; } addrlist
1183                         { $$ = newalist($4);
1184                           $$->al_family = $1.f;
1185                           $$->al_i6addr = $1.a;
1186                           $$->al_i6mask = $1.m;
1187                         }
1188         ;
1189
1190 pool:   IPFY_POOL       { yyexpectaddr = 0; yycont = NULL; yyresetdict(); }
1191         ;
1192
1193 hash:   IPFY_HASH       { yyexpectaddr = 0; yycont = NULL; yyresetdict(); }
1194         ;
1195
1196 poollist:
1197         ipaddr          { $$ = newalist(NULL);
1198                           $$->al_family = $1.f;
1199                           $$->al_i6addr = $1.a;
1200                           $$->al_i6mask = $1.m;
1201                         }
1202         | '!' ipaddr    { $$ = newalist(NULL);
1203                           $$->al_not = 1;
1204                           $$->al_family = $2.f;
1205                           $$->al_i6addr = $2.a;
1206                           $$->al_i6mask = $2.m;
1207                         }
1208         | poollist ',' ipaddr
1209                         { $$ = newalist($1);
1210                           $$->al_family = $3.f;
1211                           $$->al_i6addr = $3.a;
1212                           $$->al_i6mask = $3.m;
1213                         }
1214         | poollist ',' '!' ipaddr
1215                         { $$ = newalist($1);
1216                           $$->al_not = 1;
1217                           $$->al_family = $4.f;
1218                           $$->al_i6addr = $4.a;
1219                           $$->al_i6mask = $4.m;
1220                         }
1221         ;
1222
1223 port:   IPFY_PORT                       { yyexpectaddr = 0;
1224                                           yycont = NULL;
1225                                           if (frc->fr_proto != 0 &&
1226                                               frc->fr_proto != IPPROTO_UDP &&
1227                                               frc->fr_proto != IPPROTO_TCP)
1228                                                 yyerror("port use incorrect");
1229                                         }
1230         ;
1231
1232 portc:  port compare                    { $$ = $2;
1233                                           yysetdict(NULL);
1234                                         }
1235         | porteq                        { $$ = $1; }
1236         ;
1237
1238 porteq: port '='                        { $$ = FR_EQUAL;
1239                                           yysetdict(NULL);
1240                                         }
1241         ;
1242
1243 portr:  IPFY_PORT                       { yyexpectaddr = 0;
1244                                           yycont = NULL;
1245                                           yysetdict(NULL);
1246                                         }
1247         ;
1248
1249 portcomp:
1250         portc portnum                   { $$.pc = $1;
1251                                           $$.p1 = $2;
1252                                           yyresetdict();
1253                                         }
1254         ;
1255
1256 portrange:
1257         portr portnum range portnum     { $$.p1 = $2;
1258                                           $$.pc = $3;
1259                                           $$.p2 = $4;
1260                                           yyresetdict();
1261                                         }
1262         ;
1263
1264 icmp:   | itype icode
1265         ;
1266
1267 itype:  seticmptype icmptype
1268         { DOALL(fr->fr_icmp = htons($2 << 8); fr->fr_icmpm = htons(0xff00););
1269           yyresetdict();
1270         }
1271         | seticmptype lstart typelist lend      { yyresetdict(); }
1272         ;
1273
1274 seticmptype:
1275         IPFY_ICMPTYPE           { if (frc->fr_family == AF_UNSPEC)
1276                                         frc->fr_family = AF_INET;
1277                                   if (frc->fr_family == AF_INET &&
1278                                       frc->fr_type == FR_T_IPF &&
1279                                       frc->fr_proto != IPPROTO_ICMP) {
1280                                         yyerror("proto not icmp");
1281                                   }
1282                                   if (frc->fr_family == AF_INET6 &&
1283                                       frc->fr_type == FR_T_IPF &&
1284                                       frc->fr_proto != IPPROTO_ICMPV6) {
1285                                         yyerror("proto not ipv6-icmp");
1286                                   }
1287                                   setipftype();
1288                                   DOALL(if (fr->fr_family == AF_INET) { \
1289                                                 fr->fr_ip.fi_v = 4; \
1290                                                 fr->fr_mip.fi_v = 0xf; \
1291                                         }
1292                                         if (fr->fr_family == AF_INET6) { \
1293                                                 fr->fr_ip.fi_v = 6; \
1294                                                 fr->fr_mip.fi_v = 0xf; \
1295                                         }
1296                                   )
1297                                   yysetdict(NULL);
1298                                 }
1299         ;
1300
1301 icode:  | seticmpcode icmpcode
1302         { DOALL(fr->fr_icmp |= htons($2); fr->fr_icmpm |= htons(0xff););
1303           yyresetdict();
1304         }
1305         | seticmpcode lstart codelist lend      { yyresetdict(); }
1306         ;
1307
1308 seticmpcode:
1309         IPFY_ICMPCODE                           { yysetdict(icmpcodewords); }
1310         ;
1311
1312 typelist:
1313         icmptype
1314         { DOREM(fr->fr_icmp = htons($1 << 8); fr->fr_icmpm = htons(0xff00);) }
1315         | typelist lmore icmptype
1316         { DOREM(fr->fr_icmp = htons($3 << 8); fr->fr_icmpm = htons(0xff00);) }
1317         ;
1318
1319 codelist:
1320         icmpcode
1321         { DOREM(fr->fr_icmp |= htons($1); fr->fr_icmpm |= htons(0xff);) }
1322         | codelist lmore icmpcode
1323         { DOREM(fr->fr_icmp &= htons(0xff00); fr->fr_icmp |= htons($3); \
1324                 fr->fr_icmpm |= htons(0xff);) }
1325         ;
1326
1327 age:    | IPFY_AGE YY_NUMBER            { DOALL(fr->fr_age[0] = $2; \
1328                                                 fr->fr_age[1] = $2;) }
1329         | IPFY_AGE YY_NUMBER '/' YY_NUMBER
1330                                         { DOALL(fr->fr_age[0] = $2; \
1331                                                 fr->fr_age[1] = $4;) }
1332         ;
1333
1334 keep:   | IPFY_KEEP keepstate keep
1335         | IPFY_KEEP keepfrag keep
1336         ;
1337
1338 keepstate:
1339         IPFY_STATE stateoptlist         { DOALL(fr->fr_flags |= FR_KEEPSTATE;)}
1340         ;
1341
1342 keepfrag:
1343         IPFY_FRAGS fragoptlist          { DOALL(fr->fr_flags |= FR_KEEPFRAG;) }
1344         | IPFY_FRAG fragoptlist         { DOALL(fr->fr_flags |= FR_KEEPFRAG;) }
1345         ;
1346
1347 fragoptlist:
1348         | '(' fragopts ')'
1349         ;
1350
1351 fragopts:
1352         fragopt lanother fragopts
1353         | fragopt
1354         ;
1355
1356 fragopt:
1357         IPFY_STRICT                     { DOALL(fr->fr_flags |= FR_FRSTRICT;) }
1358         ;
1359
1360 stateoptlist:
1361         | '(' stateopts ')'
1362         ;
1363
1364 stateopts:
1365         stateopt lanother stateopts
1366         | stateopt
1367         ;
1368
1369 stateopt:
1370         IPFY_LIMIT YY_NUMBER    { DOALL(fr->fr_statemax = $2;) }
1371         | IPFY_STRICT           { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \
1372                                                 YYERROR; \
1373                                         } else if (fr->fr_flags & FR_STLOOSE) {\
1374                                                 YYERROR; \
1375                                         } else \
1376                                                 fr->fr_flags |= FR_STSTRICT;)
1377                                 }
1378         | IPFY_LOOSE            { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \
1379                                                 YYERROR; \
1380                                         } else if (fr->fr_flags & FR_STSTRICT){\
1381                                                 YYERROR; \
1382                                         } else \
1383                                                 fr->fr_flags |= FR_STLOOSE;)
1384                                 }
1385         | IPFY_NEWISN           { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \
1386                                                 YYERROR; \
1387                                           } else \
1388                                                 fr->fr_flags |= FR_NEWISN;)
1389                                 }
1390         | IPFY_NOICMPERR        { DOALL(fr->fr_flags |= FR_NOICMPERR;) }
1391
1392         | IPFY_SYNC             { DOALL(fr->fr_flags |= FR_STATESYNC;) }
1393         | IPFY_AGE YY_NUMBER            { DOALL(fr->fr_age[0] = $2; \
1394                                                 fr->fr_age[1] = $2;) }
1395         | IPFY_AGE YY_NUMBER '/' YY_NUMBER
1396                                         { DOALL(fr->fr_age[0] = $2; \
1397                                                 fr->fr_age[1] = $4;) }
1398         | IPFY_ICMPHEAD groupname
1399                                 { DOALL(seticmphead(&fr, $2);)
1400                                   free($2);
1401                                 }
1402         | IPFY_NOLOG
1403                                 { DOALL(fr->fr_nostatelog = 1;) }
1404         | IPFY_RPC
1405                                 { DOALL(fr->fr_rpc = 1;) }
1406         | IPFY_RPC IPFY_IN YY_STR
1407                                 { DOALL(fr->fr_rpc = 1;) }
1408         | IPFY_MAX_SRCS YY_NUMBER
1409                                 { DOALL(fr->fr_srctrack.ht_max_nodes = $2;) }
1410         | IPFY_MAX_PER_SRC YY_NUMBER
1411                                 { DOALL(fr->fr_srctrack.ht_max_per_node = $2; \
1412                                         fr->fr_srctrack.ht_netmask = \
1413                                         fr->fr_family == AF_INET ? 32: 128;)
1414                                 }
1415         | IPFY_MAX_PER_SRC YY_NUMBER '/' YY_NUMBER
1416                                 { DOALL(fr->fr_srctrack.ht_max_per_node = $2; \
1417                                         fr->fr_srctrack.ht_netmask = $4;)
1418                                 }
1419         ;
1420
1421 portnum:
1422         servicename                     { if (getport(frc, $1,
1423                                                       &($$), NULL) == -1)
1424                                                 yyerror("service unknown");
1425                                           $$ = ntohs($$);
1426                                           free($1);
1427                                         }
1428         | YY_NUMBER                     { if ($1 > 65535)       /* Unsigned */
1429                                                 yyerror("invalid port number");
1430                                           else
1431                                                 $$ = $1;
1432                                         }
1433         ;
1434
1435 withlist:
1436         withopt                         { nowith = 0; }
1437         | withlist withopt              { nowith = 0; }
1438         | withlist ',' withopt          { nowith = 0; }
1439         ;
1440
1441 withopt:
1442         opttype         { DOALL(fr->fr_flx |= $1; fr->fr_mflx |= $1;) }
1443         | notwith opttype               { DOALL(fr->fr_mflx |= $2;) }
1444         | ipopt ipopts                  { yyresetdict(); }
1445         | notwith ipopt ipopts          { yyresetdict(); }
1446         | startv6hdr ipv6hdrs           { yyresetdict(); }
1447         ;
1448
1449 ipopt:  IPFY_OPT                        { yysetdict(ipv4optwords); }
1450         ;
1451
1452 startv6hdr:
1453         IPFY_V6HDR      { if (frc->fr_family != AF_INET6)
1454                                 yyerror("only available with IPv6");
1455                           yysetdict(ipv6optwords);
1456                         }
1457         ;
1458
1459 notwith:
1460         IPFY_NOT                        { nowith = 1; }
1461         | IPFY_NO                       { nowith = 1; }
1462         ;
1463
1464 opttype:
1465         IPFY_IPOPTS                     { $$ = FI_OPTIONS; }
1466         | IPFY_SHORT                    { $$ = FI_SHORT; }
1467         | IPFY_NAT                      { $$ = FI_NATED; }
1468         | IPFY_BAD                      { $$ = FI_BAD; }
1469         | IPFY_BADNAT                   { $$ = FI_BADNAT; }
1470         | IPFY_BADSRC                   { $$ = FI_BADSRC; }
1471         | IPFY_LOWTTL                   { $$ = FI_LOWTTL; }
1472         | IPFY_FRAG                     { $$ = FI_FRAG; }
1473         | IPFY_FRAGBODY                 { $$ = FI_FRAGBODY; }
1474         | IPFY_FRAGS                    { $$ = FI_FRAG; }
1475         | IPFY_MBCAST                   { $$ = FI_MBCAST; }
1476         | IPFY_MULTICAST                { $$ = FI_MULTICAST; }
1477         | IPFY_BROADCAST                { $$ = FI_BROADCAST; }
1478         | IPFY_STATE                    { $$ = FI_STATE; }
1479         | IPFY_OOW                      { $$ = FI_OOW; }
1480         | IPFY_AH                       { $$ = FI_AH; }
1481         | IPFY_V6HDRS                   { $$ = FI_V6EXTHDR; }
1482         ;
1483
1484 ipopts: optlist         { DOALL(fr->fr_mip.fi_optmsk |= $1;
1485                                 if (fr->fr_family == AF_UNSPEC) {
1486                                         fr->fr_family = AF_INET;
1487                                         fr->fr_ip.fi_v = 4;
1488                                         fr->fr_mip.fi_v = 0xf;
1489                                 } else if (fr->fr_family != AF_INET) {
1490                                         YYERROR;
1491                                 }
1492                                 if (!nowith)
1493                                         fr->fr_ip.fi_optmsk |= $1;)
1494                         }
1495         ;
1496
1497 optlist:
1498         opt                             { $$ |= $1; }
1499         | optlist ',' opt               { $$ |= $1 | $3; }
1500         ;
1501
1502 ipv6hdrs:
1503         ipv6hdrlist     { DOALL(fr->fr_mip.fi_optmsk |= $1;
1504                                 if (!nowith)
1505                                         fr->fr_ip.fi_optmsk |= $1;)
1506                         }
1507         ;
1508
1509 ipv6hdrlist:
1510         ipv6hdr                         { $$ |= $1; }
1511         | ipv6hdrlist ',' ipv6hdr       { $$ |= $1 | $3; }
1512         ;
1513
1514 secname:
1515         seclevel                        { $$ |= $1; }
1516         | secname ',' seclevel          { $$ |= $1 | $3; }
1517         ;
1518
1519 seclevel:
1520         IPFY_SEC_UNC                    { $$ = secbit(IPSO_CLASS_UNCL); }
1521         | IPFY_SEC_CONF                 { $$ = secbit(IPSO_CLASS_CONF); }
1522         | IPFY_SEC_RSV1                 { $$ = secbit(IPSO_CLASS_RES1); }
1523         | IPFY_SEC_RSV2                 { $$ = secbit(IPSO_CLASS_RES2); }
1524         | IPFY_SEC_RSV3                 { $$ = secbit(IPSO_CLASS_RES3); }
1525         | IPFY_SEC_RSV4                 { $$ = secbit(IPSO_CLASS_RES4); }
1526         | IPFY_SEC_SEC                  { $$ = secbit(IPSO_CLASS_SECR); }
1527         | IPFY_SEC_TS                   { $$ = secbit(IPSO_CLASS_TOPS); }
1528         ;
1529
1530 icmptype:
1531         YY_NUMBER               { $$ = $1; }
1532         | YY_STR                { $$ = geticmptype(frc->fr_family, $1);
1533                                   if ($$ == -1)
1534                                         yyerror("unrecognised icmp type");
1535                                 }
1536         ;
1537
1538 icmpcode:
1539         YY_NUMBER                       { $$ = $1; }
1540         | IPFY_ICMPC_NETUNR             { $$ = ICMP_UNREACH_NET; }
1541         | IPFY_ICMPC_HSTUNR             { $$ = ICMP_UNREACH_HOST; }
1542         | IPFY_ICMPC_PROUNR             { $$ = ICMP_UNREACH_PROTOCOL; }
1543         | IPFY_ICMPC_PORUNR             { $$ = ICMP_UNREACH_PORT; }
1544         | IPFY_ICMPC_NEEDF              { $$ = ICMP_UNREACH_NEEDFRAG; }
1545         | IPFY_ICMPC_SRCFAIL            { $$ = ICMP_UNREACH_SRCFAIL; }
1546         | IPFY_ICMPC_NETUNK             { $$ = ICMP_UNREACH_NET_UNKNOWN; }
1547         | IPFY_ICMPC_HSTUNK             { $$ = ICMP_UNREACH_HOST_UNKNOWN; }
1548         | IPFY_ICMPC_ISOLATE            { $$ = ICMP_UNREACH_ISOLATED; }
1549         | IPFY_ICMPC_NETPRO             { $$ = ICMP_UNREACH_NET_PROHIB; }
1550         | IPFY_ICMPC_HSTPRO             { $$ = ICMP_UNREACH_HOST_PROHIB; }
1551         | IPFY_ICMPC_NETTOS             { $$ = ICMP_UNREACH_TOSNET; }
1552         | IPFY_ICMPC_HSTTOS             { $$ = ICMP_UNREACH_TOSHOST; }
1553         | IPFY_ICMPC_FLTPRO             { $$ = ICMP_UNREACH_ADMIN_PROHIBIT; }
1554         | IPFY_ICMPC_HSTPRE             { $$ = 14; }
1555         | IPFY_ICMPC_CUTPRE             { $$ = 15; }
1556         ;
1557
1558 opt:
1559         IPFY_IPOPT_NOP                  { $$ = getoptbyvalue(IPOPT_NOP); }
1560         | IPFY_IPOPT_RR                 { $$ = getoptbyvalue(IPOPT_RR); }
1561         | IPFY_IPOPT_ZSU                { $$ = getoptbyvalue(IPOPT_ZSU); }
1562         | IPFY_IPOPT_MTUP               { $$ = getoptbyvalue(IPOPT_MTUP); }
1563         | IPFY_IPOPT_MTUR               { $$ = getoptbyvalue(IPOPT_MTUR); }
1564         | IPFY_IPOPT_ENCODE             { $$ = getoptbyvalue(IPOPT_ENCODE); }
1565         | IPFY_IPOPT_TS                 { $$ = getoptbyvalue(IPOPT_TS); }
1566         | IPFY_IPOPT_TR                 { $$ = getoptbyvalue(IPOPT_TR); }
1567         | IPFY_IPOPT_SEC                { $$ = getoptbyvalue(IPOPT_SECURITY); }
1568         | IPFY_IPOPT_LSRR               { $$ = getoptbyvalue(IPOPT_LSRR); }
1569         | IPFY_IPOPT_ESEC               { $$ = getoptbyvalue(IPOPT_E_SEC); }
1570         | IPFY_IPOPT_CIPSO              { $$ = getoptbyvalue(IPOPT_CIPSO); }
1571         | IPFY_IPOPT_CIPSO doi          { $$ = getoptbyvalue(IPOPT_CIPSO); }
1572         | IPFY_IPOPT_SATID              { $$ = getoptbyvalue(IPOPT_SATID); }
1573         | IPFY_IPOPT_SSRR               { $$ = getoptbyvalue(IPOPT_SSRR); }
1574         | IPFY_IPOPT_ADDEXT             { $$ = getoptbyvalue(IPOPT_ADDEXT); }
1575         | IPFY_IPOPT_VISA               { $$ = getoptbyvalue(IPOPT_VISA); }
1576         | IPFY_IPOPT_IMITD              { $$ = getoptbyvalue(IPOPT_IMITD); }
1577         | IPFY_IPOPT_EIP                { $$ = getoptbyvalue(IPOPT_EIP); }
1578         | IPFY_IPOPT_FINN               { $$ = getoptbyvalue(IPOPT_FINN); }
1579         | IPFY_IPOPT_DPS                { $$ = getoptbyvalue(IPOPT_DPS); }
1580         | IPFY_IPOPT_SDB                { $$ = getoptbyvalue(IPOPT_SDB); }
1581         | IPFY_IPOPT_NSAPA              { $$ = getoptbyvalue(IPOPT_NSAPA); }
1582         | IPFY_IPOPT_RTRALRT            { $$ = getoptbyvalue(IPOPT_RTRALRT); }
1583         | IPFY_IPOPT_UMP                { $$ = getoptbyvalue(IPOPT_UMP); }
1584         | setsecclass secname
1585                         { DOALL(fr->fr_mip.fi_secmsk |= $2;
1586                                 if (fr->fr_family == AF_UNSPEC) {
1587                                         fr->fr_family = AF_INET;
1588                                         fr->fr_ip.fi_v = 4;
1589                                         fr->fr_mip.fi_v = 0xf;
1590                                 } else if (fr->fr_family != AF_INET) {
1591                                         YYERROR;
1592                                 }
1593                                 if (!nowith)
1594                                         fr->fr_ip.fi_secmsk |= $2;)
1595                           $$ = 0;
1596                           yyresetdict();
1597                         }
1598         ;
1599
1600 setsecclass:
1601         IPFY_SECCLASS                   { yysetdict(ipv4secwords); }
1602         ;
1603
1604 doi:    IPFY_DOI YY_NUMBER              { DOALL(fr->fr_doimask = 0xffffffff; \
1605                                                 if (!nowith) \
1606                                                         fr->fr_doi = $2;) }
1607         | IPFY_DOI YY_HEX               { DOALL(fr->fr_doimask = 0xffffffff; \
1608                                                 if (!nowith) \
1609                                                         fr->fr_doi = $2;) }
1610         ;
1611
1612 ipv6hdr:
1613         IPFY_AH                 { $$ = getv6optbyvalue(IPPROTO_AH); }
1614         | IPFY_IPV6OPT_DSTOPTS  { $$ = getv6optbyvalue(IPPROTO_DSTOPTS); }
1615         | IPFY_IPV6OPT_ESP      { $$ = getv6optbyvalue(IPPROTO_ESP); }
1616         | IPFY_IPV6OPT_HOPOPTS  { $$ = getv6optbyvalue(IPPROTO_HOPOPTS); }
1617         | IPFY_IPV6OPT_IPV6     { $$ = getv6optbyvalue(IPPROTO_IPV6); }
1618         | IPFY_IPV6OPT_NONE     { $$ = getv6optbyvalue(IPPROTO_NONE); }
1619         | IPFY_IPV6OPT_ROUTING  { $$ = getv6optbyvalue(IPPROTO_ROUTING); }
1620         | IPFY_IPV6OPT_FRAG     { $$ = getv6optbyvalue(IPPROTO_FRAGMENT); }
1621         | IPFY_IPV6OPT_MOBILITY { $$ = getv6optbyvalue(IPPROTO_MOBILITY); }
1622         ;
1623
1624 level:  IPFY_LEVEL                      { setsyslog(); }
1625         ;
1626
1627 loglevel:
1628         priority                        { fr->fr_loglevel = LOG_LOCAL0|$1; }
1629         | facility '.' priority         { fr->fr_loglevel = $1 | $3; }
1630         ;
1631
1632 facility:
1633         IPFY_FAC_KERN                   { $$ = LOG_KERN; }
1634         | IPFY_FAC_USER                 { $$ = LOG_USER; }
1635         | IPFY_FAC_MAIL                 { $$ = LOG_MAIL; }
1636         | IPFY_FAC_DAEMON               { $$ = LOG_DAEMON; }
1637         | IPFY_FAC_AUTH                 { $$ = LOG_AUTH; }
1638         | IPFY_FAC_SYSLOG               { $$ = LOG_SYSLOG; }
1639         | IPFY_FAC_LPR                  { $$ = LOG_LPR; }
1640         | IPFY_FAC_NEWS                 { $$ = LOG_NEWS; }
1641         | IPFY_FAC_UUCP                 { $$ = LOG_UUCP; }
1642         | IPFY_FAC_CRON                 { $$ = LOG_CRON; }
1643         | IPFY_FAC_FTP                  { $$ = LOG_FTP; }
1644         | IPFY_FAC_AUTHPRIV             { $$ = LOG_AUTHPRIV; }
1645         | IPFY_FAC_AUDIT                { $$ = LOG_AUDIT; }
1646         | IPFY_FAC_LFMT                 { $$ = LOG_LFMT; }
1647         | IPFY_FAC_LOCAL0               { $$ = LOG_LOCAL0; }
1648         | IPFY_FAC_LOCAL1               { $$ = LOG_LOCAL1; }
1649         | IPFY_FAC_LOCAL2               { $$ = LOG_LOCAL2; }
1650         | IPFY_FAC_LOCAL3               { $$ = LOG_LOCAL3; }
1651         | IPFY_FAC_LOCAL4               { $$ = LOG_LOCAL4; }
1652         | IPFY_FAC_LOCAL5               { $$ = LOG_LOCAL5; }
1653         | IPFY_FAC_LOCAL6               { $$ = LOG_LOCAL6; }
1654         | IPFY_FAC_LOCAL7               { $$ = LOG_LOCAL7; }
1655         | IPFY_FAC_SECURITY             { $$ = LOG_SECURITY; }
1656         ;
1657
1658 priority:
1659         IPFY_PRI_EMERG                  { $$ = LOG_EMERG; }
1660         | IPFY_PRI_ALERT                { $$ = LOG_ALERT; }
1661         | IPFY_PRI_CRIT                 { $$ = LOG_CRIT; }
1662         | IPFY_PRI_ERR                  { $$ = LOG_ERR; }
1663         | IPFY_PRI_WARN                 { $$ = LOG_WARNING; }
1664         | IPFY_PRI_NOTICE               { $$ = LOG_NOTICE; }
1665         | IPFY_PRI_INFO                 { $$ = LOG_INFO; }
1666         | IPFY_PRI_DEBUG                { $$ = LOG_DEBUG; }
1667         ;
1668
1669 compare:
1670         YY_CMP_EQ                       { $$ = FR_EQUAL; }
1671         | YY_CMP_NE                     { $$ = FR_NEQUAL; }
1672         | YY_CMP_LT                     { $$ = FR_LESST; }
1673         | YY_CMP_LE                     { $$ = FR_LESSTE; }
1674         | YY_CMP_GT                     { $$ = FR_GREATERT; }
1675         | YY_CMP_GE                     { $$ = FR_GREATERTE; }
1676         ;
1677
1678 range:  YY_RANGE_IN                     { $$ = FR_INRANGE; }
1679         | YY_RANGE_OUT                  { $$ = FR_OUTRANGE; }
1680         | ':'                           { $$ = FR_INCRANGE; }
1681         ;
1682
1683 servicename:
1684         YY_STR                          { $$ = $1; }
1685         ;
1686
1687 interfacename:  name                            { $$ = $1; }
1688         | name ':' YY_NUMBER
1689                 { $$ = $1;
1690                   fprintf(stderr, "%d: Logical interface %s:%d unsupported, "
1691                           "use the physical interface %s instead.\n",
1692                           yylineNum, $1, $3, $1);
1693                 }
1694         ;
1695
1696 name:   YY_STR                          { $$ = $1; }
1697         | '-'                           { $$ = strdup("-"); }
1698         ;
1699
1700 ipv4_16:
1701         YY_NUMBER '.' YY_NUMBER
1702                 { if ($1 > 255 || $3 > 255) {
1703                         yyerror("Invalid octet string for IP address");
1704                         return 0;
1705                   }
1706                   $$.s_addr = ($1 << 24) | ($3 << 16);
1707                   $$.s_addr = htonl($$.s_addr);
1708                 }
1709         ;
1710
1711 ipv4_24:
1712         ipv4_16 '.' YY_NUMBER
1713                 { if ($3 > 255) {
1714                         yyerror("Invalid octet string for IP address");
1715                         return 0;
1716                   }
1717                   $$.s_addr |= htonl($3 << 8);
1718                 }
1719         ;
1720
1721 ipv4:   ipv4_24 '.' YY_NUMBER
1722                 { if ($3 > 255) {
1723                         yyerror("Invalid octet string for IP address");
1724                         return 0;
1725                   }
1726                   $$.s_addr |= htonl($3);
1727                 }
1728         | ipv4_24
1729         | ipv4_16
1730         ;
1731
1732 %%
1733
1734
1735 static  struct  wordtab ipfwords[] = {
1736         { "age",                        IPFY_AGE },
1737         { "ah",                         IPFY_AH },
1738         { "all",                        IPFY_ALL },
1739         { "and",                        IPFY_AND },
1740         { "auth",                       IPFY_AUTH },
1741         { "bad",                        IPFY_BAD },
1742         { "bad-nat",                    IPFY_BADNAT },
1743         { "bad-src",                    IPFY_BADSRC },
1744         { "bcast",                      IPFY_BROADCAST },
1745         { "block",                      IPFY_BLOCK },
1746         { "body",                       IPFY_BODY },
1747         { "bpf-v4",                     IPFY_BPFV4 },
1748 #ifdef USE_INET6
1749         { "bpf-v6",                     IPFY_BPFV6 },
1750 #endif
1751         { "call",                       IPFY_CALL },
1752         { "code",                       IPFY_ICMPCODE },
1753         { "comment",                    IPFY_COMMENT },
1754         { "count",                      IPFY_COUNT },
1755         { "decapsulate",                IPFY_DECAPS },
1756         { "dstlist",                    IPFY_DSTLIST },
1757         { "doi",                        IPFY_DOI },
1758         { "dup-to",                     IPFY_DUPTO },
1759         { "eq",                         YY_CMP_EQ },
1760         { "esp",                        IPFY_ESP },
1761         { "exp",                        IPFY_IPFEXPR },
1762         { "family",                     IPFY_FAMILY },
1763         { "fastroute",                  IPFY_FROUTE },
1764         { "first",                      IPFY_FIRST },
1765         { "flags",                      IPFY_FLAGS },
1766         { "frag",                       IPFY_FRAG },
1767         { "frag-body",                  IPFY_FRAGBODY },
1768         { "frags",                      IPFY_FRAGS },
1769         { "from",                       IPFY_FROM },
1770         { "ge",                         YY_CMP_GE },
1771         { "group",                      IPFY_GROUP },
1772         { "gt",                         YY_CMP_GT },
1773         { "head",                       IPFY_HEAD },
1774         { "icmp",                       IPFY_ICMP },
1775         { "icmp-head",                  IPFY_ICMPHEAD },
1776         { "icmp-type",                  IPFY_ICMPTYPE },
1777         { "in",                         IPFY_IN },
1778         { "in-via",                     IPFY_INVIA },
1779         { "inet",                       IPFY_INET },
1780         { "inet6",                      IPFY_INET6 },
1781         { "ipopt",                      IPFY_IPOPTS },
1782         { "ipopts",                     IPFY_IPOPTS },
1783         { "keep",                       IPFY_KEEP },
1784         { "l5-as",                      IPFY_L5AS },
1785         { "le",                         YY_CMP_LE },
1786         { "level",                      IPFY_LEVEL },
1787         { "limit",                      IPFY_LIMIT },
1788         { "log",                        IPFY_LOG },
1789         { "loose",                      IPFY_LOOSE },
1790         { "lowttl",                     IPFY_LOWTTL },
1791         { "lt",                         YY_CMP_LT },
1792         { "mask",                       IPFY_MASK },
1793         { "match-tag",                  IPFY_MATCHTAG },
1794         { "max-per-src",                IPFY_MAX_PER_SRC },
1795         { "max-srcs",                   IPFY_MAX_SRCS },
1796         { "mbcast",                     IPFY_MBCAST },
1797         { "mcast",                      IPFY_MULTICAST },
1798         { "multicast",                  IPFY_MULTICAST },
1799         { "nat",                        IPFY_NAT },
1800         { "ne",                         YY_CMP_NE },
1801         { "net",                        IPFY_NETWORK },
1802         { "newisn",                     IPFY_NEWISN },
1803         { "no",                         IPFY_NO },
1804         { "no-icmp-err",                IPFY_NOICMPERR },
1805         { "nolog",                      IPFY_NOLOG },
1806         { "nomatch",                    IPFY_NOMATCH },
1807         { "now",                        IPFY_NOW },
1808         { "not",                        IPFY_NOT },
1809         { "oow",                        IPFY_OOW },
1810         { "on",                         IPFY_ON },
1811         { "opt",                        IPFY_OPT },
1812         { "or-block",                   IPFY_ORBLOCK },
1813         { "out",                        IPFY_OUT },
1814         { "out-via",                    IPFY_OUTVIA },
1815         { "pass",                       IPFY_PASS },
1816         { "port",                       IPFY_PORT },
1817         { "pps",                        IPFY_PPS },
1818         { "preauth",                    IPFY_PREAUTH },
1819         { "proto",                      IPFY_PROTO },
1820         { "quick",                      IPFY_QUICK },
1821         { "reply-to",                   IPFY_REPLY_TO },
1822         { "return-icmp",                IPFY_RETICMP },
1823         { "return-icmp-as-dest",        IPFY_RETICMPASDST },
1824         { "return-rst",                 IPFY_RETRST },
1825         { "route-to",                   IPFY_ROUTETO },
1826         { "rule-ttl",                   IPFY_RULETTL },
1827         { "rpc",                        IPFY_RPC },
1828         { "sec-class",                  IPFY_SECCLASS },
1829         { "set",                        IPFY_SET },
1830         { "set-tag",                    IPFY_SETTAG },
1831         { "skip",                       IPFY_SKIP },
1832         { "short",                      IPFY_SHORT },
1833         { "state",                      IPFY_STATE },
1834         { "state-age",                  IPFY_AGE },
1835         { "strict",                     IPFY_STRICT },
1836         { "sync",                       IPFY_SYNC },
1837         { "tcp",                        IPFY_TCP },
1838         { "tcp-udp",                    IPFY_TCPUDP },
1839         { "tos",                        IPFY_TOS },
1840         { "to",                         IPFY_TO },
1841         { "ttl",                        IPFY_TTL },
1842         { "udp",                        IPFY_UDP },
1843         { "v6hdr",                      IPFY_V6HDR },
1844         { "v6hdrs",                     IPFY_V6HDRS },
1845         { "with",                       IPFY_WITH },
1846         { NULL,                         0 }
1847 };
1848
1849 static  struct  wordtab addrwords[] = {
1850         { "any",                        IPFY_ANY },
1851         { "hash",                       IPFY_HASH },
1852         { "pool",                       IPFY_POOL },
1853         { NULL,                         0 }
1854 };
1855
1856 static  struct  wordtab maskwords[] = {
1857         { "broadcast",                  IPFY_BROADCAST },
1858         { "netmasked",                  IPFY_NETMASKED },
1859         { "network",                    IPFY_NETWORK },
1860         { "peer",                       IPFY_PEER },
1861         { NULL,                         0 }
1862 };
1863
1864 static  struct  wordtab icmpcodewords[] = {
1865         { "cutoff-preced",              IPFY_ICMPC_CUTPRE },
1866         { "filter-prohib",              IPFY_ICMPC_FLTPRO },
1867         { "isolate",                    IPFY_ICMPC_ISOLATE },
1868         { "needfrag",                   IPFY_ICMPC_NEEDF },
1869         { "net-prohib",                 IPFY_ICMPC_NETPRO },
1870         { "net-tos",                    IPFY_ICMPC_NETTOS },
1871         { "host-preced",                IPFY_ICMPC_HSTPRE },
1872         { "host-prohib",                IPFY_ICMPC_HSTPRO },
1873         { "host-tos",                   IPFY_ICMPC_HSTTOS },
1874         { "host-unk",                   IPFY_ICMPC_HSTUNK },
1875         { "host-unr",                   IPFY_ICMPC_HSTUNR },
1876         { "net-unk",                    IPFY_ICMPC_NETUNK },
1877         { "net-unr",                    IPFY_ICMPC_NETUNR },
1878         { "port-unr",                   IPFY_ICMPC_PORUNR },
1879         { "proto-unr",                  IPFY_ICMPC_PROUNR },
1880         { "srcfail",                    IPFY_ICMPC_SRCFAIL },
1881         { NULL,                         0 },
1882 };
1883
1884 static  struct  wordtab ipv4optwords[] = {
1885         { "addext",                     IPFY_IPOPT_ADDEXT },
1886         { "cipso",                      IPFY_IPOPT_CIPSO },
1887         { "dps",                        IPFY_IPOPT_DPS },
1888         { "e-sec",                      IPFY_IPOPT_ESEC },
1889         { "eip",                        IPFY_IPOPT_EIP },
1890         { "encode",                     IPFY_IPOPT_ENCODE },
1891         { "finn",                       IPFY_IPOPT_FINN },
1892         { "imitd",                      IPFY_IPOPT_IMITD },
1893         { "lsrr",                       IPFY_IPOPT_LSRR },
1894         { "mtup",                       IPFY_IPOPT_MTUP },
1895         { "mtur",                       IPFY_IPOPT_MTUR },
1896         { "nop",                        IPFY_IPOPT_NOP },
1897         { "nsapa",                      IPFY_IPOPT_NSAPA },
1898         { "rr",                         IPFY_IPOPT_RR },
1899         { "rtralrt",                    IPFY_IPOPT_RTRALRT },
1900         { "satid",                      IPFY_IPOPT_SATID },
1901         { "sdb",                        IPFY_IPOPT_SDB },
1902         { "sec",                        IPFY_IPOPT_SEC },
1903         { "ssrr",                       IPFY_IPOPT_SSRR },
1904         { "tr",                         IPFY_IPOPT_TR },
1905         { "ts",                         IPFY_IPOPT_TS },
1906         { "ump",                        IPFY_IPOPT_UMP },
1907         { "visa",                       IPFY_IPOPT_VISA },
1908         { "zsu",                        IPFY_IPOPT_ZSU },
1909         { NULL,                         0 },
1910 };
1911
1912 static  struct  wordtab ipv4secwords[] = {
1913         { "confid",                     IPFY_SEC_CONF },
1914         { "reserv-1",                   IPFY_SEC_RSV1 },
1915         { "reserv-2",                   IPFY_SEC_RSV2 },
1916         { "reserv-3",                   IPFY_SEC_RSV3 },
1917         { "reserv-4",                   IPFY_SEC_RSV4 },
1918         { "secret",                     IPFY_SEC_SEC },
1919         { "topsecret",                  IPFY_SEC_TS },
1920         { "unclass",                    IPFY_SEC_UNC },
1921         { NULL,                         0 },
1922 };
1923
1924 static  struct  wordtab ipv6optwords[] = {
1925         { "dstopts",                    IPFY_IPV6OPT_DSTOPTS },
1926         { "esp",                        IPFY_IPV6OPT_ESP },
1927         { "frag",                       IPFY_IPV6OPT_FRAG },
1928         { "hopopts",                    IPFY_IPV6OPT_HOPOPTS },
1929         { "ipv6",                       IPFY_IPV6OPT_IPV6 },
1930         { "mobility",                   IPFY_IPV6OPT_MOBILITY },
1931         { "none",                       IPFY_IPV6OPT_NONE },
1932         { "routing",                    IPFY_IPV6OPT_ROUTING },
1933         { NULL,                         0 },
1934 };
1935
1936 static  struct  wordtab logwords[] = {
1937         { "kern",                       IPFY_FAC_KERN },
1938         { "user",                       IPFY_FAC_USER },
1939         { "mail",                       IPFY_FAC_MAIL },
1940         { "daemon",                     IPFY_FAC_DAEMON },
1941         { "auth",                       IPFY_FAC_AUTH },
1942         { "syslog",                     IPFY_FAC_SYSLOG },
1943         { "lpr",                        IPFY_FAC_LPR },
1944         { "news",                       IPFY_FAC_NEWS },
1945         { "uucp",                       IPFY_FAC_UUCP },
1946         { "cron",                       IPFY_FAC_CRON },
1947         { "ftp",                        IPFY_FAC_FTP },
1948         { "authpriv",                   IPFY_FAC_AUTHPRIV },
1949         { "audit",                      IPFY_FAC_AUDIT },
1950         { "logalert",                   IPFY_FAC_LFMT },
1951         { "console",                    IPFY_FAC_CONSOLE },
1952         { "security",                   IPFY_FAC_SECURITY },
1953         { "local0",                     IPFY_FAC_LOCAL0 },
1954         { "local1",                     IPFY_FAC_LOCAL1 },
1955         { "local2",                     IPFY_FAC_LOCAL2 },
1956         { "local3",                     IPFY_FAC_LOCAL3 },
1957         { "local4",                     IPFY_FAC_LOCAL4 },
1958         { "local5",                     IPFY_FAC_LOCAL5 },
1959         { "local6",                     IPFY_FAC_LOCAL6 },
1960         { "local7",                     IPFY_FAC_LOCAL7 },
1961         { "emerg",                      IPFY_PRI_EMERG },
1962         { "alert",                      IPFY_PRI_ALERT },
1963         { "crit",                       IPFY_PRI_CRIT },
1964         { "err",                        IPFY_PRI_ERR },
1965         { "warn",                       IPFY_PRI_WARN },
1966         { "notice",                     IPFY_PRI_NOTICE },
1967         { "info",                       IPFY_PRI_INFO },
1968         { "debug",                      IPFY_PRI_DEBUG },
1969         { NULL,                         0 },
1970 };
1971
1972
1973
1974
1975 int ipf_parsefile(fd, addfunc, iocfuncs, filename)
1976 int fd;
1977 addfunc_t addfunc;
1978 ioctlfunc_t *iocfuncs;
1979 char *filename;
1980 {
1981         FILE *fp = NULL;
1982         char *s;
1983
1984         yylineNum = 1;
1985         yysettab(ipfwords);
1986
1987         s = getenv("YYDEBUG");
1988         if (s != NULL)
1989                 yydebug = atoi(s);
1990         else
1991                 yydebug = 0;
1992
1993         if (strcmp(filename, "-")) {
1994                 fp = fopen(filename, "r");
1995                 if (fp == NULL) {
1996                         fprintf(stderr, "fopen(%s) failed: %s\n", filename,
1997                                 STRERROR(errno));
1998                         return -1;
1999                 }
2000         } else
2001                 fp = stdin;
2002
2003         while (ipf_parsesome(fd, addfunc, iocfuncs, fp) == 1)
2004                 ;
2005         if (fp != NULL)
2006                 fclose(fp);
2007         return 0;
2008 }
2009
2010
2011 int ipf_parsesome(fd, addfunc, iocfuncs, fp)
2012 int fd;
2013 addfunc_t addfunc;
2014 ioctlfunc_t *iocfuncs;
2015 FILE *fp;
2016 {
2017         char *s;
2018         int i;
2019
2020         ipffd = fd;
2021         for (i = 0; i <= IPL_LOGMAX; i++)
2022                 ipfioctls[i] = iocfuncs[i];
2023         ipfaddfunc = addfunc;
2024
2025         if (feof(fp))
2026                 return 0;
2027         i = fgetc(fp);
2028         if (i == EOF)
2029                 return 0;
2030         if (ungetc(i, fp) == 0)
2031                 return 0;
2032         if (feof(fp))
2033                 return 0;
2034         s = getenv("YYDEBUG");
2035         if (s != NULL)
2036                 yydebug = atoi(s);
2037         else
2038                 yydebug = 0;
2039
2040         yyin = fp;
2041         yyparse();
2042         return 1;
2043 }
2044
2045
2046 static void newrule()
2047 {
2048         frentry_t *frn;
2049
2050         frn = allocfr();
2051         for (fr = frtop; fr != NULL && fr->fr_next != NULL; fr = fr->fr_next)
2052                 ;
2053         if (fr != NULL) {
2054                 fr->fr_next = frn;
2055                 frn->fr_pnext = &fr->fr_next;
2056         }
2057         if (frtop == NULL) {
2058                 frtop = frn;
2059                 frn->fr_pnext = &frtop;
2060         }
2061         fr = frn;
2062         frc = frn;
2063         fr->fr_loglevel = 0xffff;
2064         fr->fr_isc = (void *)-1;
2065         fr->fr_logtag = FR_NOLOGTAG;
2066         fr->fr_type = FR_T_NONE;
2067         fr->fr_flineno = yylineNum;
2068
2069         if (use_inet6 == 1)
2070                 fr->fr_family = AF_INET6;
2071         else if (use_inet6 == -1)
2072                 fr->fr_family = AF_INET;
2073
2074         nrules = 1;
2075 }
2076
2077
2078 static void setipftype()
2079 {
2080         for (fr = frc; fr != NULL; fr = fr->fr_next) {
2081                 if (fr->fr_type == FR_T_NONE) {
2082                         fr->fr_type = FR_T_IPF;
2083                         fr->fr_data = (void *)calloc(sizeof(fripf_t), 1);
2084                         fr->fr_dsize = sizeof(fripf_t);
2085                         fr->fr_family = frc->fr_family;
2086                         if (fr->fr_family == AF_INET) {
2087                                 fr->fr_ip.fi_v = 4;
2088                         }
2089                         else if (fr->fr_family == AF_INET6) {
2090                                 fr->fr_ip.fi_v = 6;
2091                         }
2092                         fr->fr_mip.fi_v = 0xf;
2093                         fr->fr_ipf->fri_sifpidx = -1;
2094                         fr->fr_ipf->fri_difpidx = -1;
2095                 }
2096                 if (fr->fr_type != FR_T_IPF) {
2097                         fprintf(stderr, "IPF Type not set\n");
2098                 }
2099         }
2100 }
2101
2102
2103 static frentry_t *addrule()
2104 {
2105         frentry_t *f, *f1, *f2;
2106         int count;
2107
2108         for (f2 = frc; f2->fr_next != NULL; f2 = f2->fr_next)
2109                 ;
2110
2111         count = nrules;
2112         f = f2;
2113         for (f1 = frc; count > 0; count--, f1 = f1->fr_next) {
2114                 f->fr_next = allocfr();
2115                 if (f->fr_next == NULL)
2116                         return NULL;
2117                 f->fr_next->fr_pnext = &f->fr_next;
2118                 added++;
2119                 f = f->fr_next;
2120                 *f = *f1;
2121                 f->fr_next = NULL;
2122                 if (f->fr_caddr != NULL) {
2123                         f->fr_caddr = malloc(f->fr_dsize);
2124                         bcopy(f1->fr_caddr, f->fr_caddr, f->fr_dsize);
2125                 }
2126         }
2127
2128         return f2->fr_next;
2129 }
2130
2131
2132 static int
2133 lookuphost(name, addrp)
2134         char *name;
2135         i6addr_t *addrp;
2136 {
2137         int i;
2138
2139         hashed = 0;
2140         pooled = 0;
2141         dynamic = -1;
2142
2143         for (i = 0; i < 4; i++) {
2144                 if (fr->fr_ifnames[i] == -1)
2145                         continue;
2146                 if (strcmp(name, fr->fr_names + fr->fr_ifnames[i]) == 0) {
2147                         ifpflag = FRI_DYNAMIC;
2148                         dynamic = addname(&fr, name);
2149                         return 1;
2150                 }
2151         }
2152
2153         if (gethost(AF_INET, name, addrp) == -1) {
2154                 fprintf(stderr, "unknown name \"%s\"\n", name);
2155                 return -1;
2156         }
2157         return 0;
2158 }
2159
2160
2161 static void dobpf(v, phrase)
2162 int v;
2163 char *phrase;
2164 {
2165 #ifdef IPFILTER_BPF
2166         struct bpf_program bpf;
2167         struct pcap *p;
2168 #endif
2169         fakebpf_t *fb;
2170         u_32_t l;
2171         char *s;
2172         int i;
2173
2174         for (fr = frc; fr != NULL; fr = fr->fr_next) {
2175                 if (fr->fr_type != FR_T_NONE) {
2176                         fprintf(stderr, "cannot mix IPF and BPF matching\n");
2177                         return;
2178                 }
2179                 fr->fr_family = vtof(v);
2180                 fr->fr_type = FR_T_BPFOPC;
2181
2182                 if (!strncmp(phrase, "0x", 2)) {
2183                         fb = malloc(sizeof(fakebpf_t));
2184
2185                         for (i = 0, s = strtok(phrase, " \r\n\t"); s != NULL;
2186                              s = strtok(NULL, " \r\n\t"), i++) {
2187                                 fb = realloc(fb, (i / 4 + 1) * sizeof(*fb));
2188                                 l = (u_32_t)strtol(s, NULL, 0);
2189                                 switch (i & 3)
2190                                 {
2191                                 case 0 :
2192                                         fb[i / 4].fb_c = l & 0xffff;
2193                                         break;
2194                                 case 1 :
2195                                         fb[i / 4].fb_t = l & 0xff;
2196                                         break;
2197                                 case 2 :
2198                                         fb[i / 4].fb_f = l & 0xff;
2199                                         break;
2200                                 case 3 :
2201                                         fb[i / 4].fb_k = l;
2202                                         break;
2203                                 }
2204                         }
2205                         if ((i & 3) != 0) {
2206                                 fprintf(stderr,
2207                                         "Odd number of bytes in BPF code\n");
2208                                 exit(1);
2209                         }
2210                         i--;
2211                         fr->fr_dsize = (i / 4 + 1) * sizeof(*fb);
2212                         fr->fr_data = fb;
2213                         return;
2214                 }
2215
2216 #ifdef IPFILTER_BPF
2217                 bzero((char *)&bpf, sizeof(bpf));
2218                 p = pcap_open_dead(DLT_RAW, 1);
2219                 if (!p) {
2220                         fprintf(stderr, "pcap_open_dead failed\n");
2221                         return;
2222                 }
2223
2224                 if (pcap_compile(p, &bpf, phrase, 1, 0xffffffff)) {
2225                         pcap_perror(p, "ipf");
2226                         pcap_close(p);
2227                         fprintf(stderr, "pcap parsing failed (%s)\n", phrase);
2228                         return;
2229                 }
2230                 pcap_close(p);
2231
2232                 fr->fr_dsize = bpf.bf_len * sizeof(struct bpf_insn);
2233                 fr->fr_data = malloc(fr->fr_dsize);
2234                 bcopy((char *)bpf.bf_insns, fr->fr_data, fr->fr_dsize);
2235                 if (!bpf_validate(fr->fr_data, bpf.bf_len)) {
2236                         fprintf(stderr, "BPF validation failed\n");
2237                         return;
2238                 }
2239 #endif
2240         }
2241
2242 #ifdef IPFILTER_BPF
2243         if (opts & OPT_DEBUG)
2244                 bpf_dump(&bpf, 0);
2245 #else
2246         fprintf(stderr, "BPF filter expressions not supported\n");
2247         exit(1);
2248 #endif
2249 }
2250
2251
2252 static void resetaddr()
2253 {
2254         hashed = 0;
2255         pooled = 0;
2256         dynamic = -1;
2257 }
2258
2259
2260 static alist_t *newalist(ptr)
2261 alist_t *ptr;
2262 {
2263         alist_t *al;
2264
2265         al = malloc(sizeof(*al));
2266         if (al == NULL)
2267                 return NULL;
2268         al->al_not = 0;
2269         al->al_next = ptr;
2270         return al;
2271 }
2272
2273
2274 static int
2275 makepool(list)
2276         alist_t *list;
2277 {
2278         ip_pool_node_t *n, *top;
2279         ip_pool_t pool;
2280         alist_t *a;
2281         int num;
2282
2283         if (list == NULL)
2284                 return 0;
2285         top = calloc(1, sizeof(*top));
2286         if (top == NULL)
2287                 return 0;
2288
2289         for (n = top, a = list; (n != NULL) && (a != NULL); a = a->al_next) {
2290                 if (use_inet6 == 1) {
2291 #ifdef AF_INET6
2292                         n->ipn_addr.adf_family = AF_INET6;
2293                         n->ipn_addr.adf_addr = a->al_i6addr;
2294                         n->ipn_addr.adf_len = offsetof(addrfamily_t,
2295                                                        adf_addr) + 16;
2296                         n->ipn_mask.adf_family = AF_INET6;
2297                         n->ipn_mask.adf_addr = a->al_i6mask;
2298                         n->ipn_mask.adf_len = offsetof(addrfamily_t,
2299                                                        adf_addr) + 16;
2300
2301 #endif
2302                 } else {
2303                         n->ipn_addr.adf_family = AF_INET;
2304                         n->ipn_addr.adf_addr.in4.s_addr = a->al_1;
2305                         n->ipn_addr.adf_len = offsetof(addrfamily_t,
2306                                                        adf_addr) + 4;
2307                         n->ipn_mask.adf_family = AF_INET;
2308                         n->ipn_mask.adf_addr.in4.s_addr = a->al_2;
2309                         n->ipn_mask.adf_len = offsetof(addrfamily_t,
2310                                                        adf_addr) + 4;
2311                 }
2312                 n->ipn_info = a->al_not;
2313                 if (a->al_next != NULL) {
2314                         n->ipn_next = calloc(1, sizeof(*n));
2315                         n = n->ipn_next;
2316                 }
2317         }
2318
2319         bzero((char *)&pool, sizeof(pool));
2320         pool.ipo_unit = IPL_LOGIPF;
2321         pool.ipo_list = top;
2322         num = load_pool(&pool, ipfioctls[IPL_LOGLOOKUP]);
2323
2324         while ((n = top) != NULL) {
2325                 top = n->ipn_next;
2326                 free(n);
2327         }
2328         return num;
2329 }
2330
2331
2332 static u_int makehash(list)
2333 alist_t *list;
2334 {
2335         iphtent_t *n, *top;
2336         iphtable_t iph;
2337         alist_t *a;
2338         int num;
2339
2340         if (list == NULL)
2341                 return 0;
2342         top = calloc(1, sizeof(*top));
2343         if (top == NULL)
2344                 return 0;
2345
2346         for (n = top, a = list; (n != NULL) && (a != NULL); a = a->al_next) {
2347                 if (a->al_family == AF_INET6) {
2348                         n->ipe_family = AF_INET6;
2349                         n->ipe_addr = a->al_i6addr;
2350                         n->ipe_mask = a->al_i6mask;
2351                 } else {
2352                         n->ipe_family = AF_INET;
2353                         n->ipe_addr.in4_addr = a->al_1;
2354                         n->ipe_mask.in4_addr = a->al_2;
2355                 }
2356                 n->ipe_value = 0;
2357                 if (a->al_next != NULL) {
2358                         n->ipe_next = calloc(1, sizeof(*n));
2359                         n = n->ipe_next;
2360                 }
2361         }
2362
2363         bzero((char *)&iph, sizeof(iph));
2364         iph.iph_unit = IPL_LOGIPF;
2365         iph.iph_type = IPHASH_LOOKUP;
2366         *iph.iph_name = '\0';
2367
2368         if (load_hash(&iph, top, ipfioctls[IPL_LOGLOOKUP]) == 0)
2369                 sscanf(iph.iph_name, "%u", &num);
2370         else
2371                 num = 0;
2372
2373         while ((n = top) != NULL) {
2374                 top = n->ipe_next;
2375                 free(n);
2376         }
2377         return num;
2378 }
2379
2380
2381 int ipf_addrule(fd, ioctlfunc, ptr)
2382 int fd;
2383 ioctlfunc_t ioctlfunc;
2384 void *ptr;
2385 {
2386         ioctlcmd_t add, del;
2387         frentry_t *fr;
2388         ipfobj_t obj;
2389
2390         if (ptr == NULL)
2391                 return 0;
2392
2393         fr = ptr;
2394         add = 0;
2395         del = 0;
2396
2397         bzero((char *)&obj, sizeof(obj));
2398         obj.ipfo_rev = IPFILTER_VERSION;
2399         obj.ipfo_size = fr->fr_size;
2400         obj.ipfo_type = IPFOBJ_FRENTRY;
2401         obj.ipfo_ptr = ptr;
2402
2403         if ((opts & OPT_DONOTHING) != 0)
2404                 fd = -1;
2405
2406         if (opts & OPT_ZERORULEST) {
2407                 add = SIOCZRLST;
2408         } else if (opts & OPT_INACTIVE) {
2409                 add = (u_int)fr->fr_hits ? SIOCINIFR :
2410                                            SIOCADIFR;
2411                 del = SIOCRMIFR;
2412         } else {
2413                 add = (u_int)fr->fr_hits ? SIOCINAFR :
2414                                            SIOCADAFR;
2415                 del = SIOCRMAFR;
2416         }
2417
2418         if ((opts & OPT_OUTQUE) != 0)
2419                 fr->fr_flags |= FR_OUTQUE;
2420         if (fr->fr_hits)
2421                 fr->fr_hits--;
2422         if ((opts & OPT_VERBOSE) != 0)
2423                 printfr(fr, ioctlfunc);
2424
2425         if ((opts & OPT_DEBUG) != 0) {
2426                 binprint(fr, sizeof(*fr));
2427                 if (fr->fr_data != NULL)
2428                         binprint(fr->fr_data, fr->fr_dsize);
2429         }
2430
2431         if ((opts & OPT_ZERORULEST) != 0) {
2432                 if ((*ioctlfunc)(fd, add, (void *)&obj) == -1) {
2433                         if ((opts & OPT_DONOTHING) == 0) {
2434                                 char msg[80];
2435
2436                                 sprintf(msg, "%d:ioctl(zero rule)",
2437                                         fr->fr_flineno);
2438                                 return ipf_perror_fd(fd, ioctlfunc, msg);
2439                         }
2440                 } else {
2441 #ifdef  USE_QUAD_T
2442                         printf("hits %qd bytes %qd ",
2443                                 (long long)fr->fr_hits,
2444                                 (long long)fr->fr_bytes);
2445 #else
2446                         printf("hits %ld bytes %ld ",
2447                                 fr->fr_hits, fr->fr_bytes);
2448 #endif
2449                         printfr(fr, ioctlfunc);
2450                 }
2451         } else if ((opts & OPT_REMOVE) != 0) {
2452                 if ((*ioctlfunc)(fd, del, (void *)&obj) == -1) {
2453                         if ((opts & OPT_DONOTHING) == 0) {
2454                                 char msg[80];
2455
2456                                 sprintf(msg, "%d:ioctl(delete rule)",
2457                                         fr->fr_flineno);
2458                                 return ipf_perror_fd(fd, ioctlfunc, msg);
2459                         }
2460                 }
2461         } else {
2462                 if ((*ioctlfunc)(fd, add, (void *)&obj) == -1) {
2463                         if ((opts & OPT_DONOTHING) == 0) {
2464                                 char msg[80];
2465
2466                                 sprintf(msg, "%d:ioctl(add/insert rule)",
2467                                         fr->fr_flineno);
2468                                 return ipf_perror_fd(fd, ioctlfunc, msg);
2469                         }
2470                 }
2471         }
2472         return 0;
2473 }
2474
2475 static void setsyslog()
2476 {
2477         yysetdict(logwords);
2478         yybreakondot = 1;
2479 }
2480
2481
2482 static void unsetsyslog()
2483 {
2484         yyresetdict();
2485         yybreakondot = 0;
2486 }
2487
2488
2489 static void fillgroup(fr)
2490 frentry_t *fr;
2491 {
2492         frentry_t *f;
2493
2494         for (f = frold; f != NULL; f = f->fr_next) {
2495                 if (f->fr_grhead == -1 && fr->fr_group == -1)
2496                         break;
2497                 if (f->fr_grhead == -1 || fr->fr_group == -1)
2498                         continue;
2499                 if (strcmp(f->fr_names + f->fr_grhead,
2500                            fr->fr_names + fr->fr_group) == 0)
2501                         break;
2502         }
2503
2504         if (f == NULL)
2505                 return;
2506
2507         /*
2508          * Only copy down matching fields if the rules are of the same type
2509          * and are of ipf type.   The only fields that are copied are those
2510          * that impact the rule parsing itself, eg. need for knowing what the
2511          * protocol should be for rules with port comparisons in them.
2512          */
2513         if (f->fr_type != fr->fr_type || f->fr_type != FR_T_IPF)
2514                 return;
2515
2516         if (fr->fr_family == 0 && f->fr_family != 0)
2517                 fr->fr_family = f->fr_family;
2518
2519         if (fr->fr_mproto == 0 && f->fr_mproto != 0)
2520                 fr->fr_mproto = f->fr_mproto;
2521         if (fr->fr_proto == 0 && f->fr_proto != 0)
2522                 fr->fr_proto = f->fr_proto;
2523
2524         if ((fr->fr_mproto == 0) && ((fr->fr_flx & FI_TCPUDP) == 0) &&
2525             ((f->fr_flx & FI_TCPUDP) != 0)) {
2526                 fr->fr_flx |= FI_TCPUDP;
2527                 fr->fr_mflx |= FI_TCPUDP;
2528         }
2529 }
2530
2531
2532 static void doipfexpr(line)
2533 char *line;
2534 {
2535         int *array;
2536         char *error;
2537
2538         array = parseipfexpr(line, &error);
2539         if (array == NULL) {
2540                 fprintf(stderr, "%s:", error);
2541                 yyerror("error parsing ipf matching expression");
2542                 return;
2543         }
2544
2545         fr->fr_type = FR_T_IPFEXPR;
2546         fr->fr_data = array;
2547         fr->fr_dsize = array[0] * sizeof(*array);
2548 }
2549
2550
2551 static void do_tuneint(varname, value)
2552 char *varname;
2553 int value;
2554 {
2555         char buffer[80];
2556
2557         strncpy(buffer, varname, 60);
2558         buffer[59] = '\0';
2559         strcat(buffer, "=");
2560         sprintf(buffer, "%u", value);
2561         ipf_dotuning(ipffd, buffer, ioctl);
2562 }
2563
2564
2565 static void do_tunestr(varname, value)
2566 char *varname, *value;
2567 {
2568
2569         if (!strcasecmp(value, "true")) {
2570                 do_tuneint(varname, 1);
2571         } else if (!strcasecmp(value, "false")) {
2572                 do_tuneint(varname, 0);
2573         } else {
2574                 yyerror("did not find true/false where expected");
2575         }
2576 }
2577
2578
2579 static void setifname(frp, idx, name)
2580 frentry_t **frp;
2581 int idx;
2582 char *name;
2583 {
2584         int pos;
2585
2586         pos = addname(frp, name);
2587         if (pos == -1)
2588                 return;
2589         (*frp)->fr_ifnames[idx] = pos;
2590 }
2591
2592
2593 static int addname(frp, name)
2594 frentry_t **frp;
2595 char *name;
2596 {
2597         frentry_t *f;
2598         int nlen;
2599         int pos;
2600
2601         nlen = strlen(name) + 1;
2602         f = realloc(*frp, (*frp)->fr_size + nlen);
2603         if (*frp == frc)
2604                 frc = f;
2605         *frp = f;
2606         if (f == NULL)
2607                 return -1;
2608         if (f->fr_pnext != NULL)
2609                 *f->fr_pnext = f;
2610         f->fr_size += nlen;
2611         pos = f->fr_namelen;
2612         f->fr_namelen += nlen;
2613         strcpy(f->fr_names + pos, name);
2614         f->fr_names[f->fr_namelen] = '\0';
2615         return pos;
2616 }
2617
2618
2619 static frentry_t *allocfr()
2620 {
2621         frentry_t *fr;
2622
2623         fr = calloc(1, sizeof(*fr));
2624         if (fr != NULL) {
2625                 fr->fr_size = sizeof(*fr);
2626                 fr->fr_comment = -1;
2627                 fr->fr_group = -1;
2628                 fr->fr_grhead = -1;
2629                 fr->fr_icmphead = -1;
2630                 fr->fr_ifnames[0] = -1;
2631                 fr->fr_ifnames[1] = -1;
2632                 fr->fr_ifnames[2] = -1;
2633                 fr->fr_ifnames[3] = -1;
2634                 fr->fr_tif.fd_name = -1;
2635                 fr->fr_rif.fd_name = -1;
2636                 fr->fr_dif.fd_name = -1;
2637         }
2638         return fr;
2639 }
2640
2641
2642 static void setgroup(frp, name)
2643 frentry_t **frp;
2644 char *name;
2645 {
2646         int pos;
2647
2648         pos = addname(frp, name);
2649         if (pos == -1)
2650                 return;
2651         (*frp)->fr_group = pos;
2652 }
2653
2654
2655 static void setgrhead(frp, name)
2656 frentry_t **frp;
2657 char *name;
2658 {
2659         int pos;
2660
2661         pos = addname(frp, name);
2662         if (pos == -1)
2663                 return;
2664         (*frp)->fr_grhead = pos;
2665 }
2666
2667
2668 static void seticmphead(frp, name)
2669 frentry_t **frp;
2670 char *name;
2671 {
2672         int pos;
2673
2674         pos = addname(frp, name);
2675         if (pos == -1)
2676                 return;
2677         (*frp)->fr_icmphead = pos;
2678 }
2679
2680
2681 static void
2682 build_dstaddr_af(fp, ptr)
2683         frentry_t *fp;
2684         void *ptr;
2685 {
2686         struct ipp_s *ipp = ptr;
2687         frentry_t *f = fp;
2688
2689         if (f->fr_family != AF_UNSPEC && ipp->f == AF_UNSPEC) {
2690                 ipp->f = f->fr_family;
2691                 ipp->v = f->fr_ip.fi_v;
2692         }
2693         if (ipp->f == AF_INET)
2694                 ipp->v = 4;
2695         else if (ipp->f == AF_INET6)
2696                 ipp->v = 6;
2697
2698         for (; f != NULL; f = f->fr_next) {
2699                 f->fr_ip.fi_dst = ipp->a;
2700                 f->fr_mip.fi_dst = ipp->m;
2701                 f->fr_family = ipp->f;
2702                 f->fr_ip.fi_v = ipp->v;
2703                 f->fr_mip.fi_v = 0xf;
2704                 f->fr_datype = ipp->type;
2705                 if (ipp->ifpos != -1)
2706                         f->fr_ipf->fri_difpidx = ipp->ifpos;
2707         }
2708         fr = NULL;
2709 }
2710
2711
2712 static void
2713 build_srcaddr_af(fp, ptr)
2714         frentry_t *fp;
2715         void *ptr;
2716 {
2717         struct ipp_s *ipp = ptr;
2718         frentry_t *f = fp;
2719
2720         if (f->fr_family != AF_UNSPEC && ipp->f == AF_UNSPEC) {
2721                 ipp->f = f->fr_family;
2722                 ipp->v = f->fr_ip.fi_v;
2723         }
2724         if (ipp->f == AF_INET)
2725                 ipp->v = 4;
2726         else if (ipp->f == AF_INET6)
2727                 ipp->v = 6;
2728
2729         for (; f != NULL; f = f->fr_next) {
2730                 f->fr_ip.fi_src = ipp->a;
2731                 f->fr_mip.fi_src = ipp->m;
2732                 f->fr_family = ipp->f;
2733                 f->fr_ip.fi_v = ipp->v;
2734                 f->fr_mip.fi_v = 0xf;
2735                 f->fr_satype = ipp->type;
2736                 f->fr_ipf->fri_sifpidx = ipp->ifpos;
2737         }
2738         fr = NULL;
2739 }