sbin/pfctl/parse.y

   1 /*      $OpenBSD: parse.y,v 1.554 2008/10/17 12:59:53 henning Exp $     */
   2
   3 /*
   4  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
   5  * Copyright (c) 2001 Daniel Hartmeier.  All rights reserved.
   6  * Copyright (c) 2001 Theo de Raadt.  All rights reserved.
   7  * Copyright (c) 2002,2003 Henning Brauer. All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29 %{
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 #include <sys/types.h>
  34 #include <sys/socket.h>
  35 #include <sys/stat.h>
  36 #ifdef __FreeBSD__
  37 #include <sys/sysctl.h>
  38 #endif
  39 #include <net/if.h>
  40 #include <netinet/in.h>
  41 #include <netinet/in_systm.h>
  42 #include <netinet/ip.h>
  43 #include <netinet/ip_icmp.h>
  44 #include <netinet/icmp6.h>
  45 #include <net/pfvar.h>
  46 #include <arpa/inet.h>
  47 #include <altq/altq.h>
  48 #include <altq/altq_cbq.h>
  49 #include <altq/altq_codel.h>
  50 #include <altq/altq_priq.h>
  51 #include <altq/altq_hfsc.h>
  52 #include <altq/altq_fairq.h>
  53
  54 #include <stdio.h>
  55 #include <unistd.h>
  56 #include <stdlib.h>
  57 #include <netdb.h>
  58 #include <stdarg.h>
  59 #include <errno.h>
  60 #include <string.h>
  61 #include <ctype.h>
  62 #include <math.h>
  63 #include <err.h>
  64 #include <limits.h>
  65 #include <pwd.h>
  66 #include <grp.h>
  67 #include <md5.h>
  68
  69 #include "pfctl_parser.h"
  70 #include "pfctl.h"
  71
  72 static struct pfctl     *pf = NULL;
  73 static int               debug = 0;
  74 static int               rulestate = 0;
  75 static u_int16_t         returnicmpdefault =
  76                             (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
  77 static u_int16_t         returnicmp6default =
  78                             (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
  79 static int               blockpolicy = PFRULE_DROP;
  80 static int               require_order = 1;
  81 static int               default_statelock;
  82
  83 TAILQ_HEAD(files, file)          files = TAILQ_HEAD_INITIALIZER(files);
  84 static struct file {
  85         TAILQ_ENTRY(file)        entry;
  86         FILE                    *stream;
  87         char                    *name;
  88         int                      lineno;
  89         int                      errors;
  90 } *file;
  91 struct file     *pushfile(const char *, int);
  92 int              popfile(void);
  93 int              check_file_secrecy(int, const char *);
  94 int              yyparse(void);
  95 int              yylex(void);
  96 int              yyerror(const char *, ...);
  97 int              kw_cmp(const void *, const void *);
  98 int              lookup(char *);
  99 int              lgetc(int);
 100 int              lungetc(int);
 101 int              findeol(void);
 102
 103 TAILQ_HEAD(symhead, sym)         symhead = TAILQ_HEAD_INITIALIZER(symhead);
 104 struct sym {
 105         TAILQ_ENTRY(sym)         entry;
 106         int                      used;
 107         int                      persist;
 108         char                    *nam;
 109         char                    *val;
 110 };
 111 int              symset(const char *, const char *, int);
 112 char            *symget(const char *);
 113
 114 int              atoul(char *, u_long *);
 115
 116 enum {
 117         PFCTL_STATE_NONE,
 118         PFCTL_STATE_OPTION,
 119         PFCTL_STATE_SCRUB,
 120         PFCTL_STATE_QUEUE,
 121         PFCTL_STATE_NAT,
 122         PFCTL_STATE_FILTER
 123 };
 124
 125 struct node_proto {
 126         u_int8_t                 proto;
 127         struct node_proto       *next;
 128         struct node_proto       *tail;
 129 };
 130
 131 struct node_port {
 132         u_int16_t                port[2];
 133         u_int8_t                 op;
 134         struct node_port        *next;
 135         struct node_port        *tail;
 136 };
 137
 138 struct node_uid {
 139         uid_t                    uid[2];
 140         u_int8_t                 op;
 141         struct node_uid         *next;
 142         struct node_uid         *tail;
 143 };
 144
 145 struct node_gid {
 146         gid_t                    gid[2];
 147         u_int8_t                 op;
 148         struct node_gid         *next;
 149         struct node_gid         *tail;
 150 };
 151
 152 struct node_icmp {
 153         u_int8_t                 code;
 154         u_int8_t                 type;
 155         u_int8_t                 proto;
 156         struct node_icmp        *next;
 157         struct node_icmp        *tail;
 158 };
 159
 160 enum    { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK,
 161             PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN,
 162             PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES,
 163             PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK,
 164             PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, };
 165
 166 enum    { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE };
 167
 168 struct node_state_opt {
 169         int                      type;
 170         union {
 171                 u_int32_t        max_states;
 172                 u_int32_t        max_src_states;
 173                 u_int32_t        max_src_conn;
 174                 struct {
 175                         u_int32_t       limit;
 176                         u_int32_t       seconds;
 177                 }                max_src_conn_rate;
 178                 struct {
 179                         u_int8_t        flush;
 180                         char            tblname[PF_TABLE_NAME_SIZE];
 181                 }                overload;
 182                 u_int32_t        max_src_nodes;
 183                 u_int8_t         src_track;
 184                 u_int32_t        statelock;
 185                 struct {
 186                         int             number;
 187                         u_int32_t       seconds;
 188                 }                timeout;
 189         }                        data;
 190         struct node_state_opt   *next;
 191         struct node_state_opt   *tail;
 192 };
 193
 194 struct peer {
 195         struct node_host        *host;
 196         struct node_port        *port;
 197 };
 198
 199 struct node_queue {
 200         char                     queue[PF_QNAME_SIZE];
 201         char                     parent[PF_QNAME_SIZE];
 202         char                     ifname[IFNAMSIZ];
 203         int                      scheduler;
 204         struct node_queue       *next;
 205         struct node_queue       *tail;
 206 }       *queues = NULL;
 207
 208 struct node_qassign {
 209         char            *qname;
 210         char            *pqname;
 211 };
 212
 213 struct filter_opts {
 214         int                      marker;
 215 #define FOM_FLAGS       0x01
 216 #define FOM_ICMP        0x02
 217 #define FOM_TOS         0x04
 218 #define FOM_KEEP        0x08
 219 #define FOM_SRCTRACK    0x10
 220         struct node_uid         *uid;
 221         struct node_gid         *gid;
 222         struct {
 223                 u_int8_t         b1;
 224                 u_int8_t         b2;
 225                 u_int16_t        w;
 226                 u_int16_t        w2;
 227         } flags;
 228         struct node_icmp        *icmpspec;
 229         u_int32_t                tos;
 230         u_int32_t                prob;
 231         struct {
 232                 int                      action;
 233                 struct node_state_opt   *options;
 234         } keep;
 235         int                      fragment;
 236         int                      allowopts;
 237         char                    *label;
 238         struct node_qassign      queues;
 239         char                    *tag;
 240         char                    *match_tag;
 241         u_int8_t                 match_tag_not;
 242         u_int                    rtableid;
 243         struct {
 244                 struct node_host        *addr;
 245                 u_int16_t               port;
 246         }                        divert;
 247 } filter_opts;
 248
 249 struct antispoof_opts {
 250         char                    *label;
 251         u_int                    rtableid;
 252 } antispoof_opts;
 253
 254 struct scrub_opts {
 255         int                      marker;
 256 #define SOM_MINTTL      0x01
 257 #define SOM_MAXMSS      0x02
 258 #define SOM_FRAGCACHE   0x04
 259 #define SOM_SETTOS      0x08
 260         int                      nodf;
 261         int                      minttl;
 262         int                      maxmss;
 263         int                      settos;
 264         int                      fragcache;
 265         int                      randomid;
 266         int                      reassemble_tcp;
 267         char                    *match_tag;
 268         u_int8_t                 match_tag_not;
 269         u_int                    rtableid;
 270 } scrub_opts;
 271
 272 struct queue_opts {
 273         int                     marker;
 274 #define QOM_BWSPEC      0x01
 275 #define QOM_SCHEDULER   0x02
 276 #define QOM_PRIORITY    0x04
 277 #define QOM_TBRSIZE     0x08
 278 #define QOM_QLIMIT      0x10
 279         struct node_queue_bw    queue_bwspec;
 280         struct node_queue_opt   scheduler;
 281         int                     priority;
 282         int                     tbrsize;
 283         int                     qlimit;
 284 } queue_opts;
 285
 286 struct table_opts {
 287         int                     flags;
 288         int                     init_addr;
 289         struct node_tinithead   init_nodes;
 290 } table_opts;
 291
 292 struct pool_opts {
 293         int                      marker;
 294 #define POM_TYPE                0x01
 295 #define POM_STICKYADDRESS       0x02
 296         u_int8_t                 opts;
 297         int                      type;
 298         int                      staticport;
 299         struct pf_poolhashkey   *key;
 300
 301 } pool_opts;
 302
 303 struct codel_opts        codel_opts;
 304 struct node_hfsc_opts    hfsc_opts;
 305 struct node_fairq_opts   fairq_opts;
 306 struct node_state_opt   *keep_state_defaults = NULL;
 307
 308 int              disallow_table(struct node_host *, const char *);
 309 int              disallow_urpf_failed(struct node_host *, const char *);
 310 int              disallow_alias(struct node_host *, const char *);
 311 int              rule_consistent(struct pf_rule *, int);
 312 int              filter_consistent(struct pf_rule *, int);
 313 int              nat_consistent(struct pf_rule *);
 314 int              rdr_consistent(struct pf_rule *);
 315 int              process_tabledef(char *, struct table_opts *);
 316 void             expand_label_str(char *, size_t, const char *, const char *);
 317 void             expand_label_if(const char *, char *, size_t, const char *);
 318 void             expand_label_addr(const char *, char *, size_t, u_int8_t,
 319                     struct node_host *);
 320 void             expand_label_port(const char *, char *, size_t,
 321                     struct node_port *);
 322 void             expand_label_proto(const char *, char *, size_t, u_int8_t);
 323 void             expand_label_nr(const char *, char *, size_t);
 324 void             expand_label(char *, size_t, const char *, u_int8_t,
 325                     struct node_host *, struct node_port *, struct node_host *,
 326                     struct node_port *, u_int8_t);
 327 void             expand_rule(struct pf_rule *, struct node_if *,
 328                     struct node_host *, struct node_proto *, struct node_os *,
 329                     struct node_host *, struct node_port *, struct node_host *,
 330                     struct node_port *, struct node_uid *, struct node_gid *,
 331                     struct node_icmp *, const char *);
 332 int              expand_altq(struct pf_altq *, struct node_if *,
 333                     struct node_queue *, struct node_queue_bw bwspec,
 334                     struct node_queue_opt *);
 335 int              expand_queue(struct pf_altq *, struct node_if *,
 336                     struct node_queue *, struct node_queue_bw,
 337                     struct node_queue_opt *);
 338 int              expand_skip_interface(struct node_if *);
 339
 340 int      check_rulestate(int);
 341 int      getservice(char *);
 342 int      rule_label(struct pf_rule *, char *);
 343 int      rt_tableid_max(void);
 344
 345 void     mv_rules(struct pf_ruleset *, struct pf_ruleset *);
 346 void     decide_address_family(struct node_host *, sa_family_t *);
 347 void     remove_invalid_hosts(struct node_host **, sa_family_t *);
 348 int      invalid_redirect(struct node_host *, sa_family_t);
 349 u_int16_t parseicmpspec(char *, sa_family_t);
 350
 351 TAILQ_HEAD(loadanchorshead, loadanchors)
 352     loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead);
 353
 354 struct loadanchors {
 355         TAILQ_ENTRY(loadanchors)         entries;
 356         char                            *anchorname;
 357         char                            *filename;
 358 };
 359
 360 typedef struct {
 361         union {
 362                 int64_t                  number;
 363                 double                   probability;
 364                 int                      i;
 365                 char                    *string;
 366                 u_int                    rtableid;
 367                 struct {
 368                         u_int8_t         b1;
 369                         u_int8_t         b2;
 370                         u_int16_t        w;
 371                         u_int16_t        w2;
 372                 }                        b;
 373                 struct range {
 374                         int              a;
 375                         int              b;
 376                         int              t;
 377                 }                        range;
 378                 struct node_if          *interface;
 379                 struct node_proto       *proto;
 380                 struct node_icmp        *icmp;
 381                 struct node_host        *host;
 382                 struct node_os          *os;
 383                 struct node_port        *port;
 384                 struct node_uid         *uid;
 385                 struct node_gid         *gid;
 386                 struct node_state_opt   *state_opt;
 387                 struct peer              peer;
 388                 struct {
 389                         struct peer      src, dst;
 390                         struct node_os  *src_os;
 391                 }                        fromto;
 392                 struct {
 393                         struct node_host        *host;
 394                         u_int8_t                 rt;
 395                         u_int8_t                 pool_opts;
 396                         sa_family_t              af;
 397                         struct pf_poolhashkey   *key;
 398                 }                        route;
 399                 struct redirection {
 400                         struct node_host        *host;
 401                         struct range             rport;
 402                 }                       *redirection;
 403                 struct {
 404                         int                      action;
 405                         struct node_state_opt   *options;
 406                 }                        keep_state;
 407                 struct {
 408                         u_int8_t         log;
 409                         u_int8_t         logif;
 410                         u_int8_t         quick;
 411                 }                        logquick;
 412                 struct {
 413                         int              neg;
 414                         char            *name;
 415                 }                        tagged;
 416                 struct pf_poolhashkey   *hashkey;
 417                 struct node_queue       *queue;
 418                 struct node_queue_opt    queue_options;
 419                 struct node_queue_bw     queue_bwspec;
 420                 struct node_qassign      qassign;
 421                 struct filter_opts       filter_opts;
 422                 struct antispoof_opts    antispoof_opts;
 423                 struct queue_opts        queue_opts;
 424                 struct scrub_opts        scrub_opts;
 425                 struct table_opts        table_opts;
 426                 struct pool_opts         pool_opts;
 427                 struct node_hfsc_opts    hfsc_opts;
 428                 struct node_fairq_opts   fairq_opts;
 429                 struct codel_opts        codel_opts;
 430         } v;
 431         int lineno;
 432 } YYSTYPE;
 433
 434 #define PPORT_RANGE     1
 435 #define PPORT_STAR      2
 436 int     parseport(char *, struct range *r, int);
 437
 438 #define DYNIF_MULTIADDR(addr) ((addr).type == PF_ADDR_DYNIFTL && \
 439         (!((addr).iflags & PFI_AFLAG_NOALIAS) ||                 \
 440         !isdigit((addr).v.ifname[strlen((addr).v.ifname)-1])))
 441
 442 %}
 443
 444 %token  PASS BLOCK SCRUB RETURN IN OS OUT LOG QUICK ON FROM TO FLAGS
 445 %token  RETURNRST RETURNICMP RETURNICMP6 PROTO INET INET6 ALL ANY ICMPTYPE
 446 %token  ICMP6TYPE CODE KEEP MODULATE STATE PORT RDR NAT BINAT ARROW NODF
 447 %token  MINTTL ERROR ALLOWOPTS FASTROUTE FILENAME ROUTETO DUPTO REPLYTO NO LABEL
 448 %token  NOROUTE URPFFAILED FRAGMENT USER GROUP MAXMSS MAXIMUM TTL TOS DROP TABLE
 449 %token  REASSEMBLE FRAGDROP FRAGCROP ANCHOR NATANCHOR RDRANCHOR BINATANCHOR
 450 %token  SET OPTIMIZATION TIMEOUT LIMIT LOGINTERFACE BLOCKPOLICY RANDOMID
 451 %token  REQUIREORDER SYNPROXY FINGERPRINTS NOSYNC DEBUG SKIP HOSTID
 452 %token  ANTISPOOF FOR INCLUDE
 453 %token  BITMASK RANDOM SOURCEHASH ROUNDROBIN STATICPORT PROBABILITY
 454 %token  ALTQ CBQ CODEL PRIQ HFSC FAIRQ BANDWIDTH TBRSIZE LINKSHARE REALTIME
 455 %token  UPPERLIMIT QUEUE PRIORITY QLIMIT HOGS BUCKETS RTABLE TARGET INTERVAL
 456 %token  LOAD RULESET_OPTIMIZATION
 457 %token  STICKYADDRESS MAXSRCSTATES MAXSRCNODES SOURCETRACK GLOBAL RULE
 458 %token  MAXSRCCONN MAXSRCCONNRATE OVERLOAD FLUSH SLOPPY
 459 %token  TAGGED TAG IFBOUND FLOATING STATEPOLICY STATEDEFAULTS ROUTE SETTOS
 460 %token  DIVERTTO DIVERTREPLY
 461 %token  <v.string>              STRING
 462 %token  <v.number>              NUMBER
 463 %token  <v.i>                   PORTBINARY
 464 %type   <v.interface>           interface if_list if_item_not if_item
 465 %type   <v.number>              number icmptype icmp6type uid gid
 466 %type   <v.number>              tos not yesno
 467 %type   <v.probability>         probability
 468 %type   <v.i>                   no dir af fragcache optimizer
 469 %type   <v.i>                   sourcetrack flush unaryop statelock
 470 %type   <v.b>                   action nataction natpasslog scrubaction
 471 %type   <v.b>                   flags flag blockspec
 472 %type   <v.range>               portplain portstar portrange
 473 %type   <v.hashkey>             hashkey
 474 %type   <v.proto>               proto proto_list proto_item
 475 %type   <v.number>              protoval
 476 %type   <v.icmp>                icmpspec
 477 %type   <v.icmp>                icmp_list icmp_item
 478 %type   <v.icmp>                icmp6_list icmp6_item
 479 %type   <v.number>              reticmpspec reticmp6spec
 480 %type   <v.fromto>              fromto
 481 %type   <v.peer>                ipportspec from to
 482 %type   <v.host>                ipspec toipspec xhost host dynaddr host_list
 483 %type   <v.host>                redir_host_list redirspec
 484 %type   <v.host>                route_host route_host_list routespec
 485 %type   <v.os>                  os xos os_list
 486 %type   <v.port>                portspec port_list port_item
 487 %type   <v.uid>                 uids uid_list uid_item
 488 %type   <v.gid>                 gids gid_list gid_item
 489 %type   <v.route>               route
 490 %type   <v.redirection>         redirection redirpool
 491 %type   <v.string>              label stringall tag anchorname
 492 %type   <v.string>              string varstring numberstring
 493 %type   <v.keep_state>          keep
 494 %type   <v.state_opt>           state_opt_spec state_opt_list state_opt_item
 495 %type   <v.logquick>            logquick quick log logopts logopt
 496 %type   <v.interface>           antispoof_ifspc antispoof_iflst antispoof_if
 497 %type   <v.qassign>             qname
 498 %type   <v.queue>               qassign qassign_list qassign_item
 499 %type   <v.queue_options>       scheduler
 500 %type   <v.number>              cbqflags_list cbqflags_item
 501 %type   <v.number>              priqflags_list priqflags_item
 502 %type   <v.hfsc_opts>           hfscopts_list hfscopts_item hfsc_opts
 503 %type   <v.fairq_opts>          fairqopts_list fairqopts_item fairq_opts
 504 %type   <v.codel_opts>          codelopts_list codelopts_item codel_opts
 505 %type   <v.queue_bwspec>        bandwidth
 506 %type   <v.filter_opts>         filter_opts filter_opt filter_opts_l
 507 %type   <v.antispoof_opts>      antispoof_opts antispoof_opt antispoof_opts_l
 508 %type   <v.queue_opts>          queue_opts queue_opt queue_opts_l
 509 %type   <v.scrub_opts>          scrub_opts scrub_opt scrub_opts_l
 510 %type   <v.table_opts>          table_opts table_opt table_opts_l
 511 %type   <v.pool_opts>           pool_opts pool_opt pool_opts_l
 512 %type   <v.tagged>              tagged
 513 %type   <v.rtableid>            rtable
 514 %%
 515
 516 ruleset         : /* empty */
 517                 | ruleset include '\n'
 518                 | ruleset '\n'
 519                 | ruleset option '\n'
 520                 | ruleset scrubrule '\n'
 521                 | ruleset natrule '\n'
 522                 | ruleset binatrule '\n'
 523                 | ruleset pfrule '\n'
 524                 | ruleset anchorrule '\n'
 525                 | ruleset loadrule '\n'
 526                 | ruleset altqif '\n'
 527                 | ruleset queuespec '\n'
 528                 | ruleset varset '\n'
 529                 | ruleset antispoof '\n'
 530                 | ruleset tabledef '\n'
 531                 | '{' fakeanchor '}' '\n';
 532                 | ruleset error '\n'            { file->errors++; }
 533                 ;
 534
 535 include         : INCLUDE STRING                {
 536                         struct file     *nfile;
 537
 538                         if ((nfile = pushfile($2, 0)) == NULL) {
 539                                 yyerror("failed to include file %s", $2);
 540                                 free($2);
 541                                 YYERROR;
 542                         }
 543                         free($2);
 544
 545                         file = nfile;
 546                         lungetc('\n');
 547                 }
 548                 ;
 549
 550 /*
 551  * apply to previouslys specified rule: must be careful to note
 552  * what that is: pf or nat or binat or rdr
 553  */
 554 fakeanchor      : fakeanchor '\n'
 555                 | fakeanchor anchorrule '\n'
 556                 | fakeanchor binatrule '\n'
 557                 | fakeanchor natrule '\n'
 558                 | fakeanchor pfrule '\n'
 559                 | fakeanchor error '\n'
 560                 ;
 561
 562 optimizer       : string        {
 563                         if (!strcmp($1, "none"))
 564                                 $$ = 0;
 565                         else if (!strcmp($1, "basic"))
 566                                 $$ = PF_OPTIMIZE_BASIC;
 567                         else if (!strcmp($1, "profile"))
 568                                 $$ = PF_OPTIMIZE_BASIC | PF_OPTIMIZE_PROFILE;
 569                         else {
 570                                 yyerror("unknown ruleset-optimization %s", $1);
 571                                 YYERROR;
 572                         }
 573                 }
 574                 ;
 575
 576 option          : SET OPTIMIZATION STRING               {
 577                         if (check_rulestate(PFCTL_STATE_OPTION)) {
 578                                 free($3);
 579                                 YYERROR;
 580                         }
 581                         if (pfctl_set_optimization(pf, $3) != 0) {
 582                                 yyerror("unknown optimization %s", $3);
 583                                 free($3);
 584                                 YYERROR;
 585                         }
 586                         free($3);
 587                 }
 588                 | SET RULESET_OPTIMIZATION optimizer {
 589                         if (!(pf->opts & PF_OPT_OPTIMIZE)) {
 590                                 pf->opts |= PF_OPT_OPTIMIZE;
 591                                 pf->optimize = $3;
 592                         }
 593                 }
 594                 | SET TIMEOUT timeout_spec
 595                 | SET TIMEOUT '{' optnl timeout_list '}'
 596                 | SET LIMIT limit_spec
 597                 | SET LIMIT '{' optnl limit_list '}'
 598                 | SET LOGINTERFACE stringall            {
 599                         if (check_rulestate(PFCTL_STATE_OPTION)) {
 600                                 free($3);
 601                                 YYERROR;
 602                         }
 603                         if (pfctl_set_logif(pf, $3) != 0) {
 604                                 yyerror("error setting loginterface %s", $3);
 605                                 free($3);
 606                                 YYERROR;
 607                         }
 608                         free($3);
 609                 }
 610                 | SET HOSTID number {
 611                         if ($3 == 0 || $3 > UINT_MAX) {
 612                                 yyerror("hostid must be non-zero");
 613                                 YYERROR;
 614                         }
 615                         if (pfctl_set_hostid(pf, $3) != 0) {
 616                                 yyerror("error setting hostid %08x", $3);
 617                                 YYERROR;
 618                         }
 619                 }
 620                 | SET BLOCKPOLICY DROP  {
 621                         if (pf->opts & PF_OPT_VERBOSE)
 622                                 printf("set block-policy drop\n");
 623                         if (check_rulestate(PFCTL_STATE_OPTION))
 624                                 YYERROR;
 625                         blockpolicy = PFRULE_DROP;
 626                 }
 627                 | SET BLOCKPOLICY RETURN {
 628                         if (pf->opts & PF_OPT_VERBOSE)
 629                                 printf("set block-policy return\n");
 630                         if (check_rulestate(PFCTL_STATE_OPTION))
 631                                 YYERROR;
 632                         blockpolicy = PFRULE_RETURN;
 633                 }
 634                 | SET REQUIREORDER yesno {
 635                         if (pf->opts & PF_OPT_VERBOSE)
 636                                 printf("set require-order %s\n",
 637                                     $3 == 1 ? "yes" : "no");
 638                         require_order = $3;
 639                 }
 640                 | SET FINGERPRINTS STRING {
 641                         if (pf->opts & PF_OPT_VERBOSE)
 642                                 printf("set fingerprints \"%s\"\n", $3);
 643                         if (check_rulestate(PFCTL_STATE_OPTION)) {
 644                                 free($3);
 645                                 YYERROR;
 646                         }
 647                         if (!pf->anchor->name[0]) {
 648                                 if (pfctl_file_fingerprints(pf->dev,
 649                                     pf->opts, $3)) {
 650                                         yyerror("error loading "
 651                                             "fingerprints %s", $3);
 652                                         free($3);
 653                                         YYERROR;
 654                                 }
 655                         }
 656                         free($3);
 657                 }
 658                 | SET STATEPOLICY statelock {
 659                         if (pf->opts & PF_OPT_VERBOSE)
 660                                 switch ($3) {
 661                                 case 0:
 662                                         printf("set state-policy floating\n");
 663                                         break;
 664                                 case PFRULE_IFBOUND:
 665                                         printf("set state-policy if-bound\n");
 666                                         break;
 667                                 }
 668                         default_statelock = $3;
 669                 }
 670                 | SET DEBUG STRING {
 671                         if (check_rulestate(PFCTL_STATE_OPTION)) {
 672                                 free($3);
 673                                 YYERROR;
 674                         }
 675                         if (pfctl_set_debug(pf, $3) != 0) {
 676                                 yyerror("error setting debuglevel %s", $3);
 677                                 free($3);
 678                                 YYERROR;
 679                         }
 680                         free($3);
 681                 }
 682                 | SET SKIP interface {
 683                         if (expand_skip_interface($3) != 0) {
 684                                 yyerror("error setting skip interface(s)");
 685                                 YYERROR;
 686                         }
 687                 }
 688                 | SET STATEDEFAULTS state_opt_list {
 689                         if (keep_state_defaults != NULL) {
 690                                 yyerror("cannot redefine state-defaults");
 691                                 YYERROR;
 692                         }
 693                         keep_state_defaults = $3;
 694                 }
 695                 ;
 696
 697 stringall       : STRING        { $$ = $1; }
 698                 | ALL           {
 699                         if (($$ = strdup("all")) == NULL) {
 700                                 err(1, "stringall: strdup");
 701                         }
 702                 }
 703                 ;
 704
 705 string          : STRING string                         {
 706                         if (asprintf(&$$, "%s %s", $1, $2) == -1)
 707                                 err(1, "string: asprintf");
 708                         free($1);
 709                         free($2);
 710                 }
 711                 | STRING
 712                 ;
 713
 714 varstring       : numberstring varstring                {
 715                         if (asprintf(&$$, "%s %s", $1, $2) == -1)
 716                                 err(1, "string: asprintf");
 717                         free($1);
 718                         free($2);
 719                 }
 720                 | numberstring
 721                 ;
 722
 723 numberstring    : NUMBER                                {
 724                         char    *s;
 725                         if (asprintf(&s, "%lld", (long long)$1) == -1) {
 726                                 yyerror("string: asprintf");
 727                                 YYERROR;
 728                         }
 729                         $$ = s;
 730                 }
 731                 | STRING
 732                 ;
 733
 734 varset          : STRING '=' varstring  {
 735                         if (pf->opts & PF_OPT_VERBOSE)
 736                                 printf("%s = \"%s\"\n", $1, $3);
 737                         if (symset($1, $3, 0) == -1)
 738                                 err(1, "cannot store variable %s", $1);
 739                         free($1);
 740                         free($3);
 741                 }
 742                 ;
 743
 744 anchorname      : STRING                        { $$ = $1; }
 745                 | /* empty */                   { $$ = NULL; }
 746                 ;
 747
 748 pfa_anchorlist  : /* empty */
 749                 | pfa_anchorlist '\n'
 750                 | pfa_anchorlist pfrule '\n'
 751                 | pfa_anchorlist anchorrule '\n'
 752                 ;
 753
 754 pfa_anchor      : '{'
 755                 {
 756                         char ta[PF_ANCHOR_NAME_SIZE];
 757                         struct pf_ruleset *rs;
 758
 759                         /* steping into a brace anchor */
 760                         pf->asd++;
 761                         pf->bn++;
 762                         pf->brace = 1;
 763
 764                         /* create a holding ruleset in the root */
 765                         snprintf(ta, PF_ANCHOR_NAME_SIZE, "_%d", pf->bn);
 766                         rs = pf_find_or_create_ruleset(ta);
 767                         if (rs == NULL)
 768                                 err(1, "pfa_anchor: pf_find_or_create_ruleset");
 769                         pf->astack[pf->asd] = rs->anchor;
 770                         pf->anchor = rs->anchor;
 771                 } '\n' pfa_anchorlist '}'
 772                 {
 773                         pf->alast = pf->anchor;
 774                         pf->asd--;
 775                         pf->anchor = pf->astack[pf->asd];
 776                 }
 777                 | /* empty */
 778                 ;
 779
 780 anchorrule      : ANCHOR anchorname dir quick interface af proto fromto
 781                     filter_opts pfa_anchor
 782                 {
 783                         struct pf_rule  r;
 784                         struct node_proto       *proto;
 785
 786                         if (check_rulestate(PFCTL_STATE_FILTER)) {
 787                                 if ($2)
 788                                         free($2);
 789                                 YYERROR;
 790                         }
 791
 792                         if ($2 && ($2[0] == '_' || strstr($2, "/_") != NULL)) {
 793                                 free($2);
 794                                 yyerror("anchor names beginning with '_' "
 795                                     "are reserved for internal use");
 796                                 YYERROR;
 797                         }
 798
 799                         memset(&r, 0, sizeof(r));
 800                         if (pf->astack[pf->asd + 1]) {
 801                                 /* move inline rules into relative location */
 802                                 pf_anchor_setup(&r,
 803                                     &pf->astack[pf->asd]->ruleset,
 804                                     $2 ? $2 : pf->alast->name);
 805
 806                                 if (r.anchor == NULL)
 807                                         err(1, "anchorrule: unable to "
 808                                             "create ruleset");
 809
 810                                 if (pf->alast != r.anchor) {
 811                                         if (r.anchor->match) {
 812                                                 yyerror("inline anchor '%s' "
 813                                                     "already exists",
 814                                                     r.anchor->name);
 815                                                 YYERROR;
 816                                         }
 817                                         mv_rules(&pf->alast->ruleset,
 818                                             &r.anchor->ruleset);
 819                                 }
 820                                 pf_remove_if_empty_ruleset(&pf->alast->ruleset);
 821                                 pf->alast = r.anchor;
 822                         } else {
 823                                 if (!$2) {
 824                                         yyerror("anchors without explicit "
 825                                             "rules must specify a name");
 826                                         YYERROR;
 827                                 }
 828                         }
 829                         r.direction = $3;
 830                         r.quick = $4.quick;
 831                         r.af = $6;
 832                         r.prob = $9.prob;
 833                         r.rtableid = $9.rtableid;
 834
 835                         if ($9.tag)
 836                                 if (strlcpy(r.tagname, $9.tag,
 837                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
 838                                         yyerror("tag too long, max %u chars",
 839                                             PF_TAG_NAME_SIZE - 1);
 840                                         YYERROR;
 841                                 }
 842                         if ($9.match_tag)
 843                                 if (strlcpy(r.match_tagname, $9.match_tag,
 844                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
 845                                         yyerror("tag too long, max %u chars",
 846                                             PF_TAG_NAME_SIZE - 1);
 847                                         YYERROR;
 848                                 }
 849                         r.match_tag_not = $9.match_tag_not;
 850                         if (rule_label(&r, $9.label))
 851                                 YYERROR;
 852                         free($9.label);
 853                         r.flags = $9.flags.b1;
 854                         r.flagset = $9.flags.b2;
 855                         if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
 856                                 yyerror("flags always false");
 857                                 YYERROR;
 858                         }
 859                         if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
 860                                 for (proto = $7; proto != NULL &&
 861                                     proto->proto != IPPROTO_TCP;
 862                                     proto = proto->next)
 863                                         ;       /* nothing */
 864                                 if (proto == NULL && $7 != NULL) {
 865                                         if ($9.flags.b1 || $9.flags.b2)
 866                                                 yyerror(
 867                                                     "flags only apply to tcp");
 868                                         if ($8.src_os)
 869                                                 yyerror(
 870                                                     "OS fingerprinting only "
 871                                                     "applies to tcp");
 872                                         YYERROR;
 873                                 }
 874                         }
 875
 876                         r.tos = $9.tos;
 877
 878                         if ($9.keep.action) {
 879                                 yyerror("cannot specify state handling "
 880                                     "on anchors");
 881                                 YYERROR;
 882                         }
 883
 884                         if ($9.match_tag)
 885                                 if (strlcpy(r.match_tagname, $9.match_tag,
 886                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
 887                                         yyerror("tag too long, max %u chars",
 888                                             PF_TAG_NAME_SIZE - 1);
 889                                         YYERROR;
 890                                 }
 891                         r.match_tag_not = $9.match_tag_not;
 892
 893                         decide_address_family($8.src.host, &r.af);
 894                         decide_address_family($8.dst.host, &r.af);
 895
 896                         expand_rule(&r, $5, NULL, $7, $8.src_os,
 897                             $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
 898                             $9.uid, $9.gid, $9.icmpspec,
 899                             pf->astack[pf->asd + 1] ? pf->alast->name : $2);
 900                         free($2);
 901                         pf->astack[pf->asd + 1] = NULL;
 902                 }
 903                 | NATANCHOR string interface af proto fromto rtable {
 904                         struct pf_rule  r;
 905
 906                         if (check_rulestate(PFCTL_STATE_NAT)) {
 907                                 free($2);
 908                                 YYERROR;
 909                         }
 910
 911                         memset(&r, 0, sizeof(r));
 912                         r.action = PF_NAT;
 913                         r.af = $4;
 914                         r.rtableid = $7;
 915
 916                         decide_address_family($6.src.host, &r.af);
 917                         decide_address_family($6.dst.host, &r.af);
 918
 919                         expand_rule(&r, $3, NULL, $5, $6.src_os,
 920                             $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
 921                             0, 0, 0, $2);
 922                         free($2);
 923                 }
 924                 | RDRANCHOR string interface af proto fromto rtable {
 925                         struct pf_rule  r;
 926
 927                         if (check_rulestate(PFCTL_STATE_NAT)) {
 928                                 free($2);
 929                                 YYERROR;
 930                         }
 931
 932                         memset(&r, 0, sizeof(r));
 933                         r.action = PF_RDR;
 934                         r.af = $4;
 935                         r.rtableid = $7;
 936
 937                         decide_address_family($6.src.host, &r.af);
 938                         decide_address_family($6.dst.host, &r.af);
 939
 940                         if ($6.src.port != NULL) {
 941                                 yyerror("source port parameter not supported"
 942                                     " in rdr-anchor");
 943                                 YYERROR;
 944                         }
 945                         if ($6.dst.port != NULL) {
 946                                 if ($6.dst.port->next != NULL) {
 947                                         yyerror("destination port list "
 948                                             "expansion not supported in "
 949                                             "rdr-anchor");
 950                                         YYERROR;
 951                                 } else if ($6.dst.port->op != PF_OP_EQ) {
 952                                         yyerror("destination port operators"
 953                                             " not supported in rdr-anchor");
 954                                         YYERROR;
 955                                 }
 956                                 r.dst.port[0] = $6.dst.port->port[0];
 957                                 r.dst.port[1] = $6.dst.port->port[1];
 958                                 r.dst.port_op = $6.dst.port->op;
 959                         }
 960
 961                         expand_rule(&r, $3, NULL, $5, $6.src_os,
 962                             $6.src.host, $6.src.port, $6.dst.host, $6.dst.port,
 963                             0, 0, 0, $2);
 964                         free($2);
 965                 }
 966                 | BINATANCHOR string interface af proto fromto rtable {
 967                         struct pf_rule  r;
 968
 969                         if (check_rulestate(PFCTL_STATE_NAT)) {
 970                                 free($2);
 971                                 YYERROR;
 972                         }
 973
 974                         memset(&r, 0, sizeof(r));
 975                         r.action = PF_BINAT;
 976                         r.af = $4;
 977                         r.rtableid = $7;
 978                         if ($5 != NULL) {
 979                                 if ($5->next != NULL) {
 980                                         yyerror("proto list expansion"
 981                                             " not supported in binat-anchor");
 982                                         YYERROR;
 983                                 }
 984                                 r.proto = $5->proto;
 985                                 free($5);
 986                         }
 987
 988                         if ($6.src.host != NULL || $6.src.port != NULL ||
 989                             $6.dst.host != NULL || $6.dst.port != NULL) {
 990                                 yyerror("fromto parameter not supported"
 991                                     " in binat-anchor");
 992                                 YYERROR;
 993                         }
 994
 995                         decide_address_family($6.src.host, &r.af);
 996                         decide_address_family($6.dst.host, &r.af);
 997
 998                         pfctl_add_rule(pf, &r, $2);
 999                         free($2);
1000                 }
1001                 ;
1002
1003 loadrule        : LOAD ANCHOR string FROM string        {
1004                         struct loadanchors      *loadanchor;
1005
1006                         if (strlen(pf->anchor->name) + 1 +
1007                             strlen($3) >= MAXPATHLEN) {
1008                                 yyerror("anchorname %s too long, max %u\n",
1009                                     $3, MAXPATHLEN - 1);
1010                                 free($3);
1011                                 YYERROR;
1012                         }
1013                         loadanchor = calloc(1, sizeof(struct loadanchors));
1014                         if (loadanchor == NULL)
1015                                 err(1, "loadrule: calloc");
1016                         if ((loadanchor->anchorname = malloc(MAXPATHLEN)) ==
1017                             NULL)
1018                                 err(1, "loadrule: malloc");
1019                         if (pf->anchor->name[0])
1020                                 snprintf(loadanchor->anchorname, MAXPATHLEN,
1021                                     "%s/%s", pf->anchor->name, $3);
1022                         else
1023                                 strlcpy(loadanchor->anchorname, $3, MAXPATHLEN);
1024                         if ((loadanchor->filename = strdup($5)) == NULL)
1025                                 err(1, "loadrule: strdup");
1026
1027                         TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,
1028                             entries);
1029
1030                         free($3);
1031                         free($5);
1032                 };
1033
1034 scrubaction     : no SCRUB {
1035                         $$.b2 = $$.w = 0;
1036                         if ($1)
1037                                 $$.b1 = PF_NOSCRUB;
1038                         else
1039                                 $$.b1 = PF_SCRUB;
1040                 }
1041                 ;
1042
1043 scrubrule       : scrubaction dir logquick interface af proto fromto scrub_opts
1044                 {
1045                         struct pf_rule  r;
1046
1047                         if (check_rulestate(PFCTL_STATE_SCRUB))
1048                                 YYERROR;
1049
1050                         memset(&r, 0, sizeof(r));
1051
1052                         r.action = $1.b1;
1053                         r.direction = $2;
1054
1055                         r.log = $3.log;
1056                         r.logif = $3.logif;
1057                         if ($3.quick) {
1058                                 yyerror("scrub rules do not support 'quick'");
1059                                 YYERROR;
1060                         }
1061
1062                         r.af = $5;
1063                         if ($8.nodf)
1064                                 r.rule_flag |= PFRULE_NODF;
1065                         if ($8.randomid)
1066                                 r.rule_flag |= PFRULE_RANDOMID;
1067                         if ($8.reassemble_tcp) {
1068                                 if (r.direction != PF_INOUT) {
1069                                         yyerror("reassemble tcp rules can not "
1070                                             "specify direction");
1071                                         YYERROR;
1072                                 }
1073                                 r.rule_flag |= PFRULE_REASSEMBLE_TCP;
1074                         }
1075                         if ($8.minttl)
1076                                 r.min_ttl = $8.minttl;
1077                         if ($8.maxmss)
1078                                 r.max_mss = $8.maxmss;
1079                         if ($8.marker & SOM_SETTOS) {
1080                                 r.rule_flag |= PFRULE_SET_TOS;
1081                                 r.set_tos = $8.settos;
1082                         }
1083                         if ($8.fragcache)
1084                                 r.rule_flag |= $8.fragcache;
1085                         if ($8.match_tag)
1086                                 if (strlcpy(r.match_tagname, $8.match_tag,
1087                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
1088                                         yyerror("tag too long, max %u chars",
1089                                             PF_TAG_NAME_SIZE - 1);
1090                                         YYERROR;
1091                                 }
1092                         r.match_tag_not = $8.match_tag_not;
1093                         r.rtableid = $8.rtableid;
1094
1095                         expand_rule(&r, $4, NULL, $6, $7.src_os,
1096                             $7.src.host, $7.src.port, $7.dst.host, $7.dst.port,
1097                             NULL, NULL, NULL, "");
1098                 }
1099                 ;
1100
1101 scrub_opts      :       {
1102                                 bzero(&scrub_opts, sizeof scrub_opts);
1103                                 scrub_opts.rtableid = -1;
1104                         }
1105                     scrub_opts_l
1106                         { $$ = scrub_opts; }
1107                 | /* empty */ {
1108                         bzero(&scrub_opts, sizeof scrub_opts);
1109                         scrub_opts.rtableid = -1;
1110                         $$ = scrub_opts;
1111                 }
1112                 ;
1113
1114 scrub_opts_l    : scrub_opts_l scrub_opt
1115                 | scrub_opt
1116                 ;
1117
1118 scrub_opt       : NODF  {
1119                         if (scrub_opts.nodf) {
1120                                 yyerror("no-df cannot be respecified");
1121                                 YYERROR;
1122                         }
1123                         scrub_opts.nodf = 1;
1124                 }
1125                 | MINTTL NUMBER {
1126                         if (scrub_opts.marker & SOM_MINTTL) {
1127                                 yyerror("min-ttl cannot be respecified");
1128                                 YYERROR;
1129                         }
1130                         if ($2 < 0 || $2 > 255) {
1131                                 yyerror("illegal min-ttl value %d", $2);
1132                                 YYERROR;
1133                         }
1134                         scrub_opts.marker |= SOM_MINTTL;
1135                         scrub_opts.minttl = $2;
1136                 }
1137                 | MAXMSS NUMBER {
1138                         if (scrub_opts.marker & SOM_MAXMSS) {
1139                                 yyerror("max-mss cannot be respecified");
1140                                 YYERROR;
1141                         }
1142                         if ($2 < 0 || $2 > 65535) {
1143                                 yyerror("illegal max-mss value %d", $2);
1144                                 YYERROR;
1145                         }
1146                         scrub_opts.marker |= SOM_MAXMSS;
1147                         scrub_opts.maxmss = $2;
1148                 }
1149                 | SETTOS tos {
1150                         if (scrub_opts.marker & SOM_SETTOS) {
1151                                 yyerror("set-tos cannot be respecified");
1152                                 YYERROR;
1153                         }
1154                         scrub_opts.marker |= SOM_SETTOS;
1155                         scrub_opts.settos = $2;
1156                 }
1157                 | fragcache {
1158                         if (scrub_opts.marker & SOM_FRAGCACHE) {
1159                                 yyerror("fragcache cannot be respecified");
1160                                 YYERROR;
1161                         }
1162                         scrub_opts.marker |= SOM_FRAGCACHE;
1163                         scrub_opts.fragcache = $1;
1164                 }
1165                 | REASSEMBLE STRING {
1166                         if (strcasecmp($2, "tcp") != 0) {
1167                                 yyerror("scrub reassemble supports only tcp, "
1168                                     "not '%s'", $2);
1169                                 free($2);
1170                                 YYERROR;
1171                         }
1172                         free($2);
1173                         if (scrub_opts.reassemble_tcp) {
1174                                 yyerror("reassemble tcp cannot be respecified");
1175                                 YYERROR;
1176                         }
1177                         scrub_opts.reassemble_tcp = 1;
1178                 }
1179                 | RANDOMID {
1180                         if (scrub_opts.randomid) {
1181                                 yyerror("random-id cannot be respecified");
1182                                 YYERROR;
1183                         }
1184                         scrub_opts.randomid = 1;
1185                 }
1186                 | RTABLE NUMBER                         {
1187                         if ($2 < 0 || $2 > rt_tableid_max()) {
1188                                 yyerror("invalid rtable id");
1189                                 YYERROR;
1190                         }
1191                         scrub_opts.rtableid = $2;
1192                 }
1193                 | not TAGGED string                     {
1194                         scrub_opts.match_tag = $3;
1195                         scrub_opts.match_tag_not = $1;
1196                 }
1197                 ;
1198
1199 fragcache       : FRAGMENT REASSEMBLE   { $$ = 0; /* default */ }
1200                 | FRAGMENT FRAGCROP     { $$ = PFRULE_FRAGCROP; }
1201                 | FRAGMENT FRAGDROP     { $$ = PFRULE_FRAGDROP; }
1202                 ;
1203
1204 antispoof       : ANTISPOOF logquick antispoof_ifspc af antispoof_opts {
1205                         struct pf_rule           r;
1206                         struct node_host        *h = NULL, *hh;
1207                         struct node_if          *i, *j;
1208
1209                         if (check_rulestate(PFCTL_STATE_FILTER))
1210                                 YYERROR;
1211
1212                         for (i = $3; i; i = i->next) {
1213                                 bzero(&r, sizeof(r));
1214
1215                                 r.action = PF_DROP;
1216                                 r.direction = PF_IN;
1217                                 r.log = $2.log;
1218                                 r.logif = $2.logif;
1219                                 r.quick = $2.quick;
1220                                 r.af = $4;
1221                                 if (rule_label(&r, $5.label))
1222                                         YYERROR;
1223                                 r.rtableid = $5.rtableid;
1224                                 j = calloc(1, sizeof(struct node_if));
1225                                 if (j == NULL)
1226                                         err(1, "antispoof: calloc");
1227                                 if (strlcpy(j->ifname, i->ifname,
1228                                     sizeof(j->ifname)) >= sizeof(j->ifname)) {
1229                                         free(j);
1230                                         yyerror("interface name too long");
1231                                         YYERROR;
1232                                 }
1233                                 j->not = 1;
1234                                 if (i->dynamic) {
1235                                         h = calloc(1, sizeof(*h));
1236                                         if (h == NULL)
1237                                                 err(1, "address: calloc");
1238                                         h->addr.type = PF_ADDR_DYNIFTL;
1239                                         set_ipmask(h, 128);
1240                                         if (strlcpy(h->addr.v.ifname, i->ifname,
1241                                             sizeof(h->addr.v.ifname)) >=
1242                                             sizeof(h->addr.v.ifname)) {
1243                                                 free(h);
1244                                                 yyerror(
1245                                                     "interface name too long");
1246                                                 YYERROR;
1247                                         }
1248                                         hh = malloc(sizeof(*hh));
1249                                         if (hh == NULL)
1250                                                  err(1, "address: malloc");
1251                                         bcopy(h, hh, sizeof(*hh));
1252                                         h->addr.iflags = PFI_AFLAG_NETWORK;
1253                                 } else {
1254                                         h = ifa_lookup(j->ifname,
1255                                             PFI_AFLAG_NETWORK);
1256                                         hh = NULL;
1257                                 }
1258
1259                                 if (h != NULL)
1260                                         expand_rule(&r, j, NULL, NULL, NULL, h,
1261                                             NULL, NULL, NULL, NULL, NULL,
1262                                             NULL, "");
1263
1264                                 if ((i->ifa_flags & IFF_LOOPBACK) == 0) {
1265                                         bzero(&r, sizeof(r));
1266
1267                                         r.action = PF_DROP;
1268                                         r.direction = PF_IN;
1269                                         r.log = $2.log;
1270                                         r.logif = $2.logif;
1271                                         r.quick = $2.quick;
1272                                         r.af = $4;
1273                                         if (rule_label(&r, $5.label))
1274                                                 YYERROR;
1275                                         r.rtableid = $5.rtableid;
1276                                         if (hh != NULL)
1277                                                 h = hh;
1278                                         else
1279                                                 h = ifa_lookup(i->ifname, 0);
1280                                         if (h != NULL)
1281                                                 expand_rule(&r, NULL, NULL,
1282                                                     NULL, NULL, h, NULL, NULL,
1283                                                     NULL, NULL, NULL, NULL, "");
1284                                 } else
1285                                         free(hh);
1286                         }
1287                         free($5.label);
1288                 }
1289                 ;
1290
1291 antispoof_ifspc : FOR antispoof_if                      { $$ = $2; }
1292                 | FOR '{' optnl antispoof_iflst '}'     { $$ = $4; }
1293                 ;
1294
1295 antispoof_iflst : antispoof_if optnl                    { $$ = $1; }
1296                 | antispoof_iflst comma antispoof_if optnl {
1297                         $1->tail->next = $3;
1298                         $1->tail = $3;
1299                         $$ = $1;
1300                 }
1301                 ;
1302
1303 antispoof_if    : if_item                               { $$ = $1; }
1304                 | '(' if_item ')'                       {
1305                         $2->dynamic = 1;
1306                         $$ = $2;
1307                 }
1308                 ;
1309
1310 antispoof_opts  :       {
1311                                 bzero(&antispoof_opts, sizeof antispoof_opts);
1312                                 antispoof_opts.rtableid = -1;
1313                         }
1314                     antispoof_opts_l
1315                         { $$ = antispoof_opts; }
1316                 | /* empty */   {
1317                         bzero(&antispoof_opts, sizeof antispoof_opts);
1318                         antispoof_opts.rtableid = -1;
1319                         $$ = antispoof_opts;
1320                 }
1321                 ;
1322
1323 antispoof_opts_l        : antispoof_opts_l antispoof_opt
1324                         | antispoof_opt
1325                         ;
1326
1327 antispoof_opt   : label {
1328                         if (antispoof_opts.label) {
1329                                 yyerror("label cannot be redefined");
1330                                 YYERROR;
1331                         }
1332                         antispoof_opts.label = $1;
1333                 }
1334                 | RTABLE NUMBER                         {
1335                         if ($2 < 0 || $2 > rt_tableid_max()) {
1336                                 yyerror("invalid rtable id");
1337                                 YYERROR;
1338                         }
1339                         antispoof_opts.rtableid = $2;
1340                 }
1341                 ;
1342
1343 not             : '!'           { $$ = 1; }
1344                 | /* empty */   { $$ = 0; }
1345                 ;
1346
1347 tabledef        : TABLE '<' STRING '>' table_opts {
1348                         struct node_host         *h, *nh;
1349                         struct node_tinit        *ti, *nti;
1350
1351                         if (strlen($3) >= PF_TABLE_NAME_SIZE) {
1352                                 yyerror("table name too long, max %d chars",
1353                                     PF_TABLE_NAME_SIZE - 1);
1354                                 free($3);
1355                                 YYERROR;
1356                         }
1357                         if (pf->loadopt & PFCTL_FLAG_TABLE)
1358                                 if (process_tabledef($3, &$5)) {
1359                                         free($3);
1360                                         YYERROR;
1361                                 }
1362                         free($3);
1363                         for (ti = SIMPLEQ_FIRST(&$5.init_nodes);
1364                             ti != SIMPLEQ_END(&$5.init_nodes); ti = nti) {
1365                                 if (ti->file)
1366                                         free(ti->file);
1367                                 for (h = ti->host; h != NULL; h = nh) {
1368                                         nh = h->next;
1369                                         free(h);
1370                                 }
1371                                 nti = SIMPLEQ_NEXT(ti, entries);
1372                                 free(ti);
1373                         }
1374                 }
1375                 ;
1376
1377 table_opts      :       {
1378                         bzero(&table_opts, sizeof table_opts);
1379                         SIMPLEQ_INIT(&table_opts.init_nodes);
1380                 }
1381                     table_opts_l
1382                         { $$ = table_opts; }
1383                 | /* empty */
1384                         {
1385                         bzero(&table_opts, sizeof table_opts);
1386                         SIMPLEQ_INIT(&table_opts.init_nodes);
1387                         $$ = table_opts;
1388                 }
1389                 ;
1390
1391 table_opts_l    : table_opts_l table_opt
1392                 | table_opt
1393                 ;
1394
1395 table_opt       : STRING                {
1396                         if (!strcmp($1, "const"))
1397                                 table_opts.flags |= PFR_TFLAG_CONST;
1398                         else if (!strcmp($1, "persist"))
1399                                 table_opts.flags |= PFR_TFLAG_PERSIST;
1400                         else if (!strcmp($1, "counters"))
1401                                 table_opts.flags |= PFR_TFLAG_COUNTERS;
1402                         else {
1403                                 yyerror("invalid table option '%s'", $1);
1404                                 free($1);
1405                                 YYERROR;
1406                         }
1407                         free($1);
1408                 }
1409                 | '{' optnl '}'         { table_opts.init_addr = 1; }
1410                 | '{' optnl host_list '}'       {
1411                         struct node_host        *n;
1412                         struct node_tinit       *ti;
1413
1414                         for (n = $3; n != NULL; n = n->next) {
1415                                 switch (n->addr.type) {
1416                                 case PF_ADDR_ADDRMASK:
1417                                         continue; /* ok */
1418                                 case PF_ADDR_RANGE:
1419                                         yyerror("address ranges are not "
1420                                             "permitted inside tables");
1421                                         break;
1422                                 case PF_ADDR_DYNIFTL:
1423                                         yyerror("dynamic addresses are not "
1424                                             "permitted inside tables");
1425                                         break;
1426                                 case PF_ADDR_TABLE:
1427                                         yyerror("tables cannot contain tables");
1428                                         break;
1429                                 case PF_ADDR_NOROUTE:
1430                                         yyerror("\"no-route\" is not permitted "
1431                                             "inside tables");
1432                                         break;
1433                                 case PF_ADDR_URPFFAILED:
1434                                         yyerror("\"urpf-failed\" is not "
1435                                             "permitted inside tables");
1436                                         break;
1437                                 default:
1438                                         yyerror("unknown address type %d",
1439                                             n->addr.type);
1440                                 }
1441                                 YYERROR;
1442                         }
1443                         if (!(ti = calloc(1, sizeof(*ti))))
1444                                 err(1, "table_opt: calloc");
1445                         ti->host = $3;
1446                         SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1447                             entries);
1448                         table_opts.init_addr = 1;
1449                 }
1450                 | FILENAME STRING       {
1451                         struct node_tinit       *ti;
1452
1453                         if (!(ti = calloc(1, sizeof(*ti))))
1454                                 err(1, "table_opt: calloc");
1455                         ti->file = $2;
1456                         SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,
1457                             entries);
1458                         table_opts.init_addr = 1;
1459                 }
1460                 ;
1461
1462 altqif          : ALTQ interface queue_opts QUEUE qassign {
1463                         struct pf_altq  a;
1464
1465                         if (check_rulestate(PFCTL_STATE_QUEUE))
1466                                 YYERROR;
1467
1468                         memset(&a, 0, sizeof(a));
1469                         if ($3.scheduler.qtype == ALTQT_NONE) {
1470                                 yyerror("no scheduler specified!");
1471                                 YYERROR;
1472                         }
1473                         a.scheduler = $3.scheduler.qtype;
1474                         a.qlimit = $3.qlimit;
1475                         a.tbrsize = $3.tbrsize;
1476                         if ($5 == NULL && $3.scheduler.qtype != ALTQT_CODEL) {
1477                                 yyerror("no child queues specified");
1478                                 YYERROR;
1479                         }
1480                         if (expand_altq(&a, $2, $5, $3.queue_bwspec,
1481                             &$3.scheduler))
1482                                 YYERROR;
1483                 }
1484                 ;
1485
1486 queuespec       : QUEUE STRING interface queue_opts qassign {
1487                         struct pf_altq  a;
1488
1489                         if (check_rulestate(PFCTL_STATE_QUEUE)) {
1490                                 free($2);
1491                                 YYERROR;
1492                         }
1493
1494                         memset(&a, 0, sizeof(a));
1495
1496                         if (strlcpy(a.qname, $2, sizeof(a.qname)) >=
1497                             sizeof(a.qname)) {
1498                                 yyerror("queue name too long (max "
1499                                     "%d chars)", PF_QNAME_SIZE-1);
1500                                 free($2);
1501                                 YYERROR;
1502                         }
1503                         free($2);
1504                         if ($4.tbrsize) {
1505                                 yyerror("cannot specify tbrsize for queue");
1506                                 YYERROR;
1507                         }
1508                         if ($4.priority > 255) {
1509                                 yyerror("priority out of range: max 255");
1510                                 YYERROR;
1511                         }
1512                         a.priority = $4.priority;
1513                         a.qlimit = $4.qlimit;
1514                         a.scheduler = $4.scheduler.qtype;
1515                         if (expand_queue(&a, $3, $5, $4.queue_bwspec,
1516                             &$4.scheduler)) {
1517                                 yyerror("errors in queue definition");
1518                                 YYERROR;
1519                         }
1520                 }
1521                 ;
1522
1523 queue_opts      :       {
1524                         bzero(&queue_opts, sizeof queue_opts);
1525                         queue_opts.priority = DEFAULT_PRIORITY;
1526                         queue_opts.qlimit = DEFAULT_QLIMIT;
1527                         queue_opts.scheduler.qtype = ALTQT_NONE;
1528                         queue_opts.queue_bwspec.bw_percent = 100;
1529                 }
1530                     queue_opts_l
1531                         { $$ = queue_opts; }
1532                 | /* empty */ {
1533                         bzero(&queue_opts, sizeof queue_opts);
1534                         queue_opts.priority = DEFAULT_PRIORITY;
1535                         queue_opts.qlimit = DEFAULT_QLIMIT;
1536                         queue_opts.scheduler.qtype = ALTQT_NONE;
1537                         queue_opts.queue_bwspec.bw_percent = 100;
1538                         $$ = queue_opts;
1539                 }
1540                 ;
1541
1542 queue_opts_l    : queue_opts_l queue_opt
1543                 | queue_opt
1544                 ;
1545
1546 queue_opt       : BANDWIDTH bandwidth   {
1547                         if (queue_opts.marker & QOM_BWSPEC) {
1548                                 yyerror("bandwidth cannot be respecified");
1549                                 YYERROR;
1550                         }
1551                         queue_opts.marker |= QOM_BWSPEC;
1552                         queue_opts.queue_bwspec = $2;
1553                 }
1554                 | PRIORITY NUMBER       {
1555                         if (queue_opts.marker & QOM_PRIORITY) {
1556                                 yyerror("priority cannot be respecified");
1557                                 YYERROR;
1558                         }
1559                         if ($2 < 0 || $2 > 255) {
1560                                 yyerror("priority out of range: max 255");
1561                                 YYERROR;
1562                         }
1563                         queue_opts.marker |= QOM_PRIORITY;
1564                         queue_opts.priority = $2;
1565                 }
1566                 | QLIMIT NUMBER {
1567                         if (queue_opts.marker & QOM_QLIMIT) {
1568                                 yyerror("qlimit cannot be respecified");
1569                                 YYERROR;
1570                         }
1571                         if ($2 < 0 || $2 > 65535) {
1572                                 yyerror("qlimit out of range: max 65535");
1573                                 YYERROR;
1574                         }
1575                         queue_opts.marker |= QOM_QLIMIT;
1576                         queue_opts.qlimit = $2;
1577                 }
1578                 | scheduler     {
1579                         if (queue_opts.marker & QOM_SCHEDULER) {
1580                                 yyerror("scheduler cannot be respecified");
1581                                 YYERROR;
1582                         }
1583                         queue_opts.marker |= QOM_SCHEDULER;
1584                         queue_opts.scheduler = $1;
1585                 }
1586                 | TBRSIZE NUMBER        {
1587                         if (queue_opts.marker & QOM_TBRSIZE) {
1588                                 yyerror("tbrsize cannot be respecified");
1589                                 YYERROR;
1590                         }
1591                         if ($2 < 0 || $2 > 65535) {
1592                                 yyerror("tbrsize too big: max 65535");
1593                                 YYERROR;
1594                         }
1595                         queue_opts.marker |= QOM_TBRSIZE;
1596                         queue_opts.tbrsize = $2;
1597                 }
1598                 ;
1599
1600 bandwidth       : STRING {
1601                         double   bps;
1602                         char    *cp;
1603
1604                         $$.bw_percent = 0;
1605
1606                         bps = strtod($1, &cp);
1607                         if (cp != NULL) {
1608                                 if (!strcmp(cp, "b"))
1609                                         ; /* nothing */
1610                                 else if (!strcmp(cp, "Kb"))
1611                                         bps *= 1000;
1612                                 else if (!strcmp(cp, "Mb"))
1613                                         bps *= 1000 * 1000;
1614                                 else if (!strcmp(cp, "Gb"))
1615                                         bps *= 1000 * 1000 * 1000;
1616                                 else if (!strcmp(cp, "%")) {
1617                                         if (bps < 0 || bps > 100) {
1618                                                 yyerror("bandwidth spec "
1619                                                     "out of range");
1620                                                 free($1);
1621                                                 YYERROR;
1622                                         }
1623                                         $$.bw_percent = bps;
1624                                         bps = 0;
1625                                 } else {
1626                                         yyerror("unknown unit %s", cp);
1627                                         free($1);
1628                                         YYERROR;
1629                                 }
1630                         }
1631                         free($1);
1632                         $$.bw_absolute = (u_int32_t)bps;
1633                 }
1634                 | NUMBER {
1635                         if ($1 < 0 || $1 > UINT_MAX) {
1636                                 yyerror("bandwidth number too big");
1637                                 YYERROR;
1638                         }
1639                         $$.bw_percent = 0;
1640                         $$.bw_absolute = $1;
1641                 }
1642                 ;
1643
1644 scheduler       : CBQ                           {
1645                         $$.qtype = ALTQT_CBQ;
1646                         $$.data.cbq_opts.flags = 0;
1647                 }
1648                 | CBQ '(' cbqflags_list ')'     {
1649                         $$.qtype = ALTQT_CBQ;
1650                         $$.data.cbq_opts.flags = $3;
1651                 }
1652                 | PRIQ                          {
1653                         $$.qtype = ALTQT_PRIQ;
1654                         $$.data.priq_opts.flags = 0;
1655                 }
1656                 | PRIQ '(' priqflags_list ')'   {
1657                         $$.qtype = ALTQT_PRIQ;
1658                         $$.data.priq_opts.flags = $3;
1659                 }
1660                 | HFSC                          {
1661                         $$.qtype = ALTQT_HFSC;
1662                         bzero(&$$.data.hfsc_opts,
1663                             sizeof(struct node_hfsc_opts));
1664                 }
1665                 | HFSC '(' hfsc_opts ')'        {
1666                         $$.qtype = ALTQT_HFSC;
1667                         $$.data.hfsc_opts = $3;
1668                 }
1669                 | FAIRQ                         {
1670                         $$.qtype = ALTQT_FAIRQ;
1671                         bzero(&$$.data.fairq_opts,
1672                                 sizeof(struct node_fairq_opts));
1673                 }
1674                 | FAIRQ '(' fairq_opts ')'      {
1675                         $$.qtype = ALTQT_FAIRQ;
1676                         $$.data.fairq_opts = $3;
1677                 }
1678                 | CODEL                         {
1679                         $$.qtype = ALTQT_CODEL;
1680                         bzero(&$$.data.codel_opts,
1681                                 sizeof(struct codel_opts));
1682                 }
1683                 | CODEL '(' codel_opts ')'      {
1684                         $$.qtype = ALTQT_CODEL;
1685                         $$.data.codel_opts = $3;
1686                 }
1687                 ;
1688
1689 cbqflags_list   : cbqflags_item                         { $$ |= $1; }
1690                 | cbqflags_list comma cbqflags_item     { $$ |= $3; }
1691                 ;
1692
1693 cbqflags_item   : STRING        {
1694                         if (!strcmp($1, "default"))
1695                                 $$ = CBQCLF_DEFCLASS;
1696                         else if (!strcmp($1, "borrow"))
1697                                 $$ = CBQCLF_BORROW;
1698                         else if (!strcmp($1, "red"))
1699                                 $$ = CBQCLF_RED;
1700                         else if (!strcmp($1, "ecn"))
1701                                 $$ = CBQCLF_RED|CBQCLF_ECN;
1702                         else if (!strcmp($1, "rio"))
1703                                 $$ = CBQCLF_RIO;
1704                         else if (!strcmp($1, "codel"))
1705                                 $$ = CBQCLF_CODEL;
1706                         else {
1707                                 yyerror("unknown cbq flag \"%s\"", $1);
1708                                 free($1);
1709                                 YYERROR;
1710                         }
1711                         free($1);
1712                 }
1713                 ;
1714
1715 priqflags_list  : priqflags_item                        { $$ |= $1; }
1716                 | priqflags_list comma priqflags_item   { $$ |= $3; }
1717                 ;
1718
1719 priqflags_item  : STRING        {
1720                         if (!strcmp($1, "default"))
1721                                 $$ = PRCF_DEFAULTCLASS;
1722                         else if (!strcmp($1, "red"))
1723                                 $$ = PRCF_RED;
1724                         else if (!strcmp($1, "ecn"))
1725                                 $$ = PRCF_RED|PRCF_ECN;
1726                         else if (!strcmp($1, "rio"))
1727                                 $$ = PRCF_RIO;
1728                         else if (!strcmp($1, "codel"))
1729                                 $$ = PRCF_CODEL;
1730                         else {
1731                                 yyerror("unknown priq flag \"%s\"", $1);
1732                                 free($1);
1733                                 YYERROR;
1734                         }
1735                         free($1);
1736                 }
1737                 ;
1738
1739 hfsc_opts       :       {
1740                                 bzero(&hfsc_opts,
1741                                     sizeof(struct node_hfsc_opts));
1742                         }
1743                     hfscopts_list                               {
1744                         $$ = hfsc_opts;
1745                 }
1746                 ;
1747
1748 hfscopts_list   : hfscopts_item
1749                 | hfscopts_list comma hfscopts_item
1750                 ;
1751
1752 hfscopts_item   : LINKSHARE bandwidth                           {
1753                         if (hfsc_opts.linkshare.used) {
1754                                 yyerror("linkshare already specified");
1755                                 YYERROR;
1756                         }
1757                         hfsc_opts.linkshare.m2 = $2;
1758                         hfsc_opts.linkshare.used = 1;
1759                 }
1760                 | LINKSHARE '(' bandwidth comma NUMBER comma bandwidth ')'
1761                     {
1762                         if ($5 < 0 || $5 > INT_MAX) {
1763                                 yyerror("timing in curve out of range");
1764                                 YYERROR;
1765                         }
1766                         if (hfsc_opts.linkshare.used) {
1767                                 yyerror("linkshare already specified");
1768                                 YYERROR;
1769                         }
1770                         hfsc_opts.linkshare.m1 = $3;
1771                         hfsc_opts.linkshare.d = $5;
1772                         hfsc_opts.linkshare.m2 = $7;
1773                         hfsc_opts.linkshare.used = 1;
1774                 }
1775                 | REALTIME bandwidth                            {
1776                         if (hfsc_opts.realtime.used) {
1777                                 yyerror("realtime already specified");
1778                                 YYERROR;
1779                         }
1780                         hfsc_opts.realtime.m2 = $2;
1781                         hfsc_opts.realtime.used = 1;
1782                 }
1783                 | REALTIME '(' bandwidth comma NUMBER comma bandwidth ')'
1784                     {
1785                         if ($5 < 0 || $5 > INT_MAX) {
1786                                 yyerror("timing in curve out of range");
1787                                 YYERROR;
1788                         }
1789                         if (hfsc_opts.realtime.used) {
1790                                 yyerror("realtime already specified");
1791                                 YYERROR;
1792                         }
1793                         hfsc_opts.realtime.m1 = $3;
1794                         hfsc_opts.realtime.d = $5;
1795                         hfsc_opts.realtime.m2 = $7;
1796                         hfsc_opts.realtime.used = 1;
1797                 }
1798                 | UPPERLIMIT bandwidth                          {
1799                         if (hfsc_opts.upperlimit.used) {
1800                                 yyerror("upperlimit already specified");
1801                                 YYERROR;
1802                         }
1803                         hfsc_opts.upperlimit.m2 = $2;
1804                         hfsc_opts.upperlimit.used = 1;
1805                 }
1806                 | UPPERLIMIT '(' bandwidth comma NUMBER comma bandwidth ')'
1807                     {
1808                         if ($5 < 0 || $5 > INT_MAX) {
1809                                 yyerror("timing in curve out of range");
1810                                 YYERROR;
1811                         }
1812                         if (hfsc_opts.upperlimit.used) {
1813                                 yyerror("upperlimit already specified");
1814                                 YYERROR;
1815                         }
1816                         hfsc_opts.upperlimit.m1 = $3;
1817                         hfsc_opts.upperlimit.d = $5;
1818                         hfsc_opts.upperlimit.m2 = $7;
1819                         hfsc_opts.upperlimit.used = 1;
1820                 }
1821                 | STRING        {
1822                         if (!strcmp($1, "default"))
1823                                 hfsc_opts.flags |= HFCF_DEFAULTCLASS;
1824                         else if (!strcmp($1, "red"))
1825                                 hfsc_opts.flags |= HFCF_RED;
1826                         else if (!strcmp($1, "ecn"))
1827                                 hfsc_opts.flags |= HFCF_RED|HFCF_ECN;
1828                         else if (!strcmp($1, "rio"))
1829                                 hfsc_opts.flags |= HFCF_RIO;
1830                         else if (!strcmp($1, "codel"))
1831                                 hfsc_opts.flags |= HFCF_CODEL;
1832                         else {
1833                                 yyerror("unknown hfsc flag \"%s\"", $1);
1834                                 free($1);
1835                                 YYERROR;
1836                         }
1837                         free($1);
1838                 }
1839                 ;
1840
1841 fairq_opts      :       {
1842                                 bzero(&fairq_opts,
1843                                     sizeof(struct node_fairq_opts));
1844                         }
1845                     fairqopts_list                              {
1846                         $$ = fairq_opts;
1847                 }
1848                 ;
1849
1850 fairqopts_list  : fairqopts_item
1851                 | fairqopts_list comma fairqopts_item
1852                 ;
1853
1854 fairqopts_item  : LINKSHARE bandwidth                           {
1855                         if (fairq_opts.linkshare.used) {
1856                                 yyerror("linkshare already specified");
1857                                 YYERROR;
1858                         }
1859                         fairq_opts.linkshare.m2 = $2;
1860                         fairq_opts.linkshare.used = 1;
1861                 }
1862                 | LINKSHARE '(' bandwidth number bandwidth ')'  {
1863                         if (fairq_opts.linkshare.used) {
1864                                 yyerror("linkshare already specified");
1865                                 YYERROR;
1866                         }
1867                         fairq_opts.linkshare.m1 = $3;
1868                         fairq_opts.linkshare.d = $4;
1869                         fairq_opts.linkshare.m2 = $5;
1870                         fairq_opts.linkshare.used = 1;
1871                 }
1872                 | HOGS bandwidth {
1873                         fairq_opts.hogs_bw = $2;
1874                 }
1875                 | BUCKETS number {
1876                         fairq_opts.nbuckets = $2;
1877                 }
1878                 | STRING        {
1879                         if (!strcmp($1, "default"))
1880                                 fairq_opts.flags |= FARF_DEFAULTCLASS;
1881                         else if (!strcmp($1, "red"))
1882                                 fairq_opts.flags |= FARF_RED;
1883                         else if (!strcmp($1, "ecn"))
1884                                 fairq_opts.flags |= FARF_RED|FARF_ECN;
1885                         else if (!strcmp($1, "rio"))
1886                                 fairq_opts.flags |= FARF_RIO;
1887                         else if (!strcmp($1, "codel"))
1888                                 fairq_opts.flags |= FARF_CODEL;
1889                         else {
1890                                 yyerror("unknown fairq flag \"%s\"", $1);
1891                                 free($1);
1892                                 YYERROR;
1893                         }
1894                         free($1);
1895                 }
1896                 ;
1897
1898 codel_opts      :       {
1899                                 bzero(&codel_opts,
1900                                     sizeof(struct codel_opts));
1901                         }
1902                     codelopts_list                              {
1903                         $$ = codel_opts;
1904                 }
1905                 ;
1906
1907 codelopts_list  : codelopts_item
1908                 | codelopts_list comma codelopts_item
1909                 ;
1910
1911 codelopts_item  : INTERVAL number                               {
1912                         if (codel_opts.interval) {
1913                                 yyerror("interval already specified");
1914                                 YYERROR;
1915                         }
1916                         codel_opts.interval = $2;
1917                 }
1918                 | TARGET number                                 {
1919                         if (codel_opts.target) {
1920                                 yyerror("target already specified");
1921                                 YYERROR;
1922                         }
1923                         codel_opts.target = $2;
1924                 }
1925                 | STRING                                        {
1926                         if (!strcmp($1, "ecn"))
1927                                 codel_opts.ecn = 1;
1928                         else {
1929                                 yyerror("unknown codel option \"%s\"", $1);
1930                                 free($1);
1931                                 YYERROR;
1932                         }
1933                         free($1);
1934                 }
1935                 ;
1936
1937 qassign         : /* empty */           { $$ = NULL; }
1938                 | qassign_item          { $$ = $1; }
1939                 | '{' optnl qassign_list '}'    { $$ = $3; }
1940                 ;
1941
1942 qassign_list    : qassign_item optnl            { $$ = $1; }
1943                 | qassign_list comma qassign_item optnl {
1944                         $1->tail->next = $3;
1945                         $1->tail = $3;
1946                         $$ = $1;
1947                 }
1948                 ;
1949
1950 qassign_item    : STRING                        {
1951                         $$ = calloc(1, sizeof(struct node_queue));
1952                         if ($$ == NULL)
1953                                 err(1, "qassign_item: calloc");
1954                         if (strlcpy($$->queue, $1, sizeof($$->queue)) >=
1955                             sizeof($$->queue)) {
1956                                 yyerror("queue name '%s' too long (max "
1957                                     "%d chars)", $1, sizeof($$->queue)-1);
1958                                 free($1);
1959                                 free($$);
1960                                 YYERROR;
1961                         }
1962                         free($1);
1963                         $$->next = NULL;
1964                         $$->tail = $$;
1965                 }
1966                 ;
1967
1968 pfrule          : action dir logquick interface route af proto fromto
1969                     filter_opts
1970                 {
1971                         struct pf_rule           r;
1972                         struct node_state_opt   *o;
1973                         struct node_proto       *proto;
1974                         int                      srctrack = 0;
1975                         int                      statelock = 0;
1976                         int                      adaptive = 0;
1977                         int                      defaults = 0;
1978
1979                         if (check_rulestate(PFCTL_STATE_FILTER))
1980                                 YYERROR;
1981
1982                         memset(&r, 0, sizeof(r));
1983
1984                         r.action = $1.b1;
1985                         switch ($1.b2) {
1986                         case PFRULE_RETURNRST:
1987                                 r.rule_flag |= PFRULE_RETURNRST;
1988                                 r.return_ttl = $1.w;
1989                                 break;
1990                         case PFRULE_RETURNICMP:
1991                                 r.rule_flag |= PFRULE_RETURNICMP;
1992                                 r.return_icmp = $1.w;
1993                                 r.return_icmp6 = $1.w2;
1994                                 break;
1995                         case PFRULE_RETURN:
1996                                 r.rule_flag |= PFRULE_RETURN;
1997                                 r.return_icmp = $1.w;
1998                                 r.return_icmp6 = $1.w2;
1999                                 break;
2000                         }
2001                         r.direction = $2;
2002                         r.log = $3.log;
2003                         r.logif = $3.logif;
2004                         r.quick = $3.quick;
2005                         r.prob = $9.prob;
2006                         r.rtableid = $9.rtableid;
2007
2008                         r.af = $6;
2009                         if ($9.tag)
2010                                 if (strlcpy(r.tagname, $9.tag,
2011                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2012                                         yyerror("tag too long, max %u chars",
2013                                             PF_TAG_NAME_SIZE - 1);
2014                                         YYERROR;
2015                                 }
2016                         if ($9.match_tag)
2017                                 if (strlcpy(r.match_tagname, $9.match_tag,
2018                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
2019                                         yyerror("tag too long, max %u chars",
2020                                             PF_TAG_NAME_SIZE - 1);
2021                                         YYERROR;
2022                                 }
2023                         r.match_tag_not = $9.match_tag_not;
2024                         if (rule_label(&r, $9.label))
2025                                 YYERROR;
2026                         free($9.label);
2027                         r.flags = $9.flags.b1;
2028                         r.flagset = $9.flags.b2;
2029                         if (($9.flags.b1 & $9.flags.b2) != $9.flags.b1) {
2030                                 yyerror("flags always false");
2031                                 YYERROR;
2032                         }
2033                         if ($9.flags.b1 || $9.flags.b2 || $8.src_os) {
2034                                 for (proto = $7; proto != NULL &&
2035                                     proto->proto != IPPROTO_TCP;
2036                                     proto = proto->next)
2037                                         ;       /* nothing */
2038                                 if (proto == NULL && $7 != NULL) {
2039                                         if ($9.flags.b1 || $9.flags.b2)
2040                                                 yyerror(
2041                                                     "flags only apply to tcp");
2042                                         if ($8.src_os)
2043                                                 yyerror(
2044                                                     "OS fingerprinting only "
2045                                                     "apply to tcp");
2046                                         YYERROR;
2047                                 }
2048 #if 0
2049                                 if (($9.flags.b1 & parse_flags("S")) == 0 &&
2050                                     $8.src_os) {
2051                                         yyerror("OS fingerprinting requires "
2052                                             "the SYN TCP flag (flags S/SA)");
2053                                         YYERROR;
2054                                 }
2055 #endif
2056                         }
2057
2058                         r.tos = $9.tos;
2059                         r.keep_state = $9.keep.action;
2060                         o = $9.keep.options;
2061
2062                         /* 'keep state' by default on pass rules. */
2063                         if (!r.keep_state && !r.action &&
2064                             !($9.marker & FOM_KEEP)) {
2065                                 r.keep_state = PF_STATE_NORMAL;
2066                                 o = keep_state_defaults;
2067                                 defaults = 1;
2068                         }
2069
2070                         while (o) {
2071                                 struct node_state_opt   *p = o;
2072
2073                                 switch (o->type) {
2074                                 case PF_STATE_OPT_MAX:
2075                                         if (r.max_states) {
2076                                                 yyerror("state option 'max' "
2077                                                     "multiple definitions");
2078                                                 YYERROR;
2079                                         }
2080                                         r.max_states = o->data.max_states;
2081                                         break;
2082                                 case PF_STATE_OPT_NOSYNC:
2083                                         if (r.rule_flag & PFRULE_NOSYNC) {
2084                                                 yyerror("state option 'sync' "
2085                                                     "multiple definitions");
2086                                                 YYERROR;
2087                                         }
2088                                         r.rule_flag |= PFRULE_NOSYNC;
2089                                         break;
2090                                 case PF_STATE_OPT_SRCTRACK:
2091                                         if (srctrack) {
2092                                                 yyerror("state option "
2093                                                     "'source-track' "
2094                                                     "multiple definitions");
2095                                                 YYERROR;
2096                                         }
2097                                         srctrack =  o->data.src_track;
2098                                         r.rule_flag |= PFRULE_SRCTRACK;
2099                                         break;
2100                                 case PF_STATE_OPT_MAX_SRC_STATES:
2101                                         if (r.max_src_states) {
2102                                                 yyerror("state option "
2103                                                     "'max-src-states' "
2104                                                     "multiple definitions");
2105                                                 YYERROR;
2106                                         }
2107                                         if (o->data.max_src_states == 0) {
2108                                                 yyerror("'max-src-states' must "
2109                                                     "be > 0");
2110                                                 YYERROR;
2111                                         }
2112                                         r.max_src_states =
2113                                             o->data.max_src_states;
2114                                         r.rule_flag |= PFRULE_SRCTRACK;
2115                                         break;
2116                                 case PF_STATE_OPT_OVERLOAD:
2117                                         if (r.overload_tblname[0]) {
2118                                                 yyerror("multiple 'overload' "
2119                                                     "table definitions");
2120                                                 YYERROR;
2121                                         }
2122                                         if (strlcpy(r.overload_tblname,
2123                                             o->data.overload.tblname,
2124                                             PF_TABLE_NAME_SIZE) >=
2125                                             PF_TABLE_NAME_SIZE) {
2126                                                 yyerror("state option: "
2127                                                     "strlcpy");
2128                                                 YYERROR;
2129                                         }
2130                                         r.flush = o->data.overload.flush;
2131                                         break;
2132                                 case PF_STATE_OPT_MAX_SRC_CONN:
2133                                         if (r.max_src_conn) {
2134                                                 yyerror("state option "
2135                                                     "'max-src-conn' "
2136                                                     "multiple definitions");
2137                                                 YYERROR;
2138                                         }
2139                                         if (o->data.max_src_conn == 0) {
2140                                                 yyerror("'max-src-conn' "
2141                                                     "must be > 0");
2142                                                 YYERROR;
2143                                         }
2144                                         r.max_src_conn =
2145                                             o->data.max_src_conn;
2146                                         r.rule_flag |= PFRULE_SRCTRACK |
2147                                             PFRULE_RULESRCTRACK;
2148                                         break;
2149                                 case PF_STATE_OPT_MAX_SRC_CONN_RATE:
2150                                         if (r.max_src_conn_rate.limit) {
2151                                                 yyerror("state option "
2152                                                     "'max-src-conn-rate' "
2153                                                     "multiple definitions");
2154                                                 YYERROR;
2155                                         }
2156                                         if (!o->data.max_src_conn_rate.limit ||
2157                                             !o->data.max_src_conn_rate.seconds) {
2158                                                 yyerror("'max-src-conn-rate' "
2159                                                     "values must be > 0");
2160                                                 YYERROR;
2161                                         }
2162                                         if (o->data.max_src_conn_rate.limit >
2163                                             PF_THRESHOLD_MAX) {
2164                                                 yyerror("'max-src-conn-rate' "
2165                                                     "maximum rate must be < %u",
2166                                                     PF_THRESHOLD_MAX);
2167                                                 YYERROR;
2168                                         }
2169                                         r.max_src_conn_rate.limit =
2170                                             o->data.max_src_conn_rate.limit;
2171                                         r.max_src_conn_rate.seconds =
2172                                             o->data.max_src_conn_rate.seconds;
2173                                         r.rule_flag |= PFRULE_SRCTRACK |
2174                                             PFRULE_RULESRCTRACK;
2175                                         break;
2176                                 case PF_STATE_OPT_MAX_SRC_NODES:
2177                                         if (r.max_src_nodes) {
2178                                                 yyerror("state option "
2179                                                     "'max-src-nodes' "
2180                                                     "multiple definitions");
2181                                                 YYERROR;
2182                                         }
2183                                         if (o->data.max_src_nodes == 0) {
2184                                                 yyerror("'max-src-nodes' must "
2185                                                     "be > 0");
2186                                                 YYERROR;
2187                                         }
2188                                         r.max_src_nodes =
2189                                             o->data.max_src_nodes;
2190                                         r.rule_flag |= PFRULE_SRCTRACK |
2191                                             PFRULE_RULESRCTRACK;
2192                                         break;
2193                                 case PF_STATE_OPT_STATELOCK:
2194                                         if (statelock) {
2195                                                 yyerror("state locking option: "
2196                                                     "multiple definitions");
2197                                                 YYERROR;
2198                                         }
2199                                         statelock = 1;
2200                                         r.rule_flag |= o->data.statelock;
2201                                         break;
2202                                 case PF_STATE_OPT_SLOPPY:
2203                                         if (r.rule_flag & PFRULE_STATESLOPPY) {
2204                                                 yyerror("state sloppy option: "
2205                                                     "multiple definitions");
2206                                                 YYERROR;
2207                                         }
2208                                         r.rule_flag |= PFRULE_STATESLOPPY;
2209                                         break;
2210                                 case PF_STATE_OPT_TIMEOUT:
2211                                         if (o->data.timeout.number ==
2212                                             PFTM_ADAPTIVE_START ||
2213                                             o->data.timeout.number ==
2214                                             PFTM_ADAPTIVE_END)
2215                                                 adaptive = 1;
2216                                         if (r.timeout[o->data.timeout.number]) {
2217                                                 yyerror("state timeout %s "
2218                                                     "multiple definitions",
2219                                                     pf_timeouts[o->data.
2220                                                     timeout.number].name);
2221                                                 YYERROR;
2222                                         }
2223                                         r.timeout[o->data.timeout.number] =
2224                                             o->data.timeout.seconds;
2225                                 }
2226                                 o = o->next;
2227                                 if (!defaults)
2228                                         free(p);
2229                         }
2230
2231                         /* 'flags S/SA' by default on stateful rules */
2232                         if (!r.action && !r.flags && !r.flagset &&
2233                             !$9.fragment && !($9.marker & FOM_FLAGS) &&
2234                             r.keep_state) {
2235                                 r.flags = parse_flags("S");
2236                                 r.flagset =  parse_flags("SA");
2237                         }
2238                         if (!adaptive && r.max_states) {
2239                                 r.timeout[PFTM_ADAPTIVE_START] =
2240                                     (r.max_states / 10) * 6;
2241                                 r.timeout[PFTM_ADAPTIVE_END] =
2242                                     (r.max_states / 10) * 12;
2243                         }
2244                         if (r.rule_flag & PFRULE_SRCTRACK) {
2245                                 if (srctrack == PF_SRCTRACK_GLOBAL &&
2246                                     r.max_src_nodes) {
2247                                         yyerror("'max-src-nodes' is "
2248                                             "incompatible with "
2249                                             "'source-track global'");
2250                                         YYERROR;
2251                                 }
2252                                 if (srctrack == PF_SRCTRACK_GLOBAL &&
2253                                     r.max_src_conn) {
2254                                         yyerror("'max-src-conn' is "
2255                                             "incompatible with "
2256                                             "'source-track global'");
2257                                         YYERROR;
2258                                 }
2259                                 if (srctrack == PF_SRCTRACK_GLOBAL &&
2260                                     r.max_src_conn_rate.seconds) {
2261                                         yyerror("'max-src-conn-rate' is "
2262                                             "incompatible with "
2263                                             "'source-track global'");
2264                                         YYERROR;
2265                                 }
2266                                 if (r.timeout[PFTM_SRC_NODE] <
2267                                     r.max_src_conn_rate.seconds)
2268                                         r.timeout[PFTM_SRC_NODE] =
2269                                             r.max_src_conn_rate.seconds;
2270                                 r.rule_flag |= PFRULE_SRCTRACK;
2271                                 if (srctrack == PF_SRCTRACK_RULE)
2272                                         r.rule_flag |= PFRULE_RULESRCTRACK;
2273                         }
2274                         if (r.keep_state && !statelock)
2275                                 r.rule_flag |= default_statelock;
2276
2277                         if ($9.fragment)
2278                                 r.rule_flag |= PFRULE_FRAGMENT;
2279                         r.allow_opts = $9.allowopts;
2280
2281                         decide_address_family($8.src.host, &r.af);
2282                         decide_address_family($8.dst.host, &r.af);
2283
2284                         if ($5.rt) {
2285                                 if (!r.direction) {
2286                                         yyerror("direction must be explicit "
2287                                             "with rules that specify routing");
2288                                         YYERROR;
2289                                 }
2290                                 r.rt = $5.rt;
2291                                 r.rpool.opts = $5.pool_opts;
2292                                 if ($5.key != NULL)
2293                                         memcpy(&r.rpool.key, $5.key,
2294                                             sizeof(struct pf_poolhashkey));
2295                         }
2296                         if (r.rt && r.rt != PF_FASTROUTE) {
2297                                 decide_address_family($5.host, &r.af);
2298                                 remove_invalid_hosts(&$5.host, &r.af);
2299                                 if ($5.host == NULL) {
2300                                         yyerror("no routing address with "
2301                                             "matching address family found.");
2302                                         YYERROR;
2303                                 }
2304                                 if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
2305                                     PF_POOL_NONE && ($5.host->next != NULL ||
2306                                     $5.host->addr.type == PF_ADDR_TABLE ||
2307                                     DYNIF_MULTIADDR($5.host->addr)))
2308                                         r.rpool.opts |= PF_POOL_ROUNDROBIN;
2309                                 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2310                                     PF_POOL_ROUNDROBIN &&
2311                                     disallow_table($5.host, "tables are only "
2312                                     "supported in round-robin routing pools"))
2313                                         YYERROR;
2314                                 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2315                                     PF_POOL_ROUNDROBIN &&
2316                                     disallow_alias($5.host, "interface (%s) "
2317                                     "is only supported in round-robin "
2318                                     "routing pools"))
2319                                         YYERROR;
2320                                 if ($5.host->next != NULL) {
2321                                         if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
2322                                             PF_POOL_ROUNDROBIN) {
2323                                                 yyerror("r.rpool.opts must "
2324                                                     "be PF_POOL_ROUNDROBIN");
2325                                                 YYERROR;
2326                                         }
2327                                 }
2328                         }
2329                         if ($9.queues.qname != NULL) {
2330                                 if (strlcpy(r.qname, $9.queues.qname,
2331                                     sizeof(r.qname)) >= sizeof(r.qname)) {
2332                                         yyerror("rule qname too long (max "
2333                                             "%d chars)", sizeof(r.qname)-1);
2334                                         YYERROR;
2335                                 }
2336                                 free($9.queues.qname);
2337                         }
2338                         if ($9.queues.pqname != NULL) {
2339                                 if (strlcpy(r.pqname, $9.queues.pqname,
2340                                     sizeof(r.pqname)) >= sizeof(r.pqname)) {
2341                                         yyerror("rule pqname too long (max "
2342                                             "%d chars)", sizeof(r.pqname)-1);
2343                                         YYERROR;
2344                                 }
2345                                 free($9.queues.pqname);
2346                         }
2347 #ifdef __FreeBSD__
2348                         r.divert.port = $9.divert.port;
2349 #else
2350                         if ((r.divert.port = $9.divert.port)) {
2351                                 if (r.direction == PF_OUT) {
2352                                         if ($9.divert.addr) {
2353                                                 yyerror("address specified "
2354                                                     "for outgoing divert");
2355                                                 YYERROR;
2356                                         }
2357                                         bzero(&r.divert.addr,
2358                                             sizeof(r.divert.addr));
2359                                 } else {
2360                                         if (!$9.divert.addr) {
2361                                                 yyerror("no address specified "
2362                                                     "for incoming divert");
2363                                                 YYERROR;
2364                                         }
2365                                         if ($9.divert.addr->af != r.af) {
2366                                                 yyerror("address family "
2367                                                     "mismatch for divert");
2368                                                 YYERROR;
2369                                         }
2370                                         r.divert.addr =
2371                                             $9.divert.addr->addr.v.a.addr;
2372                                 }
2373                         }
2374 #endif
2375
2376                         expand_rule(&r, $4, $5.host, $7, $8.src_os,
2377                             $8.src.host, $8.src.port, $8.dst.host, $8.dst.port,
2378                             $9.uid, $9.gid, $9.icmpspec, "");
2379                 }
2380                 ;
2381
2382 filter_opts     :       {
2383                                 bzero(&filter_opts, sizeof filter_opts);
2384                                 filter_opts.rtableid = -1;
2385                         }
2386                     filter_opts_l
2387                         { $$ = filter_opts; }
2388                 | /* empty */   {
2389                         bzero(&filter_opts, sizeof filter_opts);
2390                         filter_opts.rtableid = -1;
2391                         $$ = filter_opts;
2392                 }
2393                 ;
2394
2395 filter_opts_l   : filter_opts_l filter_opt
2396                 | filter_opt
2397                 ;
2398
2399 filter_opt      : USER uids {
2400                         if (filter_opts.uid)
2401                                 $2->tail->next = filter_opts.uid;
2402                         filter_opts.uid = $2;
2403                 }
2404                 | GROUP gids {
2405                         if (filter_opts.gid)
2406                                 $2->tail->next = filter_opts.gid;
2407                         filter_opts.gid = $2;
2408                 }
2409                 | flags {
2410                         if (filter_opts.marker & FOM_FLAGS) {
2411                                 yyerror("flags cannot be redefined");
2412                                 YYERROR;
2413                         }
2414                         filter_opts.marker |= FOM_FLAGS;
2415                         filter_opts.flags.b1 |= $1.b1;
2416                         filter_opts.flags.b2 |= $1.b2;
2417                         filter_opts.flags.w |= $1.w;
2418                         filter_opts.flags.w2 |= $1.w2;
2419                 }
2420                 | icmpspec {
2421                         if (filter_opts.marker & FOM_ICMP) {
2422                                 yyerror("icmp-type cannot be redefined");
2423                                 YYERROR;
2424                         }
2425                         filter_opts.marker |= FOM_ICMP;
2426                         filter_opts.icmpspec = $1;
2427                 }
2428                 | TOS tos {
2429                         if (filter_opts.marker & FOM_TOS) {
2430                                 yyerror("tos cannot be redefined");
2431                                 YYERROR;
2432                         }
2433                         filter_opts.marker |= FOM_TOS;
2434                         filter_opts.tos = $2;
2435                 }
2436                 | keep {
2437                         if (filter_opts.marker & FOM_KEEP) {
2438                                 yyerror("modulate or keep cannot be redefined");
2439                                 YYERROR;
2440                         }
2441                         filter_opts.marker |= FOM_KEEP;
2442                         filter_opts.keep.action = $1.action;
2443                         filter_opts.keep.options = $1.options;
2444                 }
2445                 | FRAGMENT {
2446                         filter_opts.fragment = 1;
2447                 }
2448                 | ALLOWOPTS {
2449                         filter_opts.allowopts = 1;
2450                 }
2451                 | label {
2452                         if (filter_opts.label) {
2453                                 yyerror("label cannot be redefined");
2454                                 YYERROR;
2455                         }
2456                         filter_opts.label = $1;
2457                 }
2458                 | qname {
2459                         if (filter_opts.queues.qname) {
2460                                 yyerror("queue cannot be redefined");
2461                                 YYERROR;
2462                         }
2463                         filter_opts.queues = $1;
2464                 }
2465                 | TAG string                            {
2466                         filter_opts.tag = $2;
2467                 }
2468                 | not TAGGED string                     {
2469                         filter_opts.match_tag = $3;
2470                         filter_opts.match_tag_not = $1;
2471                 }
2472                 | PROBABILITY probability               {
2473                         double  p;
2474
2475                         p = floor($2 * UINT_MAX + 0.5);
2476                         if (p < 0.0 || p > UINT_MAX) {
2477                                 yyerror("invalid probability: %lf", p);
2478                                 YYERROR;
2479                         }
2480                         filter_opts.prob = (u_int32_t)p;
2481                         if (filter_opts.prob == 0)
2482                                 filter_opts.prob = 1;
2483                 }
2484                 | RTABLE NUMBER                         {
2485                         if ($2 < 0 || $2 > rt_tableid_max()) {
2486                                 yyerror("invalid rtable id");
2487                                 YYERROR;
2488                         }
2489                         filter_opts.rtableid = $2;
2490                 }
2491                 | DIVERTTO portplain {
2492 #ifdef __FreeBSD__
2493                         filter_opts.divert.port = $2.a;
2494                         if (!filter_opts.divert.port) {
2495                                 yyerror("invalid divert port: %u", ntohs($2.a));
2496                                 YYERROR;
2497                         }
2498 #endif
2499                 }
2500                 | DIVERTTO STRING PORT portplain {
2501 #ifndef __FreeBSD__
2502                         if ((filter_opts.divert.addr = host($2)) == NULL) {
2503                                 yyerror("could not parse divert address: %s",
2504                                     $2);
2505                                 free($2);
2506                                 YYERROR;
2507                         }
2508 #else
2509                         if ($2)
2510 #endif
2511                         free($2);
2512                         filter_opts.divert.port = $4.a;
2513                         if (!filter_opts.divert.port) {
2514                                 yyerror("invalid divert port: %u", ntohs($4.a));
2515                                 YYERROR;
2516                         }
2517                 }
2518                 | DIVERTREPLY {
2519 #ifdef __FreeBSD__
2520                         yyerror("divert-reply has no meaning in FreeBSD pf(4)");
2521                         YYERROR;
2522 #else
2523                         filter_opts.divert.port = 1;    /* some random value */
2524 #endif
2525                 }
2526                 ;
2527
2528 probability     : STRING                                {
2529                         char    *e;
2530                         double   p = strtod($1, &e);
2531
2532                         if (*e == '%') {
2533                                 p *= 0.01;
2534                                 e++;
2535                         }
2536                         if (*e) {
2537                                 yyerror("invalid probability: %s", $1);
2538                                 free($1);
2539                                 YYERROR;
2540                         }
2541                         free($1);
2542                         $$ = p;
2543                 }
2544                 | NUMBER                                {
2545                         $$ = (double)$1;
2546                 }
2547                 ;
2548
2549
2550 action          : PASS                  { $$.b1 = PF_PASS; $$.b2 = $$.w = 0; }
2551                 | BLOCK blockspec       { $$ = $2; $$.b1 = PF_DROP; }
2552                 ;
2553
2554 blockspec       : /* empty */           {
2555                         $$.b2 = blockpolicy;
2556                         $$.w = returnicmpdefault;
2557                         $$.w2 = returnicmp6default;
2558                 }
2559                 | DROP                  {
2560                         $$.b2 = PFRULE_DROP;
2561                         $$.w = 0;
2562                         $$.w2 = 0;
2563                 }
2564                 | RETURNRST             {
2565                         $$.b2 = PFRULE_RETURNRST;
2566                         $$.w = 0;
2567                         $$.w2 = 0;
2568                 }
2569                 | RETURNRST '(' TTL NUMBER ')'  {
2570                         if ($4 < 0 || $4 > 255) {
2571                                 yyerror("illegal ttl value %d", $4);
2572                                 YYERROR;
2573                         }
2574                         $$.b2 = PFRULE_RETURNRST;
2575                         $$.w = $4;
2576                         $$.w2 = 0;
2577                 }
2578                 | RETURNICMP            {
2579                         $$.b2 = PFRULE_RETURNICMP;
2580                         $$.w = returnicmpdefault;
2581                         $$.w2 = returnicmp6default;
2582                 }
2583                 | RETURNICMP6           {
2584                         $$.b2 = PFRULE_RETURNICMP;
2585                         $$.w = returnicmpdefault;
2586                         $$.w2 = returnicmp6default;
2587                 }
2588                 | RETURNICMP '(' reticmpspec ')'        {
2589                         $$.b2 = PFRULE_RETURNICMP;
2590                         $$.w = $3;
2591                         $$.w2 = returnicmpdefault;
2592                 }
2593                 | RETURNICMP6 '(' reticmp6spec ')'      {
2594                         $$.b2 = PFRULE_RETURNICMP;
2595                         $$.w = returnicmpdefault;
2596                         $$.w2 = $3;
2597                 }
2598                 | RETURNICMP '(' reticmpspec comma reticmp6spec ')' {
2599                         $$.b2 = PFRULE_RETURNICMP;
2600                         $$.w = $3;
2601                         $$.w2 = $5;
2602                 }
2603                 | RETURN {
2604                         $$.b2 = PFRULE_RETURN;
2605                         $$.w = returnicmpdefault;
2606                         $$.w2 = returnicmp6default;
2607                 }
2608                 ;
2609
2610 reticmpspec     : STRING                        {
2611                         if (!($$ = parseicmpspec($1, AF_INET))) {
2612                                 free($1);
2613                                 YYERROR;
2614                         }
2615                         free($1);
2616                 }
2617                 | NUMBER                        {
2618                         u_int8_t                icmptype;
2619
2620                         if ($1 < 0 || $1 > 255) {
2621                                 yyerror("invalid icmp code %lu", $1);
2622                                 YYERROR;
2623                         }
2624                         icmptype = returnicmpdefault >> 8;
2625                         $$ = (icmptype << 8 | $1);
2626                 }
2627                 ;
2628
2629 reticmp6spec    : STRING                        {
2630                         if (!($$ = parseicmpspec($1, AF_INET6))) {
2631                                 free($1);
2632                                 YYERROR;
2633                         }
2634                         free($1);
2635                 }
2636                 | NUMBER                        {
2637                         u_int8_t                icmptype;
2638
2639                         if ($1 < 0 || $1 > 255) {
2640                                 yyerror("invalid icmp code %lu", $1);
2641                                 YYERROR;
2642                         }
2643                         icmptype = returnicmp6default >> 8;
2644                         $$ = (icmptype << 8 | $1);
2645                 }
2646                 ;
2647
2648 dir             : /* empty */                   { $$ = PF_INOUT; }
2649                 | IN                            { $$ = PF_IN; }
2650                 | OUT                           { $$ = PF_OUT; }
2651                 ;
2652
2653 quick           : /* empty */                   { $$.quick = 0; }
2654                 | QUICK                         { $$.quick = 1; }
2655                 ;
2656
2657 logquick        : /* empty */   { $$.log = 0; $$.quick = 0; $$.logif = 0; }
2658                 | log           { $$ = $1; $$.quick = 0; }
2659                 | QUICK         { $$.quick = 1; $$.log = 0; $$.logif = 0; }
2660                 | log QUICK     { $$ = $1; $$.quick = 1; }
2661                 | QUICK log     { $$ = $2; $$.quick = 1; }
2662                 ;
2663
2664 log             : LOG                   { $$.log = PF_LOG; $$.logif = 0; }
2665                 | LOG '(' logopts ')'   {
2666                         $$.log = PF_LOG | $3.log;
2667                         $$.logif = $3.logif;
2668                 }
2669                 ;
2670
2671 logopts         : logopt                        { $$ = $1; }
2672                 | logopts comma logopt          {
2673                         $$.log = $1.log | $3.log;
2674                         $$.logif = $3.logif;
2675                         if ($$.logif == 0)
2676                                 $$.logif = $1.logif;
2677                 }
2678                 ;
2679
2680 logopt          : ALL           { $$.log = PF_LOG_ALL; $$.logif = 0; }
2681                 | USER          { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2682                 | GROUP         { $$.log = PF_LOG_SOCKET_LOOKUP; $$.logif = 0; }
2683                 | TO string     {
2684                         const char      *errstr;
2685                         u_int            i;
2686
2687                         $$.log = 0;
2688                         if (strncmp($2, "pflog", 5)) {
2689                                 yyerror("%s: should be a pflog interface", $2);
2690                                 free($2);
2691                                 YYERROR;
2692                         }
2693                         i = strtonum($2 + 5, 0, 255, &errstr);
2694                         if (errstr) {
2695                                 yyerror("%s: %s", $2, errstr);
2696                                 free($2);
2697                                 YYERROR;
2698                         }
2699                         free($2);
2700                         $$.logif = i;
2701                 }
2702                 ;
2703
2704 interface       : /* empty */                   { $$ = NULL; }
2705                 | ON if_item_not                { $$ = $2; }
2706                 | ON '{' optnl if_list '}'      { $$ = $4; }
2707                 ;
2708
2709 if_list         : if_item_not optnl             { $$ = $1; }
2710                 | if_list comma if_item_not optnl       {
2711                         $1->tail->next = $3;
2712                         $1->tail = $3;
2713                         $$ = $1;
2714                 }
2715                 ;
2716
2717 if_item_not     : not if_item                   { $$ = $2; $$->not = $1; }
2718                 ;
2719
2720 if_item         : STRING                        {
2721                         struct node_host        *n;
2722
2723                         $$ = calloc(1, sizeof(struct node_if));
2724                         if ($$ == NULL)
2725                                 err(1, "if_item: calloc");
2726                         if (strlcpy($$->ifname, $1, sizeof($$->ifname)) >=
2727                             sizeof($$->ifname)) {
2728                                 free($1);
2729                                 free($$);
2730                                 yyerror("interface name too long");
2731                                 YYERROR;
2732                         }
2733
2734                         if ((n = ifa_exists($1)) != NULL)
2735                                 $$->ifa_flags = n->ifa_flags;
2736
2737                         free($1);
2738                         $$->not = 0;
2739                         $$->next = NULL;
2740                         $$->tail = $$;
2741                 }
2742                 ;
2743
2744 af              : /* empty */                   { $$ = 0; }
2745                 | INET                          { $$ = AF_INET; }
2746                 | INET6                         { $$ = AF_INET6; }
2747                 ;
2748
2749 proto           : /* empty */                           { $$ = NULL; }
2750                 | PROTO proto_item                      { $$ = $2; }
2751                 | PROTO '{' optnl proto_list '}'        { $$ = $4; }
2752                 ;
2753
2754 proto_list      : proto_item optnl              { $$ = $1; }
2755                 | proto_list comma proto_item optnl     {
2756                         $1->tail->next = $3;
2757                         $1->tail = $3;
2758                         $$ = $1;
2759                 }
2760                 ;
2761
2762 proto_item      : protoval                      {
2763                         u_int8_t        pr;
2764
2765                         pr = (u_int8_t)$1;
2766                         if (pr == 0) {
2767                                 yyerror("proto 0 cannot be used");
2768                                 YYERROR;
2769                         }
2770                         $$ = calloc(1, sizeof(struct node_proto));
2771                         if ($$ == NULL)
2772                                 err(1, "proto_item: calloc");
2773                         $$->proto = pr;
2774                         $$->next = NULL;
2775                         $$->tail = $$;
2776                 }
2777                 ;
2778
2779 protoval        : STRING                        {
2780                         struct protoent *p;
2781
2782                         p = getprotobyname($1);
2783                         if (p == NULL) {
2784                                 yyerror("unknown protocol %s", $1);
2785                                 free($1);
2786                                 YYERROR;
2787                         }
2788                         $$ = p->p_proto;
2789                         free($1);
2790                 }
2791                 | NUMBER                        {
2792                         if ($1 < 0 || $1 > 255) {
2793                                 yyerror("protocol outside range");
2794                                 YYERROR;
2795                         }
2796                 }
2797                 ;
2798
2799 fromto          : ALL                           {
2800                         $$.src.host = NULL;
2801                         $$.src.port = NULL;
2802                         $$.dst.host = NULL;
2803                         $$.dst.port = NULL;
2804                         $$.src_os = NULL;
2805                 }
2806                 | from os to                    {
2807                         $$.src = $1;
2808                         $$.src_os = $2;
2809                         $$.dst = $3;
2810                 }
2811                 ;
2812
2813 os              : /* empty */                   { $$ = NULL; }
2814                 | OS xos                        { $$ = $2; }
2815                 | OS '{' optnl os_list '}'      { $$ = $4; }
2816                 ;
2817
2818 xos             : STRING {
2819                         $$ = calloc(1, sizeof(struct node_os));
2820                         if ($$ == NULL)
2821                                 err(1, "os: calloc");
2822                         $$->os = $1;
2823                         $$->tail = $$;
2824                 }
2825                 ;
2826
2827 os_list         : xos optnl                     { $$ = $1; }
2828                 | os_list comma xos optnl       {
2829                         $1->tail->next = $3;
2830                         $1->tail = $3;
2831                         $$ = $1;
2832                 }
2833                 ;
2834
2835 from            : /* empty */                   {
2836                         $$.host = NULL;
2837                         $$.port = NULL;
2838                 }
2839                 | FROM ipportspec               {
2840                         $$ = $2;
2841                 }
2842                 ;
2843
2844 to              : /* empty */                   {
2845                         $$.host = NULL;
2846                         $$.port = NULL;
2847                 }
2848                 | TO ipportspec         {
2849                         if (disallow_urpf_failed($2.host, "\"urpf-failed\" is "
2850                             "not permitted in a destination address"))
2851                                 YYERROR;
2852                         $$ = $2;
2853                 }
2854                 ;
2855
2856 ipportspec      : ipspec                        {
2857                         $$.host = $1;
2858                         $$.port = NULL;
2859                 }
2860                 | ipspec PORT portspec          {
2861                         $$.host = $1;
2862                         $$.port = $3;
2863                 }
2864                 | PORT portspec                 {
2865                         $$.host = NULL;
2866                         $$.port = $2;
2867                 }
2868                 ;
2869
2870 optnl           : '\n' optnl
2871                 |
2872                 ;
2873
2874 ipspec          : ANY                           { $$ = NULL; }
2875                 | xhost                         { $$ = $1; }
2876                 | '{' optnl host_list '}'       { $$ = $3; }
2877                 ;
2878
2879 toipspec        : TO ipspec                     { $$ = $2; }
2880                 | /* empty */                   { $$ = NULL; }
2881                 ;
2882
2883 host_list       : ipspec optnl                  { $$ = $1; }
2884                 | host_list comma ipspec optnl  {
2885                         if ($3 == NULL)
2886                                 $$ = $1;
2887                         else if ($1 == NULL)
2888                                 $$ = $3;
2889                         else {
2890                                 $1->tail->next = $3;
2891                                 $1->tail = $3->tail;
2892                                 $$ = $1;
2893                         }
2894                 }
2895                 ;
2896
2897 xhost           : not host                      {
2898                         struct node_host        *n;
2899
2900                         for (n = $2; n != NULL; n = n->next)
2901                                 n->not = $1;
2902                         $$ = $2;
2903                 }
2904                 | not NOROUTE                   {
2905                         $$ = calloc(1, sizeof(struct node_host));
2906                         if ($$ == NULL)
2907                                 err(1, "xhost: calloc");
2908                         $$->addr.type = PF_ADDR_NOROUTE;
2909                         $$->next = NULL;
2910                         $$->not = $1;
2911                         $$->tail = $$;
2912                 }
2913                 | not URPFFAILED                {
2914                         $$ = calloc(1, sizeof(struct node_host));
2915                         if ($$ == NULL)
2916                                 err(1, "xhost: calloc");
2917                         $$->addr.type = PF_ADDR_URPFFAILED;
2918                         $$->next = NULL;
2919                         $$->not = $1;
2920                         $$->tail = $$;
2921                 }
2922                 ;
2923
2924 host            : STRING                        {
2925                         if (($$ = host($1)) == NULL)    {
2926                                 /* error. "any" is handled elsewhere */
2927                                 free($1);
2928                                 yyerror("could not parse host specification");
2929                                 YYERROR;
2930                         }
2931                         free($1);
2932
2933                 }
2934                 | STRING '-' STRING             {
2935                         struct node_host *b, *e;
2936
2937                         if ((b = host($1)) == NULL || (e = host($3)) == NULL) {
2938                                 free($1);
2939                                 free($3);
2940                                 yyerror("could not parse host specification");
2941                                 YYERROR;
2942                         }
2943                         if (b->af != e->af ||
2944                             b->addr.type != PF_ADDR_ADDRMASK ||
2945                             e->addr.type != PF_ADDR_ADDRMASK ||
2946                             unmask(&b->addr.v.a.mask, b->af) !=
2947                             (b->af == AF_INET ? 32 : 128) ||
2948                             unmask(&e->addr.v.a.mask, e->af) !=
2949                             (e->af == AF_INET ? 32 : 128) ||
2950                             b->next != NULL || b->not ||
2951                             e->next != NULL || e->not) {
2952                                 free(b);
2953                                 free(e);
2954                                 free($1);
2955                                 free($3);
2956                                 yyerror("invalid address range");
2957                                 YYERROR;
2958                         }
2959                         memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr,
2960                             sizeof(b->addr.v.a.mask));
2961                         b->addr.type = PF_ADDR_RANGE;
2962                         $$ = b;
2963                         free(e);
2964                         free($1);
2965                         free($3);
2966                 }
2967                 | STRING '/' NUMBER             {
2968                         char    *buf;
2969
2970                         if (asprintf(&buf, "%s/%lld", $1, (long long)$3) == -1)
2971                                 err(1, "host: asprintf");
2972                         free($1);
2973                         if (($$ = host(buf)) == NULL)   {
2974                                 /* error. "any" is handled elsewhere */
2975                                 free(buf);
2976                                 yyerror("could not parse host specification");
2977                                 YYERROR;
2978                         }
2979                         free(buf);
2980                 }
2981                 | NUMBER '/' NUMBER             {
2982                         char    *buf;
2983
2984                         /* ie. for 10/8 parsing */
2985 #ifdef __FreeBSD__
2986                         if (asprintf(&buf, "%lld/%lld", (long long)$1, (long long)$3) == -1)
2987 #else
2988                         if (asprintf(&buf, "%lld/%lld", $1, $3) == -1)
2989 #endif
2990                                 err(1, "host: asprintf");
2991                         if (($$ = host(buf)) == NULL)   {
2992                                 /* error. "any" is handled elsewhere */
2993                                 free(buf);
2994                                 yyerror("could not parse host specification");
2995                                 YYERROR;
2996                         }
2997                         free(buf);
2998                 }
2999                 | dynaddr
3000                 | dynaddr '/' NUMBER            {
3001                         struct node_host        *n;
3002
3003                         if ($3 < 0 || $3 > 128) {
3004                                 yyerror("bit number too big");
3005                                 YYERROR;
3006                         }
3007                         $$ = $1;
3008                         for (n = $1; n != NULL; n = n->next)
3009                                 set_ipmask(n, $3);
3010                 }
3011                 | '<' STRING '>'        {
3012                         if (strlen($2) >= PF_TABLE_NAME_SIZE) {
3013                                 yyerror("table name '%s' too long", $2);
3014                                 free($2);
3015                                 YYERROR;
3016                         }
3017                         $$ = calloc(1, sizeof(struct node_host));
3018                         if ($$ == NULL)
3019                                 err(1, "host: calloc");
3020                         $$->addr.type = PF_ADDR_TABLE;
3021                         if (strlcpy($$->addr.v.tblname, $2,
3022                             sizeof($$->addr.v.tblname)) >=
3023                             sizeof($$->addr.v.tblname))
3024                                 errx(1, "host: strlcpy");
3025                         free($2);
3026                         $$->next = NULL;
3027                         $$->tail = $$;
3028                 }
3029                 ;
3030
3031 number          : NUMBER
3032                 | STRING                {
3033                         u_long  ulval;
3034
3035                         if (atoul($1, &ulval) == -1) {
3036                                 yyerror("%s is not a number", $1);
3037                                 free($1);
3038                                 YYERROR;
3039                         } else
3040                                 $$ = ulval;
3041                         free($1);
3042                 }
3043                 ;
3044
3045 dynaddr         : '(' STRING ')'                {
3046                         int      flags = 0;
3047                         char    *p, *op;
3048
3049                         op = $2;
3050                         if (!isalpha(op[0])) {
3051                                 yyerror("invalid interface name '%s'", op);
3052                                 free(op);
3053                                 YYERROR;
3054                         }
3055                         while ((p = strrchr($2, ':')) != NULL) {
3056                                 if (!strcmp(p+1, "network"))
3057                                         flags |= PFI_AFLAG_NETWORK;
3058                                 else if (!strcmp(p+1, "broadcast"))
3059                                         flags |= PFI_AFLAG_BROADCAST;
3060                                 else if (!strcmp(p+1, "peer"))
3061                                         flags |= PFI_AFLAG_PEER;
3062                                 else if (!strcmp(p+1, "0"))
3063                                         flags |= PFI_AFLAG_NOALIAS;
3064                                 else {
3065                                         yyerror("interface %s has bad modifier",
3066                                             $2);
3067                                         free(op);
3068                                         YYERROR;
3069                                 }
3070                                 *p = '\0';
3071                         }
3072                         if (flags & (flags - 1) & PFI_AFLAG_MODEMASK) {
3073                                 free(op);
3074                                 yyerror("illegal combination of "
3075                                     "interface modifiers");
3076                                 YYERROR;
3077                         }
3078                         $$ = calloc(1, sizeof(struct node_host));
3079                         if ($$ == NULL)
3080                                 err(1, "address: calloc");
3081                         $$->af = 0;
3082                         set_ipmask($$, 128);
3083                         $$->addr.type = PF_ADDR_DYNIFTL;
3084                         $$->addr.iflags = flags;
3085                         if (strlcpy($$->addr.v.ifname, $2,
3086                             sizeof($$->addr.v.ifname)) >=
3087                             sizeof($$->addr.v.ifname)) {
3088                                 free(op);
3089                                 free($$);
3090                                 yyerror("interface name too long");
3091                                 YYERROR;
3092                         }
3093                         free(op);
3094                         $$->next = NULL;
3095                         $$->tail = $$;
3096                 }
3097                 ;
3098
3099 portspec        : port_item                     { $$ = $1; }
3100                 | '{' optnl port_list '}'       { $$ = $3; }
3101                 ;
3102
3103 port_list       : port_item optnl               { $$ = $1; }
3104                 | port_list comma port_item optnl       {
3105                         $1->tail->next = $3;
3106                         $1->tail = $3;
3107                         $$ = $1;
3108                 }
3109                 ;
3110
3111 port_item       : portrange                     {
3112                         $$ = calloc(1, sizeof(struct node_port));
3113                         if ($$ == NULL)
3114                                 err(1, "port_item: calloc");
3115                         $$->port[0] = $1.a;
3116                         $$->port[1] = $1.b;
3117                         if ($1.t)
3118                                 $$->op = PF_OP_RRG;
3119                         else
3120                                 $$->op = PF_OP_EQ;
3121                         $$->next = NULL;
3122                         $$->tail = $$;
3123                 }
3124                 | unaryop portrange     {
3125                         if ($2.t) {
3126                                 yyerror("':' cannot be used with an other "
3127                                     "port operator");
3128                                 YYERROR;
3129                         }
3130                         $$ = calloc(1, sizeof(struct node_port));
3131                         if ($$ == NULL)
3132                                 err(1, "port_item: calloc");
3133                         $$->port[0] = $2.a;
3134                         $$->port[1] = $2.b;
3135                         $$->op = $1;
3136                         $$->next = NULL;
3137                         $$->tail = $$;
3138                 }
3139                 | portrange PORTBINARY portrange        {
3140                         if ($1.t || $3.t) {
3141                                 yyerror("':' cannot be used with an other "
3142                                     "port operator");
3143                                 YYERROR;
3144                         }
3145                         $$ = calloc(1, sizeof(struct node_port));
3146                         if ($$ == NULL)
3147                                 err(1, "port_item: calloc");
3148                         $$->port[0] = $1.a;
3149                         $$->port[1] = $3.a;
3150                         $$->op = $2;
3151                         $$->next = NULL;
3152                         $$->tail = $$;
3153                 }
3154                 ;
3155
3156 portplain       : numberstring                  {
3157                         if (parseport($1, &$$, 0) == -1) {
3158                                 free($1);
3159                                 YYERROR;
3160                         }
3161                         free($1);
3162                 }
3163                 ;
3164
3165 portrange       : numberstring                  {
3166                         if (parseport($1, &$$, PPORT_RANGE) == -1) {
3167                                 free($1);
3168                                 YYERROR;
3169                         }
3170                         free($1);
3171                 }
3172                 ;
3173
3174 uids            : uid_item                      { $$ = $1; }
3175                 | '{' optnl uid_list '}'        { $$ = $3; }
3176                 ;
3177
3178 uid_list        : uid_item optnl                { $$ = $1; }
3179                 | uid_list comma uid_item optnl {
3180                         $1->tail->next = $3;
3181                         $1->tail = $3;
3182                         $$ = $1;
3183                 }
3184                 ;
3185
3186 uid_item        : uid                           {
3187                         $$ = calloc(1, sizeof(struct node_uid));
3188                         if ($$ == NULL)
3189                                 err(1, "uid_item: calloc");
3190                         $$->uid[0] = $1;
3191                         $$->uid[1] = $1;
3192                         $$->op = PF_OP_EQ;
3193                         $$->next = NULL;
3194                         $$->tail = $$;
3195                 }
3196                 | unaryop uid                   {
3197                         if ($2 == UID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
3198                                 yyerror("user unknown requires operator = or "
3199                                     "!=");
3200                                 YYERROR;
3201                         }
3202                         $$ = calloc(1, sizeof(struct node_uid));
3203                         if ($$ == NULL)
3204                                 err(1, "uid_item: calloc");
3205                         $$->uid[0] = $2;
3206                         $$->uid[1] = $2;
3207                         $$->op = $1;
3208                         $$->next = NULL;
3209                         $$->tail = $$;
3210                 }
3211                 | uid PORTBINARY uid            {
3212                         if ($1 == UID_MAX || $3 == UID_MAX) {
3213                                 yyerror("user unknown requires operator = or "
3214                                     "!=");
3215                                 YYERROR;
3216                         }
3217                         $$ = calloc(1, sizeof(struct node_uid));
3218                         if ($$ == NULL)
3219                                 err(1, "uid_item: calloc");
3220                         $$->uid[0] = $1;
3221                         $$->uid[1] = $3;
3222                         $$->op = $2;
3223                         $$->next = NULL;
3224                         $$->tail = $$;
3225                 }
3226                 ;
3227
3228 uid             : STRING                        {
3229                         if (!strcmp($1, "unknown"))
3230                                 $$ = UID_MAX;
3231                         else {
3232                                 struct passwd   *pw;
3233
3234                                 if ((pw = getpwnam($1)) == NULL) {
3235                                         yyerror("unknown user %s", $1);
3236                                         free($1);
3237                                         YYERROR;
3238                                 }
3239                                 $$ = pw->pw_uid;
3240                         }
3241                         free($1);
3242                 }
3243                 | NUMBER                        {
3244                         if ($1 < 0 || $1 >= UID_MAX) {
3245                                 yyerror("illegal uid value %lu", $1);
3246                                 YYERROR;
3247                         }
3248                         $$ = $1;
3249                 }
3250                 ;
3251
3252 gids            : gid_item                      { $$ = $1; }
3253                 | '{' optnl gid_list '}'        { $$ = $3; }
3254                 ;
3255
3256 gid_list        : gid_item optnl                { $$ = $1; }
3257                 | gid_list comma gid_item optnl {
3258                         $1->tail->next = $3;
3259                         $1->tail = $3;
3260                         $$ = $1;
3261                 }
3262                 ;
3263
3264 gid_item        : gid                           {
3265                         $$ = calloc(1, sizeof(struct node_gid));
3266                         if ($$ == NULL)
3267                                 err(1, "gid_item: calloc");
3268                         $$->gid[0] = $1;
3269                         $$->gid[1] = $1;
3270                         $$->op = PF_OP_EQ;
3271                         $$->next = NULL;
3272                         $$->tail = $$;
3273                 }
3274                 | unaryop gid                   {
3275                         if ($2 == GID_MAX && $1 != PF_OP_EQ && $1 != PF_OP_NE) {
3276                                 yyerror("group unknown requires operator = or "
3277                                     "!=");
3278                                 YYERROR;
3279                         }
3280                         $$ = calloc(1, sizeof(struct node_gid));
3281                         if ($$ == NULL)
3282                                 err(1, "gid_item: calloc");
3283                         $$->gid[0] = $2;
3284                         $$->gid[1] = $2;
3285                         $$->op = $1;
3286                         $$->next = NULL;
3287                         $$->tail = $$;
3288                 }
3289                 | gid PORTBINARY gid            {
3290                         if ($1 == GID_MAX || $3 == GID_MAX) {
3291                                 yyerror("group unknown requires operator = or "
3292                                     "!=");
3293                                 YYERROR;
3294                         }
3295                         $$ = calloc(1, sizeof(struct node_gid));
3296                         if ($$ == NULL)
3297                                 err(1, "gid_item: calloc");
3298                         $$->gid[0] = $1;
3299                         $$->gid[1] = $3;
3300                         $$->op = $2;
3301                         $$->next = NULL;
3302                         $$->tail = $$;
3303                 }
3304                 ;
3305
3306 gid             : STRING                        {
3307                         if (!strcmp($1, "unknown"))
3308                                 $$ = GID_MAX;
3309                         else {
3310                                 struct group    *grp;
3311
3312                                 if ((grp = getgrnam($1)) == NULL) {
3313                                         yyerror("unknown group %s", $1);
3314                                         free($1);
3315                                         YYERROR;
3316                                 }
3317                                 $$ = grp->gr_gid;
3318                         }
3319                         free($1);
3320                 }
3321                 | NUMBER                        {
3322                         if ($1 < 0 || $1 >= GID_MAX) {
3323                                 yyerror("illegal gid value %lu", $1);
3324                                 YYERROR;
3325                         }
3326                         $$ = $1;
3327                 }
3328                 ;
3329
3330 flag            : STRING                        {
3331                         int     f;
3332
3333                         if ((f = parse_flags($1)) < 0) {
3334                                 yyerror("bad flags %s", $1);
3335                                 free($1);
3336                                 YYERROR;
3337                         }
3338                         free($1);
3339                         $$.b1 = f;
3340                 }
3341                 ;
3342
3343 flags           : FLAGS flag '/' flag   { $$.b1 = $2.b1; $$.b2 = $4.b1; }
3344                 | FLAGS '/' flag        { $$.b1 = 0; $$.b2 = $3.b1; }
3345                 | FLAGS ANY             { $$.b1 = 0; $$.b2 = 0; }
3346                 ;
3347
3348 icmpspec        : ICMPTYPE icmp_item                    { $$ = $2; }
3349                 | ICMPTYPE '{' optnl icmp_list '}'      { $$ = $4; }
3350                 | ICMP6TYPE icmp6_item                  { $$ = $2; }
3351                 | ICMP6TYPE '{' optnl icmp6_list '}'    { $$ = $4; }
3352                 ;
3353
3354 icmp_list       : icmp_item optnl               { $$ = $1; }
3355                 | icmp_list comma icmp_item optnl {
3356                         $1->tail->next = $3;
3357                         $1->tail = $3;
3358                         $$ = $1;
3359                 }
3360                 ;
3361
3362 icmp6_list      : icmp6_item optnl              { $$ = $1; }
3363                 | icmp6_list comma icmp6_item optnl {
3364                         $1->tail->next = $3;
3365                         $1->tail = $3;
3366                         $$ = $1;
3367                 }
3368                 ;
3369
3370 icmp_item       : icmptype              {
3371                         $$ = calloc(1, sizeof(struct node_icmp));
3372                         if ($$ == NULL)
3373                                 err(1, "icmp_item: calloc");
3374                         $$->type = $1;
3375                         $$->code = 0;
3376                         $$->proto = IPPROTO_ICMP;
3377                         $$->next = NULL;
3378                         $$->tail = $$;
3379                 }
3380                 | icmptype CODE STRING  {
3381                         const struct icmpcodeent        *p;
3382
3383                         if ((p = geticmpcodebyname($1-1, $3, AF_INET)) == NULL) {
3384                                 yyerror("unknown icmp-code %s", $3);
3385                                 free($3);
3386                                 YYERROR;
3387                         }
3388
3389                         free($3);
3390                         $$ = calloc(1, sizeof(struct node_icmp));
3391                         if ($$ == NULL)
3392                                 err(1, "icmp_item: calloc");
3393                         $$->type = $1;
3394                         $$->code = p->code + 1;
3395                         $$->proto = IPPROTO_ICMP;
3396                         $$->next = NULL;
3397                         $$->tail = $$;
3398                 }
3399                 | icmptype CODE NUMBER  {
3400                         if ($3 < 0 || $3 > 255) {
3401                                 yyerror("illegal icmp-code %lu", $3);
3402                                 YYERROR;
3403                         }
3404                         $$ = calloc(1, sizeof(struct node_icmp));
3405                         if ($$ == NULL)
3406                                 err(1, "icmp_item: calloc");
3407                         $$->type = $1;
3408                         $$->code = $3 + 1;
3409                         $$->proto = IPPROTO_ICMP;
3410                         $$->next = NULL;
3411                         $$->tail = $$;
3412                 }
3413                 ;
3414
3415 icmp6_item      : icmp6type             {
3416                         $$ = calloc(1, sizeof(struct node_icmp));
3417                         if ($$ == NULL)
3418                                 err(1, "icmp_item: calloc");
3419                         $$->type = $1;
3420                         $$->code = 0;
3421                         $$->proto = IPPROTO_ICMPV6;
3422                         $$->next = NULL;
3423                         $$->tail = $$;
3424                 }
3425                 | icmp6type CODE STRING {
3426                         const struct icmpcodeent        *p;
3427
3428                         if ((p = geticmpcodebyname($1-1, $3, AF_INET6)) == NULL) {
3429                                 yyerror("unknown icmp6-code %s", $3);
3430                                 free($3);
3431                                 YYERROR;
3432                         }
3433                         free($3);
3434
3435                         $$ = calloc(1, sizeof(struct node_icmp));
3436                         if ($$ == NULL)
3437                                 err(1, "icmp_item: calloc");
3438                         $$->type = $1;
3439                         $$->code = p->code + 1;
3440                         $$->proto = IPPROTO_ICMPV6;
3441                         $$->next = NULL;
3442                         $$->tail = $$;
3443                 }
3444                 | icmp6type CODE NUMBER {
3445                         if ($3 < 0 || $3 > 255) {
3446                                 yyerror("illegal icmp-code %lu", $3);
3447                                 YYERROR;
3448                         }
3449                         $$ = calloc(1, sizeof(struct node_icmp));
3450                         if ($$ == NULL)
3451                                 err(1, "icmp_item: calloc");
3452                         $$->type = $1;
3453                         $$->code = $3 + 1;
3454                         $$->proto = IPPROTO_ICMPV6;
3455                         $$->next = NULL;
3456                         $$->tail = $$;
3457                 }
3458                 ;
3459
3460 icmptype        : STRING                        {
3461                         const struct icmptypeent        *p;
3462
3463                         if ((p = geticmptypebyname($1, AF_INET)) == NULL) {
3464                                 yyerror("unknown icmp-type %s", $1);
3465                                 free($1);
3466                                 YYERROR;
3467                         }
3468                         $$ = p->type + 1;
3469                         free($1);
3470                 }
3471                 | NUMBER                        {
3472                         if ($1 < 0 || $1 > 255) {
3473                                 yyerror("illegal icmp-type %lu", $1);
3474                                 YYERROR;
3475                         }
3476                         $$ = $1 + 1;
3477                 }
3478                 ;
3479
3480 icmp6type       : STRING                        {
3481                         const struct icmptypeent        *p;
3482
3483                         if ((p = geticmptypebyname($1, AF_INET6)) ==
3484                             NULL) {
3485                                 yyerror("unknown icmp6-type %s", $1);
3486                                 free($1);
3487                                 YYERROR;
3488                         }
3489                         $$ = p->type + 1;
3490                         free($1);
3491                 }
3492                 | NUMBER                        {
3493                         if ($1 < 0 || $1 > 255) {
3494                                 yyerror("illegal icmp6-type %lu", $1);
3495                                 YYERROR;
3496                         }
3497                         $$ = $1 + 1;
3498                 }
3499                 ;
3500
3501 tos     : STRING                        {
3502                         if (!strcmp($1, "lowdelay"))
3503                                 $$ = IPTOS_LOWDELAY;
3504                         else if (!strcmp($1, "throughput"))
3505                                 $$ = IPTOS_THROUGHPUT;
3506                         else if (!strcmp($1, "reliability"))
3507                                 $$ = IPTOS_RELIABILITY;
3508                         else if ($1[0] == '0' && $1[1] == 'x')
3509                                 $$ = strtoul($1, NULL, 16);
3510                         else
3511                                 $$ = 0;         /* flag bad argument */
3512                         if (!$$ || $$ > 255) {
3513                                 yyerror("illegal tos value %s", $1);
3514                                 free($1);
3515                                 YYERROR;
3516                         }
3517                         free($1);
3518                 }
3519                 | NUMBER                        {
3520                         $$ = $1;
3521                         if (!$$ || $$ > 255) {
3522                                 yyerror("illegal tos value %s", $1);
3523                                 YYERROR;
3524                         }
3525                 }
3526                 ;
3527
3528 sourcetrack     : SOURCETRACK           { $$ = PF_SRCTRACK; }
3529                 | SOURCETRACK GLOBAL    { $$ = PF_SRCTRACK_GLOBAL; }
3530                 | SOURCETRACK RULE      { $$ = PF_SRCTRACK_RULE; }
3531                 ;
3532
3533 statelock       : IFBOUND {
3534                         $$ = PFRULE_IFBOUND;
3535                 }
3536                 | FLOATING {
3537                         $$ = 0;
3538                 }
3539                 ;
3540
3541 keep            : NO STATE                      {
3542                         $$.action = 0;
3543                         $$.options = NULL;
3544                 }
3545                 | KEEP STATE state_opt_spec     {
3546                         $$.action = PF_STATE_NORMAL;
3547                         $$.options = $3;
3548                 }
3549                 | MODULATE STATE state_opt_spec {
3550                         $$.action = PF_STATE_MODULATE;
3551                         $$.options = $3;
3552                 }
3553                 | SYNPROXY STATE state_opt_spec {
3554                         $$.action = PF_STATE_SYNPROXY;
3555                         $$.options = $3;
3556                 }
3557                 ;
3558
3559 flush           : /* empty */                   { $$ = 0; }
3560                 | FLUSH                         { $$ = PF_FLUSH; }
3561                 | FLUSH GLOBAL                  {
3562                         $$ = PF_FLUSH | PF_FLUSH_GLOBAL;
3563                 }
3564                 ;
3565
3566 state_opt_spec  : '(' state_opt_list ')'        { $$ = $2; }
3567                 | /* empty */                   { $$ = NULL; }
3568                 ;
3569
3570 state_opt_list  : state_opt_item                { $$ = $1; }
3571                 | state_opt_list comma state_opt_item {
3572                         $1->tail->next = $3;
3573                         $1->tail = $3;
3574                         $$ = $1;
3575                 }
3576                 ;
3577
3578 state_opt_item  : MAXIMUM NUMBER                {
3579                         if ($2 < 0 || $2 > UINT_MAX) {
3580                                 yyerror("only positive values permitted");
3581                                 YYERROR;
3582                         }
3583                         $$ = calloc(1, sizeof(struct node_state_opt));
3584                         if ($$ == NULL)
3585                                 err(1, "state_opt_item: calloc");
3586                         $$->type = PF_STATE_OPT_MAX;
3587                         $$->data.max_states = $2;
3588                         $$->next = NULL;
3589                         $$->tail = $$;
3590                 }
3591                 | NOSYNC                                {
3592                         $$ = calloc(1, sizeof(struct node_state_opt));
3593                         if ($$ == NULL)
3594                                 err(1, "state_opt_item: calloc");
3595                         $$->type = PF_STATE_OPT_NOSYNC;
3596                         $$->next = NULL;
3597                         $$->tail = $$;
3598                 }
3599                 | MAXSRCSTATES NUMBER                   {
3600                         if ($2 < 0 || $2 > UINT_MAX) {
3601                                 yyerror("only positive values permitted");
3602                                 YYERROR;
3603                         }
3604                         $$ = calloc(1, sizeof(struct node_state_opt));
3605                         if ($$ == NULL)
3606                                 err(1, "state_opt_item: calloc");
3607                         $$->type = PF_STATE_OPT_MAX_SRC_STATES;
3608                         $$->data.max_src_states = $2;
3609                         $$->next = NULL;
3610                         $$->tail = $$;
3611                 }
3612                 | MAXSRCCONN NUMBER                     {
3613                         if ($2 < 0 || $2 > UINT_MAX) {
3614                                 yyerror("only positive values permitted");
3615                                 YYERROR;
3616                         }
3617                         $$ = calloc(1, sizeof(struct node_state_opt));
3618                         if ($$ == NULL)
3619                                 err(1, "state_opt_item: calloc");
3620                         $$->type = PF_STATE_OPT_MAX_SRC_CONN;
3621                         $$->data.max_src_conn = $2;
3622                         $$->next = NULL;
3623                         $$->tail = $$;
3624                 }
3625                 | MAXSRCCONNRATE NUMBER '/' NUMBER      {
3626                         if ($2 < 0 || $2 > UINT_MAX ||
3627                             $4 < 0 || $4 > UINT_MAX) {
3628                                 yyerror("only positive values permitted");
3629                                 YYERROR;
3630                         }
3631                         $$ = calloc(1, sizeof(struct node_state_opt));
3632                         if ($$ == NULL)
3633                                 err(1, "state_opt_item: calloc");
3634                         $$->type = PF_STATE_OPT_MAX_SRC_CONN_RATE;
3635                         $$->data.max_src_conn_rate.limit = $2;
3636                         $$->data.max_src_conn_rate.seconds = $4;
3637                         $$->next = NULL;
3638                         $$->tail = $$;
3639                 }
3640                 | OVERLOAD '<' STRING '>' flush         {
3641                         if (strlen($3) >= PF_TABLE_NAME_SIZE) {
3642                                 yyerror("table name '%s' too long", $3);
3643                                 free($3);
3644                                 YYERROR;
3645                         }
3646                         $$ = calloc(1, sizeof(struct node_state_opt));
3647                         if ($$ == NULL)
3648                                 err(1, "state_opt_item: calloc");
3649                         if (strlcpy($$->data.overload.tblname, $3,
3650                             PF_TABLE_NAME_SIZE) >= PF_TABLE_NAME_SIZE)
3651                                 errx(1, "state_opt_item: strlcpy");
3652                         free($3);
3653                         $$->type = PF_STATE_OPT_OVERLOAD;
3654                         $$->data.overload.flush = $5;
3655                         $$->next = NULL;
3656                         $$->tail = $$;
3657                 }
3658                 | MAXSRCNODES NUMBER                    {
3659                         if ($2 < 0 || $2 > UINT_MAX) {
3660                                 yyerror("only positive values permitted");
3661                                 YYERROR;
3662                         }
3663                         $$ = calloc(1, sizeof(struct node_state_opt));
3664                         if ($$ == NULL)
3665                                 err(1, "state_opt_item: calloc");
3666                         $$->type = PF_STATE_OPT_MAX_SRC_NODES;
3667                         $$->data.max_src_nodes = $2;
3668                         $$->next = NULL;
3669                         $$->tail = $$;
3670                 }
3671                 | sourcetrack {
3672                         $$ = calloc(1, sizeof(struct node_state_opt));
3673                         if ($$ == NULL)
3674                                 err(1, "state_opt_item: calloc");
3675                         $$->type = PF_STATE_OPT_SRCTRACK;
3676                         $$->data.src_track = $1;
3677                         $$->next = NULL;
3678                         $$->tail = $$;
3679                 }
3680                 | statelock {
3681                         $$ = calloc(1, sizeof(struct node_state_opt));
3682                         if ($$ == NULL)
3683                                 err(1, "state_opt_item: calloc");
3684                         $$->type = PF_STATE_OPT_STATELOCK;
3685                         $$->data.statelock = $1;
3686                         $$->next = NULL;
3687                         $$->tail = $$;
3688                 }
3689                 | SLOPPY {
3690                         $$ = calloc(1, sizeof(struct node_state_opt));
3691                         if ($$ == NULL)
3692                                 err(1, "state_opt_item: calloc");
3693                         $$->type = PF_STATE_OPT_SLOPPY;
3694                         $$->next = NULL;
3695                         $$->tail = $$;
3696                 }
3697                 | STRING NUMBER                 {
3698                         int     i;
3699
3700                         if ($2 < 0 || $2 > UINT_MAX) {
3701                                 yyerror("only positive values permitted");
3702                                 YYERROR;
3703                         }
3704                         for (i = 0; pf_timeouts[i].name &&
3705                             strcmp(pf_timeouts[i].name, $1); ++i)
3706                                 ;       /* nothing */
3707                         if (!pf_timeouts[i].name) {
3708                                 yyerror("illegal timeout name %s", $1);
3709                                 free($1);
3710                                 YYERROR;
3711                         }
3712                         if (strchr(pf_timeouts[i].name, '.') == NULL) {
3713                                 yyerror("illegal state timeout %s", $1);
3714                                 free($1);
3715                                 YYERROR;
3716                         }
3717                         free($1);
3718                         $$ = calloc(1, sizeof(struct node_state_opt));
3719                         if ($$ == NULL)
3720                                 err(1, "state_opt_item: calloc");
3721                         $$->type = PF_STATE_OPT_TIMEOUT;
3722                         $$->data.timeout.number = pf_timeouts[i].timeout;
3723                         $$->data.timeout.seconds = $2;
3724                         $$->next = NULL;
3725                         $$->tail = $$;
3726                 }
3727                 ;
3728
3729 label           : LABEL STRING                  {
3730                         $$ = $2;
3731                 }
3732                 ;
3733
3734 qname           : QUEUE STRING                          {
3735                         $$.qname = $2;
3736                         $$.pqname = NULL;
3737                 }
3738                 | QUEUE '(' STRING ')'                  {
3739                         $$.qname = $3;
3740                         $$.pqname = NULL;
3741                 }
3742                 | QUEUE '(' STRING comma STRING ')'     {
3743                         $$.qname = $3;
3744                         $$.pqname = $5;
3745                 }
3746                 ;
3747
3748 no              : /* empty */                   { $$ = 0; }
3749                 | NO                            { $$ = 1; }
3750                 ;
3751
3752 portstar        : numberstring                  {
3753                         if (parseport($1, &$$, PPORT_RANGE|PPORT_STAR) == -1) {
3754                                 free($1);
3755                                 YYERROR;
3756                         }
3757                         free($1);
3758                 }
3759                 ;
3760
3761 redirspec       : host                          { $$ = $1; }
3762                 | '{' optnl redir_host_list '}' { $$ = $3; }
3763                 ;
3764
3765 redir_host_list : host optnl                    { $$ = $1; }
3766                 | redir_host_list comma host optnl {
3767                         $1->tail->next = $3;
3768                         $1->tail = $3->tail;
3769                         $$ = $1;
3770                 }
3771                 ;
3772
3773 redirpool       : /* empty */                   { $$ = NULL; }
3774                 | ARROW redirspec               {
3775                         $$ = calloc(1, sizeof(struct redirection));
3776                         if ($$ == NULL)
3777                                 err(1, "redirection: calloc");
3778                         $$->host = $2;
3779                         $$->rport.a = $$->rport.b = $$->rport.t = 0;
3780                 }
3781                 | ARROW redirspec PORT portstar {
3782                         $$ = calloc(1, sizeof(struct redirection));
3783                         if ($$ == NULL)
3784                                 err(1, "redirection: calloc");
3785                         $$->host = $2;
3786                         $$->rport = $4;
3787                 }
3788                 ;
3789
3790 hashkey         : /* empty */
3791                 {
3792                         $$ = calloc(1, sizeof(struct pf_poolhashkey));
3793                         if ($$ == NULL)
3794                                 err(1, "hashkey: calloc");
3795                         $$->key32[0] = arc4random();
3796                         $$->key32[1] = arc4random();
3797                         $$->key32[2] = arc4random();
3798                         $$->key32[3] = arc4random();
3799                 }
3800                 | string
3801                 {
3802                         if (!strncmp($1, "0x", 2)) {
3803                                 if (strlen($1) != 34) {
3804                                         free($1);
3805                                         yyerror("hex key must be 128 bits "
3806                                                 "(32 hex digits) long");
3807                                         YYERROR;
3808                                 }
3809                                 $$ = calloc(1, sizeof(struct pf_poolhashkey));
3810                                 if ($$ == NULL)
3811                                         err(1, "hashkey: calloc");
3812
3813                                 if (sscanf($1, "0x%8x%8x%8x%8x",
3814                                     &$$->key32[0], &$$->key32[1],
3815                                     &$$->key32[2], &$$->key32[3]) != 4) {
3816                                         free($$);
3817                                         free($1);
3818                                         yyerror("invalid hex key");
3819                                         YYERROR;
3820                                 }
3821                         } else {
3822                                 MD5_CTX context;
3823
3824                                 $$ = calloc(1, sizeof(struct pf_poolhashkey));
3825                                 if ($$ == NULL)
3826                                         err(1, "hashkey: calloc");
3827                                 MD5Init(&context);
3828                                 MD5Update(&context, (unsigned char *)$1,
3829                                     strlen($1));
3830                                 MD5Final((unsigned char *)$$, &context);
3831                                 HTONL($$->key32[0]);
3832                                 HTONL($$->key32[1]);
3833                                 HTONL($$->key32[2]);
3834                                 HTONL($$->key32[3]);
3835                         }
3836                         free($1);
3837                 }
3838                 ;
3839
3840 pool_opts       :       { bzero(&pool_opts, sizeof pool_opts); }
3841                     pool_opts_l
3842                         { $$ = pool_opts; }
3843                 | /* empty */   {
3844                         bzero(&pool_opts, sizeof pool_opts);
3845                         $$ = pool_opts;
3846                 }
3847                 ;
3848
3849 pool_opts_l     : pool_opts_l pool_opt
3850                 | pool_opt
3851                 ;
3852
3853 pool_opt        : BITMASK       {
3854                         if (pool_opts.type) {
3855                                 yyerror("pool type cannot be redefined");
3856                                 YYERROR;
3857                         }
3858                         pool_opts.type =  PF_POOL_BITMASK;
3859                 }
3860                 | RANDOM        {
3861                         if (pool_opts.type) {
3862                                 yyerror("pool type cannot be redefined");
3863                                 YYERROR;
3864                         }
3865                         pool_opts.type = PF_POOL_RANDOM;
3866                 }
3867                 | SOURCEHASH hashkey {
3868                         if (pool_opts.type) {
3869                                 yyerror("pool type cannot be redefined");
3870                                 YYERROR;
3871                         }
3872                         pool_opts.type = PF_POOL_SRCHASH;
3873                         pool_opts.key = $2;
3874                 }
3875                 | ROUNDROBIN    {
3876                         if (pool_opts.type) {
3877                                 yyerror("pool type cannot be redefined");
3878                                 YYERROR;
3879                         }
3880                         pool_opts.type = PF_POOL_ROUNDROBIN;
3881                 }
3882                 | STATICPORT    {
3883                         if (pool_opts.staticport) {
3884                                 yyerror("static-port cannot be redefined");
3885                                 YYERROR;
3886                         }
3887                         pool_opts.staticport = 1;
3888                 }
3889                 | STICKYADDRESS {
3890                         if (filter_opts.marker & POM_STICKYADDRESS) {
3891                                 yyerror("sticky-address cannot be redefined");
3892                                 YYERROR;
3893                         }
3894                         pool_opts.marker |= POM_STICKYADDRESS;
3895                         pool_opts.opts |= PF_POOL_STICKYADDR;
3896                 }
3897                 ;
3898
3899 redirection     : /* empty */                   { $$ = NULL; }
3900                 | ARROW host                    {
3901                         $$ = calloc(1, sizeof(struct redirection));
3902                         if ($$ == NULL)
3903                                 err(1, "redirection: calloc");
3904                         $$->host = $2;
3905                         $$->rport.a = $$->rport.b = $$->rport.t = 0;
3906                 }
3907                 | ARROW host PORT portstar      {
3908                         $$ = calloc(1, sizeof(struct redirection));
3909                         if ($$ == NULL)
3910                                 err(1, "redirection: calloc");
3911                         $$->host = $2;
3912                         $$->rport = $4;
3913                 }
3914                 ;
3915
3916 natpasslog      : /* empty */   { $$.b1 = $$.b2 = 0; $$.w2 = 0; }
3917                 | PASS          { $$.b1 = 1; $$.b2 = 0; $$.w2 = 0; }
3918                 | PASS log      { $$.b1 = 1; $$.b2 = $2.log; $$.w2 = $2.logif; }
3919                 | log           { $$.b1 = 0; $$.b2 = $1.log; $$.w2 = $1.logif; }
3920                 ;
3921
3922 nataction       : no NAT natpasslog {
3923                         if ($1 && $3.b1) {
3924                                 yyerror("\"pass\" not valid with \"no\"");
3925                                 YYERROR;
3926                         }
3927                         if ($1)
3928                                 $$.b1 = PF_NONAT;
3929                         else
3930                                 $$.b1 = PF_NAT;
3931                         $$.b2 = $3.b1;
3932                         $$.w = $3.b2;
3933                         $$.w2 = $3.w2;
3934                 }
3935                 | no RDR natpasslog {
3936                         if ($1 && $3.b1) {
3937                                 yyerror("\"pass\" not valid with \"no\"");
3938                                 YYERROR;
3939                         }
3940                         if ($1)
3941                                 $$.b1 = PF_NORDR;
3942                         else
3943                                 $$.b1 = PF_RDR;
3944                         $$.b2 = $3.b1;
3945                         $$.w = $3.b2;
3946                         $$.w2 = $3.w2;
3947                 }
3948                 ;
3949
3950 natrule         : nataction interface af proto fromto tag tagged rtable
3951                     redirpool pool_opts
3952                 {
3953                         struct pf_rule  r;
3954
3955                         if (check_rulestate(PFCTL_STATE_NAT))
3956                                 YYERROR;
3957
3958                         memset(&r, 0, sizeof(r));
3959
3960                         r.action = $1.b1;
3961                         r.natpass = $1.b2;
3962                         r.log = $1.w;
3963                         r.logif = $1.w2;
3964                         r.af = $3;
3965
3966                         if (!r.af) {
3967                                 if ($5.src.host && $5.src.host->af &&
3968                                     !$5.src.host->ifindex)
3969                                         r.af = $5.src.host->af;
3970                                 else if ($5.dst.host && $5.dst.host->af &&
3971                                     !$5.dst.host->ifindex)
3972                                         r.af = $5.dst.host->af;
3973                         }
3974
3975                         if ($6 != NULL)
3976                                 if (strlcpy(r.tagname, $6, PF_TAG_NAME_SIZE) >=
3977                                     PF_TAG_NAME_SIZE) {
3978                                         yyerror("tag too long, max %u chars",
3979                                             PF_TAG_NAME_SIZE - 1);
3980                                         YYERROR;
3981                                 }
3982
3983                         if ($7.name)
3984                                 if (strlcpy(r.match_tagname, $7.name,
3985                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
3986                                         yyerror("tag too long, max %u chars",
3987                                             PF_TAG_NAME_SIZE - 1);
3988                                         YYERROR;
3989                                 }
3990                         r.match_tag_not = $7.neg;
3991                         r.rtableid = $8;
3992
3993                         if (r.action == PF_NONAT || r.action == PF_NORDR) {
3994                                 if ($9 != NULL) {
3995                                         yyerror("translation rule with 'no' "
3996                                             "does not need '->'");
3997                                         YYERROR;
3998                                 }
3999                         } else {
4000                                 if ($9 == NULL || $9->host == NULL) {
4001                                         yyerror("translation rule requires '-> "
4002                                             "address'");
4003                                         YYERROR;
4004                                 }
4005                                 if (!r.af && ! $9->host->ifindex)
4006                                         r.af = $9->host->af;
4007
4008                                 remove_invalid_hosts(&$9->host, &r.af);
4009                                 if (invalid_redirect($9->host, r.af))
4010                                         YYERROR;
4011                                 if (check_netmask($9->host, r.af))
4012                                         YYERROR;
4013
4014                                 r.rpool.proxy_port[0] = ntohs($9->rport.a);
4015
4016                                 switch (r.action) {
4017                                 case PF_RDR:
4018                                         if (!$9->rport.b && $9->rport.t &&
4019                                             $5.dst.port != NULL) {
4020                                                 r.rpool.proxy_port[1] =
4021                                                     ntohs($9->rport.a) +
4022                                                     (ntohs(
4023                                                     $5.dst.port->port[1]) -
4024                                                     ntohs(
4025                                                     $5.dst.port->port[0]));
4026                                         } else
4027                                                 r.rpool.proxy_port[1] =
4028                                                     ntohs($9->rport.b);
4029                                         break;
4030                                 case PF_NAT:
4031                                         r.rpool.proxy_port[1] =
4032                                             ntohs($9->rport.b);
4033                                         if (!r.rpool.proxy_port[0] &&
4034                                             !r.rpool.proxy_port[1]) {
4035                                                 r.rpool.proxy_port[0] =
4036                                                     PF_NAT_PROXY_PORT_LOW;
4037                                                 r.rpool.proxy_port[1] =
4038                                                     PF_NAT_PROXY_PORT_HIGH;
4039                                         } else if (!r.rpool.proxy_port[1])
4040                                                 r.rpool.proxy_port[1] =
4041                                                     r.rpool.proxy_port[0];
4042                                         break;
4043                                 default:
4044                                         break;
4045                                 }
4046
4047                                 r.rpool.opts = $10.type;
4048                                 if ((r.rpool.opts & PF_POOL_TYPEMASK) ==
4049                                     PF_POOL_NONE && ($9->host->next != NULL ||
4050                                     $9->host->addr.type == PF_ADDR_TABLE ||
4051                                     DYNIF_MULTIADDR($9->host->addr)))
4052                                         r.rpool.opts = PF_POOL_ROUNDROBIN;
4053                                 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4054                                     PF_POOL_ROUNDROBIN &&
4055                                     disallow_table($9->host, "tables are only "
4056                                     "supported in round-robin redirection "
4057                                     "pools"))
4058                                         YYERROR;
4059                                 if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4060                                     PF_POOL_ROUNDROBIN &&
4061                                     disallow_alias($9->host, "interface (%s) "
4062                                     "is only supported in round-robin "
4063                                     "redirection pools"))
4064                                         YYERROR;
4065                                 if ($9->host->next != NULL) {
4066                                         if ((r.rpool.opts & PF_POOL_TYPEMASK) !=
4067                                             PF_POOL_ROUNDROBIN) {
4068                                                 yyerror("only round-robin "
4069                                                     "valid for multiple "
4070                                                     "redirection addresses");
4071                                                 YYERROR;
4072                                         }
4073                                 }
4074                         }
4075
4076                         if ($10.key != NULL)
4077                                 memcpy(&r.rpool.key, $10.key,
4078                                     sizeof(struct pf_poolhashkey));
4079
4080                          if ($10.opts)
4081                                 r.rpool.opts |= $10.opts;
4082
4083                         if ($10.staticport) {
4084                                 if (r.action != PF_NAT) {
4085                                         yyerror("the 'static-port' option is "
4086                                             "only valid with nat rules");
4087                                         YYERROR;
4088                                 }
4089                                 if (r.rpool.proxy_port[0] !=
4090                                     PF_NAT_PROXY_PORT_LOW &&
4091                                     r.rpool.proxy_port[1] !=
4092                                     PF_NAT_PROXY_PORT_HIGH) {
4093                                         yyerror("the 'static-port' option can't"
4094                                             " be used when specifying a port"
4095                                             " range");
4096                                         YYERROR;
4097                                 }
4098                                 r.rpool.proxy_port[0] = 0;
4099                                 r.rpool.proxy_port[1] = 0;
4100                         }
4101
4102                         expand_rule(&r, $2, $9 == NULL ? NULL : $9->host, $4,
4103                             $5.src_os, $5.src.host, $5.src.port, $5.dst.host,
4104                             $5.dst.port, 0, 0, 0, "");
4105                         free($9);
4106                 }
4107                 ;
4108
4109 binatrule       : no BINAT natpasslog interface af proto FROM host toipspec tag
4110                     tagged rtable redirection
4111                 {
4112                         struct pf_rule          binat;
4113                         struct pf_pooladdr      *pa;
4114
4115                         if (check_rulestate(PFCTL_STATE_NAT))
4116                                 YYERROR;
4117                         if (disallow_urpf_failed($9, "\"urpf-failed\" is not "
4118                             "permitted as a binat destination"))
4119                                 YYERROR;
4120
4121                         memset(&binat, 0, sizeof(binat));
4122
4123                         if ($1 && $3.b1) {
4124                                 yyerror("\"pass\" not valid with \"no\"");
4125                                 YYERROR;
4126                         }
4127                         if ($1)
4128                                 binat.action = PF_NOBINAT;
4129                         else
4130                                 binat.action = PF_BINAT;
4131                         binat.natpass = $3.b1;
4132                         binat.log = $3.b2;
4133                         binat.logif = $3.w2;
4134                         binat.af = $5;
4135                         if (!binat.af && $8 != NULL && $8->af)
4136                                 binat.af = $8->af;
4137                         if (!binat.af && $9 != NULL && $9->af)
4138                                 binat.af = $9->af;
4139
4140                         if (!binat.af && $13 != NULL && $13->host)
4141                                 binat.af = $13->host->af;
4142                         if (!binat.af) {
4143                                 yyerror("address family (inet/inet6) "
4144                                     "undefined");
4145                                 YYERROR;
4146                         }
4147
4148                         if ($4 != NULL) {
4149                                 memcpy(binat.ifname, $4->ifname,
4150                                     sizeof(binat.ifname));
4151                                 binat.ifnot = $4->not;
4152                                 free($4);
4153                         }
4154
4155                         if ($10 != NULL)
4156                                 if (strlcpy(binat.tagname, $10,
4157                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4158                                         yyerror("tag too long, max %u chars",
4159                                             PF_TAG_NAME_SIZE - 1);
4160                                         YYERROR;
4161                                 }
4162                         if ($11.name)
4163                                 if (strlcpy(binat.match_tagname, $11.name,
4164                                     PF_TAG_NAME_SIZE) >= PF_TAG_NAME_SIZE) {
4165                                         yyerror("tag too long, max %u chars",
4166                                             PF_TAG_NAME_SIZE - 1);
4167                                         YYERROR;
4168                                 }
4169                         binat.match_tag_not = $11.neg;
4170                         binat.rtableid = $12;
4171
4172                         if ($6 != NULL) {
4173                                 binat.proto = $6->proto;
4174                                 free($6);
4175                         }
4176
4177                         if ($8 != NULL && disallow_table($8, "invalid use of "
4178                             "table <%s> as the source address of a binat rule"))
4179                                 YYERROR;
4180                         if ($8 != NULL && disallow_alias($8, "invalid use of "
4181                             "interface (%s) as the source address of a binat "
4182                             "rule"))
4183                                 YYERROR;
4184                         if ($13 != NULL && $13->host != NULL && disallow_table(
4185                             $13->host, "invalid use of table <%s> as the "
4186                             "redirect address of a binat rule"))
4187                                 YYERROR;
4188                         if ($13 != NULL && $13->host != NULL && disallow_alias(
4189                             $13->host, "invalid use of interface (%s) as the "
4190                             "redirect address of a binat rule"))
4191                                 YYERROR;
4192
4193                         if ($8 != NULL) {
4194                                 if ($8->next) {
4195                                         yyerror("multiple binat ip addresses");
4196                                         YYERROR;
4197                                 }
4198                                 if ($8->addr.type == PF_ADDR_DYNIFTL)
4199                                         $8->af = binat.af;
4200                                 if ($8->af != binat.af) {
4201                                         yyerror("binat ip versions must match");
4202                                         YYERROR;
4203                                 }
4204                                 if (check_netmask($8, binat.af))
4205                                         YYERROR;
4206                                 memcpy(&binat.src.addr, &$8->addr,
4207                                     sizeof(binat.src.addr));
4208                                 free($8);
4209                         }
4210                         if ($9 != NULL) {
4211                                 if ($9->next) {
4212                                         yyerror("multiple binat ip addresses");
4213                                         YYERROR;
4214                                 }
4215                                 if ($9->af != binat.af && $9->af) {
4216                                         yyerror("binat ip versions must match");
4217                                         YYERROR;
4218                                 }
4219                                 if (check_netmask($9, binat.af))
4220                                         YYERROR;
4221                                 memcpy(&binat.dst.addr, &$9->addr,
4222                                     sizeof(binat.dst.addr));
4223                                 binat.dst.neg = $9->not;
4224                                 free($9);
4225                         }
4226
4227                         if (binat.action == PF_NOBINAT) {
4228                                 if ($13 != NULL) {
4229                                         yyerror("'no binat' rule does not need"
4230                                             " '->'");
4231                                         YYERROR;
4232                                 }
4233                         } else {
4234                                 if ($13 == NULL || $13->host == NULL) {
4235                                         yyerror("'binat' rule requires"
4236                                             " '-> address'");
4237                                         YYERROR;
4238                                 }
4239
4240                                 remove_invalid_hosts(&$13->host, &binat.af);
4241                                 if (invalid_redirect($13->host, binat.af))
4242                                         YYERROR;
4243                                 if ($13->host->next != NULL) {
4244                                         yyerror("binat rule must redirect to "
4245                                             "a single address");
4246                                         YYERROR;
4247                                 }
4248                                 if (check_netmask($13->host, binat.af))
4249                                         YYERROR;
4250
4251                                 if (!PF_AZERO(&binat.src.addr.v.a.mask,
4252                                     binat.af) &&
4253                                     !PF_AEQ(&binat.src.addr.v.a.mask,
4254                                     &$13->host->addr.v.a.mask, binat.af)) {
4255                                         yyerror("'binat' source mask and "
4256                                             "redirect mask must be the same");
4257                                         YYERROR;
4258                                 }
4259
4260                                 TAILQ_INIT(&binat.rpool.list);
4261                                 pa = calloc(1, sizeof(struct pf_pooladdr));
4262                                 if (pa == NULL)
4263                                         err(1, "binat: calloc");
4264                                 pa->addr = $13->host->addr;
4265                                 pa->ifname[0] = 0;
4266                                 TAILQ_INSERT_TAIL(&binat.rpool.list,
4267                                     pa, entries);
4268
4269                                 free($13);
4270                         }
4271
4272                         pfctl_add_rule(pf, &binat, "");
4273                 }
4274                 ;
4275
4276 tag             : /* empty */           { $$ = NULL; }
4277                 | TAG STRING            { $$ = $2; }
4278                 ;
4279
4280 tagged          : /* empty */           { $$.neg = 0; $$.name = NULL; }
4281                 | not TAGGED string     { $$.neg = $1; $$.name = $3; }
4282                 ;
4283
4284 rtable          : /* empty */           { $$ = -1; }
4285                 | RTABLE NUMBER         {
4286                         if ($2 < 0 || $2 > rt_tableid_max()) {
4287                                 yyerror("invalid rtable id");
4288                                 YYERROR;
4289                         }
4290                         $$ = $2;
4291                 }
4292                 ;
4293
4294 route_host      : STRING                        {
4295                         $$ = calloc(1, sizeof(struct node_host));
4296                         if ($$ == NULL)
4297                                 err(1, "route_host: calloc");
4298                         $$->ifname = $1;
4299                         set_ipmask($$, 128);
4300                         $$->next = NULL;
4301                         $$->tail = $$;
4302                 }
4303                 | '(' STRING host ')'           {
4304                         $$ = $3;
4305                         $$->ifname = $2;
4306                 }
4307                 ;
4308
4309 route_host_list : route_host optnl                      { $$ = $1; }
4310                 | route_host_list comma route_host optnl {
4311                         if ($1->af == 0)
4312                                 $1->af = $3->af;
4313                         if ($1->af != $3->af) {
4314                                 yyerror("all pool addresses must be in the "
4315                                     "same address family");
4316                                 YYERROR;
4317                         }
4318                         $1->tail->next = $3;
4319                         $1->tail = $3->tail;
4320                         $$ = $1;
4321                 }
4322                 ;
4323
4324 routespec       : route_host                    { $$ = $1; }
4325                 | '{' optnl route_host_list '}' { $$ = $3; }
4326                 ;
4327
4328 route           : /* empty */                   {
4329                         $$.host = NULL;
4330                         $$.rt = 0;
4331                         $$.pool_opts = 0;
4332                 }
4333                 | FASTROUTE {
4334                         $$.host = NULL;
4335                         $$.rt = PF_FASTROUTE;
4336                         $$.pool_opts = 0;
4337                 }
4338                 | ROUTETO routespec pool_opts {
4339                         $$.host = $2;
4340                         $$.rt = PF_ROUTETO;
4341                         $$.pool_opts = $3.type | $3.opts;
4342                         if ($3.key != NULL)
4343                                 $$.key = $3.key;
4344                 }
4345                 | REPLYTO routespec pool_opts {
4346                         $$.host = $2;
4347                         $$.rt = PF_REPLYTO;
4348                         $$.pool_opts = $3.type | $3.opts;
4349                         if ($3.key != NULL)
4350                                 $$.key = $3.key;
4351                 }
4352                 | DUPTO routespec pool_opts {
4353                         $$.host = $2;
4354                         $$.rt = PF_DUPTO;
4355                         $$.pool_opts = $3.type | $3.opts;
4356                         if ($3.key != NULL)
4357                                 $$.key = $3.key;
4358                 }
4359                 ;
4360
4361 timeout_spec    : STRING NUMBER
4362                 {
4363                         if (check_rulestate(PFCTL_STATE_OPTION)) {
4364                                 free($1);
4365                                 YYERROR;
4366                         }
4367                         if ($2 < 0 || $2 > UINT_MAX) {
4368                                 yyerror("only positive values permitted");
4369                                 YYERROR;
4370                         }
4371                         if (pfctl_set_timeout(pf, $1, $2, 0) != 0) {
4372                                 yyerror("unknown timeout %s", $1);
4373                                 free($1);
4374                                 YYERROR;
4375                         }
4376                         free($1);
4377                 }
4378                 ;
4379
4380 timeout_list    : timeout_list comma timeout_spec optnl
4381                 | timeout_spec optnl
4382                 ;
4383
4384 limit_spec      : STRING NUMBER
4385                 {
4386                         if (check_rulestate(PFCTL_STATE_OPTION)) {
4387                                 free($1);
4388                                 YYERROR;
4389                         }
4390                         if ($2 < 0 || $2 > UINT_MAX) {
4391                                 yyerror("only positive values permitted");
4392                                 YYERROR;
4393                         }
4394                         if (pfctl_set_limit(pf, $1, $2) != 0) {
4395                                 yyerror("unable to set limit %s %u", $1, $2);
4396                                 free($1);
4397                                 YYERROR;
4398                         }
4399                         free($1);
4400                 }
4401                 ;
4402
4403 limit_list      : limit_list comma limit_spec optnl
4404                 | limit_spec optnl
4405                 ;
4406
4407 comma           : ','
4408                 | /* empty */
4409                 ;
4410
4411 yesno           : NO                    { $$ = 0; }
4412                 | STRING                {
4413                         if (!strcmp($1, "yes"))
4414                                 $$ = 1;
4415                         else {
4416                                 yyerror("invalid value '%s', expected 'yes' "
4417                                     "or 'no'", $1);
4418                                 free($1);
4419                                 YYERROR;
4420                         }
4421                         free($1);
4422                 }
4423                 ;
4424
4425 unaryop         : '='           { $$ = PF_OP_EQ; }
4426                 | '!' '='       { $$ = PF_OP_NE; }
4427                 | '<' '='       { $$ = PF_OP_LE; }
4428                 | '<'           { $$ = PF_OP_LT; }
4429                 | '>' '='       { $$ = PF_OP_GE; }
4430                 | '>'           { $$ = PF_OP_GT; }
4431                 ;
4432
4433 %%
4434
4435 int
4436 yyerror(const char *fmt, ...)
4437 {
4438         va_list          ap;
4439
4440         file->errors++;
4441         va_start(ap, fmt);
4442         fprintf(stderr, "%s:%d: ", file->name, yylval.lineno);
4443         vfprintf(stderr, fmt, ap);
4444         fprintf(stderr, "\n");
4445         va_end(ap);
4446         return (0);
4447 }
4448
4449 int
4450 disallow_table(struct node_host *h, const char *fmt)
4451 {
4452         for (; h != NULL; h = h->next)
4453                 if (h->addr.type == PF_ADDR_TABLE) {
4454                         yyerror(fmt, h->addr.v.tblname);
4455                         return (1);
4456                 }
4457         return (0);
4458 }
4459
4460 int
4461 disallow_urpf_failed(struct node_host *h, const char *fmt)
4462 {
4463         for (; h != NULL; h = h->next)
4464                 if (h->addr.type == PF_ADDR_URPFFAILED) {
4465                         yyerror(fmt);
4466                         return (1);
4467                 }
4468         return (0);
4469 }
4470
4471 int
4472 disallow_alias(struct node_host *h, const char *fmt)
4473 {
4474         for (; h != NULL; h = h->next)
4475                 if (DYNIF_MULTIADDR(h->addr)) {
4476                         yyerror(fmt, h->addr.v.tblname);
4477                         return (1);
4478                 }
4479         return (0);
4480 }
4481
4482 int
4483 rule_consistent(struct pf_rule *r, int anchor_call)
4484 {
4485         int     problems = 0;
4486
4487         switch (r->action) {
4488         case PF_PASS:
4489         case PF_DROP:
4490         case PF_SCRUB:
4491         case PF_NOSCRUB:
4492                 problems = filter_consistent(r, anchor_call);
4493                 break;
4494         case PF_NAT:
4495         case PF_NONAT:
4496                 problems = nat_consistent(r);
4497                 break;
4498         case PF_RDR:
4499         case PF_NORDR:
4500                 problems = rdr_consistent(r);
4501                 break;
4502         case PF_BINAT:
4503         case PF_NOBINAT:
4504         default:
4505                 break;
4506         }
4507         return (problems);
4508 }
4509
4510 int
4511 filter_consistent(struct pf_rule *r, int anchor_call)
4512 {
4513         int     problems = 0;
4514
4515         if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP &&
4516             (r->src.port_op || r->dst.port_op)) {
4517                 yyerror("port only applies to tcp/udp");
4518                 problems++;
4519         }
4520         if (r->proto != IPPROTO_ICMP && r->proto != IPPROTO_ICMPV6 &&
4521             (r->type || r->code)) {
4522                 yyerror("icmp-type/code only applies to icmp");
4523                 problems++;
4524         }
4525         if (!r->af && (r->type || r->code)) {
4526                 yyerror("must indicate address family with icmp-type/code");
4527                 problems++;
4528         }
4529         if (r->overload_tblname[0] &&
4530             r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) {
4531                 yyerror("'overload' requires 'max-src-conn' "
4532                     "or 'max-src-conn-rate'");
4533                 problems++;
4534         }
4535         if ((r->proto == IPPROTO_ICMP && r->af == AF_INET6) ||
4536             (r->proto == IPPROTO_ICMPV6 && r->af == AF_INET)) {
4537                 yyerror("proto %s doesn't match address family %s",
4538                     r->proto == IPPROTO_ICMP ? "icmp" : "icmp6",
4539                     r->af == AF_INET ? "inet" : "inet6");
4540                 problems++;
4541         }
4542         if (r->allow_opts && r->action != PF_PASS) {
4543                 yyerror("allow-opts can only be specified for pass rules");
4544                 problems++;
4545         }
4546         if (r->rule_flag & PFRULE_FRAGMENT && (r->src.port_op ||
4547             r->dst.port_op || r->flagset || r->type || r->code)) {
4548                 yyerror("fragments can be filtered only on IP header fields");
4549                 problems++;
4550         }
4551         if (r->rule_flag & PFRULE_RETURNRST && r->proto != IPPROTO_TCP) {
4552                 yyerror("return-rst can only be applied to TCP rules");
4553                 problems++;
4554         }
4555         if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK)) {
4556                 yyerror("max-src-nodes requires 'source-track rule'");
4557                 problems++;
4558         }
4559         if (r->action == PF_DROP && r->keep_state) {
4560                 yyerror("keep state on block rules doesn't make sense");
4561                 problems++;
4562         }
4563         if (r->rule_flag & PFRULE_STATESLOPPY &&
4564             (r->keep_state == PF_STATE_MODULATE ||
4565             r->keep_state == PF_STATE_SYNPROXY)) {
4566                 yyerror("sloppy state matching cannot be used with "
4567                     "synproxy state or modulate state");
4568                 problems++;
4569         }
4570         return (-problems);
4571 }
4572
4573 int
4574 nat_consistent(struct pf_rule *r)
4575 {
4576         return (0);     /* yeah! */
4577 }
4578
4579 int
4580 rdr_consistent(struct pf_rule *r)
4581 {
4582         int                      problems = 0;
4583
4584         if (r->proto != IPPROTO_TCP && r->proto != IPPROTO_UDP) {
4585                 if (r->src.port_op) {
4586                         yyerror("src port only applies to tcp/udp");
4587                         problems++;
4588                 }
4589                 if (r->dst.port_op) {
4590                         yyerror("dst port only applies to tcp/udp");
4591                         problems++;
4592                 }
4593                 if (r->rpool.proxy_port[0]) {
4594                         yyerror("rpool port only applies to tcp/udp");
4595                         problems++;
4596                 }
4597         }
4598         if (r->dst.port_op &&
4599             r->dst.port_op != PF_OP_EQ && r->dst.port_op != PF_OP_RRG) {
4600                 yyerror("invalid port operator for rdr destination port");
4601                 problems++;
4602         }
4603         return (-problems);
4604 }
4605
4606 int
4607 process_tabledef(char *name, struct table_opts *opts)
4608 {
4609         struct pfr_buffer        ab;
4610         struct node_tinit       *ti;
4611
4612         bzero(&ab, sizeof(ab));
4613         ab.pfrb_type = PFRB_ADDRS;
4614         SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries) {
4615                 if (ti->file)
4616                         if (pfr_buf_load(&ab, ti->file, 0, append_addr)) {
4617                                 if (errno)
4618                                         yyerror("cannot load \"%s\": %s",
4619                                             ti->file, strerror(errno));
4620                                 else
4621                                         yyerror("file \"%s\" contains bad data",
4622                                             ti->file);
4623                                 goto _error;
4624                         }
4625                 if (ti->host)
4626                         if (append_addr_host(&ab, ti->host, 0, 0)) {
4627                                 yyerror("cannot create address buffer: %s",
4628                                     strerror(errno));
4629                                 goto _error;
4630                         }
4631         }
4632         if (pf->opts & PF_OPT_VERBOSE)
4633                 print_tabledef(name, opts->flags, opts->init_addr,
4634                     &opts->init_nodes);
4635         if (!(pf->opts & PF_OPT_NOACTION) &&
4636             pfctl_define_table(name, opts->flags, opts->init_addr,
4637             pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) {
4638                 yyerror("cannot define table %s: %s", name,
4639                     pfr_strerror(errno));
4640                 goto _error;
4641         }
4642         pf->tdirty = 1;
4643         pfr_buf_clear(&ab);
4644         return (0);
4645 _error:
4646         pfr_buf_clear(&ab);
4647         return (-1);
4648 }
4649
4650 struct keywords {
4651         const char      *k_name;
4652         int              k_val;
4653 };
4654
4655 /* macro gore, but you should've seen the prior indentation nightmare... */
4656
4657 #define FREE_LIST(T,r) \
4658         do { \
4659                 T *p, *node = r; \
4660                 while (node != NULL) { \
4661                         p = node; \
4662                         node = node->next; \
4663                         free(p); \
4664                 } \
4665         } while (0)
4666
4667 #define LOOP_THROUGH(T,n,r,C) \
4668         do { \
4669                 T *n; \
4670                 if (r == NULL) { \
4671                         r = calloc(1, sizeof(T)); \
4672                         if (r == NULL) \
4673                                 err(1, "LOOP: calloc"); \
4674                         r->next = NULL; \
4675                 } \
4676                 n = r; \
4677                 while (n != NULL) { \
4678                         do { \
4679                                 C; \
4680                         } while (0); \
4681                         n = n->next; \
4682                 } \
4683         } while (0)
4684
4685 void
4686 expand_label_str(char *label, size_t len, const char *srch, const char *repl)
4687 {
4688         char *tmp;
4689         char *p, *q;
4690
4691         if ((tmp = calloc(1, len)) == NULL)
4692                 err(1, "expand_label_str: calloc");
4693         p = q = label;
4694         while ((q = strstr(p, srch)) != NULL) {
4695                 *q = '\0';
4696                 if ((strlcat(tmp, p, len) >= len) ||
4697                     (strlcat(tmp, repl, len) >= len))
4698                         errx(1, "expand_label: label too long");
4699                 q += strlen(srch);
4700                 p = q;
4701         }
4702         if (strlcat(tmp, p, len) >= len)
4703                 errx(1, "expand_label: label too long");
4704         strlcpy(label, tmp, len);       /* always fits */
4705         free(tmp);
4706 }
4707
4708 void
4709 expand_label_if(const char *name, char *label, size_t len, const char *ifname)
4710 {
4711         if (strstr(label, name) != NULL) {
4712                 if (!*ifname)
4713                         expand_label_str(label, len, name, "any");
4714                 else
4715                         expand_label_str(label, len, name, ifname);
4716         }
4717 }
4718
4719 void
4720 expand_label_addr(const char *name, char *label, size_t len, sa_family_t af,
4721     struct node_host *h)
4722 {
4723         char tmp[64], tmp_not[66];
4724
4725         if (strstr(label, name) != NULL) {
4726                 switch (h->addr.type) {
4727                 case PF_ADDR_DYNIFTL:
4728                         snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname);
4729                         break;
4730                 case PF_ADDR_TABLE:
4731                         snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname);
4732                         break;
4733                 case PF_ADDR_NOROUTE:
4734                         snprintf(tmp, sizeof(tmp), "no-route");
4735                         break;
4736                 case PF_ADDR_URPFFAILED:
4737                         snprintf(tmp, sizeof(tmp), "urpf-failed");
4738                         break;
4739                 case PF_ADDR_ADDRMASK:
4740                         if (!af || (PF_AZERO(&h->addr.v.a.addr, af) &&
4741                             PF_AZERO(&h->addr.v.a.mask, af)))
4742                                 snprintf(tmp, sizeof(tmp), "any");
4743                         else {
4744                                 char    a[48];
4745                                 int     bits;
4746
4747                                 if (inet_ntop(af, &h->addr.v.a.addr, a,
4748                                     sizeof(a)) == NULL)
4749                                         snprintf(tmp, sizeof(tmp), "?");
4750                                 else {
4751                                         bits = unmask(&h->addr.v.a.mask, af);
4752                                         if ((af == AF_INET && bits < 32) ||
4753                                             (af == AF_INET6 && bits < 128))
4754                                                 snprintf(tmp, sizeof(tmp),
4755                                                     "%s/%d", a, bits);
4756                                         else
4757                                                 snprintf(tmp, sizeof(tmp),
4758                                                     "%s", a);
4759                                 }
4760                         }
4761                         break;
4762                 default:
4763                         snprintf(tmp, sizeof(tmp), "?");
4764                         break;
4765                 }
4766
4767                 if (h->not) {
4768                         snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp);
4769                         expand_label_str(label, len, name, tmp_not);
4770                 } else
4771                         expand_label_str(label, len, name, tmp);
4772         }
4773 }
4774
4775 void
4776 expand_label_port(const char *name, char *label, size_t len,
4777     struct node_port *port)
4778 {
4779         char     a1[6], a2[6], op[13] = "";
4780
4781         if (strstr(label, name) != NULL) {
4782                 snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0]));
4783                 snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1]));
4784                 if (!port->op)
4785                         ;
4786                 else if (port->op == PF_OP_IRG)
4787                         snprintf(op, sizeof(op), "%s><%s", a1, a2);
4788                 else if (port->op == PF_OP_XRG)
4789                         snprintf(op, sizeof(op), "%s<>%s", a1, a2);
4790                 else if (port->op == PF_OP_EQ)
4791                         snprintf(op, sizeof(op), "%s", a1);
4792                 else if (port->op == PF_OP_NE)
4793                         snprintf(op, sizeof(op), "!=%s", a1);
4794                 else if (port->op == PF_OP_LT)
4795                         snprintf(op, sizeof(op), "<%s", a1);
4796                 else if (port->op == PF_OP_LE)
4797                         snprintf(op, sizeof(op), "<=%s", a1);
4798                 else if (port->op == PF_OP_GT)
4799                         snprintf(op, sizeof(op), ">%s", a1);
4800                 else if (port->op == PF_OP_GE)
4801                         snprintf(op, sizeof(op), ">=%s", a1);
4802                 expand_label_str(label, len, name, op);
4803         }
4804 }
4805
4806 void
4807 expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto)
4808 {
4809         struct protoent *pe;
4810         char n[4];
4811
4812         if (strstr(label, name) != NULL) {
4813                 pe = getprotobynumber(proto);
4814                 if (pe != NULL)
4815                         expand_label_str(label, len, name, pe->p_name);
4816                 else {
4817                         snprintf(n, sizeof(n), "%u", proto);
4818                         expand_label_str(label, len, name, n);
4819                 }
4820         }
4821 }
4822
4823 void
4824 expand_label_nr(const char *name, char *label, size_t len)
4825 {
4826         char n[11];
4827
4828         if (strstr(label, name) != NULL) {
4829                 snprintf(n, sizeof(n), "%u", pf->anchor->match);
4830                 expand_label_str(label, len, name, n);
4831         }
4832 }
4833
4834 void
4835 expand_label(char *label, size_t len, const char *ifname, sa_family_t af,
4836     struct node_host *src_host, struct node_port *src_port,
4837     struct node_host *dst_host, struct node_port *dst_port,
4838     u_int8_t proto)
4839 {
4840         expand_label_if("$if", label, len, ifname);
4841         expand_label_addr("$srcaddr", label, len, af, src_host);
4842         expand_label_addr("$dstaddr", label, len, af, dst_host);
4843         expand_label_port("$srcport", label, len, src_port);
4844         expand_label_port("$dstport", label, len, dst_port);
4845         expand_label_proto("$proto", label, len, proto);
4846         expand_label_nr("$nr", label, len);
4847 }
4848
4849 int
4850 expand_altq(struct pf_altq *a, struct node_if *interfaces,
4851     struct node_queue *nqueues, struct node_queue_bw bwspec,
4852     struct node_queue_opt *opts)
4853 {
4854         struct pf_altq           pa, pb;
4855         char                     qname[PF_QNAME_SIZE];
4856         struct node_queue       *n;
4857         struct node_queue_bw     bw;
4858         int                      errs = 0;
4859
4860         if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
4861                 FREE_LIST(struct node_if, interfaces);
4862                 if (nqueues)
4863                         FREE_LIST(struct node_queue, nqueues);
4864                 return (0);
4865         }
4866
4867         LOOP_THROUGH(struct node_if, interface, interfaces,
4868                 memcpy(&pa, a, sizeof(struct pf_altq));
4869                 if (strlcpy(pa.ifname, interface->ifname,
4870                     sizeof(pa.ifname)) >= sizeof(pa.ifname))
4871                         errx(1, "expand_altq: strlcpy");
4872
4873                 if (interface->not) {
4874                         yyerror("altq on ! <interface> is not supported");
4875                         errs++;
4876                 } else {
4877                         if (eval_pfaltq(pf, &pa, &bwspec, opts))
4878                                 errs++;
4879                         else
4880                                 if (pfctl_add_altq(pf, &pa))
4881                                         errs++;
4882
4883                         if (pf->opts & PF_OPT_VERBOSE) {
4884                                 print_altq(&pf->paltq->altq, 0,
4885                                     &bwspec, opts);
4886                                 if (nqueues && nqueues->tail) {
4887                                         printf("queue { ");
4888                                         LOOP_THROUGH(struct node_queue, queue,
4889                                             nqueues,
4890                                                 printf("%s ",
4891                                                     queue->queue);
4892                                         );
4893                                         printf("}");
4894                                 }
4895                                 printf("\n");
4896                         }
4897
4898                         if (pa.scheduler == ALTQT_CBQ ||
4899                             pa.scheduler == ALTQT_HFSC) {
4900                                 /* now create a root queue */
4901                                 memset(&pb, 0, sizeof(struct pf_altq));
4902                                 if (strlcpy(qname, "root_", sizeof(qname)) >=
4903                                     sizeof(qname))
4904                                         errx(1, "expand_altq: strlcpy");
4905                                 if (strlcat(qname, interface->ifname,
4906                                     sizeof(qname)) >= sizeof(qname))
4907                                         errx(1, "expand_altq: strlcat");
4908                                 if (strlcpy(pb.qname, qname,
4909                                     sizeof(pb.qname)) >= sizeof(pb.qname))
4910                                         errx(1, "expand_altq: strlcpy");
4911                                 if (strlcpy(pb.ifname, interface->ifname,
4912                                     sizeof(pb.ifname)) >= sizeof(pb.ifname))
4913                                         errx(1, "expand_altq: strlcpy");
4914                                 pb.qlimit = pa.qlimit;
4915                                 pb.scheduler = pa.scheduler;
4916                                 bw.bw_absolute = pa.ifbandwidth;
4917                                 bw.bw_percent = 0;
4918                                 if (eval_pfqueue(pf, &pb, &bw, opts))
4919                                         errs++;
4920                                 else
4921                                         if (pfctl_add_altq(pf, &pb))
4922                                                 errs++;
4923                         }
4924
4925                         LOOP_THROUGH(struct node_queue, queue, nqueues,
4926                                 n = calloc(1, sizeof(struct node_queue));
4927                                 if (n == NULL)
4928                                         err(1, "expand_altq: calloc");
4929                                 if (pa.scheduler == ALTQT_CBQ ||
4930                                     pa.scheduler == ALTQT_HFSC)
4931                                         if (strlcpy(n->parent, qname,
4932                                             sizeof(n->parent)) >=
4933                                             sizeof(n->parent))
4934                                                 errx(1, "expand_altq: strlcpy");
4935                                 if (strlcpy(n->queue, queue->queue,
4936                                     sizeof(n->queue)) >= sizeof(n->queue))
4937                                         errx(1, "expand_altq: strlcpy");
4938                                 if (strlcpy(n->ifname, interface->ifname,
4939                                     sizeof(n->ifname)) >= sizeof(n->ifname))
4940                                         errx(1, "expand_altq: strlcpy");
4941                                 n->scheduler = pa.scheduler;
4942                                 n->next = NULL;
4943                                 n->tail = n;
4944                                 if (queues == NULL)
4945                                         queues = n;
4946                                 else {
4947                                         queues->tail->next = n;
4948                                         queues->tail = n;
4949                                 }
4950                         );
4951                 }
4952         );
4953         FREE_LIST(struct node_if, interfaces);
4954         if (nqueues)
4955                 FREE_LIST(struct node_queue, nqueues);
4956
4957         return (errs);
4958 }
4959
4960 int
4961 expand_queue(struct pf_altq *a, struct node_if *interfaces,
4962     struct node_queue *nqueues, struct node_queue_bw bwspec,
4963     struct node_queue_opt *opts)
4964 {
4965         struct node_queue       *n, *nq;
4966         struct pf_altq           pa;
4967         u_int8_t                 found = 0;
4968         u_int8_t                 errs = 0;
4969
4970         if ((pf->loadopt & PFCTL_FLAG_ALTQ) == 0) {
4971                 FREE_LIST(struct node_queue, nqueues);
4972                 return (0);
4973         }
4974
4975         if (queues == NULL) {
4976                 yyerror("queue %s has no parent", a->qname);
4977                 FREE_LIST(struct node_queue, nqueues);
4978                 return (1);
4979         }
4980
4981         LOOP_THROUGH(struct node_if, interface, interfaces,
4982                 LOOP_THROUGH(struct node_queue, tqueue, queues,
4983                         if (!strncmp(a->qname, tqueue->queue, PF_QNAME_SIZE) &&
4984                             (interface->ifname[0] == 0 ||
4985                             (!interface->not && !strncmp(interface->ifname,
4986                             tqueue->ifname, IFNAMSIZ)) ||
4987                             (interface->not && strncmp(interface->ifname,
4988                             tqueue->ifname, IFNAMSIZ)))) {
4989                                 /* found ourself in queues */
4990                                 found++;
4991
4992                                 memcpy(&pa, a, sizeof(struct pf_altq));
4993
4994                                 if (pa.scheduler != ALTQT_NONE &&
4995                                     pa.scheduler != tqueue->scheduler) {
4996                                         yyerror("exactly one scheduler type "
4997                                             "per interface allowed");
4998                                         return (1);
4999                                 }
5000                                 pa.scheduler = tqueue->scheduler;
5001
5002                                 /* scheduler dependent error checking */
5003                                 switch (pa.scheduler) {
5004                                 case ALTQT_PRIQ:
5005                                         if (nqueues != NULL) {
5006                                                 yyerror("priq queues cannot "
5007                                                     "have child queues");
5008                                                 return (1);
5009                                         }
5010                                         if (bwspec.bw_absolute > 0 ||
5011                                             bwspec.bw_percent < 100) {
5012                                                 yyerror("priq doesn't take "
5013                                                     "bandwidth");
5014                                                 return (1);
5015                                         }
5016                                         break;
5017                                 default:
5018                                         break;
5019                                 }
5020
5021                                 if (strlcpy(pa.ifname, tqueue->ifname,
5022                                     sizeof(pa.ifname)) >= sizeof(pa.ifname))
5023                                         errx(1, "expand_queue: strlcpy");
5024                                 if (strlcpy(pa.parent, tqueue->parent,
5025                                     sizeof(pa.parent)) >= sizeof(pa.parent))
5026                                         errx(1, "expand_queue: strlcpy");
5027
5028                                 if (eval_pfqueue(pf, &pa, &bwspec, opts))
5029                                         errs++;
5030                                 else
5031                                         if (pfctl_add_altq(pf, &pa))
5032                                                 errs++;
5033
5034                                 for (nq = nqueues; nq != NULL; nq = nq->next) {
5035                                         if (!strcmp(a->qname, nq->queue)) {
5036                                                 yyerror("queue cannot have "
5037                                                     "itself as child");
5038                                                 errs++;
5039                                                 continue;
5040                                         }
5041                                         n = calloc(1,
5042                                             sizeof(struct node_queue));
5043                                         if (n == NULL)
5044                                                 err(1, "expand_queue: calloc");
5045                                         if (strlcpy(n->parent, a->qname,
5046                                             sizeof(n->parent)) >=
5047                                             sizeof(n->parent))
5048                                                 errx(1, "expand_queue strlcpy");
5049                                         if (strlcpy(n->queue, nq->queue,
5050                                             sizeof(n->queue)) >=
5051                                             sizeof(n->queue))
5052                                                 errx(1, "expand_queue strlcpy");
5053                                         if (strlcpy(n->ifname, tqueue->ifname,
5054                                             sizeof(n->ifname)) >=
5055                                             sizeof(n->ifname))
5056                                                 errx(1, "expand_queue strlcpy");
5057                                         n->scheduler = tqueue->scheduler;
5058                                         n->next = NULL;
5059                                         n->tail = n;
5060                                         if (queues == NULL)
5061                                                 queues = n;
5062                                         else {
5063                                                 queues->tail->next = n;
5064                                                 queues->tail = n;
5065                                         }
5066                                 }
5067                                 if ((pf->opts & PF_OPT_VERBOSE) && (
5068                                     (found == 1 && interface->ifname[0] == 0) ||
5069                                     (found > 0 && interface->ifname[0] != 0))) {
5070                                         print_queue(&pf->paltq->altq, 0,
5071                                             &bwspec, interface->ifname[0] != 0,
5072                                             opts);
5073                                         if (nqueues && nqueues->tail) {
5074                                                 printf("{ ");
5075                                                 LOOP_THROUGH(struct node_queue,
5076                                                     queue, nqueues,
5077                                                         printf("%s ",
5078                                                             queue->queue);
5079                                                 );
5080                                                 printf("}");
5081                                         }
5082                                         printf("\n");
5083                                 }
5084                         }
5085                 );
5086         );
5087
5088         FREE_LIST(struct node_queue, nqueues);
5089         FREE_LIST(struct node_if, interfaces);
5090
5091         if (!found) {
5092                 yyerror("queue %s has no parent", a->qname);
5093                 errs++;
5094         }
5095
5096         if (errs)
5097                 return (1);
5098         else
5099                 return (0);
5100 }
5101
5102 void
5103 expand_rule(struct pf_rule *r,
5104     struct node_if *interfaces, struct node_host *rpool_hosts,
5105     struct node_proto *protos, struct node_os *src_oses,
5106     struct node_host *src_hosts, struct node_port *src_ports,
5107     struct node_host *dst_hosts, struct node_port *dst_ports,
5108     struct node_uid *uids, struct node_gid *gids, struct node_icmp *icmp_types,
5109     const char *anchor_call)
5110 {
5111         sa_family_t              af = r->af;
5112         int                      added = 0, error = 0;
5113         char                     ifname[IF_NAMESIZE];
5114         char                     label[PF_RULE_LABEL_SIZE];
5115         char                     tagname[PF_TAG_NAME_SIZE];
5116         char                     match_tagname[PF_TAG_NAME_SIZE];
5117         struct pf_pooladdr      *pa;
5118         struct node_host        *h;
5119         u_int8_t                 flags, flagset, keep_state;
5120
5121         if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label))
5122                 errx(1, "expand_rule: strlcpy");
5123         if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname))
5124                 errx(1, "expand_rule: strlcpy");
5125         if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >=
5126             sizeof(match_tagname))
5127                 errx(1, "expand_rule: strlcpy");
5128         flags = r->flags;
5129         flagset = r->flagset;
5130         keep_state = r->keep_state;
5131
5132         LOOP_THROUGH(struct node_if, interface, interfaces,
5133         LOOP_THROUGH(struct node_proto, proto, protos,
5134         LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types,
5135         LOOP_THROUGH(struct node_host, src_host, src_hosts,
5136         LOOP_THROUGH(struct node_port, src_port, src_ports,
5137         LOOP_THROUGH(struct node_os, src_os, src_oses,
5138         LOOP_THROUGH(struct node_host, dst_host, dst_hosts,
5139         LOOP_THROUGH(struct node_port, dst_port, dst_ports,
5140         LOOP_THROUGH(struct node_uid, uid, uids,
5141         LOOP_THROUGH(struct node_gid, gid, gids,
5142
5143                 r->af = af;
5144                 /* for link-local IPv6 address, interface must match up */
5145                 if ((r->af && src_host->af && r->af != src_host->af) ||
5146                     (r->af && dst_host->af && r->af != dst_host->af) ||
5147                     (src_host->af && dst_host->af &&
5148                     src_host->af != dst_host->af) ||
5149                     (src_host->ifindex && dst_host->ifindex &&
5150                     src_host->ifindex != dst_host->ifindex) ||
5151                     (src_host->ifindex && *interface->ifname &&
5152                     src_host->ifindex != if_nametoindex(interface->ifname)) ||
5153                     (dst_host->ifindex && *interface->ifname &&
5154                     dst_host->ifindex != if_nametoindex(interface->ifname)))
5155                         continue;
5156                 if (!r->af && src_host->af)
5157                         r->af = src_host->af;
5158                 else if (!r->af && dst_host->af)
5159                         r->af = dst_host->af;
5160
5161                 if (*interface->ifname)
5162                         strlcpy(r->ifname, interface->ifname,
5163                             sizeof(r->ifname));
5164                 else if (if_indextoname(src_host->ifindex, ifname))
5165                         strlcpy(r->ifname, ifname, sizeof(r->ifname));
5166                 else if (if_indextoname(dst_host->ifindex, ifname))
5167                         strlcpy(r->ifname, ifname, sizeof(r->ifname));
5168                 else
5169                         memset(r->ifname, '\0', sizeof(r->ifname));
5170
5171                 if (strlcpy(r->label, label, sizeof(r->label)) >=
5172                     sizeof(r->label))
5173                         errx(1, "expand_rule: strlcpy");
5174                 if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >=
5175                     sizeof(r->tagname))
5176                         errx(1, "expand_rule: strlcpy");
5177                 if (strlcpy(r->match_tagname, match_tagname,
5178                     sizeof(r->match_tagname)) >= sizeof(r->match_tagname))
5179                         errx(1, "expand_rule: strlcpy");
5180                 expand_label(r->label, PF_RULE_LABEL_SIZE, r->ifname, r->af,
5181                     src_host, src_port, dst_host, dst_port, proto->proto);
5182                 expand_label(r->tagname, PF_TAG_NAME_SIZE, r->ifname, r->af,
5183                     src_host, src_port, dst_host, dst_port, proto->proto);
5184                 expand_label(r->match_tagname, PF_TAG_NAME_SIZE, r->ifname,
5185                     r->af, src_host, src_port, dst_host, dst_port,
5186                     proto->proto);
5187
5188                 error += check_netmask(src_host, r->af);
5189                 error += check_netmask(dst_host, r->af);
5190
5191                 r->ifnot = interface->not;
5192                 r->proto = proto->proto;
5193                 r->src.addr = src_host->addr;
5194                 r->src.neg = src_host->not;
5195                 r->src.port[0] = src_port->port[0];
5196                 r->src.port[1] = src_port->port[1];
5197                 r->src.port_op = src_port->op;
5198                 r->dst.addr = dst_host->addr;
5199                 r->dst.neg = dst_host->not;
5200                 r->dst.port[0] = dst_port->port[0];
5201                 r->dst.port[1] = dst_port->port[1];
5202                 r->dst.port_op = dst_port->op;
5203                 r->uid.op = uid->op;
5204                 r->uid.uid[0] = uid->uid[0];
5205                 r->uid.uid[1] = uid->uid[1];
5206                 r->gid.op = gid->op;
5207                 r->gid.gid[0] = gid->gid[0];
5208                 r->gid.gid[1] = gid->gid[1];
5209                 r->type = icmp_type->type;
5210                 r->code = icmp_type->code;
5211
5212                 if ((keep_state == PF_STATE_MODULATE ||
5213                     keep_state == PF_STATE_SYNPROXY) &&
5214                     r->proto && r->proto != IPPROTO_TCP)
5215                         r->keep_state = PF_STATE_NORMAL;
5216                 else
5217                         r->keep_state = keep_state;
5218
5219                 if (r->proto && r->proto != IPPROTO_TCP) {
5220                         r->flags = 0;
5221                         r->flagset = 0;
5222                 } else {
5223                         r->flags = flags;
5224                         r->flagset = flagset;
5225                 }
5226                 if (icmp_type->proto && r->proto != icmp_type->proto) {
5227                         yyerror("icmp-type mismatch");
5228                         error++;
5229                 }
5230
5231                 if (src_os && src_os->os) {
5232                         r->os_fingerprint = pfctl_get_fingerprint(src_os->os);
5233                         if ((pf->opts & PF_OPT_VERBOSE2) &&
5234                             r->os_fingerprint == PF_OSFP_NOMATCH)
5235                                 fprintf(stderr,
5236                                     "warning: unknown '%s' OS fingerprint\n",
5237                                     src_os->os);
5238                 } else {
5239                         r->os_fingerprint = PF_OSFP_ANY;
5240                 }
5241
5242                 TAILQ_INIT(&r->rpool.list);
5243                 for (h = rpool_hosts; h != NULL; h = h->next) {
5244                         pa = calloc(1, sizeof(struct pf_pooladdr));
5245                         if (pa == NULL)
5246                                 err(1, "expand_rule: calloc");
5247                         pa->addr = h->addr;
5248                         if (h->ifname != NULL) {
5249                                 if (strlcpy(pa->ifname, h->ifname,
5250                                     sizeof(pa->ifname)) >=
5251                                     sizeof(pa->ifname))
5252                                         errx(1, "expand_rule: strlcpy");
5253                         } else
5254                                 pa->ifname[0] = 0;
5255                         TAILQ_INSERT_TAIL(&r->rpool.list, pa, entries);
5256                 }
5257
5258                 if (rule_consistent(r, anchor_call[0]) < 0 || error)
5259                         yyerror("skipping rule due to errors");
5260                 else {
5261                         r->nr = pf->astack[pf->asd]->match++;
5262                         pfctl_add_rule(pf, r, anchor_call);
5263                         added++;
5264                 }
5265
5266         ))))))))));
5267
5268         FREE_LIST(struct node_if, interfaces);
5269         FREE_LIST(struct node_proto, protos);
5270         FREE_LIST(struct node_host, src_hosts);
5271         FREE_LIST(struct node_port, src_ports);
5272         FREE_LIST(struct node_os, src_oses);
5273         FREE_LIST(struct node_host, dst_hosts);
5274         FREE_LIST(struct node_port, dst_ports);
5275         FREE_LIST(struct node_uid, uids);
5276         FREE_LIST(struct node_gid, gids);
5277         FREE_LIST(struct node_icmp, icmp_types);
5278         FREE_LIST(struct node_host, rpool_hosts);
5279
5280         if (!added)
5281                 yyerror("rule expands to no valid combination");
5282 }
5283
5284 int
5285 expand_skip_interface(struct node_if *interfaces)
5286 {
5287         int     errs = 0;
5288
5289         if (!interfaces || (!interfaces->next && !interfaces->not &&
5290             !strcmp(interfaces->ifname, "none"))) {
5291                 if (pf->opts & PF_OPT_VERBOSE)
5292                         printf("set skip on none\n");
5293                 errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP, 0);
5294                 return (errs);
5295         }
5296
5297         if (pf->opts & PF_OPT_VERBOSE)
5298                 printf("set skip on {");
5299         LOOP_THROUGH(struct node_if, interface, interfaces,
5300                 if (pf->opts & PF_OPT_VERBOSE)
5301                         printf(" %s", interface->ifname);
5302                 if (interface->not) {
5303                         yyerror("skip on ! <interface> is not supported");
5304                         errs++;
5305                 } else
5306                         errs += pfctl_set_interface_flags(pf,
5307                             interface->ifname, PFI_IFLAG_SKIP, 1);
5308         );
5309         if (pf->opts & PF_OPT_VERBOSE)
5310                 printf(" }\n");
5311
5312         FREE_LIST(struct node_if, interfaces);
5313
5314         if (errs)
5315                 return (1);
5316         else
5317                 return (0);
5318 }
5319
5320 #undef FREE_LIST
5321 #undef LOOP_THROUGH
5322
5323 int
5324 check_rulestate(int desired_state)
5325 {
5326         if (require_order && (rulestate > desired_state)) {
5327                 yyerror("Rules must be in order: options, normalization, "
5328                     "queueing, translation, filtering");
5329                 return (1);
5330         }
5331         rulestate = desired_state;
5332         return (0);
5333 }
5334
5335 int
5336 kw_cmp(const void *k, const void *e)
5337 {
5338         return (strcmp(k, ((const struct keywords *)e)->k_name));
5339 }
5340
5341 int
5342 lookup(char *s)
5343 {
5344         /* this has to be sorted always */
5345         static const struct keywords keywords[] = {
5346                 { "all",                ALL},
5347                 { "allow-opts",         ALLOWOPTS},
5348                 { "altq",               ALTQ},
5349                 { "anchor",             ANCHOR},
5350                 { "antispoof",          ANTISPOOF},
5351                 { "any",                ANY},
5352                 { "bandwidth",          BANDWIDTH},
5353                 { "binat",              BINAT},
5354                 { "binat-anchor",       BINATANCHOR},
5355                 { "bitmask",            BITMASK},
5356                 { "block",              BLOCK},
5357                 { "block-policy",       BLOCKPOLICY},
5358                 { "buckets",            BUCKETS},
5359                 { "cbq",                CBQ},
5360                 { "code",               CODE},
5361                 { "codelq",             CODEL},
5362                 { "crop",               FRAGCROP},
5363                 { "debug",              DEBUG},
5364                 { "divert-reply",       DIVERTREPLY},
5365                 { "divert-to",          DIVERTTO},
5366                 { "drop",               DROP},
5367                 { "drop-ovl",           FRAGDROP},
5368                 { "dup-to",             DUPTO},
5369                 { "fairq",              FAIRQ},
5370                 { "fastroute",          FASTROUTE},
5371                 { "file",               FILENAME},
5372                 { "fingerprints",       FINGERPRINTS},
5373                 { "flags",              FLAGS},
5374                 { "floating",           FLOATING},
5375                 { "flush",              FLUSH},
5376                 { "for",                FOR},
5377                 { "fragment",           FRAGMENT},
5378                 { "from",               FROM},
5379                 { "global",             GLOBAL},
5380                 { "group",              GROUP},
5381                 { "hfsc",               HFSC},
5382                 { "hogs",               HOGS},
5383                 { "hostid",             HOSTID},
5384                 { "icmp-type",          ICMPTYPE},
5385                 { "icmp6-type",         ICMP6TYPE},
5386                 { "if-bound",           IFBOUND},
5387                 { "in",                 IN},
5388                 { "include",            INCLUDE},
5389                 { "inet",               INET},
5390                 { "inet6",              INET6},
5391                 { "interval",           INTERVAL},
5392                 { "keep",               KEEP},
5393                 { "label",              LABEL},
5394                 { "limit",              LIMIT},
5395                 { "linkshare",          LINKSHARE},
5396                 { "load",               LOAD},
5397                 { "log",                LOG},
5398                 { "loginterface",       LOGINTERFACE},
5399                 { "max",                MAXIMUM},
5400                 { "max-mss",            MAXMSS},
5401                 { "max-src-conn",       MAXSRCCONN},
5402                 { "max-src-conn-rate",  MAXSRCCONNRATE},
5403                 { "max-src-nodes",      MAXSRCNODES},
5404                 { "max-src-states",     MAXSRCSTATES},
5405                 { "min-ttl",            MINTTL},
5406                 { "modulate",           MODULATE},
5407                 { "nat",                NAT},
5408                 { "nat-anchor",         NATANCHOR},
5409                 { "no",                 NO},
5410                 { "no-df",              NODF},
5411                 { "no-route",           NOROUTE},
5412                 { "no-sync",            NOSYNC},
5413                 { "on",                 ON},
5414                 { "optimization",       OPTIMIZATION},
5415                 { "os",                 OS},
5416                 { "out",                OUT},
5417                 { "overload",           OVERLOAD},
5418                 { "pass",               PASS},
5419                 { "port",               PORT},
5420                 { "priority",           PRIORITY},
5421                 { "priq",               PRIQ},
5422                 { "probability",        PROBABILITY},
5423                 { "proto",              PROTO},
5424                 { "qlimit",             QLIMIT},
5425                 { "queue",              QUEUE},
5426                 { "quick",              QUICK},
5427                 { "random",             RANDOM},
5428                 { "random-id",          RANDOMID},
5429                 { "rdr",                RDR},
5430                 { "rdr-anchor",         RDRANCHOR},
5431                 { "realtime",           REALTIME},
5432                 { "reassemble",         REASSEMBLE},
5433                 { "reply-to",           REPLYTO},
5434                 { "require-order",      REQUIREORDER},
5435                 { "return",             RETURN},
5436                 { "return-icmp",        RETURNICMP},
5437                 { "return-icmp6",       RETURNICMP6},
5438                 { "return-rst",         RETURNRST},
5439                 { "round-robin",        ROUNDROBIN},
5440                 { "route",              ROUTE},
5441                 { "route-to",           ROUTETO},
5442                 { "rtable",             RTABLE},
5443                 { "rule",               RULE},
5444                 { "ruleset-optimization",       RULESET_OPTIMIZATION},
5445                 { "scrub",              SCRUB},
5446                 { "set",                SET},
5447                 { "set-tos",            SETTOS},
5448                 { "skip",               SKIP},
5449                 { "sloppy",             SLOPPY},
5450                 { "source-hash",        SOURCEHASH},
5451                 { "source-track",       SOURCETRACK},
5452                 { "state",              STATE},
5453                 { "state-defaults",     STATEDEFAULTS},
5454                 { "state-policy",       STATEPOLICY},
5455                 { "static-port",        STATICPORT},
5456                 { "sticky-address",     STICKYADDRESS},
5457                 { "synproxy",           SYNPROXY},
5458                 { "table",              TABLE},
5459                 { "tag",                TAG},
5460                 { "tagged",             TAGGED},
5461                 { "target",             TARGET},
5462                 { "tbrsize",            TBRSIZE},
5463                 { "timeout",            TIMEOUT},
5464                 { "to",                 TO},
5465                 { "tos",                TOS},
5466                 { "ttl",                TTL},
5467                 { "upperlimit",         UPPERLIMIT},
5468                 { "urpf-failed",        URPFFAILED},
5469                 { "user",               USER},
5470         };
5471         const struct keywords   *p;
5472
5473         p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
5474             sizeof(keywords[0]), kw_cmp);
5475
5476         if (p) {
5477                 if (debug > 1)
5478                         fprintf(stderr, "%s: %d\n", s, p->k_val);
5479                 return (p->k_val);
5480         } else {
5481                 if (debug > 1)
5482                         fprintf(stderr, "string: %s\n", s);
5483                 return (STRING);
5484         }
5485 }
5486
5487 #define MAXPUSHBACK     128
5488
5489 char    *parsebuf;
5490 int      parseindex;
5491 char     pushback_buffer[MAXPUSHBACK];
5492 int      pushback_index = 0;
5493
5494 int
5495 lgetc(int quotec)
5496 {
5497         int             c, next;
5498
5499         if (parsebuf) {
5500                 /* Read character from the parsebuffer instead of input. */
5501                 if (parseindex >= 0) {
5502                         c = parsebuf[parseindex++];
5503                         if (c != '\0')
5504                                 return (c);
5505                         parsebuf = NULL;
5506                 } else
5507                         parseindex++;
5508         }
5509
5510         if (pushback_index)
5511                 return (pushback_buffer[--pushback_index]);
5512
5513         if (quotec) {
5514                 if ((c = getc(file->stream)) == EOF) {
5515                         yyerror("reached end of file while parsing quoted string");
5516                         if (popfile() == EOF)
5517                                 return (EOF);
5518                         return (quotec);
5519                 }
5520                 return (c);
5521         }
5522
5523         while ((c = getc(file->stream)) == '\\') {
5524                 next = getc(file->stream);
5525                 if (next != '\n') {
5526                         c = next;
5527                         break;
5528                 }
5529                 yylval.lineno = file->lineno;
5530                 file->lineno++;
5531         }
5532
5533         while (c == EOF) {
5534                 if (popfile() == EOF)
5535                         return (EOF);
5536                 c = getc(file->stream);
5537         }
5538         return (c);
5539 }
5540
5541 int
5542 lungetc(int c)
5543 {
5544         if (c == EOF)
5545                 return (EOF);
5546         if (parsebuf) {
5547                 parseindex--;
5548                 if (parseindex >= 0)
5549                         return (c);
5550         }
5551         if (pushback_index < MAXPUSHBACK-1)
5552                 return (pushback_buffer[pushback_index++] = c);
5553         else
5554                 return (EOF);
5555 }
5556
5557 int
5558 findeol(void)
5559 {
5560         int     c;
5561
5562         parsebuf = NULL;
5563
5564         /* skip to either EOF or the first real EOL */
5565         while (1) {
5566                 if (pushback_index)
5567                         c = pushback_buffer[--pushback_index];
5568                 else
5569                         c = lgetc(0);
5570                 if (c == '\n') {
5571                         file->lineno++;
5572                         break;
5573                 }
5574                 if (c == EOF)
5575                         break;
5576         }
5577         return (ERROR);
5578 }
5579
5580 int
5581 yylex(void)
5582 {
5583         char     buf[8096];
5584         char    *p, *val;
5585         int      quotec, next, c;
5586         int      token;
5587
5588 top:
5589         p = buf;
5590         while ((c = lgetc(0)) == ' ' || c == '\t')
5591                 ; /* nothing */
5592
5593         yylval.lineno = file->lineno;
5594         if (c == '#')
5595                 while ((c = lgetc(0)) != '\n' && c != EOF)
5596                         ; /* nothing */
5597         if (c == '$' && parsebuf == NULL) {
5598                 while (1) {
5599                         if ((c = lgetc(0)) == EOF)
5600                                 return (0);
5601
5602                         if (p + 1 >= buf + sizeof(buf) - 1) {
5603                                 yyerror("string too long");
5604                                 return (findeol());
5605                         }
5606                         if (isalnum(c) || c == '_') {
5607                                 *p++ = (char)c;
5608                                 continue;
5609                         }
5610                         *p = '\0';
5611                         lungetc(c);
5612                         break;
5613                 }
5614                 val = symget(buf);
5615                 if (val == NULL) {
5616                         yyerror("macro '%s' not defined", buf);
5617                         return (findeol());
5618                 }
5619                 parsebuf = val;
5620                 parseindex = 0;
5621                 goto top;
5622         }
5623
5624         switch (c) {
5625         case '\'':
5626         case '"':
5627                 quotec = c;
5628                 while (1) {
5629                         if ((c = lgetc(quotec)) == EOF)
5630                                 return (0);
5631                         if (c == '\n') {
5632                                 file->lineno++;
5633                                 continue;
5634                         } else if (c == '\\') {
5635                                 if ((next = lgetc(quotec)) == EOF)
5636                                         return (0);
5637                                 if (next == quotec || c == ' ' || c == '\t')
5638                                         c = next;
5639                                 else if (next == '\n')
5640                                         continue;
5641                                 else
5642                                         lungetc(next);
5643                         } else if (c == quotec) {
5644                                 *p = '\0';
5645                                 break;
5646                         }
5647                         if (p + 1 >= buf + sizeof(buf) - 1) {
5648                                 yyerror("string too long");
5649                                 return (findeol());
5650                         }
5651                         *p++ = (char)c;
5652                 }
5653                 yylval.v.string = strdup(buf);
5654                 if (yylval.v.string == NULL)
5655                         err(1, "yylex: strdup");
5656                 return (STRING);
5657         case '<':
5658                 next = lgetc(0);
5659                 if (next == '>') {
5660                         yylval.v.i = PF_OP_XRG;
5661                         return (PORTBINARY);
5662                 }
5663                 lungetc(next);
5664                 break;
5665         case '>':
5666                 next = lgetc(0);
5667                 if (next == '<') {
5668                         yylval.v.i = PF_OP_IRG;
5669                         return (PORTBINARY);
5670                 }
5671                 lungetc(next);
5672                 break;
5673         case '-':
5674                 next = lgetc(0);
5675                 if (next == '>')
5676                         return (ARROW);
5677                 lungetc(next);
5678                 break;
5679         }
5680
5681 #define allowed_to_end_number(x) \
5682         (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')
5683
5684         if (c == '-' || isdigit(c)) {
5685                 do {
5686                         *p++ = c;
5687                         if ((unsigned)(p-buf) >= sizeof(buf)) {
5688                                 yyerror("string too long");
5689                                 return (findeol());
5690                         }
5691                 } while ((c = lgetc(0)) != EOF && isdigit(c));
5692                 lungetc(c);
5693                 if (p == buf + 1 && buf[0] == '-')
5694                         goto nodigits;
5695                 if (c == EOF || allowed_to_end_number(c)) {
5696                         const char *errstr = NULL;
5697
5698                         *p = '\0';
5699                         yylval.v.number = strtonum(buf, LLONG_MIN,
5700                             LLONG_MAX, &errstr);
5701                         if (errstr) {
5702                                 yyerror("\"%s\" invalid number: %s",
5703                                     buf, errstr);
5704                                 return (findeol());
5705                         }
5706                         return (NUMBER);
5707                 } else {
5708 nodigits:
5709                         while (p > buf + 1)
5710                                 lungetc(*--p);
5711                         c = *--p;
5712                         if (c == '-')
5713                                 return (c);
5714                 }
5715         }
5716
5717 #define allowed_in_string(x) \
5718         (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
5719         x != '{' && x != '}' && x != '<' && x != '>' && \
5720         x != '!' && x != '=' && x != '/' && x != '#' && \
5721         x != ','))
5722
5723         if (isalnum(c) || c == ':' || c == '_') {
5724                 do {
5725                         *p++ = c;
5726                         if ((unsigned)(p-buf) >= sizeof(buf)) {
5727                                 yyerror("string too long");
5728                                 return (findeol());
5729                         }
5730                 } while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
5731                 lungetc(c);
5732                 *p = '\0';
5733                 if ((token = lookup(buf)) == STRING)
5734                         if ((yylval.v.string = strdup(buf)) == NULL)
5735                                 err(1, "yylex: strdup");
5736                 return (token);
5737         }
5738         if (c == '\n') {
5739                 yylval.lineno = file->lineno;
5740                 file->lineno++;
5741         }
5742         if (c == EOF)
5743                 return (0);
5744         return (c);
5745 }
5746
5747 int
5748 check_file_secrecy(int fd, const char *fname)
5749 {
5750         struct stat     st;
5751
5752         if (fstat(fd, &st)) {
5753                 warn("cannot stat %s", fname);
5754                 return (-1);
5755         }
5756         if (st.st_uid != 0 && st.st_uid != getuid()) {
5757                 warnx("%s: owner not root or current user", fname);
5758                 return (-1);
5759         }
5760         if (st.st_mode & (S_IRWXG | S_IRWXO)) {
5761                 warnx("%s: group/world readable/writeable", fname);
5762                 return (-1);
5763         }
5764         return (0);
5765 }
5766
5767 struct file *
5768 pushfile(const char *name, int secret)
5769 {
5770         struct file     *nfile;
5771
5772         if ((nfile = calloc(1, sizeof(struct file))) == NULL ||
5773             (nfile->name = strdup(name)) == NULL) {
5774                 warn("malloc");
5775                 return (NULL);
5776         }
5777         if (TAILQ_FIRST(&files) == NULL && strcmp(nfile->name, "-") == 0) {
5778                 nfile->stream = stdin;
5779                 free(nfile->name);
5780                 if ((nfile->name = strdup("stdin")) == NULL) {
5781                         warn("strdup");
5782                         free(nfile);
5783                         return (NULL);
5784                 }
5785         } else if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
5786                 warn("%s", nfile->name);
5787                 free(nfile->name);
5788                 free(nfile);
5789                 return (NULL);
5790         } else if (secret &&
5791             check_file_secrecy(fileno(nfile->stream), nfile->name)) {
5792                 fclose(nfile->stream);
5793                 free(nfile->name);
5794                 free(nfile);
5795                 return (NULL);
5796         }
5797         nfile->lineno = 1;
5798         TAILQ_INSERT_TAIL(&files, nfile, entry);
5799         return (nfile);
5800 }
5801
5802 int
5803 popfile(void)
5804 {
5805         struct file     *prev;
5806
5807         if ((prev = TAILQ_PREV(file, files, entry)) != NULL) {
5808                 prev->errors += file->errors;
5809                 TAILQ_REMOVE(&files, file, entry);
5810                 fclose(file->stream);
5811                 free(file->name);
5812                 free(file);
5813                 file = prev;
5814                 return (0);
5815         }
5816         return (EOF);
5817 }
5818
5819 int
5820 parse_config(char *filename, struct pfctl *xpf)
5821 {
5822         int              errors = 0;
5823         struct sym      *sym;
5824
5825         pf = xpf;
5826         errors = 0;
5827         rulestate = PFCTL_STATE_NONE;
5828         returnicmpdefault = (ICMP_UNREACH << 8) | ICMP_UNREACH_PORT;
5829         returnicmp6default =
5830             (ICMP6_DST_UNREACH << 8) | ICMP6_DST_UNREACH_NOPORT;
5831         blockpolicy = PFRULE_DROP;
5832         require_order = 1;
5833
5834         if ((file = pushfile(filename, 0)) == NULL) {
5835                 warn("cannot open the main config file!");
5836                 return (-1);
5837         }
5838
5839         yyparse();
5840         errors = file->errors;
5841         popfile();
5842
5843         /* Free macros and check which have not been used. */
5844         while ((sym = TAILQ_FIRST(&symhead))) {
5845                 if ((pf->opts & PF_OPT_VERBOSE2) && !sym->used)
5846                         fprintf(stderr, "warning: macro '%s' not "
5847                             "used\n", sym->nam);
5848                 free(sym->nam);
5849                 free(sym->val);
5850                 TAILQ_REMOVE(&symhead, sym, entry);
5851                 free(sym);
5852         }
5853
5854         return (errors ? -1 : 0);
5855 }
5856
5857 int
5858 symset(const char *nam, const char *val, int persist)
5859 {
5860         struct sym      *sym;
5861
5862         for (sym = TAILQ_FIRST(&symhead); sym && strcmp(nam, sym->nam);
5863             sym = TAILQ_NEXT(sym, entry))
5864                 ;       /* nothing */
5865
5866         if (sym != NULL) {
5867                 if (sym->persist == 1)
5868                         return (0);
5869                 else {
5870                         free(sym->nam);
5871                         free(sym->val);
5872                         TAILQ_REMOVE(&symhead, sym, entry);
5873                         free(sym);
5874                 }
5875         }
5876         if ((sym = calloc(1, sizeof(*sym))) == NULL)
5877                 return (-1);
5878
5879         sym->nam = strdup(nam);
5880         if (sym->nam == NULL) {
5881                 free(sym);
5882                 return (-1);
5883         }
5884         sym->val = strdup(val);
5885         if (sym->val == NULL) {
5886                 free(sym->nam);
5887                 free(sym);
5888                 return (-1);
5889         }
5890         sym->used = 0;
5891         sym->persist = persist;
5892         TAILQ_INSERT_TAIL(&symhead, sym, entry);
5893         return (0);
5894 }
5895
5896 int
5897 pfctl_cmdline_symset(char *s)
5898 {
5899         char    *sym, *val;
5900         int      ret;
5901
5902         if ((val = strrchr(s, '=')) == NULL)
5903                 return (-1);
5904
5905         if ((sym = malloc(strlen(s) - strlen(val) + 1)) == NULL)
5906                 err(1, "pfctl_cmdline_symset: malloc");
5907
5908         strlcpy(sym, s, strlen(s) - strlen(val) + 1);
5909
5910         ret = symset(sym, val + 1, 1);
5911         free(sym);
5912
5913         return (ret);
5914 }
5915
5916 char *
5917 symget(const char *nam)
5918 {
5919         struct sym      *sym;
5920
5921         TAILQ_FOREACH(sym, &symhead, entry)
5922                 if (strcmp(nam, sym->nam) == 0) {
5923                         sym->used = 1;
5924                         return (sym->val);
5925                 }
5926         return (NULL);
5927 }
5928
5929 void
5930 mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst)
5931 {
5932         int i;
5933         struct pf_rule *r;
5934
5935         for (i = 0; i < PF_RULESET_MAX; ++i) {
5936                 while ((r = TAILQ_FIRST(src->rules[i].active.ptr))
5937                     != NULL) {
5938                         TAILQ_REMOVE(src->rules[i].active.ptr, r, entries);
5939                         TAILQ_INSERT_TAIL(dst->rules[i].active.ptr, r, entries);
5940                         dst->anchor->match++;
5941                 }
5942                 src->anchor->match = 0;
5943                 while ((r = TAILQ_FIRST(src->rules[i].inactive.ptr))
5944                     != NULL) {
5945                         TAILQ_REMOVE(src->rules[i].inactive.ptr, r, entries);
5946                         TAILQ_INSERT_TAIL(dst->rules[i].inactive.ptr,
5947                                 r, entries);
5948                 }
5949         }
5950 }
5951
5952 void
5953 decide_address_family(struct node_host *n, sa_family_t *af)
5954 {
5955         if (*af != 0 || n == NULL)
5956                 return;
5957         *af = n->af;
5958         while ((n = n->next) != NULL) {
5959                 if (n->af != *af) {
5960                         *af = 0;
5961                         return;
5962                 }
5963         }
5964 }
5965
5966 void
5967 remove_invalid_hosts(struct node_host **nh, sa_family_t *af)
5968 {
5969         struct node_host        *n = *nh, *prev = NULL;
5970
5971         while (n != NULL) {
5972                 if (*af && n->af && n->af != *af) {
5973                         /* unlink and free n */
5974                         struct node_host *next = n->next;
5975
5976                         /* adjust tail pointer */
5977                         if (n == (*nh)->tail)
5978                                 (*nh)->tail = prev;
5979                         /* adjust previous node's next pointer */
5980                         if (prev == NULL)
5981                                 *nh = next;
5982                         else
5983                                 prev->next = next;
5984                         /* free node */
5985                         if (n->ifname != NULL)
5986                                 free(n->ifname);
5987                         free(n);
5988                         n = next;
5989                 } else {
5990                         if (n->af && !*af)
5991                                 *af = n->af;
5992                         prev = n;
5993                         n = n->next;
5994                 }
5995         }
5996 }
5997
5998 int
5999 invalid_redirect(struct node_host *nh, sa_family_t af)
6000 {
6001         if (!af) {
6002                 struct node_host *n;
6003
6004                 /* tables and dyniftl are ok without an address family */
6005                 for (n = nh; n != NULL; n = n->next) {
6006                         if (n->addr.type != PF_ADDR_TABLE &&
6007                             n->addr.type != PF_ADDR_DYNIFTL) {
6008                                 yyerror("address family not given and "
6009                                     "translation address expands to multiple "
6010                                     "address families");
6011                                 return (1);
6012                         }
6013                 }
6014         }
6015         if (nh == NULL) {
6016                 yyerror("no translation address with matching address family "
6017                     "found.");
6018                 return (1);
6019         }
6020         return (0);
6021 }
6022
6023 int
6024 atoul(char *s, u_long *ulvalp)
6025 {
6026         u_long   ulval;
6027         char    *ep;
6028
6029         errno = 0;
6030         ulval = strtoul(s, &ep, 0);
6031         if (s[0] == '\0' || *ep != '\0')
6032                 return (-1);
6033         if (errno == ERANGE && ulval == ULONG_MAX)
6034                 return (-1);
6035         *ulvalp = ulval;
6036         return (0);
6037 }
6038
6039 int
6040 getservice(char *n)
6041 {
6042         struct servent  *s;
6043         u_long           ulval;
6044
6045         if (atoul(n, &ulval) == 0) {
6046                 if (ulval > 65535) {
6047                         yyerror("illegal port value %lu", ulval);
6048                         return (-1);
6049                 }
6050                 return (htons(ulval));
6051         } else {
6052                 s = getservbyname(n, "tcp");
6053                 if (s == NULL)
6054                         s = getservbyname(n, "udp");
6055                 if (s == NULL) {
6056                         yyerror("unknown port %s", n);
6057                         return (-1);
6058                 }
6059                 return (s->s_port);
6060         }
6061 }
6062
6063 int
6064 rule_label(struct pf_rule *r, char *s)
6065 {
6066         if (s) {
6067                 if (strlcpy(r->label, s, sizeof(r->label)) >=
6068                     sizeof(r->label)) {
6069                         yyerror("rule label too long (max %d chars)",
6070                             sizeof(r->label)-1);
6071                         return (-1);
6072                 }
6073         }
6074         return (0);
6075 }
6076
6077 u_int16_t
6078 parseicmpspec(char *w, sa_family_t af)
6079 {
6080         const struct icmpcodeent        *p;
6081         u_long                           ulval;
6082         u_int8_t                         icmptype;
6083
6084         if (af == AF_INET)
6085                 icmptype = returnicmpdefault >> 8;
6086         else
6087                 icmptype = returnicmp6default >> 8;
6088
6089         if (atoul(w, &ulval) == -1) {
6090                 if ((p = geticmpcodebyname(icmptype, w, af)) == NULL) {
6091                         yyerror("unknown icmp code %s", w);
6092                         return (0);
6093                 }
6094                 ulval = p->code;
6095         }
6096         if (ulval > 255) {
6097                 yyerror("invalid icmp code %lu", ulval);
6098                 return (0);
6099         }
6100         return (icmptype << 8 | ulval);
6101 }
6102
6103 int
6104 parseport(char *port, struct range *r, int extensions)
6105 {
6106         char    *p = strchr(port, ':');
6107
6108         if (p == NULL) {
6109                 if ((r->a = getservice(port)) == -1)
6110                         return (-1);
6111                 r->b = 0;
6112                 r->t = PF_OP_NONE;
6113                 return (0);
6114         }
6115         if ((extensions & PPORT_STAR) && !strcmp(p+1, "*")) {
6116                 *p = 0;
6117                 if ((r->a = getservice(port)) == -1)
6118                         return (-1);
6119                 r->b = 0;
6120                 r->t = PF_OP_IRG;
6121                 return (0);
6122         }
6123         if ((extensions & PPORT_RANGE)) {
6124                 *p++ = 0;
6125                 if ((r->a = getservice(port)) == -1 ||
6126                     (r->b = getservice(p)) == -1)
6127                         return (-1);
6128                 if (r->a == r->b) {
6129                         r->b = 0;
6130                         r->t = PF_OP_NONE;
6131                 } else
6132                         r->t = PF_OP_RRG;
6133                 return (0);
6134         }
6135         return (-1);
6136 }
6137
6138 int
6139 pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans)
6140 {
6141         struct loadanchors      *la;
6142
6143         TAILQ_FOREACH(la, &loadanchorshead, entries) {
6144                 if (pf->opts & PF_OPT_VERBOSE)
6145                         fprintf(stderr, "\nLoading anchor %s from %s\n",
6146                             la->anchorname, la->filename);
6147                 if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize,
6148                     la->anchorname, trans) == -1)
6149                         return (-1);
6150         }
6151
6152         return (0);
6153 }
6154
6155 int
6156 rt_tableid_max(void)
6157 {
6158 #ifdef __FreeBSD__
6159         int fibs;
6160         size_t l = sizeof(fibs);
6161
6162         if (sysctlbyname("net.fibs", &fibs, &l, NULL, 0) == -1)
6163                 fibs = 16;      /* XXX RT_MAXFIBS, at least limit it some. */
6164         /*
6165          * As the OpenBSD code only compares > and not >= we need to adjust
6166          * here given we only accept values of 0..n and want to avoid #ifdefs
6167          * in the grammer.
6168          */
6169         return (fibs - 1);
6170 #else
6171         return (RT_TABLEID_MAX);
6172 #endif
6173 }