NetBSD-5.0.2/dist/ipf/tools/ipf_y.y
/* $NetBSD: ipf_y.y,v 1.22 2008/05/20 07:08:07 darrenr Exp $ */
/*
* Copyright (C) 2001-2006 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*/
%{
#include "ipf.h"
#include <sys/ioctl.h>
#include <syslog.h>
#ifdef IPFILTER_BPF
# include "pcap-bpf.h"
# define _NET_BPF_H_
# include <pcap.h>
#endif
#include "netinet/ip_pool.h"
#include "netinet/ip_htable.h"
#include "netinet/ipl.h"
#include "ipf_l.h"
#define YYDEBUG 1
#define DOALL(x) for (fr = frc; fr != NULL; fr = fr->fr_next) { x }
#define DOREM(x) for (; fr != NULL; fr = fr->fr_next) { x }
extern void yyerror __P((char *));
extern int yyparse __P((void));
extern int yylex __P((void));
extern int yydebug;
extern FILE *yyin;
extern int yylineNum;
static void newrule __P((void));
static void setipftype __P((void));
static u_32_t lookuphost __P((char *));
static void dobpf __P((int, char *));
static void resetaddr __P((void));
static struct alist_s *newalist __P((struct alist_s *));
static u_int makehash __P((struct alist_s *));
static int makepool __P((struct alist_s *));
static frentry_t *addrule __P((void));
static void setsyslog __P((void));
static void unsetsyslog __P((void));
static void fillgroup __P((frentry_t *));
frentry_t *fr = NULL, *frc = NULL, *frtop = NULL, *frold = NULL;
static int ifpflag = 0;
static int nowith = 0;
static int dynamic = -1;
static int pooled = 0;
static int hashed = 0;
static int nrules = 0;
static int newlist = 0;
static int added = 0;
static int ipffd = -1;
static int *yycont = 0;
static ioctlfunc_t ipfioctl[IPL_LOGSIZE];
static addfunc_t ipfaddfunc = NULL;
static struct wordtab ipfwords[95];
static struct wordtab addrwords[4];
static struct wordtab maskwords[5];
static struct wordtab icmpcodewords[17];
static struct wordtab icmptypewords[16];
static struct wordtab ipv4optwords[25];
static struct wordtab ipv4secwords[9];
static struct wordtab ipv6optwords[9];
static struct wordtab logwords[33];
%}
%union {
char *str;
u_32_t num;
struct in_addr ipa;
frentry_t fr;
frtuc_t *frt;
struct alist_s *alist;
u_short port;
struct {
u_short p1;
u_short p2;
int pc;
} pc;
struct {
union i6addr a;
union i6addr m;
} ipp;
union i6addr ip6;
struct {
char *if1;
char *if2;
} ifs;
};
%type <port> portnum
%type <num> facility priority icmpcode seclevel secname icmptype
%type <num> opt compare range opttype flagset optlist ipv6hdrlist ipv6hdr
%type <num> portc porteq
%type <ipa> hostname ipv4 ipv4mask ipv4_16 ipv4_24
%type <ip6> ipv6mask
%type <ipp> addr ipaddr
%type <str> servicename name interfacename
%type <pc> portrange portcomp
%type <alist> addrlist poollist
%type <ifs> onname
%token <num> YY_NUMBER YY_HEX
%token <str> YY_STR
%token YY_COMMENT
%token YY_CMP_EQ YY_CMP_NE YY_CMP_LE YY_CMP_GE YY_CMP_LT YY_CMP_GT
%token YY_RANGE_OUT YY_RANGE_IN
%token <ip6> YY_IPV6
%token IPFY_PASS IPFY_BLOCK IPFY_COUNT IPFY_CALL IPFY_NOMATCH
%token IPFY_RETICMP IPFY_RETRST IPFY_RETICMPASDST
%token IPFY_IN IPFY_OUT
%token IPFY_QUICK IPFY_ON IPFY_OUTVIA IPFY_INVIA
%token IPFY_DUPTO IPFY_TO IPFY_FROUTE IPFY_REPLY_TO IPFY_ROUTETO
%token IPFY_TOS IPFY_TTL IPFY_PROTO
%token IPFY_HEAD IPFY_GROUP
%token IPFY_AUTH IPFY_PREAUTH
%token IPFY_LOG IPFY_BODY IPFY_FIRST IPFY_LEVEL IPFY_ORBLOCK
%token IPFY_LOGTAG IPFY_MATCHTAG IPFY_SETTAG IPFY_SKIP
%token IPFY_FROM IPFY_ALL IPFY_ANY IPFY_BPFV4 IPFY_BPFV6 IPFY_POOL IPFY_HASH
%token IPFY_PPS
%token IPFY_ESP IPFY_AH
%token IPFY_WITH IPFY_AND IPFY_NOT IPFY_NO IPFY_OPT
%token IPFY_TCPUDP IPFY_TCP IPFY_UDP
%token IPFY_FLAGS IPFY_MULTICAST
%token IPFY_MASK IPFY_BROADCAST IPFY_NETWORK IPFY_NETMASKED IPFY_PEER
%token IPFY_PORT
%token IPFY_NOW
%token IPFY_ICMP IPFY_ICMPTYPE IPFY_ICMPCODE
%token IPFY_IPOPTS IPFY_SHORT IPFY_NAT IPFY_BADSRC IPFY_LOWTTL IPFY_FRAG
%token IPFY_MBCAST IPFY_BAD IPFY_BADNAT IPFY_OOW IPFY_NEWISN IPFY_NOICMPERR
%token IPFY_KEEP IPFY_STATE IPFY_FRAGS IPFY_LIMIT IPFY_STRICT IPFY_AGE
%token IPFY_SYNC IPFY_FRAGBODY
%token IPFY_IPOPT_NOP IPFY_IPOPT_RR IPFY_IPOPT_ZSU IPFY_IPOPT_MTUP
%token IPFY_IPOPT_MTUR IPFY_IPOPT_ENCODE IPFY_IPOPT_TS IPFY_IPOPT_TR
%token IPFY_IPOPT_SEC IPFY_IPOPT_LSRR IPFY_IPOPT_ESEC IPFY_IPOPT_CIPSO
%token IPFY_IPOPT_SATID IPFY_IPOPT_SSRR IPFY_IPOPT_ADDEXT IPFY_IPOPT_VISA
%token IPFY_IPOPT_IMITD IPFY_IPOPT_EIP IPFY_IPOPT_FINN IPFY_IPOPT_DPS
%token IPFY_IPOPT_SDB IPFY_IPOPT_NSAPA IPFY_IPOPT_RTRALRT IPFY_IPOPT_UMP
%token IPFY_SECCLASS IPFY_SEC_UNC IPFY_SEC_CONF IPFY_SEC_RSV1 IPFY_SEC_RSV2
%token IPFY_SEC_RSV4 IPFY_SEC_SEC IPFY_SEC_TS IPFY_SEC_RSV3
%token IPF6_V6HDRS IPFY_IPV6OPT IPFY_IPV6OPT_DSTOPTS IPFY_IPV6OPT_HOPOPTS
%token IPFY_IPV6OPT_IPV6 IPFY_IPV6OPT_NONE IPFY_IPV6OPT_ROUTING
%token IPFY_IPV6OPT_MOBILITY IPFY_IPV6OPT_ESP IPFY_IPV6OPT_FRAG
%token IPFY_ICMPT_UNR IPFY_ICMPT_ECHO IPFY_ICMPT_ECHOR IPFY_ICMPT_SQUENCH
%token IPFY_ICMPT_REDIR IPFY_ICMPT_TIMEX IPFY_ICMPT_PARAMP IPFY_ICMPT_TIMEST
%token IPFY_ICMPT_TIMESTREP IPFY_ICMPT_INFOREQ IPFY_ICMPT_INFOREP
%token IPFY_ICMPT_MASKREQ IPFY_ICMPT_MASKREP IPFY_ICMPT_ROUTERAD
%token IPFY_ICMPT_ROUTERSOL
%token IPFY_ICMPC_NETUNR IPFY_ICMPC_HSTUNR IPFY_ICMPC_PROUNR IPFY_ICMPC_PORUNR
%token IPFY_ICMPC_NEEDF IPFY_ICMPC_SRCFAIL IPFY_ICMPC_NETUNK IPFY_ICMPC_HSTUNK
%token IPFY_ICMPC_ISOLATE IPFY_ICMPC_NETPRO IPFY_ICMPC_HSTPRO
%token IPFY_ICMPC_NETTOS IPFY_ICMPC_HSTTOS IPFY_ICMPC_FLTPRO IPFY_ICMPC_HSTPRE
%token IPFY_ICMPC_CUTPRE
%token IPFY_FAC_KERN IPFY_FAC_USER IPFY_FAC_MAIL IPFY_FAC_DAEMON IPFY_FAC_AUTH
%token IPFY_FAC_SYSLOG IPFY_FAC_LPR IPFY_FAC_NEWS IPFY_FAC_UUCP IPFY_FAC_CRON
%token IPFY_FAC_LOCAL0 IPFY_FAC_LOCAL1 IPFY_FAC_LOCAL2 IPFY_FAC_LOCAL3
%token IPFY_FAC_LOCAL4 IPFY_FAC_LOCAL5 IPFY_FAC_LOCAL6 IPFY_FAC_LOCAL7
%token IPFY_FAC_SECURITY IPFY_FAC_FTP IPFY_FAC_AUTHPRIV IPFY_FAC_AUDIT
%token IPFY_FAC_LFMT IPFY_FAC_CONSOLE
%token IPFY_PRI_EMERG IPFY_PRI_ALERT IPFY_PRI_CRIT IPFY_PRI_ERR IPFY_PRI_WARN
%token IPFY_PRI_NOTICE IPFY_PRI_INFO IPFY_PRI_DEBUG
%%
file: line
| assign
| file line
| file assign
;
line: rule { while ((fr = frtop) != NULL) {
frtop = fr->fr_next;
fr->fr_next = NULL;
(*ipfaddfunc)(ipffd, ipfioctl[IPL_LOGIPF], fr);
fr->fr_next = frold;
frold = fr;
}
resetlexer();
}
| YY_COMMENT
;
xx: { newrule(); }
;
assign: YY_STR assigning YY_STR ';' { set_variable($1, $3);
resetlexer();
free($1);
free($3);
yyvarnext = 0;
}
;
assigning:
'=' { yyvarnext = 1; }
;
rule: inrule eol
| outrule eol
;
eol: | ';'
;
inrule:
rulehead markin inopts rulemain ruletail intag ruletail2
;
outrule:
rulehead markout outopts rulemain ruletail outtag ruletail2
;
rulehead:
xx collection action
| xx insert collection action
;
markin: IPFY_IN { fr->fr_flags |= FR_INQUE; }
;
markout:
IPFY_OUT { fr->fr_flags |= FR_OUTQUE; }
;
rulemain:
ipfrule
| bpfrule
;
ipfrule:
tos ttl proto ip
;
bpfrule:
IPFY_BPFV4 '{' YY_STR '}' { dobpf(4, $3); free($3); }
| IPFY_BPFV6 '{' YY_STR '}' { dobpf(6, $3); free($3); }
;
ruletail:
with keep head group
;
ruletail2:
pps age new
;
intag: settagin matchtagin
;
outtag: settagout matchtagout
;
insert:
'@' YY_NUMBER { fr->fr_hits = (U_QUAD_T)$2 + 1; }
;
collection:
| YY_NUMBER { fr->fr_collect = $1; }
;
action: block
| IPFY_PASS { fr->fr_flags |= FR_PASS; }
| IPFY_NOMATCH { fr->fr_flags |= FR_NOMATCH; }
| log
| IPFY_COUNT { fr->fr_flags |= FR_ACCOUNT; }
| auth
| IPFY_SKIP YY_NUMBER { fr->fr_flags |= FR_SKIP;
fr->fr_arg = $2; }
| IPFY_CALL func
| IPFY_CALL IPFY_NOW func { fr->fr_flags |= FR_CALLNOW; }
;
block: blocked
| blocked blockreturn
;
blocked:
IPFY_BLOCK { fr->fr_flags = FR_BLOCK; }
;
blockreturn:
IPFY_RETICMP { fr->fr_flags |= FR_RETICMP; }
| IPFY_RETICMP returncode { fr->fr_flags |= FR_RETICMP; }
| IPFY_RETICMPASDST { fr->fr_flags |= FR_FAKEICMP; }
| IPFY_RETICMPASDST returncode { fr->fr_flags |= FR_FAKEICMP; }
| IPFY_RETRST { fr->fr_flags |= FR_RETRST; }
;
log: IPFY_LOG { fr->fr_flags |= FR_LOG; }
| IPFY_LOG logoptions { fr->fr_flags |= FR_LOG; }
;
auth: IPFY_AUTH { fr->fr_flags |= FR_AUTH; }
| IPFY_AUTH blockreturn { fr->fr_flags |= FR_AUTH;}
| IPFY_PREAUTH { fr->fr_flags |= FR_PREAUTH; }
;
func: YY_STR '/' YY_NUMBER { fr->fr_func = nametokva($1,
ipfioctl[IPL_LOGIPF]);
fr->fr_arg = $3;
free($1); }
;
inopts:
| inopts inopt
;
inopt:
logopt
| quick
| on
| dup
| froute
| proute
| replyto
;
outopts:
| outopts outopt
;
outopt:
logopt
| quick
| on
| dup
| proute
| replyto
;
tos: | settos YY_NUMBER { DOALL(fr->fr_tos = $2; fr->fr_mtos = 0xff;) }
| settos YY_HEX { DOALL(fr->fr_tos = $2; fr->fr_mtos = 0xff;) }
| settos lstart toslist lend
;
settos: IPFY_TOS { setipftype(); }
;
toslist:
YY_NUMBER { DOALL(fr->fr_tos = $1; fr->fr_mtos = 0xff;) }
| YY_HEX { DOREM(fr->fr_tos = $1; fr->fr_mtos = 0xff;) }
| toslist lmore YY_NUMBER
{ DOREM(fr->fr_tos = $3; fr->fr_mtos = 0xff;) }
| toslist lmore YY_HEX
{ DOREM(fr->fr_tos = $3; fr->fr_mtos = 0xff;) }
;
ttl: | setttl YY_NUMBER
{ DOALL(fr->fr_ttl = $2; fr->fr_mttl = 0xff;) }
| setttl lstart ttllist lend
;
lstart: '(' { newlist = 1; fr = frc; added = 0; }
;
lend: ')' { nrules += added; }
;
lmore: lanother { if (newlist == 1) {
newlist = 0;
}
fr = addrule();
if (yycont != NULL)
*yycont = 1;
}
;
lanother:
| ','
;
setttl: IPFY_TTL { setipftype(); }
;
ttllist:
YY_NUMBER { DOREM(fr->fr_ttl = $1; fr->fr_mttl = 0xff;) }
| ttllist lmore YY_NUMBER
{ DOREM(fr->fr_ttl = $3; fr->fr_mttl = 0xff;) }
;
proto: | protox protocol { yyresetdict(); }
;
protox: IPFY_PROTO { setipftype();
fr = frc;
yysetdict(NULL); }
;
ip: srcdst flags icmp
;
group: | IPFY_GROUP YY_STR { DOALL(strncpy(fr->fr_group, $2, \
FR_GROUPLEN); \
fillgroup(fr););
free($2); }
| IPFY_GROUP YY_NUMBER { DOALL(sprintf(fr->fr_group, "%d", \
$2); \
fillgroup(fr);) }
;
head: | IPFY_HEAD YY_STR { DOALL(strncpy(fr->fr_grhead, $2, \
FR_GROUPLEN););
free($2); }
| IPFY_HEAD YY_NUMBER { DOALL(sprintf(fr->fr_grhead, "%d", \
$2);) }
;
settagin:
| IPFY_SETTAG '(' taginlist ')'
;
taginlist:
taginspec
| taginlist ',' taginspec
;
taginspec:
logtag
;
nattag: IPFY_NAT '=' YY_STR { DOALL(strncpy(fr->fr_nattag.ipt_tag,\
$3, IPFTAG_LEN););
free($3); }
| IPFY_NAT '=' YY_NUMBER { DOALL(sprintf(fr->fr_nattag.ipt_tag,\
"%d", $3 & 0xffffffff);) }
;
logtag: IPFY_LOG '=' YY_NUMBER { DOALL(fr->fr_logtag = $3;) }
;
settagout:
| IPFY_SETTAG '(' tagoutlist ')'
;
tagoutlist:
tagoutspec
| tagoutlist ',' tagoutspec
;
tagoutspec:
logtag
| nattag
;
matchtagin:
| IPFY_MATCHTAG '(' tagoutlist ')'
;
matchtagout:
| IPFY_MATCHTAG '(' taginlist ')'
;
pps: | IPFY_PPS YY_NUMBER { DOALL(fr->fr_pps = $2;) }
;
new: | savegroup file restoregroup
;
savegroup:
'{'
;
restoregroup:
'}'
;
logopt: log
;
quick:
IPFY_QUICK { fr->fr_flags |= FR_QUICK; }
;
on: IPFY_ON onname
| IPFY_ON lstart onlist lend
| IPFY_ON onname IPFY_INVIA vianame
| IPFY_ON onname IPFY_OUTVIA vianame
;
onlist: onname { DOREM(strncpy(fr->fr_ifnames[0], $1.if1, \
sizeof(fr->fr_ifnames[0])); \
if ($1.if2 != NULL) { \
strncpy(fr->fr_ifnames[1], \
$1.if2, \
sizeof(fr->fr_ifnames[1]));\
} \
) }
| onlist lmore onname { DOREM(strncpy(fr->fr_ifnames[0], $3.if1, \
sizeof(fr->fr_ifnames[0])); \
if ($3.if2 != NULL) { \
strncpy(fr->fr_ifnames[1], \
$3.if2, \
sizeof(fr->fr_ifnames[1]));\
} \
) }
;
onname: interfacename
{ strncpy(fr->fr_ifnames[0], $1, sizeof(fr->fr_ifnames[0]));
$$.if1 = fr->fr_ifnames[0];
$$.if2 = NULL;
free($1);
}
| interfacename ',' interfacename
{ strncpy(fr->fr_ifnames[0], $1, sizeof(fr->fr_ifnames[0]));
$$.if1 = fr->fr_ifnames[0];
free($1);
strncpy(fr->fr_ifnames[1], $3, sizeof(fr->fr_ifnames[1]));
$$.if1 = fr->fr_ifnames[1];
free($3);
}
;
vianame:
name
{ strncpy(fr->fr_ifnames[2], $1, sizeof(fr->fr_ifnames[2]));
free($1);
}
| name ',' name
{ strncpy(fr->fr_ifnames[2], $1, sizeof(fr->fr_ifnames[2]));
free($1);
strncpy(fr->fr_ifnames[3], $3, sizeof(fr->fr_ifnames[3]));
free($3);
}
;
dup: IPFY_DUPTO name
{ strncpy(fr->fr_dif.fd_ifname, $2, sizeof(fr->fr_dif.fd_ifname));
fr->fr_flags |= FR_DUP;
free($2);
}
| IPFY_DUPTO name duptoseparator hostname
{ strncpy(fr->fr_dif.fd_ifname, $2, sizeof(fr->fr_dif.fd_ifname));
fr->fr_flags |= FR_DUP;
fr->fr_dif.fd_ip = $4;
yyexpectaddr = 0;
free($2);
}
| IPFY_DUPTO name duptoseparator YY_IPV6
{ strncpy(fr->fr_dif.fd_ifname, $2, sizeof(fr->fr_dif.fd_ifname));
bcopy(&$4, &fr->fr_dif.fd_ip6, sizeof(fr->fr_dif.fd_ip6));
fr->fr_flags |= FR_DUP;
yyexpectaddr = 0;
free($2);
}
;
duptoseparator:
':' { yyexpectaddr = 1; yycont = &yyexpectaddr; resetaddr(); }
;
froute: IPFY_FROUTE { fr->fr_flags |= FR_FASTROUTE; }
;
proute: routeto name
{ strncpy(fr->fr_tif.fd_ifname, $2, sizeof(fr->fr_tif.fd_ifname));
free($2);
}
| routeto name duptoseparator hostname
{ strncpy(fr->fr_tif.fd_ifname, $2, sizeof(fr->fr_tif.fd_ifname));
fr->fr_tif.fd_ip = $4;
yyexpectaddr = 0;
free($2);
}
| routeto name duptoseparator YY_IPV6
{ strncpy(fr->fr_tif.fd_ifname, $2, sizeof(fr->fr_tif.fd_ifname));
bcopy(&$4, &fr->fr_tif.fd_ip6, sizeof(fr->fr_tif.fd_ip6));
yyexpectaddr = 0;
free($2);
}
;
routeto:
IPFY_TO
| IPFY_ROUTETO
;
replyto:
IPFY_REPLY_TO name
{ strncpy(fr->fr_rif.fd_ifname, $2, sizeof(fr->fr_rif.fd_ifname));
free($2);
}
| IPFY_REPLY_TO name duptoseparator hostname
{ strncpy(fr->fr_rif.fd_ifname, $2, sizeof(fr->fr_rif.fd_ifname));
fr->fr_rif.fd_ip = $4;
free($2);
}
;
logoptions:
logoption
| logoptions logoption
;
logoption:
IPFY_BODY { fr->fr_flags |= FR_LOGBODY; }
| IPFY_FIRST { fr->fr_flags |= FR_LOGFIRST; }
| IPFY_ORBLOCK { fr->fr_flags |= FR_LOGORBLOCK; }
| level loglevel { unsetsyslog(); }
;
returncode:
starticmpcode icmpcode ')' { fr->fr_icode = $2; yyresetdict(); }
;
starticmpcode:
'(' { yysetdict(icmpcodewords); }
;
srcdst: | IPFY_ALL
| fromto
;
protocol:
YY_NUMBER { DOREM(fr->fr_proto = $1; \
fr->fr_mproto = 0xff;) }
| YY_STR { if (!strcmp($1, "tcp-udp")) {
DOREM(fr->fr_flx |= FI_TCPUDP; \
fr->fr_mflx |= FI_TCPUDP;)
} else {
int p = getproto($1);
if (p == -1)
yyerror("protocol unknown");
DOREM(fr->fr_proto = p; \
fr->fr_mproto = 0xff;)
}
free($1);
}
| YY_STR nextstring YY_STR
{ if (!strcmp($1, "tcp") &&
!strcmp($3, "udp")) {
DOREM(fr->fr_flx |= FI_TCPUDP; \
fr->fr_mflx |= FI_TCPUDP;)
} else
YYERROR;
free($1);
free($3);
}
;
nextstring:
'/' { yysetdict(NULL); }
;
fromto: from srcobject to dstobject { yyexpectaddr = 0; yycont = NULL; }
| to dstobject { yyexpectaddr = 0; yycont = NULL; }
| from srcobject { yyexpectaddr = 0; yycont = NULL; }
;
from: IPFY_FROM { setipftype();
if (fr == NULL)
fr = frc;
yyexpectaddr = 1;
if (yydebug)
printf("set yyexpectaddr\n");
yycont = &yyexpectaddr;
yysetdict(addrwords);
resetaddr(); }
;
to: IPFY_TO { if (fr == NULL)
fr = frc;
yyexpectaddr = 1;
if (yydebug)
printf("set yyexpectaddr\n");
yycont = &yyexpectaddr;
yysetdict(addrwords);
resetaddr(); }
;
with: | andwith withlist
;
andwith:
IPFY_WITH { nowith = 0; setipftype(); }
| IPFY_AND { nowith = 0; setipftype(); }
;
flags: | startflags flagset
{ DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = FR_TCPFMAX;) }
| startflags flagset '/' flagset
{ DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
| startflags '/' flagset
{ DOALL(fr->fr_tcpf = 0; fr->fr_tcpfm = $3;) }
| startflags YY_NUMBER
{ DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = FR_TCPFMAX;) }
| startflags '/' YY_NUMBER
{ DOALL(fr->fr_tcpf = 0; fr->fr_tcpfm = $3;) }
| startflags YY_NUMBER '/' YY_NUMBER
{ DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
| startflags flagset '/' YY_NUMBER
{ DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
| startflags YY_NUMBER '/' flagset
{ DOALL(fr->fr_tcpf = $2; fr->fr_tcpfm = $4;) }
;
startflags:
IPFY_FLAGS { if (frc->fr_type != FR_T_IPF)
yyerror("flags with non-ipf type rule");
if (frc->fr_proto != IPPROTO_TCP)
yyerror("flags with non-TCP rule");
}
;
flagset:
YY_STR { $$ = tcpflags($1); free($1); }
| YY_HEX { $$ = $1; }
;
srcobject:
{ yyresetdict(); } fromport
| srcaddr srcport
| '!' srcaddr srcport
{ DOALL(fr->fr_flags |= FR_NOTSRCIP;) }
;
srcaddr:
addr { DOREM(bcopy(&($1.a), &fr->fr_ip.fi_src, sizeof($1.a)); \
bcopy(&($1.m), &fr->fr_mip.fi_src, sizeof($1.m)); \
if (dynamic != -1) { \
fr->fr_satype = ifpflag; \
fr->fr_ipf->fri_sifpidx = dynamic; \
} else if (pooled || hashed) \
fr->fr_satype = FRI_LOOKUP;)
}
| lstart srcaddrlist lend
;
srcaddrlist:
addr { DOREM(bcopy(&($1.a), &fr->fr_ip.fi_src, sizeof($1.a)); \
bcopy(&($1.m), &fr->fr_mip.fi_src, sizeof($1.m)); \
if (dynamic != -1) { \
fr->fr_satype = ifpflag; \
fr->fr_ipf->fri_sifpidx = dynamic; \
} else if (pooled || hashed) \
fr->fr_satype = FRI_LOOKUP;)
}
| srcaddrlist lmore addr
{ DOREM(bcopy(&($3.a), &fr->fr_ip.fi_src, sizeof($3.a)); \
bcopy(&($3.m), &fr->fr_mip.fi_src, sizeof($3.m)); \
if (dynamic != -1) { \
fr->fr_satype = ifpflag; \
fr->fr_ipf->fri_sifpidx = dynamic; \
} else if (pooled || hashed) \
fr->fr_satype = FRI_LOOKUP;)
}
;
srcport:
| portcomp
{ DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1;) }
| portrange
{ DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1; \
fr->fr_stop = $1.p2;) }
| porteq lstart srcportlist lend
{ yyresetdict(); }
;
fromport:
portcomp
{ DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1;) }
| portrange
{ DOALL(fr->fr_scmp = $1.pc; fr->fr_sport = $1.p1; \
fr->fr_stop = $1.p2;) }
| porteq lstart srcportlist lend
{ yyresetdict(); }
;
srcportlist:
portnum { DOREM(fr->fr_scmp = FR_EQUAL; fr->fr_sport = $1;) }
| portnum ':' portnum
{ DOREM(fr->fr_scmp = FR_INCRANGE; fr->fr_sport = $1; \
fr->fr_stop = $3;) }
| portnum YY_RANGE_IN portnum
{ DOREM(fr->fr_scmp = FR_INRANGE; fr->fr_sport = $1; \
fr->fr_stop = $3;) }
| srcportlist lmore portnum
{ DOREM(fr->fr_scmp = FR_EQUAL; fr->fr_sport = $3;) }
| srcportlist lmore portnum ':' portnum
{ DOREM(fr->fr_scmp = FR_INCRANGE; fr->fr_sport = $3; \
fr->fr_stop = $5;) }
| srcportlist lmore portnum YY_RANGE_IN portnum
{ DOREM(fr->fr_scmp = FR_INRANGE; fr->fr_sport = $3; \
fr->fr_stop = $5;) }
;
dstobject:
{ yyresetdict(); } toport
| dstaddr dstport
| '!' dstaddr dstport
{ DOALL(fr->fr_flags |= FR_NOTDSTIP;) }
;
dstaddr:
addr { DOREM(bcopy(&($1.a), &fr->fr_ip.fi_dst, sizeof($1.a)); \
bcopy(&($1.m), &fr->fr_mip.fi_dst, sizeof($1.m)); \
if (dynamic != -1) { \
fr->fr_datype = ifpflag; \
fr->fr_ipf->fri_difpidx = dynamic; \
} else if (pooled || hashed) \
fr->fr_datype = FRI_LOOKUP;)
}
| lstart dstaddrlist lend
;
dstaddrlist:
addr { DOREM(bcopy(&($1.a), &fr->fr_ip.fi_dst, sizeof($1.a)); \
bcopy(&($1.m), &fr->fr_mip.fi_dst, sizeof($1.m)); \
if (dynamic != -1) { \
fr->fr_datype = ifpflag; \
fr->fr_ipf->fri_difpidx = dynamic; \
} else if (pooled || hashed) \
fr->fr_datype = FRI_LOOKUP;)
}
| dstaddrlist lmore addr
{ DOREM(bcopy(&($3.a), &fr->fr_ip.fi_dst, sizeof($3.a)); \
bcopy(&($3.m), &fr->fr_mip.fi_dst, sizeof($3.m)); \
if (dynamic != -1) { \
fr->fr_datype = ifpflag; \
fr->fr_ipf->fri_difpidx = dynamic; \
} else if (pooled || hashed) \
fr->fr_datype = FRI_LOOKUP;)
}
;
dstport:
| portcomp
{ DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1;) }
| portrange
{ DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1; \
fr->fr_dtop = $1.p2;) }
| porteq lstart dstportlist lend
{ yyresetdict(); }
;
toport:
portcomp
{ DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1;) }
| portrange
{ DOALL(fr->fr_dcmp = $1.pc; fr->fr_dport = $1.p1; \
fr->fr_dtop = $1.p2;) }
| porteq lstart dstportlist lend
{ yyresetdict(); }
;
dstportlist:
portnum { DOREM(fr->fr_dcmp = FR_EQUAL; fr->fr_dport = $1;) }
| portnum ':' portnum
{ DOREM(fr->fr_dcmp = FR_INCRANGE; fr->fr_dport = $1; \
fr->fr_dtop = $3;) }
| portnum YY_RANGE_IN portnum
{ DOREM(fr->fr_dcmp = FR_INRANGE; fr->fr_dport = $1; \
fr->fr_dtop = $3;) }
| dstportlist lmore portnum
{ DOREM(fr->fr_dcmp = FR_EQUAL; fr->fr_dport = $3;) }
| dstportlist lmore portnum ':' portnum
{ DOREM(fr->fr_dcmp = FR_INCRANGE; fr->fr_dport = $3; \
fr->fr_dtop = $5;) }
| dstportlist lmore portnum YY_RANGE_IN portnum
{ DOREM(fr->fr_dcmp = FR_INRANGE; fr->fr_dport = $3; \
fr->fr_dtop = $5;) }
;
addr: pool '/' YY_NUMBER { pooled = 1;
$$.a.iplookuptype = IPLT_POOL;
$$.a.iplookupsubtype = 0;
$$.a.iplookupnum = $3; }
| pool '/' YY_STR { pooled = 1;
$$.a.iplookuptype = IPLT_POOL;
$$.a.iplookupsubtype = 1;
strncpy($$.a.iplookupname, $3,
sizeof($$.a.iplookupname));
}
| pool '=' '(' poollist ')' { pooled = 1;
$$.a.iplookuptype = IPLT_POOL;
$$.a.iplookupsubtype = 0;
$$.a.iplookupnum = makepool($4); }
| hash '/' YY_NUMBER { hashed = 1;
$$.a.iplookuptype = IPLT_HASH;
$$.a.iplookupsubtype = 0;
$$.a.iplookupnum = $3; }
| hash '/' YY_STR { pooled = 1;
$$.a.iplookuptype = IPLT_HASH;
$$.a.iplookupsubtype = 1;
strncpy($$.a.iplookupname, $3,
sizeof($$.a.iplookupname));
}
| hash '=' '(' addrlist ')' { hashed = 1;
$$.a.iplookuptype = IPLT_HASH;
$$.a.iplookupsubtype = 0;
$$.a.iplookupnum = makehash($4); }
| ipaddr { bcopy(&$1, &$$, sizeof($$));
yyexpectaddr = 0; }
;
ipaddr: IPFY_ANY { bzero(&($$), sizeof($$));
yyresetdict();
yyexpectaddr = 0; }
| hostname { $$.a.in4 = $1;
$$.m.in4_addr = 0xffffffff;
yyexpectaddr = 0; }
| hostname { yyresetdict();
$$.a.in4_addr = $1.s_addr; }
maskspace { yysetdict(maskwords); }
ipv4mask { $$.m.in4_addr = $5.s_addr;
$$.a.in4_addr &= $5.s_addr;
yyresetdict();
yyexpectaddr = 0; }
| YY_IPV6 { bcopy(&$1, &$$.a, sizeof($$.a));
fill6bits(128, (u_32_t *)&$$.m);
yyresetdict();
yyexpectaddr = 0; }
| YY_IPV6 { yyresetdict();
bcopy(&$1, &$$.a, sizeof($$.a)); }
maskspace { yysetdict(maskwords); }
ipv6mask { bcopy(&$5, &$$.m, sizeof($$.m));
yyresetdict();
yyexpectaddr = 0; }
;
maskspace:
'/'
| IPFY_MASK
;
ipv4mask:
ipv4 { $$ = $1; }
| YY_HEX { $$.s_addr = htonl($1); }
| YY_NUMBER { ntomask(4, $1, (u_32_t *)&$$); }
| IPFY_BROADCAST { if (ifpflag == FRI_DYNAMIC) {
$$.s_addr = 0;
ifpflag = FRI_BROADCAST;
} else
YYERROR;
}
| IPFY_NETWORK { if (ifpflag == FRI_DYNAMIC) {
$$.s_addr = 0;
ifpflag = FRI_NETWORK;
} else
YYERROR;
}
| IPFY_NETMASKED { if (ifpflag == FRI_DYNAMIC) {
$$.s_addr = 0;
ifpflag = FRI_NETMASKED;
} else
YYERROR;
}
| IPFY_PEER { if (ifpflag == FRI_DYNAMIC) {
$$.s_addr = 0;
ifpflag = FRI_PEERADDR;
} else
YYERROR;
}
;
ipv6mask:
YY_NUMBER { ntomask(6, $1, $$.i6); }
| IPFY_BROADCAST { if (ifpflag == FRI_DYNAMIC) {
bzero(&$$, sizeof($$));
ifpflag = FRI_BROADCAST;
} else
YYERROR;
}
| IPFY_NETWORK { if (ifpflag == FRI_DYNAMIC) {
bzero(&$$, sizeof($$));
ifpflag = FRI_BROADCAST;
} else
YYERROR;
}
| IPFY_NETMASKED { if (ifpflag == FRI_DYNAMIC) {
bzero(&$$, sizeof($$));
ifpflag = FRI_BROADCAST;
} else
YYERROR;
}
| IPFY_PEER { if (ifpflag == FRI_DYNAMIC) {
bzero(&$$, sizeof($$));
ifpflag = FRI_BROADCAST;
} else
YYERROR;
}
;
hostname:
ipv4 { $$ = $1; }
| YY_NUMBER { $$.s_addr = $1; }
| YY_HEX { $$.s_addr = $1; }
| YY_STR { $$.s_addr = lookuphost($1);
free($1);
}
;
addrlist:
ipaddr { $$ = newalist(NULL);
bcopy(&($1.a), &($$->al_i6addr), sizeof($1.a));
bcopy(&($1.m), &($$->al_i6mask), sizeof($1.m)); }
| addrlist ',' ipaddr
{ $$ = newalist($1);
bcopy(&($3.a), &($$->al_i6addr), sizeof($3.a));
bcopy(&($3.m), &($$->al_i6mask), sizeof($3.m)); }
;
pool: IPFY_POOL { yyexpectaddr = 0; yycont = NULL; yyresetdict(); }
;
hash: IPFY_HASH { yyexpectaddr = 0; yycont = NULL; yyresetdict(); }
;
poollist:
ipaddr { $$ = newalist(NULL);
bcopy(&($1.a), &($$->al_i6addr), sizeof($1.a));
bcopy(&($1.m), &($$->al_i6mask), sizeof($1.m)); }
| '!' ipaddr { $$ = newalist(NULL);
$$->al_not = 1;
bcopy(&($2.a), &($$->al_i6addr), sizeof($2.a));
bcopy(&($2.m), &($$->al_i6mask), sizeof($2.m)); }
| poollist ',' ipaddr
{ $$ = newalist($1);
bcopy(&($3.a), &($$->al_i6addr), sizeof($3.a));
bcopy(&($3.m), &($$->al_i6mask), sizeof($3.m)); }
| poollist ',' '!' ipaddr
{ $$ = newalist($1);
$$->al_not = 1;
bcopy(&($4.a), &($$->al_i6addr), sizeof($4.a));
bcopy(&($4.m), &($$->al_i6mask), sizeof($4.m)); }
;
port: IPFY_PORT { yyexpectaddr = 0;
yycont = NULL;
}
;
portc: port compare { $$ = $2;
yysetdict(NULL); }
| porteq { $$ = $1; }
;
porteq: port '=' { $$ = FR_EQUAL;
yysetdict(NULL); }
;
portr: IPFY_PORT { yyexpectaddr = 0;
yycont = NULL;
yysetdict(NULL); }
;
portcomp:
portc portnum { $$.pc = $1;
$$.p1 = $2;
yyresetdict(); }
;
portrange:
portr portnum range portnum { $$.p1 = $2;
$$.pc = $3;
$$.p2 = $4;
yyresetdict(); }
;
icmp: | itype icode
;
itype: seticmptype icmptype
{ DOALL(fr->fr_icmp = htons($2 << 8); fr->fr_icmpm = htons(0xff00););
yyresetdict();
}
| seticmptype lstart typelist lend { yyresetdict(); }
;
seticmptype:
IPFY_ICMPTYPE { setipftype();
yysetdict(icmptypewords); }
;
icode: | seticmpcode icmpcode
{ DOALL(fr->fr_icmp |= htons($2); fr->fr_icmpm |= htons(0xff););
yyresetdict();
}
| seticmpcode lstart codelist lend { yyresetdict(); }
;
seticmpcode:
IPFY_ICMPCODE { yysetdict(icmpcodewords); }
;
typelist:
icmptype
{ DOREM(fr->fr_icmp = htons($1 << 8); fr->fr_icmpm = htons(0xff00);) }
| typelist lmore icmptype
{ DOREM(fr->fr_icmp = htons($3 << 8); fr->fr_icmpm = htons(0xff00);) }
;
codelist:
icmpcode
{ DOREM(fr->fr_icmp |= htons($1); fr->fr_icmpm |= htons(0xff);) }
| codelist lmore icmpcode
{ DOREM(fr->fr_icmp &= htons(0xff00); fr->fr_icmp |= htons($3); \
fr->fr_icmpm |= htons(0xff);) }
;
age: | IPFY_AGE YY_NUMBER { DOALL(fr->fr_age[0] = $2; \
fr->fr_age[1] = $2;) }
| IPFY_AGE YY_NUMBER '/' YY_NUMBER
{ DOALL(fr->fr_age[0] = $2; \
fr->fr_age[1] = $4;) }
;
keep: | IPFY_KEEP keepstate keep
| IPFY_KEEP keepfrag keep
;
keepstate:
IPFY_STATE stateoptlist { DOALL(fr->fr_flags |= FR_KEEPSTATE;)}
;
keepfrag:
IPFY_FRAGS fragoptlist { DOALL(fr->fr_flags |= FR_KEEPFRAG;) }
| IPFY_FRAG fragoptlist { DOALL(fr->fr_flags |= FR_KEEPFRAG;) }
;
fragoptlist:
| '(' fragopts ')'
;
fragopts:
fragopt lanother fragopts
| fragopt
;
fragopt:
IPFY_STRICT { DOALL(fr->fr_flags |= FR_FRSTRICT;) }
;
stateoptlist:
| '(' stateopts ')'
;
stateopts:
stateopt lanother stateopts
| stateopt
;
stateopt:
IPFY_LIMIT YY_NUMBER { DOALL(fr->fr_statemax = $2;) }
| IPFY_STRICT { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \
YYERROR; \
} else \
fr->fr_flags |= FR_STSTRICT;)
}
| IPFY_NEWISN { DOALL(if (fr->fr_proto != IPPROTO_TCP) { \
YYERROR; \
} else \
fr->fr_flags |= FR_NEWISN;)
}
| IPFY_NOICMPERR { DOALL(fr->fr_flags |= FR_NOICMPERR;) }
| IPFY_SYNC { DOALL(fr->fr_flags |= FR_STATESYNC;) }
| IPFY_AGE YY_NUMBER { DOALL(fr->fr_age[0] = $2; \
fr->fr_age[1] = $2;) }
| IPFY_AGE YY_NUMBER '/' YY_NUMBER
{ DOALL(fr->fr_age[0] = $2; \
fr->fr_age[1] = $4;) }
;
portnum:
servicename { if (getport(frc, $1, &($$)) == -1)
yyerror("service unknown");
$$ = ntohs($$);
free($1);
}
| YY_NUMBER { if ($1 > 65535) /* Unsigned */
yyerror("invalid port number");
else
$$ = $1;
}
;
withlist:
withopt { nowith = 0; }
| withlist withopt { nowith = 0; }
| withlist ',' withopt { nowith = 0; }
;
withopt:
opttype { DOALL(fr->fr_flx |= $1; fr->fr_mflx |= $1;) }
| notwith opttype { DOALL(fr->fr_mflx |= $2;) }
| ipopt ipopts { yyresetdict(); }
| notwith ipopt ipopts { yyresetdict(); }
| startv6hdrs ipv6hdrs { yyresetdict(); }
;
ipopt: IPFY_OPT { yysetdict(ipv4optwords); }
;
startv6hdrs:
IPF6_V6HDRS { if (use_inet6 == 0)
yyerror("only available with IPv6");
yysetdict(ipv6optwords);
}
;
notwith:
IPFY_NOT { nowith = 1; }
| IPFY_NO { nowith = 1; }
;
opttype:
IPFY_IPOPTS { $$ = FI_OPTIONS; }
| IPFY_SHORT { $$ = FI_SHORT; }
| IPFY_NAT { $$ = FI_NATED; }
| IPFY_BAD { $$ = FI_BAD; }
| IPFY_BADNAT { $$ = FI_BADNAT; }
| IPFY_BADSRC { $$ = FI_BADSRC; }
| IPFY_LOWTTL { $$ = FI_LOWTTL; }
| IPFY_FRAG { $$ = FI_FRAG; }
| IPFY_FRAGBODY { $$ = FI_FRAGBODY; }
| IPFY_FRAGS { $$ = FI_FRAG; }
| IPFY_MBCAST { $$ = FI_MBCAST; }
| IPFY_MULTICAST { $$ = FI_MULTICAST; }
| IPFY_BROADCAST { $$ = FI_BROADCAST; }
| IPFY_STATE { $$ = FI_STATE; }
| IPFY_OOW { $$ = FI_OOW; }
;
ipopts: optlist { DOALL(fr->fr_mip.fi_optmsk |= $1;
if (!nowith)
fr->fr_ip.fi_optmsk |= $1;)
}
;
optlist:
opt { $$ |= $1; }
| optlist ',' opt { $$ |= $1 | $3; }
;
ipv6hdrs:
ipv6hdrlist { DOALL(fr->fr_mip.fi_optmsk |= $1;
if (!nowith)
fr->fr_ip.fi_optmsk |= $1;)
}
;
ipv6hdrlist:
ipv6hdr { $$ |= $1; }
| ipv6hdrlist ',' ipv6hdr { $$ |= $1 | $3; }
;
secname:
seclevel { $$ |= $1; }
| secname ',' seclevel { $$ |= $1 | $3; }
;
seclevel:
IPFY_SEC_UNC { $$ = secbit(IPSO_CLASS_UNCL); }
| IPFY_SEC_CONF { $$ = secbit(IPSO_CLASS_CONF); }
| IPFY_SEC_RSV1 { $$ = secbit(IPSO_CLASS_RES1); }
| IPFY_SEC_RSV2 { $$ = secbit(IPSO_CLASS_RES2); }
| IPFY_SEC_RSV3 { $$ = secbit(IPSO_CLASS_RES3); }
| IPFY_SEC_RSV4 { $$ = secbit(IPSO_CLASS_RES4); }
| IPFY_SEC_SEC { $$ = secbit(IPSO_CLASS_SECR); }
| IPFY_SEC_TS { $$ = secbit(IPSO_CLASS_TOPS); }
;
icmptype:
YY_NUMBER { $$ = $1; }
| IPFY_ICMPT_UNR { $$ = ICMP_UNREACH; }
| IPFY_ICMPT_ECHO { $$ = ICMP_ECHO; }
| IPFY_ICMPT_ECHOR { $$ = ICMP_ECHOREPLY; }
| IPFY_ICMPT_SQUENCH { $$ = ICMP_SOURCEQUENCH; }
| IPFY_ICMPT_REDIR { $$ = ICMP_REDIRECT; }
| IPFY_ICMPT_TIMEX { $$ = ICMP_TIMXCEED; }
| IPFY_ICMPT_PARAMP { $$ = ICMP_PARAMPROB; }
| IPFY_ICMPT_TIMEST { $$ = ICMP_TSTAMP; }
| IPFY_ICMPT_TIMESTREP { $$ = ICMP_TSTAMPREPLY; }
| IPFY_ICMPT_INFOREQ { $$ = ICMP_IREQ; }
| IPFY_ICMPT_INFOREP { $$ = ICMP_IREQREPLY; }
| IPFY_ICMPT_MASKREQ { $$ = ICMP_MASKREQ; }
| IPFY_ICMPT_MASKREP { $$ = ICMP_MASKREPLY; }
| IPFY_ICMPT_ROUTERAD { $$ = ICMP_ROUTERADVERT; }
| IPFY_ICMPT_ROUTERSOL { $$ = ICMP_ROUTERSOLICIT; }
;
icmpcode:
YY_NUMBER { $$ = $1; }
| IPFY_ICMPC_NETUNR { $$ = ICMP_UNREACH_NET; }
| IPFY_ICMPC_HSTUNR { $$ = ICMP_UNREACH_HOST; }
| IPFY_ICMPC_PROUNR { $$ = ICMP_UNREACH_PROTOCOL; }
| IPFY_ICMPC_PORUNR { $$ = ICMP_UNREACH_PORT; }
| IPFY_ICMPC_NEEDF { $$ = ICMP_UNREACH_NEEDFRAG; }
| IPFY_ICMPC_SRCFAIL { $$ = ICMP_UNREACH_SRCFAIL; }
| IPFY_ICMPC_NETUNK { $$ = ICMP_UNREACH_NET_UNKNOWN; }
| IPFY_ICMPC_HSTUNK { $$ = ICMP_UNREACH_HOST_UNKNOWN; }
| IPFY_ICMPC_ISOLATE { $$ = ICMP_UNREACH_ISOLATED; }
| IPFY_ICMPC_NETPRO { $$ = ICMP_UNREACH_NET_PROHIB; }
| IPFY_ICMPC_HSTPRO { $$ = ICMP_UNREACH_HOST_PROHIB; }
| IPFY_ICMPC_NETTOS { $$ = ICMP_UNREACH_TOSNET; }
| IPFY_ICMPC_HSTTOS { $$ = ICMP_UNREACH_TOSHOST; }
| IPFY_ICMPC_FLTPRO { $$ = ICMP_UNREACH_ADMIN_PROHIBIT; }
| IPFY_ICMPC_HSTPRE { $$ = 14; }
| IPFY_ICMPC_CUTPRE { $$ = 15; }
;
opt:
IPFY_IPOPT_NOP { $$ = getoptbyvalue(IPOPT_NOP); }
| IPFY_IPOPT_RR { $$ = getoptbyvalue(IPOPT_RR); }
| IPFY_IPOPT_ZSU { $$ = getoptbyvalue(IPOPT_ZSU); }
| IPFY_IPOPT_MTUP { $$ = getoptbyvalue(IPOPT_MTUP); }
| IPFY_IPOPT_MTUR { $$ = getoptbyvalue(IPOPT_MTUR); }
| IPFY_IPOPT_ENCODE { $$ = getoptbyvalue(IPOPT_ENCODE); }
| IPFY_IPOPT_TS { $$ = getoptbyvalue(IPOPT_TS); }
| IPFY_IPOPT_TR { $$ = getoptbyvalue(IPOPT_TR); }
| IPFY_IPOPT_SEC { $$ = getoptbyvalue(IPOPT_SECURITY); }
| IPFY_IPOPT_LSRR { $$ = getoptbyvalue(IPOPT_LSRR); }
| IPFY_IPOPT_ESEC { $$ = getoptbyvalue(IPOPT_E_SEC); }
| IPFY_IPOPT_CIPSO { $$ = getoptbyvalue(IPOPT_CIPSO); }
| IPFY_IPOPT_SATID { $$ = getoptbyvalue(IPOPT_SATID); }
| IPFY_IPOPT_SSRR { $$ = getoptbyvalue(IPOPT_SSRR); }
| IPFY_IPOPT_ADDEXT { $$ = getoptbyvalue(IPOPT_ADDEXT); }
| IPFY_IPOPT_VISA { $$ = getoptbyvalue(IPOPT_VISA); }
| IPFY_IPOPT_IMITD { $$ = getoptbyvalue(IPOPT_IMITD); }
| IPFY_IPOPT_EIP { $$ = getoptbyvalue(IPOPT_EIP); }
| IPFY_IPOPT_FINN { $$ = getoptbyvalue(IPOPT_FINN); }
| IPFY_IPOPT_DPS { $$ = getoptbyvalue(IPOPT_DPS); }
| IPFY_IPOPT_SDB { $$ = getoptbyvalue(IPOPT_SDB); }
| IPFY_IPOPT_NSAPA { $$ = getoptbyvalue(IPOPT_NSAPA); }
| IPFY_IPOPT_RTRALRT { $$ = getoptbyvalue(IPOPT_RTRALRT); }
| IPFY_IPOPT_UMP { $$ = getoptbyvalue(IPOPT_UMP); }
| setsecclass secname
{ DOALL(fr->fr_mip.fi_secmsk |= $2;
if (!nowith)
fr->fr_ip.fi_secmsk |= $2;)
$$ = 0;
yyresetdict();
}
;
setsecclass:
IPFY_SECCLASS { yysetdict(ipv4secwords); }
;
ipv6hdr:
IPFY_AH { $$ = getv6optbyvalue(IPPROTO_AH); }
| IPFY_IPV6OPT_DSTOPTS { $$ = getv6optbyvalue(IPPROTO_DSTOPTS); }
| IPFY_IPV6OPT_ESP { $$ = getv6optbyvalue(IPPROTO_ESP); }
| IPFY_IPV6OPT_HOPOPTS { $$ = getv6optbyvalue(IPPROTO_HOPOPTS); }
| IPFY_IPV6OPT_IPV6 { $$ = getv6optbyvalue(IPPROTO_IPV6); }
| IPFY_IPV6OPT_NONE { $$ = getv6optbyvalue(IPPROTO_NONE); }
| IPFY_IPV6OPT_ROUTING { $$ = getv6optbyvalue(IPPROTO_ROUTING); }
| IPFY_IPV6OPT_FRAG { $$ = getv6optbyvalue(IPPROTO_FRAGMENT); }
| IPFY_IPV6OPT_MOBILITY { $$ = getv6optbyvalue(IPPROTO_MOBILITY); }
;
level: IPFY_LEVEL { setsyslog(); }
;
loglevel:
priority { fr->fr_loglevel = LOG_LOCAL0|$1; }
| facility '.' priority { fr->fr_loglevel = $1 | $3; }
;
facility:
IPFY_FAC_KERN { $$ = LOG_KERN; }
| IPFY_FAC_USER { $$ = LOG_USER; }
| IPFY_FAC_MAIL { $$ = LOG_MAIL; }
| IPFY_FAC_DAEMON { $$ = LOG_DAEMON; }
| IPFY_FAC_AUTH { $$ = LOG_AUTH; }
| IPFY_FAC_SYSLOG { $$ = LOG_SYSLOG; }
| IPFY_FAC_LPR { $$ = LOG_LPR; }
| IPFY_FAC_NEWS { $$ = LOG_NEWS; }
| IPFY_FAC_UUCP { $$ = LOG_UUCP; }
| IPFY_FAC_CRON { $$ = LOG_CRON; }
| IPFY_FAC_FTP { $$ = LOG_FTP; }
| IPFY_FAC_AUTHPRIV { $$ = LOG_AUTHPRIV; }
| IPFY_FAC_AUDIT { $$ = LOG_AUDIT; }
| IPFY_FAC_LFMT { $$ = LOG_LFMT; }
| IPFY_FAC_LOCAL0 { $$ = LOG_LOCAL0; }
| IPFY_FAC_LOCAL1 { $$ = LOG_LOCAL1; }
| IPFY_FAC_LOCAL2 { $$ = LOG_LOCAL2; }
| IPFY_FAC_LOCAL3 { $$ = LOG_LOCAL3; }
| IPFY_FAC_LOCAL4 { $$ = LOG_LOCAL4; }
| IPFY_FAC_LOCAL5 { $$ = LOG_LOCAL5; }
| IPFY_FAC_LOCAL6 { $$ = LOG_LOCAL6; }
| IPFY_FAC_LOCAL7 { $$ = LOG_LOCAL7; }
| IPFY_FAC_SECURITY { $$ = LOG_SECURITY; }
;
priority:
IPFY_PRI_EMERG { $$ = LOG_EMERG; }
| IPFY_PRI_ALERT { $$ = LOG_ALERT; }
| IPFY_PRI_CRIT { $$ = LOG_CRIT; }
| IPFY_PRI_ERR { $$ = LOG_ERR; }
| IPFY_PRI_WARN { $$ = LOG_WARNING; }
| IPFY_PRI_NOTICE { $$ = LOG_NOTICE; }
| IPFY_PRI_INFO { $$ = LOG_INFO; }
| IPFY_PRI_DEBUG { $$ = LOG_DEBUG; }
;
compare:
YY_CMP_EQ { $$ = FR_EQUAL; }
| YY_CMP_NE { $$ = FR_NEQUAL; }
| YY_CMP_LT { $$ = FR_LESST; }
| YY_CMP_LE { $$ = FR_LESSTE; }
| YY_CMP_GT { $$ = FR_GREATERT; }
| YY_CMP_GE { $$ = FR_GREATERTE; }
;
range: YY_RANGE_IN { $$ = FR_INRANGE; }
| YY_RANGE_OUT { $$ = FR_OUTRANGE; }
| ':' { $$ = FR_INCRANGE; }
;
servicename:
YY_STR { $$ = $1; }
;
interfacename: name { $$ = $1; }
| name ':' YY_NUMBER
{ $$ = $1;
fprintf(stderr, "%d: Logical interface %s:%d unsupported, "
"use the physical interface %s instead.\n",
yylineNum, $1, $3, $1);
}
;
name: YY_STR { $$ = $1; }
| '-' { $$ = strdup("-"); }
;
ipv4_16:
YY_NUMBER '.' YY_NUMBER
{ if ($1 > 255 || $3 > 255) {
yyerror("Invalid octet string for IP address");
return 0;
}
$$.s_addr = ($1 << 24) | ($3 << 16);
$$.s_addr = htonl($$.s_addr);
}
;
ipv4_24:
ipv4_16 '.' YY_NUMBER
{ if ($3 > 255) {
yyerror("Invalid octet string for IP address");
return 0;
}
$$.s_addr |= htonl($3 << 8);
}
;
ipv4: ipv4_24 '.' YY_NUMBER
{ if ($3 > 255) {
yyerror("Invalid octet string for IP address");
return 0;
}
$$.s_addr |= htonl($3);
}
| ipv4_24
| ipv4_16
;
%%
static struct wordtab ipfwords[95] = {
{ "age", IPFY_AGE },
{ "ah", IPFY_AH },
{ "all", IPFY_ALL },
{ "and", IPFY_AND },
{ "auth", IPFY_AUTH },
{ "bad", IPFY_BAD },
{ "bad-nat", IPFY_BADNAT },
{ "bad-src", IPFY_BADSRC },
{ "bcast", IPFY_BROADCAST },
{ "block", IPFY_BLOCK },
{ "body", IPFY_BODY },
{ "bpf-v4", IPFY_BPFV4 },
#ifdef USE_INET6
{ "bpf-v6", IPFY_BPFV6 },
#endif
{ "call", IPFY_CALL },
{ "code", IPFY_ICMPCODE },
{ "count", IPFY_COUNT },
{ "dup-to", IPFY_DUPTO },
{ "eq", YY_CMP_EQ },
{ "esp", IPFY_ESP },
{ "fastroute", IPFY_FROUTE },
{ "first", IPFY_FIRST },
{ "flags", IPFY_FLAGS },
{ "frag", IPFY_FRAG },
{ "frag-body", IPFY_FRAGBODY },
{ "frags", IPFY_FRAGS },
{ "from", IPFY_FROM },
{ "ge", YY_CMP_GE },
{ "group", IPFY_GROUP },
{ "gt", YY_CMP_GT },
{ "head", IPFY_HEAD },
{ "icmp", IPFY_ICMP },
{ "icmp-type", IPFY_ICMPTYPE },
{ "in", IPFY_IN },
{ "in-via", IPFY_INVIA },
{ "ipopt", IPFY_IPOPTS },
{ "ipopts", IPFY_IPOPTS },
{ "keep", IPFY_KEEP },
{ "le", YY_CMP_LE },
{ "level", IPFY_LEVEL },
{ "limit", IPFY_LIMIT },
{ "log", IPFY_LOG },
{ "lowttl", IPFY_LOWTTL },
{ "lt", YY_CMP_LT },
{ "mask", IPFY_MASK },
{ "match-tag", IPFY_MATCHTAG },
{ "mbcast", IPFY_MBCAST },
{ "mcast", IPFY_MULTICAST },
{ "multicast", IPFY_MULTICAST },
{ "nat", IPFY_NAT },
{ "ne", YY_CMP_NE },
{ "net", IPFY_NETWORK },
{ "newisn", IPFY_NEWISN },
{ "no", IPFY_NO },
{ "no-icmp-err", IPFY_NOICMPERR },
{ "nomatch", IPFY_NOMATCH },
{ "now", IPFY_NOW },
{ "not", IPFY_NOT },
{ "oow", IPFY_OOW },
{ "on", IPFY_ON },
{ "opt", IPFY_OPT },
{ "or-block", IPFY_ORBLOCK },
{ "out", IPFY_OUT },
{ "out-via", IPFY_OUTVIA },
{ "pass", IPFY_PASS },
{ "port", IPFY_PORT },
{ "pps", IPFY_PPS },
{ "preauth", IPFY_PREAUTH },
{ "proto", IPFY_PROTO },
{ "quick", IPFY_QUICK },
{ "reply-to", IPFY_REPLY_TO },
{ "return-icmp", IPFY_RETICMP },
{ "return-icmp-as-dest", IPFY_RETICMPASDST },
{ "return-rst", IPFY_RETRST },
{ "route-to", IPFY_ROUTETO },
{ "sec-class", IPFY_SECCLASS },
{ "set-tag", IPFY_SETTAG },
{ "skip", IPFY_SKIP },
{ "short", IPFY_SHORT },
{ "state", IPFY_STATE },
{ "state-age", IPFY_AGE },
{ "strict", IPFY_STRICT },
{ "sync", IPFY_SYNC },
{ "tcp", IPFY_TCP },
{ "tcp-udp", IPFY_TCPUDP },
{ "tos", IPFY_TOS },
{ "to", IPFY_TO },
{ "ttl", IPFY_TTL },
{ "udp", IPFY_UDP },
{ "v6hdrs", IPF6_V6HDRS },
{ "with", IPFY_WITH },
{ NULL, 0 }
};
static struct wordtab addrwords[4] = {
{ "any", IPFY_ANY },
{ "hash", IPFY_HASH },
{ "pool", IPFY_POOL },
{ NULL, 0 }
};
static struct wordtab maskwords[5] = {
{ "broadcast", IPFY_BROADCAST },
{ "netmasked", IPFY_NETMASKED },
{ "network", IPFY_NETWORK },
{ "peer", IPFY_PEER },
{ NULL, 0 }
};
static struct wordtab icmptypewords[16] = {
{ "echo", IPFY_ICMPT_ECHO },
{ "echorep", IPFY_ICMPT_ECHOR },
{ "inforeq", IPFY_ICMPT_INFOREQ },
{ "inforep", IPFY_ICMPT_INFOREP },
{ "maskrep", IPFY_ICMPT_MASKREP },
{ "maskreq", IPFY_ICMPT_MASKREQ },
{ "paramprob", IPFY_ICMPT_PARAMP },
{ "redir", IPFY_ICMPT_REDIR },
{ "unreach", IPFY_ICMPT_UNR },
{ "routerad", IPFY_ICMPT_ROUTERAD },
{ "routersol", IPFY_ICMPT_ROUTERSOL },
{ "squench", IPFY_ICMPT_SQUENCH },
{ "timest", IPFY_ICMPT_TIMEST },
{ "timestrep", IPFY_ICMPT_TIMESTREP },
{ "timex", IPFY_ICMPT_TIMEX },
{ NULL, 0 },
};
static struct wordtab icmpcodewords[17] = {
{ "cutoff-preced", IPFY_ICMPC_CUTPRE },
{ "filter-prohib", IPFY_ICMPC_FLTPRO },
{ "isolate", IPFY_ICMPC_ISOLATE },
{ "needfrag", IPFY_ICMPC_NEEDF },
{ "net-prohib", IPFY_ICMPC_NETPRO },
{ "net-tos", IPFY_ICMPC_NETTOS },
{ "host-preced", IPFY_ICMPC_HSTPRE },
{ "host-prohib", IPFY_ICMPC_HSTPRO },
{ "host-tos", IPFY_ICMPC_HSTTOS },
{ "host-unk", IPFY_ICMPC_HSTUNK },
{ "host-unr", IPFY_ICMPC_HSTUNR },
{ "net-unk", IPFY_ICMPC_NETUNK },
{ "net-unr", IPFY_ICMPC_NETUNR },
{ "port-unr", IPFY_ICMPC_PORUNR },
{ "proto-unr", IPFY_ICMPC_PROUNR },
{ "srcfail", IPFY_ICMPC_SRCFAIL },
{ NULL, 0 },
};
static struct wordtab ipv4optwords[25] = {
{ "addext", IPFY_IPOPT_ADDEXT },
{ "cipso", IPFY_IPOPT_CIPSO },
{ "dps", IPFY_IPOPT_DPS },
{ "e-sec", IPFY_IPOPT_ESEC },
{ "eip", IPFY_IPOPT_EIP },
{ "encode", IPFY_IPOPT_ENCODE },
{ "finn", IPFY_IPOPT_FINN },
{ "imitd", IPFY_IPOPT_IMITD },
{ "lsrr", IPFY_IPOPT_LSRR },
{ "mtup", IPFY_IPOPT_MTUP },
{ "mtur", IPFY_IPOPT_MTUR },
{ "nop", IPFY_IPOPT_NOP },
{ "nsapa", IPFY_IPOPT_NSAPA },
{ "rr", IPFY_IPOPT_RR },
{ "rtralrt", IPFY_IPOPT_RTRALRT },
{ "satid", IPFY_IPOPT_SATID },
{ "sdb", IPFY_IPOPT_SDB },
{ "sec", IPFY_IPOPT_SEC },
{ "ssrr", IPFY_IPOPT_SSRR },
{ "tr", IPFY_IPOPT_TR },
{ "ts", IPFY_IPOPT_TS },
{ "ump", IPFY_IPOPT_UMP },
{ "visa", IPFY_IPOPT_VISA },
{ "zsu", IPFY_IPOPT_ZSU },
{ NULL, 0 },
};
static struct wordtab ipv4secwords[9] = {
{ "confid", IPFY_SEC_CONF },
{ "reserv-1", IPFY_SEC_RSV1 },
{ "reserv-2", IPFY_SEC_RSV2 },
{ "reserv-3", IPFY_SEC_RSV3 },
{ "reserv-4", IPFY_SEC_RSV4 },
{ "secret", IPFY_SEC_SEC },
{ "topsecret", IPFY_SEC_TS },
{ "unclass", IPFY_SEC_UNC },
{ NULL, 0 },
};
static struct wordtab ipv6optwords[9] = {
{ "dstopts", IPFY_IPV6OPT_DSTOPTS },
{ "esp", IPFY_IPV6OPT_ESP },
{ "frag", IPFY_IPV6OPT_FRAG },
{ "hopopts", IPFY_IPV6OPT_HOPOPTS },
{ "ipv6", IPFY_IPV6OPT_IPV6 },
{ "mobility", IPFY_IPV6OPT_MOBILITY },
{ "none", IPFY_IPV6OPT_NONE },
{ "routing", IPFY_IPV6OPT_ROUTING },
{ NULL, 0 },
};
static struct wordtab logwords[33] = {
{ "kern", IPFY_FAC_KERN },
{ "user", IPFY_FAC_USER },
{ "mail", IPFY_FAC_MAIL },
{ "daemon", IPFY_FAC_DAEMON },
{ "auth", IPFY_FAC_AUTH },
{ "syslog", IPFY_FAC_SYSLOG },
{ "lpr", IPFY_FAC_LPR },
{ "news", IPFY_FAC_NEWS },
{ "uucp", IPFY_FAC_UUCP },
{ "cron", IPFY_FAC_CRON },
{ "ftp", IPFY_FAC_FTP },
{ "authpriv", IPFY_FAC_AUTHPRIV },
{ "audit", IPFY_FAC_AUDIT },
{ "logalert", IPFY_FAC_LFMT },
{ "console", IPFY_FAC_CONSOLE },
{ "security", IPFY_FAC_SECURITY },
{ "local0", IPFY_FAC_LOCAL0 },
{ "local1", IPFY_FAC_LOCAL1 },
{ "local2", IPFY_FAC_LOCAL2 },
{ "local3", IPFY_FAC_LOCAL3 },
{ "local4", IPFY_FAC_LOCAL4 },
{ "local5", IPFY_FAC_LOCAL5 },
{ "local6", IPFY_FAC_LOCAL6 },
{ "local7", IPFY_FAC_LOCAL7 },
{ "emerg", IPFY_PRI_EMERG },
{ "alert", IPFY_PRI_ALERT },
{ "crit", IPFY_PRI_CRIT },
{ "err", IPFY_PRI_ERR },
{ "warn", IPFY_PRI_WARN },
{ "notice", IPFY_PRI_NOTICE },
{ "info", IPFY_PRI_INFO },
{ "debug", IPFY_PRI_DEBUG },
{ NULL, 0 },
};
int ipf_parsefile(fd, addfunc, iocfuncs, filename)
int fd;
addfunc_t addfunc;
ioctlfunc_t *iocfuncs;
char *filename;
{
FILE *fp = NULL;
char *s;
yylineNum = 1;
yysettab(ipfwords);
s = getenv("YYDEBUG");
if (s != NULL)
yydebug = atoi(s);
else
yydebug = 0;
if (strcmp(filename, "-")) {
fp = fopen(filename, "r");
if (fp == NULL) {
fprintf(stderr, "fopen(%s) failed: %s\n", filename,
STRERROR(errno));
return -1;
}
} else
fp = stdin;
while (ipf_parsesome(fd, addfunc, iocfuncs, fp) == 1)
;
if (fp != NULL)
fclose(fp);
return 0;
}
int ipf_parsesome(fd, addfunc, iocfuncs, fp)
int fd;
addfunc_t addfunc;
ioctlfunc_t *iocfuncs;
FILE *fp;
{
char *s;
int i;
ipffd = fd;
for (i = 0; i <= IPL_LOGMAX; i++)
ipfioctl[i] = iocfuncs[i];
ipfaddfunc = addfunc;
if (feof(fp))
return 0;
i = fgetc(fp);
if (i == EOF)
return 0;
if (ungetc(i, fp) == 0)
return 0;
if (feof(fp))
return 0;
s = getenv("YYDEBUG");
if (s != NULL)
yydebug = atoi(s);
else
yydebug = 0;
yyin = fp;
yyparse();
return 1;
}
static void newrule()
{
frentry_t *frn;
frn = (frentry_t *)calloc(1, sizeof(frentry_t));
for (fr = frtop; fr != NULL && fr->fr_next != NULL; fr = fr->fr_next)
;
if (fr != NULL)
fr->fr_next = frn;
if (frtop == NULL)
frtop = frn;
fr = frn;
frc = frn;
fr->fr_loglevel = 0xffff;
fr->fr_isc = (void *)-1;
fr->fr_logtag = FR_NOLOGTAG;
fr->fr_type = FR_T_NONE;
if (use_inet6 != 0)
fr->fr_v = 6;
else
fr->fr_v = 4;
nrules = 1;
}
static void setipftype()
{
for (fr = frc; fr != NULL; fr = fr->fr_next) {
if (fr->fr_type == FR_T_NONE) {
fr->fr_type = FR_T_IPF;
fr->fr_data = (void *)calloc(sizeof(fripf_t), 1);
fr->fr_dsize = sizeof(fripf_t);
fr->fr_ip.fi_v = frc->fr_v;
fr->fr_mip.fi_v = 0xf;
fr->fr_ipf->fri_sifpidx = -1;
fr->fr_ipf->fri_difpidx = -1;
}
if (fr->fr_type != FR_T_IPF) {
fprintf(stderr, "IPF Type not set\n");
}
}
}
static frentry_t *addrule()
{
frentry_t *f, *f1, *f2;
int count;
for (f2 = frc; f2->fr_next != NULL; f2 = f2->fr_next)
;
count = nrules;
f = f2;
for (f1 = frc; count > 0; count--, f1 = f1->fr_next) {
f->fr_next = (frentry_t *)calloc(sizeof(*f), 1);
added++;
f = f->fr_next;
bcopy(f1, f, sizeof(*f));
f->fr_next = NULL;
if (f->fr_caddr != NULL) {
f->fr_caddr = malloc(f->fr_dsize);
bcopy(f1->fr_caddr, f->fr_caddr, f->fr_dsize);
}
}
return f2->fr_next;
}
static u_32_t lookuphost(name)
char *name;
{
u_32_t addr;
int i;
hashed = 0;
pooled = 0;
dynamic = -1;
for (i = 0; i < 4; i++) {
if (strncmp(name, frc->fr_ifnames[i],
sizeof(frc->fr_ifnames[i])) == 0) {
ifpflag = FRI_DYNAMIC;
dynamic = i;
return 0;
}
}
if (gethost(name, &addr) == -1) {
fprintf(stderr, "unknown name \"%s\"\n", name);
return 0;
}
return addr;
}
static void dobpf(v, phrase)
int v;
char *phrase;
{
#ifdef IPFILTER_BPF
struct bpf_program bpf;
struct pcap *p;
#endif
fakebpf_t *fb;
u_32_t l;
char *s;
int i;
for (fr = frc; fr != NULL; fr = fr->fr_next) {
if (fr->fr_type != FR_T_NONE) {
fprintf(stderr, "cannot mix IPF and BPF matching\n");
return;
}
fr->fr_v = v;
fr->fr_type = FR_T_BPFOPC;
if (!strncmp(phrase, "0x", 2)) {
fb = malloc(sizeof(fakebpf_t));
for (i = 0, s = strtok(phrase, " \r\n\t"); s != NULL;
s = strtok(NULL, " \r\n\t"), i++) {
fb = realloc(fb, (i / 4 + 1) * sizeof(*fb));
l = (u_32_t)strtol(s, NULL, 0);
switch (i & 3)
{
case 0 :
fb[i / 4].fb_c = l & 0xffff;
break;
case 1 :
fb[i / 4].fb_t = l & 0xff;
break;
case 2 :
fb[i / 4].fb_f = l & 0xff;
break;
case 3 :
fb[i / 4].fb_k = l;
break;
}
}
if ((i & 3) != 0) {
fprintf(stderr,
"Odd number of bytes in BPF code\n");
exit(1);
}
i--;
fr->fr_dsize = (i / 4 + 1) * sizeof(*fb);
fr->fr_data = fb;
return;
}
#ifdef IPFILTER_BPF
bzero((char *)&bpf, sizeof(bpf));
p = pcap_open_dead(DLT_RAW, 1);
if (!p) {
fprintf(stderr, "pcap_open_dead failed\n");
return;
}
if (pcap_compile(p, &bpf, phrase, 1, 0xffffffff)) {
pcap_perror(p, "ipf");
pcap_close(p);
fprintf(stderr, "pcap parsing failed (%s)\n", phrase);
return;
}
pcap_close(p);
fr->fr_dsize = bpf.bf_len * sizeof(struct bpf_insn);
fr->fr_data = malloc(fr->fr_dsize);
bcopy((char *)bpf.bf_insns, fr->fr_data, fr->fr_dsize);
if (!bpf_validate(fr->fr_data, bpf.bf_len)) {
fprintf(stderr, "BPF validation failed\n");
return;
}
#endif
}
#ifdef IPFILTER_BPF
if (opts & OPT_DEBUG)
bpf_dump(&bpf, 0);
#else
fprintf(stderr, "BPF filter expressions not supported\n");
exit(1);
#endif
}
static void resetaddr()
{
hashed = 0;
pooled = 0;
dynamic = -1;
}
static alist_t *newalist(ptr)
alist_t *ptr;
{
alist_t *al;
al = malloc(sizeof(*al));
if (al == NULL)
return NULL;
al->al_not = 0;
al->al_next = ptr;
return al;
}
static int makepool(list)
alist_t *list;
{
ip_pool_node_t *n, *top;
ip_pool_t pool;
alist_t *a;
int num;
if (list == NULL)
return 0;
top = calloc(1, sizeof(*top));
if (top == NULL)
return 0;
for (n = top, a = list; (n != NULL) && (a != NULL); a = a->al_next) {
n->ipn_addr.adf_addr.in4.s_addr = a->al_1;
n->ipn_mask.adf_addr.in4.s_addr = a->al_2;
n->ipn_info = a->al_not;
if (a->al_next != NULL) {
n->ipn_next = calloc(1, sizeof(*n));
n = n->ipn_next;
}
}
bzero((char *)&pool, sizeof(pool));
pool.ipo_unit = IPL_LOGIPF;
pool.ipo_list = top;
num = load_pool(&pool, ipfioctl[IPL_LOGLOOKUP]);
while ((n = top) != NULL) {
top = n->ipn_next;
free(n);
}
return num;
}
static u_int makehash(list)
alist_t *list;
{
iphtent_t *n, *top;
iphtable_t iph;
alist_t *a;
int num;
if (list == NULL)
return 0;
top = calloc(1, sizeof(*top));
if (top == NULL)
return 0;
for (n = top, a = list; (n != NULL) && (a != NULL); a = a->al_next) {
n->ipe_addr.in4_addr = a->al_1;
n->ipe_mask.in4_addr = a->al_2;
n->ipe_value = 0;
if (a->al_next != NULL) {
n->ipe_next = calloc(1, sizeof(*n));
n = n->ipe_next;
}
}
bzero((char *)&iph, sizeof(iph));
iph.iph_unit = IPL_LOGIPF;
iph.iph_type = IPHASH_LOOKUP;
*iph.iph_name = '\0';
if (load_hash(&iph, top, ipfioctl[IPL_LOGLOOKUP]) == 0)
sscanf(iph.iph_name, "%u", &num);
else
num = 0;
while ((n = top) != NULL) {
top = n->ipe_next;
free(n);
}
return num;
}
void ipf_addrule(fd, ioctlfunc, ptr)
int fd;
ioctlfunc_t ioctlfunc;
void *ptr;
{
ioctlcmd_t add, del;
frentry_t *fr;
ipfobj_t obj;
if (ptr == NULL)
return;
fr = ptr;
add = 0;
del = 0;
bzero((char *)&obj, sizeof(obj));
obj.ipfo_rev = IPFILTER_VERSION;
obj.ipfo_size = sizeof(*fr);
obj.ipfo_type = IPFOBJ_FRENTRY;
obj.ipfo_ptr = ptr;
if ((opts & OPT_DONOTHING) != 0)
fd = -1;
if (opts & OPT_ZERORULEST) {
add = SIOCZRLST;
} else if (opts & OPT_INACTIVE) {
add = (u_int)fr->fr_hits ? SIOCINIFR :
SIOCADIFR;
del = SIOCRMIFR;
} else {
add = (u_int)fr->fr_hits ? SIOCINAFR :
SIOCADAFR;
del = SIOCRMAFR;
}
if ((opts & OPT_OUTQUE) != 0)
fr->fr_flags |= FR_OUTQUE;
if (fr->fr_hits)
fr->fr_hits--;
if ((opts & OPT_VERBOSE) != 0)
printfr(fr, ioctlfunc);
if ((opts & OPT_DEBUG) != 0) {
binprint(fr, sizeof(*fr));
if (fr->fr_data != NULL)
binprint(fr->fr_data, fr->fr_dsize);
}
if ((opts & OPT_ZERORULEST) != 0) {
if ((*ioctlfunc)(fd, add, (void *)&obj) == -1) {
if ((opts & OPT_DONOTHING) == 0) {
fprintf(stderr, "%d:", yylineNum);
perror("ioctl(SIOCZRLST)");
}
} else {
#ifdef USE_QUAD_T
printf("hits %qd bytes %qd ",
(long long)fr->fr_hits,
(long long)fr->fr_bytes);
#else
printf("hits %ld bytes %ld ",
fr->fr_hits, fr->fr_bytes);
#endif
printfr(fr, ioctlfunc);
}
} else if ((opts & OPT_REMOVE) != 0) {
if ((*ioctlfunc)(fd, del, (void *)&obj) == -1) {
if ((opts & OPT_DONOTHING) != 0) {
fprintf(stderr, "%d:", yylineNum);
perror("ioctl(delete rule)");
}
}
} else {
if ((*ioctlfunc)(fd, add, (void *)&obj) == -1) {
if (!(opts & OPT_DONOTHING)) {
fprintf(stderr, "%d:", yylineNum);
perror("ioctl(add/insert rule)");
}
}
}
}
static void setsyslog()
{
yysetdict(logwords);
yybreakondot = 1;
}
static void unsetsyslog()
{
yyresetdict();
yybreakondot = 0;
}
static void fillgroup(fr)
frentry_t *fr;
{
frentry_t *f;
for (f = frold; f != NULL; f = f->fr_next)
if (strncmp(f->fr_grhead, fr->fr_group, FR_GROUPLEN) == 0)
break;
if (f == NULL)
return;
/*
* Only copy down matching fields if the rules are of the same type
* and are of ipf type. The only fields that are copied are those
* that impact the rule parsing itself, eg. need for knowing what the
* protocol should be for rules with port comparisons in them.
*/
if (f->fr_type != fr->fr_type || f->fr_type != FR_T_IPF)
return;
if (fr->fr_v == 0 && f->fr_v != 0)
fr->fr_v = f->fr_v;
if (fr->fr_mproto == 0 && f->fr_mproto != 0)
fr->fr_mproto = f->fr_mproto;
if (fr->fr_proto == 0 && f->fr_proto != 0)
fr->fr_proto = f->fr_proto;
if ((fr->fr_mproto == 0) && ((fr->fr_flx & FI_TCPUDP) == 0) &&
((f->fr_flx & FI_TCPUDP) != 0))
fr->fr_flx |= FI_TCPUDP;
}