File: | src/sbin/pfctl/obj/parse.c |
Warning: | line 7061, column 8 Null pointer passed as 2nd argument to string copy function |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | #include <stdlib.h> | |||
2 | #include <string.h> | |||
3 | #define YYBYACC1 1 | |||
4 | #define YYMAJOR1 1 | |||
5 | #define YYMINOR9 9 | |||
6 | #define YYLEXyylex() yylex() | |||
7 | #define YYEMPTY-1 -1 | |||
8 | #define yyclearin(yychar=(-1)) (yychar=(YYEMPTY-1)) | |||
9 | #define yyerrok(yyerrflag=0) (yyerrflag=0) | |||
10 | #define YYRECOVERING()(yyerrflag!=0) (yyerrflag!=0) | |||
11 | #define YYPREFIX"yy" "yy" | |||
12 | #line 30 "/usr/src/sbin/pfctl/parse.y" | |||
13 | #include <sys/types.h> | |||
14 | #include <sys/socket.h> | |||
15 | #include <sys/stat.h> | |||
16 | #include <sys/sysctl.h> | |||
17 | #include <net/if.h> | |||
18 | #include <netinet/in.h> | |||
19 | #include <netinet/ip.h> | |||
20 | #include <netinet/ip_icmp.h> | |||
21 | #include <netinet/icmp6.h> | |||
22 | #include <net/pfvar.h> | |||
23 | #include <arpa/inet.h> | |||
24 | ||||
25 | #include <stdio.h> | |||
26 | #include <unistd.h> | |||
27 | #include <stdlib.h> | |||
28 | #include <netdb.h> | |||
29 | #include <stdarg.h> | |||
30 | #include <errno(*__errno()).h> | |||
31 | #include <string.h> | |||
32 | #include <ctype.h> | |||
33 | #include <math.h> | |||
34 | #include <err.h> | |||
35 | #include <limits.h> | |||
36 | #include <pwd.h> | |||
37 | #include <grp.h> | |||
38 | #include <md5.h> | |||
39 | ||||
40 | #include "pfctl_parser.h" | |||
41 | #include "pfctl.h" | |||
42 | ||||
43 | static struct pfctl *pf = NULL((void *)0); | |||
44 | static int debug = 0; | |||
45 | static u_int16_t returnicmpdefault = | |||
46 | (ICMP_UNREACH3 << 8) | ICMP_UNREACH_PORT3; | |||
47 | static u_int16_t returnicmp6default = | |||
48 | (ICMP6_DST_UNREACH1 << 8) | ICMP6_DST_UNREACH_NOPORT4; | |||
49 | static int blockpolicy = PFRULE_DROP0x0000; | |||
50 | static int default_statelock; | |||
51 | ||||
52 | TAILQ_HEAD(files, file)struct files { struct file *tqh_first; struct file **tqh_last ; } files = TAILQ_HEAD_INITIALIZER(files){ ((void *)0), &(files).tqh_first }; | |||
53 | static struct file { | |||
54 | TAILQ_ENTRY(file)struct { struct file *tqe_next; struct file **tqe_prev; } entry; | |||
55 | FILE *stream; | |||
56 | char *name; | |||
57 | size_t ungetpos; | |||
58 | size_t ungetsize; | |||
59 | u_char *ungetbuf; | |||
60 | int eof_reached; | |||
61 | int lineno; | |||
62 | int errors; | |||
63 | } *file, *topfile; | |||
64 | struct file *pushfile(const char *, int); | |||
65 | int popfile(void); | |||
66 | int check_file_secrecy(int, const char *); | |||
67 | int yyparse(void); | |||
68 | int yylex(void); | |||
69 | int yyerror(const char *, ...) | |||
70 | __attribute__((__format__ (printf, 1, 2))) | |||
71 | __attribute__((__nonnull__ (1))); | |||
72 | int kw_cmp(const void *, const void *); | |||
73 | int lookup(char *); | |||
74 | int igetc(void); | |||
75 | int lgetc(int); | |||
76 | void lungetc(int); | |||
77 | int findeol(void); | |||
78 | ||||
79 | TAILQ_HEAD(symhead, sym)struct symhead { struct sym *tqh_first; struct sym **tqh_last ; } symhead = TAILQ_HEAD_INITIALIZER(symhead){ ((void *)0), &(symhead).tqh_first }; | |||
80 | struct sym { | |||
81 | TAILQ_ENTRY(sym)struct { struct sym *tqe_next; struct sym **tqe_prev; } entry; | |||
82 | int used; | |||
83 | int persist; | |||
84 | char *nam; | |||
85 | char *val; | |||
86 | }; | |||
87 | int symset(const char *, const char *, int); | |||
88 | char *symget(const char *); | |||
89 | ||||
90 | int atoul(char *, u_long *); | |||
91 | ||||
92 | struct node_proto { | |||
93 | u_int8_t proto; | |||
94 | struct node_proto *next; | |||
95 | struct node_proto *tail; | |||
96 | }; | |||
97 | ||||
98 | struct node_port { | |||
99 | u_int16_t port[2]; | |||
100 | u_int8_t op; | |||
101 | struct node_port *next; | |||
102 | struct node_port *tail; | |||
103 | }; | |||
104 | ||||
105 | struct node_uid { | |||
106 | uid_t uid[2]; | |||
107 | u_int8_t op; | |||
108 | struct node_uid *next; | |||
109 | struct node_uid *tail; | |||
110 | }; | |||
111 | ||||
112 | struct node_gid { | |||
113 | gid_t gid[2]; | |||
114 | u_int8_t op; | |||
115 | struct node_gid *next; | |||
116 | struct node_gid *tail; | |||
117 | }; | |||
118 | ||||
119 | struct node_icmp { | |||
120 | u_int16_t code; /* aux. value 256 is legit */ | |||
121 | u_int16_t type; /* aux. value 256 is legit */ | |||
122 | u_int8_t proto; | |||
123 | struct node_icmp *next; | |||
124 | struct node_icmp *tail; | |||
125 | }; | |||
126 | ||||
127 | enum { PF_STATE_OPT_MAX, PF_STATE_OPT_NOSYNC, PF_STATE_OPT_SRCTRACK, | |||
128 | PF_STATE_OPT_MAX_SRC_STATES, PF_STATE_OPT_MAX_SRC_CONN, | |||
129 | PF_STATE_OPT_MAX_SRC_CONN_RATE, PF_STATE_OPT_MAX_SRC_NODES, | |||
130 | PF_STATE_OPT_OVERLOAD, PF_STATE_OPT_STATELOCK, | |||
131 | PF_STATE_OPT_TIMEOUT, PF_STATE_OPT_SLOPPY, | |||
132 | PF_STATE_OPT_PFLOW }; | |||
133 | ||||
134 | enum { PF_SRCTRACK_NONE, PF_SRCTRACK, PF_SRCTRACK_GLOBAL, PF_SRCTRACK_RULE }; | |||
135 | ||||
136 | struct node_state_opt { | |||
137 | int type; | |||
138 | union { | |||
139 | u_int32_t max_states; | |||
140 | u_int32_t max_src_states; | |||
141 | u_int32_t max_src_conn; | |||
142 | struct { | |||
143 | u_int32_t limit; | |||
144 | u_int32_t seconds; | |||
145 | } max_src_conn_rate; | |||
146 | struct { | |||
147 | u_int8_t flush; | |||
148 | char tblname[PF_TABLE_NAME_SIZE32]; | |||
149 | } overload; | |||
150 | u_int32_t max_src_nodes; | |||
151 | u_int8_t src_track; | |||
152 | u_int32_t statelock; | |||
153 | struct { | |||
154 | int number; | |||
155 | u_int32_t seconds; | |||
156 | } timeout; | |||
157 | } data; | |||
158 | struct node_state_opt *next; | |||
159 | struct node_state_opt *tail; | |||
160 | }; | |||
161 | ||||
162 | struct peer { | |||
163 | struct node_host *host; | |||
164 | struct node_port *port; | |||
165 | }; | |||
166 | ||||
167 | struct node_queue { | |||
168 | char queue[PF_QNAME_SIZE64]; | |||
169 | char parent[PF_QNAME_SIZE64]; | |||
170 | char ifname[IFNAMSIZ16]; | |||
171 | int scheduler; | |||
172 | struct node_queue *next; | |||
173 | struct node_queue *tail; | |||
174 | }; | |||
175 | ||||
176 | struct node_qassign { | |||
177 | char *qname; | |||
178 | char *pqname; | |||
179 | }; | |||
180 | ||||
181 | struct range { | |||
182 | int a; | |||
183 | int b; | |||
184 | int t; | |||
185 | }; | |||
186 | struct redirection { | |||
187 | struct node_host *host; | |||
188 | struct range rport; | |||
189 | }; | |||
190 | ||||
191 | struct pool_opts { | |||
192 | int marker; | |||
193 | #define POM_TYPE0x01 0x01 | |||
194 | #define POM_STICKYADDRESS0x02 0x02 | |||
195 | u_int8_t opts; | |||
196 | int type; | |||
197 | int staticport; | |||
198 | struct pf_poolhashkey *key; | |||
199 | ||||
200 | } pool_opts; | |||
201 | ||||
202 | struct divertspec { | |||
203 | struct node_host *addr; | |||
204 | u_int16_t port; | |||
205 | enum pf_divert_types type; | |||
206 | }; | |||
207 | ||||
208 | struct redirspec { | |||
209 | struct redirection *rdr; | |||
210 | struct pool_opts pool_opts; | |||
211 | int binat; | |||
212 | int af; | |||
213 | }; | |||
214 | ||||
215 | struct filter_opts { | |||
216 | int marker; | |||
217 | #define FOM_FLAGS0x0001 0x0001 | |||
218 | #define FOM_ICMP0x0002 0x0002 | |||
219 | #define FOM_TOS0x0004 0x0004 | |||
220 | #define FOM_KEEP0x0008 0x0008 | |||
221 | #define FOM_SRCTRACK0x0010 0x0010 | |||
222 | #define FOM_MINTTL0x0020 0x0020 | |||
223 | #define FOM_MAXMSS0x0040 0x0040 | |||
224 | #define FOM_AFTO0x0080 0x0080 | |||
225 | #define FOM_SETTOS0x0100 0x0100 | |||
226 | #define FOM_SCRUB_TCP0x0200 0x0200 | |||
227 | #define FOM_SETPRIO0x0400 0x0400 | |||
228 | #define FOM_ONCE0x1000 0x1000 | |||
229 | #define FOM_PRIO0x2000 0x2000 | |||
230 | #define FOM_SETDELAY0x4000 0x4000 | |||
231 | struct node_uid *uid; | |||
232 | struct node_gid *gid; | |||
233 | struct node_if *rcv; | |||
234 | struct { | |||
235 | u_int8_t b1; | |||
236 | u_int8_t b2; | |||
237 | u_int16_t w; | |||
238 | u_int16_t w2; | |||
239 | } flags; | |||
240 | struct node_icmp *icmpspec; | |||
241 | u_int32_t tos; | |||
242 | u_int32_t prob; | |||
243 | struct { | |||
244 | int action; | |||
245 | struct node_state_opt *options; | |||
246 | } keep; | |||
247 | int fragment; | |||
248 | int allowopts; | |||
249 | char *label; | |||
250 | struct node_qassign queues; | |||
251 | char *tag; | |||
252 | char *match_tag; | |||
253 | u_int8_t match_tag_not; | |||
254 | u_int rtableid; | |||
255 | u_int8_t prio; | |||
256 | u_int8_t set_prio[2]; | |||
257 | u_int16_t delay; | |||
258 | struct divertspec divert; | |||
259 | struct redirspec nat; | |||
260 | struct redirspec rdr; | |||
261 | struct redirspec rroute; | |||
262 | u_int8_t rt; | |||
263 | ||||
264 | /* scrub opts */ | |||
265 | int nodf; | |||
266 | int minttl; | |||
267 | int settos; | |||
268 | int randomid; | |||
269 | int max_mss; | |||
270 | ||||
271 | struct { | |||
272 | u_int32_t limit; | |||
273 | u_int32_t seconds; | |||
274 | } pktrate; | |||
275 | } filter_opts; | |||
276 | ||||
277 | struct antispoof_opts { | |||
278 | char *label; | |||
279 | u_int rtableid; | |||
280 | } antispoof_opts; | |||
281 | ||||
282 | struct scrub_opts { | |||
283 | int marker; | |||
284 | int nodf; | |||
285 | int minttl; | |||
286 | int maxmss; | |||
287 | int randomid; | |||
288 | int reassemble_tcp; | |||
289 | } scrub_opts; | |||
290 | ||||
291 | struct node_sc { | |||
292 | struct node_queue_bw m1; | |||
293 | u_int d; | |||
294 | struct node_queue_bw m2; | |||
295 | }; | |||
296 | ||||
297 | struct node_fq { | |||
298 | u_int flows; | |||
299 | u_int quantum; | |||
300 | u_int target; | |||
301 | u_int interval; | |||
302 | }; | |||
303 | ||||
304 | struct queue_opts { | |||
305 | int marker; | |||
306 | #define QOM_BWSPEC0x01 0x01 | |||
307 | #define QOM_PARENT0x02 0x02 | |||
308 | #define QOM_DEFAULT0x04 0x04 | |||
309 | #define QOM_QLIMIT0x08 0x08 | |||
310 | #define QOM_FLOWS0x10 0x10 | |||
311 | #define QOM_QUANTUM0x20 0x20 | |||
312 | struct node_sc realtime; | |||
313 | struct node_sc linkshare; | |||
314 | struct node_sc upperlimit; | |||
315 | struct node_fq flowqueue; | |||
316 | char *parent; | |||
317 | int flags; | |||
318 | u_int qlimit; | |||
319 | } queue_opts; | |||
320 | ||||
321 | struct table_opts { | |||
322 | int flags; | |||
323 | int init_addr; | |||
324 | struct node_tinithead init_nodes; | |||
325 | } table_opts; | |||
326 | ||||
327 | struct node_hfsc_opts hfsc_opts; | |||
328 | struct node_state_opt *keep_state_defaults = NULL((void *)0); | |||
329 | struct pfctl_watermarks syncookie_opts; | |||
330 | ||||
331 | int validate_range(u_int8_t, u_int16_t, u_int16_t); | |||
332 | int disallow_table(struct node_host *, const char *); | |||
333 | int disallow_urpf_failed(struct node_host *, const char *); | |||
334 | int disallow_alias(struct node_host *, const char *); | |||
335 | int rule_consistent(struct pf_rule *); | |||
336 | int process_tabledef(char *, struct table_opts *, int); | |||
337 | void expand_label_str(char *, size_t, const char *, const char *); | |||
338 | void expand_label_if(const char *, char *, size_t, const char *); | |||
339 | void expand_label_addr(const char *, char *, size_t, u_int8_t, | |||
340 | struct node_host *); | |||
341 | void expand_label_port(const char *, char *, size_t, | |||
342 | struct node_port *); | |||
343 | void expand_label_proto(const char *, char *, size_t, u_int8_t); | |||
344 | void expand_label(char *, size_t, const char *, u_int8_t, | |||
345 | struct node_host *, struct node_port *, struct node_host *, | |||
346 | struct node_port *, u_int8_t); | |||
347 | int expand_divertspec(struct pf_rule *, struct divertspec *); | |||
348 | int collapse_redirspec(struct pf_pool *, struct pf_rule *, | |||
349 | struct redirspec *rs, int); | |||
350 | int apply_redirspec(struct pf_pool *, struct pf_rule *, | |||
351 | struct redirspec *, int, struct node_port *); | |||
352 | void expand_rule(struct pf_rule *, int, struct node_if *, | |||
353 | struct redirspec *, struct redirspec *, struct redirspec *, | |||
354 | struct node_proto *, | |||
355 | struct node_os *, struct node_host *, struct node_port *, | |||
356 | struct node_host *, struct node_port *, struct node_uid *, | |||
357 | struct node_gid *, struct node_if *, struct node_icmp *); | |||
358 | int expand_queue(char *, struct node_if *, struct queue_opts *); | |||
359 | int expand_skip_interface(struct node_if *); | |||
360 | ||||
361 | int getservice(char *); | |||
362 | int rule_label(struct pf_rule *, char *); | |||
363 | ||||
364 | void mv_rules(struct pf_ruleset *, struct pf_ruleset *); | |||
365 | void decide_address_family(struct node_host *, sa_family_t *); | |||
366 | int invalid_redirect(struct node_host *, sa_family_t); | |||
367 | u_int16_t parseicmpspec(char *, sa_family_t); | |||
368 | int kw_casecmp(const void *, const void *); | |||
369 | int map_tos(char *string, int *); | |||
370 | int lookup_rtable(u_int); | |||
371 | int filteropts_to_rule(struct pf_rule *, struct filter_opts *); | |||
372 | ||||
373 | TAILQ_HEAD(loadanchorshead, loadanchors)struct loadanchorshead { struct loadanchors *tqh_first; struct loadanchors **tqh_last; } | |||
374 | loadanchorshead = TAILQ_HEAD_INITIALIZER(loadanchorshead){ ((void *)0), &(loadanchorshead).tqh_first }; | |||
375 | ||||
376 | struct loadanchors { | |||
377 | TAILQ_ENTRY(loadanchors)struct { struct loadanchors *tqe_next; struct loadanchors **tqe_prev ; } entries; | |||
378 | char *anchorname; | |||
379 | char *filename; | |||
380 | }; | |||
381 | ||||
382 | typedef struct { | |||
383 | union { | |||
384 | int64_t number; | |||
385 | double probability; | |||
386 | int i; | |||
387 | char *string; | |||
388 | u_int rtableid; | |||
389 | u_int16_t weight; | |||
390 | struct { | |||
391 | u_int8_t b1; | |||
392 | u_int8_t b2; | |||
393 | u_int16_t w; | |||
394 | u_int16_t w2; | |||
395 | } b; | |||
396 | struct range range; | |||
397 | struct node_if *interface; | |||
398 | struct node_proto *proto; | |||
399 | struct node_icmp *icmp; | |||
400 | struct node_host *host; | |||
401 | struct node_os *os; | |||
402 | struct node_port *port; | |||
403 | struct node_uid *uid; | |||
404 | struct node_gid *gid; | |||
405 | struct node_state_opt *state_opt; | |||
406 | struct peer peer; | |||
407 | struct { | |||
408 | struct peer src, dst; | |||
409 | struct node_os *src_os; | |||
410 | } fromto; | |||
411 | struct redirection *redirection; | |||
412 | struct { | |||
413 | int action; | |||
414 | struct node_state_opt *options; | |||
415 | } keep_state; | |||
416 | struct { | |||
417 | u_int8_t log; | |||
418 | u_int8_t logif; | |||
419 | u_int8_t quick; | |||
420 | } logquick; | |||
421 | struct { | |||
422 | int neg; | |||
423 | char *name; | |||
424 | } tagged; | |||
425 | struct pf_poolhashkey *hashkey; | |||
426 | struct node_queue *queue; | |||
427 | struct node_queue_opt queue_options; | |||
428 | struct node_queue_bw queue_bwspec; | |||
429 | struct node_qassign qassign; | |||
430 | struct node_sc sc; | |||
431 | struct filter_opts filter_opts; | |||
432 | struct antispoof_opts antispoof_opts; | |||
433 | struct queue_opts queue_opts; | |||
434 | struct scrub_opts scrub_opts; | |||
435 | struct table_opts table_opts; | |||
436 | struct pool_opts pool_opts; | |||
437 | struct node_hfsc_opts hfsc_opts; | |||
438 | struct pfctl_watermarks *watermarks; | |||
439 | } v; | |||
440 | int lineno; | |||
441 | } YYSTYPE; | |||
442 | ||||
443 | #define PPORT_RANGE1 1 | |||
444 | #define PPORT_STAR2 2 | |||
445 | int parseport(char *, struct range *r, int); | |||
446 | ||||
447 | #define DYNIF_MULTIADDR(addr)((addr).type == PF_ADDR_DYNIFTL && (!((addr).iflags & 0x08) || !isdigit((unsigned char)(addr).v.ifname[strlen((addr ).v.ifname)-1]))) ((addr).type == PF_ADDR_DYNIFTL && \ | |||
448 | (!((addr).iflags & PFI_AFLAG_NOALIAS0x08) || \ | |||
449 | !isdigit((unsigned char)(addr).v.ifname[strlen((addr).v.ifname)-1]))) | |||
450 | ||||
451 | #line 452 "parse.c" | |||
452 | #define PASS257 257 | |||
453 | #define BLOCK258 258 | |||
454 | #define MATCH259 259 | |||
455 | #define SCRUB260 260 | |||
456 | #define RETURN261 261 | |||
457 | #define IN262 262 | |||
458 | #define OS263 263 | |||
459 | #define OUT264 264 | |||
460 | #define LOG265 265 | |||
461 | #define QUICK266 266 | |||
462 | #define ON267 267 | |||
463 | #define FROM268 268 | |||
464 | #define TO269 269 | |||
465 | #define FLAGS270 270 | |||
466 | #define RETURNRST271 271 | |||
467 | #define RETURNICMP272 272 | |||
468 | #define RETURNICMP6273 273 | |||
469 | #define PROTO274 274 | |||
470 | #define INET275 275 | |||
471 | #define INET6276 276 | |||
472 | #define ALL277 277 | |||
473 | #define ANY278 278 | |||
474 | #define ICMPTYPE279 279 | |||
475 | #define ICMP6TYPE280 280 | |||
476 | #define CODE281 281 | |||
477 | #define KEEP282 282 | |||
478 | #define MODULATE283 283 | |||
479 | #define STATE284 284 | |||
480 | #define PORT285 285 | |||
481 | #define BINATTO286 286 | |||
482 | #define NODF287 287 | |||
483 | #define MINTTL288 288 | |||
484 | #define ERROR289 289 | |||
485 | #define ALLOWOPTS290 290 | |||
486 | #define FILENAME291 291 | |||
487 | #define ROUTETO292 292 | |||
488 | #define DUPTO293 293 | |||
489 | #define REPLYTO294 294 | |||
490 | #define NO295 295 | |||
491 | #define LABEL296 296 | |||
492 | #define NOROUTE297 297 | |||
493 | #define URPFFAILED298 298 | |||
494 | #define FRAGMENT299 299 | |||
495 | #define USER300 300 | |||
496 | #define GROUP301 301 | |||
497 | #define MAXMSS302 302 | |||
498 | #define MAXIMUM303 303 | |||
499 | #define TTL304 304 | |||
500 | #define TOS305 305 | |||
501 | #define DROP306 306 | |||
502 | #define TABLE307 307 | |||
503 | #define REASSEMBLE308 308 | |||
504 | #define ANCHOR309 309 | |||
505 | #define SYNCOOKIES310 310 | |||
506 | #define SET311 311 | |||
507 | #define OPTIMIZATION312 312 | |||
508 | #define TIMEOUT313 313 | |||
509 | #define LIMIT314 314 | |||
510 | #define LOGINTERFACE315 315 | |||
511 | #define BLOCKPOLICY316 316 | |||
512 | #define RANDOMID317 317 | |||
513 | #define SYNPROXY318 318 | |||
514 | #define FINGERPRINTS319 319 | |||
515 | #define NOSYNC320 320 | |||
516 | #define DEBUG321 321 | |||
517 | #define SKIP322 322 | |||
518 | #define HOSTID323 323 | |||
519 | #define ANTISPOOF324 324 | |||
520 | #define FOR325 325 | |||
521 | #define INCLUDE326 326 | |||
522 | #define MATCHES327 327 | |||
523 | #define BITMASK328 328 | |||
524 | #define RANDOM329 329 | |||
525 | #define SOURCEHASH330 330 | |||
526 | #define ROUNDROBIN331 331 | |||
527 | #define LEASTSTATES332 332 | |||
528 | #define STATICPORT333 333 | |||
529 | #define PROBABILITY334 334 | |||
530 | #define WEIGHT335 335 | |||
531 | #define BANDWIDTH336 336 | |||
532 | #define FLOWS337 337 | |||
533 | #define QUANTUM338 338 | |||
534 | #define QUEUE339 339 | |||
535 | #define PRIORITY340 340 | |||
536 | #define QLIMIT341 341 | |||
537 | #define RTABLE342 342 | |||
538 | #define RDOMAIN343 343 | |||
539 | #define MINIMUM344 344 | |||
540 | #define BURST345 345 | |||
541 | #define PARENT346 346 | |||
542 | #define LOAD347 347 | |||
543 | #define RULESET_OPTIMIZATION348 348 | |||
544 | #define PRIO349 349 | |||
545 | #define ONCE350 350 | |||
546 | #define DEFAULT351 351 | |||
547 | #define DELAY352 352 | |||
548 | #define STICKYADDRESS353 353 | |||
549 | #define MAXSRCSTATES354 354 | |||
550 | #define MAXSRCNODES355 355 | |||
551 | #define SOURCETRACK356 356 | |||
552 | #define GLOBAL357 357 | |||
553 | #define RULE358 358 | |||
554 | #define MAXSRCCONN359 359 | |||
555 | #define MAXSRCCONNRATE360 360 | |||
556 | #define OVERLOAD361 361 | |||
557 | #define FLUSH362 362 | |||
558 | #define SLOPPY363 363 | |||
559 | #define PFLOW364 364 | |||
560 | #define MAXPKTRATE365 365 | |||
561 | #define TAGGED366 366 | |||
562 | #define TAG367 367 | |||
563 | #define IFBOUND368 368 | |||
564 | #define FLOATING369 369 | |||
565 | #define STATEPOLICY370 370 | |||
566 | #define STATEDEFAULTS371 371 | |||
567 | #define ROUTE372 372 | |||
568 | #define DIVERTTO373 373 | |||
569 | #define DIVERTREPLY374 374 | |||
570 | #define DIVERTPACKET375 375 | |||
571 | #define NATTO376 376 | |||
572 | #define AFTO377 377 | |||
573 | #define RDRTO378 378 | |||
574 | #define RECEIVEDON379 379 | |||
575 | #define NE380 380 | |||
576 | #define LE381 381 | |||
577 | #define GE382 382 | |||
578 | #define STRING383 383 | |||
579 | #define NUMBER384 384 | |||
580 | #define PORTBINARY385 385 | |||
581 | #define YYERRCODE256 256 | |||
582 | const short yylhs[] = | |||
583 | { -1, | |||
584 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
585 | 0, 0, 0, 114, 123, 123, 123, 123, 18, 13, | |||
586 | 13, 115, 115, 115, 115, 115, 115, 115, 115, 115, | |||
587 | 115, 115, 115, 115, 115, 115, 115, 115, 115, 19, | |||
588 | 113, 129, 113, 130, 130, 132, 71, 71, 73, 73, | |||
589 | 74, 74, 75, 75, 120, 72, 72, 133, 133, 133, | |||
590 | 133, 133, 135, 134, 134, 117, 118, 136, 104, 106, | |||
591 | 106, 105, 105, 105, 105, 105, 121, 85, 85, 86, | |||
592 | 86, 87, 87, 137, 96, 96, 98, 98, 97, 97, | |||
593 | 11, 11, 122, 138, 107, 107, 109, 109, 108, 108, | |||
594 | 108, 108, 54, 54, 53, 53, 119, 139, 99, 101, | |||
595 | 101, 100, 100, 100, 100, 100, 100, 102, 102, 102, | |||
596 | 102, 102, 103, 103, 89, 89, 116, 140, 90, 90, | |||
597 | 92, 92, 91, 91, 91, 91, 91, 91, 91, 91, | |||
598 | 91, 91, 91, 91, 91, 91, 91, 91, 91, 91, | |||
599 | 91, 91, 91, 91, 91, 91, 91, 91, 91, 91, | |||
600 | 91, 91, 91, 93, 93, 95, 95, 94, 94, 94, | |||
601 | 94, 28, 28, 14, 14, 24, 24, 24, 27, 27, | |||
602 | 27, 27, 27, 27, 27, 27, 27, 27, 42, 42, | |||
603 | 43, 43, 16, 16, 16, 81, 81, 80, 80, 80, | |||
604 | 80, 80, 82, 82, 83, 83, 84, 84, 84, 84, | |||
605 | 1, 1, 1, 2, 2, 3, 4, 4, 4, 17, | |||
606 | 17, 17, 33, 33, 33, 34, 34, 35, 36, 36, | |||
607 | 44, 44, 57, 57, 57, 58, 59, 59, 46, 46, | |||
608 | 47, 47, 45, 45, 45, 125, 125, 48, 48, 48, | |||
609 | 52, 52, 49, 49, 49, 15, 15, 50, 50, 50, | |||
610 | 50, 50, 50, 50, 50, 5, 5, 51, 60, 60, | |||
611 | 61, 61, 62, 62, 62, 29, 31, 63, 63, 64, | |||
612 | 64, 65, 65, 65, 8, 8, 66, 66, 67, 67, | |||
613 | 68, 68, 68, 9, 9, 26, 25, 25, 25, 37, | |||
614 | 37, 37, 37, 38, 38, 40, 40, 39, 39, 39, | |||
615 | 41, 41, 41, 6, 6, 7, 7, 10, 10, 20, | |||
616 | 20, 20, 23, 23, 76, 76, 76, 76, 21, 21, | |||
617 | 21, 77, 77, 78, 78, 79, 79, 79, 79, 79, | |||
618 | 79, 79, 79, 79, 79, 79, 79, 70, 88, 88, | |||
619 | 88, 30, 56, 56, 55, 55, 69, 69, 32, 32, | |||
620 | 142, 110, 110, 112, 112, 111, 111, 111, 111, 111, | |||
621 | 111, 111, 141, 124, 126, 126, 127, 128, 128, 131, | |||
622 | 131, 12, 12, 22, 22, 22, 22, 22, 22, | |||
623 | }; | |||
624 | const short yylen[] = | |||
625 | { 2, | |||
626 | 0, 3, 2, 3, 3, 3, 3, 3, 3, 3, | |||
627 | 3, 4, 3, 2, 2, 3, 3, 3, 1, 0, | |||
628 | 1, 4, 3, 3, 3, 6, 3, 6, 3, 3, | |||
629 | 3, 3, 3, 3, 3, 3, 3, 3, 4, 1, | |||
630 | 0, 0, 4, 3, 1, 2, 1, 1, 2, 1, | |||
631 | 2, 1, 1, 1, 3, 1, 0, 0, 2, 3, | |||
632 | 3, 3, 0, 5, 0, 10, 5, 0, 2, 3, | |||
633 | 1, 1, 2, 2, 2, 1, 5, 2, 5, 2, | |||
634 | 4, 1, 3, 0, 2, 0, 2, 1, 2, 2, | |||
635 | 1, 0, 5, 0, 2, 0, 2, 1, 1, 3, | |||
636 | 4, 2, 2, 4, 2, 4, 4, 0, 2, 2, | |||
637 | 1, 3, 2, 1, 2, 2, 2, 0, 3, 3, | |||
638 | 6, 6, 1, 5, 1, 1, 8, 0, 2, 0, | |||
639 | 2, 1, 2, 2, 1, 1, 2, 2, 1, 1, | |||
640 | 1, 2, 2, 2, 3, 2, 2, 4, 1, 3, | |||
641 | 4, 3, 5, 8, 3, 3, 2, 2, 2, 3, | |||
642 | 1, 4, 1, 4, 2, 3, 1, 1, 2, 2, | |||
643 | 2, 2, 6, 1, 1, 1, 1, 2, 0, 1, | |||
644 | 1, 5, 1, 1, 4, 4, 6, 1, 1, 1, | |||
645 | 1, 1, 0, 1, 1, 0, 1, 0, 1, 1, | |||
646 | 2, 2, 1, 4, 1, 3, 1, 1, 1, 2, | |||
647 | 0, 2, 5, 2, 4, 2, 1, 1, 2, 0, | |||
648 | 1, 1, 0, 2, 5, 2, 4, 1, 1, 1, | |||
649 | 1, 3, 0, 2, 5, 1, 2, 4, 0, 2, | |||
650 | 0, 2, 1, 3, 2, 2, 0, 1, 1, 4, | |||
651 | 2, 4, 2, 2, 2, 2, 0, 1, 3, 3, | |||
652 | 3, 1, 3, 3, 2, 1, 1, 3, 1, 4, | |||
653 | 2, 4, 1, 2, 3, 1, 1, 1, 4, 2, | |||
654 | 4, 1, 2, 3, 1, 1, 1, 4, 2, 4, | |||
655 | 1, 2, 3, 1, 1, 1, 4, 3, 2, 2, | |||
656 | 5, 2, 5, 2, 4, 2, 4, 1, 3, 3, | |||
657 | 1, 3, 3, 1, 1, 1, 1, 1, 1, 0, | |||
658 | 1, 1, 1, 1, 2, 3, 3, 3, 0, 1, | |||
659 | 2, 3, 0, 1, 3, 2, 1, 2, 2, 4, | |||
660 | 5, 2, 2, 1, 1, 1, 2, 1, 1, 3, | |||
661 | 5, 1, 2, 4, 3, 5, 1, 3, 0, 1, | |||
662 | 0, 2, 0, 2, 1, 1, 1, 2, 1, 1, | |||
663 | 1, 1, 2, 2, 4, 2, 2, 4, 2, 1, | |||
664 | 0, 1, 1, 1, 1, 1, 1, 1, 1, | |||
665 | }; | |||
666 | const short yydefred[] = | |||
667 | { 0, | |||
668 | 0, 0, 0, 0, 176, 0, 177, 0, 0, 0, | |||
669 | 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, | |||
670 | 0, 0, 0, 0, 0, 0, 0, 15, 0, 0, | |||
671 | 0, 13, 188, 0, 0, 0, 180, 178, 0, 56, | |||
672 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
673 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 14, | |||
674 | 0, 0, 0, 194, 195, 0, 2, 4, 5, 6, | |||
675 | 7, 8, 9, 10, 11, 18, 12, 17, 16, 0, | |||
676 | 0, 0, 0, 0, 382, 383, 0, 40, 0, 23, | |||
677 | 0, 0, 25, 0, 0, 27, 48, 47, 29, 32, | |||
678 | 31, 33, 36, 35, 0, 37, 267, 266, 30, 0, | |||
679 | 24, 19, 323, 324, 34, 0, 337, 0, 0, 0, | |||
680 | 0, 0, 0, 345, 346, 0, 344, 0, 334, 0, | |||
681 | 202, 0, 0, 201, 108, 0, 54, 53, 55, 0, | |||
682 | 0, 0, 189, 190, 0, 191, 192, 0, 0, 197, | |||
683 | 0, 21, 22, 39, 0, 374, 0, 0, 377, 0, | |||
684 | 0, 91, 212, 0, 49, 336, 338, 342, 321, 322, | |||
685 | 343, 339, 0, 0, 347, 380, 0, 0, 207, 209, | |||
686 | 208, 0, 205, 218, 0, 217, 0, 0, 82, 78, | |||
687 | 221, 222, 0, 107, 0, 0, 51, 0, 0, 185, | |||
688 | 0, 186, 93, 0, 0, 0, 246, 0, 0, 0, | |||
689 | 0, 0, 216, 0, 0, 335, 210, 204, 0, 219, | |||
690 | 0, 0, 77, 0, 0, 0, 0, 0, 0, 114, | |||
691 | 111, 0, 67, 0, 182, 0, 0, 99, 0, 98, | |||
692 | 0, 0, 0, 0, 45, 376, 26, 0, 379, 28, | |||
693 | 0, 0, 0, 340, 0, 206, 0, 0, 83, 0, | |||
694 | 0, 88, 0, 125, 126, 0, 0, 116, 117, 115, | |||
695 | 113, 110, 0, 0, 187, 102, 0, 97, 0, 46, | |||
696 | 43, 0, 0, 0, 213, 0, 214, 0, 341, 79, | |||
697 | 0, 80, 348, 89, 90, 87, 0, 112, 0, 229, | |||
698 | 230, 0, 224, 228, 0, 231, 0, 0, 0, 100, | |||
699 | 0, 0, 0, 0, 0, 44, 375, 378, 0, 331, | |||
700 | 0, 0, 0, 0, 0, 248, 0, 0, 240, 0, | |||
701 | 249, 127, 0, 0, 0, 0, 254, 255, 0, 0, | |||
702 | 0, 0, 0, 253, 0, 0, 103, 101, 0, 105, | |||
703 | 0, 215, 81, 0, 0, 0, 0, 0, 385, 386, | |||
704 | 388, 0, 384, 387, 389, 0, 0, 245, 269, 277, | |||
705 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 141, | |||
706 | 0, 0, 0, 0, 0, 140, 0, 0, 0, 0, | |||
707 | 0, 0, 0, 0, 0, 161, 0, 0, 0, 149, | |||
708 | 0, 0, 0, 0, 0, 135, 136, 139, 132, 0, | |||
709 | 163, 236, 0, 234, 0, 232, 0, 265, 0, 0, | |||
710 | 0, 0, 0, 0, 256, 0, 63, 66, 124, 0, | |||
711 | 0, 225, 0, 226, 0, 274, 0, 0, 0, 244, | |||
712 | 68, 299, 296, 0, 0, 314, 315, 0, 0, 300, | |||
713 | 316, 317, 0, 0, 302, 0, 0, 0, 0, 0, | |||
714 | 0, 0, 157, 159, 158, 325, 142, 285, 286, 0, | |||
715 | 0, 0, 133, 278, 294, 295, 0, 0, 0, 134, | |||
716 | 287, 318, 319, 138, 0, 0, 0, 0, 0, 168, | |||
717 | 165, 0, 174, 175, 146, 349, 0, 143, 147, 137, | |||
718 | 0, 144, 0, 0, 0, 0, 0, 0, 0, 131, | |||
719 | 0, 242, 104, 260, 259, 261, 268, 264, 263, 106, | |||
720 | 0, 0, 0, 0, 0, 0, 275, 251, 250, 0, | |||
721 | 0, 0, 298, 0, 0, 0, 0, 0, 0, 326, | |||
722 | 327, 0, 353, 0, 156, 0, 373, 0, 0, 283, | |||
723 | 0, 0, 292, 170, 169, 172, 0, 171, 167, 0, | |||
724 | 328, 0, 0, 0, 150, 276, 152, 0, 155, 145, | |||
725 | 160, 0, 0, 58, 122, 121, 227, 270, 0, 271, | |||
726 | 0, 151, 72, 0, 0, 0, 76, 71, 0, 297, | |||
727 | 0, 0, 309, 310, 0, 0, 312, 313, 0, 0, | |||
728 | 0, 358, 352, 366, 367, 0, 369, 370, 371, 372, | |||
729 | 365, 0, 0, 0, 284, 0, 0, 293, 0, 164, | |||
730 | 0, 350, 0, 162, 148, 0, 237, 235, 0, 0, | |||
731 | 0, 252, 73, 74, 75, 0, 301, 0, 304, 303, | |||
732 | 0, 306, 332, 0, 354, 0, 368, 360, 364, 279, | |||
733 | 0, 280, 288, 0, 289, 0, 166, 0, 0, 0, | |||
734 | 59, 64, 0, 0, 0, 272, 70, 0, 0, 355, | |||
735 | 0, 0, 0, 0, 351, 0, 238, 62, 60, 61, | |||
736 | 305, 307, 0, 281, 290, 173, 0, 356, 154, | |||
737 | }; | |||
738 | const short yydgoto[] = | |||
739 | { 2, | |||
740 | 106, 252, 163, 189, 109, 449, 454, 471, 478, 484, | |||
741 | 311, 87, 153, 495, 347, 66, 193, 111, 89, 171, | |||
742 | 289, 366, 127, 17, 406, 445, 38, 490, 565, 602, | |||
743 | 367, 647, 274, 357, 303, 304, 407, 591, 450, 595, | |||
744 | 455, 145, 148, 307, 329, 308, 416, 330, 331, 459, | |||
745 | 345, 439, 313, 314, 601, 460, 335, 414, 573, 368, | |||
746 | 525, 369, 473, 613, 474, 480, 616, 481, 461, 294, | |||
747 | 99, 41, 112, 139, 370, 408, 540, 128, 129, 58, | |||
748 | 151, 59, 182, 183, 133, 257, 190, 498, 266, 332, | |||
749 | 409, 410, 411, 491, 560, 223, 262, 263, 194, 231, | |||
750 | 232, 298, 267, 531, 588, 589, 203, 240, 241, 545, | |||
751 | 611, 612, 154, 18, 19, 20, 21, 22, 23, 24, | |||
752 | 25, 26, 3, 93, 158, 209, 96, 211, 155, 244, | |||
753 | 177, 245, 630, 428, 521, 532, 224, 204, 195, 333, | |||
754 | 463, 546, | |||
755 | }; | |||
756 | const short yysindex[] = | |||
757 | { -21, | |||
758 | 0, 300, 47, 59, 0, 389, 0, 52, -263, 3644, | |||
759 | -128, -172, -145, -27, 205, 0, 159, 267, 297, 316, | |||
760 | 380, 393, 404, 420, 424, 432, 437, 0, 454, 458, | |||
761 | 460, 0, 0, 277, 341, 416, 0, 0, 89, 0, | |||
762 | 159, -195, 93, 114, -81, -65, -224, -51, 125, -158, | |||
763 | 191, 118, 135, 175, 1200, 487, 258, 214, 294, 0, | |||
764 | 191, -263, 229, 0, 0, -128, 0, 0, 0, 0, | |||
765 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 245, | |||
766 | 236, 239, 500, 304, 0, 0, 291, 0, 0, 0, | |||
767 | 221, 582, 0, 231, 582, 0, 0, 0, 0, 0, | |||
768 | 0, 0, 0, 0, 58, 0, 0, 0, 0, 135, | |||
769 | 0, 0, 0, 0, 0, 279, 0, 289, 301, 272, | |||
770 | 312, 322, 534, 0, 0, 326, 0, 644, 0, -29, | |||
771 | 0, -24, 365, 0, 0, 445, 0, 0, 0, 229, | |||
772 | 191, 348, 0, 0, 208, 0, 0, 711, 0, 0, | |||
773 | 191, 0, 0, 0, 714, 0, 582, 372, 0, 386, | |||
774 | 582, 0, 0, -196, 0, 0, 0, 0, 0, 0, | |||
775 | 0, 0, 725, 387, 0, 0, 1200, 135, 0, 0, | |||
776 | 0, 399, 0, 0, 390, 0, 582, -196, 0, 0, | |||
777 | 0, 0, 0, 0, 715, 135, 0, 365, 732, 0, | |||
778 | 239, 0, 0, -92, 365, 397, 0, 582, 10, 582, | |||
779 | 82, 743, 0, 409, 736, 0, 0, 0, -29, 0, | |||
780 | -11, 768, 0, -208, 265, 426, 427, 430, 440, 0, | |||
781 | 0, 715, 0, 541, 0, 784, 447, 0, 582, 0, | |||
782 | -92, 541, 455, 408, 0, 0, 0, 372, 0, 0, | |||
783 | 386, 105, 582, 0, 475, 0, 112, 582, 0, 461, | |||
784 | 463, 0, -208, 0, 0, 507, 644, 0, 0, 0, | |||
785 | 0, 0, -103, -123, 0, 0, 75, 0, -123, 0, | |||
786 | 0, 397, 582, 582, 0, 743, 0, 488, 0, 0, | |||
787 | -11, 0, 0, 0, 0, 0, 265, 0, -76, 0, | |||
788 | 0, 582, 0, 0, 56, 0, 0, 590, 582, 0, | |||
789 | 234, 524, 120, 582, 0, 0, 0, 0, 582, 0, | |||
790 | 582, 529, 265, 265, 271, 0, 597, 582, 0, 571, | |||
791 | 0, 0, 5354, -53, 591, 62, 0, 0, 478, 401, | |||
792 | 815, 484, 486, 0, 819, 502, 0, 0, 62, 0, | |||
793 | 747, 0, 0, 506, 644, 644, 126, 582, 0, 0, | |||
794 | 0, 582, 0, 0, 0, 229, 508, 0, 0, 0, | |||
795 | 17, 597, 831, -34, -96, -75, 610, 611, 83, 0, | |||
796 | 83, 83, 83, 615, 461, 0, 789, 836, 283, 392, | |||
797 | 616, 288, -32, 517, 522, 0, 523, 135, 530, 0, | |||
798 | 629, 83, 365, 83, -261, 0, 0, 0, 0, 5354, | |||
799 | 0, 0, 582, 0, 56, 0, 160, 0, 531, 533, | |||
800 | 537, 882, 862, 542, 0, 582, 0, 0, 0, 587, | |||
801 | 630, 0, 271, 0, 868, 0, 229, 582, 164, 0, | |||
802 | 0, 0, 0, 551, 888, 0, 0, 582, 658, 0, | |||
803 | 0, 0, 582, 659, 0, 902, 902, 582, 524, 660, | |||
804 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 582, | |||
805 | 558, 307, 0, 0, 0, 0, 582, 562, 310, 0, | |||
806 | 0, 0, 0, 0, 283, -32, -30, 564, 225, 0, | |||
807 | 0, 902, 0, 0, 0, 0, 566, 0, 0, 0, | |||
808 | 903, 0, 667, 229, 0, 685, 0, 135, -196, 0, | |||
809 | 572, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
810 | 944, 265, 265, 582, 197, 582, 0, 0, 0, 17, | |||
811 | 915, 555, 0, 551, 321, 352, 354, 359, 1200, 0, | |||
812 | 0, 102, 0, 229, 0, 632, 0, 934, 307, 0, | |||
813 | 950, 310, 0, 0, 0, 0, 573, 0, 0, 446, | |||
814 | 0, 527, 574, 229, 0, 0, 0, 83, 0, 0, | |||
815 | 0, 582, 202, 0, 0, 0, 0, 0, 868, 0, | |||
816 | 582, 0, 0, 583, 584, 586, 0, 0, 644, 0, | |||
817 | 203, 582, 0, 0, 228, 582, 0, 0, 543, 524, | |||
818 | 293, 0, 0, 0, 0, 135, 0, 0, 0, 0, | |||
819 | 0, 632, 371, 582, 0, 373, 582, 0, 644, 0, | |||
820 | 225, 0, 589, 0, 0, 0, 0, 0, 572, 559, | |||
821 | 582, 0, 0, 0, 0, 555, 0, 321, 0, 0, | |||
822 | 354, 0, 0, 582, 0, 102, 0, 0, 0, 0, | |||
823 | 934, 0, 0, 950, 0, 592, 0, 925, 701, 582, | |||
824 | 0, 0, 964, 972, 974, 0, 0, 582, 582, 0, | |||
825 | 524, 582, 582, 946, 0, 83, 0, 0, 0, 0, | |||
826 | 0, 0, 582, 0, 0, 0, 0, 0, 0,}; | |||
827 | const short yyrindex[] = | |||
828 | { 5, | |||
829 | 0, 0, 0, 0, 0, 1497, 0, 0, 1617, 0, | |||
830 | 650, 0, 0, 0, 0, 0, 2097, 0, 0, 0, | |||
831 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
832 | 0, 0, 0, 1737, 1857, 1977, 0, 0, 0, 0, | |||
833 | 2217, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
834 | 978, 0, 0, 0, 0, 2337, 2568, 0, 2688, 0, | |||
835 | 733, 721, 0, 0, 0, 3279, 0, 0, 0, 0, | |||
836 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
837 | 0, 0, 0, 2808, 0, 0, 980, 0, 210, 0, | |||
838 | 0, 608, 0, 0, 608, 0, 0, 0, 0, 0, | |||
839 | 0, 0, 0, 0, -186, 0, 0, 0, 0, 1377, | |||
840 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 37, | |||
841 | 0, 0, 0, 0, 0, 0, 0, 519, 0, 0, | |||
842 | 0, 0, 4, 0, 0, 0, 0, 0, 0, 988, | |||
843 | 3630, 0, 0, 0, 362, 0, 0, 0, 2, 0, | |||
844 | 3399, 0, 0, 0, 0, 0, 1251, 0, 0, 0, | |||
845 | -8, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
846 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
847 | 0, 374, 0, 0, 0, 0, 21, 0, 0, 0, | |||
848 | 0, 0, 117, 0, 0, 0, 0, 3870, 0, 0, | |||
849 | 0, 0, 0, 0, 3750, 0, 0, -9, 617, -9, | |||
850 | 617, -186, 0, 0, 0, 0, 0, 0, 0, 0, | |||
851 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
852 | 0, 989, 0, 4110, 0, 0, 0, 0, 27, 0, | |||
853 | 991, 3990, 0, 617, 0, 0, 0, 0, 0, 0, | |||
854 | 0, -5, 33, 0, 151, 0, 134, 521, 0, 0, | |||
855 | 0, 0, 994, 0, 0, 581, 600, 0, 0, 0, | |||
856 | 0, 0, 0, 4470, 0, 0, 367, 0, 4230, 0, | |||
857 | 0, 0, -9, -9, 0, -186, 0, 472, 0, 0, | |||
858 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
859 | 0, 382, 0, 0, 367, 0, 5253, 4581, 405, 0, | |||
860 | 0, -1, 493, -14, 4821, 0, 0, 0, 33, 0, | |||
861 | 521, 0, 0, 0, 0, 0, 0, 111, 0, 4350, | |||
862 | 0, 0, -137, 0, 4931, 367, 0, 0, 0, 303, | |||
863 | 0, 0, 0, 0, 429, 0, 0, 0, 367, 0, | |||
864 | 997, 0, 0, 0, 204, 483, 362, 11, 0, 0, | |||
865 | 0, 965, 0, 0, 0, 0, 723, 0, 0, 0, | |||
866 | 367, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
867 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
868 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
869 | 0, 0, 740, 0, 0, 0, 0, 0, 0, 7, | |||
870 | 0, 0, 608, 0, 367, 0, 493, 0, 0, 0, | |||
871 | 0, 0, 0, 0, 0, -14, 0, 0, 0, 0, | |||
872 | 0, 0, 0, 0, 0, 0, 0, -22, 163, 0, | |||
873 | 0, 0, 0, 0, 0, 0, 0, 382, 1112, 0, | |||
874 | 0, 0, 382, 1232, 0, 5051, 5051, 108, 2448, 2919, | |||
875 | 3510, 3510, 0, 0, 0, 0, 0, 0, 0, 965, | |||
876 | 848, 0, 0, 0, 0, 0, 965, 987, 0, 0, | |||
877 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
878 | 0, 5051, 0, 0, 0, 0, 0, 0, 0, 0, | |||
879 | 0, 0, 0, 0, 3510, 0, 3510, 0, 0, 0, | |||
880 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
881 | 0, 0, 0, 11, 1053, 656, 0, 0, 0, 367, | |||
882 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
883 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
884 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 448, | |||
885 | 0, 617, 0, 0, 0, 0, 0, 0, 0, 0, | |||
886 | 0, -9, 617, 0, 0, 0, 0, 0, 0, 0, | |||
887 | -22, 0, 0, 0, 0, 0, 0, 0, 603, 0, | |||
888 | 362, 11, 0, 0, 362, 11, 0, 0, 1465, -4, | |||
889 | 153, 0, 0, 0, 0, 3039, 0, 0, 0, 0, | |||
890 | 0, 4701, 1053, 656, 0, 1053, 656, 0, 637, 0, | |||
891 | 0, 0, 0, 0, 0, 3159, 0, 0, 0, 0, | |||
892 | 656, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
893 | 0, 0, 0, 53, 0, 0, 0, 0, 0, 0, | |||
894 | 0, 0, 0, 0, 0, 0, 0, 0, 5152, -9, | |||
895 | 0, 0, 0, 0, 0, 0, 0, 11, 11, 0, | |||
896 | -4, 656, 656, 0, 0, 0, 0, 0, 0, 0, | |||
897 | 0, 0, 53, 0, 0, 0, 3510, 0, 0,}; | |||
898 | const short yygindex[] = | |||
899 | { 0, | |||
900 | 71, 0, -133, -143, 0, 0, 0, -344, -372, 544, | |||
901 | -43, 0, 0, 0, -418, 973, 26, 0, 0, 0, | |||
902 | 0, -312, 976, 0, 0, -358, 0, 0, 468, 0, | |||
903 | -235, 0, 791, 0, -260, 0, 0, 0, -472, 0, | |||
904 | -452, 0, 834, 763, 628, 0, 0, -347, 173, -227, | |||
905 | 0, 0, 708, 696, 0, -124, 0, -474, 0, 674, | |||
906 | 0, -412, 0, 0, -465, 0, 0, -477, -353, 665, | |||
907 | 0, 992, -106, 918, -60, 0, -359, 516, 883, 993, | |||
908 | 0, 1006, 0, 845, 0, 0, 57, 594, 770, 753, | |||
909 | 666, 0, 0, -437, 0, 0, 812, 0, 0, 846, | |||
910 | 0, 0, -290, 0, 441, 0, 0, 840, 0, -366, | |||
911 | 470, 0, 0, 453, 0, -3, -2, 0, 0, 0, | |||
912 | 0, 0, 0, -54, -93, 0, -50, 0, 0, 0, | |||
913 | -138, 803, 0, 0, 0, 0, 0, 0, 0, 0, | |||
914 | 366, 0, | |||
915 | }; | |||
916 | #define YYTABLESIZE5732 5732 | |||
917 | const short yytable[] = | |||
918 | { 30, | |||
919 | 31, 160, 140, 165, 1, 257, 201, 497, 257, 557, | |||
920 | 247, 96, 444, 220, 1, 188, 129, 247, 247, 302, | |||
921 | 213, 247, 526, 438, 247, 247, 448, 381, 188, 247, | |||
922 | 239, 257, 355, 356, 247, 257, 572, 247, 257, 257, | |||
923 | 543, 92, 257, 219, 222, 247, 320, 453, 505, 162, | |||
924 | 507, 559, 97, 176, 247, 257, 28, 95, 257, 247, | |||
925 | 247, 164, 592, 207, 358, 247, 247, 212, 32, 413, | |||
926 | 248, 217, 251, 617, 472, 479, 247, 320, 253, 140, | |||
927 | 320, 184, 614, 344, 596, 533, 247, 260, 162, 233, | |||
928 | 162, 92, 247, 221, 162, 547, 247, 541, 187, 85, | |||
929 | 247, 1, 247, 208, 508, 282, 553, 162, 247, 210, | |||
930 | 247, 39, 247, 286, 246, 247, 249, 509, 291, 40, | |||
931 | 257, 257, 342, 257, 94, 176, 86, 550, 299, 129, | |||
932 | 436, 135, 561, 261, 247, 247, 56, 57, 567, 328, | |||
933 | 569, 342, 343, 247, 305, 277, 185, 247, 176, 247, | |||
934 | 247, 247, 319, 306, 660, 176, 92, 247, 98, 287, | |||
935 | 329, 343, 103, 176, 292, 668, 631, 247, 164, 176, | |||
936 | 247, 29, 524, 381, 349, 590, 673, 247, 328, 618, | |||
937 | 161, 644, 581, 657, 309, 672, 186, 86, 669, 317, | |||
938 | 318, 329, 381, 283, 329, 381, 92, 309, 237, 310, | |||
939 | 284, 527, 381, 176, 615, 458, 250, 176, 325, 100, | |||
940 | 60, 198, 381, 120, 626, 336, 430, 431, 433, 41, | |||
941 | 350, 205, 381, 234, 104, 352, 323, 353, 92, 285, | |||
942 | 242, 575, 576, 247, 371, 472, 290, 61, 479, 178, | |||
943 | 176, 92, 164, 442, 348, 176, 176, 179, 200, 42, | |||
944 | 432, 176, 683, 184, 101, 247, 462, 462, 462, 659, | |||
945 | 1, 1, 1, 1, 434, 63, 184, 324, 435, 247, | |||
946 | 180, 176, 381, 342, 247, 247, 67, 258, 349, 300, | |||
947 | 301, 62, 247, 247, 513, 381, 446, 447, 529, 405, | |||
948 | 238, 502, 94, 343, 326, 257, 257, 181, 247, 220, | |||
949 | 530, 91, 27, 5, 6, 7, 68, 451, 452, 16, | |||
950 | 247, 1, 258, 1, 600, 1, 80, 94, 185, 511, | |||
951 | 689, 578, 687, 247, 247, 69, 628, 637, 1, 412, | |||
952 | 1, 185, 520, 326, 247, 258, 176, 381, 472, 320, | |||
953 | 327, 479, 258, 1, 528, 220, 258, 321, 443, 247, | |||
954 | 496, 1, 640, 556, 535, 9, 320, 247, 186, 537, | |||
955 | 247, 247, 258, 247, 542, 571, 405, 257, 247, 247, | |||
956 | 257, 186, 92, 247, 247, 247, 548, 381, 257, 257, | |||
957 | 81, 257, 257, 551, 94, 92, 579, 1, 247, 70, | |||
958 | 320, 320, 320, 247, 247, 320, 320, 320, 247, 320, | |||
959 | 320, 570, 71, 247, 320, 320, 92, 247, 247, 247, | |||
960 | 247, 381, 84, 72, 176, 247, 176, 645, 671, 320, | |||
961 | 64, 621, 65, 623, 247, 258, 92, 258, 506, 73, | |||
962 | 577, 489, 580, 74, 629, 247, 247, 247, 262, 218, | |||
963 | 381, 75, 176, 566, 247, 420, 76, 419, 281, 312, | |||
964 | 636, 176, 638, 329, 339, 82, 641, 105, 84, 381, | |||
965 | 381, 262, 646, 77, 247, 340, 341, 78, 262, 79, | |||
966 | 329, 83, 262, 339, 651, 88, 381, 654, 627, 247, | |||
967 | 656, 330, 247, 603, 340, 341, 620, 632, 262, 176, | |||
968 | 247, 247, 119, 247, 247, 650, 90, 653, 639, 648, | |||
969 | 107, 108, 642, 566, 329, 329, 329, 102, 312, 329, | |||
970 | 329, 329, 330, 329, 329, 330, 381, 110, 329, 329, | |||
971 | 652, 312, 56, 655, 381, 381, 130, 247, 38, 485, | |||
972 | 337, 338, 381, 329, 381, 381, 381, 666, 132, 120, | |||
973 | 120, 120, 113, 114, 120, 381, 381, 381, 142, 120, | |||
974 | 670, 262, 381, 262, 120, 4, 5, 6, 7, 134, | |||
975 | 247, 149, 258, 486, 247, 258, 677, 622, 661, 150, | |||
976 | 176, 258, 258, 487, 681, 682, 488, 152, 684, 685, | |||
977 | 258, 258, 258, 643, 258, 258, 176, 258, 258, 688, | |||
978 | 123, 157, 258, 174, 258, 258, 258, 258, 258, 258, | |||
979 | 258, 258, 258, 258, 156, 339, 8, 258, 9, 118, | |||
980 | 10, 137, 138, 258, 159, 381, 340, 341, 143, 144, | |||
981 | 258, 146, 147, 11, 123, 12, 664, 665, 169, 170, | |||
982 | 258, 258, 258, 258, 258, 258, 258, 258, 13, 191, | |||
983 | 192, 258, 381, 69, 258, 247, 14, 264, 265, 33, | |||
984 | 381, 258, 258, 300, 301, 258, 364, 363, 365, 34, | |||
985 | 35, 36, 166, 92, 92, 482, 483, 258, 258, 258, | |||
986 | 493, 494, 167, 381, 258, 258, 258, 258, 258, 258, | |||
987 | 258, 258, 15, 662, 168, 258, 258, 176, 262, 468, | |||
988 | 469, 262, 475, 476, 37, 172, 485, 262, 262, 247, | |||
989 | 381, 247, 247, 446, 447, 173, 262, 262, 262, 175, | |||
990 | 262, 262, 196, 262, 262, 247, 247, 247, 262, 362, | |||
991 | 262, 262, 262, 262, 262, 262, 262, 262, 262, 262, | |||
992 | 486, 199, 273, 262, 593, 594, 451, 452, 92, 262, | |||
993 | 487, 597, 598, 488, 381, 381, 262, 464, 465, 92, | |||
994 | 92, 202, 381, 206, 91, 273, 262, 262, 262, 262, | |||
995 | 262, 262, 262, 262, 247, 247, 273, 262, 94, 215, | |||
996 | 262, 214, 235, 220, 330, 162, 247, 262, 262, 243, | |||
997 | 247, 262, 273, 273, 273, 381, 381, 247, 247, 381, | |||
998 | 381, 330, 254, 262, 262, 262, 381, 255, 247, 381, | |||
999 | 262, 262, 262, 262, 262, 262, 262, 262, 259, 268, | |||
1000 | 269, 262, 262, 270, 273, 5, 6, 7, 119, 119, | |||
1001 | 119, 381, 271, 119, 275, 330, 330, 330, 119, 276, | |||
1002 | 330, 330, 330, 119, 330, 330, 288, 280, 381, 330, | |||
1003 | 330, 583, 584, 293, 320, 273, 295, 273, 364, 363, | |||
1004 | 365, 297, 334, 354, 330, 372, 585, 282, 346, 415, | |||
1005 | 418, 421, 586, 247, 381, 424, 422, 9, 423, 427, | |||
1006 | 441, 587, 381, 381, 381, 381, 381, 381, 381, 381, | |||
1007 | 282, 381, 381, 123, 12, 425, 381, 381, 429, 381, | |||
1008 | 381, 282, 437, 456, 457, 364, 363, 365, 466, 492, | |||
1009 | 499, 381, 381, 247, 381, 500, 501, 282, 282, 282, | |||
1010 | 381, 470, 503, 504, 514, 515, 123, 123, 123, 381, | |||
1011 | 516, 123, 517, 518, 123, 519, 123, 364, 363, 365, | |||
1012 | 522, 123, 523, 443, 534, 118, 118, 118, 536, 538, | |||
1013 | 118, 539, 549, 381, 544, 118, 552, 558, 562, 563, | |||
1014 | 118, 564, 568, 574, 412, 582, 619, 624, 477, 604, | |||
1015 | 605, 606, 607, 608, 609, 675, 633, 634, 635, 676, | |||
1016 | 282, 658, 282, 678, 198, 674, 359, 360, 361, 137, | |||
1017 | 138, 679, 273, 680, 610, 273, 686, 211, 57, 20, | |||
1018 | 247, 273, 273, 364, 363, 365, 291, 52, 109, 381, | |||
1019 | 95, 273, 273, 85, 273, 273, 65, 220, 273, 364, | |||
1020 | 363, 365, 273, 84, 273, 273, 273, 273, 273, 291, | |||
1021 | 381, 273, 273, 273, 247, 247, 247, 273, 554, 115, | |||
1022 | 291, 625, 279, 273, 236, 247, 247, 247, 247, 247, | |||
1023 | 273, 315, 512, 417, 426, 440, 291, 291, 291, 467, | |||
1024 | 225, 226, 227, 136, 599, 228, 273, 197, 141, 216, | |||
1025 | 229, 273, 131, 256, 273, 230, 322, 351, 211, 211, | |||
1026 | 211, 273, 273, 211, 296, 510, 667, 272, 211, 555, | |||
1027 | 278, 649, 663, 211, 316, 0, 0, 273, 273, 273, | |||
1028 | 0, 0, 0, 0, 0, 273, 273, 273, 273, 273, | |||
1029 | 273, 273, 273, 273, 273, 273, 273, 282, 0, 291, | |||
1030 | 0, 291, 381, 381, 381, 0, 0, 282, 0, 0, | |||
1031 | 0, 308, 0, 0, 0, 0, 282, 282, 0, 282, | |||
1032 | 282, 0, 0, 282, 0, 0, 0, 282, 0, 282, | |||
1033 | 282, 282, 282, 282, 308, 0, 282, 282, 282, 0, | |||
1034 | 0, 0, 282, 0, 0, 308, 0, 0, 282, 0, | |||
1035 | 0, 0, 0, 0, 0, 282, 0, 0, 359, 360, | |||
1036 | 361, 468, 469, 0, 0, 0, 0, 0, 0, 0, | |||
1037 | 0, 282, 0, 0, 0, 0, 282, 0, 0, 282, | |||
1038 | 0, 0, 0, 0, 0, 0, 282, 282, 0, 0, | |||
1039 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1040 | 0, 0, 282, 282, 282, 359, 360, 361, 475, 476, | |||
1041 | 282, 282, 282, 282, 282, 282, 282, 282, 282, 282, | |||
1042 | 282, 282, 0, 0, 308, 0, 308, 0, 0, 0, | |||
1043 | 0, 311, 0, 0, 0, 0, 291, 359, 360, 361, | |||
1044 | 137, 138, 0, 0, 0, 0, 291, 0, 0, 0, | |||
1045 | 0, 0, 0, 0, 311, 291, 291, 0, 291, 291, | |||
1046 | 0, 0, 291, 0, 0, 311, 291, 0, 291, 291, | |||
1047 | 291, 291, 291, 247, 0, 291, 291, 291, 0, 0, | |||
1048 | 247, 291, 0, 0, 247, 0, 0, 291, 0, 0, | |||
1049 | 0, 0, 0, 0, 291, 0, 0, 0, 0, 0, | |||
1050 | 247, 247, 247, 359, 360, 361, 468, 469, 0, 0, | |||
1051 | 291, 0, 0, 0, 0, 291, 0, 0, 291, 359, | |||
1052 | 360, 361, 475, 476, 0, 291, 291, 0, 0, 0, | |||
1053 | 0, 0, 0, 0, 247, 247, 247, 247, 247, 0, | |||
1054 | 0, 291, 291, 291, 311, 0, 311, 0, 0, 291, | |||
1055 | 291, 291, 291, 291, 291, 291, 291, 291, 291, 291, | |||
1056 | 291, 308, 0, 247, 0, 247, 0, 0, 0, 0, | |||
1057 | 0, 308, 0, 0, 0, 0, 50, 0, 0, 0, | |||
1058 | 308, 308, 0, 308, 308, 0, 0, 308, 0, 0, | |||
1059 | 0, 308, 0, 308, 308, 308, 308, 308, 0, 50, | |||
1060 | 308, 308, 308, 0, 0, 0, 308, 50, 0, 0, | |||
1061 | 50, 0, 308, 0, 0, 0, 0, 0, 0, 308, | |||
1062 | 0, 0, 381, 381, 381, 381, 381, 0, 0, 0, | |||
1063 | 0, 0, 0, 0, 0, 308, 0, 0, 0, 0, | |||
1064 | 308, 0, 0, 308, 0, 0, 0, 0, 0, 0, | |||
1065 | 308, 308, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1066 | 0, 0, 0, 0, 0, 0, 308, 308, 308, 0, | |||
1067 | 0, 0, 0, 0, 308, 308, 308, 308, 308, 308, | |||
1068 | 308, 311, 0, 0, 308, 308, 0, 0, 0, 50, | |||
1069 | 0, 311, 116, 0, 0, 0, 179, 0, 0, 0, | |||
1070 | 311, 311, 0, 311, 311, 0, 0, 311, 0, 117, | |||
1071 | 0, 311, 0, 311, 311, 311, 311, 311, 247, 179, | |||
1072 | 311, 311, 311, 0, 0, 0, 311, 0, 0, 0, | |||
1073 | 0, 0, 311, 0, 0, 0, 0, 247, 247, 311, | |||
1074 | 0, 0, 0, 118, 119, 120, 0, 0, 121, 122, | |||
1075 | 123, 0, 124, 125, 0, 311, 0, 113, 114, 0, | |||
1076 | 311, 0, 0, 311, 0, 0, 0, 0, 0, 0, | |||
1077 | 311, 311, 126, 0, 0, 0, 0, 0, 0, 0, | |||
1078 | 0, 0, 0, 247, 0, 0, 311, 311, 311, 0, | |||
1079 | 0, 0, 0, 0, 311, 311, 311, 311, 311, 311, | |||
1080 | 311, 0, 0, 0, 311, 311, 0, 0, 0, 0, | |||
1081 | 0, 0, 247, 0, 0, 0, 57, 0, 0, 0, | |||
1082 | 247, 247, 247, 247, 247, 0, 50, 0, 0, 0, | |||
1083 | 0, 0, 0, 0, 0, 50, 50, 0, 0, 57, | |||
1084 | 0, 0, 0, 50, 0, 50, 50, 0, 50, 50, | |||
1085 | 0, 0, 50, 0, 0, 0, 50, 0, 50, 50, | |||
1086 | 50, 50, 50, 0, 0, 50, 50, 50, 0, 0, | |||
1087 | 0, 50, 0, 0, 0, 0, 0, 50, 0, 0, | |||
1088 | 0, 0, 0, 0, 50, 0, 0, 0, 0, 0, | |||
1089 | 0, 0, 0, 50, 50, 50, 50, 50, 50, 50, | |||
1090 | 50, 0, 0, 0, 0, 50, 0, 0, 50, 0, | |||
1091 | 0, 0, 0, 0, 0, 50, 50, 0, 0, 50, | |||
1092 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 57, | |||
1093 | 0, 50, 50, 50, 0, 0, 181, 0, 0, 50, | |||
1094 | 50, 50, 50, 50, 50, 50, 179, 0, 179, 179, | |||
1095 | 179, 179, 179, 179, 179, 179, 179, 381, 0, 181, | |||
1096 | 179, 179, 179, 179, 0, 179, 179, 0, 179, 179, | |||
1097 | 0, 0, 179, 0, 381, 0, 179, 0, 179, 179, | |||
1098 | 179, 179, 179, 0, 0, 179, 179, 179, 0, 0, | |||
1099 | 0, 179, 0, 0, 0, 0, 0, 179, 0, 0, | |||
1100 | 0, 0, 0, 0, 179, 0, 0, 0, 381, 381, | |||
1101 | 381, 0, 0, 381, 381, 381, 0, 381, 381, 0, | |||
1102 | 179, 0, 381, 381, 0, 179, 0, 0, 179, 0, | |||
1103 | 0, 0, 0, 0, 0, 179, 179, 381, 0, 0, | |||
1104 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1105 | 0, 179, 179, 179, 0, 0, 183, 0, 0, 179, | |||
1106 | 179, 179, 179, 179, 179, 179, 57, 0, 57, 57, | |||
1107 | 57, 0, 57, 57, 57, 57, 57, 0, 0, 183, | |||
1108 | 57, 57, 57, 57, 0, 57, 57, 0, 57, 57, | |||
1109 | 0, 0, 57, 0, 0, 0, 57, 0, 57, 57, | |||
1110 | 57, 57, 57, 0, 0, 57, 57, 57, 0, 0, | |||
1111 | 0, 57, 0, 0, 0, 0, 0, 57, 0, 0, | |||
1112 | 0, 0, 0, 0, 57, 0, 0, 0, 0, 0, | |||
1113 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1114 | 57, 0, 0, 0, 0, 57, 0, 0, 57, 0, | |||
1115 | 0, 0, 0, 0, 0, 57, 57, 0, 0, 0, | |||
1116 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1117 | 0, 57, 57, 57, 0, 0, 184, 0, 0, 57, | |||
1118 | 57, 57, 57, 57, 57, 57, 181, 0, 181, 181, | |||
1119 | 181, 181, 181, 181, 181, 181, 181, 0, 0, 184, | |||
1120 | 181, 181, 181, 181, 0, 181, 181, 0, 181, 181, | |||
1121 | 0, 0, 181, 0, 0, 0, 181, 0, 181, 181, | |||
1122 | 181, 181, 181, 0, 0, 181, 181, 181, 0, 0, | |||
1123 | 0, 181, 0, 0, 0, 0, 0, 181, 0, 0, | |||
1124 | 0, 0, 0, 0, 181, 0, 0, 0, 0, 0, | |||
1125 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1126 | 181, 0, 0, 0, 0, 181, 0, 0, 181, 0, | |||
1127 | 0, 0, 0, 0, 0, 181, 181, 0, 0, 0, | |||
1128 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1129 | 0, 181, 181, 181, 0, 0, 193, 0, 0, 181, | |||
1130 | 181, 181, 181, 181, 181, 181, 183, 0, 183, 183, | |||
1131 | 183, 183, 183, 183, 183, 183, 183, 0, 0, 193, | |||
1132 | 183, 183, 183, 183, 0, 183, 183, 0, 183, 183, | |||
1133 | 0, 0, 183, 0, 0, 0, 183, 0, 183, 183, | |||
1134 | 183, 183, 183, 0, 0, 183, 183, 183, 0, 0, | |||
1135 | 0, 183, 0, 0, 0, 0, 0, 183, 0, 0, | |||
1136 | 0, 0, 0, 0, 183, 0, 0, 0, 0, 0, | |||
1137 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1138 | 183, 0, 0, 0, 0, 183, 0, 0, 183, 0, | |||
1139 | 0, 0, 0, 0, 0, 183, 183, 0, 0, 0, | |||
1140 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1141 | 0, 183, 183, 183, 0, 0, 193, 0, 0, 183, | |||
1142 | 183, 183, 183, 183, 183, 183, 184, 0, 184, 184, | |||
1143 | 184, 184, 184, 184, 184, 184, 184, 0, 0, 193, | |||
1144 | 184, 184, 184, 184, 0, 184, 184, 0, 184, 184, | |||
1145 | 0, 0, 184, 0, 0, 0, 184, 0, 184, 184, | |||
1146 | 184, 184, 184, 0, 0, 184, 184, 184, 0, 0, | |||
1147 | 0, 184, 0, 0, 0, 0, 0, 184, 0, 0, | |||
1148 | 0, 0, 0, 0, 184, 0, 0, 0, 0, 0, | |||
1149 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1150 | 184, 0, 0, 0, 0, 184, 0, 0, 184, 0, | |||
1151 | 0, 0, 0, 0, 0, 184, 184, 0, 0, 0, | |||
1152 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 193, | |||
1153 | 0, 184, 184, 184, 0, 0, 203, 0, 0, 184, | |||
1154 | 184, 184, 184, 184, 184, 184, 193, 0, 0, 193, | |||
1155 | 0, 193, 193, 193, 193, 193, 193, 0, 0, 203, | |||
1156 | 193, 193, 193, 193, 0, 193, 193, 0, 193, 193, | |||
1157 | 0, 0, 193, 0, 0, 0, 193, 0, 193, 193, | |||
1158 | 193, 193, 193, 0, 0, 193, 193, 193, 0, 0, | |||
1159 | 0, 193, 0, 0, 0, 0, 0, 193, 0, 0, | |||
1160 | 0, 0, 0, 0, 193, 0, 0, 0, 0, 0, | |||
1161 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1162 | 193, 0, 0, 0, 0, 193, 0, 0, 193, 0, | |||
1163 | 0, 0, 0, 0, 0, 193, 193, 0, 0, 0, | |||
1164 | 0, 0, 0, 0, 0, 0, 0, 257, 0, 0, | |||
1165 | 0, 193, 193, 193, 0, 0, 0, 0, 0, 193, | |||
1166 | 193, 193, 193, 193, 193, 193, 193, 0, 0, 193, | |||
1167 | 257, 0, 193, 193, 193, 193, 193, 0, 0, 0, | |||
1168 | 193, 193, 193, 193, 0, 193, 193, 0, 193, 193, | |||
1169 | 0, 0, 193, 0, 0, 0, 193, 0, 193, 193, | |||
1170 | 193, 193, 193, 0, 0, 193, 193, 193, 0, 0, | |||
1171 | 0, 193, 0, 0, 0, 0, 0, 193, 0, 0, | |||
1172 | 0, 0, 0, 0, 193, 0, 0, 0, 0, 0, | |||
1173 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1174 | 193, 0, 0, 0, 0, 193, 0, 0, 193, 0, | |||
1175 | 0, 0, 0, 0, 0, 193, 193, 0, 0, 0, | |||
1176 | 257, 0, 0, 0, 0, 0, 0, 200, 0, 0, | |||
1177 | 0, 193, 193, 193, 0, 0, 0, 0, 0, 193, | |||
1178 | 193, 193, 193, 193, 193, 193, 203, 0, 0, 203, | |||
1179 | 200, 0, 203, 203, 203, 203, 203, 0, 0, 0, | |||
1180 | 203, 203, 203, 203, 0, 203, 203, 0, 203, 203, | |||
1181 | 0, 0, 203, 0, 0, 0, 203, 0, 203, 203, | |||
1182 | 203, 203, 203, 0, 0, 203, 203, 203, 0, 0, | |||
1183 | 0, 203, 0, 0, 0, 0, 0, 203, 0, 0, | |||
1184 | 0, 0, 0, 0, 203, 0, 0, 0, 0, 0, | |||
1185 | 0, 203, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1186 | 203, 0, 0, 0, 0, 203, 0, 0, 203, 0, | |||
1187 | 0, 0, 0, 0, 0, 203, 203, 0, 0, 0, | |||
1188 | 0, 0, 0, 0, 0, 0, 0, 199, 0, 0, | |||
1189 | 0, 203, 203, 203, 0, 0, 0, 257, 0, 203, | |||
1190 | 203, 203, 203, 203, 203, 203, 257, 257, 0, 0, | |||
1191 | 199, 0, 0, 0, 0, 0, 257, 257, 0, 257, | |||
1192 | 257, 0, 257, 257, 0, 0, 0, 257, 0, 257, | |||
1193 | 257, 257, 257, 257, 0, 0, 257, 257, 257, 0, | |||
1194 | 0, 0, 257, 0, 0, 0, 0, 0, 257, 0, | |||
1195 | 0, 0, 0, 0, 0, 257, 0, 0, 0, 0, | |||
1196 | 0, 0, 0, 0, 0, 257, 257, 257, 257, 257, | |||
1197 | 257, 257, 0, 0, 0, 0, 257, 0, 0, 257, | |||
1198 | 0, 0, 0, 0, 0, 0, 257, 257, 0, 0, | |||
1199 | 257, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1200 | 0, 0, 257, 257, 257, 0, 0, 196, 0, 0, | |||
1201 | 257, 257, 257, 257, 257, 257, 257, 200, 0, 0, | |||
1202 | 200, 0, 0, 0, 200, 200, 200, 200, 0, 0, | |||
1203 | 196, 200, 200, 200, 200, 0, 200, 200, 0, 200, | |||
1204 | 200, 0, 0, 200, 0, 0, 0, 200, 0, 200, | |||
1205 | 200, 200, 200, 200, 0, 0, 200, 200, 200, 0, | |||
1206 | 0, 0, 200, 0, 0, 0, 0, 0, 200, 0, | |||
1207 | 0, 0, 0, 0, 0, 200, 0, 0, 0, 0, | |||
1208 | 0, 0, 200, 0, 0, 0, 0, 0, 0, 0, | |||
1209 | 0, 200, 0, 0, 0, 0, 200, 0, 0, 200, | |||
1210 | 0, 0, 0, 0, 0, 0, 200, 200, 0, 0, | |||
1211 | 0, 0, 0, 0, 0, 0, 0, 0, 357, 0, | |||
1212 | 196, 0, 200, 200, 200, 0, 0, 0, 0, 0, | |||
1213 | 200, 200, 200, 200, 200, 200, 200, 199, 0, 0, | |||
1214 | 199, 357, 0, 0, 199, 199, 199, 199, 0, 0, | |||
1215 | 0, 199, 199, 199, 199, 0, 199, 199, 0, 199, | |||
1216 | 199, 0, 0, 199, 0, 0, 0, 199, 0, 199, | |||
1217 | 199, 199, 199, 199, 0, 0, 199, 199, 199, 0, | |||
1218 | 0, 0, 199, 0, 0, 0, 0, 0, 199, 0, | |||
1219 | 0, 0, 0, 0, 0, 199, 0, 0, 0, 0, | |||
1220 | 0, 0, 199, 0, 0, 0, 0, 0, 0, 0, | |||
1221 | 0, 199, 0, 0, 0, 0, 199, 0, 0, 199, | |||
1222 | 0, 0, 0, 0, 0, 0, 199, 199, 0, 0, | |||
1223 | 0, 357, 0, 0, 0, 0, 0, 0, 359, 0, | |||
1224 | 0, 0, 199, 199, 199, 0, 0, 0, 0, 0, | |||
1225 | 199, 199, 199, 199, 199, 199, 199, 196, 0, 0, | |||
1226 | 196, 359, 0, 0, 196, 196, 196, 196, 0, 0, | |||
1227 | 0, 196, 196, 196, 196, 0, 196, 196, 0, 196, | |||
1228 | 196, 0, 0, 196, 0, 0, 0, 196, 0, 196, | |||
1229 | 196, 196, 196, 196, 0, 0, 196, 196, 196, 0, | |||
1230 | 0, 0, 196, 0, 0, 0, 0, 0, 196, 0, | |||
1231 | 0, 0, 0, 0, 0, 196, 0, 0, 0, 0, | |||
1232 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1233 | 0, 196, 0, 0, 0, 0, 196, 0, 0, 196, | |||
1234 | 0, 0, 0, 0, 0, 0, 196, 196, 0, 0, | |||
1235 | 0, 359, 0, 0, 0, 0, 0, 0, 363, 0, | |||
1236 | 0, 0, 196, 196, 196, 0, 0, 0, 357, 0, | |||
1237 | 196, 196, 196, 196, 196, 196, 196, 357, 357, 0, | |||
1238 | 0, 363, 0, 0, 0, 0, 0, 357, 357, 0, | |||
1239 | 357, 357, 0, 0, 357, 0, 0, 0, 357, 0, | |||
1240 | 357, 357, 357, 357, 357, 0, 0, 357, 357, 357, | |||
1241 | 0, 0, 0, 357, 0, 0, 0, 0, 0, 357, | |||
1242 | 0, 0, 0, 0, 0, 0, 357, 0, 0, 0, | |||
1243 | 0, 0, 0, 0, 0, 0, 357, 357, 357, 357, | |||
1244 | 357, 357, 357, 0, 0, 0, 0, 357, 0, 0, | |||
1245 | 357, 0, 0, 0, 0, 0, 0, 357, 357, 0, | |||
1246 | 0, 357, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1247 | 0, 363, 0, 357, 357, 357, 0, 0, 198, 0, | |||
1248 | 0, 357, 357, 357, 357, 357, 357, 357, 359, 0, | |||
1249 | 0, 0, 0, 0, 0, 0, 0, 359, 359, 0, | |||
1250 | 0, 198, 0, 0, 0, 0, 0, 359, 359, 0, | |||
1251 | 359, 359, 0, 0, 359, 0, 0, 0, 359, 0, | |||
1252 | 359, 359, 359, 359, 359, 0, 0, 359, 359, 359, | |||
1253 | 0, 0, 0, 359, 0, 0, 0, 0, 0, 359, | |||
1254 | 0, 0, 0, 0, 0, 0, 359, 0, 0, 0, | |||
1255 | 0, 0, 0, 0, 0, 0, 359, 359, 359, 359, | |||
1256 | 359, 359, 359, 0, 0, 0, 0, 359, 0, 0, | |||
1257 | 359, 0, 0, 0, 0, 0, 0, 359, 359, 0, | |||
1258 | 0, 359, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1259 | 0, 0, 0, 359, 359, 359, 0, 0, 211, 0, | |||
1260 | 0, 359, 359, 359, 359, 359, 359, 359, 363, 0, | |||
1261 | 0, 0, 0, 0, 0, 0, 0, 363, 363, 0, | |||
1262 | 0, 211, 0, 0, 0, 0, 0, 363, 363, 0, | |||
1263 | 363, 363, 0, 0, 363, 0, 0, 0, 363, 0, | |||
1264 | 363, 363, 363, 363, 363, 0, 0, 363, 363, 363, | |||
1265 | 0, 0, 0, 363, 0, 0, 0, 0, 0, 363, | |||
1266 | 0, 0, 0, 0, 0, 0, 363, 0, 0, 0, | |||
1267 | 0, 0, 0, 0, 0, 0, 361, 361, 361, 361, | |||
1268 | 361, 361, 363, 0, 0, 0, 0, 363, 0, 0, | |||
1269 | 363, 0, 0, 0, 0, 0, 0, 363, 363, 0, | |||
1270 | 0, 361, 0, 0, 0, 0, 0, 0, 0, 363, | |||
1271 | 0, 211, 0, 363, 363, 363, 0, 0, 0, 0, | |||
1272 | 0, 363, 363, 363, 363, 363, 363, 363, 198, 0, | |||
1273 | 0, 198, 363, 0, 0, 198, 198, 198, 198, 0, | |||
1274 | 0, 0, 198, 198, 198, 198, 0, 198, 198, 0, | |||
1275 | 198, 198, 0, 0, 198, 0, 0, 0, 198, 0, | |||
1276 | 198, 198, 198, 198, 198, 0, 0, 198, 198, 198, | |||
1277 | 0, 0, 0, 198, 0, 0, 0, 0, 0, 198, | |||
1278 | 0, 0, 0, 0, 0, 0, 198, 0, 0, 0, | |||
1279 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1280 | 0, 0, 198, 0, 0, 0, 0, 198, 0, 0, | |||
1281 | 198, 0, 0, 0, 0, 0, 0, 198, 198, 0, | |||
1282 | 0, 0, 363, 0, 0, 0, 0, 0, 0, 211, | |||
1283 | 0, 0, 0, 198, 198, 198, 0, 0, 0, 0, | |||
1284 | 0, 198, 198, 198, 198, 198, 198, 198, 211, 0, | |||
1285 | 0, 211, 211, 0, 0, 0, 211, 211, 211, 0, | |||
1286 | 0, 0, 211, 211, 211, 211, 0, 211, 211, 0, | |||
1287 | 211, 211, 0, 0, 211, 0, 0, 0, 211, 0, | |||
1288 | 211, 211, 211, 211, 211, 0, 0, 211, 211, 211, | |||
1289 | 0, 0, 0, 211, 0, 0, 0, 0, 0, 211, | |||
1290 | 0, 0, 0, 0, 0, 0, 211, 0, 0, 0, | |||
1291 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1292 | 0, 0, 211, 0, 0, 0, 0, 211, 0, 0, | |||
1293 | 211, 0, 0, 0, 0, 0, 0, 211, 211, 0, | |||
1294 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 220, | |||
1295 | 0, 0, 0, 211, 211, 211, 0, 0, 0, 363, | |||
1296 | 0, 211, 211, 211, 211, 211, 211, 211, 0, 363, | |||
1297 | 0, 0, 220, 0, 0, 0, 0, 0, 363, 363, | |||
1298 | 0, 363, 363, 0, 0, 363, 0, 0, 0, 363, | |||
1299 | 0, 363, 363, 363, 363, 363, 0, 0, 363, 363, | |||
1300 | 363, 0, 0, 0, 363, 0, 0, 0, 0, 0, | |||
1301 | 363, 0, 0, 0, 0, 0, 0, 363, 0, 0, | |||
1302 | 0, 0, 0, 0, 0, 0, 0, 361, 361, 361, | |||
1303 | 361, 361, 361, 363, 0, 0, 0, 0, 363, 0, | |||
1304 | 0, 363, 0, 0, 0, 0, 0, 0, 363, 363, | |||
1305 | 0, 0, 361, 0, 0, 0, 0, 0, 0, 0, | |||
1306 | 0, 0, 220, 0, 363, 363, 363, 0, 0, 220, | |||
1307 | 0, 0, 363, 363, 363, 363, 363, 363, 363, 211, | |||
1308 | 0, 0, 211, 0, 0, 0, 0, 211, 211, 211, | |||
1309 | 0, 0, 220, 211, 211, 211, 211, 0, 211, 211, | |||
1310 | 0, 211, 211, 0, 0, 211, 0, 0, 0, 211, | |||
1311 | 0, 211, 211, 211, 211, 211, 0, 0, 211, 211, | |||
1312 | 211, 0, 0, 0, 211, 0, 0, 0, 0, 0, | |||
1313 | 211, 0, 0, 0, 0, 0, 0, 211, 0, 0, | |||
1314 | 0, 42, 0, 43, 0, 44, 45, 46, 47, 48, | |||
1315 | 0, 0, 49, 211, 50, 51, 52, 0, 211, 0, | |||
1316 | 0, 211, 0, 0, 0, 0, 0, 0, 211, 211, | |||
1317 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1318 | 0, 53, 0, 0, 211, 211, 211, 0, 0, 223, | |||
1319 | 0, 0, 211, 211, 211, 211, 211, 211, 211, 220, | |||
1320 | 0, 0, 220, 54, 55, 0, 0, 220, 220, 220, | |||
1321 | 0, 0, 223, 220, 0, 0, 220, 0, 220, 220, | |||
1322 | 0, 220, 220, 0, 0, 220, 0, 0, 0, 220, | |||
1323 | 0, 220, 220, 220, 220, 220, 0, 0, 220, 220, | |||
1324 | 220, 0, 0, 0, 220, 0, 0, 0, 0, 0, | |||
1325 | 220, 0, 0, 0, 0, 0, 0, 220, 0, 0, | |||
1326 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1327 | 0, 0, 0, 220, 0, 0, 0, 0, 220, 0, | |||
1328 | 0, 220, 0, 0, 0, 0, 0, 0, 220, 220, | |||
1329 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1330 | 0, 0, 223, 0, 220, 220, 220, 0, 0, 223, | |||
1331 | 0, 0, 220, 220, 220, 220, 220, 220, 220, 220, | |||
1332 | 0, 0, 220, 0, 0, 0, 0, 220, 220, 220, | |||
1333 | 0, 0, 223, 220, 0, 0, 220, 0, 220, 220, | |||
1334 | 0, 220, 220, 0, 0, 220, 0, 0, 0, 220, | |||
1335 | 0, 220, 220, 220, 220, 220, 0, 0, 220, 220, | |||
1336 | 220, 0, 0, 0, 220, 0, 0, 0, 0, 0, | |||
1337 | 220, 0, 0, 0, 0, 0, 0, 220, 0, 0, | |||
1338 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1339 | 0, 0, 0, 220, 0, 0, 0, 0, 220, 0, | |||
1340 | 0, 220, 0, 0, 0, 0, 0, 0, 220, 220, | |||
1341 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1342 | 0, 0, 0, 0, 220, 220, 220, 0, 0, 239, | |||
1343 | 0, 0, 220, 220, 220, 220, 220, 220, 220, 223, | |||
1344 | 0, 0, 223, 0, 0, 0, 0, 223, 223, 223, | |||
1345 | 0, 0, 239, 0, 0, 0, 223, 0, 223, 223, | |||
1346 | 0, 223, 223, 0, 0, 223, 0, 0, 0, 223, | |||
1347 | 0, 223, 223, 223, 223, 223, 0, 0, 223, 223, | |||
1348 | 223, 0, 0, 0, 223, 0, 0, 0, 0, 0, | |||
1349 | 223, 0, 0, 0, 0, 0, 0, 223, 0, 0, | |||
1350 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1351 | 0, 0, 0, 223, 0, 0, 0, 0, 223, 0, | |||
1352 | 0, 223, 0, 0, 0, 0, 0, 0, 223, 223, | |||
1353 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1354 | 0, 0, 239, 0, 223, 223, 223, 0, 0, 243, | |||
1355 | 0, 0, 223, 223, 223, 223, 223, 223, 223, 223, | |||
1356 | 0, 0, 223, 0, 0, 0, 0, 223, 223, 223, | |||
1357 | 0, 0, 243, 0, 0, 0, 223, 0, 223, 223, | |||
1358 | 0, 223, 223, 0, 0, 223, 0, 0, 0, 223, | |||
1359 | 0, 223, 223, 223, 223, 223, 0, 0, 223, 223, | |||
1360 | 223, 0, 0, 0, 223, 0, 0, 0, 0, 0, | |||
1361 | 223, 0, 0, 0, 0, 0, 0, 223, 0, 0, | |||
1362 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1363 | 0, 0, 0, 223, 0, 0, 0, 0, 223, 0, | |||
1364 | 0, 223, 0, 0, 0, 0, 0, 0, 223, 223, | |||
1365 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1366 | 0, 0, 243, 0, 223, 223, 223, 0, 0, 239, | |||
1367 | 0, 0, 223, 223, 223, 223, 223, 223, 223, 239, | |||
1368 | 0, 0, 239, 0, 0, 0, 0, 0, 239, 239, | |||
1369 | 0, 0, 239, 0, 0, 0, 0, 0, 239, 239, | |||
1370 | 0, 239, 239, 0, 0, 239, 0, 0, 0, 239, | |||
1371 | 0, 239, 239, 239, 239, 239, 0, 0, 239, 239, | |||
1372 | 239, 0, 0, 0, 239, 0, 0, 0, 0, 0, | |||
1373 | 239, 0, 0, 0, 0, 0, 0, 239, 0, 0, | |||
1374 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1375 | 0, 0, 0, 239, 0, 0, 0, 0, 239, 0, | |||
1376 | 0, 239, 0, 0, 0, 0, 0, 0, 239, 239, | |||
1377 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1378 | 233, 0, 0, 0, 239, 239, 239, 0, 0, 0, | |||
1379 | 0, 0, 239, 239, 239, 239, 239, 239, 239, 243, | |||
1380 | 0, 0, 243, 233, 0, 0, 0, 0, 243, 243, | |||
1381 | 0, 0, 0, 0, 0, 0, 0, 0, 243, 243, | |||
1382 | 0, 243, 243, 0, 0, 243, 0, 0, 0, 243, | |||
1383 | 0, 243, 243, 243, 243, 243, 0, 0, 243, 243, | |||
1384 | 243, 0, 0, 0, 243, 0, 0, 0, 0, 0, | |||
1385 | 243, 0, 0, 0, 0, 0, 0, 243, 0, 0, | |||
1386 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1387 | 0, 0, 0, 243, 0, 0, 0, 0, 243, 0, | |||
1388 | 0, 243, 0, 0, 0, 0, 0, 0, 243, 243, | |||
1389 | 0, 0, 0, 233, 0, 0, 0, 0, 0, 0, | |||
1390 | 362, 0, 0, 0, 243, 243, 243, 0, 0, 0, | |||
1391 | 0, 0, 243, 243, 243, 243, 243, 243, 243, 239, | |||
1392 | 0, 0, 239, 362, 0, 0, 0, 0, 239, 239, | |||
1393 | 0, 0, 0, 0, 0, 0, 0, 0, 239, 239, | |||
1394 | 0, 239, 239, 0, 0, 239, 0, 0, 0, 239, | |||
1395 | 0, 239, 239, 239, 239, 239, 0, 0, 239, 239, | |||
1396 | 239, 0, 0, 0, 239, 0, 0, 0, 0, 0, | |||
1397 | 239, 0, 0, 0, 0, 0, 0, 239, 0, 0, | |||
1398 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1399 | 0, 0, 0, 239, 0, 0, 0, 0, 239, 0, | |||
1400 | 0, 239, 0, 0, 0, 0, 0, 0, 239, 239, | |||
1401 | 0, 0, 0, 362, 0, 0, 0, 0, 0, 0, | |||
1402 | 130, 0, 0, 0, 239, 239, 239, 0, 0, 0, | |||
1403 | 233, 0, 239, 239, 239, 239, 239, 239, 239, 233, | |||
1404 | 233, 0, 0, 128, 0, 0, 0, 0, 0, 233, | |||
1405 | 233, 0, 233, 233, 0, 0, 233, 0, 0, 0, | |||
1406 | 233, 0, 233, 233, 233, 233, 233, 0, 0, 233, | |||
1407 | 233, 233, 0, 0, 0, 233, 0, 0, 0, 0, | |||
1408 | 0, 233, 0, 0, 0, 0, 0, 0, 233, 0, | |||
1409 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1410 | 0, 0, 0, 0, 233, 0, 0, 0, 0, 233, | |||
1411 | 0, 0, 233, 0, 0, 0, 0, 0, 0, 233, | |||
1412 | 233, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1413 | 241, 0, 0, 130, 0, 233, 233, 233, 0, 0, | |||
1414 | 0, 0, 0, 233, 233, 233, 233, 233, 233, 233, | |||
1415 | 362, 0, 0, 241, 0, 0, 0, 0, 0, 362, | |||
1416 | 362, 0, 0, 0, 0, 0, 0, 0, 0, 362, | |||
1417 | 362, 0, 362, 362, 0, 0, 362, 0, 0, 0, | |||
1418 | 362, 0, 362, 362, 362, 362, 362, 0, 0, 362, | |||
1419 | 362, 362, 0, 0, 0, 362, 0, 0, 0, 0, | |||
1420 | 0, 362, 0, 0, 0, 0, 0, 0, 362, 0, | |||
1421 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1422 | 0, 0, 0, 0, 362, 0, 0, 0, 0, 362, | |||
1423 | 0, 0, 362, 0, 0, 0, 0, 0, 0, 362, | |||
1424 | 362, 0, 0, 241, 0, 0, 0, 0, 0, 0, | |||
1425 | 333, 0, 0, 0, 0, 362, 362, 362, 0, 0, | |||
1426 | 0, 0, 0, 362, 362, 362, 362, 362, 362, 362, | |||
1427 | 128, 0, 0, 333, 0, 0, 0, 0, 0, 0, | |||
1428 | 128, 0, 0, 0, 0, 0, 0, 0, 0, 128, | |||
1429 | 128, 0, 128, 128, 0, 0, 128, 0, 0, 0, | |||
1430 | 128, 0, 128, 128, 128, 128, 128, 0, 0, 128, | |||
1431 | 128, 128, 0, 0, 0, 128, 0, 0, 0, 0, | |||
1432 | 0, 128, 0, 0, 0, 0, 0, 0, 128, 0, | |||
1433 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1434 | 0, 0, 0, 0, 128, 0, 0, 0, 0, 128, | |||
1435 | 0, 153, 128, 0, 0, 0, 0, 0, 0, 128, | |||
1436 | 128, 0, 0, 333, 0, 0, 0, 0, 0, 0, | |||
1437 | 0, 0, 0, 0, 153, 128, 128, 128, 0, 0, | |||
1438 | 241, 0, 0, 128, 128, 128, 128, 128, 128, 128, | |||
1439 | 241, 0, 0, 0, 0, 0, 0, 0, 0, 241, | |||
1440 | 241, 0, 241, 241, 0, 0, 241, 0, 0, 0, | |||
1441 | 241, 0, 241, 241, 241, 241, 241, 0, 0, 241, | |||
1442 | 241, 241, 0, 0, 0, 241, 0, 0, 0, 0, | |||
1443 | 0, 241, 0, 0, 0, 0, 0, 0, 241, 0, | |||
1444 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1445 | 0, 0, 130, 0, 241, 0, 0, 0, 0, 241, | |||
1446 | 0, 0, 241, 0, 153, 0, 0, 0, 0, 241, | |||
1447 | 241, 0, 0, 0, 0, 128, 0, 0, 0, 0, | |||
1448 | 0, 0, 0, 0, 0, 241, 241, 241, 0, 0, | |||
1449 | 0, 0, 0, 241, 241, 241, 241, 241, 241, 241, | |||
1450 | 333, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1451 | 333, 0, 0, 0, 0, 0, 0, 0, 0, 333, | |||
1452 | 333, 0, 333, 333, 0, 0, 333, 0, 0, 0, | |||
1453 | 333, 0, 333, 333, 333, 333, 333, 0, 0, 333, | |||
1454 | 333, 333, 0, 0, 0, 333, 0, 0, 0, 0, | |||
1455 | 0, 333, 0, 0, 0, 0, 0, 0, 333, 0, | |||
1456 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1457 | 0, 0, 0, 0, 333, 0, 162, 0, 0, 333, | |||
1458 | 0, 0, 333, 0, 0, 0, 0, 0, 0, 333, | |||
1459 | 333, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1460 | 0, 153, 0, 0, 0, 333, 333, 333, 0, 0, | |||
1461 | 0, 153, 0, 333, 333, 333, 333, 333, 333, 333, | |||
1462 | 153, 153, 0, 153, 153, 0, 0, 153, 0, 0, | |||
1463 | 0, 153, 0, 153, 153, 153, 153, 153, 0, 0, | |||
1464 | 153, 153, 153, 0, 0, 0, 153, 0, 0, 0, | |||
1465 | 0, 0, 153, 0, 0, 0, 0, 0, 0, 153, | |||
1466 | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1467 | 0, 0, 0, 0, 0, 153, 0, 0, 0, 0, | |||
1468 | 153, 0, 0, 153, 0, 0, 0, 0, 0, 0, | |||
1469 | 153, 153, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1470 | 0, 0, 128, 0, 0, 0, 153, 153, 153, 0, | |||
1471 | 0, 0, 128, 0, 153, 153, 153, 153, 153, 153, | |||
1472 | 153, 128, 128, 0, 128, 128, 0, 0, 128, 0, | |||
1473 | 0, 0, 128, 0, 128, 128, 128, 128, 128, 0, | |||
1474 | 0, 128, 128, 128, 0, 0, 0, 128, 0, 0, | |||
1475 | 0, 0, 0, 128, 0, 0, 0, 0, 0, 0, | |||
1476 | 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1477 | 0, 0, 0, 0, 0, 0, 128, 0, 0, 0, | |||
1478 | 0, 128, 0, 0, 128, 0, 0, 0, 0, 0, | |||
1479 | 0, 128, 128, 0, 0, 0, 0, 0, 0, 0, | |||
1480 | 0, 0, 0, 373, 0, 0, 0, 128, 128, 128, | |||
1481 | 0, 0, 0, 374, 0, 128, 128, 128, 128, 128, | |||
1482 | 128, 128, 375, 376, 0, 377, 378, 0, 0, 379, | |||
1483 | 0, 0, 0, 380, 0, 381, 382, 383, 384, 385, | |||
1484 | 0, 0, 386, 387, 388, 0, 0, 0, 389, 0, | |||
1485 | 0, 0, 0, 0, 390, 0, 0, 0, 0, 0, | |||
1486 | 0, 391, 0, 0, 0, 0, 0, 0, 0, 0, | |||
1487 | 0, 0, 0, 0, 0, 0, 0, 392, 0, 0, | |||
1488 | 0, 0, 393, 0, 0, 394, 0, 0, 0, 0, | |||
1489 | 0, 0, 395, 396, 0, 0, 0, 0, 0, 0, | |||
1490 | 0, 0, 0, 0, 0, 0, 0, 0, 397, 0, | |||
1491 | 398, 0, 0, 0, 0, 0, 399, 400, 401, 402, | |||
1492 | 403, 404, | |||
1493 | }; | |||
1494 | const short yycheck[] = | |||
1495 | { 3, | |||
1496 | 3, 95, 63, 110, 0, 10, 145, 40, 10, 40, | |||
1497 | 33, 10, 47, 10, 10, 40, 10, 40, 33, 123, | |||
1498 | 164, 44, 435, 371, 33, 40, 123, 33, 40, 44, | |||
1499 | 123, 33, 323, 324, 44, 40, 511, 60, 40, 44, | |||
1500 | 459, 123, 44, 182, 188, 60, 10, 123, 402, 33, | |||
1501 | 404, 489, 277, 44, 44, 60, 10, 123, 60, 33, | |||
1502 | 40, 105, 535, 157, 325, 33, 40, 161, 10, 123, | |||
1503 | 209, 178, 211, 551, 387, 388, 44, 41, 212, 140, | |||
1504 | 44, 278, 548, 311, 537, 444, 60, 296, 33, 196, | |||
1505 | 33, 278, 40, 187, 33, 462, 44, 457, 123, 295, | |||
1506 | 123, 123, 125, 158, 366, 244, 479, 33, 123, 160, | |||
1507 | 125, 60, 60, 252, 208, 125, 210, 379, 257, 383, | |||
1508 | 125, 123, 40, 125, 123, 44, 10, 472, 267, 123, | |||
1509 | 366, 61, 492, 342, 125, 125, 265, 266, 505, 123, | |||
1510 | 507, 40, 60, 33, 268, 239, 343, 40, 44, 123, | |||
1511 | 40, 125, 286, 277, 629, 44, 343, 125, 383, 253, | |||
1512 | 10, 60, 321, 44, 258, 638, 579, 60, 212, 44, | |||
1513 | 60, 125, 433, 40, 313, 534, 654, 125, 123, 552, | |||
1514 | 123, 600, 530, 621, 123, 651, 383, 383, 641, 283, | |||
1515 | 284, 41, 40, 248, 44, 33, 383, 123, 291, 125, | |||
1516 | 251, 437, 40, 44, 549, 123, 125, 44, 302, 261, | |||
1517 | 383, 141, 60, 10, 568, 309, 355, 356, 357, 10, | |||
1518 | 314, 151, 60, 198, 383, 319, 303, 321, 366, 125, | |||
1519 | 205, 522, 523, 123, 328, 548, 125, 383, 551, 269, | |||
1520 | 44, 379, 286, 278, 125, 44, 44, 277, 41, 40, | |||
1521 | 125, 44, 671, 278, 306, 278, 381, 382, 383, 626, | |||
1522 | 256, 257, 258, 259, 358, 61, 278, 344, 362, 278, | |||
1523 | 300, 44, 278, 40, 297, 298, 10, 221, 417, 383, | |||
1524 | 384, 309, 297, 298, 125, 123, 383, 384, 125, 333, | |||
1525 | 383, 398, 291, 60, 278, 297, 298, 327, 278, 296, | |||
1526 | 439, 383, 256, 257, 258, 259, 10, 383, 384, 10, | |||
1527 | 278, 307, 10, 309, 542, 311, 40, 383, 343, 413, | |||
1528 | 687, 125, 676, 297, 298, 10, 125, 125, 324, 383, | |||
1529 | 326, 343, 426, 278, 343, 33, 44, 343, 651, 303, | |||
1530 | 285, 654, 40, 339, 438, 342, 44, 291, 383, 372, | |||
1531 | 383, 347, 125, 384, 448, 309, 320, 372, 383, 453, | |||
1532 | 383, 384, 60, 343, 458, 509, 410, 372, 383, 384, | |||
1533 | 372, 383, 366, 383, 383, 343, 470, 383, 383, 384, | |||
1534 | 40, 383, 384, 477, 383, 379, 525, 383, 278, 10, | |||
1535 | 354, 355, 356, 383, 384, 359, 360, 361, 372, 363, | |||
1536 | 364, 508, 10, 383, 368, 369, 40, 297, 298, 383, | |||
1537 | 384, 278, 296, 10, 44, 383, 44, 125, 646, 383, | |||
1538 | 262, 560, 264, 562, 372, 123, 60, 125, 403, 10, | |||
1539 | 524, 40, 526, 10, 573, 383, 384, 33, 10, 41, | |||
1540 | 278, 10, 44, 504, 40, 45, 10, 47, 41, 277, | |||
1541 | 589, 44, 591, 303, 372, 40, 595, 267, 342, 297, | |||
1542 | 298, 33, 601, 10, 60, 383, 384, 10, 40, 10, | |||
1543 | 320, 383, 44, 372, 613, 383, 343, 616, 572, 372, | |||
1544 | 619, 10, 372, 544, 383, 384, 41, 581, 60, 44, | |||
1545 | 383, 384, 10, 383, 384, 125, 383, 125, 592, 606, | |||
1546 | 383, 384, 596, 564, 354, 355, 356, 383, 336, 359, | |||
1547 | 360, 361, 41, 363, 364, 44, 383, 383, 368, 369, | |||
1548 | 614, 349, 265, 617, 372, 33, 40, 123, 10, 305, | |||
1549 | 297, 298, 40, 383, 372, 383, 384, 631, 325, 336, | |||
1550 | 337, 338, 368, 369, 341, 383, 384, 344, 304, 346, | |||
1551 | 644, 123, 60, 125, 351, 256, 257, 258, 259, 266, | |||
1552 | 40, 62, 260, 339, 44, 263, 660, 41, 10, 266, | |||
1553 | 44, 269, 270, 349, 668, 669, 352, 287, 672, 673, | |||
1554 | 278, 279, 280, 41, 282, 283, 44, 285, 286, 683, | |||
1555 | 10, 10, 290, 60, 292, 293, 294, 295, 296, 297, | |||
1556 | 298, 299, 300, 301, 384, 372, 307, 305, 309, 10, | |||
1557 | 311, 383, 384, 311, 384, 123, 383, 384, 383, 384, | |||
1558 | 318, 383, 384, 324, 44, 326, 630, 630, 357, 358, | |||
1559 | 328, 329, 330, 331, 332, 333, 334, 335, 339, 275, | |||
1560 | 276, 339, 269, 41, 342, 125, 347, 383, 384, 261, | |||
1561 | 277, 349, 350, 383, 384, 353, 60, 61, 62, 271, | |||
1562 | 272, 273, 384, 297, 298, 383, 384, 365, 366, 367, | |||
1563 | 383, 384, 384, 300, 372, 373, 374, 375, 376, 377, | |||
1564 | 378, 379, 383, 125, 384, 383, 384, 44, 260, 383, | |||
1565 | 384, 263, 383, 384, 306, 384, 305, 269, 270, 44, | |||
1566 | 327, 297, 298, 383, 384, 384, 278, 279, 280, 384, | |||
1567 | 282, 283, 268, 285, 286, 60, 61, 62, 290, 123, | |||
1568 | 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, | |||
1569 | 339, 384, 10, 305, 383, 384, 383, 384, 372, 311, | |||
1570 | 349, 383, 384, 352, 383, 384, 318, 382, 383, 383, | |||
1571 | 384, 41, 305, 40, 383, 33, 328, 329, 330, 331, | |||
1572 | 332, 333, 334, 335, 383, 384, 44, 339, 383, 383, | |||
1573 | 342, 47, 41, 384, 303, 33, 372, 349, 350, 383, | |||
1574 | 125, 353, 60, 61, 62, 303, 339, 383, 384, 297, | |||
1575 | 298, 320, 384, 365, 366, 367, 349, 62, 278, 352, | |||
1576 | 372, 373, 374, 375, 376, 377, 378, 379, 41, 384, | |||
1577 | 384, 383, 384, 384, 274, 257, 258, 259, 336, 337, | |||
1578 | 338, 303, 383, 341, 41, 354, 355, 356, 346, 383, | |||
1579 | 359, 360, 361, 351, 363, 364, 362, 383, 320, 368, | |||
1580 | 369, 287, 288, 383, 357, 123, 384, 125, 60, 61, | |||
1581 | 62, 345, 263, 325, 383, 285, 302, 10, 335, 269, | |||
1582 | 383, 47, 308, 343, 372, 47, 383, 309, 383, 123, | |||
1583 | 40, 317, 354, 355, 356, 383, 384, 359, 360, 361, | |||
1584 | 33, 363, 364, 303, 326, 384, 368, 369, 383, 287, | |||
1585 | 288, 44, 385, 284, 284, 60, 61, 62, 284, 284, | |||
1586 | 384, 383, 303, 383, 302, 384, 384, 60, 61, 62, | |||
1587 | 308, 123, 383, 285, 384, 383, 336, 337, 338, 317, | |||
1588 | 384, 341, 41, 62, 344, 384, 346, 60, 61, 62, | |||
1589 | 344, 351, 303, 383, 47, 336, 337, 338, 281, 281, | |||
1590 | 341, 40, 385, 344, 285, 346, 385, 384, 383, 47, | |||
1591 | 351, 285, 268, 10, 383, 41, 384, 384, 123, 328, | |||
1592 | 329, 330, 331, 332, 333, 41, 384, 384, 383, 269, | |||
1593 | 123, 383, 125, 10, 325, 384, 380, 381, 382, 383, | |||
1594 | 384, 10, 260, 10, 353, 263, 41, 10, 268, 10, | |||
1595 | 383, 269, 270, 60, 61, 62, 10, 10, 10, 383, | |||
1596 | 10, 279, 280, 10, 282, 283, 10, 268, 286, 60, | |||
1597 | 61, 62, 290, 41, 292, 293, 294, 295, 296, 33, | |||
1598 | 384, 299, 300, 301, 60, 61, 62, 305, 485, 54, | |||
1599 | 44, 564, 242, 311, 201, 380, 381, 382, 383, 384, | |||
1600 | 318, 279, 415, 336, 349, 372, 60, 61, 62, 385, | |||
1601 | 336, 337, 338, 62, 539, 341, 334, 140, 66, 177, | |||
1602 | 346, 339, 57, 219, 342, 351, 297, 315, 336, 337, | |||
1603 | 338, 349, 350, 341, 263, 410, 636, 232, 346, 486, | |||
1604 | 241, 612, 630, 351, 282, -1, -1, 365, 366, 367, | |||
1605 | -1, -1, -1, -1, -1, 373, 374, 375, 376, 377, | |||
1606 | 378, 379, 380, 381, 382, 383, 384, 260, -1, 123, | |||
1607 | -1, 125, 60, 61, 62, -1, -1, 270, -1, -1, | |||
1608 | -1, 10, -1, -1, -1, -1, 279, 280, -1, 282, | |||
1609 | 283, -1, -1, 286, -1, -1, -1, 290, -1, 292, | |||
1610 | 293, 294, 295, 296, 33, -1, 299, 300, 301, -1, | |||
1611 | -1, -1, 305, -1, -1, 44, -1, -1, 311, -1, | |||
1612 | -1, -1, -1, -1, -1, 318, -1, -1, 380, 381, | |||
1613 | 382, 383, 384, -1, -1, -1, -1, -1, -1, -1, | |||
1614 | -1, 334, -1, -1, -1, -1, 339, -1, -1, 342, | |||
1615 | -1, -1, -1, -1, -1, -1, 349, 350, -1, -1, | |||
1616 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1617 | -1, -1, 365, 366, 367, 380, 381, 382, 383, 384, | |||
1618 | 373, 374, 375, 376, 377, 378, 379, 380, 381, 382, | |||
1619 | 383, 384, -1, -1, 123, -1, 125, -1, -1, -1, | |||
1620 | -1, 10, -1, -1, -1, -1, 260, 380, 381, 382, | |||
1621 | 383, 384, -1, -1, -1, -1, 270, -1, -1, -1, | |||
1622 | -1, -1, -1, -1, 33, 279, 280, -1, 282, 283, | |||
1623 | -1, -1, 286, -1, -1, 44, 290, -1, 292, 293, | |||
1624 | 294, 295, 296, 33, -1, 299, 300, 301, -1, -1, | |||
1625 | 40, 305, -1, -1, 44, -1, -1, 311, -1, -1, | |||
1626 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1627 | 60, 61, 62, 380, 381, 382, 383, 384, -1, -1, | |||
1628 | 334, -1, -1, -1, -1, 339, -1, -1, 342, 380, | |||
1629 | 381, 382, 383, 384, -1, 349, 350, -1, -1, -1, | |||
1630 | -1, -1, -1, -1, 380, 381, 382, 383, 384, -1, | |||
1631 | -1, 365, 366, 367, 123, -1, 125, -1, -1, 373, | |||
1632 | 374, 375, 376, 377, 378, 379, 380, 381, 382, 383, | |||
1633 | 384, 260, -1, 123, -1, 125, -1, -1, -1, -1, | |||
1634 | -1, 270, -1, -1, -1, -1, 10, -1, -1, -1, | |||
1635 | 279, 280, -1, 282, 283, -1, -1, 286, -1, -1, | |||
1636 | -1, 290, -1, 292, 293, 294, 295, 296, -1, 33, | |||
1637 | 299, 300, 301, -1, -1, -1, 305, 41, -1, -1, | |||
1638 | 44, -1, 311, -1, -1, -1, -1, -1, -1, 318, | |||
1639 | -1, -1, 380, 381, 382, 383, 384, -1, -1, -1, | |||
1640 | -1, -1, -1, -1, -1, 334, -1, -1, -1, -1, | |||
1641 | 339, -1, -1, 342, -1, -1, -1, -1, -1, -1, | |||
1642 | 349, 350, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1643 | -1, -1, -1, -1, -1, -1, 365, 366, 367, -1, | |||
1644 | -1, -1, -1, -1, 373, 374, 375, 376, 377, 378, | |||
1645 | 379, 260, -1, -1, 383, 384, -1, -1, -1, 123, | |||
1646 | -1, 270, 303, -1, -1, -1, 10, -1, -1, -1, | |||
1647 | 279, 280, -1, 282, 283, -1, -1, 286, -1, 320, | |||
1648 | -1, 290, -1, 292, 293, 294, 295, 296, 278, 33, | |||
1649 | 299, 300, 301, -1, -1, -1, 305, -1, -1, -1, | |||
1650 | -1, -1, 311, -1, -1, -1, -1, 297, 298, 318, | |||
1651 | -1, -1, -1, 354, 355, 356, -1, -1, 359, 360, | |||
1652 | 361, -1, 363, 364, -1, 334, -1, 368, 369, -1, | |||
1653 | 339, -1, -1, 342, -1, -1, -1, -1, -1, -1, | |||
1654 | 349, 350, 383, -1, -1, -1, -1, -1, -1, -1, | |||
1655 | -1, -1, -1, 343, -1, -1, 365, 366, 367, -1, | |||
1656 | -1, -1, -1, -1, 373, 374, 375, 376, 377, 378, | |||
1657 | 379, -1, -1, -1, 383, 384, -1, -1, -1, -1, | |||
1658 | -1, -1, 372, -1, -1, -1, 10, -1, -1, -1, | |||
1659 | 380, 381, 382, 383, 384, -1, 260, -1, -1, -1, | |||
1660 | -1, -1, -1, -1, -1, 269, 270, -1, -1, 33, | |||
1661 | -1, -1, -1, 277, -1, 279, 280, -1, 282, 283, | |||
1662 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1663 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1664 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1665 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1666 | -1, -1, -1, 327, 328, 329, 330, 331, 332, 333, | |||
1667 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1668 | -1, -1, -1, -1, -1, 349, 350, -1, -1, 353, | |||
1669 | -1, -1, -1, -1, -1, -1, -1, -1, -1, 123, | |||
1670 | -1, 365, 366, 367, -1, -1, 10, -1, -1, 373, | |||
1671 | 374, 375, 376, 377, 378, 379, 260, -1, 262, 263, | |||
1672 | 264, 265, 266, 267, 268, 269, 270, 303, -1, 33, | |||
1673 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1674 | -1, -1, 286, -1, 320, -1, 290, -1, 292, 293, | |||
1675 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1676 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1677 | -1, -1, -1, -1, 318, -1, -1, -1, 354, 355, | |||
1678 | 356, -1, -1, 359, 360, 361, -1, 363, 364, -1, | |||
1679 | 334, -1, 368, 369, -1, 339, -1, -1, 342, -1, | |||
1680 | -1, -1, -1, -1, -1, 349, 350, 383, -1, -1, | |||
1681 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1682 | -1, 365, 366, 367, -1, -1, 10, -1, -1, 373, | |||
1683 | 374, 375, 376, 377, 378, 379, 260, -1, 262, 263, | |||
1684 | 264, -1, 266, 267, 268, 269, 270, -1, -1, 33, | |||
1685 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1686 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1687 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1688 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1689 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1690 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1691 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1692 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1693 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1694 | -1, 365, 366, 367, -1, -1, 10, -1, -1, 373, | |||
1695 | 374, 375, 376, 377, 378, 379, 260, -1, 262, 263, | |||
1696 | 264, 265, 266, 267, 268, 269, 270, -1, -1, 33, | |||
1697 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1698 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1699 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1700 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1701 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1702 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1703 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1704 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1705 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1706 | -1, 365, 366, 367, -1, -1, 10, -1, -1, 373, | |||
1707 | 374, 375, 376, 377, 378, 379, 260, -1, 262, 263, | |||
1708 | 264, 265, 266, 267, 268, 269, 270, -1, -1, 33, | |||
1709 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1710 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1711 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1712 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1713 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1714 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1715 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1716 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1717 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1718 | -1, 365, 366, 367, -1, -1, 10, -1, -1, 373, | |||
1719 | 374, 375, 376, 377, 378, 379, 260, -1, 262, 263, | |||
1720 | 264, 265, 266, 267, 268, 269, 270, -1, -1, 33, | |||
1721 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1722 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1723 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1724 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1725 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1726 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1727 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1728 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1729 | -1, -1, -1, -1, -1, -1, -1, -1, -1, 123, | |||
1730 | -1, 365, 366, 367, -1, -1, 10, -1, -1, 373, | |||
1731 | 374, 375, 376, 377, 378, 379, 260, -1, -1, 263, | |||
1732 | -1, 265, 266, 267, 268, 269, 270, -1, -1, 33, | |||
1733 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1734 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1735 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1736 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1737 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1738 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1739 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1740 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1741 | -1, -1, -1, -1, -1, -1, -1, 10, -1, -1, | |||
1742 | -1, 365, 366, 367, -1, -1, -1, -1, -1, 373, | |||
1743 | 374, 375, 376, 377, 378, 379, 260, -1, -1, 263, | |||
1744 | 33, -1, 266, 267, 268, 269, 270, -1, -1, -1, | |||
1745 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1746 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1747 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1748 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1749 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1750 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1751 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1752 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1753 | 123, -1, -1, -1, -1, -1, -1, 10, -1, -1, | |||
1754 | -1, 365, 366, 367, -1, -1, -1, -1, -1, 373, | |||
1755 | 374, 375, 376, 377, 378, 379, 260, -1, -1, 263, | |||
1756 | 33, -1, 266, 267, 268, 269, 270, -1, -1, -1, | |||
1757 | 274, 275, 276, 277, -1, 279, 280, -1, 282, 283, | |||
1758 | -1, -1, 286, -1, -1, -1, 290, -1, 292, 293, | |||
1759 | 294, 295, 296, -1, -1, 299, 300, 301, -1, -1, | |||
1760 | -1, 305, -1, -1, -1, -1, -1, 311, -1, -1, | |||
1761 | -1, -1, -1, -1, 318, -1, -1, -1, -1, -1, | |||
1762 | -1, 325, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1763 | 334, -1, -1, -1, -1, 339, -1, -1, 342, -1, | |||
1764 | -1, -1, -1, -1, -1, 349, 350, -1, -1, -1, | |||
1765 | -1, -1, -1, -1, -1, -1, -1, 10, -1, -1, | |||
1766 | -1, 365, 366, 367, -1, -1, -1, 260, -1, 373, | |||
1767 | 374, 375, 376, 377, 378, 379, 269, 270, -1, -1, | |||
1768 | 33, -1, -1, -1, -1, -1, 279, 280, -1, 282, | |||
1769 | 283, -1, 285, 286, -1, -1, -1, 290, -1, 292, | |||
1770 | 293, 294, 295, 296, -1, -1, 299, 300, 301, -1, | |||
1771 | -1, -1, 305, -1, -1, -1, -1, -1, 311, -1, | |||
1772 | -1, -1, -1, -1, -1, 318, -1, -1, -1, -1, | |||
1773 | -1, -1, -1, -1, -1, 328, 329, 330, 331, 332, | |||
1774 | 333, 334, -1, -1, -1, -1, 339, -1, -1, 342, | |||
1775 | -1, -1, -1, -1, -1, -1, 349, 350, -1, -1, | |||
1776 | 353, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1777 | -1, -1, 365, 366, 367, -1, -1, 10, -1, -1, | |||
1778 | 373, 374, 375, 376, 377, 378, 379, 260, -1, -1, | |||
1779 | 263, -1, -1, -1, 267, 268, 269, 270, -1, -1, | |||
1780 | 33, 274, 275, 276, 277, -1, 279, 280, -1, 282, | |||
1781 | 283, -1, -1, 286, -1, -1, -1, 290, -1, 292, | |||
1782 | 293, 294, 295, 296, -1, -1, 299, 300, 301, -1, | |||
1783 | -1, -1, 305, -1, -1, -1, -1, -1, 311, -1, | |||
1784 | -1, -1, -1, -1, -1, 318, -1, -1, -1, -1, | |||
1785 | -1, -1, 325, -1, -1, -1, -1, -1, -1, -1, | |||
1786 | -1, 334, -1, -1, -1, -1, 339, -1, -1, 342, | |||
1787 | -1, -1, -1, -1, -1, -1, 349, 350, -1, -1, | |||
1788 | -1, -1, -1, -1, -1, -1, -1, -1, 10, -1, | |||
1789 | 123, -1, 365, 366, 367, -1, -1, -1, -1, -1, | |||
1790 | 373, 374, 375, 376, 377, 378, 379, 260, -1, -1, | |||
1791 | 263, 33, -1, -1, 267, 268, 269, 270, -1, -1, | |||
1792 | -1, 274, 275, 276, 277, -1, 279, 280, -1, 282, | |||
1793 | 283, -1, -1, 286, -1, -1, -1, 290, -1, 292, | |||
1794 | 293, 294, 295, 296, -1, -1, 299, 300, 301, -1, | |||
1795 | -1, -1, 305, -1, -1, -1, -1, -1, 311, -1, | |||
1796 | -1, -1, -1, -1, -1, 318, -1, -1, -1, -1, | |||
1797 | -1, -1, 325, -1, -1, -1, -1, -1, -1, -1, | |||
1798 | -1, 334, -1, -1, -1, -1, 339, -1, -1, 342, | |||
1799 | -1, -1, -1, -1, -1, -1, 349, 350, -1, -1, | |||
1800 | -1, 123, -1, -1, -1, -1, -1, -1, 10, -1, | |||
1801 | -1, -1, 365, 366, 367, -1, -1, -1, -1, -1, | |||
1802 | 373, 374, 375, 376, 377, 378, 379, 260, -1, -1, | |||
1803 | 263, 33, -1, -1, 267, 268, 269, 270, -1, -1, | |||
1804 | -1, 274, 275, 276, 277, -1, 279, 280, -1, 282, | |||
1805 | 283, -1, -1, 286, -1, -1, -1, 290, -1, 292, | |||
1806 | 293, 294, 295, 296, -1, -1, 299, 300, 301, -1, | |||
1807 | -1, -1, 305, -1, -1, -1, -1, -1, 311, -1, | |||
1808 | -1, -1, -1, -1, -1, 318, -1, -1, -1, -1, | |||
1809 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1810 | -1, 334, -1, -1, -1, -1, 339, -1, -1, 342, | |||
1811 | -1, -1, -1, -1, -1, -1, 349, 350, -1, -1, | |||
1812 | -1, 123, -1, -1, -1, -1, -1, -1, 10, -1, | |||
1813 | -1, -1, 365, 366, 367, -1, -1, -1, 260, -1, | |||
1814 | 373, 374, 375, 376, 377, 378, 379, 269, 270, -1, | |||
1815 | -1, 33, -1, -1, -1, -1, -1, 279, 280, -1, | |||
1816 | 282, 283, -1, -1, 286, -1, -1, -1, 290, -1, | |||
1817 | 292, 293, 294, 295, 296, -1, -1, 299, 300, 301, | |||
1818 | -1, -1, -1, 305, -1, -1, -1, -1, -1, 311, | |||
1819 | -1, -1, -1, -1, -1, -1, 318, -1, -1, -1, | |||
1820 | -1, -1, -1, -1, -1, -1, 328, 329, 330, 331, | |||
1821 | 332, 333, 334, -1, -1, -1, -1, 339, -1, -1, | |||
1822 | 342, -1, -1, -1, -1, -1, -1, 349, 350, -1, | |||
1823 | -1, 353, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1824 | -1, 123, -1, 365, 366, 367, -1, -1, 10, -1, | |||
1825 | -1, 373, 374, 375, 376, 377, 378, 379, 260, -1, | |||
1826 | -1, -1, -1, -1, -1, -1, -1, 269, 270, -1, | |||
1827 | -1, 33, -1, -1, -1, -1, -1, 279, 280, -1, | |||
1828 | 282, 283, -1, -1, 286, -1, -1, -1, 290, -1, | |||
1829 | 292, 293, 294, 295, 296, -1, -1, 299, 300, 301, | |||
1830 | -1, -1, -1, 305, -1, -1, -1, -1, -1, 311, | |||
1831 | -1, -1, -1, -1, -1, -1, 318, -1, -1, -1, | |||
1832 | -1, -1, -1, -1, -1, -1, 328, 329, 330, 331, | |||
1833 | 332, 333, 334, -1, -1, -1, -1, 339, -1, -1, | |||
1834 | 342, -1, -1, -1, -1, -1, -1, 349, 350, -1, | |||
1835 | -1, 353, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1836 | -1, -1, -1, 365, 366, 367, -1, -1, 10, -1, | |||
1837 | -1, 373, 374, 375, 376, 377, 378, 379, 260, -1, | |||
1838 | -1, -1, -1, -1, -1, -1, -1, 269, 270, -1, | |||
1839 | -1, 33, -1, -1, -1, -1, -1, 279, 280, -1, | |||
1840 | 282, 283, -1, -1, 286, -1, -1, -1, 290, -1, | |||
1841 | 292, 293, 294, 295, 296, -1, -1, 299, 300, 301, | |||
1842 | -1, -1, -1, 305, -1, -1, -1, -1, -1, 311, | |||
1843 | -1, -1, -1, -1, -1, -1, 318, -1, -1, -1, | |||
1844 | -1, -1, -1, -1, -1, -1, 328, 329, 330, 331, | |||
1845 | 332, 333, 334, -1, -1, -1, -1, 339, -1, -1, | |||
1846 | 342, -1, -1, -1, -1, -1, -1, 349, 350, -1, | |||
1847 | -1, 353, -1, -1, -1, -1, -1, -1, -1, 10, | |||
1848 | -1, 123, -1, 365, 366, 367, -1, -1, -1, -1, | |||
1849 | -1, 373, 374, 375, 376, 377, 378, 379, 260, -1, | |||
1850 | -1, 263, 33, -1, -1, 267, 268, 269, 270, -1, | |||
1851 | -1, -1, 274, 275, 276, 277, -1, 279, 280, -1, | |||
1852 | 282, 283, -1, -1, 286, -1, -1, -1, 290, -1, | |||
1853 | 292, 293, 294, 295, 296, -1, -1, 299, 300, 301, | |||
1854 | -1, -1, -1, 305, -1, -1, -1, -1, -1, 311, | |||
1855 | -1, -1, -1, -1, -1, -1, 318, -1, -1, -1, | |||
1856 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1857 | -1, -1, 334, -1, -1, -1, -1, 339, -1, -1, | |||
1858 | 342, -1, -1, -1, -1, -1, -1, 349, 350, -1, | |||
1859 | -1, -1, 123, -1, -1, -1, -1, -1, -1, 10, | |||
1860 | -1, -1, -1, 365, 366, 367, -1, -1, -1, -1, | |||
1861 | -1, 373, 374, 375, 376, 377, 378, 379, 260, -1, | |||
1862 | -1, 263, 33, -1, -1, -1, 268, 269, 270, -1, | |||
1863 | -1, -1, 274, 275, 276, 277, -1, 279, 280, -1, | |||
1864 | 282, 283, -1, -1, 286, -1, -1, -1, 290, -1, | |||
1865 | 292, 293, 294, 295, 296, -1, -1, 299, 300, 301, | |||
1866 | -1, -1, -1, 305, -1, -1, -1, -1, -1, 311, | |||
1867 | -1, -1, -1, -1, -1, -1, 318, -1, -1, -1, | |||
1868 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1869 | -1, -1, 334, -1, -1, -1, -1, 339, -1, -1, | |||
1870 | 342, -1, -1, -1, -1, -1, -1, 349, 350, -1, | |||
1871 | -1, -1, -1, -1, -1, -1, -1, -1, -1, 10, | |||
1872 | -1, -1, -1, 365, 366, 367, -1, -1, -1, 260, | |||
1873 | -1, 373, 374, 375, 376, 377, 378, 379, -1, 270, | |||
1874 | -1, -1, 33, -1, -1, -1, -1, -1, 279, 280, | |||
1875 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1876 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1877 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1878 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1879 | -1, -1, -1, -1, -1, -1, -1, 328, 329, 330, | |||
1880 | 331, 332, 333, 334, -1, -1, -1, -1, 339, -1, | |||
1881 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1882 | -1, -1, 353, -1, -1, -1, -1, -1, -1, -1, | |||
1883 | -1, -1, 123, -1, 365, 366, 367, -1, -1, 10, | |||
1884 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1885 | -1, -1, 263, -1, -1, -1, -1, 268, 269, 270, | |||
1886 | -1, -1, 33, 274, 275, 276, 277, -1, 279, 280, | |||
1887 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1888 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1889 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1890 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1891 | -1, 308, -1, 310, -1, 312, 313, 314, 315, 316, | |||
1892 | -1, -1, 319, 334, 321, 322, 323, -1, 339, -1, | |||
1893 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1894 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1895 | -1, 348, -1, -1, 365, 366, 367, -1, -1, 10, | |||
1896 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1897 | -1, -1, 263, 370, 371, -1, -1, 268, 269, 270, | |||
1898 | -1, -1, 33, 274, -1, -1, 277, -1, 279, 280, | |||
1899 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1900 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1901 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1902 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1903 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1904 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1905 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1906 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1907 | -1, -1, 123, -1, 365, 366, 367, -1, -1, 10, | |||
1908 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1909 | -1, -1, 263, -1, -1, -1, -1, 268, 269, 270, | |||
1910 | -1, -1, 33, 274, -1, -1, 277, -1, 279, 280, | |||
1911 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1912 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1913 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1914 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1915 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1916 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1917 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1918 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1919 | -1, -1, -1, -1, 365, 366, 367, -1, -1, 10, | |||
1920 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1921 | -1, -1, 263, -1, -1, -1, -1, 268, 269, 270, | |||
1922 | -1, -1, 33, -1, -1, -1, 277, -1, 279, 280, | |||
1923 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1924 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1925 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1926 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1927 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1928 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1929 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1930 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1931 | -1, -1, 123, -1, 365, 366, 367, -1, -1, 10, | |||
1932 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1933 | -1, -1, 263, -1, -1, -1, -1, 268, 269, 270, | |||
1934 | -1, -1, 33, -1, -1, -1, 277, -1, 279, 280, | |||
1935 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1936 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1937 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1938 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1939 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1940 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1941 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1942 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1943 | -1, -1, 123, -1, 365, 366, 367, -1, -1, 10, | |||
1944 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1945 | -1, -1, 263, -1, -1, -1, -1, -1, 269, 270, | |||
1946 | -1, -1, 33, -1, -1, -1, -1, -1, 279, 280, | |||
1947 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1948 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1949 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1950 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1951 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1952 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1953 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1954 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1955 | 10, -1, -1, -1, 365, 366, 367, -1, -1, -1, | |||
1956 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1957 | -1, -1, 263, 33, -1, -1, -1, -1, 269, 270, | |||
1958 | -1, -1, -1, -1, -1, -1, -1, -1, 279, 280, | |||
1959 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1960 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1961 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1962 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1963 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1964 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1965 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1966 | -1, -1, -1, 123, -1, -1, -1, -1, -1, -1, | |||
1967 | 10, -1, -1, -1, 365, 366, 367, -1, -1, -1, | |||
1968 | -1, -1, 373, 374, 375, 376, 377, 378, 379, 260, | |||
1969 | -1, -1, 263, 33, -1, -1, -1, -1, 269, 270, | |||
1970 | -1, -1, -1, -1, -1, -1, -1, -1, 279, 280, | |||
1971 | -1, 282, 283, -1, -1, 286, -1, -1, -1, 290, | |||
1972 | -1, 292, 293, 294, 295, 296, -1, -1, 299, 300, | |||
1973 | 301, -1, -1, -1, 305, -1, -1, -1, -1, -1, | |||
1974 | 311, -1, -1, -1, -1, -1, -1, 318, -1, -1, | |||
1975 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1976 | -1, -1, -1, 334, -1, -1, -1, -1, 339, -1, | |||
1977 | -1, 342, -1, -1, -1, -1, -1, -1, 349, 350, | |||
1978 | -1, -1, -1, 123, -1, -1, -1, -1, -1, -1, | |||
1979 | 10, -1, -1, -1, 365, 366, 367, -1, -1, -1, | |||
1980 | 260, -1, 373, 374, 375, 376, 377, 378, 379, 269, | |||
1981 | 270, -1, -1, 33, -1, -1, -1, -1, -1, 279, | |||
1982 | 280, -1, 282, 283, -1, -1, 286, -1, -1, -1, | |||
1983 | 290, -1, 292, 293, 294, 295, 296, -1, -1, 299, | |||
1984 | 300, 301, -1, -1, -1, 305, -1, -1, -1, -1, | |||
1985 | -1, 311, -1, -1, -1, -1, -1, -1, 318, -1, | |||
1986 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1987 | -1, -1, -1, -1, 334, -1, -1, -1, -1, 339, | |||
1988 | -1, -1, 342, -1, -1, -1, -1, -1, -1, 349, | |||
1989 | 350, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1990 | 10, -1, -1, 123, -1, 365, 366, 367, -1, -1, | |||
1991 | -1, -1, -1, 373, 374, 375, 376, 377, 378, 379, | |||
1992 | 260, -1, -1, 33, -1, -1, -1, -1, -1, 269, | |||
1993 | 270, -1, -1, -1, -1, -1, -1, -1, -1, 279, | |||
1994 | 280, -1, 282, 283, -1, -1, 286, -1, -1, -1, | |||
1995 | 290, -1, 292, 293, 294, 295, 296, -1, -1, 299, | |||
1996 | 300, 301, -1, -1, -1, 305, -1, -1, -1, -1, | |||
1997 | -1, 311, -1, -1, -1, -1, -1, -1, 318, -1, | |||
1998 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
1999 | -1, -1, -1, -1, 334, -1, -1, -1, -1, 339, | |||
2000 | -1, -1, 342, -1, -1, -1, -1, -1, -1, 349, | |||
2001 | 350, -1, -1, 123, -1, -1, -1, -1, -1, -1, | |||
2002 | 10, -1, -1, -1, -1, 365, 366, 367, -1, -1, | |||
2003 | -1, -1, -1, 373, 374, 375, 376, 377, 378, 379, | |||
2004 | 260, -1, -1, 33, -1, -1, -1, -1, -1, -1, | |||
2005 | 270, -1, -1, -1, -1, -1, -1, -1, -1, 279, | |||
2006 | 280, -1, 282, 283, -1, -1, 286, -1, -1, -1, | |||
2007 | 290, -1, 292, 293, 294, 295, 296, -1, -1, 299, | |||
2008 | 300, 301, -1, -1, -1, 305, -1, -1, -1, -1, | |||
2009 | -1, 311, -1, -1, -1, -1, -1, -1, 318, -1, | |||
2010 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2011 | -1, -1, -1, -1, 334, -1, -1, -1, -1, 339, | |||
2012 | -1, 10, 342, -1, -1, -1, -1, -1, -1, 349, | |||
2013 | 350, -1, -1, 123, -1, -1, -1, -1, -1, -1, | |||
2014 | -1, -1, -1, -1, 33, 365, 366, 367, -1, -1, | |||
2015 | 260, -1, -1, 373, 374, 375, 376, 377, 378, 379, | |||
2016 | 270, -1, -1, -1, -1, -1, -1, -1, -1, 279, | |||
2017 | 280, -1, 282, 283, -1, -1, 286, -1, -1, -1, | |||
2018 | 290, -1, 292, 293, 294, 295, 296, -1, -1, 299, | |||
2019 | 300, 301, -1, -1, -1, 305, -1, -1, -1, -1, | |||
2020 | -1, 311, -1, -1, -1, -1, -1, -1, 318, -1, | |||
2021 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2022 | -1, -1, 10, -1, 334, -1, -1, -1, -1, 339, | |||
2023 | -1, -1, 342, -1, 123, -1, -1, -1, -1, 349, | |||
2024 | 350, -1, -1, -1, -1, 33, -1, -1, -1, -1, | |||
2025 | -1, -1, -1, -1, -1, 365, 366, 367, -1, -1, | |||
2026 | -1, -1, -1, 373, 374, 375, 376, 377, 378, 379, | |||
2027 | 260, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2028 | 270, -1, -1, -1, -1, -1, -1, -1, -1, 279, | |||
2029 | 280, -1, 282, 283, -1, -1, 286, -1, -1, -1, | |||
2030 | 290, -1, 292, 293, 294, 295, 296, -1, -1, 299, | |||
2031 | 300, 301, -1, -1, -1, 305, -1, -1, -1, -1, | |||
2032 | -1, 311, -1, -1, -1, -1, -1, -1, 318, -1, | |||
2033 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2034 | -1, -1, -1, -1, 334, -1, 33, -1, -1, 339, | |||
2035 | -1, -1, 342, -1, -1, -1, -1, -1, -1, 349, | |||
2036 | 350, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2037 | -1, 260, -1, -1, -1, 365, 366, 367, -1, -1, | |||
2038 | -1, 270, -1, 373, 374, 375, 376, 377, 378, 379, | |||
2039 | 279, 280, -1, 282, 283, -1, -1, 286, -1, -1, | |||
2040 | -1, 290, -1, 292, 293, 294, 295, 296, -1, -1, | |||
2041 | 299, 300, 301, -1, -1, -1, 305, -1, -1, -1, | |||
2042 | -1, -1, 311, -1, -1, -1, -1, -1, -1, 318, | |||
2043 | -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2044 | -1, -1, -1, -1, -1, 334, -1, -1, -1, -1, | |||
2045 | 339, -1, -1, 342, -1, -1, -1, -1, -1, -1, | |||
2046 | 349, 350, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2047 | -1, -1, 260, -1, -1, -1, 365, 366, 367, -1, | |||
2048 | -1, -1, 270, -1, 373, 374, 375, 376, 377, 378, | |||
2049 | 379, 279, 280, -1, 282, 283, -1, -1, 286, -1, | |||
2050 | -1, -1, 290, -1, 292, 293, 294, 295, 296, -1, | |||
2051 | -1, 299, 300, 301, -1, -1, -1, 305, -1, -1, | |||
2052 | -1, -1, -1, 311, -1, -1, -1, -1, -1, -1, | |||
2053 | 318, -1, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2054 | -1, -1, -1, -1, -1, -1, 334, -1, -1, -1, | |||
2055 | -1, 339, -1, -1, 342, -1, -1, -1, -1, -1, | |||
2056 | -1, 349, 350, -1, -1, -1, -1, -1, -1, -1, | |||
2057 | -1, -1, -1, 260, -1, -1, -1, 365, 366, 367, | |||
2058 | -1, -1, -1, 270, -1, 373, 374, 375, 376, 377, | |||
2059 | 378, 379, 279, 280, -1, 282, 283, -1, -1, 286, | |||
2060 | -1, -1, -1, 290, -1, 292, 293, 294, 295, 296, | |||
2061 | -1, -1, 299, 300, 301, -1, -1, -1, 305, -1, | |||
2062 | -1, -1, -1, -1, 311, -1, -1, -1, -1, -1, | |||
2063 | -1, 318, -1, -1, -1, -1, -1, -1, -1, -1, | |||
2064 | -1, -1, -1, -1, -1, -1, -1, 334, -1, -1, | |||
2065 | -1, -1, 339, -1, -1, 342, -1, -1, -1, -1, | |||
2066 | -1, -1, 349, 350, -1, -1, -1, -1, -1, -1, | |||
2067 | -1, -1, -1, -1, -1, -1, -1, -1, 365, -1, | |||
2068 | 367, -1, -1, -1, -1, -1, 373, 374, 375, 376, | |||
2069 | 377, 378, | |||
2070 | }; | |||
2071 | #define YYFINAL2 2 | |||
2072 | #ifndef YYDEBUG0 | |||
2073 | #define YYDEBUG0 0 | |||
2074 | #endif | |||
2075 | #define YYMAXTOKEN385 385 | |||
2076 | #if YYDEBUG0 | |||
2077 | const char * const yyname[] = | |||
2078 | { | |||
2079 | "end-of-file",0,0,0,0,0,0,0,0,0,"'\\n'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, | |||
2080 | 0,0,"'!'",0,0,0,0,0,0,"'('","')'",0,0,"','","'-'",0,"'/'",0,0,0,0,0,0,0,0,0,0,0, | |||
2081 | 0,"'<'","'='","'>'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, | |||
2082 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,"'{'",0,"'}'",0,0,0, | |||
2083 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, | |||
2084 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, | |||
2085 | 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0, | |||
2086 | 0,0,0,0,0,0,0,0,"PASS","BLOCK","MATCH","SCRUB","RETURN","IN","OS","OUT","LOG", | |||
2087 | "QUICK","ON","FROM","TO","FLAGS","RETURNRST","RETURNICMP","RETURNICMP6","PROTO", | |||
2088 | "INET","INET6","ALL","ANY","ICMPTYPE","ICMP6TYPE","CODE","KEEP","MODULATE", | |||
2089 | "STATE","PORT","BINATTO","NODF","MINTTL","ERROR","ALLOWOPTS","FILENAME", | |||
2090 | "ROUTETO","DUPTO","REPLYTO","NO","LABEL","NOROUTE","URPFFAILED","FRAGMENT", | |||
2091 | "USER","GROUP","MAXMSS","MAXIMUM","TTL","TOS","DROP","TABLE","REASSEMBLE", | |||
2092 | "ANCHOR","SYNCOOKIES","SET","OPTIMIZATION","TIMEOUT","LIMIT","LOGINTERFACE", | |||
2093 | "BLOCKPOLICY","RANDOMID","SYNPROXY","FINGERPRINTS","NOSYNC","DEBUG","SKIP", | |||
2094 | "HOSTID","ANTISPOOF","FOR","INCLUDE","MATCHES","BITMASK","RANDOM","SOURCEHASH", | |||
2095 | "ROUNDROBIN","LEASTSTATES","STATICPORT","PROBABILITY","WEIGHT","BANDWIDTH", | |||
2096 | "FLOWS","QUANTUM","QUEUE","PRIORITY","QLIMIT","RTABLE","RDOMAIN","MINIMUM", | |||
2097 | "BURST","PARENT","LOAD","RULESET_OPTIMIZATION","PRIO","ONCE","DEFAULT","DELAY", | |||
2098 | "STICKYADDRESS","MAXSRCSTATES","MAXSRCNODES","SOURCETRACK","GLOBAL","RULE", | |||
2099 | "MAXSRCCONN","MAXSRCCONNRATE","OVERLOAD","FLUSH","SLOPPY","PFLOW","MAXPKTRATE", | |||
2100 | "TAGGED","TAG","IFBOUND","FLOATING","STATEPOLICY","STATEDEFAULTS","ROUTE", | |||
2101 | "DIVERTTO","DIVERTREPLY","DIVERTPACKET","NATTO","AFTO","RDRTO","RECEIVEDON", | |||
2102 | "NE","LE","GE","STRING","NUMBER","PORTBINARY", | |||
2103 | }; | |||
2104 | const char * const yyrule[] = | |||
2105 | {"$accept : ruleset", | |||
2106 | "ruleset :", | |||
2107 | "ruleset : ruleset include '\\n'", | |||
2108 | "ruleset : ruleset '\\n'", | |||
2109 | "ruleset : ruleset option '\\n'", | |||
2110 | "ruleset : ruleset pfrule '\\n'", | |||
2111 | "ruleset : ruleset anchorrule '\\n'", | |||
2112 | "ruleset : ruleset loadrule '\\n'", | |||
2113 | "ruleset : ruleset queuespec '\\n'", | |||
2114 | "ruleset : ruleset varset '\\n'", | |||
2115 | "ruleset : ruleset antispoof '\\n'", | |||
2116 | "ruleset : ruleset tabledef '\\n'", | |||
2117 | "ruleset : '{' fakeanchor '}' '\\n'", | |||
2118 | "ruleset : ruleset error '\\n'", | |||
2119 | "include : INCLUDE STRING", | |||
2120 | "fakeanchor : fakeanchor '\\n'", | |||
2121 | "fakeanchor : fakeanchor anchorrule '\\n'", | |||
2122 | "fakeanchor : fakeanchor pfrule '\\n'", | |||
2123 | "fakeanchor : fakeanchor error '\\n'", | |||
2124 | "optimizer : string", | |||
2125 | "optnodf :", | |||
2126 | "optnodf : NODF", | |||
2127 | "option : SET REASSEMBLE yesno optnodf", | |||
2128 | "option : SET OPTIMIZATION STRING", | |||
2129 | "option : SET RULESET_OPTIMIZATION optimizer", | |||
2130 | "option : SET TIMEOUT timeout_spec", | |||
2131 | "option : SET TIMEOUT '{' optnl timeout_list '}'", | |||
2132 | "option : SET LIMIT limit_spec", | |||
2133 | "option : SET LIMIT '{' optnl limit_list '}'", | |||
2134 | "option : SET LOGINTERFACE stringall", | |||
2135 | "option : SET HOSTID number", | |||
2136 | "option : SET BLOCKPOLICY DROP", | |||
2137 | "option : SET BLOCKPOLICY RETURN", | |||
2138 | "option : SET FINGERPRINTS STRING", | |||
2139 | "option : SET STATEPOLICY statelock", | |||
2140 | "option : SET DEBUG STRING", | |||
2141 | "option : SET DEBUG DEBUG", | |||
2142 | "option : SET SKIP interface", | |||
2143 | "option : SET STATEDEFAULTS state_opt_list", | |||
2144 | "option : SET SYNCOOKIES syncookie_val syncookie_opts", | |||
2145 | "syncookie_val : STRING", | |||
2146 | "syncookie_opts :", | |||
2147 | "$$1 :", | |||
2148 | "syncookie_opts : $$1 '(' syncookie_opt_l ')'", | |||
2149 | "syncookie_opt_l : syncookie_opt_l comma syncookie_opt", | |||
2150 | "syncookie_opt_l : syncookie_opt", | |||
2151 | "syncookie_opt : STRING STRING", | |||
2152 | "stringall : STRING", | |||
2153 | "stringall : ALL", | |||
2154 | "string : STRING string", | |||
2155 | "string : STRING", | |||
2156 | "varstring : numberstring varstring", | |||
2157 | "varstring : numberstring", | |||
2158 | "numberstring : NUMBER", | |||
2159 | "numberstring : STRING", | |||
2160 | "varset : STRING '=' varstring", | |||
2161 | "anchorname : STRING", | |||
2162 | "anchorname :", | |||
2163 | "pfa_anchorlist :", | |||
2164 | "pfa_anchorlist : pfa_anchorlist '\\n'", | |||
2165 | "pfa_anchorlist : pfa_anchorlist pfrule '\\n'", | |||
2166 | "pfa_anchorlist : pfa_anchorlist anchorrule '\\n'", | |||
2167 | "pfa_anchorlist : pfa_anchorlist include '\\n'", | |||
2168 | "$$2 :", | |||
2169 | "pfa_anchor : '{' $$2 '\\n' pfa_anchorlist '}'", | |||
2170 | "pfa_anchor :", | |||
2171 | "anchorrule : ANCHOR anchorname dir quick interface af proto fromto filter_opts pfa_anchor", | |||
2172 | "loadrule : LOAD ANCHOR anchorname FROM string", | |||
2173 | "$$3 :", | |||
2174 | "scrub_opts : $$3 scrub_opts_l", | |||
2175 | "scrub_opts_l : scrub_opts_l comma scrub_opt", | |||
2176 | "scrub_opts_l : scrub_opt", | |||
2177 | "scrub_opt : NODF", | |||
2178 | "scrub_opt : MINTTL NUMBER", | |||
2179 | "scrub_opt : MAXMSS NUMBER", | |||
2180 | "scrub_opt : REASSEMBLE STRING", | |||
2181 | "scrub_opt : RANDOMID", | |||
2182 | "antispoof : ANTISPOOF logquick antispoof_ifspc af antispoof_opts", | |||
2183 | "antispoof_ifspc : FOR antispoof_if", | |||
2184 | "antispoof_ifspc : FOR '{' optnl antispoof_iflst '}'", | |||
2185 | "antispoof_iflst : antispoof_if optnl", | |||
2186 | "antispoof_iflst : antispoof_iflst comma antispoof_if optnl", | |||
2187 | "antispoof_if : if_item", | |||
2188 | "antispoof_if : '(' if_item ')'", | |||
2189 | "$$4 :", | |||
2190 | "antispoof_opts : $$4 antispoof_opts_l", | |||
2191 | "antispoof_opts :", | |||
2192 | "antispoof_opts_l : antispoof_opts_l antispoof_opt", | |||
2193 | "antispoof_opts_l : antispoof_opt", | |||
2194 | "antispoof_opt : LABEL label", | |||
2195 | "antispoof_opt : RTABLE NUMBER", | |||
2196 | "not : '!'", | |||
2197 | "not :", | |||
2198 | "tabledef : TABLE '<' STRING '>' table_opts", | |||
2199 | "$$5 :", | |||
2200 | "table_opts : $$5 table_opts_l", | |||
2201 | "table_opts :", | |||
2202 | "table_opts_l : table_opts_l table_opt", | |||
2203 | "table_opts_l : table_opt", | |||
2204 | "table_opt : STRING", | |||
2205 | "table_opt : '{' optnl '}'", | |||
2206 | "table_opt : '{' optnl table_host_list '}'", | |||
2207 | "table_opt : FILENAME STRING", | |||
2208 | "tablespec : xhost optweight", | |||
2209 | "tablespec : '{' optnl table_host_list '}'", | |||
2210 | "table_host_list : tablespec optnl", | |||
2211 | "table_host_list : table_host_list comma tablespec optnl", | |||
2212 | "queuespec : QUEUE STRING interface queue_opts", | |||
2213 | "$$6 :", | |||
2214 | "queue_opts : $$6 queue_opts_l", | |||
2215 | "queue_opts_l : queue_opts_l queue_opt", | |||
2216 | "queue_opts_l : queue_opt", | |||
2217 | "queue_opt : BANDWIDTH scspec optscs", | |||
2218 | "queue_opt : PARENT STRING", | |||
2219 | "queue_opt : DEFAULT", | |||
2220 | "queue_opt : QLIMIT NUMBER", | |||
2221 | "queue_opt : FLOWS NUMBER", | |||
2222 | "queue_opt : QUANTUM NUMBER", | |||
2223 | "optscs :", | |||
2224 | "optscs : comma MINIMUM scspec", | |||
2225 | "optscs : comma MAXIMUM scspec", | |||
2226 | "optscs : comma MINIMUM scspec comma MAXIMUM scspec", | |||
2227 | "optscs : comma MAXIMUM scspec comma MINIMUM scspec", | |||
2228 | "scspec : bandwidth", | |||
2229 | "scspec : bandwidth BURST bandwidth FOR STRING", | |||
2230 | "bandwidth : STRING", | |||
2231 | "bandwidth : NUMBER", | |||
2232 | "pfrule : action dir logquick interface af proto fromto filter_opts", | |||
2233 | "$$7 :", | |||
2234 | "filter_opts : $$7 filter_opts_l", | |||
2235 | "filter_opts :", | |||
2236 | "filter_opts_l : filter_opts_l filter_opt", | |||
2237 | "filter_opts_l : filter_opt", | |||
2238 | "filter_opt : USER uids", | |||
2239 | "filter_opt : GROUP gids", | |||
2240 | "filter_opt : flags", | |||
2241 | "filter_opt : icmpspec", | |||
2242 | "filter_opt : PRIO NUMBER", | |||
2243 | "filter_opt : TOS tos", | |||
2244 | "filter_opt : keep", | |||
2245 | "filter_opt : FRAGMENT", | |||
2246 | "filter_opt : ALLOWOPTS", | |||
2247 | "filter_opt : LABEL label", | |||
2248 | "filter_opt : QUEUE qname", | |||
2249 | "filter_opt : TAG string", | |||
2250 | "filter_opt : not TAGGED string", | |||
2251 | "filter_opt : PROBABILITY probability", | |||
2252 | "filter_opt : RTABLE NUMBER", | |||
2253 | "filter_opt : DIVERTTO STRING PORT portplain", | |||
2254 | "filter_opt : DIVERTREPLY", | |||
2255 | "filter_opt : DIVERTPACKET PORT portplain", | |||
2256 | "filter_opt : SCRUB '(' scrub_opts ')'", | |||
2257 | "filter_opt : NATTO redirpool pool_opts", | |||
2258 | "filter_opt : AFTO af FROM redirpool pool_opts", | |||
2259 | "filter_opt : AFTO af FROM redirpool pool_opts TO redirpool pool_opts", | |||
2260 | "filter_opt : RDRTO redirpool pool_opts", | |||
2261 | "filter_opt : BINATTO redirpool pool_opts", | |||
2262 | "filter_opt : ROUTETO routespec", | |||
2263 | "filter_opt : REPLYTO routespec", | |||
2264 | "filter_opt : DUPTO routespec", | |||
2265 | "filter_opt : not RECEIVEDON if_item", | |||
2266 | "filter_opt : ONCE", | |||
2267 | "filter_opt : MAXPKTRATE NUMBER '/' NUMBER", | |||
2268 | "filter_opt : filter_sets", | |||
2269 | "filter_sets : SET '(' filter_sets_l ')'", | |||
2270 | "filter_sets : SET filter_set", | |||
2271 | "filter_sets_l : filter_sets_l comma filter_set", | |||
2272 | "filter_sets_l : filter_set", | |||
2273 | "filter_set : prio", | |||
2274 | "filter_set : QUEUE qname", | |||
2275 | "filter_set : TOS tos", | |||
2276 | "filter_set : DELAY NUMBER", | |||
2277 | "prio : PRIO NUMBER", | |||
2278 | "prio : PRIO '(' NUMBER comma NUMBER ')'", | |||
2279 | "probability : STRING", | |||
2280 | "probability : NUMBER", | |||
2281 | "action : PASS", | |||
2282 | "action : MATCH", | |||
2283 | "action : BLOCK blockspec", | |||
2284 | "blockspec :", | |||
2285 | "blockspec : DROP", | |||
2286 | "blockspec : RETURNRST", | |||
2287 | "blockspec : RETURNRST '(' TTL NUMBER ')'", | |||
2288 | "blockspec : RETURNICMP", | |||
2289 | "blockspec : RETURNICMP6", | |||
2290 | "blockspec : RETURNICMP '(' reticmpspec ')'", | |||
2291 | "blockspec : RETURNICMP6 '(' reticmp6spec ')'", | |||
2292 | "blockspec : RETURNICMP '(' reticmpspec comma reticmp6spec ')'", | |||
2293 | "blockspec : RETURN", | |||
2294 | "reticmpspec : STRING", | |||
2295 | "reticmpspec : NUMBER", | |||
2296 | "reticmp6spec : STRING", | |||
2297 | "reticmp6spec : NUMBER", | |||
2298 | "dir :", | |||
2299 | "dir : IN", | |||
2300 | "dir : OUT", | |||
2301 | "quick :", | |||
2302 | "quick : QUICK", | |||
2303 | "logquick :", | |||
2304 | "logquick : log", | |||
2305 | "logquick : QUICK", | |||
2306 | "logquick : log QUICK", | |||
2307 | "logquick : QUICK log", | |||
2308 | "log : LOG", | |||
2309 | "log : LOG '(' logopts ')'", | |||
2310 | "logopts : logopt", | |||
2311 | "logopts : logopts comma logopt", | |||
2312 | "logopt : ALL", | |||
2313 | "logopt : MATCHES", | |||
2314 | "logopt : USER", | |||
2315 | "logopt : TO string", | |||
2316 | "interface :", | |||
2317 | "interface : ON if_item_not", | |||
2318 | "interface : ON '{' optnl if_list '}'", | |||
2319 | "if_list : if_item_not optnl", | |||
2320 | "if_list : if_list comma if_item_not optnl", | |||
2321 | "if_item_not : not if_item", | |||
2322 | "if_item : STRING", | |||
2323 | "if_item : ANY", | |||
2324 | "if_item : RDOMAIN NUMBER", | |||
2325 | "af :", | |||
2326 | "af : INET", | |||
2327 | "af : INET6", | |||
2328 | "proto :", | |||
2329 | "proto : PROTO proto_item", | |||
2330 | "proto : PROTO '{' optnl proto_list '}'", | |||
2331 | "proto_list : proto_item optnl", | |||
2332 | "proto_list : proto_list comma proto_item optnl", | |||
2333 | "proto_item : protoval", | |||
2334 | "protoval : STRING", | |||
2335 | "protoval : NUMBER", | |||
2336 | "fromto : ALL", | |||
2337 | "fromto : from os to", | |||
2338 | "os :", | |||
2339 | "os : OS xos", | |||
2340 | "os : OS '{' optnl os_list '}'", | |||
2341 | "xos : STRING", | |||
2342 | "os_list : xos optnl", | |||
2343 | "os_list : os_list comma xos optnl", | |||
2344 | "from :", | |||
2345 | "from : FROM ipportspec", | |||
2346 | "to :", | |||
2347 | "to : TO ipportspec", | |||
2348 | "ipportspec : ipspec", | |||
2349 | "ipportspec : ipspec PORT portspec", | |||
2350 | "ipportspec : PORT portspec", | |||
2351 | "optnl : '\\n' optnl", | |||
2352 | "optnl :", | |||
2353 | "ipspec : ANY", | |||
2354 | "ipspec : xhost", | |||
2355 | "ipspec : '{' optnl host_list '}'", | |||
2356 | "host_list : ipspec optnl", | |||
2357 | "host_list : host_list comma ipspec optnl", | |||
2358 | "xhost : not host", | |||
2359 | "xhost : not NOROUTE", | |||
2360 | "xhost : not URPFFAILED", | |||
2361 | "optweight : WEIGHT NUMBER", | |||
2362 | "optweight :", | |||
2363 | "host : STRING", | |||
2364 | "host : STRING '-' STRING", | |||
2365 | "host : STRING '/' NUMBER", | |||
2366 | "host : NUMBER '/' NUMBER", | |||
2367 | "host : dynaddr", | |||
2368 | "host : dynaddr '/' NUMBER", | |||
2369 | "host : '<' STRING '>'", | |||
2370 | "host : ROUTE STRING", | |||
2371 | "number : NUMBER", | |||
2372 | "number : STRING", | |||
2373 | "dynaddr : '(' STRING ')'", | |||
2374 | "portspec : port_item", | |||
2375 | "portspec : '{' optnl port_list '}'", | |||
2376 | "port_list : port_item optnl", | |||
2377 | "port_list : port_list comma port_item optnl", | |||
2378 | "port_item : portrange", | |||
2379 | "port_item : unaryop portrange", | |||
2380 | "port_item : portrange PORTBINARY portrange", | |||
2381 | "portplain : numberstring", | |||
2382 | "portrange : numberstring", | |||
2383 | "uids : uid_item", | |||
2384 | "uids : '{' optnl uid_list '}'", | |||
2385 | "uid_list : uid_item optnl", | |||
2386 | "uid_list : uid_list comma uid_item optnl", | |||
2387 | "uid_item : uid", | |||
2388 | "uid_item : unaryop uid", | |||
2389 | "uid_item : uid PORTBINARY uid", | |||
2390 | "uid : STRING", | |||
2391 | "uid : NUMBER", | |||
2392 | "gids : gid_item", | |||
2393 | "gids : '{' optnl gid_list '}'", | |||
2394 | "gid_list : gid_item optnl", | |||
2395 | "gid_list : gid_list comma gid_item optnl", | |||
2396 | "gid_item : gid", | |||
2397 | "gid_item : unaryop gid", | |||
2398 | "gid_item : gid PORTBINARY gid", | |||
2399 | "gid : STRING", | |||
2400 | "gid : NUMBER", | |||
2401 | "flag : STRING", | |||
2402 | "flags : FLAGS flag '/' flag", | |||
2403 | "flags : FLAGS '/' flag", | |||
2404 | "flags : FLAGS ANY", | |||
2405 | "icmpspec : ICMPTYPE icmp_item", | |||
2406 | "icmpspec : ICMPTYPE '{' optnl icmp_list '}'", | |||
2407 | "icmpspec : ICMP6TYPE icmp6_item", | |||
2408 | "icmpspec : ICMP6TYPE '{' optnl icmp6_list '}'", | |||
2409 | "icmp_list : icmp_item optnl", | |||
2410 | "icmp_list : icmp_list comma icmp_item optnl", | |||
2411 | "icmp6_list : icmp6_item optnl", | |||
2412 | "icmp6_list : icmp6_list comma icmp6_item optnl", | |||
2413 | "icmp_item : icmptype", | |||
2414 | "icmp_item : icmptype CODE STRING", | |||
2415 | "icmp_item : icmptype CODE NUMBER", | |||
2416 | "icmp6_item : icmp6type", | |||
2417 | "icmp6_item : icmp6type CODE STRING", | |||
2418 | "icmp6_item : icmp6type CODE NUMBER", | |||
2419 | "icmptype : STRING", | |||
2420 | "icmptype : NUMBER", | |||
2421 | "icmp6type : STRING", | |||
2422 | "icmp6type : NUMBER", | |||
2423 | "tos : STRING", | |||
2424 | "tos : NUMBER", | |||
2425 | "sourcetrack :", | |||
2426 | "sourcetrack : GLOBAL", | |||
2427 | "sourcetrack : RULE", | |||
2428 | "statelock : IFBOUND", | |||
2429 | "statelock : FLOATING", | |||
2430 | "keep : NO STATE", | |||
2431 | "keep : KEEP STATE state_opt_spec", | |||
2432 | "keep : MODULATE STATE state_opt_spec", | |||
2433 | "keep : SYNPROXY STATE state_opt_spec", | |||
2434 | "flush :", | |||
2435 | "flush : FLUSH", | |||
2436 | "flush : FLUSH GLOBAL", | |||
2437 | "state_opt_spec : '(' state_opt_list ')'", | |||
2438 | "state_opt_spec :", | |||
2439 | "state_opt_list : state_opt_item", | |||
2440 | "state_opt_list : state_opt_list comma state_opt_item", | |||
2441 | "state_opt_item : MAXIMUM NUMBER", | |||
2442 | "state_opt_item : NOSYNC", | |||
2443 | "state_opt_item : MAXSRCSTATES NUMBER", | |||
2444 | "state_opt_item : MAXSRCCONN NUMBER", | |||
2445 | "state_opt_item : MAXSRCCONNRATE NUMBER '/' NUMBER", | |||
2446 | "state_opt_item : OVERLOAD '<' STRING '>' flush", | |||
2447 | "state_opt_item : MAXSRCNODES NUMBER", | |||
2448 | "state_opt_item : SOURCETRACK sourcetrack", | |||
2449 | "state_opt_item : statelock", | |||
2450 | "state_opt_item : SLOPPY", | |||
2451 | "state_opt_item : PFLOW", | |||
2452 | "state_opt_item : STRING NUMBER", | |||
2453 | "label : STRING", | |||
2454 | "qname : STRING", | |||
2455 | "qname : '(' STRING ')'", | |||
2456 | "qname : '(' STRING comma STRING ')'", | |||
2457 | "portstar : numberstring", | |||
2458 | "redirspec : host optweight", | |||
2459 | "redirspec : '{' optnl redir_host_list '}'", | |||
2460 | "redir_host_list : host optweight optnl", | |||
2461 | "redir_host_list : redir_host_list comma host optweight optnl", | |||
2462 | "redirpool : redirspec", | |||
2463 | "redirpool : redirspec PORT portstar", | |||
2464 | "hashkey :", | |||
2465 | "hashkey : string", | |||
2466 | "$$8 :", | |||
2467 | "pool_opts : $$8 pool_opts_l", | |||
2468 | "pool_opts :", | |||
2469 | "pool_opts_l : pool_opts_l pool_opt", | |||
2470 | "pool_opts_l : pool_opt", | |||
2471 | "pool_opt : BITMASK", | |||
2472 | "pool_opt : RANDOM", | |||
2473 | "pool_opt : SOURCEHASH hashkey", | |||
2474 | "pool_opt : ROUNDROBIN", | |||
2475 | "pool_opt : LEASTSTATES", | |||
2476 | "pool_opt : STATICPORT", | |||
2477 | "pool_opt : STICKYADDRESS", | |||
2478 | "routespec : redirspec pool_opts", | |||
2479 | "timeout_spec : STRING NUMBER", | |||
2480 | "timeout_list : timeout_list comma timeout_spec optnl", | |||
2481 | "timeout_list : timeout_spec optnl", | |||
2482 | "limit_spec : STRING NUMBER", | |||
2483 | "limit_list : limit_list comma limit_spec optnl", | |||
2484 | "limit_list : limit_spec optnl", | |||
2485 | "comma : ','", | |||
2486 | "comma :", | |||
2487 | "yesno : NO", | |||
2488 | "yesno : STRING", | |||
2489 | "unaryop : '='", | |||
2490 | "unaryop : NE", | |||
2491 | "unaryop : LE", | |||
2492 | "unaryop : '<'", | |||
2493 | "unaryop : GE", | |||
2494 | "unaryop : '>'", | |||
2495 | }; | |||
2496 | #endif | |||
2497 | #ifdef YYSTACKSIZE10000 | |||
2498 | #undef YYMAXDEPTH10000 | |||
2499 | #define YYMAXDEPTH10000 YYSTACKSIZE10000 | |||
2500 | #else | |||
2501 | #ifdef YYMAXDEPTH10000 | |||
2502 | #define YYSTACKSIZE10000 YYMAXDEPTH10000 | |||
2503 | #else | |||
2504 | #define YYSTACKSIZE10000 10000 | |||
2505 | #define YYMAXDEPTH10000 10000 | |||
2506 | #endif | |||
2507 | #endif | |||
2508 | #define YYINITSTACKSIZE200 200 | |||
2509 | /* LINTUSED */ | |||
2510 | int yydebug; | |||
2511 | int yynerrs; | |||
2512 | int yyerrflag; | |||
2513 | int yychar; | |||
2514 | short *yyssp; | |||
2515 | YYSTYPE *yyvsp; | |||
2516 | YYSTYPE yyval; | |||
2517 | YYSTYPE yylval; | |||
2518 | short *yyss; | |||
2519 | short *yysslim; | |||
2520 | YYSTYPE *yyvs; | |||
2521 | unsigned int yystacksize; | |||
2522 | int yyparse(void); | |||
2523 | #line 3778 "/usr/src/sbin/pfctl/parse.y" | |||
2524 | ||||
2525 | int | |||
2526 | yyerror(const char *fmt, ...) | |||
2527 | { | |||
2528 | va_list ap; | |||
2529 | ||||
2530 | file->errors++; | |||
2531 | va_start(ap, fmt)__builtin_va_start((ap), fmt); | |||
2532 | fprintf(stderr(&__sF[2]), "%s:%d: ", file->name, yylval.lineno); | |||
2533 | vfprintf(stderr(&__sF[2]), fmt, ap); | |||
2534 | fprintf(stderr(&__sF[2]), "\n"); | |||
2535 | va_end(ap)__builtin_va_end((ap)); | |||
2536 | return (0); | |||
2537 | } | |||
2538 | ||||
2539 | int | |||
2540 | validate_range(u_int8_t op, u_int16_t p1, u_int16_t p2) | |||
2541 | { | |||
2542 | u_int16_t a = ntohs(p1)(__uint16_t)(__builtin_constant_p(p1) ? (__uint16_t)(((__uint16_t )(p1) & 0xffU) << 8 | ((__uint16_t)(p1) & 0xff00U ) >> 8) : __swap16md(p1)); | |||
2543 | u_int16_t b = ntohs(p2)(__uint16_t)(__builtin_constant_p(p2) ? (__uint16_t)(((__uint16_t )(p2) & 0xffU) << 8 | ((__uint16_t)(p2) & 0xff00U ) >> 8) : __swap16md(p2)); | |||
2544 | ||||
2545 | if ((op == PF_OP_RRG && a > b) || /* 34:12, i.e. none */ | |||
2546 | (op == PF_OP_IRG && a >= b) || /* 34><12, i.e. none */ | |||
2547 | (op == PF_OP_XRG && a > b)) /* 34<>22, i.e. all */ | |||
2548 | return 1; | |||
2549 | return 0; | |||
2550 | } | |||
2551 | ||||
2552 | int | |||
2553 | disallow_table(struct node_host *h, const char *fmt) | |||
2554 | { | |||
2555 | for (; h != NULL((void *)0); h = h->next) | |||
2556 | if (h->addr.type == PF_ADDR_TABLE) { | |||
2557 | yyerror(fmt, h->addr.v.tblname); | |||
2558 | return (1); | |||
2559 | } | |||
2560 | return (0); | |||
2561 | } | |||
2562 | ||||
2563 | int | |||
2564 | disallow_urpf_failed(struct node_host *h, const char *fmt) | |||
2565 | { | |||
2566 | for (; h != NULL((void *)0); h = h->next) | |||
2567 | if (h->addr.type == PF_ADDR_URPFFAILED) { | |||
2568 | yyerror("%s", fmt); | |||
2569 | return (1); | |||
2570 | } | |||
2571 | return (0); | |||
2572 | } | |||
2573 | ||||
2574 | int | |||
2575 | disallow_alias(struct node_host *h, const char *fmt) | |||
2576 | { | |||
2577 | for (; h != NULL((void *)0); h = h->next) | |||
2578 | if (DYNIF_MULTIADDR(h->addr)((h->addr).type == PF_ADDR_DYNIFTL && (!((h->addr ).iflags & 0x08) || !isdigit((unsigned char)(h->addr). v.ifname[strlen((h->addr).v.ifname)-1])))) { | |||
2579 | yyerror(fmt, h->addr.v.tblname); | |||
2580 | return (1); | |||
2581 | } | |||
2582 | return (0); | |||
2583 | } | |||
2584 | ||||
2585 | int | |||
2586 | rule_consistent(struct pf_rule *r) | |||
2587 | { | |||
2588 | int problems = 0; | |||
2589 | ||||
2590 | if (r->proto != IPPROTO_TCP6 && r->os_fingerprint != PF_OSFP_ANY((pf_osfp_t)0)) { | |||
2591 | yyerror("os only applies to tcp"); | |||
2592 | problems++; | |||
2593 | } | |||
2594 | if (r->proto != IPPROTO_TCP6 && r->proto != IPPROTO_UDP17 && | |||
2595 | (r->src.port_op || r->dst.port_op)) { | |||
2596 | yyerror("port only applies to tcp/udp"); | |||
2597 | problems++; | |||
2598 | } | |||
2599 | if (r->proto != IPPROTO_TCP6 && r->proto != IPPROTO_UDP17 && | |||
2600 | r->uid.op) { | |||
2601 | yyerror("user only applies to tcp/udp"); | |||
2602 | problems++; | |||
2603 | } | |||
2604 | if (r->proto != IPPROTO_TCP6 && r->proto != IPPROTO_UDP17 && | |||
2605 | r->gid.op) { | |||
2606 | yyerror("group only applies to tcp/udp"); | |||
2607 | problems++; | |||
2608 | } | |||
2609 | if (r->proto != IPPROTO_ICMP1 && r->proto != IPPROTO_ICMPV658 && | |||
2610 | (r->type || r->code)) { | |||
2611 | yyerror("icmp-type/code only applies to icmp"); | |||
2612 | problems++; | |||
2613 | } | |||
2614 | if (!r->af && (r->type || r->code)) { | |||
2615 | yyerror("must indicate address family with icmp-type/code"); | |||
2616 | problems++; | |||
2617 | } | |||
2618 | if (r->rule_flag & PFRULE_AFTO0x00200000 && r->af == r->naf) { | |||
2619 | yyerror("must indicate different address family with af-to"); | |||
2620 | problems++; | |||
2621 | } | |||
2622 | if (r->overload_tblname[0] && | |||
2623 | r->max_src_conn == 0 && r->max_src_conn_rate.seconds == 0) { | |||
2624 | yyerror("'overload' requires 'max-src-conn' " | |||
2625 | "or 'max-src-conn-rate'"); | |||
2626 | problems++; | |||
2627 | } | |||
2628 | if ((r->proto == IPPROTO_ICMP1 && r->af == AF_INET624) || | |||
2629 | (r->proto == IPPROTO_ICMPV658 && r->af == AF_INET2)) { | |||
2630 | yyerror("proto %s doesn't match address family %s", | |||
2631 | r->proto == IPPROTO_ICMP1 ? "icmp" : "icmp6", | |||
2632 | r->af == AF_INET2 ? "inet" : "inet6"); | |||
2633 | problems++; | |||
2634 | } | |||
2635 | if (r->allow_opts && r->action != PF_PASS) { | |||
2636 | yyerror("allow-opts can only be specified for pass rules"); | |||
2637 | problems++; | |||
2638 | } | |||
2639 | if (r->rule_flag & PFRULE_FRAGMENT0x0002 && (r->src.port_op || | |||
2640 | r->dst.port_op || r->flagset || r->type || r->code)) { | |||
2641 | yyerror("fragments can be filtered only on IP header fields"); | |||
2642 | problems++; | |||
2643 | } | |||
2644 | if (r->rule_flag & PFRULE_RETURNRST0x0001 && r->proto != IPPROTO_TCP6) { | |||
2645 | yyerror("return-rst can only be applied to TCP rules"); | |||
2646 | problems++; | |||
2647 | } | |||
2648 | if (r->max_src_nodes && !(r->rule_flag & PFRULE_RULESRCTRACK0x0040)) { | |||
2649 | yyerror("max-src-nodes requires 'source-track rule'"); | |||
2650 | problems++; | |||
2651 | } | |||
2652 | if (r->action != PF_PASS && r->keep_state) { | |||
2653 | yyerror("keep state is great, but only for pass rules"); | |||
2654 | problems++; | |||
2655 | } | |||
2656 | if (r->rt && !r->keep_state) { | |||
2657 | yyerror("route-to, reply-to and dup-to require keep state"); | |||
2658 | problems++; | |||
2659 | } | |||
2660 | if (r->rule_flag & PFRULE_STATESLOPPY0x00020000 && | |||
2661 | (r->keep_state == PF_STATE_MODULATE0x2 || | |||
2662 | r->keep_state == PF_STATE_SYNPROXY0x3)) { | |||
2663 | yyerror("sloppy state matching cannot be used with " | |||
2664 | "synproxy state or modulate state"); | |||
2665 | problems++; | |||
2666 | } | |||
2667 | ||||
2668 | if ((r->keep_state == PF_STATE_SYNPROXY0x3) && (r->direction != PF_IN)) | |||
2669 | fprintf(stderr(&__sF[2]), "%s:%d: warning: " | |||
2670 | "synproxy used for inbound rules only, " | |||
2671 | "ignored for outbound\n", file->name, yylval.lineno); | |||
2672 | ||||
2673 | if ((r->nat.addr.type != PF_ADDR_NONE || | |||
2674 | r->rdr.addr.type != PF_ADDR_NONE) && | |||
2675 | r->action != PF_MATCH && !r->keep_state) { | |||
2676 | yyerror("nat-to and rdr-to require keep state"); | |||
2677 | problems++; | |||
2678 | } | |||
2679 | if (r->direction == PF_INOUT && (r->nat.addr.type != PF_ADDR_NONE || | |||
2680 | r->rdr.addr.type != PF_ADDR_NONE)) { | |||
2681 | yyerror("nat-to and rdr-to require a direction"); | |||
2682 | problems++; | |||
2683 | } | |||
2684 | if (r->af == AF_INET624 && (r->scrub_flags & | |||
2685 | (PFSTATE_NODF0x0020|PFSTATE_RANDOMID0x0080))) { | |||
2686 | yyerror("address family inet6 does not support scrub options " | |||
2687 | "no-df, random-id"); | |||
2688 | problems++; | |||
2689 | } | |||
2690 | ||||
2691 | /* Basic rule sanity check. */ | |||
2692 | switch (r->action) { | |||
2693 | case PF_MATCH: | |||
2694 | if (r->divert.type != PF_DIVERT_NONE) { | |||
2695 | yyerror("divert is not supported on match rules"); | |||
2696 | problems++; | |||
2697 | } | |||
2698 | if (r->rt) { | |||
2699 | yyerror("route-to, reply-to and dup-to " | |||
2700 | "are not supported on match rules"); | |||
2701 | problems++; | |||
2702 | } | |||
2703 | if (r->rule_flag & PFRULE_AFTO0x00200000) { | |||
2704 | yyerror("af-to is not supported on match rules"); | |||
2705 | problems++; | |||
2706 | } | |||
2707 | break; | |||
2708 | case PF_DROP: | |||
2709 | if (r->rt) { | |||
2710 | yyerror("route-to, reply-to and dup-to " | |||
2711 | "are not supported on block rules"); | |||
2712 | problems++; | |||
2713 | } | |||
2714 | break; | |||
2715 | default:; | |||
2716 | } | |||
2717 | return (-problems); | |||
2718 | } | |||
2719 | ||||
2720 | int | |||
2721 | process_tabledef(char *name, struct table_opts *opts, int popts) | |||
2722 | { | |||
2723 | struct pfr_buffer ab; | |||
2724 | struct node_tinit *ti; | |||
2725 | ||||
2726 | bzero(&ab, sizeof(ab)); | |||
2727 | ab.pfrb_type = PFRB_ADDRS; | |||
2728 | SIMPLEQ_FOREACH(ti, &opts->init_nodes, entries)for((ti) = ((&opts->init_nodes)->sqh_first); (ti) != ((void *)0); (ti) = ((ti)->entries.sqe_next)) { | |||
2729 | if (ti->file) | |||
2730 | if (pfr_buf_load(&ab, ti->file, 0, popts)) { | |||
2731 | if (errno(*__errno())) | |||
2732 | yyerror("cannot load \"%s\": %s", | |||
2733 | ti->file, strerror(errno(*__errno()))); | |||
2734 | else | |||
2735 | yyerror("file \"%s\" contains bad data", | |||
2736 | ti->file); | |||
2737 | goto _error; | |||
2738 | } | |||
2739 | if (ti->host) | |||
2740 | if (append_addr_host(&ab, ti->host, 0, 0)) { | |||
2741 | yyerror("cannot create address buffer: %s", | |||
2742 | strerror(errno(*__errno()))); | |||
2743 | goto _error; | |||
2744 | } | |||
2745 | } | |||
2746 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
2747 | print_tabledef(name, opts->flags, opts->init_addr, | |||
2748 | &opts->init_nodes); | |||
2749 | if (!(pf->opts & PF_OPT_NOACTION0x00008) || | |||
2750 | (pf->opts & PF_OPT_DUMMYACTION0x00100)) | |||
2751 | warn_duplicate_tables(name, pf->anchor->path); | |||
2752 | else if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
2753 | fprintf(stderr(&__sF[2]), "%s:%d: skipping duplicate table checks" | |||
2754 | " for <%s>\n", file->name, yylval.lineno, name); | |||
2755 | if (!(pf->opts & PF_OPT_NOACTION0x00008) && | |||
2756 | pfctl_define_table(name, opts->flags, opts->init_addr, | |||
2757 | pf->anchor->path, &ab, pf->anchor->ruleset.tticket)) { | |||
2758 | yyerror("cannot define table %s: %s", name, | |||
2759 | pf_strerror(errno(*__errno()))); | |||
2760 | goto _error; | |||
2761 | } | |||
2762 | pf->tdirty = 1; | |||
2763 | pfr_buf_clear(&ab); | |||
2764 | return (0); | |||
2765 | _error: | |||
2766 | pfr_buf_clear(&ab); | |||
2767 | return (-1); | |||
2768 | } | |||
2769 | ||||
2770 | struct keywords { | |||
2771 | const char *k_name; | |||
2772 | int k_val; | |||
2773 | }; | |||
2774 | ||||
2775 | /* macro gore, but you should've seen the prior indentation nightmare... */ | |||
2776 | ||||
2777 | #define FREE_LIST(T,r) \ | |||
2778 | do { \ | |||
2779 | T *p, *node = r; \ | |||
2780 | while (node != NULL((void *)0)) { \ | |||
2781 | p = node; \ | |||
2782 | node = node->next; \ | |||
2783 | free(p); \ | |||
2784 | } \ | |||
2785 | } while (0) | |||
2786 | ||||
2787 | #define LOOP_THROUGH(T,n,r,C) \ | |||
2788 | do { \ | |||
2789 | T *n; \ | |||
2790 | if (r == NULL((void *)0)) { \ | |||
2791 | r = calloc(1, sizeof(T)); \ | |||
2792 | if (r == NULL((void *)0)) \ | |||
2793 | err(1, "LOOP: calloc"); \ | |||
2794 | r->next = NULL((void *)0); \ | |||
2795 | } \ | |||
2796 | n = r; \ | |||
2797 | while (n != NULL((void *)0)) { \ | |||
2798 | do { \ | |||
2799 | C; \ | |||
2800 | } while (0); \ | |||
2801 | n = n->next; \ | |||
2802 | } \ | |||
2803 | } while (0) | |||
2804 | ||||
2805 | void | |||
2806 | expand_label_str(char *label, size_t len, const char *srch, const char *repl) | |||
2807 | { | |||
2808 | char *tmp; | |||
2809 | char *p, *q; | |||
2810 | ||||
2811 | if ((tmp = calloc(1, len)) == NULL((void *)0)) | |||
2812 | err(1, "%s", __func__); | |||
2813 | p = q = label; | |||
2814 | while ((q = strstr(p, srch)) != NULL((void *)0)) { | |||
2815 | *q = '\0'; | |||
2816 | if ((strlcat(tmp, p, len) >= len) || | |||
2817 | (strlcat(tmp, repl, len) >= len)) | |||
2818 | errx(1, "expand_label: label too long"); | |||
2819 | q += strlen(srch); | |||
2820 | p = q; | |||
2821 | } | |||
2822 | if (strlcat(tmp, p, len) >= len) | |||
2823 | errx(1, "expand_label: label too long"); | |||
2824 | strlcpy(label, tmp, len); /* always fits */ | |||
2825 | free(tmp); | |||
2826 | } | |||
2827 | ||||
2828 | void | |||
2829 | expand_label_if(const char *name, char *label, size_t len, const char *ifname) | |||
2830 | { | |||
2831 | if (strstr(label, name) != NULL((void *)0)) { | |||
2832 | if (!*ifname) | |||
2833 | expand_label_str(label, len, name, "any"); | |||
2834 | else | |||
2835 | expand_label_str(label, len, name, ifname); | |||
2836 | } | |||
2837 | } | |||
2838 | ||||
2839 | void | |||
2840 | expand_label_addr(const char *name, char *label, size_t len, sa_family_t af, | |||
2841 | struct node_host *h) | |||
2842 | { | |||
2843 | char tmp[64], tmp_not[66]; | |||
2844 | ||||
2845 | if (strstr(label, name) != NULL((void *)0)) { | |||
2846 | switch (h->addr.type) { | |||
2847 | case PF_ADDR_DYNIFTL: | |||
2848 | snprintf(tmp, sizeof(tmp), "(%s)", h->addr.v.ifname); | |||
2849 | break; | |||
2850 | case PF_ADDR_TABLE: | |||
2851 | snprintf(tmp, sizeof(tmp), "<%s>", h->addr.v.tblname); | |||
2852 | break; | |||
2853 | case PF_ADDR_NOROUTE: | |||
2854 | snprintf(tmp, sizeof(tmp), "no-route"); | |||
2855 | break; | |||
2856 | case PF_ADDR_URPFFAILED: | |||
2857 | snprintf(tmp, sizeof(tmp), "urpf-failed"); | |||
2858 | break; | |||
2859 | case PF_ADDR_ADDRMASK: | |||
2860 | if (!af || (PF_AZERO(&h->addr.v.a.addr, af)((af == 2 && !(&h->addr.v.a.addr)->pfa.addr32 [0]) || (af == 24 && !(&h->addr.v.a.addr)-> pfa.addr32[0] && !(&h->addr.v.a.addr)->pfa. addr32[1] && !(&h->addr.v.a.addr)->pfa.addr32 [2] && !(&h->addr.v.a.addr)->pfa.addr32[3] ) ) && | |||
2861 | PF_AZERO(&h->addr.v.a.mask, af)((af == 2 && !(&h->addr.v.a.mask)->pfa.addr32 [0]) || (af == 24 && !(&h->addr.v.a.mask)-> pfa.addr32[0] && !(&h->addr.v.a.mask)->pfa. addr32[1] && !(&h->addr.v.a.mask)->pfa.addr32 [2] && !(&h->addr.v.a.mask)->pfa.addr32[3] ) ))) | |||
2862 | snprintf(tmp, sizeof(tmp), "any"); | |||
2863 | else { | |||
2864 | char a[48]; | |||
2865 | int bits; | |||
2866 | ||||
2867 | if (inet_ntop(af, &h->addr.v.a.addr, a, | |||
2868 | sizeof(a)) == NULL((void *)0)) | |||
2869 | snprintf(tmp, sizeof(tmp), "?"); | |||
2870 | else { | |||
2871 | bits = unmask(&h->addr.v.a.mask); | |||
2872 | if ((af == AF_INET2 && bits < 32) || | |||
2873 | (af == AF_INET624 && bits < 128)) | |||
2874 | snprintf(tmp, sizeof(tmp), | |||
2875 | "%s/%d", a, bits); | |||
2876 | else | |||
2877 | snprintf(tmp, sizeof(tmp), | |||
2878 | "%s", a); | |||
2879 | } | |||
2880 | } | |||
2881 | break; | |||
2882 | default: | |||
2883 | snprintf(tmp, sizeof(tmp), "?"); | |||
2884 | break; | |||
2885 | } | |||
2886 | ||||
2887 | if (h->not) { | |||
2888 | snprintf(tmp_not, sizeof(tmp_not), "! %s", tmp); | |||
2889 | expand_label_str(label, len, name, tmp_not); | |||
2890 | } else | |||
2891 | expand_label_str(label, len, name, tmp); | |||
2892 | } | |||
2893 | } | |||
2894 | ||||
2895 | void | |||
2896 | expand_label_port(const char *name, char *label, size_t len, | |||
2897 | struct node_port *port) | |||
2898 | { | |||
2899 | char a1[6], a2[6], op[13] = ""; | |||
2900 | ||||
2901 | if (strstr(label, name) != NULL((void *)0)) { | |||
2902 | snprintf(a1, sizeof(a1), "%u", ntohs(port->port[0])(__uint16_t)(__builtin_constant_p(port->port[0]) ? (__uint16_t )(((__uint16_t)(port->port[0]) & 0xffU) << 8 | ( (__uint16_t)(port->port[0]) & 0xff00U) >> 8) : __swap16md (port->port[0]))); | |||
2903 | snprintf(a2, sizeof(a2), "%u", ntohs(port->port[1])(__uint16_t)(__builtin_constant_p(port->port[1]) ? (__uint16_t )(((__uint16_t)(port->port[1]) & 0xffU) << 8 | ( (__uint16_t)(port->port[1]) & 0xff00U) >> 8) : __swap16md (port->port[1]))); | |||
2904 | if (!port->op) | |||
2905 | ; | |||
2906 | else if (port->op == PF_OP_IRG) | |||
2907 | snprintf(op, sizeof(op), "%s><%s", a1, a2); | |||
2908 | else if (port->op == PF_OP_XRG) | |||
2909 | snprintf(op, sizeof(op), "%s<>%s", a1, a2); | |||
2910 | else if (port->op == PF_OP_EQ) | |||
2911 | snprintf(op, sizeof(op), "%s", a1); | |||
2912 | else if (port->op == PF_OP_NE) | |||
2913 | snprintf(op, sizeof(op), "!=%s", a1); | |||
2914 | else if (port->op == PF_OP_LT) | |||
2915 | snprintf(op, sizeof(op), "<%s", a1); | |||
2916 | else if (port->op == PF_OP_LE) | |||
2917 | snprintf(op, sizeof(op), "<=%s", a1); | |||
2918 | else if (port->op == PF_OP_GT) | |||
2919 | snprintf(op, sizeof(op), ">%s", a1); | |||
2920 | else if (port->op == PF_OP_GE) | |||
2921 | snprintf(op, sizeof(op), ">=%s", a1); | |||
2922 | expand_label_str(label, len, name, op); | |||
2923 | } | |||
2924 | } | |||
2925 | ||||
2926 | void | |||
2927 | expand_label_proto(const char *name, char *label, size_t len, u_int8_t proto) | |||
2928 | { | |||
2929 | struct protoent *pe; | |||
2930 | char n[4]; | |||
2931 | ||||
2932 | if (strstr(label, name) != NULL((void *)0)) { | |||
2933 | pe = getprotobynumber(proto); | |||
2934 | if (pe != NULL((void *)0)) | |||
2935 | expand_label_str(label, len, name, pe->p_name); | |||
2936 | else { | |||
2937 | snprintf(n, sizeof(n), "%u", proto); | |||
2938 | expand_label_str(label, len, name, n); | |||
2939 | } | |||
2940 | } | |||
2941 | } | |||
2942 | ||||
2943 | void | |||
2944 | pfctl_expand_label_nr(struct pf_rule *r, unsigned int rno) | |||
2945 | { | |||
2946 | char n[11]; | |||
2947 | ||||
2948 | snprintf(n, sizeof(n), "%u", rno); | |||
2949 | ||||
2950 | if (strstr(r->label, "$nr") != NULL((void *)0)) | |||
2951 | expand_label_str(r->label, PF_RULE_LABEL_SIZE64, "$nr", n); | |||
2952 | ||||
2953 | if (strstr(r->tagname, "$nr") != NULL((void *)0)) | |||
2954 | expand_label_str(r->tagname, PF_TAG_NAME_SIZE64, "$nr", n); | |||
2955 | ||||
2956 | if (strstr(r->match_tagname, "$nr") != NULL((void *)0)) | |||
2957 | expand_label_str(r->match_tagname, PF_TAG_NAME_SIZE64, "$nr", n); | |||
2958 | } | |||
2959 | ||||
2960 | void | |||
2961 | expand_label(char *label, size_t len, const char *ifname, sa_family_t af, | |||
2962 | struct node_host *src_host, struct node_port *src_port, | |||
2963 | struct node_host *dst_host, struct node_port *dst_port, | |||
2964 | u_int8_t proto) | |||
2965 | { | |||
2966 | expand_label_if("$if", label, len, ifname); | |||
2967 | expand_label_addr("$srcaddr", label, len, af, src_host); | |||
2968 | expand_label_addr("$dstaddr", label, len, af, dst_host); | |||
2969 | expand_label_port("$srcport", label, len, src_port); | |||
2970 | expand_label_port("$dstport", label, len, dst_port); | |||
2971 | expand_label_proto("$proto", label, len, proto); | |||
2972 | /* rule number, '$nr', gets expanded after optimizer */ | |||
2973 | } | |||
2974 | ||||
2975 | int | |||
2976 | expand_queue(char *qname, struct node_if *interfaces, struct queue_opts *opts) | |||
2977 | { | |||
2978 | struct pf_queuespec qspec; | |||
2979 | ||||
2980 | LOOP_THROUGH(struct node_if, interface, interfaces, | |||
2981 | bzero(&qspec, sizeof(qspec)); | |||
2982 | if (!opts->parent && (opts->marker & QOM_BWSPEC0x01)) | |||
2983 | opts->flags |= PFQS_ROOTCLASS0x0002; | |||
2984 | if (!(opts->marker & QOM_BWSPEC0x01) && | |||
2985 | !(opts->marker & QOM_FLOWS0x10)) { | |||
2986 | yyerror("no bandwidth or flow specification"); | |||
2987 | return (1); | |||
2988 | } | |||
2989 | if (strlcpy(qspec.qname, qname, sizeof(qspec.qname)) >= | |||
2990 | sizeof(qspec.qname)) { | |||
2991 | yyerror("queuename too long"); | |||
2992 | return (1); | |||
2993 | } | |||
2994 | if (opts->parent && strlcpy(qspec.parent, opts->parent, | |||
2995 | sizeof(qspec.parent)) >= sizeof(qspec.parent)) { | |||
2996 | yyerror("parent too long"); | |||
2997 | return (1); | |||
2998 | } | |||
2999 | if (strlcpy(qspec.ifname, interface->ifname, | |||
3000 | sizeof(qspec.ifname)) >= sizeof(qspec.ifname)) { | |||
3001 | yyerror("interface too long"); | |||
3002 | return (1); | |||
3003 | } | |||
3004 | qspec.realtime.m1.absolute = opts->realtime.m1.bw_absolute; | |||
3005 | qspec.realtime.m1.percent = opts->realtime.m1.bw_percent; | |||
3006 | qspec.realtime.m2.absolute = opts->realtime.m2.bw_absolute; | |||
3007 | qspec.realtime.m2.percent = opts->realtime.m2.bw_percent; | |||
3008 | qspec.realtime.d = opts->realtime.d; | |||
3009 | ||||
3010 | qspec.linkshare.m1.absolute = opts->linkshare.m1.bw_absolute; | |||
3011 | qspec.linkshare.m1.percent = opts->linkshare.m1.bw_percent; | |||
3012 | qspec.linkshare.m2.absolute = opts->linkshare.m2.bw_absolute; | |||
3013 | qspec.linkshare.m2.percent = opts->linkshare.m2.bw_percent; | |||
3014 | qspec.linkshare.d = opts->linkshare.d; | |||
3015 | ||||
3016 | qspec.upperlimit.m1.absolute = opts->upperlimit.m1.bw_absolute; | |||
3017 | qspec.upperlimit.m1.percent = opts->upperlimit.m1.bw_percent; | |||
3018 | qspec.upperlimit.m2.absolute = opts->upperlimit.m2.bw_absolute; | |||
3019 | qspec.upperlimit.m2.percent = opts->upperlimit.m2.bw_percent; | |||
3020 | qspec.upperlimit.d = opts->upperlimit.d; | |||
3021 | ||||
3022 | qspec.flowqueue.flows = opts->flowqueue.flows; | |||
3023 | qspec.flowqueue.quantum = opts->flowqueue.quantum; | |||
3024 | qspec.flowqueue.interval = opts->flowqueue.interval; | |||
3025 | qspec.flowqueue.target = opts->flowqueue.target; | |||
3026 | ||||
3027 | qspec.flags = opts->flags; | |||
3028 | qspec.qlimit = opts->qlimit; | |||
3029 | ||||
3030 | if (pfctl_add_queue(pf, &qspec)) { | |||
3031 | yyerror("cannot add queue"); | |||
3032 | return (1); | |||
3033 | } | |||
3034 | ); | |||
3035 | ||||
3036 | FREE_LIST(struct node_if, interfaces); | |||
3037 | return (0); | |||
3038 | } | |||
3039 | ||||
3040 | int | |||
3041 | expand_divertspec(struct pf_rule *r, struct divertspec *ds) | |||
3042 | { | |||
3043 | struct node_host *n; | |||
3044 | ||||
3045 | switch (ds->type) { | |||
3046 | case PF_DIVERT_NONE: | |||
3047 | return (0); | |||
3048 | case PF_DIVERT_TO: | |||
3049 | if (r->direction == PF_OUT) { | |||
3050 | yyerror("divert-to used with outgoing rule"); | |||
3051 | return (1); | |||
3052 | } | |||
3053 | if (r->af) { | |||
3054 | for (n = ds->addr; n != NULL((void *)0); n = n->next) | |||
3055 | if (n->af == r->af) | |||
3056 | break; | |||
3057 | if (n == NULL((void *)0)) { | |||
3058 | yyerror("divert-to address family mismatch"); | |||
3059 | return (1); | |||
3060 | } | |||
3061 | r->divert.addr = n->addr.v.a.addr; | |||
3062 | } else { | |||
3063 | r->af = ds->addr->af; | |||
3064 | r->divert.addr = ds->addr->addr.v.a.addr; | |||
3065 | } | |||
3066 | r->divert.port = ds->port; | |||
3067 | r->divert.type = ds->type; | |||
3068 | return (0); | |||
3069 | case PF_DIVERT_REPLY: | |||
3070 | if (r->direction == PF_IN) { | |||
3071 | yyerror("divert-reply used with incoming rule"); | |||
3072 | return (1); | |||
3073 | } | |||
3074 | r->divert.type = ds->type; | |||
3075 | return (0); | |||
3076 | case PF_DIVERT_PACKET: | |||
3077 | r->divert.port = ds->port; | |||
3078 | r->divert.type = ds->type; | |||
3079 | return (0); | |||
3080 | } | |||
3081 | return (1); | |||
3082 | } | |||
3083 | ||||
3084 | int | |||
3085 | collapse_redirspec(struct pf_pool *rpool, struct pf_rule *r, | |||
3086 | struct redirspec *rs, int routing) | |||
3087 | { | |||
3088 | struct pf_opt_tbl *tbl = NULL((void *)0); | |||
3089 | struct node_host *h, *hprev = NULL((void *)0); | |||
3090 | struct pf_rule_addr ra; | |||
3091 | int af = 0, naddr = 0; | |||
3092 | ||||
3093 | if (!rs || !rs->rdr || rs->rdr->host == NULL((void *)0)) { | |||
3094 | rpool->addr.type = PF_ADDR_NONE; | |||
3095 | return (0); | |||
3096 | } | |||
3097 | ||||
3098 | if (r->rule_flag & PFRULE_AFTO0x00200000) | |||
3099 | r->naf = rs->af; | |||
3100 | ||||
3101 | for (h = rs->rdr->host; h != NULL((void *)0); h = h->next) { | |||
3102 | if (routing) { | |||
3103 | if (h->addr.type == PF_ADDR_DYNIFTL && | |||
3104 | h->addr.iflags != PFI_AFLAG_PEER0x04) { | |||
3105 | yyerror("route spec requires :peer with " | |||
3106 | "dynamic interface addresses"); | |||
3107 | return (1); | |||
3108 | } | |||
3109 | } | |||
3110 | ||||
3111 | /* set rule address family if redirect spec has one */ | |||
3112 | if (rs->af && !r->af && !af) { | |||
3113 | /* swap address families for af-to */ | |||
3114 | if (r->naf == AF_INET624) | |||
3115 | af = AF_INET2; | |||
3116 | else if (r->naf == AF_INET2) | |||
3117 | af = AF_INET624; | |||
3118 | else | |||
3119 | af = rs->af; | |||
3120 | } | |||
3121 | if (h->af && !r->naf) { /* nat-to/rdr-to case */ | |||
3122 | /* skip if the rule af doesn't match redirect af */ | |||
3123 | if (r->af && r->af != h->af) | |||
3124 | continue; | |||
3125 | /* | |||
3126 | * fail if the chosen af is not universal for | |||
3127 | * all addresses in the redirect address pool | |||
3128 | */ | |||
3129 | if (!r->af && af && af != h->af) { | |||
3130 | yyerror("%s spec contains addresses with " | |||
3131 | "different address families", | |||
3132 | routing ? "routing" : "translation"); | |||
3133 | return (1); | |||
3134 | } | |||
3135 | } else if (h->af) { /* af-to case */ | |||
3136 | /* | |||
3137 | * fail if the redirect spec af is not universal | |||
3138 | * for all addresses in the redirect address pool | |||
3139 | */ | |||
3140 | if (rs->af && rs->af != h->af) { | |||
3141 | yyerror("%s spec contains addresses that " | |||
3142 | "don't match target address family", | |||
3143 | routing ? "routing" : "translation"); | |||
3144 | return (1); | |||
3145 | } | |||
3146 | } | |||
3147 | /* else if (!h->af): | |||
3148 | * we silently allow any not af-specific host specs, | |||
3149 | * e.g. (em0) and let the kernel deal with them | |||
3150 | */ | |||
3151 | ||||
3152 | /* if we haven't selected the rule af yet, now it's time */ | |||
3153 | if (!r->af && !af) | |||
3154 | af = h->af; | |||
3155 | ||||
3156 | if (naddr == 0) { /* the first host */ | |||
3157 | rpool->addr = h->addr; | |||
3158 | if (h->ifname) { | |||
3159 | yyerror("@if not permitted for %s", | |||
3160 | routing ? "routing" : "translation"); | |||
3161 | return (1); | |||
3162 | } | |||
3163 | if (h->ifname && strlcpy(rpool->ifname, h->ifname, | |||
3164 | sizeof(rpool->ifname)) >= sizeof(rpool->ifname)) | |||
3165 | errx(1, "collapse_redirspec: strlcpy"); | |||
3166 | hprev = h; /* in case we need to conver to a table */ | |||
3167 | } else { /* multiple hosts */ | |||
3168 | if (rs->pool_opts.type && | |||
3169 | !PF_POOL_DYNTYPE(rs->pool_opts.type)((((rs->pool_opts.type) & 0x0f) == PF_POOL_ROUNDROBIN) || (((rs->pool_opts.type) & 0x0f) == PF_POOL_LEASTSTATES ) || (((rs->pool_opts.type) & 0x0f) == PF_POOL_RANDOM) || (((rs->pool_opts.type) & 0x0f) == PF_POOL_SRCHASH) )) { | |||
3170 | yyerror("pool type is not valid for multiple " | |||
3171 | "translation or routing addresses"); | |||
3172 | return (1); | |||
3173 | } | |||
3174 | if ((hprev && hprev->addr.type != PF_ADDR_ADDRMASK) && | |||
3175 | (hprev && hprev->addr.type != PF_ADDR_NONE) && | |||
3176 | h->addr.type != PF_ADDR_ADDRMASK && | |||
3177 | h->addr.type != PF_ADDR_NONE) { | |||
3178 | yyerror("multiple tables or dynamic interfaces " | |||
3179 | "not supported for translation or routing"); | |||
3180 | return (1); | |||
3181 | } | |||
3182 | if (h->ifname) { | |||
3183 | yyerror("@if not permitted for %s", | |||
3184 | routing ? "routing" : "translation"); | |||
3185 | return (1); | |||
3186 | } | |||
3187 | if (hprev) { | |||
3188 | /* | |||
3189 | * undo some damage and convert the single | |||
3190 | * host pool to the table | |||
3191 | */ | |||
3192 | memset(&ra, 0, sizeof(ra)); | |||
3193 | memset(rpool->ifname, 0, sizeof(rpool->ifname)); | |||
3194 | ra.addr = hprev->addr; | |||
3195 | ra.weight = hprev->weight; | |||
3196 | if (add_opt_table(pf, &tbl, | |||
3197 | hprev->af, &ra, hprev->ifname)) | |||
3198 | return (1); | |||
3199 | hprev = NULL((void *)0); | |||
3200 | } | |||
3201 | memset(&ra, 0, sizeof(ra)); | |||
3202 | ra.addr = h->addr; | |||
3203 | ra.weight = h->weight; | |||
3204 | if (add_opt_table(pf, &tbl, | |||
3205 | h->af, &ra, h->ifname)) | |||
3206 | return (1); | |||
3207 | } | |||
3208 | naddr++; | |||
3209 | } | |||
3210 | /* set rule af to the one chosen above */ | |||
3211 | if (!r->af && af) | |||
3212 | r->af = af; | |||
3213 | if (!naddr) { | |||
3214 | yyerror("af mismatch in %s spec", | |||
3215 | routing ? "routing" : "translation"); | |||
3216 | return (1); | |||
3217 | } | |||
3218 | if (tbl) { | |||
3219 | if ((pf->opts & PF_OPT_NOACTION0x00008) == 0 && | |||
3220 | pf_opt_create_table(pf, tbl)) | |||
3221 | return (1); | |||
3222 | ||||
3223 | pf->tdirty = 1; | |||
3224 | ||||
3225 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
3226 | print_tabledef(tbl->pt_name, | |||
3227 | PFR_TFLAG_CONST0x00000002 | tbl->pt_flags, | |||
3228 | 1, &tbl->pt_nodes); | |||
3229 | ||||
3230 | memset(&rpool->addr, 0, sizeof(rpool->addr)); | |||
3231 | rpool->addr.type = PF_ADDR_TABLE; | |||
3232 | strlcpy(rpool->addr.v.tblname, tbl->pt_name, | |||
3233 | sizeof(rpool->addr.v.tblname)); | |||
3234 | ||||
3235 | pfr_buf_clear(tbl->pt_buf); | |||
3236 | free(tbl->pt_buf); | |||
3237 | tbl->pt_buf = NULL((void *)0); | |||
3238 | free(tbl); | |||
3239 | } | |||
3240 | return (0); | |||
3241 | } | |||
3242 | ||||
3243 | ||||
3244 | int | |||
3245 | apply_redirspec(struct pf_pool *rpool, struct pf_rule *r, struct redirspec *rs, | |||
3246 | int isrdr, struct node_port *np) | |||
3247 | { | |||
3248 | if (!rs || !rs->rdr) | |||
3249 | return (0); | |||
3250 | ||||
3251 | rpool->proxy_port[0] = ntohs(rs->rdr->rport.a)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.a) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.a) & 0xffU ) << 8 | ((__uint16_t)(rs->rdr->rport.a) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.a)); | |||
3252 | ||||
3253 | if (isrdr) { | |||
3254 | if (!rs->rdr->rport.b && rs->rdr->rport.t) { | |||
3255 | rpool->proxy_port[1] = ntohs(rs->rdr->rport.a)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.a) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.a) & 0xffU ) << 8 | ((__uint16_t)(rs->rdr->rport.a) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.a)) + | |||
3256 | (ntohs(np->port[1])(__uint16_t)(__builtin_constant_p(np->port[1]) ? (__uint16_t )(((__uint16_t)(np->port[1]) & 0xffU) << 8 | ((__uint16_t )(np->port[1]) & 0xff00U) >> 8) : __swap16md(np-> port[1])) - ntohs(np->port[0])(__uint16_t)(__builtin_constant_p(np->port[0]) ? (__uint16_t )(((__uint16_t)(np->port[0]) & 0xffU) << 8 | ((__uint16_t )(np->port[0]) & 0xff00U) >> 8) : __swap16md(np-> port[0]))); | |||
3257 | } else { | |||
3258 | if (validate_range(rs->rdr->rport.t, rs->rdr->rport.a, | |||
3259 | rs->rdr->rport.b)) { | |||
3260 | yyerror("invalid rdr-to port range"); | |||
3261 | return (1); | |||
3262 | } | |||
3263 | ||||
3264 | rpool->port_op = rs->rdr->rport.t; | |||
3265 | rpool->proxy_port[1] = ntohs(rs->rdr->rport.b)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.b) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.b) & 0xffU ) << 8 | ((__uint16_t)(rs->rdr->rport.b) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.b)); | |||
3266 | } | |||
3267 | } else { | |||
3268 | rpool->proxy_port[1] = ntohs(rs->rdr->rport.b)(__uint16_t)(__builtin_constant_p(rs->rdr->rport.b) ? ( __uint16_t)(((__uint16_t)(rs->rdr->rport.b) & 0xffU ) << 8 | ((__uint16_t)(rs->rdr->rport.b) & 0xff00U ) >> 8) : __swap16md(rs->rdr->rport.b)); | |||
3269 | if (!rpool->proxy_port[0] && !rpool->proxy_port[1]) { | |||
3270 | rpool->proxy_port[0] = PF_NAT_PROXY_PORT_LOW50001; | |||
3271 | rpool->proxy_port[1] = PF_NAT_PROXY_PORT_HIGH65535; | |||
3272 | } else if (!rpool->proxy_port[1]) | |||
3273 | rpool->proxy_port[1] = rpool->proxy_port[0]; | |||
3274 | } | |||
3275 | ||||
3276 | rpool->opts = rs->pool_opts.type; | |||
3277 | if ((rpool->opts & PF_POOL_TYPEMASK0x0f) == PF_POOL_NONE && | |||
3278 | (rpool->addr.type == PF_ADDR_TABLE || | |||
3279 | DYNIF_MULTIADDR(rpool->addr)((rpool->addr).type == PF_ADDR_DYNIFTL && (!((rpool ->addr).iflags & 0x08) || !isdigit((unsigned char)(rpool ->addr).v.ifname[strlen((rpool->addr).v.ifname)-1]))))) | |||
3280 | rpool->opts |= PF_POOL_ROUNDROBIN; | |||
3281 | ||||
3282 | if (!PF_POOL_DYNTYPE(rpool->opts)((((rpool->opts) & 0x0f) == PF_POOL_ROUNDROBIN) || ((( rpool->opts) & 0x0f) == PF_POOL_LEASTSTATES) || (((rpool ->opts) & 0x0f) == PF_POOL_RANDOM) || (((rpool->opts ) & 0x0f) == PF_POOL_SRCHASH)) && | |||
3283 | (disallow_table(rs->rdr->host, | |||
3284 | "tables are not supported by pool type") || | |||
3285 | disallow_alias(rs->rdr->host, | |||
3286 | "interface (%s) is not supported by pool type"))) | |||
3287 | return (1); | |||
3288 | ||||
3289 | if (rs->pool_opts.key != NULL((void *)0)) | |||
3290 | memcpy(&rpool->key, rs->pool_opts.key, | |||
3291 | sizeof(struct pf_poolhashkey)); | |||
3292 | ||||
3293 | if (rs->pool_opts.opts) | |||
3294 | rpool->opts |= rs->pool_opts.opts; | |||
3295 | ||||
3296 | if (rs->pool_opts.staticport) { | |||
3297 | if (isrdr) { | |||
3298 | yyerror("the 'static-port' option is only valid with " | |||
3299 | "nat rules"); | |||
3300 | return (1); | |||
3301 | } | |||
3302 | if (rpool->proxy_port[0] != PF_NAT_PROXY_PORT_LOW50001 && | |||
3303 | rpool->proxy_port[1] != PF_NAT_PROXY_PORT_HIGH65535) { | |||
3304 | yyerror("the 'static-port' option can't be used when " | |||
3305 | "specifying a port range"); | |||
3306 | return (1); | |||
3307 | } | |||
3308 | rpool->proxy_port[0] = 0; | |||
3309 | rpool->proxy_port[1] = 0; | |||
3310 | } | |||
3311 | ||||
3312 | return (0); | |||
3313 | } | |||
3314 | ||||
3315 | ||||
3316 | void | |||
3317 | expand_rule(struct pf_rule *r, int keeprule, struct node_if *interfaces, | |||
3318 | struct redirspec *nat, struct redirspec *rdr, struct redirspec *rroute, | |||
3319 | struct node_proto *protos, struct node_os *src_oses, | |||
3320 | struct node_host *src_hosts, struct node_port *src_ports, | |||
3321 | struct node_host *dst_hosts, struct node_port *dst_ports, | |||
3322 | struct node_uid *uids, struct node_gid *gids, struct node_if *rcv, | |||
3323 | struct node_icmp *icmp_types) | |||
3324 | { | |||
3325 | sa_family_t af = r->af; | |||
3326 | int added = 0, error = 0; | |||
3327 | char ifname[IF_NAMESIZE16]; | |||
3328 | char label[PF_RULE_LABEL_SIZE64]; | |||
3329 | char tagname[PF_TAG_NAME_SIZE64]; | |||
3330 | char match_tagname[PF_TAG_NAME_SIZE64]; | |||
3331 | u_int8_t flags, flagset, keep_state; | |||
3332 | struct node_host *srch, *dsth, *osrch, *odsth; | |||
3333 | struct redirspec binat; | |||
3334 | struct pf_rule rb; | |||
3335 | int dir = r->direction; | |||
3336 | ||||
3337 | if (strlcpy(label, r->label, sizeof(label)) >= sizeof(label)) | |||
3338 | errx(1, "expand_rule: strlcpy"); | |||
3339 | if (strlcpy(tagname, r->tagname, sizeof(tagname)) >= sizeof(tagname)) | |||
3340 | errx(1, "expand_rule: strlcpy"); | |||
3341 | if (strlcpy(match_tagname, r->match_tagname, sizeof(match_tagname)) >= | |||
3342 | sizeof(match_tagname)) | |||
3343 | errx(1, "expand_rule: strlcpy"); | |||
3344 | flags = r->flags; | |||
3345 | flagset = r->flagset; | |||
3346 | keep_state = r->keep_state; | |||
3347 | ||||
3348 | r->src.addr.type = r->dst.addr.type = PF_ADDR_ADDRMASK; | |||
3349 | ||||
3350 | LOOP_THROUGH(struct node_if, interface, interfaces, | |||
3351 | LOOP_THROUGH(struct node_proto, proto, protos, | |||
3352 | LOOP_THROUGH(struct node_icmp, icmp_type, icmp_types, | |||
3353 | LOOP_THROUGH(struct node_host, src_host, src_hosts, | |||
3354 | LOOP_THROUGH(struct node_host, dst_host, dst_hosts, | |||
3355 | LOOP_THROUGH(struct node_port, src_port, src_ports, | |||
3356 | LOOP_THROUGH(struct node_port, dst_port, dst_ports, | |||
3357 | LOOP_THROUGH(struct node_os, src_os, src_oses, | |||
3358 | LOOP_THROUGH(struct node_uid, uid, uids, | |||
3359 | LOOP_THROUGH(struct node_gid, gid, gids, | |||
3360 | ||||
3361 | r->af = af; | |||
3362 | ||||
3363 | error += collapse_redirspec(&r->rdr, r, rdr, 0); | |||
3364 | error += collapse_redirspec(&r->nat, r, nat, 0); | |||
3365 | error += collapse_redirspec(&r->route, r, rroute, 1); | |||
3366 | ||||
3367 | /* disallow @if in from or to for the time being */ | |||
3368 | if ((src_host->addr.type == PF_ADDR_ADDRMASK && | |||
3369 | src_host->ifname) || | |||
3370 | (dst_host->addr.type == PF_ADDR_ADDRMASK && | |||
3371 | dst_host->ifname)) { | |||
3372 | yyerror("@if syntax not permitted in from or to"); | |||
3373 | error++; | |||
3374 | } | |||
3375 | /* for link-local IPv6 address, interface must match up */ | |||
3376 | if ((r->af && src_host->af && r->af != src_host->af) || | |||
3377 | (r->af && dst_host->af && r->af != dst_host->af) || | |||
3378 | (src_host->af && dst_host->af && | |||
3379 | src_host->af != dst_host->af) || | |||
3380 | (src_host->ifindex && dst_host->ifindex && | |||
3381 | src_host->ifindex != dst_host->ifindex) || | |||
3382 | (src_host->ifindex && *interface->ifname && | |||
3383 | src_host->ifindex != ifa_nametoindex(interface->ifname)) || | |||
3384 | (dst_host->ifindex && *interface->ifname && | |||
3385 | dst_host->ifindex != ifa_nametoindex(interface->ifname))) | |||
3386 | continue; | |||
3387 | if (!r->af && src_host->af) | |||
3388 | r->af = src_host->af; | |||
3389 | else if (!r->af && dst_host->af) | |||
3390 | r->af = dst_host->af; | |||
3391 | ||||
3392 | if (*interface->ifname) | |||
3393 | strlcpy(r->ifname, interface->ifname, | |||
3394 | sizeof(r->ifname)); | |||
3395 | else if (ifa_indextoname(src_host->ifindex, ifname)) | |||
3396 | strlcpy(r->ifname, ifname, sizeof(r->ifname)); | |||
3397 | else if (ifa_indextoname(dst_host->ifindex, ifname)) | |||
3398 | strlcpy(r->ifname, ifname, sizeof(r->ifname)); | |||
3399 | else | |||
3400 | memset(r->ifname, '\0', sizeof(r->ifname)); | |||
3401 | ||||
3402 | if (interface->use_rdomain) | |||
3403 | r->onrdomain = interface->rdomain; | |||
3404 | else | |||
3405 | r->onrdomain = -1; | |||
3406 | if (strlcpy(r->label, label, sizeof(r->label)) >= | |||
3407 | sizeof(r->label)) | |||
3408 | errx(1, "expand_rule: strlcpy"); | |||
3409 | if (strlcpy(r->tagname, tagname, sizeof(r->tagname)) >= | |||
3410 | sizeof(r->tagname)) | |||
3411 | errx(1, "expand_rule: strlcpy"); | |||
3412 | if (strlcpy(r->match_tagname, match_tagname, | |||
3413 | sizeof(r->match_tagname)) >= sizeof(r->match_tagname)) | |||
3414 | errx(1, "expand_rule: strlcpy"); | |||
3415 | expand_label(r->label, PF_RULE_LABEL_SIZE64, r->ifname, r->af, | |||
3416 | src_host, src_port, dst_host, dst_port, proto->proto); | |||
3417 | expand_label(r->tagname, PF_TAG_NAME_SIZE64, r->ifname, r->af, | |||
3418 | src_host, src_port, dst_host, dst_port, proto->proto); | |||
3419 | expand_label(r->match_tagname, PF_TAG_NAME_SIZE64, r->ifname, | |||
3420 | r->af, src_host, src_port, dst_host, dst_port, | |||
3421 | proto->proto); | |||
3422 | ||||
3423 | osrch = odsth = NULL((void *)0); | |||
3424 | if (src_host->addr.type == PF_ADDR_DYNIFTL) { | |||
3425 | osrch = src_host; | |||
3426 | if ((src_host = gen_dynnode(src_host, r->af)) == NULL((void *)0)) | |||
3427 | err(1, "%s", __func__); | |||
3428 | } | |||
3429 | if (dst_host->addr.type == PF_ADDR_DYNIFTL) { | |||
3430 | odsth = dst_host; | |||
3431 | if ((dst_host = gen_dynnode(dst_host, r->af)) == NULL((void *)0)) | |||
3432 | err(1, "%s", __func__); | |||
3433 | } | |||
3434 | ||||
3435 | error += check_netmask(src_host, r->af); | |||
3436 | error += check_netmask(dst_host, r->af); | |||
3437 | ||||
3438 | r->ifnot = interface->not; | |||
3439 | r->proto = proto->proto; | |||
3440 | r->src.addr = src_host->addr; | |||
3441 | r->src.neg = src_host->not; | |||
3442 | r->src.port[0] = src_port->port[0]; | |||
3443 | r->src.port[1] = src_port->port[1]; | |||
3444 | r->src.port_op = src_port->op; | |||
3445 | r->dst.addr = dst_host->addr; | |||
3446 | r->dst.neg = dst_host->not; | |||
3447 | r->dst.port[0] = dst_port->port[0]; | |||
3448 | r->dst.port[1] = dst_port->port[1]; | |||
3449 | r->dst.port_op = dst_port->op; | |||
3450 | r->uid.op = uid->op; | |||
3451 | r->uid.uid[0] = uid->uid[0]; | |||
3452 | r->uid.uid[1] = uid->uid[1]; | |||
3453 | r->gid.op = gid->op; | |||
3454 | r->gid.gid[0] = gid->gid[0]; | |||
3455 | r->gid.gid[1] = gid->gid[1]; | |||
3456 | if (rcv) { | |||
3457 | strlcpy(r->rcv_ifname, rcv->ifname, | |||
3458 | sizeof(r->rcv_ifname)); | |||
3459 | r->rcvifnot = rcv->not; | |||
3460 | } | |||
3461 | r->type = icmp_type->type; | |||
3462 | r->code = icmp_type->code; | |||
3463 | ||||
3464 | if ((keep_state == PF_STATE_MODULATE0x2 || | |||
3465 | keep_state == PF_STATE_SYNPROXY0x3) && | |||
3466 | r->proto && r->proto != IPPROTO_TCP6) | |||
3467 | r->keep_state = PF_STATE_NORMAL0x1; | |||
3468 | else | |||
3469 | r->keep_state = keep_state; | |||
3470 | ||||
3471 | if (r->proto && r->proto != IPPROTO_TCP6) { | |||
3472 | r->flags = 0; | |||
3473 | r->flagset = 0; | |||
3474 | } else { | |||
3475 | r->flags = flags; | |||
3476 | r->flagset = flagset; | |||
3477 | } | |||
3478 | if (icmp_type->proto && r->proto != icmp_type->proto) { | |||
3479 | yyerror("icmp-type mismatch"); | |||
3480 | error++; | |||
3481 | } | |||
3482 | ||||
3483 | if (src_os && src_os->os) { | |||
3484 | r->os_fingerprint = pfctl_get_fingerprint(src_os->os); | |||
3485 | if ((pf->opts & PF_OPT_VERBOSE20x00080) && | |||
3486 | r->os_fingerprint == PF_OSFP_NOMATCH((pf_osfp_t)-2)) | |||
3487 | fprintf(stderr(&__sF[2]), | |||
3488 | "warning: unknown '%s' OS fingerprint\n", | |||
3489 | src_os->os); | |||
3490 | } else { | |||
3491 | r->os_fingerprint = PF_OSFP_ANY((pf_osfp_t)0); | |||
3492 | } | |||
3493 | ||||
3494 | if (nat && nat->rdr && nat->binat) { | |||
3495 | if (disallow_table(src_host, "invalid use of table " | |||
3496 | "<%s> as the source address of a binat-to rule") || | |||
3497 | disallow_alias(src_host, "invalid use of interface " | |||
3498 | "(%s) as the source address of a binat-to rule")) { | |||
3499 | error++; | |||
3500 | } else if ((r->src.addr.type != PF_ADDR_ADDRMASK && | |||
3501 | r->src.addr.type != PF_ADDR_DYNIFTL) || | |||
3502 | (r->nat.addr.type != PF_ADDR_ADDRMASK && | |||
3503 | r->nat.addr.type != PF_ADDR_DYNIFTL)) { | |||
3504 | yyerror("binat-to requires a specified " | |||
3505 | "source and redirect address"); | |||
3506 | error++; | |||
3507 | } | |||
3508 | if (DYNIF_MULTIADDR(r->src.addr)((r->src.addr).type == PF_ADDR_DYNIFTL && (!((r-> src.addr).iflags & 0x08) || !isdigit((unsigned char)(r-> src.addr).v.ifname[strlen((r->src.addr).v.ifname)-1]))) || | |||
3509 | DYNIF_MULTIADDR(r->nat.addr)((r->nat.addr).type == PF_ADDR_DYNIFTL && (!((r-> nat.addr).iflags & 0x08) || !isdigit((unsigned char)(r-> nat.addr).v.ifname[strlen((r->nat.addr).v.ifname)-1])))) { | |||
3510 | yyerror ("dynamic interfaces must be used with " | |||
3511 | ":0 in a binat-to rule"); | |||
3512 | error++; | |||
3513 | } | |||
3514 | if (PF_AZERO(&r->src.addr.v.a.mask, af)((af == 2 && !(&r->src.addr.v.a.mask)->pfa. addr32[0]) || (af == 24 && !(&r->src.addr.v.a. mask)->pfa.addr32[0] && !(&r->src.addr.v.a. mask)->pfa.addr32[1] && !(&r->src.addr.v.a. mask)->pfa.addr32[2] && !(&r->src.addr.v.a. mask)->pfa.addr32[3] )) || | |||
3515 | PF_AZERO(&r->nat.addr.v.a.mask, af)((af == 2 && !(&r->nat.addr.v.a.mask)->pfa. addr32[0]) || (af == 24 && !(&r->nat.addr.v.a. mask)->pfa.addr32[0] && !(&r->nat.addr.v.a. mask)->pfa.addr32[1] && !(&r->nat.addr.v.a. mask)->pfa.addr32[2] && !(&r->nat.addr.v.a. mask)->pfa.addr32[3] ))) { | |||
3516 | yyerror ("source and redir addresess must have " | |||
3517 | "a matching network mask in binat-rule"); | |||
3518 | error++; | |||
3519 | } | |||
3520 | if (r->nat.addr.type == PF_ADDR_TABLE) { | |||
3521 | yyerror ("tables cannot be used as the redirect " | |||
3522 | "address of a binat-to rule"); | |||
3523 | error++; | |||
3524 | } | |||
3525 | if (r->direction != PF_INOUT) { | |||
3526 | yyerror("binat-to cannot be specified " | |||
3527 | "with a direction"); | |||
3528 | error++; | |||
3529 | } | |||
3530 | ||||
3531 | /* first specify outbound NAT rule */ | |||
3532 | r->direction = PF_OUT; | |||
3533 | } | |||
3534 | ||||
3535 | error += apply_redirspec(&r->nat, r, nat, 0, dst_port); | |||
3536 | error += apply_redirspec(&r->rdr, r, rdr, 1, dst_port); | |||
3537 | error += apply_redirspec(&r->route, r, rroute, 2, dst_port); | |||
3538 | ||||
3539 | if (rule_consistent(r) < 0 || error) | |||
3540 | yyerror("skipping rule due to errors"); | |||
3541 | else { | |||
3542 | r->nr = pf->astack[pf->asd]->match++; | |||
3543 | pfctl_add_rule(pf, r); | |||
3544 | added++; | |||
3545 | } | |||
3546 | r->direction = dir; | |||
3547 | ||||
3548 | /* Generate binat's matching inbound rule */ | |||
3549 | if (!error && nat && nat->rdr && nat->binat) { | |||
3550 | bcopy(r, &rb, sizeof(rb)); | |||
3551 | ||||
3552 | /* now specify inbound rdr rule */ | |||
3553 | rb.direction = PF_IN; | |||
3554 | ||||
3555 | if ((srch = calloc(1, sizeof(*srch))) == NULL((void *)0)) | |||
3556 | err(1, "%s", __func__); | |||
3557 | bcopy(src_host, srch, sizeof(*srch)); | |||
3558 | srch->ifname = NULL((void *)0); | |||
3559 | srch->next = NULL((void *)0); | |||
3560 | srch->tail = NULL((void *)0); | |||
3561 | ||||
3562 | if ((dsth = calloc(1, sizeof(*dsth))) == NULL((void *)0)) | |||
3563 | err(1, "%s", __func__); | |||
3564 | bcopy(&rb.nat.addr, &dsth->addr, sizeof(dsth->addr)); | |||
3565 | dsth->ifname = NULL((void *)0); | |||
3566 | dsth->next = NULL((void *)0); | |||
3567 | dsth->tail = NULL((void *)0); | |||
3568 | ||||
3569 | bzero(&binat, sizeof(binat)); | |||
3570 | if ((binat.rdr = | |||
3571 | calloc(1, sizeof(*binat.rdr))) == NULL((void *)0)) | |||
3572 | err(1, "%s", __func__); | |||
3573 | bcopy(nat->rdr, binat.rdr, sizeof(*binat.rdr)); | |||
3574 | bcopy(&nat->pool_opts, &binat.pool_opts, | |||
3575 | sizeof(binat.pool_opts)); | |||
3576 | binat.pool_opts.staticport = 0; | |||
3577 | binat.rdr->host = srch; | |||
3578 | ||||
3579 | expand_rule(&rb, 1, interface, NULL((void *)0), &binat, NULL((void *)0), | |||
3580 | proto, | |||
3581 | src_os, dst_host, dst_port, dsth, src_port, | |||
3582 | uid, gid, rcv, icmp_type); | |||
3583 | } | |||
3584 | ||||
3585 | if (osrch && src_host->addr.type == PF_ADDR_DYNIFTL) { | |||
3586 | free(src_host); | |||
3587 | src_host = osrch; | |||
3588 | } | |||
3589 | if (odsth && dst_host->addr.type == PF_ADDR_DYNIFTL) { | |||
3590 | free(dst_host); | |||
3591 | dst_host = odsth; | |||
3592 | } | |||
3593 | )))))))))); | |||
3594 | ||||
3595 | if (!keeprule) { | |||
3596 | FREE_LIST(struct node_if, interfaces); | |||
3597 | FREE_LIST(struct node_proto, protos); | |||
3598 | FREE_LIST(struct node_host, src_hosts); | |||
3599 | FREE_LIST(struct node_port, src_ports); | |||
3600 | FREE_LIST(struct node_os, src_oses); | |||
3601 | FREE_LIST(struct node_host, dst_hosts); | |||
3602 | FREE_LIST(struct node_port, dst_ports); | |||
3603 | FREE_LIST(struct node_uid, uids); | |||
3604 | FREE_LIST(struct node_gid, gids); | |||
3605 | FREE_LIST(struct node_icmp, icmp_types); | |||
3606 | if (nat && nat->rdr) | |||
3607 | FREE_LIST(struct node_host, nat->rdr->host); | |||
3608 | if (rdr && rdr->rdr) | |||
3609 | FREE_LIST(struct node_host, rdr->rdr->host); | |||
3610 | ||||
3611 | } | |||
3612 | ||||
3613 | if (!added) | |||
3614 | yyerror("rule expands to no valid combination"); | |||
3615 | } | |||
3616 | ||||
3617 | int | |||
3618 | expand_skip_interface(struct node_if *interfaces) | |||
3619 | { | |||
3620 | int errs = 0; | |||
3621 | ||||
3622 | if (!interfaces || (!interfaces->next && !interfaces->not && | |||
3623 | !strcmp(interfaces->ifname, "none"))) { | |||
3624 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
3625 | printf("set skip on none\n"); | |||
3626 | errs = pfctl_set_interface_flags(pf, "", PFI_IFLAG_SKIP0x0100, 0); | |||
3627 | return (errs); | |||
3628 | } | |||
3629 | ||||
3630 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
3631 | printf("set skip on {"); | |||
3632 | LOOP_THROUGH(struct node_if, interface, interfaces, | |||
3633 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
3634 | printf(" %s", interface->ifname); | |||
3635 | if (interface->not) { | |||
3636 | yyerror("skip on ! <interface> is not supported"); | |||
3637 | errs++; | |||
3638 | } else if (interface->use_rdomain) { | |||
3639 | yyerror("skip on rdomain <num> is not supported"); | |||
3640 | errs++; | |||
3641 | } else | |||
3642 | errs += pfctl_set_interface_flags(pf, | |||
3643 | interface->ifname, PFI_IFLAG_SKIP0x0100, 1); | |||
3644 | ); | |||
3645 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
3646 | printf(" }\n"); | |||
3647 | ||||
3648 | FREE_LIST(struct node_if, interfaces); | |||
3649 | ||||
3650 | if (errs) | |||
3651 | return (1); | |||
3652 | else | |||
3653 | return (0); | |||
3654 | } | |||
3655 | ||||
3656 | void | |||
3657 | freehostlist(struct node_host *h) | |||
3658 | { | |||
3659 | struct node_host *n; | |||
3660 | ||||
3661 | for (n = h; n != NULL((void *)0); n = n->next) | |||
3662 | if (n->ifname) | |||
3663 | free(n->ifname); | |||
3664 | FREE_LIST(struct node_host, h); | |||
3665 | } | |||
3666 | ||||
3667 | #undef FREE_LIST | |||
3668 | #undef LOOP_THROUGH | |||
3669 | ||||
3670 | int | |||
3671 | kw_cmp(const void *k, const void *e) | |||
3672 | { | |||
3673 | return (strcmp(k, ((const struct keywords *)e)->k_name)); | |||
3674 | } | |||
3675 | ||||
3676 | int | |||
3677 | lookup(char *s) | |||
3678 | { | |||
3679 | /* this has to be sorted always */ | |||
3680 | static const struct keywords keywords[] = { | |||
3681 | { "af-to", AFTO377}, | |||
3682 | { "all", ALL277}, | |||
3683 | { "allow-opts", ALLOWOPTS290}, | |||
3684 | { "anchor", ANCHOR309}, | |||
3685 | { "antispoof", ANTISPOOF324}, | |||
3686 | { "any", ANY278}, | |||
3687 | { "bandwidth", BANDWIDTH336}, | |||
3688 | { "binat-to", BINATTO286}, | |||
3689 | { "bitmask", BITMASK328}, | |||
3690 | { "block", BLOCK258}, | |||
3691 | { "block-policy", BLOCKPOLICY316}, | |||
3692 | { "burst", BURST345}, | |||
3693 | { "code", CODE281}, | |||
3694 | { "debug", DEBUG321}, | |||
3695 | { "default", DEFAULT351}, | |||
3696 | { "delay", DELAY352}, | |||
3697 | { "divert-packet", DIVERTPACKET375}, | |||
3698 | { "divert-reply", DIVERTREPLY374}, | |||
3699 | { "divert-to", DIVERTTO373}, | |||
3700 | { "drop", DROP306}, | |||
3701 | { "dup-to", DUPTO293}, | |||
3702 | { "file", FILENAME291}, | |||
3703 | { "fingerprints", FINGERPRINTS319}, | |||
3704 | { "flags", FLAGS270}, | |||
3705 | { "floating", FLOATING369}, | |||
3706 | { "flows", FLOWS337}, | |||
3707 | { "flush", FLUSH362}, | |||
3708 | { "for", FOR325}, | |||
3709 | { "fragment", FRAGMENT299}, | |||
3710 | { "from", FROM268}, | |||
3711 | { "global", GLOBAL357}, | |||
3712 | { "group", GROUP301}, | |||
3713 | { "hostid", HOSTID323}, | |||
3714 | { "icmp-type", ICMPTYPE279}, | |||
3715 | { "icmp6-type", ICMP6TYPE280}, | |||
3716 | { "if-bound", IFBOUND368}, | |||
3717 | { "in", IN262}, | |||
3718 | { "include", INCLUDE326}, | |||
3719 | { "inet", INET275}, | |||
3720 | { "inet6", INET6276}, | |||
3721 | { "keep", KEEP282}, | |||
3722 | { "label", LABEL296}, | |||
3723 | { "least-states", LEASTSTATES332}, | |||
3724 | { "limit", LIMIT314}, | |||
3725 | { "load", LOAD347}, | |||
3726 | { "log", LOG265}, | |||
3727 | { "loginterface", LOGINTERFACE315}, | |||
3728 | { "match", MATCH259}, | |||
3729 | { "matches", MATCHES327}, | |||
3730 | { "max", MAXIMUM303}, | |||
3731 | { "max-mss", MAXMSS302}, | |||
3732 | { "max-pkt-rate", MAXPKTRATE365}, | |||
3733 | { "max-src-conn", MAXSRCCONN359}, | |||
3734 | { "max-src-conn-rate", MAXSRCCONNRATE360}, | |||
3735 | { "max-src-nodes", MAXSRCNODES355}, | |||
3736 | { "max-src-states", MAXSRCSTATES354}, | |||
3737 | { "min", MINIMUM344}, | |||
3738 | { "min-ttl", MINTTL288}, | |||
3739 | { "modulate", MODULATE283}, | |||
3740 | { "nat-to", NATTO376}, | |||
3741 | { "no", NO295}, | |||
3742 | { "no-df", NODF287}, | |||
3743 | { "no-route", NOROUTE297}, | |||
3744 | { "no-sync", NOSYNC320}, | |||
3745 | { "on", ON267}, | |||
3746 | { "once", ONCE350}, | |||
3747 | { "optimization", OPTIMIZATION312}, | |||
3748 | { "os", OS263}, | |||
3749 | { "out", OUT264}, | |||
3750 | { "overload", OVERLOAD361}, | |||
3751 | { "parent", PARENT346}, | |||
3752 | { "pass", PASS257}, | |||
3753 | { "pflow", PFLOW364}, | |||
3754 | { "port", PORT285}, | |||
3755 | { "prio", PRIO349}, | |||
3756 | { "probability", PROBABILITY334}, | |||
3757 | { "proto", PROTO274}, | |||
3758 | { "qlimit", QLIMIT341}, | |||
3759 | { "quantum", QUANTUM338}, | |||
3760 | { "queue", QUEUE339}, | |||
3761 | { "quick", QUICK266}, | |||
3762 | { "random", RANDOM329}, | |||
3763 | { "random-id", RANDOMID317}, | |||
3764 | { "rdomain", RDOMAIN343}, | |||
3765 | { "rdr-to", RDRTO378}, | |||
3766 | { "reassemble", REASSEMBLE308}, | |||
3767 | { "received-on", RECEIVEDON379}, | |||
3768 | { "reply-to", REPLYTO294}, | |||
3769 | { "return", RETURN261}, | |||
3770 | { "return-icmp", RETURNICMP272}, | |||
3771 | { "return-icmp6", RETURNICMP6273}, | |||
3772 | { "return-rst", RETURNRST271}, | |||
3773 | { "round-robin", ROUNDROBIN331}, | |||
3774 | { "route", ROUTE372}, | |||
3775 | { "route-to", ROUTETO292}, | |||
3776 | { "rtable", RTABLE342}, | |||
3777 | { "rule", RULE358}, | |||
3778 | { "ruleset-optimization", RULESET_OPTIMIZATION348}, | |||
3779 | { "scrub", SCRUB260}, | |||
3780 | { "set", SET311}, | |||
3781 | { "skip", SKIP322}, | |||
3782 | { "sloppy", SLOPPY363}, | |||
3783 | { "source-hash", SOURCEHASH330}, | |||
3784 | { "source-track", SOURCETRACK356}, | |||
3785 | { "state", STATE284}, | |||
3786 | { "state-defaults", STATEDEFAULTS371}, | |||
3787 | { "state-policy", STATEPOLICY370}, | |||
3788 | { "static-port", STATICPORT333}, | |||
3789 | { "sticky-address", STICKYADDRESS353}, | |||
3790 | { "syncookies", SYNCOOKIES310}, | |||
3791 | { "synproxy", SYNPROXY318}, | |||
3792 | { "table", TABLE307}, | |||
3793 | { "tag", TAG367}, | |||
3794 | { "tagged", TAGGED366}, | |||
3795 | { "timeout", TIMEOUT313}, | |||
3796 | { "to", TO269}, | |||
3797 | { "tos", TOS305}, | |||
3798 | { "ttl", TTL304}, | |||
3799 | { "urpf-failed", URPFFAILED298}, | |||
3800 | { "user", USER300}, | |||
3801 | { "weight", WEIGHT335}, | |||
3802 | }; | |||
3803 | const struct keywords *p; | |||
3804 | ||||
3805 | p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]), | |||
3806 | sizeof(keywords[0]), kw_cmp); | |||
3807 | ||||
3808 | if (p) { | |||
3809 | if (debug > 1) | |||
3810 | fprintf(stderr(&__sF[2]), "%s: %d\n", s, p->k_val); | |||
3811 | return (p->k_val); | |||
3812 | } else { | |||
3813 | if (debug > 1) | |||
3814 | fprintf(stderr(&__sF[2]), "string: %s\n", s); | |||
3815 | return (STRING383); | |||
3816 | } | |||
3817 | } | |||
3818 | ||||
3819 | #define START_EXPAND1 1 | |||
3820 | #define DONE_EXPAND2 2 | |||
3821 | ||||
3822 | static int expanding; | |||
3823 | ||||
3824 | int | |||
3825 | igetc(void) | |||
3826 | { | |||
3827 | int c; | |||
3828 | while (1) { | |||
3829 | if (file->ungetpos > 0) | |||
3830 | c = file->ungetbuf[--file->ungetpos]; | |||
3831 | else | |||
3832 | c = getc(file->stream)(!__isthreaded ? (--(file->stream)->_r < 0 ? __srget (file->stream) : (int)(*(file->stream)->_p++)) : (getc )(file->stream)); | |||
3833 | if (c == START_EXPAND1) | |||
3834 | expanding = 1; | |||
3835 | else if (c == DONE_EXPAND2) | |||
3836 | expanding = 0; | |||
3837 | else | |||
3838 | break; | |||
3839 | } | |||
3840 | return (c); | |||
3841 | } | |||
3842 | ||||
3843 | int | |||
3844 | lgetc(int quotec) | |||
3845 | { | |||
3846 | int c, next; | |||
3847 | ||||
3848 | if (quotec) { | |||
3849 | if ((c = igetc()) == EOF(-1)) { | |||
3850 | yyerror("reached end of file while parsing quoted string"); | |||
3851 | if (file == topfile || popfile() == EOF(-1)) | |||
3852 | return (EOF(-1)); | |||
3853 | return (quotec); | |||
3854 | } | |||
3855 | return (c); | |||
3856 | } | |||
3857 | ||||
3858 | while ((c = igetc()) == '\\') { | |||
3859 | next = igetc(); | |||
3860 | if (next != '\n') { | |||
3861 | c = next; | |||
3862 | break; | |||
3863 | } | |||
3864 | yylval.lineno = file->lineno; | |||
3865 | file->lineno++; | |||
3866 | } | |||
3867 | ||||
3868 | if (c == EOF(-1)) { | |||
3869 | /* | |||
3870 | * Fake EOL when hit EOF for the first time. This gets line | |||
3871 | * count right if last line in included file is syntactically | |||
3872 | * invalid and has no newline. | |||
3873 | */ | |||
3874 | if (file->eof_reached == 0) { | |||
3875 | file->eof_reached = 1; | |||
3876 | return ('\n'); | |||
3877 | } | |||
3878 | while (c == EOF(-1)) { | |||
3879 | if (file == topfile || popfile() == EOF(-1)) | |||
3880 | return (EOF(-1)); | |||
3881 | c = igetc(); | |||
3882 | } | |||
3883 | } | |||
3884 | ||||
3885 | return (c); | |||
3886 | } | |||
3887 | ||||
3888 | void | |||
3889 | lungetc(int c) | |||
3890 | { | |||
3891 | if (c == EOF(-1)) | |||
3892 | return; | |||
3893 | if (file->ungetpos >= file->ungetsize) { | |||
3894 | void *p = reallocarray(file->ungetbuf, file->ungetsize, 2); | |||
3895 | if (p == NULL((void *)0)) | |||
3896 | err(1, "%s", __func__); | |||
3897 | file->ungetbuf = p; | |||
3898 | file->ungetsize *= 2; | |||
3899 | } | |||
3900 | file->ungetbuf[file->ungetpos++] = c; | |||
3901 | } | |||
3902 | ||||
3903 | int | |||
3904 | findeol(void) | |||
3905 | { | |||
3906 | int c; | |||
3907 | ||||
3908 | /* skip to either EOF or the first real EOL */ | |||
3909 | while (1) { | |||
3910 | c = lgetc(0); | |||
3911 | if (c == '\n') { | |||
3912 | file->lineno++; | |||
3913 | break; | |||
3914 | } | |||
3915 | if (c == EOF(-1)) | |||
3916 | break; | |||
3917 | } | |||
3918 | return (ERROR289); | |||
3919 | } | |||
3920 | ||||
3921 | int | |||
3922 | yylex(void) | |||
3923 | { | |||
3924 | char buf[8096]; | |||
3925 | char *p, *val; | |||
3926 | int quotec, next, c; | |||
3927 | int token; | |||
3928 | ||||
3929 | top: | |||
3930 | p = buf; | |||
3931 | while ((c = lgetc(0)) == ' ' || c == '\t') | |||
3932 | ; /* nothing */ | |||
3933 | ||||
3934 | yylval.lineno = file->lineno; | |||
3935 | if (c == '#') | |||
3936 | while ((c = lgetc(0)) != '\n' && c != EOF(-1)) | |||
3937 | ; /* nothing */ | |||
3938 | if (c == '$' && !expanding) { | |||
3939 | while (1) { | |||
3940 | if ((c = lgetc(0)) == EOF(-1)) | |||
3941 | return (0); | |||
3942 | ||||
3943 | if (p + 1 >= buf + sizeof(buf) - 1) { | |||
3944 | yyerror("string too long"); | |||
3945 | return (findeol()); | |||
3946 | } | |||
3947 | if (isalnum(c) || c == '_') { | |||
3948 | *p++ = c; | |||
3949 | continue; | |||
3950 | } | |||
3951 | *p = '\0'; | |||
3952 | lungetc(c); | |||
3953 | break; | |||
3954 | } | |||
3955 | val = symget(buf); | |||
3956 | if (val == NULL((void *)0)) { | |||
3957 | yyerror("macro '%s' not defined", buf); | |||
3958 | return (findeol()); | |||
3959 | } | |||
3960 | p = val + strlen(val) - 1; | |||
3961 | lungetc(DONE_EXPAND2); | |||
3962 | while (p >= val) { | |||
3963 | lungetc((unsigned char)*p); | |||
3964 | p--; | |||
3965 | } | |||
3966 | lungetc(START_EXPAND1); | |||
3967 | goto top; | |||
3968 | } | |||
3969 | ||||
3970 | switch (c) { | |||
3971 | case '\'': | |||
3972 | case '"': | |||
3973 | quotec = c; | |||
3974 | while (1) { | |||
3975 | if ((c = lgetc(quotec)) == EOF(-1)) | |||
3976 | return (0); | |||
3977 | if (c == '\n') { | |||
3978 | file->lineno++; | |||
3979 | continue; | |||
3980 | } else if (c == '\\') { | |||
3981 | if ((next = lgetc(quotec)) == EOF(-1)) | |||
3982 | return (0); | |||
3983 | if (next == quotec || next == ' ' || | |||
3984 | next == '\t') | |||
3985 | c = next; | |||
3986 | else if (next == '\n') { | |||
3987 | file->lineno++; | |||
3988 | continue; | |||
3989 | } else | |||
3990 | lungetc(next); | |||
3991 | } else if (c == quotec) { | |||
3992 | *p = '\0'; | |||
3993 | break; | |||
3994 | } else if (c == '\0') { | |||
3995 | yyerror("syntax error"); | |||
3996 | return (findeol()); | |||
3997 | } | |||
3998 | if (p + 1 >= buf + sizeof(buf) - 1) { | |||
3999 | yyerror("string too long"); | |||
4000 | return (findeol()); | |||
4001 | } | |||
4002 | *p++ = c; | |||
4003 | } | |||
4004 | yylval.v.string = strdup(buf); | |||
4005 | if (yylval.v.string == NULL((void *)0)) | |||
4006 | err(1, "%s", __func__); | |||
4007 | return (STRING383); | |||
4008 | case '!': | |||
4009 | next = lgetc(0); | |||
4010 | if (next == '=') | |||
4011 | return (NE380); | |||
4012 | lungetc(next); | |||
4013 | break; | |||
4014 | case '<': | |||
4015 | next = lgetc(0); | |||
4016 | if (next == '>') { | |||
4017 | yylval.v.i = PF_OP_XRG; | |||
4018 | return (PORTBINARY385); | |||
4019 | } else if (next == '=') | |||
4020 | return (LE381); | |||
4021 | lungetc(next); | |||
4022 | break; | |||
4023 | case '>': | |||
4024 | next = lgetc(0); | |||
4025 | if (next == '<') { | |||
4026 | yylval.v.i = PF_OP_IRG; | |||
4027 | return (PORTBINARY385); | |||
4028 | } else if (next == '=') | |||
4029 | return (GE382); | |||
4030 | lungetc(next); | |||
4031 | break; | |||
4032 | } | |||
4033 | ||||
4034 | #define allowed_to_end_number(x)(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') \ | |||
4035 | (isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=') | |||
4036 | ||||
4037 | if (c == '-' || isdigit(c)) { | |||
4038 | do { | |||
4039 | *p++ = c; | |||
4040 | if ((size_t)(p-buf) >= sizeof(buf)) { | |||
4041 | yyerror("string too long"); | |||
4042 | return (findeol()); | |||
4043 | } | |||
4044 | } while ((c = lgetc(0)) != EOF(-1) && isdigit(c)); | |||
4045 | lungetc(c); | |||
4046 | if (p == buf + 1 && buf[0] == '-') | |||
4047 | goto nodigits; | |||
4048 | if (c == EOF(-1) || allowed_to_end_number(c)(isspace(c) || c == ')' || c ==',' || c == '/' || c == '}' || c == '=')) { | |||
4049 | const char *errstr = NULL((void *)0); | |||
4050 | ||||
4051 | *p = '\0'; | |||
4052 | yylval.v.number = strtonum(buf, LLONG_MIN(-0x7fffffffffffffffLL-1), | |||
4053 | LLONG_MAX0x7fffffffffffffffLL, &errstr); | |||
4054 | if (errstr) { | |||
4055 | yyerror("\"%s\" invalid number: %s", | |||
4056 | buf, errstr); | |||
4057 | return (findeol()); | |||
4058 | } | |||
4059 | return (NUMBER384); | |||
4060 | } else { | |||
4061 | nodigits: | |||
4062 | while (p > buf + 1) | |||
4063 | lungetc((unsigned char)*--p); | |||
4064 | c = (unsigned char)*--p; | |||
4065 | if (c == '-') | |||
4066 | return (c); | |||
4067 | } | |||
4068 | } | |||
4069 | ||||
4070 | #define allowed_in_string(x)(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && x != '{' && x != '}' && x != '<' && x != '>' && x != '!' && x != '=' && x != '/' && x != '#' && x != ',') ) \ | |||
4071 | (isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \ | |||
4072 | x != '{' && x != '}' && x != '<' && x != '>' && \ | |||
4073 | x != '!' && x != '=' && x != '/' && x != '#' && \ | |||
4074 | x != ',')) | |||
4075 | ||||
4076 | if (isalnum(c) || c == ':' || c == '_') { | |||
4077 | do { | |||
4078 | *p++ = c; | |||
4079 | if ((size_t)(p-buf) >= sizeof(buf)) { | |||
4080 | yyerror("string too long"); | |||
4081 | return (findeol()); | |||
4082 | } | |||
4083 | } while ((c = lgetc(0)) != EOF(-1) && (allowed_in_string(c)(isalnum(c) || (ispunct(c) && c != '(' && c != ')' && c != '{' && c != '}' && c != '<' && c != '>' && c != '!' && c != '=' && c != '/' && c != '#' && c != ',') ))); | |||
4084 | lungetc(c); | |||
4085 | *p = '\0'; | |||
4086 | if ((token = lookup(buf)) == STRING383) | |||
4087 | if ((yylval.v.string = strdup(buf)) == NULL((void *)0)) | |||
4088 | err(1, "%s", __func__); | |||
4089 | return (token); | |||
4090 | } | |||
4091 | if (c == '\n') { | |||
4092 | yylval.lineno = file->lineno; | |||
4093 | file->lineno++; | |||
4094 | } | |||
4095 | if (c == EOF(-1)) | |||
4096 | return (0); | |||
4097 | return (c); | |||
4098 | } | |||
4099 | ||||
4100 | int | |||
4101 | check_file_secrecy(int fd, const char *fname) | |||
4102 | { | |||
4103 | struct stat st; | |||
4104 | ||||
4105 | if (fstat(fd, &st)) { | |||
4106 | warn("cannot stat %s", fname); | |||
4107 | return (-1); | |||
4108 | } | |||
4109 | if (st.st_uid != 0 && st.st_uid != getuid()) { | |||
4110 | warnx("%s: owner not root or current user", fname); | |||
4111 | return (-1); | |||
4112 | } | |||
4113 | if (st.st_mode & (S_IWGRP0000020 | S_IXGRP0000010 | S_IRWXO0000007)) { | |||
4114 | warnx("%s: group writable or world read/writable", fname); | |||
4115 | return (-1); | |||
4116 | } | |||
4117 | return (0); | |||
4118 | } | |||
4119 | ||||
4120 | struct file * | |||
4121 | pushfile(const char *name, int secret) | |||
4122 | { | |||
4123 | struct file *nfile; | |||
4124 | ||||
4125 | if ((nfile = calloc(1, sizeof(struct file))) == NULL((void *)0) || | |||
4126 | (nfile->name = strdup(name)) == NULL((void *)0)) { | |||
4127 | warn("%s", __func__); | |||
4128 | if (nfile) | |||
4129 | free(nfile); | |||
4130 | return (NULL((void *)0)); | |||
4131 | } | |||
4132 | if (TAILQ_FIRST(&files)((&files)->tqh_first) == NULL((void *)0) && strcmp(nfile->name, "-") == 0) { | |||
4133 | nfile->stream = stdin(&__sF[0]); | |||
4134 | free(nfile->name); | |||
4135 | if ((nfile->name = strdup("stdin")) == NULL((void *)0)) { | |||
4136 | warn("%s", __func__); | |||
4137 | free(nfile); | |||
4138 | return (NULL((void *)0)); | |||
4139 | } | |||
4140 | } else if ((nfile->stream = pfctl_fopen(nfile->name, "r")) == NULL((void *)0)) { | |||
4141 | warn("%s: %s", __func__, nfile->name); | |||
4142 | free(nfile->name); | |||
4143 | free(nfile); | |||
4144 | return (NULL((void *)0)); | |||
4145 | } else if (secret && | |||
4146 | check_file_secrecy(fileno(nfile->stream)(!__isthreaded ? ((nfile->stream)->_file) : (fileno)(nfile ->stream)), nfile->name)) { | |||
4147 | fclose(nfile->stream); | |||
4148 | free(nfile->name); | |||
4149 | free(nfile); | |||
4150 | return (NULL((void *)0)); | |||
4151 | } | |||
4152 | nfile->lineno = TAILQ_EMPTY(&files)(((&files)->tqh_first) == ((void *)0)) ? 1 : 0; | |||
4153 | nfile->ungetsize = 16; | |||
4154 | nfile->ungetbuf = malloc(nfile->ungetsize); | |||
4155 | if (nfile->ungetbuf == NULL((void *)0)) { | |||
4156 | warn("%s", __func__); | |||
4157 | fclose(nfile->stream); | |||
4158 | free(nfile->name); | |||
4159 | free(nfile); | |||
4160 | return (NULL((void *)0)); | |||
4161 | } | |||
4162 | TAILQ_INSERT_TAIL(&files, nfile, entry)do { (nfile)->entry.tqe_next = ((void *)0); (nfile)->entry .tqe_prev = (&files)->tqh_last; *(&files)->tqh_last = (nfile); (&files)->tqh_last = &(nfile)->entry .tqe_next; } while (0); | |||
4163 | return (nfile); | |||
4164 | } | |||
4165 | ||||
4166 | int | |||
4167 | popfile(void) | |||
4168 | { | |||
4169 | struct file *prev; | |||
4170 | ||||
4171 | if ((prev = TAILQ_PREV(file, files, entry)(*(((struct files *)((file)->entry.tqe_prev))->tqh_last ))) != NULL((void *)0)) | |||
4172 | prev->errors += file->errors; | |||
4173 | ||||
4174 | TAILQ_REMOVE(&files, file, entry)do { if (((file)->entry.tqe_next) != ((void *)0)) (file)-> entry.tqe_next->entry.tqe_prev = (file)->entry.tqe_prev ; else (&files)->tqh_last = (file)->entry.tqe_prev; *(file)->entry.tqe_prev = (file)->entry.tqe_next; ; ; } while (0); | |||
4175 | fclose(file->stream); | |||
4176 | free(file->name); | |||
4177 | free(file->ungetbuf); | |||
4178 | free(file); | |||
4179 | file = prev; | |||
4180 | ||||
4181 | return (file ? 0 : EOF(-1)); | |||
4182 | } | |||
4183 | ||||
4184 | int | |||
4185 | parse_config(char *filename, struct pfctl *xpf) | |||
4186 | { | |||
4187 | int errors = 0; | |||
4188 | struct sym *sym; | |||
4189 | ||||
4190 | pf = xpf; | |||
4191 | returnicmpdefault = (ICMP_UNREACH3 << 8) | ICMP_UNREACH_PORT3; | |||
4192 | returnicmp6default = | |||
4193 | (ICMP6_DST_UNREACH1 << 8) | ICMP6_DST_UNREACH_NOPORT4; | |||
4194 | blockpolicy = PFRULE_DROP0x0000; | |||
4195 | ||||
4196 | if ((file = pushfile(filename, 0)) == NULL((void *)0)) { | |||
4197 | warn("cannot open the main config file!"); | |||
4198 | return (-1); | |||
4199 | } | |||
4200 | topfile = file; | |||
4201 | ||||
4202 | yyparse(); | |||
4203 | errors = file->errors; | |||
4204 | popfile(); | |||
4205 | ||||
4206 | /* Free macros and check which have not been used. */ | |||
4207 | while ((sym = TAILQ_FIRST(&symhead)((&symhead)->tqh_first))) { | |||
4208 | if ((pf->opts & PF_OPT_VERBOSE20x00080) && !sym->used) | |||
4209 | fprintf(stderr(&__sF[2]), "warning: macro '%s' not " | |||
4210 | "used\n", sym->nam); | |||
4211 | free(sym->nam); | |||
4212 | free(sym->val); | |||
4213 | TAILQ_REMOVE(&symhead, sym, entry)do { if (((sym)->entry.tqe_next) != ((void *)0)) (sym)-> entry.tqe_next->entry.tqe_prev = (sym)->entry.tqe_prev; else (&symhead)->tqh_last = (sym)->entry.tqe_prev; *(sym)->entry.tqe_prev = (sym)->entry.tqe_next; ; ; } while (0); | |||
4214 | free(sym); | |||
4215 | } | |||
4216 | ||||
4217 | return (errors ? -1 : 0); | |||
4218 | } | |||
4219 | ||||
4220 | int | |||
4221 | symset(const char *nam, const char *val, int persist) | |||
4222 | { | |||
4223 | struct sym *sym; | |||
4224 | ||||
4225 | TAILQ_FOREACH(sym, &symhead, entry)for((sym) = ((&symhead)->tqh_first); (sym) != ((void * )0); (sym) = ((sym)->entry.tqe_next)) { | |||
4226 | if (strcmp(nam, sym->nam) == 0) | |||
4227 | break; | |||
4228 | } | |||
4229 | ||||
4230 | if (sym != NULL((void *)0)) { | |||
4231 | if (sym->persist == 1) | |||
4232 | return (0); | |||
4233 | else { | |||
4234 | free(sym->nam); | |||
4235 | free(sym->val); | |||
4236 | TAILQ_REMOVE(&symhead, sym, entry)do { if (((sym)->entry.tqe_next) != ((void *)0)) (sym)-> entry.tqe_next->entry.tqe_prev = (sym)->entry.tqe_prev; else (&symhead)->tqh_last = (sym)->entry.tqe_prev; *(sym)->entry.tqe_prev = (sym)->entry.tqe_next; ; ; } while (0); | |||
4237 | free(sym); | |||
4238 | } | |||
4239 | } | |||
4240 | if ((sym = calloc(1, sizeof(*sym))) == NULL((void *)0)) | |||
4241 | return (-1); | |||
4242 | ||||
4243 | sym->nam = strdup(nam); | |||
4244 | if (sym->nam == NULL((void *)0)) { | |||
4245 | free(sym); | |||
4246 | return (-1); | |||
4247 | } | |||
4248 | sym->val = strdup(val); | |||
4249 | if (sym->val == NULL((void *)0)) { | |||
4250 | free(sym->nam); | |||
4251 | free(sym); | |||
4252 | return (-1); | |||
4253 | } | |||
4254 | sym->used = 0; | |||
4255 | sym->persist = persist; | |||
4256 | TAILQ_INSERT_TAIL(&symhead, sym, entry)do { (sym)->entry.tqe_next = ((void *)0); (sym)->entry. tqe_prev = (&symhead)->tqh_last; *(&symhead)->tqh_last = (sym); (&symhead)->tqh_last = &(sym)->entry. tqe_next; } while (0); | |||
4257 | return (0); | |||
4258 | } | |||
4259 | ||||
4260 | int | |||
4261 | pfctl_cmdline_symset(char *s) | |||
4262 | { | |||
4263 | char *sym, *val; | |||
4264 | int ret; | |||
4265 | ||||
4266 | if ((val = strrchr(s, '=')) == NULL((void *)0)) | |||
4267 | return (-1); | |||
4268 | ||||
4269 | sym = strndup(s, val - s); | |||
4270 | if (sym == NULL((void *)0)) | |||
4271 | err(1, "%s", __func__); | |||
4272 | ret = symset(sym, val + 1, 1); | |||
4273 | free(sym); | |||
4274 | ||||
4275 | return (ret); | |||
4276 | } | |||
4277 | ||||
4278 | char * | |||
4279 | symget(const char *nam) | |||
4280 | { | |||
4281 | struct sym *sym; | |||
4282 | ||||
4283 | TAILQ_FOREACH(sym, &symhead, entry)for((sym) = ((&symhead)->tqh_first); (sym) != ((void * )0); (sym) = ((sym)->entry.tqe_next)) { | |||
4284 | if (strcmp(nam, sym->nam) == 0) { | |||
4285 | sym->used = 1; | |||
4286 | return (sym->val); | |||
4287 | } | |||
4288 | } | |||
4289 | return (NULL((void *)0)); | |||
4290 | } | |||
4291 | ||||
4292 | void | |||
4293 | mv_rules(struct pf_ruleset *src, struct pf_ruleset *dst) | |||
4294 | { | |||
4295 | struct pf_rule *r; | |||
4296 | ||||
4297 | TAILQ_FOREACH(r, src->rules.active.ptr, entries)for((r) = ((src->rules.active.ptr)->tqh_first); (r) != ( (void *)0); (r) = ((r)->entries.tqe_next)) | |||
4298 | dst->anchor->match++; | |||
4299 | TAILQ_CONCAT(dst->rules.active.ptr, src->rules.active.ptr, entries)do { if (!(((src->rules.active.ptr)->tqh_first) == ((void *)0))) { *(dst->rules.active.ptr)->tqh_last = (src-> rules.active.ptr)->tqh_first; (src->rules.active.ptr)-> tqh_first->entries.tqe_prev = (dst->rules.active.ptr)-> tqh_last; (dst->rules.active.ptr)->tqh_last = (src-> rules.active.ptr)->tqh_last; do { ((src->rules.active.ptr ))->tqh_first = ((void *)0); ((src->rules.active.ptr))-> tqh_last = &((src->rules.active.ptr))->tqh_first; } while (0); } } while (0); | |||
4300 | src->anchor->match = 0; | |||
4301 | TAILQ_CONCAT(dst->rules.inactive.ptr, src->rules.inactive.ptr, entries)do { if (!(((src->rules.inactive.ptr)->tqh_first) == (( void *)0))) { *(dst->rules.inactive.ptr)->tqh_last = (src ->rules.inactive.ptr)->tqh_first; (src->rules.inactive .ptr)->tqh_first->entries.tqe_prev = (dst->rules.inactive .ptr)->tqh_last; (dst->rules.inactive.ptr)->tqh_last = (src->rules.inactive.ptr)->tqh_last; do { ((src-> rules.inactive.ptr))->tqh_first = ((void *)0); ((src->rules .inactive.ptr))->tqh_last = &((src->rules.inactive. ptr))->tqh_first; } while (0); } } while (0); | |||
4302 | } | |||
4303 | ||||
4304 | void | |||
4305 | decide_address_family(struct node_host *n, sa_family_t *af) | |||
4306 | { | |||
4307 | if (*af != 0 || n == NULL((void *)0)) | |||
4308 | return; | |||
4309 | *af = n->af; | |||
4310 | while ((n = n->next) != NULL((void *)0)) { | |||
4311 | if (n->af != *af) { | |||
4312 | *af = 0; | |||
4313 | return; | |||
4314 | } | |||
4315 | } | |||
4316 | } | |||
4317 | ||||
4318 | int | |||
4319 | invalid_redirect(struct node_host *nh, sa_family_t af) | |||
4320 | { | |||
4321 | if (!af) { | |||
4322 | struct node_host *n; | |||
4323 | ||||
4324 | /* tables and dyniftl are ok without an address family */ | |||
4325 | for (n = nh; n != NULL((void *)0); n = n->next) { | |||
4326 | if (n->addr.type != PF_ADDR_TABLE && | |||
4327 | n->addr.type != PF_ADDR_DYNIFTL) { | |||
4328 | yyerror("address family not given and " | |||
4329 | "translation address expands to multiple " | |||
4330 | "address families"); | |||
4331 | return (1); | |||
4332 | } | |||
4333 | } | |||
4334 | } | |||
4335 | if (nh == NULL((void *)0)) { | |||
4336 | yyerror("no translation address with matching address family " | |||
4337 | "found."); | |||
4338 | return (1); | |||
4339 | } | |||
4340 | return (0); | |||
4341 | } | |||
4342 | ||||
4343 | int | |||
4344 | atoul(char *s, u_long *ulvalp) | |||
4345 | { | |||
4346 | u_long ulval; | |||
4347 | char *ep; | |||
4348 | ||||
4349 | errno(*__errno()) = 0; | |||
4350 | ulval = strtoul(s, &ep, 0); | |||
4351 | if (s[0] == '\0' || *ep != '\0') | |||
4352 | return (-1); | |||
4353 | if (errno(*__errno()) == ERANGE34 && ulval == ULONG_MAX0xffffffffffffffffUL) | |||
4354 | return (-1); | |||
4355 | *ulvalp = ulval; | |||
4356 | return (0); | |||
4357 | } | |||
4358 | ||||
4359 | int | |||
4360 | getservice(char *n) | |||
4361 | { | |||
4362 | struct servent *s; | |||
4363 | u_long ulval; | |||
4364 | ||||
4365 | if (atoul(n, &ulval) == 0) { | |||
4366 | if (ulval > 65535) { | |||
4367 | yyerror("illegal port value %lu", ulval); | |||
4368 | return (-1); | |||
4369 | } | |||
4370 | return (htons(ulval)(__uint16_t)(__builtin_constant_p(ulval) ? (__uint16_t)(((__uint16_t )(ulval) & 0xffU) << 8 | ((__uint16_t)(ulval) & 0xff00U) >> 8) : __swap16md(ulval))); | |||
4371 | } else { | |||
4372 | s = getservbyname(n, "tcp"); | |||
4373 | if (s == NULL((void *)0)) | |||
4374 | s = getservbyname(n, "udp"); | |||
4375 | if (s == NULL((void *)0)) { | |||
4376 | yyerror("unknown port %s", n); | |||
4377 | return (-1); | |||
4378 | } | |||
4379 | return (s->s_port); | |||
4380 | } | |||
4381 | } | |||
4382 | ||||
4383 | int | |||
4384 | rule_label(struct pf_rule *r, char *s) | |||
4385 | { | |||
4386 | if (s) { | |||
4387 | if (strlcpy(r->label, s, sizeof(r->label)) >= | |||
4388 | sizeof(r->label)) { | |||
4389 | yyerror("rule label too long (max %zu chars)", | |||
4390 | sizeof(r->label)-1); | |||
4391 | return (-1); | |||
4392 | } | |||
4393 | } | |||
4394 | return (0); | |||
4395 | } | |||
4396 | ||||
4397 | u_int16_t | |||
4398 | parseicmpspec(char *w, sa_family_t af) | |||
4399 | { | |||
4400 | const struct icmpcodeent *p; | |||
4401 | u_long ulval; | |||
4402 | u_int8_t icmptype; | |||
4403 | ||||
4404 | if (af == AF_INET2) | |||
4405 | icmptype = returnicmpdefault >> 8; | |||
4406 | else | |||
4407 | icmptype = returnicmp6default >> 8; | |||
4408 | ||||
4409 | if (atoul(w, &ulval) == -1) { | |||
4410 | if ((p = geticmpcodebyname(icmptype, w, af)) == NULL((void *)0)) { | |||
4411 | yyerror("unknown icmp code %s", w); | |||
4412 | return (0); | |||
4413 | } | |||
4414 | ulval = p->code; | |||
4415 | } | |||
4416 | if (ulval > 255) { | |||
4417 | yyerror("invalid icmp code %lu", ulval); | |||
4418 | return (0); | |||
4419 | } | |||
4420 | return (icmptype << 8 | ulval); | |||
4421 | } | |||
4422 | ||||
4423 | int | |||
4424 | parseport(char *port, struct range *r, int extensions) | |||
4425 | { | |||
4426 | char *p = strchr(port, ':'); | |||
4427 | ||||
4428 | if (p == NULL((void *)0)) { | |||
4429 | if ((r->a = getservice(port)) == -1) | |||
4430 | return (-1); | |||
4431 | r->b = 0; | |||
4432 | r->t = PF_OP_NONE; | |||
4433 | return (0); | |||
4434 | } | |||
4435 | if ((extensions & PPORT_STAR2) && !strcmp(p+1, "*")) { | |||
4436 | *p = 0; | |||
4437 | if ((r->a = getservice(port)) == -1) | |||
4438 | return (-1); | |||
4439 | r->b = 0; | |||
4440 | r->t = PF_OP_IRG; | |||
4441 | return (0); | |||
4442 | } | |||
4443 | if ((extensions & PPORT_RANGE1)) { | |||
4444 | *p++ = 0; | |||
4445 | if ((r->a = getservice(port)) == -1 || | |||
4446 | (r->b = getservice(p)) == -1) | |||
4447 | return (-1); | |||
4448 | if (r->a == r->b) { | |||
4449 | r->b = 0; | |||
4450 | r->t = PF_OP_NONE; | |||
4451 | } else | |||
4452 | r->t = PF_OP_RRG; | |||
4453 | return (0); | |||
4454 | } | |||
4455 | yyerror("port is invalid: %s", port); | |||
4456 | return (-1); | |||
4457 | } | |||
4458 | ||||
4459 | int | |||
4460 | pfctl_load_anchors(int dev, struct pfctl *pf, struct pfr_buffer *trans) | |||
4461 | { | |||
4462 | struct loadanchors *la; | |||
4463 | ||||
4464 | TAILQ_FOREACH(la, &loadanchorshead, entries)for((la) = ((&loadanchorshead)->tqh_first); (la) != (( void *)0); (la) = ((la)->entries.tqe_next)) { | |||
4465 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
4466 | fprintf(stderr(&__sF[2]), "\nLoading anchor %s from %s\n", | |||
4467 | la->anchorname, la->filename); | |||
4468 | if (pfctl_rules(dev, la->filename, pf->opts, pf->optimize, | |||
4469 | la->anchorname, trans) == -1) | |||
4470 | return (-1); | |||
4471 | } | |||
4472 | ||||
4473 | return (0); | |||
4474 | } | |||
4475 | ||||
4476 | int | |||
4477 | kw_casecmp(const void *k, const void *e) | |||
4478 | { | |||
4479 | return (strcasecmp(k, ((const struct keywords *)e)->k_name)); | |||
4480 | } | |||
4481 | ||||
4482 | int | |||
4483 | map_tos(char *s, int *val) | |||
4484 | { | |||
4485 | /* DiffServ Codepoints and other TOS mappings */ | |||
4486 | const struct keywords toswords[] = { | |||
4487 | { "af11", IPTOS_DSCP_AF110x28 }, | |||
4488 | { "af12", IPTOS_DSCP_AF120x30 }, | |||
4489 | { "af13", IPTOS_DSCP_AF130x38 }, | |||
4490 | { "af21", IPTOS_DSCP_AF210x48 }, | |||
4491 | { "af22", IPTOS_DSCP_AF220x50 }, | |||
4492 | { "af23", IPTOS_DSCP_AF230x58 }, | |||
4493 | { "af31", IPTOS_DSCP_AF310x68 }, | |||
4494 | { "af32", IPTOS_DSCP_AF320x70 }, | |||
4495 | { "af33", IPTOS_DSCP_AF330x78 }, | |||
4496 | { "af41", IPTOS_DSCP_AF410x88 }, | |||
4497 | { "af42", IPTOS_DSCP_AF420x90 }, | |||
4498 | { "af43", IPTOS_DSCP_AF430x98 }, | |||
4499 | { "critical", IPTOS_PREC_CRITIC_ECP0xa0 }, | |||
4500 | { "cs0", IPTOS_DSCP_CS00x00 }, | |||
4501 | { "cs1", IPTOS_DSCP_CS10x20 }, | |||
4502 | { "cs2", IPTOS_DSCP_CS20x40 }, | |||
4503 | { "cs3", IPTOS_DSCP_CS30x60 }, | |||
4504 | { "cs4", IPTOS_DSCP_CS40x80 }, | |||
4505 | { "cs5", IPTOS_DSCP_CS50xa0 }, | |||
4506 | { "cs6", IPTOS_DSCP_CS60xc0 }, | |||
4507 | { "cs7", IPTOS_DSCP_CS70xe0 }, | |||
4508 | { "ef", IPTOS_DSCP_EF0xb8 }, | |||
4509 | { "inetcontrol", IPTOS_PREC_INTERNETCONTROL0xc0 }, | |||
4510 | { "lowdelay", IPTOS_LOWDELAY0x10 }, | |||
4511 | { "netcontrol", IPTOS_PREC_NETCONTROL0xe0 }, | |||
4512 | { "reliability", IPTOS_RELIABILITY0x04 }, | |||
4513 | { "throughput", IPTOS_THROUGHPUT0x08 } | |||
4514 | }; | |||
4515 | const struct keywords *p; | |||
4516 | ||||
4517 | p = bsearch(s, toswords, sizeof(toswords)/sizeof(toswords[0]), | |||
4518 | sizeof(toswords[0]), kw_casecmp); | |||
4519 | ||||
4520 | if (p) { | |||
4521 | *val = p->k_val; | |||
4522 | return (1); | |||
4523 | } | |||
4524 | return (0); | |||
4525 | } | |||
4526 | ||||
4527 | int | |||
4528 | lookup_rtable(u_int rtableid) | |||
4529 | { | |||
4530 | size_t len; | |||
4531 | struct rt_tableinfo info; | |||
4532 | int mib[6]; | |||
4533 | static u_int found[RT_TABLEID_MAX255+1]; | |||
4534 | ||||
4535 | if (found[rtableid]) | |||
4536 | return found[rtableid]; | |||
4537 | ||||
4538 | mib[0] = CTL_NET4; | |||
4539 | mib[1] = PF_ROUTE17; | |||
4540 | mib[2] = 0; | |||
4541 | mib[3] = 0; | |||
4542 | mib[4] = NET_RT_TABLE5; | |||
4543 | mib[5] = rtableid; | |||
4544 | ||||
4545 | len = sizeof(info); | |||
4546 | if (sysctl(mib, 6, &info, &len, NULL((void *)0), 0) == -1) { | |||
4547 | if (errno(*__errno()) == ENOENT2) { | |||
4548 | /* table nonexistent */ | |||
4549 | found[rtableid] = 0; | |||
4550 | return 0; | |||
4551 | } | |||
4552 | err(1, "%s", __func__); | |||
4553 | } | |||
4554 | found[rtableid] = 1; | |||
4555 | return 1; | |||
4556 | } | |||
4557 | ||||
4558 | int | |||
4559 | filteropts_to_rule(struct pf_rule *r, struct filter_opts *opts) | |||
4560 | { | |||
4561 | if (opts->marker & FOM_ONCE0x1000) { | |||
4562 | if ((r->action != PF_PASS && r->action != PF_DROP) || r->anchor) { | |||
4563 | yyerror("'once' only applies to pass/block rules"); | |||
4564 | return (1); | |||
4565 | } | |||
4566 | r->rule_flag |= PFRULE_ONCE0x00100000; | |||
4567 | } | |||
4568 | ||||
4569 | r->keep_state = opts->keep.action; | |||
4570 | r->pktrate.limit = opts->pktrate.limit; | |||
4571 | r->pktrate.seconds = opts->pktrate.seconds; | |||
4572 | r->prob = opts->prob; | |||
4573 | r->rtableid = opts->rtableid; | |||
4574 | r->tos = opts->tos; | |||
4575 | ||||
4576 | if (opts->nodf) | |||
4577 | r->scrub_flags |= PFSTATE_NODF0x0020; | |||
4578 | if (opts->randomid) | |||
4579 | r->scrub_flags |= PFSTATE_RANDOMID0x0080; | |||
4580 | if (opts->minttl) | |||
4581 | r->min_ttl = opts->minttl; | |||
4582 | if (opts->max_mss) | |||
4583 | r->max_mss = opts->max_mss; | |||
4584 | ||||
4585 | if (opts->tag) | |||
4586 | if (strlcpy(r->tagname, opts->tag, | |||
4587 | PF_TAG_NAME_SIZE64) >= PF_TAG_NAME_SIZE64) { | |||
4588 | yyerror("tag too long, max %u chars", | |||
4589 | PF_TAG_NAME_SIZE64 - 1); | |||
4590 | return (1); | |||
4591 | } | |||
4592 | if (opts->match_tag) | |||
4593 | if (strlcpy(r->match_tagname, opts->match_tag, | |||
4594 | PF_TAG_NAME_SIZE64) >= PF_TAG_NAME_SIZE64) { | |||
4595 | yyerror("tag too long, max %u chars", | |||
4596 | PF_TAG_NAME_SIZE64 - 1); | |||
4597 | return (1); | |||
4598 | } | |||
4599 | r->match_tag_not = opts->match_tag_not; | |||
4600 | ||||
4601 | if (rule_label(r, opts->label)) | |||
4602 | return (1); | |||
4603 | free(opts->label); | |||
4604 | ||||
4605 | if (opts->marker & FOM_AFTO0x0080) | |||
4606 | r->rule_flag |= PFRULE_AFTO0x00200000; | |||
4607 | if ((opts->marker & FOM_AFTO0x0080) && r->direction != PF_IN) { | |||
4608 | yyerror("af-to can only be used with direction in"); | |||
4609 | return (1); | |||
4610 | } | |||
4611 | if ((opts->marker & FOM_AFTO0x0080) && opts->rt) { | |||
4612 | yyerror("af-to cannot be used together with " | |||
4613 | "route-to, reply-to, dup-to"); | |||
4614 | return (1); | |||
4615 | } | |||
4616 | if (opts->marker & FOM_SCRUB_TCP0x0200) | |||
4617 | r->scrub_flags |= PFSTATE_SCRUB_TCP0x0100; | |||
4618 | if (opts->marker & FOM_SETDELAY0x4000) { | |||
4619 | r->delay = opts->delay; | |||
4620 | r->rule_flag |= PFRULE_SETDELAY0x0080; | |||
4621 | } | |||
4622 | if (opts->marker & FOM_SETPRIO0x0400) { | |||
4623 | r->set_prio[0] = opts->set_prio[0]; | |||
4624 | r->set_prio[1] = opts->set_prio[1]; | |||
4625 | r->scrub_flags |= PFSTATE_SETPRIO0x0200; | |||
4626 | } | |||
4627 | if (opts->marker & FOM_SETTOS0x0100) { | |||
4628 | r->scrub_flags |= PFSTATE_SETTOS0x0040; | |||
4629 | r->set_tos = opts->settos; | |||
4630 | } | |||
4631 | if (opts->marker & FOM_PRIO0x2000) | |||
4632 | r->prio = opts->prio ? opts->prio : PF_PRIO_ZERO0xff; | |||
4633 | if (opts->marker & FOM_SETPRIO0x0400) { | |||
4634 | r->set_prio[0] = opts->set_prio[0]; | |||
4635 | r->set_prio[1] = opts->set_prio[1]; | |||
4636 | r->scrub_flags |= PFSTATE_SETPRIO0x0200; | |||
4637 | } | |||
4638 | ||||
4639 | r->flags = opts->flags.b1; | |||
4640 | r->flagset = opts->flags.b2; | |||
4641 | if ((opts->flags.b1 & opts->flags.b2) != opts->flags.b1) { | |||
4642 | yyerror("flags always false"); | |||
4643 | return (1); | |||
4644 | } | |||
4645 | ||||
4646 | if (opts->queues.qname != NULL((void *)0)) { | |||
4647 | if (strlcpy(r->qname, opts->queues.qname, | |||
4648 | sizeof(r->qname)) >= sizeof(r->qname)) { | |||
4649 | yyerror("rule qname too long (max " | |||
4650 | "%zu chars)", sizeof(r->qname)-1); | |||
4651 | return (1); | |||
4652 | } | |||
4653 | free(opts->queues.qname); | |||
4654 | } | |||
4655 | if (opts->queues.pqname != NULL((void *)0)) { | |||
4656 | if (strlcpy(r->pqname, opts->queues.pqname, | |||
4657 | sizeof(r->pqname)) >= sizeof(r->pqname)) { | |||
4658 | yyerror("rule pqname too long (max " | |||
4659 | "%zu chars)", sizeof(r->pqname)-1); | |||
4660 | return (1); | |||
4661 | } | |||
4662 | free(opts->queues.pqname); | |||
4663 | } | |||
4664 | ||||
4665 | if (opts->fragment) | |||
4666 | r->rule_flag |= PFRULE_FRAGMENT0x0002; | |||
4667 | r->allow_opts = opts->allowopts; | |||
4668 | ||||
4669 | return (0); | |||
4670 | } | |||
4671 | #line 4664 "parse.c" | |||
4672 | /* allocate initial stack or double stack size, up to YYMAXDEPTH */ | |||
4673 | static int yygrowstack(void) | |||
4674 | { | |||
4675 | unsigned int newsize; | |||
4676 | long sslen; | |||
4677 | short *newss; | |||
4678 | YYSTYPE *newvs; | |||
4679 | ||||
4680 | if ((newsize = yystacksize) == 0) | |||
4681 | newsize = YYINITSTACKSIZE200; | |||
4682 | else if (newsize >= YYMAXDEPTH10000) | |||
4683 | return -1; | |||
4684 | else if ((newsize *= 2) > YYMAXDEPTH10000) | |||
4685 | newsize = YYMAXDEPTH10000; | |||
4686 | sslen = yyssp - yyss; | |||
4687 | #ifdef SIZE_MAX | |||
4688 | #define YY_SIZE_MAX0xffffffffU SIZE_MAX | |||
4689 | #else | |||
4690 | #define YY_SIZE_MAX0xffffffffU 0xffffffffU | |||
4691 | #endif | |||
4692 | if (newsize && YY_SIZE_MAX0xffffffffU / newsize < sizeof *newss) | |||
4693 | goto bail; | |||
4694 | newss = (short *)realloc(yyss, newsize * sizeof *newss); | |||
4695 | if (newss == NULL((void *)0)) | |||
4696 | goto bail; | |||
4697 | yyss = newss; | |||
4698 | yyssp = newss + sslen; | |||
4699 | if (newsize && YY_SIZE_MAX0xffffffffU / newsize < sizeof *newvs) | |||
4700 | goto bail; | |||
4701 | newvs = (YYSTYPE *)realloc(yyvs, newsize * sizeof *newvs); | |||
4702 | if (newvs == NULL((void *)0)) | |||
4703 | goto bail; | |||
4704 | yyvs = newvs; | |||
4705 | yyvsp = newvs + sslen; | |||
4706 | yystacksize = newsize; | |||
4707 | yysslim = yyss + newsize - 1; | |||
4708 | return 0; | |||
4709 | bail: | |||
4710 | if (yyss) | |||
4711 | free(yyss); | |||
4712 | if (yyvs) | |||
4713 | free(yyvs); | |||
4714 | yyss = yyssp = NULL((void *)0); | |||
4715 | yyvs = yyvsp = NULL((void *)0); | |||
4716 | yystacksize = 0; | |||
4717 | return -1; | |||
4718 | } | |||
4719 | ||||
4720 | #define YYABORTgoto yyabort goto yyabort | |||
4721 | #define YYREJECTgoto yyabort goto yyabort | |||
4722 | #define YYACCEPTgoto yyaccept goto yyaccept | |||
4723 | #define YYERRORgoto yyerrlab goto yyerrlab | |||
4724 | int | |||
4725 | yyparse(void) | |||
4726 | { | |||
4727 | int yym, yyn, yystate; | |||
4728 | #if YYDEBUG0 | |||
4729 | const char *yys; | |||
4730 | ||||
4731 | if ((yys = getenv("YYDEBUG"))) | |||
4732 | { | |||
4733 | yyn = *yys; | |||
4734 | if (yyn >= '0' && yyn <= '9') | |||
4735 | yydebug = yyn - '0'; | |||
4736 | } | |||
4737 | #endif /* YYDEBUG */ | |||
4738 | ||||
4739 | yynerrs = 0; | |||
4740 | yyerrflag = 0; | |||
4741 | yychar = (-1); | |||
4742 | ||||
4743 | if (yyss == NULL((void *)0) && yygrowstack()) goto yyoverflow; | |||
| ||||
4744 | yyssp = yyss; | |||
4745 | yyvsp = yyvs; | |||
4746 | *yyssp = yystate = 0; | |||
4747 | ||||
4748 | yyloop: | |||
4749 | if ((yyn = yydefred[yystate]) != 0) goto yyreduce; | |||
4750 | if (yychar
| |||
4751 | { | |||
4752 | if ((yychar = yylex()) < 0) yychar = 0; | |||
4753 | #if YYDEBUG0 | |||
4754 | if (yydebug) | |||
4755 | { | |||
4756 | yys = 0; | |||
4757 | if (yychar <= YYMAXTOKEN385) yys = yyname[yychar]; | |||
4758 | if (!yys) yys = "illegal-symbol"; | |||
4759 | printf("%sdebug: state %d, reading %d (%s)\n", | |||
4760 | YYPREFIX"yy", yystate, yychar, yys); | |||
4761 | } | |||
4762 | #endif | |||
4763 | } | |||
4764 | if ((yyn = yysindex[yystate]) && (yyn += yychar) >= 0 && | |||
4765 | yyn <= YYTABLESIZE5732 && yycheck[yyn] == yychar) | |||
4766 | { | |||
4767 | #if YYDEBUG0 | |||
4768 | if (yydebug) | |||
4769 | printf("%sdebug: state %d, shifting to state %d\n", | |||
4770 | YYPREFIX"yy", yystate, yytable[yyn]); | |||
4771 | #endif | |||
4772 | if (yyssp >= yysslim && yygrowstack()) | |||
4773 | { | |||
4774 | goto yyoverflow; | |||
4775 | } | |||
4776 | *++yyssp = yystate = yytable[yyn]; | |||
4777 | *++yyvsp = yylval; | |||
4778 | yychar = (-1); | |||
4779 | if (yyerrflag > 0) --yyerrflag; | |||
4780 | goto yyloop; | |||
4781 | } | |||
4782 | if ((yyn = yyrindex[yystate]) && (yyn += yychar) >= 0 && | |||
4783 | yyn
| |||
4784 | { | |||
4785 | yyn = yytable[yyn]; | |||
4786 | goto yyreduce; | |||
4787 | } | |||
4788 | if (yyerrflag) goto yyinrecovery; | |||
4789 | #if defined(__GNUC__4) | |||
4790 | goto yynewerror; | |||
4791 | #endif | |||
4792 | yynewerror: | |||
4793 | yyerror("syntax error"); | |||
4794 | #if defined(__GNUC__4) | |||
4795 | goto yyerrlab; | |||
4796 | #endif | |||
4797 | yyerrlab: | |||
4798 | ++yynerrs; | |||
4799 | yyinrecovery: | |||
4800 | if (yyerrflag < 3) | |||
4801 | { | |||
4802 | yyerrflag = 3; | |||
4803 | for (;;) | |||
4804 | { | |||
4805 | if ((yyn = yysindex[*yyssp]) && (yyn += YYERRCODE256) >= 0 && | |||
4806 | yyn <= YYTABLESIZE5732 && yycheck[yyn] == YYERRCODE256) | |||
4807 | { | |||
4808 | #if YYDEBUG0 | |||
4809 | if (yydebug) | |||
4810 | printf("%sdebug: state %d, error recovery shifting\ | |||
4811 | to state %d\n", YYPREFIX"yy", *yyssp, yytable[yyn]); | |||
4812 | #endif | |||
4813 | if (yyssp >= yysslim && yygrowstack()) | |||
4814 | { | |||
4815 | goto yyoverflow; | |||
4816 | } | |||
4817 | *++yyssp = yystate = yytable[yyn]; | |||
4818 | *++yyvsp = yylval; | |||
4819 | goto yyloop; | |||
4820 | } | |||
4821 | else | |||
4822 | { | |||
4823 | #if YYDEBUG0 | |||
4824 | if (yydebug) | |||
4825 | printf("%sdebug: error recovery discarding state %d\n", | |||
4826 | YYPREFIX"yy", *yyssp); | |||
4827 | #endif | |||
4828 | if (yyssp <= yyss) goto yyabort; | |||
4829 | --yyssp; | |||
4830 | --yyvsp; | |||
4831 | } | |||
4832 | } | |||
4833 | } | |||
4834 | else | |||
4835 | { | |||
4836 | if (yychar == 0) goto yyabort; | |||
4837 | #if YYDEBUG0 | |||
4838 | if (yydebug) | |||
4839 | { | |||
4840 | yys = 0; | |||
4841 | if (yychar <= YYMAXTOKEN385) yys = yyname[yychar]; | |||
4842 | if (!yys) yys = "illegal-symbol"; | |||
4843 | printf("%sdebug: state %d, error recovery discards token %d (%s)\n", | |||
4844 | YYPREFIX"yy", yystate, yychar, yys); | |||
4845 | } | |||
4846 | #endif | |||
4847 | yychar = (-1); | |||
4848 | goto yyloop; | |||
4849 | } | |||
4850 | yyreduce: | |||
4851 | #if YYDEBUG0 | |||
4852 | if (yydebug) | |||
4853 | printf("%sdebug: state %d, reducing by rule %d (%s)\n", | |||
4854 | YYPREFIX"yy", yystate, yyn, yyrule[yyn]); | |||
4855 | #endif | |||
4856 | yym = yylen[yyn]; | |||
4857 | if (yym) | |||
4858 | yyval = yyvsp[1-yym]; | |||
4859 | else | |||
4860 | memset(&yyval, 0, sizeof yyval); | |||
4861 | switch (yyn) | |||
4862 | { | |||
4863 | case 13: | |||
4864 | #line 548 "/usr/src/sbin/pfctl/parse.y" | |||
4865 | { file->errors++; } | |||
4866 | break; | |||
4867 | case 14: | |||
4868 | #line 551 "/usr/src/sbin/pfctl/parse.y" | |||
4869 | { | |||
4870 | struct file *nfile; | |||
4871 | ||||
4872 | if ((nfile = pushfile(yyvsp[0].v.string, 0)) == NULL((void *)0)) { | |||
4873 | yyerror("failed to include file %s", yyvsp[0].v.string); | |||
4874 | free(yyvsp[0].v.string); | |||
4875 | YYERRORgoto yyerrlab; | |||
4876 | } | |||
4877 | free(yyvsp[0].v.string); | |||
4878 | ||||
4879 | file = nfile; | |||
4880 | lungetc('\n'); | |||
4881 | } | |||
4882 | break; | |||
4883 | case 19: | |||
4884 | #line 576 "/usr/src/sbin/pfctl/parse.y" | |||
4885 | { | |||
4886 | if (!strcmp(yyvsp[0].v.string, "none")) | |||
4887 | yyval.v.i = 0; | |||
4888 | else if (!strcmp(yyvsp[0].v.string, "basic")) | |||
4889 | yyval.v.i = PF_OPTIMIZE_BASIC0x0001; | |||
4890 | else if (!strcmp(yyvsp[0].v.string, "profile")) | |||
4891 | yyval.v.i = PF_OPTIMIZE_BASIC0x0001 | PF_OPTIMIZE_PROFILE0x0002; | |||
4892 | else { | |||
4893 | yyerror("unknown ruleset-optimization %s", yyvsp[0].v.string); | |||
4894 | YYERRORgoto yyerrlab; | |||
4895 | } | |||
4896 | } | |||
4897 | break; | |||
4898 | case 20: | |||
4899 | #line 590 "/usr/src/sbin/pfctl/parse.y" | |||
4900 | { yyval.v.number = 0; } | |||
4901 | break; | |||
4902 | case 21: | |||
4903 | #line 591 "/usr/src/sbin/pfctl/parse.y" | |||
4904 | { yyval.v.number = 1; } | |||
4905 | break; | |||
4906 | case 22: | |||
4907 | #line 594 "/usr/src/sbin/pfctl/parse.y" | |||
4908 | { | |||
4909 | pfctl_set_reassembly(pf, yyvsp[-1].v.number, yyvsp[0].v.number); | |||
4910 | } | |||
4911 | break; | |||
4912 | case 23: | |||
4913 | #line 597 "/usr/src/sbin/pfctl/parse.y" | |||
4914 | { | |||
4915 | if (pfctl_set_optimization(pf, yyvsp[0].v.string) != 0) { | |||
4916 | yyerror("unknown optimization %s", yyvsp[0].v.string); | |||
4917 | free(yyvsp[0].v.string); | |||
4918 | YYERRORgoto yyerrlab; | |||
4919 | } | |||
4920 | free(yyvsp[0].v.string); | |||
4921 | } | |||
4922 | break; | |||
4923 | case 24: | |||
4924 | #line 605 "/usr/src/sbin/pfctl/parse.y" | |||
4925 | { | |||
4926 | if (!(pf->opts & PF_OPT_OPTIMIZE0x00800)) { | |||
4927 | pf->opts |= PF_OPT_OPTIMIZE0x00800; | |||
4928 | pf->optimize = yyvsp[0].v.i; | |||
4929 | } | |||
4930 | } | |||
4931 | break; | |||
4932 | case 29: | |||
4933 | #line 615 "/usr/src/sbin/pfctl/parse.y" | |||
4934 | { | |||
4935 | if (pfctl_set_logif(pf, yyvsp[0].v.string) != 0) { | |||
4936 | yyerror("error setting loginterface %s", yyvsp[0].v.string); | |||
4937 | free(yyvsp[0].v.string); | |||
4938 | YYERRORgoto yyerrlab; | |||
4939 | } | |||
4940 | free(yyvsp[0].v.string); | |||
4941 | } | |||
4942 | break; | |||
4943 | case 30: | |||
4944 | #line 623 "/usr/src/sbin/pfctl/parse.y" | |||
4945 | { | |||
4946 | if (yyvsp[0].v.number == 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
4947 | yyerror("hostid must be non-zero"); | |||
4948 | YYERRORgoto yyerrlab; | |||
4949 | } | |||
4950 | pfctl_set_hostid(pf, yyvsp[0].v.number); | |||
4951 | } | |||
4952 | break; | |||
4953 | case 31: | |||
4954 | #line 630 "/usr/src/sbin/pfctl/parse.y" | |||
4955 | { | |||
4956 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
4957 | printf("set block-policy drop\n"); | |||
4958 | blockpolicy = PFRULE_DROP0x0000; | |||
4959 | } | |||
4960 | break; | |||
4961 | case 32: | |||
4962 | #line 635 "/usr/src/sbin/pfctl/parse.y" | |||
4963 | { | |||
4964 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
4965 | printf("set block-policy return\n"); | |||
4966 | blockpolicy = PFRULE_RETURN0x0008; | |||
4967 | } | |||
4968 | break; | |||
4969 | case 33: | |||
4970 | #line 640 "/usr/src/sbin/pfctl/parse.y" | |||
4971 | { | |||
4972 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
4973 | printf("set fingerprints \"%s\"\n", yyvsp[0].v.string); | |||
4974 | if (!pf->anchor->name[0]) { | |||
4975 | if (pfctl_file_fingerprints(pf->dev, | |||
4976 | pf->opts, yyvsp[0].v.string)) { | |||
4977 | yyerror("error loading " | |||
4978 | "fingerprints %s", yyvsp[0].v.string); | |||
4979 | free(yyvsp[0].v.string); | |||
4980 | YYERRORgoto yyerrlab; | |||
4981 | } | |||
4982 | } | |||
4983 | free(yyvsp[0].v.string); | |||
4984 | } | |||
4985 | break; | |||
4986 | case 34: | |||
4987 | #line 654 "/usr/src/sbin/pfctl/parse.y" | |||
4988 | { | |||
4989 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
4990 | switch (yyvsp[0].v.i) { | |||
4991 | case 0: | |||
4992 | printf("set state-policy floating\n"); | |||
4993 | break; | |||
4994 | case PFRULE_IFBOUND0x00010000: | |||
4995 | printf("set state-policy if-bound\n"); | |||
4996 | break; | |||
4997 | } | |||
4998 | default_statelock = yyvsp[0].v.i; | |||
4999 | } | |||
5000 | break; | |||
5001 | case 35: | |||
5002 | #line 666 "/usr/src/sbin/pfctl/parse.y" | |||
5003 | { | |||
5004 | if (pfctl_set_debug(pf, yyvsp[0].v.string) != 0) { | |||
5005 | yyerror("error setting debuglevel %s", yyvsp[0].v.string); | |||
5006 | free(yyvsp[0].v.string); | |||
5007 | YYERRORgoto yyerrlab; | |||
5008 | } | |||
5009 | free(yyvsp[0].v.string); | |||
5010 | } | |||
5011 | break; | |||
5012 | case 36: | |||
5013 | #line 674 "/usr/src/sbin/pfctl/parse.y" | |||
5014 | { | |||
5015 | if (pfctl_set_debug(pf, "debug") != 0) { | |||
5016 | yyerror("error setting debuglevel %s", "debug"); | |||
5017 | YYERRORgoto yyerrlab; | |||
5018 | } | |||
5019 | } | |||
5020 | break; | |||
5021 | case 37: | |||
5022 | #line 680 "/usr/src/sbin/pfctl/parse.y" | |||
5023 | { | |||
5024 | if (expand_skip_interface(yyvsp[0].v.interface) != 0) { | |||
5025 | yyerror("error setting skip interface(s)"); | |||
5026 | YYERRORgoto yyerrlab; | |||
5027 | } | |||
5028 | } | |||
5029 | break; | |||
5030 | case 38: | |||
5031 | #line 686 "/usr/src/sbin/pfctl/parse.y" | |||
5032 | { | |||
5033 | if (keep_state_defaults != NULL((void *)0)) { | |||
5034 | yyerror("cannot redefine state-defaults"); | |||
5035 | YYERRORgoto yyerrlab; | |||
5036 | } | |||
5037 | keep_state_defaults = yyvsp[0].v.state_opt; | |||
5038 | } | |||
5039 | break; | |||
5040 | case 39: | |||
5041 | #line 693 "/usr/src/sbin/pfctl/parse.y" | |||
5042 | { | |||
5043 | if (pfctl_set_syncookies(pf, yyvsp[-1].v.i, yyvsp[0].v.watermarks)) { | |||
5044 | yyerror("error setting syncookies"); | |||
5045 | YYERRORgoto yyerrlab; | |||
5046 | } | |||
5047 | } | |||
5048 | break; | |||
5049 | case 40: | |||
5050 | #line 701 "/usr/src/sbin/pfctl/parse.y" | |||
5051 | { | |||
5052 | if (!strcmp(yyvsp[0].v.string, "never")) | |||
5053 | yyval.v.i = PF_SYNCOOKIES_NEVER0; | |||
5054 | else if (!strcmp(yyvsp[0].v.string, "adaptive")) | |||
5055 | yyval.v.i = PF_SYNCOOKIES_ADAPTIVE2; | |||
5056 | else if (!strcmp(yyvsp[0].v.string, "always")) | |||
5057 | yyval.v.i = PF_SYNCOOKIES_ALWAYS1; | |||
5058 | else { | |||
5059 | yyerror("illegal value for syncookies"); | |||
5060 | YYERRORgoto yyerrlab; | |||
5061 | } | |||
5062 | } | |||
5063 | break; | |||
5064 | case 41: | |||
5065 | #line 715 "/usr/src/sbin/pfctl/parse.y" | |||
5066 | { yyval.v.watermarks = NULL((void *)0); } | |||
5067 | break; | |||
5068 | case 42: | |||
5069 | #line 716 "/usr/src/sbin/pfctl/parse.y" | |||
5070 | { | |||
5071 | memset(&syncookie_opts, 0, sizeof(syncookie_opts)); | |||
5072 | } | |||
5073 | break; | |||
5074 | case 43: | |||
5075 | #line 718 "/usr/src/sbin/pfctl/parse.y" | |||
5076 | { yyval.v.watermarks = &syncookie_opts; } | |||
5077 | break; | |||
5078 | case 46: | |||
5079 | #line 725 "/usr/src/sbin/pfctl/parse.y" | |||
5080 | { | |||
5081 | double val; | |||
5082 | char *cp; | |||
5083 | ||||
5084 | val = strtod(yyvsp[0].v.string, &cp); | |||
5085 | if (cp == NULL((void *)0) || strcmp(cp, "%")) | |||
5086 | YYERRORgoto yyerrlab; | |||
5087 | if (val <= 0 || val > 100) { | |||
5088 | yyerror("illegal percentage value"); | |||
5089 | YYERRORgoto yyerrlab; | |||
5090 | } | |||
5091 | if (!strcmp(yyvsp[-1].v.string, "start")) { | |||
5092 | syncookie_opts.hi = val; | |||
5093 | } else if (!strcmp(yyvsp[-1].v.string, "end")) { | |||
5094 | syncookie_opts.lo = val; | |||
5095 | } else { | |||
5096 | yyerror("illegal syncookie option"); | |||
5097 | YYERRORgoto yyerrlab; | |||
5098 | } | |||
5099 | } | |||
5100 | break; | |||
5101 | case 47: | |||
5102 | #line 747 "/usr/src/sbin/pfctl/parse.y" | |||
5103 | { yyval.v.string = yyvsp[0].v.string; } | |||
5104 | break; | |||
5105 | case 48: | |||
5106 | #line 748 "/usr/src/sbin/pfctl/parse.y" | |||
5107 | { | |||
5108 | if ((yyval.v.string = strdup("all")) == NULL((void *)0)) { | |||
5109 | err(1, "stringall: strdup"); | |||
5110 | } | |||
5111 | } | |||
5112 | break; | |||
5113 | case 49: | |||
5114 | #line 755 "/usr/src/sbin/pfctl/parse.y" | |||
5115 | { | |||
5116 | if (asprintf(&yyval.v.string, "%s %s", yyvsp[-1].v.string, yyvsp[0].v.string) == -1) | |||
5117 | err(1, "string: asprintf"); | |||
5118 | free(yyvsp[-1].v.string); | |||
5119 | free(yyvsp[0].v.string); | |||
5120 | } | |||
5121 | break; | |||
5122 | case 51: | |||
5123 | #line 764 "/usr/src/sbin/pfctl/parse.y" | |||
5124 | { | |||
5125 | if (asprintf(&yyval.v.string, "%s %s", yyvsp[-1].v.string, yyvsp[0].v.string) == -1) | |||
5126 | err(1, "string: asprintf"); | |||
5127 | free(yyvsp[-1].v.string); | |||
5128 | free(yyvsp[0].v.string); | |||
5129 | } | |||
5130 | break; | |||
5131 | case 53: | |||
5132 | #line 773 "/usr/src/sbin/pfctl/parse.y" | |||
5133 | { | |||
5134 | char *s; | |||
5135 | if (asprintf(&s, "%lld", yyvsp[0].v.number) == -1) { | |||
5136 | yyerror("string: asprintf"); | |||
5137 | YYERRORgoto yyerrlab; | |||
5138 | } | |||
5139 | yyval.v.string = s; | |||
5140 | } | |||
5141 | break; | |||
5142 | case 55: | |||
5143 | #line 784 "/usr/src/sbin/pfctl/parse.y" | |||
5144 | { | |||
5145 | char *s = yyvsp[-2].v.string; | |||
5146 | if (pf->opts & PF_OPT_VERBOSE0x00004) | |||
5147 | printf("%s = \"%s\"\n", yyvsp[-2].v.string, yyvsp[0].v.string); | |||
5148 | while (*s++) { | |||
5149 | if (isspace((unsigned char)*s)) { | |||
5150 | yyerror("macro name cannot contain " | |||
5151 | "whitespace"); | |||
5152 | free(yyvsp[-2].v.string); | |||
5153 | free(yyvsp[0].v.string); | |||
5154 | YYERRORgoto yyerrlab; | |||
5155 | } | |||
5156 | } | |||
5157 | if (symset(yyvsp[-2].v.string, yyvsp[0].v.string, 0) == -1) | |||
5158 | err(1, "cannot store variable %s", yyvsp[-2].v.string); | |||
5159 | free(yyvsp[-2].v.string); | |||
5160 | free(yyvsp[0].v.string); | |||
5161 | } | |||
5162 | break; | |||
5163 | case 56: | |||
5164 | #line 804 "/usr/src/sbin/pfctl/parse.y" | |||
5165 | { | |||
5166 | if (yyvsp[0].v.string[0] == '\0') { | |||
5167 | free(yyvsp[0].v.string); | |||
5168 | yyerror("anchor name must not be empty"); | |||
5169 | YYERRORgoto yyerrlab; | |||
5170 | } | |||
5171 | if (strlen(pf->anchor->path) + 1 + | |||
5172 | strlen(yyvsp[0].v.string) >= PATH_MAX1024) { | |||
5173 | free(yyvsp[0].v.string); | |||
5174 | yyerror("anchor name is longer than %u", | |||
5175 | PATH_MAX1024 - 1); | |||
5176 | YYERRORgoto yyerrlab; | |||
5177 | } | |||
5178 | if (yyvsp[0].v.string[0] == '_' || strstr(yyvsp[0].v.string, "/_") != NULL((void *)0)) { | |||
5179 | free(yyvsp[0].v.string); | |||
5180 | yyerror("anchor names beginning with '_' " | |||
5181 | "are reserved for internal use"); | |||
5182 | YYERRORgoto yyerrlab; | |||
5183 | } | |||
5184 | yyval.v.string = yyvsp[0].v.string; | |||
5185 | } | |||
5186 | break; | |||
5187 | case 57: | |||
5188 | #line 825 "/usr/src/sbin/pfctl/parse.y" | |||
5189 | { yyval.v.string = NULL((void *)0); } | |||
5190 | break; | |||
5191 | case 63: | |||
5192 | #line 836 "/usr/src/sbin/pfctl/parse.y" | |||
5193 | { | |||
5194 | char ta[PF_ANCHOR_NAME_SIZE64]; | |||
5195 | struct pf_ruleset *rs; | |||
5196 | ||||
5197 | /* steping into a brace anchor */ | |||
5198 | pf->asd++; | |||
5199 | if (pf->asd >= PFCTL_ANCHOR_STACK_DEPTH64) | |||
5200 | errx(1, "pfa_anchor: anchors too deep"); | |||
5201 | pf->bn++; | |||
5202 | pf->brace = 1; | |||
5203 | ||||
5204 | /* | |||
5205 | * Anchor contents are parsed before the anchor rule | |||
5206 | * production completes, so we don't know the real | |||
5207 | * location yet. Create a holding ruleset in the root; | |||
5208 | * contents will be moved afterwards. | |||
5209 | */ | |||
5210 | snprintf(ta, PF_ANCHOR_NAME_SIZE64, "_%d", pf->bn); | |||
5211 | rs = pf_find_or_create_ruleset(ta); | |||
5212 | if (rs == NULL((void *)0)) | |||
5213 | err(1, "pfa_anchor: pf_find_or_create_ruleset"); | |||
5214 | pf->astack[pf->asd] = rs->anchor; | |||
5215 | pf->anchor = rs->anchor; | |||
5216 | } | |||
5217 | break; | |||
5218 | case 64: | |||
5219 | #line 860 "/usr/src/sbin/pfctl/parse.y" | |||
5220 | { | |||
5221 | pf->alast = pf->anchor; | |||
5222 | pf->asd--; | |||
5223 | pf->anchor = pf->astack[pf->asd]; | |||
5224 | } | |||
5225 | break; | |||
5226 | case 66: | |||
5227 | #line 870 "/usr/src/sbin/pfctl/parse.y" | |||
5228 | { | |||
5229 | struct pf_rule r; | |||
5230 | struct node_proto *proto; | |||
5231 | char *p; | |||
5232 | ||||
5233 | memset(&r, 0, sizeof(r)); | |||
5234 | if (pf->astack[pf->asd + 1]) { | |||
5235 | if (yyvsp[-8].v.string && strchr(yyvsp[-8].v.string, '/') != NULL((void *)0)) { | |||
5236 | free(yyvsp[-8].v.string); | |||
5237 | yyerror("anchor paths containing '/' " | |||
5238 | "cannot be used for inline anchors."); | |||
5239 | YYERRORgoto yyerrlab; | |||
5240 | } | |||
5241 | ||||
5242 | /* Move inline rules into relative location. */ | |||
5243 | pf_anchor_setup(&r, | |||
5244 | &pf->astack[pf->asd]->ruleset, | |||
5245 | yyvsp[-8].v.string ? yyvsp[-8].v.string : pf->alast->name); | |||
5246 | ||||
5247 | if (r.anchor == NULL((void *)0)) | |||
5248 | err(1, "anchorrule: unable to " | |||
5249 | "create ruleset"); | |||
5250 | ||||
5251 | if (pf->alast != r.anchor) { | |||
5252 | if (r.anchor->match) { | |||
5253 | yyerror("inline anchor '%s' " | |||
5254 | "already exists", | |||
5255 | r.anchor->name); | |||
5256 | YYERRORgoto yyerrlab; | |||
5257 | } | |||
5258 | mv_rules(&pf->alast->ruleset, | |||
5259 | &r.anchor->ruleset); | |||
5260 | } | |||
5261 | pf_remove_if_empty_ruleset(&pf->alast->ruleset); | |||
5262 | pf->alast = r.anchor; | |||
5263 | } else { | |||
5264 | if (!yyvsp[-8].v.string) { | |||
5265 | yyerror("anchors without explicit " | |||
5266 | "rules must specify a name"); | |||
5267 | YYERRORgoto yyerrlab; | |||
5268 | } | |||
5269 | ||||
5270 | /* | |||
5271 | * Don't make non-brace anchors part of the main anchor pool. | |||
5272 | */ | |||
5273 | if ((r.anchor = calloc(1, sizeof(*r.anchor))) == NULL((void *)0)) { | |||
5274 | err(1, "anchorrule: calloc"); | |||
5275 | } | |||
5276 | pf_init_ruleset(&r.anchor->ruleset); | |||
5277 | r.anchor->ruleset.anchor = r.anchor; | |||
5278 | if (strlcpy(r.anchor->path, yyvsp[-8].v.string, | |||
5279 | sizeof(r.anchor->path)) >= sizeof(r.anchor->path)) { | |||
5280 | errx(1, "anchorrule: strlcpy"); | |||
5281 | } | |||
5282 | if ((p = strrchr(yyvsp[-8].v.string, '/')) != NULL((void *)0)) { | |||
5283 | if (strlen(p) == 1) { | |||
5284 | yyerror("anchorrule: bad anchor name %s", | |||
5285 | yyvsp[-8].v.string); | |||
5286 | YYERRORgoto yyerrlab; | |||
5287 | } | |||
5288 | } else | |||
5289 | p = yyvsp[-8].v.string; | |||
5290 | if (strlcpy(r.anchor->name, p, | |||
5291 | sizeof(r.anchor->name)) >= sizeof(r.anchor->name)) { | |||
5292 | errx(1, "anchorrule: strlcpy"); | |||
5293 | } | |||
5294 | } | |||
5295 | ||||
5296 | r.direction = yyvsp[-7].v.i; | |||
5297 | r.quick = yyvsp[-6].v.logquick.quick; | |||
5298 | r.af = yyvsp[-4].v.i; | |||
5299 | ||||
5300 | if (yyvsp[-1].v.filter_opts.flags.b1 || yyvsp[-1].v.filter_opts.flags.b2 || yyvsp[-2].v.fromto.src_os) { | |||
5301 | for (proto = yyvsp[-3].v.proto; proto != NULL((void *)0) && | |||
5302 | proto->proto != IPPROTO_TCP6; | |||
5303 | proto = proto->next) | |||
5304 | ; /* nothing */ | |||
5305 | if (proto == NULL((void *)0) && yyvsp[-3].v.proto != NULL((void *)0)) { | |||
5306 | if (yyvsp[-1].v.filter_opts.flags.b1 || yyvsp[-1].v.filter_opts.flags.b2) | |||
5307 | yyerror( | |||
5308 | "flags only apply to tcp"); | |||
5309 | if (yyvsp[-2].v.fromto.src_os) | |||
5310 | yyerror( | |||
5311 | "OS fingerprinting only " | |||
5312 | "applies to tcp"); | |||
5313 | YYERRORgoto yyerrlab; | |||
5314 | } | |||
5315 | } | |||
5316 | ||||
5317 | if (filteropts_to_rule(&r, &yyvsp[-1].v.filter_opts)) | |||
5318 | YYERRORgoto yyerrlab; | |||
5319 | ||||
5320 | if (yyvsp[-1].v.filter_opts.keep.action) { | |||
5321 | yyerror("cannot specify state handling " | |||
5322 | "on anchors"); | |||
5323 | YYERRORgoto yyerrlab; | |||
5324 | } | |||
5325 | ||||
5326 | if (yyvsp[-1].v.filter_opts.rt) { | |||
5327 | yyerror("cannot specify route handling " | |||
5328 | "on anchors"); | |||
5329 | YYERRORgoto yyerrlab; | |||
5330 | } | |||
5331 | ||||
5332 | decide_address_family(yyvsp[-2].v.fromto.src.host, &r.af); | |||
5333 | decide_address_family(yyvsp[-2].v.fromto.dst.host, &r.af); | |||
5334 | ||||
5335 | expand_rule(&r, 0, yyvsp[-5].v.interface, NULL((void *)0), NULL((void *)0), NULL((void *)0), yyvsp[-3].v.proto, yyvsp[-2].v.fromto.src_os, | |||
5336 | yyvsp[-2].v.fromto.src.host, yyvsp[-2].v.fromto.src.port, yyvsp[-2].v.fromto.dst.host, yyvsp[-2].v.fromto.dst.port, | |||
5337 | yyvsp[-1].v.filter_opts.uid, yyvsp[-1].v.filter_opts.gid, yyvsp[-1].v.filter_opts.rcv, yyvsp[-1].v.filter_opts.icmpspec); | |||
5338 | free(yyvsp[-8].v.string); | |||
5339 | pf->astack[pf->asd + 1] = NULL((void *)0); | |||
5340 | } | |||
5341 | break; | |||
5342 | case 67: | |||
5343 | #line 985 "/usr/src/sbin/pfctl/parse.y" | |||
5344 | { | |||
5345 | struct loadanchors *loadanchor; | |||
5346 | ||||
5347 | if (yyvsp[-2].v.string == NULL((void *)0)) { | |||
5348 | yyerror("anchor name is missing"); | |||
5349 | YYERRORgoto yyerrlab; | |||
5350 | } | |||
5351 | loadanchor = calloc(1, sizeof(struct loadanchors)); | |||
5352 | if (loadanchor == NULL((void *)0)) | |||
5353 | err(1, "loadrule: calloc"); | |||
5354 | if ((loadanchor->anchorname = malloc(PATH_MAX1024)) == | |||
5355 | NULL((void *)0)) | |||
5356 | err(1, "loadrule: malloc"); | |||
5357 | if (pf->anchor->name[0]) | |||
5358 | snprintf(loadanchor->anchorname, PATH_MAX1024, | |||
5359 | "%s/%s", pf->anchor->path, yyvsp[-2].v.string); | |||
5360 | else | |||
5361 | strlcpy(loadanchor->anchorname, yyvsp[-2].v.string, PATH_MAX1024); | |||
5362 | if ((loadanchor->filename = strdup(yyvsp[0].v.string)) == NULL((void *)0)) | |||
5363 | err(1, "loadrule: strdup"); | |||
5364 | ||||
5365 | TAILQ_INSERT_TAIL(&loadanchorshead, loadanchor,do { (loadanchor)->entries.tqe_next = ((void *)0); (loadanchor )->entries.tqe_prev = (&loadanchorshead)->tqh_last; *(&loadanchorshead)->tqh_last = (loadanchor); (&loadanchorshead )->tqh_last = &(loadanchor)->entries.tqe_next; } while (0) | |||
5366 | entries)do { (loadanchor)->entries.tqe_next = ((void *)0); (loadanchor )->entries.tqe_prev = (&loadanchorshead)->tqh_last; *(&loadanchorshead)->tqh_last = (loadanchor); (&loadanchorshead )->tqh_last = &(loadanchor)->entries.tqe_next; } while (0); | |||
5367 | ||||
5368 | free(yyvsp[-2].v.string); | |||
5369 | free(yyvsp[0].v.string); | |||
5370 | } | |||
5371 | break; | |||
5372 | case 68: | |||
5373 | #line 1013 "/usr/src/sbin/pfctl/parse.y" | |||
5374 | { | |||
5375 | bzero(&scrub_opts, sizeof scrub_opts); | |||
5376 | } | |||
5377 | break; | |||
5378 | case 69: | |||
5379 | #line 1017 "/usr/src/sbin/pfctl/parse.y" | |||
5380 | { yyval.v.scrub_opts = scrub_opts; } | |||
5381 | break; | |||
5382 | case 72: | |||
5383 | #line 1024 "/usr/src/sbin/pfctl/parse.y" | |||
5384 | { | |||
5385 | if (scrub_opts.nodf) { | |||
5386 | yyerror("no-df cannot be respecified"); | |||
5387 | YYERRORgoto yyerrlab; | |||
5388 | } | |||
5389 | scrub_opts.nodf = 1; | |||
5390 | } | |||
5391 | break; | |||
5392 | case 73: | |||
5393 | #line 1031 "/usr/src/sbin/pfctl/parse.y" | |||
5394 | { | |||
5395 | if (scrub_opts.marker & FOM_MINTTL0x0020) { | |||
5396 | yyerror("min-ttl cannot be respecified"); | |||
5397 | YYERRORgoto yyerrlab; | |||
5398 | } | |||
5399 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
5400 | yyerror("illegal min-ttl value %lld", yyvsp[0].v.number); | |||
5401 | YYERRORgoto yyerrlab; | |||
5402 | } | |||
5403 | scrub_opts.marker |= FOM_MINTTL0x0020; | |||
5404 | scrub_opts.minttl = yyvsp[0].v.number; | |||
5405 | } | |||
5406 | break; | |||
5407 | case 74: | |||
5408 | #line 1043 "/usr/src/sbin/pfctl/parse.y" | |||
5409 | { | |||
5410 | if (scrub_opts.marker & FOM_MAXMSS0x0040) { | |||
5411 | yyerror("max-mss cannot be respecified"); | |||
5412 | YYERRORgoto yyerrlab; | |||
5413 | } | |||
5414 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 65535) { | |||
5415 | yyerror("illegal max-mss value %lld", yyvsp[0].v.number); | |||
5416 | YYERRORgoto yyerrlab; | |||
5417 | } | |||
5418 | scrub_opts.marker |= FOM_MAXMSS0x0040; | |||
5419 | scrub_opts.maxmss = yyvsp[0].v.number; | |||
5420 | } | |||
5421 | break; | |||
5422 | case 75: | |||
5423 | #line 1055 "/usr/src/sbin/pfctl/parse.y" | |||
5424 | { | |||
5425 | if (strcasecmp(yyvsp[0].v.string, "tcp") != 0) { | |||
5426 | yyerror("scrub reassemble supports only tcp, " | |||
5427 | "not '%s'", yyvsp[0].v.string); | |||
5428 | free(yyvsp[0].v.string); | |||
5429 | YYERRORgoto yyerrlab; | |||
5430 | } | |||
5431 | free(yyvsp[0].v.string); | |||
5432 | if (scrub_opts.reassemble_tcp) { | |||
5433 | yyerror("reassemble tcp cannot be respecified"); | |||
5434 | YYERRORgoto yyerrlab; | |||
5435 | } | |||
5436 | scrub_opts.reassemble_tcp = 1; | |||
5437 | } | |||
5438 | break; | |||
5439 | case 76: | |||
5440 | #line 1069 "/usr/src/sbin/pfctl/parse.y" | |||
5441 | { | |||
5442 | if (scrub_opts.randomid) { | |||
5443 | yyerror("random-id cannot be respecified"); | |||
5444 | YYERRORgoto yyerrlab; | |||
5445 | } | |||
5446 | scrub_opts.randomid = 1; | |||
5447 | } | |||
5448 | break; | |||
5449 | case 77: | |||
5450 | #line 1078 "/usr/src/sbin/pfctl/parse.y" | |||
5451 | { | |||
5452 | struct pf_rule r; | |||
5453 | struct node_host *h = NULL((void *)0), *hh; | |||
5454 | struct node_if *i, *j; | |||
5455 | ||||
5456 | for (i = yyvsp[-2].v.interface; i; i = i->next) { | |||
5457 | bzero(&r, sizeof(r)); | |||
5458 | ||||
5459 | r.action = PF_DROP; | |||
5460 | r.direction = PF_IN; | |||
5461 | r.log = yyvsp[-3].v.logquick.log; | |||
5462 | r.logif = yyvsp[-3].v.logquick.logif; | |||
5463 | r.quick = yyvsp[-3].v.logquick.quick; | |||
5464 | r.af = yyvsp[-1].v.i; | |||
5465 | if (rule_label(&r, yyvsp[0].v.antispoof_opts.label)) | |||
5466 | YYERRORgoto yyerrlab; | |||
5467 | r.rtableid = yyvsp[0].v.antispoof_opts.rtableid; | |||
5468 | j = calloc(1, sizeof(struct node_if)); | |||
5469 | if (j == NULL((void *)0)) | |||
5470 | err(1, "antispoof: calloc"); | |||
5471 | if (strlcpy(j->ifname, i->ifname, | |||
5472 | sizeof(j->ifname)) >= sizeof(j->ifname)) { | |||
5473 | free(j); | |||
5474 | yyerror("interface name too long"); | |||
5475 | YYERRORgoto yyerrlab; | |||
5476 | } | |||
5477 | j->not = 1; | |||
5478 | if (i->dynamic) { | |||
5479 | h = calloc(1, sizeof(*h)); | |||
5480 | if (h == NULL((void *)0)) | |||
5481 | err(1, "address: calloc"); | |||
5482 | h->addr.type = PF_ADDR_DYNIFTL; | |||
5483 | set_ipmask(h, 128); | |||
5484 | if (strlcpy(h->addr.v.ifname, i->ifname, | |||
5485 | sizeof(h->addr.v.ifname)) >= | |||
5486 | sizeof(h->addr.v.ifname)) { | |||
5487 | free(h); | |||
5488 | yyerror( | |||
5489 | "interface name too long"); | |||
5490 | YYERRORgoto yyerrlab; | |||
5491 | } | |||
5492 | hh = malloc(sizeof(*hh)); | |||
5493 | if (hh == NULL((void *)0)) | |||
5494 | err(1, "address: malloc"); | |||
5495 | bcopy(h, hh, sizeof(*hh)); | |||
5496 | h->addr.iflags = PFI_AFLAG_NETWORK0x01; | |||
5497 | } else { | |||
5498 | h = ifa_lookup(j->ifname, | |||
5499 | PFI_AFLAG_NETWORK0x01); | |||
5500 | hh = NULL((void *)0); | |||
5501 | } | |||
5502 | ||||
5503 | if (h != NULL((void *)0)) | |||
5504 | expand_rule(&r, 0, j, NULL((void *)0), NULL((void *)0), NULL((void *)0), | |||
5505 | NULL((void *)0), NULL((void *)0), h, NULL((void *)0), NULL((void *)0), NULL((void *)0), | |||
5506 | NULL((void *)0), NULL((void *)0), NULL((void *)0), NULL((void *)0)); | |||
5507 | ||||
5508 | if ((i->ifa_flags & IFF_LOOPBACK0x8) == 0) { | |||
5509 | bzero(&r, sizeof(r)); | |||
5510 | ||||
5511 | r.action = PF_DROP; | |||
5512 | r.direction = PF_IN; | |||
5513 | r.log = yyvsp[-3].v.logquick.log; | |||
5514 | r.logif = yyvsp[-3].v.logquick.logif; | |||
5515 | r.quick = yyvsp[-3].v.logquick.quick; | |||
5516 | r.af = yyvsp[-1].v.i; | |||
5517 | if (rule_label(&r, yyvsp[0].v.antispoof_opts.label)) | |||
5518 | YYERRORgoto yyerrlab; | |||
5519 | r.rtableid = yyvsp[0].v.antispoof_opts.rtableid; | |||
5520 | if (hh != NULL((void *)0)) | |||
5521 | h = hh; | |||
5522 | else | |||
5523 | h = ifa_lookup(i->ifname, 0); | |||
5524 | if (h != NULL((void *)0)) | |||
5525 | expand_rule(&r, 0, NULL((void *)0), NULL((void *)0), | |||
5526 | NULL((void *)0), NULL((void *)0), NULL((void *)0), NULL((void *)0), h, | |||
5527 | NULL((void *)0), NULL((void *)0), NULL((void *)0), NULL((void *)0), | |||
5528 | NULL((void *)0), NULL((void *)0), NULL((void *)0)); | |||
5529 | } else | |||
5530 | free(hh); | |||
5531 | } | |||
5532 | free(yyvsp[0].v.antispoof_opts.label); | |||
5533 | } | |||
5534 | break; | |||
5535 | case 78: | |||
5536 | #line 1163 "/usr/src/sbin/pfctl/parse.y" | |||
5537 | { yyval.v.interface = yyvsp[0].v.interface; } | |||
5538 | break; | |||
5539 | case 79: | |||
5540 | #line 1164 "/usr/src/sbin/pfctl/parse.y" | |||
5541 | { yyval.v.interface = yyvsp[-1].v.interface; } | |||
5542 | break; | |||
5543 | case 80: | |||
5544 | #line 1167 "/usr/src/sbin/pfctl/parse.y" | |||
5545 | { yyval.v.interface = yyvsp[-1].v.interface; } | |||
5546 | break; | |||
5547 | case 81: | |||
5548 | #line 1168 "/usr/src/sbin/pfctl/parse.y" | |||
5549 | { | |||
5550 | yyvsp[-3].v.interface->tail->next = yyvsp[-1].v.interface; | |||
5551 | yyvsp[-3].v.interface->tail = yyvsp[-1].v.interface; | |||
5552 | yyval.v.interface = yyvsp[-3].v.interface; | |||
5553 | } | |||
5554 | break; | |||
5555 | case 82: | |||
5556 | #line 1175 "/usr/src/sbin/pfctl/parse.y" | |||
5557 | { yyval.v.interface = yyvsp[0].v.interface; } | |||
5558 | break; | |||
5559 | case 83: | |||
5560 | #line 1176 "/usr/src/sbin/pfctl/parse.y" | |||
5561 | { | |||
5562 | yyvsp[-1].v.interface->dynamic = 1; | |||
5563 | yyval.v.interface = yyvsp[-1].v.interface; | |||
5564 | } | |||
5565 | break; | |||
5566 | case 84: | |||
5567 | #line 1182 "/usr/src/sbin/pfctl/parse.y" | |||
5568 | { | |||
5569 | bzero(&antispoof_opts, sizeof antispoof_opts); | |||
5570 | antispoof_opts.rtableid = -1; | |||
5571 | } | |||
5572 | break; | |||
5573 | case 85: | |||
5574 | #line 1187 "/usr/src/sbin/pfctl/parse.y" | |||
5575 | { yyval.v.antispoof_opts = antispoof_opts; } | |||
5576 | break; | |||
5577 | case 86: | |||
5578 | #line 1188 "/usr/src/sbin/pfctl/parse.y" | |||
5579 | { | |||
5580 | bzero(&antispoof_opts, sizeof antispoof_opts); | |||
5581 | antispoof_opts.rtableid = -1; | |||
5582 | yyval.v.antispoof_opts = antispoof_opts; | |||
5583 | } | |||
5584 | break; | |||
5585 | case 89: | |||
5586 | #line 1199 "/usr/src/sbin/pfctl/parse.y" | |||
5587 | { | |||
5588 | if (antispoof_opts.label) { | |||
5589 | yyerror("label cannot be redefined"); | |||
5590 | YYERRORgoto yyerrlab; | |||
5591 | } | |||
5592 | antispoof_opts.label = yyvsp[0].v.string; | |||
5593 | } | |||
5594 | break; | |||
5595 | case 90: | |||
5596 | #line 1206 "/usr/src/sbin/pfctl/parse.y" | |||
5597 | { | |||
5598 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > RT_TABLEID_MAX255) { | |||
5599 | yyerror("invalid rtable id"); | |||
5600 | YYERRORgoto yyerrlab; | |||
5601 | } else if (!lookup_rtable(yyvsp[0].v.number)) { | |||
5602 | yyerror("rtable %lld does not exist", yyvsp[0].v.number); | |||
5603 | YYERRORgoto yyerrlab; | |||
5604 | } | |||
5605 | antispoof_opts.rtableid = yyvsp[0].v.number; | |||
5606 | } | |||
5607 | break; | |||
5608 | case 91: | |||
5609 | #line 1218 "/usr/src/sbin/pfctl/parse.y" | |||
5610 | { yyval.v.number = 1; } | |||
5611 | break; | |||
5612 | case 92: | |||
5613 | #line 1219 "/usr/src/sbin/pfctl/parse.y" | |||
5614 | { yyval.v.number = 0; } | |||
5615 | break; | |||
5616 | case 93: | |||
5617 | #line 1222 "/usr/src/sbin/pfctl/parse.y" | |||
5618 | { | |||
5619 | struct node_host *h, *nh; | |||
5620 | struct node_tinit *ti, *nti; | |||
5621 | ||||
5622 | if (strlen(yyvsp[-2].v.string) >= PF_TABLE_NAME_SIZE32) { | |||
5623 | yyerror("table name too long, max %d chars", | |||
5624 | PF_TABLE_NAME_SIZE32 - 1); | |||
5625 | free(yyvsp[-2].v.string); | |||
5626 | YYERRORgoto yyerrlab; | |||
5627 | } | |||
5628 | if (process_tabledef(yyvsp[-2].v.string, &yyvsp[0].v.table_opts, pf->opts)) { | |||
5629 | free(yyvsp[-2].v.string); | |||
5630 | YYERRORgoto yyerrlab; | |||
5631 | } | |||
5632 | free(yyvsp[-2].v.string); | |||
5633 | for (ti = SIMPLEQ_FIRST(&yyvsp[0].v.table_opts.init_nodes)((&yyvsp[0].v.table_opts.init_nodes)->sqh_first); ti != NULL((void *)0); | |||
5634 | ti = nti) { | |||
5635 | if (ti->file) | |||
5636 | free(ti->file); | |||
5637 | for (h = ti->host; h != NULL((void *)0); h = nh) { | |||
5638 | nh = h->next; | |||
5639 | free(h); | |||
5640 | } | |||
5641 | nti = SIMPLEQ_NEXT(ti, entries)((ti)->entries.sqe_next); | |||
5642 | free(ti); | |||
5643 | } | |||
5644 | } | |||
5645 | break; | |||
5646 | case 94: | |||
5647 | #line 1251 "/usr/src/sbin/pfctl/parse.y" | |||
5648 | { | |||
5649 | bzero(&table_opts, sizeof table_opts); | |||
5650 | SIMPLEQ_INIT(&table_opts.init_nodes)do { (&table_opts.init_nodes)->sqh_first = ((void *)0) ; (&table_opts.init_nodes)->sqh_last = &(&table_opts .init_nodes)->sqh_first; } while (0); | |||
5651 | } | |||
5652 | break; | |||
5653 | case 95: | |||
5654 | #line 1256 "/usr/src/sbin/pfctl/parse.y" | |||
5655 | { yyval.v.table_opts = table_opts; } | |||
5656 | break; | |||
5657 | case 96: | |||
5658 | #line 1258 "/usr/src/sbin/pfctl/parse.y" | |||
5659 | { | |||
5660 | bzero(&table_opts, sizeof table_opts); | |||
5661 | SIMPLEQ_INIT(&table_opts.init_nodes)do { (&table_opts.init_nodes)->sqh_first = ((void *)0) ; (&table_opts.init_nodes)->sqh_last = &(&table_opts .init_nodes)->sqh_first; } while (0); | |||
5662 | yyval.v.table_opts = table_opts; | |||
5663 | } | |||
5664 | break; | |||
5665 | case 99: | |||
5666 | #line 1269 "/usr/src/sbin/pfctl/parse.y" | |||
5667 | { | |||
5668 | if (!strcmp(yyvsp[0].v.string, "const")) | |||
5669 | table_opts.flags |= PFR_TFLAG_CONST0x00000002; | |||
5670 | else if (!strcmp(yyvsp[0].v.string, "persist")) | |||
5671 | table_opts.flags |= PFR_TFLAG_PERSIST0x00000001; | |||
5672 | else if (!strcmp(yyvsp[0].v.string, "counters")) | |||
5673 | table_opts.flags |= PFR_TFLAG_COUNTERS0x00000040; | |||
5674 | else { | |||
5675 | yyerror("invalid table option '%s'", yyvsp[0].v.string); | |||
5676 | free(yyvsp[0].v.string); | |||
5677 | YYERRORgoto yyerrlab; | |||
5678 | } | |||
5679 | free(yyvsp[0].v.string); | |||
5680 | } | |||
5681 | break; | |||
5682 | case 100: | |||
5683 | #line 1283 "/usr/src/sbin/pfctl/parse.y" | |||
5684 | { table_opts.init_addr = 1; } | |||
5685 | break; | |||
5686 | case 101: | |||
5687 | #line 1284 "/usr/src/sbin/pfctl/parse.y" | |||
5688 | { | |||
5689 | struct node_host *n; | |||
5690 | struct node_tinit *ti; | |||
5691 | ||||
5692 | for (n = yyvsp[-1].v.host; n != NULL((void *)0); n = n->next) { | |||
5693 | switch (n->addr.type) { | |||
5694 | case PF_ADDR_ADDRMASK: | |||
5695 | continue; /* ok */ | |||
5696 | case PF_ADDR_RANGE: | |||
5697 | yyerror("address ranges are not " | |||
5698 | "permitted inside tables"); | |||
5699 | break; | |||
5700 | case PF_ADDR_DYNIFTL: | |||
5701 | yyerror("dynamic addresses are not " | |||
5702 | "permitted inside tables"); | |||
5703 | break; | |||
5704 | case PF_ADDR_TABLE: | |||
5705 | yyerror("tables cannot contain tables"); | |||
5706 | break; | |||
5707 | case PF_ADDR_NOROUTE: | |||
5708 | yyerror("\"no-route\" is not permitted " | |||
5709 | "inside tables"); | |||
5710 | break; | |||
5711 | case PF_ADDR_URPFFAILED: | |||
5712 | yyerror("\"urpf-failed\" is not " | |||
5713 | "permitted inside tables"); | |||
5714 | break; | |||
5715 | default: | |||
5716 | yyerror("unknown address type %d", | |||
5717 | n->addr.type); | |||
5718 | } | |||
5719 | YYERRORgoto yyerrlab; | |||
5720 | } | |||
5721 | if (!(ti = calloc(1, sizeof(*ti)))) | |||
5722 | err(1, "table_opt: calloc"); | |||
5723 | ti->host = yyvsp[-1].v.host; | |||
5724 | SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,do { (ti)->entries.sqe_next = ((void *)0); *(&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0) | |||
5725 | entries)do { (ti)->entries.sqe_next = ((void *)0); *(&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0); | |||
5726 | table_opts.init_addr = 1; | |||
5727 | } | |||
5728 | break; | |||
5729 | case 102: | |||
5730 | #line 1324 "/usr/src/sbin/pfctl/parse.y" | |||
5731 | { | |||
5732 | struct node_tinit *ti; | |||
5733 | ||||
5734 | if (!(ti = calloc(1, sizeof(*ti)))) | |||
5735 | err(1, "table_opt: calloc"); | |||
5736 | ti->file = yyvsp[0].v.string; | |||
5737 | SIMPLEQ_INSERT_TAIL(&table_opts.init_nodes, ti,do { (ti)->entries.sqe_next = ((void *)0); *(&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0) | |||
5738 | entries)do { (ti)->entries.sqe_next = ((void *)0); *(&table_opts .init_nodes)->sqh_last = (ti); (&table_opts.init_nodes )->sqh_last = &(ti)->entries.sqe_next; } while (0); | |||
5739 | table_opts.init_addr = 1; | |||
5740 | } | |||
5741 | break; | |||
5742 | case 103: | |||
5743 | #line 1336 "/usr/src/sbin/pfctl/parse.y" | |||
5744 | { | |||
5745 | if (yyvsp[0].v.weight > 0) { | |||
5746 | struct node_host *n; | |||
5747 | for (n = yyvsp[-1].v.host; n != NULL((void *)0); n = n->next) | |||
5748 | n->weight = yyvsp[0].v.weight; | |||
5749 | } | |||
5750 | yyval.v.host = yyvsp[-1].v.host; | |||
5751 | } | |||
5752 | break; | |||
5753 | case 104: | |||
5754 | #line 1344 "/usr/src/sbin/pfctl/parse.y" | |||
5755 | { yyval.v.host = yyvsp[-1].v.host; } | |||
5756 | break; | |||
5757 | case 105: | |||
5758 | #line 1347 "/usr/src/sbin/pfctl/parse.y" | |||
5759 | { yyval.v.host = yyvsp[-1].v.host; } | |||
5760 | break; | |||
5761 | case 106: | |||
5762 | #line 1348 "/usr/src/sbin/pfctl/parse.y" | |||
5763 | { | |||
5764 | yyvsp[-3].v.host->tail->next = yyvsp[-1].v.host; | |||
5765 | yyvsp[-3].v.host->tail = yyvsp[-1].v.host->tail; | |||
5766 | yyval.v.host = yyvsp[-3].v.host; | |||
5767 | } | |||
5768 | break; | |||
5769 | case 107: | |||
5770 | #line 1355 "/usr/src/sbin/pfctl/parse.y" | |||
5771 | { | |||
5772 | struct node_host *n; | |||
5773 | ||||
5774 | if (yyvsp[-1].v.interface == NULL((void *)0) && yyvsp[0].v.queue_opts.parent == NULL((void *)0)) { | |||
5775 | yyerror("root queue without interface"); | |||
5776 | YYERRORgoto yyerrlab; | |||
5777 | } | |||
5778 | if (yyvsp[-1].v.interface != NULL((void *)0) && | |||
5779 | ((n = ifa_exists(yyvsp[-1].v.interface->ifname)) == NULL((void *)0) || | |||
5780 | n->af != AF_LINK18)) { | |||
5781 | yyerror("not an interface"); | |||
5782 | YYERRORgoto yyerrlab; | |||
5783 | } | |||
5784 | ||||
5785 | expand_queue(yyvsp[-2].v.string, yyvsp[-1].v.interface, &yyvsp[0].v.queue_opts); | |||
5786 | } | |||
5787 | break; | |||
5788 | case 108: | |||
5789 | #line 1373 "/usr/src/sbin/pfctl/parse.y" | |||
5790 | { | |||
5791 | bzero(&queue_opts, sizeof queue_opts); | |||
5792 | } | |||
5793 | break; | |||
5794 | case 109: | |||
5795 | #line 1377 "/usr/src/sbin/pfctl/parse.y" | |||
5796 | { yyval.v.queue_opts = queue_opts; } | |||
5797 | break; | |||
5798 | case 112: | |||
5799 | #line 1384 "/usr/src/sbin/pfctl/parse.y" | |||
5800 | { | |||
5801 | if (queue_opts.marker & QOM_BWSPEC0x01) { | |||
5802 | yyerror("bandwidth cannot be respecified"); | |||
5803 | YYERRORgoto yyerrlab; | |||
5804 | } | |||
5805 | queue_opts.marker |= QOM_BWSPEC0x01; | |||
5806 | queue_opts.linkshare = yyvsp[-1].v.sc; | |||
5807 | queue_opts.realtime= yyvsp[0].v.queue_opts.realtime; | |||
5808 | queue_opts.upperlimit = yyvsp[0].v.queue_opts.upperlimit; | |||
5809 | } | |||
5810 | break; | |||
5811 | case 113: | |||
5812 | #line 1394 "/usr/src/sbin/pfctl/parse.y" | |||
5813 | { | |||
5814 | if (queue_opts.marker & QOM_PARENT0x02) { | |||
5815 | yyerror("parent cannot be respecified"); | |||
5816 | YYERRORgoto yyerrlab; | |||
5817 | } | |||
5818 | queue_opts.marker |= QOM_PARENT0x02; | |||
5819 | queue_opts.parent = yyvsp[0].v.string; | |||
5820 | } | |||
5821 | break; | |||
5822 | case 114: | |||
5823 | #line 1402 "/usr/src/sbin/pfctl/parse.y" | |||
5824 | { | |||
5825 | if (queue_opts.marker & QOM_DEFAULT0x04) { | |||
5826 | yyerror("default cannot be respecified"); | |||
5827 | YYERRORgoto yyerrlab; | |||
5828 | } | |||
5829 | queue_opts.marker |= QOM_DEFAULT0x04; | |||
5830 | queue_opts.flags |= PFQS_DEFAULT0x1000; | |||
5831 | } | |||
5832 | break; | |||
5833 | case 115: | |||
5834 | #line 1410 "/usr/src/sbin/pfctl/parse.y" | |||
5835 | { | |||
5836 | if (queue_opts.marker & QOM_QLIMIT0x08) { | |||
5837 | yyerror("qlimit cannot be respecified"); | |||
5838 | YYERRORgoto yyerrlab; | |||
5839 | } | |||
5840 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 65535) { | |||
5841 | yyerror("qlimit out of range: max 65535"); | |||
5842 | YYERRORgoto yyerrlab; | |||
5843 | } | |||
5844 | queue_opts.marker |= QOM_QLIMIT0x08; | |||
5845 | queue_opts.qlimit = yyvsp[0].v.number; | |||
5846 | } | |||
5847 | break; | |||
5848 | case 116: | |||
5849 | #line 1422 "/usr/src/sbin/pfctl/parse.y" | |||
5850 | { | |||
5851 | if (queue_opts.marker & QOM_FLOWS0x10) { | |||
5852 | yyerror("number of flows cannot be respecified"); | |||
5853 | YYERRORgoto yyerrlab; | |||
5854 | } | |||
5855 | if (yyvsp[0].v.number < 1 || yyvsp[0].v.number > 32767) { | |||
5856 | yyerror("number of flows out of range: " | |||
5857 | "max 32767"); | |||
5858 | YYERRORgoto yyerrlab; | |||
5859 | } | |||
5860 | queue_opts.marker |= QOM_FLOWS0x10; | |||
5861 | queue_opts.flags |= PFQS_FLOWQUEUE0x0001; | |||
5862 | queue_opts.flowqueue.flows = yyvsp[0].v.number; | |||
5863 | } | |||
5864 | break; | |||
5865 | case 117: | |||
5866 | #line 1436 "/usr/src/sbin/pfctl/parse.y" | |||
5867 | { | |||
5868 | if (queue_opts.marker & QOM_QUANTUM0x20) { | |||
5869 | yyerror("quantum cannot be respecified"); | |||
5870 | YYERRORgoto yyerrlab; | |||
5871 | } | |||
5872 | if (yyvsp[0].v.number < 1 || yyvsp[0].v.number > 65535) { | |||
5873 | yyerror("quantum out of range: max 65535"); | |||
5874 | YYERRORgoto yyerrlab; | |||
5875 | } | |||
5876 | queue_opts.marker |= QOM_QUANTUM0x20; | |||
5877 | queue_opts.flowqueue.quantum = yyvsp[0].v.number; | |||
5878 | } | |||
5879 | break; | |||
5880 | case 118: | |||
5881 | #line 1450 "/usr/src/sbin/pfctl/parse.y" | |||
5882 | { | |||
5883 | ||||
5884 | } | |||
5885 | break; | |||
5886 | case 119: | |||
5887 | #line 1453 "/usr/src/sbin/pfctl/parse.y" | |||
5888 | { | |||
5889 | yyval.v.queue_opts.realtime = yyvsp[0].v.sc; | |||
5890 | } | |||
5891 | break; | |||
5892 | case 120: | |||
5893 | #line 1456 "/usr/src/sbin/pfctl/parse.y" | |||
5894 | { | |||
5895 | yyval.v.queue_opts.upperlimit = yyvsp[0].v.sc; | |||
5896 | } | |||
5897 | break; | |||
5898 | case 121: | |||
5899 | #line 1459 "/usr/src/sbin/pfctl/parse.y" | |||
5900 | { | |||
5901 | yyval.v.queue_opts.realtime = yyvsp[-3].v.sc; | |||
5902 | yyval.v.queue_opts.upperlimit = yyvsp[0].v.sc; | |||
5903 | } | |||
5904 | break; | |||
5905 | case 122: | |||
5906 | #line 1463 "/usr/src/sbin/pfctl/parse.y" | |||
5907 | { | |||
5908 | yyval.v.queue_opts.realtime = yyvsp[0].v.sc; | |||
5909 | yyval.v.queue_opts.upperlimit = yyvsp[-3].v.sc; | |||
5910 | } | |||
5911 | break; | |||
5912 | case 123: | |||
5913 | #line 1469 "/usr/src/sbin/pfctl/parse.y" | |||
5914 | { | |||
5915 | yyval.v.sc.m2 = yyvsp[0].v.queue_bwspec; | |||
5916 | yyval.v.sc.d = 0; | |||
5917 | if (yyval.v.sc.m2.bw_percent) { | |||
5918 | yyerror("no bandwidth in %% yet"); | |||
5919 | YYERRORgoto yyerrlab; | |||
5920 | } | |||
5921 | } | |||
5922 | break; | |||
5923 | case 124: | |||
5924 | #line 1477 "/usr/src/sbin/pfctl/parse.y" | |||
5925 | { | |||
5926 | u_long ul; | |||
5927 | char *cp; | |||
5928 | ||||
5929 | ul = strtoul(yyvsp[0].v.string, &cp, 10); | |||
5930 | if (cp == NULL((void *)0) || strcmp(cp, "ms")) { | |||
5931 | yyerror("time in scspec must be in ms"); | |||
5932 | YYERRORgoto yyerrlab; | |||
5933 | } | |||
5934 | ||||
5935 | yyval.v.sc.m1 = yyvsp[-2].v.queue_bwspec; | |||
5936 | yyval.v.sc.d = ul; | |||
5937 | yyval.v.sc.m2 = yyvsp[-4].v.queue_bwspec; | |||
5938 | ||||
5939 | if (yyval.v.sc.m1.bw_percent || yyval.v.sc.m2.bw_percent) { | |||
5940 | yyerror("no bandwidth in %% yet"); | |||
5941 | YYERRORgoto yyerrlab; | |||
5942 | } | |||
5943 | } | |||
5944 | break; | |||
5945 | case 125: | |||
5946 | #line 1498 "/usr/src/sbin/pfctl/parse.y" | |||
5947 | { | |||
5948 | double bps; | |||
5949 | char *cp; | |||
5950 | ||||
5951 | yyval.v.queue_bwspec.bw_percent = 0; | |||
5952 | ||||
5953 | bps = strtod(yyvsp[0].v.string, &cp); | |||
5954 | if (cp != NULL((void *)0)) { | |||
5955 | if (strlen(cp) > 1) { | |||
5956 | char *cu = cp + 1; | |||
5957 | if (!strcmp(cu, "Bit") || | |||
5958 | !strcmp(cu, "B") || | |||
5959 | !strcmp(cu, "bit") || | |||
5960 | !strcmp(cu, "b")) { | |||
5961 | *cu = 0; | |||
5962 | } | |||
5963 | } | |||
5964 | if (!strcmp(cp, "b")) | |||
5965 | ; /* nothing */ | |||
5966 | else if (!strcmp(cp, "K")) | |||
5967 | bps *= 1000; | |||
5968 | else if (!strcmp(cp, "M")) | |||
5969 | bps *= 1000 * 1000; | |||
5970 | else if (!strcmp(cp, "G")) | |||
5971 | bps *= 1000 * 1000 * 1000; | |||
5972 | else if (!strcmp(cp, "%")) { | |||
5973 | if (bps < 0 || bps > 100) { | |||
5974 | yyerror("bandwidth spec " | |||
5975 | "out of range"); | |||
5976 | free(yyvsp[0].v.string); | |||
5977 | YYERRORgoto yyerrlab; | |||
5978 | } | |||
5979 | yyval.v.queue_bwspec.bw_percent = bps; | |||
5980 | bps = 0; | |||
5981 | } else { | |||
5982 | yyerror("unknown unit \"%s\"", cp); | |||
5983 | free(yyvsp[0].v.string); | |||
5984 | YYERRORgoto yyerrlab; | |||
5985 | } | |||
5986 | } | |||
5987 | free(yyvsp[0].v.string); | |||
5988 | yyval.v.queue_bwspec.bw_absolute = (u_int32_t)bps; | |||
5989 | } | |||
5990 | break; | |||
5991 | case 126: | |||
5992 | #line 1541 "/usr/src/sbin/pfctl/parse.y" | |||
5993 | { | |||
5994 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
5995 | yyerror("bandwidth number too big"); | |||
5996 | YYERRORgoto yyerrlab; | |||
5997 | } | |||
5998 | yyval.v.queue_bwspec.bw_percent = 0; | |||
5999 | yyval.v.queue_bwspec.bw_absolute = yyvsp[0].v.number; | |||
6000 | } | |||
6001 | break; | |||
6002 | case 127: | |||
6003 | #line 1553 "/usr/src/sbin/pfctl/parse.y" | |||
6004 | { | |||
6005 | struct pf_rule r; | |||
6006 | struct node_state_opt *o; | |||
6007 | struct node_proto *proto; | |||
6008 | int srctrack = 0; | |||
6009 | int statelock = 0; | |||
6010 | int adaptive = 0; | |||
6011 | int defaults = 0; | |||
6012 | ||||
6013 | memset(&r, 0, sizeof(r)); | |||
6014 | r.action = yyvsp[-7].v.b.b1; | |||
6015 | switch (yyvsp[-7].v.b.b2) { | |||
6016 | case PFRULE_RETURNRST0x0001: | |||
6017 | r.rule_flag |= PFRULE_RETURNRST0x0001; | |||
6018 | r.return_ttl = yyvsp[-7].v.b.w; | |||
6019 | break; | |||
6020 | case PFRULE_RETURNICMP0x0004: | |||
6021 | r.rule_flag |= PFRULE_RETURNICMP0x0004; | |||
6022 | r.return_icmp = yyvsp[-7].v.b.w; | |||
6023 | r.return_icmp6 = yyvsp[-7].v.b.w2; | |||
6024 | break; | |||
6025 | case PFRULE_RETURN0x0008: | |||
6026 | r.rule_flag |= PFRULE_RETURN0x0008; | |||
6027 | r.return_icmp = yyvsp[-7].v.b.w; | |||
6028 | r.return_icmp6 = yyvsp[-7].v.b.w2; | |||
6029 | break; | |||
6030 | } | |||
6031 | r.direction = yyvsp[-6].v.i; | |||
6032 | r.log = yyvsp[-5].v.logquick.log; | |||
6033 | r.logif = yyvsp[-5].v.logquick.logif; | |||
6034 | r.quick = yyvsp[-5].v.logquick.quick; | |||
6035 | r.af = yyvsp[-3].v.i; | |||
6036 | ||||
6037 | if (filteropts_to_rule(&r, &yyvsp[0].v.filter_opts)) | |||
6038 | YYERRORgoto yyerrlab; | |||
6039 | ||||
6040 | if (yyvsp[0].v.filter_opts.flags.b1 || yyvsp[0].v.filter_opts.flags.b2 || yyvsp[-1].v.fromto.src_os) { | |||
6041 | for (proto = yyvsp[-2].v.proto; proto != NULL((void *)0) && | |||
6042 | proto->proto != IPPROTO_TCP6; | |||
6043 | proto = proto->next) | |||
6044 | ; /* nothing */ | |||
6045 | if (proto == NULL((void *)0) && yyvsp[-2].v.proto != NULL((void *)0)) { | |||
6046 | if (yyvsp[0].v.filter_opts.flags.b1 || yyvsp[0].v.filter_opts.flags.b2) | |||
6047 | yyerror( | |||
6048 | "flags only apply to tcp"); | |||
6049 | if (yyvsp[-1].v.fromto.src_os) | |||
6050 | yyerror( | |||
6051 | "OS fingerprinting only " | |||
6052 | "apply to tcp"); | |||
6053 | YYERRORgoto yyerrlab; | |||
6054 | } | |||
6055 | } | |||
6056 | ||||
6057 | r.keep_state = yyvsp[0].v.filter_opts.keep.action; | |||
6058 | o = yyvsp[0].v.filter_opts.keep.options; | |||
6059 | ||||
6060 | /* 'keep state' by default on pass rules. */ | |||
6061 | if (!r.keep_state && !r.action && | |||
6062 | !(yyvsp[0].v.filter_opts.marker & FOM_KEEP0x0008)) { | |||
6063 | r.keep_state = PF_STATE_NORMAL0x1; | |||
6064 | o = keep_state_defaults; | |||
6065 | defaults = 1; | |||
6066 | } | |||
6067 | ||||
6068 | while (o) { | |||
6069 | struct node_state_opt *p = o; | |||
6070 | ||||
6071 | switch (o->type) { | |||
6072 | case PF_STATE_OPT_MAX: | |||
6073 | if (r.max_states) { | |||
6074 | yyerror("state option 'max' " | |||
6075 | "multiple definitions"); | |||
6076 | YYERRORgoto yyerrlab; | |||
6077 | } | |||
6078 | r.max_states = o->data.max_states; | |||
6079 | break; | |||
6080 | case PF_STATE_OPT_NOSYNC: | |||
6081 | if (r.rule_flag & PFRULE_NOSYNC0x0010) { | |||
6082 | yyerror("state option 'sync' " | |||
6083 | "multiple definitions"); | |||
6084 | YYERRORgoto yyerrlab; | |||
6085 | } | |||
6086 | r.rule_flag |= PFRULE_NOSYNC0x0010; | |||
6087 | break; | |||
6088 | case PF_STATE_OPT_SRCTRACK: | |||
6089 | if (srctrack) { | |||
6090 | yyerror("state option " | |||
6091 | "'source-track' " | |||
6092 | "multiple definitions"); | |||
6093 | YYERRORgoto yyerrlab; | |||
6094 | } | |||
6095 | srctrack = o->data.src_track; | |||
6096 | r.rule_flag |= PFRULE_SRCTRACK0x0020; | |||
6097 | break; | |||
6098 | case PF_STATE_OPT_MAX_SRC_STATES: | |||
6099 | if (r.max_src_states) { | |||
6100 | yyerror("state option " | |||
6101 | "'max-src-states' " | |||
6102 | "multiple definitions"); | |||
6103 | YYERRORgoto yyerrlab; | |||
6104 | } | |||
6105 | if (o->data.max_src_states == 0) { | |||
6106 | yyerror("'max-src-states' must " | |||
6107 | "be > 0"); | |||
6108 | YYERRORgoto yyerrlab; | |||
6109 | } | |||
6110 | r.max_src_states = | |||
6111 | o->data.max_src_states; | |||
6112 | r.rule_flag |= PFRULE_SRCTRACK0x0020; | |||
6113 | break; | |||
6114 | case PF_STATE_OPT_OVERLOAD: | |||
6115 | if (r.overload_tblname[0]) { | |||
6116 | yyerror("multiple 'overload' " | |||
6117 | "table definitions"); | |||
6118 | YYERRORgoto yyerrlab; | |||
6119 | } | |||
6120 | if (strlcpy(r.overload_tblname, | |||
6121 | o->data.overload.tblname, | |||
6122 | PF_TABLE_NAME_SIZE32) >= | |||
6123 | PF_TABLE_NAME_SIZE32) { | |||
6124 | yyerror("state option: " | |||
6125 | "strlcpy"); | |||
6126 | YYERRORgoto yyerrlab; | |||
6127 | } | |||
6128 | r.flush = o->data.overload.flush; | |||
6129 | break; | |||
6130 | case PF_STATE_OPT_MAX_SRC_CONN: | |||
6131 | if (r.max_src_conn) { | |||
6132 | yyerror("state option " | |||
6133 | "'max-src-conn' " | |||
6134 | "multiple definitions"); | |||
6135 | YYERRORgoto yyerrlab; | |||
6136 | } | |||
6137 | if (o->data.max_src_conn == 0) { | |||
6138 | yyerror("'max-src-conn' " | |||
6139 | "must be > 0"); | |||
6140 | YYERRORgoto yyerrlab; | |||
6141 | } | |||
6142 | r.max_src_conn = | |||
6143 | o->data.max_src_conn; | |||
6144 | r.rule_flag |= PFRULE_SRCTRACK0x0020 | | |||
6145 | PFRULE_RULESRCTRACK0x0040; | |||
6146 | break; | |||
6147 | case PF_STATE_OPT_MAX_SRC_CONN_RATE: | |||
6148 | if (r.max_src_conn_rate.limit) { | |||
6149 | yyerror("state option " | |||
6150 | "'max-src-conn-rate' " | |||
6151 | "multiple definitions"); | |||
6152 | YYERRORgoto yyerrlab; | |||
6153 | } | |||
6154 | if (!o->data.max_src_conn_rate.limit || | |||
6155 | !o->data.max_src_conn_rate.seconds) { | |||
6156 | yyerror("'max-src-conn-rate' " | |||
6157 | "values must be > 0"); | |||
6158 | YYERRORgoto yyerrlab; | |||
6159 | } | |||
6160 | if (o->data.max_src_conn_rate.limit > | |||
6161 | PF_THRESHOLD_MAX0xffffffff / 1000) { | |||
6162 | yyerror("'max-src-conn-rate' " | |||
6163 | "maximum rate must be < %u", | |||
6164 | PF_THRESHOLD_MAX0xffffffff / 1000); | |||
6165 | YYERRORgoto yyerrlab; | |||
6166 | } | |||
6167 | r.max_src_conn_rate.limit = | |||
6168 | o->data.max_src_conn_rate.limit; | |||
6169 | r.max_src_conn_rate.seconds = | |||
6170 | o->data.max_src_conn_rate.seconds; | |||
6171 | r.rule_flag |= PFRULE_SRCTRACK0x0020 | | |||
6172 | PFRULE_RULESRCTRACK0x0040; | |||
6173 | break; | |||
6174 | case PF_STATE_OPT_MAX_SRC_NODES: | |||
6175 | if (r.max_src_nodes) { | |||
6176 | yyerror("state option " | |||
6177 | "'max-src-nodes' " | |||
6178 | "multiple definitions"); | |||
6179 | YYERRORgoto yyerrlab; | |||
6180 | } | |||
6181 | if (o->data.max_src_nodes == 0) { | |||
6182 | yyerror("'max-src-nodes' must " | |||
6183 | "be > 0"); | |||
6184 | YYERRORgoto yyerrlab; | |||
6185 | } | |||
6186 | r.max_src_nodes = | |||
6187 | o->data.max_src_nodes; | |||
6188 | r.rule_flag |= PFRULE_SRCTRACK0x0020 | | |||
6189 | PFRULE_RULESRCTRACK0x0040; | |||
6190 | break; | |||
6191 | case PF_STATE_OPT_STATELOCK: | |||
6192 | if (statelock) { | |||
6193 | yyerror("state locking option: " | |||
6194 | "multiple definitions"); | |||
6195 | YYERRORgoto yyerrlab; | |||
6196 | } | |||
6197 | statelock = 1; | |||
6198 | r.rule_flag |= o->data.statelock; | |||
6199 | break; | |||
6200 | case PF_STATE_OPT_SLOPPY: | |||
6201 | if (r.rule_flag & PFRULE_STATESLOPPY0x00020000) { | |||
6202 | yyerror("state sloppy option: " | |||
6203 | "multiple definitions"); | |||
6204 | YYERRORgoto yyerrlab; | |||
6205 | } | |||
6206 | r.rule_flag |= PFRULE_STATESLOPPY0x00020000; | |||
6207 | break; | |||
6208 | case PF_STATE_OPT_PFLOW: | |||
6209 | if (r.rule_flag & PFRULE_PFLOW0x00040000) { | |||
6210 | yyerror("state pflow " | |||
6211 | "option: multiple " | |||
6212 | "definitions"); | |||
6213 | YYERRORgoto yyerrlab; | |||
6214 | } | |||
6215 | r.rule_flag |= PFRULE_PFLOW0x00040000; | |||
6216 | break; | |||
6217 | case PF_STATE_OPT_TIMEOUT: | |||
6218 | if (o->data.timeout.number == | |||
6219 | PFTM_ADAPTIVE_START || | |||
6220 | o->data.timeout.number == | |||
6221 | PFTM_ADAPTIVE_END) | |||
6222 | adaptive = 1; | |||
6223 | if (r.timeout[o->data.timeout.number]) { | |||
6224 | yyerror("state timeout %s " | |||
6225 | "multiple definitions", | |||
6226 | pf_timeouts[o->data. | |||
6227 | timeout.number].name); | |||
6228 | YYERRORgoto yyerrlab; | |||
6229 | } | |||
6230 | r.timeout[o->data.timeout.number] = | |||
6231 | o->data.timeout.seconds; | |||
6232 | } | |||
6233 | o = o->next; | |||
6234 | if (!defaults) | |||
6235 | free(p); | |||
6236 | } | |||
6237 | ||||
6238 | /* 'flags S/SA' by default on stateful rules */ | |||
6239 | if (!r.action && !r.flags && !r.flagset && | |||
6240 | !yyvsp[0].v.filter_opts.fragment && !(yyvsp[0].v.filter_opts.marker & FOM_FLAGS0x0001) && | |||
6241 | r.keep_state) { | |||
6242 | r.flags = parse_flags("S"); | |||
6243 | r.flagset = parse_flags("SA"); | |||
6244 | } | |||
6245 | if (!adaptive && r.max_states) { | |||
6246 | r.timeout[PFTM_ADAPTIVE_START] = | |||
6247 | (r.max_states / 10) * 6; | |||
6248 | r.timeout[PFTM_ADAPTIVE_END] = | |||
6249 | (r.max_states / 10) * 12; | |||
6250 | } | |||
6251 | if (r.rule_flag & PFRULE_SRCTRACK0x0020) { | |||
6252 | if (srctrack == PF_SRCTRACK_GLOBAL && | |||
6253 | r.max_src_nodes) { | |||
6254 | yyerror("'max-src-nodes' is " | |||
6255 | "incompatible with " | |||
6256 | "'source-track global'"); | |||
6257 | YYERRORgoto yyerrlab; | |||
6258 | } | |||
6259 | if (srctrack == PF_SRCTRACK_GLOBAL && | |||
6260 | r.max_src_conn) { | |||
6261 | yyerror("'max-src-conn' is " | |||
6262 | "incompatible with " | |||
6263 | "'source-track global'"); | |||
6264 | YYERRORgoto yyerrlab; | |||
6265 | } | |||
6266 | if (srctrack == PF_SRCTRACK_GLOBAL && | |||
6267 | r.max_src_conn_rate.seconds) { | |||
6268 | yyerror("'max-src-conn-rate' is " | |||
6269 | "incompatible with " | |||
6270 | "'source-track global'"); | |||
6271 | YYERRORgoto yyerrlab; | |||
6272 | } | |||
6273 | if (r.timeout[PFTM_SRC_NODE] < | |||
6274 | r.max_src_conn_rate.seconds) | |||
6275 | r.timeout[PFTM_SRC_NODE] = | |||
6276 | r.max_src_conn_rate.seconds; | |||
6277 | r.rule_flag |= PFRULE_SRCTRACK0x0020; | |||
6278 | if (srctrack == PF_SRCTRACK_RULE) | |||
6279 | r.rule_flag |= PFRULE_RULESRCTRACK0x0040; | |||
6280 | } | |||
6281 | if (r.keep_state && !statelock) | |||
6282 | r.rule_flag |= default_statelock; | |||
6283 | ||||
6284 | decide_address_family(yyvsp[-1].v.fromto.src.host, &r.af); | |||
6285 | decide_address_family(yyvsp[-1].v.fromto.dst.host, &r.af); | |||
6286 | ||||
6287 | if (yyvsp[0].v.filter_opts.rt) { | |||
6288 | if (yyvsp[0].v.filter_opts.rt != PF_DUPTO && !r.direction) { | |||
6289 | yyerror("direction must be explicit " | |||
6290 | "with rules that specify routing"); | |||
6291 | YYERRORgoto yyerrlab; | |||
6292 | } | |||
6293 | r.rt = yyvsp[0].v.filter_opts.rt; | |||
6294 | } | |||
6295 | ||||
6296 | if (expand_divertspec(&r, &yyvsp[0].v.filter_opts.divert)) | |||
6297 | YYERRORgoto yyerrlab; | |||
6298 | ||||
6299 | expand_rule(&r, 0, yyvsp[-4].v.interface, &yyvsp[0].v.filter_opts.nat, &yyvsp[0].v.filter_opts.rdr, &yyvsp[0].v.filter_opts.rroute, yyvsp[-2].v.proto, | |||
6300 | yyvsp[-1].v.fromto.src_os, | |||
6301 | yyvsp[-1].v.fromto.src.host, yyvsp[-1].v.fromto.src.port, yyvsp[-1].v.fromto.dst.host, yyvsp[-1].v.fromto.dst.port, | |||
6302 | yyvsp[0].v.filter_opts.uid, yyvsp[0].v.filter_opts.gid, yyvsp[0].v.filter_opts.rcv, yyvsp[0].v.filter_opts.icmpspec); | |||
6303 | } | |||
6304 | break; | |||
6305 | case 128: | |||
6306 | #line 1855 "/usr/src/sbin/pfctl/parse.y" | |||
6307 | { | |||
6308 | bzero(&filter_opts, sizeof filter_opts); | |||
6309 | filter_opts.rtableid = -1; | |||
6310 | } | |||
6311 | break; | |||
6312 | case 129: | |||
6313 | #line 1860 "/usr/src/sbin/pfctl/parse.y" | |||
6314 | { yyval.v.filter_opts = filter_opts; } | |||
6315 | break; | |||
6316 | case 130: | |||
6317 | #line 1861 "/usr/src/sbin/pfctl/parse.y" | |||
6318 | { | |||
6319 | bzero(&filter_opts, sizeof filter_opts); | |||
6320 | filter_opts.rtableid = -1; | |||
6321 | yyval.v.filter_opts = filter_opts; | |||
6322 | } | |||
6323 | break; | |||
6324 | case 133: | |||
6325 | #line 1872 "/usr/src/sbin/pfctl/parse.y" | |||
6326 | { | |||
6327 | if (filter_opts.uid) | |||
6328 | yyvsp[0].v.uid->tail->next = filter_opts.uid; | |||
6329 | filter_opts.uid = yyvsp[0].v.uid; | |||
6330 | } | |||
6331 | break; | |||
6332 | case 134: | |||
6333 | #line 1877 "/usr/src/sbin/pfctl/parse.y" | |||
6334 | { | |||
6335 | if (filter_opts.gid) | |||
6336 | yyvsp[0].v.gid->tail->next = filter_opts.gid; | |||
6337 | filter_opts.gid = yyvsp[0].v.gid; | |||
6338 | } | |||
6339 | break; | |||
6340 | case 135: | |||
6341 | #line 1882 "/usr/src/sbin/pfctl/parse.y" | |||
6342 | { | |||
6343 | if (filter_opts.marker & FOM_FLAGS0x0001) { | |||
6344 | yyerror("flags cannot be redefined"); | |||
6345 | YYERRORgoto yyerrlab; | |||
6346 | } | |||
6347 | filter_opts.marker |= FOM_FLAGS0x0001; | |||
6348 | filter_opts.flags.b1 |= yyvsp[0].v.b.b1; | |||
6349 | filter_opts.flags.b2 |= yyvsp[0].v.b.b2; | |||
6350 | filter_opts.flags.w |= yyvsp[0].v.b.w; | |||
6351 | filter_opts.flags.w2 |= yyvsp[0].v.b.w2; | |||
6352 | } | |||
6353 | break; | |||
6354 | case 136: | |||
6355 | #line 1893 "/usr/src/sbin/pfctl/parse.y" | |||
6356 | { | |||
6357 | if (filter_opts.marker & FOM_ICMP0x0002) { | |||
6358 | yyerror("icmp-type cannot be redefined"); | |||
6359 | YYERRORgoto yyerrlab; | |||
6360 | } | |||
6361 | filter_opts.marker |= FOM_ICMP0x0002; | |||
6362 | filter_opts.icmpspec = yyvsp[0].v.icmp; | |||
6363 | } | |||
6364 | break; | |||
6365 | case 137: | |||
6366 | #line 1901 "/usr/src/sbin/pfctl/parse.y" | |||
6367 | { | |||
6368 | if (filter_opts.marker & FOM_PRIO0x2000) { | |||
6369 | yyerror("prio cannot be redefined"); | |||
6370 | YYERRORgoto yyerrlab; | |||
6371 | } | |||
6372 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > IFQ_MAXPRIO8 - 1) { | |||
6373 | yyerror("prio must be 0 - %u", IFQ_MAXPRIO8 - 1); | |||
6374 | YYERRORgoto yyerrlab; | |||
6375 | } | |||
6376 | filter_opts.marker |= FOM_PRIO0x2000; | |||
6377 | filter_opts.prio = yyvsp[0].v.number; | |||
6378 | } | |||
6379 | break; | |||
6380 | case 138: | |||
6381 | #line 1913 "/usr/src/sbin/pfctl/parse.y" | |||
6382 | { | |||
6383 | if (filter_opts.marker & FOM_TOS0x0004) { | |||
6384 | yyerror("tos cannot be redefined"); | |||
6385 | YYERRORgoto yyerrlab; | |||
6386 | } | |||
6387 | filter_opts.marker |= FOM_TOS0x0004; | |||
6388 | filter_opts.tos = yyvsp[0].v.number; | |||
6389 | } | |||
6390 | break; | |||
6391 | case 139: | |||
6392 | #line 1921 "/usr/src/sbin/pfctl/parse.y" | |||
6393 | { | |||
6394 | if (filter_opts.marker & FOM_KEEP0x0008) { | |||
6395 | yyerror("modulate or keep cannot be redefined"); | |||
6396 | YYERRORgoto yyerrlab; | |||
6397 | } | |||
6398 | filter_opts.marker |= FOM_KEEP0x0008; | |||
6399 | filter_opts.keep.action = yyvsp[0].v.keep_state.action; | |||
6400 | filter_opts.keep.options = yyvsp[0].v.keep_state.options; | |||
6401 | } | |||
6402 | break; | |||
6403 | case 140: | |||
6404 | #line 1930 "/usr/src/sbin/pfctl/parse.y" | |||
6405 | { | |||
6406 | filter_opts.fragment = 1; | |||
6407 | } | |||
6408 | break; | |||
6409 | case 141: | |||
6410 | #line 1933 "/usr/src/sbin/pfctl/parse.y" | |||
6411 | { | |||
6412 | filter_opts.allowopts = 1; | |||
6413 | } | |||
6414 | break; | |||
6415 | case 142: | |||
6416 | #line 1936 "/usr/src/sbin/pfctl/parse.y" | |||
6417 | { | |||
6418 | if (filter_opts.label) { | |||
6419 | yyerror("label cannot be redefined"); | |||
6420 | YYERRORgoto yyerrlab; | |||
6421 | } | |||
6422 | filter_opts.label = yyvsp[0].v.string; | |||
6423 | } | |||
6424 | break; | |||
6425 | case 143: | |||
6426 | #line 1943 "/usr/src/sbin/pfctl/parse.y" | |||
6427 | { | |||
6428 | if (filter_opts.queues.qname) { | |||
6429 | yyerror("queue cannot be redefined"); | |||
6430 | YYERRORgoto yyerrlab; | |||
6431 | } | |||
6432 | filter_opts.queues = yyvsp[0].v.qassign; | |||
6433 | } | |||
6434 | break; | |||
6435 | case 144: | |||
6436 | #line 1950 "/usr/src/sbin/pfctl/parse.y" | |||
6437 | { | |||
6438 | filter_opts.tag = yyvsp[0].v.string; | |||
6439 | } | |||
6440 | break; | |||
6441 | case 145: | |||
6442 | #line 1953 "/usr/src/sbin/pfctl/parse.y" | |||
6443 | { | |||
6444 | filter_opts.match_tag = yyvsp[0].v.string; | |||
6445 | filter_opts.match_tag_not = yyvsp[-2].v.number; | |||
6446 | } | |||
6447 | break; | |||
6448 | case 146: | |||
6449 | #line 1957 "/usr/src/sbin/pfctl/parse.y" | |||
6450 | { | |||
6451 | double p; | |||
6452 | ||||
6453 | p = floor(yyvsp[0].v.probability * UINT_MAX0xffffffffU + 0.5); | |||
6454 | if (p < 0.0 || p > UINT_MAX0xffffffffU) { | |||
6455 | yyerror("invalid probability: %g%%", yyvsp[0].v.probability * 100); | |||
6456 | YYERRORgoto yyerrlab; | |||
6457 | } | |||
6458 | filter_opts.prob = (u_int32_t)p; | |||
6459 | if (filter_opts.prob == 0) | |||
6460 | filter_opts.prob = 1; | |||
6461 | } | |||
6462 | break; | |||
6463 | case 147: | |||
6464 | #line 1969 "/usr/src/sbin/pfctl/parse.y" | |||
6465 | { | |||
6466 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > RT_TABLEID_MAX255) { | |||
6467 | yyerror("invalid rtable id"); | |||
6468 | YYERRORgoto yyerrlab; | |||
6469 | } else if (!lookup_rtable(yyvsp[0].v.number)) { | |||
6470 | yyerror("rtable %lld does not exist", yyvsp[0].v.number); | |||
6471 | YYERRORgoto yyerrlab; | |||
6472 | } | |||
6473 | filter_opts.rtableid = yyvsp[0].v.number; | |||
6474 | } | |||
6475 | break; | |||
6476 | case 148: | |||
6477 | #line 1979 "/usr/src/sbin/pfctl/parse.y" | |||
6478 | { | |||
6479 | if (filter_opts.divert.type != PF_DIVERT_NONE) { | |||
6480 | yyerror("more than one divert option"); | |||
6481 | YYERRORgoto yyerrlab; | |||
6482 | } | |||
6483 | filter_opts.divert.type = PF_DIVERT_TO; | |||
6484 | if ((filter_opts.divert.addr = host(yyvsp[-2].v.string, pf->opts)) == NULL((void *)0)) { | |||
6485 | yyerror("could not parse divert address: %s", | |||
6486 | yyvsp[-2].v.string); | |||
6487 | free(yyvsp[-2].v.string); | |||
6488 | YYERRORgoto yyerrlab; | |||
6489 | } | |||
6490 | free(yyvsp[-2].v.string); | |||
6491 | filter_opts.divert.port = yyvsp[0].v.range.a; | |||
6492 | if (!filter_opts.divert.port) { | |||
6493 | yyerror("invalid divert port: %u", ntohs(yyvsp[0].v.range.a)(__uint16_t)(__builtin_constant_p(yyvsp[0].v.range.a) ? (__uint16_t )(((__uint16_t)(yyvsp[0].v.range.a) & 0xffU) << 8 | ((__uint16_t)(yyvsp[0].v.range.a) & 0xff00U) >> 8) : __swap16md(yyvsp[0].v.range.a))); | |||
6494 | YYERRORgoto yyerrlab; | |||
6495 | } | |||
6496 | } | |||
6497 | break; | |||
6498 | case 149: | |||
6499 | #line 1998 "/usr/src/sbin/pfctl/parse.y" | |||
6500 | { | |||
6501 | if (filter_opts.divert.type != PF_DIVERT_NONE) { | |||
6502 | yyerror("more than one divert option"); | |||
6503 | YYERRORgoto yyerrlab; | |||
6504 | } | |||
6505 | filter_opts.divert.type = PF_DIVERT_REPLY; | |||
6506 | } | |||
6507 | break; | |||
6508 | case 150: | |||
6509 | #line 2005 "/usr/src/sbin/pfctl/parse.y" | |||
6510 | { | |||
6511 | if (filter_opts.divert.type != PF_DIVERT_NONE) { | |||
6512 | yyerror("more than one divert option"); | |||
6513 | YYERRORgoto yyerrlab; | |||
6514 | } | |||
6515 | filter_opts.divert.type = PF_DIVERT_PACKET; | |||
6516 | /* | |||
6517 | * If IP reassembly was not turned off, also | |||
6518 | * forcibly enable TCP reassembly by default. | |||
6519 | */ | |||
6520 | if (pf->reassemble & PF_REASS_ENABLED0x01) | |||
6521 | filter_opts.marker |= FOM_SCRUB_TCP0x0200; | |||
6522 | ||||
6523 | filter_opts.divert.port = yyvsp[0].v.range.a; | |||
6524 | if (!filter_opts.divert.port) { | |||
6525 | yyerror("invalid divert port: %u", ntohs(yyvsp[0].v.range.a)(__uint16_t)(__builtin_constant_p(yyvsp[0].v.range.a) ? (__uint16_t )(((__uint16_t)(yyvsp[0].v.range.a) & 0xffU) << 8 | ((__uint16_t)(yyvsp[0].v.range.a) & 0xff00U) >> 8) : __swap16md(yyvsp[0].v.range.a))); | |||
6526 | YYERRORgoto yyerrlab; | |||
6527 | } | |||
6528 | } | |||
6529 | break; | |||
6530 | case 151: | |||
6531 | #line 2024 "/usr/src/sbin/pfctl/parse.y" | |||
6532 | { | |||
6533 | filter_opts.nodf = yyvsp[-1].v.scrub_opts.nodf; | |||
6534 | filter_opts.minttl = yyvsp[-1].v.scrub_opts.minttl; | |||
6535 | filter_opts.randomid = yyvsp[-1].v.scrub_opts.randomid; | |||
6536 | filter_opts.max_mss = yyvsp[-1].v.scrub_opts.maxmss; | |||
6537 | if (yyvsp[-1].v.scrub_opts.reassemble_tcp) | |||
6538 | filter_opts.marker |= FOM_SCRUB_TCP0x0200; | |||
6539 | filter_opts.marker |= yyvsp[-1].v.scrub_opts.marker; | |||
6540 | } | |||
6541 | break; | |||
6542 | case 152: | |||
6543 | #line 2033 "/usr/src/sbin/pfctl/parse.y" | |||
6544 | { | |||
6545 | if (filter_opts.nat.rdr) { | |||
6546 | yyerror("cannot respecify nat-to/binat-to"); | |||
6547 | YYERRORgoto yyerrlab; | |||
6548 | } | |||
6549 | filter_opts.nat.rdr = yyvsp[-1].v.redirection; | |||
6550 | memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts, | |||
6551 | sizeof(filter_opts.nat.pool_opts)); | |||
6552 | } | |||
6553 | break; | |||
6554 | case 153: | |||
6555 | #line 2042 "/usr/src/sbin/pfctl/parse.y" | |||
6556 | { | |||
6557 | if (filter_opts.nat.rdr) { | |||
6558 | yyerror("cannot respecify af-to"); | |||
6559 | YYERRORgoto yyerrlab; | |||
6560 | } | |||
6561 | if (yyvsp[-3].v.i == 0) { | |||
6562 | yyerror("no target address family specified"); | |||
6563 | YYERRORgoto yyerrlab; | |||
6564 | } | |||
6565 | filter_opts.nat.af = yyvsp[-3].v.i; | |||
6566 | filter_opts.nat.rdr = yyvsp[-1].v.redirection; | |||
6567 | memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts, | |||
6568 | sizeof(filter_opts.nat.pool_opts)); | |||
6569 | filter_opts.rdr.rdr = | |||
6570 | calloc(1, sizeof(struct redirection)); | |||
6571 | bzero(&filter_opts.rdr.pool_opts, | |||
6572 | sizeof(filter_opts.rdr.pool_opts)); | |||
6573 | filter_opts.marker |= FOM_AFTO0x0080; | |||
6574 | } | |||
6575 | break; | |||
6576 | case 154: | |||
6577 | #line 2061 "/usr/src/sbin/pfctl/parse.y" | |||
6578 | { | |||
6579 | if (filter_opts.nat.rdr) { | |||
6580 | yyerror("cannot respecify af-to"); | |||
6581 | YYERRORgoto yyerrlab; | |||
6582 | } | |||
6583 | if (yyvsp[-6].v.i == 0) { | |||
6584 | yyerror("no address family specified"); | |||
6585 | YYERRORgoto yyerrlab; | |||
6586 | } | |||
6587 | if ((yyvsp[-4].v.redirection->host->af && yyvsp[-4].v.redirection->host->af != yyvsp[-6].v.i) || | |||
6588 | (yyvsp[-1].v.redirection->host->af && yyvsp[-1].v.redirection->host->af != yyvsp[-6].v.i)) { | |||
6589 | yyerror("af-to addresses must be in the " | |||
6590 | "target address family"); | |||
6591 | YYERRORgoto yyerrlab; | |||
6592 | } | |||
6593 | filter_opts.nat.af = yyvsp[-6].v.i; | |||
6594 | filter_opts.nat.rdr = yyvsp[-4].v.redirection; | |||
6595 | memcpy(&filter_opts.nat.pool_opts, &yyvsp[-3].v.pool_opts, | |||
6596 | sizeof(filter_opts.nat.pool_opts)); | |||
6597 | filter_opts.rdr.af = yyvsp[-6].v.i; | |||
6598 | filter_opts.rdr.rdr = yyvsp[-1].v.redirection; | |||
6599 | memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts, | |||
6600 | sizeof(filter_opts.nat.pool_opts)); | |||
6601 | filter_opts.marker |= FOM_AFTO0x0080; | |||
6602 | } | |||
6603 | break; | |||
6604 | case 155: | |||
6605 | #line 2086 "/usr/src/sbin/pfctl/parse.y" | |||
6606 | { | |||
6607 | if (filter_opts.rdr.rdr) { | |||
6608 | yyerror("cannot respecify rdr-to"); | |||
6609 | YYERRORgoto yyerrlab; | |||
6610 | } | |||
6611 | filter_opts.rdr.rdr = yyvsp[-1].v.redirection; | |||
6612 | memcpy(&filter_opts.rdr.pool_opts, &yyvsp[0].v.pool_opts, | |||
6613 | sizeof(filter_opts.rdr.pool_opts)); | |||
6614 | } | |||
6615 | break; | |||
6616 | case 156: | |||
6617 | #line 2095 "/usr/src/sbin/pfctl/parse.y" | |||
6618 | { | |||
6619 | if (filter_opts.nat.rdr) { | |||
6620 | yyerror("cannot respecify nat-to/binat-to"); | |||
6621 | YYERRORgoto yyerrlab; | |||
6622 | } | |||
6623 | filter_opts.nat.rdr = yyvsp[-1].v.redirection; | |||
6624 | filter_opts.nat.binat = 1; | |||
6625 | memcpy(&filter_opts.nat.pool_opts, &yyvsp[0].v.pool_opts, | |||
6626 | sizeof(filter_opts.nat.pool_opts)); | |||
6627 | filter_opts.nat.pool_opts.staticport = 1; | |||
6628 | } | |||
6629 | break; | |||
6630 | case 157: | |||
6631 | #line 2106 "/usr/src/sbin/pfctl/parse.y" | |||
6632 | { | |||
6633 | filter_opts.rt = PF_ROUTETO; | |||
6634 | } | |||
6635 | break; | |||
6636 | case 158: | |||
6637 | #line 2109 "/usr/src/sbin/pfctl/parse.y" | |||
6638 | { | |||
6639 | filter_opts.rt = PF_REPLYTO; | |||
6640 | } | |||
6641 | break; | |||
6642 | case 159: | |||
6643 | #line 2112 "/usr/src/sbin/pfctl/parse.y" | |||
6644 | { | |||
6645 | filter_opts.rt = PF_DUPTO; | |||
6646 | } | |||
6647 | break; | |||
6648 | case 160: | |||
6649 | #line 2115 "/usr/src/sbin/pfctl/parse.y" | |||
6650 | { | |||
6651 | if (filter_opts.rcv) { | |||
6652 | yyerror("cannot respecify received-on"); | |||
6653 | YYERRORgoto yyerrlab; | |||
6654 | } | |||
6655 | filter_opts.rcv = yyvsp[0].v.interface; | |||
6656 | filter_opts.rcv->not = yyvsp[-2].v.number; | |||
6657 | } | |||
6658 | break; | |||
6659 | case 161: | |||
6660 | #line 2123 "/usr/src/sbin/pfctl/parse.y" | |||
6661 | { | |||
6662 | filter_opts.marker |= FOM_ONCE0x1000; | |||
6663 | } | |||
6664 | break; | |||
6665 | case 162: | |||
6666 | #line 2126 "/usr/src/sbin/pfctl/parse.y" | |||
6667 | { | |||
6668 | if (yyvsp[-2].v.number < 0 || yyvsp[-2].v.number > UINT_MAX0xffffffffU || | |||
6669 | yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
6670 | yyerror("only positive values permitted"); | |||
6671 | YYERRORgoto yyerrlab; | |||
6672 | } | |||
6673 | if (filter_opts.pktrate.limit) { | |||
6674 | yyerror("cannot respecify max-pkt-rate"); | |||
6675 | YYERRORgoto yyerrlab; | |||
6676 | } | |||
6677 | filter_opts.pktrate.limit = yyvsp[-2].v.number; | |||
6678 | filter_opts.pktrate.seconds = yyvsp[0].v.number; | |||
6679 | } | |||
6680 | break; | |||
6681 | case 164: | |||
6682 | #line 2142 "/usr/src/sbin/pfctl/parse.y" | |||
6683 | { yyval.v.filter_opts = filter_opts; } | |||
6684 | break; | |||
6685 | case 165: | |||
6686 | #line 2143 "/usr/src/sbin/pfctl/parse.y" | |||
6687 | { yyval.v.filter_opts = filter_opts; } | |||
6688 | break; | |||
6689 | case 168: | |||
6690 | #line 2150 "/usr/src/sbin/pfctl/parse.y" | |||
6691 | { | |||
6692 | if (filter_opts.marker & FOM_SETPRIO0x0400) { | |||
6693 | yyerror("prio cannot be redefined"); | |||
6694 | YYERRORgoto yyerrlab; | |||
6695 | } | |||
6696 | filter_opts.marker |= FOM_SETPRIO0x0400; | |||
6697 | filter_opts.set_prio[0] = yyvsp[0].v.b.b1; | |||
6698 | filter_opts.set_prio[1] = yyvsp[0].v.b.b2; | |||
6699 | } | |||
6700 | break; | |||
6701 | case 169: | |||
6702 | #line 2159 "/usr/src/sbin/pfctl/parse.y" | |||
6703 | { | |||
6704 | if (filter_opts.queues.qname) { | |||
6705 | yyerror("queue cannot be redefined"); | |||
6706 | YYERRORgoto yyerrlab; | |||
6707 | } | |||
6708 | filter_opts.queues = yyvsp[0].v.qassign; | |||
6709 | } | |||
6710 | break; | |||
6711 | case 170: | |||
6712 | #line 2166 "/usr/src/sbin/pfctl/parse.y" | |||
6713 | { | |||
6714 | if (filter_opts.marker & FOM_SETTOS0x0100) { | |||
6715 | yyerror("tos cannot be respecified"); | |||
6716 | YYERRORgoto yyerrlab; | |||
6717 | } | |||
6718 | filter_opts.marker |= FOM_SETTOS0x0100; | |||
6719 | filter_opts.settos = yyvsp[0].v.number; | |||
6720 | } | |||
6721 | break; | |||
6722 | case 171: | |||
6723 | #line 2174 "/usr/src/sbin/pfctl/parse.y" | |||
6724 | { | |||
6725 | if (filter_opts.delay) { | |||
6726 | yyerror("delay cannot be respecified"); | |||
6727 | YYERRORgoto yyerrlab; | |||
6728 | } | |||
6729 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 0xffff) { | |||
6730 | yyerror("illegal delay value %lld (0-%u)", yyvsp[0].v.number, | |||
6731 | 0xffff); | |||
6732 | YYERRORgoto yyerrlab; | |||
6733 | } | |||
6734 | filter_opts.marker |= FOM_SETDELAY0x4000; | |||
6735 | filter_opts.delay = yyvsp[0].v.number; | |||
6736 | } | |||
6737 | break; | |||
6738 | case 172: | |||
6739 | #line 2189 "/usr/src/sbin/pfctl/parse.y" | |||
6740 | { | |||
6741 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > IFQ_MAXPRIO8 - 1) { | |||
6742 | yyerror("prio must be 0 - %u", IFQ_MAXPRIO8 - 1); | |||
6743 | YYERRORgoto yyerrlab; | |||
6744 | } | |||
6745 | yyval.v.b.b1 = yyval.v.b.b2 = yyvsp[0].v.number; | |||
6746 | } | |||
6747 | break; | |||
6748 | case 173: | |||
6749 | #line 2196 "/usr/src/sbin/pfctl/parse.y" | |||
6750 | { | |||
6751 | if (yyvsp[-3].v.number < 0 || yyvsp[-3].v.number > IFQ_MAXPRIO8 - 1 || | |||
6752 | yyvsp[-1].v.number < 0 || yyvsp[-1].v.number > IFQ_MAXPRIO8 - 1) { | |||
6753 | yyerror("prio must be 0 - %u", IFQ_MAXPRIO8 - 1); | |||
6754 | YYERRORgoto yyerrlab; | |||
6755 | } | |||
6756 | yyval.v.b.b1 = yyvsp[-3].v.number; | |||
6757 | yyval.v.b.b2 = yyvsp[-1].v.number; | |||
6758 | } | |||
6759 | break; | |||
6760 | case 174: | |||
6761 | #line 2207 "/usr/src/sbin/pfctl/parse.y" | |||
6762 | { | |||
6763 | char *e; | |||
6764 | double p = strtod(yyvsp[0].v.string, &e); | |||
6765 | ||||
6766 | if (*e == '%') { | |||
6767 | p *= 0.01; | |||
6768 | e++; | |||
6769 | } | |||
6770 | if (*e) { | |||
6771 | yyerror("invalid probability: %s", yyvsp[0].v.string); | |||
6772 | free(yyvsp[0].v.string); | |||
6773 | YYERRORgoto yyerrlab; | |||
6774 | } | |||
6775 | free(yyvsp[0].v.string); | |||
6776 | yyval.v.probability = p; | |||
6777 | } | |||
6778 | break; | |||
6779 | case 175: | |||
6780 | #line 2223 "/usr/src/sbin/pfctl/parse.y" | |||
6781 | { | |||
6782 | yyval.v.probability = (double)yyvsp[0].v.number; | |||
6783 | } | |||
6784 | break; | |||
6785 | case 176: | |||
6786 | #line 2229 "/usr/src/sbin/pfctl/parse.y" | |||
6787 | { yyval.v.b.b1 = PF_PASS; yyval.v.b.b2 = yyval.v.b.w = 0; } | |||
6788 | break; | |||
6789 | case 177: | |||
6790 | #line 2230 "/usr/src/sbin/pfctl/parse.y" | |||
6791 | { yyval.v.b.b1 = PF_MATCH; yyval.v.b.b2 = yyval.v.b.w = 0; } | |||
6792 | break; | |||
6793 | case 178: | |||
6794 | #line 2231 "/usr/src/sbin/pfctl/parse.y" | |||
6795 | { yyval.v.b = yyvsp[0].v.b; yyval.v.b.b1 = PF_DROP; } | |||
6796 | break; | |||
6797 | case 179: | |||
6798 | #line 2234 "/usr/src/sbin/pfctl/parse.y" | |||
6799 | { | |||
6800 | yyval.v.b.b2 = blockpolicy; | |||
6801 | yyval.v.b.w = returnicmpdefault; | |||
6802 | yyval.v.b.w2 = returnicmp6default; | |||
6803 | } | |||
6804 | break; | |||
6805 | case 180: | |||
6806 | #line 2239 "/usr/src/sbin/pfctl/parse.y" | |||
6807 | { | |||
6808 | yyval.v.b.b2 = PFRULE_DROP0x0000; | |||
6809 | yyval.v.b.w = 0; | |||
6810 | yyval.v.b.w2 = 0; | |||
6811 | } | |||
6812 | break; | |||
6813 | case 181: | |||
6814 | #line 2244 "/usr/src/sbin/pfctl/parse.y" | |||
6815 | { | |||
6816 | yyval.v.b.b2 = PFRULE_RETURNRST0x0001; | |||
6817 | yyval.v.b.w = 0; | |||
6818 | yyval.v.b.w2 = 0; | |||
6819 | } | |||
6820 | break; | |||
6821 | case 182: | |||
6822 | #line 2249 "/usr/src/sbin/pfctl/parse.y" | |||
6823 | { | |||
6824 | if (yyvsp[-1].v.number < 0 || yyvsp[-1].v.number > 255) { | |||
6825 | yyerror("illegal ttl value %lld", yyvsp[-1].v.number); | |||
6826 | YYERRORgoto yyerrlab; | |||
6827 | } | |||
6828 | yyval.v.b.b2 = PFRULE_RETURNRST0x0001; | |||
6829 | yyval.v.b.w = yyvsp[-1].v.number; | |||
6830 | yyval.v.b.w2 = 0; | |||
6831 | } | |||
6832 | break; | |||
6833 | case 183: | |||
6834 | #line 2258 "/usr/src/sbin/pfctl/parse.y" | |||
6835 | { | |||
6836 | yyval.v.b.b2 = PFRULE_RETURNICMP0x0004; | |||
6837 | yyval.v.b.w = returnicmpdefault; | |||
6838 | yyval.v.b.w2 = returnicmp6default; | |||
6839 | } | |||
6840 | break; | |||
6841 | case 184: | |||
6842 | #line 2263 "/usr/src/sbin/pfctl/parse.y" | |||
6843 | { | |||
6844 | yyval.v.b.b2 = PFRULE_RETURNICMP0x0004; | |||
6845 | yyval.v.b.w = returnicmpdefault; | |||
6846 | yyval.v.b.w2 = returnicmp6default; | |||
6847 | } | |||
6848 | break; | |||
6849 | case 185: | |||
6850 | #line 2268 "/usr/src/sbin/pfctl/parse.y" | |||
6851 | { | |||
6852 | yyval.v.b.b2 = PFRULE_RETURNICMP0x0004; | |||
6853 | yyval.v.b.w = yyvsp[-1].v.number; | |||
6854 | yyval.v.b.w2 = returnicmpdefault; | |||
6855 | } | |||
6856 | break; | |||
6857 | case 186: | |||
6858 | #line 2273 "/usr/src/sbin/pfctl/parse.y" | |||
6859 | { | |||
6860 | yyval.v.b.b2 = PFRULE_RETURNICMP0x0004; | |||
6861 | yyval.v.b.w = returnicmpdefault; | |||
6862 | yyval.v.b.w2 = yyvsp[-1].v.number; | |||
6863 | } | |||
6864 | break; | |||
6865 | case 187: | |||
6866 | #line 2278 "/usr/src/sbin/pfctl/parse.y" | |||
6867 | { | |||
6868 | yyval.v.b.b2 = PFRULE_RETURNICMP0x0004; | |||
6869 | yyval.v.b.w = yyvsp[-3].v.number; | |||
6870 | yyval.v.b.w2 = yyvsp[-1].v.number; | |||
6871 | } | |||
6872 | break; | |||
6873 | case 188: | |||
6874 | #line 2283 "/usr/src/sbin/pfctl/parse.y" | |||
6875 | { | |||
6876 | yyval.v.b.b2 = PFRULE_RETURN0x0008; | |||
6877 | yyval.v.b.w = returnicmpdefault; | |||
6878 | yyval.v.b.w2 = returnicmp6default; | |||
6879 | } | |||
6880 | break; | |||
6881 | case 189: | |||
6882 | #line 2290 "/usr/src/sbin/pfctl/parse.y" | |||
6883 | { | |||
6884 | if (!(yyval.v.number = parseicmpspec(yyvsp[0].v.string, AF_INET2))) { | |||
6885 | free(yyvsp[0].v.string); | |||
6886 | YYERRORgoto yyerrlab; | |||
6887 | } | |||
6888 | free(yyvsp[0].v.string); | |||
6889 | } | |||
6890 | break; | |||
6891 | case 190: | |||
6892 | #line 2297 "/usr/src/sbin/pfctl/parse.y" | |||
6893 | { | |||
6894 | u_int8_t icmptype; | |||
6895 | ||||
6896 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
6897 | yyerror("invalid icmp code %lld", yyvsp[0].v.number); | |||
6898 | YYERRORgoto yyerrlab; | |||
6899 | } | |||
6900 | icmptype = returnicmpdefault >> 8; | |||
6901 | yyval.v.number = (icmptype << 8 | yyvsp[0].v.number); | |||
6902 | } | |||
6903 | break; | |||
6904 | case 191: | |||
6905 | #line 2309 "/usr/src/sbin/pfctl/parse.y" | |||
6906 | { | |||
6907 | if (!(yyval.v.number = parseicmpspec(yyvsp[0].v.string, AF_INET624))) { | |||
6908 | free(yyvsp[0].v.string); | |||
6909 | YYERRORgoto yyerrlab; | |||
6910 | } | |||
6911 | free(yyvsp[0].v.string); | |||
6912 | } | |||
6913 | break; | |||
6914 | case 192: | |||
6915 | #line 2316 "/usr/src/sbin/pfctl/parse.y" | |||
6916 | { | |||
6917 | u_int8_t icmptype; | |||
6918 | ||||
6919 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
6920 | yyerror("invalid icmp code %lld", yyvsp[0].v.number); | |||
6921 | YYERRORgoto yyerrlab; | |||
6922 | } | |||
6923 | icmptype = returnicmp6default >> 8; | |||
6924 | yyval.v.number = (icmptype << 8 | yyvsp[0].v.number); | |||
6925 | } | |||
6926 | break; | |||
6927 | case 193: | |||
6928 | #line 2328 "/usr/src/sbin/pfctl/parse.y" | |||
6929 | { yyval.v.i = PF_INOUT; } | |||
6930 | break; | |||
6931 | case 194: | |||
6932 | #line 2329 "/usr/src/sbin/pfctl/parse.y" | |||
6933 | { yyval.v.i = PF_IN; } | |||
6934 | break; | |||
6935 | case 195: | |||
6936 | #line 2330 "/usr/src/sbin/pfctl/parse.y" | |||
6937 | { yyval.v.i = PF_OUT; } | |||
6938 | break; | |||
6939 | case 196: | |||
6940 | #line 2333 "/usr/src/sbin/pfctl/parse.y" | |||
6941 | { yyval.v.logquick.quick = 0; } | |||
6942 | break; | |||
6943 | case 197: | |||
6944 | #line 2334 "/usr/src/sbin/pfctl/parse.y" | |||
6945 | { yyval.v.logquick.quick = 1; } | |||
6946 | break; | |||
6947 | case 198: | |||
6948 | #line 2337 "/usr/src/sbin/pfctl/parse.y" | |||
6949 | { yyval.v.logquick.log = 0; yyval.v.logquick.quick = 0; yyval.v.logquick.logif = 0; } | |||
6950 | break; | |||
6951 | case 199: | |||
6952 | #line 2338 "/usr/src/sbin/pfctl/parse.y" | |||
6953 | { yyval.v.logquick = yyvsp[0].v.logquick; yyval.v.logquick.quick = 0; } | |||
6954 | break; | |||
6955 | case 200: | |||
6956 | #line 2339 "/usr/src/sbin/pfctl/parse.y" | |||
6957 | { yyval.v.logquick.quick = 1; yyval.v.logquick.log = 0; yyval.v.logquick.logif = 0; } | |||
6958 | break; | |||
6959 | case 201: | |||
6960 | #line 2340 "/usr/src/sbin/pfctl/parse.y" | |||
6961 | { yyval.v.logquick = yyvsp[-1].v.logquick; yyval.v.logquick.quick = 1; } | |||
6962 | break; | |||
6963 | case 202: | |||
6964 | #line 2341 "/usr/src/sbin/pfctl/parse.y" | |||
6965 | { yyval.v.logquick = yyvsp[0].v.logquick; yyval.v.logquick.quick = 1; } | |||
6966 | break; | |||
6967 | case 203: | |||
6968 | #line 2344 "/usr/src/sbin/pfctl/parse.y" | |||
6969 | { yyval.v.logquick.log = PF_LOG0x01; yyval.v.logquick.logif = 0; } | |||
6970 | break; | |||
6971 | case 204: | |||
6972 | #line 2345 "/usr/src/sbin/pfctl/parse.y" | |||
6973 | { | |||
6974 | yyval.v.logquick.log = PF_LOG0x01 | yyvsp[-1].v.logquick.log; | |||
6975 | yyval.v.logquick.logif = yyvsp[-1].v.logquick.logif; | |||
6976 | } | |||
6977 | break; | |||
6978 | case 205: | |||
6979 | #line 2351 "/usr/src/sbin/pfctl/parse.y" | |||
6980 | { yyval.v.logquick = yyvsp[0].v.logquick; } | |||
6981 | break; | |||
6982 | case 206: | |||
6983 | #line 2352 "/usr/src/sbin/pfctl/parse.y" | |||
6984 | { | |||
6985 | yyval.v.logquick.log = yyvsp[-2].v.logquick.log | yyvsp[0].v.logquick.log; | |||
6986 | yyval.v.logquick.logif = yyvsp[0].v.logquick.logif; | |||
6987 | if (yyval.v.logquick.logif == 0) | |||
6988 | yyval.v.logquick.logif = yyvsp[-2].v.logquick.logif; | |||
6989 | } | |||
6990 | break; | |||
6991 | case 207: | |||
6992 | #line 2360 "/usr/src/sbin/pfctl/parse.y" | |||
6993 | { yyval.v.logquick.log = PF_LOG_ALL0x02; yyval.v.logquick.logif = 0; } | |||
6994 | break; | |||
6995 | case 208: | |||
6996 | #line 2361 "/usr/src/sbin/pfctl/parse.y" | |||
6997 | { yyval.v.logquick.log = PF_LOG_MATCHES0x10; yyval.v.logquick.logif = 0; } | |||
6998 | break; | |||
6999 | case 209: | |||
7000 | #line 2362 "/usr/src/sbin/pfctl/parse.y" | |||
7001 | { yyval.v.logquick.log = PF_LOG_USER0x04; yyval.v.logquick.logif = 0; } | |||
7002 | break; | |||
7003 | case 210: | |||
7004 | #line 2363 "/usr/src/sbin/pfctl/parse.y" | |||
7005 | { | |||
7006 | const char *errstr; | |||
7007 | u_int i; | |||
7008 | ||||
7009 | yyval.v.logquick.log = 0; | |||
7010 | if (strncmp(yyvsp[0].v.string, "pflog", 5)) { | |||
7011 | yyerror("%s: should be a pflog interface", yyvsp[0].v.string); | |||
7012 | free(yyvsp[0].v.string); | |||
7013 | YYERRORgoto yyerrlab; | |||
7014 | } | |||
7015 | i = strtonum(yyvsp[0].v.string + 5, 0, 255, &errstr); | |||
7016 | if (errstr) { | |||
7017 | yyerror("%s: %s", yyvsp[0].v.string, errstr); | |||
7018 | free(yyvsp[0].v.string); | |||
7019 | YYERRORgoto yyerrlab; | |||
7020 | } | |||
7021 | free(yyvsp[0].v.string); | |||
7022 | yyval.v.logquick.logif = i; | |||
7023 | } | |||
7024 | break; | |||
7025 | case 211: | |||
7026 | #line 2384 "/usr/src/sbin/pfctl/parse.y" | |||
7027 | { yyval.v.interface = NULL((void *)0); } | |||
7028 | break; | |||
7029 | case 212: | |||
7030 | #line 2385 "/usr/src/sbin/pfctl/parse.y" | |||
7031 | { yyval.v.interface = yyvsp[0].v.interface; } | |||
7032 | break; | |||
7033 | case 213: | |||
7034 | #line 2386 "/usr/src/sbin/pfctl/parse.y" | |||
7035 | { yyval.v.interface = yyvsp[-1].v.interface; } | |||
7036 | break; | |||
7037 | case 214: | |||
7038 | #line 2389 "/usr/src/sbin/pfctl/parse.y" | |||
7039 | { yyval.v.interface = yyvsp[-1].v.interface; } | |||
7040 | break; | |||
7041 | case 215: | |||
7042 | #line 2390 "/usr/src/sbin/pfctl/parse.y" | |||
7043 | { | |||
7044 | yyvsp[-3].v.interface->tail->next = yyvsp[-1].v.interface; | |||
7045 | yyvsp[-3].v.interface->tail = yyvsp[-1].v.interface; | |||
7046 | yyval.v.interface = yyvsp[-3].v.interface; | |||
7047 | } | |||
7048 | break; | |||
7049 | case 216: | |||
7050 | #line 2397 "/usr/src/sbin/pfctl/parse.y" | |||
7051 | { yyval.v.interface = yyvsp[0].v.interface; yyval.v.interface->not = yyvsp[-1].v.number; } | |||
7052 | break; | |||
7053 | case 217: | |||
7054 | #line 2400 "/usr/src/sbin/pfctl/parse.y" | |||
7055 | { | |||
7056 | struct node_host *n; | |||
7057 | ||||
7058 | yyval.v.interface = calloc(1, sizeof(struct node_if)); | |||
7059 | if (yyval.v.interface == NULL((void *)0)) | |||
7060 | err(1, "if_item: calloc"); | |||
7061 | if (strlcpy(yyval.v.interface->ifname, yyvsp[0].v.string, sizeof(yyval.v.interface->ifname)) >= | |||
| ||||
7062 | sizeof(yyval.v.interface->ifname)) { | |||
7063 | free(yyvsp[0].v.string); | |||
7064 | free(yyval.v.interface); | |||
7065 | yyerror("interface name too long"); | |||
7066 | YYERRORgoto yyerrlab; | |||
7067 | } | |||
7068 | ||||
7069 | if ((n = ifa_exists(yyvsp[0].v.string)) != NULL((void *)0)) | |||
7070 | yyval.v.interface->ifa_flags = n->ifa_flags; | |||
7071 | ||||
7072 | free(yyvsp[0].v.string); | |||
7073 | yyval.v.interface->not = 0; | |||
7074 | yyval.v.interface->next = NULL((void *)0); | |||
7075 | yyval.v.interface->tail = yyval.v.interface; | |||
7076 | } | |||
7077 | break; | |||
7078 | case 218: | |||
7079 | #line 2422 "/usr/src/sbin/pfctl/parse.y" | |||
7080 | { | |||
7081 | yyval.v.interface = calloc(1, sizeof(struct node_if)); | |||
7082 | if (yyval.v.interface == NULL((void *)0)) | |||
7083 | err(1, "if_item: calloc"); | |||
7084 | strlcpy(yyval.v.interface->ifname, "any", sizeof(yyval.v.interface->ifname)); | |||
7085 | yyval.v.interface->not = 0; | |||
7086 | yyval.v.interface->next = NULL((void *)0); | |||
7087 | yyval.v.interface->tail = yyval.v.interface; | |||
7088 | } | |||
7089 | break; | |||
7090 | case 219: | |||
7091 | #line 2431 "/usr/src/sbin/pfctl/parse.y" | |||
7092 | { | |||
7093 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > RT_TABLEID_MAX255) | |||
7094 | yyerror("rdomain %lld outside range", yyvsp[0].v.number); | |||
7095 | ||||
7096 | yyval.v.interface = calloc(1, sizeof(struct node_if)); | |||
7097 | if (yyval.v.interface == NULL((void *)0)) | |||
7098 | err(1, "if_item: calloc"); | |||
7099 | yyval.v.interface->not = 0; | |||
7100 | yyval.v.interface->use_rdomain = 1; | |||
7101 | yyval.v.interface->rdomain = yyvsp[0].v.number; | |||
7102 | yyval.v.interface->next = NULL((void *)0); | |||
7103 | yyval.v.interface->tail = yyval.v.interface; | |||
7104 | } | |||
7105 | break; | |||
7106 | case 220: | |||
7107 | #line 2446 "/usr/src/sbin/pfctl/parse.y" | |||
7108 | { yyval.v.i = 0; } | |||
7109 | break; | |||
7110 | case 221: | |||
7111 | #line 2447 "/usr/src/sbin/pfctl/parse.y" | |||
7112 | { yyval.v.i = AF_INET2; } | |||
7113 | break; | |||
7114 | case 222: | |||
7115 | #line 2448 "/usr/src/sbin/pfctl/parse.y" | |||
7116 | { yyval.v.i = AF_INET624; } | |||
7117 | break; | |||
7118 | case 223: | |||
7119 | #line 2451 "/usr/src/sbin/pfctl/parse.y" | |||
7120 | { yyval.v.proto = NULL((void *)0); } | |||
7121 | break; | |||
7122 | case 224: | |||
7123 | #line 2452 "/usr/src/sbin/pfctl/parse.y" | |||
7124 | { yyval.v.proto = yyvsp[0].v.proto; } | |||
7125 | break; | |||
7126 | case 225: | |||
7127 | #line 2453 "/usr/src/sbin/pfctl/parse.y" | |||
7128 | { yyval.v.proto = yyvsp[-1].v.proto; } | |||
7129 | break; | |||
7130 | case 226: | |||
7131 | #line 2456 "/usr/src/sbin/pfctl/parse.y" | |||
7132 | { yyval.v.proto = yyvsp[-1].v.proto; } | |||
7133 | break; | |||
7134 | case 227: | |||
7135 | #line 2457 "/usr/src/sbin/pfctl/parse.y" | |||
7136 | { | |||
7137 | yyvsp[-3].v.proto->tail->next = yyvsp[-1].v.proto; | |||
7138 | yyvsp[-3].v.proto->tail = yyvsp[-1].v.proto; | |||
7139 | yyval.v.proto = yyvsp[-3].v.proto; | |||
7140 | } | |||
7141 | break; | |||
7142 | case 228: | |||
7143 | #line 2464 "/usr/src/sbin/pfctl/parse.y" | |||
7144 | { | |||
7145 | u_int8_t pr; | |||
7146 | ||||
7147 | pr = (u_int8_t)yyvsp[0].v.number; | |||
7148 | if (pr == 0) { | |||
7149 | yyerror("proto 0 cannot be used"); | |||
7150 | YYERRORgoto yyerrlab; | |||
7151 | } | |||
7152 | yyval.v.proto = calloc(1, sizeof(struct node_proto)); | |||
7153 | if (yyval.v.proto == NULL((void *)0)) | |||
7154 | err(1, "proto_item: calloc"); | |||
7155 | yyval.v.proto->proto = pr; | |||
7156 | yyval.v.proto->next = NULL((void *)0); | |||
7157 | yyval.v.proto->tail = yyval.v.proto; | |||
7158 | } | |||
7159 | break; | |||
7160 | case 229: | |||
7161 | #line 2481 "/usr/src/sbin/pfctl/parse.y" | |||
7162 | { | |||
7163 | struct protoent *p; | |||
7164 | ||||
7165 | p = getprotobyname(yyvsp[0].v.string); | |||
7166 | if (p == NULL((void *)0)) { | |||
7167 | yyerror("unknown protocol %s", yyvsp[0].v.string); | |||
7168 | free(yyvsp[0].v.string); | |||
7169 | YYERRORgoto yyerrlab; | |||
7170 | } | |||
7171 | yyval.v.number = p->p_proto; | |||
7172 | free(yyvsp[0].v.string); | |||
7173 | } | |||
7174 | break; | |||
7175 | case 230: | |||
7176 | #line 2493 "/usr/src/sbin/pfctl/parse.y" | |||
7177 | { | |||
7178 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
7179 | yyerror("protocol outside range"); | |||
7180 | YYERRORgoto yyerrlab; | |||
7181 | } | |||
7182 | } | |||
7183 | break; | |||
7184 | case 231: | |||
7185 | #line 2501 "/usr/src/sbin/pfctl/parse.y" | |||
7186 | { | |||
7187 | yyval.v.fromto.src.host = NULL((void *)0); | |||
7188 | yyval.v.fromto.src.port = NULL((void *)0); | |||
7189 | yyval.v.fromto.dst.host = NULL((void *)0); | |||
7190 | yyval.v.fromto.dst.port = NULL((void *)0); | |||
7191 | yyval.v.fromto.src_os = NULL((void *)0); | |||
7192 | } | |||
7193 | break; | |||
7194 | case 232: | |||
7195 | #line 2508 "/usr/src/sbin/pfctl/parse.y" | |||
7196 | { | |||
7197 | yyval.v.fromto.src = yyvsp[-2].v.peer; | |||
7198 | yyval.v.fromto.src_os = yyvsp[-1].v.os; | |||
7199 | yyval.v.fromto.dst = yyvsp[0].v.peer; | |||
7200 | } | |||
7201 | break; | |||
7202 | case 233: | |||
7203 | #line 2515 "/usr/src/sbin/pfctl/parse.y" | |||
7204 | { yyval.v.os = NULL((void *)0); } | |||
7205 | break; | |||
7206 | case 234: | |||
7207 | #line 2516 "/usr/src/sbin/pfctl/parse.y" | |||
7208 | { yyval.v.os = yyvsp[0].v.os; } | |||
7209 | break; | |||
7210 | case 235: | |||
7211 | #line 2517 "/usr/src/sbin/pfctl/parse.y" | |||
7212 | { yyval.v.os = yyvsp[-1].v.os; } | |||
7213 | break; | |||
7214 | case 236: | |||
7215 | #line 2520 "/usr/src/sbin/pfctl/parse.y" | |||
7216 | { | |||
7217 | yyval.v.os = calloc(1, sizeof(struct node_os)); | |||
7218 | if (yyval.v.os == NULL((void *)0)) | |||
7219 | err(1, "os: calloc"); | |||
7220 | yyval.v.os->os = yyvsp[0].v.string; | |||
7221 | yyval.v.os->tail = yyval.v.os; | |||
7222 | } | |||
7223 | break; | |||
7224 | case 237: | |||
7225 | #line 2529 "/usr/src/sbin/pfctl/parse.y" | |||
7226 | { yyval.v.os = yyvsp[-1].v.os; } | |||
7227 | break; | |||
7228 | case 238: | |||
7229 | #line 2530 "/usr/src/sbin/pfctl/parse.y" | |||
7230 | { | |||
7231 | yyvsp[-3].v.os->tail->next = yyvsp[-1].v.os; | |||
7232 | yyvsp[-3].v.os->tail = yyvsp[-1].v.os; | |||
7233 | yyval.v.os = yyvsp[-3].v.os; | |||
7234 | } | |||
7235 | break; | |||
7236 | case 239: | |||
7237 | #line 2537 "/usr/src/sbin/pfctl/parse.y" | |||
7238 | { | |||
7239 | yyval.v.peer.host = NULL((void *)0); | |||
7240 | yyval.v.peer.port = NULL((void *)0); | |||
7241 | } | |||
7242 | break; | |||
7243 | case 240: | |||
7244 | #line 2541 "/usr/src/sbin/pfctl/parse.y" | |||
7245 | { | |||
7246 | yyval.v.peer = yyvsp[0].v.peer; | |||
7247 | } | |||
7248 | break; | |||
7249 | case 241: | |||
7250 | #line 2546 "/usr/src/sbin/pfctl/parse.y" | |||
7251 | { | |||
7252 | yyval.v.peer.host = NULL((void *)0); | |||
7253 | yyval.v.peer.port = NULL((void *)0); | |||
7254 | } | |||
7255 | break; | |||
7256 | case 242: | |||
7257 | #line 2550 "/usr/src/sbin/pfctl/parse.y" | |||
7258 | { | |||
7259 | if (disallow_urpf_failed(yyvsp[0].v.peer.host, "\"urpf-failed\" is " | |||
7260 | "not permitted in a destination address")) | |||
7261 | YYERRORgoto yyerrlab; | |||
7262 | yyval.v.peer = yyvsp[0].v.peer; | |||
7263 | } | |||
7264 | break; | |||
7265 | case 243: | |||
7266 | #line 2558 "/usr/src/sbin/pfctl/parse.y" | |||
7267 | { | |||
7268 | yyval.v.peer.host = yyvsp[0].v.host; | |||
7269 | yyval.v.peer.port = NULL((void *)0); | |||
7270 | } | |||
7271 | break; | |||
7272 | case 244: | |||
7273 | #line 2562 "/usr/src/sbin/pfctl/parse.y" | |||
7274 | { | |||
7275 | yyval.v.peer.host = yyvsp[-2].v.host; | |||
7276 | yyval.v.peer.port = yyvsp[0].v.port; | |||
7277 | } | |||
7278 | break; | |||
7279 | case 245: | |||
7280 | #line 2566 "/usr/src/sbin/pfctl/parse.y" | |||
7281 | { | |||
7282 | yyval.v.peer.host = NULL((void *)0); | |||
7283 | yyval.v.peer.port = yyvsp[0].v.port; | |||
7284 | } | |||
7285 | break; | |||
7286 | case 248: | |||
7287 | #line 2576 "/usr/src/sbin/pfctl/parse.y" | |||
7288 | { yyval.v.host = NULL((void *)0); } | |||
7289 | break; | |||
7290 | case 249: | |||
7291 | #line 2577 "/usr/src/sbin/pfctl/parse.y" | |||
7292 | { yyval.v.host = yyvsp[0].v.host; } | |||
7293 | break; | |||
7294 | case 250: | |||
7295 | #line 2578 "/usr/src/sbin/pfctl/parse.y" | |||
7296 | { yyval.v.host = yyvsp[-1].v.host; } | |||
7297 | break; | |||
7298 | case 251: | |||
7299 | #line 2582 "/usr/src/sbin/pfctl/parse.y" | |||
7300 | { yyval.v.host = yyvsp[-1].v.host; } | |||
7301 | break; | |||
7302 | case 252: | |||
7303 | #line 2583 "/usr/src/sbin/pfctl/parse.y" | |||
7304 | { | |||
7305 | if (yyvsp[-3].v.host == NULL((void *)0)) { | |||
7306 | freehostlist(yyvsp[-1].v.host); | |||
7307 | yyval.v.host = yyvsp[-3].v.host; | |||
7308 | } else if (yyvsp[-1].v.host == NULL((void *)0)) { | |||
7309 | freehostlist(yyvsp[-3].v.host); | |||
7310 | yyval.v.host = yyvsp[-1].v.host; | |||
7311 | } else { | |||
7312 | yyvsp[-3].v.host->tail->next = yyvsp[-1].v.host; | |||
7313 | yyvsp[-3].v.host->tail = yyvsp[-1].v.host->tail; | |||
7314 | yyval.v.host = yyvsp[-3].v.host; | |||
7315 | } | |||
7316 | } | |||
7317 | break; | |||
7318 | case 253: | |||
7319 | #line 2598 "/usr/src/sbin/pfctl/parse.y" | |||
7320 | { | |||
7321 | struct node_host *n; | |||
7322 | ||||
7323 | for (n = yyvsp[0].v.host; n != NULL((void *)0); n = n->next) | |||
7324 | n->not = yyvsp[-1].v.number; | |||
7325 | yyval.v.host = yyvsp[0].v.host; | |||
7326 | } | |||
7327 | break; | |||
7328 | case 254: | |||
7329 | #line 2605 "/usr/src/sbin/pfctl/parse.y" | |||
7330 | { | |||
7331 | yyval.v.host = calloc(1, sizeof(struct node_host)); | |||
7332 | if (yyval.v.host == NULL((void *)0)) | |||
7333 | err(1, "xhost: calloc"); | |||
7334 | yyval.v.host->addr.type = PF_ADDR_NOROUTE; | |||
7335 | yyval.v.host->next = NULL((void *)0); | |||
7336 | yyval.v.host->not = yyvsp[-1].v.number; | |||
7337 | yyval.v.host->tail = yyval.v.host; | |||
7338 | } | |||
7339 | break; | |||
7340 | case 255: | |||
7341 | #line 2614 "/usr/src/sbin/pfctl/parse.y" | |||
7342 | { | |||
7343 | yyval.v.host = calloc(1, sizeof(struct node_host)); | |||
7344 | if (yyval.v.host == NULL((void *)0)) | |||
7345 | err(1, "xhost: calloc"); | |||
7346 | yyval.v.host->addr.type = PF_ADDR_URPFFAILED; | |||
7347 | yyval.v.host->next = NULL((void *)0); | |||
7348 | yyval.v.host->not = yyvsp[-1].v.number; | |||
7349 | yyval.v.host->tail = yyval.v.host; | |||
7350 | } | |||
7351 | break; | |||
7352 | case 256: | |||
7353 | #line 2625 "/usr/src/sbin/pfctl/parse.y" | |||
7354 | { | |||
7355 | if (yyvsp[0].v.number < 1 || yyvsp[0].v.number > USHRT_MAX0xffff) { | |||
7356 | yyerror("weight out of range"); | |||
7357 | YYERRORgoto yyerrlab; | |||
7358 | } | |||
7359 | yyval.v.weight = yyvsp[0].v.number; | |||
7360 | } | |||
7361 | break; | |||
7362 | case 257: | |||
7363 | #line 2632 "/usr/src/sbin/pfctl/parse.y" | |||
7364 | { yyval.v.weight = 0; } | |||
7365 | break; | |||
7366 | case 258: | |||
7367 | #line 2635 "/usr/src/sbin/pfctl/parse.y" | |||
7368 | { | |||
7369 | if ((yyval.v.host = host(yyvsp[0].v.string, pf->opts)) == NULL((void *)0)) { | |||
7370 | /* error. "any" is handled elsewhere */ | |||
7371 | free(yyvsp[0].v.string); | |||
7372 | yyerror("could not parse host specification"); | |||
7373 | YYERRORgoto yyerrlab; | |||
7374 | } | |||
7375 | free(yyvsp[0].v.string); | |||
7376 | ||||
7377 | } | |||
7378 | break; | |||
7379 | case 259: | |||
7380 | #line 2645 "/usr/src/sbin/pfctl/parse.y" | |||
7381 | { | |||
7382 | struct node_host *b, *e; | |||
7383 | ||||
7384 | if ((b = host(yyvsp[-2].v.string, pf->opts)) == NULL((void *)0) || | |||
7385 | (e = host(yyvsp[0].v.string, pf->opts)) == NULL((void *)0)) { | |||
7386 | free(yyvsp[-2].v.string); | |||
7387 | free(yyvsp[0].v.string); | |||
7388 | yyerror("could not parse host specification"); | |||
7389 | YYERRORgoto yyerrlab; | |||
7390 | } | |||
7391 | if (b->af != e->af || | |||
7392 | b->addr.type != PF_ADDR_ADDRMASK || | |||
7393 | e->addr.type != PF_ADDR_ADDRMASK || | |||
7394 | unmask(&b->addr.v.a.mask) != | |||
7395 | (b->af == AF_INET2 ? 32 : 128) || | |||
7396 | unmask(&e->addr.v.a.mask) != | |||
7397 | (e->af == AF_INET2 ? 32 : 128) || | |||
7398 | b->next != NULL((void *)0) || b->not || | |||
7399 | e->next != NULL((void *)0) || e->not) { | |||
7400 | free(b); | |||
7401 | free(e); | |||
7402 | free(yyvsp[-2].v.string); | |||
7403 | free(yyvsp[0].v.string); | |||
7404 | yyerror("invalid address range"); | |||
7405 | YYERRORgoto yyerrlab; | |||
7406 | } | |||
7407 | memcpy(&b->addr.v.a.mask, &e->addr.v.a.addr, | |||
7408 | sizeof(b->addr.v.a.mask)); | |||
7409 | b->addr.type = PF_ADDR_RANGE; | |||
7410 | yyval.v.host = b; | |||
7411 | free(e); | |||
7412 | free(yyvsp[-2].v.string); | |||
7413 | free(yyvsp[0].v.string); | |||
7414 | } | |||
7415 | break; | |||
7416 | case 260: | |||
7417 | #line 2679 "/usr/src/sbin/pfctl/parse.y" | |||
7418 | { | |||
7419 | char *buf; | |||
7420 | ||||
7421 | if (asprintf(&buf, "%s/%lld", yyvsp[-2].v.string, yyvsp[0].v.number) == -1) | |||
7422 | err(1, "host: asprintf"); | |||
7423 | free(yyvsp[-2].v.string); | |||
7424 | if ((yyval.v.host = host(buf, pf->opts)) == NULL((void *)0)) { | |||
7425 | /* error. "any" is handled elsewhere */ | |||
7426 | free(buf); | |||
7427 | yyerror("could not parse host specification"); | |||
7428 | YYERRORgoto yyerrlab; | |||
7429 | } | |||
7430 | free(buf); | |||
7431 | } | |||
7432 | break; | |||
7433 | case 261: | |||
7434 | #line 2693 "/usr/src/sbin/pfctl/parse.y" | |||
7435 | { | |||
7436 | char *buf; | |||
7437 | ||||
7438 | /* ie. for 10/8 parsing */ | |||
7439 | if (asprintf(&buf, "%lld/%lld", yyvsp[-2].v.number, yyvsp[0].v.number) == -1) | |||
7440 | err(1, "host: asprintf"); | |||
7441 | if ((yyval.v.host = host(buf, pf->opts)) == NULL((void *)0)) { | |||
7442 | /* error. "any" is handled elsewhere */ | |||
7443 | free(buf); | |||
7444 | yyerror("could not parse host specification"); | |||
7445 | YYERRORgoto yyerrlab; | |||
7446 | } | |||
7447 | free(buf); | |||
7448 | } | |||
7449 | break; | |||
7450 | case 263: | |||
7451 | #line 2708 "/usr/src/sbin/pfctl/parse.y" | |||
7452 | { | |||
7453 | struct node_host *n; | |||
7454 | ||||
7455 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 128) { | |||
7456 | yyerror("bit number too big"); | |||
7457 | YYERRORgoto yyerrlab; | |||
7458 | } | |||
7459 | yyval.v.host = yyvsp[-2].v.host; | |||
7460 | for (n = yyvsp[-2].v.host; n != NULL((void *)0); n = n->next) | |||
7461 | set_ipmask(n, yyvsp[0].v.number); | |||
7462 | } | |||
7463 | break; | |||
7464 | case 264: | |||
7465 | #line 2719 "/usr/src/sbin/pfctl/parse.y" | |||
7466 | { | |||
7467 | if (strlen(yyvsp[-1].v.string) >= PF_TABLE_NAME_SIZE32) { | |||
7468 | yyerror("table name '%s' too long", yyvsp[-1].v.string); | |||
7469 | free(yyvsp[-1].v.string); | |||
7470 | YYERRORgoto yyerrlab; | |||
7471 | } | |||
7472 | yyval.v.host = calloc(1, sizeof(struct node_host)); | |||
7473 | if (yyval.v.host == NULL((void *)0)) | |||
7474 | err(1, "host: calloc"); | |||
7475 | yyval.v.host->addr.type = PF_ADDR_TABLE; | |||
7476 | if (strlcpy(yyval.v.host->addr.v.tblname, yyvsp[-1].v.string, | |||
7477 | sizeof(yyval.v.host->addr.v.tblname)) >= | |||
7478 | sizeof(yyval.v.host->addr.v.tblname)) | |||
7479 | errx(1, "host: strlcpy"); | |||
7480 | free(yyvsp[-1].v.string); | |||
7481 | yyval.v.host->next = NULL((void *)0); | |||
7482 | yyval.v.host->tail = yyval.v.host; | |||
7483 | } | |||
7484 | break; | |||
7485 | case 265: | |||
7486 | #line 2737 "/usr/src/sbin/pfctl/parse.y" | |||
7487 | { | |||
7488 | yyval.v.host = calloc(1, sizeof(struct node_host)); | |||
7489 | if (yyval.v.host == NULL((void *)0)) { | |||
7490 | free(yyvsp[0].v.string); | |||
7491 | err(1, "host: calloc"); | |||
7492 | } | |||
7493 | yyval.v.host->addr.type = PF_ADDR_RTLABEL; | |||
7494 | if (strlcpy(yyval.v.host->addr.v.rtlabelname, yyvsp[0].v.string, | |||
7495 | sizeof(yyval.v.host->addr.v.rtlabelname)) >= | |||
7496 | sizeof(yyval.v.host->addr.v.rtlabelname)) { | |||
7497 | yyerror("route label too long, max %zu chars", | |||
7498 | sizeof(yyval.v.host->addr.v.rtlabelname) - 1); | |||
7499 | free(yyvsp[0].v.string); | |||
7500 | free(yyval.v.host); | |||
7501 | YYERRORgoto yyerrlab; | |||
7502 | } | |||
7503 | yyval.v.host->next = NULL((void *)0); | |||
7504 | yyval.v.host->tail = yyval.v.host; | |||
7505 | free(yyvsp[0].v.string); | |||
7506 | } | |||
7507 | break; | |||
7508 | case 267: | |||
7509 | #line 2760 "/usr/src/sbin/pfctl/parse.y" | |||
7510 | { | |||
7511 | u_long ulval; | |||
7512 | ||||
7513 | if (atoul(yyvsp[0].v.string, &ulval) == -1) { | |||
7514 | yyerror("%s is not a number", yyvsp[0].v.string); | |||
7515 | free(yyvsp[0].v.string); | |||
7516 | YYERRORgoto yyerrlab; | |||
7517 | } else | |||
7518 | yyval.v.number = ulval; | |||
7519 | free(yyvsp[0].v.string); | |||
7520 | } | |||
7521 | break; | |||
7522 | case 268: | |||
7523 | #line 2773 "/usr/src/sbin/pfctl/parse.y" | |||
7524 | { | |||
7525 | int flags = 0; | |||
7526 | char *p, *op; | |||
7527 | ||||
7528 | op = yyvsp[-1].v.string; | |||
7529 | if (!isalpha((unsigned char)op[0])) { | |||
7530 | yyerror("invalid interface name '%s'", op); | |||
7531 | free(op); | |||
7532 | YYERRORgoto yyerrlab; | |||
7533 | } | |||
7534 | while ((p = strrchr(yyvsp[-1].v.string, ':')) != NULL((void *)0)) { | |||
7535 | if (!strcmp(p+1, "network")) | |||
7536 | flags |= PFI_AFLAG_NETWORK0x01; | |||
7537 | else if (!strcmp(p+1, "broadcast")) | |||
7538 | flags |= PFI_AFLAG_BROADCAST0x02; | |||
7539 | else if (!strcmp(p+1, "peer")) | |||
7540 | flags |= PFI_AFLAG_PEER0x04; | |||
7541 | else if (!strcmp(p+1, "0")) | |||
7542 | flags |= PFI_AFLAG_NOALIAS0x08; | |||
7543 | else { | |||
7544 | yyerror("interface %s has bad modifier", | |||
7545 | yyvsp[-1].v.string); | |||
7546 | free(op); | |||
7547 | YYERRORgoto yyerrlab; | |||
7548 | } | |||
7549 | *p = '\0'; | |||
7550 | } | |||
7551 | if (flags & (flags - 1) & PFI_AFLAG_MODEMASK0x07) { | |||
7552 | free(op); | |||
7553 | yyerror("illegal combination of " | |||
7554 | "interface modifiers"); | |||
7555 | YYERRORgoto yyerrlab; | |||
7556 | } | |||
7557 | yyval.v.host = calloc(1, sizeof(struct node_host)); | |||
7558 | if (yyval.v.host == NULL((void *)0)) | |||
7559 | err(1, "address: calloc"); | |||
7560 | yyval.v.host->af = 0; | |||
7561 | set_ipmask(yyval.v.host, 128); | |||
7562 | yyval.v.host->addr.type = PF_ADDR_DYNIFTL; | |||
7563 | yyval.v.host->addr.iflags = flags; | |||
7564 | if (strlcpy(yyval.v.host->addr.v.ifname, yyvsp[-1].v.string, | |||
7565 | sizeof(yyval.v.host->addr.v.ifname)) >= | |||
7566 | sizeof(yyval.v.host->addr.v.ifname)) { | |||
7567 | free(op); | |||
7568 | free(yyval.v.host); | |||
7569 | yyerror("interface name too long"); | |||
7570 | YYERRORgoto yyerrlab; | |||
7571 | } | |||
7572 | free(op); | |||
7573 | yyval.v.host->next = NULL((void *)0); | |||
7574 | yyval.v.host->tail = yyval.v.host; | |||
7575 | } | |||
7576 | break; | |||
7577 | case 269: | |||
7578 | #line 2827 "/usr/src/sbin/pfctl/parse.y" | |||
7579 | { yyval.v.port = yyvsp[0].v.port; } | |||
7580 | break; | |||
7581 | case 270: | |||
7582 | #line 2828 "/usr/src/sbin/pfctl/parse.y" | |||
7583 | { yyval.v.port = yyvsp[-1].v.port; } | |||
7584 | break; | |||
7585 | case 271: | |||
7586 | #line 2831 "/usr/src/sbin/pfctl/parse.y" | |||
7587 | { yyval.v.port = yyvsp[-1].v.port; } | |||
7588 | break; | |||
7589 | case 272: | |||
7590 | #line 2832 "/usr/src/sbin/pfctl/parse.y" | |||
7591 | { | |||
7592 | yyvsp[-3].v.port->tail->next = yyvsp[-1].v.port; | |||
7593 | yyvsp[-3].v.port->tail = yyvsp[-1].v.port; | |||
7594 | yyval.v.port = yyvsp[-3].v.port; | |||
7595 | } | |||
7596 | break; | |||
7597 | case 273: | |||
7598 | #line 2839 "/usr/src/sbin/pfctl/parse.y" | |||
7599 | { | |||
7600 | yyval.v.port = calloc(1, sizeof(struct node_port)); | |||
7601 | if (yyval.v.port == NULL((void *)0)) | |||
7602 | err(1, "port_item: calloc"); | |||
7603 | yyval.v.port->port[0] = yyvsp[0].v.range.a; | |||
7604 | yyval.v.port->port[1] = yyvsp[0].v.range.b; | |||
7605 | if (yyvsp[0].v.range.t) { | |||
7606 | yyval.v.port->op = PF_OP_RRG; | |||
7607 | ||||
7608 | if (validate_range(yyval.v.port->op, yyval.v.port->port[0], | |||
7609 | yyval.v.port->port[1])) { | |||
7610 | yyerror("invalid port range"); | |||
7611 | YYERRORgoto yyerrlab; | |||
7612 | } | |||
7613 | } else | |||
7614 | yyval.v.port->op = PF_OP_EQ; | |||
7615 | yyval.v.port->next = NULL((void *)0); | |||
7616 | yyval.v.port->tail = yyval.v.port; | |||
7617 | } | |||
7618 | break; | |||
7619 | case 274: | |||
7620 | #line 2858 "/usr/src/sbin/pfctl/parse.y" | |||
7621 | { | |||
7622 | if (yyvsp[0].v.range.t) { | |||
7623 | yyerror("':' cannot be used with an other " | |||
7624 | "port operator"); | |||
7625 | YYERRORgoto yyerrlab; | |||
7626 | } | |||
7627 | yyval.v.port = calloc(1, sizeof(struct node_port)); | |||
7628 | if (yyval.v.port == NULL((void *)0)) | |||
7629 | err(1, "port_item: calloc"); | |||
7630 | yyval.v.port->port[0] = yyvsp[0].v.range.a; | |||
7631 | yyval.v.port->port[1] = yyvsp[0].v.range.b; | |||
7632 | yyval.v.port->op = yyvsp[-1].v.i; | |||
7633 | yyval.v.port->next = NULL((void *)0); | |||
7634 | yyval.v.port->tail = yyval.v.port; | |||
7635 | } | |||
7636 | break; | |||
7637 | case 275: | |||
7638 | #line 2873 "/usr/src/sbin/pfctl/parse.y" | |||
7639 | { | |||
7640 | if (yyvsp[-2].v.range.t || yyvsp[0].v.range.t) { | |||
7641 | yyerror("':' cannot be used with an other " | |||
7642 | "port operator"); | |||
7643 | YYERRORgoto yyerrlab; | |||
7644 | } | |||
7645 | yyval.v.port = calloc(1, sizeof(struct node_port)); | |||
7646 | if (yyval.v.port == NULL((void *)0)) | |||
7647 | err(1, "port_item: calloc"); | |||
7648 | yyval.v.port->port[0] = yyvsp[-2].v.range.a; | |||
7649 | yyval.v.port->port[1] = yyvsp[0].v.range.a; | |||
7650 | yyval.v.port->op = yyvsp[-1].v.i; | |||
7651 | if (validate_range(yyval.v.port->op, yyval.v.port->port[0], yyval.v.port->port[1])) { | |||
7652 | yyerror("invalid port range"); | |||
7653 | YYERRORgoto yyerrlab; | |||
7654 | } | |||
7655 | yyval.v.port->next = NULL((void *)0); | |||
7656 | yyval.v.port->tail = yyval.v.port; | |||
7657 | } | |||
7658 | break; | |||
7659 | case 276: | |||
7660 | #line 2894 "/usr/src/sbin/pfctl/parse.y" | |||
7661 | { | |||
7662 | if (parseport(yyvsp[0].v.string, &yyval.v.range, 0) == -1) { | |||
7663 | free(yyvsp[0].v.string); | |||
7664 | YYERRORgoto yyerrlab; | |||
7665 | } | |||
7666 | free(yyvsp[0].v.string); | |||
7667 | } | |||
7668 | break; | |||
7669 | case 277: | |||
7670 | #line 2903 "/usr/src/sbin/pfctl/parse.y" | |||
7671 | { | |||
7672 | if (parseport(yyvsp[0].v.string, &yyval.v.range, PPORT_RANGE1) == -1) { | |||
7673 | free(yyvsp[0].v.string); | |||
7674 | YYERRORgoto yyerrlab; | |||
7675 | } | |||
7676 | free(yyvsp[0].v.string); | |||
7677 | } | |||
7678 | break; | |||
7679 | case 278: | |||
7680 | #line 2912 "/usr/src/sbin/pfctl/parse.y" | |||
7681 | { yyval.v.uid = yyvsp[0].v.uid; } | |||
7682 | break; | |||
7683 | case 279: | |||
7684 | #line 2913 "/usr/src/sbin/pfctl/parse.y" | |||
7685 | { yyval.v.uid = yyvsp[-1].v.uid; } | |||
7686 | break; | |||
7687 | case 280: | |||
7688 | #line 2916 "/usr/src/sbin/pfctl/parse.y" | |||
7689 | { yyval.v.uid = yyvsp[-1].v.uid; } | |||
7690 | break; | |||
7691 | case 281: | |||
7692 | #line 2917 "/usr/src/sbin/pfctl/parse.y" | |||
7693 | { | |||
7694 | yyvsp[-3].v.uid->tail->next = yyvsp[-1].v.uid; | |||
7695 | yyvsp[-3].v.uid->tail = yyvsp[-1].v.uid; | |||
7696 | yyval.v.uid = yyvsp[-3].v.uid; | |||
7697 | } | |||
7698 | break; | |||
7699 | case 282: | |||
7700 | #line 2924 "/usr/src/sbin/pfctl/parse.y" | |||
7701 | { | |||
7702 | yyval.v.uid = calloc(1, sizeof(struct node_uid)); | |||
7703 | if (yyval.v.uid == NULL((void *)0)) | |||
7704 | err(1, "uid_item: calloc"); | |||
7705 | yyval.v.uid->uid[0] = yyvsp[0].v.number; | |||
7706 | yyval.v.uid->uid[1] = yyvsp[0].v.number; | |||
7707 | yyval.v.uid->op = PF_OP_EQ; | |||
7708 | yyval.v.uid->next = NULL((void *)0); | |||
7709 | yyval.v.uid->tail = yyval.v.uid; | |||
7710 | } | |||
7711 | break; | |||
7712 | case 283: | |||
7713 | #line 2934 "/usr/src/sbin/pfctl/parse.y" | |||
7714 | { | |||
7715 | if (yyvsp[0].v.number == -1 && yyvsp[-1].v.i != PF_OP_EQ && yyvsp[-1].v.i != PF_OP_NE) { | |||
7716 | yyerror("user unknown requires operator = or " | |||
7717 | "!="); | |||
7718 | YYERRORgoto yyerrlab; | |||
7719 | } | |||
7720 | yyval.v.uid = calloc(1, sizeof(struct node_uid)); | |||
7721 | if (yyval.v.uid == NULL((void *)0)) | |||
7722 | err(1, "uid_item: calloc"); | |||
7723 | yyval.v.uid->uid[0] = yyvsp[0].v.number; | |||
7724 | yyval.v.uid->uid[1] = yyvsp[0].v.number; | |||
7725 | yyval.v.uid->op = yyvsp[-1].v.i; | |||
7726 | yyval.v.uid->next = NULL((void *)0); | |||
7727 | yyval.v.uid->tail = yyval.v.uid; | |||
7728 | } | |||
7729 | break; | |||
7730 | case 284: | |||
7731 | #line 2949 "/usr/src/sbin/pfctl/parse.y" | |||
7732 | { | |||
7733 | if (yyvsp[-2].v.number == -1 || yyvsp[0].v.number == -1) { | |||
7734 | yyerror("user unknown requires operator = or " | |||
7735 | "!="); | |||
7736 | YYERRORgoto yyerrlab; | |||
7737 | } | |||
7738 | yyval.v.uid = calloc(1, sizeof(struct node_uid)); | |||
7739 | if (yyval.v.uid == NULL((void *)0)) | |||
7740 | err(1, "uid_item: calloc"); | |||
7741 | yyval.v.uid->uid[0] = yyvsp[-2].v.number; | |||
7742 | yyval.v.uid->uid[1] = yyvsp[0].v.number; | |||
7743 | yyval.v.uid->op = yyvsp[-1].v.i; | |||
7744 | yyval.v.uid->next = NULL((void *)0); | |||
7745 | yyval.v.uid->tail = yyval.v.uid; | |||
7746 | } | |||
7747 | break; | |||
7748 | case 285: | |||
7749 | #line 2966 "/usr/src/sbin/pfctl/parse.y" | |||
7750 | { | |||
7751 | if (!strcmp(yyvsp[0].v.string, "unknown")) | |||
7752 | yyval.v.number = -1; | |||
7753 | else { | |||
7754 | uid_t uid; | |||
7755 | ||||
7756 | if (uid_from_user(yyvsp[0].v.string, &uid) == -1) { | |||
7757 | yyerror("unknown user %s", yyvsp[0].v.string); | |||
7758 | free(yyvsp[0].v.string); | |||
7759 | YYERRORgoto yyerrlab; | |||
7760 | } | |||
7761 | yyval.v.number = uid; | |||
7762 | } | |||
7763 | free(yyvsp[0].v.string); | |||
7764 | } | |||
7765 | break; | |||
7766 | case 286: | |||
7767 | #line 2981 "/usr/src/sbin/pfctl/parse.y" | |||
7768 | { | |||
7769 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number >= UID_MAX0xffffffffU) { | |||
7770 | yyerror("illegal uid value %lld", yyvsp[0].v.number); | |||
7771 | YYERRORgoto yyerrlab; | |||
7772 | } | |||
7773 | yyval.v.number = yyvsp[0].v.number; | |||
7774 | } | |||
7775 | break; | |||
7776 | case 287: | |||
7777 | #line 2990 "/usr/src/sbin/pfctl/parse.y" | |||
7778 | { yyval.v.gid = yyvsp[0].v.gid; } | |||
7779 | break; | |||
7780 | case 288: | |||
7781 | #line 2991 "/usr/src/sbin/pfctl/parse.y" | |||
7782 | { yyval.v.gid = yyvsp[-1].v.gid; } | |||
7783 | break; | |||
7784 | case 289: | |||
7785 | #line 2994 "/usr/src/sbin/pfctl/parse.y" | |||
7786 | { yyval.v.gid = yyvsp[-1].v.gid; } | |||
7787 | break; | |||
7788 | case 290: | |||
7789 | #line 2995 "/usr/src/sbin/pfctl/parse.y" | |||
7790 | { | |||
7791 | yyvsp[-3].v.gid->tail->next = yyvsp[-1].v.gid; | |||
7792 | yyvsp[-3].v.gid->tail = yyvsp[-1].v.gid; | |||
7793 | yyval.v.gid = yyvsp[-3].v.gid; | |||
7794 | } | |||
7795 | break; | |||
7796 | case 291: | |||
7797 | #line 3002 "/usr/src/sbin/pfctl/parse.y" | |||
7798 | { | |||
7799 | yyval.v.gid = calloc(1, sizeof(struct node_gid)); | |||
7800 | if (yyval.v.gid == NULL((void *)0)) | |||
7801 | err(1, "gid_item: calloc"); | |||
7802 | yyval.v.gid->gid[0] = yyvsp[0].v.number; | |||
7803 | yyval.v.gid->gid[1] = yyvsp[0].v.number; | |||
7804 | yyval.v.gid->op = PF_OP_EQ; | |||
7805 | yyval.v.gid->next = NULL((void *)0); | |||
7806 | yyval.v.gid->tail = yyval.v.gid; | |||
7807 | } | |||
7808 | break; | |||
7809 | case 292: | |||
7810 | #line 3012 "/usr/src/sbin/pfctl/parse.y" | |||
7811 | { | |||
7812 | if (yyvsp[0].v.number == -1 && yyvsp[-1].v.i != PF_OP_EQ && yyvsp[-1].v.i != PF_OP_NE) { | |||
7813 | yyerror("group unknown requires operator = or " | |||
7814 | "!="); | |||
7815 | YYERRORgoto yyerrlab; | |||
7816 | } | |||
7817 | yyval.v.gid = calloc(1, sizeof(struct node_gid)); | |||
7818 | if (yyval.v.gid == NULL((void *)0)) | |||
7819 | err(1, "gid_item: calloc"); | |||
7820 | yyval.v.gid->gid[0] = yyvsp[0].v.number; | |||
7821 | yyval.v.gid->gid[1] = yyvsp[0].v.number; | |||
7822 | yyval.v.gid->op = yyvsp[-1].v.i; | |||
7823 | yyval.v.gid->next = NULL((void *)0); | |||
7824 | yyval.v.gid->tail = yyval.v.gid; | |||
7825 | } | |||
7826 | break; | |||
7827 | case 293: | |||
7828 | #line 3027 "/usr/src/sbin/pfctl/parse.y" | |||
7829 | { | |||
7830 | if (yyvsp[-2].v.number == -1 || yyvsp[0].v.number == -1) { | |||
7831 | yyerror("group unknown requires operator = or " | |||
7832 | "!="); | |||
7833 | YYERRORgoto yyerrlab; | |||
7834 | } | |||
7835 | yyval.v.gid = calloc(1, sizeof(struct node_gid)); | |||
7836 | if (yyval.v.gid == NULL((void *)0)) | |||
7837 | err(1, "gid_item: calloc"); | |||
7838 | yyval.v.gid->gid[0] = yyvsp[-2].v.number; | |||
7839 | yyval.v.gid->gid[1] = yyvsp[0].v.number; | |||
7840 | yyval.v.gid->op = yyvsp[-1].v.i; | |||
7841 | yyval.v.gid->next = NULL((void *)0); | |||
7842 | yyval.v.gid->tail = yyval.v.gid; | |||
7843 | } | |||
7844 | break; | |||
7845 | case 294: | |||
7846 | #line 3044 "/usr/src/sbin/pfctl/parse.y" | |||
7847 | { | |||
7848 | if (!strcmp(yyvsp[0].v.string, "unknown")) | |||
7849 | yyval.v.number = -1; | |||
7850 | else { | |||
7851 | gid_t gid; | |||
7852 | ||||
7853 | if (gid_from_group(yyvsp[0].v.string, &gid) == -1) { | |||
7854 | yyerror("unknown group %s", yyvsp[0].v.string); | |||
7855 | free(yyvsp[0].v.string); | |||
7856 | YYERRORgoto yyerrlab; | |||
7857 | } | |||
7858 | yyval.v.number = gid; | |||
7859 | } | |||
7860 | free(yyvsp[0].v.string); | |||
7861 | } | |||
7862 | break; | |||
7863 | case 295: | |||
7864 | #line 3059 "/usr/src/sbin/pfctl/parse.y" | |||
7865 | { | |||
7866 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number >= GID_MAX0xffffffffU) { | |||
7867 | yyerror("illegal gid value %lld", yyvsp[0].v.number); | |||
7868 | YYERRORgoto yyerrlab; | |||
7869 | } | |||
7870 | yyval.v.number = yyvsp[0].v.number; | |||
7871 | } | |||
7872 | break; | |||
7873 | case 296: | |||
7874 | #line 3068 "/usr/src/sbin/pfctl/parse.y" | |||
7875 | { | |||
7876 | int f; | |||
7877 | ||||
7878 | if ((f = parse_flags(yyvsp[0].v.string)) < 0) { | |||
7879 | yyerror("bad flags %s", yyvsp[0].v.string); | |||
7880 | free(yyvsp[0].v.string); | |||
7881 | YYERRORgoto yyerrlab; | |||
7882 | } | |||
7883 | free(yyvsp[0].v.string); | |||
7884 | yyval.v.b.b1 = f; | |||
7885 | } | |||
7886 | break; | |||
7887 | case 297: | |||
7888 | #line 3081 "/usr/src/sbin/pfctl/parse.y" | |||
7889 | { yyval.v.b.b1 = yyvsp[-2].v.b.b1; yyval.v.b.b2 = yyvsp[0].v.b.b1; } | |||
7890 | break; | |||
7891 | case 298: | |||
7892 | #line 3082 "/usr/src/sbin/pfctl/parse.y" | |||
7893 | { yyval.v.b.b1 = 0; yyval.v.b.b2 = yyvsp[0].v.b.b1; } | |||
7894 | break; | |||
7895 | case 299: | |||
7896 | #line 3083 "/usr/src/sbin/pfctl/parse.y" | |||
7897 | { yyval.v.b.b1 = 0; yyval.v.b.b2 = 0; } | |||
7898 | break; | |||
7899 | case 300: | |||
7900 | #line 3086 "/usr/src/sbin/pfctl/parse.y" | |||
7901 | { yyval.v.icmp = yyvsp[0].v.icmp; } | |||
7902 | break; | |||
7903 | case 301: | |||
7904 | #line 3087 "/usr/src/sbin/pfctl/parse.y" | |||
7905 | { yyval.v.icmp = yyvsp[-1].v.icmp; } | |||
7906 | break; | |||
7907 | case 302: | |||
7908 | #line 3088 "/usr/src/sbin/pfctl/parse.y" | |||
7909 | { yyval.v.icmp = yyvsp[0].v.icmp; } | |||
7910 | break; | |||
7911 | case 303: | |||
7912 | #line 3089 "/usr/src/sbin/pfctl/parse.y" | |||
7913 | { yyval.v.icmp = yyvsp[-1].v.icmp; } | |||
7914 | break; | |||
7915 | case 304: | |||
7916 | #line 3092 "/usr/src/sbin/pfctl/parse.y" | |||
7917 | { yyval.v.icmp = yyvsp[-1].v.icmp; } | |||
7918 | break; | |||
7919 | case 305: | |||
7920 | #line 3093 "/usr/src/sbin/pfctl/parse.y" | |||
7921 | { | |||
7922 | yyvsp[-3].v.icmp->tail->next = yyvsp[-1].v.icmp; | |||
7923 | yyvsp[-3].v.icmp->tail = yyvsp[-1].v.icmp; | |||
7924 | yyval.v.icmp = yyvsp[-3].v.icmp; | |||
7925 | } | |||
7926 | break; | |||
7927 | case 306: | |||
7928 | #line 3100 "/usr/src/sbin/pfctl/parse.y" | |||
7929 | { yyval.v.icmp = yyvsp[-1].v.icmp; } | |||
7930 | break; | |||
7931 | case 307: | |||
7932 | #line 3101 "/usr/src/sbin/pfctl/parse.y" | |||
7933 | { | |||
7934 | yyvsp[-3].v.icmp->tail->next = yyvsp[-1].v.icmp; | |||
7935 | yyvsp[-3].v.icmp->tail = yyvsp[-1].v.icmp; | |||
7936 | yyval.v.icmp = yyvsp[-3].v.icmp; | |||
7937 | } | |||
7938 | break; | |||
7939 | case 308: | |||
7940 | #line 3108 "/usr/src/sbin/pfctl/parse.y" | |||
7941 | { | |||
7942 | yyval.v.icmp = calloc(1, sizeof(struct node_icmp)); | |||
7943 | if (yyval.v.icmp == NULL((void *)0)) | |||
7944 | err(1, "icmp_item: calloc"); | |||
7945 | yyval.v.icmp->type = yyvsp[0].v.number; | |||
7946 | yyval.v.icmp->code = 0; | |||
7947 | yyval.v.icmp->proto = IPPROTO_ICMP1; | |||
7948 | yyval.v.icmp->next = NULL((void *)0); | |||
7949 | yyval.v.icmp->tail = yyval.v.icmp; | |||
7950 | } | |||
7951 | break; | |||
7952 | case 309: | |||
7953 | #line 3118 "/usr/src/sbin/pfctl/parse.y" | |||
7954 | { | |||
7955 | const struct icmpcodeent *p; | |||
7956 | ||||
7957 | if ((p = geticmpcodebyname(yyvsp[-2].v.number-1, yyvsp[0].v.string, AF_INET2)) == NULL((void *)0)) { | |||
7958 | yyerror("unknown icmp-code %s", yyvsp[0].v.string); | |||
7959 | free(yyvsp[0].v.string); | |||
7960 | YYERRORgoto yyerrlab; | |||
7961 | } | |||
7962 | ||||
7963 | free(yyvsp[0].v.string); | |||
7964 | yyval.v.icmp = calloc(1, sizeof(struct node_icmp)); | |||
7965 | if (yyval.v.icmp == NULL((void *)0)) | |||
7966 | err(1, "icmp_item: calloc"); | |||
7967 | yyval.v.icmp->type = yyvsp[-2].v.number; | |||
7968 | yyval.v.icmp->code = p->code + 1; | |||
7969 | yyval.v.icmp->proto = IPPROTO_ICMP1; | |||
7970 | yyval.v.icmp->next = NULL((void *)0); | |||
7971 | yyval.v.icmp->tail = yyval.v.icmp; | |||
7972 | } | |||
7973 | break; | |||
7974 | case 310: | |||
7975 | #line 3137 "/usr/src/sbin/pfctl/parse.y" | |||
7976 | { | |||
7977 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
7978 | yyerror("illegal icmp-code %lld", yyvsp[0].v.number); | |||
7979 | YYERRORgoto yyerrlab; | |||
7980 | } | |||
7981 | yyval.v.icmp = calloc(1, sizeof(struct node_icmp)); | |||
7982 | if (yyval.v.icmp == NULL((void *)0)) | |||
7983 | err(1, "icmp_item: calloc"); | |||
7984 | yyval.v.icmp->type = yyvsp[-2].v.number; | |||
7985 | yyval.v.icmp->code = yyvsp[0].v.number + 1; | |||
7986 | yyval.v.icmp->proto = IPPROTO_ICMP1; | |||
7987 | yyval.v.icmp->next = NULL((void *)0); | |||
7988 | yyval.v.icmp->tail = yyval.v.icmp; | |||
7989 | } | |||
7990 | break; | |||
7991 | case 311: | |||
7992 | #line 3153 "/usr/src/sbin/pfctl/parse.y" | |||
7993 | { | |||
7994 | yyval.v.icmp = calloc(1, sizeof(struct node_icmp)); | |||
7995 | if (yyval.v.icmp == NULL((void *)0)) | |||
7996 | err(1, "icmp_item: calloc"); | |||
7997 | yyval.v.icmp->type = yyvsp[0].v.number; | |||
7998 | yyval.v.icmp->code = 0; | |||
7999 | yyval.v.icmp->proto = IPPROTO_ICMPV658; | |||
8000 | yyval.v.icmp->next = NULL((void *)0); | |||
8001 | yyval.v.icmp->tail = yyval.v.icmp; | |||
8002 | } | |||
8003 | break; | |||
8004 | case 312: | |||
8005 | #line 3163 "/usr/src/sbin/pfctl/parse.y" | |||
8006 | { | |||
8007 | const struct icmpcodeent *p; | |||
8008 | ||||
8009 | if ((p = geticmpcodebyname(yyvsp[-2].v.number-1, yyvsp[0].v.string, AF_INET624)) == NULL((void *)0)) { | |||
8010 | yyerror("unknown icmp6-code %s", yyvsp[0].v.string); | |||
8011 | free(yyvsp[0].v.string); | |||
8012 | YYERRORgoto yyerrlab; | |||
8013 | } | |||
8014 | free(yyvsp[0].v.string); | |||
8015 | ||||
8016 | yyval.v.icmp = calloc(1, sizeof(struct node_icmp)); | |||
8017 | if (yyval.v.icmp == NULL((void *)0)) | |||
8018 | err(1, "icmp_item: calloc"); | |||
8019 | yyval.v.icmp->type = yyvsp[-2].v.number; | |||
8020 | yyval.v.icmp->code = p->code + 1; | |||
8021 | yyval.v.icmp->proto = IPPROTO_ICMPV658; | |||
8022 | yyval.v.icmp->next = NULL((void *)0); | |||
8023 | yyval.v.icmp->tail = yyval.v.icmp; | |||
8024 | } | |||
8025 | break; | |||
8026 | case 313: | |||
8027 | #line 3182 "/usr/src/sbin/pfctl/parse.y" | |||
8028 | { | |||
8029 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
8030 | yyerror("illegal icmp-code %lld", yyvsp[0].v.number); | |||
8031 | YYERRORgoto yyerrlab; | |||
8032 | } | |||
8033 | yyval.v.icmp = calloc(1, sizeof(struct node_icmp)); | |||
8034 | if (yyval.v.icmp == NULL((void *)0)) | |||
8035 | err(1, "icmp_item: calloc"); | |||
8036 | yyval.v.icmp->type = yyvsp[-2].v.number; | |||
8037 | yyval.v.icmp->code = yyvsp[0].v.number + 1; | |||
8038 | yyval.v.icmp->proto = IPPROTO_ICMPV658; | |||
8039 | yyval.v.icmp->next = NULL((void *)0); | |||
8040 | yyval.v.icmp->tail = yyval.v.icmp; | |||
8041 | } | |||
8042 | break; | |||
8043 | case 314: | |||
8044 | #line 3198 "/usr/src/sbin/pfctl/parse.y" | |||
8045 | { | |||
8046 | const struct icmptypeent *p; | |||
8047 | ||||
8048 | if ((p = geticmptypebyname(yyvsp[0].v.string, AF_INET2)) == NULL((void *)0)) { | |||
8049 | yyerror("unknown icmp-type %s", yyvsp[0].v.string); | |||
8050 | free(yyvsp[0].v.string); | |||
8051 | YYERRORgoto yyerrlab; | |||
8052 | } | |||
8053 | yyval.v.number = p->type + 1; | |||
8054 | free(yyvsp[0].v.string); | |||
8055 | } | |||
8056 | break; | |||
8057 | case 315: | |||
8058 | #line 3209 "/usr/src/sbin/pfctl/parse.y" | |||
8059 | { | |||
8060 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
8061 | yyerror("illegal icmp-type %lld", yyvsp[0].v.number); | |||
8062 | YYERRORgoto yyerrlab; | |||
8063 | } | |||
8064 | yyval.v.number = yyvsp[0].v.number + 1; | |||
8065 | } | |||
8066 | break; | |||
8067 | case 316: | |||
8068 | #line 3218 "/usr/src/sbin/pfctl/parse.y" | |||
8069 | { | |||
8070 | const struct icmptypeent *p; | |||
8071 | ||||
8072 | if ((p = geticmptypebyname(yyvsp[0].v.string, AF_INET624)) == | |||
8073 | NULL((void *)0)) { | |||
8074 | yyerror("unknown icmp6-type %s", yyvsp[0].v.string); | |||
8075 | free(yyvsp[0].v.string); | |||
8076 | YYERRORgoto yyerrlab; | |||
8077 | } | |||
8078 | yyval.v.number = p->type + 1; | |||
8079 | free(yyvsp[0].v.string); | |||
8080 | } | |||
8081 | break; | |||
8082 | case 317: | |||
8083 | #line 3230 "/usr/src/sbin/pfctl/parse.y" | |||
8084 | { | |||
8085 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > 255) { | |||
8086 | yyerror("illegal icmp6-type %lld", yyvsp[0].v.number); | |||
8087 | YYERRORgoto yyerrlab; | |||
8088 | } | |||
8089 | yyval.v.number = yyvsp[0].v.number + 1; | |||
8090 | } | |||
8091 | break; | |||
8092 | case 318: | |||
8093 | #line 3239 "/usr/src/sbin/pfctl/parse.y" | |||
8094 | { | |||
8095 | int val; | |||
8096 | char *end; | |||
8097 | ||||
8098 | if (map_tos(yyvsp[0].v.string, &val)) | |||
8099 | yyval.v.number = val; | |||
8100 | else if (yyvsp[0].v.string[0] == '0' && yyvsp[0].v.string[1] == 'x') { | |||
8101 | errno(*__errno()) = 0; | |||
8102 | yyval.v.number = strtoul(yyvsp[0].v.string, &end, 16); | |||
8103 | if (errno(*__errno()) || *end != '\0') | |||
8104 | yyval.v.number = 256; | |||
8105 | } else | |||
8106 | yyval.v.number = 256; /* flag bad argument */ | |||
8107 | if (yyval.v.number < 0 || yyval.v.number > 255) { | |||
8108 | yyerror("illegal tos value %s", yyvsp[0].v.string); | |||
8109 | free(yyvsp[0].v.string); | |||
8110 | YYERRORgoto yyerrlab; | |||
8111 | } | |||
8112 | free(yyvsp[0].v.string); | |||
8113 | } | |||
8114 | break; | |||
8115 | case 319: | |||
8116 | #line 3259 "/usr/src/sbin/pfctl/parse.y" | |||
8117 | { | |||
8118 | yyval.v.number = yyvsp[0].v.number; | |||
8119 | if (yyval.v.number < 0 || yyval.v.number > 255) { | |||
8120 | yyerror("illegal tos value %lld", yyvsp[0].v.number); | |||
8121 | YYERRORgoto yyerrlab; | |||
8122 | } | |||
8123 | } | |||
8124 | break; | |||
8125 | case 320: | |||
8126 | #line 3268 "/usr/src/sbin/pfctl/parse.y" | |||
8127 | { yyval.v.i = PF_SRCTRACK; } | |||
8128 | break; | |||
8129 | case 321: | |||
8130 | #line 3269 "/usr/src/sbin/pfctl/parse.y" | |||
8131 | { yyval.v.i = PF_SRCTRACK_GLOBAL; } | |||
8132 | break; | |||
8133 | case 322: | |||
8134 | #line 3270 "/usr/src/sbin/pfctl/parse.y" | |||
8135 | { yyval.v.i = PF_SRCTRACK_RULE; } | |||
8136 | break; | |||
8137 | case 323: | |||
8138 | #line 3273 "/usr/src/sbin/pfctl/parse.y" | |||
8139 | { | |||
8140 | yyval.v.i = PFRULE_IFBOUND0x00010000; | |||
8141 | } | |||
8142 | break; | |||
8143 | case 324: | |||
8144 | #line 3276 "/usr/src/sbin/pfctl/parse.y" | |||
8145 | { | |||
8146 | yyval.v.i = 0; | |||
8147 | } | |||
8148 | break; | |||
8149 | case 325: | |||
8150 | #line 3281 "/usr/src/sbin/pfctl/parse.y" | |||
8151 | { | |||
8152 | yyval.v.keep_state.action = 0; | |||
8153 | yyval.v.keep_state.options = NULL((void *)0); | |||
8154 | } | |||
8155 | break; | |||
8156 | case 326: | |||
8157 | #line 3285 "/usr/src/sbin/pfctl/parse.y" | |||
8158 | { | |||
8159 | yyval.v.keep_state.action = PF_STATE_NORMAL0x1; | |||
8160 | yyval.v.keep_state.options = yyvsp[0].v.state_opt; | |||
8161 | } | |||
8162 | break; | |||
8163 | case 327: | |||
8164 | #line 3289 "/usr/src/sbin/pfctl/parse.y" | |||
8165 | { | |||
8166 | yyval.v.keep_state.action = PF_STATE_MODULATE0x2; | |||
8167 | yyval.v.keep_state.options = yyvsp[0].v.state_opt; | |||
8168 | } | |||
8169 | break; | |||
8170 | case 328: | |||
8171 | #line 3293 "/usr/src/sbin/pfctl/parse.y" | |||
8172 | { | |||
8173 | yyval.v.keep_state.action = PF_STATE_SYNPROXY0x3; | |||
8174 | yyval.v.keep_state.options = yyvsp[0].v.state_opt; | |||
8175 | } | |||
8176 | break; | |||
8177 | case 329: | |||
8178 | #line 3299 "/usr/src/sbin/pfctl/parse.y" | |||
8179 | { yyval.v.i = 0; } | |||
8180 | break; | |||
8181 | case 330: | |||
8182 | #line 3300 "/usr/src/sbin/pfctl/parse.y" | |||
8183 | { yyval.v.i = PF_FLUSH0x01; } | |||
8184 | break; | |||
8185 | case 331: | |||
8186 | #line 3301 "/usr/src/sbin/pfctl/parse.y" | |||
8187 | { | |||
8188 | yyval.v.i = PF_FLUSH0x01 | PF_FLUSH_GLOBAL0x02; | |||
8189 | } | |||
8190 | break; | |||
8191 | case 332: | |||
8192 | #line 3306 "/usr/src/sbin/pfctl/parse.y" | |||
8193 | { yyval.v.state_opt = yyvsp[-1].v.state_opt; } | |||
8194 | break; | |||
8195 | case 333: | |||
8196 | #line 3307 "/usr/src/sbin/pfctl/parse.y" | |||
8197 | { yyval.v.state_opt = NULL((void *)0); } | |||
8198 | break; | |||
8199 | case 334: | |||
8200 | #line 3310 "/usr/src/sbin/pfctl/parse.y" | |||
8201 | { yyval.v.state_opt = yyvsp[0].v.state_opt; } | |||
8202 | break; | |||
8203 | case 335: | |||
8204 | #line 3311 "/usr/src/sbin/pfctl/parse.y" | |||
8205 | { | |||
8206 | yyvsp[-2].v.state_opt->tail->next = yyvsp[0].v.state_opt; | |||
8207 | yyvsp[-2].v.state_opt->tail = yyvsp[0].v.state_opt; | |||
8208 | yyval.v.state_opt = yyvsp[-2].v.state_opt; | |||
8209 | } | |||
8210 | break; | |||
8211 | case 336: | |||
8212 | #line 3318 "/usr/src/sbin/pfctl/parse.y" | |||
8213 | { | |||
8214 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8215 | yyerror("only positive values permitted"); | |||
8216 | YYERRORgoto yyerrlab; | |||
8217 | } | |||
8218 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8219 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8220 | err(1, "state_opt_item: calloc"); | |||
8221 | yyval.v.state_opt->type = PF_STATE_OPT_MAX; | |||
8222 | yyval.v.state_opt->data.max_states = yyvsp[0].v.number; | |||
8223 | yyval.v.state_opt->next = NULL((void *)0); | |||
8224 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8225 | } | |||
8226 | break; | |||
8227 | case 337: | |||
8228 | #line 3331 "/usr/src/sbin/pfctl/parse.y" | |||
8229 | { | |||
8230 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8231 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8232 | err(1, "state_opt_item: calloc"); | |||
8233 | yyval.v.state_opt->type = PF_STATE_OPT_NOSYNC; | |||
8234 | yyval.v.state_opt->next = NULL((void *)0); | |||
8235 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8236 | } | |||
8237 | break; | |||
8238 | case 338: | |||
8239 | #line 3339 "/usr/src/sbin/pfctl/parse.y" | |||
8240 | { | |||
8241 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8242 | yyerror("only positive values permitted"); | |||
8243 | YYERRORgoto yyerrlab; | |||
8244 | } | |||
8245 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8246 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8247 | err(1, "state_opt_item: calloc"); | |||
8248 | yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_STATES; | |||
8249 | yyval.v.state_opt->data.max_src_states = yyvsp[0].v.number; | |||
8250 | yyval.v.state_opt->next = NULL((void *)0); | |||
8251 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8252 | } | |||
8253 | break; | |||
8254 | case 339: | |||
8255 | #line 3352 "/usr/src/sbin/pfctl/parse.y" | |||
8256 | { | |||
8257 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8258 | yyerror("only positive values permitted"); | |||
8259 | YYERRORgoto yyerrlab; | |||
8260 | } | |||
8261 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8262 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8263 | err(1, "state_opt_item: calloc"); | |||
8264 | yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_CONN; | |||
8265 | yyval.v.state_opt->data.max_src_conn = yyvsp[0].v.number; | |||
8266 | yyval.v.state_opt->next = NULL((void *)0); | |||
8267 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8268 | } | |||
8269 | break; | |||
8270 | case 340: | |||
8271 | #line 3365 "/usr/src/sbin/pfctl/parse.y" | |||
8272 | { | |||
8273 | if (yyvsp[-2].v.number < 0 || yyvsp[-2].v.number > UINT_MAX0xffffffffU || | |||
8274 | yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8275 | yyerror("only positive values permitted"); | |||
8276 | YYERRORgoto yyerrlab; | |||
8277 | } | |||
8278 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8279 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8280 | err(1, "state_opt_item: calloc"); | |||
8281 | yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_CONN_RATE; | |||
8282 | yyval.v.state_opt->data.max_src_conn_rate.limit = yyvsp[-2].v.number; | |||
8283 | yyval.v.state_opt->data.max_src_conn_rate.seconds = yyvsp[0].v.number; | |||
8284 | yyval.v.state_opt->next = NULL((void *)0); | |||
8285 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8286 | } | |||
8287 | break; | |||
8288 | case 341: | |||
8289 | #line 3380 "/usr/src/sbin/pfctl/parse.y" | |||
8290 | { | |||
8291 | if (strlen(yyvsp[-2].v.string) >= PF_TABLE_NAME_SIZE32) { | |||
8292 | yyerror("table name '%s' too long", yyvsp[-2].v.string); | |||
8293 | free(yyvsp[-2].v.string); | |||
8294 | YYERRORgoto yyerrlab; | |||
8295 | } | |||
8296 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8297 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8298 | err(1, "state_opt_item: calloc"); | |||
8299 | if (strlcpy(yyval.v.state_opt->data.overload.tblname, yyvsp[-2].v.string, | |||
8300 | PF_TABLE_NAME_SIZE32) >= PF_TABLE_NAME_SIZE32) | |||
8301 | errx(1, "state_opt_item: strlcpy"); | |||
8302 | free(yyvsp[-2].v.string); | |||
8303 | yyval.v.state_opt->type = PF_STATE_OPT_OVERLOAD; | |||
8304 | yyval.v.state_opt->data.overload.flush = yyvsp[0].v.i; | |||
8305 | yyval.v.state_opt->next = NULL((void *)0); | |||
8306 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8307 | } | |||
8308 | break; | |||
8309 | case 342: | |||
8310 | #line 3398 "/usr/src/sbin/pfctl/parse.y" | |||
8311 | { | |||
8312 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8313 | yyerror("only positive values permitted"); | |||
8314 | YYERRORgoto yyerrlab; | |||
8315 | } | |||
8316 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8317 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8318 | err(1, "state_opt_item: calloc"); | |||
8319 | yyval.v.state_opt->type = PF_STATE_OPT_MAX_SRC_NODES; | |||
8320 | yyval.v.state_opt->data.max_src_nodes = yyvsp[0].v.number; | |||
8321 | yyval.v.state_opt->next = NULL((void *)0); | |||
8322 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8323 | } | |||
8324 | break; | |||
8325 | case 343: | |||
8326 | #line 3411 "/usr/src/sbin/pfctl/parse.y" | |||
8327 | { | |||
8328 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8329 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8330 | err(1, "state_opt_item: calloc"); | |||
8331 | yyval.v.state_opt->type = PF_STATE_OPT_SRCTRACK; | |||
8332 | yyval.v.state_opt->data.src_track = yyvsp[0].v.i; | |||
8333 | yyval.v.state_opt->next = NULL((void *)0); | |||
8334 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8335 | } | |||
8336 | break; | |||
8337 | case 344: | |||
8338 | #line 3420 "/usr/src/sbin/pfctl/parse.y" | |||
8339 | { | |||
8340 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8341 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8342 | err(1, "state_opt_item: calloc"); | |||
8343 | yyval.v.state_opt->type = PF_STATE_OPT_STATELOCK; | |||
8344 | yyval.v.state_opt->data.statelock = yyvsp[0].v.i; | |||
8345 | yyval.v.state_opt->next = NULL((void *)0); | |||
8346 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8347 | } | |||
8348 | break; | |||
8349 | case 345: | |||
8350 | #line 3429 "/usr/src/sbin/pfctl/parse.y" | |||
8351 | { | |||
8352 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8353 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8354 | err(1, "state_opt_item: calloc"); | |||
8355 | yyval.v.state_opt->type = PF_STATE_OPT_SLOPPY; | |||
8356 | yyval.v.state_opt->next = NULL((void *)0); | |||
8357 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8358 | } | |||
8359 | break; | |||
8360 | case 346: | |||
8361 | #line 3437 "/usr/src/sbin/pfctl/parse.y" | |||
8362 | { | |||
8363 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8364 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8365 | err(1, "state_opt_item: calloc"); | |||
8366 | yyval.v.state_opt->type = PF_STATE_OPT_PFLOW; | |||
8367 | yyval.v.state_opt->next = NULL((void *)0); | |||
8368 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8369 | } | |||
8370 | break; | |||
8371 | case 347: | |||
8372 | #line 3445 "/usr/src/sbin/pfctl/parse.y" | |||
8373 | { | |||
8374 | int i; | |||
8375 | ||||
8376 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8377 | yyerror("only positive values permitted"); | |||
8378 | YYERRORgoto yyerrlab; | |||
8379 | } | |||
8380 | for (i = 0; pf_timeouts[i].name && | |||
8381 | strcmp(pf_timeouts[i].name, yyvsp[-1].v.string); ++i) | |||
8382 | ; /* nothing */ | |||
8383 | if (!pf_timeouts[i].name) { | |||
8384 | yyerror("illegal timeout name %s", yyvsp[-1].v.string); | |||
8385 | free(yyvsp[-1].v.string); | |||
8386 | YYERRORgoto yyerrlab; | |||
8387 | } | |||
8388 | if (strchr(pf_timeouts[i].name, '.') == NULL((void *)0)) { | |||
8389 | yyerror("illegal state timeout %s", yyvsp[-1].v.string); | |||
8390 | free(yyvsp[-1].v.string); | |||
8391 | YYERRORgoto yyerrlab; | |||
8392 | } | |||
8393 | free(yyvsp[-1].v.string); | |||
8394 | yyval.v.state_opt = calloc(1, sizeof(struct node_state_opt)); | |||
8395 | if (yyval.v.state_opt == NULL((void *)0)) | |||
8396 | err(1, "state_opt_item: calloc"); | |||
8397 | yyval.v.state_opt->type = PF_STATE_OPT_TIMEOUT; | |||
8398 | yyval.v.state_opt->data.timeout.number = pf_timeouts[i].timeout; | |||
8399 | yyval.v.state_opt->data.timeout.seconds = yyvsp[0].v.number; | |||
8400 | yyval.v.state_opt->next = NULL((void *)0); | |||
8401 | yyval.v.state_opt->tail = yyval.v.state_opt; | |||
8402 | } | |||
8403 | break; | |||
8404 | case 348: | |||
8405 | #line 3477 "/usr/src/sbin/pfctl/parse.y" | |||
8406 | { | |||
8407 | yyval.v.string = yyvsp[0].v.string; | |||
8408 | } | |||
8409 | break; | |||
8410 | case 349: | |||
8411 | #line 3482 "/usr/src/sbin/pfctl/parse.y" | |||
8412 | { | |||
8413 | struct pfctl_qsitem *qsi; | |||
8414 | ||||
8415 | if ((qsi = pfctl_find_queue(yyvsp[0].v.string, &qspecs)) == NULL((void *)0)) { | |||
8416 | yyerror("queue %s is not defined", yyvsp[0].v.string); | |||
8417 | YYERRORgoto yyerrlab; | |||
8418 | } | |||
8419 | yyval.v.qassign.qname = yyvsp[0].v.string; | |||
8420 | yyval.v.qassign.pqname = NULL((void *)0); | |||
8421 | } | |||
8422 | break; | |||
8423 | case 350: | |||
8424 | #line 3492 "/usr/src/sbin/pfctl/parse.y" | |||
8425 | { | |||
8426 | struct pfctl_qsitem *qsi; | |||
8427 | ||||
8428 | if ((qsi = pfctl_find_queue(yyvsp[-1].v.string, &qspecs)) == NULL((void *)0)) { | |||
8429 | yyerror("queue %s is not defined", yyvsp[-1].v.string); | |||
8430 | YYERRORgoto yyerrlab; | |||
8431 | } | |||
8432 | yyval.v.qassign.qname = yyvsp[-1].v.string; | |||
8433 | yyval.v.qassign.pqname = NULL((void *)0); | |||
8434 | } | |||
8435 | break; | |||
8436 | case 351: | |||
8437 | #line 3502 "/usr/src/sbin/pfctl/parse.y" | |||
8438 | { | |||
8439 | struct pfctl_qsitem *qsi, *pqsi; | |||
8440 | ||||
8441 | if ((qsi = pfctl_find_queue(yyvsp[-3].v.string, &qspecs)) == NULL((void *)0)) { | |||
8442 | yyerror("queue %s is not defined", yyvsp[-3].v.string); | |||
8443 | YYERRORgoto yyerrlab; | |||
8444 | } | |||
8445 | if ((pqsi = pfctl_find_queue(yyvsp[-1].v.string, &qspecs)) == NULL((void *)0)) { | |||
8446 | yyerror("queue %s is not defined", yyvsp[-1].v.string); | |||
8447 | YYERRORgoto yyerrlab; | |||
8448 | } | |||
8449 | yyval.v.qassign.qname = yyvsp[-3].v.string; | |||
8450 | yyval.v.qassign.pqname = yyvsp[-1].v.string; | |||
8451 | } | |||
8452 | break; | |||
8453 | case 352: | |||
8454 | #line 3518 "/usr/src/sbin/pfctl/parse.y" | |||
8455 | { | |||
8456 | if (parseport(yyvsp[0].v.string, &yyval.v.range, PPORT_RANGE1|PPORT_STAR2) == -1) { | |||
8457 | free(yyvsp[0].v.string); | |||
8458 | YYERRORgoto yyerrlab; | |||
8459 | } | |||
8460 | free(yyvsp[0].v.string); | |||
8461 | } | |||
8462 | break; | |||
8463 | case 353: | |||
8464 | #line 3527 "/usr/src/sbin/pfctl/parse.y" | |||
8465 | { | |||
8466 | if (yyvsp[0].v.weight > 0) { | |||
8467 | struct node_host *n; | |||
8468 | for (n = yyvsp[-1].v.host; n != NULL((void *)0); n = n->next) | |||
8469 | n->weight = yyvsp[0].v.weight; | |||
8470 | } | |||
8471 | yyval.v.host = yyvsp[-1].v.host; | |||
8472 | } | |||
8473 | break; | |||
8474 | case 354: | |||
8475 | #line 3535 "/usr/src/sbin/pfctl/parse.y" | |||
8476 | { yyval.v.host = yyvsp[-1].v.host; } | |||
8477 | break; | |||
8478 | case 355: | |||
8479 | #line 3538 "/usr/src/sbin/pfctl/parse.y" | |||
8480 | { | |||
8481 | if (yyvsp[-2].v.host->addr.type != PF_ADDR_ADDRMASK) { | |||
8482 | free(yyvsp[-2].v.host); | |||
8483 | yyerror("only addresses can be listed for " | |||
8484 | "redirection pools "); | |||
8485 | YYERRORgoto yyerrlab; | |||
8486 | } | |||
8487 | if (yyvsp[-1].v.weight > 0) { | |||
8488 | struct node_host *n; | |||
8489 | for (n = yyvsp[-2].v.host; n != NULL((void *)0); n = n->next) | |||
8490 | n->weight = yyvsp[-1].v.weight; | |||
8491 | } | |||
8492 | yyval.v.host = yyvsp[-2].v.host; | |||
8493 | } | |||
8494 | break; | |||
8495 | case 356: | |||
8496 | #line 3552 "/usr/src/sbin/pfctl/parse.y" | |||
8497 | { | |||
8498 | yyvsp[-4].v.host->tail->next = yyvsp[-2].v.host; | |||
8499 | yyvsp[-4].v.host->tail = yyvsp[-2].v.host->tail; | |||
8500 | if (yyvsp[-1].v.weight > 0) { | |||
8501 | struct node_host *n; | |||
8502 | for (n = yyvsp[-2].v.host; n != NULL((void *)0); n = n->next) | |||
8503 | n->weight = yyvsp[-1].v.weight; | |||
8504 | } | |||
8505 | yyval.v.host = yyvsp[-4].v.host; | |||
8506 | } | |||
8507 | break; | |||
8508 | case 357: | |||
8509 | #line 3564 "/usr/src/sbin/pfctl/parse.y" | |||
8510 | { | |||
8511 | yyval.v.redirection = calloc(1, sizeof(struct redirection)); | |||
8512 | if (yyval.v.redirection == NULL((void *)0)) | |||
8513 | err(1, "redirection: calloc"); | |||
8514 | yyval.v.redirection->host = yyvsp[0].v.host; | |||
8515 | yyval.v.redirection->rport.a = yyval.v.redirection->rport.b = yyval.v.redirection->rport.t = 0; | |||
8516 | } | |||
8517 | break; | |||
8518 | case 358: | |||
8519 | #line 3571 "/usr/src/sbin/pfctl/parse.y" | |||
8520 | { | |||
8521 | yyval.v.redirection = calloc(1, sizeof(struct redirection)); | |||
8522 | if (yyval.v.redirection == NULL((void *)0)) | |||
8523 | err(1, "redirection: calloc"); | |||
8524 | yyval.v.redirection->host = yyvsp[-2].v.host; | |||
8525 | yyval.v.redirection->rport = yyvsp[0].v.range; | |||
8526 | } | |||
8527 | break; | |||
8528 | case 359: | |||
8529 | #line 3581 "/usr/src/sbin/pfctl/parse.y" | |||
8530 | { | |||
8531 | yyval.v.hashkey = calloc(1, sizeof(struct pf_poolhashkey)); | |||
8532 | if (yyval.v.hashkey == NULL((void *)0)) | |||
8533 | err(1, "hashkey: calloc"); | |||
8534 | yyval.v.hashkey->key32pfk.key32[0] = arc4random(); | |||
8535 | yyval.v.hashkey->key32pfk.key32[1] = arc4random(); | |||
8536 | yyval.v.hashkey->key32pfk.key32[2] = arc4random(); | |||
8537 | yyval.v.hashkey->key32pfk.key32[3] = arc4random(); | |||
8538 | } | |||
8539 | break; | |||
8540 | case 360: | |||
8541 | #line 3591 "/usr/src/sbin/pfctl/parse.y" | |||
8542 | { | |||
8543 | if (!strncmp(yyvsp[0].v.string, "0x", 2)) { | |||
8544 | if (strlen(yyvsp[0].v.string) != 34) { | |||
8545 | free(yyvsp[0].v.string); | |||
8546 | yyerror("hex key must be 128 bits " | |||
8547 | "(32 hex digits) long"); | |||
8548 | YYERRORgoto yyerrlab; | |||
8549 | } | |||
8550 | yyval.v.hashkey = calloc(1, sizeof(struct pf_poolhashkey)); | |||
8551 | if (yyval.v.hashkey == NULL((void *)0)) | |||
8552 | err(1, "hashkey: calloc"); | |||
8553 | ||||
8554 | if (sscanf(yyvsp[0].v.string, "0x%8x%8x%8x%8x", | |||
8555 | &yyval.v.hashkey->key32pfk.key32[0], &yyval.v.hashkey->key32pfk.key32[1], | |||
8556 | &yyval.v.hashkey->key32pfk.key32[2], &yyval.v.hashkey->key32pfk.key32[3]) != 4) { | |||
8557 | free(yyval.v.hashkey); | |||
8558 | free(yyvsp[0].v.string); | |||
8559 | yyerror("invalid hex key"); | |||
8560 | YYERRORgoto yyerrlab; | |||
8561 | } | |||
8562 | } else { | |||
8563 | MD5_CTX context; | |||
8564 | ||||
8565 | yyval.v.hashkey = calloc(1, sizeof(struct pf_poolhashkey)); | |||
8566 | if (yyval.v.hashkey == NULL((void *)0)) | |||
8567 | err(1, "hashkey: calloc"); | |||
8568 | MD5Init(&context); | |||
8569 | MD5Update(&context, (unsigned char *)yyvsp[0].v.string, | |||
8570 | strlen(yyvsp[0].v.string)); | |||
8571 | MD5Final((unsigned char *)yyval.v.hashkey, &context); | |||
8572 | HTONL(yyval.v.hashkey->key32[0])(yyval.v.hashkey->pfk.key32[0]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[0])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[0]) ) & 0xff) << 24 | ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[0])) & 0xff00) << 8 | ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[0])) & 0xff0000 ) >> 8 | ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[0])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[0]))); | |||
8573 | HTONL(yyval.v.hashkey->key32[1])(yyval.v.hashkey->pfk.key32[1]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[1])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[1]) ) & 0xff) << 24 | ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[1])) & 0xff00) << 8 | ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[1])) & 0xff0000 ) >> 8 | ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[1])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[1]))); | |||
8574 | HTONL(yyval.v.hashkey->key32[2])(yyval.v.hashkey->pfk.key32[2]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[2])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[2]) ) & 0xff) << 24 | ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[2])) & 0xff00) << 8 | ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[2])) & 0xff0000 ) >> 8 | ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[2])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[2]))); | |||
8575 | HTONL(yyval.v.hashkey->key32[3])(yyval.v.hashkey->pfk.key32[3]) = (__uint32_t)(__builtin_constant_p ((u_int32_t)(yyval.v.hashkey->pfk.key32[3])) ? (__uint32_t )(((__uint32_t)((u_int32_t)(yyval.v.hashkey->pfk.key32[3]) ) & 0xff) << 24 | ((__uint32_t)((u_int32_t)(yyval.v .hashkey->pfk.key32[3])) & 0xff00) << 8 | ((__uint32_t )((u_int32_t)(yyval.v.hashkey->pfk.key32[3])) & 0xff0000 ) >> 8 | ((__uint32_t)((u_int32_t)(yyval.v.hashkey-> pfk.key32[3])) & 0xff000000) >> 24) : __swap32md((u_int32_t )(yyval.v.hashkey->pfk.key32[3]))); | |||
8576 | } | |||
8577 | free(yyvsp[0].v.string); | |||
8578 | } | |||
8579 | break; | |||
8580 | case 361: | |||
8581 | #line 3630 "/usr/src/sbin/pfctl/parse.y" | |||
8582 | { bzero(&pool_opts, sizeof pool_opts); } | |||
8583 | break; | |||
8584 | case 362: | |||
8585 | #line 3632 "/usr/src/sbin/pfctl/parse.y" | |||
8586 | { yyval.v.pool_opts = pool_opts; } | |||
8587 | break; | |||
8588 | case 363: | |||
8589 | #line 3633 "/usr/src/sbin/pfctl/parse.y" | |||
8590 | { | |||
8591 | bzero(&pool_opts, sizeof pool_opts); | |||
8592 | yyval.v.pool_opts = pool_opts; | |||
8593 | } | |||
8594 | break; | |||
8595 | case 366: | |||
8596 | #line 3643 "/usr/src/sbin/pfctl/parse.y" | |||
8597 | { | |||
8598 | if (pool_opts.type) { | |||
8599 | yyerror("pool type cannot be redefined"); | |||
8600 | YYERRORgoto yyerrlab; | |||
8601 | } | |||
8602 | pool_opts.type = PF_POOL_BITMASK; | |||
8603 | } | |||
8604 | break; | |||
8605 | case 367: | |||
8606 | #line 3650 "/usr/src/sbin/pfctl/parse.y" | |||
8607 | { | |||
8608 | if (pool_opts.type) { | |||
8609 | yyerror("pool type cannot be redefined"); | |||
8610 | YYERRORgoto yyerrlab; | |||
8611 | } | |||
8612 | pool_opts.type = PF_POOL_RANDOM; | |||
8613 | } | |||
8614 | break; | |||
8615 | case 368: | |||
8616 | #line 3657 "/usr/src/sbin/pfctl/parse.y" | |||
8617 | { | |||
8618 | if (pool_opts.type) { | |||
8619 | yyerror("pool type cannot be redefined"); | |||
8620 | YYERRORgoto yyerrlab; | |||
8621 | } | |||
8622 | pool_opts.type = PF_POOL_SRCHASH; | |||
8623 | pool_opts.key = yyvsp[0].v.hashkey; | |||
8624 | } | |||
8625 | break; | |||
8626 | case 369: | |||
8627 | #line 3665 "/usr/src/sbin/pfctl/parse.y" | |||
8628 | { | |||
8629 | if (pool_opts.type) { | |||
8630 | yyerror("pool type cannot be redefined"); | |||
8631 | YYERRORgoto yyerrlab; | |||
8632 | } | |||
8633 | pool_opts.type = PF_POOL_ROUNDROBIN; | |||
8634 | } | |||
8635 | break; | |||
8636 | case 370: | |||
8637 | #line 3672 "/usr/src/sbin/pfctl/parse.y" | |||
8638 | { | |||
8639 | if (pool_opts.type) { | |||
8640 | yyerror("pool type cannot be redefined"); | |||
8641 | YYERRORgoto yyerrlab; | |||
8642 | } | |||
8643 | pool_opts.type = PF_POOL_LEASTSTATES; | |||
8644 | } | |||
8645 | break; | |||
8646 | case 371: | |||
8647 | #line 3679 "/usr/src/sbin/pfctl/parse.y" | |||
8648 | { | |||
8649 | if (pool_opts.staticport) { | |||
8650 | yyerror("static-port cannot be redefined"); | |||
8651 | YYERRORgoto yyerrlab; | |||
8652 | } | |||
8653 | pool_opts.staticport = 1; | |||
8654 | } | |||
8655 | break; | |||
8656 | case 372: | |||
8657 | #line 3686 "/usr/src/sbin/pfctl/parse.y" | |||
8658 | { | |||
8659 | if (pool_opts.marker & POM_STICKYADDRESS0x02) { | |||
8660 | yyerror("sticky-address cannot be redefined"); | |||
8661 | YYERRORgoto yyerrlab; | |||
8662 | } | |||
8663 | pool_opts.marker |= POM_STICKYADDRESS0x02; | |||
8664 | pool_opts.opts |= PF_POOL_STICKYADDR0x20; | |||
8665 | } | |||
8666 | break; | |||
8667 | case 373: | |||
8668 | #line 3696 "/usr/src/sbin/pfctl/parse.y" | |||
8669 | { | |||
8670 | struct redirection *redir; | |||
8671 | if (filter_opts.rt != PF_NOPFROUTE) { | |||
8672 | yyerror("cannot respecify " | |||
8673 | "route-to/reply-to/dup-to"); | |||
8674 | YYERRORgoto yyerrlab; | |||
8675 | } | |||
8676 | redir = calloc(1, sizeof(*redir)); | |||
8677 | if (redir == NULL((void *)0)) | |||
8678 | err(1, "routespec calloc"); | |||
8679 | redir->host = yyvsp[-1].v.host; | |||
8680 | filter_opts.rroute.rdr = redir; | |||
8681 | memcpy(&filter_opts.rroute.pool_opts, &yyvsp[0].v.pool_opts, | |||
8682 | sizeof(filter_opts.rroute.pool_opts)); | |||
8683 | } | |||
8684 | break; | |||
8685 | case 374: | |||
8686 | #line 3714 "/usr/src/sbin/pfctl/parse.y" | |||
8687 | { | |||
8688 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8689 | yyerror("only positive values permitted"); | |||
8690 | YYERRORgoto yyerrlab; | |||
8691 | } | |||
8692 | if (pfctl_set_timeout(pf, yyvsp[-1].v.string, yyvsp[0].v.number, 0) != 0) { | |||
8693 | yyerror("unknown timeout %s", yyvsp[-1].v.string); | |||
8694 | free(yyvsp[-1].v.string); | |||
8695 | YYERRORgoto yyerrlab; | |||
8696 | } | |||
8697 | free(yyvsp[-1].v.string); | |||
8698 | } | |||
8699 | break; | |||
8700 | case 377: | |||
8701 | #line 3733 "/usr/src/sbin/pfctl/parse.y" | |||
8702 | { | |||
8703 | if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > UINT_MAX0xffffffffU) { | |||
8704 | yyerror("only positive values permitted"); | |||
8705 | YYERRORgoto yyerrlab; | |||
8706 | } | |||
8707 | if (pfctl_set_limit(pf, yyvsp[-1].v.string, yyvsp[0].v.number) != 0) { | |||
8708 | yyerror("unable to set limit %s %lld", yyvsp[-1].v.string, yyvsp[0].v.number); | |||
8709 | free(yyvsp[-1].v.string); | |||
8710 | YYERRORgoto yyerrlab; | |||
8711 | } | |||
8712 | free(yyvsp[-1].v.string); | |||
8713 | } | |||
8714 | break; | |||
8715 | case 382: | |||
8716 | #line 3755 "/usr/src/sbin/pfctl/parse.y" | |||
8717 | { yyval.v.number = 0; } | |||
8718 | break; | |||
8719 | case 383: | |||
8720 | #line 3756 "/usr/src/sbin/pfctl/parse.y" | |||
8721 | { | |||
8722 | if (!strcmp(yyvsp[0].v.string, "yes")) | |||
8723 | yyval.v.number = 1; | |||
8724 | else { | |||
8725 | yyerror("invalid value '%s', expected 'yes' " | |||
8726 | "or 'no'", yyvsp[0].v.string); | |||
8727 | free(yyvsp[0].v.string); | |||
8728 | YYERRORgoto yyerrlab; | |||
8729 | } | |||
8730 | free(yyvsp[0].v.string); | |||
8731 | } | |||
8732 | break; | |||
8733 | case 384: | |||
8734 | #line 3769 "/usr/src/sbin/pfctl/parse.y" | |||
8735 | { yyval.v.i = PF_OP_EQ; } | |||
8736 | break; | |||
8737 | case 385: | |||
8738 | #line 3770 "/usr/src/sbin/pfctl/parse.y" | |||
8739 | { yyval.v.i = PF_OP_NE; } | |||
8740 | break; | |||
8741 | case 386: | |||
8742 | #line 3771 "/usr/src/sbin/pfctl/parse.y" | |||
8743 | { yyval.v.i = PF_OP_LE; } | |||
8744 | break; | |||
8745 | case 387: | |||
8746 | #line 3772 "/usr/src/sbin/pfctl/parse.y" | |||
8747 | { yyval.v.i = PF_OP_LT; } | |||
8748 | break; | |||
8749 | case 388: | |||
8750 | #line 3773 "/usr/src/sbin/pfctl/parse.y" | |||
8751 | { yyval.v.i = PF_OP_GE; } | |||
8752 | break; | |||
8753 | case 389: | |||
8754 | #line 3774 "/usr/src/sbin/pfctl/parse.y" | |||
8755 | { yyval.v.i = PF_OP_GT; } | |||
8756 | break; | |||
8757 | #line 8750 "parse.c" | |||
8758 | } | |||
8759 | yyssp -= yym; | |||
8760 | yystate = *yyssp; | |||
8761 | yyvsp -= yym; | |||
8762 | yym = yylhs[yyn]; | |||
8763 | if (yystate == 0 && yym == 0) | |||
8764 | { | |||
8765 | #if YYDEBUG0 | |||
8766 | if (yydebug) | |||
8767 | printf("%sdebug: after reduction, shifting from state 0 to\ | |||
8768 | state %d\n", YYPREFIX"yy", YYFINAL2); | |||
8769 | #endif | |||
8770 | yystate = YYFINAL2; | |||
8771 | *++yyssp = YYFINAL2; | |||
8772 | *++yyvsp = yyval; | |||
8773 | if (yychar < 0) | |||
8774 | { | |||
8775 | if ((yychar = yylex()) < 0) yychar = 0; | |||
8776 | #if YYDEBUG0 | |||
8777 | if (yydebug) | |||
8778 | { | |||
8779 | yys = 0; | |||
8780 | if (yychar <= YYMAXTOKEN385) yys = yyname[yychar]; | |||
8781 | if (!yys) yys = "illegal-symbol"; | |||
8782 | printf("%sdebug: state %d, reading %d (%s)\n", | |||
8783 | YYPREFIX"yy", YYFINAL2, yychar, yys); | |||
8784 | } | |||
8785 | #endif | |||
8786 | } | |||
8787 | if (yychar == 0) goto yyaccept; | |||
8788 | goto yyloop; | |||
8789 | } | |||
8790 | if ((yyn = yygindex[yym]) && (yyn += yystate) >= 0 && | |||
8791 | yyn <= YYTABLESIZE5732 && yycheck[yyn] == yystate) | |||
8792 | yystate = yytable[yyn]; | |||
8793 | else | |||
8794 | yystate = yydgoto[yym]; | |||
8795 | #if YYDEBUG0 | |||
8796 | if (yydebug) | |||
8797 | printf("%sdebug: after reduction, shifting from state %d \ | |||
8798 | to state %d\n", YYPREFIX"yy", *yyssp, yystate); | |||
8799 | #endif | |||
8800 | if (yyssp >= yysslim && yygrowstack()) | |||
8801 | { | |||
8802 | goto yyoverflow; | |||
8803 | } | |||
8804 | *++yyssp = yystate; | |||
8805 | *++yyvsp = yyval; | |||
8806 | goto yyloop; | |||
8807 | yyoverflow: | |||
8808 | yyerror("yacc stack overflow"); | |||
8809 | yyabort: | |||
8810 | if (yyss) | |||
8811 | free(yyss); | |||
8812 | if (yyvs) | |||
8813 | free(yyvs); | |||
8814 | yyss = yyssp = NULL((void *)0); | |||
8815 | yyvs = yyvsp = NULL((void *)0); | |||
8816 | yystacksize = 0; | |||
8817 | return (1); | |||
8818 | yyaccept: | |||
8819 | if (yyss) | |||
8820 | free(yyss); | |||
8821 | if (yyvs) | |||
8822 | free(yyvs); | |||
8823 | yyss = yyssp = NULL((void *)0); | |||
8824 | yyvs = yyvsp = NULL((void *)0); | |||
8825 | yystacksize = 0; | |||
8826 | return (0); | |||
8827 | } |