config_parse.y

sock protocol ,it is useful!

	}
	;

user_libwrap:	USER_LIBWRAP ':' userid {
#if HAVE_LIBWRAP && SOCKS_SERVER
		config.uid.libwrap			= $3;
		config.uid.libwrap_isset	= 1;
#else  /* HAVE_LIBWRAP */
		yyerror("libwrap support not compiled in");
#endif /* !HAVE_LIBWRAP */
	}
	;


userid:	USERNAME {
		struct passwd *pw;

		if ((pw = getpwnam($1)) == NULL)
			serrx(EXIT_FAILURE, "no such user \"%s\"", $1);
		else
			$$ = pw->pw_uid;
	}
	;

iotimeout:	IOTIMEOUT ':' NUMBER {
#if SOCKS_SERVER
		config.timeout.io = atol($3);
#endif
	}
	;

connecttimeout:	CONNECTTIMEOUT ':' NUMBER {
#if SOCKS_SERVER
		config.timeout.negotiate = atol($3);
#endif
	}
	;

debuging: DEBUGING ':' NUMBER {
		config.option.debug = atoi($3);
	}
	;

compatibility:	COMPATIBILITY ':' compatibilitys
	;

compatibilityname:	REUSEADDR {
#if SOCKS_SERVER
		config.compat.reuseaddr = 1;
	}
	|	SAMEPORT {
		config.compat.sameport = 1;
#endif
	}
	;

compatibilitys:	compatibilityname
	|	compatibilityname compatibilitys
	;

resolveprotocol:	RESOLVEPROTOCOL ':' resolveprotocolname
	;

resolveprotocolname:	PROTOCOL_FAKE {
			config.resolveprotocol = RESOLVEPROTOCOL_FAKE;
	}
	|  PROTOCOL_TCP {
#if HAVE_NO_RESOLVESTUFF
			yyerror("resolveprotocol keyword not supported on this installation");
#else /* HAVE_NO_RESOLVESTUFF */
			config.resolveprotocol = RESOLVEPROTOCOL_TCP;
#endif /* !HAVE_NO_RESOLVESTUFF */
	}
	|	PROTOCOL_UDP {
			config.resolveprotocol = RESOLVEPROTOCOL_UDP;
	}
	;

srchost:	SRCHOST ':' srchostoptions
	;

srchostoption:	NOMISMATCH {
#if HAVE_LIBWRAP && SOCKS_SERVER
			config.srchost.nomismatch = 1;
	}
	|  NOUNKNOWN {
			config.srchost.nounknown = 1;
#else
		yyerror("srchostoption requires libwrap");
#endif
	}
	;

srchostoptions:	srchostoption
	|	srchostoption srchostoptions
	;


authmethod:	METHOD ':' authmethods
	;

authmethodname:	NONE {
		ADDMETHOD(AUTHMETHOD_NONE);
	};
	|	GSSAPI {
		yyerror("GSSAPI not supported");
	}
	|	UNAME {
		ADDMETHOD(AUTHMETHOD_UNAME);
	}
	|	RFC931 {
#if HAVE_LIBWRAP && SOCKS_SERVER
		ADDMETHOD(AUTHMETHOD_RFC931);
#else /* !HAVE_LIBWRAP */
		yyerror("method rfc931 requires libwrap");
#endif /* !HAVE_LIBWRAP */
	}
	;

authmethods:	authmethodname
	|	authmethodname authmethods
	;


	/* filterrules */

clientrule: CLIENTRULE verdict '{' clientruleoptions fromto clientruleoptions '}' {
#if SOCKS_SERVER
		rule.src = src;
		rule.dst = dst;

		addclientrule(&rule);

		bzero(&src, sizeof(src));
		bzero(&dst, sizeof(dst));
		rule = ruleinit;

		src.atype = SOCKS_ADDR_IPV4;
		dst.atype = SOCKS_ADDR_IPV4;
#endif
	}
	;

clientruleoption:	libwrap
	|	log
	|	user
	;

clientruleoptions:	{ $$ = NULL; }
	|	clientruleoption clientruleoptions
	;

rule:	verdict '{' ruleoptions fromto ruleoptions '}' {
#if SOCKS_SERVER
		rule.src = src;
		rule.dst = dst;

		addsocksrule(&rule);

		bzero(&src, sizeof(src));
		bzero(&dst, sizeof(dst));
		rule = ruleinit;

		src.atype	= SOCKS_ADDR_IPV4;
		dst.atype	= SOCKS_ADDR_IPV4;
#endif
	}
	;


ruleoption:	authmethod
	|	command
	|	libwrap
	|	log
	|	protocol
	|	proxyprotocol
	|	user
	;

ruleoptions:	{ $$ = NULL; }
	| ruleoption ruleoptions
	;

verdict:	VERDICT_BLOCK {
#if SOCKS_SERVER
		rule.verdict	= VERDICT_BLOCK;
		command			= &rule.state.command;
		methodv			= rule.state.methodv;
		methodc			= &rule.state.methodc;
		protocol			= &rule.state.protocol;
		proxyprotocol	= &rule.state.proxyprotocol;
		userbase			= &rule.user;
	}
	|	VERDICT_PASS {
		rule.verdict	= VERDICT_PASS;
		command			= &rule.state.command;
		methodv			= rule.state.methodv;
		methodc			= &rule.state.methodc;
		protocol			= &rule.state.protocol;
		proxyprotocol	= &rule.state.proxyprotocol;
		userbase			= &rule.user;
#endif
	}
	;

command:	COMMAND ':' commands
	;

commandname:	COMMAND_BIND {
			command->bind = 1;
	}
	|	COMMAND_CONNECT {
			command->connect = 1;
	}
	|	COMMAND_UDPASSOCIATE {
			command->udpassociate = 1;
	}

	/* pseudocommands */

	|	COMMAND_BINDREPLY	{
			command->bindreply = 1;
	}

	|	COMMAND_UDPREPLY {
			command->udpreply = 1;
	}
	;

commands:	commandname
	|	commandname commands
	;

protocol:	PROTOCOL ':'  protocols
	;

protocolname:	PROTOCOL_TCP {
		protocol->tcp = 1;
	}
	|	PROTOCOL_UDP {
		protocol->udp = 1;
	}
	;

protocols:	protocolname
	|	protocolname protocols
	;


fromto:	srcaddress dstaddress
	;

log:	LOG ':' logs
	;

logname:  LOG_CONNECT {
#if SOCKS_SERVER
	rule.log.connect = 1;
	}
	|	LOG_DATA {
			rule.log.data = 1;
	}
	|	LOG_DISCONNECT {
			rule.log.disconnect = 1;
	}
	|	LOG_ERROR {
			rule.log.error = 1;
	}
	|	LOG_IOOPERATION {
			rule.log.iooperation = 1;
#endif
	}
	;

logs:	logname
	|  logname logs
	;


libwrap:	LIBWRAPSTART ':' LINE {
#if HAVE_LIBWRAP && SOCKS_SERVER
		struct request_info request;
		char libwrap[LIBWRAPBUF];

		if (strlen($3) >= sizeof(rule.libwrap))
			yyerror("libwrap line too long, make LIBWRAPBUF bigger");
		strcpy(rule.libwrap, $3);

		/* libwrap modifies the passed buffer. */
		SASSERTX(strlen(rule.libwrap) < sizeof(libwrap));
		strcpy(libwrap, rule.libwrap);

		++dry_run;
		request_init(&request, RQ_FILE, -1, RQ_DAEMON, __progname, 0);
		if (setjmp(tcpd_buf) != 0)
			yyerror("bad libwrap line");
		process_options(libwrap, &request);
		--dry_run;

#else /* !HAVE_LIBWRAP */
		yyerror("libwrap support not compiled in");
#endif
	}
	;


srcaddress:	from ':' address
	;


dstaddress:	to ':' address
	;


gateway:	via ':' gwaddress
	;

routeoption:	command
	|	extension
	|	protocol
	|	proxyprotocol
	|	authmethod
	;

routeoptions:	{ $$ = NULL; }
	| routeoption routeoptions
	;

from:	FROM {
		addressinit(&src);
	}
	;


to:	TO {
		addressinit(&dst);
	}
	;


via:	VIA {
#if SOCKS_CLIENT
		addressinit(&gw);
#endif
	}
	;


address:		ipaddress '/' netmask port
	|	domain port
	;


gwaddress:	ipaddress port
	|	domain port
	|	direct
	;


ipaddress:	IPADDRESS {
		*atype = SOCKS_ADDR_IPV4;

		if (inet_aton($1, ipaddr) != 1)
			yyerror("bad address");
	}
	;


netmask:	NUMBER {
		if (atoi($1) < 0 || atoi($1) > 32)
			yyerror("bad netmask");

		netmask->s_addr
		= atoi($1) == 0 ? 0 : htonl(0xffffffff << (32 - atoi($1)));
	}
	|	IPADDRESS {
			if (!inet_aton($1, netmask))
				yyerror("bad netmask");
	}
	;

domain:	DOMAIN {
		*atype = SOCKS_ADDR_DOMAIN;

		if (strlen($1) >= MAXHOSTNAMELEN)
			yyerror("domain too long");
		strcpy(domain, $1);
	}
	;

direct:	DIRECT {
		*atype = SOCKS_ADDR_DOMAIN;

		if (strlen($1) >= MAXHOSTNAMELEN)
			yyerror("domain too long");
		strcpy(domain, $1);

#if SOCKS_CLIENT
		route.state.direct = 1;
#endif
	}
	;

port: { $$ = NULL; }
	|	PORT portoperator portnumber
	|	PORT portrange
	;

portnumber:	portservice
	|	portstart
	;

portrange:	portstart '-' portend
	;


portstart:	PORTNUMBER {
		*port_tcp	= htons((in_port_t)atoi($1));
		*port_udp	= htons((in_port_t)atoi($1));
	}
	;

portservice:	SERVICENAME {
		struct servent	*service;
		struct protocol_t	protocolunset;
		int set;

		bzero(&protocolunset, sizeof(protocolunset));

		/* set all protocols if none set, default. */
		if (memcmp(protocol, &protocolunset, sizeof(*protocol)) == 0) {
			memset(protocol, UCHAR_MAX, sizeof(*protocol));
			set = 0;
		}
		else
			set = 1;

		if (protocol->tcp) {
			if ((service = getservbyname($1, "tcp")) == NULL) {
				if (set)
					yyerror("bad servicename for tcp");
				else
					*port_tcp = htons(0);
			}
			else
				*port_tcp = (in_port_t)service->s_port;
		}

		if (protocol->udp) {
			if ((service = getservbyname($1, "udp")) == NULL) {
				if (set)
					yyerror("bad servicename for udp");
				else
					*port_udp = htons(0);
			}
			else
				*port_udp = (in_port_t)service->s_port;
		}

		/* check we got both protocol ports set right. */
		if (*port_tcp == htons(0) && *port_udp == htons(0))
			yyerror("bad service name for tcp/udp");
		if (*port_tcp == htons(0))
			*port_tcp = *port_udp;
		else if (*port_udp == htons(0))
			*port_udp = *port_tcp;
	}
	;


portend:	PORTNUMBER {
		ruleaddress->portend = htons((in_port_t)atoi($1));
		ruleaddress->operator = range;
	}
	;

portoperator:	OPERATOR {
		*operator = string2operator($1);
	}
	;

%%

#define INTERACTIVE		0

#if SOCKS_SERVER
#define ELECTRICFENCE	0
#else
#define ELECTRICFENCE	0
#endif


#if ELECTRICFENCE
	extern int EF_PROTECT_FREE;
	extern int EF_ALLOW_MALLOC_0;
	extern int EF_ALIGNMENT;
	extern int EF_PROTECT_BELOW;
#endif /* ELECTRICFENCE */

extern FILE *yyin;

int parseinit;

int
readconfig(filename)
	const char *filename;
{
	const char *function = "readconfig()";

#if ELECTRICFENCE
	EF_PROTECT_FREE         = 1;
	EF_ALLOW_MALLOC_0       = 1;
	EF_ALIGNMENT            = 0;
	EF_PROTECT_BELOW			= 0;
#endif /* ELECTRICFENCE */

/*	yydebug		= 0; */
	yylineno		= 1;
	parseinit	= 0;

	if ((yyin = fopen(filename, "r")) == NULL) {
		swarn("%s: %s", function, filename);
		return -1;
	}

	yyparse();
	fclose(yyin);

	errno = 0; /* yacc for some reason alters errno sometimes. */

	return 0;
}


void
yyerror(s)
	const char *s;
{

	serrx(1, "%s: error on line %d, near '%.10s': %s",
	config.option.configfile, yylineno,
	(yytext == NULL || *yytext == NUL) ? "'start of line'" : yytext, s);
}


static void
addressinit(address)
	struct ruleaddress_t *address;
{
		ruleaddress	= address;

		atype			= &ruleaddress->atype;
		ipaddr		= &ruleaddress->addr.ipv4.ip;
		netmask		= &ruleaddress->addr.ipv4.mask;
		domain		= ruleaddress->addr.domain;
		port_tcp		= &ruleaddress->port.tcp;
		port_udp		= &ruleaddress->port.udp;
		operator		= &ruleaddress->operator;
}