Head

GCC Code Coverage Report
Directory:	./		Exec	Total	Coverage
File:	usr.sbin/relayd/parse.c	Lines:	478	1269	37.7 %
Date:	2017-11-07	Branches:	268	829	32.3 %

#include <stdlib.h>
#include <string.h>
#define YYBYACC 1
#define YYMAJOR 1
#define YYMINOR 9
#define YYLEX yylex()
#define YYEMPTY -1
#define yyclearin (yychar=(YYEMPTY))
#define yyerrok (yyerrflag=0)
#define YYRECOVERING() (yyerrflag!=0)
#define YYPREFIX "yy"
#line 28 "parse.y"
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/queue.h>
#include <sys/ioctl.h>
#include <sys/time.h>
#include <sys/tree.h>

#include <netinet/in.h>
#include <arpa/inet.h>
#include <net/if.h>
#include <net/pfvar.h>
#include <net/route.h>

#include <stdint.h>
#include <stdarg.h>
#include <stdio.h>
#include <unistd.h>
#include <ctype.h>
#include <err.h>
#include <endian.h>
#include <errno.h>
#include <limits.h>
#include <netdb.h>
#include <string.h>
#include <ifaddrs.h>
#include <syslog.h>
#include <md5.h>

#include "relayd.h"
#include "http.h"
#include "snmp.h"

TAILQ_HEAD(files, file)		 files = TAILQ_HEAD_INITIALIZER(files);
static struct file {
	TAILQ_ENTRY(file)	 entry;
	FILE			*stream;
	char			*name;
	int			 lineno;
	int			 errors;
} *file, *topfile;
struct file	*pushfile(const char *, int);
int		 popfile(void);
int		 check_file_secrecy(int, const char *);
int		 yyparse(void);
int		 yylex(void);
int		 yyerror(const char *, ...);
int		 kw_cmp(const void *, const void *);
int		 lookup(char *);
int		 lgetc(int);
int		 lungetc(int);
int		 findeol(void);

TAILQ_HEAD(symhead, sym)	 symhead = TAILQ_HEAD_INITIALIZER(symhead);
struct sym {
	TAILQ_ENTRY(sym)	 entry;
	int			 used;
	int			 persist;
	char			*nam;
	char			*val;
};
int		 symset(const char *, const char *, int);
char		*symget(const char *);

struct relayd		*conf = NULL;
static int		 errors = 0;
static int		 loadcfg = 0;
objid_t			 last_rdr_id = 0;
objid_t			 last_table_id = 0;
objid_t			 last_host_id = 0;
objid_t			 last_relay_id = 0;
objid_t			 last_proto_id = 0;
objid_t			 last_rt_id = 0;
objid_t			 last_nr_id = 0;
objid_t			 last_key_id = 0;

static struct rdr	*rdr = NULL;
static struct table	*table = NULL;
static struct relay	*rlay = NULL;
static struct host	*hst = NULL;
struct relaylist	 relays;
static struct protocol	*proto = NULL;
static struct relay_rule *rule = NULL;
static struct router	*router = NULL;
static int		 label = 0;
static int		 tagged = 0;
static int		 tag = 0;
static in_port_t	 tableport = 0;
static int		 dstmode;
static enum key_type	 keytype = KEY_TYPE_NONE;
static enum direction	 dir = RELAY_DIR_ANY;
static char		*rulefile = NULL;
static union hashkey	*hashkey = NULL;

struct address	*host_v4(const char *);
struct address	*host_v6(const char *);
int		 host_dns(const char *, struct addresslist *,
		    int, struct portrange *, const char *, int);
int		 host_if(const char *, struct addresslist *,
		    int, struct portrange *, const char *, int);
int		 host(const char *, struct addresslist *,
		    int, struct portrange *, const char *, int);
void		 host_free(struct addresslist *);

struct table	*table_inherit(struct table *);
int		 relay_id(struct relay *);
struct relay	*relay_inherit(struct relay *, struct relay *);
int		 getservice(char *);
int		 is_if_in_group(const char *, const char *);

typedef struct {
	union {
		int64_t			 number;
		char			*string;
		struct host		*host;
		struct timeval		 tv;
		struct table		*table;
		struct portrange	 port;
		struct {
			union hashkey	 key;
			int		 keyset;
		}			 key;
		enum direction		 dir;
		struct {
			struct sockaddr_storage	 ss;
			char			 name[HOST_NAME_MAX+1];
		}			 addr;
		struct {
			enum digest_type type;
			char		*digest;
		}			 digest;
	} v;
	int lineno;
} YYSTYPE;

#line 149 "parse.c"
#define ALL 257
#define APPEND 258
#define BACKLOG 259
#define BACKUP 260
#define BUFFER 261
#define CA 262
#define CACHE 263
#define SET 264
#define CHECK 265
#define CIPHERS 266
#define CODE 267
#define COOKIE 268
#define DEMOTE 269
#define DIGEST 270
#define DISABLE 271
#define ERROR 272
#define EXPECT 273
#define PASS 274
#define BLOCK 275
#define EXTERNAL 276
#define FILENAME 277
#define FORWARD 278
#define FROM 279
#define HASH 280
#define HEADER 281
#define HOST 282
#define ICMP 283
#define INCLUDE 284
#define INET 285
#define INET6 286
#define INTERFACE 287
#define INTERVAL 288
#define IP 289
#define LABEL 290
#define LISTEN 291
#define VALUE 292
#define LOADBALANCE 293
#define LOG 294
#define LOOKUP 295
#define METHOD 296
#define MODE 297
#define NAT 298
#define NO 299
#define DESTINATION 300
#define NODELAY 301
#define NOTHING 302
#define ON 303
#define PARENT 304
#define PATH 305
#define PFTAG 306
#define PORT 307
#define PREFORK 308
#define PRIORITY 309
#define PROTO 310
#define QUERYSTR 311
#define REAL 312
#define REDIRECT 313
#define RELAY 314
#define REMOVE 315
#define REQUEST 316
#define RESPONSE 317
#define RETRY 318
#define QUICK 319
#define RETURN 320
#define ROUNDROBIN 321
#define ROUTE 322
#define SACK 323
#define SCRIPT 324
#define SEND 325
#define SESSION 326
#define SNMP 327
#define SOCKET 328
#define SPLICE 329
#define SSL 330
#define STICKYADDR 331
#define STYLE 332
#define TABLE 333
#define TAG 334
#define TAGGED 335
#define TCP 336
#define TIMEOUT 337
#define TLS 338
#define TO 339
#define ROUTER 340
#define RTLABEL 341
#define TRANSPARENT 342
#define TRAP 343
#define UPDATES 344
#define URL 345
#define VIRTUAL 346
#define WITH 347
#define TTL 348
#define RTABLE 349
#define MATCH 350
#define PARAMS 351
#define RANDOM 352
#define LEASTSTATES 353
#define SRCHASH 354
#define KEY 355
#define CERTIFICATE 356
#define PASSWORD 357
#define ECDH 358
#define EDH 359
#define CURVE 360
#define TICKETS 361
#define STRING 362
#define NUMBER 363
#define YYERRCODE 256
const short yylhs[] =
	{                                        -1,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,   31,   39,   39,   14,   14,   15,   15,    6,    1,
    1,   17,   17,   17,   16,   16,   16,   40,   40,   43,
   43,   41,   22,   22,   32,   44,   44,   33,   33,   33,
   33,   33,    9,    9,    7,    7,   45,   34,   47,   47,
   48,   48,   48,   48,   48,   48,   48,   18,   18,   12,
   12,   12,    3,   51,   35,   50,   50,   52,   52,   53,
   53,   54,   54,   56,   28,   55,   55,   57,   57,   57,
   57,   57,   57,   30,   30,   58,   58,   58,   58,   58,
   58,   58,   26,   27,   27,   60,   37,   59,   59,   59,
   61,   61,   62,   62,   62,   62,   62,   62,   62,   62,
   66,   66,   65,   65,   65,   65,   65,   65,   65,   65,
   65,   64,   64,   63,   63,   63,   63,   63,   63,   63,
   63,   63,   63,   63,   63,   63,   63,   11,   71,   67,
   19,   19,   19,   29,   29,   29,    8,    8,   20,   20,
   20,   68,   69,   70,   70,   72,   72,   73,   73,   73,
   73,   73,   73,   73,   73,   73,   73,   73,   73,   73,
   73,   73,   73,   73,   73,    4,    4,   21,   21,   21,
   21,   21,   21,   74,   36,   75,   75,   76,   76,   76,
   76,   76,   76,   77,   77,   77,   77,   10,   10,   10,
   10,   10,   10,   10,   79,   38,   80,   80,   81,   81,
   81,   81,   81,   81,   78,   78,   78,    2,    2,   83,
   23,   82,   82,   84,   84,   85,   85,   85,   85,   24,
   13,   13,   25,   42,   42,   42,   46,   46,   49,    5,
    5,
};
const short yylen[] =
	{                                         2,
    0,    3,    2,    3,    3,    3,    3,    3,    3,    3,
    3,    2,    1,    1,    0,    1,    0,    2,    1,    0,
    2,    0,    1,    1,    0,    1,    1,    3,    1,    0,
    1,    2,    2,    2,    3,    1,    1,    2,    2,    2,
    2,    3,    0,    1,    1,    1,    0,    7,    3,    2,
    4,    6,    1,    1,    3,    3,    1,    0,    1,    1,
    1,    2,    3,    0,    4,    2,    1,    1,    4,    3,
    2,    1,    1,    0,    3,    2,    1,    2,    1,    2,
    2,    2,    3,    0,    1,    1,    1,    1,    5,    4,
    5,    2,    2,    1,    1,    0,    5,    0,    2,    4,
    3,    2,    2,    4,    2,    4,    3,    5,    1,    1,
    3,    1,    1,    2,    1,    2,    1,    2,    2,    3,
    3,    3,    1,    2,    3,    2,    2,    1,    3,    2,
    1,    3,    3,    5,    3,    2,    1,    1,    0,    8,
    1,    1,    1,    0,    1,    1,    0,    1,    0,    1,
    1,    0,    0,    0,    1,    2,    1,    2,    4,    2,
    4,    2,    4,    2,    4,    2,    4,    2,    3,    2,
    2,    2,    2,    2,    3,    0,    2,    0,    1,    1,
    1,    1,    1,    0,    7,    3,    2,    5,    5,    3,
    2,    1,    1,    3,    3,    2,    1,    0,    1,    1,
    1,    1,    1,    1,    0,    7,    3,    2,    4,    3,
    2,    2,    1,    1,    0,    1,    2,    0,    2,    0,
    3,    0,    1,    2,    1,    2,    2,    2,    3,    1,
    0,    2,    1,    1,    1,    0,    2,    0,    2,    1,
    0,
};
const short yydefred[] =
	{                                      1,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
   23,    0,    0,    0,    3,    0,    0,    0,    0,    0,
    0,    0,    0,    0,   11,   12,   38,   46,   45,   39,
   41,   47,  184,   44,    0,    0,   64,  233,   40,  205,
    0,    0,    2,    4,    5,    6,    7,    8,    9,   10,
    0,    0,  240,   42,    0,    0,    0,   35,   96,    0,
    0,   63,   68,    0,    0,   67,    0,    0,    0,    0,
    0,    0,   66,    0,    0,   97,  237,   53,   60,    0,
   61,    0,   54,    0,   59,    0,    0,   57,    0,    0,
  192,    0,    0,    0,    0,  193,    0,    0,  230,   72,
  220,   73,    0,    0,  213,    0,    0,    0,    0,  214,
    0,    0,   99,    0,    0,    0,   62,    0,    0,   48,
    0,   50,    0,  191,    0,    0,    0,  185,    0,  187,
    0,   69,    0,  234,    0,   71,  235,    0,    0,  212,
  211,  206,    0,  208,  141,  142,    0,   13,    0,   14,
  143,    0,  110,    0,    0,    0,  109,    0,   56,   74,
    0,   55,    0,   49,    0,  190,   18,    0,  186,    0,
    0,    0,    0,  221,  223,    0,    0,   70,  210,    0,
  207,    0,    0,    0,    0,  115,  113,    0,  117,    0,
  105,  145,  146,    0,    0,    0,    0,    0,    0,    0,
  138,    0,  137,  103,  100,    0,  102,   26,   27,    0,
    0,    0,   51,  239,    0,    0,    0,    0,    0,  197,
    0,    0,  227,  228,  226,  224,  209,    0,    0,   31,
  107,  119,    0,  116,  114,  118,    0,    0,    0,  148,
    0,    0,    0,    0,  126,    0,  130,  127,  136,  124,
    0,    0,    0,    0,  101,    0,    0,    0,    0,    0,
    0,   79,   75,    0,  219,   33,   34,  188,   16,    0,
    0,  196,    0,  216,    0,  189,  229,   32,    0,    0,
  121,  120,    0,  106,  151,  150,  152,  133,    0,  135,
  125,  132,  129,    0,  104,   52,   86,    0,    0,   87,
   19,    0,   88,   78,   81,   82,  201,  199,  200,  204,
  202,  203,    0,   80,   76,  195,  232,  194,  217,  108,
    0,  111,  153,    0,  122,   92,   36,   37,    0,    0,
   85,   83,   28,  139,  134,    0,    0,    0,    0,    0,
   21,    0,    0,   90,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,  140,  155,    0,   91,
   89,   93,  179,  180,  182,  183,  181,    0,    0,    0,
    0,  173,  158,  174,  171,    0,    0,  170,  172,    0,
  156,    0,    0,  175,  169,    0,    0,    0,   95,   94,
    0,  159,  177,  161,  163,  165,  167,
};
const short yydgoto[] =
	{                                       1,
  338,  213,  160,  384,   54,  302,   30,  241,   35,  313,
  203,   86,  272,  268,  127,  210,   16,   87,  152,  287,
  368,  262,  100,  101,   39,  344,  391,  161,  194,  332,
   88,   18,   19,   20,   21,   22,   23,   24,  154,  279,
  280,  135,  231,  329,   51,   70,   89,   90,  137,   65,
   56,   66,  103,  104,  263,  211,  264,  304,   76,   68,
  155,  156,  253,  254,  238,  239,  157,  323,  334,  357,
  339,  358,  359,   52,   97,   98,  221,  276,   57,  111,
  112,  174,  131,  175,  176,
};
const short yysindex[] =
	{                                      0,
  189,   36, -309, -301, -237, -293, -284, -275, -254,   66,
    0, -233, -211,   95,    0, -151,  151,  153,  158,  168,
  172,  175,  179,  182,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0, -168, -166,    0,    0,    0,    0,
 -161, -160,    0,    0,    0,    0,    0,    0,    0,    0,
   74,   80,    0,    0,  142, -111,   86,    0,    0,  200,
  200,    0,    0,  200, -111,    0,  200,   88,  200, 1005,
  841, -261,    0, -199,    4,    0,    0,    0,    0,  -88,
    0, -118,    0,  -61,    0, -117,  -82,    0,  381,  200,
    0,  -77, -131, -105, -102,    0,  936,  200,    0,    0,
    0,    0,  111,   32,    0,  -81, -125, -107, -106,    0,
  -78,  200,    0, 1018, -103,  -99,    0,   66,  -97,    0,
  251,    0,  -96,    0,  -95, -280,  -72,    0,  251,    0,
 -123,    0,  200,    0, -261,    0,    0,   66,  223,    0,
    0,    0,  251,    0,    0,    0,   12,    0,  192,    0,
    0, -207,    0, -119, -122,  200,    0, -302,    0,    0,
    8,    0,  200,    0,  -21,    0,    0,  -52,    0,  -48,
  -76,  -67,  -60,    0,    0, -123,    0,    0,    0,  -55,
    0, -112,  -54,  -51, -156,    0,    0,   41,    0,  181,
    0,    0,    0,    6, -220,  -44, -294,  -27,  -22,  -12,
    0, -244,    0,    0,    0,  251,    0,    0,    0,  -21,
 -217,  -18,    0,    0, -263, -280,   51,   30,  -21,    0,
 -137,  -13,    0,    0,    0,    0,    0,    5,   38,    0,
    0,    0,  -11,    0,    0,    0,    9,   33,  248,    0,
  -98,   13,   16,   23,    0,   27,    0,    0,    0,    0,
   31,   37,   33,  249,    0,    8, -197,   39,   26,   76,
 -233,    0,    0, -217,    0,    0,    0,    0,    0,   30,
   42,    0,   30,    0,   48,    0,    0,    0,  270,   33,
    0,    0,  181,    0,    0,    0,    0,    0,   43,    0,
    0,    0,    0, -244,    0,    0,    0,   49, -274,    0,
    0,   52,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,   53,    0,    0,    0,    0,    0,    0,    0,
   38,    0,    0,   54,    0,    0,    0,    0,  131,  136,
    0,    0,    0,    0,    0,   58,   62, -172, 1007, -280,
    0,   50,   64,    0, -219,   71,   97, -219,   72,   77,
 -265, -219, -219,   79,   84, -219,    0,    0, 1007,    0,
    0,    0,    0,    0,    0,    0,    0,   85,  146,   66,
   90,    0,    0,    0,    0,   93,   94,    0,    0, -251,
    0,  146,   98,    0,    0,  146,  146,  146,    0,    0,
  146,    0,    0,    0,    0,    0,    0,};
const short yyrindex[] =
	{                                      0,
  132,    0,    0,    0,    0,    0,    0,    0,   -8,    0,
    0,    0,    0,  140,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,  447,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,  973,
 1048,    0,    0, -258,  449,    0, -165,  452,  911,  157,
    0,    0,    0,    0, 1033,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,  157, -101,
    0,    0,    0,    0,  126,    0,    0,  945,    0,    0,
    0,    0,    0, -120,    0,    0,    0,    0,    0,    0,
    0,  201,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
   -4,    0, -115,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,  262,    0,    0,    0,  819,    0,  160,    0,    0,
  399,    0,  911,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,   -3, -110,    0,    0,    0,
    0,   -1,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,  294,    0,    0,    0,    0,  128,  169,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,  850,    0,   21,    0,    0,
  852,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,  521,    0,    0,
  491,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0, -108,    0,    0,  399,    0,    0,    0,   -9,
    0,    0,    0,  796,    0,    0,    0,    0,    0,   21,
    0,    0,   21,    0,    0,    0,    0,    0,    0, -109,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,  369,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0, -162,
    0,    0,    0,    0,    0,    0,    0,    0,  281,  451,
    0,    0,    0,    0,   87,    0,    0,   87,    0,    0,
    0,   87,   87,    0,    0,   46,    0,    0,  478,    0,
    0,    0,    0,    0,    0,    0,    0,  556,  603,    0,
  635,    0,    0,    0,    0,  682,  714,    0,    0,  779,
    0,  603,    0,    0,    0,  603,  603,  603,    0,    0,
  603,    0,    0,    0,    0,    0,    0,};
const short yygindex[] =
	{                                      0,
    0,  213,  -10, -153,    0,    0,    0,    0,    0,    0,
  274,  -34, -133,  134,    0,    0,    0,    0,    0,    0,
  -63, -136,    0,  368,  215,  104,    0,  -84,    0,    0,
   20,    0,    0,    0,    0,    0,    0,    0, -113,  171,
  314, -187,    0,    0,    0,  -31,    0,  409,  -94,    0,
    0,  435,  373,    0,  247,    0,    0,    0,    0,    0,
    0,  357,  359,  220,  383,  234,    0,    0,    0,    0,
    0,  159,    0,    0,    0,  436,    0,    0,    0,    0,
  423,    0,    0,  362,    0,
};
#define YYTABLESIZE 1390
const short yytable[] =
	{                                      37,
  198,   43,  205,  202,  238,  222,  225,   36,   30,  238,
  229,   64,  167,   69,  237,   29,  123,  195,  343,   28,
   17,  196,    3,  238,  374,  238,  164,  327,  216,   71,
  231,  246,   72,  208,  169,   74,   95,   77,  363,  222,
  225,  133,  163,  114,  364,   25,  142,  257,  181,  148,
  283,  258,   26,  179,  197,  178,  242,  150,  122,  209,
  365,   27,   95,  247,  248,  294,  130,  201,  375,   31,
  259,  105,  136,  256,  366,  134,  134,   32,  106,  260,
  144,  198,  273,  220,    3,  297,   33,  328,   34,  215,
   96,  102,  321,  110,  342,  367,  178,  343,  266,  267,
   99,  177,  269,  238,   20,  238,   29,   20,  192,  193,
  389,  255,  238,  199,  200,  198,   96,  201,  238,  261,
  222,  225,  107,   30,  207,   36,  298,  299,  113,   38,
  110,  214,  148,  153,  243,  244,  316,  131,  300,  318,
  150,  108,  195,  303,  234,  231,  196,  274,  275,  109,
   40,  145,  146,  236,  102,   41,  238,  236,   42,   63,
   43,    3,   44,  236,  301,  170,  235,   45,  238,  238,
  178,  131,  236,  239,  153,  238,  238,   46,  128,  197,
  171,   47,  238,  238,   48,  172,  285,  286,   49,  238,
  236,   50,  105,   53,  173,   55,   60,  147,   15,  106,
   58,   59,   61,   62,  238,    3,  198,  148,   67,   69,
   75,  178,  128,  149,  115,  150,  117,  236,  116,  228,
  238,  118,  236,  119,  238,  123,  269,  151,  392,  238,
  124,  125,  394,  395,  396,  132,   99,  397,  199,  200,
  238,  236,  201,  107,  126,  217,  238,  218,  238,  236,
  236,  239,  131,  236,  140,  198,  141,  138,  158,  198,
  163,  198,  108,  159,  162,  165,  168,  166,  198,  180,
  109,  144,   30,   30,  198,  198,  198,  198,  198,  222,
  225,  198,   30,  182,  371,  215,  223,  198,  376,  377,
  154,  231,  380,  128,  212,  224,  198,  198,  231,  222,
  198,  237,  225,  147,  231,  231,  231,  227,  232,  219,
  233,  231,  198,  178,  190,  178,  198,  245,   30,  178,
  178,  198,  178,  178,  240,  238,  178,  198,   30,  178,
  231,  198,  198,  250,   30,  178,   30,  251,  252,  198,
  198,  178,  231,  265,  178,  270,  231,  271,   30,  277,
  178,  281,  198,   43,  178,  307,  178,  222,  225,  385,
  178,  178,  231,  178,  178,  178,  278,  178,  308,  228,
  178,  282,  284,  295,  288,  178,  178,  289,   84,  178,
  178,  178,  178,  178,  290,  178,  144,  291,  306,  131,
  178,  178,  292,  131,  320,  178,  309,  178,  293,  324,
  305,  131,  131,  336,  317,  154,  178,  178,  218,  319,
  326,  131,  361,  330,  331,  335,  178,  337,  147,  340,
  178,  178,  178,  341,  178,  362,  131,  310,  311,  312,
  128,  178,  369,  372,  128,  370,  178,  383,  373,  183,
  378,   22,  128,  128,    2,  379,  382,  131,  178,   24,
  183,  386,  128,  131,  387,  388,  241,  131,   65,  393,
   15,   98,   58,  131,   17,  131,   25,  128,  296,  184,
  249,  238,    3,  360,  139,  314,    4,  131,  238,  185,
  184,  186,    5,  390,  238,  131,  131,  157,  128,  131,
  185,  333,  186,   84,  128,  230,    6,  121,  128,   73,
  149,    7,    8,  187,  128,  120,  128,  178,  188,  189,
  315,  206,  204,  325,  187,    9,  322,  381,  128,  188,
  189,   10,  238,  218,   11,   12,  128,  128,   13,  144,
  128,  191,  129,  143,    0,  144,  144,  226,  144,  144,
    0,  238,  144,    0,    0,  144,  144,  144,    0,  238,
   14,  144,    0,    0,  154,  154,    0,  144,    0,    0,
  144,  147,    0,    0,  154,  160,  144,  147,  147,    0,
  147,  147,  144,    0,  147,   15,    0,  147,  147,  147,
  144,  144,    0,  147,    0,    0,    0,    0,    0,  147,
    0,  144,  147,    0,    0,  144,  144,  144,  147,  144,
  154,    0,  157,    0,  147,    0,  144,    0,    0,    0,
  154,  144,  176,  147,    0,  149,  154,    0,  154,    0,
    0,    0,    0,  147,    0,    0,    0,  147,  147,  147,
  154,  147,    0,   84,    0,    0,    0,   84,  147,   84,
    0,    0,    0,  147,  162,  112,   84,    0,    0,    0,
    0,   78,   84,   84,   84,   84,   84,    0,   79,   84,
    0,    0,    0,    0,    3,   84,    0,    0,    0,  218,
    0,   80,    0,    0,   84,   84,  218,    0,   84,    0,
  160,    0,  218,    0,    0,    0,    0,    0,    0,  218,
   84,  164,    0,    0,   84,    0,    0,    0,    0,   84,
    0,    0,   81,    0,  218,   84,   82,    0,    0,   84,
   84,   83,    0,    0,    0,   15,    0,   84,   84,   15,
  218,   15,   84,  166,  218,    0,    0,  176,   15,  218,
   85,    0,    0,    0,   15,   15,   15,   15,   15,    0,
  218,   15,    0,    0,    0,    0,    0,   15,  218,    0,
    0,  157,  157,    0,    0,    0,   15,   15,  149,  162,
   15,  157,    0,    0,  149,  149,    0,  149,  149,    0,
    0,  149,   15,    0,  149,    0,   15,    0,    0,  236,
  149,   15,    0,    0,    0,    0,  149,   15,  168,  149,
    0,   15,   15,    0,    0,  149,    0,  157,    0,   15,
   15,  149,    0,    0,    0,   77,  164,  157,    0,  236,
  149,    0,    0,  157,    0,  157,    0,    0,    0,  236,
  149,  236,    0,  160,  149,  149,  149,  157,  149,  160,
  160,    0,  160,  160,    0,  149,  160,    0,  166,  160,
  149,    0,    0,  236,    0,  160,    0,    0,  236,  236,
    0,  160,    0,    0,  160,    0,    0,    0,    0,   15,
  160,  215,    0,    0,    0,    0,  160,    0,    0,    0,
  176,    0,    0,    0,    0,  160,  176,  176,    0,  176,
  176,    0,    0,  176,    0,  160,  176,    0,    0,  160,
  160,  160,  176,  160,    0,    0,    0,    0,  176,    0,
  160,  176,  162,  168,    0,  160,    0,  176,  162,  162,
    0,  162,  162,  176,    0,  162,    0,    0,  162,    0,
   77,    0,  176,    0,  162,    0,    0,    0,    0,    0,
  162,    0,  176,  162,    0,    0,  176,  176,  176,  162,
  176,    0,    0,  238,    0,  162,    0,  176,    0,  164,
    0,    0,  176,    0,  162,  164,  164,    0,  164,  164,
    0,    0,  164,    0,  162,  164,    0,    0,  162,  162,
  162,  164,  162,    0,   15,    0,  215,  164,    0,  162,
  164,  166,    0,    0,  162,    0,  164,  166,  166,    0,
  166,  166,  164,    0,  166,    0,    0,  166,    0,    0,
    0,  164,    0,  166,    0,    0,    0,    0,    0,  166,
    0,  164,  166,    0,    0,  164,  164,  164,  166,  164,
    0,    0,    0,    0,  166,    0,  164,    0,    0,    0,
    0,  164,    0,  166,    0,  238,    0,    0,    0,    0,
    0,    0,    0,  166,    0,    0,  168,  166,  166,  166,
    0,  166,  168,  168,    0,  168,  168,    0,  166,  168,
  128,    0,  168,  166,    0,    0,   77,    0,  168,  238,
    0,    0,    0,   77,  168,    0,    0,  168,    0,   77,
   77,   77,   77,  168,    0,    0,   77,    0,    0,  168,
    0,    0,  238,  238,    0,    0,    0,    0,  168,    0,
    0,   77,  238,    0,    0,   77,    0,    0,  168,    0,
    0,   91,  168,  168,  168,    0,  168,   77,   79,    0,
   15,   77,  215,  168,    3,    0,   77,   15,  168,  215,
    0,   92,    0,   15,    0,  215,   77,   77,  238,    0,
   15,    0,  215,    0,   77,   77,    0,    0,  238,    0,
   93,    0,    0,    0,  238,    0,  238,    0,    0,   15,
    0,  215,   81,    0,    0,    0,   94,    0,  238,  238,
    0,   15,  238,  215,    0,   15,  238,  215,    0,    0,
    0,  238,   84,    0,  238,  238,    0,    0,  238,    0,
    0,   15,    0,  215,  238,    0,    0,    0,    0,  238,
    0,  238,    0,    0,    0,    0,   91,    0,    0,  238,
    0,  238,    0,   79,    0,  238,  238,    0,    0,    3,
  238,    0,  238,    0,    0,    0,   92,    0,  238,    0,
  238,    0,  238,  238,    0,  238,  238,    0,  238,  238,
  238,  238,  238,  238,    0,   93,  238,    0,  238,    0,
  238,  238,  238,    0,  238,    0,  238,   81,    0,  238,
  238,   94,    0,  238,    0,    0,  238,    0,  238,  238,
  238,    0,  238,    0,  345,   78,    0,   84,  238,    0,
    0,    0,   79,  346,  347,    0,  238,  348,    3,    0,
    0,  145,  146,    0,  238,   80,  349,    0,  238,    0,
    0,    3,  350,  238,    0,  351,  238,  238,    0,    0,
    0,  352,    0,    0,  238,    0,  238,  353,  238,    0,
    0,    0,  238,    0,    0,  238,   81,    0,    0,    0,
   82,  238,    0,    0,    0,   83,    0,  147,  238,    0,
  354,  355,    0,    0,    0,    0,   84,  148,    0,    0,
    0,  356,  238,  149,   85,  150,    0,  238,    0,    0,
    0,    0,  238,    0,    0,    0,    0,  151,  238,  238,
  238,    0,    0,  238,    0,    0,    0,    0,    0,    0,
    0,    0,  238,    0,    0,    0,    0,    0,    0,  238,
};
const short yycheck[] =
	{                                      10,
   10,   10,  125,  123,  125,   10,   10,   60,   10,  125,
  123,  123,  126,   10,  125,  125,  125,  262,  270,  257,
    1,  266,  284,  125,  290,  284,  121,  302,  165,   61,
   10,  326,   64,  336,  129,   67,   71,   69,  258,   44,
   44,   10,   10,   75,  264,   10,  125,  265,  143,  330,
  238,  269,  362,  138,  299,   10,  277,  338,   90,  362,
  280,  363,   97,  358,  359,  253,   98,  362,  334,  363,
  288,  271,  104,  210,  294,   44,   44,  362,  278,  297,
  112,  326,  219,  168,  284,  283,  362,  362,  343,  307,
   71,   72,  280,   74,  267,  315,   10,  270,  362,  363,
  362,  133,  216,  362,  267,  271,  344,  270,  316,  317,
  362,  206,  278,  358,  359,  125,   97,  362,  284,  337,
  125,  125,  322,  125,  156,   60,  324,  325,  125,  363,
  111,  163,  330,  114,  355,  356,  270,   10,  336,  273,
  338,  341,  262,  257,  301,  125,  266,  285,  286,  349,
  362,  274,  275,  262,  135,   61,  322,  266,  310,  271,
   10,  284,   10,  284,  362,  289,  323,   10,  284,  271,
  125,   44,  329,  284,  155,  341,  278,   10,   10,  299,
  304,   10,  284,  349,   10,  309,  285,  286,   10,  291,
  299,   10,  271,  362,  318,  362,  123,  320,   10,  278,
  362,  362,  123,   62,  306,  284,  326,  330,  123,   10,
  123,  125,   44,  336,  303,  338,  278,  326,  337,  332,
  322,  339,  332,  306,  326,  303,  340,  350,  382,  331,
  362,  337,  386,  387,  388,  125,  362,  391,  358,  359,
  342,  362,  362,  322,  347,  298,  362,  300,  350,  358,
  359,  362,  125,  362,  362,  265,  363,  339,  362,  269,
   10,  271,  341,  363,  362,  362,  339,  363,  278,   47,
  349,   10,  274,  275,  284,  285,  286,  287,  288,  284,
  284,  291,  284,  272,  348,  307,  363,  297,  352,  353,
   10,  271,  356,  125,  287,  363,  306,  307,  278,  348,
  310,  261,  363,   10,  284,  285,  286,  363,  363,  362,
  362,  291,  322,  268,  123,  270,  326,  362,  320,  274,
  275,  331,  277,  278,  319,  125,  281,  337,  330,  284,
  310,  341,  342,  361,  336,  290,  338,  360,  351,  349,
  350,  296,  322,  362,  299,  295,  326,  318,  350,  363,
  305,  363,  362,  362,  268,  280,  311,  362,  362,  370,
  274,  275,  342,  277,  278,  320,  362,  281,  293,  332,
  284,  363,  125,  125,  362,  330,  290,  362,   10,  334,
  335,  336,  296,  338,  362,  299,  125,  361,  363,  262,
  345,  305,  362,  266,  125,  350,  321,  311,  362,  357,
  362,  274,  275,  273,  363,  125,  320,  362,   10,  362,
  362,  284,  363,  362,  362,  362,  330,  282,  125,  362,
  334,  335,  336,  362,  338,  362,  299,  352,  353,  354,
  262,  345,  362,  362,  266,  339,  350,  292,  362,  259,
  362,  310,  274,  275,  256,  362,  362,  320,  362,  310,
  259,  362,  284,  326,  362,  362,   10,  330,   10,  362,
   10,   10,  306,  336,  339,  338,  307,  299,  256,  289,
  197,  271,  284,  340,  107,  261,  288,  350,  278,  299,
  289,  301,  294,  380,  284,  358,  359,   10,  320,  362,
  299,  321,  301,  125,  326,  182,  308,   89,  330,   65,
   10,  313,  314,  323,  336,  125,  338,  135,  328,  329,
  264,  155,  154,  294,  323,  327,  283,  359,  350,  328,
  329,  333,  322,  125,  336,  337,  358,  359,  340,  268,
  362,  149,   97,  111,   -1,  274,  275,  176,  277,  278,
   -1,  341,  281,   -1,   -1,  284,  285,  286,   -1,  349,
  362,  290,   -1,   -1,  274,  275,   -1,  296,   -1,   -1,
  299,  268,   -1,   -1,  284,   10,  305,  274,  275,   -1,
  277,  278,  311,   -1,  281,  125,   -1,  284,  285,  286,
  319,  320,   -1,  290,   -1,   -1,   -1,   -1,   -1,  296,
   -1,  330,  299,   -1,   -1,  334,  335,  336,  305,  338,
  320,   -1,  125,   -1,  311,   -1,  345,   -1,   -1,   -1,
  330,  350,   10,  320,   -1,  125,  336,   -1,  338,   -1,
   -1,   -1,   -1,  330,   -1,   -1,   -1,  334,  335,  336,
  350,  338,   -1,  265,   -1,   -1,   -1,  269,  345,  271,
   -1,   -1,   -1,  350,   10,  125,  278,   -1,   -1,   -1,
   -1,  271,  284,  285,  286,  287,  288,   -1,  278,  291,
   -1,   -1,   -1,   -1,  284,  297,   -1,   -1,   -1,  271,
   -1,  291,   -1,   -1,  306,  307,  278,   -1,  310,   -1,
  125,   -1,  284,   -1,   -1,   -1,   -1,   -1,   -1,  291,
  322,   10,   -1,   -1,  326,   -1,   -1,   -1,   -1,  331,
   -1,   -1,  322,   -1,  306,  337,  326,   -1,   -1,  341,
  342,  331,   -1,   -1,   -1,  265,   -1,  349,  350,  269,
  322,  271,  342,   10,  326,   -1,   -1,  125,  278,  331,
  350,   -1,   -1,   -1,  284,  285,  286,  287,  288,   -1,
  342,  291,   -1,   -1,   -1,   -1,   -1,  297,  350,   -1,
   -1,  274,  275,   -1,   -1,   -1,  306,  307,  268,  125,
  310,  284,   -1,   -1,  274,  275,   -1,  277,  278,   -1,
   -1,  281,  322,   -1,  284,   -1,  326,   -1,   -1,  259,
  290,  331,   -1,   -1,   -1,   -1,  296,  337,   10,  299,
   -1,  341,  342,   -1,   -1,  305,   -1,  320,   -1,  349,
  350,  311,   -1,   -1,   -1,   10,  125,  330,   -1,  289,
  320,   -1,   -1,  336,   -1,  338,   -1,   -1,   -1,  299,
  330,  301,   -1,  268,  334,  335,  336,  350,  338,  274,
  275,   -1,  277,  278,   -1,  345,  281,   -1,  125,  284,
  350,   -1,   -1,  323,   -1,  290,   -1,   -1,  328,  329,
   -1,  296,   -1,   -1,  299,   -1,   -1,   -1,   -1,   10,
  305,   10,   -1,   -1,   -1,   -1,  311,   -1,   -1,   -1,
  268,   -1,   -1,   -1,   -1,  320,  274,  275,   -1,  277,
  278,   -1,   -1,  281,   -1,  330,  284,   -1,   -1,  334,
  335,  336,  290,  338,   -1,   -1,   -1,   -1,  296,   -1,
  345,  299,  268,  125,   -1,  350,   -1,  305,  274,  275,
   -1,  277,  278,  311,   -1,  281,   -1,   -1,  284,   -1,
  125,   -1,  320,   -1,  290,   -1,   -1,   -1,   -1,   -1,
  296,   -1,  330,  299,   -1,   -1,  334,  335,  336,  305,
  338,   -1,   -1,  125,   -1,  311,   -1,  345,   -1,  268,
   -1,   -1,  350,   -1,  320,  274,  275,   -1,  277,  278,
   -1,   -1,  281,   -1,  330,  284,   -1,   -1,  334,  335,
  336,  290,  338,   -1,  125,   -1,  125,  296,   -1,  345,
  299,  268,   -1,   -1,  350,   -1,  305,  274,  275,   -1,
  277,  278,  311,   -1,  281,   -1,   -1,  284,   -1,   -1,
   -1,  320,   -1,  290,   -1,   -1,   -1,   -1,   -1,  296,
   -1,  330,  299,   -1,   -1,  334,  335,  336,  305,  338,
   -1,   -1,   -1,   -1,  311,   -1,  345,   -1,   -1,   -1,
   -1,  350,   -1,  320,   -1,  125,   -1,   -1,   -1,   -1,
   -1,   -1,   -1,  330,   -1,   -1,  268,  334,  335,  336,
   -1,  338,  274,  275,   -1,  277,  278,   -1,  345,  281,
  125,   -1,  284,  350,   -1,   -1,  271,   -1,  290,  125,
   -1,   -1,   -1,  278,  296,   -1,   -1,  299,   -1,  284,
  285,  286,  287,  305,   -1,   -1,  291,   -1,   -1,  311,
   -1,   -1,  274,  275,   -1,   -1,   -1,   -1,  320,   -1,
   -1,  306,  284,   -1,   -1,  310,   -1,   -1,  330,   -1,
   -1,  271,  334,  335,  336,   -1,  338,  322,  278,   -1,
  271,  326,  271,  345,  284,   -1,  331,  278,  350,  278,
   -1,  291,   -1,  284,   -1,  284,  341,  342,  320,   -1,
  291,   -1,  291,   -1,  349,  350,   -1,   -1,  330,   -1,
  310,   -1,   -1,   -1,  336,   -1,  338,   -1,   -1,  310,
   -1,  310,  322,   -1,   -1,   -1,  326,   -1,  350,  259,
   -1,  322,  262,  322,   -1,  326,  266,  326,   -1,   -1,
   -1,  271,  342,   -1,  274,  275,   -1,   -1,  278,   -1,
   -1,  342,   -1,  342,  284,   -1,   -1,   -1,   -1,  289,
   -1,  291,   -1,   -1,   -1,   -1,  271,   -1,   -1,  299,
   -1,  301,   -1,  278,   -1,  271,  306,   -1,   -1,  284,
  310,   -1,  278,   -1,   -1,   -1,  291,   -1,  284,   -1,
  320,   -1,  322,  323,   -1,  291,  326,   -1,  328,  329,
  330,  331,  332,  271,   -1,  310,  336,   -1,  338,   -1,
  278,  341,  342,   -1,  310,   -1,  284,  322,   -1,  349,
  350,  326,   -1,  291,   -1,   -1,  322,   -1,  358,  359,
  326,   -1,  362,   -1,  268,  271,   -1,  342,  306,   -1,
   -1,   -1,  278,  277,  278,   -1,  342,  281,  284,   -1,
   -1,  274,  275,   -1,  322,  291,  290,   -1,  326,   -1,
   -1,  284,  296,  331,   -1,  299,  274,  275,   -1,   -1,
   -1,  305,   -1,   -1,  342,   -1,  284,  311,  271,   -1,
   -1,   -1,  350,   -1,   -1,  278,  322,   -1,   -1,   -1,
  326,  284,   -1,   -1,   -1,  331,   -1,  320,  291,   -1,
  334,  335,   -1,   -1,   -1,   -1,  342,  330,   -1,   -1,
   -1,  345,  320,  336,  350,  338,   -1,  310,   -1,   -1,
   -1,   -1,  330,   -1,   -1,   -1,   -1,  350,  336,  322,
  338,   -1,   -1,  326,   -1,   -1,   -1,   -1,   -1,   -1,
   -1,   -1,  350,   -1,   -1,   -1,   -1,   -1,   -1,  342,
};
#define YYFINAL 1
#ifndef YYDEBUG
#define YYDEBUG 0
#endif
#define YYMAXTOKEN 363
#if YYDEBUG
const char * const yyname[] =
	{
"end-of-file",0,0,0,0,0,0,0,0,0,"'\\n'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,"','",0,0,"'/'",0,0,0,0,0,0,0,0,0,0,0,0,"'<'","'='",
"'>'",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,"'{'",0,"'}'",0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
0,"ALL","APPEND","BACKLOG","BACKUP","BUFFER","CA","CACHE","SET","CHECK",
"CIPHERS","CODE","COOKIE","DEMOTE","DIGEST","DISABLE","ERROR","EXPECT","PASS",
"BLOCK","EXTERNAL","FILENAME","FORWARD","FROM","HASH","HEADER","HOST","ICMP",
"INCLUDE","INET","INET6","INTERFACE","INTERVAL","IP","LABEL","LISTEN","VALUE",
"LOADBALANCE","LOG","LOOKUP","METHOD","MODE","NAT","NO","DESTINATION","NODELAY",
"NOTHING","ON","PARENT","PATH","PFTAG","PORT","PREFORK","PRIORITY","PROTO",
"QUERYSTR","REAL","REDIRECT","RELAY","REMOVE","REQUEST","RESPONSE","RETRY",
"QUICK","RETURN","ROUNDROBIN","ROUTE","SACK","SCRIPT","SEND","SESSION","SNMP",
"SOCKET","SPLICE","SSL","STICKYADDR","STYLE","TABLE","TAG","TAGGED","TCP",
"TIMEOUT","TLS","TO","ROUTER","RTLABEL","TRANSPARENT","TRAP","UPDATES","URL",
"VIRTUAL","WITH","TTL","RTABLE","MATCH","PARAMS","RANDOM","LEASTSTATES",
"SRCHASH","KEY","CERTIFICATE","PASSWORD","ECDH","EDH","CURVE","TICKETS",
"STRING","NUMBER",
};
const char * const yyrule[] =
	{"$accept : grammar",
"grammar :",
"grammar : grammar include '\\n'",
"grammar : grammar '\\n'",
"grammar : grammar varset '\\n'",
"grammar : grammar main '\\n'",
"grammar : grammar rdr '\\n'",
"grammar : grammar tabledef '\\n'",
"grammar : grammar relay '\\n'",
"grammar : grammar proto '\\n'",
"grammar : grammar router '\\n'",
"grammar : grammar error '\\n'",
"include : INCLUDE STRING",
"ssltls : SSL",
"ssltls : TLS",
"opttls :",
"opttls : ssltls",
"opttlsclient :",
"opttlsclient : WITH ssltls",
"http_type : STRING",
"hostname :",
"hostname : HOST STRING",
"relay_proto :",
"relay_proto : TCP",
"relay_proto : STRING",
"redirect_proto :",
"redirect_proto : TCP",
"redirect_proto : STRING",
"eflags_l : eflags comma eflags_l",
"eflags_l : eflags",
"opteflags :",
"opteflags : eflags",
"eflags : STYLE STRING",
"port : PORT STRING",
"port : PORT NUMBER",
"varset : STRING '=' STRING",
"sendbuf : NOTHING",
"sendbuf : STRING",
"main : INTERVAL NUMBER",
"main : LOG loglevel",
"main : TIMEOUT timeout",
"main : PREFORK NUMBER",
"main : SNMP trap optstring",
"trap :",
"trap : TRAP",
"loglevel : UPDATES",
"loglevel : ALL",
"$$1 :",
"rdr : REDIRECT STRING $$1 '{' optnl rdropts_l '}'",
"rdropts_l : rdropts_l rdroptsl nl",
"rdropts_l : rdroptsl optnl",
"rdroptsl : forwardmode TO tablespec interface",
"rdroptsl : LISTEN ON STRING redirect_proto port interface",
"rdroptsl : DISABLE",
"rdroptsl : STICKYADDR",
"rdroptsl : match PFTAG STRING",
"rdroptsl : SESSION TIMEOUT NUMBER",
"rdroptsl : include",
"match :",
"match : MATCH",
"forwardmode : FORWARD",
"forwardmode : ROUTE",
"forwardmode : TRANSPARENT FORWARD",
"table : '<' STRING '>'",
"$$2 :",
"tabledef : TABLE table $$2 tabledefopts_l",
"tabledefopts_l : tabledefopts_l tabledefopts",
"tabledefopts_l : tabledefopts",
"tabledefopts : DISABLE",
"tabledefopts : '{' optnl tablelist_l '}'",
"tablelist_l : tablelist comma tablelist_l",
"tablelist_l : tablelist optnl",
"tablelist : host",
"tablelist : include",
"$$3 :",
"tablespec : table $$3 tableopts_l",
"tableopts_l : tableopts tableopts_l",
"tableopts_l : tableopts",
"tableopts : CHECK tablecheck",
"tableopts : port",
"tableopts : TIMEOUT timeout",
"tableopts : DEMOTE STRING",
"tableopts : INTERVAL NUMBER",
"tableopts : MODE dstmode hashkey",
"hashkey :",
"hashkey : STRING",
"tablecheck : ICMP",
"tablecheck : TCP",
"tablecheck : ssltls",
"tablecheck : http_type STRING hostname CODE NUMBER",
"tablecheck : http_type STRING hostname digest",
"tablecheck : SEND sendbuf EXPECT STRING opttls",
"tablecheck : SCRIPT STRING",
"digest : DIGEST STRING",
"optdigest : digest",
"optdigest : STRING",
"$$4 :",
"proto : relay_proto PROTO STRING $$4 protopts_n",
"protopts_n :",
"protopts_n : '{' '}'",
"protopts_n : '{' optnl protopts_l '}'",
"protopts_l : protopts_l protoptsl nl",
"protopts_l : protoptsl optnl",
"protoptsl : ssltls tlsflags",
"protoptsl : ssltls '{' tlsflags_l '}'",
"protoptsl : TCP tcpflags",
"protoptsl : TCP '{' tcpflags_l '}'",
"protoptsl : RETURN ERROR opteflags",
"protoptsl : RETURN ERROR '{' eflags_l '}'",
"protoptsl : filterrule",
"protoptsl : include",
"tcpflags_l : tcpflags comma tcpflags_l",
"tcpflags_l : tcpflags",
"tcpflags : SACK",
"tcpflags : NO SACK",
"tcpflags : NODELAY",
"tcpflags : NO NODELAY",
"tcpflags : SPLICE",
"tcpflags : NO SPLICE",
"tcpflags : BACKLOG NUMBER",
"tcpflags : SOCKET BUFFER NUMBER",
"tcpflags : IP STRING NUMBER",
"tlsflags_l : tlsflags comma tlsflags_l",
"tlsflags_l : tlsflags",
"tlsflags : SESSION TICKETS",
"tlsflags : NO SESSION TICKETS",
"tlsflags : CIPHERS STRING",
"tlsflags : NO EDH",
"tlsflags : EDH",
"tlsflags : EDH PARAMS STRING",
"tlsflags : NO ECDH",
"tlsflags : ECDH",
"tlsflags : ECDH CURVE STRING",
"tlsflags : CA FILENAME STRING",
"tlsflags : CA KEY STRING PASSWORD STRING",
"tlsflags : CA CERTIFICATE STRING",
"tlsflags : NO flag",
"tlsflags : flag",
"flag : STRING",
"$$5 :",
"filterrule : action dir quick ruleaf rulesrc ruledst $$5 ruleopts_l",
"action : PASS",
"action : BLOCK",
"action : MATCH",
"dir :",
"dir : REQUEST",
"dir : RESPONSE",
"quick :",
"quick : QUICK",
"ruleaf :",
"ruleaf : INET6",
"ruleaf : INET",
"rulesrc :",
"ruledst :",
"ruleopts_l :",
"ruleopts_l : ruleopts_t",
"ruleopts_t : ruleopts ruleopts_t",
"ruleopts_t : ruleopts",
"ruleopts : METHOD STRING",
"ruleopts : COOKIE key_option STRING value",
"ruleopts : COOKIE key_option",
"ruleopts : HEADER key_option STRING value",
"ruleopts : HEADER key_option",
"ruleopts : PATH key_option STRING value",
"ruleopts : PATH key_option",
"ruleopts : QUERYSTR key_option STRING value",
"ruleopts : QUERYSTR key_option",
"ruleopts : URL key_option optdigest value",
"ruleopts : URL key_option",
"ruleopts : FORWARD TO table",
"ruleopts : TAG STRING",
"ruleopts : NO TAG",
"ruleopts : TAGGED STRING",
"ruleopts : LABEL STRING",
"ruleopts : NO LABEL",
"ruleopts : FILENAME STRING value",
"value :",
"value : VALUE STRING",
"key_option :",
"key_option : APPEND",
"key_option : SET",
"key_option : REMOVE",
"key_option : HASH",
"key_option : LOG",
"$$6 :",
"relay : RELAY STRING $$6 '{' optnl relayopts_l '}'",
"relayopts_l : relayopts_l relayoptsl nl",
"relayopts_l : relayoptsl optnl",
"relayoptsl : LISTEN ON STRING port opttls",
"relayoptsl : forwardmode opttlsclient TO forwardspec dstaf",
"relayoptsl : SESSION TIMEOUT NUMBER",
"relayoptsl : PROTO STRING",
"relayoptsl : DISABLE",
"relayoptsl : include",
"forwardspec : STRING port retry",
"forwardspec : NAT LOOKUP retry",
"forwardspec : DESTINATION retry",
"forwardspec : tablespec",
"dstmode :",
"dstmode : LOADBALANCE",
"dstmode : ROUNDROBIN",
"dstmode : HASH",
"dstmode : LEASTSTATES",
"dstmode : SRCHASH",
"dstmode : RANDOM",
"$$7 :",
"router : ROUTER STRING $$7 '{' optnl routeopts_l '}'",
"routeopts_l : routeopts_l routeoptsl nl",
"routeopts_l : routeoptsl optnl",
"routeoptsl : ROUTE address '/' NUMBER",
"routeoptsl : FORWARD TO tablespec",
"routeoptsl : RTABLE NUMBER",
"routeoptsl : RTLABEL STRING",
"routeoptsl : DISABLE",
"routeoptsl : include",
"dstaf :",
"dstaf : INET",
"dstaf : INET6 STRING",
"interface :",
"interface : INTERFACE STRING",
"$$8 :",
"host : address $$8 opthostflags",
"opthostflags :",
"opthostflags : hostflags_l",
"hostflags_l : hostflags hostflags_l",
"hostflags_l : hostflags",
"hostflags : RETRY NUMBER",
"hostflags : PARENT NUMBER",
"hostflags : PRIORITY NUMBER",
"hostflags : IP TTL NUMBER",
"address : STRING",
"retry :",
"retry : RETRY NUMBER",
"timeout : NUMBER",
"comma : ','",
"comma : nl",
"comma :",
"optnl : '\\n' optnl",
"optnl :",
"nl : '\\n' optnl",
"optstring : STRING",
"optstring :",
};
#endif
#ifdef YYSTACKSIZE
#undef YYMAXDEPTH
#define YYMAXDEPTH YYSTACKSIZE
#else
#ifdef YYMAXDEPTH
#define YYSTACKSIZE YYMAXDEPTH
#else
#define YYSTACKSIZE 10000
#define YYMAXDEPTH 10000
#endif
#endif
#define YYINITSTACKSIZE 200
/* LINTUSED */
int yydebug;
int yynerrs;
int yyerrflag;
int yychar;
short *yyssp;
YYSTYPE *yyvsp;
YYSTYPE yyval;
YYSTYPE yylval;
short *yyss;
short *yysslim;
YYSTYPE *yyvs;
unsigned int yystacksize;
int yyparse(void);
#line 2152 "parse.y"

struct keywords {
	const char	*k_name;
	int		 k_val;
};

int
yyerror(const char *fmt, ...)
{
	va_list		 ap;
	char		*msg;

	file->errors++;
	va_start(ap, fmt);
	if (vasprintf(&msg, fmt, ap) == -1)
		fatalx("yyerror vasprintf");
	va_end(ap);
	logit(LOG_CRIT, "%s:%d: %s", file->name, yylval.lineno, msg);
	free(msg);
	return (0);
}

int
kw_cmp(const void *k, const void *e)
{
	return (strcmp(k, ((const struct keywords *)e)->k_name));
}

int
lookup(char *s)
{
	/* this has to be sorted always */
	static const struct keywords keywords[] = {
		{ "all",		ALL },
		{ "append",		APPEND },
		{ "backlog",		BACKLOG },
		{ "backup",		BACKUP },
		{ "block",		BLOCK },
		{ "buffer",		BUFFER },
		{ "ca",			CA },
		{ "cache",		CACHE },
		{ "cert",		CERTIFICATE },
		{ "check",		CHECK },
		{ "ciphers",		CIPHERS },
		{ "code",		CODE },
		{ "cookie",		COOKIE },
		{ "curve",		CURVE },
		{ "demote",		DEMOTE },
		{ "destination",	DESTINATION },
		{ "digest",		DIGEST },
		{ "disable",		DISABLE },
		{ "ecdh",		ECDH },
		{ "edh",		EDH },
		{ "error",		ERROR },
		{ "expect",		EXPECT },
		{ "external",		EXTERNAL },
		{ "file",		FILENAME },
		{ "forward",		FORWARD },
		{ "from",		FROM },
		{ "hash",		HASH },
		{ "header",		HEADER },
		{ "host",		HOST },
		{ "icmp",		ICMP },
		{ "include",		INCLUDE },
		{ "inet",		INET },
		{ "inet6",		INET6 },
		{ "interface",		INTERFACE },
		{ "interval",		INTERVAL },
		{ "ip",			IP },
		{ "key",		KEY },
		{ "label",		LABEL },
		{ "least-states",	LEASTSTATES },
		{ "listen",		LISTEN },
		{ "loadbalance",	LOADBALANCE },
		{ "log",		LOG },
		{ "lookup",		LOOKUP },
		{ "match",		MATCH },
		{ "method",		METHOD },
		{ "mode",		MODE },
		{ "nat",		NAT },
		{ "no",			NO },
		{ "nodelay",		NODELAY },
		{ "nothing",		NOTHING },
		{ "on",			ON },
		{ "params",		PARAMS },
		{ "parent",		PARENT },
		{ "pass",		PASS },
		{ "password",		PASSWORD },
		{ "path",		PATH },
		{ "pftag",		PFTAG },
		{ "port",		PORT },
		{ "prefork",		PREFORK },
		{ "priority",		PRIORITY },
		{ "protocol",		PROTO },
		{ "query",		QUERYSTR },
		{ "quick",		QUICK },
		{ "random",		RANDOM },
		{ "real",		REAL },
		{ "redirect",		REDIRECT },
		{ "relay",		RELAY },
		{ "remove",		REMOVE },
		{ "request",		REQUEST },
		{ "response",		RESPONSE },
		{ "retry",		RETRY },
		{ "return",		RETURN },
		{ "roundrobin",		ROUNDROBIN },
		{ "route",		ROUTE },
		{ "router",		ROUTER },
		{ "rtable",		RTABLE },
		{ "rtlabel",		RTLABEL },
		{ "sack",		SACK },
		{ "script",		SCRIPT },
		{ "send",		SEND },
		{ "session",		SESSION },
		{ "set",		SET },
		{ "snmp",		SNMP },
		{ "socket",		SOCKET },
		{ "source-hash",	SRCHASH },
		{ "splice",		SPLICE },
		{ "ssl",		SSL },
		{ "sticky-address",	STICKYADDR },
		{ "style",		STYLE },
		{ "table",		TABLE },
		{ "tag",		TAG },
		{ "tagged",		TAGGED },
		{ "tcp",		TCP },
		{ "tickets",		TICKETS },
		{ "timeout",		TIMEOUT },
		{ "tls",		TLS },
		{ "to",			TO },
		{ "transparent",	TRANSPARENT },
		{ "trap",		TRAP },
		{ "ttl",		TTL },
		{ "updates",		UPDATES },
		{ "url",		URL },
		{ "value",		VALUE },
		{ "virtual",		VIRTUAL },
		{ "with",		WITH }
	};
	const struct keywords	*p;

	p = bsearch(s, keywords, sizeof(keywords)/sizeof(keywords[0]),
	    sizeof(keywords[0]), kw_cmp);

	if (p)
		return (p->k_val);
	else
		return (STRING);
}

#define MAXPUSHBACK	128

u_char	*parsebuf;
int	 parseindex;
u_char	 pushback_buffer[MAXPUSHBACK];
int	 pushback_index = 0;

int
lgetc(int quotec)
{
	int		c, next;

	if (parsebuf) {
		/* Read character from the parsebuffer instead of input. */
		if (parseindex >= 0) {
			c = parsebuf[parseindex++];
			if (c != '\0')
				return (c);
			parsebuf = NULL;
		} else
			parseindex++;
	}

	if (pushback_index)
		return (pushback_buffer[--pushback_index]);

	if (quotec) {
		if ((c = getc(file->stream)) == EOF) {
			yyerror("reached end of file while parsing "
			    "quoted string");
			if (file == topfile || popfile() == EOF)
				return (EOF);
			return (quotec);
		}
		return (c);
	}

	while ((c = getc(file->stream)) == '\\') {
		next = getc(file->stream);
		if (next != '\n') {
			c = next;
			break;
		}
		yylval.lineno = file->lineno;
		file->lineno++;
	}

	while (c == EOF) {
		if (file == topfile || popfile() == EOF)
			return (EOF);
		c = getc(file->stream);
	}
	return (c);
}

int
lungetc(int c)
{
	if (c == EOF)
		return (EOF);
	if (parsebuf) {
		parseindex--;
		if (parseindex >= 0)
			return (c);
	}
	if (pushback_index < MAXPUSHBACK-1)
		return (pushback_buffer[pushback_index++] = c);
	else
		return (EOF);
}

int
findeol(void)
{
	int	c;

	parsebuf = NULL;

	/* skip to either EOF or the first real EOL */
	while (1) {
		if (pushback_index)
			c = pushback_buffer[--pushback_index];
		else
			c = lgetc(0);
		if (c == '\n') {
			file->lineno++;
			break;
		}
		if (c == EOF)
			break;
	}
	return (ERROR);
}

int
yylex(void)
{
	u_char	 buf[8096];
	u_char	*p, *val;
	int	 quotec, next, c;
	int	 token;

top:
	p = buf;
	while ((c = lgetc(0)) == ' ' || c == '\t')
		; /* nothing */

	yylval.lineno = file->lineno;
	if (c == '#')
		while ((c = lgetc(0)) != '\n' && c != EOF)
			; /* nothing */
	if (c == '$' && parsebuf == NULL) {
		while (1) {
			if ((c = lgetc(0)) == EOF)
				return (0);

			if (p + 1 >= buf + sizeof(buf) - 1) {
				yyerror("string too long");
				return (findeol());
			}
			if (isalnum(c) || c == '_') {
				*p++ = c;
				continue;
			}
			*p = '\0';
			lungetc(c);
			break;
		}
		val = symget(buf);
		if (val == NULL) {
			yyerror("macro '%s' not defined", buf);
			return (findeol());
		}
		parsebuf = val;
		parseindex = 0;
		goto top;
	}

	switch (c) {
	case '\'':
	case '"':
		quotec = c;
		while (1) {
			if ((c = lgetc(quotec)) == EOF)
				return (0);
			if (c == '\n') {
				file->lineno++;
				continue;
			} else if (c == '\\') {
				if ((next = lgetc(quotec)) == EOF)
					return (0);
				if (next == quotec || c == ' ' || c == '\t')
					c = next;
				else if (next == '\n') {
					file->lineno++;
					continue;
				} else
					lungetc(next);
			} else if (c == quotec) {
				*p = '\0';
				break;
			} else if (c == '\0') {
				yyerror("syntax error");
				return (findeol());
			}
			if (p + 1 >= buf + sizeof(buf) - 1) {
				yyerror("string too long");
				return (findeol());
			}
			*p++ = c;
		}
		yylval.v.string = strdup(buf);
		if (yylval.v.string == NULL)
			err(1, "yylex: strdup");
		return (STRING);
	}

#define allowed_to_end_number(x) \
	(isspace(x) || x == ')' || x ==',' || x == '/' || x == '}' || x == '=')

	if (c == '-' || isdigit(c)) {
		do {
			*p++ = c;
			if ((unsigned)(p-buf) >= sizeof(buf)) {
				yyerror("string too long");
				return (findeol());
			}
		} while ((c = lgetc(0)) != EOF && isdigit(c));
		lungetc(c);
		if (p == buf + 1 && buf[0] == '-')
			goto nodigits;
		if (c == EOF || allowed_to_end_number(c)) {
			const char *errstr = NULL;

			*p = '\0';
			yylval.v.number = strtonum(buf, LLONG_MIN,
			    LLONG_MAX, &errstr);
			if (errstr) {
				yyerror("\"%s\" invalid number: %s",
				    buf, errstr);
				return (findeol());
			}
			return (NUMBER);
		} else {
nodigits:
			while (p > buf + 1)
				lungetc(*--p);
			c = *--p;
			if (c == '-')
				return (c);
		}
	}

#define allowed_in_string(x) \
	(isalnum(x) || (ispunct(x) && x != '(' && x != ')' && \
	x != '{' && x != '}' && x != '<' && x != '>' && \
	x != '!' && x != '=' && x != '#' && \
	x != ',' && x != '/'))

	if (isalnum(c) || c == ':' || c == '_') {
		do {
			*p++ = c;
			if ((unsigned)(p-buf) >= sizeof(buf)) {
				yyerror("string too long");
				return (findeol());
			}
		} while ((c = lgetc(0)) != EOF && (allowed_in_string(c)));
		lungetc(c);
		*p = '\0';
		if ((token = lookup(buf)) == STRING)
			if ((yylval.v.string = strdup(buf)) == NULL)
				err(1, "yylex: strdup");
		return (token);
	}
	if (c == '\n') {
		yylval.lineno = file->lineno;
		file->lineno++;
	}
	if (c == EOF)
		return (0);
	return (c);
}

int
check_file_secrecy(int fd, const char *fname)
{
	struct stat	st;

	if (fstat(fd, &st)) {
		log_warn("cannot stat %s", fname);
		return (-1);
	}
	if (st.st_uid != 0 && st.st_uid != getuid()) {
		log_warnx("%s: owner not root or current user", fname);
		return (-1);
	}
	if (st.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)) {
		log_warnx("%s: group writable or world read/writable", fname);
		return (-1);
	}
	return (0);
}

struct file *
pushfile(const char *name, int secret)
{
	struct file	*nfile;

	if ((nfile = calloc(1, sizeof(struct file))) == NULL) {
		log_warn("%s: malloc", __func__);
		return (NULL);
	}
	if ((nfile->name = strdup(name)) == NULL) {
		log_warn("%s: malloc", __func__);
		free(nfile);
		return (NULL);
	}
	if ((nfile->stream = fopen(nfile->name, "r")) == NULL) {
		log_warn("%s: %s", __func__, nfile->name);
		free(nfile->name);
		free(nfile);
		return (NULL);
	} else if (secret &&
	    check_file_secrecy(fileno(nfile->stream), nfile->name)) {
		fclose(nfile->stream);
		free(nfile->name);
		free(nfile);
		return (NULL);
	}
	nfile->lineno = 1;
	TAILQ_INSERT_TAIL(&files, nfile, entry);
	return (nfile);
}

int
popfile(void)
{
	struct file	*prev;

	if ((prev = TAILQ_PREV(file, files, entry)) != NULL)
		prev->errors += file->errors;

	TAILQ_REMOVE(&files, file, entry);
	fclose(file->stream);
	free(file->name);
	free(file);
	file = prev;
	return (file ? 0 : EOF);
}

int
parse_config(const char *filename, struct relayd *x_conf)
{
	struct sym	*sym, *next;

	conf = x_conf;
	if (config_init(conf) == -1) {
		log_warn("%s: cannot initialize configuration", __func__);
		return (-1);
	}

	errors = 0;

	if ((file = pushfile(filename, 0)) == NULL)
		return (-1);

	topfile = file;
	setservent(1);

	yyparse();
	errors = file->errors;
	popfile();

	endservent();
	endprotoent();

	/* Free macros */
	TAILQ_FOREACH_SAFE(sym, &symhead, entry, next) {
		if (!sym->persist) {
			free(sym->nam);
			free(sym->val);
			TAILQ_REMOVE(&symhead, sym, entry);
			free(sym);
		}
	}

	return (errors ? -1 : 0);
}

int
load_config(const char *filename, struct relayd *x_conf)
{
	struct sym		*sym, *next;
	struct table		*nexttb;
	struct host		*h, *ph;
	struct relay_table	*rlt;

	conf = x_conf;
	conf->sc_conf.flags = 0;

	loadcfg = 1;
	errors = 0;
	last_host_id = last_table_id = last_rdr_id = last_proto_id =
	    last_relay_id = last_rt_id = last_nr_id = 0;

	rdr = NULL;
	table = NULL;
	rlay = NULL;
	proto = NULL;
	router = NULL;

	if ((file = pushfile(filename, 0)) == NULL)
		return (-1);

	topfile = file;
	setservent(1);

	yyparse();
	errors = file->errors;
	popfile();

	endservent();
	endprotoent();

	/* Free macros and check which have not been used. */
	for (sym = TAILQ_FIRST(&symhead); sym != NULL; sym = next) {
		next = TAILQ_NEXT(sym, entry);
		if ((conf->sc_conf.opts & RELAYD_OPT_VERBOSE) && !sym->used)
			fprintf(stderr, "warning: macro '%s' not "
			    "used\n", sym->nam);
		if (!sym->persist) {
			free(sym->nam);
			free(sym->val);
			TAILQ_REMOVE(&symhead, sym, entry);
			free(sym);
		}
	}

	if (TAILQ_EMPTY(conf->sc_rdrs) &&
	    TAILQ_EMPTY(conf->sc_relays) &&
	    TAILQ_EMPTY(conf->sc_rts)) {
		log_warnx("no actions, nothing to do");
		errors++;
	}

	/* Cleanup relay list to inherit */
	while ((rlay = TAILQ_FIRST(&relays)) != NULL) {
		TAILQ_REMOVE(&relays, rlay, rl_entry);
		while ((rlt = TAILQ_FIRST(&rlay->rl_tables))) {
			TAILQ_REMOVE(&rlay->rl_tables, rlt, rlt_entry);
			free(rlt);
		}
		free(rlay);
	}

	if (timercmp(&conf->sc_conf.timeout, &conf->sc_conf.interval, >=)) {
		log_warnx("global timeout exceeds interval");
		errors++;
	}

	/* Verify that every table is used */
	for (table = TAILQ_FIRST(conf->sc_tables); table != NULL;
	     table = nexttb) {
		nexttb = TAILQ_NEXT(table, entry);
		if (table->conf.port == 0) {
			TAILQ_REMOVE(conf->sc_tables, table, entry);
			while ((h = TAILQ_FIRST(&table->hosts)) != NULL) {
				TAILQ_REMOVE(&table->hosts, h, entry);
				free(h);
			}
			if (table->sendbuf != NULL)
				free(table->sendbuf);
			free(table);
			continue;
		}

		TAILQ_FOREACH(h, &table->hosts, entry) {
			if (h->conf.parentid) {
				ph = host_find(conf, h->conf.parentid);

				/* Validate the parent id */
				if (h->conf.id == h->conf.parentid ||
				    ph == NULL || ph->conf.parentid)
					ph = NULL;

				if (ph == NULL) {
					log_warnx("host parent id %d invalid",
					    h->conf.parentid);
					errors++;
				} else
					SLIST_INSERT_HEAD(&ph->children,
					    h, child);
			}
		}

		if (!(table->conf.flags & F_USED)) {
			log_warnx("unused table: %s", table->conf.name);
			errors++;
		}
		if (timercmp(&table->conf.timeout,
		    &conf->sc_conf.interval, >=)) {
			log_warnx("table timeout exceeds interval: %s",
			    table->conf.name);
			errors++;
		}
	}

	/* Verify that every non-default protocol is used */
	TAILQ_FOREACH(proto, conf->sc_protos, entry) {
		if (!(proto->flags & F_USED)) {
			log_warnx("unused protocol: %s", proto->name);
		}
	}

	return (errors ? -1 : 0);
}

int
symset(const char *nam, const char *val, int persist)
{
	struct sym	*sym;

	TAILQ_FOREACH(sym, &symhead, entry) {
		if (strcmp(nam, sym->nam) == 0)
			break;
	}

	if (sym != NULL) {
		if (sym->persist == 1)
			return (0);
		else {
			free(sym->nam);
			free(sym->val);
			TAILQ_REMOVE(&symhead, sym, entry);
			free(sym);
		}
	}
	if ((sym = calloc(1, sizeof(*sym))) == NULL)
		return (-1);

	sym->nam = strdup(nam);
	if (sym->nam == NULL) {
		free(sym);
		return (-1);
	}
	sym->val = strdup(val);
	if (sym->val == NULL) {
		free(sym->nam);
		free(sym);
		return (-1);
	}
	sym->used = 0;
	sym->persist = persist;
	TAILQ_INSERT_TAIL(&symhead, sym, entry);
	return (0);
}

int
cmdline_symset(char *s)
{
	char	*sym, *val;
	int	ret;
	size_t	len;

	if ((val = strrchr(s, '=')) == NULL)
		return (-1);

	len = strlen(s) - strlen(val) + 1;
	if ((sym = malloc(len)) == NULL)
		errx(1, "cmdline_symset: malloc");

	(void)strlcpy(sym, s, len);

	ret = symset(sym, val + 1, 1);
	free(sym);

	return (ret);
}

char *
symget(const char *nam)
{
	struct sym	*sym;

	TAILQ_FOREACH(sym, &symhead, entry) {
		if (strcmp(nam, sym->nam) == 0) {
			sym->used = 1;
			return (sym->val);
		}
	}
	return (NULL);
}

struct address *
host_v4(const char *s)
{
	struct in_addr		 ina;
	struct sockaddr_in	*sain;
	struct address		*h;

	bzero(&ina, sizeof(ina));
	if (inet_pton(AF_INET, s, &ina) != 1)
		return (NULL);

	if ((h = calloc(1, sizeof(*h))) == NULL)
		fatal(__func__);
	sain = (struct sockaddr_in *)&h->ss;
	sain->sin_len = sizeof(struct sockaddr_in);
	sain->sin_family = AF_INET;
	sain->sin_addr.s_addr = ina.s_addr;

	return (h);
}

struct address *
host_v6(const char *s)
{
	struct addrinfo		 hints, *res;
	struct sockaddr_in6	*sa_in6;
	struct address		*h = NULL;

	bzero(&hints, sizeof(hints));
	hints.ai_family = AF_INET6;
	hints.ai_socktype = SOCK_DGRAM; /* dummy */
	hints.ai_flags = AI_NUMERICHOST;
	if (getaddrinfo(s, "0", &hints, &res) == 0) {
		if ((h = calloc(1, sizeof(*h))) == NULL)
			fatal(__func__);
		sa_in6 = (struct sockaddr_in6 *)&h->ss;
		sa_in6->sin6_len = sizeof(struct sockaddr_in6);
		sa_in6->sin6_family = AF_INET6;
		memcpy(&sa_in6->sin6_addr,
		    &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr,
		    sizeof(sa_in6->sin6_addr));
		sa_in6->sin6_scope_id =
		    ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id;

		freeaddrinfo(res);
	}

	return (h);
}

int
host_dns(const char *s, struct addresslist *al, int max,
    struct portrange *port, const char *ifname, int ipproto)
{
	struct addrinfo		 hints, *res0, *res;
	int			 error, cnt = 0;
	struct sockaddr_in	*sain;
	struct sockaddr_in6	*sin6;
	struct address		*h;

	if ((cnt = host_if(s, al, max, port, ifname, ipproto)) != 0)
		return (cnt);

	bzero(&hints, sizeof(hints));
	hints.ai_family = PF_UNSPEC;
	hints.ai_socktype = SOCK_DGRAM; /* DUMMY */
	hints.ai_flags = AI_ADDRCONFIG;
	error = getaddrinfo(s, NULL, &hints, &res0);
	if (error == EAI_AGAIN || error == EAI_NODATA || error == EAI_NONAME)
		return (0);
	if (error) {
		log_warnx("%s: could not parse \"%s\": %s", __func__, s,
		    gai_strerror(error));
		return (-1);
	}

	for (res = res0; res && cnt < max; res = res->ai_next) {
		if (res->ai_family != AF_INET &&
		    res->ai_family != AF_INET6)
			continue;
		if ((h = calloc(1, sizeof(*h))) == NULL)
			fatal(__func__);

		if (port != NULL)
			bcopy(port, &h->port, sizeof(h->port));
		if (ifname != NULL) {
			if (strlcpy(h->ifname, ifname, sizeof(h->ifname)) >=
			    sizeof(h->ifname))
				log_warnx("%s: interface name truncated",
				    __func__);
			freeaddrinfo(res0);
			free(h);
			return (-1);
		}
		if (ipproto != -1)
			h->ipproto = ipproto;
		h->ss.ss_family = res->ai_family;

		if (res->ai_family == AF_INET) {
			sain = (struct sockaddr_in *)&h->ss;
			sain->sin_len = sizeof(struct sockaddr_in);
			sain->sin_addr.s_addr = ((struct sockaddr_in *)
			    res->ai_addr)->sin_addr.s_addr;
		} else {
			sin6 = (struct sockaddr_in6 *)&h->ss;
			sin6->sin6_len = sizeof(struct sockaddr_in6);
			memcpy(&sin6->sin6_addr, &((struct sockaddr_in6 *)
			    res->ai_addr)->sin6_addr, sizeof(struct in6_addr));
		}

		TAILQ_INSERT_HEAD(al, h, entry);
		cnt++;
	}
	if (cnt == max && res) {
		log_warnx("%s: %s resolves to more than %d hosts", __func__,
		    s, max);
	}
	freeaddrinfo(res0);
	return (cnt);
}

int
host_if(const char *s, struct addresslist *al, int max,
    struct portrange *port, const char *ifname, int ipproto)
{
	struct ifaddrs		*ifap, *p;
	struct sockaddr_in	*sain;
	struct sockaddr_in6	*sin6;
	struct address		*h;
	int			 cnt = 0, af;

	if (getifaddrs(&ifap) == -1)
		fatal("getifaddrs");

	/* First search for IPv4 addresses */
	af = AF_INET;

 nextaf:
	for (p = ifap; p != NULL && cnt < max; p = p->ifa_next) {
		if (p->ifa_addr->sa_family != af ||
		    (strcmp(s, p->ifa_name) != 0 &&
		    !is_if_in_group(p->ifa_name, s)))
			continue;
		if ((h = calloc(1, sizeof(*h))) == NULL)
			fatal("calloc");

		if (port != NULL)
			bcopy(port, &h->port, sizeof(h->port));
		if (ifname != NULL) {
			if (strlcpy(h->ifname, ifname, sizeof(h->ifname)) >=
			    sizeof(h->ifname))
				log_warnx("%s: interface name truncated",
				    __func__);
			freeifaddrs(ifap);
			return (-1);
		}
		if (ipproto != -1)
			h->ipproto = ipproto;
		h->ss.ss_family = af;

		if (af == AF_INET) {
			sain = (struct sockaddr_in *)&h->ss;
			sain->sin_len = sizeof(struct sockaddr_in);
			sain->sin_addr.s_addr = ((struct sockaddr_in *)
			    p->ifa_addr)->sin_addr.s_addr;
		} else {
			sin6 = (struct sockaddr_in6 *)&h->ss;
			sin6->sin6_len = sizeof(struct sockaddr_in6);
			memcpy(&sin6->sin6_addr, &((struct sockaddr_in6 *)
			    p->ifa_addr)->sin6_addr, sizeof(struct in6_addr));
			sin6->sin6_scope_id = ((struct sockaddr_in6 *)
			    p->ifa_addr)->sin6_scope_id;
		}

		TAILQ_INSERT_HEAD(al, h, entry);
		cnt++;
	}
	if (af == AF_INET) {
		/* Next search for IPv6 addresses */
		af = AF_INET6;
		goto nextaf;
	}

	if (cnt > max) {
		log_warnx("%s: %s resolves to more than %d hosts", __func__,
		    s, max);
	}
	freeifaddrs(ifap);
	return (cnt);
}

int
host(const char *s, struct addresslist *al, int max,
    struct portrange *port, const char *ifname, int ipproto)
{
	struct address *h;

	h = host_v4(s);

	/* IPv6 address? */
	if (h == NULL)
		h = host_v6(s);

	if (h != NULL) {
		if (port != NULL)
			bcopy(port, &h->port, sizeof(h->port));
		if (ifname != NULL) {
			if (strlcpy(h->ifname, ifname, sizeof(h->ifname)) >=
			    sizeof(h->ifname)) {
				log_warnx("%s: interface name truncated",
				    __func__);
				free(h);
				return (-1);
			}
		}
		if (ipproto != -1)
			h->ipproto = ipproto;

		TAILQ_INSERT_HEAD(al, h, entry);
		return (1);
	}

	return (host_dns(s, al, max, port, ifname, ipproto));
}

void
host_free(struct addresslist *al)
{
	struct address	 *h;

	while ((h = TAILQ_FIRST(al)) != NULL) {
		TAILQ_REMOVE(al, h, entry);
		free(h);
	}
}

struct table *
table_inherit(struct table *tb)
{
	char		pname[TABLE_NAME_SIZE + 6];
	struct host	*h, *dsth;
	struct table	*dsttb, *oldtb;

	/* Get the table or table template */
	if ((dsttb = table_findbyname(conf, tb->conf.name)) == NULL) {
		yyerror("unknown table %s", tb->conf.name);
		goto fail;
	}
	if (dsttb->conf.port != 0)
		fatal("invalid table");	/* should not happen */

	if (tb->conf.port == 0) {
		yyerror("invalid port");
		goto fail;
	}

	/* Check if a matching table already exists */
	if (snprintf(pname, sizeof(pname), "%s:%u",
	    tb->conf.name, ntohs(tb->conf.port)) >= (int)sizeof(pname)) {
		yyerror("invalid table name");
		goto fail;
	}
	if (strlcpy(tb->conf.name, pname, sizeof(tb->conf.name)) >=
	    sizeof(tb->conf.name)) {
		yyerror("invalid table mame");
		goto fail;
	}
	if ((oldtb = table_findbyconf(conf, tb)) != NULL) {
		purge_table(conf, NULL, tb);
		return (oldtb);
	}

	/* Create a new table */
	tb->conf.id = ++last_table_id;
	if (last_table_id == INT_MAX) {
		yyerror("too many tables defined");
		goto fail;
	}
	tb->conf.flags |= dsttb->conf.flags;

	/* Inherit global table options */
	if (tb->conf.timeout.tv_sec == 0 && tb->conf.timeout.tv_usec == 0)
		bcopy(&dsttb->conf.timeout, &tb->conf.timeout,
		    sizeof(struct timeval));

	/* Copy the associated hosts */
	TAILQ_INIT(&tb->hosts);
	TAILQ_FOREACH(dsth, &dsttb->hosts, entry) {
		if ((h = (struct host *)
		    calloc(1, sizeof (*h))) == NULL)
			fatal("out of memory");
		bcopy(dsth, h, sizeof(*h));
		h->conf.id = ++last_host_id;
		if (last_host_id == INT_MAX) {
			yyerror("too many hosts defined");
			free(h);
			goto fail;
		}
		h->conf.tableid = tb->conf.id;
		h->tablename = tb->conf.name;
		SLIST_INIT(&h->children);
		TAILQ_INSERT_TAIL(&tb->hosts, h, entry);
		TAILQ_INSERT_TAIL(&conf->sc_hosts, h, globalentry);
	}

	conf->sc_tablecount++;
	TAILQ_INSERT_TAIL(conf->sc_tables, tb, entry);

	return (tb);

 fail:
	purge_table(conf, NULL, tb);
	return (NULL);
}

int
relay_id(struct relay *rl)
{
	rl->rl_conf.id = ++last_relay_id;
	rl->rl_conf.tls_keyid = ++last_key_id;
	rl->rl_conf.tls_cakeyid = ++last_key_id;

	if (last_relay_id == INT_MAX || last_key_id == INT_MAX)
		return (-1);

	return (0);
}

struct relay *
relay_inherit(struct relay *ra, struct relay *rb)
{
	struct relay_config	 rc;
	struct relay_table	*rta, *rtb;

	bcopy(&rb->rl_conf, &rc, sizeof(rc));
	bcopy(ra, rb, sizeof(*rb));

	bcopy(&rc.ss, &rb->rl_conf.ss, sizeof(rb->rl_conf.ss));
	rb->rl_conf.port = rc.port;
	rb->rl_conf.flags =
	    (ra->rl_conf.flags & ~F_TLS) | (rc.flags & F_TLS);
	if (!(rb->rl_conf.flags & F_TLS)) {
		rb->rl_tls_cert = NULL;
		rb->rl_conf.tls_cert_len = 0;
		rb->rl_tls_key = NULL;
		rb->rl_conf.tls_key_len = 0;
	}
	TAILQ_INIT(&rb->rl_tables);

	if (relay_id(rb) == -1) {
		yyerror("too many relays defined");
		goto err;
	}

	if (snprintf(rb->rl_conf.name, sizeof(rb->rl_conf.name), "%s%u:%u",
	    ra->rl_conf.name, rb->rl_conf.id, ntohs(rc.port)) >=
	    (int)sizeof(rb->rl_conf.name)) {
		yyerror("invalid relay name");
		goto err;
	}

	if (relay_findbyname(conf, rb->rl_conf.name) != NULL ||
	    relay_findbyaddr(conf, &rb->rl_conf) != NULL) {
		yyerror("relay %s defined twice", rb->rl_conf.name);
		goto err;
	}
	if (relay_load_certfiles(rb) == -1) {
		yyerror("cannot load certificates for relay %s",
		    rb->rl_conf.name);
		goto err;
	}

	TAILQ_FOREACH(rta, &ra->rl_tables, rlt_entry) {
		if ((rtb = calloc(1, sizeof(*rtb))) == NULL) {
			yyerror("cannot allocate relay table");
			goto err;
		}
		rtb->rlt_table = rta->rlt_table;
		rtb->rlt_mode = rta->rlt_mode;
		rtb->rlt_flags = rta->rlt_flags;

		TAILQ_INSERT_TAIL(&rb->rl_tables, rtb, rlt_entry);
	}

	conf->sc_relaycount++;
	SPLAY_INIT(&rlay->rl_sessions);
	TAILQ_INSERT_TAIL(conf->sc_relays, rb, rl_entry);

	return (rb);

 err:
	while ((rtb = TAILQ_FIRST(&rb->rl_tables))) {
		TAILQ_REMOVE(&rb->rl_tables, rtb, rlt_entry);
		free(rtb);
	}
	free(rb);
	return (NULL);
}

int
getservice(char *n)
{
	struct servent	*s;
	const char	*errstr;
	long long	 llval;

	llval = strtonum(n, 0, UINT16_MAX, &errstr);
	if (errstr) {
		s = getservbyname(n, "tcp");
		if (s == NULL)
			s = getservbyname(n, "udp");
		if (s == NULL) {
			yyerror("unknown port %s", n);
			return (-1);
		}
		return (s->s_port);
	}

	return (htons((u_short)llval));
}

int
is_if_in_group(const char *ifname, const char *groupname)
{
	unsigned int		 len;
	struct ifgroupreq	 ifgr;
	struct ifg_req		*ifg;
	int			 s;
	int			 ret = 0;

	if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
		err(1, "socket");

	memset(&ifgr, 0, sizeof(ifgr));
	if (strlcpy(ifgr.ifgr_name, ifname, IFNAMSIZ) >= IFNAMSIZ)
		err(1, "IFNAMSIZ");
	if (ioctl(s, SIOCGIFGROUP, (caddr_t)&ifgr) == -1) {
		if (errno == EINVAL || errno == ENOTTY)
			goto end;
		err(1, "SIOCGIFGROUP");
	}

	len = ifgr.ifgr_len;
	ifgr.ifgr_groups = calloc(len / sizeof(struct ifg_req),
	    sizeof(struct ifg_req));
	if (ifgr.ifgr_groups == NULL)
		err(1, "getifgroups");
	if (ioctl(s, SIOCGIFGROUP, (caddr_t)&ifgr) == -1)
		err(1, "SIOCGIFGROUP");

	ifg = ifgr.ifgr_groups;
	for (; ifg && len >= sizeof(struct ifg_req); ifg++) {
		len -= sizeof(struct ifg_req);
		if (strcmp(ifg->ifgrq_group, groupname) == 0) {
			ret = 1;
			break;
		}
	}
	free(ifgr.ifgr_groups);

end:
	close(s);
	return (ret);
}
#line 2210 "parse.c"
/* allocate initial stack or double stack size, up to YYMAXDEPTH */
static int yygrowstack(void)
{
    unsigned int newsize;
    long sslen;
    short *newss;
    YYSTYPE *newvs;

    if ((newsize = yystacksize) == 0)
        newsize = YYINITSTACKSIZE;
    else if (newsize >= YYMAXDEPTH)
        return -1;
    else if ((newsize *= 2) > YYMAXDEPTH)
        newsize = YYMAXDEPTH;
    sslen = yyssp - yyss;
#ifdef SIZE_MAX
#define YY_SIZE_MAX SIZE_MAX
#else
#define YY_SIZE_MAX 0xffffffffU
#endif
    if (newsize && YY_SIZE_MAX / newsize < sizeof *newss)
        goto bail;
    newss = yyss ? (short *)realloc(yyss, newsize * sizeof *newss) :
      (short *)malloc(newsize * sizeof *newss); /* overflow check above */
    if (newss == NULL)
        goto bail;
    yyss = newss;
    yyssp = newss + sslen;
    if (newsize && YY_SIZE_MAX / newsize < sizeof *newvs)
        goto bail;
    newvs = yyvs ? (YYSTYPE *)realloc(yyvs, newsize * sizeof *newvs) :
      (YYSTYPE *)malloc(newsize * sizeof *newvs); /* overflow check above */
    if (newvs == NULL)
        goto bail;
    yyvs = newvs;
    yyvsp = newvs + sslen;
    yystacksize = newsize;
    yysslim = yyss + newsize - 1;
    return 0;
bail:
    if (yyss)
            free(yyss);
    if (yyvs)
            free(yyvs);
    yyss = yyssp = NULL;
    yyvs = yyvsp = NULL;
    yystacksize = 0;
    return -1;
}

#define YYABORT goto yyabort
#define YYREJECT goto yyabort
#define YYACCEPT goto yyaccept
#define YYERROR goto yyerrlab
int
yyparse(void)
{
    int yym, yyn, yystate;
#if YYDEBUG
    const char *yys;

    if ((yys = getenv("YYDEBUG")))
    {
        yyn = *yys;
        if (yyn >= '0' && yyn <= '9')
            yydebug = yyn - '0';
    }
#endif /* YYDEBUG */

    yynerrs = 0;
    yyerrflag = 0;
    yychar = (-1);

    if (yyss == NULL && yygrowstack()) goto yyoverflow;
    yyssp = yyss;
    yyvsp = yyvs;
    *yyssp = yystate = 0;

yyloop:
    if ((yyn = yydefred[yystate]) != 0) goto yyreduce;
    if (yychar < 0)
    {
        if ((yychar = yylex()) < 0) yychar = 0;
#if YYDEBUG
        if (yydebug)
        {
            yys = 0;
            if (yychar <= YYMAXTOKEN) yys = yyname[yychar];
            if (!yys) yys = "illegal-symbol";
            printf("%sdebug: state %d, reading %d (%s)\n",
                    YYPREFIX, yystate, yychar, yys);
        }
#endif
    }
    if ((yyn = yysindex[yystate]) && (yyn += yychar) >= 0 &&
            yyn <= YYTABLESIZE && yycheck[yyn] == yychar)
    {
#if YYDEBUG
        if (yydebug)
            printf("%sdebug: state %d, shifting to state %d\n",
                    YYPREFIX, yystate, yytable[yyn]);
#endif
        if (yyssp >= yysslim && yygrowstack())
        {
            goto yyoverflow;
        }
        *++yyssp = yystate = yytable[yyn];
        *++yyvsp = yylval;
        yychar = (-1);
        if (yyerrflag > 0)  --yyerrflag;
        goto yyloop;
    }
    if ((yyn = yyrindex[yystate]) && (yyn += yychar) >= 0 &&
            yyn <= YYTABLESIZE && yycheck[yyn] == yychar)
    {
        yyn = yytable[yyn];
        goto yyreduce;
    }
    if (yyerrflag) goto yyinrecovery;
#if defined(__GNUC__)
    goto yynewerror;
#endif
yynewerror:
    yyerror("syntax error");
#if defined(__GNUC__)
    goto yyerrlab;
#endif
yyerrlab:
    ++yynerrs;
yyinrecovery:
    if (yyerrflag < 3)
    {
        yyerrflag = 3;
        for (;;)
        {
            if ((yyn = yysindex[*yyssp]) && (yyn += YYERRCODE) >= 0 &&
                    yyn <= YYTABLESIZE && yycheck[yyn] == YYERRCODE)
            {
#if YYDEBUG
                if (yydebug)
                    printf("%sdebug: state %d, error recovery shifting\
 to state %d\n", YYPREFIX, *yyssp, yytable[yyn]);
#endif
                if (yyssp >= yysslim && yygrowstack())
                {
                    goto yyoverflow;
                }
                *++yyssp = yystate = yytable[yyn];
                *++yyvsp = yylval;
                goto yyloop;
            }
            else
            {
#if YYDEBUG
                if (yydebug)
                    printf("%sdebug: error recovery discarding state %d\n",
                            YYPREFIX, *yyssp);
#endif
                if (yyssp <= yyss) goto yyabort;
                --yyssp;
                --yyvsp;
            }
        }
    }
    else
    {
        if (yychar == 0) goto yyabort;
#if YYDEBUG
        if (yydebug)
        {
            yys = 0;
            if (yychar <= YYMAXTOKEN) yys = yyname[yychar];
            if (!yys) yys = "illegal-symbol";
            printf("%sdebug: state %d, error recovery discards token %d (%s)\n",
                    YYPREFIX, yystate, yychar, yys);
        }
#endif
        yychar = (-1);
        goto yyloop;
    }
yyreduce:
#if YYDEBUG
    if (yydebug)
        printf("%sdebug: state %d, reducing by rule %d (%s)\n",
                YYPREFIX, yystate, yyn, yyrule[yyn]);
#endif
    yym = yylen[yyn];
    if (yym)
        yyval = yyvsp[1-yym];
    else
        memset(&yyval, 0, sizeof yyval);
    switch (yyn)
    {
case 11:
#line 205 "parse.y"
{ file->errors++; }
break;
case 12:
#line 208 "parse.y"
{
			struct file	*nfile;

			if ((nfile = pushfile(yyvsp[0].v.string, 0)) == NULL) {
				yyerror("failed to include file %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);

			file = nfile;
			lungetc('\n');
		}
break;
case 13:
#line 223 "parse.y"
{
			log_warnx("%s:%d: %s",
			    file->name, yylval.lineno,
			    "please use the \"tls\" keyword"
			    " instead of \"ssl\"");
		}
break;
case 15:
#line 232 "parse.y"
{ yyval.v.number = 0; }
break;
case 16:
#line 233 "parse.y"
{ yyval.v.number = 1; }
break;
case 17:
#line 236 "parse.y"
{ yyval.v.number = 0; }
break;
case 18:
#line 237 "parse.y"
{ yyval.v.number = 1; }
break;
case 19:
#line 240 "parse.y"
{
			if (strcmp("https", yyvsp[0].v.string) == 0) {
				yyval.v.number = 1;
			} else if (strcmp("http", yyvsp[0].v.string) == 0) {
				yyval.v.number = 0;
			} else {
				yyerror("invalid check type: %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 20:
#line 254 "parse.y"
{
			yyval.v.string = strdup("");
			if (yyval.v.string == NULL)
				fatal("calloc");
		}
break;
case 21:
#line 259 "parse.y"
{
			if (asprintf(&yyval.v.string, "Host: %s\r\nConnection: close\r\n",
			    yyvsp[0].v.string) == -1)
				fatal("asprintf");
		}
break;
case 22:
#line 266 "parse.y"
{ yyval.v.number = RELAY_PROTO_TCP; }
break;
case 23:
#line 267 "parse.y"
{ yyval.v.number = RELAY_PROTO_TCP; }
break;
case 24:
#line 268 "parse.y"
{
			if (strcmp("http", yyvsp[0].v.string) == 0) {
				yyval.v.number = RELAY_PROTO_HTTP;
			} else if (strcmp("dns", yyvsp[0].v.string) == 0) {
				yyval.v.number = RELAY_PROTO_DNS;
			} else {
				yyerror("invalid protocol type: %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 25:
#line 282 "parse.y"
{ yyval.v.number = IPPROTO_TCP; }
break;
case 26:
#line 283 "parse.y"
{ yyval.v.number = IPPROTO_TCP; }
break;
case 27:
#line 284 "parse.y"
{
			struct protoent	*p;

			if ((p = getprotobyname(yyvsp[0].v.string)) == NULL) {
				yyerror("invalid protocol: %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);

			yyval.v.number = p->p_proto;
		}
break;
case 32:
#line 307 "parse.y"
{
			if ((proto->style = strdup(yyvsp[0].v.string)) == NULL)
				fatal("out of memory");
			free(yyvsp[0].v.string);
		}
break;
case 33:
#line 314 "parse.y"
{
			char		*a, *b;
			int		 p[2];

			p[0] = p[1] = 0;

			a = yyvsp[0].v.string;
			b = strchr(yyvsp[0].v.string, ':');
			if (b == NULL)
				yyval.v.port.op = PF_OP_EQ;
			else {
				*b++ = '\0';
				if ((p[1] = getservice(b)) == -1) {
					free(yyvsp[0].v.string);
					YYERROR;
				}
				yyval.v.port.op = PF_OP_RRG;
			}
			if ((p[0] = getservice(a)) == -1) {
				free(yyvsp[0].v.string);
				YYERROR;
			}
			yyval.v.port.val[0] = p[0];
			yyval.v.port.val[1] = p[1];
			free(yyvsp[0].v.string);
		}
break;
case 34:
#line 340 "parse.y"
{
			if (yyvsp[0].v.number <= 0 || yyvsp[0].v.number > (int)USHRT_MAX) {
				yyerror("invalid port: %d", yyvsp[0].v.number);
				YYERROR;
			}
			yyval.v.port.val[0] = htons(yyvsp[0].v.number);
			yyval.v.port.op = PF_OP_EQ;
		}
break;
case 35:
#line 350 "parse.y"
{
			char *s = yyvsp[-2].v.string;
			while (*s++) {
				if (isspace((unsigned char)*s)) {
					yyerror("macro name cannot contain "
					    "whitespace");
					YYERROR;
				}
			}
			if (symset(yyvsp[-2].v.string, yyvsp[0].v.string, 0) == -1)
				fatal("cannot store variable");
			free(yyvsp[-2].v.string);
			free(yyvsp[0].v.string);
		}
break;
case 36:
#line 366 "parse.y"
{
			table->sendbuf = NULL;
		}
break;
case 37:
#line 369 "parse.y"
{
			table->sendbuf = strdup(yyvsp[0].v.string);
			if (table->sendbuf == NULL)
				fatal("out of memory");
			free(yyvsp[0].v.string);
		}
break;
case 38:
#line 377 "parse.y"
{
			if ((conf->sc_conf.interval.tv_sec = yyvsp[0].v.number) < 0) {
				yyerror("invalid interval: %d", yyvsp[0].v.number);
				YYERROR;
			}
		}
break;
case 39:
#line 383 "parse.y"
{
			conf->sc_conf.opts |= yyvsp[0].v.number;
		}
break;
case 40:
#line 386 "parse.y"
{
			bcopy(&yyvsp[0].v.tv, &conf->sc_conf.timeout,
			    sizeof(struct timeval));
		}
break;
case 41:
#line 390 "parse.y"
{
			if (yyvsp[0].v.number <= 0 || yyvsp[0].v.number > PROC_MAX_INSTANCES) {
				yyerror("invalid number of preforked "
				    "relays: %d", yyvsp[0].v.number);
				YYERROR;
			}
			conf->sc_conf.prefork_relay = yyvsp[0].v.number;
		}
break;
case 42:
#line 398 "parse.y"
{
			conf->sc_conf.flags |= F_SNMP;
			if (yyvsp[-1].v.number)
				conf->sc_conf.flags |= F_SNMP_TRAPONLY;
			if (yyvsp[0].v.string) {
				if (strlcpy(conf->sc_conf.snmp_path,
				    yyvsp[0].v.string, sizeof(conf->sc_conf.snmp_path)) >=
				    sizeof(conf->sc_conf.snmp_path)) {
					yyerror("snmp path truncated");
					free(yyvsp[0].v.string);
					YYERROR;
				}
				free(yyvsp[0].v.string);
			} else
				(void)strlcpy(conf->sc_conf.snmp_path,
				    AGENTX_SOCKET,
				    sizeof(conf->sc_conf.snmp_path));
		}
break;
case 43:
#line 418 "parse.y"
{ yyval.v.number = 0; }
break;
case 44:
#line 419 "parse.y"
{ yyval.v.number = 1; }
break;
case 45:
#line 421 "parse.y"
{ yyval.v.number = RELAYD_OPT_LOGUPDATE; }
break;
case 46:
#line 422 "parse.y"
{ yyval.v.number = RELAYD_OPT_LOGALL; }
break;
case 47:
#line 425 "parse.y"
{
			struct rdr *srv;

			conf->sc_conf.flags |= F_NEEDPF;

			if (!loadcfg) {
				free(yyvsp[0].v.string);
				YYACCEPT;
			}

			TAILQ_FOREACH(srv, conf->sc_rdrs, entry)
				if (!strcmp(srv->conf.name, yyvsp[0].v.string))
					break;
			if (srv != NULL) {
				yyerror("redirection %s defined twice", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if ((srv = calloc(1, sizeof (*srv))) == NULL)
				fatal("out of memory");

			if (strlcpy(srv->conf.name, yyvsp[0].v.string,
			    sizeof(srv->conf.name)) >=
			    sizeof(srv->conf.name)) {
				yyerror("redirection name truncated");
				free(yyvsp[0].v.string);
				free(srv);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			srv->conf.id = ++last_rdr_id;
			srv->conf.timeout.tv_sec = RELAY_TIMEOUT;
			if (last_rdr_id == INT_MAX) {
				yyerror("too many redirections defined");
				free(srv);
				YYERROR;
			}
			rdr = srv;
		}
break;
case 48:
#line 463 "parse.y"
{
			if (rdr->table == NULL) {
				yyerror("redirection %s has no table",
				    rdr->conf.name);
				YYERROR;
			}
			if (TAILQ_EMPTY(&rdr->virts)) {
				yyerror("redirection %s has no virtual ip",
				    rdr->conf.name);
				YYERROR;
			}
			conf->sc_rdrcount++;
			if (rdr->backup == NULL) {
				rdr->conf.backup_id =
				    conf->sc_empty_table.conf.id;
				rdr->backup = &conf->sc_empty_table;
			} else if (rdr->backup->conf.port !=
			    rdr->table->conf.port) {
				yyerror("redirection %s uses two different "
				    "ports for its table and backup table",
				    rdr->conf.name);
				YYERROR;
			}
			if (!(rdr->conf.flags & F_DISABLE))
				rdr->conf.flags |= F_ADD;
			TAILQ_INSERT_TAIL(conf->sc_rdrs, rdr, entry);
			tableport = 0;
			rdr = NULL;
		}
break;
case 51:
#line 498 "parse.y"
{
			if (hashkey != NULL) {
				memcpy(&rdr->conf.key,
				    hashkey, sizeof(rdr->conf.key));
				rdr->conf.flags |= F_HASHKEY;
				free(hashkey);
				hashkey = NULL;
			}

			switch (yyvsp[-3].v.number) {
			case FWD_NORMAL:
				if (yyvsp[0].v.string == NULL)
					break;
				yyerror("superfluous interface");
				free(yyvsp[0].v.string);
				YYERROR;
			case FWD_ROUTE:
				if (yyvsp[0].v.string != NULL)
					break;
				yyerror("missing interface to route to");
				free(yyvsp[0].v.string);
				YYERROR;
			case FWD_TRANS:
				yyerror("no transparent forward here");
				if (yyvsp[0].v.string != NULL)
					free(yyvsp[0].v.string);
				YYERROR;
			}
			if (yyvsp[0].v.string != NULL) {
				if (strlcpy(yyvsp[-1].v.table->conf.ifname, yyvsp[0].v.string,
				    sizeof(yyvsp[-1].v.table->conf.ifname)) >=
				    sizeof(yyvsp[-1].v.table->conf.ifname)) {
					yyerror("interface name truncated");
					free(yyvsp[0].v.string);
					YYERROR;
				}
				free(yyvsp[0].v.string);
			}

			if (yyvsp[-1].v.table->conf.check == CHECK_NOCHECK) {
				yyerror("table %s has no check", yyvsp[-1].v.table->conf.name);
				purge_table(conf, conf->sc_tables, yyvsp[-1].v.table);
				YYERROR;
			}
			if (rdr->backup) {
				yyerror("only one backup table is allowed");
				purge_table(conf, conf->sc_tables, yyvsp[-1].v.table);
				YYERROR;
			}
			if (rdr->table) {
				rdr->backup = yyvsp[-1].v.table;
				rdr->conf.backup_id = yyvsp[-1].v.table->conf.id;
				if (dstmode != rdr->conf.mode) {
					yyerror("backup table for %s with "
					    "different mode", rdr->conf.name);
					YYERROR;
				}
			} else {
				rdr->table = yyvsp[-1].v.table;
				rdr->conf.table_id = yyvsp[-1].v.table->conf.id;
				rdr->conf.mode = dstmode;
			}
			yyvsp[-1].v.table->conf.fwdmode = yyvsp[-3].v.number;
			yyvsp[-1].v.table->conf.rdrid = rdr->conf.id;
			yyvsp[-1].v.table->conf.flags |= F_USED;
		}
break;
case 52:
#line 564 "parse.y"
{
			if (host(yyvsp[-3].v.string, &rdr->virts,
			    SRV_MAX_VIRTS, &yyvsp[-1].v.port, yyvsp[0].v.string, yyvsp[-2].v.number) <= 0) {
				yyerror("invalid virtual ip: %s", yyvsp[-3].v.string);
				free(yyvsp[-3].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[-3].v.string);
			free(yyvsp[0].v.string);
			if (rdr->conf.port == 0)
				rdr->conf.port = yyvsp[-1].v.port.val[0];
			tableport = rdr->conf.port;
		}
break;
case 53:
#line 578 "parse.y"
{ rdr->conf.flags |= F_DISABLE; }
break;
case 54:
#line 579 "parse.y"
{ rdr->conf.flags |= F_STICKY; }
break;
case 55:
#line 580 "parse.y"
{
			conf->sc_conf.flags |= F_NEEDPF;
			if (strlcpy(rdr->conf.tag, yyvsp[0].v.string,
			    sizeof(rdr->conf.tag)) >=
			    sizeof(rdr->conf.tag)) {
				yyerror("redirection tag name truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if (yyvsp[-2].v.number)
				rdr->conf.flags |= F_MATCH;
			free(yyvsp[0].v.string);
		}
break;
case 56:
#line 593 "parse.y"
{
			if ((rdr->conf.timeout.tv_sec = yyvsp[0].v.number) < 0) {
				yyerror("invalid timeout: %lld", yyvsp[0].v.number);
				YYERROR;
			}
			if (rdr->conf.timeout.tv_sec > INT_MAX) {
				yyerror("timeout too large: %lld", yyvsp[0].v.number);
				YYERROR;
			}
		}
break;
case 58:
#line 606 "parse.y"
{ yyval.v.number = 0; }
break;
case 59:
#line 607 "parse.y"
{ yyval.v.number = 1; }
break;
case 60:
#line 610 "parse.y"
{ yyval.v.number = FWD_NORMAL; }
break;
case 61:
#line 611 "parse.y"
{ yyval.v.number = FWD_ROUTE; }
break;
case 62:
#line 612 "parse.y"
{ yyval.v.number = FWD_TRANS; }
break;
case 63:
#line 615 "parse.y"
{
			if (strlen(yyvsp[-1].v.string) >= TABLE_NAME_SIZE) {
				yyerror("invalid table name");
				free(yyvsp[-1].v.string);
				YYERROR;
			}
			yyval.v.string = yyvsp[-1].v.string;
		}
break;
case 64:
#line 625 "parse.y"
{
			struct table *tb;

			if (!loadcfg) {
				free(yyvsp[0].v.string);
				YYACCEPT;
			}

			TAILQ_FOREACH(tb, conf->sc_tables, entry)
				if (!strcmp(tb->conf.name, yyvsp[0].v.string))
					break;
			if (tb != NULL) {
				yyerror("table %s defined twice", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}

			if ((tb = calloc(1, sizeof (*tb))) == NULL)
				fatal("out of memory");

			if (strlcpy(tb->conf.name, yyvsp[0].v.string,
			    sizeof(tb->conf.name)) >= sizeof(tb->conf.name)) {
				yyerror("table name truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);

			tb->conf.id = 0; /* will be set later */
			bcopy(&conf->sc_conf.timeout, &tb->conf.timeout,
			    sizeof(struct timeval));
			TAILQ_INIT(&tb->hosts);
			table = tb;
			dstmode = RELAY_DSTMODE_DEFAULT;
		}
break;
case 65:
#line 659 "parse.y"
{
			if (TAILQ_EMPTY(&table->hosts)) {
				yyerror("table %s has no hosts",
				    table->conf.name);
				YYERROR;
			}
			conf->sc_tablecount++;
			TAILQ_INSERT_TAIL(conf->sc_tables, table, entry);
		}
break;
case 68:
#line 674 "parse.y"
{ table->conf.flags |= F_DISABLE; }
break;
case 72:
#line 682 "parse.y"
{
			yyvsp[0].v.host->conf.tableid = table->conf.id;
			yyvsp[0].v.host->tablename = table->conf.name;
			TAILQ_INSERT_TAIL(&table->hosts, yyvsp[0].v.host, entry);
		}
break;
case 74:
#line 690 "parse.y"
{
			struct table	*tb;
			if ((tb = calloc(1, sizeof (*tb))) == NULL)
				fatal("out of memory");
			if (strlcpy(tb->conf.name, yyvsp[0].v.string,
			    sizeof(tb->conf.name)) >= sizeof(tb->conf.name)) {
				yyerror("table name truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			table = tb;
			dstmode = RELAY_DSTMODE_DEFAULT;
			hashkey = NULL;
		}
break;
case 75:
#line 704 "parse.y"
{
			struct table	*tb;
			if (table->conf.port == 0)
				table->conf.port = tableport;
			else
				table->conf.flags |= F_PORT;
			if ((tb = table_inherit(table)) == NULL)
				YYERROR;
			yyval.v.table = tb;
		}
break;
case 79:
#line 721 "parse.y"
{
			if (yyvsp[0].v.port.op != PF_OP_EQ) {
				yyerror("invalid port");
				YYERROR;
			}
			table->conf.port = yyvsp[0].v.port.val[0];
		}
break;
case 80:
#line 728 "parse.y"
{
			bcopy(&yyvsp[0].v.tv, &table->conf.timeout,
			    sizeof(struct timeval));
		}
break;
case 81:
#line 732 "parse.y"
{
			table->conf.flags |= F_DEMOTE;
			if (strlcpy(table->conf.demote_group, yyvsp[0].v.string,
			    sizeof(table->conf.demote_group))
			    >= sizeof(table->conf.demote_group)) {
				yyerror("yyparse: demote group name too long");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			if (carp_demote_init(table->conf.demote_group, 1)
			    == -1) {
				yyerror("yyparse: error initializing group "
				    "'%s'", table->conf.demote_group);
				YYERROR;
			}
		}
break;
case 82:
#line 749 "parse.y"
{
			if (yyvsp[0].v.number < conf->sc_conf.interval.tv_sec ||
			    yyvsp[0].v.number % conf->sc_conf.interval.tv_sec) {
				yyerror("table interval must be "
				    "divisible by global interval");
				YYERROR;
			}
			table->conf.skip_cnt =
			    (yyvsp[0].v.number / conf->sc_conf.interval.tv_sec) - 1;
		}
break;
case 83:
#line 759 "parse.y"
{
			switch (yyvsp[-1].v.number) {
			case RELAY_DSTMODE_LOADBALANCE:
			case RELAY_DSTMODE_HASH:
			case RELAY_DSTMODE_SRCHASH:
				if (hashkey != NULL) {
					yyerror("key already specified");
					free(hashkey);
					YYERROR;
				}
				if ((hashkey = calloc(1,
				    sizeof(*hashkey))) == NULL)
					fatal("out of memory");
				memcpy(hashkey, &yyvsp[0].v.key.key, sizeof(*hashkey));
				break;
			default:
				if (yyvsp[0].v.key.keyset) {
					yyerror("key not supported by mode");
					YYERROR;
				}
				hashkey = NULL;
				break;
			}

			switch (yyvsp[-1].v.number) {
			case RELAY_DSTMODE_LOADBALANCE:
			case RELAY_DSTMODE_HASH:
				if (rdr != NULL) {
					yyerror("mode not supported "
					    "for redirections");
					YYERROR;
				}
				/* FALLTHROUGH */
			case RELAY_DSTMODE_RANDOM:
			case RELAY_DSTMODE_ROUNDROBIN:
			case RELAY_DSTMODE_SRCHASH:
				dstmode = yyvsp[-1].v.number;
				break;
			case RELAY_DSTMODE_LEASTSTATES:
				if (rdr == NULL) {
					yyerror("mode not supported "
					    "for relays");
					YYERROR;
				}
				dstmode = yyvsp[-1].v.number;
				break;
			}
		}
break;
case 84:
#line 810 "parse.y"
{
			yyval.v.key.keyset = 0;
			yyval.v.key.key.data[0] = arc4random();
			yyval.v.key.key.data[1] = arc4random();
			yyval.v.key.key.data[2] = arc4random();
			yyval.v.key.key.data[3] = arc4random();
		}
break;
case 85:
#line 817 "parse.y"
{
			/* manual key configuration */
			yyval.v.key.keyset = 1;

			if (!strncmp(yyvsp[0].v.string, "0x", 2)) {
				if (strlen(yyvsp[0].v.string) != 34) {
					free(yyvsp[0].v.string);
					yyerror("hex key must be 128 bits "
					    "(32 hex digits) long");
					YYERROR;
				}

				if (sscanf(yyvsp[0].v.string, "0x%8x%8x%8x%8x",
				    &yyval.v.key.key.data[0], &yyval.v.key.key.data[1],
				    &yyval.v.key.key.data[2], &yyval.v.key.key.data[3]) != 4) {
					free(yyvsp[0].v.string);
					yyerror("invalid hex key");
					YYERROR;
				}
			} else {
				MD5_CTX	context;

				MD5Init(&context);
				MD5Update(&context, (unsigned char *)yyvsp[0].v.string,
				    strlen(yyvsp[0].v.string));
				MD5Final((unsigned char *)yyval.v.key.key.data,
				    &context);
				HTONL(yyval.v.key.key.data[0]);
				HTONL(yyval.v.key.key.data[1]);
				HTONL(yyval.v.key.key.data[2]);
				HTONL(yyval.v.key.key.data[3]);
			}
			free(yyvsp[0].v.string);
		}
break;
case 86:
#line 853 "parse.y"
{ table->conf.check = CHECK_ICMP; }
break;
case 87:
#line 854 "parse.y"
{ table->conf.check = CHECK_TCP; }
break;
case 88:
#line 855 "parse.y"
{
			table->conf.check = CHECK_TCP;
			conf->sc_conf.flags |= F_TLS;
			table->conf.flags |= F_TLS;
		}
break;
case 89:
#line 860 "parse.y"
{
			if (yyvsp[-4].v.number) {
				conf->sc_conf.flags |= F_TLS;
				table->conf.flags |= F_TLS;
			}
			table->conf.check = CHECK_HTTP_CODE;
			if ((table->conf.retcode = yyvsp[0].v.number) <= 0) {
				yyerror("invalid HTTP code: %d", yyvsp[0].v.number);
				free(yyvsp[-3].v.string);
				free(yyvsp[-2].v.string);
				YYERROR;
			}
			if (asprintf(&table->sendbuf,
			    "HEAD %s HTTP/1.%c\r\n%s\r\n",
			    yyvsp[-3].v.string, strlen(yyvsp[-2].v.string) ? '1' : '0', yyvsp[-2].v.string) == -1)
				fatal("asprintf");
			free(yyvsp[-3].v.string);
			free(yyvsp[-2].v.string);
			if (table->sendbuf == NULL)
				fatal("out of memory");
		}
break;
case 90:
#line 881 "parse.y"
{
			if (yyvsp[-3].v.number) {
				conf->sc_conf.flags |= F_TLS;
				table->conf.flags |= F_TLS;
			}
			table->conf.check = CHECK_HTTP_DIGEST;
			if (asprintf(&table->sendbuf,
			    "GET %s HTTP/1.%c\r\n%s\r\n",
			    yyvsp[-2].v.string, strlen(yyvsp[-1].v.string) ? '1' : '0', yyvsp[-1].v.string) == -1)
				fatal("asprintf");
			free(yyvsp[-2].v.string);
			free(yyvsp[-1].v.string);
			if (table->sendbuf == NULL)
				fatal("out of memory");
			if (strlcpy(table->conf.digest, yyvsp[0].v.digest.digest,
			    sizeof(table->conf.digest)) >=
			    sizeof(table->conf.digest)) {
				yyerror("digest truncated");
				free(yyvsp[0].v.digest.digest);
				YYERROR;
			}
			table->conf.digest_type = yyvsp[0].v.digest.type;
			free(yyvsp[0].v.digest.digest);
		}
break;
case 91:
#line 905 "parse.y"
{
			table->conf.check = CHECK_SEND_EXPECT;
			if (yyvsp[0].v.number) {
				conf->sc_conf.flags |= F_TLS;
				table->conf.flags |= F_TLS;
			}
			if (strlcpy(table->conf.exbuf, yyvsp[-1].v.string,
			    sizeof(table->conf.exbuf))
			    >= sizeof(table->conf.exbuf)) {
				yyerror("yyparse: expect buffer truncated");
				free(yyvsp[-1].v.string);
				YYERROR;
			}
			translate_string(table->conf.exbuf);
			free(yyvsp[-1].v.string);
		}
break;
case 92:
#line 921 "parse.y"
{
			table->conf.check = CHECK_SCRIPT;
			if (strlcpy(table->conf.path, yyvsp[0].v.string,
			    sizeof(table->conf.path)) >=
			    sizeof(table->conf.path)) {
				yyerror("script path truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			conf->sc_conf.flags |= F_SCRIPT;
			free(yyvsp[0].v.string);
		}
break;
case 93:
#line 936 "parse.y"
{
			switch (strlen(yyvsp[0].v.string)) {
			case 40:
				yyval.v.digest.type = DIGEST_SHA1;
				break;
			case 32:
				yyval.v.digest.type = DIGEST_MD5;
				break;
			default:
				yyerror("invalid http digest");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			yyval.v.digest.digest = yyvsp[0].v.string;
		}
break;
case 94:
#line 953 "parse.y"
{
			yyval.v.digest.digest = yyvsp[0].v.digest.digest;
			yyval.v.digest.type = yyvsp[0].v.digest.type;
		}
break;
case 95:
#line 957 "parse.y"
{
			yyval.v.digest.digest = yyvsp[0].v.string;
			yyval.v.digest.type = DIGEST_NONE;
		}
break;
case 96:
#line 963 "parse.y"
{
			struct protocol *p;

			if (!loadcfg) {
				free(yyvsp[0].v.string);
				YYACCEPT;
			}

			if (strcmp(yyvsp[0].v.string, "default") == 0) {
				p = &conf->sc_proto_default;
			} else {
				TAILQ_FOREACH(p, conf->sc_protos, entry)
					if (!strcmp(p->name, yyvsp[0].v.string))
						break;
			}
			if (p != NULL) {
				yyerror("protocol %s defined twice", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if ((p = calloc(1, sizeof (*p))) == NULL)
				fatal("out of memory");

			if (strlcpy(p->name, yyvsp[0].v.string, sizeof(p->name)) >=
			    sizeof(p->name)) {
				yyerror("protocol name truncated");
				free(yyvsp[0].v.string);
				free(p);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			p->id = ++last_proto_id;
			p->type = yyvsp[-2].v.number;
			p->tcpflags = TCPFLAG_DEFAULT;
			p->tlsflags = TLSFLAG_DEFAULT;
			p->tcpbacklog = RELAY_BACKLOG;
			TAILQ_INIT(&p->rules);
			(void)strlcpy(p->tlsciphers, TLSCIPHERS_DEFAULT,
			    sizeof(p->tlsciphers));
			(void)strlcpy(p->tlsecdhcurve, TLSECDHCURVE_DEFAULT,
			    sizeof(p->tlsecdhcurve));
			(void)strlcpy(p->tlsdhparams, TLSDHPARAM_DEFAULT,
			    sizeof(p->tlsdhparams));
			if (last_proto_id == INT_MAX) {
				yyerror("too many protocols defined");
				free(p);
				YYERROR;
			}
			proto = p;
		}
break;
case 97:
#line 1012 "parse.y"
{
			conf->sc_protocount++;

			if ((proto->tlsflags & TLSFLAG_VERSION) == 0) {
				yyerror("invalid TLS protocol");
				YYERROR;
			}

			TAILQ_INSERT_TAIL(conf->sc_protos, proto, entry);
		}
break;
case 107:
#line 1037 "parse.y"
{ proto->flags |= F_RETURN; }
break;
case 108:
#line 1038 "parse.y"
{ proto->flags |= F_RETURN; }
break;
case 113:
#line 1047 "parse.y"
{ proto->tcpflags |= TCPFLAG_SACK; }
break;
case 114:
#line 1048 "parse.y"
{ proto->tcpflags |= TCPFLAG_NSACK; }
break;
case 115:
#line 1049 "parse.y"
{ proto->tcpflags |= TCPFLAG_NODELAY; }
break;
case 116:
#line 1050 "parse.y"
{ proto->tcpflags |= TCPFLAG_NNODELAY; }
break;
case 117:
#line 1051 "parse.y"
{ /* default */ }
break;
case 118:
#line 1052 "parse.y"
{ proto->tcpflags |= TCPFLAG_NSPLICE; }
break;
case 119:
#line 1053 "parse.y"
{
			if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > RELAY_MAX_SESSIONS) {
				yyerror("invalid backlog: %d", yyvsp[0].v.number);
				YYERROR;
			}
			proto->tcpbacklog = yyvsp[0].v.number;
		}
break;
case 120:
#line 1060 "parse.y"
{
			proto->tcpflags |= TCPFLAG_BUFSIZ;
			if ((proto->tcpbufsiz = yyvsp[0].v.number) < 0) {
				yyerror("invalid socket buffer size: %d", yyvsp[0].v.number);
				YYERROR;
			}
		}
break;
case 121:
#line 1067 "parse.y"
{
			if (yyvsp[0].v.number < 0) {
				yyerror("invalid ttl: %d", yyvsp[0].v.number);
				free(yyvsp[-1].v.string);
				YYERROR;
			}
			if (strcasecmp("ttl", yyvsp[-1].v.string) == 0) {
				proto->tcpflags |= TCPFLAG_IPTTL;
				proto->tcpipttl = yyvsp[0].v.number;
			} else if (strcasecmp("minttl", yyvsp[-1].v.string) == 0) {
				proto->tcpflags |= TCPFLAG_IPMINTTL;
				proto->tcpipminttl = yyvsp[0].v.number;
			} else {
				yyerror("invalid TCP/IP flag: %s", yyvsp[-1].v.string);
				free(yyvsp[-1].v.string);
				YYERROR;
			}
			free(yyvsp[-1].v.string);
		}
break;
case 124:
#line 1092 "parse.y"
{ proto->tickets = 1; }
break;
case 125:
#line 1093 "parse.y"
{ proto->tickets = 0; }
break;
case 126:
#line 1094 "parse.y"
{
			if (strlcpy(proto->tlsciphers, yyvsp[0].v.string,
			    sizeof(proto->tlsciphers)) >=
			    sizeof(proto->tlsciphers)) {
				yyerror("tlsciphers truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 127:
#line 1104 "parse.y"
{
			(void)strlcpy(proto->tlsdhparams, "none",
			    sizeof(proto->tlsdhparams));
		}
break;
case 128:
#line 1108 "parse.y"
{
			(void)strlcpy(proto->tlsdhparams, "auto",
			    sizeof(proto->tlsdhparams));
		}
break;
case 129:
#line 1112 "parse.y"
{
			struct tls_config	*tls_cfg;
			if ((tls_cfg = tls_config_new()) == NULL) {
				yyerror("tls_config_new failed");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if (tls_config_set_dheparams(tls_cfg, yyvsp[0].v.string) != 0) {
				yyerror("tls edh params %s: %s", yyvsp[0].v.string,
				    tls_config_error(tls_cfg));
				tls_config_free(tls_cfg);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			tls_config_free(tls_cfg);
			if (strlcpy(proto->tlsdhparams, yyvsp[0].v.string,
			    sizeof(proto->tlsdhparams)) >=
			    sizeof(proto->tlsdhparams)) {
				yyerror("tls edh truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 130:
#line 1136 "parse.y"
{
			(void)strlcpy(proto->tlsecdhcurve, "none",
			    sizeof(proto->tlsecdhcurve));
		}
break;
case 131:
#line 1140 "parse.y"
{
			(void)strlcpy(proto->tlsecdhcurve, "auto",
			    sizeof(proto->tlsecdhcurve));
		}
break;
case 132:
#line 1144 "parse.y"
{
			struct tls_config	*tls_cfg;
			if ((tls_cfg = tls_config_new()) == NULL) {
				yyerror("tls_config_new failed");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if (tls_config_set_ecdhecurve(tls_cfg, yyvsp[0].v.string) != 0) {
				yyerror("tls ecdh curve %s: %s", yyvsp[0].v.string,
				    tls_config_error(tls_cfg));
				tls_config_free(tls_cfg);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			tls_config_free(tls_cfg);
			if (strlcpy(proto->tlsecdhcurve, yyvsp[0].v.string,
			    sizeof(proto->tlsecdhcurve)) >=
			    sizeof(proto->tlsecdhcurve)) {
				yyerror("tls ecdh truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 133:
#line 1168 "parse.y"
{
			if (strlcpy(proto->tlsca, yyvsp[0].v.string,
			    sizeof(proto->tlsca)) >=
			    sizeof(proto->tlsca)) {
				yyerror("tlsca truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 134:
#line 1178 "parse.y"
{
			if (strlcpy(proto->tlscakey, yyvsp[-2].v.string,
			    sizeof(proto->tlscakey)) >=
			    sizeof(proto->tlscakey)) {
				yyerror("tlscakey truncated");
				free(yyvsp[-2].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if ((proto->tlscapass = strdup(yyvsp[0].v.string)) == NULL) {
				yyerror("tlscapass");
				free(yyvsp[-2].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[-2].v.string);
			free(yyvsp[0].v.string);
		}
break;
case 135:
#line 1196 "parse.y"
{
			if (strlcpy(proto->tlscacert, yyvsp[0].v.string,
			    sizeof(proto->tlscacert)) >=
			    sizeof(proto->tlscacert)) {
				yyerror("tlscacert truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 136:
#line 1206 "parse.y"
{ proto->tlsflags &= ~(yyvsp[0].v.number); }
break;
case 137:
#line 1207 "parse.y"
{ proto->tlsflags |= yyvsp[0].v.number; }
break;
case 138:
#line 1210 "parse.y"
{
			if (strcmp("sslv3", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_SSLV3;
			else if (strcmp("tlsv1", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_TLSV1;
			else if (strcmp("tlsv1.0", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_TLSV1_0;
			else if (strcmp("tlsv1.1", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_TLSV1_1;
			else if (strcmp("tlsv1.2", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_TLSV1_2;
			else if (strcmp("cipher-server-preference", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_CIPHER_SERVER_PREF;
			else if (strcmp("client-renegotiation", yyvsp[0].v.string) == 0)
				yyval.v.number = TLSFLAG_CLIENT_RENEG;
			else {
				yyerror("invalid TLS flag: %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 139:
#line 1234 "parse.y"
{
			if ((rule = calloc(1, sizeof(*rule))) == NULL)
				fatal("out of memory");

			rule->rule_action = yyvsp[-5].v.number;
			rule->rule_proto = proto->type;
			rule->rule_dir = yyvsp[-4].v.dir;
			rule->rule_flags |= yyvsp[-3].v.number;
			rule->rule_af = yyvsp[-2].v.number;

			rulefile = NULL;
		}
break;
case 140:
#line 1245 "parse.y"
{
			if (rule_add(proto, rule, rulefile) == -1) {
				if (rulefile == NULL) {
					yyerror("failed to load rule");
				} else {
					yyerror("failed to load rules from %s",
					    rulefile);
					free(rulefile);
				}
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			if (rulefile)
				free(rulefile);
			rulefile = NULL;
			rule = NULL;
			keytype = KEY_TYPE_NONE;
		}
break;
case 141:
#line 1266 "parse.y"
{ yyval.v.number = RULE_ACTION_PASS; }
break;
case 142:
#line 1267 "parse.y"
{ yyval.v.number = RULE_ACTION_BLOCK; }
break;
case 143:
#line 1268 "parse.y"
{ yyval.v.number = RULE_ACTION_MATCH; }
break;
case 144:
#line 1271 "parse.y"
{
			yyval.v.dir = dir = RELAY_DIR_REQUEST;
		}
break;
case 145:
#line 1274 "parse.y"
{
			yyval.v.dir = dir = RELAY_DIR_REQUEST;
		}
break;
case 146:
#line 1277 "parse.y"
{
			yyval.v.dir = dir = RELAY_DIR_RESPONSE;
		}
break;
case 147:
#line 1282 "parse.y"
{ yyval.v.number = 0; }
break;
case 148:
#line 1283 "parse.y"
{ yyval.v.number = RULE_FLAG_QUICK; }
break;
case 149:
#line 1286 "parse.y"
{ yyval.v.number = AF_UNSPEC; }
break;
case 150:
#line 1287 "parse.y"
{ yyval.v.number = AF_INET6; }
break;
case 151:
#line 1288 "parse.y"
{ yyval.v.number = AF_INET; }
break;
case 158:
#line 1305 "parse.y"
{
			u_int	id;
			if ((id = relay_httpmethod_byname(yyvsp[0].v.string)) ==
			    HTTP_METHOD_NONE) {
				yyerror("unknown HTTP method currently not "
				    "supported");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			rule->rule_method = id;
			free(yyvsp[0].v.string);
		}
break;
case 159:
#line 1317 "parse.y"
{
			keytype = KEY_TYPE_COOKIE;
			rule->rule_kv[keytype].kv_key = strdup(yyvsp[-1].v.string);
			rule->rule_kv[keytype].kv_option = yyvsp[-2].v.number;
			rule->rule_kv[keytype].kv_value = ((yyvsp[0].v.string != NULL) ?
			    strdup(yyvsp[0].v.string) : strdup("*"));
			if (rule->rule_kv[keytype].kv_key == NULL ||
			    rule->rule_kv[keytype].kv_value == NULL)
				fatal("out of memory");
			free(yyvsp[-1].v.string);
			if (yyvsp[0].v.string)
				free(yyvsp[0].v.string);
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 160:
#line 1331 "parse.y"
{
			keytype = KEY_TYPE_COOKIE;
			rule->rule_kv[keytype].kv_option = yyvsp[0].v.number;
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 161:
#line 1336 "parse.y"
{
			keytype = KEY_TYPE_HEADER;
			memset(&rule->rule_kv[keytype], 0,
			    sizeof(rule->rule_kv[keytype]));
			rule->rule_kv[keytype].kv_option = yyvsp[-2].v.number;
			rule->rule_kv[keytype].kv_key = strdup(yyvsp[-1].v.string);
			rule->rule_kv[keytype].kv_value = ((yyvsp[0].v.string != NULL) ?
			    strdup(yyvsp[0].v.string) : strdup("*"));
			if (rule->rule_kv[keytype].kv_key == NULL ||
			    rule->rule_kv[keytype].kv_value == NULL)
				fatal("out of memory");
			free(yyvsp[-1].v.string);
			if (yyvsp[0].v.string)
				free(yyvsp[0].v.string);
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 162:
#line 1352 "parse.y"
{
			keytype = KEY_TYPE_HEADER;
			rule->rule_kv[keytype].kv_option = yyvsp[0].v.number;
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 163:
#line 1357 "parse.y"
{
			keytype = KEY_TYPE_PATH;
			rule->rule_kv[keytype].kv_option = yyvsp[-2].v.number;
			rule->rule_kv[keytype].kv_key = strdup(yyvsp[-1].v.string);
			rule->rule_kv[keytype].kv_value = ((yyvsp[0].v.string != NULL) ?
			    strdup(yyvsp[0].v.string) : strdup("*"));
			if (rule->rule_kv[keytype].kv_key == NULL ||
			    rule->rule_kv[keytype].kv_value == NULL)
				fatal("out of memory");
			free(yyvsp[-1].v.string);
			if (yyvsp[0].v.string)
				free(yyvsp[0].v.string);
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 164:
#line 1371 "parse.y"
{
			keytype = KEY_TYPE_PATH;
			rule->rule_kv[keytype].kv_option = yyvsp[0].v.number;
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 165:
#line 1376 "parse.y"
{
			switch (yyvsp[-2].v.number) {
			case KEY_OPTION_APPEND:
			case KEY_OPTION_SET:
			case KEY_OPTION_REMOVE:
				yyerror("combining query type and the given "
				    "option is not supported");
				free(yyvsp[-1].v.string);
				if (yyvsp[0].v.string)
					free(yyvsp[0].v.string);
				YYERROR;
				break;
			}
			keytype = KEY_TYPE_QUERY;
			rule->rule_kv[keytype].kv_option = yyvsp[-2].v.number;
			rule->rule_kv[keytype].kv_key = strdup(yyvsp[-1].v.string);
			rule->rule_kv[keytype].kv_value = ((yyvsp[0].v.string != NULL) ?
			    strdup(yyvsp[0].v.string) : strdup("*"));
			if (rule->rule_kv[keytype].kv_key == NULL ||
			    rule->rule_kv[keytype].kv_value == NULL)
				fatal("out of memory");
			free(yyvsp[-1].v.string);
			if (yyvsp[0].v.string)
				free(yyvsp[0].v.string);
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 166:
#line 1402 "parse.y"
{
			switch (yyvsp[0].v.number) {
			case KEY_OPTION_APPEND:
			case KEY_OPTION_SET:
			case KEY_OPTION_REMOVE:
				yyerror("combining query type and the given "
				    "option is not supported");
				YYERROR;
				break;
			}
			keytype = KEY_TYPE_QUERY;
			rule->rule_kv[keytype].kv_option = yyvsp[0].v.number;
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 167:
#line 1416 "parse.y"
{
			switch (yyvsp[-2].v.number) {
			case KEY_OPTION_APPEND:
			case KEY_OPTION_SET:
			case KEY_OPTION_REMOVE:
				yyerror("combining url type and the given "
				"option is not supported");
				free(yyvsp[-1].v.digest.digest);
				free(yyvsp[0].v.string);
				YYERROR;
				break;
			}
			keytype = KEY_TYPE_URL;
			rule->rule_kv[keytype].kv_option = yyvsp[-2].v.number;
			rule->rule_kv[keytype].kv_key = strdup(yyvsp[-1].v.digest.digest);
			rule->rule_kv[keytype].kv_digest = yyvsp[-1].v.digest.type;
			rule->rule_kv[keytype].kv_value = ((yyvsp[0].v.string != NULL) ?
			    strdup(yyvsp[0].v.string) : strdup("*"));
			if (rule->rule_kv[keytype].kv_key == NULL ||
			    rule->rule_kv[keytype].kv_value == NULL)
				fatal("out of memory");
			free(yyvsp[-1].v.digest.digest);
			if (yyvsp[0].v.string)
				free(yyvsp[0].v.string);
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 168:
#line 1442 "parse.y"
{
			switch (yyvsp[0].v.number) {
			case KEY_OPTION_APPEND:
			case KEY_OPTION_SET:
			case KEY_OPTION_REMOVE:
				yyerror("combining url type and the given "
				    "option is not supported");
				YYERROR;
				break;
			}
			keytype = KEY_TYPE_URL;
			rule->rule_kv[keytype].kv_option = yyvsp[0].v.number;
			rule->rule_kv[keytype].kv_type = keytype;
		}
break;
case 169:
#line 1456 "parse.y"
{
			if (table_findbyname(conf, yyvsp[0].v.string) == NULL) {
				yyerror("undefined forward table");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			if (strlcpy(rule->rule_tablename, yyvsp[0].v.string,
			    sizeof(rule->rule_tablename)) >=
			    sizeof(rule->rule_tablename)) {
				yyerror("invalid forward table name");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 170:
#line 1471 "parse.y"
{
			tag = tag_name2id(yyvsp[0].v.string);
			if (rule->rule_tag) {
				yyerror("tag already defined");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			if (tag == 0) {
				yyerror("invalid tag");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			rule->rule_tag = tag;
			if (strlcpy(rule->rule_tagname, yyvsp[0].v.string,
			    sizeof(rule->rule_tagname)) >=
			    sizeof(rule->rule_tagname)) {
				yyerror("tag truncated");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 171:
#line 1499 "parse.y"
{
			if (tag == 0) {
				yyerror("no tag defined");
				YYERROR;
			}
			rule->rule_tag = -1;
			memset(rule->rule_tagname, 0,
			    sizeof(rule->rule_tagname));
		}
break;
case 172:
#line 1508 "parse.y"
{
			tagged = tag_name2id(yyvsp[0].v.string);
			if (rule->rule_tagged) {
				yyerror("tagged already defined");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			if (tagged == 0) {
				yyerror("invalid tag");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			rule->rule_tagged = tagged;
			if (strlcpy(rule->rule_taggedname, yyvsp[0].v.string,
			    sizeof(rule->rule_taggedname)) >=
			    sizeof(rule->rule_taggedname)) {
				yyerror("tagged truncated");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 173:
#line 1536 "parse.y"
{
			label = label_name2id(yyvsp[0].v.string);
			if (rule->rule_label) {
				yyerror("label already defined");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			if (label == 0) {
				yyerror("invalid label");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			rule->rule_label = label;
			if (strlcpy(rule->rule_labelname, yyvsp[0].v.string,
			    sizeof(rule->rule_labelname)) >=
			    sizeof(rule->rule_labelname)) {
				yyerror("label truncated");
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 174:
#line 1564 "parse.y"
{
			if (label == 0) {
				yyerror("no label defined");
				YYERROR;
			}
			rule->rule_label = -1;
			memset(rule->rule_labelname, 0,
			    sizeof(rule->rule_labelname));
		}
break;
case 175:
#line 1573 "parse.y"
{
			if (rulefile != NULL) {
				yyerror("only one file per rule supported");
				free(yyvsp[-1].v.string);
				free(yyvsp[0].v.string);
				rule_free(rule);
				free(rule);
				YYERROR;
			}
			if (yyvsp[0].v.string) {
				if ((rule->rule_kv[keytype].kv_value =
				    strdup(yyvsp[0].v.string)) == NULL)
					fatal("out of memory");
				free(yyvsp[0].v.string);
			} else
				rule->rule_kv[keytype].kv_value = NULL;
			rulefile = yyvsp[-1].v.string;
		}
break;
case 176:
#line 1593 "parse.y"
{ yyval.v.string = NULL; }
break;
case 177:
#line 1594 "parse.y"
{ yyval.v.string = yyvsp[0].v.string; }
break;
case 178:
#line 1597 "parse.y"
{ yyval.v.number = KEY_OPTION_NONE; }
break;
case 179:
#line 1598 "parse.y"
{ yyval.v.number = KEY_OPTION_APPEND; }
break;
case 180:
#line 1599 "parse.y"
{ yyval.v.number = KEY_OPTION_SET; }
break;
case 181:
#line 1600 "parse.y"
{ yyval.v.number = KEY_OPTION_REMOVE; }
break;
case 182:
#line 1601 "parse.y"
{ yyval.v.number = KEY_OPTION_HASH; }
break;
case 183:
#line 1602 "parse.y"
{ yyval.v.number = KEY_OPTION_LOG; }
break;
case 184:
#line 1605 "parse.y"
{
			struct relay *r;

			if (!loadcfg) {
				free(yyvsp[0].v.string);
				YYACCEPT;
			}

			TAILQ_FOREACH(r, conf->sc_relays, rl_entry)
				if (!strcmp(r->rl_conf.name, yyvsp[0].v.string))
					break;
			if (r != NULL) {
				yyerror("relay %s defined twice", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			TAILQ_INIT(&relays);

			if ((r = calloc(1, sizeof (*r))) == NULL)
				fatal("out of memory");

			if (strlcpy(r->rl_conf.name, yyvsp[0].v.string,
			    sizeof(r->rl_conf.name)) >=
			    sizeof(r->rl_conf.name)) {
				yyerror("relay name truncated");
				free(yyvsp[0].v.string);
				free(r);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			if (relay_id(r) == -1) {
				yyerror("too many relays defined");
				free(r);
				YYERROR;
			}
			r->rl_conf.timeout.tv_sec = RELAY_TIMEOUT;
			r->rl_proto = NULL;
			r->rl_conf.proto = EMPTY_ID;
			r->rl_conf.dstretry = 0;
			TAILQ_INIT(&r->rl_tables);
			if (last_relay_id == INT_MAX) {
				yyerror("too many relays defined");
				free(r);
				YYERROR;
			}
			dstmode = RELAY_DSTMODE_DEFAULT;
			rlay = r;
		}
break;
case 185:
#line 1652 "parse.y"
{
			struct relay	*r;

			if (rlay->rl_conf.ss.ss_family == AF_UNSPEC) {
				yyerror("relay %s has no listener",
				    rlay->rl_conf.name);
				YYERROR;
			}
			if ((rlay->rl_conf.flags & (F_NATLOOK|F_DIVERT)) ==
			    (F_NATLOOK|F_DIVERT)) {
				yyerror("relay %s with conflicting nat lookup "
				    "and peer options", rlay->rl_conf.name);
				YYERROR;
			}
			if ((rlay->rl_conf.flags & (F_NATLOOK|F_DIVERT)) == 0 &&
			    rlay->rl_conf.dstss.ss_family == AF_UNSPEC &&
			    TAILQ_EMPTY(&rlay->rl_tables)) {
				yyerror("relay %s has no target, rdr, "
				    "or table", rlay->rl_conf.name);
				YYERROR;
			}
			if (rlay->rl_conf.proto == EMPTY_ID) {
				rlay->rl_proto = &conf->sc_proto_default;
				rlay->rl_conf.proto = conf->sc_proto_default.id;
			}
			if (relay_load_certfiles(rlay) == -1) {
				yyerror("cannot load certificates for relay %s",
				    rlay->rl_conf.name);
				YYERROR;
			}
			conf->sc_relaycount++;
			SPLAY_INIT(&rlay->rl_sessions);
			TAILQ_INSERT_TAIL(conf->sc_relays, rlay, rl_entry);

			tableport = 0;

			while ((r = TAILQ_FIRST(&relays)) != NULL) {
				TAILQ_REMOVE(&relays, r, rl_entry);
				if (relay_inherit(rlay, r) == NULL) {
					YYERROR;
				}
			}
			rlay = NULL;
		}
break;
case 188:
#line 1702 "parse.y"
{
			struct addresslist	 al;
			struct address		*h;
			struct relay		*r;

			if (rlay->rl_conf.ss.ss_family != AF_UNSPEC) {
				if ((r = calloc(1, sizeof (*r))) == NULL)
					fatal("out of memory");
				TAILQ_INSERT_TAIL(&relays, r, rl_entry);
			} else
				r = rlay;
			if (yyvsp[-1].v.port.op != PF_OP_EQ) {
				yyerror("invalid port");
				free(yyvsp[-2].v.string);
				YYERROR;
			}

			TAILQ_INIT(&al);
			if (host(yyvsp[-2].v.string, &al, 1, &yyvsp[-1].v.port, NULL, -1) <= 0) {
				yyerror("invalid listen ip: %s", yyvsp[-2].v.string);
				free(yyvsp[-2].v.string);
				YYERROR;
			}
			free(yyvsp[-2].v.string);
			h = TAILQ_FIRST(&al);
			bcopy(&h->ss, &r->rl_conf.ss, sizeof(r->rl_conf.ss));
			r->rl_conf.port = h->port.val[0];
			if (yyvsp[0].v.number) {
				r->rl_conf.flags |= F_TLS;
				conf->sc_conf.flags |= F_TLS;
			}
			tableport = h->port.val[0];
			host_free(&al);
		}
break;
case 189:
#line 1736 "parse.y"
{
			rlay->rl_conf.fwdmode = yyvsp[-4].v.number;
			if (yyvsp[-4].v.number == FWD_ROUTE) {
				yyerror("no route for relays");
				YYERROR;
			}
			if (yyvsp[-3].v.number) {
				rlay->rl_conf.flags |= F_TLSCLIENT;
				conf->sc_conf.flags |= F_TLSCLIENT;
			}
		}
break;
case 190:
#line 1747 "parse.y"
{
			if ((rlay->rl_conf.timeout.tv_sec = yyvsp[0].v.number) < 0) {
				yyerror("invalid timeout: %lld", yyvsp[0].v.number);
				YYERROR;
			}
			if (rlay->rl_conf.timeout.tv_sec > INT_MAX) {
				yyerror("timeout too large: %lld", yyvsp[0].v.number);
				YYERROR;
			}
		}
break;
case 191:
#line 1757 "parse.y"
{
			struct protocol *p;

			TAILQ_FOREACH(p, conf->sc_protos, entry)
				if (!strcmp(p->name, yyvsp[0].v.string))
					break;
			if (p == NULL) {
				yyerror("no such protocol: %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			p->flags |= F_USED;
			rlay->rl_conf.proto = p->id;
			rlay->rl_proto = p;
			free(yyvsp[0].v.string);
		}
break;
case 192:
#line 1773 "parse.y"
{ rlay->rl_conf.flags |= F_DISABLE; }
break;
case 194:
#line 1777 "parse.y"
{
			struct addresslist	 al;
			struct address		*h;

			if (rlay->rl_conf.dstss.ss_family != AF_UNSPEC) {
				yyerror("relay %s target or redirection "
				    "already specified", rlay->rl_conf.name);
				free(yyvsp[-2].v.string);
				YYERROR;
			}
			if (yyvsp[-1].v.port.op != PF_OP_EQ) {
				yyerror("invalid port");
				free(yyvsp[-2].v.string);
				YYERROR;
			}

			TAILQ_INIT(&al);
			if (host(yyvsp[-2].v.string, &al, 1, &yyvsp[-1].v.port, NULL, -1) <= 0) {
				yyerror("invalid listen ip: %s", yyvsp[-2].v.string);
				free(yyvsp[-2].v.string);
				YYERROR;
			}
			free(yyvsp[-2].v.string);
			h = TAILQ_FIRST(&al);
			bcopy(&h->ss, &rlay->rl_conf.dstss,
			    sizeof(rlay->rl_conf.dstss));
			rlay->rl_conf.dstport = h->port.val[0];
			rlay->rl_conf.dstretry = yyvsp[0].v.number;
			host_free(&al);
		}
break;
case 195:
#line 1807 "parse.y"
{
			conf->sc_conf.flags |= F_NEEDPF;
			rlay->rl_conf.flags |= F_NATLOOK;
			rlay->rl_conf.dstretry = yyvsp[0].v.number;
		}
break;
case 196:
#line 1812 "parse.y"
{
			conf->sc_conf.flags |= F_NEEDPF;
			rlay->rl_conf.flags |= F_DIVERT;
			rlay->rl_conf.dstretry = yyvsp[0].v.number;
		}
break;
case 197:
#line 1817 "parse.y"
{
			struct relay_table	*rlt;

			if ((rlt = calloc(1, sizeof(*rlt))) == NULL) {
				yyerror("failed to allocate table reference");
				YYERROR;
			}

			rlt->rlt_table = yyvsp[0].v.table;
			rlt->rlt_table->conf.flags |= F_USED;
			rlt->rlt_mode = dstmode;
			rlt->rlt_flags = F_USED;
			if (!TAILQ_EMPTY(&rlay->rl_tables))
				rlt->rlt_flags |= F_BACKUP;

			if (hashkey != NULL &&
			    (rlay->rl_conf.flags & F_HASHKEY) == 0) {
				memcpy(&rlay->rl_conf.hashkey,
				    hashkey, sizeof(rlay->rl_conf.hashkey));
				rlay->rl_conf.flags |= F_HASHKEY;
			}
			free(hashkey);
			hashkey = NULL;

			TAILQ_INSERT_TAIL(&rlay->rl_tables, rlt, rlt_entry);
		}
break;
case 198:
#line 1845 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_DEFAULT; }
break;
case 199:
#line 1846 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_LOADBALANCE; }
break;
case 200:
#line 1847 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_ROUNDROBIN; }
break;
case 201:
#line 1848 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_HASH; }
break;
case 202:
#line 1849 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_LEASTSTATES; }
break;
case 203:
#line 1850 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_SRCHASH; }
break;
case 204:
#line 1851 "parse.y"
{ yyval.v.number = RELAY_DSTMODE_RANDOM; }
break;
case 205:
#line 1854 "parse.y"
{
			struct router *rt = NULL;

			if (!loadcfg) {
				free(yyvsp[0].v.string);
				YYACCEPT;
			}

			conf->sc_conf.flags |= F_NEEDRT;
			TAILQ_FOREACH(rt, conf->sc_rts, rt_entry)
				if (!strcmp(rt->rt_conf.name, yyvsp[0].v.string))
					break;
			if (rt != NULL) {
				yyerror("router %s defined twice", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}

			if ((rt = calloc(1, sizeof (*rt))) == NULL)
				fatal("out of memory");

			if (strlcpy(rt->rt_conf.name, yyvsp[0].v.string,
			    sizeof(rt->rt_conf.name)) >=
			    sizeof(rt->rt_conf.name)) {
				yyerror("router name truncated");
				free(rt);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			rt->rt_conf.id = ++last_rt_id;
			if (last_rt_id == INT_MAX) {
				yyerror("too many routers defined");
				free(rt);
				YYERROR;
			}
			TAILQ_INIT(&rt->rt_netroutes);
			router = rt;

			tableport = -1;
		}
break;
case 206:
#line 1893 "parse.y"
{
			if (!router->rt_conf.nroutes) {
				yyerror("router %s without routes",
				    router->rt_conf.name);
				free(router);
				router = NULL;
				YYERROR;
			}

			conf->sc_routercount++;
			TAILQ_INSERT_TAIL(conf->sc_rts, router, rt_entry);
			router = NULL;

			tableport = 0;
		}
break;
case 209:
#line 1914 "parse.y"
{
			struct netroute	*nr;

			if (router->rt_conf.af == AF_UNSPEC)
				router->rt_conf.af = yyvsp[-2].v.addr.ss.ss_family;
			else if (router->rt_conf.af != yyvsp[-2].v.addr.ss.ss_family) {
				yyerror("router %s address family mismatch",
				    router->rt_conf.name);
				YYERROR;
			}

			if ((router->rt_conf.af == AF_INET &&
			    (yyvsp[0].v.number > 32 || yyvsp[0].v.number < 0)) ||
			    (router->rt_conf.af == AF_INET6 &&
			    (yyvsp[0].v.number > 128 || yyvsp[0].v.number < 0))) {
				yyerror("invalid prefixlen %d", yyvsp[0].v.number);
				YYERROR;
			}

			if ((nr = calloc(1, sizeof(*nr))) == NULL)
				fatal("out of memory");

			nr->nr_conf.id = ++last_nr_id;
			if (last_nr_id == INT_MAX) {
				yyerror("too many routes defined");
				free(nr);
				YYERROR;
			}
			nr->nr_conf.prefixlen = yyvsp[0].v.number;
			nr->nr_conf.routerid = router->rt_conf.id;
			nr->nr_router = router;
			bcopy(&yyvsp[-2].v.addr.ss, &nr->nr_conf.ss, sizeof(yyvsp[-2].v.addr.ss));

			router->rt_conf.nroutes++;
			conf->sc_routecount++;
			TAILQ_INSERT_TAIL(&router->rt_netroutes, nr, nr_entry);
			TAILQ_INSERT_TAIL(conf->sc_routes, nr, nr_route);
		}
break;
case 210:
#line 1952 "parse.y"
{
			free(hashkey);
			hashkey = NULL;

			if (router->rt_gwtable) {
				yyerror("router %s table already specified",
				    router->rt_conf.name);
				purge_table(conf, conf->sc_tables, yyvsp[0].v.table);
				YYERROR;
			}
			router->rt_gwtable = yyvsp[0].v.table;
			router->rt_gwtable->conf.flags |= F_USED;
			router->rt_conf.gwtable = yyvsp[0].v.table->conf.id;
			router->rt_conf.gwport = yyvsp[0].v.table->conf.port;
		}
break;
case 211:
#line 1967 "parse.y"
{
			if (router->rt_conf.rtable) {
				yyerror("router %s rtable already specified",
				    router->rt_conf.name);
				YYERROR;
			}
			if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > RT_TABLEID_MAX) {
				yyerror("invalid rtable id %d", yyvsp[0].v.number);
				YYERROR;
			}
			router->rt_conf.rtable = yyvsp[0].v.number;
		}
break;
case 212:
#line 1979 "parse.y"
{
			if (strlcpy(router->rt_conf.label, yyvsp[0].v.string,
			    sizeof(router->rt_conf.label)) >=
			    sizeof(router->rt_conf.label)) {
				yyerror("route label truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
		}
break;
case 213:
#line 1989 "parse.y"
{ rlay->rl_conf.flags |= F_DISABLE; }
break;
case 215:
#line 1993 "parse.y"
{
			rlay->rl_conf.dstaf.ss_family = AF_UNSPEC;
		}
break;
case 216:
#line 1996 "parse.y"
{
			rlay->rl_conf.dstaf.ss_family = AF_INET;
		}
break;
case 217:
#line 1999 "parse.y"
{
			struct sockaddr_in6	*sin6;

			sin6 = (struct sockaddr_in6 *)&rlay->rl_conf.dstaf;
			if (inet_pton(AF_INET6, yyvsp[0].v.string, &sin6->sin6_addr) == -1) {
				yyerror("invalid ipv6 address %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);

			sin6->sin6_family = AF_INET6;
			sin6->sin6_len = sizeof(*sin6);
		}
break;
case 218:
#line 2015 "parse.y"
{ yyval.v.string = NULL; }
break;
case 219:
#line 2016 "parse.y"
{ yyval.v.string = yyvsp[0].v.string; }
break;
case 220:
#line 2019 "parse.y"
{
			if ((hst = calloc(1, sizeof(*(hst)))) == NULL)
				fatal("out of memory");

			if (strlcpy(hst->conf.name, yyvsp[0].v.addr.name,
			    sizeof(hst->conf.name)) >= sizeof(hst->conf.name)) {
				yyerror("host name truncated");
				free(hst);
				YYERROR;
			}
			bcopy(&yyvsp[0].v.addr.ss, &hst->conf.ss, sizeof(yyvsp[0].v.addr.ss));
			hst->conf.id = 0; /* will be set later */
			SLIST_INIT(&hst->children);
		}
break;
case 221:
#line 2032 "parse.y"
{
			yyval.v.host = hst;
			hst = NULL;
		}
break;
case 226:
#line 2046 "parse.y"
{
			if (hst->conf.retry) {
				yyerror("retry value already set");
				YYERROR;
			}
			if (yyvsp[0].v.number < 0) {
				yyerror("invalid retry value: %d\n", yyvsp[0].v.number);
				YYERROR;
			}
			hst->conf.retry = yyvsp[0].v.number;
		}
break;
case 227:
#line 2057 "parse.y"
{
			if (hst->conf.parentid) {
				yyerror("parent value already set");
				YYERROR;
			}
			if (yyvsp[0].v.number < 0) {
				yyerror("invalid parent value: %d\n", yyvsp[0].v.number);
				YYERROR;
			}
			hst->conf.parentid = yyvsp[0].v.number;
		}
break;
case 228:
#line 2068 "parse.y"
{
			if (hst->conf.priority) {
				yyerror("priority already set");
				YYERROR;
			}
			if (yyvsp[0].v.number < 0 || yyvsp[0].v.number > RTP_MAX) {
				yyerror("invalid priority value: %d\n", yyvsp[0].v.number);
				YYERROR;
			}
			hst->conf.priority = yyvsp[0].v.number;
		}
break;
case 229:
#line 2079 "parse.y"
{
			if (hst->conf.ttl) {
				yyerror("ttl value already set");
				YYERROR;
			}
			if (yyvsp[0].v.number < 0) {
				yyerror("invalid ttl value: %d\n", yyvsp[0].v.number);
				YYERROR;
			}
			hst->conf.ttl = yyvsp[0].v.number;
		}
break;
case 230:
#line 2092 "parse.y"
{
			struct address *h;
			struct addresslist al;

			if (strlcpy(yyval.v.addr.name, yyvsp[0].v.string,
			    sizeof(yyval.v.addr.name)) >= sizeof(yyval.v.addr.name)) {
				yyerror("host name truncated");
				free(yyvsp[0].v.string);
				YYERROR;
			}

			TAILQ_INIT(&al);
			if (host(yyvsp[0].v.string, &al, 1, NULL, NULL, -1) <= 0) {
				yyerror("invalid host %s", yyvsp[0].v.string);
				free(yyvsp[0].v.string);
				YYERROR;
			}
			free(yyvsp[0].v.string);
			h = TAILQ_FIRST(&al);
			memcpy(&yyval.v.addr.ss, &h->ss, sizeof(yyval.v.addr.ss));
			host_free(&al);
		}
break;
case 231:
#line 2116 "parse.y"
{ yyval.v.number = 0; }
break;
case 232:
#line 2117 "parse.y"
{
			if ((yyval.v.number = yyvsp[0].v.number) < 0) {
				yyerror("invalid retry value: %d\n", yyvsp[0].v.number);
				YYERROR;
			}
		}
break;
case 233:
#line 2126 "parse.y"
{
			if (yyvsp[0].v.number < 0) {
				yyerror("invalid timeout: %d\n", yyvsp[0].v.number);
				YYERROR;
			}
			yyval.v.tv.tv_sec = yyvsp[0].v.number / 1000;
			yyval.v.tv.tv_usec = (yyvsp[0].v.number % 1000) * 1000;
		}
break;
case 240:
#line 2148 "parse.y"
{ yyval.v.string = yyvsp[0].v.string; }
break;
case 241:
#line 2149 "parse.y"
{ yyval.v.string = NULL; }
break;
#line 4677 "parse.c"
    }
    yyssp -= yym;
    yystate = *yyssp;
    yyvsp -= yym;
    yym = yylhs[yyn];
    if (yystate == 0 && yym == 0)
    {
#if YYDEBUG
        if (yydebug)
            printf("%sdebug: after reduction, shifting from state 0 to\
 state %d\n", YYPREFIX, YYFINAL);
#endif
        yystate = YYFINAL;
        *++yyssp = YYFINAL;
        *++yyvsp = yyval;
        if (yychar < 0)
        {
            if ((yychar = yylex()) < 0) yychar = 0;
#if YYDEBUG
            if (yydebug)
            {
                yys = 0;
                if (yychar <= YYMAXTOKEN) yys = yyname[yychar];
                if (!yys) yys = "illegal-symbol";
                printf("%sdebug: state %d, reading %d (%s)\n",
                        YYPREFIX, YYFINAL, yychar, yys);
            }
#endif
        }
        if (yychar == 0) goto yyaccept;
        goto yyloop;
    }
    if ((yyn = yygindex[yym]) && (yyn += yystate) >= 0 &&
            yyn <= YYTABLESIZE && yycheck[yyn] == yystate)
        yystate = yytable[yyn];
    else
        yystate = yydgoto[yym];
#if YYDEBUG
    if (yydebug)
        printf("%sdebug: after reduction, shifting from state %d \
to state %d\n", YYPREFIX, *yyssp, yystate);
#endif
    if (yyssp >= yysslim && yygrowstack())
    {
        goto yyoverflow;
    }
    *++yyssp = yystate;
    *++yyvsp = yyval;
    goto yyloop;
yyoverflow:
    yyerror("yacc stack overflow");
yyabort:
    if (yyss)
            free(yyss);
    if (yyvs)
            free(yyvs);
    yyss = yyssp = NULL;
    yyvs = yyvsp = NULL;
    yystacksize = 0;
    return (1);
yyaccept:
    if (yyss)
            free(yyss);
    if (yyvs)
            free(yyvs);
    yyss = yyssp = NULL;
    yyvs = yyvsp = NULL;
    yystacksize = 0;
    return (0);
}

Generated by: GCOVR (Version 3.3)