see #2447 implemented import of parameters for action "block"

src/import/PFImporter.cpp

@@ -77,6 +77,23 @@ PFImporter::PFImporter(FWObject *lib,
 {
     setPlatform("pf");
     address_maker->setInvertedNetmasks(false);
+
+    icmp_codes_to_reject_parameters["net-unr"] = "ICMP net unreachable";
+    icmp_codes_to_reject_parameters["0"] = "ICMP net unreachable";
+    icmp_codes_to_reject_parameters["host-unr"] = "ICMP host unreachable";
+    icmp_codes_to_reject_parameters["1"] = "ICMP host unreachable";
+    icmp_codes_to_reject_parameters["proto-unr"] = "ICMP protocol unreachable";
+    icmp_codes_to_reject_parameters["2"] = "ICMP protocol unreachable";
+    icmp_codes_to_reject_parameters["port-unr"] = "ICMP port unreachable";
+    icmp_codes_to_reject_parameters["3"] = "ICMP port unreachable";
+
+    icmp_codes_to_reject_parameters["net-prohib"] = "ICMP net prohibited";
+    icmp_codes_to_reject_parameters["9"] = "ICMP net prohibited";
+    icmp_codes_to_reject_parameters["host-prohib"] = "ICMP host prohibited";
+    icmp_codes_to_reject_parameters["10"] = "ICMP host prohibited";
+    icmp_codes_to_reject_parameters["filter-prohib"] = "ICMP admin prohibited";
+    icmp_codes_to_reject_parameters["13"] = "ICMP admin prohibited";
+
 }
 
 PFImporter::~PFImporter()
@@ -109,6 +126,8 @@ void PFImporter::clear()
 
     icmp_type_code_group.clear();
 
+    block_action_params.clear();
+
     queue = "";
     state_op = "";
     logopts = "";
@@ -569,10 +588,61 @@ void PFImporter::pushPolicyRule()
         ropt->setBool("stateless", false);
     }
 
-    if (action=="drop")
+    if (action=="block")
     {
         rule->setAction(PolicyRule::Deny);
         ropt->setBool("stateless", true);
+
+        if (block_action_params.size() > 0)
+        {
+            string block_return = block_action_params.front();
+            block_action_params.pop_front();
+
+            if (block_return == "drop")
+            {
+                ;  // Action Drop accurately represents "block drop"
+            }
+
+            if (block_return == "return")
+            {
+                rule->setAction(PolicyRule::Reject);
+
+                error_tracker->registerError(
+                    QObject::tr(
+                        "'block return' is not supported in fwbuilder, "
+                        "replacing with 'block return-icmp' "));
+
+                ropt->setStr("action_on_reject", "ICMP admin prohibited");
+            }
+
+            if (block_return == "return-rst")
+            {
+                rule->setAction(PolicyRule::Reject);
+                ropt->setStr("action_on_reject", "TCP RST");
+            }
+
+            if (block_return == "return-icmp")
+            {
+                rule->setAction(PolicyRule::Reject);
+                ropt->setStr("action_on_reject", "ICMP admin prohibited");
+                if (block_action_params.size() > 0)
+                {
+                    string icmp_code = icmp_codes_to_reject_parameters[
+                        block_action_params.front()];
+                    block_action_params.pop_front();
+
+                    if (icmp_code.empty())
+                        error_tracker->registerError(
+                            QObject::tr(
+                                "Unrecognized icmp code parameter for "
+                                "'block return-icmp' action: %1")
+                            .arg(block_action_params.front().c_str()));
+
+                    ropt->setStr("action_on_reject", icmp_code);
+                }
+            }
+
+        }
     }
 
     if (direction == "in") rule->setDirection(PolicyRule::Inbound);

src/import/PFImporter.h

@@ -205,6 +205,9 @@ public:
     bool dst_neg;
     bool tmp_neg;
 
+    std::map<std::string, std::string> icmp_codes_to_reject_parameters;
+    std::list<std::string> block_action_params;
+    
     std::list<InterfaceSpec> iface_group;
     
     std::list<std::string> proto_list;

src/parsers/PFCfgLexer.cpp

@@ -44,96 +44,100 @@ PFCfgLexer::PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& st
 
 void PFCfgLexer::initLiterals()
 {
-	literals["vrrp"] = 65;
+	literals["vrrp"] = 71;
-	literals["critical"] = 103;
+	literals["critical"] = 109;
-	literals["ospf"] = 63;
+	literals["ospf"] = 69;
-	literals["rdp"] = 57;
+	literals["rdp"] = 63;
-	literals["disable"] = 110;
+	literals["disable"] = 116;
+	literals["return-rst"] = 41;
 	literals["scrub"] = 12;
-	literals["ipsec"] = 93;
+	literals["ipsec"] = 99;
-	literals["inet"] = 49;
+	literals["inet"] = 55;
-	literals["pcp"] = 95;
+	literals["pcp"] = 101;
-	literals["emergencies"] = 105;
+	literals["emergencies"] = 111;
-	literals["debugging"] = 104;
+	literals["debugging"] = 110;
 	literals["persist"] = 16;
-	literals["snp"] = 99;
+	literals["snp"] = 105;
 	literals["timeout"] = 36;
-	literals["to"] = 46;
+	literals["to"] = 52;
-	literals["flags"] = 75;
+	literals["flags"] = 81;
-	literals["isis"] = 67;
+	literals["isis"] = 73;
-	literals["icmp6-type"] = 78;
+	literals["icmp6-type"] = 84;
 	literals["const"] = 17;
-	literals["pptp"] = 97;
+	literals["return"] = 40;
+	literals["pptp"] = 103;
 	literals["pass"] = 37;
-	literals["no"] = 81;
+	literals["no"] = 87;
-	literals["from"] = 68;
+	literals["from"] = 74;
-	literals["igrp"] = 92;
+	literals["igrp"] = 98;
-	literals["pim"] = 96;
+	literals["pim"] = 102;
-	literals["tagged"] = 79;
+	literals["tagged"] = 85;
-	literals["rsvp"] = 58;
+	literals["rsvp"] = 64;
-	literals["route-to"] = 73;
+	literals["route-to"] = 79;
-	literals["nos"] = 94;
+	literals["nos"] = 100;
-	literals["quit"] = 89;
+	literals["quit"] = 95;
-	literals["->"] = 112;
+	literals["->"] = 118;
 	literals["peer"] = 28;
-	literals["icmp-type"] = 76;
+	literals["icmp-type"] = 82;
-	literals["exit"] = 88;
+	literals["exit"] = 94;
-	literals["modulate"] = 83;
+	literals["modulate"] = 89;
 	literals["nat"] = 33;
-	literals["range"] = 101;
+	literals["range"] = 107;
-	literals["urpf-failed"] = 69;
+	literals["urpf-failed"] = 75;
-	literals["out"] = 40;
+	literals["out"] = 48;
 	literals["queue"] = 10;
-	literals["gre"] = 59;
+	literals["gre"] = 65;
 	literals["set"] = 11;
-	literals["warnings"] = 109;
+	literals["warnings"] = 115;
-	literals["ah"] = 61;
+	literals["ah"] = 67;
-	literals["host"] = 100;
+	literals["host"] = 106;
-	literals["interface"] = 90;
+	literals["interface"] = 96;
-	literals["rip"] = 98;
+	literals["rip"] = 104;
-	literals["icmp6"] = 91;
+	literals["icmp6"] = 97;
 	literals["broadcast"] = 27;
-	literals["notifications"] = 108;
+	literals["notifications"] = 114;
 	literals["file"] = 19;
 	literals["network"] = 26;
-	literals["synproxy"] = 84;
+	literals["synproxy"] = 90;
 	literals["altq"] = 9;
-	literals["any"] = 70;
+	literals["any"] = 76;
-	literals["esp"] = 60;
+	literals["esp"] = 66;
-	literals["alerts"] = 102;
+	literals["alerts"] = 108;
-	literals["all"] = 44;
+	literals["all"] = 50;
-	literals["inet6"] = 50;
+	literals["drop"] = 39;
-	literals["inactive"] = 111;
+	literals["return-icmp"] = 43;
-	literals["label"] = 86;
+	literals["inet6"] = 56;
-	literals["no-route"] = 71;
+	literals["inactive"] = 117;
-	literals["udp"] = 56;
+	literals["label"] = 92;
-	literals["reply-to"] = 74;
+	literals["no-route"] = 77;
-	literals["tag"] = 80;
+	literals["udp"] = 62;
-	literals["port"] = 87;
+	literals["reply-to"] = 80;
-	literals["code"] = 77;
+	literals["tag"] = 86;
-	literals["ip"] = 52;
+	literals["port"] = 93;
+	literals["code"] = 83;
+	literals["ip"] = 58;
 	literals["table"] = 13;
-	literals["eigrp"] = 62;
+	literals["eigrp"] = 68;
-	literals["errors"] = 106;
+	literals["errors"] = 112;
-	literals["ipip"] = 64;
+	literals["ipip"] = 70;
 	literals["antispoof"] = 8;
 	literals["binat"] = 34;
-	literals["igmp"] = 54;
+	literals["igmp"] = 60;
-	literals["on"] = 48;
+	literals["on"] = 54;
-	literals["state"] = 85;
+	literals["state"] = 91;
-	literals["log"] = 41;
+	literals["log"] = 49;
-	literals["proto"] = 51;
+	literals["proto"] = 57;
 	literals["rdr"] = 35;
-	literals["informational"] = 107;
+	literals["informational"] = 113;
 	literals["self"] = 30;
-	literals["in"] = 39;
+	literals["in"] = 47;
-	literals["keep"] = 82;
+	literals["keep"] = 88;
 	literals["block"] = 38;
-	literals["l2tp"] = 66;
+	literals["l2tp"] = 72;
-	literals["quick"] = 47;
+	literals["quick"] = 53;
-	literals["user"] = 45;
+	literals["user"] = 51;
-	literals["icmp"] = 53;
+	literals["icmp"] = 59;
-	literals["tcp"] = 55;
+	literals["tcp"] = 61;
 }
 
 ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
@@ -441,11 +445,11 @@ void PFCfgLexer::mLINE_COMMENT(bool _createToken) {
 			}
 		}
 		else {
-			goto _loop157;
+			goto _loop165;
 		}
 		
 	}
-	_loop157:;
+	_loop165:;
 	} // ( ... )*
 	mNEWLINE(false);
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -477,9 +481,9 @@ void PFCfgLexer::mNEWLINE(bool _createToken) {
 	
 	}
 	if ( inputState->guessing==0 ) {
-#line 1086 "pf.g"
+#line 1132 "pf.g"
 		newline();
-#line 483 "PFCfgLexer.cpp"
+#line 487 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -558,9 +562,9 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 1081 "pf.g"
+#line 1127 "pf.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
-#line 564 "PFCfgLexer.cpp"
+#line 568 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -745,10 +749,10 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 	_ttype = NUMBER_ADDRESS_OR_WORD;
 	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
 	
-	bool synPredMatched182 = false;
+	bool synPredMatched190 = false;
 	if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
-		int _m182 = mark();
+		int _m190 = mark();
-		synPredMatched182 = true;
+		synPredMatched190 = true;
 		inputState->guessing++;
 		try {
 			{
@@ -759,12 +763,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			}
 		}
 		catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-			synPredMatched182 = false;
+			synPredMatched190 = false;
 		}
-		rewind(_m182);
+		rewind(_m190);
 		inputState->guessing--;
 	}
-	if ( synPredMatched182 ) {
+	if ( synPredMatched190 ) {
 		{
 		mNUM_3DIGIT(false);
 		match('.' /* charlit */ );
@@ -775,99 +779,99 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		mNUM_3DIGIT(false);
 		}
 		if ( inputState->guessing==0 ) {
-#line 1123 "pf.g"
+#line 1169 "pf.g"
 			_ttype = IPV4;
-#line 781 "PFCfgLexer.cpp"
+#line 785 "PFCfgLexer.cpp"
 		}
 	}
 	else {
-		bool synPredMatched189 = false;
+		bool synPredMatched197 = false;
 		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
-			int _m189 = mark();
+			int _m197 = mark();
-			synPredMatched189 = true;
+			synPredMatched197 = true;
 			inputState->guessing++;
 			try {
 				{
 				{ // ( ... )+
-				int _cnt186=0;
+				int _cnt194=0;
 				for (;;) {
 					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 						mDIGIT(false);
 					}
 					else {
-						if ( _cnt186>=1 ) { goto _loop186; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt194>=1 ) { goto _loop194; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt186++;
+					_cnt194++;
 				}
-				_loop186:;
+				_loop194:;
 				}  // ( ... )+
 				match('.' /* charlit */ );
 				{ // ( ... )+
-				int _cnt188=0;
+				int _cnt196=0;
 				for (;;) {
 					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 						mDIGIT(false);
 					}
 					else {
-						if ( _cnt188>=1 ) { goto _loop188; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt196>=1 ) { goto _loop196; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt188++;
+					_cnt196++;
 				}
-				_loop188:;
+				_loop196:;
 				}  // ( ... )+
 				}
 			}
 			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				synPredMatched189 = false;
+				synPredMatched197 = false;
 			}
-			rewind(_m189);
+			rewind(_m197);
 			inputState->guessing--;
 		}
-		if ( synPredMatched189 ) {
+		if ( synPredMatched197 ) {
 			{
 			{ // ( ... )+
-			int _cnt192=0;
+			int _cnt200=0;
 			for (;;) {
 				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 					mDIGIT(false);
 				}
 				else {
-					if ( _cnt192>=1 ) { goto _loop192; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					if ( _cnt200>=1 ) { goto _loop200; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
 				
-				_cnt192++;
+				_cnt200++;
 			}
-			_loop192:;
+			_loop200:;
 			}  // ( ... )+
 			match('.' /* charlit */ );
 			{ // ( ... )+
-			int _cnt194=0;
+			int _cnt202=0;
 			for (;;) {
 				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 					mDIGIT(false);
 				}
 				else {
-					if ( _cnt194>=1 ) { goto _loop194; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					if ( _cnt202>=1 ) { goto _loop202; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
 				
-				_cnt194++;
+				_cnt202++;
 			}
-			_loop194:;
+			_loop202:;
 			}  // ( ... )+
 			}
 			if ( inputState->guessing==0 ) {
-#line 1126 "pf.g"
+#line 1172 "pf.g"
 				_ttype = NUMBER;
-#line 864 "PFCfgLexer.cpp"
+#line 868 "PFCfgLexer.cpp"
 			}
 		}
 		else {
-			bool synPredMatched213 = false;
+			bool synPredMatched221 = false;
 			if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && ((LA(3) >= 0x30 /* '0' */  && LA(3) <= 0x39 /* '9' */ )))) {
-				int _m213 = mark();
+				int _m221 = mark();
-				synPredMatched213 = true;
+				synPredMatched221 = true;
 				inputState->guessing++;
 				try {
 					{
@@ -877,12 +881,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					}
 				}
 				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-					synPredMatched213 = false;
+					synPredMatched221 = false;
 				}
-				rewind(_m213);
+				rewind(_m221);
 				inputState->guessing--;
 			}
-			if ( synPredMatched213 ) {
+			if ( synPredMatched221 ) {
 				match(':' /* charlit */ );
 				match(':' /* charlit */ );
 				mNUM_HEX_4DIGIT(false);
@@ -893,23 +897,23 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						mNUM_HEX_4DIGIT(false);
 					}
 					else {
-						goto _loop215;
+						goto _loop223;
 					}
 					
 				}
-				_loop215:;
+				_loop223:;
 				} // ( ... )*
 				if ( inputState->guessing==0 ) {
-#line 1149 "pf.g"
+#line 1195 "pf.g"
 					_ttype = IPV6;
-#line 906 "PFCfgLexer.cpp"
+#line 910 "PFCfgLexer.cpp"
 				}
 			}
 			else {
-				bool synPredMatched198 = false;
+				bool synPredMatched206 = false;
 				if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && ((LA(2) >= 0x61 /* 'a' */  && LA(2) <= 0x66 /* 'f' */ )))) {
-					int _m198 = mark();
+					int _m206 = mark();
-					synPredMatched198 = true;
+					synPredMatched206 = true;
 					inputState->guessing++;
 					try {
 						{
@@ -918,60 +922,60 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 					}
 					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-						synPredMatched198 = false;
+						synPredMatched206 = false;
 					}
-					rewind(_m198);
+					rewind(_m206);
 					inputState->guessing--;
 				}
-				if ( synPredMatched198 ) {
+				if ( synPredMatched206 ) {
 					{
-					bool synPredMatched203 = false;
+					bool synPredMatched211 = false;
 					if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && ((LA(2) >= 0x61 /* 'a' */  && LA(2) <= 0x66 /* 'f' */ )) && ((LA(3) >= 0x30 /* '0' */  && LA(3) <= 0x3a /* ':' */ )))) {
-						int _m203 = mark();
+						int _m211 = mark();
-						synPredMatched203 = true;
+						synPredMatched211 = true;
 						inputState->guessing++;
 						try {
 							{
 							{ // ( ... )+
-							int _cnt202=0;
+							int _cnt210=0;
 							for (;;) {
 								if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 									mNUM_HEX_4DIGIT(false);
 									match(':' /* charlit */ );
 								}
 								else {
-									if ( _cnt202>=1 ) { goto _loop202; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+									if ( _cnt210>=1 ) { goto _loop210; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 								}
 								
-								_cnt202++;
+								_cnt210++;
 							}
-							_loop202:;
+							_loop210:;
 							}  // ( ... )+
 							match(':' /* charlit */ );
 							}
 						}
 						catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-							synPredMatched203 = false;
+							synPredMatched211 = false;
 						}
-						rewind(_m203);
+						rewind(_m211);
 						inputState->guessing--;
 					}
-					if ( synPredMatched203 ) {
+					if ( synPredMatched211 ) {
 						{
 						{ // ( ... )+
-						int _cnt206=0;
+						int _cnt214=0;
 						for (;;) {
 							if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 								mNUM_HEX_4DIGIT(false);
 								match(':' /* charlit */ );
 							}
 							else {
-								if ( _cnt206>=1 ) { goto _loop206; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								if ( _cnt214>=1 ) { goto _loop214; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 							}
 							
-							_cnt206++;
+							_cnt214++;
 						}
-						_loop206:;
+						_loop214:;
 						}  // ( ... )+
 						match(':' /* charlit */ );
 						{
@@ -984,11 +988,11 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 									mNUM_HEX_4DIGIT(false);
 								}
 								else {
-									goto _loop209;
+									goto _loop217;
 								}
 								
 							}
-							_loop209:;
+							_loop217:;
 							} // ( ... )*
 						}
 						else {
@@ -997,32 +1001,32 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						}
 						if ( inputState->guessing==0 ) {
-#line 1140 "pf.g"
+#line 1186 "pf.g"
 							_ttype = IPV6;
-#line 1003 "PFCfgLexer.cpp"
+#line 1007 "PFCfgLexer.cpp"
 						}
 					}
 					else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && ((LA(2) >= 0x61 /* 'a' */  && LA(2) <= 0x66 /* 'f' */ )) && ((LA(3) >= 0x30 /* '0' */  && LA(3) <= 0x3a /* ':' */ ))) {
 						mNUM_HEX_4DIGIT(false);
 						{ // ( ... )+
-						int _cnt211=0;
+						int _cnt219=0;
 						for (;;) {
 							if ((LA(1) == 0x3a /* ':' */ )) {
 								match(':' /* charlit */ );
 								mNUM_HEX_4DIGIT(false);
 							}
 							else {
-								if ( _cnt211>=1 ) { goto _loop211; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								if ( _cnt219>=1 ) { goto _loop219; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 							}
 							
-							_cnt211++;
+							_cnt219++;
 						}
-						_loop211:;
+						_loop219:;
 						}  // ( ... )+
 						if ( inputState->guessing==0 ) {
-#line 1143 "pf.g"
+#line 1189 "pf.g"
 							_ttype = IPV6;
-#line 1026 "PFCfgLexer.cpp"
+#line 1030 "PFCfgLexer.cpp"
 						}
 					}
 					else {
@@ -1031,47 +1035,47 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 					
 					}
 					if ( inputState->guessing==0 ) {
-#line 1145 "pf.g"
+#line 1191 "pf.g"
 						_ttype = IPV6;
-#line 1037 "PFCfgLexer.cpp"
+#line 1041 "PFCfgLexer.cpp"
 					}
 				}
 				else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
 					match(':' /* charlit */ );
 					match(':' /* charlit */ );
 					if ( inputState->guessing==0 ) {
-#line 1152 "pf.g"
+#line 1198 "pf.g"
 						_ttype = IPV6;
-#line 1046 "PFCfgLexer.cpp"
+#line 1050 "PFCfgLexer.cpp"
 					}
 				}
 				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
 					{ // ( ... )+
-					int _cnt196=0;
+					int _cnt204=0;
 					for (;;) {
 						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 							mDIGIT(false);
 						}
 						else {
-							if ( _cnt196>=1 ) { goto _loop196; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							if ( _cnt204>=1 ) { goto _loop204; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 						}
 						
-						_cnt196++;
+						_cnt204++;
 					}
-					_loop196:;
+					_loop204:;
 					}  // ( ... )+
 					if ( inputState->guessing==0 ) {
-#line 1131 "pf.g"
+#line 1177 "pf.g"
 						_ttype = INT_CONST;
-#line 1067 "PFCfgLexer.cpp"
+#line 1071 "PFCfgLexer.cpp"
 					}
 				}
 				else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
 					match(':' /* charlit */ );
 					if ( inputState->guessing==0 ) {
-#line 1155 "pf.g"
+#line 1201 "pf.g"
 						_ttype = COLON;
-#line 1075 "PFCfgLexer.cpp"
+#line 1079 "PFCfgLexer.cpp"
 					}
 				}
 				else if ((_tokenSet_3.member(LA(1)))) {
@@ -1282,16 +1286,16 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						default:
 						{
-							goto _loop218;
+							goto _loop226;
 						}
 						}
 					}
-					_loop218:;
+					_loop226:;
 					} // ( ... )*
 					if ( inputState->guessing==0 ) {
-#line 1167 "pf.g"
+#line 1213 "pf.g"
 						_ttype = WORD;
-#line 1295 "PFCfgLexer.cpp"
+#line 1299 "PFCfgLexer.cpp"
 					}
 				}
 	else {
@@ -1319,11 +1323,11 @@ void PFCfgLexer::mSTRING(bool _createToken) {
 			matchNot('\"' /* charlit */ );
 		}
 		else {
-			goto _loop221;
+			goto _loop229;
 		}
 		
 	}
-	_loop221:;
+	_loop229:;
 	} // ( ... )*
 	match('\"' /* charlit */ );
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -1730,7 +1734,8 @@ void PFCfgLexer::mDOUBLE_QUOTE(bool _createToken) {
 const unsigned long PFCfgLexer::_tokenSet_0_data_[] = { 4294958072UL, 1UL, 0UL, 2147483648UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xb 0xc 0xe 0xf 0x10 0x11 0x12 0x13 0x14 
 // 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f   0x7f 0x80 0x81 
-// 0x82 0x83 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 
+// 0x82 0x83 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 
+// 0x90 0x91 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_0(_tokenSet_0_data_,16);
 const unsigned long PFCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xb 0xc 0xe 0xf 0x10 0x11 0x12 0x13 0x14 
@@ -1738,7 +1743,7 @@ const unsigned long PFCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 4294967295
 // & \' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G 
 // H I J K L M N O P Q R S T U V W X Y Z [ 0x5c ] ^ _ ` a b c d e f g h 
 // i j k l m n o p q r s t u v w x y z { | } ~ 0x7f 0x80 0x81 0x82 0x83 
-// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 
+// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 0x91 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_1(_tokenSet_1_data_,16);
 const unsigned long PFCfgLexer::_tokenSet_2_data_[] = { 0UL, 67059712UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // . 0 1 2 3 4 5 6 7 8 9 
@@ -1753,6 +1758,6 @@ const unsigned long PFCfgLexer::_tokenSet_4_data_[] = { 4294967288UL, 4294967291
 // % & \' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F 
 // G H I J K L M N O P Q R S T U V W X Y Z [ 0x5c ] ^ _ ` a b c d e f g 
 // h i j k l m n o p q r s t u v w x y z { | } ~ 0x7f 0x80 0x81 0x82 0x83 
-// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 
+// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 0x91 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_4(_tokenSet_4_data_,16);
 

src/parsers/PFCfgParser.cpp

@@ -531,12 +531,58 @@ void PFCfgParser::block_command() {
 		*dbg << LT(1)->getLine() << ":" << " block   ";
 		
 #line 534 "PFCfgParser.cpp"
+		{
+		switch ( LA(1)) {
+		case DROP:
+		case RETURN:
+		case RETURN_RST:
+		case RETURN_ICMP:
+		case RETURN_ICMP6:
+		{
+			block_return();
+			break;
+		}
+		case NEWLINE:
+		case QUEUE:
+		case EXLAMATION:
+		case IN:
+		case OUT:
+		case LOG:
+		case ALL:
+		case TO:
+		case QUICK:
+		case ON:
+		case INET:
+		case INET6:
+		case PROTO:
+		case FROM:
+		case ROUTE_TO:
+		case REPLY_TO:
+		case FLAGS:
+		case ICMP_TYPE:
+		case ICMP6_TYPE:
+		case TAGGED:
+		case TAG:
+		case NO:
+		case KEEP:
+		case MODULATE:
+		case SYNPROXY:
+		case LABEL:
+		{
+			break;
+		}
+		default:
+		{
+			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+		}
+		}
+		}
 		rule_extended();
-#line 393 "pf.g"
+#line 394 "pf.g"
 		
 		importer->pushRule();
 		
-#line 540 "PFCfgParser.cpp"
+#line 586 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -558,7 +604,7 @@ void PFCfgParser::timeout_command() {
 		QString("Warning: import of 'timeout' commands has not been implemented yet."));
 		consumeUntil(NEWLINE);
 		
-#line 562 "PFCfgParser.cpp"
+#line 608 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -577,7 +623,7 @@ void PFCfgParser::unknown_command() {
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		consumeUntil(NEWLINE);
 		
-#line 581 "PFCfgParser.cpp"
+#line 627 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -589,7 +635,7 @@ void PFCfgParser::tableaddr_spec() {
 	Tracer traceInOut(this, "tableaddr_spec");
 #line 250 "pf.g"
 	AddressSpec as;
-#line 593 "PFCfgParser.cpp"
+#line 639 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -599,7 +645,7 @@ void PFCfgParser::tableaddr_spec() {
 			match(EXLAMATION);
 #line 251 "pf.g"
 			as.neg = true;
-#line 603 "PFCfgParser.cpp"
+#line 649 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -624,7 +670,7 @@ void PFCfgParser::tableaddr_spec() {
 			as.at = AddressSpec::INTERFACE_NAME;
 			as.address = LT(0)->getText();
 			
-#line 628 "PFCfgParser.cpp"
+#line 674 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -639,7 +685,7 @@ void PFCfgParser::tableaddr_spec() {
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 643 "PFCfgParser.cpp"
+#line 689 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
@@ -649,7 +695,7 @@ void PFCfgParser::tableaddr_spec() {
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 653 "PFCfgParser.cpp"
+#line 699 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
@@ -660,7 +706,7 @@ void PFCfgParser::tableaddr_spec() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 664 "PFCfgParser.cpp"
+#line 710 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
@@ -671,7 +717,7 @@ void PFCfgParser::tableaddr_spec() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 675 "PFCfgParser.cpp"
+#line 721 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -707,7 +753,7 @@ void PFCfgParser::tableaddr_spec() {
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 711 "PFCfgParser.cpp"
+#line 757 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV4:
@@ -718,7 +764,7 @@ void PFCfgParser::tableaddr_spec() {
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 722 "PFCfgParser.cpp"
+#line 768 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
@@ -728,7 +774,7 @@ void PFCfgParser::tableaddr_spec() {
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 732 "PFCfgParser.cpp"
+#line 778 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -751,7 +797,7 @@ void PFCfgParser::tableaddr_spec() {
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 755 "PFCfgParser.cpp"
+#line 801 "PFCfgParser.cpp"
 				break;
 			}
 			case WORD:
@@ -781,7 +827,7 @@ void PFCfgParser::tableaddr_spec() {
 		
 		importer->tmp_group.push_back(as);
 		
-#line 785 "PFCfgParser.cpp"
+#line 831 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1096,6 +1142,223 @@ void PFCfgParser::rule_extended() {
 	}
 }
 
+void PFCfgParser::block_return() {
+	Tracer traceInOut(this, "block_return");
+	
+	try {      // for error handling
+		{
+		switch ( LA(1)) {
+		case DROP:
+		{
+			match(DROP);
+#line 402 "pf.g"
+			importer->block_action_params.push_back("drop");
+#line 1157 "PFCfgParser.cpp"
+			break;
+		}
+		case RETURN:
+		{
+			match(RETURN);
+#line 404 "pf.g"
+			importer->block_action_params.push_back("return");
+#line 1165 "PFCfgParser.cpp"
+			break;
+		}
+		case RETURN_RST:
+		{
+			match(RETURN_RST);
+#line 406 "pf.g"
+			importer->block_action_params.push_back("return-rst");
+#line 1173 "PFCfgParser.cpp"
+			{
+			switch ( LA(1)) {
+			case TTL:
+			{
+				match(TTL);
+				match(INT_CONST);
+#line 409 "pf.g"
+				
+				importer->error_tracker->registerError(
+				QString("Import of \"block return-rst ttl number\" is not supported. "));
+				
+#line 1185 "PFCfgParser.cpp"
+				break;
+			}
+			case NEWLINE:
+			case QUEUE:
+			case EXLAMATION:
+			case IN:
+			case OUT:
+			case LOG:
+			case ALL:
+			case TO:
+			case QUICK:
+			case ON:
+			case INET:
+			case INET6:
+			case PROTO:
+			case FROM:
+			case ROUTE_TO:
+			case REPLY_TO:
+			case FLAGS:
+			case ICMP_TYPE:
+			case ICMP6_TYPE:
+			case TAGGED:
+			case TAG:
+			case NO:
+			case KEEP:
+			case MODULATE:
+			case SYNPROXY:
+			case LABEL:
+			{
+				break;
+			}
+			default:
+			{
+				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+			}
+			}
+			}
+			break;
+		}
+		case RETURN_ICMP:
+		{
+			match(RETURN_ICMP);
+#line 415 "pf.g"
+			importer->block_action_params.push_back("return-icmp");
+#line 1230 "PFCfgParser.cpp"
+			{
+			switch ( LA(1)) {
+			case OPENING_PAREN:
+			{
+				match(OPENING_PAREN);
+				{
+				switch ( LA(1)) {
+				case WORD:
+				{
+					match(WORD);
+					break;
+				}
+				case INT_CONST:
+				{
+					match(INT_CONST);
+					break;
+				}
+				default:
+				{
+					throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+				}
+				}
+				}
+#line 419 "pf.g"
+				importer->block_action_params.push_back(LT(0)->getText());
+#line 1256 "PFCfgParser.cpp"
+				{
+				switch ( LA(1)) {
+				case COMMA:
+				{
+					match(COMMA);
+					{
+					switch ( LA(1)) {
+					case WORD:
+					{
+						match(WORD);
+						break;
+					}
+					case INT_CONST:
+					{
+						match(INT_CONST);
+						break;
+					}
+					default:
+					{
+						throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+					}
+					}
+					}
+#line 423 "pf.g"
+					
+					importer->error_tracker->registerError(
+					QString("Import of \"block return-icmp (icmp_code, icmp6_code)\" is not supported"));
+					
+#line 1285 "PFCfgParser.cpp"
+					break;
+				}
+				case CLOSING_PAREN:
+				{
+					break;
+				}
+				default:
+				{
+					throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+				}
+				}
+				}
+				match(CLOSING_PAREN);
+				break;
+			}
+			case NEWLINE:
+			case QUEUE:
+			case EXLAMATION:
+			case IN:
+			case OUT:
+			case LOG:
+			case ALL:
+			case TO:
+			case QUICK:
+			case ON:
+			case INET:
+			case INET6:
+			case PROTO:
+			case FROM:
+			case ROUTE_TO:
+			case REPLY_TO:
+			case FLAGS:
+			case ICMP_TYPE:
+			case ICMP6_TYPE:
+			case TAGGED:
+			case TAG:
+			case NO:
+			case KEEP:
+			case MODULATE:
+			case SYNPROXY:
+			case LABEL:
+			{
+				break;
+			}
+			default:
+			{
+				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+			}
+			}
+			}
+			break;
+		}
+		case RETURN_ICMP6:
+		{
+			match(RETURN_ICMP6);
+#line 432 "pf.g"
+			
+			importer->error_tracker->registerError(
+			QString("Import of \"block return-icmp6\" is not supported"));
+			importer->block_action_params.push_back("return-icmp");
+			
+#line 1347 "PFCfgParser.cpp"
+			break;
+		}
+		default:
+		{
+			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+		}
+		}
+		}
+	}
+	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
+		reportError(ex);
+		recover(ex,_tokenSet_9);
+	}
+}
+
 void PFCfgParser::direction() {
 	Tracer traceInOut(this, "direction");
 	
@@ -1118,15 +1381,15 @@ void PFCfgParser::direction() {
 		}
 		}
 		}
-#line 412 "pf.g"
+#line 453 "pf.g"
 		
 		importer->direction = LT(0)->getText();
 		
-#line 1126 "PFCfgParser.cpp"
+#line 1389 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_9);
+		recover(ex,_tokenSet_10);
 	}
 }
 
@@ -1174,15 +1437,15 @@ void PFCfgParser::logging() {
 		}
 		}
 		}
-#line 419 "pf.g"
+#line 460 "pf.g"
 		
 		importer->logging = true;
 		
-#line 1182 "PFCfgParser.cpp"
+#line 1445 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_10);
+		recover(ex,_tokenSet_11);
 	}
 }
 
@@ -1191,15 +1454,15 @@ void PFCfgParser::quick() {
 	
 	try {      // for error handling
 		match(QUICK);
-#line 441 "pf.g"
+#line 482 "pf.g"
 		
 		importer->quick = true;
 		
-#line 1199 "PFCfgParser.cpp"
+#line 1462 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_11);
+		recover(ex,_tokenSet_12);
 	}
 }
 
@@ -1230,7 +1493,7 @@ void PFCfgParser::intrface() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_12);
+		recover(ex,_tokenSet_13);
 	}
 }
 
@@ -1257,7 +1520,7 @@ void PFCfgParser::route() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_13);
+		recover(ex,_tokenSet_14);
 	}
 }
 
@@ -1274,11 +1537,11 @@ void PFCfgParser::address_family() {
 		case INET6:
 		{
 			match(INET6);
-#line 471 "pf.g"
+#line 512 "pf.g"
 			
 			importer->address_family = LT(0)->getText();
 			
-#line 1282 "PFCfgParser.cpp"
+#line 1545 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -1289,7 +1552,7 @@ void PFCfgParser::address_family() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_14);
+		recover(ex,_tokenSet_15);
 	}
 }
 
@@ -1314,14 +1577,14 @@ void PFCfgParser::hosts() {
 		case ALL:
 		{
 			match(ALL);
-#line 514 "pf.g"
+#line 555 "pf.g"
 			
 			importer->src_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			importer->dst_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 1325 "PFCfgParser.cpp"
+#line 1588 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -1420,7 +1683,7 @@ void PFCfgParser::filteropts() {
 		filteropt();
 		{ // ( ... )*
 		for (;;) {
-			if ((_tokenSet_15.member(LA(1)))) {
+			if ((_tokenSet_16.member(LA(1)))) {
 				{
 				switch ( LA(1)) {
 				case COMMA:
@@ -1452,11 +1715,11 @@ void PFCfgParser::filteropts() {
 				filteropt();
 			}
 			else {
-				goto _loop110;
+				goto _loop118;
 			}
 			
 		}
-		_loop110:;
+		_loop118:;
 		} // ( ... )*
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1475,23 +1738,23 @@ void PFCfgParser::logopts() {
 		for (;;) {
 			if ((LA(1) == COMMA)) {
 				match(COMMA);
-#line 428 "pf.g"
+#line 469 "pf.g"
 				importer->logopts += ",";
-#line 1481 "PFCfgParser.cpp"
+#line 1744 "PFCfgParser.cpp"
 				logopt();
 			}
 			else {
-				goto _loop49;
+				goto _loop57;
 			}
 			
 		}
-		_loop49:;
+		_loop57:;
 		} // ( ... )*
 		match(CLOSING_PAREN);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_10);
+		recover(ex,_tokenSet_11);
 	}
 }
 
@@ -1514,11 +1777,11 @@ void PFCfgParser::logopt() {
 		{
 			match(TO);
 			match(WORD);
-#line 435 "pf.g"
+#line 476 "pf.g"
 			
 			importer->logopts += LT(0)->getText();
 			
-#line 1522 "PFCfgParser.cpp"
+#line 1785 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -1529,15 +1792,15 @@ void PFCfgParser::logopt() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_16);
+		recover(ex,_tokenSet_17);
 	}
 }
 
 void PFCfgParser::ifspec() {
 	Tracer traceInOut(this, "ifspec");
-#line 449 "pf.g"
+#line 490 "pf.g"
 	InterfaceSpec is;
-#line 1541 "PFCfgParser.cpp"
+#line 1804 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -1545,9 +1808,9 @@ void PFCfgParser::ifspec() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 450 "pf.g"
+#line 491 "pf.g"
 			is.neg = true;
-#line 1551 "PFCfgParser.cpp"
+#line 1814 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -1561,17 +1824,17 @@ void PFCfgParser::ifspec() {
 		}
 		}
 		match(WORD);
-#line 452 "pf.g"
+#line 493 "pf.g"
 		
 		is.name = LT(0)->getText();
 		importer->iface_group.push_back(is);
 		importer->newInterface(is.name);
 		
-#line 1571 "PFCfgParser.cpp"
+#line 1834 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_17);
+		recover(ex,_tokenSet_18);
 	}
 }
 
@@ -1605,17 +1868,17 @@ void PFCfgParser::interface_list() {
 				ifspec();
 			}
 			else {
-				goto _loop59;
+				goto _loop67;
 			}
 			
 		}
-		_loop59:;
+		_loop67:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_12);
+		recover(ex,_tokenSet_13);
 	}
 }
 
@@ -1664,7 +1927,7 @@ void PFCfgParser::proto_def() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_18);
+		recover(ex,_tokenSet_19);
 	}
 }
 
@@ -1760,15 +2023,15 @@ void PFCfgParser::proto_name() {
 		}
 		}
 		}
-#line 491 "pf.g"
+#line 532 "pf.g"
 		
 		importer->proto_list.push_back(LT(0)->getText());
 		
-#line 1768 "PFCfgParser.cpp"
+#line 2031 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_18);
+		recover(ex,_tokenSet_19);
 	}
 }
 
@@ -1777,15 +2040,15 @@ void PFCfgParser::proto_number() {
 	
 	try {      // for error handling
 		match(INT_CONST);
-#line 497 "pf.g"
+#line 538 "pf.g"
 		
 		importer->proto_list.push_back(LT(0)->getText());
 		
-#line 1785 "PFCfgParser.cpp"
+#line 2048 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_18);
+		recover(ex,_tokenSet_19);
 	}
 }
 
@@ -1797,7 +2060,7 @@ void PFCfgParser::proto_list() {
 		proto_def();
 		{ // ( ... )*
 		for (;;) {
-			if ((_tokenSet_19.member(LA(1)))) {
+			if ((_tokenSet_20.member(LA(1)))) {
 				{
 				switch ( LA(1)) {
 				case COMMA:
@@ -1835,17 +2098,17 @@ void PFCfgParser::proto_list() {
 				proto_def();
 			}
 			else {
-				goto _loop70;
+				goto _loop78;
 			}
 			
 		}
-		_loop70:;
+		_loop78:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_18);
+		recover(ex,_tokenSet_19);
 	}
 }
 
@@ -1855,10 +2118,10 @@ void PFCfgParser::hosts_from() {
 	try {      // for error handling
 		match(FROM);
 		{
-		if ((_tokenSet_20.member(LA(1))) && (_tokenSet_21.member(LA(2)))) {
+		if ((_tokenSet_21.member(LA(1))) && (_tokenSet_22.member(LA(2)))) {
 			src_hosts_part();
 		}
-		else if ((_tokenSet_22.member(LA(1))) && (_tokenSet_23.member(LA(2)))) {
+		else if ((_tokenSet_23.member(LA(1))) && (_tokenSet_24.member(LA(2)))) {
 		}
 		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -1898,7 +2161,7 @@ void PFCfgParser::hosts_from() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_24);
+		recover(ex,_tokenSet_25);
 	}
 }
 
@@ -1908,10 +2171,10 @@ void PFCfgParser::hosts_to() {
 	try {      // for error handling
 		match(TO);
 		{
-		if ((_tokenSet_25.member(LA(1))) && (_tokenSet_26.member(LA(2)))) {
+		if ((_tokenSet_26.member(LA(1))) && (_tokenSet_27.member(LA(2)))) {
 			dst_hosts_part();
 		}
-		else if ((_tokenSet_27.member(LA(1))) && (_tokenSet_28.member(LA(2)))) {
+		else if ((_tokenSet_28.member(LA(1))) && (_tokenSet_29.member(LA(2)))) {
 		}
 		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -1976,13 +2239,13 @@ void PFCfgParser::src_hosts_part() {
 		case URPF_FAILED:
 		{
 			match(URPF_FAILED);
-#line 537 "pf.g"
+#line 578 "pf.g"
 			
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false,
 			"urpf-failed", ""));
 			
-#line 1986 "PFCfgParser.cpp"
+#line 2249 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -1991,17 +2254,17 @@ void PFCfgParser::src_hosts_part() {
 		}
 		}
 		}
-#line 543 "pf.g"
+#line 584 "pf.g"
 		
 		importer->src_neg = importer->tmp_neg;
 		importer->src_group.splice(importer->src_group.begin(),
 		importer->tmp_group);
 		
-#line 2001 "PFCfgParser.cpp"
+#line 2264 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_22);
+		recover(ex,_tokenSet_23);
 	}
 }
 
@@ -2033,16 +2296,16 @@ void PFCfgParser::src_port_part() {
 		}
 		}
 		}
-#line 861 "pf.g"
+#line 902 "pf.g"
 		
 		importer->src_port_group.splice(importer->src_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 2042 "PFCfgParser.cpp"
+#line 2305 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_24);
+		recover(ex,_tokenSet_25);
 	}
 }
 
@@ -2051,17 +2314,17 @@ void PFCfgParser::dst_hosts_part() {
 	
 	try {      // for error handling
 		common_hosts_part();
-#line 552 "pf.g"
+#line 593 "pf.g"
 		
 		importer->dst_neg = importer->tmp_neg;
 		importer->dst_group.splice(importer->dst_group.begin(),
 		importer->tmp_group);
 		
-#line 2061 "PFCfgParser.cpp"
+#line 2324 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_27);
+		recover(ex,_tokenSet_28);
 	}
 }
 
@@ -2093,12 +2356,12 @@ void PFCfgParser::dst_port_part() {
 		}
 		}
 		}
-#line 869 "pf.g"
+#line 910 "pf.g"
 		
 		importer->dst_port_group.splice(importer->dst_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 2102 "PFCfgParser.cpp"
+#line 2365 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2114,23 +2377,23 @@ void PFCfgParser::common_hosts_part() {
 		case ANY:
 		{
 			match(ANY);
-#line 561 "pf.g"
+#line 602 "pf.g"
 			
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 2123 "PFCfgParser.cpp"
+#line 2386 "PFCfgParser.cpp"
 			break;
 		}
 		case NO_ROUTE:
 		{
 			match(NO_ROUTE);
-#line 567 "pf.g"
+#line 608 "pf.g"
 			
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false, "no-route", ""));
 			
-#line 2134 "PFCfgParser.cpp"
+#line 2397 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -2156,16 +2419,16 @@ void PFCfgParser::common_hosts_part() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_22);
+		recover(ex,_tokenSet_23);
 	}
 }
 
 void PFCfgParser::host() {
 	Tracer traceInOut(this, "host");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  tn = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 577 "pf.g"
+#line 618 "pf.g"
 	AddressSpec as;
-#line 2169 "PFCfgParser.cpp"
+#line 2432 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -2173,9 +2436,9 @@ void PFCfgParser::host() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 578 "pf.g"
+#line 619 "pf.g"
 			as.neg = true;
-#line 2179 "PFCfgParser.cpp"
+#line 2442 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -2197,13 +2460,13 @@ void PFCfgParser::host() {
 		case WORD:
 		{
 			match(WORD);
-#line 581 "pf.g"
+#line 622 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_NAME;
 			as.address = LT(0)->getText();
 			
-#line 2207 "PFCfgParser.cpp"
+#line 2470 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -2214,43 +2477,43 @@ void PFCfgParser::host() {
 				case NETWORK:
 				{
 					match(NETWORK);
-#line 590 "pf.g"
+#line 631 "pf.g"
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 2222 "PFCfgParser.cpp"
+#line 2485 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
 				{
 					match(BROADCAST);
-#line 595 "pf.g"
+#line 636 "pf.g"
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 2232 "PFCfgParser.cpp"
+#line 2495 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
 				{
 					match(PEER);
-#line 600 "pf.g"
+#line 641 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 2243 "PFCfgParser.cpp"
+#line 2506 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
 				{
 					match(INT_CONST);
-#line 606 "pf.g"
+#line 647 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 2254 "PFCfgParser.cpp"
+#line 2517 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -2292,44 +2555,44 @@ void PFCfgParser::host() {
 		case SELF:
 		{
 			match(SELF);
-#line 614 "pf.g"
+#line 655 "pf.g"
 			
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 2301 "PFCfgParser.cpp"
+#line 2564 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV6:
 		{
 			match(IPV6);
-#line 620 "pf.g"
+#line 661 "pf.g"
 			
 			importer->addMessageToLog(QString("IPv6 import is not supported. "));
 			consumeUntil(NEWLINE);
 			
-#line 2312 "PFCfgParser.cpp"
+#line 2575 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV4:
 		{
 			match(IPV4);
-#line 626 "pf.g"
+#line 667 "pf.g"
 			
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 2323 "PFCfgParser.cpp"
+#line 2586 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
 			{
 				match(SLASH);
-#line 632 "pf.g"
+#line 673 "pf.g"
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 2333 "PFCfgParser.cpp"
+#line 2596 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -2348,11 +2611,11 @@ void PFCfgParser::host() {
 				}
 				}
 				}
-#line 636 "pf.g"
+#line 677 "pf.g"
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 2356 "PFCfgParser.cpp"
+#line 2619 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -2389,12 +2652,12 @@ void PFCfgParser::host() {
 			tn = LT(1);
 			match(WORD);
 			match(GREATER_THAN);
-#line 642 "pf.g"
+#line 683 "pf.g"
 			
 			as.at = AddressSpec::TABLE;
 			as.address = tn->getText();
 			
-#line 2398 "PFCfgParser.cpp"
+#line 2661 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -2403,15 +2666,15 @@ void PFCfgParser::host() {
 		}
 		}
 		}
-#line 647 "pf.g"
+#line 688 "pf.g"
 		
 		importer->tmp_group.push_back(as);
 		
-#line 2411 "PFCfgParser.cpp"
+#line 2674 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_29);
+		recover(ex,_tokenSet_30);
 	}
 }
 
@@ -2428,17 +2691,17 @@ void PFCfgParser::host_list() {
 				host();
 			}
 			else {
-				goto _loop93;
+				goto _loop101;
 			}
 			
 		}
-		_loop93:;
+		_loop101:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_22);
+		recover(ex,_tokenSet_23);
 	}
 }
 
@@ -2465,15 +2728,15 @@ void PFCfgParser::route_to() {
 		}
 		}
 		}
-#line 669 "pf.g"
+#line 710 "pf.g"
 		
 		importer->route_type = PFImporter::ROUTE_TO;
 		
-#line 2473 "PFCfgParser.cpp"
+#line 2736 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_13);
+		recover(ex,_tokenSet_14);
 	}
 }
 
@@ -2500,15 +2763,15 @@ void PFCfgParser::reply_to() {
 		}
 		}
 		}
-#line 676 "pf.g"
+#line 717 "pf.g"
 		
 		importer->route_type = PFImporter::REPLY_TO;
 		
-#line 2508 "PFCfgParser.cpp"
+#line 2771 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_13);
+		recover(ex,_tokenSet_14);
 	}
 }
 
@@ -2518,16 +2781,16 @@ void PFCfgParser::routehost() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  v6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 681 "pf.g"
+#line 722 "pf.g"
 	RouteSpec rs;
-#line 2524 "PFCfgParser.cpp"
+#line 2787 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
 		match(WORD);
-#line 683 "pf.g"
+#line 724 "pf.g"
 		rs.iface = LT(0)->getText();
-#line 2531 "PFCfgParser.cpp"
+#line 2794 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case IPV4:
@@ -2585,7 +2848,7 @@ void PFCfgParser::routehost() {
 		}
 		}
 		}
-#line 685 "pf.g"
+#line 726 "pf.g"
 		
 		if (v6)
 		{
@@ -2598,12 +2861,12 @@ void PFCfgParser::routehost() {
 		importer->route_group.push_back(rs);
 		}
 		
-#line 2602 "PFCfgParser.cpp"
+#line 2865 "PFCfgParser.cpp"
 		match(CLOSING_PAREN);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_30);
+		recover(ex,_tokenSet_31);
 	}
 }
 
@@ -2636,17 +2899,17 @@ void PFCfgParser::routehost_list() {
 				routehost();
 			}
 			else {
-				goto _loop106;
+				goto _loop114;
 			}
 			
 		}
-		_loop106:;
+		_loop114:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_13);
+		recover(ex,_tokenSet_14);
 	}
 }
 
@@ -2707,7 +2970,7 @@ void PFCfgParser::filteropt() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2723,12 +2986,12 @@ void PFCfgParser::tcp_flags() {
 		case ANY:
 		{
 			match(ANY);
-#line 741 "pf.g"
+#line 782 "pf.g"
 			
 			importer->flags_check = "none";
 			importer->flags_mask = "none";
 			
-#line 2732 "PFCfgParser.cpp"
+#line 2995 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -2784,7 +3047,7 @@ void PFCfgParser::tcp_flags() {
 			}
 			}
 			}
-#line 747 "pf.g"
+#line 788 "pf.g"
 			
 			if (check)
 			importer->flags_check = check->getText();
@@ -2795,7 +3058,7 @@ void PFCfgParser::tcp_flags() {
 			else
 			importer->flags_mask = "all";
 			
-#line 2799 "PFCfgParser.cpp"
+#line 3062 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -2807,7 +3070,7 @@ void PFCfgParser::tcp_flags() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2838,7 +3101,7 @@ void PFCfgParser::icmp_type() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2847,16 +3110,16 @@ void PFCfgParser::icmp6_type() {
 	
 	try {      // for error handling
 		match(ICMP6_TYPE);
-#line 801 "pf.g"
+#line 842 "pf.g"
 		
 		importer->addMessageToLog(QString("ICMP6 import is not supported. "));
 		consumeUntil(NEWLINE);
 		
-#line 2856 "PFCfgParser.cpp"
+#line 3119 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2869,9 +3132,9 @@ void PFCfgParser::tagged() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 808 "pf.g"
+#line 849 "pf.g"
 			importer->tagged_neg = true;
-#line 2875 "PFCfgParser.cpp"
+#line 3138 "PFCfgParser.cpp"
 			break;
 		}
 		case TAGGED:
@@ -2886,15 +3149,15 @@ void PFCfgParser::tagged() {
 		}
 		match(TAGGED);
 		match(WORD);
-#line 810 "pf.g"
+#line 851 "pf.g"
 		
 		importer->tagged = LT(0)->getText();
 		
-#line 2894 "PFCfgParser.cpp"
+#line 3157 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2904,15 +3167,15 @@ void PFCfgParser::tag_clause() {
 	try {      // for error handling
 		match(TAG);
 		match(WORD);
-#line 817 "pf.g"
+#line 858 "pf.g"
 		
 		importer->tag = LT(0)->getText();
 		
-#line 2912 "PFCfgParser.cpp"
+#line 3175 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2948,16 +3211,16 @@ void PFCfgParser::state() {
 		}
 		}
 		}
-#line 832 "pf.g"
+#line 873 "pf.g"
 		
 		importer->state_op = LT(0)->getText();
 		
-#line 2956 "PFCfgParser.cpp"
+#line 3219 "PFCfgParser.cpp"
 		match(STATE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -2971,36 +3234,36 @@ void PFCfgParser::queue() {
 		case WORD:
 		{
 			match(WORD);
-#line 841 "pf.g"
+#line 882 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 2977 "PFCfgParser.cpp"
+#line 3240 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
 		{
 			match(OPENING_PAREN);
 			match(WORD);
-#line 844 "pf.g"
+#line 885 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 2986 "PFCfgParser.cpp"
+#line 3249 "PFCfgParser.cpp"
 			{ // ( ... )*
 			for (;;) {
 				if ((LA(1) == COMMA)) {
 					match(COMMA);
-#line 846 "pf.g"
+#line 887 "pf.g"
 					importer->queue += ",";
-#line 2993 "PFCfgParser.cpp"
+#line 3256 "PFCfgParser.cpp"
 					match(WORD);
-#line 847 "pf.g"
+#line 888 "pf.g"
 					importer->queue += LT(0)->getText();
-#line 2997 "PFCfgParser.cpp"
+#line 3260 "PFCfgParser.cpp"
 				}
 				else {
-					goto _loop135;
+					goto _loop143;
 				}
 				
 			}
-			_loop135:;
+			_loop143:;
 			} // ( ... )*
 			match(CLOSING_PAREN);
 			break;
@@ -3014,7 +3277,7 @@ void PFCfgParser::queue() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
@@ -3027,15 +3290,15 @@ void PFCfgParser::label() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
 void PFCfgParser::icmp_type_code() {
 	Tracer traceInOut(this, "icmp_type_code");
-#line 769 "pf.g"
+#line 810 "pf.g"
 	IcmpSpec is;
-#line 3039 "PFCfgParser.cpp"
+#line 3302 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -3043,17 +3306,17 @@ void PFCfgParser::icmp_type_code() {
 		case WORD:
 		{
 			match(WORD);
-#line 771 "pf.g"
+#line 812 "pf.g"
 			is.icmp_type_name = LT(0)->getText();
-#line 3049 "PFCfgParser.cpp"
+#line 3312 "PFCfgParser.cpp"
 			break;
 		}
 		case INT_CONST:
 		{
 			match(INT_CONST);
-#line 773 "pf.g"
+#line 814 "pf.g"
 			is.icmp_type_int = LT(0)->getText();
-#line 3057 "PFCfgParser.cpp"
+#line 3320 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3072,17 +3335,17 @@ void PFCfgParser::icmp_type_code() {
 			case WORD:
 			{
 				match(WORD);
-#line 778 "pf.g"
+#line 819 "pf.g"
 				is.icmp_code_name = LT(0)->getText();
-#line 3078 "PFCfgParser.cpp"
+#line 3341 "PFCfgParser.cpp"
 				break;
 			}
 			case INT_CONST:
 			{
 				match(INT_CONST);
-#line 780 "pf.g"
+#line 821 "pf.g"
 				is.icmp_code_int = LT(0)->getText();
-#line 3086 "PFCfgParser.cpp"
+#line 3349 "PFCfgParser.cpp"
 				break;
 			}
 			default:
@@ -3119,15 +3382,15 @@ void PFCfgParser::icmp_type_code() {
 		}
 		}
 		}
-#line 783 "pf.g"
+#line 824 "pf.g"
 		
 		importer->icmp_type_code_group.push_back(is);
 		
-#line 3127 "PFCfgParser.cpp"
+#line 3390 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_32);
+		recover(ex,_tokenSet_33);
 	}
 }
 
@@ -3161,25 +3424,25 @@ void PFCfgParser::icmp_list() {
 				icmp_type_code();
 			}
 			else {
-				goto _loop125;
+				goto _loop133;
 			}
 			
 		}
-		_loop125:;
+		_loop133:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_31);
+		recover(ex,_tokenSet_32);
 	}
 }
 
 void PFCfgParser::port_op() {
 	Tracer traceInOut(this, "port_op");
-#line 901 "pf.g"
+#line 942 "pf.g"
 	PortSpec ps;
-#line 3183 "PFCfgParser.cpp"
+#line 3446 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -3190,41 +3453,41 @@ void PFCfgParser::port_op() {
 		case EXLAMATION:
 		{
 			unary_port_op();
-#line 903 "pf.g"
+#line 944 "pf.g"
 			ps.port_op = importer->tmp_port_op;
-#line 3196 "PFCfgParser.cpp"
+#line 3459 "PFCfgParser.cpp"
 			port_def();
-#line 905 "pf.g"
+#line 946 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = importer->tmp_port_def;
 			
-#line 3203 "PFCfgParser.cpp"
+#line 3466 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
 		case INT_CONST:
 		{
 			port_def();
-#line 911 "pf.g"
+#line 952 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = ps.port1;
 			ps.port_op = "=";
 			
-#line 3216 "PFCfgParser.cpp"
+#line 3479 "PFCfgParser.cpp"
 			{
-			if ((LA(1) == LESS_THAN || LA(1) == GREATER_THAN || LA(1) == COLON) && (_tokenSet_33.member(LA(2)))) {
+			if ((LA(1) == LESS_THAN || LA(1) == GREATER_THAN || LA(1) == COLON) && (_tokenSet_34.member(LA(2)))) {
 				binary_port_op();
-#line 917 "pf.g"
+#line 958 "pf.g"
 				ps.port_op = importer->tmp_port_op;
-#line 3222 "PFCfgParser.cpp"
+#line 3485 "PFCfgParser.cpp"
 				port_def();
-#line 918 "pf.g"
+#line 959 "pf.g"
 				ps.port2 = LT(0)->getText();
-#line 3226 "PFCfgParser.cpp"
+#line 3489 "PFCfgParser.cpp"
 			}
-			else if ((_tokenSet_34.member(LA(1))) && (_tokenSet_35.member(LA(2)))) {
+			else if ((_tokenSet_35.member(LA(1))) && (_tokenSet_36.member(LA(2)))) {
 			}
 			else {
 				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -3239,15 +3502,15 @@ void PFCfgParser::port_op() {
 		}
 		}
 		}
-#line 921 "pf.g"
+#line 962 "pf.g"
 		
 		importer->tmp_port_group.push_back(ps);
 		
-#line 3247 "PFCfgParser.cpp"
+#line 3510 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_34);
+		recover(ex,_tokenSet_35);
 	}
 }
 
@@ -3259,7 +3522,7 @@ void PFCfgParser::port_op_list() {
 		port_op();
 		{ // ( ... )*
 		for (;;) {
-			if ((_tokenSet_36.member(LA(1)))) {
+			if ((_tokenSet_37.member(LA(1)))) {
 				{
 				switch ( LA(1)) {
 				case COMMA:
@@ -3285,17 +3548,17 @@ void PFCfgParser::port_op_list() {
 				port_op();
 			}
 			else {
-				goto _loop153;
+				goto _loop161;
 			}
 			
 		}
-		_loop153:;
+		_loop161:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_24);
+		recover(ex,_tokenSet_25);
 	}
 }
 
@@ -3308,46 +3571,46 @@ void PFCfgParser::unary_port_op() {
 		case EQUAL:
 		{
 			match(EQUAL);
-#line 877 "pf.g"
+#line 918 "pf.g"
 			importer->tmp_port_op = "=";
-#line 3314 "PFCfgParser.cpp"
+#line 3577 "PFCfgParser.cpp"
 			break;
 		}
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
 			match(EQUAL);
-#line 879 "pf.g"
+#line 920 "pf.g"
 			importer->tmp_port_op = "!=";
-#line 3323 "PFCfgParser.cpp"
+#line 3586 "PFCfgParser.cpp"
 			break;
 		}
 		default:
 			if ((LA(1) == LESS_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(LESS_THAN);
-#line 881 "pf.g"
+#line 922 "pf.g"
 				importer->tmp_port_op = "<";
-#line 3331 "PFCfgParser.cpp"
+#line 3594 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == LESS_THAN) && (LA(2) == EQUAL)) {
 				match(LESS_THAN);
 				match(EQUAL);
-#line 883 "pf.g"
+#line 924 "pf.g"
 				importer->tmp_port_op = "<=";
-#line 3338 "PFCfgParser.cpp"
+#line 3601 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(GREATER_THAN);
-#line 885 "pf.g"
+#line 926 "pf.g"
 				importer->tmp_port_op = ">";
-#line 3344 "PFCfgParser.cpp"
+#line 3607 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == EQUAL)) {
 				match(GREATER_THAN);
 				match(EQUAL);
-#line 887 "pf.g"
+#line 928 "pf.g"
 				importer->tmp_port_op = ">=";
-#line 3351 "PFCfgParser.cpp"
+#line 3614 "PFCfgParser.cpp"
 			}
 		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -3357,7 +3620,7 @@ void PFCfgParser::unary_port_op() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_37);
+		recover(ex,_tokenSet_38);
 	}
 }
 
@@ -3371,26 +3634,26 @@ void PFCfgParser::binary_port_op() {
 		{
 			match(LESS_THAN);
 			match(GREATER_THAN);
-#line 893 "pf.g"
+#line 934 "pf.g"
 			importer->tmp_port_op = "<>";
-#line 3377 "PFCfgParser.cpp"
+#line 3640 "PFCfgParser.cpp"
 			break;
 		}
 		case GREATER_THAN:
 		{
 			match(GREATER_THAN);
 			match(LESS_THAN);
-#line 895 "pf.g"
+#line 936 "pf.g"
 			importer->tmp_port_op = "><";
-#line 3386 "PFCfgParser.cpp"
+#line 3649 "PFCfgParser.cpp"
 			break;
 		}
 		case COLON:
 		{
 			match(COLON);
-#line 897 "pf.g"
+#line 938 "pf.g"
 			importer->tmp_port_op = ":";
-#line 3394 "PFCfgParser.cpp"
+#line 3657 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3402,7 +3665,7 @@ void PFCfgParser::binary_port_op() {
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_37);
+		recover(ex,_tokenSet_38);
 	}
 }
 
@@ -3428,15 +3691,15 @@ void PFCfgParser::port_def() {
 		}
 		}
 		}
-#line 928 "pf.g"
+#line 969 "pf.g"
 		
 		importer->tmp_port_def = LT(0)->getText();
 		
-#line 3436 "PFCfgParser.cpp"
+#line 3699 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
-		recover(ex,_tokenSet_38);
+		recover(ex,_tokenSet_39);
 	}
 }
 
@@ -3483,11 +3746,17 @@ const char* PFCfgParser::tokenNames[] = {
 	"\"timeout\"",
 	"\"pass\"",
 	"\"block\"",
+	"\"drop\"",
+	"\"return\"",
+	"\"return-rst\"",
+	"TTL",
+	"\"return-icmp\"",
+	"OPENING_PAREN",
+	"CLOSING_PAREN",
+	"RETURN_ICMP6",
 	"\"in\"",
 	"\"out\"",
 	"\"log\"",
-	"OPENING_PAREN",
-	"CLOSING_PAREN",
 	"\"all\"",
 	"\"user\"",
 	"\"to\"",
@@ -3600,22 +3869,22 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_2(_tokenSet_2_data
 const unsigned long PFCfgParser::_tokenSet_3_data_[] = { 3250585664UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD COMMA CLOSING_BRACE EXLAMATION "self" IPV4 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_3(_tokenSet_3_data_,6);
-const unsigned long PFCfgParser::_tokenSet_4_data_[] = { 16778256UL, 20480UL, 6281232UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_4_data_[] = { 16778256UL, 1310720UL, 401998848UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "all" "to" "from" "flags" "icmp-type" "icmp6-type" 
 // "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_4(_tokenSet_4_data_,8);
-const unsigned long PFCfgParser::_tokenSet_5_data_[] = { 3782246258UL, 17535UL, 16767456UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_5_data_[] = { 3782246258UL, 1052799UL, 1073117184UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT WORD "antispoof" "altq" "queue" "set" "scrub" 
 // "table" LESS_THAN STRING OPENING_BRACE COMMA EXLAMATION INT_CONST "self" 
 // IPV4 SLASH "nat" "binat" "rdr" "timeout" "pass" "block" OPENING_PAREN 
 // "to" "urpf-failed" "any" "no-route" IPV6 "flags" "icmp-type" "icmp6-type" 
 // "tagged" "tag" "no" "keep" "modulate" "synproxy" "state" "label" "port" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_5(_tokenSet_5_data_,8);
-const unsigned long PFCfgParser::_tokenSet_6_data_[] = { 16778256UL, 0UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_6_data_[] = { 16778256UL, 0UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_6(_tokenSet_6_data_,8);
-const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 561004402UL, 1151UL, 8378432UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 561004402UL, 4223UL, 536219648UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT WORD "antispoof" "altq" "queue" "set" "scrub" 
 // "table" STRING OPENING_BRACE COMMA EXLAMATION INT_CONST SLASH "nat" 
 // "binat" "rdr" "timeout" "pass" "block" OPENING_PAREN "any" "flags" "icmp-type" 
@@ -3625,146 +3894,151 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_7(_tokenSet_7_data
 const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 16UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_8(_tokenSet_8_data_,6);
-const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 16778256UL, 1036800UL, 6282768UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 16778256UL, 66551808UL, 402097152UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+// NEWLINE "queue" EXLAMATION "in" "out" "log" "all" "to" "quick" "on" 
+// "inet" "inet6" "proto" "from" "route-to" "reply-to" "flags" "icmp-type" 
+// "icmp6-type" "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_9(_tokenSet_9_data_,8);
+const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 16778256UL, 66453504UL, 402097152UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "log" "all" "to" "quick" "on" "inet" "inet6" 
 // "proto" "from" "route-to" "reply-to" "flags" "icmp-type" "icmp6-type" 
 // "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_9(_tokenSet_9_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_10(_tokenSet_10_data_,8);
-const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 16778256UL, 1036288UL, 6282768UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_11_data_[] = { 16778256UL, 66322432UL, 402097152UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "all" "to" "quick" "on" "inet" "inet6" "proto" 
 // "from" "route-to" "reply-to" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_10(_tokenSet_10_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_11(_tokenSet_11_data_,8);
-const unsigned long PFCfgParser::_tokenSet_11_data_[] = { 16778256UL, 1003520UL, 6282768UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_12_data_[] = { 16778256UL, 64225280UL, 402097152UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "all" "to" "on" "inet" "inet6" "proto" "from" 
 // "route-to" "reply-to" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_11(_tokenSet_11_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_12(_tokenSet_12_data_,8);
-const unsigned long PFCfgParser::_tokenSet_12_data_[] = { 16778256UL, 937984UL, 6282768UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_13_data_[] = { 16778256UL, 60030976UL, 402097152UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "all" "to" "inet" "inet6" "proto" "from" 
 // "route-to" "reply-to" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_12(_tokenSet_12_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_13(_tokenSet_13_data_,8);
-const unsigned long PFCfgParser::_tokenSet_13_data_[] = { 16778256UL, 937984UL, 6281232UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_14_data_[] = { 16778256UL, 60030976UL, 401998848UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "all" "to" "inet" "inet6" "proto" "from" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "no" "keep" "modulate" 
 // "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_13(_tokenSet_13_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_14(_tokenSet_14_data_,8);
-const unsigned long PFCfgParser::_tokenSet_14_data_[] = { 16778256UL, 544768UL, 6281232UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_15_data_[] = { 16778256UL, 34865152UL, 401998848UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "all" "to" "proto" "from" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_14(_tokenSet_14_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_15(_tokenSet_15_data_,8);
-const unsigned long PFCfgParser::_tokenSet_15_data_[] = { 20972544UL, 0UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_16_data_[] = { 20972544UL, 0UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "queue" COMMA EXLAMATION "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_15(_tokenSet_15_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_16(_tokenSet_16_data_,8);
-const unsigned long PFCfgParser::_tokenSet_16_data_[] = { 4194304UL, 2048UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_17_data_[] = { 4194304UL, 8192UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA CLOSING_PAREN 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_16(_tokenSet_16_data_,6);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_17(_tokenSet_17_data_,6);
-const unsigned long PFCfgParser::_tokenSet_17_data_[] = { 29361232UL, 937984UL, 6282768UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_18_data_[] = { 29361232UL, 60030976UL, 402097152UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" COMMA CLOSING_BRACE EXLAMATION "all" "to" "inet" 
 // "inet6" "proto" "from" "route-to" "reply-to" "flags" "icmp-type" "icmp6-type" 
 // "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_17(_tokenSet_17_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_18(_tokenSet_18_data_,8);
-const unsigned long PFCfgParser::_tokenSet_18_data_[] = { 568329232UL, 4293939200UL, 6281247UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_19_data_[] = { 568329232UL, 4229169152UL, 401999871UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" OPENING_BRACE COMMA CLOSING_BRACE EXLAMATION INT_CONST 
 // "all" "to" "ip" "icmp" "igmp" "tcp" "udp" "rdp" "rsvp" "gre" "esp" "ah" 
 // "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" "from" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_18(_tokenSet_18_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_19(_tokenSet_19_data_,8);
-const unsigned long PFCfgParser::_tokenSet_19_data_[] = { 543162368UL, 4293918720UL, 15UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_20_data_[] = { 543162368UL, 4227858432UL, 1023UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // OPENING_BRACE COMMA INT_CONST "ip" "icmp" "igmp" "tcp" "udp" "rdp" "rsvp" 
 // "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_19(_tokenSet_19_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_20(_tokenSet_20_data_,8);
-const unsigned long PFCfgParser::_tokenSet_20_data_[] = { 3240116288UL, 0UL, 480UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_21_data_[] = { 3240116288UL, 0UL, 30720UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD LESS_THAN OPENING_BRACE EXLAMATION "self" IPV4 "urpf-failed" "any" 
 // "no-route" IPV6 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_20(_tokenSet_20_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_21(_tokenSet_21_data_,8);
-const unsigned long PFCfgParser::_tokenSet_21_data_[] = { 3271574608UL, 16385UL, 14670080UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_22_data_[] = { 3271574608UL, 1048577UL, 938885120UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" LESS_THAN EXLAMATION COLON "self" IPV4 SLASH "to" 
 // IPV6 "flags" "icmp-type" "icmp6-type" "tagged" "tag" "no" "keep" "modulate" 
 // "synproxy" "label" "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_21(_tokenSet_21_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_22(_tokenSet_22_data_,8);
-const unsigned long PFCfgParser::_tokenSet_22_data_[] = { 16778256UL, 16384UL, 14669824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_23_data_[] = { 16778256UL, 1048576UL, 938868736UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "to" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_22(_tokenSet_22_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_23(_tokenSet_23_data_,8);
-const unsigned long PFCfgParser::_tokenSet_23_data_[] = { 3782279154UL, 1151UL, 16767424UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 3782279154UL, 4223UL, 1073115136UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT WORD EQUAL "antispoof" "altq" "queue" "set" 
 // "scrub" "table" LESS_THAN GREATER_THAN STRING OPENING_BRACE COMMA EXLAMATION 
 // INT_CONST "self" IPV4 SLASH "nat" "binat" "rdr" "timeout" "pass" "block" 
 // OPENING_PAREN "any" "no-route" IPV6 "flags" "icmp-type" "icmp6-type" 
 // "tagged" "tag" "no" "keep" "modulate" "synproxy" "state" "label" "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_23(_tokenSet_23_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_24(_tokenSet_24_data_,8);
-const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 16778256UL, 16384UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 16778256UL, 1048576UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "to" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_24(_tokenSet_24_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_25(_tokenSet_25_data_,8);
-const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 3240116288UL, 0UL, 448UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 3240116288UL, 0UL, 28672UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD LESS_THAN OPENING_BRACE EXLAMATION "self" IPV4 "any" "no-route" 
 // IPV6 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_25(_tokenSet_25_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_26(_tokenSet_26_data_,8);
-const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 3271574608UL, 1UL, 14670080UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 3271574608UL, 1UL, 938885120UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" LESS_THAN EXLAMATION COLON "self" IPV4 SLASH IPV6 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "no" "keep" "modulate" 
 // "synproxy" "label" "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_26(_tokenSet_26_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_27(_tokenSet_27_data_,8);
-const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 16778256UL, 0UL, 14669824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 16778256UL, 0UL, 938868736UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" EXLAMATION "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_27(_tokenSet_27_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_28(_tokenSet_28_data_,8);
-const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 561053682UL, 1151UL, 8378432UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_29_data_[] = { 561053682UL, 4223UL, 536219648UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT WORD EQUAL "antispoof" "altq" "queue" "set" 
 // "scrub" "table" LESS_THAN GREATER_THAN STRING OPENING_BRACE COMMA EXLAMATION 
 // INT_CONST SLASH "nat" "binat" "rdr" "timeout" "pass" "block" OPENING_PAREN 
 // "any" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "no" "keep" "modulate" 
 // "synproxy" "state" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_28(_tokenSet_28_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_29(_tokenSet_29_data_,8);
-const unsigned long PFCfgParser::_tokenSet_29_data_[] = { 29361168UL, 16384UL, 14669824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 29361168UL, 1048576UL, 938868736UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA CLOSING_BRACE EXLAMATION "to" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "no" "keep" "modulate" "synproxy" "label" 
 // "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_29(_tokenSet_29_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_30(_tokenSet_30_data_,8);
-const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 29361168UL, 939008UL, 6281232UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 29361168UL, 60035072UL, 401998848UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA CLOSING_BRACE EXLAMATION OPENING_PAREN "all" "to" 
 // "inet" "inet6" "proto" "from" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_30(_tokenSet_30_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_31(_tokenSet_31_data_,8);
-const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 20972560UL, 0UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 20972560UL, 0UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA EXLAMATION "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_31(_tokenSet_31_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_32(_tokenSet_32_data_,8);
-const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 566232144UL, 0UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 566232144UL, 0UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" COMMA CLOSING_BRACE EXLAMATION INT_CONST "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "no" "keep" "modulate" "synproxy" 
 // "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_32(_tokenSet_32_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_33(_tokenSet_33_data_,8);
-const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 536920128UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_34_data_[] = { 536920128UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD LESS_THAN GREATER_THAN INT_CONST 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_33(_tokenSet_33_data_,6);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_34(_tokenSet_34_data_,6);
-const unsigned long PFCfgParser::_tokenSet_34_data_[] = { 566281424UL, 16384UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_35_data_[] = { 566281424UL, 1048576UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" LESS_THAN GREATER_THAN COMMA CLOSING_BRACE 
 // EXLAMATION INT_CONST "to" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_34(_tokenSet_34_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_35(_tokenSet_35_data_,8);
-const unsigned long PFCfgParser::_tokenSet_35_data_[] = { 3824222194UL, 17535UL, 16767424UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_36_data_[] = { 3824222194UL, 1052799UL, 1073115136UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT WORD EQUAL "antispoof" "altq" "queue" "set" 
 // "scrub" "table" LESS_THAN GREATER_THAN STRING OPENING_BRACE COMMA CLOSING_BRACE 
 // EXLAMATION COLON INT_CONST "self" IPV4 SLASH "nat" "binat" "rdr" "timeout" 
 // "pass" "block" OPENING_PAREN "to" "any" "no-route" IPV6 "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "no" "keep" "modulate" "synproxy" "state" 
 // "label" "port" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_35(_tokenSet_35_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_36(_tokenSet_36_data_,8);
-const unsigned long PFCfgParser::_tokenSet_36_data_[] = { 557891776UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_37_data_[] = { 557891776UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD EQUAL LESS_THAN GREATER_THAN COMMA EXLAMATION INT_CONST 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_36(_tokenSet_36_data_,6);
-const unsigned long PFCfgParser::_tokenSet_37_data_[] = { 536870976UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// WORD INT_CONST 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_37(_tokenSet_37_data_,6);
-const unsigned long PFCfgParser::_tokenSet_38_data_[] = { 599835856UL, 16384UL, 6281216UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_38_data_[] = { 536870976UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+// WORD INT_CONST 
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_38(_tokenSet_38_data_,6);
+const unsigned long PFCfgParser::_tokenSet_39_data_[] = { 599835856UL, 1048576UL, 401997824UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" LESS_THAN GREATER_THAN COMMA CLOSING_BRACE 
 // EXLAMATION COLON INT_CONST "to" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "no" "keep" "modulate" "synproxy" "label" 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_38(_tokenSet_38_data_,8);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_39(_tokenSet_39_data_,8);
 
 

src/parsers/PFCfgParser.hpp

@@ -107,6 +107,7 @@ public:
 	public: void unknown_command();
 	public: void tableaddr_spec();
 	public: void rule_extended();
+	public: void block_return();
 	public: void direction();
 	public: void logging();
 	public: void quick();
@@ -164,10 +165,10 @@ protected:
 private:
 	static const char* tokenNames[];
 #ifndef NO_STATIC_CONSTS
-	static const int NUM_TOKENS = 140;
+	static const int NUM_TOKENS = 146;
 #else
 	enum {
-		NUM_TOKENS = 140
+		NUM_TOKENS = 146
 	};
 #endif
 	
@@ -249,6 +250,8 @@ private:
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_37;
 	static const unsigned long _tokenSet_38_data_[];
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_38;
+	static const unsigned long _tokenSet_39_data_[];
+	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_39;
 };
 
 #endif /*INC_PFCfgParser_hpp_*/

src/parsers/PFCfgParserTokenTypes.hpp

@@ -47,107 +47,113 @@ struct CUSTOM_API PFCfgParserTokenTypes {
 		TIMEOUT = 36,
 		PASS = 37,
 		BLOCK = 38,
-		IN = 39,
+		DROP = 39,
-		OUT = 40,
+		RETURN = 40,
-		LOG = 41,
+		RETURN_RST = 41,
-		OPENING_PAREN = 42,
+		TTL = 42,
-		CLOSING_PAREN = 43,
+		RETURN_ICMP = 43,
-		ALL = 44,
+		OPENING_PAREN = 44,
-		USER = 45,
+		CLOSING_PAREN = 45,
-		TO = 46,
+		RETURN_ICMP6 = 46,
-		QUICK = 47,
+		IN = 47,
-		ON = 48,
+		OUT = 48,
-		INET = 49,
+		LOG = 49,
-		INET6 = 50,
+		ALL = 50,
-		PROTO = 51,
+		USER = 51,
-		IP = 52,
+		TO = 52,
-		ICMP = 53,
+		QUICK = 53,
-		IGMP = 54,
+		ON = 54,
-		TCP = 55,
+		INET = 55,
-		UDP = 56,
+		INET6 = 56,
-		RDP = 57,
+		PROTO = 57,
-		RSVP = 58,
+		IP = 58,
-		GRE = 59,
+		ICMP = 59,
-		ESP = 60,
+		IGMP = 60,
-		AH = 61,
+		TCP = 61,
-		EIGRP = 62,
+		UDP = 62,
-		OSPF = 63,
+		RDP = 63,
-		IPIP = 64,
+		RSVP = 64,
-		VRRP = 65,
+		GRE = 65,
-		L2TP = 66,
+		ESP = 66,
-		ISIS = 67,
+		AH = 67,
-		FROM = 68,
+		EIGRP = 68,
-		URPF_FAILED = 69,
+		OSPF = 69,
-		ANY = 70,
+		IPIP = 70,
-		NO_ROUTE = 71,
+		VRRP = 71,
-		IPV6 = 72,
+		L2TP = 72,
-		ROUTE_TO = 73,
+		ISIS = 73,
-		REPLY_TO = 74,
+		FROM = 74,
-		FLAGS = 75,
+		URPF_FAILED = 75,
-		ICMP_TYPE = 76,
+		ANY = 76,
-		ICMP_CODE = 77,
+		NO_ROUTE = 77,
-		ICMP6_TYPE = 78,
+		IPV6 = 78,
-		TAGGED = 79,
+		ROUTE_TO = 79,
-		TAG = 80,
+		REPLY_TO = 80,
-		NO = 81,
+		FLAGS = 81,
-		KEEP = 82,
+		ICMP_TYPE = 82,
-		MODULATE = 83,
+		ICMP_CODE = 83,
-		SYNPROXY = 84,
+		ICMP6_TYPE = 84,
-		STATE = 85,
+		TAGGED = 85,
-		LABEL = 86,
+		TAG = 86,
-		PORT = 87,
+		NO = 87,
-		EXIT = 88,
+		KEEP = 88,
-		QUIT = 89,
+		MODULATE = 89,
-		INTRFACE = 90,
+		SYNPROXY = 90,
-		ICMP6 = 91,
+		STATE = 91,
-		IGRP = 92,
+		LABEL = 92,
-		IPSEC = 93,
+		PORT = 93,
-		NOS = 94,
+		EXIT = 94,
-		PCP = 95,
+		QUIT = 95,
-		PIM = 96,
+		INTRFACE = 96,
-		PPTP = 97,
+		ICMP6 = 97,
-		RIP = 98,
+		IGRP = 98,
-		SNP = 99,
+		IPSEC = 99,
-		HOST = 100,
+		NOS = 100,
-		RANGE = 101,
+		PCP = 101,
-		LOG_LEVEL_ALERTS = 102,
+		PIM = 102,
-		LOG_LEVEL_CRITICAL = 103,
+		PPTP = 103,
-		LOG_LEVEL_DEBUGGING = 104,
+		RIP = 104,
-		LOG_LEVEL_EMERGENCIES = 105,
+		SNP = 105,
-		LOG_LEVEL_ERRORS = 106,
+		HOST = 106,
-		LOG_LEVEL_INFORMATIONAL = 107,
+		RANGE = 107,
-		LOG_LEVEL_NOTIFICATIONS = 108,
+		LOG_LEVEL_ALERTS = 108,
-		LOG_LEVEL_WARNINGS = 109,
+		LOG_LEVEL_CRITICAL = 109,
-		LOG_LEVEL_DISABLE = 110,
+		LOG_LEVEL_DEBUGGING = 110,
-		LOG_LEVEL_INACTIVE = 111,
+		LOG_LEVEL_EMERGENCIES = 111,
-		TRANSLATE_TO = 112,
+		LOG_LEVEL_ERRORS = 112,
-		Whitespace = 113,
+		LOG_LEVEL_INFORMATIONAL = 113,
-		HEX_CONST = 114,
+		LOG_LEVEL_NOTIFICATIONS = 114,
-		NUMBER = 115,
+		LOG_LEVEL_WARNINGS = 115,
-		NEG_INT_CONST = 116,
+		LOG_LEVEL_DISABLE = 116,
-		HEX_DIGIT = 117,
+		LOG_LEVEL_INACTIVE = 117,
-		DIGIT = 118,
+		TRANSLATE_TO = 118,
-		NUM_3DIGIT = 119,
+		Whitespace = 119,
-		NUM_HEX_4DIGIT = 120,
+		HEX_CONST = 120,
-		NUMBER_ADDRESS_OR_WORD = 121,
+		NUMBER = 121,
-		PIPE_CHAR = 122,
+		NEG_INT_CONST = 122,
-		NUMBER_SIGN = 123,
+		HEX_DIGIT = 123,
-		PERCENT = 124,
+		DIGIT = 124,
-		AMPERSAND = 125,
+		NUM_3DIGIT = 125,
-		APOSTROPHE = 126,
+		NUM_HEX_4DIGIT = 126,
-		STAR = 127,
+		NUMBER_ADDRESS_OR_WORD = 127,
-		PLUS = 128,
+		PIPE_CHAR = 128,
-		MINUS = 129,
+		NUMBER_SIGN = 129,
-		DOT = 130,
+		PERCENT = 130,
-		SEMICOLON = 131,
+		AMPERSAND = 131,
-		QUESTION = 132,
+		APOSTROPHE = 132,
-		COMMERCIAL_AT = 133,
+		STAR = 133,
-		OPENING_SQUARE = 134,
+		PLUS = 134,
-		CLOSING_SQUARE = 135,
+		MINUS = 135,
-		CARET = 136,
+		DOT = 136,
-		UNDERLINE = 137,
+		SEMICOLON = 137,
-		TILDE = 138,
+		QUESTION = 138,
-		DOUBLE_QUOTE = 139,
+		COMMERCIAL_AT = 139,
+		OPENING_SQUARE = 140,
+		CLOSING_SQUARE = 141,
+		CARET = 142,
+		UNDERLINE = 143,
+		TILDE = 144,
+		DOUBLE_QUOTE = 145,
 		NULL_TREE_LOOKAHEAD = 3
 	};
 #ifdef __cplusplus

src/parsers/PFCfgParserTokenTypes.txt

@@ -35,104 +35,110 @@ RDR="rdr"=35
 TIMEOUT="timeout"=36
 PASS="pass"=37
 BLOCK="block"=38
-IN="in"=39
+DROP="drop"=39
-OUT="out"=40
+RETURN="return"=40
-LOG="log"=41
+RETURN_RST="return-rst"=41
-OPENING_PAREN=42
+TTL=42
-CLOSING_PAREN=43
+RETURN_ICMP="return-icmp"=43
-ALL="all"=44
+OPENING_PAREN=44
-USER="user"=45
+CLOSING_PAREN=45
-TO="to"=46
+RETURN_ICMP6=46
-QUICK="quick"=47
+IN="in"=47
-ON="on"=48
+OUT="out"=48
-INET="inet"=49
+LOG="log"=49
-INET6="inet6"=50
+ALL="all"=50
-PROTO="proto"=51
+USER="user"=51
-IP="ip"=52
+TO="to"=52
-ICMP="icmp"=53
+QUICK="quick"=53
-IGMP="igmp"=54
+ON="on"=54
-TCP="tcp"=55
+INET="inet"=55
-UDP="udp"=56
+INET6="inet6"=56
-RDP="rdp"=57
+PROTO="proto"=57
-RSVP="rsvp"=58
+IP="ip"=58
-GRE="gre"=59
+ICMP="icmp"=59
-ESP="esp"=60
+IGMP="igmp"=60
-AH="ah"=61
+TCP="tcp"=61
-EIGRP="eigrp"=62
+UDP="udp"=62
-OSPF="ospf"=63
+RDP="rdp"=63
-IPIP="ipip"=64
+RSVP="rsvp"=64
-VRRP="vrrp"=65
+GRE="gre"=65
-L2TP="l2tp"=66
+ESP="esp"=66
-ISIS="isis"=67
+AH="ah"=67
-FROM="from"=68
+EIGRP="eigrp"=68
-URPF_FAILED="urpf-failed"=69
+OSPF="ospf"=69
-ANY="any"=70
+IPIP="ipip"=70
-NO_ROUTE="no-route"=71
+VRRP="vrrp"=71
-IPV6=72
+L2TP="l2tp"=72
-ROUTE_TO="route-to"=73
+ISIS="isis"=73
-REPLY_TO="reply-to"=74
+FROM="from"=74
-FLAGS="flags"=75
+URPF_FAILED="urpf-failed"=75
-ICMP_TYPE="icmp-type"=76
+ANY="any"=76
-ICMP_CODE="code"=77
+NO_ROUTE="no-route"=77
-ICMP6_TYPE="icmp6-type"=78
+IPV6=78
-TAGGED="tagged"=79
+ROUTE_TO="route-to"=79
-TAG="tag"=80
+REPLY_TO="reply-to"=80
-NO="no"=81
+FLAGS="flags"=81
-KEEP="keep"=82
+ICMP_TYPE="icmp-type"=82
-MODULATE="modulate"=83
+ICMP_CODE="code"=83
-SYNPROXY="synproxy"=84
+ICMP6_TYPE="icmp6-type"=84
-STATE="state"=85
+TAGGED="tagged"=85
-LABEL="label"=86
+TAG="tag"=86
-PORT="port"=87
+NO="no"=87
-EXIT="exit"=88
+KEEP="keep"=88
-QUIT="quit"=89
+MODULATE="modulate"=89
-INTRFACE="interface"=90
+SYNPROXY="synproxy"=90
-ICMP6="icmp6"=91
+STATE="state"=91
-IGRP="igrp"=92
+LABEL="label"=92
-IPSEC="ipsec"=93
+PORT="port"=93
-NOS="nos"=94
+EXIT="exit"=94
-PCP="pcp"=95
+QUIT="quit"=95
-PIM="pim"=96
+INTRFACE="interface"=96
-PPTP="pptp"=97
+ICMP6="icmp6"=97
-RIP="rip"=98
+IGRP="igrp"=98
-SNP="snp"=99
+IPSEC="ipsec"=99
-HOST="host"=100
+NOS="nos"=100
-RANGE="range"=101
+PCP="pcp"=101
-LOG_LEVEL_ALERTS="alerts"=102
+PIM="pim"=102
-LOG_LEVEL_CRITICAL="critical"=103
+PPTP="pptp"=103
-LOG_LEVEL_DEBUGGING="debugging"=104
+RIP="rip"=104
-LOG_LEVEL_EMERGENCIES="emergencies"=105
+SNP="snp"=105
-LOG_LEVEL_ERRORS="errors"=106
+HOST="host"=106
-LOG_LEVEL_INFORMATIONAL="informational"=107
+RANGE="range"=107
-LOG_LEVEL_NOTIFICATIONS="notifications"=108
+LOG_LEVEL_ALERTS="alerts"=108
-LOG_LEVEL_WARNINGS="warnings"=109
+LOG_LEVEL_CRITICAL="critical"=109
-LOG_LEVEL_DISABLE="disable"=110
+LOG_LEVEL_DEBUGGING="debugging"=110
-LOG_LEVEL_INACTIVE="inactive"=111
+LOG_LEVEL_EMERGENCIES="emergencies"=111
-TRANSLATE_TO="->"=112
+LOG_LEVEL_ERRORS="errors"=112
-Whitespace=113
+LOG_LEVEL_INFORMATIONAL="informational"=113
-HEX_CONST=114
+LOG_LEVEL_NOTIFICATIONS="notifications"=114
-NUMBER=115
+LOG_LEVEL_WARNINGS="warnings"=115
-NEG_INT_CONST=116
+LOG_LEVEL_DISABLE="disable"=116
-HEX_DIGIT=117
+LOG_LEVEL_INACTIVE="inactive"=117
-DIGIT=118
+TRANSLATE_TO="->"=118
-NUM_3DIGIT=119
+Whitespace=119
-NUM_HEX_4DIGIT=120
+HEX_CONST=120
-NUMBER_ADDRESS_OR_WORD=121
+NUMBER=121
-PIPE_CHAR=122
+NEG_INT_CONST=122
-NUMBER_SIGN=123
+HEX_DIGIT=123
-PERCENT=124
+DIGIT=124
-AMPERSAND=125
+NUM_3DIGIT=125
-APOSTROPHE=126
+NUM_HEX_4DIGIT=126
-STAR=127
+NUMBER_ADDRESS_OR_WORD=127
-PLUS=128
+PIPE_CHAR=128
-MINUS=129
+NUMBER_SIGN=129
-DOT=130
+PERCENT=130
-SEMICOLON=131
+AMPERSAND=131
-QUESTION=132
+APOSTROPHE=132
-COMMERCIAL_AT=133
+STAR=133
-OPENING_SQUARE=134
+PLUS=134
-CLOSING_SQUARE=135
+MINUS=135
-CARET=136
+DOT=136
-UNDERLINE=137
+SEMICOLON=137
-TILDE=138
+QUESTION=138
-DOUBLE_QUOTE=139
+COMMERCIAL_AT=139
+OPENING_SQUARE=140
+CLOSING_SQUARE=141
+CARET=142
+UNDERLINE=143
+TILDE=144
+DOUBLE_QUOTE=145

src/parsers/pf.g

@@ -389,6 +389,7 @@ block_command : BLOCK
             importer->action = "block";
             *dbg << LT(1)->getLine() << ":" << " block   ";
         }
+        ( block_return )?
         rule_extended 
         {
             importer->pushRule();
@@ -396,6 +397,46 @@ block_command : BLOCK
         NEWLINE
     ;
 
+block_return :
+        (
+            DROP         { importer->block_action_params.push_back("drop"); }
+        |
+            RETURN       { importer->block_action_params.push_back("return"); }
+        |
+            RETURN_RST   { importer->block_action_params.push_back("return-rst"); }
+            (
+                TTL INT_CONST
+                {
+                    importer->error_tracker->registerError(
+                        QString("Import of \"block return-rst ttl number\" is not supported. "));
+                }
+            )?
+        |
+            RETURN_ICMP  { importer->block_action_params.push_back("return-icmp"); }
+            (
+                OPENING_PAREN
+                ( WORD | INT_CONST )
+                { importer->block_action_params.push_back(LT(0)->getText()); }
+                (
+                    COMMA
+                    ( WORD | INT_CONST )
+                    {
+                        importer->error_tracker->registerError(
+                            QString("Import of \"block return-icmp (icmp_code, icmp6_code)\" is not supported"));
+                    }
+                )?
+                CLOSING_PAREN
+            )?
+        |
+            RETURN_ICMP6 
+            {
+                importer->error_tracker->registerError(
+                    QString("Import of \"block return-icmp6\" is not supported"));
+                importer->block_action_params.push_back("return-icmp");
+            }
+        )
+    ;
+
 rule_extended :
         ( direction )?
         ( logging )?
@@ -1058,6 +1099,11 @@ tokens
     ROUTE_TO = "route-to";
     REPLY_TO = "reply-to";
 
+    DROP = "drop";
+    RETURN = "return";
+    RETURN_RST = "return-rst";
+    RETURN_ICMP = "return-icmp";
+
     TAG = "tag";
     TAGGED = "tagged";