npf_parse.y revision 1.48
1 /*- 2 * Copyright (c) 2011-2017 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This code is derived from software contributed to The NetBSD Foundation 6 * by Martin Husemann, Christos Zoulas and Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 %{ 31 32 #include <err.h> 33 #include <netdb.h> 34 #include <stdio.h> 35 #include <stdlib.h> 36 #include <string.h> 37 #ifdef __NetBSD__ 38 #include <vis.h> 39 #endif 40 41 #include "npfctl.h" 42 43 #define YYSTACKSIZE 4096 44 45 int yyparsetarget; 46 const char * yyfilename; 47 48 extern int yylineno, yycolumn; 49 extern int yylex(void); 50 51 void 52 yyerror(const char *fmt, ...) 53 { 54 extern int yyleng; 55 extern char *yytext; 56 57 char *msg, *context = estrndup(yytext, yyleng); 58 bool eol = (*context == '\n'); 59 va_list ap; 60 61 va_start(ap, fmt); 62 vasprintf(&msg, fmt, ap); 63 va_end(ap); 64 65 fprintf(stderr, "%s:%d:%d: %s", yyfilename, 66 yylineno - (int)eol, yycolumn, msg); 67 if (!eol) { 68 #ifdef __NetBSD__ 69 size_t len = strlen(context); 70 char *dst = ecalloc(1, len * 4 + 1); 71 72 strvisx(dst, context, len, VIS_WHITE|VIS_CSTYLE); 73 context = dst; 74 #endif 75 fprintf(stderr, " near '%s'", context); 76 } 77 fprintf(stderr, "\n"); 78 exit(EXIT_FAILURE); 79 } 80 81 #define CHECK_PARSER_FILE \ 82 if (yyparsetarget != NPFCTL_PARSE_FILE) \ 83 yyerror("rule must be in the group"); 84 85 #define CHECK_PARSER_STRING \ 86 if (yyparsetarget != NPFCTL_PARSE_STRING) \ 87 yyerror("invalid rule syntax"); 88 89 %} 90 91 /* 92 * No conflicts allowed. Keep it this way. 93 */ 94 %expect 0 95 %expect-rr 0 96 97 %token ALG 98 %token ALGO 99 %token ALL 100 %token ANY 101 %token APPLY 102 %token ARROWBOTH 103 %token ARROWLEFT 104 %token ARROWRIGHT 105 %token BLOCK 106 %token BPFJIT 107 %token CDB 108 %token CONST 109 %token CURLY_CLOSE 110 %token CURLY_OPEN 111 %token CODE 112 %token COLON 113 %token COMMA 114 %token DEFAULT 115 %token TDYNAMIC 116 %token TSTATIC 117 %token EQ 118 %token EXCL_MARK 119 %token TFILE 120 %token FLAGS 121 %token FROM 122 %token GROUP 123 %token HASH 124 %token ICMPTYPE 125 %token ID 126 %token IFADDRS 127 %token IN 128 %token INET4 129 %token INET6 130 %token INTERFACE 131 %token IPHASH 132 %token IPSET 133 %token LPM 134 %token MAP 135 %token NO_PORTS 136 %token MINUS 137 %token NAME 138 %token NETMAP 139 %token NPT66 140 %token ON 141 %token OFF 142 %token OUT 143 %token PAR_CLOSE 144 %token PAR_OPEN 145 %token PASS 146 %token PCAP_FILTER 147 %token PORT 148 %token PROCEDURE 149 %token PROTO 150 %token FAMILY 151 %token FINAL 152 %token FORW 153 %token RETURN 154 %token RETURNICMP 155 %token RETURNRST 156 %token ROUNDROBIN 157 %token RULESET 158 %token SEPLINE 159 %token SET 160 %token SLASH 161 %token STATEFUL 162 %token STATEFUL_ENDS 163 %token TABLE 164 %token TCP 165 %token TO 166 %token TREE 167 %token TYPE 168 %token <num> ICMP 169 %token <num> ICMP6 170 171 %token <num> HEX 172 %token <str> IDENTIFIER 173 %token <str> IPV4ADDR 174 %token <str> IPV6ADDR 175 %token <num> NUM 176 %token <fpnum> FPNUM 177 %token <str> STRING 178 %token <str> TABLE_ID 179 %token <str> VAR_ID 180 181 %type <str> addr some_name table_store dynamic_ifaddrs 182 %type <str> proc_param_val opt_apply ifname on_ifname ifref 183 %type <num> port opt_final number afamily opt_family 184 %type <num> block_or_pass rule_dir group_dir block_opts 185 %type <num> maybe_not opt_stateful icmp_type table_type 186 %type <num> map_sd map_algo map_flags map_type 187 %type <var> static_ifaddrs addr_or_ifaddr 188 %type <var> port_range icmp_type_and_code 189 %type <var> filt_addr addr_and_mask tcp_flags tcp_flags_and_mask 190 %type <var> procs proc_call proc_param_list proc_param 191 %type <var> element list_elems list value 192 %type <addrport> mapseg 193 %type <filtopts> filt_opts all_or_filt_opts 194 %type <optproto> proto opt_proto 195 %type <rulegroup> group_opts 196 %type <tf> onoff 197 198 %union { 199 char * str; 200 bool tf; 201 unsigned long num; 202 double fpnum; 203 npfvar_t * var; 204 addr_port_t addrport; 205 filt_opts_t filtopts; 206 opt_proto_t optproto; 207 rule_group_t rulegroup; 208 } 209 210 %% 211 212 input 213 : { CHECK_PARSER_FILE } lines 214 | { CHECK_PARSER_STRING } rule 215 ; 216 217 lines 218 : lines SEPLINE line 219 | line 220 ; 221 222 line 223 : vardef 224 | table 225 | map 226 | group 227 | rproc 228 | alg 229 | set 230 | 231 ; 232 233 alg 234 : ALG STRING 235 { 236 npfctl_build_alg($2); 237 } 238 ; 239 240 onoff 241 : ON { 242 $$ = true; 243 } 244 | OFF { 245 $$ = false; 246 } 247 ; 248 249 set 250 : SET BPFJIT onoff { 251 npfctl_bpfjit($3); 252 } 253 ; 254 255 /* 256 * A value - an element or a list of elements. 257 * Can be assigned to a variable or used inline. 258 */ 259 260 vardef 261 : VAR_ID EQ value 262 { 263 npfvar_add($3, $1); 264 } 265 ; 266 267 value 268 : element 269 | list 270 ; 271 272 list 273 : CURLY_OPEN list_elems CURLY_CLOSE 274 { 275 $$ = $2; 276 } 277 ; 278 279 list_elems 280 : list_elems COMMA element 281 { 282 npfvar_add_elements($1, $3); 283 } 284 | element 285 ; 286 287 element 288 : IDENTIFIER 289 { 290 $$ = npfvar_create_from_string(NPFVAR_IDENTIFIER, $1); 291 } 292 | STRING 293 { 294 $$ = npfvar_create_from_string(NPFVAR_STRING, $1); 295 } 296 | number MINUS number 297 { 298 $$ = npfctl_parse_port_range($1, $3); 299 } 300 | number 301 { 302 $$ = npfvar_create_element(NPFVAR_NUM, &$1, sizeof($1)); 303 } 304 | VAR_ID 305 { 306 $$ = npfvar_create_from_string(NPFVAR_VAR_ID, $1); 307 } 308 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 309 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 310 | static_ifaddrs { $$ = $1; } 311 | addr_and_mask { $$ = $1; } 312 ; 313 314 /* 315 * Table definition. 316 */ 317 318 table 319 : TABLE TABLE_ID TYPE table_type table_store 320 { 321 npfctl_build_table($2, $4, $5); 322 } 323 ; 324 325 table_type 326 : IPSET { $$ = NPF_TABLE_IPSET; } 327 | HASH 328 { 329 warnx("warning - table type \"hash\" is deprecated and may be " 330 "deleted in\nthe future; please use the \"ipset\" type " 331 "instead."); 332 $$ = NPF_TABLE_IPSET; 333 } 334 | LPM { $$ = NPF_TABLE_LPM; } 335 | TREE 336 { 337 warnx("warning - table type \"tree\" is deprecated and may be " 338 "deleted in\nthe future; please use the \"lpm\" type " 339 "instead."); 340 $$ = NPF_TABLE_LPM; 341 } 342 | CONST { $$ = NPF_TABLE_CONST; } 343 | CDB 344 { 345 warnx("warning -- table type \"cdb\" is deprecated and may be " 346 "deleted in\nthe future; please use the \"const\" type " 347 "instead."); 348 $$ = NPF_TABLE_CONST; 349 } 350 ; 351 352 table_store 353 : TFILE STRING { $$ = $2; } 354 | TDYNAMIC 355 { 356 warnx("warning - the \"dynamic\" keyword for tables is obsolete"); 357 $$ = NULL; 358 } 359 | { $$ = NULL; } 360 ; 361 362 /* 363 * Map definition. 364 */ 365 366 map_sd 367 : TSTATIC { $$ = NPFCTL_NAT_STATIC; } 368 | TDYNAMIC { $$ = NPFCTL_NAT_DYNAMIC; } 369 | { $$ = NPFCTL_NAT_DYNAMIC; } 370 ; 371 372 map_algo 373 : ALGO NETMAP { $$ = NPF_ALGO_NETMAP; } 374 | ALGO IPHASH { $$ = NPF_ALGO_IPHASH; } 375 | ALGO ROUNDROBIN { $$ = NPF_ALGO_RR; } 376 | ALGO NPT66 { $$ = NPF_ALGO_NPT66; } 377 | { $$ = 0; } 378 ; 379 380 map_flags 381 : NO_PORTS { $$ = NPF_NAT_PORTS; } 382 | { $$ = 0; } 383 ; 384 385 map_type 386 : ARROWBOTH { $$ = NPF_NATIN | NPF_NATOUT; } 387 | ARROWLEFT { $$ = NPF_NATIN; } 388 | ARROWRIGHT { $$ = NPF_NATOUT; } 389 ; 390 391 mapseg 392 : filt_addr port_range 393 { 394 $$.ap_netaddr = $1; 395 $$.ap_portrange = $2; 396 } 397 ; 398 399 map 400 : MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 401 PASS opt_family opt_proto all_or_filt_opts 402 { 403 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, &$11, &$12, $4); 404 } 405 | MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 406 { 407 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, NULL, NULL, $4); 408 } 409 | MAP ifref map_sd map_algo map_flags proto mapseg map_type mapseg 410 { 411 npfctl_build_natseg($3, $8, $5, $2, &$7, &$9, &$6, NULL, $4); 412 } 413 | MAP RULESET group_opts 414 { 415 npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifname); 416 } 417 ; 418 419 /* 420 * Rule procedure definition and its parameters. 421 */ 422 423 rproc 424 : PROCEDURE STRING CURLY_OPEN procs CURLY_CLOSE 425 { 426 npfctl_build_rproc($2, $4); 427 } 428 ; 429 430 procs 431 : procs SEPLINE proc_call 432 { 433 $$ = npfvar_add_elements($1, $3); 434 } 435 | proc_call { $$ = $1; } 436 ; 437 438 proc_call 439 : IDENTIFIER COLON proc_param_list 440 { 441 proc_call_t pc; 442 443 pc.pc_name = estrdup($1); 444 pc.pc_opts = $3; 445 446 $$ = npfvar_create_element(NPFVAR_PROC, &pc, sizeof(pc)); 447 } 448 | { $$ = NULL; } 449 ; 450 451 proc_param_list 452 : proc_param_list COMMA proc_param 453 { 454 $$ = npfvar_add_elements($1, $3); 455 } 456 | proc_param { $$ = $1; } 457 | { $$ = NULL; } 458 ; 459 460 proc_param 461 : some_name proc_param_val 462 { 463 proc_param_t pp; 464 465 pp.pp_param = estrdup($1); 466 pp.pp_value = $2 ? estrdup($2) : NULL; 467 468 $$ = npfvar_create_element(NPFVAR_PROC_PARAM, &pp, sizeof(pp)); 469 } 470 ; 471 472 proc_param_val 473 : some_name { $$ = $1; } 474 | number { (void)asprintf(&$$, "%ld", $1); } 475 | FPNUM { (void)asprintf(&$$, "%lf", $1); } 476 | { $$ = NULL; } 477 ; 478 479 /* 480 * Group and dynamic ruleset definition. 481 */ 482 483 group 484 : GROUP group_opts 485 { 486 /* Build a group. Increase the nesting level. */ 487 npfctl_build_group($2.rg_name, $2.rg_attr, 488 $2.rg_ifname, $2.rg_default); 489 } 490 ruleset_block 491 { 492 /* Decrease the nesting level. */ 493 npfctl_build_group_end(); 494 } 495 ; 496 497 ruleset 498 : RULESET group_opts 499 { 500 /* Ruleset is a dynamic group. */ 501 npfctl_build_group($2.rg_name, $2.rg_attr | NPF_RULE_DYNAMIC, 502 $2.rg_ifname, $2.rg_default); 503 npfctl_build_group_end(); 504 } 505 ; 506 507 group_dir 508 : FORW { $$ = NPF_RULE_FORW; } 509 | rule_dir 510 ; 511 512 group_opts 513 : DEFAULT 514 { 515 memset(&$$, 0, sizeof(rule_group_t)); 516 $$.rg_default = true; 517 } 518 | STRING group_dir on_ifname 519 { 520 memset(&$$, 0, sizeof(rule_group_t)); 521 $$.rg_name = $1; 522 $$.rg_attr = $2; 523 $$.rg_ifname = $3; 524 } 525 ; 526 527 ruleset_block 528 : CURLY_OPEN ruleset_def CURLY_CLOSE 529 ; 530 531 ruleset_def 532 : ruleset_def SEPLINE rule_group 533 | rule_group 534 ; 535 536 rule_group 537 : rule 538 | group 539 | ruleset 540 | 541 ; 542 543 /* 544 * Rule and misc. 545 */ 546 547 rule 548 : block_or_pass opt_stateful rule_dir opt_final on_ifname 549 opt_family opt_proto all_or_filt_opts opt_apply 550 { 551 npfctl_build_rule($1 | $2 | $3 | $4, $5, 552 $6, &$7, &$8, NULL, $9); 553 } 554 | block_or_pass opt_stateful rule_dir opt_final on_ifname 555 PCAP_FILTER STRING opt_apply 556 { 557 npfctl_build_rule($1 | $2 | $3 | $4, $5, 558 AF_UNSPEC, NULL, NULL, $7, $8); 559 } 560 ; 561 562 block_or_pass 563 : BLOCK block_opts { $$ = $2; } 564 | PASS { $$ = NPF_RULE_PASS; } 565 ; 566 567 rule_dir 568 : IN { $$ = NPF_RULE_IN; } 569 | OUT { $$ = NPF_RULE_OUT; } 570 | { $$ = NPF_RULE_IN | NPF_RULE_OUT; } 571 ; 572 573 opt_final 574 : FINAL { $$ = NPF_RULE_FINAL; } 575 | { $$ = 0; } 576 ; 577 578 on_ifname 579 : ON ifref { $$ = $2; } 580 | { $$ = NULL; } 581 ; 582 583 afamily 584 : INET4 { $$ = AF_INET; } 585 | INET6 { $$ = AF_INET6; } 586 ; 587 588 maybe_not 589 : EXCL_MARK { $$ = true; } 590 | { $$ = false; } 591 ; 592 593 opt_family 594 : FAMILY afamily { $$ = $2; } 595 | { $$ = AF_UNSPEC; } 596 ; 597 598 proto 599 : PROTO TCP tcp_flags_and_mask 600 { 601 $$.op_proto = IPPROTO_TCP; 602 $$.op_opts = $3; 603 } 604 | PROTO ICMP icmp_type_and_code 605 { 606 $$.op_proto = IPPROTO_ICMP; 607 $$.op_opts = $3; 608 } 609 | PROTO ICMP6 icmp_type_and_code 610 { 611 $$.op_proto = IPPROTO_ICMPV6; 612 $$.op_opts = $3; 613 } 614 | PROTO some_name 615 { 616 $$.op_proto = npfctl_protono($2); 617 $$.op_opts = NULL; 618 } 619 | PROTO number 620 { 621 $$.op_proto = $2; 622 $$.op_opts = NULL; 623 } 624 ; 625 626 opt_proto 627 : proto { $$ = $1; } 628 | 629 { 630 $$.op_proto = -1; 631 $$.op_opts = NULL; 632 } 633 ; 634 635 all_or_filt_opts 636 : ALL 637 { 638 $$.fo_finvert = false; 639 $$.fo_from.ap_netaddr = NULL; 640 $$.fo_from.ap_portrange = NULL; 641 $$.fo_tinvert = false; 642 $$.fo_to.ap_netaddr = NULL; 643 $$.fo_to.ap_portrange = NULL; 644 } 645 | filt_opts { $$ = $1; } 646 ; 647 648 opt_stateful 649 : STATEFUL { $$ = NPF_RULE_STATEFUL; } 650 | STATEFUL_ENDS { $$ = NPF_RULE_STATEFUL | NPF_RULE_MULTIENDS; } 651 | { $$ = 0; } 652 ; 653 654 opt_apply 655 : APPLY STRING { $$ = $2; } 656 | { $$ = NULL; } 657 ; 658 659 block_opts 660 : RETURNRST { $$ = NPF_RULE_RETRST; } 661 | RETURNICMP { $$ = NPF_RULE_RETICMP; } 662 | RETURN { $$ = NPF_RULE_RETRST | NPF_RULE_RETICMP; } 663 | { $$ = 0; } 664 ; 665 666 filt_opts 667 : FROM maybe_not filt_addr port_range TO maybe_not filt_addr port_range 668 { 669 $$.fo_finvert = $2; 670 $$.fo_from.ap_netaddr = $3; 671 $$.fo_from.ap_portrange = $4; 672 $$.fo_tinvert = $6; 673 $$.fo_to.ap_netaddr = $7; 674 $$.fo_to.ap_portrange = $8; 675 } 676 | FROM maybe_not filt_addr port_range 677 { 678 $$.fo_finvert = $2; 679 $$.fo_from.ap_netaddr = $3; 680 $$.fo_from.ap_portrange = $4; 681 $$.fo_tinvert = false; 682 $$.fo_to.ap_netaddr = NULL; 683 $$.fo_to.ap_portrange = NULL; 684 } 685 | TO maybe_not filt_addr port_range 686 { 687 $$.fo_finvert = false; 688 $$.fo_from.ap_netaddr = NULL; 689 $$.fo_from.ap_portrange = NULL; 690 $$.fo_tinvert = $2; 691 $$.fo_to.ap_netaddr = $3; 692 $$.fo_to.ap_portrange = $4; 693 } 694 ; 695 696 filt_addr 697 : list { $$ = $1; } 698 | addr_or_ifaddr { $$ = $1; } 699 | ANY { $$ = NULL; } 700 ; 701 702 addr_and_mask 703 : addr SLASH number 704 { 705 $$ = npfctl_parse_fam_addr_mask($1, NULL, &$3); 706 } 707 | addr SLASH addr 708 { 709 $$ = npfctl_parse_fam_addr_mask($1, $3, NULL); 710 } 711 | addr 712 { 713 $$ = npfctl_parse_fam_addr_mask($1, NULL, NULL); 714 } 715 ; 716 717 addr_or_ifaddr 718 : addr_and_mask { assert($1 != NULL); $$ = $1; } 719 | static_ifaddrs 720 { 721 if (npfvar_get_count($1) != 1) 722 yyerror("multiple interfaces are not supported"); 723 ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 724 $$ = ifna->ifna_addrs; 725 } 726 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 727 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 728 | VAR_ID 729 { 730 npfvar_t *vp = npfvar_lookup($1); 731 int type = npfvar_get_type(vp, 0); 732 ifnet_addr_t *ifna; 733 again: 734 switch (type) { 735 case NPFVAR_IDENTIFIER: 736 case NPFVAR_STRING: 737 vp = npfctl_parse_ifnet(npfvar_expand_string(vp), 738 AF_UNSPEC); 739 type = npfvar_get_type(vp, 0); 740 goto again; 741 case NPFVAR_FAM: 742 case NPFVAR_TABLE: 743 $$ = vp; 744 break; 745 case NPFVAR_INTERFACE: 746 $$ = NULL; 747 for (u_int i = 0; i < npfvar_get_count(vp); i++) { 748 ifna = npfvar_get_data(vp, type, i); 749 $$ = npfvar_add_elements($$, ifna->ifna_addrs); 750 } 751 break; 752 case -1: 753 yyerror("undefined variable '%s'", $1); 754 break; 755 default: 756 yyerror("wrong variable '%s' type '%s' for address " 757 "or interface", $1, npfvar_type(type)); 758 break; 759 } 760 } 761 ; 762 763 addr 764 : IPV4ADDR { $$ = $1; } 765 | IPV6ADDR { $$ = $1; } 766 ; 767 768 port_range 769 : PORT port /* just port */ 770 { 771 $$ = npfctl_parse_port_range($2, $2); 772 } 773 | PORT port MINUS port /* port from-to */ 774 { 775 $$ = npfctl_parse_port_range($2, $4); 776 } 777 | PORT VAR_ID 778 { 779 npfvar_t *vp = npfvar_lookup($2); 780 $$ = npfctl_parse_port_range_variable($2, vp); 781 } 782 | PORT list 783 { 784 $$ = npfctl_parse_port_range_variable(NULL, $2); 785 } 786 | { $$ = NULL; } 787 ; 788 789 port 790 : number { $$ = $1; } 791 | IDENTIFIER { $$ = npfctl_portno($1); } 792 | STRING { $$ = npfctl_portno($1); } 793 ; 794 795 icmp_type_and_code 796 : ICMPTYPE icmp_type 797 { 798 $$ = npfctl_parse_icmp($<num>0, $2, -1); 799 } 800 | ICMPTYPE icmp_type CODE number 801 { 802 $$ = npfctl_parse_icmp($<num>0, $2, $4); 803 } 804 | ICMPTYPE icmp_type CODE IDENTIFIER 805 { 806 $$ = npfctl_parse_icmp($<num>0, $2, 807 npfctl_icmpcode($<num>0, $2, $4)); 808 } 809 | ICMPTYPE icmp_type CODE VAR_ID 810 { 811 char *s = npfvar_expand_string(npfvar_lookup($4)); 812 $$ = npfctl_parse_icmp($<num>0, $2, 813 npfctl_icmpcode($<num>0, $2, s)); 814 } 815 | { $$ = NULL; } 816 ; 817 818 tcp_flags_and_mask 819 : FLAGS tcp_flags SLASH tcp_flags 820 { 821 npfvar_add_elements($2, $4); 822 $$ = $2; 823 } 824 | FLAGS tcp_flags 825 { 826 if (npfvar_get_count($2) != 1) 827 yyerror("multiple tcpflags are not supported"); 828 char *s = npfvar_get_data($2, NPFVAR_TCPFLAG, 0); 829 npfvar_add_elements($2, npfctl_parse_tcpflag(s)); 830 $$ = $2; 831 } 832 | { $$ = NULL; } 833 ; 834 835 tcp_flags 836 : IDENTIFIER { $$ = npfctl_parse_tcpflag($1); } 837 ; 838 839 icmp_type 840 : number { $$ = $1; } 841 | IDENTIFIER { $$ = npfctl_icmptype($<num>-1, $1); } 842 | VAR_ID 843 { 844 char *s = npfvar_expand_string(npfvar_lookup($1)); 845 $$ = npfctl_icmptype($<num>-1, s); 846 } 847 ; 848 849 ifname 850 : some_name 851 { 852 npfctl_note_interface($1); 853 $$ = $1; 854 } 855 | VAR_ID 856 { 857 npfvar_t *vp = npfvar_lookup($1); 858 const int type = npfvar_get_type(vp, 0); 859 ifnet_addr_t *ifna; 860 const char *name; 861 unsigned *tid; 862 bool ifaddr; 863 864 switch (type) { 865 case NPFVAR_STRING: 866 case NPFVAR_IDENTIFIER: 867 $$ = npfvar_expand_string(vp); 868 break; 869 case NPFVAR_INTERFACE: 870 if (npfvar_get_count(vp) != 1) 871 yyerror( 872 "multiple interfaces are not supported"); 873 ifna = npfvar_get_data(vp, type, 0); 874 $$ = ifna->ifna_name; 875 break; 876 case NPFVAR_TABLE: 877 tid = npfvar_get_data(vp, type, 0); 878 name = npfctl_table_getname(npfctl_config_ref(), 879 *tid, &ifaddr); 880 if (!ifaddr) { 881 yyerror("variable '%s' references a table " 882 "%s instead of an interface", $1, name); 883 } 884 $$ = estrdup(name); 885 break; 886 case -1: 887 yyerror("undefined variable '%s' for interface", $1); 888 break; 889 default: 890 yyerror("wrong variable '%s' type '%s' for interface", 891 $1, npfvar_type(type)); 892 break; 893 } 894 npfctl_note_interface($$); 895 } 896 ; 897 898 static_ifaddrs 899 : afamily PAR_OPEN ifname PAR_CLOSE 900 { 901 $$ = npfctl_parse_ifnet($3, $1); 902 } 903 ; 904 905 dynamic_ifaddrs 906 : IFADDRS PAR_OPEN ifname PAR_CLOSE 907 { 908 $$ = $3; 909 } 910 ; 911 912 ifref 913 : ifname 914 | dynamic_ifaddrs 915 | static_ifaddrs 916 { 917 if (npfvar_get_count($1) != 1) 918 yyerror("multiple interfaces are not supported"); 919 ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 920 npfctl_note_interface(ifna->ifna_name); 921 $$ = ifna->ifna_name; 922 } 923 ; 924 925 number 926 : HEX { $$ = $1; } 927 | NUM { $$ = $1; } 928 ; 929 930 some_name 931 : IDENTIFIER { $$ = $1; } 932 | STRING { $$ = $1; } 933 ; 934 935 %% 936
Indexes created Tue Sep 30 20:09:53 GMT 2025