npf_parse.y revision 1.55
1 /*- 2 * Copyright (c) 2011-2025 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This code is derived from software contributed to The NetBSD Foundation 6 * by Martin Husemann, Christos Zoulas and Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 %{ 31 32 #include <err.h> 33 #include <netdb.h> 34 #include <stdio.h> 35 #include <stdlib.h> 36 #include <string.h> 37 #ifdef __NetBSD__ 38 #include <vis.h> 39 #endif 40 41 #include "npfctl.h" 42 43 #define YYSTACKSIZE 4096 44 45 int yystarttoken; 46 const char * yyfilename; 47 48 extern int yylineno, yycolumn; 49 extern int yylex(int); 50 51 void 52 yyerror(const char *fmt, ...) 53 { 54 extern int yyleng; 55 extern char *yytext; 56 57 char *msg, *context = estrndup(yytext, yyleng); 58 bool eol = (*context == '\n'); 59 va_list ap; 60 61 va_start(ap, fmt); 62 vasprintf(&msg, fmt, ap); 63 va_end(ap); 64 65 fprintf(stderr, "%s:%d:%d: %s", yyfilename, 66 yylineno - (int)eol, yycolumn, msg); 67 if (!eol) { 68 #ifdef __NetBSD__ 69 size_t len = strlen(context); 70 char *dst = ecalloc(1, len * 4 + 1); 71 72 strvisx(dst, context, len, VIS_WHITE|VIS_CSTYLE); 73 context = dst; 74 #endif 75 fprintf(stderr, " near '%s'", context); 76 } 77 fprintf(stderr, "\n"); 78 exit(EXIT_FAILURE); 79 } 80 81 %} 82 83 /* 84 * No conflicts allowed. Keep it this way. 85 */ 86 %expect 0 87 %expect-rr 0 88 89 /* 90 * Depending on the mode of operation, set a different start symbol. 91 * Workaround yacc limitation by passing the start token. 92 */ 93 %start input 94 %token RULE_ENTRY_TOKEN MAP_ENTRY_TOKEN 95 %lex-param { int yystarttoken } 96 97 /* 98 * General tokens. 99 */ 100 %token ALG 101 %token ALGO 102 %token ALL 103 %token ANY 104 %token APPLY 105 %token ARROWBOTH 106 %token ARROWLEFT 107 %token ARROWRIGHT 108 %token BLOCK 109 %token CDB 110 %token CONST 111 %token CURLY_CLOSE 112 %token CURLY_OPEN 113 %token CODE 114 %token COLON 115 %token COMMA 116 %token DEFAULT 117 %token TDYNAMIC 118 %token TSTATIC 119 %token EQ 120 %token EXCL_MARK 121 %token TFILE 122 %token FLAGS 123 %token FROM 124 %token GROUP 125 %token HASH 126 %token ICMPTYPE 127 %token ID 128 %token IFADDRS 129 %token IN 130 %token INET4 131 %token INET6 132 %token INTERFACE 133 %token INVALID 134 %token IPHASH 135 %token IPSET 136 %token LPM 137 %token MAP 138 %token NEWLINE 139 %token NO_PORTS 140 %token MINUS 141 %token NAME 142 %token NETMAP 143 %token NPT66 144 %token ON 145 %token OFF 146 %token OUT 147 %token PAR_CLOSE 148 %token PAR_OPEN 149 %token PASS 150 %token PCAP_FILTER 151 %token PORT 152 %token PROCEDURE 153 %token PROTO 154 %token FAMILY 155 %token FINAL 156 %token FORW 157 %token RETURN 158 %token RETURNICMP 159 %token RETURNRST 160 %token ROUNDROBIN 161 %token RULESET 162 %token SEMICOLON 163 %token SET 164 %token SLASH 165 %token STATEFUL 166 %token STATEFUL_ALL 167 %token TABLE 168 %token TCP 169 %token TO 170 %token TREE 171 %token TYPE 172 %token USER 173 %token <num> ICMP 174 %token <num> ICMP6 175 176 %token <num> HEX 177 %token <str> IDENTIFIER 178 %token <str> IPV4ADDR 179 %token <str> IPV6ADDR 180 %token <num> NUM 181 %token <fpnum> FPNUM 182 %token <str> STRING 183 %token <str> PARAM 184 %token <str> TABLE_ID 185 %token <str> VAR_ID 186 187 %type <str> addr some_name table_store dynamic_ifaddrs 188 %type <str> proc_param_val opt_apply ifname on_ifname ifref 189 %type <num> port opt_final number afamily opt_family 190 %type <num> block_or_pass rule_dir group_dir block_opts 191 %type <num> maybe_not opt_stateful icmp_type table_type 192 %type <num> map_sd map_algo map_flags map_type 193 %type <num> param_val op_unary op_binary 194 %type <rid> uid gid 195 %type <var> static_ifaddrs filt_addr_element 196 %type <var> filt_port filt_port_list port_range icmp_type_and_code 197 %type <var> filt_addr addr_and_mask tcp_flags tcp_flags_and_mask 198 %type <var> procs proc_call proc_param_list proc_param 199 %type <var> element list_elems list_trail list value filt_addr_list 200 %type <var> opt_proto proto proto_elems 201 %type <addrport> mapseg 202 %type <uid> uids uid_item uid_list user_id 203 %type <gid> gids gid_item gid_list group_id 204 %type <filtopts> filt_opts all_or_filt_opts 205 %type <optproto> rawproto 206 %type <rulegroup> group_opts 207 208 %union { 209 char * str; 210 unsigned long num; 211 uint32_t rid; 212 double fpnum; 213 npfvar_t * var; 214 addr_port_t addrport; 215 filt_opts_t filtopts; 216 opt_proto_t optproto; 217 rule_group_t rulegroup; 218 struct r_id uid; 219 struct r_id gid; 220 } 221 222 %% 223 224 input 225 : lines 226 | RULE_ENTRY_TOKEN rule 227 | MAP_ENTRY_TOKEN map 228 ; 229 230 lines 231 : lines sepline line 232 | line 233 ; 234 235 line 236 : vardef 237 | table 238 | map 239 | group 240 | rproc 241 | alg 242 | set 243 | 244 ; 245 246 alg 247 : ALG STRING 248 { 249 npfctl_build_alg($2); 250 } 251 ; 252 253 sepline 254 : NEWLINE 255 | SEMICOLON 256 ; 257 258 param_val 259 : number { $$ = $1; } 260 | ON { $$ = true; } 261 | OFF { $$ = false; } 262 ; 263 264 set 265 : SET PARAM param_val { 266 npfctl_setparam($2, $3); 267 } 268 ; 269 270 /* 271 * A value - an element or a list of elements. 272 * Can be assigned to a variable or used inline. 273 */ 274 275 vardef 276 : VAR_ID EQ value 277 { 278 npfvar_add($3, $1); 279 } 280 ; 281 282 value 283 : element 284 | list 285 ; 286 287 list 288 : CURLY_OPEN opt_nl list_elems CURLY_CLOSE 289 { 290 $$ = $3; 291 } 292 ; 293 294 list_elems 295 : element list_trail 296 { 297 $$ = npfvar_add_elements($1, $2); 298 } 299 ; 300 301 element 302 : IDENTIFIER 303 { 304 $$ = npfvar_create_from_string(NPFVAR_IDENTIFIER, $1); 305 } 306 | STRING 307 { 308 $$ = npfvar_create_from_string(NPFVAR_STRING, $1); 309 } 310 | number MINUS number 311 { 312 $$ = npfctl_parse_port_range($1, $3); 313 } 314 | number 315 { 316 $$ = npfvar_create_element(NPFVAR_NUM, &$1, sizeof($1)); 317 } 318 | VAR_ID 319 { 320 $$ = npfvar_create_from_string(NPFVAR_VAR_ID, $1); 321 } 322 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 323 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 324 | static_ifaddrs { $$ = $1; } 325 | addr_and_mask { $$ = $1; } 326 ; 327 328 list_trail 329 : element_sep element list_trail 330 { 331 $$ = npfvar_add_elements($2, $3); 332 } 333 | opt_nl { $$ = NULL; } 334 | element_sep { $$ = NULL; } 335 ; 336 337 element_sep 338 : opt_nl COMMA opt_nl 339 ; 340 341 opt_nl 342 : opt_nl NEWLINE 343 | 344 ; 345 346 /* 347 * Table definition. 348 */ 349 350 table 351 : TABLE TABLE_ID TYPE table_type table_store 352 { 353 npfctl_build_table($2, $4, $5); 354 } 355 ; 356 357 table_type 358 : IPSET { $$ = NPF_TABLE_IPSET; } 359 | HASH 360 { 361 warnx("warning - table type \"hash\" is deprecated and may be " 362 "deleted in\nthe future; please use the \"ipset\" type " 363 "instead."); 364 $$ = NPF_TABLE_IPSET; 365 } 366 | LPM { $$ = NPF_TABLE_LPM; } 367 | TREE 368 { 369 warnx("warning - table type \"tree\" is deprecated and may be " 370 "deleted in\nthe future; please use the \"lpm\" type " 371 "instead."); 372 $$ = NPF_TABLE_LPM; 373 } 374 | CONST { $$ = NPF_TABLE_CONST; } 375 | CDB 376 { 377 warnx("warning -- table type \"cdb\" is deprecated and may be " 378 "deleted in\nthe future; please use the \"const\" type " 379 "instead."); 380 $$ = NPF_TABLE_CONST; 381 } 382 ; 383 384 table_store 385 : TFILE STRING { $$ = $2; } 386 | TDYNAMIC 387 { 388 warnx("warning - the \"dynamic\" keyword for tables is obsolete"); 389 $$ = NULL; 390 } 391 | { $$ = NULL; } 392 ; 393 394 /* 395 * Map definition. 396 */ 397 398 map_sd 399 : TSTATIC { $$ = NPFCTL_NAT_STATIC; } 400 | TDYNAMIC { $$ = NPFCTL_NAT_DYNAMIC; } 401 | { $$ = NPFCTL_NAT_DYNAMIC; } 402 ; 403 404 map_algo 405 : ALGO NETMAP { $$ = NPF_ALGO_NETMAP; } 406 | ALGO IPHASH { $$ = NPF_ALGO_IPHASH; } 407 | ALGO ROUNDROBIN { $$ = NPF_ALGO_RR; } 408 | ALGO NPT66 { $$ = NPF_ALGO_NPT66; } 409 | { $$ = 0; } 410 ; 411 412 map_flags 413 : NO_PORTS { $$ = NPF_NAT_PORTS; } 414 | { $$ = 0; } 415 ; 416 417 map_type 418 : ARROWBOTH { $$ = NPF_NATIN | NPF_NATOUT; } 419 | ARROWLEFT { $$ = NPF_NATIN; } 420 | ARROWRIGHT { $$ = NPF_NATOUT; } 421 ; 422 423 mapseg 424 : filt_addr filt_port 425 { 426 $$.ap_netaddr = $1; 427 $$.ap_portrange = $2; 428 } 429 ; 430 431 map 432 : MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 433 PASS opt_family opt_proto all_or_filt_opts 434 { 435 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, $11, &$12, $4); 436 } 437 | MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 438 { 439 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, NULL, NULL, $4); 440 } 441 | MAP ifref map_sd map_algo map_flags proto mapseg map_type mapseg 442 { 443 npfctl_build_natseg($3, $8, $5, $2, &$7, &$9, $6, NULL, $4); 444 } 445 | MAP RULESET group_opts 446 { 447 npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifname); 448 } 449 ; 450 451 /* 452 * Rule procedure definition and its parameters. 453 */ 454 455 rproc 456 : PROCEDURE STRING CURLY_OPEN procs CURLY_CLOSE 457 { 458 npfctl_build_rproc($2, $4); 459 } 460 ; 461 462 procs 463 : procs sepline proc_call 464 { 465 $$ = npfvar_add_elements($1, $3); 466 } 467 | proc_call { $$ = $1; } 468 ; 469 470 proc_call 471 : IDENTIFIER COLON proc_param_list 472 { 473 proc_call_t pc; 474 475 pc.pc_name = estrdup($1); 476 pc.pc_opts = $3; 477 478 $$ = npfvar_create_element(NPFVAR_PROC, &pc, sizeof(pc)); 479 } 480 | { $$ = NULL; } 481 ; 482 483 proc_param_list 484 : proc_param_list COMMA proc_param 485 { 486 $$ = npfvar_add_elements($1, $3); 487 } 488 | proc_param { $$ = $1; } 489 | { $$ = NULL; } 490 ; 491 492 proc_param 493 : some_name proc_param_val 494 { 495 proc_param_t pp; 496 497 pp.pp_param = estrdup($1); 498 pp.pp_value = $2 ? estrdup($2) : NULL; 499 500 $$ = npfvar_create_element(NPFVAR_PROC_PARAM, &pp, sizeof(pp)); 501 } 502 ; 503 504 proc_param_val 505 : some_name { $$ = $1; } 506 | number { (void)asprintf(&$$, "%ld", $1); } 507 | FPNUM { (void)asprintf(&$$, "%lf", $1); } 508 | { $$ = NULL; } 509 ; 510 511 /* 512 * Group and dynamic ruleset definition. 513 */ 514 515 group 516 : GROUP group_opts 517 { 518 /* Build a group. Increase the nesting level. */ 519 npfctl_build_group($2.rg_name, $2.rg_attr, 520 $2.rg_ifname, $2.rg_default); 521 } 522 ruleset_block 523 { 524 /* Decrease the nesting level. */ 525 npfctl_build_group_end(); 526 } 527 ; 528 529 ruleset 530 : RULESET group_opts 531 { 532 /* Ruleset is a dynamic group. */ 533 npfctl_build_group($2.rg_name, $2.rg_attr | NPF_RULE_DYNAMIC, 534 $2.rg_ifname, $2.rg_default); 535 npfctl_build_group_end(); 536 } 537 ; 538 539 group_dir 540 : FORW { $$ = NPF_RULE_FORW; } 541 | rule_dir 542 ; 543 544 group_opts 545 : DEFAULT 546 { 547 memset(&$$, 0, sizeof(rule_group_t)); 548 $$.rg_default = true; 549 } 550 | STRING group_dir on_ifname 551 { 552 memset(&$$, 0, sizeof(rule_group_t)); 553 $$.rg_name = $1; 554 $$.rg_attr = $2; 555 $$.rg_ifname = $3; 556 } 557 ; 558 559 ruleset_block 560 : CURLY_OPEN ruleset_def CURLY_CLOSE 561 ; 562 563 ruleset_def 564 : ruleset_def sepline rule_group 565 | rule_group 566 ; 567 568 rule_group 569 : rule 570 | group 571 | ruleset 572 | 573 ; 574 575 /* 576 * Rule and misc. 577 */ 578 579 rule 580 : block_or_pass opt_stateful rule_dir opt_final on_ifname 581 opt_family opt_proto all_or_filt_opts opt_apply 582 { 583 npfctl_build_rule($1 | $2 | $3 | $4, $5, 584 $6, $7, &$8, NULL, $9); 585 } 586 | block_or_pass opt_stateful rule_dir opt_final on_ifname 587 PCAP_FILTER STRING opt_apply 588 { 589 npfctl_build_rule($1 | $2 | $3 | $4, $5, 590 AF_UNSPEC, NULL, NULL, $7, $8); 591 } 592 ; 593 594 block_or_pass 595 : BLOCK block_opts { $$ = $2; } 596 | PASS { $$ = NPF_RULE_PASS; } 597 ; 598 599 rule_dir 600 : IN { $$ = NPF_RULE_IN; } 601 | OUT { $$ = NPF_RULE_OUT; } 602 | { $$ = NPF_RULE_IN | NPF_RULE_OUT; } 603 ; 604 605 opt_final 606 : FINAL { $$ = NPF_RULE_FINAL; } 607 | { $$ = 0; } 608 ; 609 610 on_ifname 611 : ON ifref { $$ = $2; } 612 | { $$ = NULL; } 613 ; 614 615 afamily 616 : INET4 { $$ = AF_INET; } 617 | INET6 { $$ = AF_INET6; } 618 ; 619 620 maybe_not 621 : EXCL_MARK { $$ = true; } 622 | { $$ = false; } 623 ; 624 625 opt_family 626 : FAMILY afamily { $$ = $2; } 627 | { $$ = AF_UNSPEC; } 628 ; 629 630 rawproto 631 : TCP tcp_flags_and_mask 632 { 633 $$.op_proto = IPPROTO_TCP; 634 $$.op_opts = $2; 635 } 636 | ICMP icmp_type_and_code 637 { 638 $$.op_proto = IPPROTO_ICMP; 639 $$.op_opts = $2; 640 } 641 | ICMP6 icmp_type_and_code 642 { 643 $$.op_proto = IPPROTO_ICMPV6; 644 $$.op_opts = $2; 645 } 646 | some_name 647 { 648 $$.op_proto = npfctl_protono($1); 649 $$.op_opts = NULL; 650 } 651 | number 652 { 653 $$.op_proto = $1; 654 $$.op_opts = NULL; 655 } 656 ; 657 658 proto_elems 659 : proto_elems COMMA rawproto 660 { 661 npfvar_t *pvar = npfvar_create_element( 662 NPFVAR_PROTO, &$3, sizeof($3)); 663 $$ = npfvar_add_elements($1, pvar); 664 } 665 | rawproto 666 { 667 $$ = npfvar_create_element(NPFVAR_PROTO, &$1, sizeof($1)); 668 } 669 ; 670 671 proto 672 : PROTO rawproto 673 { 674 $$ = npfvar_create_element(NPFVAR_PROTO, &$2, sizeof($2)); 675 } 676 | PROTO CURLY_OPEN proto_elems CURLY_CLOSE 677 { 678 $$ = $3; 679 } 680 ; 681 682 opt_proto 683 : proto { $$ = $1; } 684 | { $$ = NULL; } 685 ; 686 687 all_or_filt_opts 688 : ALL user_id group_id 689 { 690 $$.fo_finvert = false; 691 $$.fo_from.ap_netaddr = NULL; 692 $$.fo_from.ap_portrange = NULL; 693 $$.fo_tinvert = false; 694 $$.fo_to.ap_netaddr = NULL; 695 $$.fo_to.ap_portrange = NULL; 696 $$.uid = $2; 697 $$.gid = $3; 698 } 699 | filt_opts { $$ = $1; } 700 ; 701 702 opt_stateful 703 : STATEFUL { $$ = NPF_RULE_STATEFUL; } 704 | STATEFUL_ALL { $$ = NPF_RULE_STATEFUL | NPF_RULE_GSTATEFUL; } 705 | { $$ = 0; } 706 ; 707 708 opt_apply 709 : APPLY STRING { $$ = $2; } 710 | { $$ = NULL; } 711 ; 712 713 block_opts 714 : RETURNRST { $$ = NPF_RULE_RETRST; } 715 | RETURNICMP { $$ = NPF_RULE_RETICMP; } 716 | RETURN { $$ = NPF_RULE_RETRST | NPF_RULE_RETICMP; } 717 | { $$ = 0; } 718 ; 719 720 filt_opts 721 : FROM maybe_not filt_addr filt_port TO maybe_not filt_addr filt_port 722 user_id group_id 723 { 724 $$.fo_finvert = $2; 725 $$.fo_from.ap_netaddr = $3; 726 $$.fo_from.ap_portrange = $4; 727 $$.fo_tinvert = $6; 728 $$.fo_to.ap_netaddr = $7; 729 $$.fo_to.ap_portrange = $8; 730 $$.uid = $9; 731 $$.gid = $10; 732 } 733 | FROM maybe_not filt_addr filt_port user_id group_id 734 { 735 $$.fo_finvert = $2; 736 $$.fo_from.ap_netaddr = $3; 737 $$.fo_from.ap_portrange = $4; 738 $$.fo_tinvert = false; 739 $$.fo_to.ap_netaddr = NULL; 740 $$.fo_to.ap_portrange = NULL; 741 $$.uid = $5; 742 $$.gid = $6; 743 } 744 | TO maybe_not filt_addr filt_port user_id group_id 745 { 746 $$.fo_finvert = false; 747 $$.fo_from.ap_netaddr = NULL; 748 $$.fo_from.ap_portrange = NULL; 749 $$.fo_tinvert = $2; 750 $$.fo_to.ap_netaddr = $3; 751 $$.fo_to.ap_portrange = $4; 752 $$.uid = $5; 753 $$.gid = $6; 754 } 755 ; 756 757 filt_addr_list 758 : filt_addr_list COMMA filt_addr_element 759 { 760 npfvar_add_elements($1, $3); 761 } 762 | filt_addr_element 763 ; 764 765 filt_addr 766 : CURLY_OPEN filt_addr_list CURLY_CLOSE 767 { 768 $$ = $2; 769 } 770 | filt_addr_element { $$ = $1; } 771 | ANY { $$ = NULL; } 772 ; 773 774 addr_and_mask 775 : addr SLASH number 776 { 777 $$ = npfctl_parse_fam_addr_mask($1, NULL, &$3); 778 } 779 | addr SLASH addr 780 { 781 $$ = npfctl_parse_fam_addr_mask($1, $3, NULL); 782 } 783 | addr 784 { 785 $$ = npfctl_parse_fam_addr_mask($1, NULL, NULL); 786 } 787 ; 788 789 filt_addr_element 790 : addr_and_mask { assert($1 != NULL); $$ = $1; } 791 | static_ifaddrs 792 { 793 if (npfvar_get_count($1) != 1) 794 yyerror("multiple interfaces are not supported"); 795 ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 796 $$ = ifna->ifna_addrs; 797 } 798 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 799 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 800 | VAR_ID 801 { 802 npfvar_t *vp = npfvar_lookup($1); 803 int type = npfvar_get_type(vp, 0); 804 ifnet_addr_t *ifna; 805 again: 806 switch (type) { 807 case NPFVAR_IDENTIFIER: 808 case NPFVAR_STRING: 809 vp = npfctl_parse_ifnet(npfvar_expand_string(vp), 810 AF_UNSPEC); 811 type = npfvar_get_type(vp, 0); 812 goto again; 813 case NPFVAR_FAM: 814 case NPFVAR_TABLE: 815 $$ = vp; 816 break; 817 case NPFVAR_INTERFACE: 818 $$ = NULL; 819 for (u_int i = 0; i < npfvar_get_count(vp); i++) { 820 ifna = npfvar_get_data(vp, type, i); 821 $$ = npfvar_add_elements($$, ifna->ifna_addrs); 822 } 823 break; 824 case -1: 825 yyerror("undefined variable '%s'", $1); 826 break; 827 default: 828 yyerror("wrong variable '%s' type '%s' for address " 829 "or interface", $1, npfvar_type(type)); 830 break; 831 } 832 } 833 ; 834 835 addr 836 : IPV4ADDR { $$ = $1; } 837 | IPV6ADDR { $$ = $1; } 838 ; 839 840 filt_port 841 : PORT CURLY_OPEN filt_port_list CURLY_CLOSE 842 { 843 $$ = npfctl_parse_port_range_variable(NULL, $3); 844 } 845 | PORT port_range { $$ = $2; } 846 | { $$ = NULL; } 847 ; 848 849 filt_port_list 850 : filt_port_list COMMA port_range 851 { 852 npfvar_add_elements($1, $3); 853 } 854 | port_range 855 ; 856 857 port_range 858 : port /* just port */ 859 { 860 $$ = npfctl_parse_port_range($1, $1); 861 } 862 | port MINUS port /* port from-to */ 863 { 864 $$ = npfctl_parse_port_range($1, $3); 865 } 866 | VAR_ID 867 { 868 npfvar_t *vp; 869 if ((vp = npfvar_lookup($1)) == NULL) 870 yyerror("undefined port variable %s", $1); 871 $$ = npfctl_parse_port_range_variable($1, vp); 872 } 873 ; 874 875 port 876 : number { $$ = $1; } 877 | IDENTIFIER { $$ = npfctl_portno($1); } 878 | STRING { $$ = npfctl_portno($1); } 879 ; 880 881 icmp_type_and_code 882 : ICMPTYPE icmp_type 883 { 884 $$ = npfctl_parse_icmp($<num>0, $2, -1); 885 } 886 | ICMPTYPE icmp_type CODE number 887 { 888 $$ = npfctl_parse_icmp($<num>0, $2, $4); 889 } 890 | ICMPTYPE icmp_type CODE IDENTIFIER 891 { 892 $$ = npfctl_parse_icmp($<num>0, $2, 893 npfctl_icmpcode($<num>0, $2, $4)); 894 } 895 | ICMPTYPE icmp_type CODE VAR_ID 896 { 897 char *s = npfvar_expand_string(npfvar_lookup($4)); 898 $$ = npfctl_parse_icmp($<num>0, $2, 899 npfctl_icmpcode($<num>0, $2, s)); 900 } 901 | { $$ = NULL; } 902 ; 903 904 tcp_flags_and_mask 905 : FLAGS tcp_flags SLASH tcp_flags 906 { 907 npfvar_add_elements($2, $4); 908 $$ = $2; 909 } 910 | FLAGS tcp_flags 911 { 912 if (npfvar_get_count($2) != 1) 913 yyerror("multiple tcpflags are not supported"); 914 char *s = npfvar_get_data($2, NPFVAR_TCPFLAG, 0); 915 npfvar_add_elements($2, npfctl_parse_tcpflag(s)); 916 $$ = $2; 917 } 918 | { $$ = NULL; } 919 ; 920 921 tcp_flags 922 : IDENTIFIER { $$ = npfctl_parse_tcpflag($1); } 923 ; 924 925 icmp_type 926 : number { $$ = $1; } 927 | IDENTIFIER { $$ = npfctl_icmptype($<num>-1, $1); } 928 | VAR_ID 929 { 930 char *s = npfvar_expand_string(npfvar_lookup($1)); 931 $$ = npfctl_icmptype($<num>-1, s); 932 } 933 ; 934 935 ifname 936 : some_name 937 { 938 npfctl_note_interface($1); 939 $$ = $1; 940 } 941 | VAR_ID 942 { 943 npfvar_t *vp = npfvar_lookup($1); 944 const int type = npfvar_get_type(vp, 0); 945 ifnet_addr_t *ifna; 946 const char *name; 947 unsigned *tid; 948 bool ifaddr; 949 950 switch (type) { 951 case NPFVAR_STRING: 952 case NPFVAR_IDENTIFIER: 953 $$ = npfvar_expand_string(vp); 954 break; 955 case NPFVAR_INTERFACE: 956 if (npfvar_get_count(vp) != 1) 957 yyerror( 958 "multiple interfaces are not supported"); 959 ifna = npfvar_get_data(vp, type, 0); 960 $$ = ifna->ifna_name; 961 break; 962 case NPFVAR_TABLE: 963 tid = npfvar_get_data(vp, type, 0); 964 name = npfctl_table_getname(npfctl_config_ref(), 965 *tid, &ifaddr); 966 if (!ifaddr) { 967 yyerror("variable '%s' references a table " 968 "%s instead of an interface", $1, name); 969 } 970 $$ = estrdup(name); 971 break; 972 case -1: 973 yyerror("undefined variable '%s' for interface", $1); 974 break; 975 default: 976 yyerror("wrong variable '%s' type '%s' for interface", 977 $1, npfvar_type(type)); 978 break; 979 } 980 npfctl_note_interface($$); 981 } 982 ; 983 984 static_ifaddrs 985 : afamily PAR_OPEN ifname PAR_CLOSE 986 { 987 $$ = npfctl_parse_ifnet($3, $1); 988 } 989 ; 990 991 dynamic_ifaddrs 992 : IFADDRS PAR_OPEN ifname PAR_CLOSE 993 { 994 $$ = $3; 995 } 996 ; 997 998 ifref 999 : ifname 1000 | dynamic_ifaddrs 1001 | static_ifaddrs 1002 { 1003 ifnet_addr_t *ifna; 1004 1005 if (npfvar_get_count($1) != 1) { 1006 yyerror("multiple interfaces are not supported"); 1007 } 1008 ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 1009 npfctl_note_interface(ifna->ifna_name); 1010 $$ = ifna->ifna_name; 1011 } 1012 ; 1013 1014 user_id 1015 : /* empty */ { $$.op = NPF_OP_NONE; } 1016 | USER uids { $$ = $2; } 1017 ; 1018 1019 uids 1020 : uid_item { $$ = $1; } 1021 ; 1022 1023 uid_item 1024 : uid 1025 { 1026 npfctl_init_rid(&$$, $1, $1, NPF_OP_EQ); 1027 } 1028 | op_unary uid 1029 { 1030 npfctl_init_rid(&$$, $2, $2, $1); 1031 } 1032 | uid op_binary uid 1033 { 1034 npfctl_init_rid(&$$, $1, $3, $2); 1035 } 1036 ; 1037 1038 uid 1039 : NUM 1040 { 1041 if ($1 >= UID_MAX) { 1042 yyerror("illegal uid value %lu", $1); 1043 } 1044 $$ = $1; 1045 } 1046 | IDENTIFIER 1047 { 1048 if (npfctl_parse_user($1, &$$) == -1) { 1049 yyerror("unknown user %s", $1); 1050 } 1051 } 1052 | VAR_ID 1053 { 1054 npf_var_rid($1, npfctl_parse_user, &$$, "user"); 1055 } 1056 ; 1057 1058 group_id 1059 : /* empty */ { $$.op = NPF_OP_NONE; } 1060 | GROUP gids { $$ = $2; } 1061 ; 1062 1063 gids 1064 : gid_item { $$ = $1; } 1065 ; 1066 1067 gid_item 1068 : gid 1069 { 1070 npfctl_init_rid(&$$, $1, $1, NPF_OP_EQ); 1071 } 1072 | op_unary gid 1073 { 1074 npfctl_init_rid(&$$, $2, $2, $1); 1075 } 1076 | gid op_binary gid 1077 { 1078 npfctl_init_rid(&$$, $1, $3, $2); 1079 } 1080 ; 1081 1082 gid 1083 : NUM 1084 { 1085 if ($1 >= GID_MAX) { 1086 yyerror("illegal gid value %lu", $1); 1087 } 1088 $$ = $1; 1089 } 1090 | IDENTIFIER 1091 { 1092 if (npfctl_parse_group($1, &$$) == -1) { 1093 yyerror("unknown group %s", $1); 1094 } 1095 } 1096 | VAR_ID 1097 { 1098 npf_var_rid($1, npfctl_parse_group, &$$, "group"); 1099 } 1100 ; 1101 1102 op_unary 1103 : EQ { $$ = NPF_OP_EQ; } 1104 | EXCL_MARK EQ { $$ = NPF_OP_NE; } 1105 | LT EQ { $$ = NPF_OP_LE; } 1106 | LT { $$ = NPF_OP_LT; } 1107 | GT EQ { $$ = NPF_OP_GE; } 1108 | GT { $$ = NPF_OP_GT; } 1109 ; 1110 1111 op_binary 1112 : XRG { $$ = NPF_OP_XRG; } 1113 | IRG { $$ = NPF_OP_IRG; } 1114 ; 1115 1116 number 1117 : HEX { $$ = $1; } 1118 | NUM { $$ = $1; } 1119 ; 1120 1121 some_name 1122 : IDENTIFIER { $$ = $1; } 1123 | STRING { $$ = $1; } 1124 ; 1125 1126 %% 1127
Indexes created Mon Sep 29 21:09:56 GMT 2025