npf_parse.y revision 1.56
1 /*- 2 * Copyright (c) 2011-2025 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This code is derived from software contributed to The NetBSD Foundation 6 * by Martin Husemann, Christos Zoulas and Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 %{ 31 32 #include <err.h> 33 #include <netdb.h> 34 #include <stdio.h> 35 #include <stdlib.h> 36 #include <string.h> 37 #ifdef __NetBSD__ 38 #include <vis.h> 39 #endif 40 41 #include "npfctl.h" 42 43 #define YYSTACKSIZE 4096 44 45 int yystarttoken; 46 const char * yyfilename; 47 48 extern int yylineno, yycolumn; 49 extern int yylex(int); 50 51 void 52 yyerror(const char *fmt, ...) 53 { 54 extern int yyleng; 55 extern char *yytext; 56 57 char *msg, *context = estrndup(yytext, yyleng); 58 bool eol = (*context == '\n'); 59 va_list ap; 60 61 va_start(ap, fmt); 62 vasprintf(&msg, fmt, ap); 63 va_end(ap); 64 65 fprintf(stderr, "%s:%d:%d: %s", yyfilename, 66 yylineno - (int)eol, yycolumn, msg); 67 if (!eol) { 68 #ifdef __NetBSD__ 69 size_t len = strlen(context); 70 char *dst = ecalloc(1, len * 4 + 1); 71 72 strvisx(dst, context, len, VIS_WHITE|VIS_CSTYLE); 73 context = dst; 74 #endif 75 fprintf(stderr, " near '%s'", context); 76 } 77 fprintf(stderr, "\n"); 78 exit(EXIT_FAILURE); 79 } 80 81 %} 82 83 /* 84 * No conflicts allowed. Keep it this way. 85 */ 86 %expect 0 87 %expect-rr 0 88 89 /* 90 * Depending on the mode of operation, set a different start symbol. 91 * Workaround yacc limitation by passing the start token. 92 */ 93 %start input 94 %token RULE_ENTRY_TOKEN MAP_ENTRY_TOKEN 95 %lex-param { int yystarttoken } 96 97 /* 98 * General tokens. 99 */ 100 %token ALG 101 %token ALGO 102 %token ALL 103 %token ANY 104 %token APPLY 105 %token ARROWBOTH 106 %token ARROWLEFT 107 %token ARROWRIGHT 108 %token BLOCK 109 %token CDB 110 %token CONST 111 %token CURLY_CLOSE 112 %token CURLY_OPEN 113 %token CODE 114 %token COLON 115 %token COMMA 116 %token DEFAULT 117 %token TDYNAMIC 118 %token TSTATIC 119 %token EQ 120 %token EXCL_MARK 121 %token TFILE 122 %token FLAGS 123 %token FROM 124 %token GROUP 125 %token HASH 126 %token ICMPTYPE 127 %token ID 128 %token IFADDRS 129 %token IN 130 %token INET4 131 %token INET6 132 %token INTERFACE 133 %token INVALID 134 %token IPHASH 135 %token IPSET 136 %token LPM 137 %token MAP 138 %token NEWLINE 139 %token NO_PORTS 140 %token MINUS 141 %token NAME 142 %token NETMAP 143 %token NPT66 144 %token ON 145 %token OFF 146 %token OUT 147 %token PAR_CLOSE 148 %token PAR_OPEN 149 %token PASS 150 %token PCAP_FILTER 151 %token PORT 152 %token PROCEDURE 153 %token PROTO 154 %token FAMILY 155 %token FINAL 156 %token FORW 157 %token RETURN 158 %token RETURNICMP 159 %token RETURNRST 160 %token ROUNDROBIN 161 %token RULESET 162 %token SEMICOLON 163 %token SET 164 %token SLASH 165 %token STATEFUL 166 %token STATEFUL_ALL 167 %token TABLE 168 %token TCP 169 %token TO 170 %token TREE 171 %token TYPE 172 %token USER 173 %token <num> ICMP 174 %token <num> ICMP6 175 176 %token <num> HEX 177 %token <str> IDENTIFIER 178 %token <str> IPV4ADDR 179 %token <str> IPV6ADDR 180 %token <num> NUM 181 %token <fpnum> FPNUM 182 %token <str> STRING 183 %token <str> PARAM 184 %token <str> TABLE_ID 185 %token <str> VAR_ID 186 187 %type <str> addr some_name table_store dynamic_ifaddrs 188 %type <str> proc_param_val opt_apply ifname on_ifname ifref 189 %type <num> port opt_final number afamily opt_family 190 %type <num> block_or_pass rule_dir group_dir block_opts 191 %type <num> maybe_not opt_stateful icmp_type table_type 192 %type <num> map_sd map_algo map_flags map_type 193 %type <num> param_val op_unary op_binary 194 %type <rid> uid gid 195 %type <var> static_ifaddrs filt_addr_element 196 %type <var> filt_port filt_port_list port_range icmp_type_and_code 197 %type <var> filt_addr addr_and_mask tcp_flags tcp_flags_and_mask 198 %type <var> procs proc_call proc_param_list proc_param 199 %type <var> element list_elems list_trail list value filt_addr_list 200 %type <var> opt_proto proto proto_elems 201 %type <addrport> mapseg 202 %type <uid> uids uid_item uid_list user_id 203 %type <gid> gids gid_item gid_list group_id 204 %type <filtopts> filt_opts all_or_filt_opts 205 %type <optproto> rawproto 206 %type <rulegroup> group_opts 207 208 %union { 209 char * str; 210 unsigned long num; 211 uint32_t rid; 212 double fpnum; 213 npfvar_t * var; 214 addr_port_t addrport; 215 filt_opts_t filtopts; 216 opt_proto_t optproto; 217 rule_group_t rulegroup; 218 struct r_id uid; 219 struct r_id gid; 220 } 221 222 %% 223 224 input 225 : lines 226 | RULE_ENTRY_TOKEN rule 227 | MAP_ENTRY_TOKEN map 228 ; 229 230 lines 231 : lines sepline line 232 | line 233 ; 234 235 line 236 : vardef 237 | table 238 | map 239 | group 240 | rproc 241 | alg 242 | set 243 | 244 ; 245 246 alg 247 : ALG STRING 248 { 249 npfctl_build_alg($2); 250 } 251 ; 252 253 sepline 254 : NEWLINE 255 | SEMICOLON 256 ; 257 258 param_val 259 : number { $$ = $1; } 260 | ON { $$ = true; } 261 | OFF { $$ = false; } 262 ; 263 264 set 265 : SET PARAM param_val { 266 npfctl_setparam($2, $3); 267 } 268 ; 269 270 /* 271 * A value - an element or a list of elements. 272 * Can be assigned to a variable or used inline. 273 */ 274 275 vardef 276 : VAR_ID EQ value 277 { 278 npfvar_add($3, $1); 279 } 280 ; 281 282 value 283 : element 284 | list 285 ; 286 287 list 288 : CURLY_OPEN opt_nl list_elems CURLY_CLOSE 289 { 290 $$ = $3; 291 } 292 ; 293 294 list_elems 295 : element list_trail 296 { 297 $$ = npfvar_add_elements($1, $2); 298 } 299 ; 300 301 element 302 : IDENTIFIER 303 { 304 $$ = npfvar_create_from_string(NPFVAR_IDENTIFIER, $1); 305 } 306 | STRING 307 { 308 $$ = npfvar_create_from_string(NPFVAR_STRING, $1); 309 } 310 | number MINUS number 311 { 312 $$ = npfctl_parse_port_range($1, $3); 313 } 314 | number 315 { 316 uint32_t val = $1; 317 $$ = npfvar_create_element(NPFVAR_NUM, &val, sizeof(val)); 318 } 319 | VAR_ID 320 { 321 $$ = npfvar_create_from_string(NPFVAR_VAR_ID, $1); 322 } 323 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 324 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 325 | static_ifaddrs { $$ = $1; } 326 | addr_and_mask { $$ = $1; } 327 ; 328 329 list_trail 330 : element_sep element list_trail 331 { 332 $$ = npfvar_add_elements($2, $3); 333 } 334 | opt_nl { $$ = NULL; } 335 | element_sep { $$ = NULL; } 336 ; 337 338 element_sep 339 : opt_nl COMMA opt_nl 340 ; 341 342 opt_nl 343 : opt_nl NEWLINE 344 | 345 ; 346 347 /* 348 * Table definition. 349 */ 350 351 table 352 : TABLE TABLE_ID TYPE table_type table_store 353 { 354 npfctl_build_table($2, $4, $5); 355 } 356 ; 357 358 table_type 359 : IPSET { $$ = NPF_TABLE_IPSET; } 360 | HASH 361 { 362 warnx("warning - table type \"hash\" is deprecated and may be " 363 "deleted in\nthe future; please use the \"ipset\" type " 364 "instead."); 365 $$ = NPF_TABLE_IPSET; 366 } 367 | LPM { $$ = NPF_TABLE_LPM; } 368 | TREE 369 { 370 warnx("warning - table type \"tree\" is deprecated and may be " 371 "deleted in\nthe future; please use the \"lpm\" type " 372 "instead."); 373 $$ = NPF_TABLE_LPM; 374 } 375 | CONST { $$ = NPF_TABLE_CONST; } 376 | CDB 377 { 378 warnx("warning -- table type \"cdb\" is deprecated and may be " 379 "deleted in\nthe future; please use the \"const\" type " 380 "instead."); 381 $$ = NPF_TABLE_CONST; 382 } 383 ; 384 385 table_store 386 : TFILE STRING { $$ = $2; } 387 | TDYNAMIC 388 { 389 warnx("warning - the \"dynamic\" keyword for tables is obsolete"); 390 $$ = NULL; 391 } 392 | { $$ = NULL; } 393 ; 394 395 /* 396 * Map definition. 397 */ 398 399 map_sd 400 : TSTATIC { $$ = NPFCTL_NAT_STATIC; } 401 | TDYNAMIC { $$ = NPFCTL_NAT_DYNAMIC; } 402 | { $$ = NPFCTL_NAT_DYNAMIC; } 403 ; 404 405 map_algo 406 : ALGO NETMAP { $$ = NPF_ALGO_NETMAP; } 407 | ALGO IPHASH { $$ = NPF_ALGO_IPHASH; } 408 | ALGO ROUNDROBIN { $$ = NPF_ALGO_RR; } 409 | ALGO NPT66 { $$ = NPF_ALGO_NPT66; } 410 | { $$ = 0; } 411 ; 412 413 map_flags 414 : NO_PORTS { $$ = NPF_NAT_PORTS; } 415 | { $$ = 0; } 416 ; 417 418 map_type 419 : ARROWBOTH { $$ = NPF_NATIN | NPF_NATOUT; } 420 | ARROWLEFT { $$ = NPF_NATIN; } 421 | ARROWRIGHT { $$ = NPF_NATOUT; } 422 ; 423 424 mapseg 425 : filt_addr filt_port 426 { 427 $$.ap_netaddr = $1; 428 $$.ap_portrange = $2; 429 } 430 ; 431 432 map 433 : MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 434 PASS opt_family opt_proto all_or_filt_opts 435 { 436 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, $11, &$12, $4); 437 } 438 | MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 439 { 440 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, NULL, NULL, $4); 441 } 442 | MAP ifref map_sd map_algo map_flags proto mapseg map_type mapseg 443 { 444 npfctl_build_natseg($3, $8, $5, $2, &$7, &$9, $6, NULL, $4); 445 } 446 | MAP RULESET group_opts 447 { 448 npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifname); 449 } 450 ; 451 452 /* 453 * Rule procedure definition and its parameters. 454 */ 455 456 rproc 457 : PROCEDURE STRING CURLY_OPEN procs CURLY_CLOSE 458 { 459 npfctl_build_rproc($2, $4); 460 } 461 ; 462 463 procs 464 : procs sepline proc_call 465 { 466 $$ = npfvar_add_elements($1, $3); 467 } 468 | proc_call { $$ = $1; } 469 ; 470 471 proc_call 472 : IDENTIFIER COLON proc_param_list 473 { 474 proc_call_t pc; 475 476 pc.pc_name = estrdup($1); 477 pc.pc_opts = $3; 478 479 $$ = npfvar_create_element(NPFVAR_PROC, &pc, sizeof(pc)); 480 } 481 | { $$ = NULL; } 482 ; 483 484 proc_param_list 485 : proc_param_list COMMA proc_param 486 { 487 $$ = npfvar_add_elements($1, $3); 488 } 489 | proc_param { $$ = $1; } 490 | { $$ = NULL; } 491 ; 492 493 proc_param 494 : some_name proc_param_val 495 { 496 proc_param_t pp; 497 498 pp.pp_param = estrdup($1); 499 pp.pp_value = $2 ? estrdup($2) : NULL; 500 501 $$ = npfvar_create_element(NPFVAR_PROC_PARAM, &pp, sizeof(pp)); 502 } 503 ; 504 505 proc_param_val 506 : some_name { $$ = $1; } 507 | number { (void)asprintf(&$$, "%ld", $1); } 508 | FPNUM { (void)asprintf(&$$, "%lf", $1); } 509 | { $$ = NULL; } 510 ; 511 512 /* 513 * Group and dynamic ruleset definition. 514 */ 515 516 group 517 : GROUP group_opts 518 { 519 /* Build a group. Increase the nesting level. */ 520 npfctl_build_group($2.rg_name, $2.rg_attr, 521 $2.rg_ifname, $2.rg_default); 522 } 523 ruleset_block 524 { 525 /* Decrease the nesting level. */ 526 npfctl_build_group_end(); 527 } 528 ; 529 530 ruleset 531 : RULESET group_opts 532 { 533 /* Ruleset is a dynamic group. */ 534 npfctl_build_group($2.rg_name, $2.rg_attr | NPF_RULE_DYNAMIC, 535 $2.rg_ifname, $2.rg_default); 536 npfctl_build_group_end(); 537 } 538 ; 539 540 group_dir 541 : FORW { $$ = NPF_RULE_FORW; } 542 | rule_dir 543 ; 544 545 group_opts 546 : DEFAULT 547 { 548 memset(&$$, 0, sizeof(rule_group_t)); 549 $$.rg_default = true; 550 } 551 | STRING group_dir on_ifname 552 { 553 memset(&$$, 0, sizeof(rule_group_t)); 554 $$.rg_name = $1; 555 $$.rg_attr = $2; 556 $$.rg_ifname = $3; 557 } 558 ; 559 560 ruleset_block 561 : CURLY_OPEN ruleset_def CURLY_CLOSE 562 ; 563 564 ruleset_def 565 : ruleset_def sepline rule_group 566 | rule_group 567 ; 568 569 rule_group 570 : rule 571 | group 572 | ruleset 573 | 574 ; 575 576 /* 577 * Rule and misc. 578 */ 579 580 rule 581 : block_or_pass opt_stateful rule_dir opt_final on_ifname 582 opt_family opt_proto all_or_filt_opts opt_apply 583 { 584 npfctl_build_rule($1 | $2 | $3 | $4, $5, 585 $6, $7, &$8, NULL, $9); 586 } 587 | block_or_pass opt_stateful rule_dir opt_final on_ifname 588 PCAP_FILTER STRING opt_apply 589 { 590 npfctl_build_rule($1 | $2 | $3 | $4, $5, 591 AF_UNSPEC, NULL, NULL, $7, $8); 592 } 593 ; 594 595 block_or_pass 596 : BLOCK block_opts { $$ = $2; } 597 | PASS { $$ = NPF_RULE_PASS; } 598 ; 599 600 rule_dir 601 : IN { $$ = NPF_RULE_IN; } 602 | OUT { $$ = NPF_RULE_OUT; } 603 | { $$ = NPF_RULE_IN | NPF_RULE_OUT; } 604 ; 605 606 opt_final 607 : FINAL { $$ = NPF_RULE_FINAL; } 608 | { $$ = 0; } 609 ; 610 611 on_ifname 612 : ON ifref { $$ = $2; } 613 | { $$ = NULL; } 614 ; 615 616 afamily 617 : INET4 { $$ = AF_INET; } 618 | INET6 { $$ = AF_INET6; } 619 ; 620 621 maybe_not 622 : EXCL_MARK { $$ = true; } 623 | { $$ = false; } 624 ; 625 626 opt_family 627 : FAMILY afamily { $$ = $2; } 628 | { $$ = AF_UNSPEC; } 629 ; 630 631 rawproto 632 : TCP tcp_flags_and_mask 633 { 634 $$.op_proto = IPPROTO_TCP; 635 $$.op_opts = $2; 636 } 637 | ICMP icmp_type_and_code 638 { 639 $$.op_proto = IPPROTO_ICMP; 640 $$.op_opts = $2; 641 } 642 | ICMP6 icmp_type_and_code 643 { 644 $$.op_proto = IPPROTO_ICMPV6; 645 $$.op_opts = $2; 646 } 647 | some_name 648 { 649 $$.op_proto = npfctl_protono($1); 650 $$.op_opts = NULL; 651 } 652 | number 653 { 654 $$.op_proto = $1; 655 $$.op_opts = NULL; 656 } 657 ; 658 659 proto_elems 660 : proto_elems COMMA rawproto 661 { 662 npfvar_t *pvar = npfvar_create_element( 663 NPFVAR_PROTO, &$3, sizeof($3)); 664 $$ = npfvar_add_elements($1, pvar); 665 } 666 | rawproto 667 { 668 $$ = npfvar_create_element(NPFVAR_PROTO, &$1, sizeof($1)); 669 } 670 ; 671 672 proto 673 : PROTO rawproto 674 { 675 $$ = npfvar_create_element(NPFVAR_PROTO, &$2, sizeof($2)); 676 } 677 | PROTO CURLY_OPEN proto_elems CURLY_CLOSE 678 { 679 $$ = $3; 680 } 681 ; 682 683 opt_proto 684 : proto { $$ = $1; } 685 | { $$ = NULL; } 686 ; 687 688 all_or_filt_opts 689 : ALL user_id group_id 690 { 691 $$.fo_finvert = false; 692 $$.fo_from.ap_netaddr = NULL; 693 $$.fo_from.ap_portrange = NULL; 694 $$.fo_tinvert = false; 695 $$.fo_to.ap_netaddr = NULL; 696 $$.fo_to.ap_portrange = NULL; 697 $$.uid = $2; 698 $$.gid = $3; 699 } 700 | filt_opts { $$ = $1; } 701 ; 702 703 opt_stateful 704 : STATEFUL { $$ = NPF_RULE_STATEFUL; } 705 | STATEFUL_ALL { $$ = NPF_RULE_STATEFUL | NPF_RULE_GSTATEFUL; } 706 | { $$ = 0; } 707 ; 708 709 opt_apply 710 : APPLY STRING { $$ = $2; } 711 | { $$ = NULL; } 712 ; 713 714 block_opts 715 : RETURNRST { $$ = NPF_RULE_RETRST; } 716 | RETURNICMP { $$ = NPF_RULE_RETICMP; } 717 | RETURN { $$ = NPF_RULE_RETRST | NPF_RULE_RETICMP; } 718 | { $$ = 0; } 719 ; 720 721 filt_opts 722 : FROM maybe_not filt_addr filt_port TO maybe_not filt_addr filt_port 723 user_id group_id 724 { 725 $$.fo_finvert = $2; 726 $$.fo_from.ap_netaddr = $3; 727 $$.fo_from.ap_portrange = $4; 728 $$.fo_tinvert = $6; 729 $$.fo_to.ap_netaddr = $7; 730 $$.fo_to.ap_portrange = $8; 731 $$.uid = $9; 732 $$.gid = $10; 733 } 734 | FROM maybe_not filt_addr filt_port user_id group_id 735 { 736 $$.fo_finvert = $2; 737 $$.fo_from.ap_netaddr = $3; 738 $$.fo_from.ap_portrange = $4; 739 $$.fo_tinvert = false; 740 $$.fo_to.ap_netaddr = NULL; 741 $$.fo_to.ap_portrange = NULL; 742 $$.uid = $5; 743 $$.gid = $6; 744 } 745 | TO maybe_not filt_addr filt_port user_id group_id 746 { 747 $$.fo_finvert = false; 748 $$.fo_from.ap_netaddr = NULL; 749 $$.fo_from.ap_portrange = NULL; 750 $$.fo_tinvert = $2; 751 $$.fo_to.ap_netaddr = $3; 752 $$.fo_to.ap_portrange = $4; 753 $$.uid = $5; 754 $$.gid = $6; 755 } 756 ; 757 758 filt_addr_list 759 : filt_addr_list COMMA filt_addr_element 760 { 761 npfvar_add_elements($1, $3); 762 } 763 | filt_addr_element 764 ; 765 766 filt_addr 767 : CURLY_OPEN filt_addr_list CURLY_CLOSE 768 { 769 $$ = $2; 770 } 771 | filt_addr_element { $$ = $1; } 772 | ANY { $$ = NULL; } 773 ; 774 775 addr_and_mask 776 : addr SLASH number 777 { 778 $$ = npfctl_parse_fam_addr_mask($1, NULL, &$3); 779 } 780 | addr SLASH addr 781 { 782 $$ = npfctl_parse_fam_addr_mask($1, $3, NULL); 783 } 784 | addr 785 { 786 $$ = npfctl_parse_fam_addr_mask($1, NULL, NULL); 787 } 788 ; 789 790 filt_addr_element 791 : addr_and_mask { assert($1 != NULL); $$ = $1; } 792 | static_ifaddrs 793 { 794 if (npfvar_get_count($1) != 1) 795 yyerror("multiple interfaces are not supported"); 796 ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 797 $$ = ifna->ifna_addrs; 798 } 799 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 800 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 801 | VAR_ID 802 { 803 npfvar_t *vp = npfvar_lookup($1); 804 int type = npfvar_get_type(vp, 0); 805 ifnet_addr_t *ifna; 806 again: 807 switch (type) { 808 case NPFVAR_IDENTIFIER: 809 case NPFVAR_STRING: 810 vp = npfctl_parse_ifnet(npfvar_expand_string(vp), 811 AF_UNSPEC); 812 type = npfvar_get_type(vp, 0); 813 goto again; 814 case NPFVAR_FAM: 815 case NPFVAR_TABLE: 816 $$ = vp; 817 break; 818 case NPFVAR_INTERFACE: 819 $$ = NULL; 820 for (u_int i = 0; i < npfvar_get_count(vp); i++) { 821 ifna = npfvar_get_data(vp, type, i); 822 $$ = npfvar_add_elements($$, ifna->ifna_addrs); 823 } 824 break; 825 case -1: 826 yyerror("undefined variable '%s'", $1); 827 break; 828 default: 829 yyerror("wrong variable '%s' type '%s' for address " 830 "or interface", $1, npfvar_type(type)); 831 break; 832 } 833 } 834 ; 835 836 addr 837 : IPV4ADDR { $$ = $1; } 838 | IPV6ADDR { $$ = $1; } 839 ; 840 841 filt_port 842 : PORT CURLY_OPEN filt_port_list CURLY_CLOSE 843 { 844 $$ = npfctl_parse_port_range_variable(NULL, $3); 845 } 846 | PORT port_range { $$ = $2; } 847 | { $$ = NULL; } 848 ; 849 850 filt_port_list 851 : filt_port_list COMMA port_range 852 { 853 npfvar_add_elements($1, $3); 854 } 855 | port_range 856 ; 857 858 port_range 859 : port /* just port */ 860 { 861 $$ = npfctl_parse_port_range($1, $1); 862 } 863 | port MINUS port /* port from-to */ 864 { 865 $$ = npfctl_parse_port_range($1, $3); 866 } 867 | VAR_ID 868 { 869 npfvar_t *vp; 870 if ((vp = npfvar_lookup($1)) == NULL) 871 yyerror("undefined port variable %s", $1); 872 $$ = npfctl_parse_port_range_variable($1, vp); 873 } 874 ; 875 876 port 877 : number { $$ = $1; } 878 | IDENTIFIER { $$ = npfctl_portno($1); } 879 | STRING { $$ = npfctl_portno($1); } 880 ; 881 882 icmp_type_and_code 883 : ICMPTYPE icmp_type 884 { 885 $$ = npfctl_parse_icmp($<num>0, $2, -1); 886 } 887 | ICMPTYPE icmp_type CODE number 888 { 889 $$ = npfctl_parse_icmp($<num>0, $2, $4); 890 } 891 | ICMPTYPE icmp_type CODE IDENTIFIER 892 { 893 $$ = npfctl_parse_icmp($<num>0, $2, 894 npfctl_icmpcode($<num>0, $2, $4)); 895 } 896 | ICMPTYPE icmp_type CODE VAR_ID 897 { 898 char *s = npfvar_expand_string(npfvar_lookup($4)); 899 $$ = npfctl_parse_icmp($<num>0, $2, 900 npfctl_icmpcode($<num>0, $2, s)); 901 } 902 | { $$ = NULL; } 903 ; 904 905 tcp_flags_and_mask 906 : FLAGS tcp_flags SLASH tcp_flags 907 { 908 npfvar_add_elements($2, $4); 909 $$ = $2; 910 } 911 | FLAGS tcp_flags 912 { 913 if (npfvar_get_count($2) != 1) 914 yyerror("multiple tcpflags are not supported"); 915 char *s = npfvar_get_data($2, NPFVAR_TCPFLAG, 0); 916 npfvar_add_elements($2, npfctl_parse_tcpflag(s)); 917 $$ = $2; 918 } 919 | { $$ = NULL; } 920 ; 921 922 tcp_flags 923 : IDENTIFIER { $$ = npfctl_parse_tcpflag($1); } 924 ; 925 926 icmp_type 927 : number { $$ = $1; } 928 | IDENTIFIER { $$ = npfctl_icmptype($<num>-1, $1); } 929 | VAR_ID 930 { 931 char *s = npfvar_expand_string(npfvar_lookup($1)); 932 $$ = npfctl_icmptype($<num>-1, s); 933 } 934 ; 935 936 ifname 937 : some_name 938 { 939 npfctl_note_interface($1); 940 $$ = $1; 941 } 942 | VAR_ID 943 { 944 npfvar_t *vp = npfvar_lookup($1); 945 const int type = npfvar_get_type(vp, 0); 946 ifnet_addr_t *ifna; 947 const char *name; 948 unsigned *tid; 949 bool ifaddr; 950 951 switch (type) { 952 case NPFVAR_STRING: 953 case NPFVAR_IDENTIFIER: 954 $$ = npfvar_expand_string(vp); 955 break; 956 case NPFVAR_INTERFACE: 957 if (npfvar_get_count(vp) != 1) 958 yyerror( 959 "multiple interfaces are not supported"); 960 ifna = npfvar_get_data(vp, type, 0); 961 $$ = ifna->ifna_name; 962 break; 963 case NPFVAR_TABLE: 964 tid = npfvar_get_data(vp, type, 0); 965 name = npfctl_table_getname(npfctl_config_ref(), 966 *tid, &ifaddr); 967 if (!ifaddr) { 968 yyerror("variable '%s' references a table " 969 "%s instead of an interface", $1, name); 970 } 971 $$ = estrdup(name); 972 break; 973 case -1: 974 yyerror("undefined variable '%s' for interface", $1); 975 break; 976 default: 977 yyerror("wrong variable '%s' type '%s' for interface", 978 $1, npfvar_type(type)); 979 break; 980 } 981 npfctl_note_interface($$); 982 } 983 ; 984 985 static_ifaddrs 986 : afamily PAR_OPEN ifname PAR_CLOSE 987 { 988 $$ = npfctl_parse_ifnet($3, $1); 989 } 990 ; 991 992 dynamic_ifaddrs 993 : IFADDRS PAR_OPEN ifname PAR_CLOSE 994 { 995 $$ = $3; 996 } 997 ; 998 999 ifref 1000 : ifname 1001 | dynamic_ifaddrs 1002 | static_ifaddrs 1003 { 1004 ifnet_addr_t *ifna; 1005 1006 if (npfvar_get_count($1) != 1) { 1007 yyerror("multiple interfaces are not supported"); 1008 } 1009 ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 1010 npfctl_note_interface(ifna->ifna_name); 1011 $$ = ifna->ifna_name; 1012 } 1013 ; 1014 1015 user_id 1016 : /* empty */ { $$.op = NPF_OP_NONE; } 1017 | USER uids { $$ = $2; } 1018 ; 1019 1020 uids 1021 : uid_item { $$ = $1; } 1022 ; 1023 1024 uid_item 1025 : uid 1026 { 1027 npfctl_init_rid(&$$, $1, $1, NPF_OP_EQ); 1028 } 1029 | op_unary uid 1030 { 1031 npfctl_init_rid(&$$, $2, $2, $1); 1032 } 1033 | uid op_binary uid 1034 { 1035 npfctl_init_rid(&$$, $1, $3, $2); 1036 } 1037 ; 1038 1039 uid 1040 : NUM 1041 { 1042 if ($1 >= UID_MAX) { 1043 yyerror("illegal uid value %lu", $1); 1044 } 1045 $$ = $1; 1046 } 1047 | IDENTIFIER 1048 { 1049 if (npfctl_parse_user($1, &$$) == -1) { 1050 yyerror("unknown user %s", $1); 1051 } 1052 } 1053 | VAR_ID 1054 { 1055 npf_var_rid($1, npfctl_parse_user, &$$, "user"); 1056 } 1057 ; 1058 1059 group_id 1060 : /* empty */ { $$.op = NPF_OP_NONE; } 1061 | GROUP gids { $$ = $2; } 1062 ; 1063 1064 gids 1065 : gid_item { $$ = $1; } 1066 ; 1067 1068 gid_item 1069 : gid 1070 { 1071 npfctl_init_rid(&$$, $1, $1, NPF_OP_EQ); 1072 } 1073 | op_unary gid 1074 { 1075 npfctl_init_rid(&$$, $2, $2, $1); 1076 } 1077 | gid op_binary gid 1078 { 1079 npfctl_init_rid(&$$, $1, $3, $2); 1080 } 1081 ; 1082 1083 gid 1084 : NUM 1085 { 1086 if ($1 >= GID_MAX) { 1087 yyerror("illegal gid value %lu", $1); 1088 } 1089 $$ = $1; 1090 } 1091 | IDENTIFIER 1092 { 1093 if (npfctl_parse_group($1, &$$) == -1) { 1094 yyerror("unknown group %s", $1); 1095 } 1096 } 1097 | VAR_ID 1098 { 1099 npf_var_rid($1, npfctl_parse_group, &$$, "group"); 1100 } 1101 ; 1102 1103 op_unary 1104 : EQ { $$ = NPF_OP_EQ; } 1105 | EXCL_MARK EQ { $$ = NPF_OP_NE; } 1106 | LT EQ { $$ = NPF_OP_LE; } 1107 | LT { $$ = NPF_OP_LT; } 1108 | GT EQ { $$ = NPF_OP_GE; } 1109 | GT { $$ = NPF_OP_GT; } 1110 ; 1111 1112 op_binary 1113 : XRG { $$ = NPF_OP_XRG; } 1114 | IRG { $$ = NPF_OP_IRG; } 1115 ; 1116 1117 number 1118 : HEX { $$ = $1; } 1119 | NUM { $$ = $1; } 1120 ; 1121 1122 some_name 1123 : IDENTIFIER { $$ = $1; } 1124 | STRING { $$ = $1; } 1125 ; 1126 1127 %% 1128
Indexes created Tue Sep 30 11:09:46 GMT 2025