npf_parse.y revision 1.57
1 /*- 2 * Copyright (c) 2011-2025 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This code is derived from software contributed to The NetBSD Foundation 6 * by Martin Husemann, Christos Zoulas and Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 %{ 31 32 #include <err.h> 33 #include <netdb.h> 34 #include <stdio.h> 35 #include <stdlib.h> 36 #include <string.h> 37 #ifdef __NetBSD__ 38 #include <vis.h> 39 #endif 40 41 #include "npfctl.h" 42 43 #define YYSTACKSIZE 4096 44 45 int yystarttoken; 46 const char * yyfilename; 47 48 extern int yylineno, yycolumn; 49 extern int yylex(int); 50 51 void 52 yyerror(const char *fmt, ...) 53 { 54 extern int yyleng; 55 extern char *yytext; 56 57 char *msg, *context = estrndup(yytext, yyleng); 58 bool eol = (*context == '\n'); 59 va_list ap; 60 61 va_start(ap, fmt); 62 vasprintf(&msg, fmt, ap); 63 va_end(ap); 64 65 fprintf(stderr, "%s:%d:%d: %s", yyfilename, 66 yylineno - (int)eol, yycolumn, msg); 67 if (!eol) { 68 #ifdef __NetBSD__ 69 size_t len = strlen(context); 70 char *dst = ecalloc(1, len * 4 + 1); 71 72 strvisx(dst, context, len, VIS_WHITE|VIS_CSTYLE); 73 context = dst; 74 #endif 75 fprintf(stderr, " near '%s'", context); 76 } 77 fprintf(stderr, "\n"); 78 exit(EXIT_FAILURE); 79 } 80 81 %} 82 83 /* 84 * No conflicts allowed. Keep it this way. 85 */ 86 %expect 0 87 %expect-rr 0 88 89 /* 90 * Depending on the mode of operation, set a different start symbol. 91 * Workaround yacc limitation by passing the start token. 92 */ 93 %start input 94 %token RULE_ENTRY_TOKEN MAP_ENTRY_TOKEN 95 %lex-param { int yystarttoken } 96 97 /* 98 * General tokens. 99 */ 100 %token ALG 101 %token ALGO 102 %token ALL 103 %token ANY 104 %token APPLY 105 %token ARROWBOTH 106 %token ARROWLEFT 107 %token ARROWRIGHT 108 %token BLOCK 109 %token CDB 110 %token CONST 111 %token CURLY_CLOSE 112 %token CURLY_OPEN 113 %token CODE 114 %token COLON 115 %token COMMA 116 %token DEFAULT 117 %token TDYNAMIC 118 %token TSTATIC 119 %token EQ 120 %token ETHER 121 %token EXCL_MARK 122 %token TFILE 123 %token FLAGS 124 %token FROM 125 %token GROUP 126 %token HASH 127 %token ICMPTYPE 128 %token ID 129 %token IFADDRS 130 %token IN 131 %token INET4 132 %token INET6 133 %token INTERFACE 134 %token INVALID 135 %token IPHASH 136 %token IPSET 137 %token LPM 138 %token L2 139 %token MAP 140 %token NEWLINE 141 %token NO_PORTS 142 %token MINUS 143 %token NAME 144 %token NETMAP 145 %token NPT66 146 %token ON 147 %token OFF 148 %token OUT 149 %token PAR_CLOSE 150 %token PAR_OPEN 151 %token PASS 152 %token PCAP_FILTER 153 %token PORT 154 %token PROCEDURE 155 %token PROTO 156 %token FAMILY 157 %token FINAL 158 %token FORW 159 %token RETURN 160 %token RETURNICMP 161 %token RETURNRST 162 %token ROUNDROBIN 163 %token RULESET 164 %token SEMICOLON 165 %token SET 166 %token SLASH 167 %token STATEFUL 168 %token STATEFUL_ALL 169 %token TABLE 170 %token TCP 171 %token TO 172 %token TREE 173 %token TYPE 174 %token USER 175 %token <num> ICMP 176 %token <num> ICMP6 177 178 %token <num> HEX 179 %token <str> ETHERHEX 180 %token <str> IDENTIFIER 181 %token <str> IPV4ADDR 182 %token <str> IPV6ADDR 183 %token <str> MACADDR 184 %token <num> NUM 185 %token <fpnum> FPNUM 186 %token <str> STRING 187 %token <str> PARAM 188 %token <str> TABLE_ID 189 %token <str> VAR_ID 190 191 %type <str> addr some_name table_store dynamic_ifaddrs 192 %type <str> proc_param_val opt_apply ifname on_ifname ifref 193 %type <num> port opt_final number afamily opt_family 194 %type <num> block_or_pass rule_dir group_dir block_opts 195 %type <num> maybe_not opt_stateful icmp_type table_type 196 %type <num> map_sd map_algo map_flags map_type layer 197 %type <num> param_val op_unary op_binary 198 %type <etype> ether_type 199 %type <rid> uid gid 200 %type <var> static_ifaddrs filt_addr_element 201 %type <var> filt_port filt_port_list port_range icmp_type_and_code 202 %type <var> filt_addr addr_and_mask tcp_flags tcp_flags_and_mask 203 %type <var> procs proc_call proc_param_list proc_param mac_addr 204 %type <var> element list_elems list_trail list value filt_addr_list 205 %type <var> opt_proto proto proto_elems 206 %type <addrport> mapseg 207 %type <uid> uids uid_item uid_list user_id 208 %type <gid> gids gid_item gid_list group_id 209 %type <filtopts> filt_opts all_or_filt_opts l2_filt_opts l2_all_of_filt_opts 210 %type <optproto> rawproto 211 %type <rulegroup> group_opts 212 213 %union { 214 char * str; 215 uint16_t etype; 216 unsigned long num; 217 uint32_t rid; 218 double fpnum; 219 npfvar_t * var; 220 addr_port_t addrport; 221 filt_opts_t filtopts; 222 opt_proto_t optproto; 223 rule_group_t rulegroup; 224 struct r_id uid; 225 struct r_id gid; 226 } 227 228 %% 229 230 input 231 : lines 232 | RULE_ENTRY_TOKEN rule 233 | MAP_ENTRY_TOKEN map 234 ; 235 236 lines 237 : lines sepline line 238 | line 239 ; 240 241 line 242 : vardef 243 | table 244 | map 245 | group 246 | rproc 247 | alg 248 | set 249 | 250 ; 251 252 alg 253 : ALG STRING 254 { 255 npfctl_build_alg($2); 256 } 257 ; 258 259 sepline 260 : NEWLINE 261 | SEMICOLON 262 ; 263 264 param_val 265 : number { $$ = $1; } 266 | ON { $$ = true; } 267 | OFF { $$ = false; } 268 ; 269 270 set 271 : SET PARAM param_val { 272 npfctl_setparam($2, $3); 273 } 274 ; 275 276 /* 277 * A value - an element or a list of elements. 278 * Can be assigned to a variable or used inline. 279 */ 280 281 vardef 282 : VAR_ID EQ value 283 { 284 npfvar_add($3, $1); 285 } 286 ; 287 288 value 289 : element 290 | list 291 ; 292 293 list 294 : CURLY_OPEN opt_nl list_elems CURLY_CLOSE 295 { 296 $$ = $3; 297 } 298 ; 299 300 list_elems 301 : element list_trail 302 { 303 $$ = npfvar_add_elements($1, $2); 304 } 305 ; 306 307 element 308 : IDENTIFIER 309 { 310 $$ = npfvar_create_from_string(NPFVAR_IDENTIFIER, $1); 311 } 312 | STRING 313 { 314 $$ = npfvar_create_from_string(NPFVAR_STRING, $1); 315 } 316 | number MINUS number 317 { 318 $$ = npfctl_parse_port_range($1, $3); 319 } 320 | number 321 { 322 uint32_t val = $1; 323 $$ = npfvar_create_element(NPFVAR_NUM, &val, sizeof(val)); 324 } 325 | VAR_ID 326 { 327 $$ = npfvar_create_from_string(NPFVAR_VAR_ID, $1); 328 } 329 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 330 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 331 | static_ifaddrs { $$ = $1; } 332 | addr_and_mask { $$ = $1; } 333 | mac_addr { $$ = $1; } 334 ; 335 336 list_trail 337 : element_sep element list_trail 338 { 339 $$ = npfvar_add_elements($2, $3); 340 } 341 | opt_nl { $$ = NULL; } 342 | element_sep { $$ = NULL; } 343 ; 344 345 element_sep 346 : opt_nl COMMA opt_nl 347 ; 348 349 opt_nl 350 : opt_nl NEWLINE 351 | 352 ; 353 354 /* 355 * Table definition. 356 */ 357 358 table 359 : TABLE TABLE_ID TYPE table_type table_store 360 { 361 npfctl_build_table($2, $4, $5); 362 } 363 ; 364 365 table_type 366 : IPSET { $$ = NPF_TABLE_IPSET; } 367 | HASH 368 { 369 warnx("warning - table type \"hash\" is deprecated and may be " 370 "deleted in\nthe future; please use the \"ipset\" type " 371 "instead."); 372 $$ = NPF_TABLE_IPSET; 373 } 374 | LPM { $$ = NPF_TABLE_LPM; } 375 | TREE 376 { 377 warnx("warning - table type \"tree\" is deprecated and may be " 378 "deleted in\nthe future; please use the \"lpm\" type " 379 "instead."); 380 $$ = NPF_TABLE_LPM; 381 } 382 | CONST { $$ = NPF_TABLE_CONST; } 383 | CDB 384 { 385 warnx("warning -- table type \"cdb\" is deprecated and may be " 386 "deleted in\nthe future; please use the \"const\" type " 387 "instead."); 388 $$ = NPF_TABLE_CONST; 389 } 390 ; 391 392 table_store 393 : TFILE STRING { $$ = $2; } 394 | TDYNAMIC 395 { 396 warnx("warning - the \"dynamic\" keyword for tables is obsolete"); 397 $$ = NULL; 398 } 399 | { $$ = NULL; } 400 ; 401 402 /* 403 * Map definition. 404 */ 405 406 map_sd 407 : TSTATIC { $$ = NPFCTL_NAT_STATIC; } 408 | TDYNAMIC { $$ = NPFCTL_NAT_DYNAMIC; } 409 | { $$ = NPFCTL_NAT_DYNAMIC; } 410 ; 411 412 map_algo 413 : ALGO NETMAP { $$ = NPF_ALGO_NETMAP; } 414 | ALGO IPHASH { $$ = NPF_ALGO_IPHASH; } 415 | ALGO ROUNDROBIN { $$ = NPF_ALGO_RR; } 416 | ALGO NPT66 { $$ = NPF_ALGO_NPT66; } 417 | { $$ = 0; } 418 ; 419 420 map_flags 421 : NO_PORTS { $$ = NPF_NAT_PORTS; } 422 | { $$ = 0; } 423 ; 424 425 map_type 426 : ARROWBOTH { $$ = NPF_NATIN | NPF_NATOUT; } 427 | ARROWLEFT { $$ = NPF_NATIN; } 428 | ARROWRIGHT { $$ = NPF_NATOUT; } 429 ; 430 431 mapseg 432 : filt_addr filt_port 433 { 434 $$.ap_netaddr = $1; 435 $$.ap_portrange = $2; 436 } 437 ; 438 439 map 440 : MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 441 PASS opt_family opt_proto all_or_filt_opts 442 { 443 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, $11, &$12, $4); 444 } 445 | MAP ifref map_sd map_algo map_flags mapseg map_type mapseg 446 { 447 npfctl_build_natseg($3, $7, $5, $2, &$6, &$8, NULL, NULL, $4); 448 } 449 | MAP ifref map_sd map_algo map_flags proto mapseg map_type mapseg 450 { 451 npfctl_build_natseg($3, $8, $5, $2, &$7, &$9, $6, NULL, $4); 452 } 453 | MAP RULESET group_opts 454 { 455 npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifname); 456 } 457 ; 458 459 /* 460 * Rule procedure definition and its parameters. 461 */ 462 463 rproc 464 : PROCEDURE STRING CURLY_OPEN procs CURLY_CLOSE 465 { 466 npfctl_build_rproc($2, $4); 467 } 468 ; 469 470 procs 471 : procs sepline proc_call 472 { 473 $$ = npfvar_add_elements($1, $3); 474 } 475 | proc_call { $$ = $1; } 476 ; 477 478 proc_call 479 : IDENTIFIER COLON proc_param_list 480 { 481 proc_call_t pc; 482 483 pc.pc_name = estrdup($1); 484 pc.pc_opts = $3; 485 486 $$ = npfvar_create_element(NPFVAR_PROC, &pc, sizeof(pc)); 487 } 488 | { $$ = NULL; } 489 ; 490 491 proc_param_list 492 : proc_param_list COMMA proc_param 493 { 494 $$ = npfvar_add_elements($1, $3); 495 } 496 | proc_param { $$ = $1; } 497 | { $$ = NULL; } 498 ; 499 500 proc_param 501 : some_name proc_param_val 502 { 503 proc_param_t pp; 504 505 pp.pp_param = estrdup($1); 506 pp.pp_value = $2 ? estrdup($2) : NULL; 507 508 $$ = npfvar_create_element(NPFVAR_PROC_PARAM, &pp, sizeof(pp)); 509 } 510 ; 511 512 proc_param_val 513 : some_name { $$ = $1; } 514 | number { (void)asprintf(&$$, "%ld", $1); } 515 | FPNUM { (void)asprintf(&$$, "%lf", $1); } 516 | { $$ = NULL; } 517 ; 518 519 /* 520 * Group and dynamic ruleset definition. 521 */ 522 523 group 524 : GROUP group_opts 525 { 526 /* Build a group. Increase the nesting level. */ 527 npfctl_build_group($2.rg_name, $2.rg_attr, 528 $2.rg_ifname, $2.rg_default); 529 } 530 ruleset_block 531 { 532 /* Decrease the nesting level. */ 533 npfctl_build_group_end(); 534 } 535 ; 536 537 ruleset 538 : RULESET group_opts 539 { 540 /* Ruleset is a dynamic group. */ 541 npfctl_build_group($2.rg_name, $2.rg_attr | NPF_RULE_DYNAMIC, 542 $2.rg_ifname, $2.rg_default); 543 npfctl_build_group_end(); 544 } 545 ; 546 547 group_dir 548 : FORW { $$ = NPF_RULE_FORW; } 549 | rule_dir 550 ; 551 552 group_opts 553 : DEFAULT layer 554 { 555 memset(&$$, 0, sizeof(rule_group_t)); 556 $$.rg_default = true; 557 $$.rg_attr |= $2; 558 } 559 | STRING group_dir on_ifname layer 560 { 561 memset(&$$, 0, sizeof(rule_group_t)); 562 $$.rg_name = $1; 563 $$.rg_attr = $2 | $4; 564 $$.rg_ifname = $3; 565 } 566 ; 567 568 layer 569 : L2 { $$ = NPF_RULE_LAYER_2; } 570 | { $$ = NPF_RULE_LAYER_3; } /* ret layer3 by defualt */ 571 ; 572 573 ruleset_block 574 : CURLY_OPEN ruleset_def CURLY_CLOSE 575 ; 576 577 ruleset_def 578 : ruleset_def sepline rule_group 579 | rule_group 580 ; 581 582 rule_group 583 : rule 584 | group 585 | ruleset 586 | 587 ; 588 589 /* 590 * Rule and misc. 591 */ 592 593 rule 594 : block_or_pass opt_stateful rule_dir opt_final on_ifname 595 opt_family opt_proto all_or_filt_opts opt_apply 596 { 597 npfctl_build_rule($1 | $2 | $3 | $4, $5, 598 $6, $7, &$8, NULL, $9); 599 } 600 | block_or_pass opt_stateful rule_dir opt_final on_ifname 601 PCAP_FILTER STRING opt_apply 602 { 603 npfctl_build_rule($1 | $2 | $3 | $4, $5, 604 AF_UNSPEC, NULL, NULL, $7, $8); 605 } 606 | block_or_pass ETHER rule_dir opt_final on_ifname 607 l2_all_of_filt_opts 608 { 609 npfctl_build_rule($1 | $3 | $4, $5, 0, NULL, &$6, NULL, NULL); 610 } 611 ; 612 613 block_or_pass 614 : BLOCK block_opts { $$ = $2; } 615 | PASS { $$ = NPF_RULE_PASS; } 616 ; 617 618 rule_dir 619 : IN { $$ = NPF_RULE_IN; } 620 | OUT { $$ = NPF_RULE_OUT; } 621 | { $$ = NPF_RULE_IN | NPF_RULE_OUT; } 622 ; 623 624 opt_final 625 : FINAL { $$ = NPF_RULE_FINAL; } 626 | { $$ = 0; } 627 ; 628 629 on_ifname 630 : ON ifref { $$ = $2; } 631 | { $$ = NULL; } 632 ; 633 634 afamily 635 : INET4 { $$ = AF_INET; } 636 | INET6 { $$ = AF_INET6; } 637 ; 638 639 maybe_not 640 : EXCL_MARK { $$ = true; } 641 | { $$ = false; } 642 ; 643 644 opt_family 645 : FAMILY afamily { $$ = $2; } 646 | { $$ = AF_UNSPEC; } 647 ; 648 649 rawproto 650 : TCP tcp_flags_and_mask 651 { 652 $$.op_proto = IPPROTO_TCP; 653 $$.op_opts = $2; 654 } 655 | ICMP icmp_type_and_code 656 { 657 $$.op_proto = IPPROTO_ICMP; 658 $$.op_opts = $2; 659 } 660 | ICMP6 icmp_type_and_code 661 { 662 $$.op_proto = IPPROTO_ICMPV6; 663 $$.op_opts = $2; 664 } 665 | some_name 666 { 667 $$.op_proto = npfctl_protono($1); 668 $$.op_opts = NULL; 669 } 670 | number 671 { 672 $$.op_proto = $1; 673 $$.op_opts = NULL; 674 } 675 ; 676 677 proto_elems 678 : proto_elems COMMA rawproto 679 { 680 npfvar_t *pvar = npfvar_create_element( 681 NPFVAR_PROTO, &$3, sizeof($3)); 682 $$ = npfvar_add_elements($1, pvar); 683 } 684 | rawproto 685 { 686 $$ = npfvar_create_element(NPFVAR_PROTO, &$1, sizeof($1)); 687 } 688 ; 689 690 proto 691 : PROTO rawproto 692 { 693 $$ = npfvar_create_element(NPFVAR_PROTO, &$2, sizeof($2)); 694 } 695 | PROTO CURLY_OPEN proto_elems CURLY_CLOSE 696 { 697 $$ = $3; 698 } 699 ; 700 701 opt_proto 702 : proto { $$ = $1; } 703 | { $$ = NULL; } 704 ; 705 706 all_or_filt_opts 707 : ALL user_id group_id 708 { 709 $$ = npfctl_parse_l3filt_opt(NULL, NULL, false, NULL, NULL, false, $2, $3); 710 } 711 | filt_opts { $$ = $1; } 712 ; 713 714 l2_all_of_filt_opts 715 : ALL 716 { 717 $$ = npfctl_parse_l2filt_opt(NULL, false, NULL, false, 0); 718 } 719 | l2_filt_opts { $$ = $1; } 720 ; 721 722 opt_stateful 723 : STATEFUL { $$ = NPF_RULE_STATEFUL; } 724 | STATEFUL_ALL { $$ = NPF_RULE_STATEFUL | NPF_RULE_GSTATEFUL; } 725 | { $$ = 0; } 726 ; 727 728 opt_apply 729 : APPLY STRING { $$ = $2; } 730 | { $$ = NULL; } 731 ; 732 733 block_opts 734 : RETURNRST { $$ = NPF_RULE_RETRST; } 735 | RETURNICMP { $$ = NPF_RULE_RETICMP; } 736 | RETURN { $$ = NPF_RULE_RETRST | NPF_RULE_RETICMP; } 737 | { $$ = 0; } 738 ; 739 740 filt_opts 741 : FROM maybe_not filt_addr filt_port TO maybe_not filt_addr filt_port 742 user_id group_id 743 { 744 $$ = npfctl_parse_l3filt_opt($3, $4, $2, $7, $8, $6, $9, $10); 745 } 746 | FROM maybe_not filt_addr filt_port user_id group_id 747 { 748 $$ = npfctl_parse_l3filt_opt($3, $4, $2, NULL, NULL, false, $5, $6); 749 } 750 | TO maybe_not filt_addr filt_port user_id group_id 751 { 752 $$ = npfctl_parse_l3filt_opt(NULL, NULL, false, $3, $4, $2, $5, $6); 753 } 754 ; 755 756 l2_filt_opts 757 : FROM maybe_not filt_addr TO maybe_not filt_addr ether_type 758 { 759 $$ = npfctl_parse_l2filt_opt($3, $2, $6, $5, $7); 760 761 } 762 | FROM maybe_not filt_addr ether_type 763 { 764 $$ = npfctl_parse_l2filt_opt($3, $2, NULL, false, $4); 765 } 766 | TO maybe_not filt_addr ether_type 767 { 768 $$ = npfctl_parse_l2filt_opt(NULL, false, $3, $2, $4); 769 } 770 ; 771 772 ether_type 773 : TYPE ETHERHEX { $$ = npfctl_parse_ether_type($2); } 774 | { $$ = 0; } 775 ; 776 777 filt_addr_list 778 : filt_addr_list COMMA filt_addr_element 779 { 780 npfvar_add_elements($1, $3); 781 } 782 | filt_addr_element 783 ; 784 785 filt_addr 786 : CURLY_OPEN filt_addr_list CURLY_CLOSE 787 { 788 $$ = $2; 789 } 790 | filt_addr_element { $$ = $1; } 791 | ANY { $$ = NULL; } 792 ; 793 794 addr_and_mask 795 : addr SLASH number 796 { 797 $$ = npfctl_parse_fam_addr_mask($1, NULL, &$3); 798 } 799 | addr SLASH addr 800 { 801 $$ = npfctl_parse_fam_addr_mask($1, $3, NULL); 802 } 803 | addr 804 { 805 $$ = npfctl_parse_fam_addr_mask($1, NULL, NULL); 806 } 807 ; 808 809 mac_addr 810 : MACADDR 811 { 812 $$ = npfctl_parse_mac_addr($1); 813 } 814 ; 815 816 filt_addr_element 817 : addr_and_mask { assert($1 != NULL); $$ = $1; } 818 | mac_addr { assert($1 != NULL); $$ = $1; } 819 | static_ifaddrs 820 { 821 if (npfvar_get_count($1) != 1) 822 yyerror("multiple interfaces are not supported"); 823 ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 824 $$ = ifna->ifna_addrs; 825 } 826 | dynamic_ifaddrs { $$ = npfctl_ifnet_table($1); } 827 | TABLE_ID { $$ = npfctl_parse_table_id($1); } 828 | VAR_ID 829 { 830 npfvar_t *vp = npfvar_lookup($1); 831 int type = npfvar_get_type(vp, 0); 832 ifnet_addr_t *ifna; 833 again: 834 switch (type) { 835 case NPFVAR_IDENTIFIER: 836 case NPFVAR_STRING: 837 vp = npfctl_parse_ifnet(npfvar_expand_string(vp), 838 AF_UNSPEC); 839 type = npfvar_get_type(vp, 0); 840 goto again; 841 case NPFVAR_FAM: 842 case NPFVAR_MAC: 843 case NPFVAR_TABLE: 844 $$ = vp; 845 break; 846 case NPFVAR_INTERFACE: 847 $$ = NULL; 848 for (u_int i = 0; i < npfvar_get_count(vp); i++) { 849 ifna = npfvar_get_data(vp, type, i); 850 $$ = npfvar_add_elements($$, ifna->ifna_addrs); 851 } 852 break; 853 case -1: 854 yyerror("undefined variable '%s'", $1); 855 break; 856 default: 857 yyerror("wrong variable '%s' type '%s' for address " 858 "or interface", $1, npfvar_type(type)); 859 break; 860 } 861 } 862 ; 863 864 addr 865 : IPV4ADDR { $$ = $1; } 866 | IPV6ADDR { $$ = $1; } 867 ; 868 869 filt_port 870 : PORT CURLY_OPEN filt_port_list CURLY_CLOSE 871 { 872 $$ = npfctl_parse_port_range_variable(NULL, $3); 873 } 874 | PORT port_range { $$ = $2; } 875 | { $$ = NULL; } 876 ; 877 878 filt_port_list 879 : filt_port_list COMMA port_range 880 { 881 npfvar_add_elements($1, $3); 882 } 883 | port_range 884 ; 885 886 port_range 887 : port /* just port */ 888 { 889 $$ = npfctl_parse_port_range($1, $1); 890 } 891 | port MINUS port /* port from-to */ 892 { 893 $$ = npfctl_parse_port_range($1, $3); 894 } 895 | VAR_ID 896 { 897 npfvar_t *vp; 898 if ((vp = npfvar_lookup($1)) == NULL) 899 yyerror("undefined port variable %s", $1); 900 $$ = npfctl_parse_port_range_variable($1, vp); 901 } 902 ; 903 904 port 905 : number { $$ = $1; } 906 | IDENTIFIER { $$ = npfctl_portno($1); } 907 | STRING { $$ = npfctl_portno($1); } 908 ; 909 910 icmp_type_and_code 911 : ICMPTYPE icmp_type 912 { 913 $$ = npfctl_parse_icmp($<num>0, $2, -1); 914 } 915 | ICMPTYPE icmp_type CODE number 916 { 917 $$ = npfctl_parse_icmp($<num>0, $2, $4); 918 } 919 | ICMPTYPE icmp_type CODE IDENTIFIER 920 { 921 $$ = npfctl_parse_icmp($<num>0, $2, 922 npfctl_icmpcode($<num>0, $2, $4)); 923 } 924 | ICMPTYPE icmp_type CODE VAR_ID 925 { 926 char *s = npfvar_expand_string(npfvar_lookup($4)); 927 $$ = npfctl_parse_icmp($<num>0, $2, 928 npfctl_icmpcode($<num>0, $2, s)); 929 } 930 | { $$ = NULL; } 931 ; 932 933 tcp_flags_and_mask 934 : FLAGS tcp_flags SLASH tcp_flags 935 { 936 npfvar_add_elements($2, $4); 937 $$ = $2; 938 } 939 | FLAGS tcp_flags 940 { 941 if (npfvar_get_count($2) != 1) 942 yyerror("multiple tcpflags are not supported"); 943 char *s = npfvar_get_data($2, NPFVAR_TCPFLAG, 0); 944 npfvar_add_elements($2, npfctl_parse_tcpflag(s)); 945 $$ = $2; 946 } 947 | { $$ = NULL; } 948 ; 949 950 tcp_flags 951 : IDENTIFIER { $$ = npfctl_parse_tcpflag($1); } 952 ; 953 954 icmp_type 955 : number { $$ = $1; } 956 | IDENTIFIER { $$ = npfctl_icmptype($<num>-1, $1); } 957 | VAR_ID 958 { 959 char *s = npfvar_expand_string(npfvar_lookup($1)); 960 $$ = npfctl_icmptype($<num>-1, s); 961 } 962 ; 963 964 ifname 965 : some_name 966 { 967 npfctl_note_interface($1); 968 $$ = $1; 969 } 970 | VAR_ID 971 { 972 npfvar_t *vp = npfvar_lookup($1); 973 const int type = npfvar_get_type(vp, 0); 974 ifnet_addr_t *ifna; 975 const char *name; 976 unsigned *tid; 977 bool ifaddr; 978 979 switch (type) { 980 case NPFVAR_STRING: 981 case NPFVAR_IDENTIFIER: 982 $$ = npfvar_expand_string(vp); 983 break; 984 case NPFVAR_INTERFACE: 985 if (npfvar_get_count(vp) != 1) 986 yyerror( 987 "multiple interfaces are not supported"); 988 ifna = npfvar_get_data(vp, type, 0); 989 $$ = ifna->ifna_name; 990 break; 991 case NPFVAR_TABLE: 992 tid = npfvar_get_data(vp, type, 0); 993 name = npfctl_table_getname(npfctl_config_ref(), 994 *tid, &ifaddr); 995 if (!ifaddr) { 996 yyerror("variable '%s' references a table " 997 "%s instead of an interface", $1, name); 998 } 999 $$ = estrdup(name); 1000 break; 1001 case -1: 1002 yyerror("undefined variable '%s' for interface", $1); 1003 break; 1004 default: 1005 yyerror("wrong variable '%s' type '%s' for interface", 1006 $1, npfvar_type(type)); 1007 break; 1008 } 1009 npfctl_note_interface($$); 1010 } 1011 ; 1012 1013 static_ifaddrs 1014 : afamily PAR_OPEN ifname PAR_CLOSE 1015 { 1016 $$ = npfctl_parse_ifnet($3, $1); 1017 } 1018 ; 1019 1020 dynamic_ifaddrs 1021 : IFADDRS PAR_OPEN ifname PAR_CLOSE 1022 { 1023 $$ = $3; 1024 } 1025 ; 1026 1027 ifref 1028 : ifname 1029 | dynamic_ifaddrs 1030 | static_ifaddrs 1031 { 1032 ifnet_addr_t *ifna; 1033 1034 if (npfvar_get_count($1) != 1) { 1035 yyerror("multiple interfaces are not supported"); 1036 } 1037 ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); 1038 npfctl_note_interface(ifna->ifna_name); 1039 $$ = ifna->ifna_name; 1040 } 1041 ; 1042 1043 user_id 1044 : /* empty */ { $$.op = NPF_OP_NONE; } 1045 | USER uids { $$ = $2; } 1046 ; 1047 1048 uids 1049 : uid_item { $$ = $1; } 1050 ; 1051 1052 uid_item 1053 : uid 1054 { 1055 npfctl_init_rid(&$$, $1, $1, NPF_OP_EQ); 1056 } 1057 | op_unary uid 1058 { 1059 npfctl_init_rid(&$$, $2, $2, $1); 1060 } 1061 | uid op_binary uid 1062 { 1063 npfctl_init_rid(&$$, $1, $3, $2); 1064 } 1065 ; 1066 1067 uid 1068 : NUM 1069 { 1070 if ($1 >= UID_MAX) { 1071 yyerror("illegal uid value %lu", $1); 1072 } 1073 $$ = $1; 1074 } 1075 | IDENTIFIER 1076 { 1077 if (npfctl_parse_user($1, &$$) == -1) { 1078 yyerror("unknown user %s", $1); 1079 } 1080 } 1081 | VAR_ID 1082 { 1083 npf_var_rid($1, npfctl_parse_user, &$$, "user"); 1084 } 1085 ; 1086 1087 group_id 1088 : /* empty */ { $$.op = NPF_OP_NONE; } 1089 | GROUP gids { $$ = $2; } 1090 ; 1091 1092 gids 1093 : gid_item { $$ = $1; } 1094 ; 1095 1096 gid_item 1097 : gid 1098 { 1099 npfctl_init_rid(&$$, $1, $1, NPF_OP_EQ); 1100 } 1101 | op_unary gid 1102 { 1103 npfctl_init_rid(&$$, $2, $2, $1); 1104 } 1105 | gid op_binary gid 1106 { 1107 npfctl_init_rid(&$$, $1, $3, $2); 1108 } 1109 ; 1110 1111 gid 1112 : NUM 1113 { 1114 if ($1 >= GID_MAX) { 1115 yyerror("illegal gid value %lu", $1); 1116 } 1117 $$ = $1; 1118 } 1119 | IDENTIFIER 1120 { 1121 if (npfctl_parse_group($1, &$$) == -1) { 1122 yyerror("unknown group %s", $1); 1123 } 1124 } 1125 | VAR_ID 1126 { 1127 npf_var_rid($1, npfctl_parse_group, &$$, "group"); 1128 } 1129 ; 1130 1131 op_unary 1132 : EQ { $$ = NPF_OP_EQ; } 1133 | EXCL_MARK EQ { $$ = NPF_OP_NE; } 1134 | LT EQ { $$ = NPF_OP_LE; } 1135 | LT { $$ = NPF_OP_LT; } 1136 | GT EQ { $$ = NPF_OP_GE; } 1137 | GT { $$ = NPF_OP_GT; } 1138 ; 1139 1140 op_binary 1141 : XRG { $$ = NPF_OP_XRG; } 1142 | IRG { $$ = NPF_OP_IRG; } 1143 ; 1144 1145 number 1146 : HEX { $$ = $1; } 1147 | NUM { $$ = $1; } 1148 ; 1149 1150 some_name 1151 : IDENTIFIER { $$ = $1; } 1152 | STRING { $$ = $1; } 1153 ; 1154 1155 %% 1156
Indexes created Tue Sep 30 11:09:46 GMT 2025