parser: move qualified meta expression parsing to flex/bison

The meta keyword currently accepts 'STRING' arguments.
This was originally done to avoid pollution the global token namespace.

However, nowadays we do have flex scopes to avoid this.
Add the tokens currently handled implciitly via STRING within
META flex scope.

SECPATH is a compatibility alias, map this to IPSEC token.
IBRPORT/OBRPORT are also compatibility aliases, remove those tokens
and handle this directly in scanner.l.

This also avoids nft from printing tokens in help texts that are only
there for compatibility with old rulesets.

meta_key_parse() is retained for json input parser.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Phil Sutter <phil@nwl.cc>

diff --git a/doc/libnftables-json.adoc b/doc/libnftables-json.adoc
index 049c3254ff03f5129ab7cdd2473f1480c3b23a9c..c3af007e19177f06c40b19efa190656b50c15e58 100644 (file)
--- a/doc/libnftables-json.adoc
+++ b/doc/libnftables-json.adoc
@@ -1269,7 +1269,7 @@ ____
 'META_KEY' := *"length"* | *"protocol"* | *"priority"* | *"random"* | *"mark"* |
               *"iif"* | *"iifname"* | *"iiftype"* | *"oif"* | *"oifname"* |
              *"oiftype"* | *"skuid"* | *"skgid"* | *"nftrace"* |
-             *"rtclassid"* | *"ibriport"* | *"obriport"* | *"ibridgename"* |
+             *"rtclassid"* | *"ibrname"* | *"obrname"* | *"ibridgename"* |
              *"obridgename"* | *"pkttype"* | *"cpu"* | *"iifgroup"* |
              *"oifgroup"* | *"cgroup"* | *"nfproto"* | *"l4proto"* |
              *"secpath"*

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 33e2e3eaea73440aa59b98fedccbe4a35bf9b0db..74c3d25db4ff6b108c03b86d07ffb7f5ca253cd9 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -584,8 +584,6 @@ int nft_lex(void *, void *, void *);
 %token SKGID                   "skgid"
 %token NFTRACE                 "nftrace"
 %token RTCLASSID               "rtclassid"
-%token IBRIPORT                        "ibriport"
-%token OBRIPORT                        "obriport"
 %token IBRIDGENAME             "ibrname"
 %token OBRIDGENAME             "obrname"
 %token PKTTYPE                 "pkttype"
@@ -595,6 +593,17 @@ int nft_lex(void *, void *, void *);
 %token CGROUP                  "cgroup"
 %token TIME                    "time"
 
+%token NFPROTO                 "nfproto"
+%token L4PROTO                 "l4proto"
+%token IIFKIND                 "iifkind"
+%token OIFKIND                 "oifkind"
+%token IBRPVID                 "ibrpvid"
+%token IBRVPROTO               "ibrvproto"
+%token SDIF                    "sdif"
+%token SDIFNAME                        "sdifname"
+%token BROUTE                  "broute"
+%token BRIFHWADDR              "ibrhwaddr"
+
 %token CLASSID                 "classid"
 %token NEXTHOP                 "nexthop"
 
@@ -5421,20 +5430,6 @@ meta_expr                :       META    meta_key        close_scope_meta
                        {
                                $$ = meta_expr_alloc(&@$, $1);
                        }
-                       |       META    STRING  close_scope_meta
-                       {
-                               struct error_record *erec;
-                               unsigned int key;
-
-                               erec = meta_key_parse(&@$, $2, &key);
-                               free_const($2);
-                               if (erec != NULL) {
-                                       erec_queue(erec, state->msgs);
-                                       YYERROR;
-                               }
-
-                               $$ = meta_expr_alloc(&@$, key);
-                       }
                        ;
 
 meta_key               :       meta_key_qualified
@@ -5446,6 +5441,16 @@ meta_key_qualified       :       LENGTH          { $$ = NFT_META_LEN; }
                        |       PRIORITY        { $$ = NFT_META_PRIORITY; }
                        |       RANDOM          { $$ = NFT_META_PRANDOM; }
                        |       SECMARK close_scope_secmark { $$ = NFT_META_SECMARK; }
+                       |       NFPROTO         { $$ = NFT_META_NFPROTO; }
+                       |       L4PROTO         { $$ = NFT_META_L4PROTO; }
+                       |       IIFKIND         { $$ = NFT_META_IIFKIND; }
+                       |       OIFKIND         { $$ = NFT_META_OIFKIND; }
+                       |       IBRPVID         { $$ = NFT_META_BRI_IIFPVID; }
+                       |       IBRVPROTO       { $$ = NFT_META_BRI_IIFVPROTO; }
+                       |       SDIF            { $$ = NFT_META_SDIF; }
+                       |       SDIFNAME        { $$ = NFT_META_SDIFNAME; }
+                       |       BROUTE          { $$ = NFT_META_BRI_BROUTE; }
+                       |       BRIFHWADDR      { $$ = NFT_META_BRI_IIFHWADDR; }
                        ;
 
 meta_key_unqualified   :       MARK            { $$ = NFT_META_MARK; }
@@ -5459,8 +5464,6 @@ meta_key_unqualified      :       MARK            { $$ = NFT_META_MARK; }
                        |       SKGID           { $$ = NFT_META_SKGID; }
                        |       NFTRACE         { $$ = NFT_META_NFTRACE; }
                        |       RTCLASSID       { $$ = NFT_META_RTCLASSID; }
-                       |       IBRIPORT        { $$ = NFT_META_BRI_IIFNAME; }
-                       |       OBRIPORT        { $$ = NFT_META_BRI_OIFNAME; }
                        |       IBRIDGENAME     { $$ = NFT_META_BRI_IIFNAME; }
                        |       OBRIDGENAME     { $$ = NFT_META_BRI_OIFNAME; }
                        |       PKTTYPE         { $$ = NFT_META_PKTTYPE; }
@@ -5498,21 +5501,6 @@ meta_stmt                :       META    meta_key        SET     stmt_expr       close_scope_meta
                        {
                                $$ = meta_stmt_alloc(&@$, $1, $3);
                        }
-                       |       META    STRING  SET     stmt_expr       close_scope_meta
-                       {
-                               struct error_record *erec;
-                               unsigned int key;
-
-                               erec = meta_key_parse(&@$, $2, &key);
-                               free_const($2);
-                               if (erec != NULL) {
-                                       erec_queue(erec, state->msgs);
-                                       expr_free($4);
-                                       YYERROR;
-                               }
-
-                               $$ = meta_stmt_alloc(&@$, key, $4);
-                       }
                        |       NOTRACK
                        {
                                $$ = notrack_stmt_alloc(&@$);

diff --git a/src/scanner.l b/src/scanner.l
index 9d8fade8308d3d2ecf8114830038bd6f3f69e56b..1b4eb1cf13a47b8b506b730962fea38c6243af19 100644 (file)
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -754,15 +754,30 @@ addrstring        ({macaddr}|{ip4addr}|{ip6addr})
 "skgid"                        { return SKGID; }
 "nftrace"              { return NFTRACE; }
 "rtclassid"            { return RTCLASSID; }
-"ibriport"             { return IBRIPORT; }
+"ibriport"             { return IBRIDGENAME; } /* backwards compat */
 "ibrname"              { return IBRIDGENAME; }
-"obriport"             { return OBRIPORT; }
+"obriport"             { return OBRIDGENAME; } /* backwards compat */
 "obrname"              { return OBRIDGENAME; }
 "pkttype"              { return PKTTYPE; }
 "cpu"                  { return CPU; }
 "iifgroup"             { return IIFGROUP; }
 "oifgroup"             { return OIFGROUP; }
 "cgroup"               { return CGROUP; }
+<SCANSTATE_META>{
+       "nfproto"       { return NFPROTO; }
+       "l4proto"       { return L4PROTO; }
+       "iifkind"       { return IIFKIND; }
+       "oifkind"       { return OIFKIND; }
+       "ibrpvid"       { return IBRPVID; }
+       "ibrvproto"     { return IBRVPROTO; }
+       "sdif"          { return SDIF; }
+       "sdifname"      { return SDIFNAME; }
+       "broute"        { return BROUTE; }
+       "ibrhwaddr"     { return BRIFHWADDR; }
+
+       /* backwards compat */
+       "secpath"       { scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_IPSEC); return IPSEC; }
+}
 
 <SCANSTATE_EXPR_RT>{
        "nexthop"               { return NEXTHOP; }