From: Florian Westphal Date: Tue, 20 Jan 2026 13:02:28 +0000 (+0100) Subject: parser: move qualified meta expression parsing to flex/bison X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=43b5dcaa3e179a439eb70a51354c783fe621647d;p=thirdparty%2Fnftables.git parser: move qualified meta expression parsing to flex/bison The meta keyword currently accepts 'STRING' arguments. This was originally done to avoid pollution the global token namespace. However, nowadays we do have flex scopes to avoid this. Add the tokens currently handled implciitly via STRING within META flex scope. SECPATH is a compatibility alias, map this to IPSEC token. IBRPORT/OBRPORT are also compatibility aliases, remove those tokens and handle this directly in scanner.l. This also avoids nft from printing tokens in help texts that are only there for compatibility with old rulesets. meta_key_parse() is retained for json input parser. Signed-off-by: Florian Westphal Acked-by: Phil Sutter --- diff --git a/doc/libnftables-json.adoc b/doc/libnftables-json.adoc index 049c3254..c3af007e 100644 --- a/doc/libnftables-json.adoc +++ b/doc/libnftables-json.adoc @@ -1269,7 +1269,7 @@ ____ 'META_KEY' := *"length"* | *"protocol"* | *"priority"* | *"random"* | *"mark"* | *"iif"* | *"iifname"* | *"iiftype"* | *"oif"* | *"oifname"* | *"oiftype"* | *"skuid"* | *"skgid"* | *"nftrace"* | - *"rtclassid"* | *"ibriport"* | *"obriport"* | *"ibridgename"* | + *"rtclassid"* | *"ibrname"* | *"obrname"* | *"ibridgename"* | *"obridgename"* | *"pkttype"* | *"cpu"* | *"iifgroup"* | *"oifgroup"* | *"cgroup"* | *"nfproto"* | *"l4proto"* | *"secpath"* diff --git a/src/parser_bison.y b/src/parser_bison.y index 33e2e3ea..74c3d25d 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -584,8 +584,6 @@ int nft_lex(void *, void *, void *); %token SKGID "skgid" %token NFTRACE "nftrace" %token RTCLASSID "rtclassid" -%token IBRIPORT "ibriport" -%token OBRIPORT "obriport" %token IBRIDGENAME "ibrname" %token OBRIDGENAME "obrname" %token PKTTYPE "pkttype" @@ -595,6 +593,17 @@ int nft_lex(void *, void *, void *); %token CGROUP "cgroup" %token TIME "time" +%token NFPROTO "nfproto" +%token L4PROTO "l4proto" +%token IIFKIND "iifkind" +%token OIFKIND "oifkind" +%token IBRPVID "ibrpvid" +%token IBRVPROTO "ibrvproto" +%token SDIF "sdif" +%token SDIFNAME "sdifname" +%token BROUTE "broute" +%token BRIFHWADDR "ibrhwaddr" + %token CLASSID "classid" %token NEXTHOP "nexthop" @@ -5421,20 +5430,6 @@ meta_expr : META meta_key close_scope_meta { $$ = meta_expr_alloc(&@$, $1); } - | META STRING close_scope_meta - { - struct error_record *erec; - unsigned int key; - - erec = meta_key_parse(&@$, $2, &key); - free_const($2); - if (erec != NULL) { - erec_queue(erec, state->msgs); - YYERROR; - } - - $$ = meta_expr_alloc(&@$, key); - } ; meta_key : meta_key_qualified @@ -5446,6 +5441,16 @@ meta_key_qualified : LENGTH { $$ = NFT_META_LEN; } | PRIORITY { $$ = NFT_META_PRIORITY; } | RANDOM { $$ = NFT_META_PRANDOM; } | SECMARK close_scope_secmark { $$ = NFT_META_SECMARK; } + | NFPROTO { $$ = NFT_META_NFPROTO; } + | L4PROTO { $$ = NFT_META_L4PROTO; } + | IIFKIND { $$ = NFT_META_IIFKIND; } + | OIFKIND { $$ = NFT_META_OIFKIND; } + | IBRPVID { $$ = NFT_META_BRI_IIFPVID; } + | IBRVPROTO { $$ = NFT_META_BRI_IIFVPROTO; } + | SDIF { $$ = NFT_META_SDIF; } + | SDIFNAME { $$ = NFT_META_SDIFNAME; } + | BROUTE { $$ = NFT_META_BRI_BROUTE; } + | BRIFHWADDR { $$ = NFT_META_BRI_IIFHWADDR; } ; meta_key_unqualified : MARK { $$ = NFT_META_MARK; } @@ -5459,8 +5464,6 @@ meta_key_unqualified : MARK { $$ = NFT_META_MARK; } | SKGID { $$ = NFT_META_SKGID; } | NFTRACE { $$ = NFT_META_NFTRACE; } | RTCLASSID { $$ = NFT_META_RTCLASSID; } - | IBRIPORT { $$ = NFT_META_BRI_IIFNAME; } - | OBRIPORT { $$ = NFT_META_BRI_OIFNAME; } | IBRIDGENAME { $$ = NFT_META_BRI_IIFNAME; } | OBRIDGENAME { $$ = NFT_META_BRI_OIFNAME; } | PKTTYPE { $$ = NFT_META_PKTTYPE; } @@ -5498,21 +5501,6 @@ meta_stmt : META meta_key SET stmt_expr close_scope_meta { $$ = meta_stmt_alloc(&@$, $1, $3); } - | META STRING SET stmt_expr close_scope_meta - { - struct error_record *erec; - unsigned int key; - - erec = meta_key_parse(&@$, $2, &key); - free_const($2); - if (erec != NULL) { - erec_queue(erec, state->msgs); - expr_free($4); - YYERROR; - } - - $$ = meta_stmt_alloc(&@$, key, $4); - } | NOTRACK { $$ = notrack_stmt_alloc(&@$); diff --git a/src/scanner.l b/src/scanner.l index 9d8fade8..1b4eb1cf 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -754,15 +754,30 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "skgid" { return SKGID; } "nftrace" { return NFTRACE; } "rtclassid" { return RTCLASSID; } -"ibriport" { return IBRIPORT; } +"ibriport" { return IBRIDGENAME; } /* backwards compat */ "ibrname" { return IBRIDGENAME; } -"obriport" { return OBRIPORT; } +"obriport" { return OBRIDGENAME; } /* backwards compat */ "obrname" { return OBRIDGENAME; } "pkttype" { return PKTTYPE; } "cpu" { return CPU; } "iifgroup" { return IIFGROUP; } "oifgroup" { return OIFGROUP; } "cgroup" { return CGROUP; } +{ + "nfproto" { return NFPROTO; } + "l4proto" { return L4PROTO; } + "iifkind" { return IIFKIND; } + "oifkind" { return OIFKIND; } + "ibrpvid" { return IBRPVID; } + "ibrvproto" { return IBRVPROTO; } + "sdif" { return SDIF; } + "sdifname" { return SDIFNAME; } + "broute" { return BROUTE; } + "ibrhwaddr" { return BRIFHWADDR; } + + /* backwards compat */ + "secpath" { scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_IPSEC); return IPSEC; } +} { "nexthop" { return NEXTHOP; }