4 #define WS_LOG_DOMAIN LOG_DOMAIN_DFILTER
8 #include "dfilter-int.h"
9 #include "syntax-tree.h"
10 #include "sttype-field.h"
11 #include "sttype-slice.h"
12 #include "sttype-op.h"
13 #include "sttype-function.h"
14 #include "sttype-set.h"
16 #include <epan/strutil.h>
21 #pragma warning(disable:4671)
25 new_reference(dfsyntax_t *dfs, stnode_t *node);
28 new_function(dfsyntax_t *dfs, stnode_t *node);
31 resolve_unparsed(dfsyntax_t *dfs, stnode_t *node);
33 #define FAIL(dfs, node, ...) \
35 ws_noisy("Parsing failed here."); \
36 dfilter_fail(dfs, DF_ERROR_GENERIC, stnode_location(node), __VA_ARGS__); \
40 } /* end of %include */
46 /* Parser Information */
49 %extra_argument {dfsyntax_t *dfs}
51 /* Terminal and Non-Terminal types and destructors */
52 %token_type {stnode_t*}
58 %default_type {stnode_t*}
59 %default_destructor {stnode_free($$);}
61 %type range_node_list {GSList*}
62 %destructor range_node_list {drange_node_free_list($$);}
64 %type func_params_list {GSList*}
65 %destructor func_params_list {st_funcparams_free($$);}
67 %type set_list {GSList*}
68 %destructor set_list {set_nodelist_free($$);}
70 %type set_element_list {GSList*}
71 %destructor set_element_list {set_nodelist_free($$);}
73 /* This is called as soon as a syntax error happens. After that,
74 any "error" symbols are shifted, if possible. */
77 dfilter_fail(dfs, DF_ERROR_UNEXPECTED_END, DFILTER_LOC_EMPTY, "Unexpected end of filter expression.");
80 FAIL(dfs, TOKEN, "\"%s\" was unexpected in this context.", stnode_token(TOKEN));
83 /* ----------------- The grammar -------------- */
90 %nonassoc TEST_ALL_EQ TEST_ANY_EQ TEST_ALL_NE TEST_ANY_NE TEST_LT TEST_LE TEST_GT TEST_GE
91 TEST_CONTAINS TEST_MATCHES.
94 %left STAR RSLASH PERCENT.
95 %nonassoc UNARY_PLUS UNARY_MINUS.
97 /* Top-level targets */
98 sentence ::= expr(X). { dfs->st_root = X; }
99 sentence ::= . { dfs->st_root = NULL; }
101 expr(X) ::= relation(R). { X = R; }
102 expr(X) ::= arithmetic_expr(E). { X = E; }
105 expr(X) ::= expr(Y) TEST_AND(T) expr(Z).
108 sttype_oper_set2(X, STNODE_OP_AND, Y, Z);
109 stnode_merge_location(X, Y, Z);
112 expr(X) ::= expr(Y) TEST_OR(T) expr(Z).
115 sttype_oper_set2(X, STNODE_OP_OR, Y, Z);
116 stnode_merge_location(X, Y, Z);
119 expr(X) ::= expr(Y) TEST_XOR(T) expr(Z).
121 stnode_t *A = stnode_new(STTYPE_TEST, NULL, NULL, DFILTER_LOC_EMPTY);
122 sttype_oper_set2(A, STNODE_OP_OR, stnode_dup(Y), stnode_dup(Z));
124 stnode_t *B = stnode_new(STTYPE_TEST, NULL, NULL, DFILTER_LOC_EMPTY);
125 sttype_oper_set2(B, STNODE_OP_AND, Y, Z);
127 stnode_t *C = stnode_new(STTYPE_TEST, NULL, NULL, DFILTER_LOC_EMPTY);
128 sttype_oper_set1(C, STNODE_OP_NOT, B);
131 sttype_oper_set2(X, STNODE_OP_AND, A, C);
132 stnode_merge_location(X, Y, Z);
135 expr(X) ::= TEST_NOT(T) expr(Y).
138 sttype_oper_set1(X, STNODE_OP_NOT, Y);
139 stnode_merge_location(X, T, Y);
142 /* Any expression inside parens is simply that expression */
143 expr(X) ::= LPAREN(L) expr(Y) RPAREN(R).
146 stnode_merge_location(X, L, R);
151 /* Entities, or things that can be compared/tested/checked */
152 atom(A) ::= STRING(S). { A = S; }
153 atom(A) ::= CHARCONST(N). { A = N; }
154 atom(A) ::= LITERAL(S). { A = S; }
155 atom(A) ::= NUMBER(N). { A = N; }
159 resolve_unparsed(dfsyntax_t *dfs, stnode_t *node)
161 if (stnode_type_id(node) != STTYPE_UNPARSED) {
162 ws_assert(stnode_type_id(node) == STTYPE_FIELD);
165 const char *name = stnode_token(node);
166 header_field_info *hfinfo = dfilter_resolve_unparsed(name, dfs->deprecated);
167 if (hfinfo == NULL) {
168 FAIL(dfs, node, "\"%s\" is not a valid protocol or protocol field.", name);
170 stnode_replace(node, STTYPE_FIELD, hfinfo); // NULL is OK here, we will fail later
175 field(X) ::= FIELD(F). { X = F; }
176 field(X) ::= IDENTIFIER(U). { X = U; }
177 field(X) ::= UNPARSED(U). { X = U; }
179 layered_field(X) ::= field(F).
184 layered_field(X) ::= field(F) HASH LBRACKET range_node_list(L) RBRACKET(R).
186 X = resolve_unparsed(dfs, F);
187 sttype_field_set_range(X, L);
189 stnode_merge_location(X, F, R);
193 layered_field(X) ::= field(F) HASH INDEX(N).
195 X = resolve_unparsed(dfs, F);
196 char *err_msg = NULL;
197 drange_node *range = drange_node_from_str(stnode_token(N), &err_msg);
198 if (err_msg != NULL) {
199 FAIL(dfs, N, "%s", err_msg);
202 sttype_field_set_range1(X, range);
203 stnode_merge_location(X, F, N);
207 rawable_field(X) ::= layered_field(F).
212 rawable_field(X) ::= ATSIGN(A) layered_field(F).
214 X = resolve_unparsed(dfs, F);
215 sttype_field_set_raw(X, true);
216 stnode_merge_location(X, A, F);
222 new_reference(dfsyntax_t *dfs _U_, stnode_t *node)
224 /* convert field to reference */
226 stnode_t *ref = stnode_new(STTYPE_REFERENCE, sttype_field_hfinfo(node), g_strdup(stnode_token(node)), stnode_location(node));
227 sttype_field_set_drange(ref, sttype_field_drange_steal(node));
228 sttype_field_set_raw(ref, sttype_field_raw(node));
233 reference(X) ::= DOLLAR(D) LBRACE rawable_field(F) RBRACE(R).
235 F = resolve_unparsed(dfs, F);
236 X = new_reference(dfs, F);
237 stnode_merge_location(X, D, R);
243 reference(X) ::= DOLLAR(D) rawable_field(F).
245 F = resolve_unparsed(dfs, F);
246 X = new_reference(dfs, F);
247 stnode_merge_location(X, D, F);
252 entity(E) ::= atom(A). { E = A; }
253 entity(E) ::= slice(R). { E = R; }
254 entity(E) ::= function(F). { E = F; }
255 entity(E) ::= rawable_field(F). { E = F; }
256 entity(E) ::= reference(R). { E = R; }
258 arithmetic_expr(T) ::= entity(N).
263 arithmetic_expr(T) ::= PLUS(P) arithmetic_expr(N). [UNARY_PLUS]
266 stnode_merge_location(T, P, N);
270 arithmetic_expr(T) ::= MINUS(M) arithmetic_expr(N). [UNARY_MINUS]
273 sttype_oper_set1(T, STNODE_OP_UNARY_MINUS, N);
274 stnode_merge_location(T, M, N);
277 arithmetic_expr(T) ::= arithmetic_expr(F) BITWISE_AND(O) arithmetic_expr(M).
280 sttype_oper_set2(T, STNODE_OP_BITWISE_AND, F, M);
281 stnode_merge_location(T, F, M);
284 arithmetic_expr(T) ::= arithmetic_expr(F) PLUS(O) arithmetic_expr(M).
287 sttype_oper_set2(T, STNODE_OP_ADD, F, M);
288 stnode_merge_location(T, F, M);
291 arithmetic_expr(T) ::= arithmetic_expr(F) MINUS(O) arithmetic_expr(M).
294 sttype_oper_set2(T, STNODE_OP_SUBTRACT, F, M);
295 stnode_merge_location(T, F, M);
298 arithmetic_expr(T) ::= arithmetic_expr(F) STAR(O) arithmetic_expr(M).
301 sttype_oper_set2(T, STNODE_OP_MULTIPLY, F, M);
302 stnode_merge_location(T, F, M);
305 arithmetic_expr(T) ::= arithmetic_expr(F) RSLASH(O) arithmetic_expr(M).
308 sttype_oper_set2(T, STNODE_OP_DIVIDE, F, M);
309 stnode_merge_location(T, F, M);
312 arithmetic_expr(T) ::= arithmetic_expr(F) PERCENT(O) arithmetic_expr(M).
315 sttype_oper_set2(T, STNODE_OP_MODULO, F, M);
316 stnode_merge_location(T, F, M);
319 arithmetic_expr(T) ::= LBRACE(L) arithmetic_expr(F) RBRACE(R).
322 stnode_merge_location(T, L, R);
327 /* Relational tests */
328 cmp_op(O) ::= TEST_ALL_EQ(L).
331 sttype_oper_set_op(O, STNODE_OP_ALL_EQ);
334 cmp_op(O) ::= TEST_ANY_EQ(L).
337 sttype_oper_set_op(O, STNODE_OP_ANY_EQ);
340 cmp_op(O) ::= TEST_ALL_NE(L).
343 sttype_oper_set_op(O, STNODE_OP_ALL_NE);
346 cmp_op(O) ::= TEST_ANY_NE(L).
349 sttype_oper_set_op(O, STNODE_OP_ANY_NE);
352 cmp_op(O) ::= TEST_GT(L).
355 sttype_oper_set_op(O, STNODE_OP_GT);
358 cmp_op(O) ::= TEST_GE(L).
361 sttype_oper_set_op(O, STNODE_OP_GE);
364 cmp_op(O) ::= TEST_LT(L).
367 sttype_oper_set_op(O, STNODE_OP_LT);
370 cmp_op(O) ::= TEST_LE(L).
373 sttype_oper_set_op(O, STNODE_OP_LE);
376 comparison_test(T) ::= arithmetic_expr(E) cmp_op(O) arithmetic_expr(F).
379 sttype_oper_set2_args(O, E, F);
380 stnode_merge_location(T, E, F);
383 /* 'a == b == c' or 'a < b <= c <= d < e' */
384 comparison_test(T) ::= arithmetic_expr(E) cmp_op(O) comparison_test(R).
389 while (stnode_type_id(F) == STTYPE_TEST) {
390 sttype_oper_get(F, NULL, &F, NULL);
394 sttype_oper_set2_args(L, E, stnode_dup(F));
396 T = stnode_new_empty(STTYPE_TEST);
397 sttype_oper_set2(T, STNODE_OP_AND, L, R);
398 stnode_merge_location(T, E, R);
401 relation_test(T) ::= comparison_test(C). { T = C; }
403 relation_test(T) ::= entity(E) TEST_CONTAINS(L) entity(F).
406 sttype_oper_set2(T, STNODE_OP_CONTAINS, E, F);
407 stnode_merge_location(T, E, F);
410 relation_test(T) ::= entity(E) TEST_MATCHES(L) entity(F).
413 sttype_oper_set2(T, STNODE_OP_MATCHES, E, F);
414 stnode_merge_location(T, E, F);
417 relation_test(T) ::= entity(E) TEST_IN(O) set(S).
420 sttype_oper_set2(T, STNODE_OP_IN, E, S);
421 stnode_merge_location(T, E, S);
424 relation_test(T) ::= entity(E) TEST_NOT TEST_IN(O) set(S).
427 sttype_oper_set2(O, STNODE_OP_NOT_IN, E, S);
428 stnode_merge_location(T, E, S);
431 relation(R) ::= relation_test(T). { R = T; }
433 relation(R) ::= ANY(A) relation_test(T).
436 sttype_test_set_match(R, STNODE_MATCH_ANY);
437 stnode_merge_location(R, A, T);
441 relation(R) ::= ALL(A) relation_test(T).
444 sttype_test_set_match(R, STNODE_MATCH_ALL);
445 stnode_merge_location(R, A, T);
451 set_element_list(N) ::= arithmetic_expr(X).
453 N = g_slist_append(NULL, X);
454 N = g_slist_append(N, NULL);
457 set_element_list(N) ::= arithmetic_expr(X) DOTDOT arithmetic_expr(Y).
459 N = g_slist_append(NULL, X);
460 N = g_slist_append(N, Y);
463 set_list(L) ::= set_element_list(N).
465 L = g_slist_concat(NULL, N);
468 set_list(L) ::= set_list(P) COMMA set_element_list(N).
470 L = g_slist_concat(P, N);
473 set(S) ::= LBRACE(LB) set_list(L) RBRACE(RB).
475 S = stnode_new(STTYPE_SET, L, NULL, DFILTER_LOC_EMPTY);
476 stnode_merge_location(S, LB, RB);
483 slice(R) ::= entity(E) LBRACKET range_node_list(L) RBRACKET.
485 R = stnode_new(STTYPE_SLICE, NULL, NULL, DFILTER_LOC_EMPTY);
486 sttype_slice_set(R, E, L);
488 /* Delete the list, but not the drange_nodes that
489 * the list contains. */
493 range_node_list(L) ::= RANGE_NODE(N).
495 char *err_msg = NULL;
496 drange_node *rn = drange_node_from_str(stnode_token(N), &err_msg);
497 if (err_msg != NULL) {
498 FAIL(dfs, N, "%s", err_msg);
501 L = g_slist_append(NULL, rn);
505 range_node_list(L) ::= range_node_list(P) COMMA RANGE_NODE(N).
507 char *err_msg = NULL;
508 drange_node *rn = drange_node_from_str(stnode_token(N), &err_msg);
509 if (err_msg != NULL) {
510 FAIL(dfs, N, "%s", err_msg);
513 L = g_slist_append(P, rn);
521 new_function(dfsyntax_t *dfs, stnode_t *node)
523 const char *name = stnode_token(node);
525 df_func_def_t *def = df_func_lookup(name);
527 FAIL(dfs, node, "Function '%s' does not exist", name);
529 stnode_replace(node, STTYPE_FUNCTION, def);
534 /* A function can have one or more parameters */
535 function(F) ::= IDENTIFIER(U) LPAREN func_params_list(P) RPAREN(R).
537 F = new_function(dfs, U);
538 sttype_function_set_params(F, P);
539 stnode_merge_location(F, U, R);
543 /* A function can have zero parameters. */
544 function(F) ::= IDENTIFIER(U) LPAREN RPAREN(R).
546 F = new_function(dfs, U);
547 stnode_merge_location(F, U, R);
551 func_params_list(P) ::= arithmetic_expr(E).
553 P = g_slist_append(NULL, E);
556 func_params_list(P) ::= func_params_list(L) COMMA arithmetic_expr(E).
558 P = g_slist_append(L, E);