diff options
| author | rmind <rmind@NetBSD.org> | 2013-11-08 00:38:26 +0000 |
|---|---|---|
| committer | rmind <rmind@NetBSD.org> | 2013-11-08 00:38:26 +0000 |
| commit | d1d2e2c9b05cd0a6ff3487f2022ff26ecb24a91d (patch) | |
| tree | f67e712c15e878d250a44ab2480e3cf6ef308cf8 /usr.sbin/npf/npfctl/npf_parse.y | |
| parent | 7c6db3061bd13e1d209c3f71f8e23ff03365f80a (diff) | |
NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections). Once the interface is reattached they will
become active.
Bump NPF_VERSION.
Diffstat (limited to 'usr.sbin/npf/npfctl/npf_parse.y')
| -rw-r--r-- | usr.sbin/npf/npfctl/npf_parse.y | 44 |
1 files changed, 23 insertions, 21 deletions
diff --git a/usr.sbin/npf/npfctl/npf_parse.y b/usr.sbin/npf/npfctl/npf_parse.y index 91df977b069..9a417dd426f 100644 --- a/usr.sbin/npf/npfctl/npf_parse.y +++ b/usr.sbin/npf/npfctl/npf_parse.y @@ -1,4 +1,4 @@ -/* $NetBSD: npf_parse.y,v 1.26 2013/09/20 03:03:52 rmind Exp $ */ +/* $NetBSD: npf_parse.y,v 1.27 2013/11/08 00:38:26 rmind Exp $ */ /*- * Copyright (c) 2011-2013 The NetBSD Foundation, Inc. @@ -156,9 +156,8 @@ yyerror(const char *fmt, ...) %token <str> VAR_ID %type <str> addr, some_name, list_elem, table_store, string -%type <str> proc_param_val, opt_apply -%type <num> ifindex, port, opt_final, on_ifindex, number -%type <num> afamily, opt_family +%type <str> proc_param_val, opt_apply, ifname, on_ifname +%type <num> port, opt_final, number, afamily, opt_family %type <num> block_or_pass, rule_dir, group_dir, block_opts %type <num> opt_stateful, icmp_type, table_type, map_sd, map_type %type <var> ifnet, addr_or_ifnet, port_range, icmp_type_and_code @@ -306,17 +305,17 @@ mapseg ; map - : MAP ifindex map_sd mapseg map_type mapseg PASS filt_opts + : MAP ifname map_sd mapseg map_type mapseg PASS filt_opts { npfctl_build_natseg($3, $5, $2, &$4, &$6, &$8); } - | MAP ifindex map_sd mapseg map_type mapseg + | MAP ifname map_sd mapseg map_type mapseg { npfctl_build_natseg($3, $5, $2, &$4, &$6, NULL); } | MAP RULESET group_opts { - npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifnum); + npfctl_build_maprset($3.rg_name, $3.rg_attr, $3.rg_ifname); } ; @@ -389,7 +388,7 @@ group { /* Build a group. Increases the nesting level. */ npfctl_build_group($2.rg_name, $2.rg_attr, - $2.rg_ifnum, $2.rg_default); + $2.rg_ifname, $2.rg_default); } ruleset_block { @@ -403,7 +402,7 @@ ruleset { /* Ruleset is a dynamic group. */ npfctl_build_group($2.rg_name, $2.rg_attr | NPF_RULE_DYNAMIC, - $2.rg_ifnum, $2.rg_default); + $2.rg_ifname, $2.rg_default); npfctl_build_group_end(); } ; @@ -419,12 +418,12 @@ group_opts memset(&$$, 0, sizeof(rule_group_t)); $$.rg_default = true; } - | STRING group_dir on_ifindex + | STRING group_dir on_ifname { memset(&$$, 0, sizeof(rule_group_t)); $$.rg_name = $1; $$.rg_attr = $2; - $$.rg_ifnum = $3; + $$.rg_ifname = $3; } ; @@ -445,13 +444,13 @@ rule_group ; rule - : block_or_pass opt_stateful rule_dir opt_final on_ifindex + : block_or_pass opt_stateful rule_dir opt_final on_ifname opt_family opt_proto all_or_filt_opts opt_apply { npfctl_build_rule($1 | $2 | $3 | $4, $5, $6, &$7, &$8, NULL, $9); } - | block_or_pass opt_stateful rule_dir opt_final on_ifindex + | block_or_pass opt_stateful rule_dir opt_final on_ifname PCAP_FILTER STRING opt_apply { npfctl_build_rule($1 | $2 | $3 | $4, $5, @@ -475,9 +474,9 @@ opt_final | { $$ = 0; } ; -on_ifindex - : ON ifindex { $$ = $2; } - | { $$ = 0; } +on_ifname + : ON ifname { $$ = $2; } + | { $$ = NULL; } ; afamily @@ -758,15 +757,17 @@ ifnet } ; -ifindex +ifname : some_name { - $$ = npfctl_find_ifindex($1); + npfctl_note_interface($1); + $$ = $1; } | ifnet { ifnet_addr_t *ifna = npfvar_get_data($1, NPFVAR_INTERFACE, 0); - $$ = ifna->ifna_index; + npfctl_note_interface(ifna->ifna_name); + $$ = ifna->ifna_name; } | VAR_ID { @@ -777,11 +778,11 @@ ifindex switch (type) { case NPFVAR_STRING: case NPFVAR_IDENTIFIER: - $$ = npfctl_find_ifindex(npfvar_expand_string(vp)); + $$ = npfvar_expand_string(vp); break; case NPFVAR_INTERFACE: ifna = npfvar_get_data(vp, type, 0); - $$ = ifna->ifna_index; + $$ = ifna->ifna_name; break; case -1: yyerror("undefined variable '%s' for interface", $1); @@ -791,6 +792,7 @@ ifindex $1, npfvar_type(type)); break; } + npfctl_note_interface($$); } ; |
