wireshark/epan/dfilter/scanner.l

%top {
/* Include this before everything else, for various large-file definitions */
#include "config.h"
#include <wireshark.h>

#include <stdlib.h>
#include <errno.h>

#include "dfilter-int.h"
#include "syntax-tree.h"
#include "grammar.h"
#include "dfunctions.h"
}

/*
 * We want a reentrant scanner.
 */
%option reentrant

/*
 * We don't use input, so don't generate code for it.
 */
%option noinput

/*
 * We don't use unput, so don't generate code for it.
 */
%option nounput

/*
 * We don't read interactively from the terminal.
 */
%option never-interactive

/*
 * Prefix scanner routines with "df_" rather than "yy", so this scanner
 * can coexist with other scanners.
 */
%option prefix="df_"

/*
 * We're reading from a string, so we don't need yywrap.
 */
%option noyywrap

/*
 * The type for the state we keep for a scanner.
 */
%option extra-type="df_scanner_state_t *"

/*
 * We have to override the memory allocators so that we don't get
 * "unused argument" warnings from the yyscanner argument (which
 * we don't use, as we have a global memory allocator).
 *
 * We provide, as macros, our own versions of the routines generated by Flex,
 * which just call malloc()/realloc()/free() (as the Flex versions do),
 * discarding the extra argument.
 */
%option noyyalloc
%option noyyrealloc
%option noyyfree

%{
/*
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 2001 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

/*
 * Disable diagnostics in the code generated by Flex.
 */
DIAG_OFF_FLEX

df_lval_t *df_lval;

static int set_lval_str(int token, const char *token_value);
#define simple(token) set_lval_str(token, yytext)

/*
 * Sleazy hack to suppress compiler warnings in yy_fatal_error().
 */
#define YY_EXIT_FAILURE ((void)yyscanner, 2)

/*
 * Macros for the allocators, to discard the extra argument.
 */
#define df_alloc(size, yyscanner)		(void *)malloc(size)
#define df_realloc(ptr, size, yyscanner)	(void *)realloc((char *)(ptr), (size))
#define df_free(ptr, yyscanner)			free((char *)ptr)

%}

%x RANGE
%x DQUOTE
%x SQUOTE

%%

[[:blank:]\n]+

"("		return simple(TOKEN_LPAREN);
")"		return simple(TOKEN_RPAREN);
","		return simple(TOKEN_COMMA);
"{"		return simple(TOKEN_LBRACE);
".."		return simple(TOKEN_DOTDOT);
"}"		return simple(TOKEN_RBRACE);

"=="		return simple(TOKEN_TEST_ANY_EQ);
"eq"		return simple(TOKEN_TEST_ANY_EQ);
"!="		return simple(TOKEN_TEST_ALL_NE);
"ne"		return simple(TOKEN_TEST_ALL_NE);
"~="		return simple(TOKEN_TEST_ANY_NE);
"any_ne"	return simple(TOKEN_TEST_ANY_NE);
">"		return simple(TOKEN_TEST_GT);
"gt"		return simple(TOKEN_TEST_GT);
">="		return simple(TOKEN_TEST_GE);
"ge"		return simple(TOKEN_TEST_GE);
"<"		return simple(TOKEN_TEST_LT);
"lt"		return simple(TOKEN_TEST_LT);
"<="		return simple(TOKEN_TEST_LE);
"le"		return simple(TOKEN_TEST_LE);
"bitwise_and"	return simple(TOKEN_TEST_BITWISE_AND);
"&"		return simple(TOKEN_TEST_BITWISE_AND);
"contains"	return simple(TOKEN_TEST_CONTAINS);
"~"		return simple(TOKEN_TEST_MATCHES);
"matches"	return simple(TOKEN_TEST_MATCHES);
"!"		return simple(TOKEN_TEST_NOT);
"not"		return simple(TOKEN_TEST_NOT);
"&&"		return simple(TOKEN_TEST_AND);
"and"		return simple(TOKEN_TEST_AND);
"||"		return simple(TOKEN_TEST_OR);
"or"		return simple(TOKEN_TEST_OR);
"in"		return simple(TOKEN_TEST_IN);

"["				{
	BEGIN(RANGE);
	return simple(TOKEN_LBRACKET);
}

<RANGE>[^],]+			{
	return set_lval_str(TOKEN_RANGE, yytext);
}

<RANGE>","			{
	return simple(TOKEN_COMMA);
}

<RANGE>"]"				{
	BEGIN(INITIAL);
	return simple(TOKEN_RBRACKET);
}

<RANGE><<EOF>>				{
	dfilter_fail(yyextra->dfw, "The right bracket was missing from a slice.");
	return SCAN_FAILED;
}

[rR]{0,1}\042			{
	/* start quote of a quoted string */
	/* The example of how to scan for strings was taken from
	the flex 2.5.4 manual, from the section "Start Conditions".
	See:
	http://www.gnu.org/software/flex/manual/html_node/flex_11.html */

	BEGIN(DQUOTE);
	/* A previous filter that failed to compile due to
	a missing end quote will have left quoted_string set
	to something. Clear it now that we are starting
	a new quoted string. */
	if (yyextra->quoted_string) {
		g_string_free(yyextra->quoted_string, TRUE);
		/* Don't set quoted_string to NULL, as we
		do in other quoted_string-cleanup code, as we're
		about to set it in the next line. */
	}
	yyextra->quoted_string = g_string_new("");
	if (yytext[0] == 'r' || yytext[0] == 'R') {
		/*
		 * This is a raw string (like in Python). Rules: 1) The two
		 * escape sequences are \\ and \". 2) Backslashes are
		 * preserved. 3) Double quotes in the string must be escaped.
		 * Corollary: Strings cannot end with an odd number of
		 * backslashes.
		 * Example: r"a\b\x12\"\\" is the string (including the implicit NUL terminator)
		 * {'a', '\\', 'b', '\\', 'x', '1', '2', '\\', '"', '\\'. '\\', '\0'}
		 */
		yyextra->raw_string = TRUE;
	}
	else {
		yyextra->raw_string = FALSE;
	}
}

<DQUOTE><<EOF>>				{
	/* unterminated string */
	/* The example of how to handle unclosed strings was taken from
	the flex 2.5.4 manual, from the section "End-of-file rules".
	See:
	http://www.gnu.org/software/flex/manual/html_node/flex_13.html */

	dfilter_fail(yyextra->dfw, "The final quote was missing from a quoted string.");
	return SCAN_FAILED;
}

<DQUOTE>\042			{
	/* end quote */
	BEGIN(INITIAL);
	df_lval->value = g_string_free(yyextra->quoted_string, FALSE);
	yyextra->quoted_string = NULL;
	return TOKEN_STRING;
}

<DQUOTE>\\[0-7]{1,3} {
	/* octal sequence */
	if (yyextra->raw_string) {
		g_string_append(yyextra->quoted_string, yytext);
	}
	else {
		unsigned long result;
		result = strtoul(yytext + 1, NULL, 8);
		if (result == 0) {
			g_string_free(yyextra->quoted_string, TRUE);
			yyextra->quoted_string = NULL;
			dfilter_fail(yyextra->dfw, "%s (NUL byte) cannot be used with a regular string.", yytext);
			return SCAN_FAILED;
		}
		if (result > 0xff) {
			g_string_free(yyextra->quoted_string, TRUE);
			yyextra->quoted_string = NULL;
			dfilter_fail(yyextra->dfw, "%s is larger than 255.", yytext);
			return SCAN_FAILED;
		}
		g_string_append_c(yyextra->quoted_string, (gchar) result);
	}
}

<DQUOTE>\\x[[:xdigit:]]{1,2} {
	/* hex sequence */
	if (yyextra->raw_string) {
		g_string_append(yyextra->quoted_string, yytext);
	}
	else {
		unsigned long result;
		result = strtoul(yytext + 2, NULL, 16);
		if (result == 0) {
			g_string_free(yyextra->quoted_string, TRUE);
			yyextra->quoted_string = NULL;
			dfilter_fail(yyextra->dfw, "%s (NUL byte) cannot be used with a regular string.", yytext);
			return SCAN_FAILED;
		}
		g_string_append_c(yyextra->quoted_string, (gchar) result);
	}
}


<DQUOTE>\\.				{
	/* escaped character */
	if (yyextra->raw_string) {
		g_string_append(yyextra->quoted_string, yytext);
	}
	else {
		g_string_append_c(yyextra->quoted_string, yytext[1]);
	}
}

<DQUOTE>[^\\\042]+			{
	/* non-escaped string */
	g_string_append(yyextra->quoted_string, yytext);
}


\047				{
	/* start quote of a quoted character value */
	/* The example of how to scan for strings was taken from
	the Flex manual, from the section "Start Conditions".
	See:
	http://flex.sourceforge.net/manual/Start-Conditions.html#Start-Conditions */

	BEGIN(SQUOTE);
	/* A previous filter that failed to compile due to
	a missing end quote will have left quoted_string set
	to something. Clear it now that we are starting
	a new quoted string. */
	if (yyextra->quoted_string) {
		g_string_free(yyextra->quoted_string, TRUE);
		/* Don't set quoted_string to NULL, as we
		do in other quoted_string-cleanup code, as we're
		about to set it in the next line. */
	}
	yyextra->quoted_string = g_string_new("'");
}

<SQUOTE><<EOF>>				{
	/* unterminated character value */
	/* The example of how to handle unclosed strings was taken from
	the Flex manual, from the section "End-of-file rules".
	See:
	http://flex.sourceforge.net/manual/EOF.html#EOF.html */

	dfilter_fail(yyextra->dfw, "The final quote was missing from a character constant.");
	return SCAN_FAILED;
}

<SQUOTE>\047			{
	/* end quote */
	BEGIN(INITIAL);
	g_string_append_c(yyextra->quoted_string, '\'');
	df_lval->value = g_string_free(yyextra->quoted_string, FALSE);
	yyextra->quoted_string = NULL;
	return TOKEN_CHARCONST;
}

<SQUOTE>\\.				{
	/* escaped character */
	g_string_append(yyextra->quoted_string, yytext);
}

<SQUOTE>[^\\\047]+			{
	/* non-escaped string */
	g_string_append(yyextra->quoted_string, yytext);
}


	/* None of the patterns below can match ".." anywhere in the token string. */
 
[-+[:alnum:]_:./]+ {
	char *s, *value;

	/* Hack (but lesser) to make sure that ".." is interpreted as a token on its own. */
	if ((s = strstr(yytext, "..")) != NULL) {
		/* If it starts with ".." it is its own token. */
		if (yytext[0] == '.' && yytext[1] == '.') {
			yyless(2);
			df_lval->value = g_strdup("..");
			return TOKEN_DOTDOT;
		}

		/* Match only the prefix before "..". */
		*s = '\0';
		value = g_strdup(yytext);
		*s = '.'; /* Restore */
		yyless(strlen(value));
		df_lval->value = value;
		return TOKEN_UNPARSED;
	}

	/* It is a variable or a literal value (CIDR, bytes, number, ...). */
	return set_lval_str(TOKEN_UNPARSED, yytext);
}

. {
 	/* Default */
	dfilter_fail(yyextra->dfw, "\"%s\" was unexpected in this context.", yytext);
	return SCAN_FAILED;
}


%%

/*
 * Turn diagnostics back on, so we check the code that we've written.
 */
DIAG_ON_FLEX

static int
set_lval_str(int token, const char *token_value)
{
	df_lval->value = g_strdup(token_value);
	return token;
}