[PATCH nft] parser: move qualified meta expression parsing to flex/bison

[PATCH nft] parser: move qualified meta expression parsing to flex/bison

[Florian Westphal]

The meta keyword currently accepts 'STRING' arguments.
This was originally done to avoid pollution the global token namespace.

However, nowadays we do have flex scopes to avoid this.
Add the tokens currently handled implciitly via STRING within
META flex scope.

SECPATH is a compatibility alias, map this to IPSEC token.
IBRPORT/OBRPORT are also compatibility aliases, remove those tokens
and handle this directly in scanner.l.

This also avoids nft from printing tokens in help texts that are only
there for compatibility with old rulesets.

meta_key_parse() is retained for json input parser.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 doc/libnftables-json.adoc |  2 +-
 src/parser_bison.y        | 54 +++++++++++++++------------------------
 src/scanner.l             | 19 ++++++++++++--
 3 files changed, 39 insertions(+), 36 deletions(-)

diff --git a/doc/libnftables-json.adoc b/doc/libnftables-json.adoc
index 049c3254ff03..c3af007e1917 100644
--- a/doc/libnftables-json.adoc
+++ b/doc/libnftables-json.adoc
@@ -1269,7 +1269,7 @@ ____
 'META_KEY' := *"length"* | *"protocol"* | *"priority"* | *"random"* | *"mark"* |
               *"iif"* | *"iifname"* | *"iiftype"* | *"oif"* | *"oifname"* |
 	      *"oiftype"* | *"skuid"* | *"skgid"* | *"nftrace"* |
-	      *"rtclassid"* | *"ibriport"* | *"obriport"* | *"ibridgename"* |
+	      *"rtclassid"* | *"ibrname"* | *"obrname"* | *"ibridgename"* |
 	      *"obridgename"* | *"pkttype"* | *"cpu"* | *"iifgroup"* |
 	      *"oifgroup"* | *"cgroup"* | *"nfproto"* | *"l4proto"* |
 	      *"secpath"*
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 33e2e3eaea73..74c3d25db4ff 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -584,8 +584,6 @@ int nft_lex(void *, void *, void *);
 %token SKGID			"skgid"
 %token NFTRACE			"nftrace"
 %token RTCLASSID		"rtclassid"
-%token IBRIPORT			"ibriport"
-%token OBRIPORT			"obriport"
 %token IBRIDGENAME		"ibrname"
 %token OBRIDGENAME		"obrname"
 %token PKTTYPE			"pkttype"
@@ -595,6 +593,17 @@ int nft_lex(void *, void *, void *);
 %token CGROUP			"cgroup"
 %token TIME			"time"
 
+%token NFPROTO			"nfproto"
+%token L4PROTO			"l4proto"
+%token IIFKIND			"iifkind"
+%token OIFKIND			"oifkind"
+%token IBRPVID			"ibrpvid"
+%token IBRVPROTO		"ibrvproto"
+%token SDIF			"sdif"
+%token SDIFNAME			"sdifname"
+%token BROUTE			"broute"
+%token BRIFHWADDR		"ibrhwaddr"
+
 %token CLASSID			"classid"
 %token NEXTHOP			"nexthop"
 
@@ -5421,20 +5430,6 @@ meta_expr		:	META	meta_key	close_scope_meta
 			{
 				$$ = meta_expr_alloc(&@$, $1);
 			}
-			|	META	STRING	close_scope_meta
-			{
-				struct error_record *erec;
-				unsigned int key;
-
-				erec = meta_key_parse(&@$, $2, &key);
-				free_const($2);
-				if (erec != NULL) {
-					erec_queue(erec, state->msgs);
-					YYERROR;
-				}
-
-				$$ = meta_expr_alloc(&@$, key);
-			}
 			;
 
 meta_key		:	meta_key_qualified
@@ -5446,6 +5441,16 @@ meta_key_qualified	:	LENGTH		{ $$ = NFT_META_LEN; }
 			|	PRIORITY	{ $$ = NFT_META_PRIORITY; }
 			|	RANDOM		{ $$ = NFT_META_PRANDOM; }
 			|	SECMARK	close_scope_secmark { $$ = NFT_META_SECMARK; }
+			|	NFPROTO		{ $$ = NFT_META_NFPROTO; }
+			|	L4PROTO		{ $$ = NFT_META_L4PROTO; }
+			|	IIFKIND		{ $$ = NFT_META_IIFKIND; }
+			|	OIFKIND		{ $$ = NFT_META_OIFKIND; }
+			|	IBRPVID		{ $$ = NFT_META_BRI_IIFPVID; }
+			|	IBRVPROTO	{ $$ = NFT_META_BRI_IIFVPROTO; }
+			|	SDIF		{ $$ = NFT_META_SDIF; }
+			|	SDIFNAME	{ $$ = NFT_META_SDIFNAME; }
+			|	BROUTE		{ $$ = NFT_META_BRI_BROUTE; }
+			|	BRIFHWADDR	{ $$ = NFT_META_BRI_IIFHWADDR; }
 			;
 
 meta_key_unqualified	:	MARK		{ $$ = NFT_META_MARK; }
@@ -5459,8 +5464,6 @@ meta_key_unqualified	:	MARK		{ $$ = NFT_META_MARK; }
 			|	SKGID		{ $$ = NFT_META_SKGID; }
 			|	NFTRACE		{ $$ = NFT_META_NFTRACE; }
 			|	RTCLASSID	{ $$ = NFT_META_RTCLASSID; }
-			|	IBRIPORT	{ $$ = NFT_META_BRI_IIFNAME; }
-			|       OBRIPORT	{ $$ = NFT_META_BRI_OIFNAME; }
 			|	IBRIDGENAME	{ $$ = NFT_META_BRI_IIFNAME; }
 			|       OBRIDGENAME	{ $$ = NFT_META_BRI_OIFNAME; }
 			|       PKTTYPE		{ $$ = NFT_META_PKTTYPE; }
@@ -5498,21 +5501,6 @@ meta_stmt		:	META	meta_key	SET	stmt_expr	close_scope_meta
 			{
 				$$ = meta_stmt_alloc(&@$, $1, $3);
 			}
-			|	META	STRING	SET	stmt_expr	close_scope_meta
-			{
-				struct error_record *erec;
-				unsigned int key;
-
-				erec = meta_key_parse(&@$, $2, &key);
-				free_const($2);
-				if (erec != NULL) {
-					erec_queue(erec, state->msgs);
-					expr_free($4);
-					YYERROR;
-				}
-
-				$$ = meta_stmt_alloc(&@$, key, $4);
-			}
 			|	NOTRACK
 			{
 				$$ = notrack_stmt_alloc(&@$);
diff --git a/src/scanner.l b/src/scanner.l
index 9d8fade8308d..1b4eb1cf13a4 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -754,15 +754,30 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 "skgid"			{ return SKGID; }
 "nftrace"		{ return NFTRACE; }
 "rtclassid"		{ return RTCLASSID; }
-"ibriport"		{ return IBRIPORT; }
+"ibriport"		{ return IBRIDGENAME; } /* backwards compat */
 "ibrname"		{ return IBRIDGENAME; }
-"obriport"		{ return OBRIPORT; }
+"obriport"		{ return OBRIDGENAME; }	/* backwards compat */
 "obrname"		{ return OBRIDGENAME; }
 "pkttype"		{ return PKTTYPE; }
 "cpu"			{ return CPU; }
 "iifgroup"		{ return IIFGROUP; }
 "oifgroup"		{ return OIFGROUP; }
 "cgroup"		{ return CGROUP; }
+<SCANSTATE_META>{
+	"nfproto"	{ return NFPROTO; }
+	"l4proto"	{ return L4PROTO; }
+	"iifkind"	{ return IIFKIND; }
+	"oifkind"	{ return OIFKIND; }
+	"ibrpvid"	{ return IBRPVID; }
+	"ibrvproto"	{ return IBRVPROTO; }
+	"sdif"		{ return SDIF; }
+	"sdifname"	{ return SDIFNAME; }
+	"broute"	{ return BROUTE; }
+	"ibrhwaddr"	{ return BRIFHWADDR; }
+
+	/* backwards compat */
+	"secpath"	{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_IPSEC); return IPSEC; }
+}
 
 <SCANSTATE_EXPR_RT>{
 	"nexthop"		{ return NEXTHOP; }
-- 
2.52.0

Re: [PATCH nft] parser: move qualified meta expression parsing to flex/bison

[Phil Sutter]

On Tue, Jan 20, 2026 at 08:13:16PM +0100, Florian Westphal wrote:
> The meta keyword currently accepts 'STRING' arguments.
> This was originally done to avoid pollution the global token namespace.
> 
> However, nowadays we do have flex scopes to avoid this.
> Add the tokens currently handled implciitly via STRING within
> META flex scope.
> 
> SECPATH is a compatibility alias, map this to IPSEC token.
> IBRPORT/OBRPORT are also compatibility aliases, remove those tokens
> and handle this directly in scanner.l.
> 
> This also avoids nft from printing tokens in help texts that are only
> there for compatibility with old rulesets.
> 
> meta_key_parse() is retained for json input parser.
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>

Acked-by: Phil Sutter <phil@nwl.cc>