contrib/ipfilter/BNF

   1 filter-rule = [ insert ] action in-out [ options ] [ tos ] [ ttl ]
   2               [ proto ] [ ip ] [ group ].
   3
   4 insert  = "@" decnumber .
   5 action  = block | "no-match" | "pass" | log | "count" | skip | auth | call .
   6 in-out  = "in" | "out" .
   7 options = [ log ] [ "quick" ] [ "on" interface-name [ dup ] [ froute ]
   8           [ via ] ] .
   9 tos     = "tos" decnumber | "tos" hexnumber .
  10 ttl     = "ttl" decnumber .
  11 proto   = "proto" protocol .
  12 ip      = srcdst [ flags ] [ with withopt ] [ icmp ] [ keep ] .
  13 group   = [ "head" decnumber ] [ "group" decnumber ] .
  14
  15 block   = "block" [ return-icmp[return-code] | "return-rst" ] .
  16 auth    = "auth" | "preauth" .
  17 log     = "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
  18 call    = "call" [ "now" ] function-name .
  19 skip    = "skip" decnumber .
  20 dup     = "dup-to" interface-name[":"ipaddr] .
  21 via     = "in-via" interface-name | "out-via" interface-name .
  22 froute  = "fastroute" | "to" interface-name [ ":" ipaddr ] .
  23 protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
  24 srcdst  = "all" | fromto .
  25 fromto  = "from" object "to" object .
  26
  27 return-icmp = "return-icmp" | "return-icmp-as-dest" .
  28 loglevel = facility"."priority | priority .
  29 object  = addr [ port-comp | port-range ] .
  30 addr    = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
  31 port-comp = "port" compare port-num .
  32 port-range = "port" port-num range port-num .
  33 flags   = "flags" flag { flag } [ "/" flag { flag } ] .
  34 with    = "with" | "and" .
  35 icmp    = "icmp-type" icmp-type [ "code" decnumber ] .
  36 return-code = "("icmp-code")" .
  37 keep    = "keep" "state" | "keep" "frags" | "keep" "state-age" state-age .
  38 state-age = decnmber [ "/" decnumber ] .
  39
  40 nummask = host-name [ "/" decnumber ] .
  41 host-name = ipaddr | hostname | "any" .
  42 ipaddr  = host-num "." host-num "." host-num "." host-num .
  43 host-num = digit [ digit [ digit ] ] .
  44 port-num = service-name | decnumber .
  45
  46 withopt = [ "not" | "no" ] opttype [ withopt ] .
  47 opttype = "ipopts" | "short" | "frag" | "opt" ipopts  .
  48 optname = ipopts [ "," optname ] .
  49 ipopts  = optlist | "sec-class" [ secname ] .
  50 secname = seclvl [ "," secname ] .
  51 seclvl  = "unclass" | "confid" | "reserv-1" | "reserv-2" | "reserv-3" |
  52           "reserv-4" | "secret" | "topsecret" .
  53 icmp-type = "unreach" | "echo" | "echorep" | "squench" | "redir" |
  54             "timex" | "paramprob" | "timest" | "timestrep" | "inforeq" |
  55             "inforep" | "maskreq" | "maskrep"  | "routerad" |
  56             "routersol" | decnumber .
  57 icmp-code = decumber | "net-unr" | "host-unr" | "proto-unr" | "port-unr" |
  58             "needfrag" | "srcfail" | "net-unk" | "host-unk" | "isolate" |
  59             "net-prohib" | "host-prohib" | "net-tos" | "host-tos" |
  60             "filter-prohib" | "host-preced" | "cutoff-preced" .
  61 optlist = "nop" | "rr" | "zsu" | "mtup" | "mtur" | "encode" | "ts" | "tr" |
  62           "sec" | "lsrr" | "e-sec" | "cipso" | "satid" | "ssrr" | "addext" |
  63           "visa" | "imitd" | "eip" | "finn" .
  64 facility = "kern" | "user" | "mail" | "daemon" | "auth" | "syslog" |
  65            "lpr" | "news" | "uucp" | "cron" | "ftp" | "authpriv" |
  66            "audit" | "logalert" | "local0" | "local1" | "local2" |
  67            "local3" | "local4" | "local5" | "local6" | "local7" .
  68 priority = "emerg" | "alert" | "crit" | "err" | "warn" | "notice" |
  69            "info" | "debug" .
  70
  71 hexnumber = "0" "x" hexstring .
  72 hexstring = hexdigit [ hexstring ] .
  73 decnumber = digit [ decnumber ] .
  74
  75 compare = "=" | "!=" | "<" | ">" | "<=" | ">=" | "eq" | "ne" | "lt" | "gt" |
  76           "le" | "ge" .
  77 range   = "<>" | "><" .
  78 hexdigit = digit | "a" | "b" | "c" | "d" | "e" | "f" .
  79 digit   = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" .
  80 flag    = "F" | "S" | "R" | "P" | "A" | "U" .