1 %{
2 #include <mediator/mediator_ctx.h>
3 #include <stdint.h>
4 #include <ctype.h>
5 #include <mediator/mediator_config.h>
6 #include "mediator_config_parse.h"
7 
8 int mediatorconf_errors = 0;
9 int lineNumber       = 1;
10 
11 #define BUF_SIZE 2048
12 static char pipeconf_buf[BUF_SIZE];
13 static char *pipeconf_buf_end = pipeconf_buf + BUF_SIZE - 1;
14 static char *pipeconf_buf_ptr;
15 
16 #define STRING_CHECK                            \
17     if (pipeconf_buf_ptr >= pipeconf_buf_end) { \
18         *pipeconf_buf_end = '\0';               \
19         printf("String too long");         \
20         BEGIN(ST_STRING_ERR);                   \
21     }
22 
23 %}
24 
25 %option never-interactive nounput
26 
27 %x ST_STRING
28 
29     /* state to use when a quoted string is too long */
30 
31 %x ST_STRING_ERR
32 
33     /* state for reading pysilk code.  we accept everything until a
34      * line that begins with "end" */
35 
36     /* %x ST_PYSILK */
37 
38     /* state to use when parsing an argument and we come to the end of
39      * the line. We delay incrementing the line count until after the
40      * parser returns so errors are reported on the correct line. */
41 
42 %x ST_NEWLINE
43 
44 
45 %x ST_TOKEN_ERR
46 
47      /* character classes */
48 
49 wschar      [ \t\r]
50 
51 wsopt       {wschar}*
52 
53 ws          {wschar}+
54 
55 comment     {wsopt}#.*\n
56 
57 nl          {wsopt}\n
58 
59 eol         {nl}|{comment}
60 
61     /* Atoms (symbols) without quotes */
62 
63 atomchar    [-_/@A-Za-z0-9]
64 atom        {atomchar}+
65 
66     /* numbers */
67 
68 number      [0-9]+
69 exponent    [Ee][-+]?{number}
70 
71     /* various forms for IP addresses */
72 
73 ip4         [0-9]+\.[0-9]+\.[0-9\./]+
74 ip6         [0-9a-fA-F:]*:[0-9a-fA-F:]*:[0-9a-fA-F\.\:/]*
75 int_cidr    [0-9]+\/[0-9]+
76 
77 ip          {ip4}|{ip6}|{int_cidr}
78 
79     /* date / time */
80 
81 timestr     [0-9]+[-/][0-9]+[-/][0-9Tt:.]+
82 
83 %%
84 
85 {eol}                   {lineNumber++; return EOS;}
86 {ws}                    ;
87 "["                     {return LEFT_SQ_BRACKET;}
88 "]"                     {return RIGHT_SQ_BRACKET;}
89 "("                     {return LEFT_PAREN;}
90 ")"                     {return RIGHT_PAREN;}
91 ","                     {return COMMA;}
92 "*"                     {return WILD;}
93 MEDIATOR                {return TOK_MEDIATOR;}
94 END                     {return TOK_END;}
95 COLLECTOR               {return TOK_COLLECTOR;}
96 EXPORTER                {return TOK_EXPORTER;}
97 SPREAD                  {yylval.transport = SPREAD; return VAL_TRANSPORT;}
98 DECOMPRESS_DIRECTORY    {return TOK_DECOMPRESS;}
99 DECOMPRESS{ws}DIRECTORY {return TOK_DECOMPRESS;}
100 DECOMPRESS              {return TOK_DECOMPRESS;}
101 DNS_DEDUP               {return TOK_DNS_DEDUP;}
102 DNS{ws}DEDUP            {return TOK_DNS_DEDUP;}
103 DNS_DEDUP_ONLY          {return TOK_DNSDEDUP_ONLY;}
104 DNS{ws}DEDUP{ws}ONLY    {return TOK_DNSDEDUP_ONLY;}
105 DEDUP_PER_FLOW          {return TOK_DEDUP_PER_FLOW;}
106 DEDUP{ws}PER{ws}FLOW    {return TOK_DEDUP_PER_FLOW;}
107 DEDUP_CONFIG            {return TOK_DEDUP_CONFIG;}
108 DEDUP{ws}CONFIG         {return TOK_DEDUP_CONFIG;}
109 DEDUP_ONLY              {return TOK_DEDUP_ONLY;}
110 DEDUP{ws}ONLY           {return TOK_DEDUP_ONLY;}
111 NO_FLOW                 {return TOK_NO_FLOW;}
112 NO{ws}FLOW              {return TOK_NO_FLOW;}
113 MERGE_TRUNCATED         {return TOK_MERGE;}
114 MERGE{ws}TRUNCATED      {return TOK_MERGE;}
115 DPI_CONFIG              {return TOK_DPI_CONFIG;}
116 DPI{ws}CONFIG           {return TOK_DPI_CONFIG;}
117 FILE_PREFIX             {return TOK_FILE;}
118 PREFIX                  {return TOK_FILE;}
119 FILE{ws}PREFIX          {return TOK_FILE;}
120 SSL_CONFIG              {return TOK_SSL_CONFIG;}
121 SSL{ws}CONFIG           {return TOK_SSL_CONFIG;}
122 ISSUER                  {return TOK_ISSUER;}
123 SUBJECT                 {return TOK_SUBJECT;}
124 OTHER                   {return TOK_OTHER;}
125 EXTENSION               {return TOK_EXTENSIONS;}
126 EXTENSIONS              {return TOK_EXTENSIONS;}
127 SSL_CERT_DEDUP          {return TOK_SSL_DEDUP;}
128 SSL_DEDUP               {return TOK_SSL_DEDUP;}
129 SSL{ws}CERT{ws}DEDUP    {return TOK_SSL_DEDUP;}
130 SSL{ws}DEDUP            {return TOK_SSL_DEDUP;}
131 SSL_DEDUP_ONLY          {return TOK_SSL_DEDUP_ONLY;}
132 SSL{ws}DEDUP{ws}ONLY    {return TOK_SSL_DEDUP_ONLY;}
133 CERT_FILE               {return TOK_CERT_FILE;}
134 CERT{ws}FILE            {return TOK_CERT_FILE;}
135 SSL_CERT_HASH_SHA1      {return TOK_SHA1;}
136 SSL{ws}CERT{ws}HASH{ws}SHA1 {return TOK_SHA1;}
137 SHA1                    {return TOK_SHA1;}
138 SHA1_HASH               {return TOK_SHA1;}
139 SSL_CERT_HASH_MD5       {return TOK_MD5;}
140 SSL{ws}CERT{ws}HASH{ws}MD5 {return TOK_MD5;}
141 MD5                     {return TOK_MD5;}
142 MD5_HASH                {return TOK_MD5;}
143 DPI_FIELD_LIST          {return TOK_DPI_FIELD_LIST;}
144 DPI{ws}FIELD{ws}LIST    {return TOK_DPI_FIELD_LIST;}
145 DPI_FIELDS              {return TOK_DPI_FIELD_LIST;}
146 TABLE                   {return TOK_TABLE;}
147 MULTI                   {return TOK_MULTI_FILES;}
148 MULTI_FILES             {return TOK_MULTI_FILES;}
149 MULTI{ws}FILES          {return TOK_MULTI_FILES;}
150 JSON                    {return TOK_JSON;}
151 FILTER                  {return TOK_FILTER;}
152 NO_STATS                {return TOK_NO_STATS;}
153 NO{ws}STATS             {return TOK_NO_STATS;}
154 STATS_TIMEOUT           {return TOK_STATS_TO;}
155 STATS{ws}TIMEOUT        {return TOK_STATS_TO;}
156 STATS{ws}TIMEOUT        {return TOK_STATS_TO;}
157 TOMBSTONE_CONFIG        {return TOK_TOMBSTONE_CONFIG;}
158 GEN{ws}TOMBSTONE        {return TOK_GEN_TOMBSTONE;}
159 GEN_TOMBSTONE           {return TOK_GEN_TOMBSTONE;}
160 TOMBSTONE_CONFIGURED_ID {return TOK_TOMBSTONE_CONFIGURED_ID;}
161 HOSTNAME                {return TOK_HOST;}
162 HOST                    {return TOK_HOST;}
163 IP_ADDRESS              {return TOK_HOST;}
164 IP{ws}ADDRESS           {return TOK_HOST;}
165 FILEHANDLER             {yylval.transport = FILEHANDLER; return VAL_TRANSPORT;}
166 FILE                    {return TOK_PATH;}
167 PATH                    {return TOK_PATH;}
168 TEXT                    {yylval.transport = TEXT; return VAL_TRANSPORT;}
169 DIR                     {yylval.transport = DIRECTORY; return VAL_TRANSPORT;}
170 DIRECTORY               {yylval.transport = DIRECTORY; return VAL_TRANSPORT;}
171 POLL                    {return TOK_POLL;}
172 DAEMON                  {return TOK_DAEMON;}
173 GROUP                   {return TOK_GROUP;}
174 MOVE_PATH               {return TOK_MOVE;}
175 MOVE{ws}PATH            {return TOK_MOVE;}
176 MOVE                    {return TOK_MOVE;}
177 DELIMITER               {return TOK_DELIM;}
178 DELIM                   {return TOK_DELIM;}
179 DPI_DELIMITER           {return TOK_DPI_DELIMITER;}
180 DELETE                  {return TOK_DELETE;}
181 LOCK                    {return TOK_LOCK;}
182 LOG_FILE                {return TOK_LOG_FILE;}
183 LOG{ws}FILE             {return TOK_LOG_FILE;}
184 LOG                     {return TOK_LOG_FILE;}
185 LOG_DIRECTORY           {return TOK_LOG_DIR;}
186 LOG{ws}DIRECTORY        {return TOK_LOG_DIR;}
187 LOG_DIR                 {return TOK_LOG_DIR;}
188 LOG{ws}DIR              {return TOK_LOG_DIR;}
189 LOGDIR                  {return TOK_LOG_DIR;}
190 UDP_TEMPLATE_TIMEOUT    {return TOK_UDP_TIMEOUT;}
191 UDP{ws}TEMPLATE{ws}TIMEOUT {return TOK_UDP_TIMEOUT;}
192 UDP{ws}TIMEOUT          {return TOK_UDP_TIMEOUT;}
193 ROTATE                  {return TOK_ROTATE;}
194 PORT                    {return TOK_PORT;}
195 USER_IE                 {return TOK_USERIE;}
196 USER{ws}IE              {return TOK_USERIE;}
197 TCP                     {yylval.transport = TCP;  return VAL_TRANSPORT;}
198 UDP                     {yylval.transport = UDP;  return VAL_TRANSPORT;}
199 FLOW{ws}ONLY            {return TOK_FLOW_ONLY;}
200 FLOW_ONLY               {return TOK_FLOW_ONLY;}
201 DPI{ws}ONLY             {return TOK_DPI_ONLY;}
202 DPI_ONLY                {return TOK_DPI_ONLY;}
203 STATS_ONLY              {return TOK_STATS_ONLY;}
204 STATS{ws}ONLY           {return TOK_STATS_ONLY;}
205 STATS                   {return TOK_STATS_ONLY;}
206 DNS_RR_ONLY             {return TOK_DNSRR_ONLY;}
207 DNS{ws}RR{ws}ONLY       {return TOK_DNSRR_ONLY;}
208 DNS_RESPONSE_ONLY       {return TOK_RESP_ONLY;}
209 DNS_RR                  {return TOK_DNSRR;}
210 DNS{ws}RR               {return TOK_DNSRR;}
211 FULL                    {return TOK_FULL;}
212 full                    {return TOK_FULL;}
213 PRINT_HEADER            {return TOK_PRINT_HDR;}
214 PRINT{ws}HEADER         {return TOK_PRINT_HDR;}
215 NO_INDEX                {return TOK_NO_INDEX;}
216 NO{ws}INDEX             {return TOK_NO_INDEX;}
217 NO_FLOW_STATS           {return TOK_NO_FLOW_STATS;}
218 NO{ws}FLOW{ws}STATS     {return TOK_NO_FLOW_STATS;}
219 TIMESTAMP_FILES         {return TOK_TIMESTAMP;}
220 TIMESTAMP{ws}FILES      {return TOK_TIMESTAMP;}
221 FIELDS                  {return TOK_FIELDS;}
222 APPLICATION             {yylval.field = APPLICATION; return VAL_FIELD;}
223 application             {yylval.field = APPLICATION; return VAL_FIELD;}
224 app                     {yylval.field =APPLICATION; return VAL_FIELD;}
225 APP                     {yylval.field =APPLICATION; return VAL_FIELD;}
226 DIP                     {yylval.field = DIP_ANY; return VAL_FIELD;}
227 dip                     {yylval.field = DIP_ANY; return VAL_FIELD;}
228 DIP_INT                 {yylval.field = DIP_INT; return VAL_FIELD;}
229 DIPINT                  {yylval.field = DIP_INT; return VAL_FIELD;}
230 dipint                  {yylval.field = DIP_INT; return VAL_FIELD;}
231 DIP_V4                  {yylval.field = DIP_V4; return VAL_FIELD;}
232 DIP{ws}V4               {yylval.field = DIP_V4; return VAL_FIELD;}
233 DPORT                   {yylval.field = DPORT; return VAL_FIELD;}
234 dport                   {yylval.field = DPORT; return VAL_FIELD;}
235 ANY_IP                  {yylval.field = ANY_IP; return VAL_FIELD;}
236 ANY_IP6                 {yylval.field = ANY_IP6; return VAL_FIELD;}
237 IP                      {yylval.field = ANY_IP; return VAL_FIELD;}
238 ANY_PORT                {yylval.field = ANY_PORT; return VAL_FIELD;}
239 ANY{ws}PORT             {yylval.field = ANY_PORT; return VAL_FIELD;}
240 PROTOCOL                {yylval.field = PROTOCOL; return VAL_FIELD;}
241 protocol                {yylval.field = PROTOCOL; return VAL_FIELD;}
242 proto                   {yylval.field = PROTOCOL; return VAL_FIELD;}
243 SPORT                   {yylval.field = SPORT; return VAL_FIELD;}
244 sport                   {yylval.field = SPORT; return VAL_FIELD;}
245 SIP_V4                  {yylval.field = SIP_V4; return VAL_FIELD;}
246 SIP{ws}V4               {yylval.field = SIP_V4; return VAL_FIELD;}
247 SIP                     {yylval.field = SIP_ANY; return VAL_FIELD;}
248 sip                     {yylval.field = SIP_ANY; return VAL_FIELD;}
249 SIP_INT                 {yylval.field = SIP_INT; return VAL_FIELD;}
250 SIPINT                  {yylval.field = SIP_INT; return VAL_FIELD;}
251 sipint                  {yylval.field = SIP_INT; return VAL_FIELD;}
252 SIP_V6                  {yylval.field = SIP_V6; return VAL_FIELD;}
253 SIP{ws}V6               {yylval.field = SIP_V6; return VAL_FIELD;}
254 DIP_V6                  {yylval.field = DIP_V6; return VAL_FIELD;}
255 DIP{ws}V6               {yylval.field = DIP_V6; return VAL_FIELD;}
256 VERSION                 {yylval.field = IPVERSION; return VAL_FIELD;}
257 VLAN                    {yylval.field = VLAN; return VAL_FIELD;}
258 vlan                    {yylval.field = VLAN; return VAL_FIELD;}
259 VLANINT                 {yylval.field = VLANINT; return VAL_FIELD;}
260 vlanint                 {yylval.field = VLANINT; return VAL_FIELD;}
261 OBDOMAIN                {yylval.field = OBDOMAIN; return VAL_FIELD;}
262 obdomain                {yylval.field = OBDOMAIN; return VAL_FIELD;}
263 INGRESS                 {yylval.field = INGRESS; return VAL_FIELD;}
264 ingress                 {yylval.field = INGRESS; return VAL_FIELD;}
265 EGRESS                  {yylval.field = EGRESS; return VAL_FIELD;}
266 egress                  {yylval.field = EGRESS; return VAL_FIELD;}
267 DOMAIN                  {yylval.field = OBDOMAIN; return VAL_FIELD;}
268 domain                  {yylval.field = OBDOMAIN; return VAL_FIELD;}
269 DURATION                {yylval.field = DURATION; return VAL_FIELD;}
270 duration                {yylval.field = DURATION; return VAL_FIELD;}
271 dur                     {yylval.field = DURATION; return VAL_FIELD;}
272 STIME                   {yylval.field = STIME; return VAL_FIELD;}
273 stime                   {yylval.field = STIME; return VAL_FIELD;}
274 STIMEMS                 {yylval.field = STIMEMS; return VAL_FIELD;}
275 stimems                 {yylval.field = STIMEMS; return VAL_FIELD;}
276 ETIME                   {yylval.field = ENDTIME; return VAL_FIELD;}
277 etime                   {yylval.field = ENDTIME; return VAL_FIELD;}
278 ETIMEMS                 {yylval.field = ETIMEMS; return VAL_FIELD;}
279 etimems                 {yylval.field = ETIMEMS; return VAL_FIELD;}
280 RTT                     {yylval.field = RTT; return VAL_FIELD;}
281 rtt                     {yylval.field = RTT; return VAL_FIELD;}
282 PKTS                    {yylval.field = PKTS; return VAL_FIELD;}
283 pkts                    {yylval.field = PKTS; return VAL_FIELD;}
284 PACKETS                 {yylval.field = PKTS; return VAL_FIELD;}
285 packets                 {yylval.field = PKTS; return VAL_FIELD;}
286 RPKTS                   {yylval.field = RPKTS; return VAL_FIELD;}
287 rpkts                   {yylval.field = RPKTS; return VAL_FIELD;}
288 RPACKETS                {yylval.field = RPKTS; return VAL_FIELD;}
289 rpackets                {yylval.field = RPKTS; return VAL_FIELD;}
290 BYTES                   {yylval.field = BYTES; return VAL_FIELD;}
291 bytes                   {yylval.field = BYTES; return VAL_FIELD;}
292 RBYTES                  {yylval.field = RBYTES; return VAL_FIELD;}
293 rbytes                  {yylval.field = RBYTES; return VAL_FIELD;}
294 IFLAGS                  {yylval.field = IFLAGS; return VAL_FIELD;}
295 iflags                  {yylval.field = IFLAGS; return VAL_FIELD;}
296 RIFLAGS                 {yylval.field = RIFLAGS; return VAL_FIELD;}
297 riflags                 {yylval.field = RIFLAGS; return VAL_FIELD;}
298 UFLAGS                  {yylval.field = UFLAGS; return VAL_FIELD;}
299 uflags                  {yylval.field = UFLAGS; return VAL_FIELD;}
300 RUFLAGS                 {yylval.field = RUFLAGS; return VAL_FIELD;}
301 ruflags                 {yylval.field = RUFLAGS; return VAL_FIELD;}
302 ATTRIBUTES              {yylval.field = ATTRIBUTES; return VAL_FIELD;}
303 attributes              {yylval.field = ATTRIBUTES; return VAL_FIELD;}
304 RATTRIBUTES             {yylval.field = RATTRIBUTES; return VAL_FIELD;}
305 rattributes             {yylval.field = RATTRIBUTES; return VAL_FIELD;}
306 MAC                     {yylval.field = MAC; return VAL_FIELD;}
307 mac                     {yylval.field = MAC; return VAL_FIELD;}
308 DSTMAC                  {yylval.field = DSTMAC; return VAL_FIELD;}
309 dstmac                  {yylval.field = DSTMAC; return VAL_FIELD;}
310 TCPSEQ                  {yylval.field = TCPSEQ; return VAL_FIELD;}
311 tcpseq                  {yylval.field = TCPSEQ; return VAL_FIELD;}
312 RTCPSEQ                 {yylval.field = RTCPSEQ; return VAL_FIELD;}
313 rtcpseq                 {yylval.field = RTCPSEQ; return VAL_FIELD;}
314 ENTROPY                 {yylval.field = ENTROPY; return VAL_FIELD;}
315 entropy                 {yylval.field = ENTROPY; return VAL_FIELD;}
316 RENTROPY                {yylval.field = RENTROPY; return VAL_FIELD;}
317 rentropy                {yylval.field = RENTROPY; return VAL_FIELD;}
318 ENDREASON               {yylval.field = END; return VAL_FIELD;}
319 endreason               {yylval.field = END; return VAL_FIELD;}
320 OSNAME                  {yylval.field = OSNAME; return VAL_FIELD;}
321 osname                  {yylval.field = OSNAME; return VAL_FIELD;}
322 OSVERSION               {yylval.field = OSVERSION; return VAL_FIELD;}
323 osversion               {yylval.field = OSVERSION; return VAL_FIELD;}
324 ROSNAME                 {yylval.field = ROSNAME; return VAL_FIELD;}
325 rosname                 {yylval.field = ROSNAME; return VAL_FIELD;}
326 ROSVERSION              {yylval.field = ROSVERSION; return VAL_FIELD;}
327 rosversion              {yylval.field = ROSVERSION; return VAL_FIELD;}
328 FINGERPRINT             {yylval.field = FINGERPRINT; return VAL_FIELD;}
329 fingerprint             {yylval.field = FINGERPRINT; return VAL_FIELD;}
330 RFINGERPRINT            {yylval.field = RFINGERPRINT; return VAL_FIELD;}
331 rfingerprint            {yylval.field = RFINGERPRINT; return VAL_FIELD;}
332 OSFINGERPRINT           {yylval.field = FINGERPRINT; return VAL_FIELD;}
333 osfingerprint           {yylval.field = FINGERPRINT; return VAL_FIELD;}
334 ROSFINGERPRINT          {yylval.field = RFINGERPRINT; return VAL_FIELD;}
335 rosfingerprint          {yylval.field = RFINGERPRINT; return VAL_FIELD;}
336 DHCPFP                  {yylval.field = DHCPFP; return VAL_FIELD;}
337 dhcpfp                  {yylval.field = DHCPFP; return VAL_FIELD;}
338 DHCPVC                  {yylval.field = DHCPVC; return VAL_FIELD;}
339 dhcpvc                  {yylval.field = DHCPVC; return VAL_FIELD;}
340 RDHCPFP                 {yylval.field = RDHCPFP; return VAL_FIELD;}
341 rdhcpfp                 {yylval.field = RDHCPFP; return VAL_FIELD;}
342 RDHCPVC                 {yylval.field = RDHCPVC; return VAL_FIELD;}
343 rdhcpvc                 {yylval.field = RDHCPVC; return VAL_FIELD;}
344 DHCPOPTIONS             {yylval.field = DHCPOPTIONS; return VAL_FIELD;}
345 dhcpoptions             {yylval.field = DHCPOPTIONS; return VAL_FIELD;}
346 DHCPOPTION              {yylval.field = DHCPOPTIONS; return VAL_FIELD;}
347 dhcpoption              {yylval.field = DHCPOPTIONS; return VAL_FIELD;}
348 RDHCPOPTIONS            {yylval.field = RDHCPOPTIONS; return VAL_FIELD;}
349 rdhcpoptions            {yylval.field = RDHCPOPTIONS; return VAL_FIELD;}
350 rdhcpoption             {yylval.field = RDHCPOPTIONS; return VAL_FIELD;}
351 RDHCPOPTION             {yylval.field = RDHCPOPTIONS; return VAL_FIELD;}
352 DATABYTES               {yylval.field = DATABYTES; return VAL_FIELD;}
353 databytes               {yylval.field = DATABYTES; return VAL_FIELD;}
354 RDATABYTES              {yylval.field = RDATABYTES; return VAL_FIELD;}
355 rdatabytes              {yylval.field = RDATABYTES; return VAL_FIELD;}
356 ITIME                   {yylval.field = ITIME; return VAL_FIELD;}
357 itime                   {yylval.field = ITIME; return VAL_FIELD;}
358 RITIME                  {yylval.field = RITIME; return VAL_FIELD;}
359 ritime                  {yylval.field = RITIME; return VAL_FIELD;}
360 STDITIME                {yylval.field = STDITIME; return VAL_FIELD;}
361 stditime                {yylval.field = STDITIME; return VAL_FIELD;}
362 RSTDITIME               {yylval.field = RSTDITIME; return VAL_FIELD;}
363 rstditime               {yylval.field = RSTDITIME; return VAL_FIELD;}
364 TCPURG                  {yylval.field = TCPURG; return VAL_FIELD;}
365 tcpurg                  {yylval.field = TCPURG; return VAL_FIELD;}
366 RTCPURG                 {yylval.field = RTCPURG; return VAL_FIELD;}
367 rtcpurg                 {yylval.field = RTCPURG; return VAL_FIELD;}
368 SMALLPKTS               {yylval.field = SMALLPKTS; return VAL_FIELD;}
369 smallpkts               {yylval.field = SMALLPKTS; return VAL_FIELD;}
370 RSMALLPKTS              {yylval.field = RSMALLPKTS; return VAL_FIELD;}
371 rsmallpkts              {yylval.field = RSMALLPKTS; return VAL_FIELD;}
372 LARGEPKTS               {yylval.field = LARGEPKTS; return VAL_FIELD;}
373 largepkts               {yylval.field = LARGEPKTS; return VAL_FIELD;}
374 RLARGEPKTS              {yylval.field = RLARGEPKTS; return VAL_FIELD;}
375 rlargepkts              {yylval.field = RLARGEPKTS; return VAL_FIELD;}
376 NONEMPTYPKTS            {yylval.field = NONEMPTYPKTS; return VAL_FIELD;}
377 nonemptypkts            {yylval.field = NONEMPTYPKTS; return VAL_FIELD;}
378 RNONEMPTYPKTS           {yylval.field = RNONEMPTYPKTS; return VAL_FIELD;}
379 rnonemptypkts           {yylval.field = RNONEMPTYPKTS; return VAL_FIELD;}
380 FIRSTNONEMPTY           {yylval.field = FIRSTNONEMPTY; return VAL_FIELD;}
381 firstnonempty           {yylval.field = FIRSTNONEMPTY; return VAL_FIELD;}
382 RFIRSTNONEMPTY          {yylval.field = RFIRSTNONEMPTY; return VAL_FIELD;}
383 rfirstnonempty          {yylval.field = RFIRSTNONEMPTY; return VAL_FIELD;}
384 MAXSIZE                 {yylval.field = MAXSIZE; return VAL_FIELD;}
385 maxsize                 {yylval.field = MAXSIZE; return VAL_FIELD;}
386 RMAXSIZE                {yylval.field = RMAXSIZE; return VAL_FIELD;}
387 rmaxsize                {yylval.field = RMAXSIZE; return VAL_FIELD;}
388 STDPAYLEN               {yylval.field = STDPAYLEN; return VAL_FIELD;}
389 stdpaylen               {yylval.field = STDPAYLEN; return VAL_FIELD;}
390 RSTDPAYLEN              {yylval.field = RSTDPAYLEN; return VAL_FIELD;}
391 rstdpaylen              {yylval.field = RSTDPAYLEN; return VAL_FIELD;}
392 FIRSTEIGHT              {yylval.field = FIRSTEIGHT; return VAL_FIELD;}
393 firsteight              {yylval.field = FIRSTEIGHT; return VAL_FIELD;}
394 FLOWKEYHASH             {yylval.field = FLOWKEYHASH; return VAL_FIELD;}
395 flowkeyhash             {yylval.field = FLOWKEYHASH; return VAL_FIELD;}
396 HASH                    {yylval.field = FLOWKEYHASH; return VAL_FIELD;}
397 hash                    {yylval.field = FLOWKEYHASH; return VAL_FIELD;}
398 DPI                     {yylval.field = DPI; return VAL_FIELD;}
399 dpi                     {yylval.field = DPI; return VAL_FIELD;}
400 TOS                     {yylval.field = TOS; return VAL_FIELD;}
401 tos                     {yylval.field = TOS; return VAL_FIELD;}
402 RTOS                    {yylval.field = RTOS; return VAL_FIELD;}
403 rtos                    {yylval.field = RTOS; return VAL_FIELD;}
404 MPLS1                   {yylval.field = MPLS1; return VAL_FIELD;}
405 MPLS2                   {yylval.field = MPLS2; return VAL_FIELD;}
406 MPLS3                   {yylval.field = MPLS3; return VAL_FIELD;}
407 mpls1                   {yylval.field = MPLS1; return VAL_FIELD;}
408 mpls2                   {yylval.field = MPLS2; return VAL_FIELD;}
409 mpls3                   {yylval.field = MPLS3; return VAL_FIELD;}
410 collector               {yylval.field = COLLECTOR; return VAL_FIELD;}
411 MPTCPSEQ                {yylval.field = MPTCPSEQ; return VAL_FIELD;}
412 mptcpseq                {yylval.field = MPTCPSEQ; return VAL_FIELD;}
413 MPTCPTOKEN              {yylval.field = MPTCPTOKEN; return VAL_FIELD;}
414 mptcptoken              {yylval.field = MPTCPTOKEN; return VAL_FIELD;}
415 MPTCPMSS                {yylval.field = MPTCPMSS; return VAL_FIELD;}
416 mptcpmss                {yylval.field = MPTCPMSS; return VAL_FIELD;}
417 MPTCPID                 {yylval.field = MPTCPID; return VAL_FIELD;}
418 mptcpid                 {yylval.field = MPTCPID; return VAL_FIELD;}
419 MPTCPFLAGS              {yylval.field = MPTCPFLAGS; return VAL_FIELD;}
420 mptcpflags              {yylval.field = MPTCPFLAGS; return VAL_FIELD;}
421 PAYLOAD                 {yylval.field = PAYLOAD; return VAL_FIELD;}
422 payload                 {yylval.field = PAYLOAD; return VAL_FIELD;}
423 RPAYLOAD                {yylval.field = RPAYLOAD; return VAL_FIELD;}
424 rpayload                {yylval.field = RPAYLOAD; return VAL_FIELD;}
425 "=="                    {yylval.oper = EQUAL; return VAL_OPER;}
426 "!="                    {yylval.oper = NOT_EQUAL; return VAL_OPER;}
427 "<"                     {yylval.oper = LESS_THAN; return VAL_OPER;}
428 "<="                    {yylval.oper = LESS_THAN_OR_EQUAL; return VAL_OPER;}
429 ">"                     {yylval.oper = GREATER_THAN; return VAL_OPER;}
430 ">="                    {yylval.oper = GREATER_THAN_OR_EQUAL; return VAL_OPER;}
431 IN_LIST                 {yylval.oper = IN_LIST; return VAL_OPER;}
432 NOT_IN_LIST             {yylval.oper = NOT_IN_LIST; return VAL_OPER;}
433 MAX_HIT_COUNT           {return TOK_MAX_HIT;}
434 MAX{ws}HIT{ws}COUNT     {return TOK_MAX_HIT;}
435 FLUSH_TIME              {return TOK_FLUSH_SECS;}
436 FLUSH{ws}TIME           {return TOK_FLUSH_SECS;}
437 FLUSH_TIMEOUT           {return TOK_FLUSH_SECS;}
438 BASE64_ENCODE           {return TOK_BASE_64;}
439 BASE64{ws}ENCODE        {return TOK_BASE_64;}
440 LAST_SEEN               {return TOK_LAST_SEEN;}
441 LAST{ws}SEEN            {return TOK_LAST_SEEN;}
442 DEBUG                   {yylval.log_level = MD_DEBUG; return VAL_LOGLEVEL;}
443 MESSAGE                 {yylval.log_level = MESSAGE; return VAL_LOGLEVEL;}
444 QUIET                   {yylval.log_level = QUIET; return VAL_LOGLEVEL;}
445 WARNING                 {yylval.log_level = WARNING; return VAL_LOGLEVEL;}
446 ERROR                   {yylval.log_level = ERROR; return VAL_LOGLEVEL;}
447 LOGLEVEL                {return TOK_LOG_LEVEL;}
448 LOG{ws}LEVEL            {return TOK_LOG_LEVEL;}
449 LOG_LEVEL               {return TOK_LOG_LEVEL;}
450 PIDFILE                 {return TOK_PID_FILE;}
451 PID{ws}FILE             {return TOK_PID_FILE;}
452 REMOVE_EMPTY_FILES      {return TOK_RM_EMPTY;}
453 REMOVE{ws}EMPTY{ws}FILES {return TOK_RM_EMPTY;}
454 AND_FILTER              {return TOK_AND_FILTER;}
455 AND_FILTERS             {return TOK_AND_FILTER;}
456 AND{ws}FILTERS          {return TOK_AND_FILTER;}
457 AND{ws}FILTER           {return TOK_AND_FILTER;}
458 MYSQL_USER              {return TOK_MY_USER;}
459 MYSQL{ws}USER           {return TOK_MY_USER;}
460 MYSQL_PASSWORD          {return TOK_MY_PW;}
461 MYSQL{ws}PASSWORD       {return TOK_MY_PW;}
462 MYSQL_PASS              {return TOK_MY_PW;}
463 MYSQL_DATABASE          {return TOK_MY_DB;}
464 MYSQL{ws}DATABASE       {return TOK_MY_DB;}
465 MYSQL_DB                {return TOK_MY_DB;}
466 MYSQL_HOST              {return TOK_MY_HOST;}
467 MYSQL{ws}HOST           {return TOK_MY_HOST;}
468 MYSQL_TABLE             {return TOK_MY_TABLE;}
469 MYSQL{ws}TABLE          {return TOK_MY_TABLE;}
470 REMOVE_UPLOADED         {return TOK_MY_REMOVE;}
471 REMOVE{ws}UPLOADED      {return TOK_MY_REMOVE;}
472 ESCAPE_CHARS            {return TOK_ESCAPE;}
473 ESCAPE{ws}CHARS         {return TOK_ESCAPE;}
474 ESCAPE_CHARACTERS       {return TOK_ESCAPE;}
475 ESCAPE{ws}CHARACTERS    {return TOK_ESCAPE;}
476 ESCAPE                  {return TOK_ESCAPE;}
477 RECORDS                 {return TOK_RECORDS;}
478 GZIP_FILES              {return TOK_GZIP;}
479 GZIP{ws}FILES           {return TOK_GZIP;}
480 GZIP                    {return TOK_GZIP;}
481 VLAN_MAP                {return TOK_VLAN_MAP;}
482 VLAN{ws}MAP             {return TOK_VLAN_MAP;}
483 OBID_MAP                {return TOK_OBID_MAP;}
484 OBID{ws}MAP             {return TOK_OBID_MAP;}
485 MAP                     {return TOK_MAP;}
486 DISCARD_OTHER           {return TOK_DISCARD;}
487 DISCARD{ws}OTHER        {return TOK_DISCARD;}
488 DISCARD                 {return TOK_DISCARD;}
489 ADD_EXPORTER_NAME       {return TOK_ADD_EXPORT;}
490 ADD{ws}EXPORTER{ws}NAME {return TOK_ADD_EXPORT;}
491 ADD_EXPORTER            {return TOK_ADD_EXPORT;}
492 ADD{ws}EXPORTER         {return TOK_ADD_EXPORT;}
493 ADD_EXPORT              {return TOK_ADD_EXPORT;}
494 ADD_EXPORT_NAME         {return TOK_ADD_EXPORT;}
495 NDPI_MASTER             {yylval.field = NDPI_MASTER; return VAL_FIELD;}
496 ndpi_master             {yylval.field = NDPI_MASTER; return VAL_FIELD;}
497 NDPI_SUB                {yylval.field = NDPI_SUB; return VAL_FIELD;}
498 ndpi_sub                {yylval.field = NDPI_SUB; return VAL_FIELD;}
499 METADATA_EXPORT         {return TOK_METADATA_EXPORT;}
500 
501 {ip}                    {yylval.str = strdup(yytext); return VAL_IP;}
502 
503 {number}"."{number}     {yylval.str = strdup(yytext); return VAL_DOUBLE;}
504 "."{number}             {yylval.str = strdup(yytext); return VAL_DOUBLE;}
505 {number}"."             {yylval.str = strdup(yytext); return VAL_DOUBLE;}
506 {number}"."{number}{exponent}  {yylval.str = strdup(yytext);return VAL_DOUBLE;}
507 "."{number}{exponent}   {yylval.str = strdup(yytext); return VAL_DOUBLE;}
508 {number}"."{exponent}   {yylval.str = strdup(yytext); return VAL_DOUBLE;}
509 
510 {number}                {yylval.str = strdup(yytext); return VAL_INTEGER;}
511 
512 {atom}                  {yylval.str = strdup(yytext); return VAL_ATOM;}
513 
514 \"                     {BEGIN(ST_STRING); pipeconf_buf_ptr = pipeconf_buf;}
515 
516 <ST_STRING>\\n         {*pipeconf_buf_ptr++ = '\n'; STRING_CHECK;}
517 <ST_STRING>\\t         {*pipeconf_buf_ptr++ = '\t'; STRING_CHECK;}
518 <ST_STRING>\\r         {*pipeconf_buf_ptr++ = '\r'; STRING_CHECK;}
519 <ST_STRING>\\b         {*pipeconf_buf_ptr++ = '\b'; STRING_CHECK;}
520 <ST_STRING>\\f         {*pipeconf_buf_ptr++ = '\f'; STRING_CHECK;}
521 <ST_STRING>\\\n        {*pipeconf_buf_ptr++ = '\n'; STRING_CHECK;}
522 <ST_STRING>\\.         {*pipeconf_buf_ptr++ = yytext[1]; STRING_CHECK;}
523 
524 <ST_STRING>[^\\\n\"]+  {if ((pipeconf_buf_ptr + yyleng) < pipeconf_buf_end ) {
525                             memcpy(pipeconf_buf_ptr, yytext, yyleng);
526                             pipeconf_buf_ptr += yyleng;
527                         } else {
528                             memcpy(pipeconf_buf_ptr, yytext,
529                                    pipeconf_buf_end - pipeconf_buf_ptr);
530                             *pipeconf_buf_end = '\0';
531                             printf("String too long");
532                             BEGIN(ST_STRING_ERR);
533                         } }
534 
535 <ST_STRING>\n          {BEGIN(INITIAL);
536                         yyless(0);
537                         printf("String missing closing \"");
538                         *pipeconf_buf_ptr = '\0';
539                         yylval.str = strdup(pipeconf_buf);
540                         return VAL_QSTRING; }
541 
542 <ST_STRING>\"          {BEGIN(INITIAL);
543                         *pipeconf_buf_ptr = '\0';
544                         yylval.str = strdup(pipeconf_buf);
545                         return VAL_QSTRING; }
546 
547     /* ST_STRING_ERR state: Entered when a string is too long.
548      * Accepts everything up to closing quote or the end of the
549      * line. */
550 
551 <ST_STRING_ERR>[^\\\n\"]+  ;
552 <ST_STRING_ERR>\\.         ;
553 <ST_STRING_ERR>\"      {BEGIN(INITIAL);
554                         yylval.str = strdup(pipeconf_buf);
555                         return VAL_QSTRING; }
556 <ST_STRING_ERR>\n      {BEGIN(INITIAL);
557                         yyless(0);
558                         printf("String missing closing \"");
559                         yylval.str = strdup(pipeconf_buf);
560                         return VAL_QSTRING; }
561 
562     /* Handle unknown keyword */
563 
564 .                           {yyless(0); BEGIN(ST_TOKEN_ERR);}
565 
566 <ST_TOKEN_ERR>[^ \t\r\n]+   {printf("Unrecognized token '%s'", yytext);
567                              BEGIN(INITIAL); }
568 
569 
570 %%
571 int yywrap(void) {
572     return 1;
573 }
574 
575 int mediator_config_error(const char *fmt)
576 {
577     lineNumber--;
578     mediatorconf_errors++;
579     printf("Error on line: %d\n", lineNumber);
580     printf("Error: %s\n", fmt);
581     exit(-1);
582     return 0;
583 }
584