Fix #560 - geo filter containing keywords

phaag · Aug 27, 2024 · ae52e09 · ae52e09
1 parent dfb736f
commit ae52e09
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 9 deletions.
diff --git a/src/libnfdump/filter/grammar.y b/src/libnfdump/filter/grammar.y
@@ -183,9 +183,10 @@ static int AddASList(direction_t direction, void *U64List);
 %token DURATION PPS BPS BPP FLAGS
 %token PROTO PORT AS IF VLAN MPLS MAC ICMP ICMPTYPE ICMPCODE
 %token PACKETS BYTES FLOWS ETHERTYPE
-%token MASK FLOWDIR TOS FWDSTAT LATENCY ASA ACL PAYLOAD GEO VRF
+%token MASK FLOWDIR TOS FWDSTAT LATENCY ASA ACL PAYLOAD VRF
 %token OBSERVATION PF
 %token <s> STRING
+%token <s> GEOSTRING
 %token <value> NUMBER
 %type <value> expr
 %type <param> dqual term comp
@@ -426,8 +427,8 @@ term:	ANY { /* this is an unconditionally true expression, as a filter applies i
 		$$.self = AddPayload($2, $3, $4); if ( $$.self < 0 ) YYABORT;
 	}
 
-	| dqual GEO STRING {
-		$$.self = AddGeo($1.direction, $3); if ( $$.self < 0 ) YYABORT;
+	| dqual GEOSTRING {
+		$$.self = AddGeo($1.direction, $2); if ( $$.self < 0 ) YYABORT;
 	}
 
 	| OBSERVATION STRING STRING comp NUMBER {
@@ -1352,6 +1353,7 @@ static int AddPayload(char *type, char *arg, char *opt) {
 
 static int AddGeo(direction_t direction, char *geo) {
 
+	geo += 4;
 	if ( strlen(geo) != 2 ) {
 			yyprintf("Unknown Geo country: %s. Need a two letter country code.", geo);
 			return -1;

diff --git a/src/libnfdump/filter/scanner.l b/src/libnfdump/filter/scanner.l
@@ -152,11 +152,11 @@ not|"!"		{ return NOT; }
 "<"			  { return LT;  }
 ">="			{ return GE;  }
 "<="			{ return LE;  }
-"eq"			{ return EQ;  }
-"gt"		  { return GT;  }
-"lt"		  { return LT;  }
-"ge"			{ return GE;  }
-"le"			{ return LE;  }
+"eq"      { return EQ;  }
+"gt"      { return GT;  }
+"lt"      { return LT;  }
+"ge"      { return GE;  }
+"le"      { return LE;  }
 
 "engine"      { return ENGINE;     }
 "engine-type" { return ENGINETYPE; }
@@ -190,7 +190,6 @@ not|"!"		{ return NOT; }
 "asa"       { return ASA;     }
 "acl"       { return ACL;     }
 "payload"   { return PAYLOAD; }
-"geo"       { return GEO;			}
 "vrf"       { return VRF;			}
 "pf" 				{ return PF;			}
 
@@ -214,6 +213,10 @@ not|"!"		{ return NOT; }
                     yylval.s = stripQuotes(yytext);
                     return STRING;
                 }
+geo\ [a-zA-Z]{2}      { 
+                    yylval.s = stripQuotes(yytext);
+	                  return GEOSTRING;
+								}
 
 \n			{ lineno++; }
 .				{ return yytext[0]; }