cisco_acl_intp 0.0.1

data/lib/cisco_acl_intp/parser.ry

@@ -0,0 +1,1397 @@
+# -*- coding: utf-8 -*-
+
+# cisco IOS access list parser
+class Parser
+
+start expr
+
+rule
+         expr: ipacl
+             | ipacl expr
+
+        ipacl: numbered_acl
+             | named_acl
+             | objgrp
+
+          eos: EOS
+                 {
+                   # end of line or "empty line"
+                   yyerrok
+                 }
+
+                 # standard access-list
+
+ numbered_acl: NUMD_STD_ACL std_acl eos
+                 {
+                   dputs "## numd std acl: #{val[0]}/#{val[1]}"
+                   @curr_acl_name = val[0]
+                   unless @acl_table[@curr_acl_name]
+                     @acl_table[@curr_acl_name] = NumberedStdAcl.new(@curr_acl_name)
+                     @line_number = 0
+                   end
+                   @acl_table[@curr_acl_name].add_entry(val[1])
+                   @line_number += 1
+                 }
+             | NUMD_EXT_ACL ext_acl eos
+                 {
+                   dputs "## numd ext acl: #{val[0]}/#{val[1]}"
+                   @curr_acl_name = val[0]
+                   unless @acl_table[@curr_acl_name]
+                     @acl_table[@curr_acl_name] = NumberedExtAcl.new(@curr_acl_name)
+                     @line_number = 0
+                   end
+                   @acl_table[@curr_acl_name].add_entry(val[1])
+                   @line_number += 1
+                 }
+             | error eos
+             | numbered_acl eos
+
+      std_acl: action ip_spec std_acl_log_spec
+                 {
+                   dputs "## std_acl: #{val[0]}/#{val[1]}/#{val[2]}"
+                   result = StandardAce.new(
+                     :action => val[0],
+                     :src => AceSrcDstSpec.new(:ip_spec => val[1]),
+                     :log => val[2]
+                     )
+                 }
+             | 'remark' STRING
+                 {
+                   dputs "## std_acl: remark/#{val[1]}"
+                   result = RemarkAce.new(val[1])
+                 }
+
+std_acl_log_spec:
+             | 'log' log_cookie
+                 {
+                   result = AceLogSpec.new(val[1])
+                 }
+
+                 # extended access-list
+
+      ext_acl: dynamic_spec ext_acl_body other_qualifier_list
+                 {
+                   ## NOT implemented yet:
+                   ##   dynamic_spec,
+                   ##   other_qualifier_list (partially implemented)
+                   dputs '## ext_acl'
+                   val[1].tcp_other_qualifiers = val[2]
+                   result = val[1]
+                 }
+             | 'remark' STRING
+                 {
+                   dputs "## ext_acl: remark/#{val[1]}"
+                   result = RemarkAce.new(val[1])
+                 }
+
+ ext_acl_body: action ip_proto ip_spec ip_spec
+                 {
+                   dputs "## ext_acl_body ip: #{val[0]}/#{val[1]}/#{val[2]}/#{val[3]}"
+                   result = ExtendedAce.new(
+                     :action => val[0],
+                     :protocol => val[1],
+                     :src => AceSrcDstSpec.new(:ip_spec => val[2]),
+                     :dst => AceSrcDstSpec.new(:ip_spec => val[3])
+                     )
+                 }
+             | action icmp_proto ip_spec ip_spec icmp_qualifier
+                 {
+                   result = ExtendedAce.new(
+                     :action => val[0],
+                     :protocol => val[1],
+                     :src => AceSrcDstSpec.new(:ip_spec => val[2]),
+                     :dst => AceSrcDstSpec.new(:ip_spec => val[3])
+                     ## TBD: icmp_qualifier: val[4]
+                     )
+                 }
+             | action tcp_proto tcp_srcdst_spec tcp_srcdst_spec tcp_flags_qualifier
+                 {
+                   result = ExtendedAce.new(
+                     :action => val[0],
+                     :protocol => val[1],
+                     :src => val[2],
+                     :dst => val[3],
+                     :tcp_flags_qualifier => val[4]
+                     )
+                 }
+             | action udp_proto udp_srcdst_spec udp_srcdst_spec
+                 {
+                   result = ExtendedAce.new(
+                     :action => val[0],
+                     :protocol => val[1],
+                     :src => val[2],
+                     :dst => val[3]
+                     )
+                 }
+             | action objgrp_service_spec objgrp_srcdst_spec objgrp_srcdst_spec
+                 {
+                   ## TBD: object group
+                 }
+
+                 # protocols
+
+     ip_proto: 'ahp'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 51
+                     )
+                 }
+             | 'eigrp'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 88
+                     )
+                 }
+             | 'esp'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 50
+                     )
+                 }
+             | 'gre'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 47
+                     )
+                 }
+             | 'igmp'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 2
+                     )
+                 }
+             | 'igrp'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 9
+                     )
+                 }
+             | 'ip'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0]
+                     )
+                 } # IS NOT 0! (no number)
+             | 'ipinip'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 94
+                     )
+                 }
+             | 'nos'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 4
+                     )
+                 }
+             | 'ospf'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 89
+                     )
+                 }
+             | 'pcp'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 108
+                     )
+                 }
+             | 'pim'
+                 {
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 103
+                     )
+                 }
+             | NUMBER # ip protocol number (0-255)
+                 {
+                   begin
+                     dputs "## ip_proto number: #{val[0]}"
+                     result = AceIpProtoSpec.new(
+                       :number => val[0].to_i
+                       )
+                   rescue => err
+                     yyerror_with err.message
+                   end
+                 }
+
+   icmp_proto: 'icmp'
+                 {
+                   dputs '## icmp_proto'
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 1
+                     )
+                 }
+
+    tcp_proto: 'tcp'
+                 {
+                   dputs '## tcp_proto'
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 6
+                     )
+                 }
+
+    udp_proto: 'udp'
+                 {
+                   dputs '## udp_proto'
+                   result = AceIpProtoSpec.new(
+                     :name => val[0], :number => 17
+                     )
+                 }
+
+tcp_srcdst_spec: objgrp_srcdst_spec tcp_port_spec
+                 {
+                   result = AceSrcDstSpec.new(
+                     :ip_spec => val[0],
+                     :port_spec => val[1]
+                     )
+                 }
+
+udp_srcdst_spec: objgrp_srcdst_spec udp_port_spec
+                 {
+                   result = AceSrcDstSpec.new(
+                     :ip_spec => val[0],
+                     :port_spec => val[1]
+                     )
+                 }
+
+                 # ip named access-list
+
+    named_acl: std_named_acl_header std_named_acl_entry_list
+             | ext_named_acl_header ext_named_acl_entry_list
+                 # Notice:
+                 # acl header でエラーがあると、そのあとのエントリ追加用のハコ(object)が
+                 # つくれないので、エラーリカバリしようがない。
+                 # acl_entry_list の中身については可能な範囲で parse して追加。
+
+std_named_acl_header: NAMED_ACL 'standard' STRING eos
+                 {
+                   dputs "## std named acl: #{val[2]}"
+                   @curr_acl_name = val[2]
+                   @acl_table[@curr_acl_name] = NamedStdAcl.new(@curr_acl_name)
+                   dputs "## make NamedStdAcl obj, name = #{ @curr_acl_name }"
+                 }
+
+std_named_acl_entry_list:
+             | std_named_acl_entry_list std_named_acl_entry
+                 {
+                   @acl_table[@curr_acl_name].add_entry(val[1])
+                   @line_number += 1
+                 }
+             | std_named_acl_entry_list error eos
+                 # when a line contains syntax error (error recovery)
+             | std_named_acl_entry_list eos
+                 # acl ends when empty-line "eos"
+
+std_named_acl_entry: seq_number std_acl eos
+                 {
+                   # std_acl returns StandardAce/RemarkAce object
+                   val[1].seq_number = val[0].to_i
+                   result = val[1]
+                 }
+
+ext_named_acl_header: NAMED_ACL 'extended' STRING eos
+                 {
+                   dputs "## ext named acl: #{val[2]}"
+                   @curr_acl_name = val[2]
+                   @acl_table[@curr_acl_name] = NamedExtAcl.new(@curr_acl_name)
+                   dputs "## make NamedExtAcl obj, name = #{ @curr_acl_name }"
+                 }
+
+ext_named_acl_entry_list:
+             | ext_named_acl_entry_list ext_named_acl_entry
+                 {
+                   @acl_table[@curr_acl_name].add_entry(val[1])
+                   @line_number += 1
+                 }
+             | ext_named_acl_entry_list error eos
+                 # when a line contains syntax error (error recovery)
+             | ext_named_acl_entry_list eos
+                 # acl ends when empty-line "eos"
+
+ext_named_acl_entry: seq_number ext_acl eos
+                 {
+                   # ext_acl returns ExtendedAce/RemarkAce object
+                   val[1].seq_number = val[0].to_i
+                   result = val[1]
+                 }
+             | seq_number 'evaluate' STRING eos
+                 {
+                   result = EvaluateAce.new(
+                     :number => val[0].to_i,
+                     :recursive_name => val[2]
+                     )
+                 }
+
+   seq_number:
+             | NUMBER # (1-2147483647)
+                 {
+                   result = val[0].to_i
+                 }
+
+                 # access-list common components
+
+       action: 'permit'
+                 {
+                   result = val[0]
+                 }
+             | 'deny'
+                 {
+                   result = val[0]
+                 }
+
+
+      ip_spec: 'host' IPV4_ADDR
+                 {
+                   begin
+                     dputs "## ip_spec host: #{val[0]}/#{val[1]}"
+                     result = AceIpSpec.new(
+                       :ipaddr => val[1], :wildcard => '0.0.0.0'
+                       )
+                   rescue => err
+                     yyerror_with err.message
+                   end
+                 }
+             | IPV4_ADDR IPV4_ADDR # ipaddr wildcard
+                 {
+                   begin
+                     dputs "## ip_spec #{val[0]}/#{val[1]}"
+                     result = AceIpSpec.new(
+                       :ipaddr => val[0], :wildcard => val[1]
+                       )
+                   rescue => err
+                     yyerror_with err.message
+                   end
+                 }
+             | 'any'
+                 {
+                   dputs "## ip_spec any: #{val[0]}"
+                   result = AceIpSpec.new(
+                     :ipaddr => '0.0.0.0', :wildcard => '255.255.255.255'
+                     )
+                 }
+
+ dynamic_spec:
+             | 'dynamic' STRING timeout_spec
+
+ timeout_spec:
+             | 'timeout' NUMBER
+
+                 # object-group
+
+                 ## TBD
+                 # object group syntax was not implemented
+                 # 'eos' termination
+
+       objgrp: objgrp_service
+             | objgrp_network
+
+objgrp_service_spec: 'object-group' STRING # service object group
+                 {
+                 }
+
+objgrp_srcdst_spec: objgrp_network_spec
+             | ip_spec
+                 {
+                   result = val[0]
+                 }
+
+objgrp_network_spec: 'object-group' STRING # network object group
+                 {
+                 }
+
+objgrp_network: objgrp_network_header objgrp_network_entry_list
+
+objgrp_network_header: 'object-group' 'network' STRING
+                 {
+                 }
+
+objgrp_network_entry_list:
+             | objgrp_network_entry_list objgrp_network_entry
+                 {
+                 }
+
+objgrp_network_entry: 'description' STRING
+                 {
+                 }
+             | 'host' IPV4_ADDR
+                 {
+                 }
+             | IPV4_ADDR IPV4_ADDR
+                 {
+                 }
+             | IPV4_ADDR '/' NUMBER # 0-32
+                 {
+                 }
+             | 'range' IPV4_ADDR IPV4_ADDR
+                 {
+                 }
+             | 'group-object' STRING # nested object-group
+                 {
+                 }
+
+objgrp_service: objgrp_service_header objgrp_service_entry_list
+
+objgrp_service_header: 'object-group' 'service' STRING
+                 {
+                 }
+
+objgrp_service_entry_list:
+             | objgrp_service_entry_list objgrp_service_entry
+                 {
+                 }
+
+objgrp_service_entry: 'description' STRING
+             | ip_proto
+                 {
+                 }
+             | icmp_proto icmp_qualifier
+                 {
+                 }
+             | tcp_proto objgrp_tcp_proto
+                 {
+                 }
+             | udp_proto objgrp_udp_proto
+                 {
+                 }
+             | 'tcp-udp' objgrp_tcpudp_proto
+                 {
+                 }
+             | 'group-object' STRING # nested object-group
+                 {
+                 }
+
+objgrp_tcp_proto: objgrp_tcp_proto_spec
+                 {
+                 }
+             | 'source' objgrp_tcp_proto_spec
+                 {
+                 }
+
+objgrp_tcp_proto_spec:
+             | unary_operator tcp_port_qualifier
+                 {
+                 }
+             | 'range' tcp_port_qualifier tcp_port_qualifier
+                 {
+                 }
+             | tcp_port_qualifier
+                 {
+                 }
+
+objgrp_udp_proto: objgrp_udp_proto_spec
+                 {
+                 }
+             | 'source' objgrp_udp_proto_spec
+                 {
+                 }
+
+objgrp_udp_proto_spec:
+             | unary_operator udp_port_qualifier
+                 {
+                 }
+             | 'range' udp_port_qualifier udp_port_qualifier
+                 {
+                 }
+             | udp_port_qualifier
+                 {
+                 }
+
+objgrp_tcpudp_proto: objgrp_tcpudp_proto_spec
+                 {
+                 }
+             | 'source' objgrp_tcpudp_proto_spec
+                 {
+                 }
+
+objgrp_tcpudp_proto_spec:
+             | unary_operator tcpudp_port_qualifier
+                 {
+                 }
+             | 'range' tcpudp_port_qualifier tcpudp_port_qualifier
+                 {
+                 }
+             | tcpudp_port_qualifier
+                 {
+                 }
+
+tcpudp_port_qualifier: NUMBER        # port number (0-65535)
+             | 'discard'
+             | 'domain'
+             | 'echo'
+             | 'pim-auto-rp'
+             | 'sunrpc'
+             | 'syslog'
+             | 'tacacs'
+             | 'talk'
+
+                 # icmp qualifier
+
+icmp_qualifier:
+             | 'administratively-prohibited'
+             | 'alternate-address'
+             | 'conversion-error'
+             | 'dod-host-prohibited'
+             | 'dod-net-prohibited'
+             | 'echo'
+             | 'echo-reply'
+             | 'general-parameter-problem'
+             | 'host-isolated'
+             | 'mobile-redirect'
+             | 'net-redirect'
+             | 'net-tos-redirect'
+             | 'net-unreachable'
+             | 'net-unknown'
+             | 'no-room-for-option'
+             | 'option-missing'
+             | 'packet-too-big'
+             | 'parameter-problem'
+             | 'port-unreachable'
+             | 'precedence-unreachable'
+             | 'protocol-unreachable'
+             | 'host-precedence-unreachable'
+             | 'host-redirect'
+             | 'host-tos-redirect'
+             | 'host-unknown'
+             | 'host-unreachable'
+             | 'information-reply'
+             | 'information-request'
+             | 'mask-reply'
+             | 'mask-request'
+             | 'reassembly-timeout'
+             | 'redirect'
+             | 'router-advertisement'
+             | 'router-solicitation'
+             | 'source-quench'
+             | 'source-route-failed'
+             | 'time-exceeded'
+             | 'timestamp-reply'
+             | 'timestamp-request'
+             | 'traceroute'
+             | 'ttl-exceeded'
+             | 'unreachable'
+             | icmp_numtype icmp_numcode
+
+ icmp_numtype: NUMBER # icmp message type (0-255)
+
+ icmp_numcode:
+             | NUMBER # icmp message code (0-255)
+
+
+
+                 # tcp/udp port spec
+
+tcp_port_spec:
+                 {
+                   # tcp any
+                   dputs '## tcp port any'
+                   result = AcePortSpec.new(:operator => 'any')
+                 }
+             | unary_operator tcp_port_qualifier
+                 {
+                   dputs "## tcp port spec: #{val[0]}/#{val[1]}"
+                   result = AcePortSpec.new(
+                     :operator => val[0],
+                     :port => val[1]
+                     )
+                 }
+             | 'range' tcp_port_qualifier tcp_port_qualifier
+                 {
+                   dputs "## tcp port spec: #{val[0]}/#{val[1]}/#{val[2]}"
+                   result = AcePortSpec.new(
+                     :operator => val[0],
+                     :begin_port => val[1],
+                     :end_port => val[2]
+                     )
+                 }
+
+udp_port_spec:
+                 {
+                   # udp any
+                   dputs '## udp port: any'
+                   result = AcePortSpec.new(:operator => 'any')
+                 }
+             | unary_operator udp_port_qualifier
+                 {
+                   dputs "## udp port spec: #{val[0]}/#{val[1]}"
+                   result = AcePortSpec.new(
+                     :operator => val[0],
+                     :port => val[1]
+                     )
+                 }
+             | 'range' udp_port_qualifier udp_port_qualifier
+                 {
+                   dputs "## udp port spec: #{val[0]}/#{val[1]}/#{val[2]}"
+                   result = AcePortSpec.new(
+                     :operator => val[0],
+                     :begin_port => val[1],
+                     :end_port => val[2]
+                     )
+                 }
+
+unary_operator: 'gt'
+             | 'lt'
+             | 'eq'
+             | 'neq'
+
+tcp_port_qualifier: NUMBER
+                 {
+                   begin
+                     # port number (0-65535)
+                     result = AceTcpProtoSpec.new(
+                       :number => val[0]
+                       )
+                   rescue => err
+                     yyerror_with err.message
+                   end
+                 }
+             | 'bgp'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 179
+                     )
+                 }
+             | 'chargen'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 19
+                     )
+                 }
+             | 'cmd'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 514
+                     )
+                 }
+             | 'daytime'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 13
+                     )
+                 }
+             | 'discard'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 9
+                     )
+                 }
+             | 'domain'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 53
+                     )
+                 }
+             | 'drip'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 3949
+                     )
+                 }
+             | 'echo'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 7
+                     )
+                 }
+             | 'exec'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 512
+                     )
+                 }
+             | 'finger'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 79
+                     )
+                 }
+             | 'ftp'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 21
+                     )
+                 }
+             | 'ftp-data'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 20
+                     )
+                 }
+             | 'gopher'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 70
+                     )
+                 }
+             | 'hostname'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 101
+                     )
+                 }
+             | 'ident'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 113
+                     )
+                 }
+             | 'irc'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 194
+                     )
+                 }
+             | 'klogin'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 543
+                     )
+                 }
+             | 'kshell'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 544
+                     )
+                 }
+             | 'login'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 513
+                     )
+                 }
+             | 'lpd'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 515
+                     )
+                 }
+             | 'nntp'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 119
+                     )
+                 }
+             | 'pim-auto-rp'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 496
+                     )
+                 }
+             | 'pop2'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 109
+                     )
+                 }
+             | 'pop3'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 110
+                     )
+                 }
+             | 'smtp'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 25
+                     )
+                 }
+             | 'sunrpc'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 111
+                     )
+                 }
+             | 'syslog'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 514
+                     )
+                 }
+             | 'tacacs'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 49
+                     )
+                 }
+             | 'talk'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 517
+                     )
+                 }
+             | 'telnet'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 23
+                     )
+                 }
+             | 'time'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 37
+                     )
+                 }
+             | 'uucp'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 540
+                     )
+                 }
+             | 'whois'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 43
+                     )
+                 }
+             | 'www'
+                 {
+                   result = AceTcpProtoSpec.new(
+                     :name => val[0], :number => 80
+                     )
+                 }
+
+udp_port_qualifier: NUMBER
+                 {
+                   # port number (0-65535)
+                   result = AceUdpProtoSpec.new(
+                     :number => val[0]
+                     )
+                 }
+             | 'biff'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 512
+                     )
+                 }
+             | 'bootpc'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 68
+                     )
+                 }
+             | 'bootps'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 67
+                     )
+                 }
+             | 'discard'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 9
+                     )
+                 }
+             | 'dnsix'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 195
+                     )
+                 }
+             | 'domain'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 53
+                     )
+                 }
+             | 'echo'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 7
+                     )
+                 }
+             | 'isakmp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 500
+                     )
+                 }
+             | 'mobile-ip'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 434
+                     )
+                 }
+             | 'nameserver'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 42
+                     )
+                 }
+             | 'netbios-dgm'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 138
+                     )
+                 }
+             | 'netbios-ns'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 137
+                     )
+                 }
+             | 'netbios-ss'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 139
+                     )
+                 }
+             | 'non500-isakmp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 4500
+                     )
+                 }
+             | 'ntp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 123
+                     )
+                 }
+             | 'pim-auto-rp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 496
+                     )
+                 }
+             | 'rip'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 520
+                     )
+                 }
+             | 'snmp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 161
+                     )
+                 }
+             | 'snmptrap'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 162
+                     )
+                 }
+             | 'sunrpc'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 111
+                     )
+                 }
+             | 'syslog'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 514
+                     )
+                 }
+             | 'tacacs'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 49
+                     )
+                 }
+             | 'talk'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 517
+                     )
+                 }
+             | 'tftp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 69
+                     )
+                 }
+             | 'time'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 37
+                     )
+                 }
+             | 'who'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 513
+                     )
+                 }
+             | 'xdmcp'
+                 {
+                   result = AceUdpProtoSpec.new(
+                     :name => val[0], :number => 177
+                     )
+                 }
+
+                 # tcp flags list
+
+tcp_flags_qualifier:
+             | tcp_flags_list
+             | 'match-all' pm_tcp_flags_list
+             | 'match-any' pm_tcp_flags_list
+
+tcp_flags_list: tcp_flags
+                 {
+                   list = AceTcpFlagList.new
+                   list.push(val[0])
+                   result = list
+                 }
+             | tcp_flags_list tcp_flags
+                 {
+                   val[0].push(val[1])
+                   result = val[0]
+                 }
+
+    tcp_flags: 'established'
+                 {
+                   dputs "## tcp_flags, established: #{val[0]}"
+                   result = AceTcpFlag.new(val[0])
+                 }
+             | 'ack'
+                 {
+                   result = AceTcpFlag.new(val[0])
+                 }
+             | 'syn'
+                 {
+                   result = AceTcpFlag.new(val[0])
+                 }
+             | 'fin'
+                 {
+                   result = AceTcpFlag.new(val[0])
+                 }
+             | 'psh'
+                 {
+                   result = AceTcpFlag.new(val[0])
+                 }
+             | 'urg'
+                 {
+                   result = AceTcpFlag.new(val[0])
+                 }
+             | 'rst'
+                 {
+                   result = AceTcpFlag.new(val[0])
+                 }
+
+pm_tcp_flags_list: pm_tcp_flags
+             | pm_tcp_flags_list pm_tcp_flags
+
+ pm_tcp_flags: '+ack'
+             | '-ack'
+             | '+syn'
+             | '-syn'
+             | '+fin'
+             | '-fin'
+             | '+psh'
+             | '-psh'
+             | '+urg'
+             | '-urg'
+             | '+rst'
+             | '-rst'
+
+                 # oether qualifier list
+
+other_qualifier_list:
+             | other_qualifier_list other_qualifier
+                 {
+                   dputs "## other qualifier list, #{val[0]}/#{val[1]}"
+                   if val[0]
+                     list = val[0]
+                   else
+                     list = AceOtherQualifierList.new
+                   end
+                   list.push(val[1])
+                   result = list
+                 }
+
+other_qualifier: dscp_rule
+             | 'fragments'
+             | logging
+                 {
+                   dputs "## other qualifier, logging, #{val[0]})"
+                   result = val[0]
+                 }
+             | tos_qualifier
+             | precedence_qualifier
+             | time_range_spec
+             | recursive_qualifier
+                 {
+                   result = val[0]
+                 }
+             | ttl_qualifier      # IOS 12.4
+             | option_qualifier   # IOS 12.3(4)T,12.2(25)S, IP Options
+
+    dscp_rule: 'dscp' dscp_spec
+                 ;
+
+    dscp_spec: NUMBER     # 0-63
+             | 'af11'     # 001010
+             | 'af12'     # 001100
+             | 'af13'     # 001110
+             | 'af21'     # 010010
+             | 'af22'     # 010100
+             | 'af23'     # 010110
+             | 'af31'     # 011010
+             | 'af32'     # 011100
+             | 'af33'     # 011110
+             | 'af41'     # 100010
+             | 'af42'     # 100100
+             | 'af43'     # 100110
+             | 'CS1'      # 001000
+             | 'CS2'      # 010000
+             | 'CS3'      # 011000
+             | 'CS4'      # 100000
+             | 'CS5'      # 101000
+             | 'CS6'      # 110000
+             | 'CS7'      # 111000
+             | 'default'  # 000000
+             | 'ef'       # 101110
+
+      logging: 'log-input' log_cookie
+                 {
+                   result = AceLogSpec.new(val[1], true)
+                 }
+             | 'log' log_cookie
+                 {
+                   result = AceLogSpec.new(val[1])
+                 }
+
+   log_cookie:
+             | STRING
+                 {
+                   result = val[0]
+                 }
+
+tos_qualifier: 'tos' tos_string
+             | 'tos' NUMBER
+
+   tos_string: 'max-reliability'
+             | 'max-throughput'
+             | 'min-delay'
+             | 'min-monetary-cost'
+             | 'normal'
+
+precedence_qualifier: 'precedence' precedence_string
+             | 'precedence' NUMBER # 0-7
+
+precedence_string: 'critical'   # 5
+             | 'flash'          # 3
+             | 'flash-override' # 4
+             | 'immediate'      # 2
+             | 'internet'       # 6
+             | 'network'        # 7
+             | 'priority'       # 1
+             | 'routine'        # 0
+
+time_range_spec: 'time-range' STRING
+
+recursive_qualifier: 'reflect' STRING timeout_spec
+                 {
+                   ## TBD: timeout_spec not implemented yet.
+                   result = AceRecursiveQualifier.new(val[1])
+                 }
+
+ttl_qualifier: 'ttl' unary_operator NUMBER # 0-255
+             | 'ttl' 'range' NUMBER NUMBER
+
+option_qualifier: 'option' option_spec
+
+  option_spec: 'add-ext'       # opt 147
+             | 'any-options'
+             | 'com-security'  # opt 134
+             | 'dps'           # opt 151
+             | 'encode'        # opt 15
+             | 'eool'          # opt 0
+             | 'ext-ip'        # opt 145
+             | 'ext-security'  # opt 133
+             | 'finn'          # opt 205
+             | 'imitd'         # opt 144
+             | 'lsr'           # opt 131
+             | 'mtup'          # opt 11
+             | 'mtur'          # opt 12
+             | 'no-op'         # opt 1
+             | 'nsapa'         # opt 150
+             | 'record-route'  # opt 7
+             | 'route-alert'   # opt 148
+             | 'sdb'           # opt 149
+             | 'security'      # opt 130
+             | 'ssr'           # opt 137
+             | 'stream-id'     # opt 136
+             | 'timestamp'     # opt 68
+             | 'traceroute'    # opt 82
+             | 'ump'           # opt 152
+             | 'visa'          # opt 142
+             | 'zsu'           # opt 10
+             | NUMBER          # ip options vlaue (0-255)
+
+---- header
+
+require 'term/ansicolor'
+require 'cisco_acl_intp/scanner'
+require 'cisco_acl_intp/acl'
+
+module CiscoAclIntp
+
+---- inner
+
+  # @return [Hash] ACL Table by ACL name key
+  attr_reader :acl_table, :error_count
+
+  # Constructor
+  # @param [Hash] opts Options
+  # @option [Boolean] :yydebug Enable Racc debug print.
+  #   (default: false)
+  # @option [Boolean] :debug Enable debug print.
+  #   (default: false)
+  # @option [Boolean] :color Enable Term ANSI Color.
+  #   (default: false)
+  # @option [Boolean] :silent Enable all parser syntax error
+  #   (default: false)
+  # @return [CiscoACLParser]
+  def initialize opts
+    @yydebug = opts[:yydebug] || false
+    @debug_print = opts[:debug] || false
+    @color_mode = opts[:color] || false
+    @silent_mode = @debug_print || opts[:silent] || false
+
+    if @color_mode
+      AclContainerBase.enable_color
+    else
+      AclContainerBase.disable_color
+    end
+
+    @acl_table = {}
+    @curr_acl_name = ''
+    @line_number = 0
+    @error_count = 0
+  end
+
+  # Scan ACL from file to parse
+  # @param [String] file File name
+  # @param [IO] file IO Object
+  # @return [Hash] ACL Table
+  def parse_file filename
+    begin
+      file = nil
+      case filename
+      when String
+        file = File.new(filename)
+      when IO, StringIO
+        file = filename
+      end
+
+      if file
+        scanner = Scanner.new
+        @queue = scanner.scan_file(file)
+        @error_count = 0 # reset error count
+        do_parse
+      else
+        @error_count = 1
+        fail AclError, "File: #{filename} not found."
+      end
+    rescue Racc::ParseError => err
+      eputs(
+        ["Parse aborted. Found syntax error:",
+          "  #{err.message}"
+        ].join("\n")
+        )
+    rescue AclArgumentError => err
+      eputs(
+        ["Parse aborted. Found acl argment error:",
+          "  #{err.message}",
+          "  #{err_pos_str}"
+        ].join("\n")
+        )
+    rescue AclError => err
+      eputs(
+        ["Parse aborted. Found acl error:",
+          "  #{err.message}"
+        ].join("\n")
+        )
+    rescue => err
+      eputs(
+        [ "Parse aborted. Found unknown error:",
+          "  #{err.message}"
+        ].join("\n")
+        )
+    end
+    @acl_table
+  end
+
+  # Syntax error handler
+  # @raise [Racc::ParseError]
+  def on_error tok, val, vstack
+    errstr = [
+      err_pos_str,
+      "near value: #{val}",
+      "(token: #{token_to_str(tok)})",
+    ].join(', ')
+
+    # raise Racc::ParseError, errstr
+    eputs errstr
+  end
+
+  # Parsed data contains error or not?
+  # @return [Boolean]
+  def contains_error?
+    @error_count > 0 ? true : false
+  end
+
+  private
+
+  # count syntax error
+  def count_error
+    @error_count = @error_count + 1
+  end
+
+  # print error message and enter error recovery mode
+  # @param [String] str Error message
+  def yyerror_with str
+    eputs [err_pos_str, str].join(', ')
+    yyerror
+  end
+
+  # normal err print
+  # @param [String] str Message string
+  def eputs str
+    count_error
+    puts c_err(str) unless @silent_mode
+  end
+
+  # debug print
+  # @param [String] str String to print
+  def dputs str
+    puts str if @debug_print
+  end
+
+  # Get next token
+  # @return [Array] Next token array
+  def next_token
+    @queue.shift
+  end
+
+  # Coloring error string
+  # @param [String] str Message string
+  # @return [String] Colored message string
+  def c_err str
+    if @color_mode
+      c = Term::ANSIColor
+      str = [c.red, c.bold, str, c.clear].join
+    end
+    str
+  end
+
+  # Generate error string
+  # @return [String] error position string
+  def err_pos_str
+    line_num = @acl_table[@curr_acl_name] ?
+    @acl_table[@curr_acl_name].length + 1 : ''
+    ["in acl: #{@curr_acl_name}",
+     "line: #{line_num}"
+    ].join(', ')
+  end
+
+---- footer
+
+end # module
+
+### Local variables:
+### mode: Racc
+### coding: utf-8-unix
+### indent-tabs-mode: nil
+### End: