* nftables: Dynamically updating sets gives syntax error
@ 2016-06-25 13:30 Anders K. Pedersen
2016-07-02 14:12 ` Anders K. Pedersen
0 siblings, 1 reply; 4+ messages in thread
From: Anders K. Pedersen @ 2016-06-25 13:30 UTC (permalink / raw)
To: netfilter
Hello,
With nftables 0.6 I'm getting a syntax error, when I try to use the
feature that was introduced by http://git.netfilter.org/nftables/commit
/?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example:
# nft filter input set add tcp dport @myset
<cmdline>:1:26-30: Error: syntax error, unexpected dport
filter input set add tcp dport @myset
^^^^^
# nft filter input set add ip saddr timeout 10s @myset
<cmdline>:1:25-29: Error: syntax error, unexpected saddr
filter input set add ip saddr timeout 10s @myset
^^^^^
# nft filter input set update ip saddr timeout 10s @myset
<cmdline>:1:28-32: Error: syntax error, unexpected saddr
filter input set update ip saddr timeout 10s @myset
^^^^^
Is there a new syntax for this or was it broken unintentionally?
Regards,
Anders K. Pedersen
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: nftables: Dynamically updating sets gives syntax error
2016-06-25 13:30 nftables: Dynamically updating sets gives syntax error Anders K. Pedersen
@ 2016-07-02 14:12 ` Anders K. Pedersen
2016-07-12 15:22 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Anders K. Pedersen @ 2016-07-02 14:12 UTC (permalink / raw)
To: netfilter, netfilter-devel, Pablo Neira Ayuso
Hello,
On lør, 2016-06-25 at 15:30 +0200, Anders K. Pedersen wrote:
> With nftables 0.6 I'm getting a syntax error, when I try to use the
> feature that was introduced
> by http://git.netfilter.org/nftables/commit
> /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example:
>
> # nft filter input set add tcp dport @myset
> <cmdline>:1:26-30: Error: syntax error, unexpected dport
> filter input set add tcp dport @myset
> ^^^^^
> # nft filter input set add ip saddr timeout 10s @myset
> <cmdline>:1:25-29: Error: syntax error, unexpected saddr
> filter input set add ip saddr timeout 10s @myset
> ^^^^^
> # nft filter input set update ip saddr timeout 10s @myset
> <cmdline>:1:28-32: Error: syntax error, unexpected saddr
> filter input set update ip saddr timeout 10s @myset
> ^^^^^
I did a git bisect on this and found that it was broken by
commit a3e60492a684be09374d0649735da42bdadc6b48
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sun Dec 27 22:15:17 2015 +0100
parser: restrict relational rhs expression recursion
After studying it a bit I reverted a part of it with the following
change, which made the commands above work again:
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -2054,7 +2054,7 @@ set_elem_option : TIMEOUT time_spec
}
;
-set_lhs_expr : concat_rhs_expr
+set_lhs_expr : concat_expr
| multiton_rhs_expr
;
The commit message indicated that it intended to handle rhs
expressions, but this is a lhs expression, so maybe this change was
unintended?
Regards,
Anders K. Pedersen
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: nftables: Dynamically updating sets gives syntax error
2016-07-02 14:12 ` Anders K. Pedersen
@ 2016-07-12 15:22 ` Pablo Neira Ayuso
2016-07-13 7:14 ` Anders K. Pedersen
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2016-07-12 15:22 UTC (permalink / raw)
To: Anders K. Pedersen; +Cc: netfilter, netfilter-devel
On Sat, Jul 02, 2016 at 04:12:56PM +0200, Anders K. Pedersen wrote:
> Hello,
>
> On lør, 2016-06-25 at 15:30 +0200, Anders K. Pedersen wrote:
> > With nftables 0.6 I'm getting a syntax error, when I try to use the
> > feature that was introduced
> > by http://git.netfilter.org/nftables/commit
> > /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example:
> >
> > # nft filter input set add tcp dport @myset
> > <cmdline>:1:26-30: Error: syntax error, unexpected dport
> > filter input set add tcp dport @myset
> > ^^^^^
> > # nft filter input set add ip saddr timeout 10s @myset
> > <cmdline>:1:25-29: Error: syntax error, unexpected saddr
> > filter input set add ip saddr timeout 10s @myset
> > ^^^^^
> > # nft filter input set update ip saddr timeout 10s @myset
> > <cmdline>:1:28-32: Error: syntax error, unexpected saddr
> > filter input set update ip saddr timeout 10s @myset
> > ^^^^^
>
> I did a git bisect on this and found that it was broken by
>
> commit a3e60492a684be09374d0649735da42bdadc6b48
> Author: Pablo Neira Ayuso <pablo@netfilter.org>
> Date: Sun Dec 27 22:15:17 2015 +0100
>
> parser: restrict relational rhs expression recursion
>
> After studying it a bit I reverted a part of it with the following
> change, which made the commands above work again:
>
> --- a/src/parser_bison.y
> +++ b/src/parser_bison.y
> @@ -2054,7 +2054,7 @@ set_elem_option : TIMEOUT time_spec
> }
> ;
>
> -set_lhs_expr : concat_rhs_expr
> +set_lhs_expr : concat_expr
> | multiton_rhs_expr
> ;
>
> The commit message indicated that it intended to handle rhs
> expressions, but this is a lhs expression, so maybe this change was
> unintended?
Thanks for reporting. This results however in shift/reduce conflicts
in the grammar, just sent patches to address this:
http://patchwork.ozlabs.org/patch/647448/
http://patchwork.ozlabs.org/patch/647447/
Please, test and let me know if this works for you. Thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: nftables: Dynamically updating sets gives syntax error
2016-07-12 15:22 ` Pablo Neira Ayuso
@ 2016-07-13 7:14 ` Anders K. Pedersen
0 siblings, 0 replies; 4+ messages in thread
From: Anders K. Pedersen @ 2016-07-13 7:14 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter, netfilter-devel
On tir, 2016-07-12 at 17:22 +0200, Pablo Neira Ayuso wrote:
> On Sat, Jul 02, 2016 at 04:12:56PM +0200, Anders K. Pedersen wrote:
> > Hello,
> >
> > On lør, 2016-06-25 at 15:30 +0200, Anders K. Pedersen wrote:
> > > With nftables 0.6 I'm getting a syntax error, when I try to use
> > > the
> > > feature that was introduced
> > > by http://git.netfilter.org/nftables/commit
> > > /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example:
> > >
> > > # nft filter input set add tcp dport @myset
> > > <cmdline>:1:26-30: Error: syntax error, unexpected dport
> > > filter input set add tcp dport @myset
> > > ^^^^^
> > > # nft filter input set add ip saddr timeout 10s @myset
> > > <cmdline>:1:25-29: Error: syntax error, unexpected saddr
> > > filter input set add ip saddr timeout 10s @myset
> > > ^^^^^
> > > # nft filter input set update ip saddr timeout 10s @myset
> > > <cmdline>:1:28-32: Error: syntax error, unexpected saddr
> > > filter input set update ip saddr timeout 10s @myset
> > > ^^^^^
> >
> > I did a git bisect on this and found that it was broken by
> >
> > commit a3e60492a684be09374d0649735da42bdadc6b48
> > Author: Pablo Neira Ayuso <pablo@netfilter.org>
> > Date: Sun Dec 27 22:15:17 2015 +0100
> >
> > parser: restrict relational rhs expression recursion
> >
> > After studying it a bit I reverted a part of it with the following
> > change, which made the commands above work again:
> >
> > --- a/src/parser_bison.y
> > +++ b/src/parser_bison.y
> > @@ -2054,7 +2054,7 @@ set_elem_option : TIMEO
> > UT time_spec
> > }
> > ;
> >
> > -set_lhs_expr : concat_rhs_expr
> > +set_lhs_expr : concat_expr
> > | multiton_rhs_expr
> > ;
> >
> > The commit message indicated that it intended to handle rhs
> > expressions, but this is a lhs expression, so maybe this change was
> > unintended?
>
> Thanks for reporting. This results however in shift/reduce conflicts
> in the grammar, just sent patches to address this:
>
> http://patchwork.ozlabs.org/patch/647448/
> http://patchwork.ozlabs.org/patch/647447/
>
> Please, test and let me know if this works for you. Thanks.
I applied these patches on top of current nftables git, and tested that
they solve the problem. Thanks for fixing this.
Regards,
Anders K. Pedersen
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-07-13 7:14 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-25 13:30 nftables: Dynamically updating sets gives syntax error Anders K. Pedersen
2016-07-02 14:12 ` Anders K. Pedersen
2016-07-12 15:22 ` Pablo Neira Ayuso
2016-07-13 7:14 ` Anders K. Pedersen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.