All of lore.kernel.org
 help / color / mirror / Atom feed
* nftables: Add anonymous set to named set
@ 2016-10-18 20:52 Leon Merten Lohse
  2016-10-20 15:11   ` Pablo Neira Ayuso
  0 siblings, 1 reply; 3+ messages in thread
From: Leon Merten Lohse @ 2016-10-18 20:52 UTC (permalink / raw)
  To: netfilter

Hi,

I am trying to add an anonymous set that is defined as a variable to a
named set as follows:

define whitelist_v4 = { 1.1.1.1}

table inet filter {
  set whitelist_v4 { type ipv4_addr; }
 
  [ ... ]
}

add element inet filter whitelist_v4 $whitelist_v4

This produces the error:

./testfw.ruleset:290:38-38: Error: syntax error, unexpected '$',
expecting '{' add element inet filter whitelist_v4 $whitelist_v4
                                     ^
If I use curly braces instead, there is no error but a failed assertion:
add element inet filter whitelist_v4 {$whitelist_v4}

produces

BUG: invalid data expression type set
nft: netlink.c:337: netlink_gen_data: Assertion `0' failed.

What is the correct way to use this?

Note: Direct definition as `elements = ...` shows the same behaviour.

The reason I am using this is because I need the whitelist in the nat
(ip) and the filter (inet) table. Yes I could use the anonymous set
directly but that would imho make the rules less readable.

System:
# nft --version
nftables v0.6 (Support Edward Snowden)
# uname -a
Linux maracuja 4.7.0-0.bpo.1-amd64 #1 SMP Debian 4.7.5-1~bpo8+2
(2016-10-01) x86_64 GNU/Linux

Thanks in advance.

Best
Leon

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: nftables: Add anonymous set to named set
  2016-10-18 20:52 nftables: Add anonymous set to named set Leon Merten Lohse
@ 2016-10-20 15:11   ` Pablo Neira Ayuso
  0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2016-10-20 15:11 UTC (permalink / raw)
  To: Leon Merten Lohse; +Cc: netfilter, netfilter-devel

[-- Attachment #1: Type: text/plain, Size: 411 bytes --]

On Tue, Oct 18, 2016 at 10:52:31PM +0200, Leon Merten Lohse wrote:
> Hi,
> 
> I am trying to add an anonymous set that is defined as a variable to a
> named set as follows:
> 
> define whitelist_v4 = { 1.1.1.1}
> 
> table inet filter {
>   set whitelist_v4 { type ipv4_addr; }
>  
>   [ ... ]
> }
> 
> add element inet filter whitelist_v4 $whitelist_v4

Attaching a patch to resolve this. Thanks for reporting.

[-- Attachment #2: 0001-parser_bison-allow-to-use-variable-to-add-create-del.patch --]
[-- Type: text/x-diff, Size: 1945 bytes --]

>From 86ea36cfcb18bf4f1d3128e6b848c4d4ffc5f964 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 20 Oct 2016 17:06:05 +0200
Subject: [PATCH nft] parser_bison: allow to use variable to add/create/delete
 elements

Using variable definitions from element command doesn't work, eg.

-test.nft-
 define whitelist_v4 = { 1.1.1.1 }
 table inet filter {
	set whitelist_v4 { type ipv4_addr; }
 }
 add element inet filter whitelist_v4 $whitelist_v4
-EOF-

 # nft -f test.nft
 test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{'
 add element inet filter whitelist_v4 $whitelist_v4
                                      ^

Fix this by using set_block_expr rule for every element command.

Reported-by: Leon Merten Lohse <leon@green-side.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 14ad67f61b6b..4108dff7e228 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -750,7 +750,7 @@ add_cmd			:	TABLE		table_spec
 				handle_merge(&$3->handle, &$2);
 				$$ = cmd_alloc(CMD_ADD, CMD_OBJ_SET, &$2, &@$, $5);
 			}
-			|	ELEMENT		set_spec	set_expr
+			|	ELEMENT		set_spec	set_block_expr
 			{
 				$$ = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEM, &$2, &@$, $3);
 			}
@@ -799,7 +799,7 @@ create_cmd		:	TABLE		table_spec
 				handle_merge(&$3->handle, &$2);
 				$$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SET, &$2, &@$, $5);
 			}
-			|	ELEMENT		set_spec	set_expr
+			|	ELEMENT		set_spec	set_block_expr
 			{
 				$$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SETELEM, &$2, &@$, $3);
 			}
@@ -831,7 +831,7 @@ delete_cmd		:	TABLE		table_spec
 			{
 				$$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SET, &$2, &@$, NULL);
 			}
-			|	ELEMENT		set_spec	set_expr
+			|	ELEMENT		set_spec	set_block_expr
 			{
 				$$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SETELEM, &$2, &@$, $3);
 			}
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: nftables: Add anonymous set to named set
@ 2016-10-20 15:11   ` Pablo Neira Ayuso
  0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2016-10-20 15:11 UTC (permalink / raw)
  To: Leon Merten Lohse; +Cc: netfilter, netfilter-devel

[-- Attachment #1: Type: text/plain, Size: 411 bytes --]

On Tue, Oct 18, 2016 at 10:52:31PM +0200, Leon Merten Lohse wrote:
> Hi,
> 
> I am trying to add an anonymous set that is defined as a variable to a
> named set as follows:
> 
> define whitelist_v4 = { 1.1.1.1}
> 
> table inet filter {
>   set whitelist_v4 { type ipv4_addr; }
>  
>   [ ... ]
> }
> 
> add element inet filter whitelist_v4 $whitelist_v4

Attaching a patch to resolve this. Thanks for reporting.

[-- Attachment #2: 0001-parser_bison-allow-to-use-variable-to-add-create-del.patch --]
[-- Type: text/x-diff, Size: 1944 bytes --]

From 86ea36cfcb18bf4f1d3128e6b848c4d4ffc5f964 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Thu, 20 Oct 2016 17:06:05 +0200
Subject: [PATCH nft] parser_bison: allow to use variable to add/create/delete
 elements

Using variable definitions from element command doesn't work, eg.

-test.nft-
 define whitelist_v4 = { 1.1.1.1 }
 table inet filter {
	set whitelist_v4 { type ipv4_addr; }
 }
 add element inet filter whitelist_v4 $whitelist_v4
-EOF-

 # nft -f test.nft
 test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{'
 add element inet filter whitelist_v4 $whitelist_v4
                                      ^

Fix this by using set_block_expr rule for every element command.

Reported-by: Leon Merten Lohse <leon@green-side.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 14ad67f61b6b..4108dff7e228 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -750,7 +750,7 @@ add_cmd			:	TABLE		table_spec
 				handle_merge(&$3->handle, &$2);
 				$$ = cmd_alloc(CMD_ADD, CMD_OBJ_SET, &$2, &@$, $5);
 			}
-			|	ELEMENT		set_spec	set_expr
+			|	ELEMENT		set_spec	set_block_expr
 			{
 				$$ = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEM, &$2, &@$, $3);
 			}
@@ -799,7 +799,7 @@ create_cmd		:	TABLE		table_spec
 				handle_merge(&$3->handle, &$2);
 				$$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SET, &$2, &@$, $5);
 			}
-			|	ELEMENT		set_spec	set_expr
+			|	ELEMENT		set_spec	set_block_expr
 			{
 				$$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SETELEM, &$2, &@$, $3);
 			}
@@ -831,7 +831,7 @@ delete_cmd		:	TABLE		table_spec
 			{
 				$$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SET, &$2, &@$, NULL);
 			}
-			|	ELEMENT		set_spec	set_expr
+			|	ELEMENT		set_spec	set_block_expr
 			{
 				$$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SETELEM, &$2, &@$, $3);
 			}
-- 
2.1.4


^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-10-20 15:11 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-10-18 20:52 nftables: Add anonymous set to named set Leon Merten Lohse
2016-10-20 15:11 ` Pablo Neira Ayuso
2016-10-20 15:11   ` Pablo Neira Ayuso

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.