Re: [PATCH 2/2 nft] jump: Allow goto and jump to a variable using nft input files

From: Phil Sutter <phil@nwl.cc>
To: Fernando Fernandez Mancera <ffmancera@riseup.net>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 2/2 nft] jump: Allow goto and jump to a variable using nft input files
Date: Wed, 15 May 2019 12:58:50 +0200	[thread overview]
Message-ID: <20190515105850.GA4851@orbyte.nwl.cc> (raw)
In-Reply-To: <20190514211340.913-2-ffmancera@riseup.net>

Hey,

On Tue, May 14, 2019 at 11:13:40PM +0200, Fernando Fernandez Mancera wrote:
[...]
> diff --git a/src/datatype.c b/src/datatype.c
> index 6aaf9ea..7e9ec5e 100644
> --- a/src/datatype.c
> +++ b/src/datatype.c
> @@ -297,11 +297,22 @@ static void verdict_type_print(const struct expr *expr, struct output_ctx *octx)
>  	}
>  }
>  
> +static struct error_record *verdict_type_parse(const struct expr *sym,
> +					       struct expr **res)
> +{
> +	*res = constant_expr_alloc(&sym->location, &string_type,
> +				   BYTEORDER_HOST_ENDIAN,
> +				   (strlen(sym->identifier) + 1) * BITS_PER_BYTE,
> +				   sym->identifier);
> +	return NULL;
> +}

One more thing: The above lacks error checking of any kind. I *think*
this is the place where one should make sure the symbol expression is
actually a string (but I'm not quite sure how you do that).

In any case, please try to exploit that variable support in the testcase
(or maybe a separate one), just to make sure we don't allow weird
things.

Thanks, Phil