[PATCH nft 1/2] evaluate: replace variable expression by the value expression

[PATCH nft 1/2] evaluate: replace variable expression by the value expression

[Pablo Neira Ayuso]

The variable expression provides the binding between the variable
dereference and the value expression. Replace the variable expression by
the real value expression after the evaluation.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/evaluate.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/evaluate.c b/src/evaluate.c
index 4ec91a1ce771..5111dce55eb6 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2013,10 +2013,13 @@ static int expr_evaluate_variable(struct eval_ctx *ctx, struct expr **exprp)
 {
 	struct expr *new = expr_clone((*exprp)->sym->expr);
 
+	if (expr_evaluate(ctx, &new) < 0)
+		return -1;
+
 	expr_free(*exprp);
 	*exprp = new;
 
-	return expr_evaluate(ctx, exprp);
+	return 0;
 }
 
 static int expr_evaluate_xfrm(struct eval_ctx *ctx, struct expr **exprp)
-- 
2.20.1

[PATCH nft 2/2] src: allow for negative value in variable definitions

[Pablo Neira Ayuso]

Extend test to cover for negative value in chain priority definition.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y                                  | 10 +++++++++-
 .../shell/testcases/chains/0032priority_variable_0  | 10 ++++++++++
 .../chains/dumps/0032priority_variable_0.nft        | 13 +++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 tests/shell/testcases/chains/dumps/0032priority_variable_0.nft

diff --git a/src/parser_bison.y b/src/parser_bison.y
index d2d7694ae170..f0cca64136ee 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -2157,7 +2157,6 @@ extended_prio_spec	:	int_num
 			{
 				struct prio_spec spec = {0};
 
-				datatype_set($1->sym->expr, &priority_type);
 				spec.expr = $1;
 				$$ = spec;
 			}
@@ -3982,6 +3981,15 @@ set_rhs_expr		:	concat_rhs_expr
 initializer_expr	:	rhs_expr
 			|	list_rhs_expr
 			|	'{' '}'		{ $$ = compound_expr_alloc(&@$, EXPR_SET); }
+			|	DASH	NUM
+			{
+				int32_t num = -$2;
+
+				$$ = constant_expr_alloc(&@$, &integer_type,
+							 BYTEORDER_HOST_ENDIAN,
+							 sizeof(num) * BITS_PER_BYTE,
+							 &num);
+			}
 			;
 
 counter_config		:	PACKETS		NUM	BYTES	NUM
diff --git a/tests/shell/testcases/chains/0032priority_variable_0 b/tests/shell/testcases/chains/0032priority_variable_0
index 51bc5eb15e2a..8f2e57b9b3c3 100755
--- a/tests/shell/testcases/chains/0032priority_variable_0
+++ b/tests/shell/testcases/chains/0032priority_variable_0
@@ -6,12 +6,22 @@ set -e
 
 RULESET="
 define pri = 10
+define post = -10
+define for = \"filter - 100\"
 
 table inet global {
     chain prerouting {
         type filter hook prerouting priority \$pri
         policy accept
     }
+    chain forward {
+        type filter hook prerouting priority \$for
+        policy accept
+    }
+    chain postrouting {
+        type filter hook postrouting priority \$post
+        policy accept
+    }
 }"
 
 $NFT -f - <<< "$RULESET"
diff --git a/tests/shell/testcases/chains/dumps/0032priority_variable_0.nft b/tests/shell/testcases/chains/dumps/0032priority_variable_0.nft
new file mode 100644
index 000000000000..1a1b0794bb83
--- /dev/null
+++ b/tests/shell/testcases/chains/dumps/0032priority_variable_0.nft
@@ -0,0 +1,13 @@
+table inet global {
+	chain prerouting {
+		type filter hook prerouting priority filter + 10; policy accept;
+	}
+
+	chain forward {
+		type filter hook prerouting priority dstnat; policy accept;
+	}
+
+	chain postrouting {
+		type filter hook postrouting priority filter - 10; policy accept;
+	}
+}
-- 
2.20.1