Re: nft: parser problem, can use mark as datatype in sets and maps

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Aug 11, 2015 at 01:25:21PM +0200, Andreas Schultz wrote:
> On 08/11/2015 12:41 PM, Pablo Neira Ayuso wrote:
> >On Tue, Aug 11, 2015 at 11:18:54AM +0200, Andreas Schultz wrote:
> >>On 08/10/2015 07:09 PM, Pablo Neira Ayuso wrote:
> >>>On Mon, Aug 10, 2015 at 03:48:12PM +0200, Andreas Schultz wrote:
> >>>>Hi,
> >>>>
> >>>>The data type definition for mark and the general idea of the parser
> >>>>indicate that the following nft statements should work:
> >>>>
> >>>>   # nft add map filter MAP1 { type ipv4_addr : mark\; }
> >>>>   # nft add set filter SET1 { type mark\; }
> >>>>
> >>>>However, both fail with a similar error message:
> >>>>
> >>>>   <cmdline>:1:40-43: Error: syntax error, unexpected mark, expecting string
> >>>>   add map filter MAP1 { type ipv4_addr : mark; }
> >>>>   <cmdline>:1:28-31: Error: syntax error, unexpected mark, expecting string
> >>>>   add set filter SET1 { type mark; }
> >>>>
> >>>>The problem is parser, it expects a string as data type spec, but
> >>>>mark is already declared as a token.
> >>>>
> >>>>I don't have much experience with bison, so does anyone have a quick
> >>>>work-around for this?
> >>>
> >>>This is fixed by 2baf59c ("parser_bison: allow to use mark as datatype
> >>>for maps and sets").
> >>
> >>Ah, I was using the next-4.2 branch and missed this fix in master,
> >>sorry for the noise.
> >>
> >>However, the parser problem is solved, but named mark maps are still
> >>not working:
> >>
> >>anonymous maps work as expected:
> >>
> >>   # nft add rule ip mangle OUTPUT mark set ip saddr map {
> >>192.168.0.10 : 0x1 }
> >>
> >>named maps do not:
> >>
> >>   # nft add map mangle CLASS05 "{ type ipv4_addr : mark; }"
> >>   # nft add element mangle CLASS05 { 192.168.0.10 : 0x1 }
> >>   # nft add rule ip mangle OUTPUT mark set ip saddr map @CLASS05
> >>   <cmdline>:1:1-56: Error: Could not process rule: Invalid argument
> >>
> >>Any idea?
> >
> >This is working fine here with a nf.git tree snapshot.
> >
> >table ip mangle {
> >         map CLASS05 {
> >                 type ipv4_addr : mark
> >                 elements = { 192.168.0.10 : 0x00000001}
> >         }
> >
> >         chain OUTPUT {
> >                 type route hook output priority 0; policy accept;
> >                 mark set ip saddr map @CLASS05
> >         }
> >}
> 
> When I put that into a file and try to restore it, I get this:
> 
> # nft -f /tmp/map.nft
> /tmp/map.nft:4:28-54: Error: mapping outside of map context
>                 elements = { 192.168.0.10 : 0x00000001}
>                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> >What Linux kernel version are you using? Remember that concatenation
> >support is there since 4.1.
> 
> Userland:
> 
> git://git.netfilter.org/libnftnl  branch master @ HEAD (0edeb66)
> git://git.netfilter.org/nftables  branch master @ HEAD (ecf855b)

Please, give a try to this branch:

http://git.netfilter.org/nftables/log/?h=cache-consolidation

I was testing your examples with these patcheset applied on top of
nftables HEAD:

http://marc.info/?l=netfilter-devel&m=143920709517449&w=2

Let me know, thanks.