* nftables: Add anonymous set to named set
@ 2016-10-18 20:52 Leon Merten Lohse
2016-10-20 15:11 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Leon Merten Lohse @ 2016-10-18 20:52 UTC (permalink / raw)
To: netfilter
Hi,
I am trying to add an anonymous set that is defined as a variable to a
named set as follows:
define whitelist_v4 = { 1.1.1.1}
table inet filter {
set whitelist_v4 { type ipv4_addr; }
[ ... ]
}
add element inet filter whitelist_v4 $whitelist_v4
This produces the error:
./testfw.ruleset:290:38-38: Error: syntax error, unexpected '$',
expecting '{' add element inet filter whitelist_v4 $whitelist_v4
^
If I use curly braces instead, there is no error but a failed assertion:
add element inet filter whitelist_v4 {$whitelist_v4}
produces
BUG: invalid data expression type set
nft: netlink.c:337: netlink_gen_data: Assertion `0' failed.
What is the correct way to use this?
Note: Direct definition as `elements = ...` shows the same behaviour.
The reason I am using this is because I need the whitelist in the nat
(ip) and the filter (inet) table. Yes I could use the anonymous set
directly but that would imho make the rules less readable.
System:
# nft --version
nftables v0.6 (Support Edward Snowden)
# uname -a
Linux maracuja 4.7.0-0.bpo.1-amd64 #1 SMP Debian 4.7.5-1~bpo8+2
(2016-10-01) x86_64 GNU/Linux
Thanks in advance.
Best
Leon
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: nftables: Add anonymous set to named set 2016-10-18 20:52 nftables: Add anonymous set to named set Leon Merten Lohse @ 2016-10-20 15:11 ` Pablo Neira Ayuso 0 siblings, 0 replies; 3+ messages in thread From: Pablo Neira Ayuso @ 2016-10-20 15:11 UTC (permalink / raw) To: Leon Merten Lohse; +Cc: netfilter, netfilter-devel [-- Attachment #1: Type: text/plain, Size: 411 bytes --] On Tue, Oct 18, 2016 at 10:52:31PM +0200, Leon Merten Lohse wrote: > Hi, > > I am trying to add an anonymous set that is defined as a variable to a > named set as follows: > > define whitelist_v4 = { 1.1.1.1} > > table inet filter { > set whitelist_v4 { type ipv4_addr; } > > [ ... ] > } > > add element inet filter whitelist_v4 $whitelist_v4 Attaching a patch to resolve this. Thanks for reporting. [-- Attachment #2: 0001-parser_bison-allow-to-use-variable-to-add-create-del.patch --] [-- Type: text/x-diff, Size: 1944 bytes --] From 86ea36cfcb18bf4f1d3128e6b848c4d4ffc5f964 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Thu, 20 Oct 2016 17:06:05 +0200 Subject: [PATCH nft] parser_bison: allow to use variable to add/create/delete elements Using variable definitions from element command doesn't work, eg. -test.nft- define whitelist_v4 = { 1.1.1.1 } table inet filter { set whitelist_v4 { type ipv4_addr; } } add element inet filter whitelist_v4 $whitelist_v4 -EOF- # nft -f test.nft test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{' add element inet filter whitelist_v4 $whitelist_v4 ^ Fix this by using set_block_expr rule for every element command. Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- src/parser_bison.y | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/parser_bison.y b/src/parser_bison.y index 14ad67f61b6b..4108dff7e228 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -750,7 +750,7 @@ add_cmd : TABLE table_spec handle_merge(&$3->handle, &$2); $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SET, &$2, &@$, $5); } - | ELEMENT set_spec set_expr + | ELEMENT set_spec set_block_expr { $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEM, &$2, &@$, $3); } @@ -799,7 +799,7 @@ create_cmd : TABLE table_spec handle_merge(&$3->handle, &$2); $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SET, &$2, &@$, $5); } - | ELEMENT set_spec set_expr + | ELEMENT set_spec set_block_expr { $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SETELEM, &$2, &@$, $3); } @@ -831,7 +831,7 @@ delete_cmd : TABLE table_spec { $$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SET, &$2, &@$, NULL); } - | ELEMENT set_spec set_expr + | ELEMENT set_spec set_block_expr { $$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SETELEM, &$2, &@$, $3); } -- 2.1.4 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: nftables: Add anonymous set to named set @ 2016-10-20 15:11 ` Pablo Neira Ayuso 0 siblings, 0 replies; 3+ messages in thread From: Pablo Neira Ayuso @ 2016-10-20 15:11 UTC (permalink / raw) To: Leon Merten Lohse; +Cc: netfilter, netfilter-devel [-- Attachment #1: Type: text/plain, Size: 411 bytes --] On Tue, Oct 18, 2016 at 10:52:31PM +0200, Leon Merten Lohse wrote: > Hi, > > I am trying to add an anonymous set that is defined as a variable to a > named set as follows: > > define whitelist_v4 = { 1.1.1.1} > > table inet filter { > set whitelist_v4 { type ipv4_addr; } > > [ ... ] > } > > add element inet filter whitelist_v4 $whitelist_v4 Attaching a patch to resolve this. Thanks for reporting. [-- Attachment #2: 0001-parser_bison-allow-to-use-variable-to-add-create-del.patch --] [-- Type: text/x-diff, Size: 1945 bytes --] >From 86ea36cfcb18bf4f1d3128e6b848c4d4ffc5f964 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso <pablo@netfilter.org> Date: Thu, 20 Oct 2016 17:06:05 +0200 Subject: [PATCH nft] parser_bison: allow to use variable to add/create/delete elements Using variable definitions from element command doesn't work, eg. -test.nft- define whitelist_v4 = { 1.1.1.1 } table inet filter { set whitelist_v4 { type ipv4_addr; } } add element inet filter whitelist_v4 $whitelist_v4 -EOF- # nft -f test.nft test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{' add element inet filter whitelist_v4 $whitelist_v4 ^ Fix this by using set_block_expr rule for every element command. Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- src/parser_bison.y | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/parser_bison.y b/src/parser_bison.y index 14ad67f61b6b..4108dff7e228 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -750,7 +750,7 @@ add_cmd : TABLE table_spec handle_merge(&$3->handle, &$2); $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SET, &$2, &@$, $5); } - | ELEMENT set_spec set_expr + | ELEMENT set_spec set_block_expr { $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEM, &$2, &@$, $3); } @@ -799,7 +799,7 @@ create_cmd : TABLE table_spec handle_merge(&$3->handle, &$2); $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SET, &$2, &@$, $5); } - | ELEMENT set_spec set_expr + | ELEMENT set_spec set_block_expr { $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SETELEM, &$2, &@$, $3); } @@ -831,7 +831,7 @@ delete_cmd : TABLE table_spec { $$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SET, &$2, &@$, NULL); } - | ELEMENT set_spec set_expr + | ELEMENT set_spec set_block_expr { $$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SETELEM, &$2, &@$, $3); } -- 2.1.4 ^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-10-20 15:11 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-10-18 20:52 nftables: Add anonymous set to named set Leon Merten Lohse 2016-10-20 15:11 ` Pablo Neira Ayuso 2016-10-20 15:11 ` Pablo Neira Ayuso
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.