[PATCH nft] parser_bison: allow to used named limit from dictionaries too

[PATCH nft] parser_bison: allow to used named limit from dictionaries too

[Pablo Neira Ayuso]

Allow to use limit objects from dictionaries.

Fixes: c0697eabe832 ("src: add stateful object support for limit")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/parser_bison.y | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/parser_bison.y b/src/parser_bison.y
index f996d9d94880..7016f5b24887 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -1426,6 +1426,15 @@ map_block		:	/* empty */	{ $$ = $<set>-1; }
 				$1->flags  |= NFT_SET_OBJECT;
 				$$ = $1;
 			}
+			|	map_block	TYPE
+						data_type_expr	COLON	LIMIT
+						stmt_separator
+			{
+				$1->key = $3;
+				$1->objtype = NFT_OBJECT_LIMIT;
+				$1->flags  |= NFT_SET_OBJECT;
+				$$ = $1;
+			}
 			|	map_block	FLAGS		set_flag_list	stmt_separator
 			{
 				$1->flags |= $3;
-- 
2.1.4

[PATCH nft] scanner: IPv4-Mapped IPv6 addresses support

[Pablo Neira Ayuso]

The scanner rejects IPv4-Mapped IPv6 addresses, eg.

 # cat test
 #!/usr/sbin/nft -f
 flush ruleset
 table inet global {
    set blackhole_ipv6 {
        type ipv6_addr
        flags interval
        elements = { ::ffff:0.0.0.0/96 }
    }
 }

 # nft -f test
 test:8:30-38: Error: syntax error, unexpected string, expecting comma or '}'
        elements = { ::ffff:0.0.0.0/96 }
                            ^^^^^^^^^^

According to RFC4291, Sect. 2.5.5.2. IPv4-Mapped IPv6 Address:

   |                80 bits               | 16 |      32 bits        |
   +--------------------------------------+--------------------------+
   |0000..............................0000|FFFF|    IPv4 address     |
   +--------------------------------------+----+---------------------+

Update scanner bits to parse this.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/scanner.l | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/scanner.l b/src/scanner.l
index 186fb47eb763..594073660c6b 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -160,7 +160,8 @@ v63		({v630}|{v631}|{v632}|{v633})
 v620		((:)((:{hex4}){2}))
 v621		((({hex4}:){1})((:{hex4}){1}))
 v622		((({hex4}:){2})(:))
-v62		({v620}|{v621}|{v622})
+v62_rfc4291	((:)(:[fF]{4})(:{ip4addr}))
+v62		({v620}|{v621}|{v622}|{v62_rfc4291})
 v610		((:)(:{hex4}{1}))
 v611		((({hex4}:){1})(:))
 v61		({v610}|{v611})
-- 
2.1.4

Re: [PATCH nft] parser_bison: allow to used named limit from dictionaries too

[Pablo Neira Ayuso]

On Mon, Oct 09, 2017 at 01:48:11PM +0200, Pablo Neira Ayuso wrote:
> Allow to use limit objects from dictionaries.

Please, ignore this. My robot accidentally included this, this is
already upstream for a while.