[PATCH nftables] evaluate: allow == and != in the new shortcut syntax to match for flags

[PATCH nftables] evaluate: allow == and != in the new shortcut syntax to match for flags

[Pablo Neira Ayuso]

The flags / mask syntax only allows for ==, !=  and the implicit
operation (which is == in this case).

 # nft add rule x y tcp flags ! syn / syn,ack
 Error: either == or != is allowed
 add rule x y tcp flags ! syn / syn,ack
              ^^^^^^^^^^^^^^^^^^^^^^^^^

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/evaluate.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/evaluate.c b/src/evaluate.c
index 006b04affbd7..384e2fa786e0 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2139,6 +2139,10 @@ static int expr_evaluate_flagcmp(struct eval_ctx *ctx, struct expr **exprp)
 {
 	struct expr *expr = *exprp, *binop, *rel;
 
+	if (expr->op != OP_EQ &&
+	    expr->op != OP_NEQ)
+		return expr_error(ctx->msgs, expr, "either == or != is allowed");
+
 	binop = binop_expr_alloc(&expr->location, OP_AND,
 				 expr_get(expr->flagcmp.expr),
 				 expr_get(expr->flagcmp.mask));
-- 
2.20.1

[PATCH nftables] expression: display an error on unknown datatype

[Pablo Neira Ayuso]

 # nft describe foo
 datatype foo is invalid

Fixes: 21cbab5b6ffe ("expression: extend 'nft describe' to allow listing data types")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/expression.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/expression.c b/src/expression.c
index 7ae075d23ee3..c91333631ad0 100644
--- a/src/expression.c
+++ b/src/expression.c
@@ -135,9 +135,12 @@ void expr_describe(const struct expr *expr, struct output_ctx *octx)
 		nft_print(octx, "datatype %s (%s)",
 			  dtype->name, dtype->desc);
 		len = dtype->size;
-	} else {
+	} else if (dtype != &invalid_type) {
 		nft_print(octx, "%s expression, datatype %s (%s)",
 			  expr_name(expr), dtype->name, dtype->desc);
+	} else {
+		nft_print(octx, "datatype %s is invalid\n", expr->identifier);
+		return;
 	}
 
 	if (dtype->basetype != NULL) {
-- 
2.20.1