From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: phil@nwl.cc, Florian Westphal <fw@strlen.de>
Subject: [PATCH nft 0/5] parser_json: fix up transaction ordering
Date: Thu, 7 Mar 2024 13:26:30 +0100 [thread overview]
Message-ID: <20240307122640.29507-1-fw@strlen.de> (raw)
The existing parser cannot handle certain inputs. Example:
"map": {
"table": "test",
[..]
"map": "verdict",
"elem": [ [ "*", {
"jump": {
"target": "testchain"
[..]
},
{
"chain": {
"family": "ip",
"table": "test",
"name": "testchain",
...
This will fail to load because the generated transaction
adds the element containing the jump to 'testchain' before
the 'add chain'.
The normal (bison) parser does not have this issue, elements get
added to the map, the map is added to the table.
Then, *after* parsing, the 'add chain' and 'add element' commands
are generated via command expansion.
Change the json parser to do the same and avoid cmd_alloc where
possible.
Patch 4 is the main change, patch 5 adds test cases that did not
work before.
json parser still cannot handle several existing tests due to lack
of 'typeof' support (dump would contain base types like 'integer' which
are rejected as they lack the needed key length information).
Florian Westphal (5):
parser_json: move some code around
parser_json: move list_add into json_parse_cmd
parser_json: add and use CMD_ERR helpers
parser_json: defer command allocation to nft_cmd_expand
tests: shell: add more json-nft dumps
src/parser_json.c | 331 ++++++++---
.../dumps/0011endless_jump_loop_1.json-nft | 75 +++
.../testcases/maps/dumps/0011vmap_0.json-nft | 145 +++++
.../dumps/map_catchall_double_free_2.json-nft | 46 ++
.../maps/dumps/vmap_mark_bitwise_0.json-nft | 158 +++++
.../maps/dumps/vmap_timeout.json-nft | 229 ++++++++
.../dumps/0008create_verdict_map_0.json-nft | 78 +++
.../sets/dumps/sets_with_ifnames.json-nft | 551 ++++++++++++++++++
8 files changed, 1516 insertions(+), 97 deletions(-)
create mode 100644 tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft
create mode 100644 tests/shell/testcases/maps/dumps/0011vmap_0.json-nft
create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_free_2.json-nft
create mode 100644 tests/shell/testcases/maps/dumps/vmap_mark_bitwise_0.json-nft
create mode 100644 tests/shell/testcases/maps/dumps/vmap_timeout.json-nft
create mode 100644 tests/shell/testcases/sets/dumps/0008create_verdict_map_0.json-nft
create mode 100644 tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft
--
2.43.0
next reply other threads:[~2024-03-07 12:32 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-07 12:26 Florian Westphal [this message]
2024-03-07 12:26 ` [PATCH nft 1/5] parser_json: move some code around Florian Westphal
2024-03-07 12:26 ` [PATCH nft 2/5] parser_json: move list_add into json_parse_cmd Florian Westphal
2024-03-07 14:31 ` Phil Sutter
2024-03-07 15:10 ` Florian Westphal
2024-03-07 15:52 ` Phil Sutter
2024-03-07 16:44 ` Florian Westphal
2024-03-07 17:58 ` Phil Sutter
2024-03-07 12:26 ` [PATCH nft 3/5] parser_json: add and use CMD_ERR helpers Florian Westphal
2024-03-07 12:26 ` [PATCH nft 4/5] parser_json: defer command allocation to nft_cmd_expand Florian Westphal
2024-03-07 12:26 ` [PATCH nft 5/5] tests: shell: add more json-nft dumps Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240307122640.29507-1-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).