netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: phil@nwl.cc, Florian Westphal <fw@strlen.de>
Subject: [PATCH nft 0/5] parser_json: fix up transaction ordering
Date: Thu,  7 Mar 2024 13:26:30 +0100	[thread overview]
Message-ID: <20240307122640.29507-1-fw@strlen.de> (raw)

The existing parser cannot handle certain inputs.  Example:

  "map": {
   "table": "test",
   [..]
   "map": "verdict",
   "elem": [ [ "*", {
        "jump": {
           "target": "testchain"
[..]
    },
    {
      "chain": {
        "family": "ip",
        "table": "test",
        "name": "testchain",
        ...

This will fail to load because the generated transaction
adds the element containing the jump to 'testchain' before
the 'add chain'.

The normal (bison) parser does not have this issue, elements get
added to the map, the map is added to the table.

Then, *after* parsing, the 'add chain' and 'add element' commands
are generated via command expansion.

Change the json parser to do the same and avoid cmd_alloc where
possible.

Patch 4 is the main change, patch 5 adds test cases that did not
work before.

json parser still cannot handle several existing tests due to lack
of 'typeof' support (dump would contain base types like 'integer' which
are rejected as they lack the needed key length information).

Florian Westphal (5):
  parser_json: move some code around
  parser_json: move list_add into json_parse_cmd
  parser_json: add and use CMD_ERR helpers
  parser_json: defer command allocation to nft_cmd_expand
  tests: shell: add more json-nft dumps

 src/parser_json.c                             | 331 ++++++++---
 .../dumps/0011endless_jump_loop_1.json-nft    |  75 +++
 .../testcases/maps/dumps/0011vmap_0.json-nft  | 145 +++++
 .../dumps/map_catchall_double_free_2.json-nft |  46 ++
 .../maps/dumps/vmap_mark_bitwise_0.json-nft   | 158 +++++
 .../maps/dumps/vmap_timeout.json-nft          | 229 ++++++++
 .../dumps/0008create_verdict_map_0.json-nft   |  78 +++
 .../sets/dumps/sets_with_ifnames.json-nft     | 551 ++++++++++++++++++
 8 files changed, 1516 insertions(+), 97 deletions(-)
 create mode 100644 tests/shell/testcases/chains/dumps/0011endless_jump_loop_1.json-nft
 create mode 100644 tests/shell/testcases/maps/dumps/0011vmap_0.json-nft
 create mode 100644 tests/shell/testcases/maps/dumps/map_catchall_double_free_2.json-nft
 create mode 100644 tests/shell/testcases/maps/dumps/vmap_mark_bitwise_0.json-nft
 create mode 100644 tests/shell/testcases/maps/dumps/vmap_timeout.json-nft
 create mode 100644 tests/shell/testcases/sets/dumps/0008create_verdict_map_0.json-nft
 create mode 100644 tests/shell/testcases/sets/dumps/sets_with_ifnames.json-nft

-- 
2.43.0


             reply	other threads:[~2024-03-07 12:32 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-03-07 12:26 Florian Westphal [this message]
2024-03-07 12:26 ` [PATCH nft 1/5] parser_json: move some code around Florian Westphal
2024-03-07 12:26 ` [PATCH nft 2/5] parser_json: move list_add into json_parse_cmd Florian Westphal
2024-03-07 14:31   ` Phil Sutter
2024-03-07 15:10     ` Florian Westphal
2024-03-07 15:52       ` Phil Sutter
2024-03-07 16:44         ` Florian Westphal
2024-03-07 17:58           ` Phil Sutter
2024-03-07 12:26 ` [PATCH nft 3/5] parser_json: add and use CMD_ERR helpers Florian Westphal
2024-03-07 12:26 ` [PATCH nft 4/5] parser_json: defer command allocation to nft_cmd_expand Florian Westphal
2024-03-07 12:26 ` [PATCH nft 5/5] tests: shell: add more json-nft dumps Florian Westphal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240307122640.29507-1-fw@strlen.de \
    --to=fw@strlen.de \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=phil@nwl.cc \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).