[PATCH nft,v2 4/5] src: allow reset commands in batch with list and get commands only

[Pablo Neira Ayuso <pablo@netfilter.org>]

Currently, only single reset command is working properly, but more than
one fail because of the existing cache logic. Bail out in case user
mixes reset commands.

The reset command is special because it provides no transaction
semantics, like the list command. Allowing the use of the reset command
in conjunction with other commands require an implicit end of batch /
commit command.

Allow a batch that contains reset commands with list and get command
by now.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 include/cmd.h      |  2 ++
 src/cmd.c          | 37 +++++++++++++++++++++++++++++++++++++
 src/parser_bison.y | 12 ++++++++++--
 src/parser_json.c  |  8 ++++----
 4 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/cmd.h b/include/cmd.h
index cf7e43bf46ec..a457364aeeeb 100644
--- a/include/cmd.h
+++ b/include/cmd.h
@@ -11,4 +11,6 @@ bool nft_cmd_collapse_elems(enum cmd_ops op, struct list_head *cmds,
 
 void nft_cmd_expand(struct cmd *cmd);
 
+int cmd_batch_add(struct cmd *cmd, struct list_head *cmds);
+
 #endif
diff --git a/src/cmd.c b/src/cmd.c
index 9d5544f03c32..7ee2176191b1 100644
--- a/src/cmd.c
+++ b/src/cmd.c
@@ -489,3 +489,40 @@ void nft_cmd_expand(struct cmd *cmd)
 		break;
 	}
 }
+
+static bool cmd_valid_mix(const struct cmd *cmd, const struct cmd *last_cmd)
+{
+	switch (cmd->op) {
+	case CMD_RESET:
+		if (last_cmd->op == CMD_RESET ||
+		    last_cmd->op == CMD_LIST ||
+		    last_cmd->op == CMD_GET)
+			return true;
+
+		return false;
+	case CMD_LIST:
+	case CMD_GET:
+		return true;
+	default:
+		if (last_cmd->op == CMD_RESET)
+			return false;
+		break;
+	}
+
+	return true;
+}
+
+int cmd_batch_add(struct cmd *cmd, struct list_head *cmds)
+{
+	struct cmd *last_cmd;
+	int ret = 0;
+
+	if (!list_empty(cmds)) {
+		last_cmd = list_last_entry(cmds, struct cmd, list);
+		if (!cmd_valid_mix(cmd, last_cmd))
+			ret = -1;
+	}
+	list_add_tail(&cmd->list, cmds);
+
+	return ret;
+}
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 5a334bf0c499..48151a419096 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -1073,7 +1073,11 @@ input			:	/* empty */
 			{
 				if ($2 != NULL) {
 					$2->location = @2;
-					list_add_tail(&$2->list, state->cmds);
+					if (cmd_batch_add($2, state->cmds) < 0) {
+						erec_queue(error(&@2, "unsupported command mix"),
+							   state->msgs);
+						YYERROR;
+					}
 				}
 			}
 			;
@@ -1210,7 +1214,11 @@ line			:	common_block			{ $$ = NULL; }
 				 */
 				if ($1 != NULL) {
 					$1->location = @1;
-					list_add_tail(&$1->list, state->cmds);
+					if (cmd_batch_add($1, state->cmds) < 0) {
+						erec_queue(error(&@2, "unsupported command mix"),
+							   state->msgs);
+						YYERROR;
+					}
 				}
 				$$ = NULL;
 				YYACCEPT;
diff --git a/src/parser_json.c b/src/parser_json.c
index f04772a022a0..47acc200ad83 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -4492,7 +4492,6 @@ static int __json_parse(struct json_ctx *ctx)
 
 	json_array_foreach(tmp, index, value) {
 		/* this is more or less from parser_bison.y:716 */
-		LIST_HEAD(list);
 		struct cmd *cmd;
 		json_t *tmp2;
 
@@ -4522,9 +4521,10 @@ static int __json_parse(struct json_ctx *ctx)
 			return -1;
 		}
 
-		list_add_tail(&cmd->list, &list);
-
-		list_splice_tail(&list, ctx->cmds);
+		if (cmd_batch_add(cmd, ctx->cmds) < 0) {
+			json_error(ctx, "unsupported command mix");
+			return -1;
+		}
 
 		if (nft_output_echo(&ctx->nft->output))
 			json_cmd_assoc_add(value, cmd);
-- 
2.47.3