* nftables: Dynamically updating sets gives syntax error @ 2016-06-25 13:30 Anders K. Pedersen 2016-07-02 14:12 ` Anders K. Pedersen 0 siblings, 1 reply; 4+ messages in thread From: Anders K. Pedersen @ 2016-06-25 13:30 UTC (permalink / raw) To: netfilter Hello, With nftables 0.6 I'm getting a syntax error, when I try to use the feature that was introduced by http://git.netfilter.org/nftables/commit /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example: # nft filter input set add tcp dport @myset <cmdline>:1:26-30: Error: syntax error, unexpected dport filter input set add tcp dport @myset ^^^^^ # nft filter input set add ip saddr timeout 10s @myset <cmdline>:1:25-29: Error: syntax error, unexpected saddr filter input set add ip saddr timeout 10s @myset ^^^^^ # nft filter input set update ip saddr timeout 10s @myset <cmdline>:1:28-32: Error: syntax error, unexpected saddr filter input set update ip saddr timeout 10s @myset ^^^^^ Is there a new syntax for this or was it broken unintentionally? Regards, Anders K. Pedersen ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: nftables: Dynamically updating sets gives syntax error 2016-06-25 13:30 nftables: Dynamically updating sets gives syntax error Anders K. Pedersen @ 2016-07-02 14:12 ` Anders K. Pedersen 2016-07-12 15:22 ` Pablo Neira Ayuso 0 siblings, 1 reply; 4+ messages in thread From: Anders K. Pedersen @ 2016-07-02 14:12 UTC (permalink / raw) To: netfilter, netfilter-devel, Pablo Neira Ayuso Hello, On lør, 2016-06-25 at 15:30 +0200, Anders K. Pedersen wrote: > With nftables 0.6 I'm getting a syntax error, when I try to use the > feature that was introduced > by http://git.netfilter.org/nftables/commit > /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example: > > # nft filter input set add tcp dport @myset > <cmdline>:1:26-30: Error: syntax error, unexpected dport > filter input set add tcp dport @myset > ^^^^^ > # nft filter input set add ip saddr timeout 10s @myset > <cmdline>:1:25-29: Error: syntax error, unexpected saddr > filter input set add ip saddr timeout 10s @myset > ^^^^^ > # nft filter input set update ip saddr timeout 10s @myset > <cmdline>:1:28-32: Error: syntax error, unexpected saddr > filter input set update ip saddr timeout 10s @myset > ^^^^^ I did a git bisect on this and found that it was broken by commit a3e60492a684be09374d0649735da42bdadc6b48 Author: Pablo Neira Ayuso <pablo@netfilter.org> Date: Sun Dec 27 22:15:17 2015 +0100 parser: restrict relational rhs expression recursion After studying it a bit I reverted a part of it with the following change, which made the commands above work again: --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -2054,7 +2054,7 @@ set_elem_option : TIMEOUT time_spec } ; -set_lhs_expr : concat_rhs_expr +set_lhs_expr : concat_expr | multiton_rhs_expr ; The commit message indicated that it intended to handle rhs expressions, but this is a lhs expression, so maybe this change was unintended? Regards, Anders K. Pedersen ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: nftables: Dynamically updating sets gives syntax error 2016-07-02 14:12 ` Anders K. Pedersen @ 2016-07-12 15:22 ` Pablo Neira Ayuso 2016-07-13 7:14 ` Anders K. Pedersen 0 siblings, 1 reply; 4+ messages in thread From: Pablo Neira Ayuso @ 2016-07-12 15:22 UTC (permalink / raw) To: Anders K. Pedersen; +Cc: netfilter, netfilter-devel On Sat, Jul 02, 2016 at 04:12:56PM +0200, Anders K. Pedersen wrote: > Hello, > > On lør, 2016-06-25 at 15:30 +0200, Anders K. Pedersen wrote: > > With nftables 0.6 I'm getting a syntax error, when I try to use the > > feature that was introduced > > by http://git.netfilter.org/nftables/commit > > /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example: > > > > # nft filter input set add tcp dport @myset > > <cmdline>:1:26-30: Error: syntax error, unexpected dport > > filter input set add tcp dport @myset > > ^^^^^ > > # nft filter input set add ip saddr timeout 10s @myset > > <cmdline>:1:25-29: Error: syntax error, unexpected saddr > > filter input set add ip saddr timeout 10s @myset > > ^^^^^ > > # nft filter input set update ip saddr timeout 10s @myset > > <cmdline>:1:28-32: Error: syntax error, unexpected saddr > > filter input set update ip saddr timeout 10s @myset > > ^^^^^ > > I did a git bisect on this and found that it was broken by > > commit a3e60492a684be09374d0649735da42bdadc6b48 > Author: Pablo Neira Ayuso <pablo@netfilter.org> > Date: Sun Dec 27 22:15:17 2015 +0100 > > parser: restrict relational rhs expression recursion > > After studying it a bit I reverted a part of it with the following > change, which made the commands above work again: > > --- a/src/parser_bison.y > +++ b/src/parser_bison.y > @@ -2054,7 +2054,7 @@ set_elem_option : TIMEOUT time_spec > } > ; > > -set_lhs_expr : concat_rhs_expr > +set_lhs_expr : concat_expr > | multiton_rhs_expr > ; > > The commit message indicated that it intended to handle rhs > expressions, but this is a lhs expression, so maybe this change was > unintended? Thanks for reporting. This results however in shift/reduce conflicts in the grammar, just sent patches to address this: http://patchwork.ozlabs.org/patch/647448/ http://patchwork.ozlabs.org/patch/647447/ Please, test and let me know if this works for you. Thanks. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: nftables: Dynamically updating sets gives syntax error 2016-07-12 15:22 ` Pablo Neira Ayuso @ 2016-07-13 7:14 ` Anders K. Pedersen 0 siblings, 0 replies; 4+ messages in thread From: Anders K. Pedersen @ 2016-07-13 7:14 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: netfilter, netfilter-devel On tir, 2016-07-12 at 17:22 +0200, Pablo Neira Ayuso wrote: > On Sat, Jul 02, 2016 at 04:12:56PM +0200, Anders K. Pedersen wrote: > > Hello, > > > > On lør, 2016-06-25 at 15:30 +0200, Anders K. Pedersen wrote: > > > With nftables 0.6 I'm getting a syntax error, when I try to use > > > the > > > feature that was introduced > > > by http://git.netfilter.org/nftables/commit > > > /?id=a9467e55973b10c2e8fe37525514c961580f8506 . For example: > > > > > > # nft filter input set add tcp dport @myset > > > <cmdline>:1:26-30: Error: syntax error, unexpected dport > > > filter input set add tcp dport @myset > > > ^^^^^ > > > # nft filter input set add ip saddr timeout 10s @myset > > > <cmdline>:1:25-29: Error: syntax error, unexpected saddr > > > filter input set add ip saddr timeout 10s @myset > > > ^^^^^ > > > # nft filter input set update ip saddr timeout 10s @myset > > > <cmdline>:1:28-32: Error: syntax error, unexpected saddr > > > filter input set update ip saddr timeout 10s @myset > > > ^^^^^ > > > > I did a git bisect on this and found that it was broken by > > > > commit a3e60492a684be09374d0649735da42bdadc6b48 > > Author: Pablo Neira Ayuso <pablo@netfilter.org> > > Date: Sun Dec 27 22:15:17 2015 +0100 > > > > parser: restrict relational rhs expression recursion > > > > After studying it a bit I reverted a part of it with the following > > change, which made the commands above work again: > > > > --- a/src/parser_bison.y > > +++ b/src/parser_bison.y > > @@ -2054,7 +2054,7 @@ set_elem_option : TIMEO > > UT time_spec > > } > > ; > > > > -set_lhs_expr : concat_rhs_expr > > +set_lhs_expr : concat_expr > > | multiton_rhs_expr > > ; > > > > The commit message indicated that it intended to handle rhs > > expressions, but this is a lhs expression, so maybe this change was > > unintended? > > Thanks for reporting. This results however in shift/reduce conflicts > in the grammar, just sent patches to address this: > > http://patchwork.ozlabs.org/patch/647448/ > http://patchwork.ozlabs.org/patch/647447/ > > Please, test and let me know if this works for you. Thanks. I applied these patches on top of current nftables git, and tested that they solve the problem. Thanks for fixing this. Regards, Anders K. Pedersen -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-07-13 7:14 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-06-25 13:30 nftables: Dynamically updating sets gives syntax error Anders K. Pedersen 2016-07-02 14:12 ` Anders K. Pedersen 2016-07-12 15:22 ` Pablo Neira Ayuso 2016-07-13 7:14 ` Anders K. Pedersen
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox