diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-10-18 20:02:16 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-11-02 12:51:36 +0100 |
commit | b851ba4731d9f7c5e38889875a83173fcc4d3f16 (patch) | |
tree | 3ca89f5c184998ece7216eae4d9095807cb7ef0f /src/scanner.l | |
parent | 0721fbbe7a951a1e879d120c7a722012c38af9a6 (diff) |
src: add interface wildcard matching
Contrary to iptables, we use the asterisk character '*' as wildcard.
# nft --debug=netlink add rule test test iifname eth\*
ip test test
[ meta load iifname => reg 1 ]
[ cmp eq reg 1 0x00687465 ]
Note that this generates an optimized comparison without bitwise.
In case you want to match a device that contains an asterisk, you have
to escape the asterisk, ie.
# nft add rule test test iifname eth\\*
The wildcard string handling occurs from the evaluation step, where we
convert from:
relational
/ \
/ \
meta value
oifname eth*
to:
relational
/ \
/ \
meta prefix
ofiname
As Patrick suggested, this not actually a wildcard but a prefix since it
only applies to the string when placed at the end.
More comments:
* This relaxes the left->size > right->size from netlink_parse_cmp()
for strings since the optimization that this patch applies may now
result in bogus errors.
* This patch can be later on extended to apply a similar optimization to
payload expressions when:
expr->len % BITS_PER_BYTE == 0
For meta and ct, the kernel checks for the exact length of the attributes
(it expects integer 32 bits) so we can't do it unless we relax that.
* Wildcard strings are not supported from sets and maps yet. Error
reporting is not very good at this stage since expr_evaluate_prefix()
doesn't have enough context (ctx->set is NULL, the set object is
currently created later after evaluating the lhs and rhs of the
relational). I'll be following up on this later.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/scanner.l')
-rw-r--r-- | src/scanner.l | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/scanner.l b/src/scanner.l index 1a9f43f8..a98e7b6a 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -114,6 +114,7 @@ range ({decstring}?:{decstring}?) letter [a-zA-Z] string ({letter})({letter}|{digit}|[/\-_\.])* quotedstring \"[^"]*\" +asteriskstring ({string}\*|{string}\\\*) comment #.*$ slash \/ @@ -499,6 +500,11 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) return QUOTED_STRING; } +{asteriskstring} { + yylval->string = xstrdup(yytext); + return ASTERISK_STRING; + } + {string} { yylval->string = xstrdup(yytext); return STRING; |