diff options
author | Fernando Fernandez Mancera <ffmancera@riseup.net> | 2019-08-02 12:12:08 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-08-08 12:32:48 +0200 |
commit | 627c451b2351310da9ad82dbdb64747b1fada8e5 (patch) | |
tree | a049c393ec78296bd014d807943c573c75695e81 /src | |
parent | 45cb29a2ada4edfc2b547fe023d923ce0299a61d (diff) |
src: allow variables in the chain priority specification
This patch allows you to use variables in chain priority definitions,
e.g.
define prio = filter
define prionum = 10
define prioffset = "filter - 150"
add table ip foo
add chain ip foo bar { type filter hook input priority $prio; }
add chain ip foo ber { type filter hook input priority $prionum; }
add chain ip foo bor { type filter hook input priority $prioffset; }
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
-rw-r--r-- | src/datatype.c | 36 | ||||
-rwxr-xr-x[-rw-r--r--] | src/evaluate.c | 61 | ||||
-rw-r--r-- | src/json.c | 11 | ||||
-rw-r--r-- | src/mnl.c | 13 | ||||
-rw-r--r-- | src/netlink.c | 22 | ||||
-rw-r--r-- | src/parser_bison.y | 40 | ||||
-rw-r--r-- | src/parser_json.c | 10 | ||||
-rw-r--r-- | src/rule.c | 15 |
8 files changed, 167 insertions, 41 deletions
diff --git a/src/datatype.c b/src/datatype.c index 396a300c..93eb1855 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -1256,3 +1256,39 @@ const struct datatype boolean_type = { .sym_tbl = &boolean_tbl, .json = boolean_type_json, }; + +static struct error_record *priority_type_parse(struct parse_ctx *ctx, + const struct expr *sym, + struct expr **res) +{ + struct error_record *erec; + int num; + + erec = integer_type_parse(ctx, sym, res); + if (!erec) { + num = atoi(sym->identifier); + expr_free(*res); + *res = constant_expr_alloc(&sym->location, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, &num); + } else { + erec_destroy(erec); + *res = constant_expr_alloc(&sym->location, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen(sym->identifier) * BITS_PER_BYTE, + sym->identifier); + } + + return NULL; +} + +/* This datatype is not registered via datatype_register() + * since this datatype should not ever be used from either + * rules or elements. + */ +const struct datatype priority_type = { + .type = TYPE_STRING, + .name = "priority", + .desc = "priority type", + .parse = priority_type_parse, +}; diff --git a/src/evaluate.c b/src/evaluate.c index df8e808f..1879eb0f 100644..100755 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -3243,19 +3243,52 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) return 0; } -static bool evaluate_priority(struct prio_spec *prio, int family, int hook) +static bool evaluate_priority(struct eval_ctx *ctx, struct prio_spec *prio, + int family, int hook) { + char prio_str[NFT_NAME_MAXLEN]; + char prio_fst[NFT_NAME_MAXLEN]; + struct location loc; int priority; + int prio_snd; + char op; - /* A numeric value has been used to specify priority. */ - if (prio->str == NULL) + ctx->ectx.dtype = &priority_type; + ctx->ectx.len = NFT_NAME_MAXLEN * BITS_PER_BYTE; + if (expr_evaluate(ctx, &prio->expr) < 0) + return false; + if (prio->expr->etype != EXPR_VALUE) { + expr_error(ctx->msgs, prio->expr, "%s is not a valid " + "priority expression", expr_name(prio->expr)); + return false; + } + if (prio->expr->dtype->type == TYPE_INTEGER) return true; - priority = std_prio_lookup(prio->str, family, hook); - if (priority == NF_IP_PRI_LAST) - return false; - prio->num += priority; + mpz_export_data(prio_str, prio->expr->value, BYTEORDER_HOST_ENDIAN, + NFT_NAME_MAXLEN); + loc = prio->expr->location; + expr_free(prio->expr); + if (sscanf(prio_str, "%s %c %d", prio_fst, &op, &prio_snd) < 3) { + priority = std_prio_lookup(prio_str, family, hook); + if (priority == NF_IP_PRI_LAST) + return false; + } else { + priority = std_prio_lookup(prio_fst, family, hook); + if (priority == NF_IP_PRI_LAST) + return false; + if (op == '+') + priority += prio_snd; + else if (op == '-') + priority -= prio_snd; + else + return false; + } + prio->expr = constant_expr_alloc(&loc, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, + &priority); return true; } @@ -3273,10 +3306,10 @@ static int flowtable_evaluate(struct eval_ctx *ctx, struct flowtable *ft) if (ft->hooknum == NF_INET_NUMHOOKS) return chain_error(ctx, ft, "invalid hook %s", ft->hookstr); - if (!evaluate_priority(&ft->priority, NFPROTO_NETDEV, ft->hooknum)) + if (!evaluate_priority(ctx, &ft->priority, NFPROTO_NETDEV, ft->hooknum)) return __stmt_binary_error(ctx, &ft->priority.loc, NULL, - "'%s' is invalid priority.", - ft->priority.str); + "invalid priority expression %s.", + expr_name(ft->priority.expr)); if (!ft->dev_expr) return chain_error(ctx, ft, "Unbound flowtable not allowed (must specify devices)"); @@ -3471,11 +3504,11 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) return chain_error(ctx, chain, "invalid hook %s", chain->hookstr); - if (!evaluate_priority(&chain->priority, chain->handle.family, - chain->hooknum)) + if (!evaluate_priority(ctx, &chain->priority, + chain->handle.family, chain->hooknum)) return __stmt_binary_error(ctx, &chain->priority.loc, NULL, - "'%s' is invalid priority in this context.", - chain->priority.str); + "invalid priority expression %s in this context.", + expr_name(chain->priority.expr)); } list_for_each_entry(rule, &chain->rules, list) { @@ -223,6 +223,7 @@ static json_t *rule_print_json(struct output_ctx *octx, static json_t *chain_print_json(const struct chain *chain) { json_t *root, *tmp; + int priority; root = json_pack("{s:s, s:s, s:s, s:I}", "family", family2str(chain->handle.family), @@ -231,11 +232,13 @@ static json_t *chain_print_json(const struct chain *chain) "handle", chain->handle.handle.id); if (chain->flags & CHAIN_F_BASECHAIN) { + mpz_export_data(&priority, chain->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); tmp = json_pack("{s:s, s:s, s:i, s:s}", "type", chain->type, "hook", hooknum2str(chain->handle.family, chain->hooknum), - "prio", chain->priority.num, + "prio", priority, "policy", chain_policy2str(chain->policy)); if (chain->dev) json_object_set_new(tmp, "dev", json_string(chain->dev)); @@ -373,14 +376,16 @@ static json_t *obj_print_json(const struct obj *obj) static json_t *flowtable_print_json(const struct flowtable *ftable) { json_t *root, *devs = NULL; - int i; + int i, priority; + mpz_export_data(&priority, ftable->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); root = json_pack("{s:s, s:s, s:s, s:s, s:i}", "family", family2str(ftable->handle.family), "name", ftable->handle.flowtable, "table", ftable->handle.table.name, "hook", hooknum2str(NFPROTO_NETDEV, ftable->hooknum), - "prio", ftable->priority.num); + "prio", priority); for (i = 0; i < ftable->dev_array_len; i++) { const char *dev = ftable->dev_array[i]; @@ -518,6 +518,7 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd, { struct nftnl_chain *nlc; struct nlmsghdr *nlh; + int priority; nlc = nftnl_chain_alloc(); if (nlc == NULL) @@ -531,8 +532,10 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd, if (cmd->chain->flags & CHAIN_F_BASECHAIN) { nftnl_chain_set_u32(nlc, NFTNL_CHAIN_HOOKNUM, cmd->chain->hooknum); - nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO, - cmd->chain->priority.num); + mpz_export_data(&priority, + cmd->chain->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); + nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO, priority); nftnl_chain_set_str(nlc, NFTNL_CHAIN_TYPE, cmd->chain->type); } @@ -1371,6 +1374,7 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, const struct cmd *cmd, const char *dev_array[8]; struct nlmsghdr *nlh; struct expr *expr; + int priority; int i = 0; flo = nftnl_flowtable_alloc(); @@ -1385,8 +1389,9 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, const struct cmd *cmd, cmd->handle.flowtable); nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_HOOKNUM, cmd->flowtable->hooknum); - nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, - cmd->flowtable->priority.num); + mpz_export_data(&priority, cmd->flowtable->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); + nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, priority); list_for_each_entry(expr, &cmd->flowtable->dev_expr->expressions, list) dev_array[i++] = expr->identifier; diff --git a/src/netlink.c b/src/netlink.c index 14b0df41..93067ef5 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -369,6 +369,7 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx, const struct nftnl_chain *nlc) { struct chain *chain; + int priority; chain = chain_alloc(nftnl_chain_get_str(nlc, NFTNL_CHAIN_NAME)); chain->handle.family = @@ -386,8 +387,13 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx, nftnl_chain_get_u32(nlc, NFTNL_CHAIN_HOOKNUM); chain->hookstr = hooknum2str(chain->handle.family, chain->hooknum); - chain->priority.num = - nftnl_chain_get_s32(nlc, NFTNL_CHAIN_PRIO); + priority = nftnl_chain_get_s32(nlc, NFTNL_CHAIN_PRIO); + chain->priority.expr = + constant_expr_alloc(&netlink_location, + &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, + &priority); chain->type = xstrdup(nftnl_chain_get_str(nlc, NFTNL_CHAIN_TYPE)); chain->policy = @@ -1080,7 +1086,7 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx, { struct flowtable *flowtable; const char * const *dev_array; - int len = 0, i; + int len = 0, i, priority; flowtable = flowtable_alloc(&netlink_location); flowtable->handle.family = @@ -1099,8 +1105,14 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx, flowtable->dev_array_len = len; - flowtable->priority.num = - nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO); + priority = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO); + flowtable->priority.expr = + constant_expr_alloc(&netlink_location, + &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * + BITS_PER_BYTE, + &priority); flowtable->hooknum = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_HOOKNUM); diff --git a/src/parser_bison.y b/src/parser_bison.y index b463a140..f2b1e5ac 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -1972,27 +1972,55 @@ extended_prio_name : OUT extended_prio_spec : int_num { struct prio_spec spec = {0}; - spec.num = $1; + + spec.expr = constant_expr_alloc(&@$, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * + BITS_PER_BYTE, &$1); + $$ = spec; + } + | variable_expr + { + struct prio_spec spec = {0}; + + datatype_set($1->sym->expr, &priority_type); + spec.expr = $1; $$ = spec; } | extended_prio_name { struct prio_spec spec = {0}; - spec.str = $1; + + spec.expr = constant_expr_alloc(&@$, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen($1) * BITS_PER_BYTE, + $1); + xfree($1); $$ = spec; } | extended_prio_name PLUS NUM { struct prio_spec spec = {0}; - spec.num = $3; - spec.str = $1; + + char str[NFT_NAME_MAXLEN]; + snprintf(str, sizeof(str), "%s + %" PRIu64, $1, $3); + spec.expr = constant_expr_alloc(&@$, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen(str) * BITS_PER_BYTE, + str); + xfree($1); $$ = spec; } | extended_prio_name DASH NUM { struct prio_spec spec = {0}; - spec.num = -$3; - spec.str = $1; + char str[NFT_NAME_MAXLEN]; + + snprintf(str, sizeof(str), "%s - %" PRIu64, $1, $3); + spec.expr = constant_expr_alloc(&@$, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen(str) * BITS_PER_BYTE, + str); $$ = spec; } ; diff --git a/src/parser_json.c b/src/parser_json.c index 76c0a5cc..a45234ad 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -2580,7 +2580,10 @@ static struct cmd *json_parse_cmd_add_chain(struct json_ctx *ctx, json_t *root, chain = chain_alloc(NULL); chain->flags |= CHAIN_F_BASECHAIN; chain->type = xstrdup(type); - chain->priority.num = prio; + chain->priority.expr = constant_expr_alloc(int_loc, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, + &prio); chain->hookstr = chain_hookname_lookup(hookstr); if (!chain->hookstr) { json_error(ctx, "Invalid chain hook '%s'.", hookstr); @@ -2947,7 +2950,10 @@ static struct cmd *json_parse_cmd_add_flowtable(struct json_ctx *ctx, flowtable = flowtable_alloc(int_loc); flowtable->hookstr = hookstr; - flowtable->priority.num = prio; + flowtable->priority.expr = + constant_expr_alloc(int_loc, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, &prio); flowtable->dev_expr = json_parse_flowtable_devs(ctx, devs); if (!flowtable->dev_expr) { @@ -821,7 +821,7 @@ void chain_free(struct chain *chain) xfree(chain->type); if (chain->dev != NULL) xfree(chain->dev); - xfree(chain->priority.str); + expr_free(chain->priority.expr); xfree(chain); } @@ -1051,14 +1051,15 @@ int std_prio_lookup(const char *std_prio_name, int family, int hook) static const char *prio2str(const struct output_ctx *octx, char *buf, size_t bufsize, int family, int hook, - int prio) + const struct expr *expr) { const struct prio_tag *prio_arr; + int std_prio, offset, prio; const char *std_prio_str; const int reach = 10; - int std_prio, offset; size_t i, arr_size; + mpz_export_data(&prio, expr->value, BYTEORDER_HOST_ENDIAN, sizeof(int)); if (family == NFPROTO_BRIDGE) { prio_arr = bridge_std_prios; arr_size = array_size(bridge_std_prios); @@ -1110,7 +1111,7 @@ static void chain_print_declaration(const struct chain *chain, nft_print(octx, " priority %s; policy %s;\n", prio2str(octx, priobuf, sizeof(priobuf), chain->handle.family, chain->hooknum, - chain->priority.num), + chain->priority.expr), chain_policy2str(chain->policy)); } } @@ -1141,7 +1142,7 @@ void chain_print_plain(const struct chain *chain, struct output_ctx *octx) chain->type, chain->hookstr, prio2str(octx, priobuf, sizeof(priobuf), chain->handle.family, chain->hooknum, - chain->priority.num), + chain->priority.expr), chain_policy2str(chain->policy)); } if (nft_output_handle(octx)) @@ -2047,7 +2048,7 @@ void flowtable_free(struct flowtable *flowtable) if (--flowtable->refcnt > 0) return; handle_free(&flowtable->handle); - xfree(flowtable->priority.str); + expr_free(flowtable->priority.expr); xfree(flowtable); } @@ -2077,7 +2078,7 @@ static void flowtable_print_declaration(const struct flowtable *flowtable, opts->tab, opts->tab, hooknum2str(NFPROTO_NETDEV, flowtable->hooknum), prio2str(octx, priobuf, sizeof(priobuf), NFPROTO_NETDEV, - flowtable->hooknum, flowtable->priority.num), + flowtable->hooknum, flowtable->priority.expr), opts->stmt_separator); nft_print(octx, "%s%sdevices = { ", opts->tab, opts->tab); |