diff options
| -rw-r--r-- | include/nftables.h | 2 | ||||
| -rw-r--r-- | include/parser.h | 4 | ||||
| -rw-r--r-- | include/rule.h | 2 | ||||
| -rw-r--r-- | src/libnftables.c | 6 | ||||
| -rw-r--r-- | src/parser_bison.y | 6 | ||||
| -rw-r--r-- | src/rule.c | 15 | ||||
| -rwxr-xr-x | tests/shell/testcases/nft-i/0001define_0 | 22 |
7 files changed, 50 insertions, 7 deletions
diff --git a/include/nftables.h b/include/nftables.h index 21553c6b..90d33196 100644 --- a/include/nftables.h +++ b/include/nftables.h @@ -104,6 +104,7 @@ struct nft_cache { struct mnl_socket; struct parser_state; +struct scope; #define MAX_INCLUDE_DEPTH 16 @@ -119,6 +120,7 @@ struct nft_ctx { uint32_t flags; struct parser_state *state; void *scanner; + struct scope *top_scope; void *json_root; FILE *f[MAX_INCLUDE_DEPTH]; }; diff --git a/include/parser.h b/include/parser.h index 39a75212..949284d9 100644 --- a/include/parser.h +++ b/include/parser.h @@ -22,7 +22,6 @@ struct parser_state { struct list_head *msgs; unsigned int nerrs; - struct scope top_scope; struct scope *scopes[SCOPE_NEST_MAX]; unsigned int scope; @@ -32,7 +31,8 @@ struct parser_state { struct mnl_socket; extern void parser_init(struct nft_ctx *nft, struct parser_state *state, - struct list_head *msgs, struct list_head *cmds); + struct list_head *msgs, struct list_head *cmds, + struct scope *top_scope); extern int nft_parse(struct nft_ctx *ctx, void *, struct parser_state *state); extern void *scanner_init(struct parser_state *state); diff --git a/include/rule.h b/include/rule.h index 48b5ba50..0b2eba37 100644 --- a/include/rule.h +++ b/include/rule.h @@ -97,8 +97,10 @@ struct scope { struct list_head symbols; }; +extern struct scope *scope_alloc(void); extern struct scope *scope_init(struct scope *scope, const struct scope *parent); extern void scope_release(const struct scope *scope); +extern void scope_free(struct scope *scope); /** * struct symbol diff --git a/src/libnftables.c b/src/libnftables.c index e2037243..cd2fcf2f 100644 --- a/src/libnftables.c +++ b/src/libnftables.c @@ -155,6 +155,7 @@ struct nft_ctx *nft_ctx_new(uint32_t flags) nft_ctx_add_include_path(ctx, DEFAULT_INCLUDE_PATH); ctx->parser_max_errors = 10; init_list_head(&ctx->cache.list); + ctx->top_scope = scope_alloc(); ctx->flags = flags; ctx->output.output_fp = stdout; ctx->output.error_fp = stderr; @@ -292,6 +293,7 @@ void nft_ctx_free(struct nft_ctx *ctx) iface_cache_release(); cache_release(&ctx->cache); nft_ctx_clear_include_paths(ctx); + scope_free(ctx->top_scope); xfree(ctx->state); nft_exit(ctx); xfree(ctx); @@ -368,7 +370,7 @@ static int nft_parse_bison_buffer(struct nft_ctx *nft, const char *buf, { int ret; - parser_init(nft, nft->state, msgs, cmds); + parser_init(nft, nft->state, msgs, cmds, nft->top_scope); nft->scanner = scanner_init(nft->state); scanner_push_buffer(nft->scanner, &indesc_cmdline, buf); @@ -384,7 +386,7 @@ static int nft_parse_bison_filename(struct nft_ctx *nft, const char *filename, { int ret; - parser_init(nft, nft->state, msgs, cmds); + parser_init(nft, nft->state, msgs, cmds, nft->top_scope); nft->scanner = scanner_init(nft->state); if (scanner_read_file(nft, filename, &internal_location) < 0) return -1; diff --git a/src/parser_bison.y b/src/parser_bison.y index 6f525d5b..3f283256 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -42,13 +42,13 @@ #include "parser_bison.h" void parser_init(struct nft_ctx *nft, struct parser_state *state, - struct list_head *msgs, struct list_head *cmds) + struct list_head *msgs, struct list_head *cmds, + struct scope *top_scope) { memset(state, 0, sizeof(*state)); - init_list_head(&state->top_scope.symbols); state->msgs = msgs; state->cmds = cmds; - state->scopes[0] = scope_init(&state->top_scope, NULL); + state->scopes[0] = scope_init(top_scope, NULL); init_list_head(&state->indesc_list); } @@ -645,6 +645,15 @@ struct rule *rule_lookup_by_index(const struct chain *chain, uint64_t index) return NULL; } +struct scope *scope_alloc(void) +{ + struct scope *scope = xzalloc(sizeof(struct scope)); + + init_list_head(&scope->symbols); + + return scope; +} + struct scope *scope_init(struct scope *scope, const struct scope *parent) { scope->parent = parent; @@ -664,6 +673,12 @@ void scope_release(const struct scope *scope) } } +void scope_free(struct scope *scope) +{ + scope_release(scope); + xfree(scope); +} + void symbol_bind(struct scope *scope, const char *identifier, struct expr *expr) { struct symbol *sym; diff --git a/tests/shell/testcases/nft-i/0001define_0 b/tests/shell/testcases/nft-i/0001define_0 new file mode 100755 index 00000000..62e1b6de --- /dev/null +++ b/tests/shell/testcases/nft-i/0001define_0 @@ -0,0 +1,22 @@ +#!/bin/bash + +set -e + +# test if using defines in interactive nft sessions works + +$NFT -i >/dev/null <<EOF +add table inet t +add chain inet t c +define ports = { 22, 443 } +add rule inet t c tcp dport \$ports accept +add rule inet t c udp dport \$ports accept +EOF + +$NFT -i >/dev/null <<EOF +define port = 22 +flush chain inet t c +redefine port = 443 +delete chain inet t c +undefine port +delete table inet t +EOF |