diff options
| author | Florian Westphal <fw@strlen.de> | 2022-06-10 13:01:46 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2022-06-10 13:09:11 +0200 |
| commit | 638af0ceb2b22307098bb2730822e148ef0b9424 (patch) | |
| tree | ec439ae301850e2f531d5edc7de19872f6921542 /src/scanner.l | |
| parent | 3eb0da9f47b10d4a98e9150e0fd67d8f616250f9 (diff) | |
Revert "scanner: flags: move to own scope"
Excess nesting of scanner scopes is very fragile and error prone:
rule `iif != lo ip daddr 127.0.0.1/8 counter limit rate 1/second log flags all prefix "nft_lo4 " drop`
fails with `Error: No symbol type information` hinting at `prefix`
Problem is that we nest via:
counter
limit
log
flags
By the time 'prefix' is scanned, state is still stuck in 'counter' due
to this nesting. Working around "prefix" isn't enough, any other
keyword, e.g. "level" in 'flags all level debug' will be parsed as 'string' too.
So, revert this.
Fixes: a16697097e2b ("scanner: flags: move to own scope")
Reported-by: Christian Göttsche <cgzones@googlemail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src/scanner.l')
| -rw-r--r-- | src/scanner.l | 18 |
1 files changed, 7 insertions, 11 deletions
diff --git a/src/scanner.l b/src/scanner.l index 2154281e..7eb74020 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -201,7 +201,6 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) %s SCANSTATE_CT %s SCANSTATE_COUNTER %s SCANSTATE_ETH -%s SCANSTATE_FLAGS %s SCANSTATE_ICMP %s SCANSTATE_IGMP %s SCANSTATE_IP @@ -339,7 +338,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "jump" { return JUMP; } "goto" { return GOTO; } "return" { return RETURN; } -<SCANSTATE_EXPR_QUEUE,SCANSTATE_STMT_DUP,SCANSTATE_STMT_FWD,SCANSTATE_STMT_NAT,SCANSTATE_STMT_TPROXY,SCANSTATE_FLAGS,SCANSTATE_IP,SCANSTATE_IP6>"to" { return TO; } /* XXX: SCANSTATE_FLAGS and SCANSTATE_IP here are workarounds */ +<SCANSTATE_EXPR_QUEUE,SCANSTATE_STMT_DUP,SCANSTATE_STMT_FWD,SCANSTATE_STMT_NAT,SCANSTATE_STMT_TPROXY,SCANSTATE_IP,SCANSTATE_IP6>"to" { return TO; } /* XXX: SCANSTATE_IP is a workaround */ "inet" { return INET; } "netdev" { return NETDEV; } @@ -363,14 +362,9 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "index" { return INDEX; } "comment" { return COMMENT; } -<SCANSTATE_FLAGS>{ - "constant" { return CONSTANT; } - "dynamic" { return DYNAMIC; } - - /* log flags */ - "all" { return ALL; } -} +"constant" { return CONSTANT; } "interval" { return INTERVAL; } +"dynamic" { return DYNAMIC; } "auto-merge" { return AUTOMERGE; } "timeout" { return TIMEOUT; } "gc-interval" { return GC_INTERVAL; } @@ -418,7 +412,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) } "queue" { scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_QUEUE); return QUEUE;} -<SCANSTATE_FLAGS,SCANSTATE_EXPR_QUEUE>{ +<SCANSTATE_EXPR_QUEUE>{ "num" { return QUEUENUM;} "bypass" { return BYPASS;} "fanout" { return FANOUT;} @@ -612,7 +606,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) <SCANSTATE_EXPR_COMP>{ "cpi" { return CPI; } } -"flags" { scanner_push_start_cond(yyscanner, SCANSTATE_FLAGS); return FLAGS; } +"flags" { return FLAGS; } "udp" { scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_UDP); return UDP; } "udplite" { scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_UDPLITE); return UDPLITE; } @@ -781,6 +775,8 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "notrack" { return NOTRACK; } +"all" { return ALL; } + <SCANSTATE_CMD_EXPORT,SCANSTATE_CMD_IMPORT,SCANSTATE_CMD_MONITOR>{ "xml" { return XML; } "json" { return JSON; } |