diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-11-24 13:58:57 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2017-11-24 15:50:01 +0100 |
| commit | 24a912eea21f9d18909c53a865cf623839616281 (patch) | |
| tree | 993eca503a34b8073efcd5fac93f8b78d1f67810 /src | |
| parent | 48661c54357aea271bf87ab2b6ef907eafc97e9a (diff) | |
parser_bison: dismiss anonymous meters
The former 'flow table' syntax allows flow tables with no name:
# nft add rule x y flow { ip saddr counter }
However, when listing, it leaks the name that it is autoallocating.
# nft list ruleset
table ip x {
chain y {
flow table __mt0 { ip saddr counter}
}
}
Which is odd since then restoring will use such a name.
Remove anonymous flow table/meters, so everyone needs to specify a name.
There is no way to fix this, given anonymous flag tells us that the set
behind this meter is bound to a rule, hence, released once the rule is
going - the term "anonymous" was not good choice as a flag in first
place. Only possibility is to strcmp for __ft to identify this is a
nameless meter, which is a hack.
Moreover, having no name means you cannot flush the set behind this
meter, which criples this feature for no reason.
On top of it, the wiki only documents named meters, and we have a record
of users complaining on this behaviour.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'src')
| -rw-r--r-- | src/evaluate.c | 3 | ||||
| -rw-r--r-- | src/parser_bison.y | 7 |
2 files changed, 1 insertions, 9 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index f30543f8..b0ce9f63 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -2042,8 +2042,7 @@ static int stmt_evaluate_meter(struct eval_ctx *ctx, struct stmt *stmt) if (key->timeout) set->set_flags |= NFT_SET_TIMEOUT; - setref = implicit_set_declaration(ctx, stmt->meter.name ?: "__mt%d", - key, set); + setref = implicit_set_declaration(ctx, stmt->meter.name, key, set); stmt->meter.set = setref; diff --git a/src/parser_bison.y b/src/parser_bison.y index 6610b9dc..d2673173 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -2489,13 +2489,6 @@ meter_stmt : meter_stmt_alloc meter_stmt_opts '{' meter_key_expr stmt '}' $$->location = @$; $$ = $1; } - | meter_stmt_alloc '{' meter_key_expr stmt '}' - { - $1->meter.key = $3; - $1->meter.stmt = $4; - $$->location = @$; - $$ = $1; - } ; meter_stmt_alloc : FLOW |