diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-08-11 12:08:41 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-08-12 16:49:04 +0200 |
| commit | bb6b4c4c794a9090547f562f2bba8cf5f0048127 (patch) | |
| tree | 93d1580cc976a7cea821639980c19ec354762767 /src | |
| parent | 26e6b6e9018c342b58a11e5f5b713a0212e03415 (diff) | |
evaluate: expand variable containing set into multiple mappings
# cat x.nft
define interfaces = { eth0, eth1 }
table ip x {
chain y {
type filter hook input priority 0; policy accept;
iifname vmap { lo : accept, $interfaces : drop }
}
}
# nft -f x.nft
# nft list ruleset
table ip x {
chain y {
type filter hook input priority 0; policy accept;
iifname vmap { "lo" : accept, "eth0" : drop, "eth1" : drop }
}
}
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/evaluate.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 8b5f51ce..8ebc7561 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -1431,6 +1431,23 @@ static int expr_evaluate_set(struct eval_ctx *ctx, struct expr **expr) if (list_member_evaluate(ctx, &i) < 0) return -1; + if (i->etype == EXPR_MAPPING && + i->left->etype == EXPR_SET_ELEM && + i->left->key->etype == EXPR_SET) { + struct expr *new, *j; + + list_for_each_entry(j, &i->left->key->expressions, list) { + new = mapping_expr_alloc(&i->location, + expr_get(j), + expr_clone(i->right)); + list_add_tail(&new->list, &set->expressions); + set->size++; + } + list_del(&i->list); + expr_free(i); + continue; + } + elem = expr_set_elem(i); if (elem->etype == EXPR_SET_ELEM && |