From 627c451b2351310da9ad82dbdb64747b1fada8e5 Mon Sep 17 00:00:00 2001 From: Fernando Fernandez Mancera Date: Fri, 2 Aug 2019 12:12:08 +0200 Subject: src: allow variables in the chain priority specification This patch allows you to use variables in chain priority definitions, e.g. define prio = filter define prionum = 10 define prioffset = "filter - 150" add table ip foo add chain ip foo bar { type filter hook input priority $prio; } add chain ip foo ber { type filter hook input priority $prionum; } add chain ip foo bor { type filter hook input priority $prioffset; } Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso --- include/datatype.h | 1 + include/rule.h | 7 +-- src/datatype.c | 36 +++++++++++++ src/evaluate.c | 61 +++++++++++++++++----- src/json.c | 11 ++-- src/mnl.c | 13 +++-- src/netlink.c | 22 ++++++-- src/parser_bison.y | 40 +++++++++++--- src/parser_json.c | 10 +++- src/rule.c | 15 +++--- .../shell/testcases/nft-f/0021priority_variable_0 | 17 ++++++ .../shell/testcases/nft-f/0022priority_variable_0 | 17 ++++++ .../shell/testcases/nft-f/0023priority_variable_1 | 18 +++++++ .../shell/testcases/nft-f/0024priority_variable_1 | 18 +++++++ .../nft-f/dumps/0021priority_variable_0.nft | 5 ++ .../nft-f/dumps/0022priority_variable_0.nft | 5 ++ 16 files changed, 250 insertions(+), 46 deletions(-) mode change 100644 => 100755 src/evaluate.c create mode 100755 tests/shell/testcases/nft-f/0021priority_variable_0 create mode 100755 tests/shell/testcases/nft-f/0022priority_variable_0 create mode 100755 tests/shell/testcases/nft-f/0023priority_variable_1 create mode 100755 tests/shell/testcases/nft-f/0024priority_variable_1 create mode 100644 tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft create mode 100644 tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft diff --git a/include/datatype.h b/include/datatype.h index cf115158..ddcb7db8 100644 --- a/include/datatype.h +++ b/include/datatype.h @@ -262,6 +262,7 @@ extern const struct datatype icmpx_code_type; extern const struct datatype igmp_type_type; extern const struct datatype time_type; extern const struct datatype boolean_type; +extern const struct datatype priority_type; void inet_service_type_print(const struct expr *expr, struct output_ctx *octx); diff --git a/include/rule.h b/include/rule.h index ee881b9c..4c8cab13 100644 --- a/include/rule.h +++ b/include/rule.h @@ -174,14 +174,11 @@ enum chain_flags { * struct prio_spec - extendend priority specification for mixed * textual/numerical parsing. * - * @str: name of the standard priority value - * @num: Numerical value. This MUST contain the parsed value of str after - * evaluation. + * @expr: expr of the standard priority value */ struct prio_spec { - const char *str; - int num; struct location loc; + struct expr *expr; }; /** diff --git a/src/datatype.c b/src/datatype.c index 396a300c..93eb1855 100644 --- a/src/datatype.c +++ b/src/datatype.c @@ -1256,3 +1256,39 @@ const struct datatype boolean_type = { .sym_tbl = &boolean_tbl, .json = boolean_type_json, }; + +static struct error_record *priority_type_parse(struct parse_ctx *ctx, + const struct expr *sym, + struct expr **res) +{ + struct error_record *erec; + int num; + + erec = integer_type_parse(ctx, sym, res); + if (!erec) { + num = atoi(sym->identifier); + expr_free(*res); + *res = constant_expr_alloc(&sym->location, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, &num); + } else { + erec_destroy(erec); + *res = constant_expr_alloc(&sym->location, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen(sym->identifier) * BITS_PER_BYTE, + sym->identifier); + } + + return NULL; +} + +/* This datatype is not registered via datatype_register() + * since this datatype should not ever be used from either + * rules or elements. + */ +const struct datatype priority_type = { + .type = TYPE_STRING, + .name = "priority", + .desc = "priority type", + .parse = priority_type_parse, +}; diff --git a/src/evaluate.c b/src/evaluate.c old mode 100644 new mode 100755 index df8e808f..1879eb0f --- a/src/evaluate.c +++ b/src/evaluate.c @@ -3243,19 +3243,52 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set) return 0; } -static bool evaluate_priority(struct prio_spec *prio, int family, int hook) +static bool evaluate_priority(struct eval_ctx *ctx, struct prio_spec *prio, + int family, int hook) { + char prio_str[NFT_NAME_MAXLEN]; + char prio_fst[NFT_NAME_MAXLEN]; + struct location loc; int priority; + int prio_snd; + char op; - /* A numeric value has been used to specify priority. */ - if (prio->str == NULL) + ctx->ectx.dtype = &priority_type; + ctx->ectx.len = NFT_NAME_MAXLEN * BITS_PER_BYTE; + if (expr_evaluate(ctx, &prio->expr) < 0) + return false; + if (prio->expr->etype != EXPR_VALUE) { + expr_error(ctx->msgs, prio->expr, "%s is not a valid " + "priority expression", expr_name(prio->expr)); + return false; + } + if (prio->expr->dtype->type == TYPE_INTEGER) return true; - priority = std_prio_lookup(prio->str, family, hook); - if (priority == NF_IP_PRI_LAST) - return false; - prio->num += priority; + mpz_export_data(prio_str, prio->expr->value, BYTEORDER_HOST_ENDIAN, + NFT_NAME_MAXLEN); + loc = prio->expr->location; + expr_free(prio->expr); + if (sscanf(prio_str, "%s %c %d", prio_fst, &op, &prio_snd) < 3) { + priority = std_prio_lookup(prio_str, family, hook); + if (priority == NF_IP_PRI_LAST) + return false; + } else { + priority = std_prio_lookup(prio_fst, family, hook); + if (priority == NF_IP_PRI_LAST) + return false; + if (op == '+') + priority += prio_snd; + else if (op == '-') + priority -= prio_snd; + else + return false; + } + prio->expr = constant_expr_alloc(&loc, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, + &priority); return true; } @@ -3273,10 +3306,10 @@ static int flowtable_evaluate(struct eval_ctx *ctx, struct flowtable *ft) if (ft->hooknum == NF_INET_NUMHOOKS) return chain_error(ctx, ft, "invalid hook %s", ft->hookstr); - if (!evaluate_priority(&ft->priority, NFPROTO_NETDEV, ft->hooknum)) + if (!evaluate_priority(ctx, &ft->priority, NFPROTO_NETDEV, ft->hooknum)) return __stmt_binary_error(ctx, &ft->priority.loc, NULL, - "'%s' is invalid priority.", - ft->priority.str); + "invalid priority expression %s.", + expr_name(ft->priority.expr)); if (!ft->dev_expr) return chain_error(ctx, ft, "Unbound flowtable not allowed (must specify devices)"); @@ -3471,11 +3504,11 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) return chain_error(ctx, chain, "invalid hook %s", chain->hookstr); - if (!evaluate_priority(&chain->priority, chain->handle.family, - chain->hooknum)) + if (!evaluate_priority(ctx, &chain->priority, + chain->handle.family, chain->hooknum)) return __stmt_binary_error(ctx, &chain->priority.loc, NULL, - "'%s' is invalid priority in this context.", - chain->priority.str); + "invalid priority expression %s in this context.", + expr_name(chain->priority.expr)); } list_for_each_entry(rule, &chain->rules, list) { diff --git a/src/json.c b/src/json.c index 9dfa3076..fd184183 100644 --- a/src/json.c +++ b/src/json.c @@ -223,6 +223,7 @@ static json_t *rule_print_json(struct output_ctx *octx, static json_t *chain_print_json(const struct chain *chain) { json_t *root, *tmp; + int priority; root = json_pack("{s:s, s:s, s:s, s:I}", "family", family2str(chain->handle.family), @@ -231,11 +232,13 @@ static json_t *chain_print_json(const struct chain *chain) "handle", chain->handle.handle.id); if (chain->flags & CHAIN_F_BASECHAIN) { + mpz_export_data(&priority, chain->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); tmp = json_pack("{s:s, s:s, s:i, s:s}", "type", chain->type, "hook", hooknum2str(chain->handle.family, chain->hooknum), - "prio", chain->priority.num, + "prio", priority, "policy", chain_policy2str(chain->policy)); if (chain->dev) json_object_set_new(tmp, "dev", json_string(chain->dev)); @@ -373,14 +376,16 @@ static json_t *obj_print_json(const struct obj *obj) static json_t *flowtable_print_json(const struct flowtable *ftable) { json_t *root, *devs = NULL; - int i; + int i, priority; + mpz_export_data(&priority, ftable->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); root = json_pack("{s:s, s:s, s:s, s:s, s:i}", "family", family2str(ftable->handle.family), "name", ftable->handle.flowtable, "table", ftable->handle.table.name, "hook", hooknum2str(NFPROTO_NETDEV, ftable->hooknum), - "prio", ftable->priority.num); + "prio", priority); for (i = 0; i < ftable->dev_array_len; i++) { const char *dev = ftable->dev_array[i]; diff --git a/src/mnl.c b/src/mnl.c index eab8d548..8921ccfb 100644 --- a/src/mnl.c +++ b/src/mnl.c @@ -518,6 +518,7 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd, { struct nftnl_chain *nlc; struct nlmsghdr *nlh; + int priority; nlc = nftnl_chain_alloc(); if (nlc == NULL) @@ -531,8 +532,10 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd, if (cmd->chain->flags & CHAIN_F_BASECHAIN) { nftnl_chain_set_u32(nlc, NFTNL_CHAIN_HOOKNUM, cmd->chain->hooknum); - nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO, - cmd->chain->priority.num); + mpz_export_data(&priority, + cmd->chain->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); + nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO, priority); nftnl_chain_set_str(nlc, NFTNL_CHAIN_TYPE, cmd->chain->type); } @@ -1371,6 +1374,7 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, const struct cmd *cmd, const char *dev_array[8]; struct nlmsghdr *nlh; struct expr *expr; + int priority; int i = 0; flo = nftnl_flowtable_alloc(); @@ -1385,8 +1389,9 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, const struct cmd *cmd, cmd->handle.flowtable); nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_HOOKNUM, cmd->flowtable->hooknum); - nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, - cmd->flowtable->priority.num); + mpz_export_data(&priority, cmd->flowtable->priority.expr->value, + BYTEORDER_HOST_ENDIAN, sizeof(int)); + nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, priority); list_for_each_entry(expr, &cmd->flowtable->dev_expr->expressions, list) dev_array[i++] = expr->identifier; diff --git a/src/netlink.c b/src/netlink.c index 14b0df41..93067ef5 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -369,6 +369,7 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx, const struct nftnl_chain *nlc) { struct chain *chain; + int priority; chain = chain_alloc(nftnl_chain_get_str(nlc, NFTNL_CHAIN_NAME)); chain->handle.family = @@ -386,8 +387,13 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx, nftnl_chain_get_u32(nlc, NFTNL_CHAIN_HOOKNUM); chain->hookstr = hooknum2str(chain->handle.family, chain->hooknum); - chain->priority.num = - nftnl_chain_get_s32(nlc, NFTNL_CHAIN_PRIO); + priority = nftnl_chain_get_s32(nlc, NFTNL_CHAIN_PRIO); + chain->priority.expr = + constant_expr_alloc(&netlink_location, + &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, + &priority); chain->type = xstrdup(nftnl_chain_get_str(nlc, NFTNL_CHAIN_TYPE)); chain->policy = @@ -1080,7 +1086,7 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx, { struct flowtable *flowtable; const char * const *dev_array; - int len = 0, i; + int len = 0, i, priority; flowtable = flowtable_alloc(&netlink_location); flowtable->handle.family = @@ -1099,8 +1105,14 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx, flowtable->dev_array_len = len; - flowtable->priority.num = - nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO); + priority = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO); + flowtable->priority.expr = + constant_expr_alloc(&netlink_location, + &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * + BITS_PER_BYTE, + &priority); flowtable->hooknum = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_HOOKNUM); diff --git a/src/parser_bison.y b/src/parser_bison.y index b463a140..f2b1e5ac 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -1972,27 +1972,55 @@ extended_prio_name : OUT extended_prio_spec : int_num { struct prio_spec spec = {0}; - spec.num = $1; + + spec.expr = constant_expr_alloc(&@$, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * + BITS_PER_BYTE, &$1); + $$ = spec; + } + | variable_expr + { + struct prio_spec spec = {0}; + + datatype_set($1->sym->expr, &priority_type); + spec.expr = $1; $$ = spec; } | extended_prio_name { struct prio_spec spec = {0}; - spec.str = $1; + + spec.expr = constant_expr_alloc(&@$, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen($1) * BITS_PER_BYTE, + $1); + xfree($1); $$ = spec; } | extended_prio_name PLUS NUM { struct prio_spec spec = {0}; - spec.num = $3; - spec.str = $1; + + char str[NFT_NAME_MAXLEN]; + snprintf(str, sizeof(str), "%s + %" PRIu64, $1, $3); + spec.expr = constant_expr_alloc(&@$, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen(str) * BITS_PER_BYTE, + str); + xfree($1); $$ = spec; } | extended_prio_name DASH NUM { struct prio_spec spec = {0}; - spec.num = -$3; - spec.str = $1; + char str[NFT_NAME_MAXLEN]; + + snprintf(str, sizeof(str), "%s - %" PRIu64, $1, $3); + spec.expr = constant_expr_alloc(&@$, &string_type, + BYTEORDER_HOST_ENDIAN, + strlen(str) * BITS_PER_BYTE, + str); $$ = spec; } ; diff --git a/src/parser_json.c b/src/parser_json.c index 76c0a5cc..a45234ad 100644 --- a/src/parser_json.c +++ b/src/parser_json.c @@ -2580,7 +2580,10 @@ static struct cmd *json_parse_cmd_add_chain(struct json_ctx *ctx, json_t *root, chain = chain_alloc(NULL); chain->flags |= CHAIN_F_BASECHAIN; chain->type = xstrdup(type); - chain->priority.num = prio; + chain->priority.expr = constant_expr_alloc(int_loc, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, + &prio); chain->hookstr = chain_hookname_lookup(hookstr); if (!chain->hookstr) { json_error(ctx, "Invalid chain hook '%s'.", hookstr); @@ -2947,7 +2950,10 @@ static struct cmd *json_parse_cmd_add_flowtable(struct json_ctx *ctx, flowtable = flowtable_alloc(int_loc); flowtable->hookstr = hookstr; - flowtable->priority.num = prio; + flowtable->priority.expr = + constant_expr_alloc(int_loc, &integer_type, + BYTEORDER_HOST_ENDIAN, + sizeof(int) * BITS_PER_BYTE, &prio); flowtable->dev_expr = json_parse_flowtable_devs(ctx, devs); if (!flowtable->dev_expr) { diff --git a/src/rule.c b/src/rule.c index 29360657..2aca8aff 100644 --- a/src/rule.c +++ b/src/rule.c @@ -821,7 +821,7 @@ void chain_free(struct chain *chain) xfree(chain->type); if (chain->dev != NULL) xfree(chain->dev); - xfree(chain->priority.str); + expr_free(chain->priority.expr); xfree(chain); } @@ -1051,14 +1051,15 @@ int std_prio_lookup(const char *std_prio_name, int family, int hook) static const char *prio2str(const struct output_ctx *octx, char *buf, size_t bufsize, int family, int hook, - int prio) + const struct expr *expr) { const struct prio_tag *prio_arr; + int std_prio, offset, prio; const char *std_prio_str; const int reach = 10; - int std_prio, offset; size_t i, arr_size; + mpz_export_data(&prio, expr->value, BYTEORDER_HOST_ENDIAN, sizeof(int)); if (family == NFPROTO_BRIDGE) { prio_arr = bridge_std_prios; arr_size = array_size(bridge_std_prios); @@ -1110,7 +1111,7 @@ static void chain_print_declaration(const struct chain *chain, nft_print(octx, " priority %s; policy %s;\n", prio2str(octx, priobuf, sizeof(priobuf), chain->handle.family, chain->hooknum, - chain->priority.num), + chain->priority.expr), chain_policy2str(chain->policy)); } } @@ -1141,7 +1142,7 @@ void chain_print_plain(const struct chain *chain, struct output_ctx *octx) chain->type, chain->hookstr, prio2str(octx, priobuf, sizeof(priobuf), chain->handle.family, chain->hooknum, - chain->priority.num), + chain->priority.expr), chain_policy2str(chain->policy)); } if (nft_output_handle(octx)) @@ -2047,7 +2048,7 @@ void flowtable_free(struct flowtable *flowtable) if (--flowtable->refcnt > 0) return; handle_free(&flowtable->handle); - xfree(flowtable->priority.str); + expr_free(flowtable->priority.expr); xfree(flowtable); } @@ -2077,7 +2078,7 @@ static void flowtable_print_declaration(const struct flowtable *flowtable, opts->tab, opts->tab, hooknum2str(NFPROTO_NETDEV, flowtable->hooknum), prio2str(octx, priobuf, sizeof(priobuf), NFPROTO_NETDEV, - flowtable->hooknum, flowtable->priority.num), + flowtable->hooknum, flowtable->priority.expr), opts->stmt_separator); nft_print(octx, "%s%sdevices = { ", opts->tab, opts->tab); diff --git a/tests/shell/testcases/nft-f/0021priority_variable_0 b/tests/shell/testcases/nft-f/0021priority_variable_0 new file mode 100755 index 00000000..2b143dbb --- /dev/null +++ b/tests/shell/testcases/nft-f/0021priority_variable_0 @@ -0,0 +1,17 @@ +#!/bin/bash + +# Tests use of variables in priority specification + +set -e + +RULESET=" +define pri = filter + +table inet global { + chain prerouting { + type filter hook prerouting priority \$pri + policy accept + } +}" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/nft-f/0022priority_variable_0 b/tests/shell/testcases/nft-f/0022priority_variable_0 new file mode 100755 index 00000000..51bc5eb1 --- /dev/null +++ b/tests/shell/testcases/nft-f/0022priority_variable_0 @@ -0,0 +1,17 @@ +#!/bin/bash + +# Tests use of variables in priority specification + +set -e + +RULESET=" +define pri = 10 + +table inet global { + chain prerouting { + type filter hook prerouting priority \$pri + policy accept + } +}" + +$NFT -f - <<< "$RULESET" diff --git a/tests/shell/testcases/nft-f/0023priority_variable_1 b/tests/shell/testcases/nft-f/0023priority_variable_1 new file mode 100755 index 00000000..eddaf5b9 --- /dev/null +++ b/tests/shell/testcases/nft-f/0023priority_variable_1 @@ -0,0 +1,18 @@ +#!/bin/bash + +# Tests use of variables in priority specification + +set -e + +RULESET=" +define pri = * + +table inet global { + chain prerouting { + type filter hook prerouting priority \$pri + policy accept + } +}" + +$NFT -f - <<< "$RULESET" && exit 1 +exit 0 diff --git a/tests/shell/testcases/nft-f/0024priority_variable_1 b/tests/shell/testcases/nft-f/0024priority_variable_1 new file mode 100755 index 00000000..592cb56b --- /dev/null +++ b/tests/shell/testcases/nft-f/0024priority_variable_1 @@ -0,0 +1,18 @@ +#!/bin/bash + +# Tests use of variables in priority specification + +set -e + +RULESET=" +define pri = { 127.0.0.1 } + +table inet global { + chain prerouting { + type filter hook prerouting priority \$pri + policy accept + } +}" + +$NFT -f - <<< "$RULESET" && exit 1 +exit 0 diff --git a/tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft b/tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft new file mode 100644 index 00000000..f4093097 --- /dev/null +++ b/tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft @@ -0,0 +1,5 @@ +table inet global { + chain prerouting { + type filter hook prerouting priority filter; policy accept; + } +} diff --git a/tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft b/tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft new file mode 100644 index 00000000..2e944599 --- /dev/null +++ b/tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft @@ -0,0 +1,5 @@ +table inet global { + chain prerouting { + type filter hook prerouting priority filter + 10; policy accept; + } +} -- cgit v1.2.3