From 816d8c7659c1d90ce6827baaa939820a3bae2ae0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 9 May 2018 16:03:42 +0200 Subject: Support 'add/insert rule index ' Allow to specify an absolute rule position in add/insert commands like with iptables. The translation to rule handle takes place in userspace, so no kernel support for this is needed. Possible undesired effects are pointed out in man page to make users aware that this way of specifying a rule location might not be ideal. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 174150aa..0e3ee84f 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -485,6 +485,7 @@ int nft_lex(void *, void *, void *); %token SEED "seed" %token POSITION "position" +%token INDEX "index" %token COMMENT "comment" %token XML "xml" @@ -512,8 +513,8 @@ int nft_lex(void *, void *, void *); %type base_cmd add_cmd replace_cmd create_cmd insert_cmd delete_cmd get_cmd list_cmd reset_cmd flush_cmd rename_cmd export_cmd monitor_cmd describe_cmd import_cmd %destructor { cmd_free($$); } base_cmd add_cmd replace_cmd create_cmd insert_cmd delete_cmd get_cmd list_cmd reset_cmd flush_cmd rename_cmd export_cmd monitor_cmd describe_cmd import_cmd -%type table_spec tableid_spec chain_spec chainid_spec flowtable_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec -%destructor { handle_free(&$$); } table_spec tableid_spec chain_spec chainid_spec flowtable_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec +%type table_spec tableid_spec chain_spec chainid_spec flowtable_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec index_spec +%destructor { handle_free(&$$); } table_spec tableid_spec chain_spec chainid_spec flowtable_spec chain_identifier ruleid_spec handle_spec position_spec rule_position ruleset_spec index_spec %type set_spec setid_spec set_identifier flowtable_identifier obj_spec objid_spec obj_identifier %destructor { handle_free(&$$); } set_spec setid_spec set_identifier obj_spec objid_spec obj_identifier %type family_spec family_spec_explicit chain_policy prio_spec @@ -1961,6 +1962,14 @@ position_spec : POSITION NUM } ; +index_spec : INDEX NUM + { + memset(&$$, 0, sizeof($$)); + $$.index.location = @$; + $$.index.id = $2 + 1; + } + ; + rule_position : chain_spec { $$ = $1; @@ -1978,6 +1987,11 @@ rule_position : chain_spec handle_merge(&$1, &$2); $$ = $1; } + | chain_spec index_spec + { + handle_merge(&$1, &$2); + $$ = $1; + } ; ruleid_spec : chain_spec handle_spec -- cgit v1.2.3