src: allow variables in the chain priority specification

This patch allows you to use variables in chain priority definitions,
e.g.

define prio = filter
define prionum = 10
define prioffset = "filter - 150"

add table ip foo
add chain ip foo bar { type filter hook input priority $prio; }
add chain ip foo ber { type filter hook input priority $prionum; }
add chain ip foo bor { type filter hook input priority $prioffset; }

Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/datatype.h b/include/datatype.h
index cf1151582245d92ea580626b179af58e84d68532..ddcb7db863e660bacaea324fe44bd3386e336062 100644 (file)
--- a/include/datatype.h
+++ b/include/datatype.h
@@ -262,6 +262,7 @@ extern const struct datatype icmpx_code_type;
 extern const struct datatype igmp_type_type;
 extern const struct datatype time_type;
 extern const struct datatype boolean_type;
+extern const struct datatype priority_type;
 
 void inet_service_type_print(const struct expr *expr, struct output_ctx *octx);
 

diff --git a/include/rule.h b/include/rule.h
index ee881b9ccd17cbb392ff684fdef2663f50300d40..4c8cab13743408cc451485e24995d862897dca80 100644 (file)
--- a/include/rule.h
+++ b/include/rule.h
@@ -174,14 +174,11 @@ enum chain_flags {
  * struct prio_spec - extendend priority specification for mixed
  *                    textual/numerical parsing.
  *
- * @str:  name of the standard priority value
- * @num:  Numerical value. This MUST contain the parsed value of str after
- *        evaluation.
+ * @expr:  expr of the standard priority value
  */
 struct prio_spec {
-       const char  *str;
-       int          num;
        struct location loc;
+       struct expr     *expr;
 };
 
 /**

diff --git a/src/datatype.c b/src/datatype.c
index 396a300cba4b1420665a646f7fb1abc5d97f4e20..93eb1855887c29c46c649dbff11e25ffcc215a89 100644 (file)
--- a/src/datatype.c
+++ b/src/datatype.c
@@ -1256,3 +1256,39 @@ const struct datatype boolean_type = {
        .sym_tbl        = &boolean_tbl,
        .json           = boolean_type_json,
 };
+
+static struct error_record *priority_type_parse(struct parse_ctx *ctx,
+                                               const struct expr *sym,
+                                               struct expr **res)
+{
+       struct error_record *erec;
+       int num;
+
+       erec = integer_type_parse(ctx, sym, res);
+       if (!erec) {
+               num = atoi(sym->identifier);
+               expr_free(*res);
+               *res = constant_expr_alloc(&sym->location, &integer_type,
+                                          BYTEORDER_HOST_ENDIAN,
+                                          sizeof(int) * BITS_PER_BYTE, &num);
+       } else {
+               erec_destroy(erec);
+               *res = constant_expr_alloc(&sym->location, &string_type,
+                                          BYTEORDER_HOST_ENDIAN,
+                                          strlen(sym->identifier) * BITS_PER_BYTE,
+                                          sym->identifier);
+       }
+
+       return NULL;
+}
+
+/* This datatype is not registered via datatype_register()
+ * since this datatype should not ever be used from either
+ * rules or elements.
+ */
+const struct datatype priority_type = {
+       .type           = TYPE_STRING,
+       .name           = "priority",
+       .desc           = "priority type",
+       .parse          = priority_type_parse,
+};

diff --git a/src/evaluate.c b/src/evaluate.c
old mode 100644 (file)
new mode 100755 (executable)
index df8e808..1879eb0
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3243,19 +3243,52 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
        return 0;
 }
 
-static bool evaluate_priority(struct prio_spec *prio, int family, int hook)
+static bool evaluate_priority(struct eval_ctx *ctx, struct prio_spec *prio,
+                             int family, int hook)
 {
+       char prio_str[NFT_NAME_MAXLEN];
+       char prio_fst[NFT_NAME_MAXLEN];
+       struct location loc;
        int priority;
+       int prio_snd;
+       char op;
 
-       /* A numeric value has been used to specify priority. */
-       if (prio->str == NULL)
+       ctx->ectx.dtype = &priority_type;
+       ctx->ectx.len = NFT_NAME_MAXLEN * BITS_PER_BYTE;
+       if (expr_evaluate(ctx, &prio->expr) < 0)
+               return false;
+       if (prio->expr->etype != EXPR_VALUE) {
+               expr_error(ctx->msgs, prio->expr, "%s is not a valid "
+                          "priority expression", expr_name(prio->expr));
+               return false;
+       }
+       if (prio->expr->dtype->type == TYPE_INTEGER)
                return true;
 
-       priority = std_prio_lookup(prio->str, family, hook);
-       if (priority == NF_IP_PRI_LAST)
-               return false;
-       prio->num += priority;
+       mpz_export_data(prio_str, prio->expr->value, BYTEORDER_HOST_ENDIAN,
+                       NFT_NAME_MAXLEN);
+       loc = prio->expr->location;
+       expr_free(prio->expr);
 
+       if (sscanf(prio_str, "%s %c %d", prio_fst, &op, &prio_snd) < 3) {
+               priority = std_prio_lookup(prio_str, family, hook);
+               if (priority == NF_IP_PRI_LAST)
+                       return false;
+       } else {
+               priority = std_prio_lookup(prio_fst, family, hook);
+               if (priority == NF_IP_PRI_LAST)
+                       return false;
+               if (op == '+')
+                       priority += prio_snd;
+               else if (op == '-')
+                       priority -= prio_snd;
+               else
+                       return false;
+       }
+       prio->expr = constant_expr_alloc(&loc, &integer_type,
+                                        BYTEORDER_HOST_ENDIAN,
+                                        sizeof(int) * BITS_PER_BYTE,
+                                        &priority);
        return true;
 }
 
@@ -3273,10 +3306,10 @@ static int flowtable_evaluate(struct eval_ctx *ctx, struct flowtable *ft)
        if (ft->hooknum == NF_INET_NUMHOOKS)
                return chain_error(ctx, ft, "invalid hook %s", ft->hookstr);
 
-       if (!evaluate_priority(&ft->priority, NFPROTO_NETDEV, ft->hooknum))
+       if (!evaluate_priority(ctx, &ft->priority, NFPROTO_NETDEV, ft->hooknum))
                return __stmt_binary_error(ctx, &ft->priority.loc, NULL,
-                                          "'%s' is invalid priority.",
-                                          ft->priority.str);
+                                          "invalid priority expression %s.",
+                                          expr_name(ft->priority.expr));
 
        if (!ft->dev_expr)
                return chain_error(ctx, ft, "Unbound flowtable not allowed (must specify devices)");
@@ -3471,11 +3504,11 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain)
                        return chain_error(ctx, chain, "invalid hook %s",
                                           chain->hookstr);
 
-               if (!evaluate_priority(&chain->priority, chain->handle.family,
-                                      chain->hooknum))
+               if (!evaluate_priority(ctx, &chain->priority,
+                                      chain->handle.family, chain->hooknum))
                        return __stmt_binary_error(ctx, &chain->priority.loc, NULL,
-                                                  "'%s' is invalid priority in this context.",
-                                                  chain->priority.str);
+                                                  "invalid priority expression %s in this context.",
+                                                  expr_name(chain->priority.expr));
        }
 
        list_for_each_entry(rule, &chain->rules, list) {

diff --git a/src/json.c b/src/json.c
index 9dfa3076429d1b39679a0b40e09d249754414760..fd1841837b3fe42a0dd63e48f26d74ff42681cd8 100644 (file)
--- a/src/json.c
+++ b/src/json.c
@@ -223,6 +223,7 @@ static json_t *rule_print_json(struct output_ctx *octx,
 static json_t *chain_print_json(const struct chain *chain)
 {
        json_t *root, *tmp;
+       int priority;
 
        root = json_pack("{s:s, s:s, s:s, s:I}",
                         "family", family2str(chain->handle.family),
@@ -231,11 +232,13 @@ static json_t *chain_print_json(const struct chain *chain)
                         "handle", chain->handle.handle.id);
 
        if (chain->flags & CHAIN_F_BASECHAIN) {
+               mpz_export_data(&priority, chain->priority.expr->value,
+                               BYTEORDER_HOST_ENDIAN, sizeof(int));
                tmp = json_pack("{s:s, s:s, s:i, s:s}",
                                "type", chain->type,
                                "hook", hooknum2str(chain->handle.family,
                                                    chain->hooknum),
-                               "prio", chain->priority.num,
+                               "prio", priority,
                                "policy", chain_policy2str(chain->policy));
                if (chain->dev)
                        json_object_set_new(tmp, "dev", json_string(chain->dev));
@@ -373,14 +376,16 @@ static json_t *obj_print_json(const struct obj *obj)
 static json_t *flowtable_print_json(const struct flowtable *ftable)
 {
        json_t *root, *devs = NULL;
-       int i;
+       int i, priority;
 
+       mpz_export_data(&priority, ftable->priority.expr->value,
+                       BYTEORDER_HOST_ENDIAN, sizeof(int));
        root = json_pack("{s:s, s:s, s:s, s:s, s:i}",
                        "family", family2str(ftable->handle.family),
                        "name", ftable->handle.flowtable,
                        "table", ftable->handle.table.name,
                        "hook", hooknum2str(NFPROTO_NETDEV, ftable->hooknum),
-                       "prio", ftable->priority.num);
+                       "prio", priority);
 
        for (i = 0; i < ftable->dev_array_len; i++) {
                const char *dev = ftable->dev_array[i];

diff --git a/src/mnl.c b/src/mnl.c
index eab8d5486437b6f520511caafd7480bd1a334c5b..8921ccfb6eba712390150122388f6815c853b97d 100644 (file)
--- a/src/mnl.c
+++ b/src/mnl.c
@@ -518,6 +518,7 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd,
 {
        struct nftnl_chain *nlc;
        struct nlmsghdr *nlh;
+       int priority;
 
        nlc = nftnl_chain_alloc();
        if (nlc == NULL)
@@ -531,8 +532,10 @@ int mnl_nft_chain_add(struct netlink_ctx *ctx, const struct cmd *cmd,
                if (cmd->chain->flags & CHAIN_F_BASECHAIN) {
                        nftnl_chain_set_u32(nlc, NFTNL_CHAIN_HOOKNUM,
                                            cmd->chain->hooknum);
-                       nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO,
-                                           cmd->chain->priority.num);
+                       mpz_export_data(&priority,
+                                       cmd->chain->priority.expr->value,
+                                       BYTEORDER_HOST_ENDIAN, sizeof(int));
+                       nftnl_chain_set_s32(nlc, NFTNL_CHAIN_PRIO, priority);
                        nftnl_chain_set_str(nlc, NFTNL_CHAIN_TYPE,
                                            cmd->chain->type);
                }
@@ -1371,6 +1374,7 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, const struct cmd *cmd,
        const char *dev_array[8];
        struct nlmsghdr *nlh;
        struct expr *expr;
+       int priority;
        int i = 0;
 
        flo = nftnl_flowtable_alloc();
@@ -1385,8 +1389,9 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, const struct cmd *cmd,
                                cmd->handle.flowtable);
        nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_HOOKNUM,
                                cmd->flowtable->hooknum);
-       nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO,
-                               cmd->flowtable->priority.num);
+       mpz_export_data(&priority, cmd->flowtable->priority.expr->value,
+                       BYTEORDER_HOST_ENDIAN, sizeof(int));
+       nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, priority);
 
        list_for_each_entry(expr, &cmd->flowtable->dev_expr->expressions, list)
                dev_array[i++] = expr->identifier;

diff --git a/src/netlink.c b/src/netlink.c
index 14b0df410726a856f3d62ebd6cdb799e90bd8931..93067ef5033291d784fe142a7538b930813331b5 100644 (file)
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -369,6 +369,7 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx,
                                        const struct nftnl_chain *nlc)
 {
        struct chain *chain;
+       int priority;
 
        chain = chain_alloc(nftnl_chain_get_str(nlc, NFTNL_CHAIN_NAME));
        chain->handle.family =
@@ -386,8 +387,13 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx,
                        nftnl_chain_get_u32(nlc, NFTNL_CHAIN_HOOKNUM);
                chain->hookstr       =
                        hooknum2str(chain->handle.family, chain->hooknum);
-               chain->priority.num  =
-                       nftnl_chain_get_s32(nlc, NFTNL_CHAIN_PRIO);
+               priority = nftnl_chain_get_s32(nlc, NFTNL_CHAIN_PRIO);
+               chain->priority.expr =
+                               constant_expr_alloc(&netlink_location,
+                                                   &integer_type,
+                                                   BYTEORDER_HOST_ENDIAN,
+                                                   sizeof(int) * BITS_PER_BYTE,
+                                                   &priority);
                chain->type          =
                        xstrdup(nftnl_chain_get_str(nlc, NFTNL_CHAIN_TYPE));
                chain->policy          =
@@ -1080,7 +1086,7 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx,
 {
        struct flowtable *flowtable;
        const char * const *dev_array;
-       int len = 0, i;
+       int len = 0, i, priority;
 
        flowtable = flowtable_alloc(&netlink_location);
        flowtable->handle.family =
@@ -1099,8 +1105,14 @@ netlink_delinearize_flowtable(struct netlink_ctx *ctx,
 
        flowtable->dev_array_len = len;
 
-       flowtable->priority.num =
-               nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO);
+       priority = nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_PRIO);
+       flowtable->priority.expr =
+                               constant_expr_alloc(&netlink_location,
+                                                   &integer_type,
+                                                   BYTEORDER_HOST_ENDIAN,
+                                                   sizeof(int) *
+                                                   BITS_PER_BYTE,
+                                                   &priority);
        flowtable->hooknum =
                nftnl_flowtable_get_u32(nlo, NFTNL_FLOWTABLE_HOOKNUM);
 

diff --git a/src/parser_bison.y b/src/parser_bison.y
index b463a140d31ff4513e2895cdec6318b85a03e89d..f2b1e5ac4662a8b2ff16d66265eabdb3aabbc529 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -1972,27 +1972,55 @@ extended_prio_name      :       OUT
 extended_prio_spec     :       int_num
                        {
                                struct prio_spec spec = {0};
-                               spec.num = $1;
+
+                               spec.expr = constant_expr_alloc(&@$, &integer_type,
+                                                               BYTEORDER_HOST_ENDIAN,
+                                                               sizeof(int) *
+                                                               BITS_PER_BYTE, &$1);
+                               $$ = spec;
+                       }
+                       |       variable_expr
+                       {
+                               struct prio_spec spec = {0};
+
+                               datatype_set($1->sym->expr, &priority_type);
+                               spec.expr = $1;
                                $$ = spec;
                        }
                        |       extended_prio_name
                        {
                                struct prio_spec spec = {0};
-                               spec.str = $1;
+
+                               spec.expr = constant_expr_alloc(&@$, &string_type,
+                                                               BYTEORDER_HOST_ENDIAN,
+                                                               strlen($1) * BITS_PER_BYTE,
+                                                               $1);
+                               xfree($1);
                                $$ = spec;
                        }
                        |       extended_prio_name PLUS NUM
                        {
                                struct prio_spec spec = {0};
-                               spec.num = $3;
-                               spec.str = $1;
+
+                               char str[NFT_NAME_MAXLEN];
+                               snprintf(str, sizeof(str), "%s + %" PRIu64, $1, $3);
+                               spec.expr = constant_expr_alloc(&@$, &string_type,
+                                                               BYTEORDER_HOST_ENDIAN,
+                                                               strlen(str) * BITS_PER_BYTE,
+                                                               str);
+                               xfree($1);
                                $$ = spec;
                        }
                        |       extended_prio_name DASH NUM
                        {
                                struct prio_spec spec = {0};
-                               spec.num = -$3;
-                               spec.str = $1;
+                               char str[NFT_NAME_MAXLEN];
+
+                               snprintf(str, sizeof(str), "%s - %" PRIu64, $1, $3);
+                               spec.expr = constant_expr_alloc(&@$, &string_type,
+                                                               BYTEORDER_HOST_ENDIAN,
+                                                               strlen(str) * BITS_PER_BYTE,
+                                                               str);
                                $$ = spec;
                        }
                        ;

diff --git a/src/parser_json.c b/src/parser_json.c
index 76c0a5ccddddeb61df45dcecdc515d10d06ac465..a45234ada6792d1429c772471b37f1dab74822a3 100644 (file)
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -2580,7 +2580,10 @@ static struct cmd *json_parse_cmd_add_chain(struct json_ctx *ctx, json_t *root,
        chain = chain_alloc(NULL);
        chain->flags |= CHAIN_F_BASECHAIN;
        chain->type = xstrdup(type);
-       chain->priority.num = prio;
+       chain->priority.expr = constant_expr_alloc(int_loc, &integer_type,
+                                                  BYTEORDER_HOST_ENDIAN,
+                                                  sizeof(int) * BITS_PER_BYTE,
+                                                  &prio);
        chain->hookstr = chain_hookname_lookup(hookstr);
        if (!chain->hookstr) {
                json_error(ctx, "Invalid chain hook '%s'.", hookstr);
@@ -2947,7 +2950,10 @@ static struct cmd *json_parse_cmd_add_flowtable(struct json_ctx *ctx,
 
        flowtable = flowtable_alloc(int_loc);
        flowtable->hookstr = hookstr;
-       flowtable->priority.num = prio;
+       flowtable->priority.expr =
+               constant_expr_alloc(int_loc, &integer_type,
+                                   BYTEORDER_HOST_ENDIAN,
+                                   sizeof(int) * BITS_PER_BYTE, &prio);
 
        flowtable->dev_expr = json_parse_flowtable_devs(ctx, devs);
        if (!flowtable->dev_expr) {

diff --git a/src/rule.c b/src/rule.c
index 2936065760442372b74a1e7a41bf5af0197c82c0..2aca8affb55f3b241f35e0b2e61d44c550504203 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -821,7 +821,7 @@ void chain_free(struct chain *chain)
        xfree(chain->type);
        if (chain->dev != NULL)
                xfree(chain->dev);
-       xfree(chain->priority.str);
+       expr_free(chain->priority.expr);
        xfree(chain);
 }
 
@@ -1051,14 +1051,15 @@ int std_prio_lookup(const char *std_prio_name, int family, int hook)
 
 static const char *prio2str(const struct output_ctx *octx,
                            char *buf, size_t bufsize, int family, int hook,
-                           int prio)
+                           const struct expr *expr)
 {
        const struct prio_tag *prio_arr;
+       int std_prio, offset, prio;
        const char *std_prio_str;
        const int reach = 10;
-       int std_prio, offset;
        size_t i, arr_size;
 
+       mpz_export_data(&prio, expr->value, BYTEORDER_HOST_ENDIAN, sizeof(int));
        if (family == NFPROTO_BRIDGE) {
                prio_arr = bridge_std_prios;
                arr_size = array_size(bridge_std_prios);
@@ -1110,7 +1111,7 @@ static void chain_print_declaration(const struct chain *chain,
                nft_print(octx, " priority %s; policy %s;\n",
                          prio2str(octx, priobuf, sizeof(priobuf),
                                   chain->handle.family, chain->hooknum,
-                                  chain->priority.num),
+                                  chain->priority.expr),
                          chain_policy2str(chain->policy));
        }
 }
@@ -1141,7 +1142,7 @@ void chain_print_plain(const struct chain *chain, struct output_ctx *octx)
                          chain->type, chain->hookstr,
                          prio2str(octx, priobuf, sizeof(priobuf),
                                   chain->handle.family, chain->hooknum,
-                                  chain->priority.num),
+                                  chain->priority.expr),
                          chain_policy2str(chain->policy));
        }
        if (nft_output_handle(octx))
@@ -2047,7 +2048,7 @@ void flowtable_free(struct flowtable *flowtable)
        if (--flowtable->refcnt > 0)
                return;
        handle_free(&flowtable->handle);
-       xfree(flowtable->priority.str);
+       expr_free(flowtable->priority.expr);
        xfree(flowtable);
 }
 
@@ -2077,7 +2078,7 @@ static void flowtable_print_declaration(const struct flowtable *flowtable,
                  opts->tab, opts->tab,
                  hooknum2str(NFPROTO_NETDEV, flowtable->hooknum),
                  prio2str(octx, priobuf, sizeof(priobuf), NFPROTO_NETDEV,
-                          flowtable->hooknum, flowtable->priority.num),
+                          flowtable->hooknum, flowtable->priority.expr),
                  opts->stmt_separator);
 
        nft_print(octx, "%s%sdevices = { ", opts->tab, opts->tab);

diff --git a/tests/shell/testcases/nft-f/0021priority_variable_0 b/tests/shell/testcases/nft-f/0021priority_variable_0
new file mode 100755 (executable)
index 0000000..2b143db
--- /dev/null
+++ b/tests/shell/testcases/nft-f/0021priority_variable_0
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Tests use of variables in priority specification
+
+set -e
+
+RULESET="
+define pri = filter
+
+table inet global {
+    chain prerouting {
+        type filter hook prerouting priority \$pri
+        policy accept
+    }
+}"
+
+$NFT -f - <<< "$RULESET"

diff --git a/tests/shell/testcases/nft-f/0022priority_variable_0 b/tests/shell/testcases/nft-f/0022priority_variable_0
new file mode 100755 (executable)
index 0000000..51bc5eb
--- /dev/null
+++ b/tests/shell/testcases/nft-f/0022priority_variable_0
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Tests use of variables in priority specification
+
+set -e
+
+RULESET="
+define pri = 10
+
+table inet global {
+    chain prerouting {
+        type filter hook prerouting priority \$pri
+        policy accept
+    }
+}"
+
+$NFT -f - <<< "$RULESET"

diff --git a/tests/shell/testcases/nft-f/0023priority_variable_1 b/tests/shell/testcases/nft-f/0023priority_variable_1
new file mode 100755 (executable)
index 0000000..eddaf5b
--- /dev/null
+++ b/tests/shell/testcases/nft-f/0023priority_variable_1
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Tests use of variables in priority specification
+
+set -e
+
+RULESET="
+define pri = *
+
+table inet global {
+    chain prerouting {
+        type filter hook prerouting priority \$pri
+        policy accept
+    }
+}"
+
+$NFT -f - <<< "$RULESET" && exit 1
+exit 0

diff --git a/tests/shell/testcases/nft-f/0024priority_variable_1 b/tests/shell/testcases/nft-f/0024priority_variable_1
new file mode 100755 (executable)
index 0000000..592cb56
--- /dev/null
+++ b/tests/shell/testcases/nft-f/0024priority_variable_1
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Tests use of variables in priority specification
+
+set -e
+
+RULESET="
+define pri = { 127.0.0.1 }
+
+table inet global {
+    chain prerouting {
+        type filter hook prerouting priority \$pri
+        policy accept
+    }
+}"
+
+$NFT -f - <<< "$RULESET" && exit 1
+exit 0

diff --git a/tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft b/tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft
new file mode 100644 (file)
index 0000000..f409309
--- /dev/null
+++ b/tests/shell/testcases/nft-f/dumps/0021priority_variable_0.nft
@@ -0,0 +1,5 @@
+table inet global {
+       chain prerouting {
+               type filter hook prerouting priority filter; policy accept;
+       }
+}

diff --git a/tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft b/tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft
new file mode 100644 (file)
index 0000000..2e94459
--- /dev/null
+++ b/tests/shell/testcases/nft-f/dumps/0022priority_variable_0.nft
@@ -0,0 +1,5 @@
+table inet global {
+       chain prerouting {
+               type filter hook prerouting priority filter + 10; policy accept;
+       }
+}