scanner: match full comment line in case of tie

  add element ip filter public_services {
          # comment 1
          tcp . 80  : jump log_accept,
  # comment 2
          tcp . 443 : jump log_accept,
  }

still fails with the error message:

  # nft -f filter_sets.ip
  In file included from filter_sets.ip:63:1-42:
  filter_sets.ip:4:12-12: Error: syntax error,
  unexpected newline, expecting comma or '}'
  # comment 2
             ^

flex honors the first rule found in case of tie, place comment_line
before comment rule.

Fixes: 931737a17198 ("scanner: munch full comment lines")
Reported-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/scanner.l b/src/scanner.l
index e72a427aab483f7c3680a7c4384be624e0509e56..7e8748f51c274a503b2b793a52943534978f0423 100644 (file)
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -858,10 +858,10 @@ addrstring        ({macaddr}|{ip4addr}|{ip6addr})
 
 {tab}+
 {space}+
-{comment}
 {comment_line}         {
                                reset_pos(yyget_extra(yyscanner), yylloc);
                        }
+{comment}
 
 <<EOF>>                {
                                update_pos(yyget_extra(yyscanner), yylloc, 1);

diff --git a/tests/shell/testcases/comments/comments_0 b/tests/shell/testcases/comments/comments_0
index b272ad675763f928087fbb6021f22d52d5728040..a50387d6bfcfc07a3a44e428df2d17bbfda7cfc1 100755 (executable)
--- a/tests/shell/testcases/comments/comments_0
+++ b/tests/shell/testcases/comments/comments_0
@@ -10,6 +10,7 @@ RULESET="table inet x {               # comment
                         2.2.2.2, # comment
                         # more comments
                         3.3.3.3,       # comment
+# comment
                 }
                # comment
         }
@@ -23,6 +24,7 @@ RULESET="table inet x {               # comment
                } accept
 
                icmp type {
+# comment
                        1,
                        # comments also allowed here
                        2,