parser_bison: allow to use variable to add/create/delete elements

Using variable definitions from element command doesn't work, eg.

-test.nft-
 define whitelist_v4 = { 1.1.1.1 }
 table inet filter {
	set whitelist_v4 { type ipv4_addr; }
 }
 add element inet filter whitelist_v4 $whitelist_v4
-EOF-

 # nft -f test.nft
 test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{'
 add element inet filter whitelist_v4 $whitelist_v4
                                      ^

Fix this by using set_block_expr rule for every element command.
This patch also comes with a new regression test.

Reported-by: Leon Merten Lohse <leon@green-side.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/parser_bison.y b/src/parser_bison.y
index 36dbc8d8515a58880be8c97b3cd84b1f43283221..baf0a539efa072dcc88e793d79b2af2de751e9f8 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -748,7 +748,7 @@ add_cmd                     :       TABLE           table_spec
                                handle_merge(&$3->handle, &$2);
                                $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SET, &$2, &@$, $5);
                        }
-                       |       ELEMENT         set_spec        set_expr
+                       |       ELEMENT         set_spec        set_block_expr
                        {
                                $$ = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEM, &$2, &@$, $3);
                        }
@@ -797,7 +797,7 @@ create_cmd          :       TABLE           table_spec
                                handle_merge(&$3->handle, &$2);
                                $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SET, &$2, &@$, $5);
                        }
-                       |       ELEMENT         set_spec        set_expr
+                       |       ELEMENT         set_spec        set_block_expr
                        {
                                $$ = cmd_alloc(CMD_CREATE, CMD_OBJ_SETELEM, &$2, &@$, $3);
                        }
@@ -829,7 +829,7 @@ delete_cmd          :       TABLE           table_spec
                        {
                                $$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SET, &$2, &@$, NULL);
                        }
-                       |       ELEMENT         set_spec        set_expr
+                       |       ELEMENT         set_spec        set_block_expr
                        {
                                $$ = cmd_alloc(CMD_DELETE, CMD_OBJ_SETELEM, &$2, &@$, $3);
                        }

diff --git a/tests/shell/testcases/nft-f/0010variable_0 b/tests/shell/testcases/nft-f/0010variable_0
new file mode 100755 (executable)
index 0000000..2df71b1
--- /dev/null
+++ b/tests/shell/testcases/nft-f/0010variable_0
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e
+
+tmpfile=$(mktemp)
+if [ ! -w $tmpfile ] ; then
+        echo "Failed to create tmp file" >&2
+        exit 0
+fi
+
+trap "rm -rf $tmpfile" EXIT # cleanup if aborted
+
+RULESET="define whitelist_v4 = { 1.1.1.1 }
+
+table inet filter {
+       set whitelist_v4 { type ipv4_addr; }
+}
+add element inet filter whitelist_v4 \$whitelist_v4
+"
+
+echo "$RULESET" > $tmpfile
+$NFT -f $tmpfile