|
 |
bacbc8 |
From bd7a8291c1e00c3625dd348dbb7246b4a7aa357d Mon Sep 17 00:00:00 2001
|
|
|
bacbc8 |
From: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
bacbc8 |
Date: Mon, 3 Dec 2018 17:06:21 +0100
|
|
|
bacbc8 |
Subject: [PATCH] parser: bail out on incorrect burst unit
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Burst can be either bytes or packets, depending on the rate limit unit.
|
|
|
bacbc8 |
|
|
|
bacbc8 |
# nft add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets
|
|
|
bacbc8 |
Error: syntax error, unexpected packets, expecting string or bytes
|
|
|
bacbc8 |
add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets
|
|
|
bacbc8 |
^^^^^^^
|
|
|
bacbc8 |
|
|
|
bacbc8 |
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1306
|
|
|
bacbc8 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
bacbc8 |
(cherry picked from commit 1018eae77176cffd39bad0e499010923642c2cba)
|
|
|
bacbc8 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
bacbc8 |
---
|
|
|
bacbc8 |
src/parser_bison.y | 15 +++++++++------
|
|
|
bacbc8 |
tests/py/any/limit.t | 2 ++
|
|
|
bacbc8 |
2 files changed, 11 insertions(+), 6 deletions(-)
|
|
|
bacbc8 |
|
|
|
bacbc8 |
diff --git a/src/parser_bison.y b/src/parser_bison.y
|
|
|
bacbc8 |
index a6b6fc1745a72..aabf16316ff8b 100644
|
|
|
bacbc8 |
--- a/src/parser_bison.y
|
|
|
bacbc8 |
+++ b/src/parser_bison.y
|
|
|
bacbc8 |
@@ -562,7 +562,7 @@ int nft_lex(void *, void *, void *);
|
|
|
bacbc8 |
%type <val> level_type log_flags log_flags_tcp log_flag_tcp
|
|
|
bacbc8 |
%type <stmt> limit_stmt quota_stmt connlimit_stmt
|
|
|
bacbc8 |
%destructor { stmt_free($$); } limit_stmt quota_stmt connlimit_stmt
|
|
|
bacbc8 |
-%type <val> limit_burst limit_mode time_unit quota_mode
|
|
|
bacbc8 |
+%type <val> limit_burst_pkts limit_burst_bytes limit_mode time_unit quota_mode
|
|
|
bacbc8 |
%type <stmt> reject_stmt reject_stmt_alloc
|
|
|
bacbc8 |
%destructor { stmt_free($$); } reject_stmt reject_stmt_alloc
|
|
|
bacbc8 |
%type <stmt> nat_stmt nat_stmt_alloc masq_stmt masq_stmt_alloc redir_stmt redir_stmt_alloc
|
|
|
bacbc8 |
@@ -2298,7 +2298,7 @@ log_flag_tcp : SEQUENCE
|
|
|
bacbc8 |
}
|
|
|
bacbc8 |
;
|
|
|
bacbc8 |
|
|
|
bacbc8 |
-limit_stmt : LIMIT RATE limit_mode NUM SLASH time_unit limit_burst
|
|
|
bacbc8 |
+limit_stmt : LIMIT RATE limit_mode NUM SLASH time_unit limit_burst_pkts
|
|
|
bacbc8 |
{
|
|
|
bacbc8 |
$$ = limit_stmt_alloc(&@$);
|
|
|
bacbc8 |
$$->limit.rate = $4;
|
|
|
bacbc8 |
@@ -2307,7 +2307,7 @@ limit_stmt : LIMIT RATE limit_mode NUM SLASH time_unit limit_burst
|
|
|
bacbc8 |
$$->limit.type = NFT_LIMIT_PKTS;
|
|
|
bacbc8 |
$$->limit.flags = $3;
|
|
|
bacbc8 |
}
|
|
|
bacbc8 |
- | LIMIT RATE limit_mode NUM STRING limit_burst
|
|
|
bacbc8 |
+ | LIMIT RATE limit_mode NUM STRING limit_burst_bytes
|
|
|
bacbc8 |
{
|
|
|
bacbc8 |
struct error_record *erec;
|
|
|
bacbc8 |
uint64_t rate, unit;
|
|
|
bacbc8 |
@@ -2388,8 +2388,11 @@ limit_mode : OVER { $$ = NFT_LIMIT_F_INV; }
|
|
|
bacbc8 |
| /* empty */ { $$ = 0; }
|
|
|
bacbc8 |
;
|
|
|
bacbc8 |
|
|
|
bacbc8 |
-limit_burst : /* empty */ { $$ = 0; }
|
|
|
bacbc8 |
+limit_burst_pkts : /* empty */ { $$ = 0; }
|
|
|
bacbc8 |
| BURST NUM PACKETS { $$ = $2; }
|
|
|
bacbc8 |
+ ;
|
|
|
bacbc8 |
+
|
|
|
bacbc8 |
+limit_burst_bytes : /* empty */ { $$ = 0; }
|
|
|
bacbc8 |
| BURST NUM BYTES { $$ = $2; }
|
|
|
bacbc8 |
| BURST NUM STRING
|
|
|
bacbc8 |
{
|
|
|
bacbc8 |
@@ -3199,7 +3202,7 @@ ct_obj_alloc :
|
|
|
bacbc8 |
}
|
|
|
bacbc8 |
;
|
|
|
bacbc8 |
|
|
|
bacbc8 |
-limit_config : RATE limit_mode NUM SLASH time_unit limit_burst
|
|
|
bacbc8 |
+limit_config : RATE limit_mode NUM SLASH time_unit limit_burst_pkts
|
|
|
bacbc8 |
{
|
|
|
bacbc8 |
struct limit *limit;
|
|
|
bacbc8 |
limit = xzalloc(sizeof(*limit));
|
|
|
bacbc8 |
@@ -3210,7 +3213,7 @@ limit_config : RATE limit_mode NUM SLASH time_unit limit_burst
|
|
|
bacbc8 |
limit->flags = $2;
|
|
|
bacbc8 |
$$ = limit;
|
|
|
bacbc8 |
}
|
|
|
bacbc8 |
- | RATE limit_mode NUM STRING limit_burst
|
|
|
bacbc8 |
+ | RATE limit_mode NUM STRING limit_burst_bytes
|
|
|
bacbc8 |
{
|
|
|
bacbc8 |
struct limit *limit;
|
|
|
bacbc8 |
struct error_record *erec;
|
|
|
bacbc8 |
diff --git a/tests/py/any/limit.t b/tests/py/any/limit.t
|
|
|
bacbc8 |
index 8180bea3ddae6..ef7f93133297f 100644
|
|
|
bacbc8 |
--- a/tests/py/any/limit.t
|
|
|
bacbc8 |
+++ b/tests/py/any/limit.t
|
|
|
bacbc8 |
@@ -14,6 +14,7 @@ limit rate 400/hour;ok
|
|
|
bacbc8 |
limit rate 40/day;ok
|
|
|
bacbc8 |
limit rate 400/week;ok
|
|
|
bacbc8 |
limit rate 1023/second burst 10 packets;ok
|
|
|
bacbc8 |
+limit rate 1023/second burst 10 bytes;fail
|
|
|
bacbc8 |
|
|
|
bacbc8 |
limit rate 1 kbytes/second;ok
|
|
|
bacbc8 |
limit rate 2 kbytes/second;ok
|
|
|
bacbc8 |
@@ -21,6 +22,7 @@ limit rate 1025 kbytes/second;ok
|
|
|
bacbc8 |
limit rate 1023 mbytes/second;ok
|
|
|
bacbc8 |
limit rate 10230 mbytes/second;ok
|
|
|
bacbc8 |
limit rate 1023000 mbytes/second;ok
|
|
|
bacbc8 |
+limit rate 512 kbytes/second burst 5 packets;fail
|
|
|
bacbc8 |
|
|
|
bacbc8 |
limit rate 1025 bytes/second burst 512 bytes;ok
|
|
|
bacbc8 |
limit rate 1025 kbytes/second burst 1023 kbytes;ok
|
|
|
bacbc8 |
--
|
|
|
bacbc8 |
2.21.0
|
|
|
bacbc8 |
|