From c724812d9561021fb6a80c817d411d9ba2de5dbd Mon Sep 17 00:00:00 2001

From: Phil Sutter <psutter@redhat.com>

Date: Tue, 13 Jul 2021 13:54:12 +0200

Subject: [PATCH] scanner: introduce start condition stack

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1979334

Upstream Status: nftables commit 5896772fe3c5f

commit 5896772fe3c5f01696188ea04957a825ee601b12

Author: Florian Westphal <fw@strlen.de>

Date:   Mon Mar 8 18:18:33 2021 +0100

    scanner: introduce start condition stack

    Add a small initial chunk of flex start conditionals.

    This starts with two low-hanging fruits, numgen and j/symhash.

    NUMGEN and HASH start conditions are entered from flex when

    the corresponding expression token is encountered.

    Flex returns to the INIT condition when the bison parser

    has seen a complete numgen/hash statement.

    This intentionally uses a stack rather than BEGIN()

    to eventually support nested states.

    The scanner_pop_start_cond() function argument is not used yet, but

    will need to be used later to deal with nesting.

    Signed-off-by: Florian Westphal <fw@strlen.de>

---

 include/parser.h   |  8 ++++++++

 src/parser_bison.y | 11 +++++++----

 src/scanner.l      | 36 +++++++++++++++++++++++++++++-------

 3 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/include/parser.h b/include/parser.h

index 949284d..1d293f5 100644

--- a/include/parser.h

+++ b/include/parser.h

@@ -28,6 +28,12 @@ struct parser_state {

 	struct list_head		*cmds;

 };

+enum startcond_type {

+	PARSER_SC_BEGIN,

+	PARSER_SC_EXPR_HASH,

+	PARSER_SC_EXPR_NUMGEN,

+};

+

 struct mnl_socket;

 extern void parser_init(struct nft_ctx *nft, struct parser_state *state,

@@ -47,4 +53,6 @@ extern void scanner_push_buffer(void *scanner,

 				const struct input_descriptor *indesc,

 				const char *buffer);

+extern void scanner_pop_start_cond(void *scanner, enum startcond_type sc);

+

 #endif /* NFTABLES_PARSER_H */

diff --git a/src/parser_bison.y b/src/parser_bison.y

index 5aedc55..9a9447f 100644

--- a/src/parser_bison.y

+++ b/src/parser_bison.y

@@ -840,6 +840,9 @@ opt_newline		:	NEWLINE

 		 	|	/* empty */

 			;

+close_scope_hash	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_HASH); };

+close_scope_numgen	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_NUMGEN); };

+

 common_block		:	INCLUDE		QUOTED_STRING	stmt_separator

 			{

 				if (scanner_include_file(nft, scanner, $2, &@$) < 0) {

@@ -4249,7 +4252,7 @@ numgen_type		:	INC		{ $$ = NFT_NG_INCREMENTAL; }

 			|	RANDOM		{ $$ = NFT_NG_RANDOM; }

 			;

-numgen_expr		:	NUMGEN	numgen_type	MOD	NUM	offset_opt

+numgen_expr		:	NUMGEN	numgen_type	MOD	NUM	offset_opt	close_scope_numgen

 			{

 				$$ = numgen_expr_alloc(&@$, $2, $4, $5);

 			}

@@ -4306,17 +4309,17 @@ xfrm_expr		:	IPSEC	xfrm_dir	xfrm_spnum	xfrm_state_key

 			}

 			;

-hash_expr		:	JHASH		expr	MOD	NUM	SEED	NUM	offset_opt

+hash_expr		:	JHASH		expr	MOD	NUM	SEED	NUM	offset_opt	close_scope_hash

 			{

 				$$ = hash_expr_alloc(&@$, $4, true, $6, $7, NFT_HASH_JENKINS);

 				$$->hash.expr = $2;

 			}

-			|	JHASH		expr	MOD	NUM	offset_opt

+			|	JHASH		expr	MOD	NUM	offset_opt	close_scope_hash

 			{

 				$$ = hash_expr_alloc(&@$, $4, false, 0, $5, NFT_HASH_JENKINS);

 				$$->hash.expr = $2;

 			}

-			|	SYMHASH		MOD	NUM	offset_opt

+			|	SYMHASH		MOD	NUM	offset_opt	close_scope_hash

 			{

 				$$ = hash_expr_alloc(&@$, $3, false, 0, $4, NFT_HASH_SYM);

 			}

diff --git a/src/scanner.l b/src/scanner.l

index 20b1b2d..68fe988 100644

--- a/src/scanner.l

+++ b/src/scanner.l

@@ -98,6 +98,8 @@ static void reset_pos(struct parser_state *state, struct location *loc)

 	state->indesc->column		= 1;

 }

+static void scanner_push_start_cond(void *scanner, enum startcond_type type);

+

 #define YY_USER_ACTION {					\

 	update_pos(yyget_extra(yyscanner), yylloc, yyleng);	\

 	update_offset(yyget_extra(yyscanner), yylloc, yyleng);	\

@@ -193,6 +195,9 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})

 %option yylineno

 %option nodefault

 %option warn

+%option stack

+%s SCANSTATE_EXPR_HASH

+%s SCANSTATE_EXPR_NUMGEN

 %%

@@ -548,15 +553,21 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})

 "state"			{ return STATE; }

 "status"		{ return STATUS; }

-"numgen"		{ return NUMGEN; }

-"inc"			{ return INC; }

-"mod"			{ return MOD; }

-"offset"		{ return OFFSET; }

+"numgen"		{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_NUMGEN); return NUMGEN; }

+<SCANSTATE_EXPR_NUMGEN>{

+	"inc"		{ return INC; }

+}

-"jhash"			{ return JHASH; }

-"symhash"		{ return SYMHASH; }

-"seed"			{ return SEED; }

+"jhash"			{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_HASH); return JHASH; }

+"symhash"		{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_HASH); return SYMHASH; }

+<SCANSTATE_EXPR_HASH>{

+	"seed"		{ return SEED; }

+}

+<SCANSTATE_EXPR_HASH,SCANSTATE_EXPR_NUMGEN>{

+	"mod"		{ return MOD; }

+	"offset"	{ return OFFSET; }

+}

 "dup"			{ return DUP; }

 "fwd"			{ return FWD; }

@@ -949,3 +960,14 @@ void scanner_destroy(struct nft_ctx *nft)

 	input_descriptor_list_destroy(state);

 	yylex_destroy(nft->scanner);

 }

+

+static void scanner_push_start_cond(void *scanner, enum startcond_type type)

+{

+	yy_push_state((int)type, scanner);

+}

+

+void scanner_pop_start_cond(void *scanner, enum startcond_type t)

+{

+	yy_pop_state(scanner);

+	(void)yy_top_state(scanner); /* suppress gcc warning wrt. unused function */

+}

-- 

2.31.1