FS#75094 - [nftables] regression introduced since 1.0.3 can prevent valid rulesets from loading
Attached to Project:
Arch Linux
Opened by Kerin Millar (kerframil) - Friday, 17 June 2022, 03:06 GMT
Last edited by Sébastien Luttringer (seblu) - Monday, 17 October 2022, 23:27 GMT
Opened by Kerin Millar (kerframil) - Friday, 17 June 2022, 03:06 GMT
Last edited by Sébastien Luttringer (seblu) - Monday, 17 October 2022, 23:27 GMT
|
Details
Description:
Following on from the sub-standard 1.0.3 release, a serious regression remains present. I recently rebooted an Arch box that uses nftables to find that my ruleset, which contains perfectly valid rules incorporating the log keyword, had not been loaded. As such, this is a request to incorporate commit 638af0ceb2b22307098bb2730822e148ef0b9424, which addresses the issue (assuming that 1.0.5 has not been released by the time that this request is considered). Note that the bug is easy enough to trigger that it could plausibly affect many deployed rulesets in the wild. Additional info: This report is for nftables-1.0.4-1. The aforementioned commit can be found below. https://git.netfilter.org/nftables/commit/?id=638af0ceb2b22307098bb2730822e148ef0b9424 Steps to reproduce: See the test case that the commit introduces. |
This task depends upon
```
parser_bison.y: In function 'nft_parse':
parser_bison.y:945:73: error: 'PARSER_SC_FLAGS' undeclared (first use in this function); did you mean 'PARSER_SC_VLAN'?
945 | close_scope_frag : { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_FRAG); };
| ^~~~~~~~~~~~~~~
| PARSER_SC_VLAN
parser_bison.y:945:73: note: each undeclared identifier is reported only once for each function it appears in
```