diff mbox series

[nft] evaluate: missing basic evaluation of expectations

Message ID 20190716192021.4729-1-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show
Series [nft] evaluate: missing basic evaluation of expectations | expand

Commit Message

Pablo Neira Ayuso July 16, 2019, 7:20 p.m. UTC 
Basic ct expectation object evaluation. This fixes tests/py errors.

Error reporting is very sparse at this stage. I'm intentionally leaving
this as future work to store location objects for each field, so user
gets better indication on what is missing when configuring expectations.

Fixes: 65ae2cb6509b ("src: add ct expectations support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/evaluate.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/src/evaluate.c b/src/evaluate.c
index ff0271c757c2..5f2e0a01d0ca 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3425,15 +3425,26 @@  static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain)
 	return 0;
 }
 
-static int obj_evaluate(struct eval_ctx *ctx, struct obj *obj)
+static int ct_expect_evaluate(struct eval_ctx *ctx, struct obj *obj)
+{
+	struct ct_expect *ct = &obj->ct_expect;
+
+	if (!ct->l4proto ||
+	    !ct->dport ||
+	    !ct->timeout ||
+	    !ct->size)
+		return __stmt_binary_error(ctx, &obj->location, NULL,
+					   "missing configuration options");
+
+	return 0;
+}
+
+static int ct_timeout_evaluate(struct eval_ctx *ctx, struct obj *obj)
 {
 	struct ct_timeout *ct = &obj->ct_timeout;
 	struct timeout_state *ts, *next;
 	unsigned int i;
 
-	if (obj->type != NFT_OBJECT_CT_TIMEOUT)
-		return 0;
-
 	for (i = 0; i < timeout_protocol[ct->l4proto].array_size; i++)
 		ct->timeout[i] = timeout_protocol[ct->l4proto].dflt_timeout[i];
 
@@ -3446,6 +3457,21 @@  static int obj_evaluate(struct eval_ctx *ctx, struct obj *obj)
 		list_del(&ts->head);
 		xfree(ts);
 	}
+
+	return 0;
+}
+
+static int obj_evaluate(struct eval_ctx *ctx, struct obj *obj)
+{
+	switch (obj->type) {
+	case NFT_OBJECT_CT_TIMEOUT:
+		return ct_timeout_evaluate(ctx, obj);
+	case NFT_OBJECT_CT_EXPECT:
+		return ct_expect_evaluate(ctx, obj);
+	default:
+		break;
+	}
+
 	return 0;
 }