summaryrefslogtreecommitdiffstats
path: root/src/expr/queue.c
Commit message (Collapse)AuthorAgeFilesLines
* expr: Respect data_len when setting attributesHEADmasterPhil Sutter8 days1-4/+4
| | | | | | | | With attr_policy in place, data_len has an upper boundary but it may be lower than the attribute's storage area in which case memcpy() would read garbage. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Introduce struct expr_ops::attr_policyPhil Sutter2024-03-061-0/+8
| | | | | | | | | | | | | | | | | Similar to kernel's nla_policy, enable expressions to inform about restrictions on attribute use. This allows the generic expression code to perform sanity checks before dispatching to expression ops. For now, this holds only the maximum data len which may be passed to nftnl_expr_set(). While one may debate whether accepting e.g. uint32_t for sreg/dreg attributes is correct, it is necessary to not break nftables. Note that this introduces artificial restrictions on name lengths which were caught by the kernel (if nftables didn't). Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Call expr_ops::set with legal types onlyPhil Sutter2024-03-061-2/+0
| | | | | | | | | | Having the new expr_ops::nftnl_max_attr field in place, the valid range of attribute type values is known now. Reject illegal ones upfront. Consequently drop the default case from callbacks' switches which handle all supported attributes. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Repurpose struct expr_ops::max_attr fieldPhil Sutter2024-03-061-1/+1
| | | | | | | | | Instead of holding the maximum kernel space (NFTA_*) attribute value, use it to hold the maximum expression attribute (NFTNL_EXPR_*) value instead. This will be used for index boundary checks in an attribute policy array later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: fix clang+glibc snprintf substitution errorNicholas Vinson2022-06-151-1/+1
| | | | | | | | | | | | | | | | | | | | When building with clang and glibc and -D_FORTIFY_SOURCE=2 is passed to clang, the snprintf member of the expr_ops and obj_ops structures will be incorrectly replaced with __builtin_snprintf_chk() which results in "error: no member named '__builtin___snprintf_chk'" errors at build time. This patch changes the member name from 'snprintf' to 'output' to prevent the replacement. This bug can be emulated using GCC by undefining the __va_arg_pack macro before stdio.h is included. This patch is based on the notes provided in https://bugs.gentoo.org/807766. Signed-off-by: Nicholas Vinson <nvinson234@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Drop pointless local variable in snprintf callbacksPhil Sutter2021-03-151-2/+2
| | | | | | | | | | A common idiom among snprintf callbacks was to copy the unsigned parameter 'size' (or 'len') into a signed variable for further use. Though since snprintf() itself casts it to unsigned and SNPRINTF_BUFFER_SIZE() does not allow it to become negative, this is not needed. Drop the local variable and rename the parameter accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Check output type once and for allPhil Sutter2021-03-151-17/+3
| | | | | | | | | | | There is but a single supported output type left, so check it in expr.c and drop all the single option switch statements in individual expressions. Since the parameter is now unused (and to ensure code correctness), drop 'type' parameter from struct expr_ops' snprintf callback. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Fix snprintf buffer length updatesPhil Sutter2021-03-151-6/+6
| | | | | | | | Subsequent calls to snprintf() sometimes reuse 'len' variable although they should refer to the updated value in 'remain' instead. Fixes: 676ea569bbe5a ("src: Change parameters of SNPRINTF_BUFFER_SIZE macro.") Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: remove nftnl_rule_cmp() and nftnl_expr_cmp()Pablo Neira Ayuso2018-10-241-20/+0
| | | | | | | | | | | | | | These functions are not very useful, rule comparison from this layer does not work well with implicit set definitions. This infrastructure was added as an attempt to support for deletion by name from this layer, which should be done from higher level libnftables library. Finally, we never had a client for this code in git.netfilter.org. Let's remove it and bump libversion for safety reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-191-4/+4
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-151-49/+0
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: no need to nul-terminate buffer from expression ->snprintf indirectionPablo Neira Ayuso2017-10-041-3/+0
| | | | | | | ->snprintf() is always called via nftnl_expr_snprintf() wrapper, which is already dealing with this corner case for us. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Buffer is null terminated.Varsha Rao2017-09-271-0/+2
| | | | | | | In _snprintf() functions definition the buffer is null terminated. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Change parameters of SNPRINTF_BUFFER_SIZE macro.Varsha Rao2017-09-271-7/+7
| | | | | | | | | SNPRINTF_BUFFER_SIZE() macro declaration and definition is changed so that it accepts three arguments ret, remain and offset. Parameters size and len are not required instead parameter remain keeps track of available space in the buffer. Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
* src: remove libmxml supportArturo Borrero2016-09-231-36/+0
| | | | | | | | | | | | | | | | | | | This patch removes the libmxml integration in libnftnl, since we have JSON in place and there is no need to support two at the same time. The JSON support is much better, for example libjansson has a better parsing error reporting. Moreover, libmxml 2.10 breaks the integration with libnftnl somehow, as reported in Debian bug #83870 [0]. Also, the XML support inside libnftnl has never been in good shape, with several tiny inconsitencies. [0] https://bugs.debian.org/838370 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: add NFTA_QUEUE_SREG_QNUM attr supportLiping Zhang2016-09-221-7/+50
| | | | | | | | | | After adding _SREG_QNUM attr, queuenum is not must option anymore, so we must test NFTNL_EXPR_QUEUE_NUM first before dumpping queue num in snprintf_default. Also add a tailing space in snprintf_default, this is consistent with other expressions. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: remove redundant NFTNL_EXPR_QUEUE_NUM set in json parseLiping Zhang2016-09-121-1/+0
| | | | | | | | We have already set NFTNL_EXPR_QUEUE_NUM when parse "num" successfully, here is wrong and redundant, remove it. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Implement rule comparisonCarlos Falgueras García2016-08-171-0/+18
| | | | | | | | | | | | | | | | | | | | This patch implements the function: bool nftnl_rule_cmp(const struct nftnl_rule *r1, const struct nftnl_rule *r2) for rule comparison. Expressions within rules need to be compared, so also has been created the function: bool nftnl_expr_cmp(const struct nftnl_expr *e1, const struct nftnl_expr *e2); Also includes all expression comparators. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftnl: constify object arguments to various functionsPatrick McHardy2016-05-091-4/+4
| | | | | | | | | flow table support needs constant object arguments to printing functions to avoid ugly casts. While at it, also constify object arguments to message construction, destructor and a few helper functions. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename nftnl_rule_expr to nftnl_exprPablo Neira Ayuso2015-09-071-30/+30
| | | | | | | Use a shorter name for this, morever this can be used from sets so the _rule_ is misleading. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename existing functions to use the nftnl_ prefixPablo Neira Ayuso2015-09-071-75/+75
| | | | | | | | | So we can use the nft_* prefix anytime soon for our upcoming higher level library. After this patch, the nft_* symbols become an alias of the nftnl_* symbols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: restore static array with expression operationsPablo Neira Ayuso2015-03-231-5/+0
| | | | | | | | | | | | | We cannot use __attribute__((constructor)) to register the supported expressions in runtime when the library is statically linked. This lead us to some explicit libnftnl_init() function that needs to be called from the main() function of the client program. This patch reverts 4dd0772 ("expr: use __attribute__((constructor)) to register expression"). Reported-by: Laurent Bercot <ska-devel@skarnet.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: split internal.h is smaller filesPablo Neira Ayuso2015-02-171-2/+0
| | | | | | | | | The internal.h file started being a small file with private definitions. Its size has been increasing over time more and more, so let's split this in small header files that map to the corresponding class where the functions belong to. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate XML/JSON exportationPablo Neira Ayuso2014-11-101-52/+13
| | | | | | | | | | | | | | Add new buffer class to consolidate the existing code to export objects in XML/JSON and use it. We save ~700 LOC with this change. The rule and set objects are not yet consolidated. It seems this would require some specific glue code per representation type since lists are arranged differently. This also consolidates the tag names, so we make sure the same are used from XML and JSON by placing them in include/buffer.h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-201-4/+2
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Use snprintf and SNPRINTF_BUFFER_SIZE in snprintf_default functionAna Rey2014-06-161-16/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Code refactoring to use snprintf and SNPRINTF_BUFFER_SIZE in snprintf_default functions. Also, It adapts to the next syntax in queue. Added in: http://git.netfilter.org/nftables/commit/?id=27619ffbe503ed4d9e59a02e81db9a7ac49d37af Here, some examples: ip test input 31 [ queue num 3-5 bypass fanout] ip test input 32 31 [ queue num 0] ip test input 33 32 [ queue num 4] ip test input 34 33 [ queue num 2-6 bypass] table ip test { chain input { type filter hook input priority 0; queue num 3-5 bypass fanout queue num 0 queue num 4 queue num 2-6 bypass } } Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Use the correct data typeAna Rey2014-06-161-4/+5
| | | | | | | Fix wrong data types, eg. queue num is u16. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Do not print unset values in jsonAna Rey2014-06-161-17/+29
| | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This json file is gotten for a queue: {"expr":[{"type":"queue","num":0,"total":1,"flags":0}]} Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Do not print unset values in xmlAna Rey2014-06-161-14/+25
| | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This xml file is gotten for a queue: [...] <expr type="queue"> <num>0</num> <total>1</total> <flags>0</flags> </expr> [...] Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Use nft_rule_expr_* in the xmlAna Rey2014-06-161-10/+7
| | | | | | | Code refactoring to use nft_rule_expr_* in parse xml functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Add nft_rule_expr_queue_snprinf_* functionsAna Rey2014-06-161-31/+51
| | | | | | | | | | | | | | | Code refactoring in nft_rule_expr_queue_snprinf functions. This patch adds three new functions: * nft_rule_expr_queue_snprinf_default * nft_rule_expr_queue_snprinf_xml * nft_rule_expr_queue_snprinf_json Moreover, I have deleted an unnecesary whitespace as the CodingStyle recommends. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: compile queue expression supportPablo Neira Ayuso2014-02-171-8/+13
| | | | | | | This got lost in 29fd6a1df9 when merging major changes in master to next-3.14. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' into next-3.14Pablo Neira Ayuso2014-02-031-2/+2
| | | | | | | | | | | | | | | | | This patch includes changes to adapt this branch to the library rename that happened in the master branch. Conflicts: src/Makefile.am src/expr/cmp.c src/expr/ct.c src/expr/data_reg.c src/expr/meta.c tests/jsonfiles/01-table.json tests/jsonfiles/02-table.json tests/jsonfiles/64-ruleset.json tests/xmlfiles/01-table.xml tests/xmlfiles/02-table.xml
* expr: add support for nfnetlink queueEric Leblond2013-12-041-0/+254
This patch adds a support of the queue target. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>