summaryrefslogtreecommitdiffstats
path: root/src/obj/ct_timeout.c
Commit message (Collapse)AuthorAgeFilesLines
* obj: Respect data_len when setting attributesPhil Sutter9 days1-2/+2
| | | | | | | | With attr_policy in place, data_len has an upper boundary. Use it for memcpy() calls to cover for caller passing data with lower size than the attribute's storage. Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj: Introduce struct obj_ops::attr_policyPhil Sutter9 days1-0/+7
| | | | | | | | Just like with struct expr_ops::attr_policy, enable object types to inform about restrictions on attribute use. This way generic object code may perform sanity checks before dispatching to object ops. Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj: Call obj_ops::set with legal attributes onlyPhil Sutter9 days1-2/+0
| | | | | | | | | | Refer to obj_ops::nftnl_max_attr field value for the maximum supported attribute value to reject invalid ones upfront. Consequently drop default cases from callbacks' switches which handle all supported attributes. Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj: Repurpose struct obj_ops::max_attr fieldPhil Sutter9 days1-1/+1
| | | | | | | Just like with struct expr_ops::max_attr, make it hold the maximum object attribute (NFTNL_OBJ_*) value supported by this object type. Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj: ct_timeout: setter checks for timeout array boundariesPablo Neira Ayuso2024-02-201-4/+7
| | | | | | | | Use _MAX definitions for timeout attribute arrays and check that timeout array is not larger than NFTNL_CTTIMEOUT_ARRAY_MAX. Fixes: 0adceeab1597 ("src: add ct timeout support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix clang+glibc snprintf substitution errorNicholas Vinson2022-06-151-1/+1
| | | | | | | | | | | | | | | | | | | | When building with clang and glibc and -D_FORTIFY_SOURCE=2 is passed to clang, the snprintf member of the expr_ops and obj_ops structures will be incorrectly replaced with __builtin_snprintf_chk() which results in "error: no member named '__builtin___snprintf_chk'" errors at build time. This patch changes the member name from 'snprintf' to 'output' to prevent the replacement. This bug can be emulated using GCC by undefining the __va_arg_pack macro before stdio.h is included. This patch is based on the notes provided in https://bugs.gentoo.org/807766. Signed-off-by: Nicholas Vinson <nvinson234@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Drop pointless local variable in snprintf callbacksPhil Sutter2021-03-151-3/+2
| | | | | | | | | | A common idiom among snprintf callbacks was to copy the unsigned parameter 'size' (or 'len') into a signed variable for further use. Though since snprintf() itself casts it to unsigned and SNPRINTF_BUFFER_SIZE() does not allow it to become negative, this is not needed. Drop the local variable and rename the parameter accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj: Drop type parameter from snprintf callbackPhil Sutter2021-03-151-19/+3
| | | | | | | Objects don't support any other output type than NFTNL_OUTPUT_DEFAULT, so just drop the parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj/ct_timeout: Fix snprintf buffer length updatesPhil Sutter2021-03-151-5/+5
| | | | | | | | Have to pass shrinking 'remain' variable to consecutive snprintf calls instead of the unchanged 'len' parameter. Fixes: 0adceeab1597a ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parserPhil Sutter2019-10-171-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | This is a necessary follow-up on commit 00b144bc9d093 ("obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data()") which fixed array out of bounds access but missed the logic behind it: The nested attribute type values are incremented by one when being transferred between kernel and userspace, the zero type value is reserved for "unspecified". Kernel uses CTA_TIMEOUT_* symbols for that, libnftnl simply mangles the type values in nftnl_obj_ct_timeout_build(). Return path was broken as it overstepped its nlattr array but apart from that worked: Type values were decremented by one in timeout_parse_attr_data(). This patch moves the type value mangling into parse_timeout_attr_policy_cb() (which still overstepped nlattr array). Consequently, when copying values from nlattr array into ct timeout object in timeout_parse_attr_data(), loop is adjusted to start at index 0 and the type value decrement is dropped there. Fixes: 0adceeab1597a ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data()Phil Sutter2019-10-151-1/+1
| | | | | | | | | | Array 'tb' has only 'attr_max' elements, the loop overstepped its boundary by one. Copy array_size() macro from include/utils.h in nftables.git to make sure code does the right thing. Fixes: 0adceeab1597a ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: Check return code of mnl_attr_parse_nested()Phil Sutter2019-10-151-3/+6
| | | | | | | | | Don't ignore nested attribute parsing errors, this may hide bugs in users' code. Fixes: 0adceeab1597a ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-191-2/+2
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-151-16/+0
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: don't skip zero value timeoutPablo Neira Ayuso2018-08-311-4/+3
| | | | | | It's a valid configuration, don't assume this means timeout is unset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: use fixed size arrayPablo Neira Ayuso2018-08-311-23/+5
| | | | | | | | | Use an internal array and expose maximum size so we can just use the same array size for all protocol timeouts. This simplifies handling a bit and we don't need to set NFTNL_OBJ_CT_TIMEOUT_L4PROTO in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: fix gcc4 build errorFlorian Westphal2018-08-211-1/+3
| | | | | | gcc 4.9 only allows for-loop initialisation declarations in C99 or C11 modes. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: remove cttimeout.h leftoverPablo Neira Ayuso2018-08-141-1/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ct timeout supportHarsha Sharma2018-08-131-0/+368
Add support for ct timeout objects, used to assign connection tracking timeout policies. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>