diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-05-20 20:23:37 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-06-02 14:06:06 +0200 |
commit | 6e15bdda54e4521be5efab4e00e141a612d6e064 (patch) | |
tree | 141b529f2b8d8928122f6e67ce30f3e9e20ad98f | |
parent | d35e789cdae6e7ac622c40e50558901f45e2d53c (diff) |
src: allow flowtable definitions with no devices
The listing shows no devices:
# nft list ruleset
table ip x {
flowtable y {
hook ingress priority filter
}
}
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r-- | src/mnl.c | 10 | ||||
-rw-r--r-- | src/rule.c | 14 | ||||
-rwxr-xr-x | tests/shell/testcases/flowtable/0006segfault_0 | 3 |
3 files changed, 14 insertions, 13 deletions
@@ -1652,10 +1652,12 @@ int mnl_nft_flowtable_add(struct netlink_ctx *ctx, struct cmd *cmd, nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_PRIO, 0); } - dev_array = nft_flowtable_dev_array(cmd); - nftnl_flowtable_set_data(flo, NFTNL_FLOWTABLE_DEVICES, - dev_array, 0); - nft_flowtable_dev_array_free(dev_array); + if (cmd->flowtable->dev_expr) { + dev_array = nft_flowtable_dev_array(cmd); + nftnl_flowtable_set_data(flo, NFTNL_FLOWTABLE_DEVICES, + dev_array, 0); + nft_flowtable_dev_array_free(dev_array); + } nftnl_flowtable_set_u32(flo, NFTNL_FLOWTABLE_FLAGS, cmd->flowtable->flags); @@ -2272,13 +2272,15 @@ static void flowtable_print_declaration(const struct flowtable *flowtable, flowtable->hook.num, flowtable->priority.expr), opts->stmt_separator); - nft_print(octx, "%s%sdevices = { ", opts->tab, opts->tab); - for (i = 0; i < flowtable->dev_array_len; i++) { - nft_print(octx, "%s", flowtable->dev_array[i]); - if (i + 1 != flowtable->dev_array_len) - nft_print(octx, ", "); + if (flowtable->dev_array_len > 0) { + nft_print(octx, "%s%sdevices = { ", opts->tab, opts->tab); + for (i = 0; i < flowtable->dev_array_len; i++) { + nft_print(octx, "%s", flowtable->dev_array[i]); + if (i + 1 != flowtable->dev_array_len) + nft_print(octx, ", "); + } + nft_print(octx, " }%s", opts->stmt_separator); } - nft_print(octx, " }%s", opts->stmt_separator); if (flowtable->flags & NFT_FLOWTABLE_COUNTER) nft_print(octx, "%s%scounter%s", opts->tab, opts->tab, diff --git a/tests/shell/testcases/flowtable/0006segfault_0 b/tests/shell/testcases/flowtable/0006segfault_0 index de590b77..fb7c52fe 100755 --- a/tests/shell/testcases/flowtable/0006segfault_0 +++ b/tests/shell/testcases/flowtable/0006segfault_0 @@ -9,6 +9,3 @@ $NFT add flowtable ip t f { hook ingress priority 10\; devices = { lo } } $NFT add flowtable ip t f { hook ingress\; priority 10\; } [[ $? -eq 1 ]] || exit 1 - -$NFT add flowtable ip t f { hook ingress priority 10\; } -[[ $? -eq 1 ]] || exit 1 |