summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2019-07-11 15:49:09 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2019-07-16 19:53:43 +0200
commit7d3c01182e883e18050903b9176593c517e4ff91 (patch)
tree2cc24b204177e2192bbd6be3e8f2b8e5bd27c6d7
parent0fd53234e360d4dde8aa53dbcaad89495a4fab7f (diff)
evaluate: missing object maps handling in list and flush commands
NFT_SET_OBJECT tells there is an object map. # nft list ruleset table inet filter { map countermap { type ipv4_addr : counter } } The following command fails: # nft flush set inet filter countermap This patch checks for NFT_SET_OBJECT from new set_is_literal() and map_is_literal() functions. This patch also adds tests for this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--include/rule.h15
-rw-r--r--src/evaluate.c13
-rwxr-xr-xtests/shell/testcases/listing/0017objects_019
-rwxr-xr-xtests/shell/testcases/listing/0018data_019
-rwxr-xr-xtests/shell/testcases/listing/0019set_019
5 files changed, 77 insertions, 8 deletions
diff --git a/include/rule.h b/include/rule.h
index bee1d447..42d29b7c 100644
--- a/include/rule.h
+++ b/include/rule.h
@@ -337,6 +337,21 @@ static inline bool set_is_map(uint32_t set_flags)
return set_is_datamap(set_flags) || set_is_objmap(set_flags);
}
+static inline bool set_is_anonymous(uint32_t set_flags)
+{
+ return set_flags & NFT_SET_ANONYMOUS;
+}
+
+static inline bool set_is_literal(uint32_t set_flags)
+{
+ return !(set_is_anonymous(set_flags) || set_is_map(set_flags));
+}
+
+static inline bool map_is_literal(uint32_t set_flags)
+{
+ return !(set_is_anonymous(set_flags) || !set_is_map(set_flags));
+}
+
#include <statement.h>
struct counter {
diff --git a/src/evaluate.c b/src/evaluate.c
index e1a827e7..f9151871 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3630,8 +3630,8 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct cmd *cmd)
if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (set->flags & (NFT_SET_MAP | NFT_SET_ANONYMOUS))
- return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ else if (!set_is_literal(set->flags))
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
return 0;
@@ -3659,8 +3659,7 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct cmd *cmd)
if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (!(set->flags & NFT_SET_MAP) ||
- set->flags & NFT_SET_ANONYMOUS)
+ else if (!map_is_literal(set->flags))
return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
@@ -3752,10 +3751,9 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (set->flags & (NFT_SET_MAP | NFT_SET_ANONYMOUS))
+ else if (!set_is_literal(set->flags))
return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
-
return 0;
case CMD_OBJ_MAP:
table = table_lookup(&cmd->handle, &ctx->nft->cache);
@@ -3766,8 +3764,7 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
- else if (!(set->flags & NFT_SET_MAP) ||
- set->flags & NFT_SET_ANONYMOUS)
+ else if (!map_is_literal(set->flags))
return cmd_error(ctx, &ctx->cmd->handle.set.location,
"%s", strerror(ENOENT));
diff --git a/tests/shell/testcases/listing/0017objects_0 b/tests/shell/testcases/listing/0017objects_0
new file mode 100755
index 00000000..14d61438
--- /dev/null
+++ b/tests/shell/testcases/listing/0017objects_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+EXPECTED="table inet filter {
+ map countermap {
+ type ipv4_addr : counter
+ }
+}"
+
+set -e
+
+$NFT -f - <<< $EXPECTED
+$NFT flush map inet filter countermap
+
+GET="$($NFT list map inet filter countermap)"
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/listing/0018data_0 b/tests/shell/testcases/listing/0018data_0
new file mode 100755
index 00000000..767fe13a
--- /dev/null
+++ b/tests/shell/testcases/listing/0018data_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+EXPECTED="table inet filter {
+ map ipmap {
+ type ipv4_addr : ipv4_addr
+ }
+}"
+
+set -e
+
+$NFT -f - <<< $EXPECTED
+$NFT flush map inet filter ipmap
+
+GET="$($NFT list map inet filter ipmap)"
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi
diff --git a/tests/shell/testcases/listing/0019set_0 b/tests/shell/testcases/listing/0019set_0
new file mode 100755
index 00000000..04eb0faf
--- /dev/null
+++ b/tests/shell/testcases/listing/0019set_0
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+EXPECTED="table inet filter {
+ set ipset {
+ type ipv4_addr
+ }
+}"
+
+set -e
+
+$NFT -f - <<< $EXPECTED
+$NFT flush set inet filter ipset
+
+GET="$($NFT list set inet filter ipset)"
+if [ "$EXPECTED" != "$GET" ] ; then
+ DIFF="$(which diff)"
+ [ -x $DIFF ] && $DIFF -u <(echo "$EXPECTED") <(echo "$GET")
+ exit 1
+fi