summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests/py: Fix JSON equivalents of osf testsPhil Sutter2019-05-091-2/+57
| | | | | | Fixes: 12adf747a3f62 ("tests: py: add osf tests with versions") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fix printing of zero-length prefixesPhil Sutter2019-05-091-1/+3
| | | | | | | | | | | | | | | | | | | When delinearizing, an all-zero mask didn't qualify as prefix. Therefore a statement: | ip daddr 0.0.0.0/0 would be printed as: | ip daddr & 0.0.0.0 == 0.0.0.0 To fix this, expr_mask_is_prefix() must return true if the initial 1-bit search fails (the given value must be zero in this case). Additionally, a shortcut is needed in conversion algorithm of expr_mask_to_prefix() to not turn the zero prefix into a 1 by accident. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix igmp supportPhil Sutter2019-05-092-0/+324
| | | | | | | | | Parser didn't know about that protocol, also testsuite bits were missing. Fixes: bad27ca386276 ("src: add igmp support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support nat in inet familyPhil Sutter2019-05-095-1/+316
| | | | | | | | Add the missing bits to JSON parser, printer, man page and testsuite. Fixes: fbe27464dee45 ("src: add nat support for the inet family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Review man page synopsesPhil Sutter2019-05-085-118/+164
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix use of font typefaces: - *bold* for terminals - 'italic' for non-terminals - plain for meta-characters Apart from that: * Variable definitions require an equals sign * 'auto-merge' option in set spec does not take a parameter * List header fields in payload expressions instead of unexplained placeholder * Introduce non-terminals in some places to avoid repetitions or clarify syntax * Fix syntax for ip6 header expresssion example * Reorganize ct expression synopsis into four parts: 1) direction not allowed 2) direction optional 3) direction mandatory 4) direction and family mandatory * Add missing 'version' keyword to osf expression * Clarify verdict statements example topic * Add synopses for payload and exthdr statements * Fix typo: differv -> diffserv * Reorganize reject statement synopsis to point out which code type is required for which type arg * Counter statement requires either one of 'packets' or 'bytes' args or both, none is an invalid variant * Limit statement accepts a unit in burst, too * Improve language in limit statement description a bit Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* py: Fix gitignore of lib/ directoryPhil Sutter2019-05-081-1/+1
| | | | | | | | | Pattern is not a PCRE one but merely a shell glob. Hence 'lib.*' matches only 'lib.' prefix, not also 'lib'. Fixes: bf9653667a39e ("python: installation of binding via make install") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* gmputil: Add missing header for va_listRosen Penev2019-05-061-0/+1
| | | | | | | Otherwise it errors with unknown type name when using uClibc. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use UDATA defines from libnftnlPhil Sutter2019-05-038-76/+50
| | | | | | | | | | | | | Userdata attribute names have been added to libnftnl, use them instead of the local copy. While being at it, rename udata_get_comment() in netlink_delinearize.c and the callback it uses since the function is specific to rules. Also integrate the existence check for NFTNL_RULE_USERDATA into it along with the call to nftnl_rule_get_data(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: fix crash on add rule to bad referencesEric Garver2019-05-031-1/+5
| | | | | | | | | | | Pass the location via the handle so the error leg in rule_translate_index() can reference it. Applies to invalid references to tables, chains, and indexes. Fixes: 586ad210368b ("libnftables: Implement JSON parser") Signed-off-by: Eric Garver <eric@garver.life> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: fix off by one index on rule add/replaceEric Garver2019-05-031-2/+6
| | | | | | | | | We need to increment the index by one just as the CLI does. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Eric Garver <eric@garver.life> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: support for draft-ietf-tsvwg-le-phb-10.txtLoganaden Velvindron2019-05-0312-11/+15
| | | | | | | | | | Upcoming dscp codepoint for background traffic of low precendence such as bulk data transfers with low priority in time, non time-critical backups, larger software updates, web search engines while gathering information from web servers and so on. Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: default to unspecified l3proto for ct helper/timeoutEric Garver2019-05-031-1/+1
| | | | | | | | | | As per the man page, if the user does not specify the l3proto it should be derived from the table family. Fixes: 586ad210368b ("libnftables: Implement JSON parser") Signed-off-by: Eric Garver <eric@garver.life> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix double free on xt stmt destructionFlorian Westphal2019-05-013-8/+2
| | | | | | | | | | | | 'nft monitor' dies with: *** Error in `/sbin/nft': double free or corruption (fasttop): 0x000055f8ba57b750 *** ... when the iptables-nft test suite is running in parallel, because xfree(stmt->xt.name) gets called twice. Fixes: 4ac11b890fe870 ("src: missing destroy function in statement definitions") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix parser for list maps commandPhil Sutter2019-04-301-1/+1
| | | | | | | | Wrong callback in json_parse_cmd_list() for "maps" key. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix typo in ct timeout policy parserPhil Sutter2019-04-301-1/+1
| | | | | | | | | Parser expects an object in policy property and json_is_object() returns true if given parameter is an object. The check was inverse by accident. Fixes: c82a26ebf7e9f ("json: Add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix error messages in chain_delete()Phil Sutter2019-04-301-2/+2
| | | | | | | | | | Adding string and chain object is an illegal operation in Python. Instead concatenate with cmd string since that contains all required information already. Fixes: 820fd08b5f1d4 ("tests/py: Review print statements in nft-test.py") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: monitor: Adjust to changed events orderingPhil Sutter2019-04-301-2/+2
| | | | | | | | | | When replacing a rule, kernel nowadays seems to report rule add event before rule delete one. Since both events belong to the same transaction, this is harmless per definition and merely needs adjustment in expected output. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Disallow ct helper as type to map toPhil Sutter2019-04-111-1/+0
| | | | | | | | | | | When creating a map, users may either map dtype:dtype or dtype:object. In the second case, only counter, quota, limit and secmark is allowed by bison, but JSON parser wasn't as strict, allowing ct helper as well. Remove that to avoid undefined behaviour. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: fix segfault in translating string to nft objectLaura Garcia Liebana2019-04-111-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A segmentation fault is produced when applying an input JSON file like the following: {"nftables": [ { "add": {"map": {"family": "ip", "name": "persistencia", "table": "nftlb", "type": "ipv4_addr", "map": "mark", "size": 65535, "flags": ["timeout"], "timeout": 44 } } } ]} The captured error is: Program received signal SIGSEGV, Segmentation fault. #1 0x00007ffff7f734f9 in string_to_nft_object (str=0x55555555f410 "mark") at parser_json.c:2513 2513 if (!strcmp(str, obj_tbl[i])) The obj_tbl array is allocated with the maximum element index even if lower indexes are not populated, so it produces null pointer items. This patch ensures that the maximum number of possible indexes but also the element is not comparing a null pointer. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: fix memleak in interval_map_decompose()Pablo Neira Ayuso2019-04-101-7/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not inconditionally hold reference to start interval. The handling depends on what kind of range expression we need to build, either no range at all, a prefix or a plain range. Depending on the case, we need to partially clone what we need from the expression to avoid use-after-free. This fixes valgrind reports that look like this, when listing rulesets: ==30018== 2,057,984 (1,028,992 direct, 1,028,992 indirect) bytes in 8,039 blocks are definitely lost in loss record 76 of 83 ==30018== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==30018== by 0x4E75978: xmalloc (utils.c:36) ==30018== by 0x4E75A5D: xzalloc (utils.c:65) ==30018== by 0x4E5CEC0: expr_alloc (expression.c:45) ==30018== by 0x4E5D610: mapping_expr_alloc (expression.c:985) ==30018== by 0x4E6A068: netlink_delinearize_setelem (netlink.c:810) ==30018== by 0x5B51320: nftnl_set_elem_foreach (set_elem.c:673) ==30018== by 0x4E6A2D5: netlink_list_setelems (netlink.c:864) ==30018== by 0x4E56C76: cache_init_objects (rule.c:166) ==30018== by 0x4E56C76: cache_init (rule.c:216) ==30018== by 0x4E56C76: cache_update (rule.c:243) ==30018== by 0x4E64530: cmd_evaluate_list (evaluate.c:3503) ==30018== by 0x4E64530: cmd_evaluate (evaluate.c:3880) ==30018== by 0x4E7D12F: nft_parse (parser_bison.y:798) ==30018== by 0x4E7AB56: nft_parse_bison_buffer (libnftables.c:349) ==30018== by 0x4E7AB56: nft_run_cmd_from_buffer (libnftables.c:394) Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: memleak in expressionsPablo Neira Ayuso2019-04-102-0/+7
| | | | | | Fix memleak in set element and hash expressions destroy path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nat support for the inet familyFlorian Westphal2019-04-0912-46/+266
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | consider a simple ip6 nat table: table ip6 nat { chain output { type nat hook output priority 0; policy accept; dnat to dead:2::99 } Now consider same ruleset, but using 'table inet nat': nft now lacks context to determine address family to parse 'to $address'. This adds code to make the following work: table inet nat { [ .. ] # detect af from network protocol context: ip6 daddr dead::2::1 dnat to dead:2::99 # use new dnat ip6 keyword: dnat ip6 to dead:2::99 } On list side, the keyword is only shown in the inet family, else the short version (dnat to ...) is used as the family is redundant when the table already mandates the ip protocol version supported. Address mismatches such as table ip6 { .. dnat ip to 1.2.3.4 are detected/handled during the evaluation phase. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: pf.os: merge the signatures splitted by versionFernando Fernandez Mancera2019-04-081-26/+14
| | | | | | | | | | | | | | | | | | In order to be able to identify the OS version we need to merge the signatures split by version. eg. 65535:64:1:60:M*,N,W1,N,N,T: FreeBSD:4.7-4.11::FreeBSD 4.7-5.2 65535:64:1:60:M*,N,W1,N,N,T: FreeBSD:5.0-5.2::FreeBSD 4.7-5.2 65535:64:1:60:M*,N,W1,N,N,T: FreeBSD:4.7-5.2::FreeBSD 4.7-5.2 Fingerprints need to be unique to make this fit into the set/map infrastructure for exact matches. Having multiples fingerprints with same signature is a problem, since it forces users to add multiple rules. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: osf: update pf.os with newer OS fingerprintsFernando Fernandez Mancera2019-04-081-0/+6
| | | | | | | | After notice that some fingerprints are outdated we have updated the most common of them. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add osf version option to man pageFernando Fernandez Mancera2019-04-081-0/+2
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add osf tests with versionsFernando Fernandez Mancera2019-04-083-0/+85
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: osf: add version json supportFernando Fernandez Mancera2019-04-082-3/+13
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add version fingerprint supportFernando Fernandez Mancera2019-04-087-7/+29
| | | | | | | | | | | | | | | Add support for version fingerprint in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" osf ttl skip version "Linux:4.20" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update nft list plural form parametersFernando Fernandez Mancera2019-04-081-0/+6
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: missing destroy function in statement definitionsPablo Neira Ayuso2019-04-056-0/+54
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: type_identifier string memleakPablo Neira Ayuso2019-04-051-1/+1
| | | | | | | | | | | | | ==6297== 24 bytes in 3 blocks are definitely lost in loss record 2 of 13 ==6297== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==6297== by 0x56193B9: strdup (strdup.c:42) ==6297== by 0x4E758BD: xstrdup (utils.c:75) ==6297== by 0x4E7F9D3: nft_parse (parser_bison.y:1895) ==6297== by 0x4E7AAE1: nft_parse_bison_filename (libnftables.c:370) ==6297== by 0x4E7AAE1: nft_run_cmd_from_filename (libnftables.c:438) ==6297== by 0x109A33: main (main.c:310) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: use nft_print() instead of printf()Pablo Neira Ayuso2019-04-051-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: improve error reporting in tproxy with inet familyPablo Neira Ayuso2019-04-041-2/+5
| | | | | | | | | | | | | | | | | # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: conflicting protocols specified: ip vs. unknown. You must specify ip or ip6 family in tproxy statement add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ~~~~~~~~ ^^^^^^^^^^^^^^^ instead of: # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: Conflicting network layer protocols. add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing tproxy syntax with port only for inet familyPablo Neira Ayuso2019-04-047-4/+52
| | | | | | | | | | | | | | | | | # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy ip to :2000 Error: syntax error, unexpected colon add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy ip to :2000 ^ Syntax with no protocol for tproxy complains with: # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: Conflicting network layer protocols. add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add minimal description of (v)map statementsPhil Sutter2019-04-031-0/+34
| | | | | | | | Although quite useful, these were missing in man page. Content loosely based on wiki documentation. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Rewrite echo supportPhil Sutter2019-04-033-249/+243
| | | | | | | | | | | | | | | | | Instead of guessing which object to update with retrieved handle, introduce a list containing struct cmd <-> json_t associations. Upon batch commit, allocated cmd objects are assigned a unique netlink sequence number. Monitor events contain that number as well, so they may be associated to the cmd object which triggered them. Using json_cmd_assoc list the event may in turn be associated to the input's JSON object which should receive the handle value. This also fixes incorrect behaviour if JSON input contained "insert" commands. Fixes: bb32d8db9a125 ("JSON: Add support for echo option") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip binary transfer for named setsPablo Neira Ayuso2019-03-261-0/+3
| | | | | | | | Set may be empty, content might be yet unknown, we cannot do any transfer in this case. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1327 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use 'flow add' syntaxPablo Neira Ayuso2019-03-207-9/+13
| | | | | | As discussed during NFWS 2018. Old syntax is stilled allowed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: missing misspell.h in Makefile.amPablo Neira Ayuso2019-03-201-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: Clean up AC_ARG_{WITH, ENABLE} invocations, s/==/=/Luis Ressel2019-03-181-19/+15
| | | | | | | | | | | | | | | | | | | | * AC_ARG_ENABLE implicitly defines enable_debug; there's no point in performing extra work just to define with_debug with an identical value. * The same applies to with_xtables and with_libxtables. * The AS_IF block in the `AC_ARG_ENABLE([man-doc], ...` invocation is essentially a noop. All it does is to set enable_man_doc to `yes` if has a value that matches neither `yes` nor `no`. (This could happen if a user calls `configure --enable-man-doc=foo`, but that'd be a user error which we don't need to handle.) * The correct operator for equality tests in `test` is `=`. Some implementations also support `==`, but this is not portable. Signed-off-by: Luis Ressel <aranea@aixah.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: Fix a2x checkLuis Ressel2019-03-181-6/+3
| | | | | | | | | | | | | | | * If enable_man_doc is set, but a2x can't be found, configure should fail instead of silently disabling man page creation. * The AS_IF block checking $need_a2x is never active (need_a2x has been removed from configure.ac in 13e44a608 and a277479dc). * AC_CHECK_PROG(VAR, ...) is a noop if VAR is already set, allowing the user to explicitly specify the (path to the) binary in VAR. Adjust the AS_IF check to account for this. Signed-off-by: Luis Ressel <aranea@aixah.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: file descriptor leak in include_file()Pablo Neira Ayuso2019-03-154-25/+32
| | | | | | | | File that contains the ruleset is never closed, track open files through the nft_ctx object and close them accordingly. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: no need for statement separator for ct object commandsPablo Neira Ayuso2019-03-141-4/+4
| | | | | | | | | | | | | Otherwise, this forces user to place a double semi-colon to skip a parser error in a multi-line commands: # nft add "ct helper ip filter test { type \"ftp\" protocol tcp; };add rule filter test ct helper set \"ftp\"" Error: syntax error, unexpected add, expecting end of file or newline or semicolon add ct helper ip filter test { type "ftp" protocol tcp; };add rule filter test ct helper set "ftp" ^^^ Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY on helper deletion from transactionPablo Neira Ayuso2019-03-141-0/+15
| | | | | Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus ENOENT on element deletion in interval setPablo Neira Ayuso2019-03-121-0/+26
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY in set deletion after flushPablo Neira Ayuso2019-03-081-0/+18
| | | | | | | | | | | | | | | | flush chain ip filter group_7933 Removes all rules, including references to set 'group_7933', however: delete map ip filter group_7933 results in: delete.nft:6:1-32: Error: Could not process rule: Device or resource busy delete map ip filter group_7933 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for anon set abort.Florian Westphal2019-03-071-0/+10
| | | | | | | This triggers kernel crash in 5.0, see https://bugzilla.netfilter.org/show_bug.cgi?id=1325 Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: misleading error reporting with sets and mapsPablo Neira Ayuso2019-03-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to list a map content, if set is used, nft reports: # nft list set filter group_7933 Error: No such file or directory; did you mean set ‘group_7933’ in table ip ‘filter’? list set filter group_7933 ^^^^^^^^^^ Which is confusing in case user wants to list an existing map: # nft list map filter group_7933 table ip filter { map group_7933 { type ipv4_addr : classid flags interval elements = { 10.4.22.0/24 : 1:c7cb } } } Instead, give a hint to user that probably wants to list a map, not a set: # nft list set filter group_7933 Error: No such file or directory; did you mean map ‘group_7933’ in table ip ‘filter’? list set filter group_7933 ^^^^^^^^^^ Fixes: 285bb67a11ad ("src: introduce simple hints on incorrect set") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: add missing non-matching segment to set in flat representationPablo Neira Ayuso2019-03-062-3/+16
| | | | | | | | | | | | | | | | | # cat test.nft add set x y { type ipv4_addr; } add element x y { 10.0.24.0/24 } # nft -f test.nft # nft delete element x y { 10.0.24.0/24 } bogusly returns -ENOENT. The non-matching segment (0.0.0.0 with end-flag set on) is not added to the set in the example above. This patch also adds a test to cover this case. Fixes: 4935a0d561b5 ("segtree: special handling for the first non-matching segment") Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: remove dummy debug_octxPablo Neira Ayuso2019-03-063-10/+10
| | | | | | | | Breaks custom-defined configuration in library mode, ie. user may want to store output in a file, instead of stderr. Fixes: 35f6cd327c2e ("src: Pass stateless, numeric, ip2name and handle variables as structure members.") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-17 01:40:15 +0000