summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build: Bump version to 1.0.9v1.0.9Pablo Neira Ayuso2023-10-191-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: validate maximum log statement prefix lengthPablo Neira Ayuso2023-10-171-1/+6
| | | | | | | | Otherwise too long string overruns the log prefix buffer. Fixes: e76bb3794018 ("src: allow for variables in the log prefix string") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1714 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: use bash instead of /bin/sh for testsThomas Haller2023-10-1612-12/+12
| | | | | | | | | | | | | | | | | All tests under "tests/shell" are shell scripts with shebang /bin/bash or /bin/sh. This may seem expected, since these tests are under "tests/shell" directory, but any executable file would work. Anyway. The vast majority of the tests has "#!/bin/bash" as shebang. A few tests had "#!/bin/sh" or "#!/bin/sh -e". Unify this and always use bash. Since we anyway require bash, this is not a limitation. Also, if we know that this is a bash script (by parsing the shebang), we can let the test wrapper pass "-x" to the script. The next commit will do that, and it is nicer if the shebangs are all uniform. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing "vlan_8021ad_tag.nodump" fileThomas Haller2023-10-161-0/+0
| | | | | | | | | | This is an inconsistency. The test should have either a .nft or a .nodump file. "./tools/check-tree.sh" enforces that and will in the future run by `make check`. Fixes: 74cf3d16d8e9 ('tests: shell: add vlan match test case') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: suggest != in negation error messageFlorian Westphal2023-10-131-1/+1
| | | | | | | | | | | | | | when I run sudo nft insert rule filter FORWARD iifname "ens2f1" ip saddr not @ip_macs counter drop comment \" BLOCK ALL NON REGISTERED IP/MACS \" I get: Error: negation can only be used with singleton bitmask values And even I did not spot the problem immediately. I don't think "not" should have been added, its easily confused with "not equal"/"neq"/!= and hides that this is allegedly a binop. At least *mention* that the commandline is asking for a binary operation here and suggest "!=". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "-S|--setup-host" option to set sysctl for rootless testsThomas Haller2023-10-101-0/+46
| | | | | | | | | | | | | | | | | | | | | | Most tests can run just fine without root. A few of them will fail if /proc/sys/net/core/{wmem_max,rmem_max} is too small (as it is by default on the host). The easy workaround is to bump those limits once. This has to be repeated after each reboot. Doing that manually (every time) is cumbersome. Add a "--setup-host" option for that. Usage: $ sudo ./tests/shell/run-tests.sh -S Setting up host for running as rootless (requires root). echo 4096000 > /proc/sys/net/core/rmem_max (previous value 100000) echo 4096000 > /proc/sys/net/core/wmem_max (previous value 100000) Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: preserve result directory with NFT_TEST_FAIL_ON_SKIPThomas Haller2023-10-101-2/+7
| | | | | | | | | | | On a successful run, the result directory will be deleted (unless run with "-k|--keep-logs" option or NFT_TEST_KEEP_LOGS=y). With NFT_TEST_FAIL_ON_SKIP=y, when there are no failures but skipped tests, also preserve the result. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: mount all of "/var/run" in "test-wrapper.sh"Thomas Haller2023-10-101-11/+15
| | | | | | | | | | | | | | | | | | | | | After reboot, "/var/run/netns" does not exist before we run the first `ip netns add` command. Previously, "test-wrapper.sh" would mount a tmpfs on that directory, but that fails, if the directory doesn't exist. You will notice this, by deleting /var/run/netns (which only root can delete or create, and which is wiped on reboot). Instead, mount all of "/var/run". Then we can also create /var/run/netns directory. This means, any other content from /var/run is hidden too. That's probably desirable, because it means we don't depend on stuff that happens to be there. If we would require other content in /var/run, then the test runner needs to be aware of the requirement and ensure it's present. But best is just to not require anything. It's only iproute2 which insists on /var/run/netns. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: remove references to timeout in reset commandPablo Neira Ayuso2023-10-101-5/+5
| | | | | | | | | | After Linux kernel's patch ("netfilter: nf_tables: do not refresh timeout when resetting element") timers are not reset anymore, update documentation to keep this in sync. Fixes: 83e0f4402fb7 ("Implement 'reset {set,map,element}' commands") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan match test caseFlorian Westphal2023-10-071-0/+50
| | | | | | | Check that we can match on the 8021ad header and vlan tag, see af84f9e447a6 ("netfilter: nft_payload: rebuild vlan header on h_proto access"). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test for dormant on/off/on bugFlorian Westphal2023-10-072-0/+52
| | | | | | | | | | | Disallow enabling/disabling a table in a single transaction. Make sure we still allow one update, either to dormant, or from active to dormant. Reported-by: "Lee, Cherie-Anne" <cherie.lee@starlabs.sg> Cc: Bing-Jhong Billy Jheng <billy@starlabs.sg> Cc: info@starlabs.sg Signed-off-by: Florian Westphal <fw@strlen.de>
* icmpv6: Allow matching target address in NS/NA, redirect and MLDNicolas Cavallari2023-10-069-7/+458
| | | | | | | | | | | | | | | It was currently not possible to match the target address of a neighbor solicitation or neighbor advertisement against a dynamic set, unlike in IPv4. Since they are many ICMPv6 messages with an address at the same offset, allow filtering on the target address for all icmp types that have one. While at it, also allow matching the destination address of an ICMPv6 redirect. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: never merge across non-expression statements redux 2Florian Westphal2023-10-062-0/+95
| | | | | | | Turns out I also love to forget about nft-test.py -j. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: sets/reset_command_0: Fix drop_seconds()Phil Sutter2023-09-291-1/+1
| | | | | | | | | | The function print_times() skips any time elements which are zero, so output may lack the ms part. Adjust the sed call dropping anything but the minutes value to not fail in that case. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 255ec36a11525 ("tests: shell: Stabilize sets/reset_command_0 test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: restrict include directive to regular filesFlorian Westphal2023-09-292-3/+67
| | | | | | | | | | | | | | Similar to previous change, also check all include "foo" and reject those if they refer to named fifos, block devices etc. Directories are still skipped, I don't think we can change this anymore. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1664 Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: refuse to open onput files other than named pipes or regular filesFlorian Westphal2023-09-291-0/+34
| | | | | | | | | | | Don't start e.g. parsing a block device. nftables is typically run as privileged user, exit early if we get unexpected input. Only exception: Allow character device if input is /dev/stdin. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1664 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: never merge across non-expression statements reduxFlorian Westphal2023-09-293-0/+54
| | | | | | | Forgot to 'git add' inet/bridge/netdev payload records. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: never merge across non-expression statementsFlorian Westphal2023-09-296-4/+40
| | | | | | | | | | | | | | | | | | The existing logic can merge across non-expression statements, if there is only one payload expression. Example: ether saddr 00:11:22:33:44:55 counter ether type 8021q is turned into counter ether saddr 00:11:22:33:44:55 ether type 8021q which isn't the same thing. Fix this up and add test cases for adjacent vlan and ip header fields. 'Counter' serves as a non-merge fence. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix for failing nft-f/sample-rulesetPhil Sutter2023-09-281-2/+2
| | | | | | | | | | For whatever reason, my system lacks an entry for 'sip' in /etc/services. Assuming the service name is not relevant to the test, just replace it by the respective port number. Fixes: 68728014435d9 ("tests: shell: add sample ruleset reproducer") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: use xmalloc() for allocating datatype in datatype_clone()Thomas Haller2023-09-281-1/+1
| | | | | | | | The returned memory will be initialized. No need to zero it first. Use xmalloc() instead of xzalloc(). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add missing map statement stubPablo Neira Ayuso2023-09-281-0/+1
| | | | | | | Add map statement stub to restore compilation without json support. Fixes: 27a2da23d508 ("netlink_linearize: skip set element expression in map statement key") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: include <string.h> in <nft.h>Thomas Haller2023-09-2841-41/+1
| | | | | | | | <string.h> provides strcmp(), as such it's very basic and used everywhere. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: fix spurious errors in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-09-271-3/+7
| | | | | | | | | | | | | | | A number of changes to fix spurious errors: - Add seconds as expiration, otherwise 14m59 reports 14m in minute granularity, this ensures suficient time in a very slow environment with debugging instrumentation. - Provide expected output. - Update sed regular expression to make 'ms' optional and use -E mode. Fixes: adf38fd84257 ("tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mergesort: avoid cloning value in expr_msort_cmp()Thomas Haller2023-09-271-16/+15
| | | | | | | | If we have a plain EXPR_VALUE value, there is no need to copy it via mpz_set(). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in map statement keyPablo Neira Ayuso2023-09-2715-3/+204
| | | | | | | | | | | | | | | | | This fix is similar to 22d201010919 ("netlink_linearize: skip set element expression in set statement key") to fix map statement. netlink_gen_map_stmt() relies on the map key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. This includes JSON support to make this feature complete and it updates tests/shell to cover for this support. Reported-by: Luci Stanescu <luci@cnix.ro> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: expose dynamic flagPablo Neira Ayuso2023-09-272-0/+3
| | | | | | | | | | The dynamic flag is not exported via JSON, this triggers spurious ENOTSUPP errors when restoring rulesets in JSON with dynamic flags set on. Fixes: 6e45b102650a2 ("nft: set: print dynamic flag when set") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add map supportPablo Neira Ayuso2023-09-271-4/+66
| | | | | | | | | | Add basic map support to this infrastructure, eg. !map1 ipv4_addr : mark;ok Adding elements to map is still not supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: features: Fix table owner flag checkPhil Sutter2023-09-261-1/+1
| | | | | | | | | | | The keyword is "flags", not "flag". Resulted in a false-negative: features/table_flag_owner.nft:4:2-5: Error: syntax error, unexpected string flag owner; ^^^^ Fixes: 10373f0936cd3 ("tests: shell: skip flowtable-uaf if we lack table owner support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* expression: cleanup expr_ops_by_type() and handle u32 inputThomas Haller2023-09-253-14/+15
| | | | | | | | | | | | | | | | | | | | Make fewer assumptions about the underlying integer type of the enum. Instead, be clear about where we have an untrusted uint32_t from netlink and an enum. Rename expr_ops_by_type() to expr_ops_by_type_u32() to make this clearer. Later we might make the enum as packed, when this starts to matter more. Also, only the code path expr_ops() wants strict validation and assert against valid enum values. Move the assertion out of __expr_ops_by_type(). Then expr_ops_by_type_u32() does not need to duplicate the handling of EXPR_INVALID. We still need to duplicate the check against EXPR_MAX, to ensure that the uint32_t value can be cast to an enum value. [ Remove cast on EXPR_MAX. --pablo ] Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip flowtable-uaf if we lack table owner supportFlorian Westphal2023-09-222-0/+7
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: Default meter size to zeroPhil Sutter2023-09-221-1/+1
| | | | | | | | JSON parser was missed when performing the same change in standard syntax parser. Fixes: c2cad53ffc22a ("meters: do not set a defaut meter size from userspace") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Catch nonsense ops in match statementPhil Sutter2023-09-221-4/+9
| | | | | | | | Since expr_op_symbols array includes binary operators and more, simply checking the given string matches any of the elements is not sufficient. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Wrong check in json_parse_ct_timeout_policy()Phil Sutter2023-09-221-1/+1
| | | | | | | | | The conditional around json_unpack() was meant to accept a missing policy attribute. But the accidentally inverted check made the function either ignore a given policy or access uninitialized memory. Fixes: c82a26ebf7e9f ("json: Add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Fix synproxy object mss/wscale parsingPhil Sutter2023-09-221-3/+4
| | | | | | | | The fields are 16 and 8 bits in size, introduce temporary variables to parse into. Fixes: f44ab88b1088e ("src: add synproxy stateful object support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Fix limit object burst value parsingPhil Sutter2023-09-221-1/+1
| | | | | | | The field is of type uint32_t, use lower case 'i' format specifier. Fixes: c36288dbe2ba3 ("JSON: Fix parsing and printing of limit objects") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Fix flowtable prio value parsingPhil Sutter2023-09-221-1/+1
| | | | | | | | Using format specifier 'I' requires a 64bit variable to write into. The temporary variable 'prio' is of type int, though. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Proper ct expectation attribute parsingPhil Sutter2023-09-221-6/+7
| | | | | | | | | Parts of the code were unsafe (parsing 'I' format into uint32_t), the rest just plain wrong (parsing 'o' format into char *tmp). Introduce a temporary int variable to parse into. Fixes: 1dd08fcfa07a4 ("src: add ct expectations support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Fix typo in json_parse_cmd_add_object()Phil Sutter2023-09-221-1/+1
| | | | | | | | A case of bad c'n'p in the fixed commit broke ct timeout objects parsing. Fixes: c7a5401943df8 ("parser_json: Fix for ineffective family value checks") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Catch wrong "reset" payloadPhil Sutter2023-09-221-1/+8
| | | | | | | | | | | | The statement happily accepted any valid expression as payload and assumed it to be a tcpopt expression (actually, a special case of exthdr). Add a check to make sure this is the case. Standard syntax does not provide this flexibility, so no need to have the check there as well. Fixes: 5d837d270d5a8 ("src: add tcp option reset support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: add feature probe for sctp chunk matchingFlorian Westphal2023-09-212-10/+23
| | | | | | Skip the relavant parts of the test if nft_exthdr lacks sctp support. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add feature probe for sets with more than one elementFlorian Westphal2023-09-215-0/+23
| | | | | | | | | | Kernels < 5.11 can handle only one expression per element, e.g. its possible to attach a counter per key, or a rate limiter, or a quota, but not two at the same time. Add a probe file and skip the relevant tests if the feature is absent. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip adding catchall elements if unuspportedFlorian Westphal2023-09-211-2/+6
| | | | | | | | | | The test fails on kernels without catchall support, so elide this small part. No need to skip the test in this case, the dump file validates that the added elements are no longer there after the timeout. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: honor NFT_TEST_FAIL_ON_SKIP variable to fail on any skipped testsThomas Haller2023-09-211-1/+7
| | | | | | | | | | | | | | | | | | The test suite should pass with various kernels and build configurations. Of course, that means, that some tests will be gracefully skipped, and we don't treat that as an overall failure. However, it should be possible to run a specific kernel (net-next?) and build configuration, where we expect that all tests pass. Add an option to fail the run, if any tests were skipped. This is to ensure that we don't have broken tests that never pass. This will make more sense with automated CI is running, to enable on a test system and ensure that at least on that system, all tests pass. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: return const pointer from datatype_get()Thomas Haller2023-09-212-2/+2
| | | | | | | | | | | | "struct datatype" is for the most part immutable, and most callers deal with const pointers. That's why datatype_get() accepts a const pointer to increase the reference count (mutating the refcnt field). It should also return a const pointer. In fact, all callers are fine with that already. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: use enum icmp_hdr_field_type in payload_may_dependency_kill_icmp()Thomas Haller2023-09-201-6/+4
| | | | | | | Don't mix icmp_dep (enum icmp_hdr_field_type) and the uint8_t icmp_type. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: use "enum byteorder" instead of int in set_datatype_alloc()Thomas Haller2023-09-203-3/+3
| | | | | | | Use the enum types as we have them. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: handle invalid etype in set_make_key()Thomas Haller2023-09-201-0/+2
| | | | | | | | | It's not clear to me, what ensures that the etype is always valid. Handle a NULL. Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: fix missing definitions in <cache.h>/<headers.h>Thomas Haller2023-09-202-0/+11
| | | | | | | | | | | | | The headers should be self-contained so they can be included in any order. With exception of <nft.h>, which any internal header can rely on. Some fixes for <cache.h>/<headers.h>. In case of <cache.h>, forward declare some of the structs instead of including the headers. <headers.h> uses struct in6_addr. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: add missing proto_definitions for PROTO_DESC_GENEVEThomas Haller2023-09-201-1/+2
| | | | | | | | | | While at it, make proto_definitions const. For global variables, this allows the linker to mark the memory as read only. It's just good to do by default. Fixes: 156d22654003 ("src: add geneve matching support") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix indentation/whitespaceThomas Haller2023-09-201-2/+2
| | | | | Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>