summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add regression test for catchall double-deleteFlorian Westphal2024-02-182-0/+36
| | | | | | | | Test case for: b1db244ffd04 ("netfilter: nf_tables: check if catch-all set element is active in next generation") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: permit use of host-endian constant values in set lookup keysFlorian Westphal2024-02-143-0/+126
| | | | | | | | | | | extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching Fixes: c0080feb0d03 ("evaluate: permit use of host-endian constant values in set lookup keys") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: missing line in describe command with invalid expressionPablo Neira Ayuso2024-02-131-1/+3
| | | | | | | | | | | | | | | | Before: duh@testbed:~# nft describe blah symbol expression, datatype invalid (invalid)duh@testbed:# After: duh@testbed:~# nft describe blah symbol expression, datatype invalid (invalid) duh@testbed:# Fixes: 48aca2de80a7 ("iptopt: fix crash with invalid field/type combo") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: permit use of host-endian constant values in set lookup keysPablo Neira Ayuso2024-02-133-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AFL found following crash: table ip filter { map ipsec_in { typeof ipsec in reqid . iif : verdict flags interval } chain INPUT { type filter hook input priority filter; policy drop; ipsec in reqid . 100 @ipsec_in } } Which yields: nft: evaluate.c:1213: expr_evaluate_unary: Assertion `!expr_is_constant(arg)' failed. All existing test cases with constant values use big endian values, but "iif" expects host endian values. As raw values were not supported before, concat byteorder conversion doesn't handle constants. Fix this: 1. Add constant handling so that the number is converted in-place, without unary expression. 2. Add the inverse handling on delinearization for non-interval set types. When dissecting the concat data soup, watch for integer constants where the datatype indicates host endian integer. Last, extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching. Based on original patch from Florian Westphal, patch subject and description wrote by him. Fixes: b422b07ab2f9 ("src: permit use of constant values in set lookup keys") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: move concat and value postprocessing to helpersFlorian Westphal2024-02-131-35/+47
| | | | | | No functional changes intended. Signed-off-by: Florian Westphal <fw@strlen.de>
* cache: Always set NFT_CACHE_TERSE for list cmd with --tersePhil Sutter2024-02-131-7/+3
| | | | | | | | | | | | | | This fixes at least 'nft -t list table ...' and 'nft -t list set ...'. Note how --terse handling for 'list sets/maps' remains in place since setting NFT_CACHE_TERSE does not fully undo NFT_CACHE_SETELEM: setting both enables fetching of anonymous sets which is pointless for that command. Reported-by: anton.khazan@gmail.com Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1735 Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_linearize: add assertion to catch for buggy byteorderPablo Neira Ayuso2024-02-091-0/+2
| | | | | | | Add assertion to catch buggy bytecode where unary expression is present with 1-byte selectors, where no byteorder conversion is required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip byteorder conversion for selector smaller than 2 bytesPablo Neira Ayuso2024-02-095-5/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add unary expression to trigger byteorder conversion for host byteorder selectors only if selectors length is larger or equal than 2 bytes. # cat test.nft table ip x { set test { type ipv4_addr . ether_addr . inet_proto flags interval } chain y { ip saddr . ether saddr . meta l4proto @test counter } } # nft -f test.nft ip x y [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ payload load 4b @ network header + 12 => reg 1 ] [ payload load 6b @ link header + 6 => reg 9 ] [ meta load l4proto => reg 11 ] [ byteorder reg 11 = hton(reg 11, 2, 1) ] <--- should not be here [ lookup reg 1 set test ] [ counter pkts 0 bytes 0 ] Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: no longer support unprettified ".json-nft" filesThomas Haller2024-02-091-16/+3
| | | | | | | | | | By now, all ".json-nft" files are prettified and will be generated in that form. Drop the fallback code that accepts them in the previous form. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-08340-340/+41954
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: have .json-nft dumps prettified to wrap linesThomas Haller2024-02-082-15/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the .json-nft file in git contains the output of `nft -j list ruleset`. This is one long line and makes diffs harder to review. Instead, have the prettified .json-nft file committed to git. - the diff now operates on the prettified version. That means, it compares essentially - `nft -j list ruleset | json-sanitize-ruleset.sh | json-pretty.sh` - `cat "$TEST.json-nft" | json-pretty.sh` The script "json-diff-pretty.sh" is no longer used. It is kept however, because it might be a useful for manual comparing files. Note that "json-sanitize-ruleset.sh" and "json-pretty.sh" are still two separate scripts and called at different times. They also do something different. The former mangles the JSON to account for changes that are not stable (in the JSON data itself), while the latter only pretty prints it. - when generating a new .json-nft dump file, the file will be updated to use the new, prettified format, unless the file is in the old format and needs no update. This means, with DUMPGEN=y, old style is preserved unless an update becomes necessary. This requires "json-pretty.sh" having stable output, as those files are committed to git. This is probably fine. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: missing auto-merge in json outputPablo Neira Ayuso2024-02-073-3/+3
| | | | | | | | | Several tests reports DUMP_FAILED because it was missing the auto-merge flag. That is, the original json dump was not correct. Update tests accordingly now that json support provides an automerge flag. Fixes: a4034c66b03e ("json: Support sets' auto-merge option") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: Optimize caching for 'list tables' commandPhil Sutter2024-02-071-1/+5
| | | | | | | | | | | | | | No point in fetching anything other than existing tables from kernel: 'list tables' merely prints existing table names, no contents. Also populate filter's family field to reduce overhead when listing tables in one family with many tables in another one. It works without further adjustments because nftnl_nlmsg_build_hdr() will use the value for nfgen_family. Reported-by: anton.khazan@gmail.com Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1735 Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile.am: don't silence -Wimplicit-function-declarationSam James2024-02-071-1/+0
| | | | | | | | | | | | | This becomes an error in GCC 14 and Clang 16. It's a common misconception that these warnings are invalid or simply noise for Bison/parser files, but even if that were true, we'd need to handle it somehow anyway. Silencing them does nothing, so stop doing that. Further, I don't actually get any warnings to fix with bison-3.8.2. This mirrors changes we've done in other netfilter.org projects. Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: fix check for unknown in cmd_op_to_name谢致邦 (XIE Zhibang)2024-02-071-1/+1
| | | | | | | | | | | | | | | Example: nft --debug=all destroy table ip missingtable Before: Evaluate unknown After: Evaluate destroy Fixes: e1dfd5cc4c46 ("src: add support to command "destroy"") Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: don't assert on net/transport header conflictFlorian Westphal2024-02-072-36/+38
| | | | | | | | | | | | | | | | | | | | | | before: nft: evaluate.c:467: conflict_resolution_gen_dependency: Assertion `expr->payload.base == PROTO_BASE_LL_HDR' failed. Aborted (core dumped) conflict_resolution_gen_dependency() can only handle linklayer conflicts, hence the assert. Rename it accordingly. Also rename resolve_protocol_conflict, it doesn't do anything for != PROTO_BASE_LL_HDR and extend the assertion to that function too. Callers now enforce PROTO_BASE_LL_HDR prerequisite. after: Error: conflicting transport layer protocols specified: comp vs. udp ip6 nexthdr comp udp dport 4789 ^^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: display 0s time datatypePablo Neira Ayuso2024-02-071-5/+19
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover netns removal for netdev and inet/ingress basechainsPablo Neira Ayuso2024-02-074-0/+78
| | | | | | | Add two tests to exercise netns removal with netdev and inet/ingress basechains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: netdevice removal for inet familyPablo Neira Ayuso2024-02-072-6/+20
| | | | | | cover netdevice removal when such netdevice belongs to basechain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support sets' auto-merge optionPhil Sutter2024-01-313-2/+9
| | | | | | | | If enabled, list the option as additional attribute with boolean value. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1734 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: add test to cover ct offload by using nft flowtablesYi Chen2024-01-231-0/+96
| | | | | | | To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove huge-limit test casesFlorian Westphal2024-01-194-100/+0
| | | | | | | These tests will fail once the kernel checks for overflow in the internal token bucken counter, so drop them. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix sym refcount assertionFlorian Westphal2024-01-152-1/+8
| | | | | | | | | | | | Scope release must happen last. afl provided a reproducer where policy is a define, because scope is released too early we get: nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed. ... because chain->policy is EXPR_SYMBOL. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: error out when store needs more than one 128bit register of align ↵Florian Westphal2024-01-152-0/+6
| | | | | | | | | | | | | | | | | | | | | fixup Else this gives: nft: evaluate.c:2983: stmt_evaluate_payload: Assertion `sizeof(data) * BITS_PER_BYTE >= masklen' failed. For loads, this is already prevented via expr_evaluate_bits() which has: if (masklen > NFT_REG_SIZE * BITS_PER_BYTE) return expr_error(ctx->msgs, expr, "mask length %u exceeds allowed maximum of %u\n", masklen, NFT_REG_SIZE * BITS_PER_BYTE); But for the store path this isn't called. The reproducer asks to store a 128 bit integer at bit offset 1, i.e. 17 bytes would need to be munged, but we can only handle up to 16 bytes (one pseudo-register). Fixes: 78936d50f306 ("evaluate: add support to set IPv6 non-byte header fields") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject raw payload expressions with 0 lengthFlorian Westphal2024-01-123-5/+32
| | | | | | | | Reject this at parser stage. Fix up the json input side too, else reproducer gives: nft: src/netlink.c:243: netlink_gen_raw_data: Assertion `len > 0' failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: only assert if l2 header base has no lengthFlorian Westphal2024-01-122-2/+2
| | | | | | | | | | nftables will assert in some cases because the sanity check is done even for network and transport header bases. However, stacked headers are only supported for the link layer. Move the assertion around and add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: release mpz type in expr_evaluate_list() error pathPablo Neira Ayuso2024-01-121-3/+9
| | | | | | | | | | | | | | Detected when running: # nft -f tests/shell/testcases/bogons/nft-f/no_integer_basetype_crash ==383222==ERROR: LeakSanitizer: detected memory leaks Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7fe7b54a9e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7fe7b538b9a9 in __gmp_default_allocate (/lib/x86_64-linux-gnu/libgmp.so.10+0xc9a9) Fixes: 3671c4897003 ("evaluate: guard against NULL basetype") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: release key expression in error path of implicit map with unknown ↵Pablo Neira Ayuso2024-01-121-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | datatype Detected when running: # nft -f tests/shell/testcases/bogons/nft-f/mapping_with_invalid_datatype_crash ==382584==ERROR: LeakSanitizer: detected memory leaks Direct leak of 144 byte(s) in 1 object(s) allocated from: #0 0x7fde06ca9e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x7fde062924af in xmalloc src/utils.c:31 #2 0x7fde0629266c in xzalloc src/utils.c:70 #3 0x7fde06167299 in expr_alloc src/expression.c:46 #4 0x7fde0616b014 in constant_expr_alloc src/expression.c:420 #5 0x7fde06128e43 in expr_evaluate_map src/evaluate.c:2027 #6 0x7fde06137b06 in expr_evaluate src/evaluate.c:2891 #7 0x7fde06132417 in expr_evaluate_relational src/evaluate.c:2497 #8 0x7fde06137b36 in expr_evaluate src/evaluate.c:2895 #9 0x7fde06137d5f in stmt_evaluate_expr src/evaluate.c:2914 #10 0x7fde061524c8 in stmt_evaluate src/evaluate.c:4646 #11 0x7fde0615c9ee in rule_evaluate src/evaluate.c:5202 #12 0x7fde061600c7 in cmd_evaluate_add src/evaluate.c:5422 Fixes: 70054e6e1c87 ("evaluate: catch implicit map expressions without known datatype") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bail out if anonymous concat set defines a non concat expressionPablo Neira Ayuso2024-01-124-2/+46
| | | | | | | | | | | | | Iterate over the element list in the anonymous set to validate that all expressions are concatenations, otherwise bail out. ruleset.nft:3:46-53: Error: expression is not a concatenation ip protocol . th dport vmap { tcp / 22 : accept, tcp . 80 : drop} ^^^^^^^^ This is based on a patch from Florian Westphal. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not fetch next expression on runaway number of concatenation ↵Pablo Neira Ayuso2024-01-121-2/+2
| | | | | | | | | | | | | | components If this is the last expression, then the runaway flag is set on and evaluation bails in the next iteration, do not fetch next list element which refers to the list head. I found this by code inspection, I could not trigger any crash with this one. Fixes: ae1d54d1343f ("evaluate: do not crash on runaway number of concatenation components") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip anonymous set optimization for concatenationsPablo Neira Ayuso2024-01-121-9/+11
| | | | | | | | | Concatenation is only supported with sets. Moreover, stripping of the set leads to broken ruleset listing, therefore, skip this optimization for the concatenations. Fixes: fa17b17ea74a ("evaluate: revisit anonymous set with single element optimization") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add missing range checks for dup,fwd and payload statementsFlorian Westphal2024-01-113-41/+69
| | | | | | | | | | Else we assert with: BUG: unknown expression type range nft: src/netlink_linearize.c:912: netlink_gen_expr: Assertion `0' failed. While at it, condense meta and exthdr to reuse the same helper. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: tproxy: move range error checks after arg evaluationFlorian Westphal2024-01-112-6/+14
| | | | | | | | | | Testing for range before evaluation will still crash us later during netlink linearization, prefixes turn into ranges, symbolic expression might hide a range/prefix. So move this after the argument has been evaluated. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: error out when expression has no datatypeFlorian Westphal2024-01-111-0/+5
| | | | | | | | | | | | | | | | | | add rule ip6 f i rt2 addr . ip6 daddr { dead:: . dead:: } ... will cause a segmentation fault, we assume expr->dtype is always set. rt2 support is incomplete, the template is uninitialised. This could be fixed up, but rt2 (a subset of the deperecated type 0), like all other routing headers, lacks correct dependency tracking. Currently such routing headers are always assumed to be segment routing headers, we would need to add dependency on 'Routing Type' field in the routing header, similar to icmp type/code. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: clarify reject is supported at prerouting stageQuan Tian2024-01-101-1/+1
| | | | | | | | | It's supported since kernel commit f53b9b0bdc59 ("netfilter: introduce support for reject at prerouting stage"). Reported-by: Dan Winship <danwinship@redhat.com> Signed-off-by: Quan Tian <tianquan23@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: incorrect datatype description for icmpv6_type and icmpvx_codePablo Neira Ayuso2024-01-101-2/+2
| | | | | | | | | Fix incorrect description in manpage: ICMPV6 TYPE TYPE is icmpv6_type ICMPVX CODE TYPE is icmpx_code Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: extend coverage for netdevice removalPablo Neira Ayuso2024-01-104-0/+59
| | | | | | Add two extra tests to exercise netdevice removal path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a test case for double-flush bug in pipapoFlorian Westphal2024-01-082-0/+34
| | | | | | | | Test for 'netfilter: nft_set_pipapo: skip inactive elements during set walk'. Reported-by: Xingyuan Mo <hdthky0@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: do not assert when value exceeds expected widthFlorian Westphal2024-01-081-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Inputs: ip protocol . th dport { tcp / 22, }' or th dport . ip protocol { tcp / 22, }' are not rejected at this time. 'list ruleset' yields: ip protocol & nft: src/gmputil.c:77: mpz_get_uint8: Assertion `cnt <= 1' failed. or th dport & nft: src/gmputil.c:87: mpz_get_be16: Assertion `cnt <= 1' failed. While this should be caught at input too, the print path should be more robust, e.g. when there are direct nfnetlink users. After this patch, the print functions fall back to 'integer_type_print' which can handle large numbers too. Note that the output printed this way cannot be read back by nft; it will dump something like: tcp dport & 18446739675663040512 . ip protocol 0 . 0 but thats better than assert(). v2: same problem exists for service too. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: prefer project nft to system-wide nftFlorian Westphal2024-01-072-20/+20
| | | | | | | | Use $NFT (src/nft, in-tree binary), not the one installed by the distro. Else we may not find newly added bugs unless user did "make install" or bug has propagated to release. Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: Describe rt symbol tablesPhil Sutter2024-01-025-0/+58
| | | | | | | | | | | | | Implement a symbol_table_print() wrapper for the run-time populated rt_symbol_tables which formats output similar to expr_describe() and includes the data source. Since these tables reside in struct output_ctx there is no implicit connection between data type and therefore providing callbacks for relevant datat types which feed the data into said wrapper is a simpler solution than extending expr_describe() itself. Signed-off-by: Phil Sutter <phil@nwl.cc>
* datatype: Initialize rt_symbol_tables' base fieldPhil Sutter2024-01-021-4/+8
| | | | | | | | | It is unconditionally accessed in symbol_table_print() so make sure it is initialized to either BASE_DECIMAL (arbitrary) for empty or non-existent source files or a proper value depending on entry number format. Signed-off-by: Phil Sutter <phil@nwl.cc>
* datatype: rt_symbol_table_init() to search for iproute2 configsPhil Sutter2024-01-023-6/+36
| | | | | | | | | | | | | | | | | | | There is an ongoing effort among various distributions to tidy up in /etc. The idea is to reduce contents to just what the admin manually inserted to customize the system, anything else shall move out to /usr (or so). The various files in /etc/iproute2 fall in that category as they are seldomly modified. The crux is though that iproute2 project seems not quite sure yet where the files should go. While v6.6.0 installs them into /usr/lib/iproute2, current mast^Wmain branch uses /usr/share/iproute2. Assume this is going to stay as /(usr/)lib does not seem right for such files. Note that rt_symbol_table_init() is not just used for iproute2-maintained configs but also for connlabel.conf - so retain the old behaviour when passed an absolute path. Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_bison: ensure all timeout policy names are releasedFlorian Westphal2023-12-222-5/+34
| | | | | | | | | | | | | | | | | | | We need to add a custom destructor for this structure, it contains the dynamically allocated names. a:5:55-55: Error: syntax error, unexpected '}', expecting string policy = { estabQisheestablished : 2m3s, cd : 2m3s, } ==562373==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 160 byte(s) in 2 object(s) allocated from: #1 0x5a565b in xmalloc src/utils.c:31:8 #2 0x5a565b in xzalloc src/utils.c:70:8 #3 0x3d9352 in nft_parse_bison_filename src/libnftables.c:520:8 [..] Fixes: c7c94802679c ("src: add ct timeout support") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: do not allow to chain more than 16 binopsFlorian Westphal2023-12-225-5/+53
| | | | | | | | | | | | | | | | | | | | | netlink_linearize.c has never supported more than 16 chained binops. Adding more is possible but overwrites the stack in netlink_gen_bitwise(). Add a recursion counter to catch this at eval stage. Its not enough to just abort once the counter hits NFT_MAX_EXPR_RECURSION. This is because there are valid test cases that exceed this. For example, evaluation of 1 | 2 will merge the constans, so even if there are a dozen recursive eval calls this will not end up with large binop chain post-evaluation. v2: allow more than 16 binops iff the evaluation function did constant-merging. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: fix stack overflow due to erroneous roundingFlorian Westphal2023-12-202-3/+14
| | | | | | | Byteorder switch in this function may undersize the conversion buffer by one byte, this needs to use div_round_up(). Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: don't crash if object map does not refer to a valueFlorian Westphal2023-12-202-0/+11
| | | | | | | | | | | Before: BUG: Value export of 512 bytes would overflownft: src/netlink.c:474: netlink_gen_prefix: Assertion `0' failed. After: 66: Error: Object mapping data should be a value, not prefix synproxy name ip saddr map { 192.168.1.0/24 : "v*" } Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: error out on duplicated type/typeof/element keywordsFlorian Westphal2023-12-191-2/+36
| | | | | | | | | | | Otherwise nft will leak the previous definition (expressions). Also remove the nonsensical datatype_set($1->key, $3->dtype); This is a no-op, at this point: $1->key and $3 are identical. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test to cover payload transport match and manglePablo Neira Ayuso2023-12-192-0/+180
| | | | | | | | | | Exercise payload transport match and mangle for inet, bridge and netdev families with IPv4 and IPv6 packets. To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* intervals: BUG on prefix expressions without valueFlorian Westphal2023-12-191-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Its possible to end up with prefix expressions that have a symbolic expression, e.g.: table t { set s { type inet_service flags interval elements = { 172.16.0.0/16 } } set s { type inet_service flags interval elements = { 0-1024, 8080-8082, 10000-40000 } } } Without this change, nft will crash. We end up in setelem_expr_to_range() with prefix "/16" for the symbolic expression "172.16.0.0". We than pass invalid mpz_t pointer into libgmp. This isn't a real fix, but instead of blindly assuming that the attached expression has a gmp value die with at least some info. Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-13 17:29:06 +0000