summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: Add missing json-nft dumpsPhil Sutter2024-03-1913-0/+1808
| | | | | | | | | Given that a bunch of issues got fixed, add some more dumps. Also add tests/shell/testcases/owner/dumps/0002-persist.nft while at it, even though it's really small. Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser: json: Support for synproxy objectsPhil Sutter2024-03-191-6/+11
| | | | | | | | | | Parsing code was there already, merely the entry in json_parse_cmd_add() missing. To support maps with synproxy target, an entry in string_to_nft_object() is required. While being at it, add other missing entries as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Support maps with concatenated dataPhil Sutter2024-03-192-14/+14
| | | | | | | Dump such maps with an array of types in "map" property, make the parser aware of this. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-1960-647/+647
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Order output like nft_cmd_expand()Phil Sutter2024-03-191-3/+5
| | | | | | | | Print empty chain add commands early in list so following verdict maps and rules referring to them won't cause spurious errors when loading the resulting ruleset dump. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: packetpath/flowtables: Avoid spurious EPERMPhil Sutter2024-03-191-3/+3
| | | | | | | | | On my system for testing, called socat is not allowed to create the pipe file in local directory (probably due to sshfs). Specify a likely unique path in /tmp to avoid such problems. Fixes: 419c0199774c6 ("tests: shell: add test to cover ct offload by using nft flowtables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: move meter tests to tests/shellPablo Neira Ayuso2024-03-1310-182/+250
| | | | | | | | | Userspace performs an translation to dynamic set which does not fit well into tests/py, move them to tests/shell. Fixes: b8f8ddfff733 ("evaluate: translate meter into dynamic set") Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove utf-8 character in printf linesFlorian Westphal2024-03-132-13/+13
| | | | | | replace "‘" (UTF-8, 0xe280 0x98) with "'" (ASCII 0x27). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add payload merging test casesFlorian Westphal2024-03-133-0/+291
| | | | | | Add a test case that would fail without preceeding fix. Signed-off-by: Florian Westphal <fw@strlen.de>
* nftables: do mot merge payloads on negationSriram Rajagopalan2024-03-131-1/+0
| | | | | | | | | | | else, a rule like tcp sport != 22 tcp dport != 23 will match even if the destination is 23 as long as sport is != 22. (or vice versa). Signed-off-by: Sriram Rajagopalan <sriramr@arista.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: translate meter into dynamic setPablo Neira Ayuso2024-03-129-34/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 129f9d153279 ("nft: migrate man page examples with `meter` directive to sets") already replaced meters by dynamic sets. This patch removes NFT_SET_ANONYMOUS flag from the implicit set that is instantiated via meter, so the listing shows a dynamic set instead which is the recommended approach these days. Therefore, a batch like this: add table t add chain t c add rule t c tcp dport 80 meter m size 128 { ip saddr timeout 1s limit rate 10/second } gets translated to a dynamic set: table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } chain c { tcp dport 80 update @m { ip saddr timeout 1s limit rate 10/second burst 5 packets } } } Check for NFT_SET_ANONYMOUS flag is also relaxed for list and flush meter commands: # nft list meter ip t m table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } } # nft flush meter ip t m As a side effect the legacy 'list meter' and 'flush meter' commands allow to flush a dynamic set to retain backward compatibility. This patch updates testcases/sets/0022type_selective_flush_0 and testcases/sets/0038meter_list_0 as well as the json output which now uses the dynamic set representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile: mkdir $(builddir}/docNeels Hofmeyr2024-03-081-0/+1
| | | | | | | | | When building separately from the source tree (as in ../src/configure), the 'doc' dir is not present from just the source tree. Create the dir before calling a2x. Signed-off-by: Neels Hofmeyr <nhofmeyr@sysmocom.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: add test case for named ct objectsFlorian Westphal2024-03-052-0/+165
| | | | | | | | | | Add a dedicated test for named conntrack objects: timeouts, helpers and expectations. A json dump file is not added because the json input code does not support "typeof" declarations for sets/maps. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: allow to define maps that contain ct helpersFlorian Westphal2024-03-051-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Its currently not possible to use ct helpers in objref maps. Simply adding "CT HELPER" to "map_block_obj_type" does not work due to a conflict with the "ct helper" ct_expr block. map m { type ipv4_addr : ct helper .. ... declares a map storing ip addresses and conntrack helper names (string type). This does not make sense, there is no way to use the associated value (the names) in any sensible way: ct helper "ftp" - this matches if the packet has a conntrack entry that was accepted via the "ftp" conntrack helper. In nft vm terms, this is translated to: [ ct load helper => reg 1 ] [ cmp eq reg 1 0x00707466 0x00000000 0x00000000 0x00000000 ] Or one can query a set, e.g. 'ct helper { "ftp", "sip" }'. "ftp" and "sip" are the kernel-defined names of these connection tracking helpers. ct helper set "ftp" is something else, however: This is used to assign a *userspace defined helper objrect reference*. Nftables will translate this to: [ objref type 3 name ftp ] .. where "ftp" is a arbitrary user-chosen name. ct helper "ftp" { type "ftp" protocol tcp l3proto ip } IOW, "ct helper" is ambiguous. Without the "set" keyword (first case), it places the kernel-defined name of the active connection tracking helper in the chosen register (or it will cancel rule evaluation if no helper was active). With the set keyword (second case), the expected argument is a user-defined object reference which will then tell the connection tracking engine to monitor all further packets of the new flow with the given helper template. This change makes it so that map m { type ipv4_addr : ct helper .. declares a map storing ct helper object references suitable for 'ct helper set'. The better alternative would be to resolve the ambiguity by adding an additional postfix keyword, for example ct helper name (case one) ct helper object (case two). But this needs a kernel change that adds NFT_CT_HELPER_NAME and NFT_CT_HELPER_OBJECT to enum nft_ct_keys. While a new kernel could handle old nftables binaries that still use NFT_CT_HELPER key, new nftables would need to probe support first. Furthermore, ct helper name set "foo" ... would make no sense, as the kernel-defined helper names are readonly. ct helper object "foo" ... would make no sense, unless we extend the kernel to store the nftables userspace-defined name in a well-known location in the kernel. Userdata area cannot work for this, because the nft conntrack expression in the kernel would need to know how to retrieve this info again. Also, I cannot think of a sensible use case for this. So the only remaining, useful commands are: ct helper name "ftp" ct helper object set "foo" ... which is identical to what we already support, just with extra keyword. So a much simpler solution that does not need any kernel changes is make "ct helper" have different meaning depending on wheter it is placed on the key side, i.e.: "typeof ct helper", "typeof ct helper : $value" versus when its on placed on the data (value) side of maps: "typeof $key : ct helper". Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: allow to define maps that contain timeouts and expectationsFlorian Westphal2024-03-051-3/+11
| | | | | | | | | | | | | | Its currently not possible to use ct timeouts/expectations/helpers in objref maps, bison parser lacks the relevant keywords. This change adds support for timeouts and expectations. Ct helpers are more problematic, this will come in a different change. Support is only added for the "typeof" keyword, otherwise we'd need to add pseudo-datatypes as well, but making "ct expectation" available as "type" as well might be confusing. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix ASAN errors in chain priority to textual namesPablo Neira Ayuso2024-03-051-6/+9
| | | | | | | | | | | | | | | | | | | | | ASAN reports several errors when listing this ruleset: table ip x { chain y { type filter hook input priority -2147483648; policy accept; } } src/rule.c:1002:8: runtime error: negation of -2147483648 cannot be represented in type 'int'; cast to an unsigned type to negate this value to itself src/rule.c:1001:11: runtime error: signed integer overflow: -2147483648 - 50 cannot be represented in type 'int' Use int64_t for the offset to avoid an underflow when calculating closest existing priority definition. Use llabs() because abs() is undefined with INT32_MIN. Fixes: c8a0e8c90e2d ("src: Set/print standard chain prios with textual names") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: move test case to "maps" directoryFlorian Westphal2024-03-012-0/+0
| | | | | | | This tests named object maps, so this should reside in maps/ not sets/ directory. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: maps: add a test case for "limit" objref mapFlorian Westphal2024-03-013-0/+442
| | | | | | | | | check add, delete and removal operations for objref maps. Also check type vs. typeof declarations and use both interval and interval+concatenation (rbtree, pipapo). Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: allow typeof keywords with objref maps during listingFlorian Westphal2024-03-011-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without this, typeof meta l4proto . ip saddr . tcp sport : limit ... is shown as type inet_proto . ipv4_addr . inet_service : limit The "data" element is a value (the object type number). It doesn't support userinfo data. There is no reason to add it, the value is the object type number that the object-reference map stores. So, if we have an objref map, DO NOT discard the key part, as we do for normal maps. For normal maps, we support either typeof notation, i.e.: typeof meta l4proto . ip saddr . tcp sport : ip saddr or the data type version: type inet_proto . ipv4_addr . inet_service : ipv4_addr ... but not a mix, a hyptothetical typeof meta l4proto . ip saddr . tcp sport : ipv4_addr ... does not work. If nft finds no udata attached to the data element, for normal map case, it has to fall back to the "type" form. But for objref maps this is expected, udata for key but not for data. Hence, for objref case, keep the typeof part if its valid. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: allow typeof in objref mapsFlorian Westphal2024-03-011-0/+9
| | | | | | | | | | | | | | | | | | Its currently not possible to declare a map that stores object references with the "typeof" keyword, e.g. map m { type ipv4_addr : limit will work, but map m { typeof ip saddr : limit will give a syntax error ("unexpected limit"). Followup pach will add support for listing side too. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: compact type/typeof set rulesFlorian Westphal2024-03-011-15/+9
| | | | | | | | | | | Set/maps keys can be declared either by 'type' or 'typeof' keyword. Compact this to use a common block for both cases. The datatype_set call is redundant, remove it: at this point $3 == $1->key, so this is a no-op. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: compact interval typeof rulesFlorian Westphal2024-03-011-20/+14
| | | | | | | | | There are two nearly identical blocks for typeof maps: one with INTERVAL keyword present and one without. Compact this into a single block. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: improve error reporting for destroy command谢致邦 (XIE Zhibang)2024-02-281-0/+6
| | | | | | | | | | | | | | | | Example for older kernels (<6.3): nft destroy table ip missingtable Before: Error: Could not process rule: Invalid argument After: Error: "destroy" command is not supported, perhaps kernel support is missing? Fixes: e1dfd5cc4c46 ("src: add support to command "destroy"") Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: allow 0 offsets againFlorian Westphal2024-02-261-1/+1
| | | | | | | | | | | | | | | | | Its valid in case of tcp option removal: [ { "reset": { "tcp option": { "base": 123, "len": 0, "offset": 0 } This makes nft-test.py -j pass again. Fixes: e08627257ecf ("parser: reject raw payload expressions with 0 length") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add more json dumpsFlorian Westphal2024-02-2610-0/+2551
| | | | | | | | | | | | Those are expected to be stable, so add them. Some are not 100% correct, as "typeof" is misprinted as "type" (json output and input parser lack support for this), but for these files the "type" is valid too. This will allow better validation once proper "typeof" support is added to json.c and json-parser.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add missing json.output dataFlorian Westphal2024-02-261-0/+31
| | | | | | | Fixes: bridge/vlan.t: WARNING: line 56: ... Fixes: 8b9ae77598b4 ("tests: never merge across non-expression statements redux 2") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add regression test for catchall double-deleteFlorian Westphal2024-02-182-0/+36
| | | | | | | | Test case for: b1db244ffd04 ("netfilter: nf_tables: check if catch-all set element is active in next generation") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: permit use of host-endian constant values in set lookup keysFlorian Westphal2024-02-143-0/+126
| | | | | | | | | | | extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching Fixes: c0080feb0d03 ("evaluate: permit use of host-endian constant values in set lookup keys") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: missing line in describe command with invalid expressionPablo Neira Ayuso2024-02-131-1/+3
| | | | | | | | | | | | | | | | Before: duh@testbed:~# nft describe blah symbol expression, datatype invalid (invalid)duh@testbed:# After: duh@testbed:~# nft describe blah symbol expression, datatype invalid (invalid) duh@testbed:# Fixes: 48aca2de80a7 ("iptopt: fix crash with invalid field/type combo") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: permit use of host-endian constant values in set lookup keysPablo Neira Ayuso2024-02-133-7/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | AFL found following crash: table ip filter { map ipsec_in { typeof ipsec in reqid . iif : verdict flags interval } chain INPUT { type filter hook input priority filter; policy drop; ipsec in reqid . 100 @ipsec_in } } Which yields: nft: evaluate.c:1213: expr_evaluate_unary: Assertion `!expr_is_constant(arg)' failed. All existing test cases with constant values use big endian values, but "iif" expects host endian values. As raw values were not supported before, concat byteorder conversion doesn't handle constants. Fix this: 1. Add constant handling so that the number is converted in-place, without unary expression. 2. Add the inverse handling on delinearization for non-interval set types. When dissecting the concat data soup, watch for integer constants where the datatype indicates host endian integer. Last, extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching. Based on original patch from Florian Westphal, patch subject and description wrote by him. Fixes: b422b07ab2f9 ("src: permit use of constant values in set lookup keys") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: move concat and value postprocessing to helpersFlorian Westphal2024-02-131-35/+47
| | | | | | No functional changes intended. Signed-off-by: Florian Westphal <fw@strlen.de>
* cache: Always set NFT_CACHE_TERSE for list cmd with --tersePhil Sutter2024-02-131-7/+3
| | | | | | | | | | | | | | This fixes at least 'nft -t list table ...' and 'nft -t list set ...'. Note how --terse handling for 'list sets/maps' remains in place since setting NFT_CACHE_TERSE does not fully undo NFT_CACHE_SETELEM: setting both enables fetching of anonymous sets which is pointless for that command. Reported-by: anton.khazan@gmail.com Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1735 Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_linearize: add assertion to catch for buggy byteorderPablo Neira Ayuso2024-02-091-0/+2
| | | | | | | Add assertion to catch buggy bytecode where unary expression is present with 1-byte selectors, where no byteorder conversion is required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip byteorder conversion for selector smaller than 2 bytesPablo Neira Ayuso2024-02-095-5/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add unary expression to trigger byteorder conversion for host byteorder selectors only if selectors length is larger or equal than 2 bytes. # cat test.nft table ip x { set test { type ipv4_addr . ether_addr . inet_proto flags interval } chain y { ip saddr . ether saddr . meta l4proto @test counter } } # nft -f test.nft ip x y [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ payload load 4b @ network header + 12 => reg 1 ] [ payload load 6b @ link header + 6 => reg 9 ] [ meta load l4proto => reg 11 ] [ byteorder reg 11 = hton(reg 11, 2, 1) ] <--- should not be here [ lookup reg 1 set test ] [ counter pkts 0 bytes 0 ] Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: no longer support unprettified ".json-nft" filesThomas Haller2024-02-091-16/+3
| | | | | | | | | | By now, all ".json-nft" files are prettified and will be generated in that form. Drop the fallback code that accepts them in the previous form. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-08340-340/+41954
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: have .json-nft dumps prettified to wrap linesThomas Haller2024-02-082-15/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the .json-nft file in git contains the output of `nft -j list ruleset`. This is one long line and makes diffs harder to review. Instead, have the prettified .json-nft file committed to git. - the diff now operates on the prettified version. That means, it compares essentially - `nft -j list ruleset | json-sanitize-ruleset.sh | json-pretty.sh` - `cat "$TEST.json-nft" | json-pretty.sh` The script "json-diff-pretty.sh" is no longer used. It is kept however, because it might be a useful for manual comparing files. Note that "json-sanitize-ruleset.sh" and "json-pretty.sh" are still two separate scripts and called at different times. They also do something different. The former mangles the JSON to account for changes that are not stable (in the JSON data itself), while the latter only pretty prints it. - when generating a new .json-nft dump file, the file will be updated to use the new, prettified format, unless the file is in the old format and needs no update. This means, with DUMPGEN=y, old style is preserved unless an update becomes necessary. This requires "json-pretty.sh" having stable output, as those files are committed to git. This is probably fine. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: missing auto-merge in json outputPablo Neira Ayuso2024-02-073-3/+3
| | | | | | | | | Several tests reports DUMP_FAILED because it was missing the auto-merge flag. That is, the original json dump was not correct. Update tests accordingly now that json support provides an automerge flag. Fixes: a4034c66b03e ("json: Support sets' auto-merge option") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: Optimize caching for 'list tables' commandPhil Sutter2024-02-071-1/+5
| | | | | | | | | | | | | | No point in fetching anything other than existing tables from kernel: 'list tables' merely prints existing table names, no contents. Also populate filter's family field to reduce overhead when listing tables in one family with many tables in another one. It works without further adjustments because nftnl_nlmsg_build_hdr() will use the value for nfgen_family. Reported-by: anton.khazan@gmail.com Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1735 Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile.am: don't silence -Wimplicit-function-declarationSam James2024-02-071-1/+0
| | | | | | | | | | | | | This becomes an error in GCC 14 and Clang 16. It's a common misconception that these warnings are invalid or simply noise for Bison/parser files, but even if that were true, we'd need to handle it somehow anyway. Silencing them does nothing, so stop doing that. Further, I don't actually get any warnings to fix with bison-3.8.2. This mirrors changes we've done in other netfilter.org projects. Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: fix check for unknown in cmd_op_to_name谢致邦 (XIE Zhibang)2024-02-071-1/+1
| | | | | | | | | | | | | | | Example: nft --debug=all destroy table ip missingtable Before: Evaluate unknown After: Evaluate destroy Fixes: e1dfd5cc4c46 ("src: add support to command "destroy"") Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: don't assert on net/transport header conflictFlorian Westphal2024-02-072-36/+38
| | | | | | | | | | | | | | | | | | | | | | before: nft: evaluate.c:467: conflict_resolution_gen_dependency: Assertion `expr->payload.base == PROTO_BASE_LL_HDR' failed. Aborted (core dumped) conflict_resolution_gen_dependency() can only handle linklayer conflicts, hence the assert. Rename it accordingly. Also rename resolve_protocol_conflict, it doesn't do anything for != PROTO_BASE_LL_HDR and extend the assertion to that function too. Callers now enforce PROTO_BASE_LL_HDR prerequisite. after: Error: conflicting transport layer protocols specified: comp vs. udp ip6 nexthdr comp udp dport 4789 ^^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: display 0s time datatypePablo Neira Ayuso2024-02-071-5/+19
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover netns removal for netdev and inet/ingress basechainsPablo Neira Ayuso2024-02-074-0/+78
| | | | | | | Add two tests to exercise netns removal with netdev and inet/ingress basechains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: netdevice removal for inet familyPablo Neira Ayuso2024-02-072-6/+20
| | | | | | cover netdevice removal when such netdevice belongs to basechain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support sets' auto-merge optionPhil Sutter2024-01-313-2/+9
| | | | | | | | If enabled, list the option as additional attribute with boolean value. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1734 Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: add test to cover ct offload by using nft flowtablesYi Chen2024-01-231-0/+96
| | | | | | | To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove huge-limit test casesFlorian Westphal2024-01-194-100/+0
| | | | | | | These tests will fail once the kernel checks for overflow in the internal token bucken counter, so drop them. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix sym refcount assertionFlorian Westphal2024-01-152-1/+8
| | | | | | | | | | | | Scope release must happen last. afl provided a reproducer where policy is a define, because scope is released too early we get: nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed. ... because chain->policy is EXPR_SYMBOL. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: error out when store needs more than one 128bit register of align ↵Florian Westphal2024-01-152-0/+6
| | | | | | | | | | | | | | | | | | | | | fixup Else this gives: nft: evaluate.c:2983: stmt_evaluate_payload: Assertion `sizeof(data) * BITS_PER_BYTE >= masklen' failed. For loads, this is already prevented via expr_evaluate_bits() which has: if (masklen > NFT_REG_SIZE * BITS_PER_BYTE) return expr_error(ctx->msgs, expr, "mask length %u exceeds allowed maximum of %u\n", masklen, NFT_REG_SIZE * BITS_PER_BYTE); But for the store path this isn't called. The reproducer asks to store a 128 bit integer at bit offset 1, i.e. 17 bytes would need to be munged, but we can only handle up to 16 bytes (one pseudo-register). Fixes: 78936d50f306 ("evaluate: add support to set IPv6 non-byte header fields") Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 19:44:00 +0000