summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* parser_bison: missing initialization of ct timeout policy listPablo Neira Ayuso2021-07-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | rule.c:1715:3: runtime error: member access within null pointer of type 'struct timeout_state' AddressSanitizer:DEADLYSIGNAL ================================================================= ==29500==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5bfd43c2a4 bp 0x7ffcb82f13b0 sp 0x7ffcb82f1360 T0) ==29500==The signal is caused by a READ memory access. ==29500==Hint: address points to the zero page. #0 0x7f5bfd43c2a3 in obj_free /home/test/nftables/src/rule.c:1715 #1 0x7f5bfd43875d in cmd_free /home/test/nftables/src/rule.c:1447 #2 0x7f5bfd58e6f2 in nft_run_cmd_from_filename /home/test/nftables/src/libnftables.c:628 #3 0x5645c48762b1 in main /home/test/nftables/src/main.c:512 #4 0x7f5bfc0eb09a in __libc_start_main ../csu/libc-start.c:308 #5 0x5645c4873459 in _start (/home/test/nftables/src/.libs/nft+0x9459) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/test/nftables/src/rule.c:1715 in obj_free ==29500==ABORTING Fixes: 7a0e26723496 ("rule: memleak of list of timeout policies") Signed-off-by: Pablo Neira Ayuso <test@netfilter.org>
* tests: py: add dnat to port without defining destination addressPablo Neira Ayuso2021-07-223-0/+28
| | | | | | | Add a test to cover dnat to port without destination address. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: missing nft_ctx_add_var() symbol map updatePablo Neira Ayuso2021-07-211-0/+4
| | | | | | | Add nft_ctx_add_var() to libnftables.map symbol map. Fixes: 9edaa6a51eab ("src: add --define key=value") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix inet nat with no layer 3 infoPablo Neira Ayuso2021-07-201-2/+3
| | | | | | | | | | | | | | nft currently reports: Error: Could not process rule: Protocol error add rule inet x y meta l4proto tcp dnat to :80 ^^^^ default to NFPROTO_INET family, otherwise kernel bails out EPROTO when trying to load the conntrack helper. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --define key=valuePablo Neira Ayuso2021-07-207-1/+158
| | | | | | | | | | | | | | | | | This patch adds a new option to define variables from the command line. # cat test.nft table netdev x { chain y { type filter hook ingress devices = $dev priority 0; counter accept } } # nft --define dev="{ eth0, eth1 }" -f test.nft You can only combine it with -f/--filename. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend coverage for dnat with classic range representationPablo Neira Ayuso2021-07-142-0/+43
| | | | | | Add a few more tests for the classic dnat range representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for nat with interval concatenationPablo Neira Ayuso2021-07-1311-41/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to combine concatenation and interval in NAT mappings, e.g. add rule x y dnat to ip saddr . tcp dport map { 192.168.1.2 . 80 : 10.141.10.2-10.141.10.5 . 8888-8999 } This generates the following NAT expression: [ nat dnat ip addr_min reg 1 addr_max reg 10 proto_min reg 9 proto_max reg 11 ] which expects to obtain the following tuple: IP address (min), source port (min), IP address (max), source port (max) to be obtained from the map. This representation simplifies the delinearize path, since the datatype is specified as: ipv4_addr . inet_service. A few more notes on this update: - alloc_nftnl_setelem() needs a variant netlink_gen_data() to deal with the representation of the range on the rhs of the mapping. In contrast to interval concatenation in the key side, where the range is expressed as two netlink attributes, the data side of the set element mapping stores the interval concatenation in a contiguos memory area, see __netlink_gen_concat_expand() for reference. - add range_expr_postprocess() to postprocess the data mapping range. If either one single IP address or port is used, then the minimum and maximum value in the range is the same value, e.g. to avoid listing 80-80, this round simplify the range. This also invokes the range to prefix conversion routine. - add concat_elem_expr() helper function to consolidate code to build the concatenation expression on the rhs element data side. This patch also adds tests/py and tests/shell. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: infer NAT mapping with concatenation from setPablo Neira Ayuso2021-07-137-21/+56
| | | | | | | | | | | | If the map is anonymous, infer it from the set elements. Otherwise, the set definition already have an explicit concatenation definition in the data side of the mapping. This update simplifies the NAT mapping syntax with concatenations, e.g. snat ip to ip saddr map { 10.141.11.4 : 192.168.2.3 . 80 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove STMT_NAT_F_INTERVAL flags and interval keywordPablo Neira Ayuso2021-07-139-35/+6
| | | | | | | | | | | | | | | STMT_NAT_F_INTERVAL is not useful, the keyword interval can be removed to simplify the syntax, e.g. snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } This patch reworks 9599d9d25a6b ("src: NAT support for intervals in maps"). Do not remove STMT_NAT_F_INTERVAL yet since this flag is needed for interval concatenations coming in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: stmt and expr error path memleaksPablo Neira Ayuso2021-07-131-10/+10
| | | | | | | | Use stmt_free() and expr_free() to release these objects. Fixes: 671851617c8d ("netlink_delinearize: Fix resource leaks") Fixes: 3a8640672978 ("src: hash: support of symmetric hash") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: get `make distcheck` to pass againDuncan Roe2021-07-051-0/+1
| | | | | | | | Commit 4694f7230195 introduced nfnetlink_hook.h but didn't update the automake system to take account of the new file. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinarize: don't check for set element if set is not populatedFlorian Westphal2021-06-302-0/+14
| | | | | | | | | | | | 0065_icmp_postprocessing: line 13: Segmentation fault $NFT insert rule ip x foo index 1 accept Since no listing is done, cache isn't populated and 'nft insert' will trip over set->init == NULL during postprocessing of the existing 'icmp id 42' expression. Fixes: 9a5574e2d4e9 ("netlink_delinearize: add missing icmp id/sequence support") Reported-by: Eric Garver <eric@garver.life> Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* cmd: incorrect error reporting when table declaration existsPablo Neira Ayuso2021-06-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This example ruleset is missing the chain declaration: add table x add set x y { typeof ip saddr ; } add rule x y counter After this patch, error reporting provides suggestions for the missing chain: # nft -f ruleset.nft ruleset.nft:3:12-12: Error: No such file or directory; did you mean chain ‘INPUT’ in table ip ‘filter’? add rule x y counter ^ Before this patch, it incorrectly refers to the table: ruleset.nft:3:10-10: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x y counter ^ This patch invalidates the table that is found via fuzzy lookup if it exists in the cache. Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: incorrect table location in error reportingPablo Neira Ayuso2021-06-291-8/+8
| | | | | | | | | | | | | | | | | If the command refers to an inexisting table, then use the table location. ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ before this patch location is not correct: ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: obj_free() releases timeout state stringPablo Neira Ayuso2021-06-231-0/+1
| | | | | | | Missing free() on the timeout state string on object release. Fixes: 7a0e26723496 ("rule: memleak of list of timeout policies" Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in rate limit parserPablo Neira Ayuso2021-06-231-0/+1
| | | | | | | | | | Direct leak of 13 byte(s) in 1 object(s) allocated from: #0 0x7fb49ad79810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7fb496b8f63a in xstrdup /home/pablo/nftables/src/utils.c:85 #2 0x7fb496c9a79d in nft_lex /home/pablo/nftables/src/scanner.l:740 [...] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: string memleak in YYERROR pathPablo Neira Ayuso2021-06-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Release dynamically allocated string by lex from the YYERROR path, e.g. # cat test.nft table x { map test { type ipv4_addr . foo . inet_service : ipv4_addr . inet_service } } # nft -f test.nft test.nft:3:20-22: Error: unknown datatype foo type ipv4_addr . foo . inet_service : ipv4_addr . inet_service ^^^ test.nft:6-9: Error: set definition does not specify key map test { ^^^^ ==29692==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x7f6c869e8810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7f6c8637f63a in xstrdup /home/test/nftables/src/utils.c:85 #2 0x7f6c8648a4d3 in nft_lex /home/test/nftables/src/scanner.l:740 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: fix memleak when first message in batch is used to report errorPablo Neira Ayuso2021-06-231-0/+6
| | | | | | | | | The err->seqnum == batch_seqnum case results in a memleak of mnl_err objects under some scenarios such as nf_tables kernel support is not available or user runs the nft executable as non-root. Fixes: f930cc500318 ("nftables: fix supression of "permission denied" errors") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix maps with key and data concatenationsPablo Neira Ayuso2021-06-233-6/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | expr_evaluate_concat() is overloaded, it deals with two cases: #1 set key and data definitions, this case uses the special dynamically created concatenation datatype which is taken from the context. #2 set elements, this case iterates over the set key and data expressions that are components of the concatenation tuple, to fetch the corresponding datatype. Add a new function to deal with case #1 specifically. This patch is implicitly fixing up map that include arbitrary concatenations. This is failing with a spurious error report such as: # cat bug.nft table x { map test { type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service } } # nft -f bug.nft bug.nft:3:48-71: Error: datatype mismatch, expected concatenation of (IPv4 address, Internet protocol, internet network service), expression has type concatenation of (IPv4 address, internet network service) type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service ^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: queue: allow use of MAP statement for queue number retrievalFlorian Westphal2021-06-215-2/+49
| | | | | | | | | This allows to chose a queue number at run time using map statements, e.g.: queue flags bypass to ip saddr map { 192.168.7/24 : 0, 192.168.0/24 : 1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend queue testcases for new sreg supportFlorian Westphal2021-06-213-0/+82
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: queue: allow use of arbitrary queue expressionsFlorian Westphal2021-06-216-25/+93
| | | | | | | | | | | | | | | | | | | | | back in 2016 Liping Zhang added support to kernel and libnftnl to specify a source register containing the queue number to use. This was never added to nft itself, so allow this. On linearization side, check if attached expression is a range. If its not, allocate a new register and set NFTNL_EXPR_QUEUE_SREG_QNUM attribute after generating the lowlevel expressions for the kernel. On delinarization we need to check for presence of NFTNL_EXPR_QUEUE_SREG_QNUM and decode the expression(s) when present. Also need to do postprocessing for STMT_QUEUE so that the protocol context is set correctly, without this only raw payload expressions will be shown (@nh,32,...) instead of 'ip ...'. Next patch adds test cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: new queue flag input formatFlorian Westphal2021-06-214-11/+19
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: add queue_stmt_compatFlorian Westphal2021-06-211-8/+11
| | | | | | | | | | | | | | | | | | | | | Rename existing rules to _compat to make sure old rules using 'queue' statement will work. Next patch adds distinct input format where flags are explicitly provided: queue flags name,<nextflag> num 1 Without this, extension of queue expression to handle arbitrary expression instead of queue number or range results in parser errors. Example: queue num jhash ip saddr mod 4 and 1 bypass will fail because scanner is still in 'ip' state, not 'queue', when "bypass" is read. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add queue expr and flags to queue_stmt_allocFlorian Westphal2021-06-215-22/+25
| | | | | | Preparation patch to avoid too much $<stmt>$ references in the parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: restrict queue num expressivenessFlorian Westphal2021-06-211-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Else we run into trouble once we allow queue num symhash mod 4 and 1 and so on. Example problem: queue num jhash ip saddr mod 4 and 1 bypass This will fail to parse because the scanner is in the wrong state (ip, not queue), so 'bypass' is parsed as a string. Currently, while nft will eat the above just fine (minus 'bypass'), nft rejects this from the evaluation phase with Error: queue number is not constant So seems we are lucky and can restrict the supported expressions to integer and range. Furthermore, the line looks wrong because this statement: queue num jhash ip saddr mod 4 and 1 bypass doesn't specifiy a number, "queue num 4" does, or "queue num 1-2" do. For arbitrary expr support it seems sensible to enforce stricter ordering to avoid any problems with the flags, for example: queue bypass,futurekeyword to jhash ip saddr mod 42 Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix hash expression maxvalFlorian Westphal2021-06-181-2/+6
| | | | | | | | It needs to account for the offset too. Fixes: 9bee0c86f179 ("src: add offset attribute for hash expression") Fixes: d4f9a8fb9e9a ("src: add offset attribute for numgen expression") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: memleak of list of timeout policiesPablo Neira Ayuso2021-06-182-0/+9
| | | | | | | | | | | | Release list of ct timeout policy when object is freed. Direct leak of 160 byte(s) in 2 object(s) allocated from: #0 0x7fc0273ad330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7fc0231377c4 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7fc023137983 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7fc0231f64d6 in nft_parse /home/.../devel/nftables/src/parser_bison.y:4448 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in osf flagsPablo Neira Ayuso2021-06-181-0/+2
| | | | | | Release osf string flag after processing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: memleak when listing ct event rulePablo Neira Ayuso2021-06-181-4/+7
| | | | | | | | | | | | | | | | | | | listing a ruleset containing: ct event set new,related,destroy,label results in memleak: Direct leak of 3672 byte(s) in 27 object(s) allocated from: #0 0x7fa5465c0330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7fa54233772c in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7fa5423378eb in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7fa5422488c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7fa54224fb91 in binop_expr_alloc /home/.../devel/nftables/src/expression.c:698 #5 0x7fa54224ddf8 in bitmask_expr_to_binops /home/.../devel/nftables/src/expression.c:512 #6 0x7fa5423102ca in expr_postprocess /home/.../devel/nftables/src/netlink_delinearize.c:2448 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: memleak in error path of the set to segtree conversionPablo Neira Ayuso2021-06-182-3/+15
| | | | | | | | | | | Release the array of intervals and the segtree in case of error, otherwise these structures and objects are never released: SUMMARY: AddressSanitizer: 2864 byte(s) leaked in 37 allocation(s). Moreover, improve existing a test coverage of this error path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: memleak in string netlink postprocessingPablo Neira Ayuso2021-06-181-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Listing a matching wilcard string results in a memleak: ifname "dummy*" Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f27ba52e330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f27b9e1d434 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f27b9e1d5f3 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7f27b9d2e8c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7f27b9d326e9 in constant_expr_alloc /home/.../devel/nftables/src/expression.c:419 #5 0x7f27b9db9318 in netlink_alloc_value /home/.../devel/nftables/src/netlink.c:390 #6 0x7f27b9de0433 in netlink_parse_cmp /home/.../devel/nftables/src/netlink_delinearize.c:321 #7 0x7f27b9deb025 in netlink_parse_expr /home/.../devel/nftables/src/netlink_delinearize.c:1764 #8 0x7f27b9deb0de in netlink_parse_rule_expr /home/.../devel/nftables/src/netlink_delinearize.c:1776 #9 0x7f27b860af7b in nftnl_expr_foreach /home/.../devel/libnftnl/src/rule.c:690 Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f27ba52e330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f27b9e1d434 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f27b96975c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: memleak in binary operation transfer to RHSPablo Neira Ayuso2021-06-181-2/+0
| | | | | | | | | | | | | | | | | | | | | | | Remove useless reference count grabbing on constant expression that results in a memleak. Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f4cd54af330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f4cd4d9e489 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f4cd4d9e648 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7f4cd4caf8c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7f4cd4cb36e9 in constant_expr_alloc /home/.../devel/nftables/src/expression.c:419 #5 0x7f4cd4ca714c in integer_type_parse /home/.../devel/nftables/src/datatype.c:397 #6 0x7f4cd4ca4bee in symbolic_constant_parse /home/.../devel/nftables/src/datatype.c:165 #7 0x7f4cd4ca4572 in symbol_parse /home/.../devel/nftables/src/datatype.c:135 #8 0x7f4cd4cc333f in expr_evaluate_symbol /home/.../devel/nftables/src/evaluate.c:251 [...] Indirect leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f4cd54af330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f4cd4d9e489 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f4cd46185c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: unbreak verdict maps with implicit map with interval concatenationsPablo Neira Ayuso2021-06-187-0/+100
| | | | | | | | | | | Verdict maps in combination with interval concatenations are broken, e.g. # nft add rule x y tcp dport . ip saddr vmap { 1025-65535 . 192.168.10.2 : accept } Retrieve the concatenation field length and count from the map->map expressions that represents the key of the implicit map. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not skip mapping elementsPablo Neira Ayuso2021-06-181-7/+19
| | | | | | | | | | | Set element keys are of EXPR_SET_ELEM expression type, however, mappings use the EXPR_MAPPING expression to wrap the EXPR_SET_ELEM key (mapping->left) and the corresponding data (mapping->right). This patch adds a wrapper function to fetch the EXPR_SET_ELEM expression from the key in case of mappings and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a icmp-reply only and icmpv6 id test casesFlorian Westphal2021-06-176-0/+123
| | | | | | | | | | | | | | | | | | Check that nft doesn't remove the dependency in these cases: icmp type echo-reply icmp id 1 ("icmp id" matches both echo request and reply). Add icmpv6 test cases. These fail without the previous patches: add rule ip6 test-ip6 input icmpv6 id 1: 'icmpv6 id 1' mismatches 'icmpv6 type { echo-request, echo-reply} icmpv6 parameter-problem 65536/16' add rule ip6 test-ip6 input icmpv6 type echo-reply icmpv6 id 65534': 'icmpv6 type echo-reply icmpv6 id 65534' mismatches 'icmpv6 type echo-reply @th,32,16 65534' Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: do not remove icmp echo dependencyFlorian Westphal2021-06-171-24/+37
| | | | | | | | | | | "icmp type echo-request icmp id 2" and "icmp id 2" are not the same, the latter gains an implicit dependency on both echo-request and echo-reply. Change payload dependency tracking to not store dependency in case the value type is ICMP(6)_ECHO(REPLY). Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: add missing icmp id/sequence supportFlorian Westphal2021-06-171-3/+65
| | | | | | | | | | | | | | | | | | | | | | Pablo reports following input and output: in: icmpv6 id 1 out: icmpv6 type { echo-request, echo-reply } icmpv6 parameter-problem 65536/16 Reason is that icmp fields overlap, decoding of the correct name requires check of the icmpv6 type. This only works for equality tests, for instance in: icmpv6 type echo-request icmpv6 id 1 will be listed as "icmpv6 id 1" (which is not correct either, since the input only matches on echo-request). with this patch, output of 'icmpv6 id 1' is icmpv6 type { echo-request, echo-reply } icmpv6 id 1 The second problem, the removal of a single check (request OR reply), is resolved in the followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cover split chain reference across tablesPablo Neira Ayuso2021-06-142-0/+26
| | | | | | | | Add a test to cover table T1 containing the definition of chain C1, and table T1' (actually the same definition as T1) that contains a (jump) reference to chain C1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: extend connlimit testPablo Neira Ayuso2021-06-141-0/+12
| | | | | | | | | Extend existing test to add a ct count expression in the set definition. This test cover the upstream kernel fix ad9f151e560b ("netfilter: nf_tables: initialize set before expression setup"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace opencoded NFT_SET_ANONYMOUS set flag check by set_is_anonymous()Pablo Neira Ayuso2021-06-144-4/+4
| | | | | | | | Use set_is_anonymous() to check for the NFT_SET_ANONYMOUS set flag instead. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xzalloc_array() and use it to allocate the expression hashtablePablo Neira Ayuso2021-06-143-1/+12
| | | | | | | | | | | Otherwise, assertion to ensure that no colission occur is hit due to uninitialized hashtable memory area: nft: netlink_delinearize.c:1741: expr_handler_init: Assertion `expr_handle_ht[hash] == NULL' failed. Fixes: c4058f96c6a5 ("netlink_delinearize: Fix suspicious calloc() call") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add set to cache oncePablo Neira Ayuso2021-06-141-3/+0
| | | | | | | | | | | | | | 67d3969a7244 ("evaluate: add set to the cache") re-adds the set into the cache again. This bug was hidden behind 5ec5c706d993 ("cache: add hashtable cache for table") which broke set_evaluate() for anonymous sets. Phil reported a gcc compilation warning which uncovered this problem. Reported-by: Phil Sutter <phil@nwl.cc> Fixes: 67d3969a7244 ("evaluate: add set to the cache") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: tests: add missing concat test caseFlorian Westphal2021-06-141-0/+39
| | | | | | | | | | Fix ERROR: did not find JSON equivalent for rule 'ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }' when running nft-test.py -j Fixes: bbcc5eda7e58 ("evaluate: restore interval + concatenation in anonymous set") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: tests: fix vlan.t cfi test caseFlorian Westphal2021-06-141-1/+29
| | | | | | | | | | | The test case exists twice, once with new dei, once with old 'cfi', so we need to retain the cfi one in the json file too. Else we get: WARNING: line 2: Wrote JSON equivalent for rule vlan id 4094 vlan dei 1 Fixes: d2fba515ff94 ("src: add vlan dei") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: Fix for potential off-by-one in cmd_add_loc()Phil Sutter2021-06-141-1/+1
| | | | | | | | Using num_attrs as index means it must be at max one less than the array's size at function start. Fixes: 27362a5bfa433 ("rule: larger number of error locations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_delinearize: Fix suspicious calloc() callPhil Sutter2021-06-141-3/+2
| | | | | | | | Parameter passed to sizeof() was wrong. While being at it, replace the whole call with xmalloc_array() which takes care of error checking. Fixes: 913979f882d13 ("src: add expression handler hashtable") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_obj()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'obj' has to be freed before returning to caller. Fixes: 293c9b114faef ("src: add comment support for objects") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_table()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'table' has to be freed before returning to caller. Fixes: c156232a530b3 ("src: add comment support when adding tables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_chain()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'chain' has to be freed before returning to caller. Fixes: 702ac2b72c0e8 ("src: add comment support for chains") Signed-off-by: Phil Sutter <phil@nwl.cc>