summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* segtree: memleaks in interval_map_decompose()HEADmasterPablo Neira Ayuso7 days1-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mpz_init_bitmask() overrides the existing memory area: ==19179== 8 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==19179== at 0x483577F: malloc (vg_replace_malloc.c:299) ==19179== by 0x489C718: xmalloc (utils.c:36) ==19179== by 0x4B825C5: __gmpz_init2 (in /usr/lib/x86_64-linux-g nu/libgmp.so.10.3.2) f ==19179== by 0x4880239: constant_expr_alloc (expression.c:400) ==19179== by 0x489B8A1: interval_map_decompose (segtree.c:1098) ==19179== by 0x489017D: netlink_list_setelems (netlink.c:1220) ==19179== by 0x48779AC: cache_init_objects (rule.c:170) 5 ==19179== by 0x48779AC: cache_init (rule.c:228) ==19179== by 0x48779AC: cache_update (rule.c:279) ==19179== by 0x48A21AE: nft_evaluate (libnftables.c:406) left-hand side of the interval is leaked when building the range: ==25835== 368 (128 direct, 240 indirect) bytes in 1 blocks are definitely lost in loss record 5 of 5 ==25835== at 0x483577F: malloc (vg_replace_malloc.c:299) ==25835== by 0x489B628: xmalloc (utils.c:36) ==25835== by 0x489B6F8: xzalloc (utils.c:65) ==25835== by 0x487E176: expr_alloc (expression.c:45) ==25835== by 0x487F960: mapping_expr_alloc (expression.c:1149) ==25835== by 0x488EC84: netlink_delinearize_setelem (netlink.c:1166) ==25835== by 0x4DC6928: nftnl_set_elem_foreach (set_elem.c:725) ==25835== by 0x488F0D5: netlink_list_setelems (netlink.c:1215) ==25835== by 0x487695C: cache_init_objects (rule.c:170) ==25835== by 0x487695C: cache_init (rule.c:228) ==25835== by 0x487695C: cache_update (rule.c:279) ==25835== by 0x48A10BE: nft_evaluate (libnftables.c:406) ==25835== by 0x48A19B6: nft_run_cmd_from_buffer (libnftables.c:451) ==25835== by 0x10A8E1: main (main.c:487) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix obj list output when reset commandJose M. Guisado Gomez9 days1-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables json output when doing a reset command. Previously do_list_obj was called at the end of do_command_reset to list the named object affected by the reset, this function is for nft output only. Listing affected objects using do_command_list ensures output flags will be honored. Eg: For a ruleset like table inet x { counter user123 { packets 12 bytes 1433 } counter user321 { packets 0 bytes 0 } quota user123 { over 2000 bytes } quota user124 { over 2000 bytes } set y { type ipv4_addr } ... } { "nftables": [ { "metainfo": { "json_schema_version": 1, "release_name": "Capital Idea #2", "version": "0.9.6" } }, { "counter": { "bytes": 0, "family": "inet", "handle": 3, "name": "user321", "packets": 0, "table": "x" } }, { "counter": { "bytes": 1433, "family": "inet", "handle": 2, "name": "user123", "packets": 12, "table": "x" } } ] } Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1336 Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disregard ct address matching without familyPablo Neira Ayuso12 days1-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | The following rule: # nft add rule ip x y ct original daddr @servers breaks with: # nft list ruleset nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed. Aborted Bail out if this syntax is used, instead users should rely on: # nft add rule ip x y ct original ip daddr @servers ~~ which uses NFT_CT_{SRC,DST}_{IP,IP6} in the bytecode generation. This issue is described in 7f742d0a9071 ("ct: support for NFT_CT_{SRC,DST}_{IP,IP6}"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: transform binary operation to prefix only with valuesPablo Neira Ayuso14 days1-1/+1
| | | | | | | | | | | | | | | The following rule: nft add rule inet filter input ip6 saddr and ffff:ffff:ffff:ffff:: @allowable counter when listing the ruleset becomes: ip6 saddr @allowable/64 counter packets 3 bytes 212 This transformation is unparseable, allow prefix transformation only for values. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: UAF in hook priority expressionPablo Neira Ayuso14 days1-1/+1
| | | | | | | | Release priority expression right before assigning the constant expression that results from the evaluation. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: memleak in invalid default policy definitionPablo Neira Ayuso14 days1-1/+3
| | | | | | | Release the clone expression from the exit path. Fixes: 5173151863d3 ("evaluate: replace variable expression by the value expression") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak symbol redefinitionPablo Neira Ayuso14 days1-0/+1
| | | | | | Missing expr_free() from the error path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove table from cache on delete tablePablo Neira Ayuso14 days1-0/+15
| | | | | | | | | | | | | | | | | | | | | The following ruleset crashes nft if loaded twice, via nft -ef: add table inet filter delete table inet filter table inet filter { chain input { type filter hook input priority filter; policy drop; iifname { "eth0" } counter accept } } If the table contains anonymous sets, such as __set0, then delete + add table might result in nft reusing the existing stale __set0 in the cache. The problem is that nft gets confused and it reuses the existing stale __set0 instead of the new anonymous set __set0 with the same name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove cache lookups after the evaluation phasePablo Neira Ayuso14 days4-44/+34
| | | | | | | | | | | | This patch adds a new field to the cmd structure for elements to store a reference to the set. This saves an extra lookup in the netlink bytecode generation step. This patch also allows to incrementally update during the evaluation phase according to the command actions, which is required by the follow up ("evaluate: remove table from cache on delete table") bugfix patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: flush set cache from the evaluation phasePablo Neira Ayuso14 days2-16/+15
| | | | | | | | This patch reworks 40ef308e19b6 ("rule: flush set cache before flush command"). This patch flushes the set cache earlier, from the command evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: rearrange help output to group related options togetherArturo Borrero Gonzalez14 days1-53/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has been reported that nft options are a bit chaotic. With a growing list of options for the nft CLI, we can do better when presenting them to the user who requests help. This patch introduces a textual output grouping for options, in 4 groups: * Options (general) -- common Unix utility options * Options (operative) -- the options that modify the operative behaviour of nft * Options (translation) -- output text modifiers for data translation * Options (parsing) -- output text modifiers for parsing and other operations There is no behavior change in this patch, is mostly a cosmetic change in the hope that users will find the nft tool a bit less confusing to use. After this patch, the help output is: === 8< === % nft --help Usage: nft [ options ] [ cmds... ] Options (general): -h, help Show this help -v, version Show version information -V Show extended version information Options (ruleset input handling): -f, file <filename> Read input from <filename> -i, interactive Read input from interactive CLI -I, includepath <directory> Add <directory> to the paths searched for include files. Defaul[..] -c, check Check commands validity without actually applying the changes. Options (ruleset list formatting): -a, handle Output rule handle. -s, stateless Omit stateful information of ruleset. -t, terse Omit contents of sets. -S, service Translate ports to service names as described in /etc/services. -N, reversedns Translate IP addresses to names. -u, guid Print UID/GID as defined in /etc/passwd and /etc/group. -n, numeric Print fully numerical output. -y, numeric-priority Print chain priority numerically. -p, numeric-protocol Print layer 4 protocols numerically. -T, numeric-time Print time values numerically. Options (command output format): -e, echo Echo what has been added, inserted or replaced. -j, json Format output in JSON -d, debug <level [,level...]> Specify debugging level (scanner, parser, eval, netlink, mnl, p[..] === 8< === While at it, refresh the man page to better reflex this new grouping, and add some missing options. Joint work with Pablo. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Expect refcount increment by json_array_extend()Phil Sutter2020-07-291-2/+4
| | | | | | | | | | | This function is apparently not "joining" two arrays but rather copying all items from the second array to the first, leaving the original reference in place. Therefore it naturally increments refcounts, which means if used to join two arrays caller must explicitly decrement the second array's refcount. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: bail out with concatenations and singleton valuesPablo Neira Ayuso2020-07-241-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | The rule: # nft add rule x y iifname . oifname p . q is equivalent to: # nft add rule x y iifname p oifname q Bail out with: Error: Use concatenations with sets and maps, not singleton values add rule x y iifname . oifname p . q ^^^^^^^^^^^^^^^^^ ~~~~~ instead of: BUG: invalid expression type concat nft: evaluate.c:1916: expr_evaluate_relational: Assertion `0' failed. Aborted Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix concat range expansion in map caseFlorian Westphal2020-07-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Maps with range + concatenation do not work: Input to nft -f: map map_test_concat_interval { type ipv4_addr . ipv4_addr : mark flags interval elements = { 192.168.0.0/24 . 192.168.0.0/24 : 1, 192.168.0.0/24 . 10.0.0.1 : 2, 192.168.1.0/24 . 10.0.0.1 : 3, 192.168.0.0/24 . 192.168.1.10 : 4, } } nft list: map map_test_concat_interval { type ipv4_addr . ipv4_addr : mark flags interval elements = { 192.168.0.0 . 192.168.0.0-10.0.0.1 : 0x00000002, 192.168.1.0-192.168.0.0 . 10.0.0.1-192.168.1.10 : 0x00000004 } } This is not a display bug, nft sends broken information to kernel. Use the correct key expression to fix this. Fixes: 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
* src: allow for negative value in variable definitionsPablo Neira Ayuso2020-07-221-1/+9
| | | | | | Extend test to cover for negative value in chain priority definition. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: replace variable expression by the value expressionPablo Neira Ayuso2020-07-221-1/+4
| | | | | | | | The variable expression provides the binding between the variable dereference and the value expression. Replace the variable expression by the real value expression after the evaluation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: permit get element on mapsFlorian Westphal2020-07-221-12/+0
| | | | | | | | | | | | | | | | | | | | | | Its possible to add an element to a map, but you can't read it back: before: nft add element inet filter test "{ 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 }" nft get element inet filter test "{ 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 }" Error: No such file or directory; did you mean map ‘test’ in table inet ‘filter’? get element inet filter test { 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 } ^^^^ after: nft get element inet filter test "{ 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 }" table inet filter { map test { type ipv4_addr . ether_addr . inet_service : mark flags interval,timeout elements = { 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x00000042 } } } Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: missing map command expansionPablo Neira Ayuso2020-07-211-0/+1
| | | | | | | Maps also need to be split in two commands for proper error reporting. Fixes: c9eae091983a ("src: add CMD_OBJ_SETELEMS") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: flush set cache before flush commandPablo Neira Ayuso2020-07-211-0/+16
| | | | | | Flush the set cache before adding the flush command to the netlink batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use evaluate_expr_variable() for chain policy evaluationPablo Neira Ayuso2020-07-211-20/+3
| | | | | | evaluate_policy() is very similar to evaluate_expr_variable(), replace it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to use variables in flowtable and chain devicesPablo Neira Ayuso2020-07-212-0/+85
| | | | | | | | | | | | | | | This patch adds support for using variables for devices in the chain and flowtable definitions, eg. define if_main = lo table netdev filter1 { chain Main_Ingress1 { type filter hook ingress device $if_main priority -500; policy accept; } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: print "dormant" flag in monitor modeFlorian Westphal2020-07-181-0/+4
| | | | | | | This distinction is important: a table with this flag is inert -- all base chains are unregistered and see no traffic. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: UAF in stmt_evaluate_log_prefix()Pablo Neira Ayuso2020-07-151-5/+4
| | | | | | | | Release existing list expression including variables after creating the prefix string. Fixes: 96c909ef46f0 ("src: allow for variables in the log prefix string") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in log prefix stringPablo Neira Ayuso2020-07-151-0/+1
| | | | | | | Release the string after creating the constant expression. Fixes: 96c909ef46f0 ("src: allow for variables in the log prefix string") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for implicit chain bindingsPablo Neira Ayuso2020-07-158-33/+270
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to group rules in a subchain, e.g. table inet x { chain y { type filter hook input priority 0; tcp dport 22 jump { ip saddr { 127.0.0.0/8, 172.23.0.0/16, 192.168.13.0/24 } accept ip6 saddr ::1/128 accept; } } } This also supports for the `goto' chain verdict. This patch adds a new chain binding list to avoid a chain list lookup from the delinearize path for the usual chains. This can be simplified later on with a single hashtable per table for all chains. From the shell, you have to use the explicit separator ';', in bash you have to escape this: # nft add rule inet x y tcp dport 80 jump { ip saddr 127.0.0.1 accept\; ip6 saddr ::1 accept \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: convert chain name from gmp value to stringPablo Neira Ayuso2020-07-151-8/+13
| | | | | | | Add expr_chain_export() helper function to convert the chain name that is stored in a gmp value variable to string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow for variables in the log prefix stringPablo Neira Ayuso2020-07-082-5/+166
| | | | | | | | | | | | | | | | | | | For example: define test = "state" define foo = "match" table x { chain y { ct state invalid log prefix "invalid $test $foo:" } } This patch scans for variables in the log prefix string. The log prefix expression is a list of constant and variable expression that are converted into a constant expression from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use expression to store the log prefixPablo Neira Ayuso2020-07-087-11/+42
| | | | | | Intsead of using an array of char. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: zap element statement when decomposing intervalPablo Neira Ayuso2020-07-061-0/+16
| | | | | | | | Otherwise, interval sets do not display element statement such as counters. Fixes: 6d80e0f15492 ("src: support for counter in set definition") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow for empty set variable definitionPablo Neira Ayuso2020-07-042-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow for empty set definition in variables if they are merged to non-empty set definition: define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443} define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {} table inet filter { chain input { type filter hook input priority 0; policy drop; tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept } } However, disallow this: define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {} table inet filter { chain input { type filter hook input priority 0; policy drop; tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept } } # nft -f x.nft /tmp/x.nft:6:18-52: Error: Set is empty tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: fix build with gcc <= 4.8Fabrice Fontaine2020-06-081-1/+3
| | | | | | | | | | | | | | | Since commit 719e44277f8e89323a87219b4d4bc7abac05b051, build with gcc <= 4.8 fails on: main.c:186:2: error: 'for' loop initial declarations are only allowed in C99 mode for (size_t i = IDX_INTERACTIVE + 1; i < NR_NFT_OPTIONS; ++i) ^ Fixes: - http://autobuild.buildroot.org/results/cf2359b8311fe91f9335c91f2bb4a730c9f4c9dc Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: add misspelling suggestions for rule commandsPablo Neira Ayuso2020-06-081-0/+38
| | | | | | | | | # nft add rule foo ber counter Error: No such file or directory; did you mean chain ‘bar’ in table ip ‘foo’? add rule foo ber counter ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix asan runtime error in tc handlePablo Neira Ayuso2020-06-081-1/+1
| | | | | | | | | | ASAN reports: meta.c:92:17: runtime error: left shift of 34661 by 16 places cannot be represented in type 'int' use 32-bit integer as tmp variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: fix asan runtime errorPablo Neira Ayuso2020-06-081-2/+2
| | | | | | | | | | ASAN reports: segtree.c:387:30: runtime error: variable length array bound evaluates to non-positive value 0 Update array definition to be the set size plus 1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: release dummy rule object from netlink_parse_set_expr()Pablo Neira Ayuso2020-06-081-1/+7
| | | | | | | | | | | | | | | | | | | | | netlink_parse_set_expr() creates a dummy rule object to reuse the existing netlink parser. Release the rule object to fix a memleak. Zap the statement list to avoid a use-after-free since the statement needs to remain in place after releasing the rule. ==21601==ERROR: LeakSanitizer: detected memory leaks Direct leak of 2016 byte(s) in 4 object(s) allocated from: #0 0x7f7824b26330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f78245fcebd in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 #2 0x7f78245fd016 in xzalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:65 #3 0x7f782456f0b5 in rule_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/rule.c:623 Add a test to check for set counters. SUMMARY: AddressSanitizer: 2016 byte(s) leaked in 4 allocation(s). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove superfluous check in set_evaluate()Pablo Neira Ayuso2020-06-071-5/+0
| | | | | | If set_is_objmap() is true, then set->data is always NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: missing datatype definition in implicit_set_declaration()Pablo Neira Ayuso2020-06-071-10/+12
| | | | | | | | | | | | | | | | | | | | | | set->data from implicit_set_declaration(), otherwise, set_evaluation() bails out with: # nft -f /etc/nftables/inet-filter.nft /etc/nftables/inet-filter.nft:8:32-54: Error: map definition does not specify mapping data type tcp dport vmap { 22 : jump ssh_input } ^^^^^^^^^^^^^^^^^^^^^^^ /etc/nftables/inet-filter.nft:13:26-52: Error: map definition does not specify mapping data type iif vmap { "eth0" : jump wan_input } ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Add a test to cover this case. Fixes: 7aa08d45031e ("evaluate: Perform set evaluation on implicitly declared (anonymous) sets") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=208093 Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow flowtable definitions with no devicesPablo Neira Ayuso2020-06-022-10/+14
| | | | | | | | | | | | | The listing shows no devices: # nft list ruleset table ip x { flowtable y { hook ingress priority filter } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: delete devices to an existing flowtablePablo Neira Ayuso2020-06-022-0/+18
| | | | | | | | This patch allows you to remove a device to an existing flowtable: # nft delete flowtable x y { devices = { eth0 } \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add devices to an existing flowtablePablo Neira Ayuso2020-06-022-16/+21
| | | | | | | | This patch allows you to add new devices to an existing flowtables. # nft add flowtable x y { devices = { eth0 } \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add function to convert flowtable device list to arrayPablo Neira Ayuso2020-06-021-20/+34
| | | | | | | | This patch adds nft_flowtable_dev_array() to convert the list of devices into an array. This array is released through nft_flowtable_dev_array_free(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Perform set evaluation on implicitly declared (anonymous) setsStefano Brivio2020-05-281-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a set is implicitly declared, set_evaluate() is not called as a result of cmd_evaluate_add(), because we're adding in fact something else (e.g. a rule). Expression-wise, evaluation still happens as the implicit set expression is eventually found in the tree and handled by expr_evaluate_set(), but context-wise evaluation (set_evaluate()) is skipped, and this might be relevant instead. This is visible in the reported case of an anonymous set including concatenated ranges: # nft add rule t c ip saddr . tcp dport { 192.0.2.1 . 20-30 } accept BUG: invalid range expression type concat nft: expression.c:1160: range_expr_value_low: Assertion `0' failed. Aborted because we reach do_add_set() without properly evaluated flags and set description, and eventually end up in expr_to_intervals(), which can't handle that expression. Explicitly call set_evaluate() as we add anonymous sets into the context, and instruct the same function to: - skip expression-wise set evaluation if the set is anonymous, as that happens later anyway as part of the general tree evaluation - skip the insertion in the set cache, as it makes no sense to have sets that shouldn't be referenced there For object maps, the allocation of the expression for set->data is already handled by set_evaluate(), so we can now drop that from stmt_evaluate_objref_map(). v2: - skip insertion of set in cache (Pablo Neira Ayuso) - drop double allocation of expression (and leak of the first one) for object maps (Pablo Neira Ayuso) Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: enable reject with 802.1qMichael Braun2020-05-281-1/+1
| | | | | | | | | | | | This enables the use nft bridge reject with bridge vlan filtering. It depends on a kernel patch to make the kernel preserve the vlan id in nft bridge reject generation. [ pablo: update tests/py ] Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add frag-needed (ipv4) to reject optionsMichael Braun2020-05-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This enables to send icmp frag-needed messages using reject target. I have a bridge with connects an gretap tunnel with some ethernet lan. On the gretap device I use ignore-df to avoid packets being lost without icmp reject to the sender of the bridged packet. Still I want to avoid packet fragmentation with the gretap packets. So I though about adding an nftables rule like this: nft insert rule bridge filter FORWARD \ ip protocol tcp \ ip length > 1400 \ ip frag-off & 0x4000 != 0 \ reject with icmp type frag-needed This would reject all tcp packets with ip dont-fragment bit set that are bigger than some threshold (here 1400 bytes). The sender would then receive ICMP unreachable - fragmentation needed and reduce its packet size (as defined with PMTU). [ pablo: update tests/py ] Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove empty filePablo Neira Ayuso2020-05-261-0/+0
| | | | | | Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1429 Fixes: f9465cf517cc ("src: add STMT_NAT_F_CONCAT flag and use it") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add CMD_OBJ_SETELEMSPablo Neira Ayuso2020-05-141-4/+19
| | | | | | | | | | | This new command type results from expanding the set definition in two commands: One to add the set and another to add the elements. This results in 1:1 mapping between the command object to the netlink API. The command is then translated into a netlink message which gets a unique sequence number. This sequence number allows to correlate the netlink extended error reporting with the corresponding command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: call nft_cmd_expand() only with CMD_ADDPablo Neira Ayuso2020-05-141-1/+5
| | | | | | | Restrict the expansion logic to the CMD_ADD command which is where this is only required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTSPablo Neira Ayuso2020-05-145-15/+15
| | | | | | | | The CMD_OBJ_ELEMENTS provides an expression that contains the list of set elements. This leaves room to introduce CMD_OBJ_SETELEMS in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix error rule reporting with missing table/chain and anonymous setsPablo Neira Ayuso2020-05-141-0/+1
| | | | | | | | | | | | | | | | | handle_merge() skips handle location initialization because set name != NULL. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f64f1e in erec_print (octx=0x55555555d2c0, erec=0x55555555fcf0, debug_mask=0) at erec.c:95 95 switch (indesc->type) { (gdb) bt buf=0x55555555db20 "add rule inet traffic-filter input tcp dport { 22, 80, 443 } accept") at libnftables.c:459 (gdb) p indesc $1 = (const struct input_descriptor *) 0x0 Closes: http://bugzilla.opensuse.org/show_bug.cgi?id=1171321 Fixes: 086ec6f30c96 ("mnl: extended error support for create command") Reported-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Improve performance of json_events_cb()Phil Sutter2020-05-141-3/+6
| | | | | | | | | | | | The function tries to insert handles into JSON input for echo option. Yet there may be nothing to do if the given netlink message doesn't contain a handle, e.g. if it is an 'add element' command. Calling seqnum_to_json() is pointless overhead in that case, and if input is large this overhead is significant. Better wait with that call until after checking if the message is relevant at all. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Eric Garver <eric@garver.life>