summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY attributeHEADmasterPhil Sutter5 days1-3/+4
| | | | | | | | If missing, the memcpy call ends up reading from address zero. Fixes: c7c94802679cd ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Dump flowtable hook spec only if presentPhil Sutter5 days1-8/+14
| | | | | | | | | | | | | If there is no priority.expr set, assume hook.num is bogus, too. While this is fixing JSON output, it's hard to tell what commit this is actually fixing: Before commit 627c451b23513 ("src: allow variables in the chain priority specification"), there was no way to detect flowtables missing hook specs (e.g. when printing flowtable delete monitor event). Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Correctly print flowtable updatesPhil Sutter5 days1-5/+9
| | | | | | | | | An update deleting a hook from a flowtable was indistinguishable from a flowtable deletion. Fixes: 73a8adfc2432e ("monitor: Recognize flowtable add/del events") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Do not allocate a bogus flowtable priority exprPhil Sutter5 days1-2/+4
| | | | | | | | | Code accidentally treats missing NFTNL_FLOWTABLE_PRIO attribute as zero prio value which may not be correct. Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fix for potential crash parsing a flowtablePhil Sutter5 days1-1/+1
| | | | | | | | | | Kernel's flowtable message might not contain the NFTA_FLOWTABLE_HOOK_DEVS attribute. In that case, nftnl_flowtable_get() will return NULL for the respective nftnl attribute. Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: catch bogus expressions before crashingFlorian Westphal6 days1-0/+11
| | | | | | | | | | | | | | | | | | | We can't recover from errors here, but we can abort with a more precise reason than 'segmentation fault', or stack corruptions that get caught way later, or not at all. expr->value is going to be read, we can't cope with other expression types here. We will copy to stack buffer of IFNAMSIZ size, abort if we would overflow. Check there is a NUL byte present too. This is a preemptive patch, I've seen one crash in this area but no reproducer yet. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: work around fuzzer-induced assert crashesFlorian Westphal13 days1-131/+140
| | | | | | | | | | | | | fuzzer can cause assert failures due to json_pack() returning a NULL value and therefore triggering the assert(out) in __json_pack macro. All instances I saw are due to invalid UTF-8 strings, i.e., table/chain names with non-text characters in them. Work around this for now, replace the assert with a plaintext error message and return NULL instead of abort(). Signed-off-by: Florian Westphal <fw@strlen.de>
* json: prevent null deref if chain->policy is not setFlorian Westphal14 days1-5/+14
| | | | | | | | | | | | | | The two commits mentioned below resolved null dererence crashes when the policy resp. priority keyword was missing in the chain/flowtable specification. Same issue exists in the json output path, so apply similar fix there and extend the existing test cases. Fixes: 5b37479b42b3 ("nftables: don't crash in 'list ruleset' if policy is not set") Fixes: b40bebbcee36 ("rule: do not crash if to-be-printed flowtable lacks priority") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* cache: Tolerate object deserialization failuresPhil Sutter2025-05-251-6/+5
| | | | | | | | If netlink_delinearize_obj() fails, it will print an error message. Skip this object and keep going. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Keep going after set element parsing failuresPhil Sutter2025-05-251-1/+3
| | | | | | | | Print an error message and try to deserialize the remaining elements instead of calling BUG(). Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Pass netlink_ctx to netlink_delinearize_setelem()Phil Sutter2025-05-252-9/+9
| | | | | | | | | Prepare for calling netlink_io_error() which needs the context pointer. Trade this in for the cache pointer since no caller uses a special one. No functional change intended. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: Replace some BUG()s by error messagesPhil Sutter2025-05-251-6/+11
| | | | | | | | | | Netlink parser tries to keep going despite errors. Faced with an incompatible ruleset, this is much more user-friendly than exiting the program upon the first obstacle. This patch fixes three more spots to support this. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Catch unknown types when deserializing objectsPhil Sutter2025-05-201-0/+4
| | | | | | | | | Print an error message and discard the object instead of returning it to the caller. At least when trying to print it, we would hit an assert() in obj_type_name() anyway. Fixes: 4756d92e517ae ("src: listing of stateful objects") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid potential NULL-ptr deref parsing set elem expressionsPhil Sutter2025-05-201-1/+2
| | | | | | | | Since netlink_parse_set_expr() may return NULL, the following deref must be guarded. Fixes: e6d1d0d611958 ("src: add set element multi-statement support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Introduce json_add_array_new()Phil Sutter2025-05-131-75/+24
| | | | | | | | Propagate nat_stmt_add_array() to a generic helper for use in all spots adding an array property which may reduce to a single item or even not exist at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print single synproxy flags as non-arrayPhil Sutter2025-05-131-2/+6
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print single fib flag as non-arrayPhil Sutter2025-05-131-1/+9
| | | | | | | | | | Check array size and reduce the array if possible. The zero array length check is dead code here due to the surrounding 'if (flags)' block, but it's a common idiom one could replace by a shared routine later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print single set flag as non-arrayPhil Sutter2025-05-131-1/+1
| | | | | | | | The code obviously intended to do this already but got the array length check wrong. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Introduce parse_flags_array()Phil Sutter2025-05-131-333/+133
| | | | | | | | | | | | | | | | Various objects support a 'flags' property with value usually being an array of strings. There is a special case, when merely a single flag is set: The value may be a string representing this flag. Introduce a function assisting in parsing this polymorphic value. Have callers pass a parser callback translating a single flag name into a corresponding value. Luckily, these single flag parsers are very common already. As a side-effect, enable the single flag spec for set flags as well and update the documentation accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: netlink: fix crash when ops doesn't support udataFlorian Westphal2025-05-111-1/+1
| | | | | | | | | | | | Whenever a new version adds udata support to an expression, then old versions of nft will crash when trying to list such a ruleset generated by a more recent version of nftables. Fix this by falling back to 'type' format. Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support') Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove bogus empty fileFlorian Westphal2025-04-251-0/+0
| | | | | | | | No idea how this happened, remove it. Reported-by: Sunny73Cr <Sunny73Cr@protonmail.com> Fixes: 058246016188 ("src: allow to map key to nfqueue number") Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: bogus concatenated set ranges with netlink message overrunPablo Neira Ayuso2025-04-211-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building each component of the set element key, a late byteorder switch is performed to ensure that all components in the interval are represented in big endian, as required by the pipapo backend. In case that the set element does not fit into the netlink message, the byteorder switch happens twice, leading to inserting an element with a bogus component with large sets, so instead: "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" listing reports: 16777216 . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" Note that 16777216 is 0x1000000, which should instead be 0x00000001 to represent "lo" as u32. Fix this by switching the value in a temporary variable and use it to set the set element key attribute in the netlink message. Later, revisit this to perform this byteorder switch from evaluation step. Add tests/shell unit to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1792 Fixes: 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evalute: make vlan pcp updates workFlorian Westphal2025-04-221-4/+38
| | | | | | | | | | | | | | | | On kernel side, nft_payload_set_vlan() requires a 2 or 4 byte write to the vlan header. As-is, nft emits a 1 byte write: [ payload load 1b @ link header + 14 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000001f ) ^ 0x00000020 ] ... which the kernel doesn't support. Expand all vlan header updates to a 2 or 4 byte write and update the existing vlan id test case. Reported-by: Kevin Vigouroux <ke.vigouroux@laposte.net> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "intervals: do not merge intervals with different timeout"Pablo Neira Ayuso2025-04-171-5/+1
| | | | | | | | | | | This reverts commit da0bac050c8b2588242727f9915a1ea8bc48ceb2. This results in an error when adding an interval that overlaps an existing interval in the kernel, this defeats the purpose of the auto-merge feature. Reported-by: Slavko <linux@slavino.sk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: add selector_expr rule to restrict typeof_exprPablo Neira Ayuso2025-04-111-17/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | typeof_expr allows for symbol, constant and bitwise expressions, restrict it to selector expressions. After this patch, input generated by fuzzer is rejected upfront: # nft -f test.nft test.nft:3:53-53: Error: syntax error, unexpected number typeof numgen inc mod 2 : ip daddr . 0 ^ test.nft:2:12-13: Error: set definition does not specify key map t2 { ^^ test.nft:8:65-67: Error: No such file or directory meta l4proto tcp dnat ip to numgen inc mod 2 map @t2 ^^^ test.nft:8:65-67: Error: No such file or directory meta l4proto tcp dnat ip to numgen inc mod 2 map @t2 ^^^ Revisit 4ab1e5e60779 ("src: allow use of 'verdict' in typeof definitions") to handle verdict as string, later a token can be added to the scanner and enable it via flex start conditions. Fixes: 14357cff40ed ("parser: add typeof keyword for declarations") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: invalidate merge in case of duplicated key in set/mapPablo Neira Ayuso2025-04-091-1/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -o/--optimize results in EEXIST error when merging two rules that lead to ambiguous set/map, for instance: table ip x { chain v4icmp {} chain v4icmpc {} chain y { ip protocol icmp jump v4icmp ip protocol icmp goto v4icmpc } } which is not possible because duplicated keys are not possible in set/map. This is how it shows when running a test: Merging: testcases/sets/dumps/sets_with_ifnames.nft:56:3-30: ip protocol icmp jump v4icmp testcases/sets/dumps/sets_with_ifnames.nft:57:3-31: ip protocol icmp goto v4icmpc into: ip protocol vmap { icmp : jump v4icmp, icmp : goto v4icmpc } internal:0:0-0: Error: Could not process rule: File exists Add a new step to compare rules that are candidate to be merged to detect colissions in set/map keys in order to skip them in the next final merging step. Add tests/shell unit to improve coverage. Fixes: fb298877ece2 ("src: add ruleset optimization infrastructure") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bail out if ct saddr/daddr dependency cannot be insertedFlorian Westphal2025-04-071-1/+2
| | | | | | | | | | | | | | | | | | | | | If we have an incomplete rule like "ct original saddr" in inet family, this function generates an error because it can't determine the required protocol dependency, hinting at missing ip/ip6 keyword. We should not go on in this case to avoid a redundant followup error: nft add rule inet f c ct original saddr 1.2.3.4 Error: cannot determine ip protocol version, use "ip saddr" or "ip6 saddr" instead add rule inet f c ct original saddr 1.2.3.4 ^^^^^^^^^^^^^^^^^ Error: Could not parse symbolic invalid expression add rule inet f c ct original saddr 1.2.3.4 After this change only the first error is shown. Fixes: 2b29ea5f3c3e ("src: ct: add eval part to inject dependencies for ct saddr/daddr") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: only allow concatenations with 2 or more expressionsFlorian Westphal2025-04-022-9/+15
| | | | | | | | | | | | | | | | | | | | | | | | | The bison parser enforces this implicitly by grammar rules. Because subkeys have to be conatenated via ".", notation, e.g. "mark . ip saddr", all concatenation expressions always consist of at least two elements. But this doesn't apply to the json frontend which just uses an array: it can be empty or only contain one element. The included reproducer makes the eval stage set the "concatenation" flag on the interval set. This prevents the needed conversion code to turn the element values into ranges from getting run. The reproducer asserts with: nft: src/intervals.c:786: setelem_to_interval: Assertion `key->etype == EXPR_RANGE_VALUE' failed. Convert the assertion to BUG() so we can see what element type got passed to the set interval code in case we have further issues in this area. Reject 0-or-1-element concatenations from the json parser. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix crash when generating reject statement errorFlorian Westphal2025-04-021-2/+14
| | | | | | | | | | | After patch, this gets rejected with: internal:0:0-0: Error: conflicting protocols specified: ip vs ip6 Without patch, we crash with a NULL dereference: we cannot use reject.expr->location unconditionally. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: remove unused expr function argumentFlorian Westphal2025-04-021-16/+10
| | | | | | | stmt_evaluate_reject passes cmd->expr argument but its never used. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: expand expression list when merging into concatenationPablo Neira Ayuso2025-04-011-0/+10
| | | | | | | | | | | | | | | | | The following rules: udp dport 137 ct state new,untracked accept udp dport 138 ct state new,untracked accept results in: nft: src/optimize.c:670: __merge_concat: Assertion `0' failed. The logic to expand to the new,untracked list in the concatenation is missing. Fixes: 187c6d01d357 ("optimize: expand implicit set element when merging into concatenation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: prevent possible crash rule filter is NULLPablo Neira Ayuso2025-04-011-2/+4
| | | | | | | | | Similar to 3f0a47f9f00c ("cache: don't crash when filter is NULL"). No real crash observed but it is good to tigthen this. Fixes: dbff26bfba83 ("cache: consolidate reset command") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: bail out on malformed statement in setPablo Neira Ayuso2025-04-011-12/+27
| | | | | | | Propagate error to caller so it bails out on malformed set statements. Fixes: 07958ec53830 ("json: add set statement list support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: allow statement stateful statement only in set elementsPablo Neira Ayuso2025-04-011-0/+5
| | | | | | | Upfront reject of non stateful statements in set elements. Fixes: 07958ec53830 ("json: add set statement list support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: reject empty jump/goto chainPablo Neira Ayuso2025-04-011-3/+7
| | | | | | | | | | | | | When parsing a verdict map json where element jumps to chain represented as empty string. internal:0:0-0: Error: Parsing list expression item at index 0 failed. internal:0:0-0: Error: Invalid set elem at index 0. internal:0:0-0: Error: Invalid set elem expression. internal:0:0-0: Error: Parsing command array at index 2 failed. Fixes: 586ad210368b ("libnftables: Implement JSON parser") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: don't crash when filter is NULLFlorian Westphal2025-04-011-2/+4
| | | | | | | | | a delete request will cause a crash in obj_cache_dump, move the deref into the filter block. Fixes: dbff26bfba83 ("cache: consolidate reset command") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: incorrect assert() list_expr_to_binopPablo Neira Ayuso2025-04-011-1/+1
| | | | | | | | | | | | assert() logic is reversed, all expressions in the list are handled, including the first. src/expression.c:1285: list_expr_to_binop: Assertion `first' failed. Fixes: 53d6bb992445 ("expression: initialize list of expression to silence gcc compile warning") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: only allow stateful statements in set and map definitionsFlorian Westphal2025-03-311-1/+4
| | | | | | | | | | | | | | | | The bison parser doesn't allow this to happen due to grammar restrictions, but the json input has no such issues. The bogon input assigns 'notrack' which triggers: BUG: unknown stateful statement type 19 nft: src/netlink_linearize.c:1061: netlink_gen_stmt_stateful: Assertion `0' failed. After patch, we get: Error: map statement must be stateful Fixes: 07958ec53830 ("json: add set statement list support") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: compact STMT_F_STATEFUL checksFlorian Westphal2025-03-311-12/+14
| | | | | | | | We'll gain another F_STATEFUL check in a followup patch, so lets condense the pattern into a helper to reduce copypaste. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: don't try to import empty stringFlorian Westphal2025-03-311-1/+1
| | | | | | | | The bogon will trigger the assertion in mpz_import_data: src/expression.c:418: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: initialize list of expression to silence gcc compile warningPablo Neira Ayuso2025-03-311-1/+6
| | | | | | | | | | | | | | | | The helper function to translate flagcmp expression to binop expression results in the following compile warning. src/expression.c: In function 'list_expr_to_binop': src/expression.c:1286:16: warning: 'last' may be used uninitialized [-Wmaybe-uninitialized] 1286 | return last; While at it, add assert() to validate the premises where this function can be called. Fixes: 4d5990c92c83 ("src: transform flag match expression to binop expression from parser") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix error propagation when parsing binop lhs/rhsFlorian Westphal2025-03-311-0/+14
| | | | | | | | | | | | | | | | | | | | Malformed input returns NULL when decoding left/right side of binop. This causes a NULL dereference in expr_evaluate_binop; left/right must point to a valid expression. Fix this in the parser, else would have to sprinkle NULL checks all over the evaluation code. After fix, loading the bogon yields: internal:0:0-0: Error: Malformed object (too many properties): '{}'. internal:0:0-0: Error: could not decode binop rhs, '<<'. internal:0:0-0: Error: Invalid mangle statement value internal:0:0-0: Error: Parsing expr array at index 1 failed. internal:0:0-0: Error: Parsing command array at index 3 failed. Fixes: 0ac39384fd9e ("json: Accept more than two operands in binary expressions") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: don't BUG when asked to list synproxiesFlorian Westphal2025-03-273-6/+38
| | | | | | | | | | | | | | | | "-j list synproxys" triggers a BUG(). Rewrite this so that all enum values are handled so the compiler can alert us to a missing value in case there are more commands in the future. While at it, implement a few low-hanging fruites as well. Not-yet-supported cases are simply ignored. v2: return EOPNOTSUPP for unsupported commands (Pablo Neira Ayuso) Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: disallow empty concatenationPablo Neira Ayuso2025-03-271-0/+7
| | | | | | | | | | | | Disallow empty concatenation in set declaration in json. internal:0:0-0: Error: Empty concatenation internal:0:0-0: Error: Invalid set type. internal:0:0-0: Error: Parsing command array at index 1 failed. Joint work with Florian Westphal. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove flagcmp expressionPablo Neira Ayuso2025-03-273-91/+0
| | | | | | | | | | | | | | This expression is not used anymore, since: ("src: transform flag match expression to binop expression from parser") remove it. This completes the revert of c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations"), except the parser chunk for backwards compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: transform flag match expression to binop expression from parserPablo Neira Ayuso2025-03-272-4/+41
| | | | | | | | | | | | | | | | | | | | | | | | Transform flagcmp expression to a relational with binop on the left hand side, ie. relational / \ binop value / \ payload mask Add list_expr_to_binop() to make this transformation. Goal is two-fold: - Allow -o/--optimize to pick up on this representation. - Remove the flagcmp expression in a follow up patch. This prepare for the removal of the flagcmp expression added by: c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: compact bitmask matching in set/mapPablo Neira Ayuso2025-03-271-1/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check if right hand side of relational is a bitmask, ie. relational / \ ... or / \ value or / \ value value then, if left hand side is a binop expression, compare left and right hand sides (not only left hand of this binop expression) to check for redundant matches in consecutive rules, ie. relational / \ and ... / \ payload value before this patch, only payload in the binop expression was compared. This allows to compact several rules matching tcp flags in a set/map, eg. # nft -c -o -f ruleset.nft Merging: ruleset.nft:7:17-76: tcp flags & (fin | syn | rst | ack | urg) == fin | ack | urg ruleset.nft:8:17-70: tcp flags & (fin | syn | rst | ack | urg) == fin | ack ruleset.nft:9:17-64: tcp flags & (fin | syn | rst | ack | urg) == fin ruleset.nft:10:17-70: tcp flags & (fin | syn | rst | ack | urg) == syn | ack ruleset.nft:11:17-64: tcp flags & (fin | syn | rst | ack | urg) == syn ruleset.nft:12:17-70: tcp flags & (fin | syn | rst | ack | urg) == rst | ack ruleset.nft:13:17-64: tcp flags & (fin | syn | rst | ack | urg) == rst ruleset.nft:14:17-70: tcp flags & (fin | syn | rst | ack | urg) == ack | urg ruleset.nft:15:17-64: tcp flags & (fin | syn | rst | ack | urg) == ack into: tcp flags & (fin | syn | rst | ack | urg) == { fin | ack | urg, fin | ack, fin, syn | ack, syn, rst | ack, rst, ack | urg, ack } Merging: ruleset.nft:17:17-61: tcp flags & (ack | urg) == ack jump ack_chain ruleset.bft:18:17-61: tcp flags & (ack | urg) == urg jump urg_chain into: tcp flags & (ack | urg) vmap { ack : jump ack_chain, urg : jump urg_chain } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: incorrect comparison for reject statementPablo Neira Ayuso2025-03-271-1/+1
| | | | | | | | Logic is reverse, this should returns false if the compared reject expressions are not the same. Fixes: 38d48fe57fff ("optimize: fix reject statement") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: add __EXPR_MAX and use it to define EXPR_MAXPablo Neira Ayuso2025-03-271-0/+1
| | | | | | | | | | | | EXPR_MAX was never updated to the newest expression, add __EXPR_MAX and use it to define EXPR_MAX. Add case to expr_ops() other gcc complains with a warning on the __EXPR_MAX case is not handled. Fixes: 347039f64509 ("src: add symbol range expression to further compact intervals") Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: return error if table does not existFlorian Westphal2025-03-271-1/+6
| | | | | | | | Identical bug and thus same fix as 853d3a2d3cbd ("rule: return error if table does not exist"), but this time for json. Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2025-06-18 04:17:24 +0000