summaryrefslogtreecommitdiffstats
path: root/src/expr/socket.c
Commit message (Collapse)AuthorAgeFilesLines
* expr: Respect data_len when setting attributesHEADmasterPhil Sutter2024-04-111-3/+3
| | | | | | | | With attr_policy in place, data_len has an upper boundary but it may be lower than the attribute's storage area in which case memcpy() would read garbage. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Introduce struct expr_ops::attr_policyPhil Sutter2024-03-061-0/+7
| | | | | | | | | | | | | | | | | Similar to kernel's nla_policy, enable expressions to inform about restrictions on attribute use. This allows the generic expression code to perform sanity checks before dispatching to expression ops. For now, this holds only the maximum data len which may be passed to nftnl_expr_set(). While one may debate whether accepting e.g. uint32_t for sreg/dreg attributes is correct, it is necessary to not break nftables. Note that this introduces artificial restrictions on name lengths which were caught by the kernel (if nftables didn't). Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Call expr_ops::set with legal types onlyPhil Sutter2024-03-061-2/+0
| | | | | | | | | | Having the new expr_ops::nftnl_max_attr field in place, the valid range of attribute type values is known now. Reject illegal ones upfront. Consequently drop the default case from callbacks' switches which handle all supported attributes. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: Repurpose struct expr_ops::max_attr fieldPhil Sutter2024-03-061-1/+1
| | | | | | | | | Instead of holding the maximum kernel space (NFTA_*) attribute value, use it to hold the maximum expression attribute (NFTNL_EXPR_*) value instead. This will be used for index boundary checks in an attribute policy array later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: fix clang+glibc snprintf substitution errorNicholas Vinson2022-06-151-1/+1
| | | | | | | | | | | | | | | | | | | | When building with clang and glibc and -D_FORTIFY_SOURCE=2 is passed to clang, the snprintf member of the expr_ops and obj_ops structures will be incorrectly replaced with __builtin_snprintf_chk() which results in "error: no member named '__builtin___snprintf_chk'" errors at build time. This patch changes the member name from 'snprintf' to 'output' to prevent the replacement. This bug can be emulated using GCC by undefining the __va_arg_pack macro before stdio.h is included. This patch is based on the notes provided in https://bugs.gentoo.org/807766. Signed-off-by: Nicholas Vinson <nvinson234@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* expr: socket: add cgroups v2 supportPablo Neira Ayuso2021-05-031-0/+18
| | | | | | Add NFT_SOCKET_CGROUPSV2 key type and NFTA_SOCKET_LEVEL attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: Check output type once and for allPhil Sutter2021-03-151-17/+2
| | | | | | | | | | | There is but a single supported output type left, so check it in expr.c and drop all the single option switch statements in individual expressions. Since the parameter is now unused (and to ensure code correctness), drop 'type' parameter from struct expr_ops' snprintf callback. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr/socket: Kill dead codePhil Sutter2021-03-091-13/+0
| | | | | | | Function str2socket_key() was never used. Fixes: 038d226f2e6cc ("src: Add support for native socket matching") Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: socket: add wildcard supportPablo Neira Ayuso2020-10-121-0/+1
| | | | | | Add missing NFT_SOCKET_WILDCARD definition. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove nftnl_rule_cmp() and nftnl_expr_cmp()Pablo Neira Ayuso2018-10-241-16/+0
| | | | | | | | | | | | | | These functions are not very useful, rule comparison from this layer does not work well with implicit set definitions. This infrastructure was added as an attempt to support for deletion by name from this layer, which should be done from higher level libnftables library. Finally, we never had a client for this code in git.netfilter.org. Let's remove it and bump libversion for safety reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-191-2/+2
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-151-15/+0
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* socket: Expose socket mark via socket expressionMáté Eckl2018-07-301-0/+1
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for native socket matchingMáté Eckl2018-06-011-0/+208
Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>