summaryrefslogtreecommitdiffstats
path: root/src/set.c
Commit message (Collapse)AuthorAgeFilesLines
* utils: Introduce and use nftnl_set_str_attr()Phil Sutter2024-04-111-14/+4
| | | | | | | | | | | | | | | The function consolidates the necessary code when assigning to string pointer attributes, namely: * Conditional free of the previous value * Allocation of new value * Checking for memory allocation errors * Setting respective flag bit A new feature previously missing in all call sites is respecting data_len in case the buffer up to that point did not contain a NUL-char. Signed-off-by: Phil Sutter <phil@nwl.cc>
* set: Validate NFTNL_SET_ID, tooPhil Sutter2024-04-111-0/+1
| | | | | Fixes: 26298a9ffc2e2 ("set: add set ID support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* set: buffer overflow in NFTNL_SET_DESC_CONCAT setterPablo Neira Ayuso2024-01-111-1/+7
| | | | | | | | | Allow to set a maximum limit of sizeof(s->desc.field_len) which is 16 bytes, otherwise, bail out. Ensure s->desc.field_count does not go over the array boundary. Fixes: 7cd41b5387ac ("set: Add support for NFTA_SET_DESC_CONCAT attributes") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Do not leave free'd expr_list elements in placePhil Sutter2023-07-131-4/+12
| | | | | | | | When freeing elements, remove them also to prevent a potential UAF. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1685 Fixes: 3469f09286cee ("src: add NFTNL_SET_EXPRESSIONS") Signed-off-by: Phil Sutter <phil@nwl.cc>
* set: use NFTNL_SET_ELEM_VERDICT to print verdictPablo Neira Ayuso2021-11-041-1/+1
| | | | | | | | This patch reworks 228e8b174627 ("set_elem: Fix printing of verdict map elements"), check if NFTNL_SET_ELEM_VERDICT is set then print the set element verdict. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Get rid of single option switch statementsPhil Sutter2021-03-151-12/+5
| | | | | | | | | | | | Replace each by a conditional testing the only valid case. There is one odd example, namely src/set.c: When printing a set with type NFTNL_OUTPUT_XML, the relevant function would return 0 instead of -1 like all others. Just drop it assuming nothing depends on that (faulty) behaviour. Cc: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* Drop pointless local variable in snprintf callbacksPhil Sutter2021-03-151-5/+4
| | | | | | | | | | A common idiom among snprintf callbacks was to copy the unsigned parameter 'size' (or 'len') into a signed variable for further use. Though since snprintf() itself casts it to unsigned and SNPRINTF_BUFFER_SIZE() does not allow it to become negative, this is not needed. Drop the local variable and rename the parameter accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* set_elem: Fix printing of verdict map elementsPhil Sutter2021-03-091-2/+2
| | | | | | | | | | | | | | | | Elements' data was printed as type DATA_VALUE no matter the actual type. For verdicts, this meant no printing at all (because reg->len is either zero or garbage). To fix this, nftnl_set_elem_snprintf_default() needs type info held in struct nftnl_set. Pass it via parameter to that function, make it non-static and call it from nftnl_set_snprintf_default() instead of the generic nftnl_set_elem_snprintf(). This way no changes have to be done to exported functions, also the output type is already defined when nftnl_set_snprintf_default() runs so checking type value again is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add NFTNL_SET_EXPRESSIONSPablo Neira Ayuso2020-12-171-16/+95
| | | | | | | | | | | | | | | | NFTNL_SET_EXPR defines the stateful expression type that this set stores in each element. This provides the set definition in terms of stateful expressions. The expression that is passed via NFNTL_SET_ELEM_EXPR must equal to this set stateful expression type, otherwise the kernel bails out. This patch adds support for the set expression list, which generalizes NFTNL_SET_EXPR. This patch also adds nftnl_set_add_expr() to add new expressions to a set and nftnl_set_elem_expr_foreach() to iterate over the list of expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: support for NFTNL_SET_EXPRPablo Neira Ayuso2020-03-171-0/+27
| | | | | | This patch adds support for the NFTA_SET_EXPR netlink attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Add support for NFTA_SET_DESC_CONCAT attributesStefano Brivio2020-02-051-19/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If NFTNL_SET_DESC_CONCAT data is passed, pass that to the kernel as NFTA_SET_DESC_CONCAT attributes: it describes the length of single concatenated fields, in bytes. Similarly, parse NFTA_SET_DESC_CONCAT attributes if received from the kernel. This is the libnftnl counterpart for nftables patch: src: Add support for NFTNL_SET_DESC_CONCAT v4: - move NFTNL_SET_DESC_CONCAT to the end of enum nftnl_set_attr to avoid ABI breakage (Pablo Neira Ayuso) v3: - use NFTNL_SET_DESC_CONCAT and NFTA_SET_DESC_CONCAT instead of a stand-alone NFTA_SET_SUBKEY attribute (Pablo Neira Ayuso) - pass field length in bytes instead of bits, fields would get unnecessarily big otherwise v2: - fixed grammar in commit message - removed copy of array bytes in nftnl_set_nlmsg_build_subkey_payload(), we're simply passing values to htonl() (Phil Sutter) Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Deprecate untyped data settersPhil Sutter2019-10-311-1/+1
| | | | | | | | | These functions make assumptions on size of passed data pointer and therefore tend to hide programming mistakes. Instead either one of the type-specific setters or the generic *_set_data() setter should be used. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Don't bypass checks in nftnl_set_set_u{32,64}()Phil Sutter2019-10-151-2/+2
| | | | | | | | | By calling nftnl_set_set(), any data size checks are effectively bypassed. Better call nftnl_set_set_data() directly, passing the real size for validation. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Export nftnl_set_list_lookup_byname()Phil Sutter2019-10-101-19/+34
| | | | | | | | | Rename and optimize internal function nftnl_set_lookup() for external use. Just like with nftnl_chain_list, use a hash table for fast set name lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-191-13/+13
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-151-259/+1
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix parsing for set handle attributesHarsha Sharma2018-03-111-1/+1
| | | | | | | Correct one typo for parsing set handles. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parse new handle attribute for setsHarsha Sharma2018-03-051-0/+18
| | | | | | | This patch adds code to allocate set handles and delete sets via set handle. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
* src: Fix exporting symbols with clangArmin K2017-12-301-32/+34
| | | | | | | | | | | | | When EXPORT_SYMBOL is located after function definition, clang won't properly export the function, resulting in a library with no symbols when built with clang. Based on libmnl commit dcdb47373a37 ("Move declaration of visibility attributes before definition.") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1205 Signed-off-by: Armin K <krejzi@email.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not nul-terminate internal helper functionsPablo Neira Ayuso2017-10-041-3/+0
| | | | | | | Public API already does this for us, no need to do this again from internal helper functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: no need to nul-terminate buffer for nftnl_fprintf() callsPablo Neira Ayuso2017-10-041-3/+0
| | | | | | | This function bails out with -1 if we cannot print, and this buffer is internally allocated. No need for this overly deffensive initialization. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Buffer is null terminated.Varsha Rao2017-09-271-0/+9
| | | | | | | In _snprintf() functions definition the buffer is null terminated. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Change parameters of SNPRINTF_BUFFER_SIZE macro.Varsha Rao2017-09-271-62/+64
| | | | | | | | | SNPRINTF_BUFFER_SIZE() macro declaration and definition is changed so that it accepts three arguments ret, remain and offset. Parameters size and len are not required instead parameter remain keeps track of available space in the buffer. Signed-off-by: Varsha Rao <rvarsha016@gmail.com>
* set: free user dataEric Leblond2017-07-061-0/+2
| | | | | | | | | | | | This was causing a memory leak when using set. Catched by an ASAN run: ==21004==ERROR: LeakSanitizer: detected memory leaks Direct leak of 12 byte(s) in 2 object(s) allocated from: #0 0x4cde58 in malloc (/usr/local/sbin/nft+0x4cde58) #1 0x7ffff79b8c19 in nftnl_set_set_data /home/eric/git/netfilter/libnftnl/src/set.c:179
* src: get rid of aliases and compatPablo Neira Ayuso2016-12-201-32/+32
| | | | | | | | | | | This machinery was introduced to avoid sudden compilation breakage of old nftables releases. With the upcoming release of 0.7 (and 0.6 which is now 6 months old) this is not required anymore. Moreover, users gain nothing from older releases since they are half-boiled and buggy. So let's get rid of aliases now. Bump LIBVERSION and update map file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add NFTNL_SET_OBJ_TYPE attributePablo Neira Ayuso2016-12-091-0/+27
| | | | | | | | This new attribute specifies the stateful object type this set stores. Similar to data type, but specific to store objects. You must set the NFT_SET_OBJECT flag to use this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove libmxml supportArturo Borrero2016-09-231-190/+4
| | | | | | | | | | | | | | | | | | | This patch removes the libmxml integration in libnftnl, since we have JSON in place and there is no need to support two at the same time. The JSON support is much better, for example libjansson has a better parsing error reporting. Moreover, libmxml 2.10 breaks the integration with libnftnl somehow, as reported in Debian bug #83870 [0]. Also, the XML support inside libnftnl has never been in good shape, with several tiny inconsitencies. [0] https://bugs.debian.org/838370 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix incorrect maximum set description attributePablo Neira Ayuso2016-08-301-1/+1
| | | | | | | Maximum set description attribute is NFTA_SET_DESC_MAX, instead of NFTA_SET_MAX. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Avoid returning uninitialized dataPhil Sutter2016-08-121-1/+1
| | | | | | | | | Although the 'err' pointer should be interesting for users only if the parser returned non-zero, having it point to uninitialized data is generally a bad thing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: prevent memleak in nftnl_jansson_parse_set_info()Phil Sutter2016-08-121-5/+5
| | | | | | | | | During list populating, in error case the function returns without freeing the newly allocated 'elem' object, thereby losing any references to it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Constify iteratorsCarlos Falgueras García2016-08-101-3/+5
| | | | | | | | Iterators do not modify objects which they iterate, so input pointer must be const. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix nftnl_*_get_data() to return the real attribute lengthCarlos Falgueras García2016-07-111-0/+2
| | | | | | | | | | | All getters must set the memory size of the attributes, ie. this includes the nul-termination in strings. For references to opaque objects hidden behind the curtain, report a zero size. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix missing nul-termination in nftnl_*_set_str()Carlos Falgueras García2016-07-061-1/+1
| | | | | | | | The string length must be one character longer to include the nul-termination. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Add new attribute into 'set' to store user dataCarlos Falgueras García2016-07-011-0/+29
| | | | | | | | The new structure 'user' holds a pointer to user data and its length. The kernel must have the flag NFTA_SET_USERDATA to support this feature. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix missing error checking in parser functionsCarlos Falgueras García2016-06-221-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bail out on errors in several nftnl_*_nlmsg_parse() functions. We can overwrite the previous error value, and may execute code which should not. Bad way: int f() { int ret; ret = g(); ret = h(); return ret; } Good way: int f() { int ret; ret = g(); if (ret < 0) return ret; ret = h(); if (ret < 0) return ret; return 0; } Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for flags before releasing attributesPablo Neira Ayuso2016-06-151-6/+8
| | | | | | | Now that unsetters don't set pointers to NULL, check if the attribute is set before trying to release it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify unsettersPablo Neira Ayuso2016-06-151-10/+5
| | | | | | | If the attribute is set as we already check at the beginning of this function, then we can release the object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for strdup() errors from setters and parsersPablo Neira Ayuso2016-06-151-2/+12
| | | | | | And pass up an error to the caller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: return value on setters that internally allocate memoryPablo Neira Ayuso2016-06-151-6/+11
| | | | | | | | So the client can bail out of memory allocation errors. Or in case of daemon, make sure things are left in consistent state before bailing out. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: assert when setting unknown attributesPablo Neira Ayuso2016-06-151-3/+1
| | | | | | | | | | | | If this attribute is not supported by the library, we should rise an assertion so the client knows something is wrong, instead of silently going through. The only case I can think may hit this problem is version mismatch between library and tools. This should not ever really happen, so better bail out from the library itself in this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unnecessary inline in _snprintf functionsPablo Neira Ayuso2016-05-091-3/+2
| | | | | | | These functions are passed as parameter, so we basically get nothing with this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftnl: constify object arguments to various functionsPatrick McHardy2016-05-091-24/+27
| | | | | | | | | flow table support needs constant object arguments to printing functions to avoid ugly casts. While at it, also constify object arguments to message construction, destructor and a few helper functions. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename EXPORT_SYMBOL to EXPORT_SYMBOL_ALIASFlorian Westphal2015-11-241-32/+32
| | | | | | | Future symbols don't need backwards-compat aliases. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of _attr_ infix in new nftnl_ definitionsPablo Neira Ayuso2015-09-071-56/+56
| | | | | | | The function names are already large, trim off the _ATTR_ infix in the attribute definitions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of _ATTR_ infix in new nfntl_ definitionsPablo Neira Ayuso2015-09-071-126/+126
| | | | | | | The constant names are already large, trim off the _ATTR_ infix in the attribute definitions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename nftnl_rule_expr to nftnl_exprPablo Neira Ayuso2015-09-071-2/+2
| | | | | | | Use a shorter name for this, morever this can be used from sets so the _rule_ is misleading. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename existing functions to use the nftnl_ prefixPablo Neira Ayuso2015-09-071-323/+323
| | | | | | | | | So we can use the nft_* prefix anytime soon for our upcoming higher level library. After this patch, the nft_* symbols become an alias of the nftnl_* symbols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce nftnl_* aliases for all existing functionsPablo Neira Ayuso2015-09-021-32/+32
| | | | | | | | | | | This patch introduces the nftnl_ symbols as aliases for the existing nft_ symbols through the EXPORT_SYMBOL(...) macro. We would like to use the nft_* prefix from our upcoming higher level library, meanwhile with this move we avoid that old binaries break because of missing symbol dependencies. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix memory leaks at nft_[object]_nlmsg_parseCarlos Falgueras García2015-08-181-0/+2
| | | | | | | | Free object attributes before overwrite it. Fix 'nlmsg_parse' methods of following objects: 'table', 'chain', 'rule', 'set' and 'set_element'. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: print set elem timeout informationPatrick McHardy2015-04-121-0/+13
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>