summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* expr: queue: Do not print unset values in jsonAna Rey2014-06-161-17/+29
| | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This json file is gotten for a queue: {"expr":[{"type":"queue","num":0,"total":1,"flags":0}]} Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Do not print unset values in xmlAna Rey2014-06-161-14/+25
| | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This xml file is gotten for a queue: [...] <expr type="queue"> <num>0</num> <total>1</total> <flags>0</flags> </expr> [...] Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Use nft_rule_expr_* in the xmlAna Rey2014-06-161-10/+7
| | | | | | | Code refactoring to use nft_rule_expr_* in parse xml functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: Add nft_rule_expr_queue_snprinf_* functionsAna Rey2014-06-161-31/+51
| | | | | | | | | | | | | | | Code refactoring in nft_rule_expr_queue_snprinf functions. This patch adds three new functions: * nft_rule_expr_queue_snprinf_default * nft_rule_expr_queue_snprinf_xml * nft_rule_expr_queue_snprinf_json Moreover, I have deleted an unnecesary whitespace as the CodingStyle recommends. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Free memory in the same function that is reservedAna Rey2014-06-111-11/+10
| | | | | | | Free memory in the same function that is reserved. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in jsonAna Rey2014-06-113-67/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This json file is gotten for a set: { "set": { "name": "mi6set3", "table": "test6", "flags": "0", "family": "unknown", "key_type": "0", "key_len": "0", "set_elem": [ { "flags": "0", "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" Now, This json file is gotten for a set without unset elements. { "set": { "name": "mi6set3", "table": "test6", "family": "unknown", "set_elem": [ { "key": { "data_reg": { "type": "value", "len": "16", "data0": "0x000080fe", "data1": "0x00000000", "data2": "0xffb30202", "data3": "0x89001efe" [ Note: These fields are unset when they are obtained from the set element information --pablo. ] Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Do not print unset values in xmlAna Rey2014-06-112-46/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. This xml file is gotten for a set: <set> <family>unknown</family> <table>test</table> <name>miset</name> <flags>0</flags> <key_type>0</key_type> <key_len>0</key_len> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> <set_elem> <flags>0</flags> <key> <data_reg type="value"> <len>4</len> <data0>0x0501a8c0</data0> </data_reg> </key> </set_elem> </set> Now, this xml file is gotten without unset values: <set> <family>unknown</family> <table>test</table> <name>miset</name> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x00000002</data0> </data_reg> </key> </set_elem> <set_elem> <key> <data_reg type="value"> <len>4</len> <data0>0x0401a8c0</data0> </data_reg> </key> </set_elem> </set> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* common: homogeneous error message in nft_parse_perror()Pablo Neira Ayuso2014-06-111-7/+7
| | | | | | | | The user-specified message should be used even if the error type is unspecified. Moreover, make the output error message homogeneous. Sometimes is was including a space before the ':' separator. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-112-35/+21
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: reject: Do not print unset values in jsonAna Rey2014-06-051-11/+20
| | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. If It uses this rule: nft add rule ip test output input It gets this json file: [...] "expr":[{"type":"reject","type":0,"code":0}]} Now, That rule creates this json file without null values: [...] "expr":[{"type":"reject"}]} Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: reject: Convert the type of a variableAna Rey2014-06-051-1/+1
| | | | | | | Convert the type of a variable from uint16_t to uint8_t. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: reject: Do not print unset values in xmlAna Rey2014-06-051-9/+17
| | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. If we used this rule: nft add rule ip test output reject It gets this xml file: [...] <expr type="reject"> <type>0</type> <code>0</code> </expr> </rule></nftables> Now, That rule creates this xml file without null values: [...] <expr type="reject"> </expr> </rule></nftables> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: reject: Use nft_rule_expr_set_* in the xmlAna Rey2014-06-051-9/+6
| | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com>
* expr: reject: Add nft_rule_expr_reject_snprinf_* functionsAna Rey2014-06-051-10/+32
| | | | | | | | | | | | Code refactoring in nft_rule_expr_reject_snprinf functions. This process adds three new functions: * nft_rule_expr_reject_snprinf_default * nft_rule_expr_reject_snprinf_xml * nft_rule_expr_reject_snprinf_json Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: Do not print unset values in jsonAna Rey2014-06-052-22/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. Also, It fixes an unnecessary comma after key-value pair type. This comma is not necessary if there is not more key-value pairs in this expr. Example: "expr":[{"type":"log"}] If It uses this rule: nft add rule ip test output log It gets this json file: [...] {"expr":[{"type":"log","prefix":"(null)","group":0,"snaplen":0,"qthreshold":0}]} [...] Now, That rule creates this json file without null values: {"expr":[{"type":"log"}]} Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: Do not print unset values in xmlAna Rey2014-06-051-18/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It changes the parse and the snprint functions to omit unset values. If we used this rule: nft add rule ip test output log We got this xml file: <rule><family>ip</family> <table>test</table> <chain>output</chain> <handle>88</handle> <expr type="log"> <prefix>(null)</prefix> <group>0</group> <snaplen>0</snaplen> <qthreshold>0</qthreshold> </expr> </rule> And It was imposible import this file. Now, That rule creates this xml file without null values: <rule><family>ip</family> <table>test</table> <chain>output</chain> <handle>88</handle> <expr type="log"> </expr> </rule> and It's possible import this xml file. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-051-17/+11
| | | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Suggested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: Rename variables in nft_rule_expr_log_json_parse functionsAna Rey2014-06-051-5/+5
| | | | | | | Renames some variables for code readability reasons. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: Code refactoring in nft_rule_expr_log_snprintfAna Rey2014-05-291-18/+40
| | | | | | | | | | | This process adds three new functions: * nft_rule_expr_log_snprintf_default * nft_rule_expr_log_snprintf_xml * nft_rule_expr_log_snprintf_json Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add set ID supportPablo Neira Ayuso2014-05-194-0/+37
| | | | | | | Add the set ID (u32) which allows us to uniquely identify the set in the batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: synchronize nf_tables.h with nftables treePablo Neira Ayuso2014-05-191-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: fix buffer reallocation of nft_fprinft()Arturo Borrero2014-05-131-3/+10
| | | | | | | | | | | | | | | | When _snprintf() reports it would print n characters, that n doesn't include the trailing \0 that snprintf adds. Thus, we need to [re]allocate n+1 characters. While at it, change the reallocation trigger. If the length of the buffer we used is equals to the expanded string length, the output has been truncated. In other words, if ret == bufsiz, then the trailing \0 is missing. Also, check if _snprintf() returned < 0, which means an error ocurred. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* internal: fix SNPRINTF_BUFFER_SIZE macroArturo Borrero2014-05-131-2/+4
| | | | | | | | | | | | | | | | | | | | | We need to store in 'offset' the complete amount of characters as returned from _snprintf. The value means how many characters long needs the buffer to be in order to store the corresponding string expansion. Before this patch, in cases where the buffer is smaller than the expansion, then ret > len, and therefore ret = len. So when incrementing offset, we do it with a wrong value. All previous versions of libnftnl are unable to handle this situations: small buffers (or long string expansion). BTW, if a caller must reallocate a buffer to the returned value of snprintf, it should be ret + 1. While at it, let's add a check to know if the last snprintf call failed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* data_reg: fix bad buffer size boundsArturo Borrero2014-05-071-5/+5
| | | | | | | | | | These calls need to use the new buffer size, instead of the size that the buffer originally had. Bugs introduced by myself at dec68741 [data_reg: fix verdict format approach]. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: fix erroneous call to snprintfArturo Borrero2014-05-071-1/+1
| | | | | | This snprintf call is taking an erroneous value for size. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* common: fix unconditional output of event wrapping stuffArturo Borrero2014-04-281-0/+3
| | | | | | | | | We can't unconditionally print out these strings. Before this patch, objects being printed will be treated as an 'unkown' event. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flag to add event wrapping in output functionsArturo Borrero2014-04-268-34/+218
| | | | | | | | | | | | | | This patch uses the flag option of each output function to print an event wrapper string in each object. In order to use this functionality, the caller must pass the corresponding flags: NFT_OF_EVENT_NEW / NFT_OF_EVENT_DEL. (I have slightly refactorized the original code to add the xml/json header and footer --pablo). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-241-1/+3
| | | | | | | | | Add support for dedicated bridge meta key, related to device names: - NFT_META_BRI_IIFNAME - NFT_META_BRI_OIFNAME Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* lookup: Fix an invalid readAna Rey2014-04-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports the following invalid read: $ sudo valgrind ./nft-parsing-test -f ../jsonfiles/30-rule-lookup.json ==26664== Memcheck, a memory error detector ==26664== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==26664== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info ==26664== Command: ./nft-parsing-test -f ../jsonfiles/30-rule-lookup.json ==26664== ==26664== Invalid read of size 8 ==26664== at 0x4E45490: nft_rule_expr_lookup_set (lookup.c:50) ==26664== by 0x4E40B04: nft_rule_expr_set (expr.c:73) ==26664== by 0x4E44FFF: nft_rule_expr_lookup_json_parse (lookup.c:157) ==26664== by 0x4E408CD: nft_jansson_expr_parse (jansson.c:206) ==26664== by 0x4E3B719: nft_jansson_parse_rule (rule.c:606) ==26664== by 0x4E3F005: nft_ruleset_do_parse (ruleset.c:312) ==26664== by 0x401479: test_json (nft-parsing-test.c:129) ==26664== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==26664== by 0x400EBB: main (nft-parsing-test.c:332) ==26664== Address 0x5c34d40 is 0 bytes inside a block of size 5 alloc'd ==26664== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==26664== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== ==26664== Invalid read of size 8 ==26664== at 0x4E45497: nft_rule_expr_lookup_set (lookup.c:50) ==26664== by 0x4E40B04: nft_rule_expr_set (expr.c:73) ==26664== by 0x4E44FFF: nft_rule_expr_lookup_json_parse (lookup.c:157) ==26664== by 0x4E408CD: nft_jansson_expr_parse (jansson.c:206) ==26664== by 0x4E3B719: nft_jansson_parse_rule (rule.c:606) ==26664== by 0x4E3F005: nft_ruleset_do_parse (ruleset.c:312) ==26664== by 0x401479: test_json (nft-parsing-test.c:129) ==26664== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==26664== by 0x400EBB: main (nft-parsing-test.c:332) ==26664== Address 0x5c34d48 is 3 bytes after a block of size 5 alloc'd ==26664== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==26664== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26664== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) Signed-off-by: Ana Rey <anarey@gmail.com>
* set-elem: fix a memory leakAna Rey2014-04-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports the following memory leak: valgrind --leak-check=full ./nft-parsing-test -f jsonfiles/63-set.json ==7131== HEAP SUMMARY: ==7131== in use at exit: 2 bytes in 1 blocks ==7131== total heap usage: 155 allocs, 154 frees, 6,497 bytes allocated ==7131== ==7131== 2 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==7131== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==7131== by 0x590B829: strdup (strdup.c:42) ==7131== by 0x4E4341A: nft_data_reg_json_parse (data_reg.c:55) ==7131== by 0x4E4093A: nft_jansson_data_reg_parse (jansson.c:231) ==7131== by 0x4E40A1B: nft_jansson_et_elem_parse (jansson.c:257) ==7131== by 0x4E3CECA: nft_jansson_parse_set (set.c:398) ==7131== by 0x4E3EC65: nft_ruleset_do_parse (ruleset.c:263) ==7131== by 0x401479: test_json (nft-parsing-test.c:129) ==7131== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==7131== by 0x400EBB: main (nft-parsing-test.c:332) Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* target, match: Fix an invalid readAna Rey2014-04-142-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Valgrind reports the following invalid read: $ sudo valgrind --leak-check=full ./nft-parsing-test -f ../jsonfiles/35-rule-target.json ( and similar result with jsonfiles/29-rule-match.json file) ==26018== Invalid read of size 8 ==26018== at 0x4E484E3: nft_rule_expr_target_set (target.c:46) ==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73) ==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185) ==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206) ==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606) ==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312) ==26018== by 0x401479: test_json (nft-parsing-test.c:129) ==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==26018== by 0x400EBB: main (nft-parsing-test.c:332) ==26018== Address 0x5c34a60 is 0 bytes inside a block of size 4 alloc'd ==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== ==26018== Invalid read of size 8 ==26018== at 0x4E484ED: nft_rule_expr_target_set (target.c:46) ==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73) ==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185) ==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206) ==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606) ==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312) ==26018== by 0x401479: test_json (nft-parsing-test.c:129) ==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==26018== by 0x400EBB: main (nft-parsing-test.c:332) ==26018== Address 0x5c34a68 is 4 bytes after a block of size 4 alloc'd ==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== ==26018== Invalid read of size 8 ==26018== at 0x4E484F5: nft_rule_expr_target_set (target.c:46) ==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73) ==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185) ==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206) ==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606) ==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312) ==26018== by 0x401479: test_json (nft-parsing-test.c:129) ==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==26018== by 0x400EBB: main (nft-parsing-test.c:332) ==26018== Address 0x5c34a70 is 12 bytes after a block of size 4 alloc'd ==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== ==26018== Invalid read of size 4 ==26018== at 0x4E484FD: nft_rule_expr_target_set (target.c:46) ==26018== by 0x4E40B54: nft_rule_expr_set (expr.c:73) ==26018== by 0x4E48167: nft_rule_expr_target_json_parse (target.c:185) ==26018== by 0x4E4091D: nft_jansson_expr_parse (jansson.c:206) ==26018== by 0x4E3B769: nft_jansson_parse_rule (rule.c:606) ==26018== by 0x4E3F055: nft_ruleset_do_parse (ruleset.c:312) ==26018== by 0x401479: test_json (nft-parsing-test.c:129) ==26018== by 0x4017C2: execute_test_file (nft-parsing-test.c:270) ==26018== by 0x400EBB: main (nft-parsing-test.c:332) ==26018== Address 0x5c34a78 is 20 bytes after a block of size 4 alloc'd ==26018== at 0x4C274A0: malloc (vg_replace_malloc.c:291) ==26018== by 0x56834FF: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5685825: json_string_nocheck (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682A3F: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682C5D: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682ADE: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5682EDD: ??? (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) ==26018== by 0x5683295: json_loadf (in /usr/lib/x86_64-linux-gnu/libjansson.so.4.6.0) Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xml, json: Delete an immediatedate label in xml and json fileAna Rey2014-04-141-10/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It deletes the immediatedata label in the structure of json and xml file. Example of the old structure of xmlfile: <nftables> <rule> <family>ip</family> <table>filter</table> <chain>input</chain> <handle>32</handle> <expr type="immediate"> <dreg>0</dreg> <immediatedata> <data_reg type="verdict"> <verdict>accept</verdict> </data_reg> </immediatedata> </expr> </rule> </nftables> Example of the new structure of xmlfile: <nftables> <rule> <family>ip</family> <table>filter</table> <chain>input</chain> <handle>32</handle> <expr type="immediate"> <dreg>0</dreg> <data_reg type="verdict"> <verdict>accept</verdict> </data_reg> </expr> </rule> </nftables> To generate the new testfiles, It use the option -u of nft-parsing-test script. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xml, json: Delete a cmpdata label in xml and json fileAna Rey2014-04-143-22/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It delete the cmpdata label in the structure of json and xml file. Example of xmlfile: The old structure of xml file: [...] <expr type="cmp"> <sreg>1</sreg> <op>eq</op> <cmpdata> <data_reg type="value"> <len>4</len> <data0>0x0100a8c0</data0> </data_reg> </cmpdata> </expr> The new structure of json file: [...] <expr type="cmp"> <sreg>1</sreg> <op>eq</op> <data_reg type="value"> <len>4</len> <data0>0x0100a8c0</data0> </data_reg> </expr> [...] To generate the new testfiles, It use the option -u of nft-parsing-test script. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix bogus assertion for unset attributesPablo Neira Ayuso2014-04-075-18/+20
| | | | | | | | | | | | If you try to obtain an unset attribute, you hit an assertion error that should not happen. Fix this by checking if the attribute is unset, otherwise skip the assertion checking. Now that we have that nft_assert takes the data parameter, we can also validate if someone is using the setter passing NULL, which is illegal. So let's add an assertion for that as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: parse family from Netlink messageArturo Borrero2014-04-071-0/+3
| | | | | | | Lets obtain the family from the Netlink message. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elems: delete unexisting exported symbolArturo Borrero2014-03-262-2/+0
| | | | | | | There is no function called 'nft_set_elem_nlmsg_parse()' Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: don't enforce attributes when parsingÁlvaro Neira Ayuso2014-03-171-41/+31
| | | | | | | | This change allow us to parser the rule and the kernel bail out if the rule is well-formed. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: don't print unset attributesÁlvaro Neira Ayuso2014-03-171-13/+79
| | | | | | | | | | | | | | | | | | | | We print some attribute that maybe the user hasn't defined for printing. We can't assume that the user want to print some attribute that we have put mandatory in the rules. Example: If we have defined family, the output is like that: {"rule":{"family":"ip","handle":4... <rule><family>ip</family><handle>4</handle>... And this if we unset the family. {"rule":{"handle":4... <rule><handle>4</handle>... Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add NFT_RULE_ATTR_USERDATA supportPablo Neira Ayuso2014-02-271-1/+57
| | | | | | This allows us to manipulate the user data area of the rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check if netlink parsing failsArturo Borrero2014-02-275-10/+30
| | | | | | | | We have to check if mnl_attr_parse() returns an error, which means that it failed to validate and retrieve the attributes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix wrong type in NFT_ATTR_*_FAMILYPablo Neira Ayuso2014-02-273-12/+12
| | | | | | This fixes assertions in the test files. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_attr_{set|get}_data interfacePablo Neira Ayuso2014-02-275-27/+193
| | | | | | | | | | | | This patch adds two functions that allows you to validate the size of the attribute. This new functions provide a replacement for nft_rule_attr_set and nft_rule_attr_get. The data_len parameter was already passed to the {_set|_get} funcion in expressions. For consistency, add nft_rule_expr_{set|get}_data alias. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add assertion infrastructure to validate attribute typesPablo Neira Ayuso2014-02-272-0/+20
| | | | | | | This will be used to validate that the size is correct according to the expected attribute size. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: early attribute type validation in nft_*_attr_setPablo Neira Ayuso2014-02-274-11/+15
| | | | | | | | This allows us to remove the default case in the switch, which show help to spot missing attribute support since gcc will spot a compilation warning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add conntrack label match supportFlorian Westphal2014-02-181-2/+3
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: compile queue expression supportPablo Neira Ayuso2014-02-172-8/+14
| | | | | | | This got lost in 29fd6a1df9 when merging major changes in master to next-3.14. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: print usage counter for base chain via default output as wellPablo Neira Ayuso2014-02-111-4/+4
| | | | | | | For some reason this was only printed in custom chains. Print it for any chain, this is useful for debugging purposes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' into next-3.14Pablo Neira Ayuso2014-02-0334-746/+1275
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch includes changes to adapt this branch to the library rename that happened in the master branch. Conflicts: src/Makefile.am src/expr/cmp.c src/expr/ct.c src/expr/data_reg.c src/expr/meta.c tests/jsonfiles/01-table.json tests/jsonfiles/02-table.json tests/jsonfiles/64-ruleset.json tests/xmlfiles/01-table.xml tests/xmlfiles/02-table.xml
| * build: resolve build failure involving linux/netlink.hJan Engelhardt2014-01-211-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This was seen with a sufficiently-old /usr/include/linux (from Linux 2.6.32). In file included from common.c:10: /usr/include/linux/netlink.h:34: error: expected specifier-qualifier-list before 'sa_family_t' The solution is to include <linux/*> last of all system headers. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * rename library to libnftnllibnftnl-1.0.0Pablo Neira Ayuso2014-01-2030-94/+94
| | | | | | | | | | | | We plan to use this library name for the higher layer library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>