summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/evaluate.c20
-rw-r--r--src/json.c32
-rw-r--r--src/parser_json.c41
-rw-r--r--tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert34
-rw-r--r--tests/shell/testcases/bogons/nft-j-f/concat_is_not_concat_assert39
-rw-r--r--tests/shell/testcases/bogons/nft-j-f/mnl_nft_dev_add_ifname_len_0_assert19
-rw-r--r--tests/shell/testcases/bogons/nft-j-f/null_ingress_type_crash6
7 files changed, 168 insertions, 23 deletions
diff --git a/src/evaluate.c b/src/evaluate.c
index f7e97ef7..c20a1d52 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2361,6 +2361,20 @@ static bool data_mapping_has_interval(struct expr *data)
return false;
}
+static bool elem_data_compatible(const struct expr *set_data,
+ const struct expr *elem_data)
+{
+ if (elem_data->etype == EXPR_RANGE) {
+ /* EXPR_RANGE has invalid_type, use the lhs type.
+ * It should be impossible to have a EXPR_RANGE where
+ * lhs and rhs don't have the same dtype.
+ */
+ return elem_data_compatible(set_data, elem_data->left);
+ }
+
+ return datatype_compatible(set_data->dtype, elem_data->dtype);
+}
+
static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr)
{
struct expr *mapping = *expr;
@@ -2417,6 +2431,12 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr)
"Object mapping data should be a value, not %s",
expr_name(mapping->right));
+ if (set_is_datamap(set->flags) &&
+ !elem_data_compatible(set->data, mapping->right))
+ return expr_error(ctx->msgs, mapping->right,
+ "Element mapping mismatches map definition, expected %s, not '%s'",
+ set->data->dtype->desc, mapping->right->dtype->desc);
+
mapping->flags |= EXPR_F_CONSTANT;
return 0;
}
diff --git a/src/json.c b/src/json.c
index 5d34b27e..977f5566 100644
--- a/src/json.c
+++ b/src/json.c
@@ -294,8 +294,7 @@ static json_t *rule_print_json(struct output_ctx *octx,
static json_t *chain_print_json(const struct chain *chain)
{
- json_t *root, *tmp, *devs = NULL;
- int priority, policy, i;
+ json_t *root;
root = nft_json_pack("{s:s, s:s, s:s, s:I}",
"family", family2str(chain->handle.family),
@@ -307,8 +306,12 @@ static json_t *chain_print_json(const struct chain *chain)
json_object_set_new(root, "comment", json_string(chain->comment));
if (chain->flags & CHAIN_F_BASECHAIN) {
- mpz_export_data(&priority, chain->priority.expr->value,
- BYTEORDER_HOST_ENDIAN, sizeof(int));
+ json_t *tmp = NULL, *devs = NULL;
+ int priority = 0, policy, i;
+
+ if (chain->priority.expr)
+ mpz_export_data(&priority, chain->priority.expr->value,
+ BYTEORDER_HOST_ENDIAN, sizeof(int));
if (chain->policy) {
mpz_export_data(&policy, chain->policy->value,
@@ -317,12 +320,15 @@ static json_t *chain_print_json(const struct chain *chain)
policy = NF_ACCEPT;
}
- tmp = nft_json_pack("{s:s, s:s, s:i, s:s}",
- "type", chain->type.str,
- "hook", hooknum2str(chain->handle.family,
- chain->hook.num),
- "prio", priority,
- "policy", chain_policy2str(policy));
+ if (chain->type.str)
+ tmp = nft_json_pack("{s:s, s:s, s:i, s:s}",
+ "type", chain->type.str,
+ "hook", hooknum2str(chain->handle.family,
+ chain->hook.num),
+ "prio", priority,
+ "policy", chain_policy2str(policy));
+ else
+ tmp = NULL;
for (i = 0; i < chain->dev_array_len; i++) {
const char *dev = chain->dev_array[i];
@@ -336,8 +342,10 @@ static json_t *chain_print_json(const struct chain *chain)
if (devs)
json_object_set_new(root, "dev", devs);
- json_object_update(root, tmp);
- json_decref(tmp);
+ if (tmp) {
+ json_object_update(root, tmp);
+ json_decref(tmp);
+ }
}
return nft_json_pack("{s:o}", "chain", root);
diff --git a/src/parser_json.c b/src/parser_json.c
index bd865de5..be0de698 100644
--- a/src/parser_json.c
+++ b/src/parser_json.c
@@ -1286,11 +1286,18 @@ static struct expr *json_parse_binop_expr(struct json_ctx *ctx,
static struct expr *json_check_concat_expr(struct json_ctx *ctx, struct expr *e)
{
+ if (e->etype != EXPR_CONCAT) {
+ json_error(ctx, "Expected concatenation, got %s", expr_name(e));
+ goto err_free;
+ }
+
if (expr_concat(e)->size >= 2)
return e;
json_error(ctx, "Concatenation with %d elements is illegal",
expr_concat(e)->size);
+
+err_free:
expr_free(e);
return NULL;
}
@@ -2952,6 +2959,25 @@ static struct expr *parse_policy(const char *policy)
sizeof(int) * BITS_PER_BYTE, &policy_num);
}
+static struct expr *ifname_expr_alloc(struct json_ctx *ctx,
+ const char *name)
+{
+ size_t length = strlen(name);
+
+ if (length == 0) {
+ json_error(ctx, "empty interface name");
+ return NULL;
+ }
+
+ if (length >= IFNAMSIZ) {
+ json_error(ctx, "Device name %s too long", name);
+ return NULL;
+ }
+
+ return constant_expr_alloc(int_loc, &ifname_type, BYTEORDER_HOST_ENDIAN,
+ length * BITS_PER_BYTE, name);
+}
+
static struct expr *json_parse_devs(struct json_ctx *ctx, json_t *root)
{
struct expr *tmp, *expr = compound_expr_alloc(int_loc, EXPR_LIST);
@@ -2960,15 +2986,12 @@ static struct expr *json_parse_devs(struct json_ctx *ctx, json_t *root)
size_t index;
if (!json_unpack(root, "s", &dev)) {
- if (strlen(dev) >= IFNAMSIZ) {
- json_error(ctx, "Device name %s too long", dev);
+ tmp = ifname_expr_alloc(ctx, dev);
+ if (!tmp) {
expr_free(expr);
return NULL;
}
- tmp = constant_expr_alloc(int_loc, &ifname_type,
- BYTEORDER_HOST_ENDIAN,
- strlen(dev) * BITS_PER_BYTE, dev);
compound_expr_add(expr, tmp);
return expr;
}
@@ -2985,15 +3008,11 @@ static struct expr *json_parse_devs(struct json_ctx *ctx, json_t *root)
return NULL;
}
- if (strlen(dev) >= IFNAMSIZ) {
- json_error(ctx, "Device name %s too long at index %zu", dev, index);
+ tmp = ifname_expr_alloc(ctx, dev);
+ if (!tmp) {
expr_free(expr);
return NULL;
}
-
- tmp = constant_expr_alloc(int_loc, &ifname_type,
- BYTEORDER_HOST_ENDIAN,
- strlen(dev) * BITS_PER_BYTE, dev);
compound_expr_add(expr, tmp);
}
return expr;
diff --git a/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert b/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert
new file mode 100644
index 00000000..5b224f9b
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-j-f/catchall_as_data_element_assert
@@ -0,0 +1,34 @@
+{
+ "nftables": [
+ {
+ "metainfo": {
+ "version": "1.1.1",
+ "release_name": "Commodore Bullmoose #2",
+ "json_schema_version": 1
+ }
+ },
+ {
+ "table": {
+ "family": "ip",
+ "name": "t",
+ "handle": 1
+ }
+ },
+ {
+ "map": {
+ "family": "ip",
+ "name": "m",
+ "table": "t",
+ "type": "ipv4_addr",
+ "handle": 1,
+ "map": "mark",
+ "elem": [
+ [
+ "1.2.3.4",
+ "*"
+ ]
+ ]
+ }
+ }
+ ]
+}
diff --git a/tests/shell/testcases/bogons/nft-j-f/concat_is_not_concat_assert b/tests/shell/testcases/bogons/nft-j-f/concat_is_not_concat_assert
new file mode 100644
index 00000000..bdee0351
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-j-f/concat_is_not_concat_assert
@@ -0,0 +1,39 @@
+{
+ "nftables": [
+ {
+ "metainfo": {
+"ver": "ION",
+ "rame": "RAME",
+ "json_schema_version": 1
+ }
+ },
+ {
+ "table": { "family": "ip", "name": "filter",
+ "le": 0
+ }
+ },
+ {
+ "set": {
+ "family": "ip",
+ "name": "test_set",
+ "table": "filter",
+ "type": [
+ "iface_index", "ether_addr", "ipv4_addr"
+ ],
+ "he": 0,
+ "flags": "interval",
+"elem": [
+ {
+ "elem": {
+ "val": {
+ "concat": [
+ "10.1.2.3"
+ ] },
+ "comment": "90"
+}
+ }
+ ]
+ }
+}
+ ]
+}
diff --git a/tests/shell/testcases/bogons/nft-j-f/mnl_nft_dev_add_ifname_len_0_assert b/tests/shell/testcases/bogons/nft-j-f/mnl_nft_dev_add_ifname_len_0_assert
new file mode 100644
index 00000000..3be394c1
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-j-f/mnl_nft_dev_add_ifname_len_0_assert
@@ -0,0 +1,19 @@
+{
+ "nftables": [
+ {
+ "table": { "family": "netdev", "name": "test", "ha": 0,
+ "flags": "dormant" } },
+{
+ "chain": {
+ "family": "netdev",
+ "table": "test",
+"name": "ingress",
+ "le": 0,
+"dev": "", "ha": 0,
+ "flags": "dormy1", "type": "fi",
+ "hook": "ingress",
+ "prio": 0, "policy": "drop"
+ }
+ }
+ ]
+}
diff --git a/tests/shell/testcases/bogons/nft-j-f/null_ingress_type_crash b/tests/shell/testcases/bogons/nft-j-f/null_ingress_type_crash
new file mode 100644
index 00000000..2ed88af2
--- /dev/null
+++ b/tests/shell/testcases/bogons/nft-j-f/null_ingress_type_crash
@@ -0,0 +1,6 @@
+table netdev filter1 {
+ chain c {
+ devices = { lo }
+ }
+}
+list ruleset
generated by cgit v1.2.3 (git 2.25.0) at 2025-07-22 16:22:07 +0000