summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: queue: allow use of arbitrary queue expressionsFlorian Westphal2021-06-216-25/+93
| | | | | | | | | | | | | | | | | | | | | back in 2016 Liping Zhang added support to kernel and libnftnl to specify a source register containing the queue number to use. This was never added to nft itself, so allow this. On linearization side, check if attached expression is a range. If its not, allocate a new register and set NFTNL_EXPR_QUEUE_SREG_QNUM attribute after generating the lowlevel expressions for the kernel. On delinarization we need to check for presence of NFTNL_EXPR_QUEUE_SREG_QNUM and decode the expression(s) when present. Also need to do postprocessing for STMT_QUEUE so that the protocol context is set correctly, without this only raw payload expressions will be shown (@nh,32,...) instead of 'ip ...'. Next patch adds test cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: new queue flag input formatFlorian Westphal2021-06-214-11/+19
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: add queue_stmt_compatFlorian Westphal2021-06-211-8/+11
| | | | | | | | | | | | | | | | | | | | | Rename existing rules to _compat to make sure old rules using 'queue' statement will work. Next patch adds distinct input format where flags are explicitly provided: queue flags name,<nextflag> num 1 Without this, extension of queue expression to handle arbitrary expression instead of queue number or range results in parser errors. Example: queue num jhash ip saddr mod 4 and 1 bypass will fail because scanner is still in 'ip' state, not 'queue', when "bypass" is read. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add queue expr and flags to queue_stmt_allocFlorian Westphal2021-06-215-22/+25
| | | | | | Preparation patch to avoid too much $<stmt>$ references in the parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: restrict queue num expressivenessFlorian Westphal2021-06-211-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Else we run into trouble once we allow queue num symhash mod 4 and 1 and so on. Example problem: queue num jhash ip saddr mod 4 and 1 bypass This will fail to parse because the scanner is in the wrong state (ip, not queue), so 'bypass' is parsed as a string. Currently, while nft will eat the above just fine (minus 'bypass'), nft rejects this from the evaluation phase with Error: queue number is not constant So seems we are lucky and can restrict the supported expressions to integer and range. Furthermore, the line looks wrong because this statement: queue num jhash ip saddr mod 4 and 1 bypass doesn't specifiy a number, "queue num 4" does, or "queue num 1-2" do. For arbitrary expr support it seems sensible to enforce stricter ordering to avoid any problems with the flags, for example: queue bypass,futurekeyword to jhash ip saddr mod 42 Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix hash expression maxvalFlorian Westphal2021-06-181-2/+6
| | | | | | | | It needs to account for the offset too. Fixes: 9bee0c86f179 ("src: add offset attribute for hash expression") Fixes: d4f9a8fb9e9a ("src: add offset attribute for numgen expression") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: memleak of list of timeout policiesPablo Neira Ayuso2021-06-182-0/+9
| | | | | | | | | | | | Release list of ct timeout policy when object is freed. Direct leak of 160 byte(s) in 2 object(s) allocated from: #0 0x7fc0273ad330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7fc0231377c4 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7fc023137983 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7fc0231f64d6 in nft_parse /home/.../devel/nftables/src/parser_bison.y:4448 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in osf flagsPablo Neira Ayuso2021-06-181-0/+2
| | | | | | Release osf string flag after processing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: memleak when listing ct event rulePablo Neira Ayuso2021-06-181-4/+7
| | | | | | | | | | | | | | | | | | | listing a ruleset containing: ct event set new,related,destroy,label results in memleak: Direct leak of 3672 byte(s) in 27 object(s) allocated from: #0 0x7fa5465c0330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7fa54233772c in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7fa5423378eb in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7fa5422488c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7fa54224fb91 in binop_expr_alloc /home/.../devel/nftables/src/expression.c:698 #5 0x7fa54224ddf8 in bitmask_expr_to_binops /home/.../devel/nftables/src/expression.c:512 #6 0x7fa5423102ca in expr_postprocess /home/.../devel/nftables/src/netlink_delinearize.c:2448 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: memleak in error path of the set to segtree conversionPablo Neira Ayuso2021-06-182-3/+15
| | | | | | | | | | | Release the array of intervals and the segtree in case of error, otherwise these structures and objects are never released: SUMMARY: AddressSanitizer: 2864 byte(s) leaked in 37 allocation(s). Moreover, improve existing a test coverage of this error path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: memleak in string netlink postprocessingPablo Neira Ayuso2021-06-181-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Listing a matching wilcard string results in a memleak: ifname "dummy*" Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f27ba52e330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f27b9e1d434 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f27b9e1d5f3 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7f27b9d2e8c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7f27b9d326e9 in constant_expr_alloc /home/.../devel/nftables/src/expression.c:419 #5 0x7f27b9db9318 in netlink_alloc_value /home/.../devel/nftables/src/netlink.c:390 #6 0x7f27b9de0433 in netlink_parse_cmp /home/.../devel/nftables/src/netlink_delinearize.c:321 #7 0x7f27b9deb025 in netlink_parse_expr /home/.../devel/nftables/src/netlink_delinearize.c:1764 #8 0x7f27b9deb0de in netlink_parse_rule_expr /home/.../devel/nftables/src/netlink_delinearize.c:1776 #9 0x7f27b860af7b in nftnl_expr_foreach /home/.../devel/libnftnl/src/rule.c:690 Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f27ba52e330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f27b9e1d434 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f27b96975c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: memleak in binary operation transfer to RHSPablo Neira Ayuso2021-06-181-2/+0
| | | | | | | | | | | | | | | | | | | | | | | Remove useless reference count grabbing on constant expression that results in a memleak. Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f4cd54af330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f4cd4d9e489 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f4cd4d9e648 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7f4cd4caf8c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7f4cd4cb36e9 in constant_expr_alloc /home/.../devel/nftables/src/expression.c:419 #5 0x7f4cd4ca714c in integer_type_parse /home/.../devel/nftables/src/datatype.c:397 #6 0x7f4cd4ca4bee in symbolic_constant_parse /home/.../devel/nftables/src/datatype.c:165 #7 0x7f4cd4ca4572 in symbol_parse /home/.../devel/nftables/src/datatype.c:135 #8 0x7f4cd4cc333f in expr_evaluate_symbol /home/.../devel/nftables/src/evaluate.c:251 [...] Indirect leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f4cd54af330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f4cd4d9e489 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f4cd46185c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: unbreak verdict maps with implicit map with interval concatenationsPablo Neira Ayuso2021-06-187-0/+100
| | | | | | | | | | | Verdict maps in combination with interval concatenations are broken, e.g. # nft add rule x y tcp dport . ip saddr vmap { 1025-65535 . 192.168.10.2 : accept } Retrieve the concatenation field length and count from the map->map expressions that represents the key of the implicit map. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not skip mapping elementsPablo Neira Ayuso2021-06-181-7/+19
| | | | | | | | | | | Set element keys are of EXPR_SET_ELEM expression type, however, mappings use the EXPR_MAPPING expression to wrap the EXPR_SET_ELEM key (mapping->left) and the corresponding data (mapping->right). This patch adds a wrapper function to fetch the EXPR_SET_ELEM expression from the key in case of mappings and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a icmp-reply only and icmpv6 id test casesFlorian Westphal2021-06-176-0/+123
| | | | | | | | | | | | | | | | | | Check that nft doesn't remove the dependency in these cases: icmp type echo-reply icmp id 1 ("icmp id" matches both echo request and reply). Add icmpv6 test cases. These fail without the previous patches: add rule ip6 test-ip6 input icmpv6 id 1: 'icmpv6 id 1' mismatches 'icmpv6 type { echo-request, echo-reply} icmpv6 parameter-problem 65536/16' add rule ip6 test-ip6 input icmpv6 type echo-reply icmpv6 id 65534': 'icmpv6 type echo-reply icmpv6 id 65534' mismatches 'icmpv6 type echo-reply @th,32,16 65534' Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: do not remove icmp echo dependencyFlorian Westphal2021-06-171-24/+37
| | | | | | | | | | | "icmp type echo-request icmp id 2" and "icmp id 2" are not the same, the latter gains an implicit dependency on both echo-request and echo-reply. Change payload dependency tracking to not store dependency in case the value type is ICMP(6)_ECHO(REPLY). Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: add missing icmp id/sequence supportFlorian Westphal2021-06-171-3/+65
| | | | | | | | | | | | | | | | | | | | | | Pablo reports following input and output: in: icmpv6 id 1 out: icmpv6 type { echo-request, echo-reply } icmpv6 parameter-problem 65536/16 Reason is that icmp fields overlap, decoding of the correct name requires check of the icmpv6 type. This only works for equality tests, for instance in: icmpv6 type echo-request icmpv6 id 1 will be listed as "icmpv6 id 1" (which is not correct either, since the input only matches on echo-request). with this patch, output of 'icmpv6 id 1' is icmpv6 type { echo-request, echo-reply } icmpv6 id 1 The second problem, the removal of a single check (request OR reply), is resolved in the followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cover split chain reference across tablesPablo Neira Ayuso2021-06-142-0/+26
| | | | | | | | Add a test to cover table T1 containing the definition of chain C1, and table T1' (actually the same definition as T1) that contains a (jump) reference to chain C1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: extend connlimit testPablo Neira Ayuso2021-06-141-0/+12
| | | | | | | | | Extend existing test to add a ct count expression in the set definition. This test cover the upstream kernel fix ad9f151e560b ("netfilter: nf_tables: initialize set before expression setup"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace opencoded NFT_SET_ANONYMOUS set flag check by set_is_anonymous()Pablo Neira Ayuso2021-06-144-4/+4
| | | | | | | | Use set_is_anonymous() to check for the NFT_SET_ANONYMOUS set flag instead. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xzalloc_array() and use it to allocate the expression hashtablePablo Neira Ayuso2021-06-143-1/+12
| | | | | | | | | | | Otherwise, assertion to ensure that no colission occur is hit due to uninitialized hashtable memory area: nft: netlink_delinearize.c:1741: expr_handler_init: Assertion `expr_handle_ht[hash] == NULL' failed. Fixes: c4058f96c6a5 ("netlink_delinearize: Fix suspicious calloc() call") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add set to cache oncePablo Neira Ayuso2021-06-141-3/+0
| | | | | | | | | | | | | | 67d3969a7244 ("evaluate: add set to the cache") re-adds the set into the cache again. This bug was hidden behind 5ec5c706d993 ("cache: add hashtable cache for table") which broke set_evaluate() for anonymous sets. Phil reported a gcc compilation warning which uncovered this problem. Reported-by: Phil Sutter <phil@nwl.cc> Fixes: 67d3969a7244 ("evaluate: add set to the cache") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: tests: add missing concat test caseFlorian Westphal2021-06-141-0/+39
| | | | | | | | | | Fix ERROR: did not find JSON equivalent for rule 'ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }' when running nft-test.py -j Fixes: bbcc5eda7e58 ("evaluate: restore interval + concatenation in anonymous set") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: tests: fix vlan.t cfi test caseFlorian Westphal2021-06-141-1/+29
| | | | | | | | | | | The test case exists twice, once with new dei, once with old 'cfi', so we need to retain the cfi one in the json file too. Else we get: WARNING: line 2: Wrote JSON equivalent for rule vlan id 4094 vlan dei 1 Fixes: d2fba515ff94 ("src: add vlan dei") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: Fix for potential off-by-one in cmd_add_loc()Phil Sutter2021-06-141-1/+1
| | | | | | | | Using num_attrs as index means it must be at max one less than the array's size at function start. Fixes: 27362a5bfa433 ("rule: larger number of error locations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_delinearize: Fix suspicious calloc() callPhil Sutter2021-06-141-3/+2
| | | | | | | | Parameter passed to sizeof() was wrong. While being at it, replace the whole call with xmalloc_array() which takes care of error checking. Fixes: 913979f882d13 ("src: add expression handler hashtable") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_obj()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'obj' has to be freed before returning to caller. Fixes: 293c9b114faef ("src: add comment support for objects") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_table()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'table' has to be freed before returning to caller. Fixes: c156232a530b3 ("src: add comment support when adding tables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_chain()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'chain' has to be freed before returning to caller. Fixes: 702ac2b72c0e8 ("src: add comment support for chains") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_set()Phil Sutter2021-06-141-2/+2
| | | | | | | | Duplicate string 'comment' later when the function does not fail anymore. Fixes: 0864c2d49ee8a ("src: add comment support for set declarations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Drop pointless assignment in exthdr_expr_json()Phil Sutter2021-06-141-1/+0
| | | | | | | The updated value of 'is_exists' is no longer read at this point. Fixes: cb21869649208 ("json: tcp: add raw tcp option match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: Mark fall through case in str2hooknum()Phil Sutter2021-06-141-0/+1
| | | | | | | It is certainly intentional, so just mark it as such. Fixes: b4775dec9f80b ("src: ingress inet support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Fix for memleak in tcp option error pathPhil Sutter2021-06-141-3/+3
| | | | | | | | If 'kind' value is invalid, the function returned without freeing 'expr' first. Fix this by performing the check before allocation. Fixes: cb21869649208 ("json: tcp: add raw tcp option match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_bison: Fix for implicit declaration of isalnumPhil Sutter2021-06-141-0/+1
| | | | | | | Have to include ctype.h to make it known. Fixes: e76bb37940181 ("src: allow for variables in the log prefix string") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: restore interval + concatenation in anonymous setPablo Neira Ayuso2021-06-116-8/+53
| | | | | | | | | | | | | | | | | | | Perform the table and set lookup only for non-anonymous sets, where the incremental cache update is required. The problem fixed by 7aa08d45031e ("evaluate: Perform set evaluation on implicitly declared (anonymous) sets") resurrected after the cache rework. # nft add rule x y tcp sport . tcp dport vmap { ssh . 0-65535 : accept, 0-65535 . ssh : accept } BUG: invalid range expression type concat nft: expression.c:1422: range_expr_value_low: Assertion `0' failed. Abort Add a test case to make sure this does not happen again. Fixes: 5ec5c706d993 ("cache: add hashtable cache for table") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add vlan deiPablo Neira Ayuso2021-06-119-41/+71
| | | | | | | | | | the CFI bit has been repurposed as DEI "Drop Eligible Indicator" since 802.1Q-2011. The vlan cfi field is still retained for compatibility. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1516 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add LISTING sectionFlorian Westphal2021-06-091-0/+11
| | | | | | | mention various 'nft list' options, such as secmarks, flow tables, and so on. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add support for base hook dumpingFlorian Westphal2021-06-099-4/+457
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Example output: $ nft list hook ip input family ip hook input { +0000000000 nft_do_chain_inet [nf_tables] # nft table ip filter chain input +0000000010 nft_do_chain_inet [nf_tables] # nft table ip firewalld chain filter_INPUT +0000000100 nf_nat_ipv4_local_in [nf_nat] +2147483647 ipv4_confirm [nf_conntrack] } $ nft list hooks netdev type ingress device lo family netdev hook ingress device lo { +0000000000 nft_do_chain_netdev [nf_tables] } $ nft list hooks inet family ip hook prerouting { -0000000400 ipv4_conntrack_defrag [nf_defrag_ipv4] -0000000300 iptable_raw_hook [iptable_raw] -0000000290 nft_do_chain_inet [nf_tables] # nft table ip firewalld chain raw_PREROUTING -0000000200 ipv4_conntrack_in [nf_conntrack] -0000000140 nft_do_chain_inet [nf_tables] # nft table ip firewalld chain mangle_PREROUTING -0000000100 nf_nat_ipv4_pre_routing [nf_nat] } ... 'nft list hooks' will display everyting except the netdev family via successive dump request for all family:hook combinations. Signed-off-by: Florian Westphal <fw@strlen.de>
* scanner: add list cmd parser scopeFlorian Westphal2021-06-093-7/+12
| | | | | | | | | | Followup patch will add new 'hooks' keyword for nft list hooks Add a scope for list to avoid exposure of the new keyword in nft rulesets. Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: Fix segfault when restoring a huge interval setPhil Sutter2021-06-091-4/+6
| | | | | | | | | | | | Restoring a set of IPv4 prefixes with about 1.1M elements crashes nft as set_to_segtree() exhausts the stack. Prevent this by allocating the pointer array on heap and make sure it is freed before returning to caller. With this patch in place, restoring said set succeeds with allocation of about 3GB of memory, according to valgrind. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print warnings to stderr rather than stdoutKerin Millar2021-06-091-3/+5
| | | | | | | | Unsurprisingly, printing warnings to stdout results in malformed JSON. Signed-off-by: Kerin Millar <kfm@plushkava.net> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1511 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: quick sort array of devicesPablo Neira Ayuso2021-06-081-0/+18
| | | | | | | Provide an ordered list of devices for (netdev) chain and flowtable. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1525 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: check for table mismatch first in error reportingPablo Neira Ayuso2021-06-081-14/+57
| | | | | | | | | | | | | | | | | | | | | | | | | If the fuzzy lookup provides a table, check if it is an inexact matching, in that case, report that the table does not exist and provide a mispelling suggestion for the non-existing table. Initialize table to NULL since the fuzzy lookup might return no table at all. This patch fixes misleading error reporting: # nft delete chain xxx yyy Error: No such file or directory; did you mean chain ‘B’ in table ip ‘A’? delete chain xxx yyy ^^^ This refers to table 'xxx' but the suggestion refers to the chain instead. Therefore, if the fuzzy lookup provides an exact matching table, then do the fuzzy lookup for the next non-existing object (either chain, set, ...). Fixes: 3a0e07106f66 ("src: combine extended netlink error reporting with mispelling support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: rework CMD_OBJ_SETELEMS logicPablo Neira Ayuso2021-06-072-19/+40
| | | | | | | | | | | | | | | | | | | Do not clone the set and zap the elements during the set and map expansion to the CMD_OBJ_SETELEMS command. Instead, update the CMD_OBJ_SET command to add the set to the kernel (without elements) and let CMD_OBJ_SETELEMS add the elements. The CMD_OBJ_SET command calls set_to_intervals() to update set->init->size (NFTNL_SET_DESC_SIZE) before adding the set to the kernel. Updating the set size from do_add_setelems() comes too late, it might result in spurious ENFILE errors for interval sets. Moreover, skip CMD_OBJ_SETELEMS if the set definition specifies no elements. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1500 Fixes: c9eae091983a ("src: add CMD_OBJ_SETELEMS") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for removal of anon sets with only a single elementFlorian Westphal2021-06-074-1/+64
| | | | | | | | | | | | | Also add a few examples that should not be changed: - anon set with 2 elements - anon map with 1 element - anon set with a concatenation The latter could be done with cmp but this currently triggers 'Error: Use concatenations with sets and maps, not singleton values' after removing the anon set. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: remove anon sets with exactly one elementFlorian Westphal2021-06-071-2/+19
| | | | | | | | | | | | | | | | | | | | Auto-replace lookups in single-element anon sets with a standard compare. 'add rule foo bar meta iif { "lo" }' gets replaced with 'add rule foo bar meta iif "lo"'. The former is a set lookup, the latter is a comparision. Comparisions are faster for the one-element case. Only prefixes, ranges and values are handled at this time. Anonymous maps are left alone, same for concatenations. Concatenations could be handled, but it would require more work: the concatenation would have to be replaced with a singleton value. Evaluation step rejects concat RHS on a relational expression. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: remove redundant test casesFlorian Westphal2021-06-0769-5220/+0
| | | | | | | | | | | | | Check for ... 23-42 ... ... { 23-42 } ... and remove the latter. Followup patch will translate the former to the latter during evaluation step to avoid the unneded anon set. A separate test case will be added that checks for such rewrites. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: ct: prefer normal cmpFlorian Westphal2021-06-073-12/+5
| | | | | | | | Followup patch will replace the { 1.2.3.4 } with single cmp, so this will cause an error when the netlink dump gets compared. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: missing catchall expression stub with ./configure --without-jsonPablo Neira Ayuso2021-06-041-0/+1
| | | | | | | | | | | set_elem_catchall_expr_json undeclared here (not in a function); did you mean 'set_elem_catchall_expr_ops'? 1344 | .json = set_elem_catchall_expr_json, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ | set_elem_catchall_expr_ops https://bugzilla.netfilter.org/show_bug.cgi?id=1542 Fixes: 5c2c6b092860 json: catchall element support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update netdev reject test fileFlorian Westphal2021-06-041-45/+21
| | | | | | | | netdev/reject.t throws a couple of WARNINGs. For some reason this file wasn't updated after the reject statement json output was changed to keep the icmp type/protocol. Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-14 20:16:21 +0000