summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: Fix sets/reset_command_0 for current kernelsPhil Sutter2023-11-221-8/+2
| | | | | | | | | Since kernel commit 4c90bba60c26 ("netfilter: nf_tables: do not refresh timeout when resetting element"), element reset won't touch expiry anymore. Invert the one check to make sure it remains unaltered, drop the other testing behaviour for per-element timeouts. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: prettify JSON in test output and add helperThomas Haller2023-11-223-0/+38
| | | | | | | | | | | | | | | | | - add helper script "json-pretty.sh" for prettify/format JSON. It uses either `jq` or a `python` fallback. In my tests, they produce the same output, but the output is not guaranteed to be stable. This is mainly for informational purpose. - add a "json-diff-pretty.sh" which prettifies two JSON inputs and shows a diff of them. - in "test-wrapper.sh", after the check for a .json-nft dump fails, also call "json-diff-pretty.sh" and write the output to "ruleset-diff.json.pretty". This is beside "ruleset-diff.json", which contains the original diff. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: sanitize "handle" in JSON outputThomas Haller2023-11-22279-280/+286
| | | | | | | | | The "handle" in JSON output is not stable. Sanitize/normalize to zero. Adjust the sanitize code, and regenerate the .json-nft files. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not allow to restore set element expirationPablo Neira Ayuso2023-11-222-0/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip secmark tests if kernel does not support itPablo Neira Ayuso2023-11-222-0/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split nat inet testsPablo Neira Ayuso2023-11-224-27/+32
| | | | | | Detach nat inet from existing tests not to reduce test coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip nat inet if kernel does not support itPablo Neira Ayuso2023-11-222-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip synproxy test if kernel does not support itPablo Neira Ayuso2023-11-222-0/+11
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: detach synproxy testPablo Neira Ayuso2023-11-224-33/+52
| | | | | | Old kernels do not support synproxy, split existing tests with stateful objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip stateful object updates if unsupportedPablo Neira Ayuso2023-11-222-0/+23
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: connlimit tests requires set expression supportPablo Neira Ayuso2023-11-221-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus error when adding devices to flowtablePablo Neira Ayuso2023-11-222-1/+9
| | | | | | | | | | | | | | | | | | | | | | Bail out if flowtable declaration is missing and no devices are specified. Otherwise, this reports a bogus error when adding new devices to an existing flowtable. # nft -v nftables v1.0.9 (Old Doc Yak #3) # ip link add dummy1 type dummy # ip link set dummy1 up # nft 'create flowtable inet filter f1 { hook ingress priority 0; counter }' # nft 'add flowtable inet filter f1 { devices = { dummy1 } ; }' Error: missing hook and priority in flowtable declaration add flowtable inet filter f1 { devices = { dummy1 } ; } ^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: 5ad475fce5a1 ("evaluate: bail out if new flowtable does not specify hook and priority") Reported-by: Martin Gignac <martin.gignac@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: flush connlimit setsPablo Neira Ayuso2023-11-212-2/+3
| | | | | | | | | | | Restored elements via set declaration are removed almost inmediately by GC, this is causing spurious failures in test runs. Flush sets to ensure dump is always consistent. Still, cover that restoring a set with connlimit elements do not. Fixes: 95d348d55a9e ("tests: shell: extend connlimit test") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip meta time test meta expression lacks supportFlorian Westphal2023-11-212-0/+9
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip maps delete test if dynset lacks delete opFlorian Westphal2023-11-212-0/+14
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip ct expectation test if feature is missingFlorian Westphal2023-11-211-0/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: quote reference to array to iterate over empty stringPablo Neira Ayuso2023-11-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | This patch restores coverage for non-interval set backend. Use "${FLAGS[@]}" in loop, otherwise empty string is skipped in the iteration. This snippet: FLAGS=("") available_flags FLAGS "single" for flags in "${FLAGS[@]}" ; do echo $flags done ... now shows the empty string: # bash test.sh interval Fixes: ed927baa4fd8 ("tests: shell: skip pipapo set backend in transactions/30s-stress") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: adjust add-after-delete flowtable for older kernelsPablo Neira Ayuso2023-11-213-3/+2
| | | | | | | | | | | Remove counter from flowtable, older kernels (<=5.4) do not support this in testcases/flowtable/0013addafterdelete_0 so this bug is still covered. Skip testcases/flowtable/0014addafterdelete_0 if flowtable counter support is not available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix rule replacement with anon setsFlorian Westphal2023-11-201-0/+1
| | | | | | | | | | nft replace rule t c handle 3 'jhash ip protocol . ip saddr mod 170 vmap { 0-94 : goto wan1, 95-169 : goto wan2, 170-269 }"' BUG: unhandled op 2 nft: src/evaluate.c:1748: interval_set_eval: Assertion `0' failed. Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge") Reported-by: Tino Reichardt <milky-netfilter@mcmilk.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip sets/sets_with_ifnames if no pipapo backend is availablePablo Neira Ayuso2023-11-151-0/+2
| | | | | | | | Skip this by now for older kernels until someone detaches the tests that require the pipapo set backend. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: restore pipapo and chain binding coverage in standalone 30s-stressPablo Neira Ayuso2023-11-151-0/+9
| | | | | | | | | | | | | | | | | | Do not disable pipapo and chain binding coverage for standalone runs by default. Instead, turn them on by default and allow users to disable them through: # export NFT_TEST_HAVE_chain_binding=n; bash tests/shell/testcases/transactions/30s-stress 3600 ... running standalone with: NFT_TEST_HAVE_chain_binding=n NFT_TEST_HAVE_pipapo=y given feature detection is not available in this case, thus, user has to provide an explicit hint on what this kernel supports. Fixes: c5b5b1044fdd ("tests/shell: add feature probing via "features/*.nft" files") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo set backend in transactions/30s-stressPablo Neira Ayuso2023-11-151-7/+44
| | | | | | Skip tests with concatenations and intervals if kernel does not support it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support flowtable with no devicesPablo Neira Ayuso2023-11-152-0/+10
| | | | | | | | Originally, flowtables required devices in place to work, this was later relaxed to allow flowtable with no initial devices, see 05abe4456fa3 ("netfilter: nf_tables: allow to register flowtable with no devices"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support flowtable counterPablo Neira Ayuso2023-11-152-0/+18
| | | | | | | Check if kernel provides flowtable counter supports which is available since 53c2b2899af7 ("netfilter: flowtable: add counter support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tools: check for consistency of .json-nft dumps in "check-tree.sh"Thomas Haller2023-11-151-1/+20
| | | | | | | | | | | | | | | | Add checks for the newly introduced .json-nft dump files. Optimally, every test that has a .nft dump should also have a .json-nft dump, and vice versa. However, currently some JSON tests fail to validate, and are missing. Only flag those missing files as warning, without failing the script. The reason to warn about this, is that we really should fix those tests, and having a annoying warning increases the pressure and makes it discoverable. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tools: check more strictly for bash shebang in "check-tree.sh"Thomas Haller2023-11-151-2/+7
| | | | | | | | | | | | | | | | | There is no problem in principle to allow any executable/shebang. However, it also not clear why we would want to use anything except bash. Unless we have a good use case, check and reject anything else. Also not that `./tests/shell/run-tests.sh -x` only works if the shebang is either exactly "#!/bin/bash" or "#!/bin/bash -e". While it probably could be made work with other shebangs, the simpler thing is to just use bash consistently. Just check that they are all bash scripts. If there ever is a use-case, we can always adjust this check. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tools: simplify error handling in "check-tree.sh" by adding msg_err()/msg_warn()Thomas Haller2023-11-151-17/+20
| | | | | | | | | | | | msg_err() also sets EXIT_CODE=, so we don't have to duplicate this. Also add msg_warn() to print non-fatal warnings. Will be used in the future. As "check-tree.sh" tests the consistency of the source tree, a warning only makes sense to point something out that really should be fixed, but is not yet. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add JSON dump filesThomas Haller2023-11-15339-0/+339
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Generate and add ".json-nft" files. These files contain the output of `nft -j list ruleset` after the test. Also, "test-wrapper.sh" will compare the current ruleset against the ".json-nft" files and test them with "nft -j --check -f $FILE`. These are useful extra tests, that we almost get for free. Note that for some JSON dumps, `nft -f --check` fails (or prints something). For those tests no *.json-nft file is added. The bugs needs to be fixed first. An example of such an issue is: $ DUMPGEN=all ./tests/shell/run-tests.sh tests/shell/testcases/maps/nat_addr_port which gives a file "rc-failed-chkdump" with Command `./tests/shell/../../src/nft -j --check -f "tests/shell/testcases/maps/dumps/nat_addr_port.json-nft"` failed >>>> internal:0:0-0: Error: Invalid map type 'ipv4_addr . inet_service'. internal:0:0-0: Error: Parsing command array at index 3 failed. internal:0:0-0: Error: unqualified type integer specified in map definition. Try "typeof expression" instead of "type datatype". <<<< Tests like "tests/shell/testcases/nft-f/0012different_defines_0" and "tests/shell/testcases/nft-f/0024priority_0" also don't get a .json-nft dump yet, because their output is not stable. That needs fixing too. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: check and generate JSON dump filesThomas Haller2023-11-153-39/+138
| | | | | | | | | | | | | | | | | | | | | | The rules after a successful test are good opportunity to test `nft -j list ruleset` and `nft -j --check`. This quite possibly touches code paths that are not hit by other tests yet. The only downside is the increase of the test runtime (which seems negligible, given the benefits of increasing test coverage). Future commits will generate and commit those ".json-nft" dump files. "DUMPGEN=y" will, like before, regenerate only the existing "*.{nodump,nft,json-nft}" files (unless a test has none of the 3 files, in which case they are all generated and the user is suggested to commit the correct ones). Now also "DUMPGEN=all" is honored, that will generate all 3 files, regardless of whether they already existed. That is useful if you start out with a test that only has a .nft file, and then you want to generate a .json-nft file too. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix use after free in table_flags_json()Thomas Haller2023-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add `$NFT -j list ruleset` to the end of "tests/shell/testcases/transactions/table_onoff". Then valgrind will find this issue: $ make -j && ./tests/shell/run-tests.sh tests/shell/testcases/transactions/table_onoff -V Gives: ==286== Invalid read of size 4 ==286== at 0x49B0261: do_dump (dump.c:211) ==286== by 0x49B08B8: do_dump (dump.c:378) ==286== by 0x49B08B8: do_dump (dump.c:378) ==286== by 0x49B04F7: do_dump (dump.c:273) ==286== by 0x49B08B8: do_dump (dump.c:378) ==286== by 0x49B0E84: json_dump_callback (dump.c:465) ==286== by 0x48AF22A: do_command_list_json (json.c:2016) ==286== by 0x48732F1: do_command_list (rule.c:2335) ==286== by 0x48737F5: do_command (rule.c:2605) ==286== by 0x48A867D: nft_netlink (libnftables.c:42) ==286== by 0x48A92B1: nft_run_cmd_from_buffer (libnftables.c:597) ==286== by 0x402CBA: main (main.c:533) Fixes: e70354f53e9f ("libnftables: Implement JSON output support") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expand create commandsPablo Neira Ayuso2023-11-155-1/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | create commands also need to be expanded, otherwise elements are never evaluated: # cat ruleset.nft define ip-block-4 = { 1.1.1.1 } create set netdev filter ip-block-4-test { type ipv4_addr flags interval auto-merge elements = $ip-block-4 } # nft -f ruleset.nft BUG: unhandled expression type 0 nft: src/intervals.c:211: interval_expr_key: Assertion `0' failed. Aborted Same applies to chains in the form of: create chain x y { counter } which is also accepted by the parser. Update tests/shell to improve coverage for these use cases. Fixes: 56c90a2dd2eb ("evaluate: expand sets and maps before evaluation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: use size_t type for strlen() resultsThomas Haller2023-11-152-2/+2
| | | | | | | strlen() has a "size_t" as result. Use the correct type. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: split merge nat optimization in two testsPablo Neira Ayuso2023-11-114-21/+26
| | | | | | | One without pipapo support and another with not to harm existing coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split single element in anonymous setPablo Neira Ayuso2023-11-114-4/+31
| | | | | | | Split this to move set stateful expression support into a separated test not to harm existing coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split map testPablo Neira Ayuso2023-11-114-32/+38
| | | | | | | Split interval + concatenation into a separated file, so older kernels with no pipapo can still run what it is supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: split set NAT interval testPablo Neira Ayuso2023-11-114-22/+32
| | | | | | | | Split test in two, one for interval sets and another with concatenation + intervals, so at least intervals are tested in older kernels with no pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip if kernel does not support bitshiftPablo Neira Ayuso2023-11-112-43/+45
| | | | | | | | A few tests are missing bitshift checks that has been added to 885845468408 ("tests/shell: skip bitshift tests if kernel lacks support"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip multidevice chain tests if kernel lacks supportPablo Neira Ayuso2023-11-112-0/+19
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip comment tests if kernel lacks supportPablo Neira Ayuso2023-11-116-0/+23
| | | | | | Skip tests that require comment support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip NAT netmap tests if kernel lacks supportPablo Neira Ayuso2023-11-112-0/+10
| | | | | | Skip tests that require NAT netmap support Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip stateful expression in sets tests if kernel lacks supportPablo Neira Ayuso2023-11-117-0/+30
| | | | | | Skip tests that require stateful expressions in sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip prerouting reject tests if kernel lacks supportPablo Neira Ayuso2023-11-112-0/+10
| | | | | | Skip tests that require reject at prerouting hook. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip pipapo tests if kernel lacks supportPablo Neira Ayuso2023-11-1112-2/+38
| | | | | | Skip tests that require net/netfilter/nft_set_pipapo support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix buffer size for user data in netlink_delinearize_chain()Thomas Haller2023-11-091-1/+1
| | | | | | | | | | The correct define is NFTNL_UDATA_CHAIN_MAX and not NFTNL_UDATA_OBJ_MAX. In current libnftnl, they both are defined as 1, so (with current libnftnl) there is no difference. Fixes: 702ac2b72c0e ("src: add comment support for chains") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove xfree() and use plain free()Thomas Haller2023-11-0920-67/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xmalloc() (and similar x-functions) are used for allocation. They wrap malloc()/realloc() but will abort the program on ENOMEM. The meaning of xmalloc() is that it wraps malloc() but aborts on failure. I don't think x-functions should have the notion, that this were potentially a different memory allocator that must be paired with a particular xfree(). Even if the original intent was that the allocator is abstracted (and possibly not backed by standard malloc()/free()), then that doesn't seem a good idea. Nowadays libc allocators are pretty good, and we would need a very special use cases to switch to something else. In other words, it will never happen that xmalloc() is not backed by malloc(). Also there were a few places, where a xmalloc() was already "wrongly" paired with free() (for example, iface_cache_release(), exit_cookie(), nft_run_cmd_from_buffer()). Or note how pid2name() returns an allocated string from fscanf(), which needs to be freed with free() (and not xfree()). This requirement bubbles up the callers portid2name() and name_by_portid(). This case was actually handled correctly and the buffer was freed with free(). But it shows that mixing different allocators is cumbersome to get right. Of course, we don't actually have different allocators and whether to use free() or xfree() makes no different. The point is that xfree() serves no actual purpose except raising irrelevant questions about whether x-functions are correctly paired with xfree(). Note that xfree() also used to accept const pointers. It is bad to unconditionally for all deallocations. Instead prefer to use plain free(). To free a const pointer use free_const() which obviously wraps free, as indicated by the name. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add free_const() and use it instead of xfree()Thomas Haller2023-11-0913-118/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Almost everywhere xmalloc() and friends is used instead of malloc(). This is almost everywhere paired with xfree(). xfree() has two problems. First, it brings the wrong notion that xmalloc() should be paired with xfree(), as if xmalloc() would not use the plain malloc() allocator. In practices, xfree() just wraps free(), and it wouldn't make sense any other way. xfree() should go away. This will be addressed in the next commit. The problem addressed by this commit is that xfree() accepts a const pointer. Paired with the practice of almost always using xfree() instead of free(), all our calls to xfree() cast away constness of the pointer, regardless whether that is necessary. Declaring a pointer as const should help us to catch wrong uses. If the xfree() function always casts aways const, the compiler doesn't help. There are many places that rightly cast away const during free. But not all of them. Add a free_const() macro, which is like free(), but accepts const pointers. We should always make an intentional choice whether to use free() or free_const(). Having a free_const() macro makes this very common choice clearer, instead of adding a (void*) cast at many places. Note that we now pair xmalloc() allocations with a free() call (instead of xfree(). That inconsistency will be resolved in the next commit. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gmputil: add nft_gmp_free() to free strings from mpz_get_str()Thomas Haller2023-11-093-4/+25
| | | | | | | | | | | | | | | | mpz_get_str() (with NULL as first argument) will allocate a buffer using the allocator functions (mp_set_memory_functions()). We should free those buffers with the corresponding free function. Add nft_gmp_free() for that and use it. The name nft_gmp_free() is chosen because "mini-gmp.c" already has an internal define called gmp_free(). There wouldn't be a direct conflict, but using the same name is confusing. And maybe our own defines should have a clear nft prefix. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: don't return a const string from cgroupv2_get_path()Thomas Haller2023-11-091-3/+3
| | | | | | | | The caller is supposed to free the allocated string. Return a non-const string to make that clearer. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: place byteorder conversion before rshift in payload expressionsPablo Neira Ayuso2023-11-065-1/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the key from the evaluation context to perform the byteorder conversion in case that this expression is used for lookups and updates on explicit sets. # nft --debug=netlink add rule ip6 t output ip6 dscp @mapv6 ip6 t output [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <-------------- this was missing! [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ lookup reg 1 set mapv6 ] Also with set statements (updates from packet path): # nft --debug=netlink add rule ip6 t output update @mapv6 { ip6 dscp } ip6 t output [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <------------- also here! [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ dynset update reg_key 1 set mapv6 ] Simple matches on values and implicit sets rely on the binary transfer mechanism to propagate the shift to the constant, no explicit byteorder is required in such case. Fixes: 668c18f67203 ("evaluate: place byteorder conversion before rshift in payload statement") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reset statement length context only for set mappingsPablo Neira Ayuso2023-11-065-1/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | map expression (which is used a key to look up for the mapping) needs to consider the statement length context, otherwise incorrect bytecode is generated when {ct,meta} statement is generated. # nft -f - <<EOF add table ip6 t add chain ip6 t c add map ip6 t mapv6 { typeof ip6 dscp : meta mark; } EOF # nft -d netlink add rule ip6 t c meta mark set ip6 dscp map @mapv6 ip6 t c [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] ... missing byteorder conversion here before shift ... [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ lookup reg 1 set mapv6 dreg 1 ] [ meta set mark with reg 1 ] Reset statement length context only for the mapping side for the elements in the set. Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Reported-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-07-22 00:19:41 +0000