summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* src: remove STMT_NAT_F_INTERVAL flags and interval keywordPablo Neira Ayuso2021-07-139-35/+6
| | | | | | | | | | | | | | | STMT_NAT_F_INTERVAL is not useful, the keyword interval can be removed to simplify the syntax, e.g. snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } This patch reworks 9599d9d25a6b ("src: NAT support for intervals in maps"). Do not remove STMT_NAT_F_INTERVAL yet since this flag is needed for interval concatenations coming in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: stmt and expr error path memleaksPablo Neira Ayuso2021-07-131-10/+10
| | | | | | | | Use stmt_free() and expr_free() to release these objects. Fixes: 671851617c8d ("netlink_delinearize: Fix resource leaks") Fixes: 3a8640672978 ("src: hash: support of symmetric hash") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: get `make distcheck` to pass againDuncan Roe2021-07-051-0/+1
| | | | | | | | Commit 4694f7230195 introduced nfnetlink_hook.h but didn't update the automake system to take account of the new file. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinarize: don't check for set element if set is not populatedFlorian Westphal2021-06-302-0/+14
| | | | | | | | | | | | 0065_icmp_postprocessing: line 13: Segmentation fault $NFT insert rule ip x foo index 1 accept Since no listing is done, cache isn't populated and 'nft insert' will trip over set->init == NULL during postprocessing of the existing 'icmp id 42' expression. Fixes: 9a5574e2d4e9 ("netlink_delinearize: add missing icmp id/sequence support") Reported-by: Eric Garver <eric@garver.life> Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* cmd: incorrect error reporting when table declaration existsPablo Neira Ayuso2021-06-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This example ruleset is missing the chain declaration: add table x add set x y { typeof ip saddr ; } add rule x y counter After this patch, error reporting provides suggestions for the missing chain: # nft -f ruleset.nft ruleset.nft:3:12-12: Error: No such file or directory; did you mean chain ‘INPUT’ in table ip ‘filter’? add rule x y counter ^ Before this patch, it incorrectly refers to the table: ruleset.nft:3:10-10: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x y counter ^ This patch invalidates the table that is found via fuzzy lookup if it exists in the cache. Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: incorrect table location in error reportingPablo Neira Ayuso2021-06-291-8/+8
| | | | | | | | | | | | | | | | | If the command refers to an inexisting table, then use the table location. ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ before this patch location is not correct: ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: obj_free() releases timeout state stringPablo Neira Ayuso2021-06-231-0/+1
| | | | | | | Missing free() on the timeout state string on object release. Fixes: 7a0e26723496 ("rule: memleak of list of timeout policies" Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in rate limit parserPablo Neira Ayuso2021-06-231-0/+1
| | | | | | | | | | Direct leak of 13 byte(s) in 1 object(s) allocated from: #0 0x7fb49ad79810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7fb496b8f63a in xstrdup /home/pablo/nftables/src/utils.c:85 #2 0x7fb496c9a79d in nft_lex /home/pablo/nftables/src/scanner.l:740 [...] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: string memleak in YYERROR pathPablo Neira Ayuso2021-06-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Release dynamically allocated string by lex from the YYERROR path, e.g. # cat test.nft table x { map test { type ipv4_addr . foo . inet_service : ipv4_addr . inet_service } } # nft -f test.nft test.nft:3:20-22: Error: unknown datatype foo type ipv4_addr . foo . inet_service : ipv4_addr . inet_service ^^^ test.nft:6-9: Error: set definition does not specify key map test { ^^^^ ==29692==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x7f6c869e8810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7f6c8637f63a in xstrdup /home/test/nftables/src/utils.c:85 #2 0x7f6c8648a4d3 in nft_lex /home/test/nftables/src/scanner.l:740 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: fix memleak when first message in batch is used to report errorPablo Neira Ayuso2021-06-231-0/+6
| | | | | | | | | The err->seqnum == batch_seqnum case results in a memleak of mnl_err objects under some scenarios such as nf_tables kernel support is not available or user runs the nft executable as non-root. Fixes: f930cc500318 ("nftables: fix supression of "permission denied" errors") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix maps with key and data concatenationsPablo Neira Ayuso2021-06-233-6/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | expr_evaluate_concat() is overloaded, it deals with two cases: #1 set key and data definitions, this case uses the special dynamically created concatenation datatype which is taken from the context. #2 set elements, this case iterates over the set key and data expressions that are components of the concatenation tuple, to fetch the corresponding datatype. Add a new function to deal with case #1 specifically. This patch is implicitly fixing up map that include arbitrary concatenations. This is failing with a spurious error report such as: # cat bug.nft table x { map test { type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service } } # nft -f bug.nft bug.nft:3:48-71: Error: datatype mismatch, expected concatenation of (IPv4 address, Internet protocol, internet network service), expression has type concatenation of (IPv4 address, internet network service) type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service ^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: queue: allow use of MAP statement for queue number retrievalFlorian Westphal2021-06-215-2/+49
| | | | | | | | | This allows to chose a queue number at run time using map statements, e.g.: queue flags bypass to ip saddr map { 192.168.7/24 : 0, 192.168.0/24 : 1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend queue testcases for new sreg supportFlorian Westphal2021-06-213-0/+82
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: queue: allow use of arbitrary queue expressionsFlorian Westphal2021-06-216-25/+93
| | | | | | | | | | | | | | | | | | | | | back in 2016 Liping Zhang added support to kernel and libnftnl to specify a source register containing the queue number to use. This was never added to nft itself, so allow this. On linearization side, check if attached expression is a range. If its not, allocate a new register and set NFTNL_EXPR_QUEUE_SREG_QNUM attribute after generating the lowlevel expressions for the kernel. On delinarization we need to check for presence of NFTNL_EXPR_QUEUE_SREG_QNUM and decode the expression(s) when present. Also need to do postprocessing for STMT_QUEUE so that the protocol context is set correctly, without this only raw payload expressions will be shown (@nh,32,...) instead of 'ip ...'. Next patch adds test cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: new queue flag input formatFlorian Westphal2021-06-214-11/+19
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: add queue_stmt_compatFlorian Westphal2021-06-211-8/+11
| | | | | | | | | | | | | | | | | | | | | Rename existing rules to _compat to make sure old rules using 'queue' statement will work. Next patch adds distinct input format where flags are explicitly provided: queue flags name,<nextflag> num 1 Without this, extension of queue expression to handle arbitrary expression instead of queue number or range results in parser errors. Example: queue num jhash ip saddr mod 4 and 1 bypass will fail because scanner is still in 'ip' state, not 'queue', when "bypass" is read. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add queue expr and flags to queue_stmt_allocFlorian Westphal2021-06-215-22/+25
| | | | | | Preparation patch to avoid too much $<stmt>$ references in the parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: restrict queue num expressivenessFlorian Westphal2021-06-211-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Else we run into trouble once we allow queue num symhash mod 4 and 1 and so on. Example problem: queue num jhash ip saddr mod 4 and 1 bypass This will fail to parse because the scanner is in the wrong state (ip, not queue), so 'bypass' is parsed as a string. Currently, while nft will eat the above just fine (minus 'bypass'), nft rejects this from the evaluation phase with Error: queue number is not constant So seems we are lucky and can restrict the supported expressions to integer and range. Furthermore, the line looks wrong because this statement: queue num jhash ip saddr mod 4 and 1 bypass doesn't specifiy a number, "queue num 4" does, or "queue num 1-2" do. For arbitrary expr support it seems sensible to enforce stricter ordering to avoid any problems with the flags, for example: queue bypass,futurekeyword to jhash ip saddr mod 42 Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix hash expression maxvalFlorian Westphal2021-06-181-2/+6
| | | | | | | | It needs to account for the offset too. Fixes: 9bee0c86f179 ("src: add offset attribute for hash expression") Fixes: d4f9a8fb9e9a ("src: add offset attribute for numgen expression") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: memleak of list of timeout policiesPablo Neira Ayuso2021-06-182-0/+9
| | | | | | | | | | | | Release list of ct timeout policy when object is freed. Direct leak of 160 byte(s) in 2 object(s) allocated from: #0 0x7fc0273ad330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7fc0231377c4 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7fc023137983 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7fc0231f64d6 in nft_parse /home/.../devel/nftables/src/parser_bison.y:4448 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in osf flagsPablo Neira Ayuso2021-06-181-0/+2
| | | | | | Release osf string flag after processing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: memleak when listing ct event rulePablo Neira Ayuso2021-06-181-4/+7
| | | | | | | | | | | | | | | | | | | listing a ruleset containing: ct event set new,related,destroy,label results in memleak: Direct leak of 3672 byte(s) in 27 object(s) allocated from: #0 0x7fa5465c0330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7fa54233772c in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7fa5423378eb in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7fa5422488c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7fa54224fb91 in binop_expr_alloc /home/.../devel/nftables/src/expression.c:698 #5 0x7fa54224ddf8 in bitmask_expr_to_binops /home/.../devel/nftables/src/expression.c:512 #6 0x7fa5423102ca in expr_postprocess /home/.../devel/nftables/src/netlink_delinearize.c:2448 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: memleak in error path of the set to segtree conversionPablo Neira Ayuso2021-06-182-3/+15
| | | | | | | | | | | Release the array of intervals and the segtree in case of error, otherwise these structures and objects are never released: SUMMARY: AddressSanitizer: 2864 byte(s) leaked in 37 allocation(s). Moreover, improve existing a test coverage of this error path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: memleak in string netlink postprocessingPablo Neira Ayuso2021-06-181-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Listing a matching wilcard string results in a memleak: ifname "dummy*" Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f27ba52e330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f27b9e1d434 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f27b9e1d5f3 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7f27b9d2e8c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7f27b9d326e9 in constant_expr_alloc /home/.../devel/nftables/src/expression.c:419 #5 0x7f27b9db9318 in netlink_alloc_value /home/.../devel/nftables/src/netlink.c:390 #6 0x7f27b9de0433 in netlink_parse_cmp /home/.../devel/nftables/src/netlink_delinearize.c:321 #7 0x7f27b9deb025 in netlink_parse_expr /home/.../devel/nftables/src/netlink_delinearize.c:1764 #8 0x7f27b9deb0de in netlink_parse_rule_expr /home/.../devel/nftables/src/netlink_delinearize.c:1776 #9 0x7f27b860af7b in nftnl_expr_foreach /home/.../devel/libnftnl/src/rule.c:690 Direct leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f27ba52e330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f27b9e1d434 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f27b96975c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: memleak in binary operation transfer to RHSPablo Neira Ayuso2021-06-181-2/+0
| | | | | | | | | | | | | | | | | | | | | | | Remove useless reference count grabbing on constant expression that results in a memleak. Direct leak of 136 byte(s) in 1 object(s) allocated from: #0 0x7f4cd54af330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f4cd4d9e489 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f4cd4d9e648 in xzalloc /home/.../devel/nftables/src/utils.c:75 #3 0x7f4cd4caf8c6 in expr_alloc /home/.../devel/nftables/src/expression.c:45 #4 0x7f4cd4cb36e9 in constant_expr_alloc /home/.../devel/nftables/src/expression.c:419 #5 0x7f4cd4ca714c in integer_type_parse /home/.../devel/nftables/src/datatype.c:397 #6 0x7f4cd4ca4bee in symbolic_constant_parse /home/.../devel/nftables/src/datatype.c:165 #7 0x7f4cd4ca4572 in symbol_parse /home/.../devel/nftables/src/datatype.c:135 #8 0x7f4cd4cc333f in expr_evaluate_symbol /home/.../devel/nftables/src/evaluate.c:251 [...] Indirect leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f4cd54af330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f4cd4d9e489 in xmalloc /home/.../devel/nftables/src/utils.c:36 #2 0x7f4cd46185c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: unbreak verdict maps with implicit map with interval concatenationsPablo Neira Ayuso2021-06-187-0/+100
| | | | | | | | | | | Verdict maps in combination with interval concatenations are broken, e.g. # nft add rule x y tcp dport . ip saddr vmap { 1025-65535 . 192.168.10.2 : accept } Retrieve the concatenation field length and count from the map->map expressions that represents the key of the implicit map. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not skip mapping elementsPablo Neira Ayuso2021-06-181-7/+19
| | | | | | | | | | | Set element keys are of EXPR_SET_ELEM expression type, however, mappings use the EXPR_MAPPING expression to wrap the EXPR_SET_ELEM key (mapping->left) and the corresponding data (mapping->right). This patch adds a wrapper function to fetch the EXPR_SET_ELEM expression from the key in case of mappings and use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a icmp-reply only and icmpv6 id test casesFlorian Westphal2021-06-176-0/+123
| | | | | | | | | | | | | | | | | | Check that nft doesn't remove the dependency in these cases: icmp type echo-reply icmp id 1 ("icmp id" matches both echo request and reply). Add icmpv6 test cases. These fail without the previous patches: add rule ip6 test-ip6 input icmpv6 id 1: 'icmpv6 id 1' mismatches 'icmpv6 type { echo-request, echo-reply} icmpv6 parameter-problem 65536/16' add rule ip6 test-ip6 input icmpv6 type echo-reply icmpv6 id 65534': 'icmpv6 type echo-reply icmpv6 id 65534' mismatches 'icmpv6 type echo-reply @th,32,16 65534' Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: do not remove icmp echo dependencyFlorian Westphal2021-06-171-24/+37
| | | | | | | | | | | "icmp type echo-request icmp id 2" and "icmp id 2" are not the same, the latter gains an implicit dependency on both echo-request and echo-reply. Change payload dependency tracking to not store dependency in case the value type is ICMP(6)_ECHO(REPLY). Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: add missing icmp id/sequence supportFlorian Westphal2021-06-171-3/+65
| | | | | | | | | | | | | | | | | | | | | | Pablo reports following input and output: in: icmpv6 id 1 out: icmpv6 type { echo-request, echo-reply } icmpv6 parameter-problem 65536/16 Reason is that icmp fields overlap, decoding of the correct name requires check of the icmpv6 type. This only works for equality tests, for instance in: icmpv6 type echo-request icmpv6 id 1 will be listed as "icmpv6 id 1" (which is not correct either, since the input only matches on echo-request). with this patch, output of 'icmpv6 id 1' is icmpv6 type { echo-request, echo-reply } icmpv6 id 1 The second problem, the removal of a single check (request OR reply), is resolved in the followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cover split chain reference across tablesPablo Neira Ayuso2021-06-142-0/+26
| | | | | | | | Add a test to cover table T1 containing the definition of chain C1, and table T1' (actually the same definition as T1) that contains a (jump) reference to chain C1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: extend connlimit testPablo Neira Ayuso2021-06-141-0/+12
| | | | | | | | | Extend existing test to add a ct count expression in the set definition. This test cover the upstream kernel fix ad9f151e560b ("netfilter: nf_tables: initialize set before expression setup"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace opencoded NFT_SET_ANONYMOUS set flag check by set_is_anonymous()Pablo Neira Ayuso2021-06-144-4/+4
| | | | | | | | Use set_is_anonymous() to check for the NFT_SET_ANONYMOUS set flag instead. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xzalloc_array() and use it to allocate the expression hashtablePablo Neira Ayuso2021-06-143-1/+12
| | | | | | | | | | | Otherwise, assertion to ensure that no colission occur is hit due to uninitialized hashtable memory area: nft: netlink_delinearize.c:1741: expr_handler_init: Assertion `expr_handle_ht[hash] == NULL' failed. Fixes: c4058f96c6a5 ("netlink_delinearize: Fix suspicious calloc() call") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add set to cache oncePablo Neira Ayuso2021-06-141-3/+0
| | | | | | | | | | | | | | 67d3969a7244 ("evaluate: add set to the cache") re-adds the set into the cache again. This bug was hidden behind 5ec5c706d993 ("cache: add hashtable cache for table") which broke set_evaluate() for anonymous sets. Phil reported a gcc compilation warning which uncovered this problem. Reported-by: Phil Sutter <phil@nwl.cc> Fixes: 67d3969a7244 ("evaluate: add set to the cache") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: tests: add missing concat test caseFlorian Westphal2021-06-141-0/+39
| | | | | | | | | | Fix ERROR: did not find JSON equivalent for rule 'ip saddr . ip daddr { 192.0.2.1 . 10.0.0.1-10.0.0.2 }' when running nft-test.py -j Fixes: bbcc5eda7e58 ("evaluate: restore interval + concatenation in anonymous set") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: tests: fix vlan.t cfi test caseFlorian Westphal2021-06-141-1/+29
| | | | | | | | | | | The test case exists twice, once with new dei, once with old 'cfi', so we need to retain the cfi one in the json file too. Else we get: WARNING: line 2: Wrote JSON equivalent for rule vlan id 4094 vlan dei 1 Fixes: d2fba515ff94 ("src: add vlan dei") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: Fix for potential off-by-one in cmd_add_loc()Phil Sutter2021-06-141-1/+1
| | | | | | | | Using num_attrs as index means it must be at max one less than the array's size at function start. Fixes: 27362a5bfa433 ("rule: larger number of error locations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_delinearize: Fix suspicious calloc() callPhil Sutter2021-06-141-3/+2
| | | | | | | | Parameter passed to sizeof() was wrong. While being at it, replace the whole call with xmalloc_array() which takes care of error checking. Fixes: 913979f882d13 ("src: add expression handler hashtable") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_obj()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'obj' has to be freed before returning to caller. Fixes: 293c9b114faef ("src: add comment support for objects") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_table()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'table' has to be freed before returning to caller. Fixes: c156232a530b3 ("src: add comment support when adding tables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_chain()Phil Sutter2021-06-141-0/+1
| | | | | | | | If parsing udata fails, 'chain' has to be freed before returning to caller. Fixes: 702ac2b72c0e8 ("src: add comment support for chains") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid memleak in error path of netlink_delinearize_set()Phil Sutter2021-06-141-2/+2
| | | | | | | | Duplicate string 'comment' later when the function does not fail anymore. Fixes: 0864c2d49ee8a ("src: add comment support for set declarations") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Drop pointless assignment in exthdr_expr_json()Phil Sutter2021-06-141-1/+0
| | | | | | | The updated value of 'is_exists' is no longer read at this point. Fixes: cb21869649208 ("json: tcp: add raw tcp option match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: Mark fall through case in str2hooknum()Phil Sutter2021-06-141-0/+1
| | | | | | | It is certainly intentional, so just mark it as such. Fixes: b4775dec9f80b ("src: ingress inet support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Fix for memleak in tcp option error pathPhil Sutter2021-06-141-3/+3
| | | | | | | | If 'kind' value is invalid, the function returned without freeing 'expr' first. Fix this by performing the check before allocation. Fixes: cb21869649208 ("json: tcp: add raw tcp option match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_bison: Fix for implicit declaration of isalnumPhil Sutter2021-06-141-0/+1
| | | | | | | Have to include ctype.h to make it known. Fixes: e76bb37940181 ("src: allow for variables in the log prefix string") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: restore interval + concatenation in anonymous setPablo Neira Ayuso2021-06-116-8/+53
| | | | | | | | | | | | | | | | | | | Perform the table and set lookup only for non-anonymous sets, where the incremental cache update is required. The problem fixed by 7aa08d45031e ("evaluate: Perform set evaluation on implicitly declared (anonymous) sets") resurrected after the cache rework. # nft add rule x y tcp sport . tcp dport vmap { ssh . 0-65535 : accept, 0-65535 . ssh : accept } BUG: invalid range expression type concat nft: expression.c:1422: range_expr_value_low: Assertion `0' failed. Abort Add a test case to make sure this does not happen again. Fixes: 5ec5c706d993 ("cache: add hashtable cache for table") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add vlan deiPablo Neira Ayuso2021-06-119-41/+71
| | | | | | | | | | the CFI bit has been repurposed as DEI "Drop Eligible Indicator" since 802.1Q-2011. The vlan cfi field is still retained for compatibility. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1516 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add LISTING sectionFlorian Westphal2021-06-091-0/+11
| | | | | | | mention various 'nft list' options, such as secmarks, flow tables, and so on. Signed-off-by: Florian Westphal <fw@strlen.de>