summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* libnftables: fix crash when freeing non-malloc'd addressFlorian Westphal2024-07-101-3/+3
| | | | | | | | | dirname may return static pointer: munmap_chunk(): invalid pointer 20508 Aborted nft -f test Fixes: 6ef04f99382c ("libnftables: search for default include path last") Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: clone counter before insertion into set elementPablo Neira Ayuso2024-07-053-7/+45
| | | | | | | | The counter statement that is zapped from the rule needs to be cloned before inserting it into each set element. Fixes: 686ab8b6996e ("optimize: do not remove counter in verdict maps") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: remove deprecated flow statementPablo Neira Ayuso2024-07-051-17/+3
| | | | | | | | | | Dynamic set/maps are used these days to represent what 3ed5e31f4a32 ("src: add flow statement") provides. Unlikely meter statement, this statement was never documented other than in the source code. Ditch it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: recursive table declaration in deprecated meter statementPablo Neira Ayuso2024-07-051-16/+4
| | | | | | | | | | | This is allowing for recursive table NAME declarations such as: ... table xyz1 table xyz2 { ... } remove it. Fixes: 3ed5e31f4a32 ("src: add flow statement") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover set element deletion in mapsPablo Neira Ayuso2024-07-054-0/+87
| | | | | | | Extend existing coverage to deal with set element deletion, including catchall elements too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* intervals: fix element deletions with mapsPablo Neira Ayuso2024-07-051-13/+18
| | | | | | | | | | | | | | | | | | | | Set element deletion in maps (including catchall elements) does not work. # nft delete element ip x m { \* } BUG: invalid range expression type catch-all set element nft: src/expression.c:1472: range_expr_value_low: Assertion `0' failed. Aborted Call interval_expr_key() to fetch expr->left in the mapping but use the expression that represents the mapping because it provides access to the EXPR_F_REMOVE flags. Moreover, assume maximum value for catchall expression by means of the expr->len to reuse the existing code to check if the element to be deleted really exists. Fixes: 3e8d934e4f72 ("intervals: support to partial deletion with automerge") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: set on EXPR_F_KERNEL flag for catchall elements in the cachePablo Neira Ayuso2024-07-051-1/+3
| | | | | | | | | Catchall set element deletion requires this flag to be set on, otherwise it bogusly reports that such element does not exist in the set. Fixes: f1cc44edb218 ("src: add EXPR_F_KERNEL to identify expression in the kernel") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: set on expr->len for catchall set elementsPablo Neira Ayuso2024-07-051-1/+11
| | | | | | | | | | | | Catchall elements coming from the parser provide expr->len == 0. However, the existing mergesort implementation requires expr->len to be set up to the length of the set key to properly sort elements. In particular, set element deletion leverages such list sorting to find if elements exists in the set. Fixes: 419d19688688 ("src: add set element catch-all support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: check for removing table via handle with incorrect familyPablo Neira Ayuso2024-06-271-0/+9
| | | | | | | | This test checks for upstream commit: f6e1532a2697 ("netfilter: nf_tables: validate family when identifying table via handle") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add string preprocessor and use it for log prefix stringPablo Neira Ayuso2024-06-2514-199/+198
| | | | | | | | Add a string preprocessor to identify and replace variables in a string. Rework existing support to variables in log prefix strings to use it. Fixes: e76bb3794018 ("src: allow for variables in the log prefix string") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: drop redundant JSON outputsPablo Neira Ayuso2024-06-252-86/+0
| | | | | | | | | | | 8abe71f862e6 ("tests: py: Warn if recorded JSON output matches the input") adds a warning on duplicated JSON outputs. Remove them when running tests with -j: WARNING: Recorded JSON output matches input for: icmp code { 2, 4, 54, 33, 56} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: search for default include path lastPablo Neira Ayuso2024-06-252-23/+41
| | | | | | | | | | | | | | | The default include path is searched for files before include paths specified via -I/--include. Search for default include path after user-specified include paths to allow users for test nftables configurations spanning multiple files without overwriting the globally installed ones. See: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20220627222304.93139-1-dxld@darkboxed.org/ Reported-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: add base directory of -f/--filename to include pathPablo Neira Ayuso2024-06-252-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds an include path relative to the current (the including) file's directory. Users of -f/--filename have to explicitly specify -I with a redundant path to find included files in the main file, eg. # nft -I /path/to/files -f /path/to/files/ruleset.nft Assuming: # cat /path/to/files/ruleset.nft include "file1.nft" include "file2.nft" include "file3.nft" The follow up patch ("libnftables: search for default include path last") is also required according to what it is described in the manpage update coming with this patch. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1661 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for reset tcp warningFlorian Westphal2024-06-253-0/+212
| | | | | | | | | | | | | | | | | | | | tcp reset rule + nftrace 1 triggers (harmless) splat from flow dissector: WARNING: CPU: 2 PID: 145809 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x19d4/0x5cc0 __skb_get_hash+0xa8/0x220 nft_trace_init+0x2ff/0x3b0 nft_do_chain+0xb04/0x1370 nft_do_chain_inet+0xc5/0x2e0 nf_hook_slow+0xa0/0x1d0 ip_local_out+0x14/0x90 nf_send_reset+0x94e/0xbd0 nft_reject_inet_eval+0x45e/0x690 nft_do_chain+0x220/0x1370 nf_hook_slow+0xa0/0x1d0 ip_local_deliver+0x23f/0x2d0 Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* dynset: avoid errouneous assert with ipv6 concat dataSon Dinh2024-06-1612-3/+144
| | | | | | | | | | | | | | | | | | nft add rule ip6 table-test chain-1 update @map-X { ip6 saddr : 1000::1 . 5001 } nft: src/netlink_linearize.c:873: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Aborted (core dumped) This is because we pass the EXPR_SET_ELEM expr to the register allocation, which will make it reserve 1 128 bit register / 16 bytes. This happens to be enough for most cases, but its not for ipv6 concat data. Pass the actual key and data instead: This will reserve enough space to hold a possible concat expression. Also add test cases. Signed-off-by: Son Dinh <dinhtrason@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: do not crash if to-be-printed flowtable lacks priorityFlorian Westphal2024-06-162-6/+15
| | | | | | | Print an empty flowtable rather than crashing when dereferencing flowtable->priority.expr (its NULL). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: use common shebang in "packetpath/flowtables" testThomas Haller2024-06-161-1/+3
| | | | | | | | | | | | | | | | | | | | | | "./tools/check-tree.sh" checks for a certain shebang. Either `/bin/bash` or `/bin/bash -e`. No other are currently allowed, because it makes sense to be strict/consistent and there is no need such flexibility. Move the "-x" to a later command. Note that "set -x" may not be a good choice anyway. If you want to debug a test and see the shell commands, you could just run $ ./tests/shell/run-tests.sh tests/shell/testcases/packetpath/flowtables -x That will automatically use `/bin/bash -x` as interpreter. And that works for all tests the same. This is also the reason why "check-tree.sh" checks for a well-known shebang. Because the "-x" option of the test runner mangles the shebang, but for that it needs to understand it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: skip NFTA_RULE_POSITION_ID tests if kernel does not support itPablo Neira Ayuso2024-06-133-0/+27
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ipsec tests if kernel does not support itPablo Neira Ayuso2024-06-132-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip ip option tests if kernel does not support itPablo Neira Ayuso2024-06-132-0/+10
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add dependencies to skip unsupported tests in older kernelsPablo Neira Ayuso2024-06-135-0/+14
| | | | | | Update tests which contain unsupported features in older kernels. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: skip variable set elements when collapsing commandsPablo Neira Ayuso2024-06-114-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | ASAN reports an issue when collapsing commands that represent an element through a variable: include/list.h:60:13: runtime error: member access within null pointer of type 'struct list_head' AddressSanitizer:DEADLYSIGNAL ================================================================= ==11398==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ffb77cf09c2 bp 0x7ffc818267c0 sp 0x7ffc818267a0 T0) ==11398==The signal is caused by a WRITE memory access. ==11398==Hint: address points to the zero page. #0 0x7ffb77cf09c2 in __list_add include/list.h:60 #1 0x7ffb77cf0ad9 in list_add_tail include/list.h:87 #2 0x7ffb77cf0e72 in list_move_tail include/list.h:169 #3 0x7ffb77cf86ad in nft_cmd_collapse src/cmd.c:478 #4 0x7ffb77da9f16 in nft_evaluate src/libnftables.c:531 #5 0x7ffb77dac471 in __nft_run_cmd_from_filename src/libnftables.c:720 #6 0x7ffb77dad703 in nft_run_cmd_from_filename src/libnftables.c:807 Skip such commands to address this issue. This patch also extends tests/shell to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1754 Fixes: 498a5f0c219d ("rule: collapse set element commands") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: provide better hint if chain is already declared with different ↵Pablo Neira Ayuso2024-06-111-1/+14
| | | | | | | | | | | | | | | | type/hook/priority Display the following error in such case: ruleset.nft:7:9-52: Error: Chain "input" already exists in table ip 'filter' with different declaration type filter hook postrouting priority filter; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ instead of reporting a misleading unsupported chain type when updating an existing chain with different type/hook/priority. Fixes: 573788e05363 ("src: improve error reporting for unsupported chain type") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: too large shift exponent displaying payload expressionPablo Neira Ayuso2024-06-111-0/+1
| | | | | | | | | | | | ASAN reports too large shift exponent when displaying traces for raw payload expression: trace id ec23e848 ip x y packet: oif "wlan0" src/netlink.c:2100:32: runtime error: shift exponent 1431657095 is too large for 32-bit type 'int' skip if proto_unknown_template is set on in this payload expression. Fixes: be5d9120e81e ("nft monitor [ trace ]") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: inet_pton() allows for broader IPv4-Mapped IPv6 addressesPablo Neira Ayuso2024-06-111-24/+23
| | | | | | | | | | | | inet_pton() allows for broader IPv4-Mapped IPv6 address syntax than those specified by rfc4291 Sect.2.5.5. This patch extends the scanner to support them for compatibility reasons. This allows to represent the last 4 bytes of an IPv6 address as an IPv4 address. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1730 Fixes: fd513de78bc0 ("scanner: IPv4-Mapped IPv6 addresses support") Fixes: 3f82ef3d0dbf ("scanner: Support rfc4291 IPv4-compatible addresses") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: recycle existing cache with incremental updatesPablo Neira Ayuso2024-06-031-3/+15
| | | | | | | | | | | | | | | Cache tracking has improved over time by incrementally adding/deleting objects when evaluating commands that are going to be sent to the kernel. nft_cache_is_complete() already checks that the cache contains objects that are required to handle this batch of commands by comparing cache flags. Infer from the current generation ID if no other transaction has invalidated the existing cache, this allows to skip unnecessary cache flush then refill situations which slow down incremental updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: check for NFT_CACHE_REFRESH in current requested cache tooPablo Neira Ayuso2024-06-031-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | NFT_CACHE_REFRESH is set on inconditionally by ruleset list commands to deal with stateful information in this ruleset. This flag results in dropping the existing cache and fully fetching all objects from the kernel. Set on this flag for reset commands too, this is missing. List/reset commands allow for filtering by specific family and object, therefore, NFT_CACHE_REFRESH also signals that the cache is partially populated. Check if this flag is requested by the current list/reset command, as well as cache->flags which represents the cache after the _previous_ list of commands. A follow up patch allows to recycle the existing cache if the flags report that the same objects are already available in the cache, NFT_CACHE_REFRESH is useful to report that cache cannot be recycled. Fixes: 407c54f71255 ("src: cache gets out of sync in interactive mode") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix incorrect checking the `base` variable in case of IPV6Maks Mishin2024-06-031-1/+1
| | | | | | | | Found by RASU JSC. Fixes: 2b29ea5f3c3e ("src: ct: add eval part to inject dependencies for ct saddr/daddr") Signed-off-by: Maks Mishin <maks.mishinFZ@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan mangling test casePablo Neira Ayuso2024-06-031-0/+75
| | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan double tagging match simple test casePablo Neira Ayuso2024-06-031-0/+73
| | | | | | | | | | As a follow up for: 74cf3d16d8e9 ("tests: shell: add vlan match test case") Add basic test for q-in-q matching support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus protocol conflicts in vlan with implicit dependenciesPablo Neira Ayuso2024-06-031-12/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following command: # nft add rule netdev x y ip saddr 10.1.1.1 icmp type echo-request vlan id set 321 fails with: Error: conflicting link layer protocols specified: ether vs. vlan netdev x y ip saddr 10.1.1.1 icmp type echo-request vlan id set 321 ^^^^^^^ Users can work around this issue by prepending an explicit match for vlan ethertype field, that is: ether type vlan ip saddr 10.1.1.1 ... ^-------------^ but nft should really handle this itself. The error above is triggered by the following check in resolve_ll_protocol_conflict(): /* This payload and the existing context don't match, conflict. */ if (pctx->protocol[base + 1].desc != NULL) return 1; This check was added by 39f15c243912 ("nft: support listing expressions that use non-byte header fields") and f7d5590688a6 ("tests: vlan tests") to deal with conflicting link layer protocols, for instance: ether type ip vlan id 1 this is matching ethertype ip at offset 12, but then it matches for vlan id at offset 14 which is not present given the previous check. One possibility is to remove such check, but nft does not bail out for the example above and it results in bytecode that never matches: # nft --debug=netlink netdev x y ether type ip vlan id 10 netdev x y [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ payload load 2b @ link header + 12 => reg 1 ] <---- ether type [ cmp eq reg 1 0x00000008 ] <---- ip [ payload load 2b @ link header + 12 => reg 1 ] <---- ether type [ cmp eq reg 1 0x00000081 ] <---- vlan [ payload load 2b @ link header + 14 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000ff0f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000a00 ] This is due to resolve_ll_protocol_conflict() which deals with the conflict by updating protocol context and emitting an implicit dependency, but there is already an explicit match coming from the user. This patch adds a new helper function to check if an implicit dependency clashes with an existing statement, which results in: # nft add rule netdev x y ether type ip vlan id 1 Error: conflicting statements add rule netdev x y ether type ip vlan id 1 ^^^^^^^^^^^^^ ~~~~~~~ Theoretically, no duplicated implicit dependency should ever be emitted if protocol context is correctly handled. Only implicit payload expressions are considered at this stage for this conflict check, this patch can be extended to deal with other dependency types. Fixes: 39f15c243912 ("nft: support listing expressions that use non-byte header fields") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: drop duplicate ARP HEADER EXPRESSION谢致邦 (XIE Zhibang)2024-05-281-38/+0
| | | | | Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: add support for variables in map expressionsJeremy Sowden2024-05-209-0/+338
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is possible to use a variable to initialize a map, which is then used in a map statement: define dst_map = { ::1234 : 5678 } table ip6 nat { map dst_map { typeof ip6 daddr : tcp dport; elements = $dst_map } chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map @dst_map } } However, if one tries to use the variable directly in the statement: define dst_map = { ::1234 : 5678 } table ip6 nat { chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map $dst_map } } nft rejects it: /space/azazel/tmp/ruleset.1067161.nft:5:47-54: Error: invalid mapping expression variable ip6 nexthdr tcp redirect to ip6 daddr map $dst_map ~~~~~~~~~ ^^^^^^^^ It also rejects variables in stateful object statements: define quota_map = { 192.168.10.123 : "user123", 192.168.10.124 : "user124" } table ip nat { quota user123 { over 20 mbytes } quota user124 { over 20 mbytes } chain prerouting { quota name ip saddr map $quota_map } } thus: /space/azazel/tmp/ruleset.1067161.nft:15:29-38: Error: invalid mapping expression variable quota name ip saddr map $quota_map ~~~~~~~~ ^^^^^^^^^^ Add support for these uses together with some test-cases. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067161 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: handle invalid mapping expressions in stateful object statements ↵Jeremy Sowden2024-05-201-2/+3
| | | | | | | | | | | | | | | | | | | gracefully. Currently, they are reported as assertion failures: BUG: invalid mapping expression variable nft: src/evaluate.c:4618: stmt_evaluate_objref_map: Assertion `0' failed. Aborted Instead, report them more informatively as errors: /space/azazel/tmp/ruleset.1067161.nft:15:29-38: Error: invalid mapping expression variable quota name ip saddr map $quota_map ~~~~~~~~ ^^^^^^^^^^ Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: combine dormant flag with netdevice removalPablo Neira Ayuso2024-04-251-0/+9
| | | | | | Exercise table is dormant and netdevice is gone combination. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: packetpath: add check for drop policyFlorian Westphal2024-04-253-0/+174
| | | | | | | check that policy can be changed from accept to drop and that the kernel acts on this. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: nft.8: Highlight "hook" in flowtable descriptionPhil Sutter2024-04-241-2/+2
| | | | | | | | Lacking an explicit description of possible hook values, emphasising the word in the description text should draw readers' attention in the right direction. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: nft.8: Fix markup in ct expectation synopsisPhil Sutter2024-04-241-1/+1
| | | | | | | Just a missing asterisk somewhere. Fixes: 1dd08fcfa07a4 ("src: add ct expectations support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Fix for maps/typeof_maps_add_delete with ASANPhil Sutter2024-04-243-4/+4
| | | | | | | | With both KASAN and ASAN enabled, my VM is too slow so the ping-induced set entry times out before the test checks its existence. Increase its timeout to 2s, seems to do the trick. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Fix for memleak in __binop_expr_jsonPhil Sutter2024-04-241-8/+16
| | | | | | | | | | | | | When merging the JSON arrays generated for LHS and RHS of nested binop expressions, the emptied array objects leak if their reference is not decremented. Fix this and tidy up other spots which did it right already by introducing a json_array_extend wrapper. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 0ac39384fd9e4 ("json: Accept more than two operands in binary expressions") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Add support for table's persist flagPhil Sutter2024-04-198-17/+142
| | | | | | | | | Bison parser lacked support for passing multiple flags, JSON parser did not support table flags at all. Document also 'owner' flag (and describe their relationship in nft.8. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Avoid escape chars when printing to non-terminalsPhil Sutter2024-04-121-2/+2
| | | | | | | | Print the 'EXECUTING' status line only if stdout is a terminal, the mandatory following escape sequence to delete it messes up log file contents. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Drop needless recorded JSON outputsPhil Sutter2024-04-125-512/+0
| | | | | | These match the input already, no need to track them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Warn if recorded JSON output matches the inputPhil Sutter2024-04-121-0/+2
| | | | | | Actively support spring-cleaning by nagging callers. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Fix some JSON equivalentsPhil Sutter2024-04-123-55/+75
| | | | | | | | | | | | Make sure they match the standard syntax input as much as possible. For some reason inet/tcp.t.json was using plain arrays in place of binary OR expressions in many cases. These arrays are interpreted as list expressions, which seems to be semantically identical but the goal here is to present an accurate equivalent to the rule in standard syntax. Signed-off-by: Phil Sutter <phil@nwl.cc>
* mergesort: Avoid accidental set element reorderingPhil Sutter2024-04-124-22/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In corner cases, expr_msort_cmp() may return 0 for two non-identical elements. An example are ORed tcp flags: 'syn' and 'syn | ack' are considered the same value since expr_msort_value() reduces the latter to its LHS. Keeping the above in mind and looking at how list_expr_sort() works: The list in 'head' is cut in half, the first half put into the temporary list 'list' and finally 'list' is merged back into 'head' considering each element's position. Shall expr_msort_cmp() return 0 for two elements, the one from 'list' ends up after the one in 'head', thus reverting their previous ordering. The practical implication is that output never matches input for the sample set '{ syn, syn | ack }' as the sorting after delinearization in netlink_list_setelems() keeps swapping the elements. Out of coincidence, the commit this fixes itself illustrates the use-case this breaks, namely tracking a ruleset in git: Each ruleset reload will trigger an update to the stored dump. This change breaks interval set element deletion because __set_delete() implicitly relies upon this reordering of duplicate entries by inserting a clone of the one to delete into the start (via list_move()) and after sorting assumes the clone will end up right behind the original. Fix this by calling list_move_tail() instead. Fixes: 14ee0a979b622 ("src: sort set elements in netlink_get_setelems()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Accept more than two operands in binary expressionsPhil Sutter2024-04-127-235/+91
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: nft.8: Two minor synopsis fixupsPhil Sutter2024-04-111-2/+2
| | | | | | | | | | | | The curly braces in 'add table' are to be put literally, so need to be bold. Also, they are optional unless either one (or both) of 'comment' and 'flags' are specified. The 'add chain' synopsis contained a stray tick, messing up the following markup. Fixes: 7fd67ce121f86 ("doc: fix synopsis of named counter, quota and ct {helper,timeout,expect}") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: check for reset tcp options supportPablo Neira Ayuso2024-04-082-0/+7
| | | | | Fixes: 59a33d08ab3a ("parser: tcpopt: fix tcp option parsing with NUM + length field") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: maps/{vmap_unary,named_limits} require pipapo set backendPablo Neira Ayuso2024-04-084-0/+8
| | | | | | ... sets/typeof_sets_concat needs it too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-08-03 08:48:39 +0000