summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: allow to use variables in flowtable and chain devicesPablo Neira Ayuso2020-07-216-0/+180
| | | | | | | | | | | | | | | This patch adds support for using variables for devices in the chain and flowtable definitions, eg. define if_main = lo table netdev filter1 { chain Main_Ingress1 { type filter hook ingress device $if_main priority -500; policy accept; } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: chmod 755 testcases/chains/0030create_0Pablo Neira Ayuso2020-07-211-0/+0
| | | | | | Update permissions in this test script. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: extend existing dormat test case to catch a kernel bugFlorian Westphal2020-07-182-0/+5
| | | | | | | This is a test case for the kernel bug fixed by: netfilter: nf_tables: fix nat hook table deletion Signed-off-by: Florian Westphal <fw@strlen.de>
* monitor: print "dormant" flag in monitor modeFlorian Westphal2020-07-181-0/+4
| | | | | | | This distinction is important: a table with this flag is inert -- all base chains are unregistered and see no traffic. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: UAF in stmt_evaluate_log_prefix()Pablo Neira Ayuso2020-07-151-5/+4
| | | | | | | | Release existing list expression including variables after creating the prefix string. Fixes: 96c909ef46f0 ("src: allow for variables in the log prefix string") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in log prefix stringPablo Neira Ayuso2020-07-151-0/+1
| | | | | | | Release the string after creating the constant expression. Fixes: 96c909ef46f0 ("src: allow for variables in the log prefix string") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for implicit chain bindingsPablo Neira Ayuso2020-07-1516-34/+324
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to group rules in a subchain, e.g. table inet x { chain y { type filter hook input priority 0; tcp dport 22 jump { ip saddr { 127.0.0.0/8, 172.23.0.0/16, 192.168.13.0/24 } accept ip6 saddr ::1/128 accept; } } } This also supports for the `goto' chain verdict. This patch adds a new chain binding list to avoid a chain list lookup from the delinearize path for the usual chains. This can be simplified later on with a single hashtable per table for all chains. From the shell, you have to use the explicit separator ';', in bash you have to escape this: # nft add rule inet x y tcp dport 80 jump { ip saddr 127.0.0.1 accept\; ip6 saddr ::1 accept \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: convert chain name from gmp value to stringPablo Neira Ayuso2020-07-152-8/+15
| | | | | | | Add expr_chain_export() helper function to convert the chain name that is stored in a gmp value variable to string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow for variables in the log prefix stringPablo Neira Ayuso2020-07-084-5/+187
| | | | | | | | | | | | | | | | | | | For example: define test = "state" define foo = "match" table x { chain y { ct state invalid log prefix "invalid $test $foo:" } } This patch scans for variables in the log prefix string. The log prefix expression is a list of constant and variable expression that are converted into a constant expression from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use expression to store the log prefixPablo Neira Ayuso2020-07-0810-12/+48
| | | | | | Intsead of using an array of char. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: zap element statement when decomposing intervalPablo Neira Ayuso2020-07-063-0/+48
| | | | | | | | Otherwise, interval sets do not display element statement such as counters. Fixes: 6d80e0f15492 ("src: support for counter in set definition") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow for empty set variable definitionPablo Neira Ayuso2020-07-045-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow for empty set definition in variables if they are merged to non-empty set definition: define BASE_ALLOWED_INCOMING_TCP_PORTS = {22, 80, 443} define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {} table inet filter { chain input { type filter hook input priority 0; policy drop; tcp dport {$BASE_ALLOWED_INCOMING_TCP_PORTS, $EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept } } However, disallow this: define EXTRA_ALLOWED_INCOMING_TCP_PORTS = {} table inet filter { chain input { type filter hook input priority 0; policy drop; tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept } } # nft -f x.nft /tmp/x.nft:6:18-52: Error: Set is empty tcp dport {$EXTRA_ALLOWED_INCOMING_TCP_PORTS} ct state new counter accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: revisit meta/rt primary expressions and ct statementFlorian Westphal2020-06-252-4/+12
| | | | | | | Clarify meta/rt ipsec examples and document that 'ct helper set' needs to be used *after* conntrack lookup. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Document notrack statementPhil Sutter2020-06-221-0/+14
| | | | | | | | Merely a stub, but better to mention it explicitly instead of having it appear in synproxy examples and letting users guess as to what it does. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* tests: shell: Allow wrappers to be passed as nft commandStefano Brivio2020-06-151-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The current check on $NFT only allows to directly pass an executable, so I've been commenting it out locally for a while to run tests with valgrind. Instead of using the -x test, run nft without arguments and check the exit status. POSIX.1-2017, Shell and Utilities volume, par. 2.8.2 ("Exit Status for Commands") states: If a command is not found, the exit status shall be 127. If the command name is found, but it is not an executable utility, the exit status shall be 126. Applications that invoke utilities without using the shell should use these exit status values to report similar errors. While this script isn't POSIX-compliant, it requires bash, and any modern version of bash complies with those exit status requirements. Also valgrind complies with this. We need to quote the NFT variable passed to execute the commands in the main loop and adjust error and informational messages, too. This way, for example, export NFT="valgrind nft" can be issued to run tests with valgrind. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Run in separate network namespace, don't break connectivityStefano Brivio2020-06-152-0/+15
| | | | | | | | | | | | | It might be convenient to run tests from a development branch that resides on another host, and if we break connectivity on the test host as tests are executed, we can't run them this way. If kernel implementation (CONFIG_NET_NS), unshare(1), or Python bindings for unshare() are not available, warn and continue. Suggested-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to v0.9.6v0.9.6Pablo Neira Ayuso2020-06-151-2/+2
| | | | | | | | | | v0.9.5 broke 'vmap' support: https://bugzilla.kernel.org/show_bug.cgi?id=208093 Release new version to fix this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: rename testcases/map/dump/0009vmap_0dump.nftPablo Neira Ayuso2020-06-141-1/+1
| | | | | | | Missing .nft extension in dump file. Fixes: 54eb1e16cc47 ("evaluate: missing datatype definition in implicit_set_declaration()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: fix build with gcc <= 4.8Fabrice Fontaine2020-06-081-1/+3
| | | | | | | | | | | | | | | Since commit 719e44277f8e89323a87219b4d4bc7abac05b051, build with gcc <= 4.8 fails on: main.c:186:2: error: 'for' loop initial declarations are only allowed in C99 mode for (size_t i = IDX_INTERACTIVE + 1; i < NR_NFT_OPTIONS; ++i) ^ Fixes: - http://autobuild.buildroot.org/results/cf2359b8311fe91f9335c91f2bb4a730c9f4c9dc Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: add misspelling suggestions for rule commandsPablo Neira Ayuso2020-06-081-0/+38
| | | | | | | | | # nft add rule foo ber counter Error: No such file or directory; did you mean chain ‘bar’ in table ip ‘foo’? add rule foo ber counter ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix asan runtime error in tc handlePablo Neira Ayuso2020-06-081-1/+1
| | | | | | | | | | ASAN reports: meta.c:92:17: runtime error: left shift of 34661 by 16 places cannot be represented in type 'int' use 32-bit integer as tmp variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: fix asan runtime errorPablo Neira Ayuso2020-06-081-2/+2
| | | | | | | | | | ASAN reports: segtree.c:387:30: runtime error: variable length array bound evaluates to non-positive value 0 Update array definition to be the set size plus 1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: release dummy rule object from netlink_parse_set_expr()Pablo Neira Ayuso2020-06-083-1/+38
| | | | | | | | | | | | | | | | | | | | | netlink_parse_set_expr() creates a dummy rule object to reuse the existing netlink parser. Release the rule object to fix a memleak. Zap the statement list to avoid a use-after-free since the statement needs to remain in place after releasing the rule. ==21601==ERROR: LeakSanitizer: detected memory leaks Direct leak of 2016 byte(s) in 4 object(s) allocated from: #0 0x7f7824b26330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f78245fcebd in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 #2 0x7f78245fd016 in xzalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:65 #3 0x7f782456f0b5 in rule_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/rule.c:623 Add a test to check for set counters. SUMMARY: AddressSanitizer: 2016 byte(s) leaked in 4 allocation(s). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove superfluous check in set_evaluate()Pablo Neira Ayuso2020-06-071-5/+0
| | | | | | If set_is_objmap() is true, then set->data is always NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: missing datatype definition in implicit_set_declaration()Pablo Neira Ayuso2020-06-073-10/+44
| | | | | | | | | | | | | | | | | | | | | | set->data from implicit_set_declaration(), otherwise, set_evaluation() bails out with: # nft -f /etc/nftables/inet-filter.nft /etc/nftables/inet-filter.nft:8:32-54: Error: map definition does not specify mapping data type tcp dport vmap { 22 : jump ssh_input } ^^^^^^^^^^^^^^^^^^^^^^^ /etc/nftables/inet-filter.nft:13:26-52: Error: map definition does not specify mapping data type iif vmap { "eth0" : jump wan_input } ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Add a test to cover this case. Fixes: 7aa08d45031e ("evaluate: Perform set evaluation on implicitly declared (anonymous) sets") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=208093 Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to v0.9.5v0.9.5Pablo Neira Ayuso2020-06-061-4/+4
| | | | | | | | Update release name based on Jazz series, Gene Krupa's "Capital Idea". Bump dependencies on libmnl and libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow flowtable definitions with no devicesPablo Neira Ayuso2020-06-023-13/+14
| | | | | | | | | | | | | The listing shows no devices: # nft list ruleset table ip x { flowtable y { hook ingress priority filter } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: delete devices to an existing flowtablePablo Neira Ayuso2020-06-022-0/+18
| | | | | | | | This patch allows you to remove a device to an existing flowtable: # nft delete flowtable x y { devices = { eth0 } \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add devices to an existing flowtablePablo Neira Ayuso2020-06-022-16/+21
| | | | | | | | This patch allows you to add new devices to an existing flowtables. # nft add flowtable x y { devices = { eth0 } \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add function to convert flowtable device list to arrayPablo Neira Ayuso2020-06-021-20/+34
| | | | | | | | This patch adds nft_flowtable_dev_array() to convert the list of devices into an array. This array is released through nft_flowtable_dev_array_free(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Enable anonymous set rule with concatenated ranges in inet/sets.tStefano Brivio2020-05-284-1/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 64b9aa3803dd ("tests/py: Add tests involving concatenated ranges") introduced a rule, commented out, adding an anonymous set including concatenated ranges. Now that they are properly handled, we can enable it. Note that this introduces a new warning. In the output below, '\' marks newlines I introduced to keep lines short: inet/sets.t: WARNING: line 24: \ 'add rule inet test-inet input ip daddr . tcp dport \ { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept': \ 'ip daddr . tcp dport \ { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept' \ mismatches 'meta nfproto ipv4 ip daddr . tcp dport \ { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443} accept' which is similar to the existing warning, also introduced by commit 64b9aa3803dd: inet/sets.t: WARNING: line 23: \ 'add rule inet test-inet input \ ip saddr . ip daddr . tcp dport @set3 accept': \ 'ip saddr . ip daddr . tcp dport @set3 accept' mismatches \ 'meta nfproto ipv4 ip saddr . ip daddr . tcp dport @set3 accept' This is mentioned in the commit message for 64b9aa3803dd itself: * Payload dependency killing ignores the concatenated IP header expressions on LHS, so rule output is asymmetric. which means that for family inet, 'meta nfproto ipv4' is added to the output of the rule, on top of what was passed as input, but not for families bridge and netdev. For this reason, it's not possible in this case to specify a single expected output, differing from the input, and, also, 'meta nfproto ipv4' can only be passed as input for family inet as it's not relevant for the other families. As an alternative, we could split the rules from this test into tests for the corresponding families, as this test case itself is under the 'inet' directory, but I consider this beyond the scope of this patchset. v2: Enable rule in py/inet/sets.t instead of adding a new test in shell/sets (Phil Sutter) Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* evaluate: Perform set evaluation on implicitly declared (anonymous) setsStefano Brivio2020-05-281-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a set is implicitly declared, set_evaluate() is not called as a result of cmd_evaluate_add(), because we're adding in fact something else (e.g. a rule). Expression-wise, evaluation still happens as the implicit set expression is eventually found in the tree and handled by expr_evaluate_set(), but context-wise evaluation (set_evaluate()) is skipped, and this might be relevant instead. This is visible in the reported case of an anonymous set including concatenated ranges: # nft add rule t c ip saddr . tcp dport { 192.0.2.1 . 20-30 } accept BUG: invalid range expression type concat nft: expression.c:1160: range_expr_value_low: Assertion `0' failed. Aborted because we reach do_add_set() without properly evaluated flags and set description, and eventually end up in expr_to_intervals(), which can't handle that expression. Explicitly call set_evaluate() as we add anonymous sets into the context, and instruct the same function to: - skip expression-wise set evaluation if the set is anonymous, as that happens later anyway as part of the general tree evaluation - skip the insertion in the set cache, as it makes no sense to have sets that shouldn't be referenced there For object maps, the allocation of the expression for set->data is already handled by set_evaluate(), so we can now drop that from stmt_evaluate_objref_map(). v2: - skip insertion of set in cache (Pablo Neira Ayuso) - drop double allocation of expression (and leak of the first one) for object maps (Pablo Neira Ayuso) Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: enable reject with 802.1qMichael Braun2020-05-283-6/+24
| | | | | | | | | | | | This enables the use nft bridge reject with bridge vlan filtering. It depends on a kernel patch to make the kernel preserve the vlan id in nft bridge reject generation. [ pablo: update tests/py ] Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add frag-needed (ipv4) to reject optionsMichael Braun2020-05-284-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | This enables to send icmp frag-needed messages using reject target. I have a bridge with connects an gretap tunnel with some ethernet lan. On the gretap device I use ignore-df to avoid packets being lost without icmp reject to the sender of the bridged packet. Still I want to avoid packet fragmentation with the gretap packets. So I though about adding an nftables rule like this: nft insert rule bridge filter FORWARD \ ip protocol tcp \ ip length > 1400 \ ip frag-off & 0x4000 != 0 \ reject with icmp type frag-needed This would reject all tcp packets with ip dont-fragment bit set that are bigger than some threshold (here 1400 bytes). The sender would then receive ICMP unreachable - fragmentation needed and reduce its packet size (as defined with PMTU). [ pablo: update tests/py ] Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove empty filePablo Neira Ayuso2020-05-261-0/+0
| | | | | | Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1429 Fixes: f9465cf517cc ("src: add STMT_NAT_F_CONCAT flag and use it") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Actually use all available hooks in bridge/chains.tStefano Brivio2020-05-251-2/+2
| | | | | | | | | | Despite being explicitly mentioned as available, prerouting and postrouting hooks are not used, filter-pre and filter-post chains are both built to hook on input. Fixes: 25851df85e85 ("tests: regression: revisit chain tests") Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Fix doc build, restore A2X assignment for doc/MakefileStefano Brivio2020-05-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 4f2813a313ae ("build: Include generated man pages in dist tarball") skips AC_CHECK_PROG for A2X altogether if doc/nft.8 is already present. Now, starting from a clean situation, we can have this sequence: ./configure # doc/nft.8 not there, A2X set in doc/Makefile make # builds doc/nft.8 ./configure # doc/nft.8 is there, A2X left empty in doc/Makefile make clean # removes doc/nft.8 make resulting in: [...] GEN nft.8 /bin/sh: -L: command not found make[2]: *** [Makefile:639: nft.8] Error 127 and the only way to get out of this is to issue ./configure again after make clean, which is rather unexpected. Instead of skipping AC_CHECK_PROG when doc/nft.8 is present, keep it and simply avoid returning failure if a2x(1) is not available but doc/nft.8 was built, so that A2X is properly set in doc/Makefile whenever needed. Fixes: 4f2813a313ae ("build: Include generated man pages in dist tarball") Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix tentative generation of nft.8 after disabled docLaura Garcia Liebana2020-05-181-1/+1
| | | | | | | | | | | | | | | | | | | Despite doc generation is disabled, the makefile is trying to build it. $ ./configure --disable-man-doc $ make Making all in doc make[2]: Entering directory '/workdir/build-pkg/workdir/doc' make[2]: *** No rule to make target 'nft.8', needed by 'all-am'. Stop. make[2]: Leaving directory '/workdir/build-pkg/workdir/doc' make[1]: *** [Makefile:479: all-recursive] Error 1 make[1]: Leaving directory '/workdir/build-pkg/workdir' make: *** [Makefile:388: all] Error 2 Fixes: 4f2813a313ae0 ("build: Include generated man pages in dist tarball") Reported-by: Adan Marin Jacquot <adan.marin@zevenet.com> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add CMD_OBJ_SETELEMSPablo Neira Ayuso2020-05-142-4/+21
| | | | | | | | | | | This new command type results from expanding the set definition in two commands: One to add the set and another to add the elements. This results in 1:1 mapping between the command object to the netlink API. The command is then translated into a netlink message which gets a unique sequence number. This sequence number allows to correlate the netlink extended error reporting with the corresponding command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: call nft_cmd_expand() only with CMD_ADDPablo Neira Ayuso2020-05-141-1/+5
| | | | | | | Restrict the expansion logic to the CMD_ADD command which is where this is only required. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTSPablo Neira Ayuso2020-05-146-17/+17
| | | | | | | | The CMD_OBJ_ELEMENTS provides an expression that contains the list of set elements. This leaves room to introduce CMD_OBJ_SETELEMS in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix error rule reporting with missing table/chain and anonymous setsPablo Neira Ayuso2020-05-141-0/+1
| | | | | | | | | | | | | | | | | handle_merge() skips handle location initialization because set name != NULL. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f64f1e in erec_print (octx=0x55555555d2c0, erec=0x55555555fcf0, debug_mask=0) at erec.c:95 95 switch (indesc->type) { (gdb) bt buf=0x55555555db20 "add rule inet traffic-filter input tcp dport { 22, 80, 443 } accept") at libnftables.c:459 (gdb) p indesc $1 = (const struct input_descriptor *) 0x0 Closes: http://bugzilla.opensuse.org/show_bug.cgi?id=1171321 Fixes: 086ec6f30c96 ("mnl: extended error support for create command") Reported-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Improve performance of json_events_cb()Phil Sutter2020-05-141-3/+6
| | | | | | | | | | | | The function tries to insert handles into JSON input for echo option. Yet there may be nothing to do if the given netlink message doesn't contain a handle, e.g. if it is an 'add element' command. Calling seqnum_to_json() is pointless overhead in that case, and if input is large this overhead is significant. Better wait with that call until after checking if the message is relevant at all. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Eric Garver <eric@garver.life>
* evaluate: fix memleak in stmt_evaluate_reject_icmp()Pablo Neira Ayuso2020-05-061-0/+2
| | | | | | | | | | | | | | | | | | ==26297==ERROR: LeakSanitizer: detected memory leaks c Direct leak of 512 byte(s) in 4 object(s) allocated from: #0 0x7f46f8167330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f46f7b3cf1c in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 #2 0x7f46f7b3d075 in xzalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:65 #3 0x7f46f7a85760 in expr_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/expression.c:45 #4 0x7f46f7a8915d in constant_expr_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/expression.c:388 #5 0x7f46f7a7bad4 in symbolic_constant_parse /home/pablo/devel/scm/git-netfilter/nftables/src/datatype.c:173 #6 0x7f46f7a7af5f in symbol_parse /home/pablo/devel/scm/git-netfilter/nftables/src/datatype.c:132 #7 0x7f46f7abf2bd in stmt_evaluate_reject_icmp /home/pablo/devel/scm/git-netfilter/nftables./src/evaluate.c:2739 [...] SUMMARY: AddressSanitizer: 544 byte(s) leaked in 8 allocation(s). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix netlink_get_setelem() memleaksPablo Neira Ayuso2020-05-062-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ==26693==ERROR: LeakSanitizer: detected memory leaks Direct leak of 256 byte(s) in 2 object(s) allocated from: #0 0x7f6ce2189330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f6ce1b1767a in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 #2 0x7f6ce1b177d3 in xzalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:65 #3 0x7f6ce1a41760 in expr_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/expression.c:45 #4 0x7f6ce1a4dea7 in set_elem_expr_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/expression.c:1278 #5 0x7f6ce1ac2215 in netlink_delinearize_setelem /home/pablo/devel/scm/git-netfilter/nftables/src/netlink.c:1094 #6 0x7f6ce1ac3c16 in list_setelem_cb /home/pablo/devel/scm/git-netfilter/nftables/src/netlink.c:1172 #7 0x7f6ce0198808 in nftnl_set_elem_foreach /home/pablo/devel/scm/git-netfilter/libnftnl/src/set_elem.c:725 Indirect leak of 256 byte(s) in 2 object(s) allocated from: #0 0x7f6ce2189330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f6ce1b1767a in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 #2 0x7f6ce1b177d3 in xzalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:65 #3 0x7f6ce1a41760 in expr_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/expression.c:45 #4 0x7f6ce1a4515d in constant_expr_alloc /home/pablo/devel/scm/git-netfilter/nftables/src/expression.c:388 #5 0x7f6ce1abaf12 in netlink_alloc_value /home/pablo/devel/scm/git-netfilter/nftables/src/netlink.c:354 #6 0x7f6ce1ac17f5 in netlink_delinearize_setelem /home/pablo/devel/scm/git-netfilter/nftables/src/netlink.c:1080 #7 0x7f6ce1ac3c16 in list_setelem_cb /home/pablo/devel/scm/git-netfilter/nftables/src/netlink.c:1172 #8 0x7f6ce0198808 in nftnl_set_elem_foreach /home/pablo/devel/scm/git-netfilter/libnftnl/src/set_elem.c:725 Indirect leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7f6ce2189720 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9720) #1 0x7f6ce1b1778d in xrealloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:55 #2 0x7f6ce1b1756d in gmp_xrealloc /home/pablo/devel/scm/git-netfilter/nftables/src/gmputil.c:202 #3 0x7f6ce1417059 in __gmpz_realloc (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x23059) Indirect leak of 8 byte(s) in 1 object(s) allocated from: #0 0x7f6ce2189330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7f6ce1b1767a in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 #2 0x7f6ce14105c5 in __gmpz_init2 (/usr/lib/x86_64-linux-gnu/libgmp.so.10+0x1c5c5) SUMMARY: AddressSanitizer: 536 byte(s) leaked in 6 allocation(s). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ct_timeout: release policy string and state listPablo Neira Ayuso2020-05-052-0/+2
| | | | | | | | | | | | | | | | | | | ================================================================= ==19037==ERROR: LeakSanitizer: detected memory leaks Direct leak of 18 byte(s) in 2 object(s) allocated from: #0 0x7ff6ee6f9810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7ff6ee22666d in xstrdup /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:75 #2 0x7ff6ee28cce9 in nft_parse /home/pablo/devel/scm/git-netfilter/nftables/src/parser_bison.c:5792 #3 0x4b903f302c8010a (<unknown module>) Direct leak of 16 byte(s) in 1 object(s) allocated from: #0 0x7ff6ee7a8330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330) #1 0x7ff6ee226578 in xmalloc /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:36 SUMMARY: AddressSanitizer: 34 byte(s) leaked in 3 allocation(s). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: release helper type string after parsingPablo Neira Ayuso2020-05-051-0/+1
| | | | | | | | | | | ==4060==ERROR: LeakSanitizer: detected memory leaks Direct leak of 4 byte(s) in 1 object(s) allocated from: #0 0x7f637b64a810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7f637b17766d in xstrdup /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:75 #2 0x7f637b1ddce9 in nft_parse /home/pablo/devel/scm/git-netfilter/nftables/src/parser_bison.c:5792 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: release extended priority string after parsingPablo Neira Ayuso2020-05-051-0/+1
| | | | | | | | | | | | | | | | ==29581==ERROR: LeakSanitizer: detected memory leaks Direct leak of 1034 byte(s) in 152 object(s) allocated from: #0 0x7f7b55f1b810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7f7b559597e0 in xstrdup /home/pablo/devel/scm/git-netfilter/nftables/src/utils.c:75 #2 0x7f7b55a494a0 in nft_lex /home/pablo/devel/scm/git-netfilter/nftables/src/scanner.l:641 #3 0x7f7b559cec25 in nft_parse /home/pablo/devel/scm/git-netfilter/nftables/src/parser_bison.c:5792 #4 0x7f7b5597e318 in nft_parse_bison_filename /home/pablo/devel/scm/git-netfilter/nftables/src/libnftables.c:392 #5 0x7f7b5597f864 in nft_run_cmd_from_filename /home/pablo/devel/scm/git-netfilter/nftables/src/libnftables.c:495 #6 0x562a25bbce71 in main /home/pablo/devel/scm/git-netfilter/nftables/src/main.c:457 #7 0x7f7b5457509a in __libc_start_main ../csu/libc-start.c:308 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule_stmt_append() and use itPablo Neira Ayuso2020-05-055-10/+14
| | | | | | | This helper function adds a statement at the end of the rule statement list and it updates the rule statement counter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule_stmt_insert_at() and use itPablo Neira Ayuso2020-05-053-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | This helper function adds a statement at a given position and it updates the rule statement counter. This patch fixes this: flush table bridge test-bridge add rule bridge test-bridge input vlan id 1 ip saddr 10.0.0.1 rule.c:2870:5: runtime error: index 2 out of bounds for type 'stmt *[*]' ================================================================= ==1043==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffdd69c1350 at pc 0x7f1036f53330 bp 0x7ffdd69c1300 sp 0x7ffdd69c12f8 WRITE of size 8 at 0x7ffdd69c1350 thread T0 #0 0x7f1036f5332f in payload_try_merge /home/mbr/nftables/src/rule.c:2870 #1 0x7f1036f534b7 in rule_postprocess /home/mbr/nftables/src/rule.c:2885 #2 0x7f1036fb2785 in rule_evaluate /home/mbr/nftables/src/evaluate.c:3744 #3 0x7f1036fb627b in cmd_evaluate_add /home/mbr/nftables/src/evaluate.c:3982 #4 0x7f1036fbb9e9 in cmd_evaluate /home/mbr/nftables/src/evaluate.c:4462 #5 0x7f10370652d2 in nft_evaluate /home/mbr/nftables/src/libnftables.c:414 #6 0x7f1037065ba1 in nft_run_cmd_from_buffer /home/mbr/nftables/src/libnftables.c:447 Reported-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>