summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* gmputil: add nft_gmp_free() to free strings from mpz_get_str()Thomas Haller2023-11-093-4/+25
| | | | | | | | | | | | | | | | mpz_get_str() (with NULL as first argument) will allocate a buffer using the allocator functions (mp_set_memory_functions()). We should free those buffers with the corresponding free function. Add nft_gmp_free() for that and use it. The name nft_gmp_free() is chosen because "mini-gmp.c" already has an internal define called gmp_free(). There wouldn't be a direct conflict, but using the same name is confusing. And maybe our own defines should have a clear nft prefix. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: don't return a const string from cgroupv2_get_path()Thomas Haller2023-11-091-3/+3
| | | | | | | | The caller is supposed to free the allocated string. Return a non-const string to make that clearer. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: place byteorder conversion before rshift in payload expressionsPablo Neira Ayuso2023-11-065-1/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the key from the evaluation context to perform the byteorder conversion in case that this expression is used for lookups and updates on explicit sets. # nft --debug=netlink add rule ip6 t output ip6 dscp @mapv6 ip6 t output [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <-------------- this was missing! [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ lookup reg 1 set mapv6 ] Also with set statements (updates from packet path): # nft --debug=netlink add rule ip6 t output update @mapv6 { ip6 dscp } ip6 t output [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <------------- also here! [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ dynset update reg_key 1 set mapv6 ] Simple matches on values and implicit sets rely on the binary transfer mechanism to propagate the shift to the constant, no explicit byteorder is required in such case. Fixes: 668c18f67203 ("evaluate: place byteorder conversion before rshift in payload statement") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reset statement length context only for set mappingsPablo Neira Ayuso2023-11-065-1/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | map expression (which is used a key to look up for the mapping) needs to consider the statement length context, otherwise incorrect bytecode is generated when {ct,meta} statement is generated. # nft -f - <<EOF add table ip6 t add chain ip6 t c add map ip6 t mapv6 { typeof ip6 dscp : meta mark; } EOF # nft -d netlink add rule ip6 t c meta mark set ip6 dscp map @mapv6 ip6 t c [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] ... missing byteorder conversion here before shift ... [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ lookup reg 1 set mapv6 dreg 1 ] [ meta set mark with reg 1 ] Reset statement length context only for the mapping side for the elements in the set. Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Reported-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix hour decoding when timezone offset is negativeFlorian Westphal2023-11-023-2/+61
| | | | | | | | | | | | | | | | | | | | | Brian Davidson says: meta hour rules don't display properly after being created when the hour is on or after 00:00 UTC. The netlink debug looks correct for seconds past midnight UTC, but displaying the rules looks like an overflow or a byte order problem. I am in UTC-0400, so today, 20:00 and later exhibits the problem, while 19:00 and earlier hours are fine. meta.c only ever worked when the delta to UTC is positive. We need to add in case the second counter turns negative after offset adjustment. Also add a test case for this. Fixes: f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") Reported-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tproxy: Drop artificial port printing restrictionPhil Sutter2023-11-024-1/+50
| | | | | | | | | | | | | It does not make much sense to omit printing the port expression if it's not a value expression: On one hand, input allows for more advanced uses. On the other, if it is in-kernel, best nft can do is to try and print it no matter what. Just ignoring ruleset elements can't be correct. Fixes: 2be1d52644cf7 ("src: Add tproxy support") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1721 Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: no recursive make for "doc/Makefile.am"Thomas Haller2023-11-023-36/+55
| | | | | | | | Merge the Makefile.am under "doc/" into the toplevel Makefile.am. This is a step in the effort of dropping recursive make. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: no recursive make for "examples/Makefile.am"Thomas Haller2023-11-023-10/+16
| | | | | | | | Merge the Makefile.am under "examples/" into the toplevel Makefile.am. This is a step in the effort of dropping recursive make. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: no recursive make for "src/Makefile.am"Thomas Haller2023-11-024-146/+213
| | | | | | | | Merge the Makefile.am under "src/" into the toplevel Makefile.am. This is a step in the effort of dropping recursive make. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: no recursive make for "files/**/Makefile.am"Thomas Haller2023-11-026-29/+42
| | | | | | | | Merge the Makefile.am under "files/" into the toplevel Makefile.am. This is a step in the effort of dropping recursive make. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: no recursive make for "py/Makefile.am"Thomas Haller2023-11-023-6/+16
| | | | | | | | Merge the Makefile.am under "py/" into the toplevel Makefile.am. This is a step in the effort of dropping recursive make. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: no recursive-make for "include/**/Makefile.am"Thomas Haller2023-11-0210-81/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switch from recursive-make to a single top-level Makefile. This is the first step, the following patches will continue this. Unlike meson's subdir() or C's #include, automake's SUBDIRS= does not include a Makefile. Instead, it calls `make -C $dir`. https://www.gnu.org/software/make/manual/html_node/Recursion.html https://www.gnu.org/software/automake/manual/html_node/Subdirectories.html See also, "Recursive Make Considered Harmful". https://accu.org/journals/overload/14/71/miller_2004/ This has several problems, which we an avoid with a single Makefile: - recursive-make is harder to maintain and understand as a whole. Recursive-make makes sense, when there are truly independent sub-projects. Which is not the case here. The project needs to be considered as a whole and not one directory at a time. When we add unit tests (which we should), those would reside in separate directories but have dependencies between directories. With a single Makefile, we see all at once. The build setup has an inherent complexity, and that complexity is not necessarily reduced by splitting it into more files. On the contrary it helps to have it all in once place, provided that it's sensibly structured, named and organized. - typing `make` prints irrelevant "Entering directory" messages. So much so, that at the end of the build, the terminal is filled with such messages and we have to scroll to see what even happened. - with recursive-make, during build we see: make[3]: Entering directory '.../nftables/src' CC meta.lo meta.c:13:2: error: #warning hello test [-Werror=cpp] 13 | #warning hello test | ^~~~~~~ With a single Makefile we get CC src/meta.lo src/meta.c:13:2: error: #warning hello test [-Werror=cpp] 13 | #warning hello test | ^~~~~~~ This shows the full filename -- assuming that the developer works from the top level directory. The full name is useful, for example to copy+paste into the terminal. - single Makefile is also faster: $ make && perf stat -r 200 -B make -j I measure 35msec vs. 80msec. - recursive-make limits parallel make. You have to craft the SUBDIRS= in the correct order. The dependencies between directories are limited, as make only sees "LDADD = $(top_builddir)/src/libnftables.la" and not the deeper dependencies for the library. - I presume, some people like recursive-make because of `make -C $subdir` to only rebuild one directory. Rebuilding the entire tree is already very fast, so this feature seems not relevant. Also, as dependency handling is limited, we might wrongly not rebuild a target. For example, make check touch src/meta.c make -C examples check does not rebuild "examples/nft-json-file". What we now can do with single Makefile (and better than before), is `make examples/nft-json-file`, which works as desired and rebuilds all dependencies. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* gitignore: ignore ".dirstamp" filesThomas Haller2023-11-021-0/+1
| | | | | | | | Those will be generated by automake, once the recursive Makefiles are gone. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: fix mount command in "test-wrapper.sh"Thomas Haller2023-11-021-1/+1
| | | | | | | | | | | | | | | With Fedora 39 (util-linux-core-2.39.2-1.fc39), the mount command starts to fail. It was still working with Fedora 38 (util-linux-core-2.38.1-4.fc38). $ unshare -f -p -m --mount-proc -U --map-root-user -n bash -c 'mount -t tmpfs --make-private /var/run && mount' mount: /run: mount failed: Invalid argument. Not sure why this starts to fail. But arguably the command line arguments were wrong. Fix it, we need a pseudo name for the device. Fixes: df6f1a3e0803 ("tests/shell: bind mount private /var/run/netns in test container") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: reject set in concatenationPablo Neira Ayuso2023-10-261-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | Consider the following ruleset. define ext_if = { "eth0", "eth1" } table ip filter { chain c { iifname . tcp dport { $ext_if . 22 } accept } } Attempting to load this ruleset results in: BUG: invalid expression type 'set' in setnft: netlink.c:304: __netlink_gen_concat_key: Assertion `0' failed. Aborted (core dumped) After this patch: # nft -f ruleset.nft ruleset.nft:1:17-40: Error: cannot use set in concatenation define ext_if = { "eth0", "eth1" } ^^^^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1715 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* check-tree.sh: check and flag /bin/sh usageFlorian Westphal2023-10-241-0/+1
| | | | | | | | | | | | Almost all shell tests use /bin/bash already. In some cases we've had shell tests use /bin/sh, but still having a bashism. This causes failures on systems where sh is dash or another, strict bourne shell. Flag those via check-tree.sh. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: use /bin/bash in sets/elem_opts_compat_0Pablo Neira Ayuso2023-10-241-1/+1
| | | | | | So running this test with /bin/sh != /bin/bash works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: fix length check for ifname in ifname_expr_alloc()Thomas Haller2023-10-242-7/+3
| | | | | | | | | | | | | | IFNAMSIZ is 16, and the allowed byte length of the name is one less than that. Fix the length check and adjust a test for covering the longest allowed interface name. This is obviously a change in behavior, because previously interface names with length 16 were accepted and were silently truncated along the way. Now they are rejected as invalid. Fixes: fa52bc225806 ("parser: reject zero-length interface names") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: cover long interface name in "0042chain_variable_0" testThomas Haller2023-10-242-6/+34
| | | | | | | | | | | | | | | | IFNAMSIZ is 16. Adjust "0042chain_variable_0" to use an interface name with the maximum allowed bytes length. Instead of adding an entirely different test, adjust an existing one to use another interface name. The aspect for testing for a long interface name is not special enough, to warrant a separate test. We can cover it by extending an existing test. Note that the length check in "parser_bison.y" is wrong. The test checks still for the wrong behavior and that "d23456789012345x" is accepted. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add "bogons/nft-f/zero_length_devicename2_assert"Thomas Haller2023-10-241-0/+5
| | | | | | | | | | | | | | | | | This is copied from "bogons/nft-f/zero_length_devicename_assert" and adjusted. - `device""lo"` looks odd. In this file use `device ""` to only check against empty strings, without oddity. - "ip" type has no hook ingress in filter. If the device name would be valid, the file would still be rejected. Use "netdev". The purpose is to add a test for a file that would otherwise pass, except having an empty device name. Without oddities. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tools: reject unexpected files in "tests/shell/testcases/" with "check-tree.sh"Thomas Haller2023-10-241-2/+17
| | | | | | | | | "check-tree.sh" does consistency checks on the source tree. Extend the check to flag more unexpected files. We don't want to accidentally have left over files. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: inline input data in "single_anon_set" testThomas Haller2023-10-242-40/+45
| | | | | | | | | | | | | | | | | The file "optimizations/dumps/single_anon_set.nft.input" was laying around, and it was unclear how it was used. Let's extend "check-patch.sh" to flag all unused files. But the script cannot understand how "single_anon_set.nft.input" is used (aside allow listing it). Instead, inline the script to keep it inside the test (script). We still write the data to a separate file and don't use `nft -f -` (because reading stdin uses a different code path we want to cover). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: test for maximum length of "comment" in "comments_objects_0"Thomas Haller2023-10-242-6/+23
| | | | | | | | | | | | | | | The comment length is limited to NFTNL_UDATA_COMMENT_MAXLEN. Test for that. Adjust an existing test for that. Also rename $EXPECTED to $RULESET. We don't compare the value of $EXPECTED against the actually configured rules. It also wouldn't work, because the input is not normalized and wouldn't match. It also isn't necessary, because there is a .nft dump file. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add missing "elem_opts_compat_0.nodump" fileThomas Haller2023-10-241-0/+0
| | | | | | | | | | This is an inconsistency. The test should have either a .nft or a .nodump file. "./tools/check-tree.sh" enforces that and will in the future run by `make check`. Fixes: 22fab8681a50 ("parser_bison: Fix for broken compatibility with older dumps") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: honor NFT_TEST_VERBOSE_TEST variable to debug tests via `bash -x`Thomas Haller2023-10-212-2/+28
| | | | | | | | | | | | | | | | | | | | | | | | | It can be cumbersome to debug why a test fails. Our tests are just shell scripts, which for the most part don't print much. That is good, but for debugging, it can be useful to run the test via `bash -x`. Previously, we would just patch the source file while debugging. Add an option "-x" and NFT_TEST_VERBOSE_TEST=y environment variable. If set, "test-wrapper.sh" will check whether the shebang is "#!/bin/bash" and add "-x" to the command line. While at it, let test-wrapper.sh also log a line like Command: $CMD With this, we see in the log the command that was run, and how NFT_TEST_VERBOSE_TEST may have affected it. This is anyway useful, because many tests don't print anything at all, and we end up with an empty "testout.log". Empty files are cumbersome, e.g. I like to use `grep -R ^` to show the content of all files, which does not show empty files. Ensuring that something is always written is desirable. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: Fix for broken compatibility with older dumpsPhil Sutter2023-10-202-0/+35
| | | | | | | | | | | | Commit e6d1d0d611958 ("src: add set element multi-statement support") changed the order of expressions and other state attached to set elements are expected in input. This broke parsing of ruleset dumps created by nft commands prior to that commit. Restore compatibility by also accepting the old ordering. Fixes: e6d1d0d611958 ("src: add set element multi-statement support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* build: Bump version to 1.0.9v1.0.9Pablo Neira Ayuso2023-10-191-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: validate maximum log statement prefix lengthPablo Neira Ayuso2023-10-171-1/+6
| | | | | | | | Otherwise too long string overruns the log prefix buffer. Fixes: e76bb3794018 ("src: allow for variables in the log prefix string") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1714 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: use bash instead of /bin/sh for testsThomas Haller2023-10-1612-12/+12
| | | | | | | | | | | | | | | | | All tests under "tests/shell" are shell scripts with shebang /bin/bash or /bin/sh. This may seem expected, since these tests are under "tests/shell" directory, but any executable file would work. Anyway. The vast majority of the tests has "#!/bin/bash" as shebang. A few tests had "#!/bin/sh" or "#!/bin/sh -e". Unify this and always use bash. Since we anyway require bash, this is not a limitation. Also, if we know that this is a bash script (by parsing the shebang), we can let the test wrapper pass "-x" to the script. The next commit will do that, and it is nicer if the shebangs are all uniform. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add missing "vlan_8021ad_tag.nodump" fileThomas Haller2023-10-161-0/+0
| | | | | | | | | | This is an inconsistency. The test should have either a .nft or a .nodump file. "./tools/check-tree.sh" enforces that and will in the future run by `make check`. Fixes: 74cf3d16d8e9 ('tests: shell: add vlan match test case') Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: suggest != in negation error messageFlorian Westphal2023-10-131-1/+1
| | | | | | | | | | | | | | when I run sudo nft insert rule filter FORWARD iifname "ens2f1" ip saddr not @ip_macs counter drop comment \" BLOCK ALL NON REGISTERED IP/MACS \" I get: Error: negation can only be used with singleton bitmask values And even I did not spot the problem immediately. I don't think "not" should have been added, its easily confused with "not equal"/"neq"/!= and hides that this is allegedly a binop. At least *mention* that the commandline is asking for a binary operation here and suggest "!=". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: add "-S|--setup-host" option to set sysctl for rootless testsThomas Haller2023-10-101-0/+46
| | | | | | | | | | | | | | | | | | | | | | Most tests can run just fine without root. A few of them will fail if /proc/sys/net/core/{wmem_max,rmem_max} is too small (as it is by default on the host). The easy workaround is to bump those limits once. This has to be repeated after each reboot. Doing that manually (every time) is cumbersome. Add a "--setup-host" option for that. Usage: $ sudo ./tests/shell/run-tests.sh -S Setting up host for running as rootless (requires root). echo 4096000 > /proc/sys/net/core/rmem_max (previous value 100000) echo 4096000 > /proc/sys/net/core/wmem_max (previous value 100000) Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: preserve result directory with NFT_TEST_FAIL_ON_SKIPThomas Haller2023-10-101-2/+7
| | | | | | | | | | | On a successful run, the result directory will be deleted (unless run with "-k|--keep-logs" option or NFT_TEST_KEEP_LOGS=y). With NFT_TEST_FAIL_ON_SKIP=y, when there are no failures but skipped tests, also preserve the result. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: mount all of "/var/run" in "test-wrapper.sh"Thomas Haller2023-10-101-11/+15
| | | | | | | | | | | | | | | | | | | | | After reboot, "/var/run/netns" does not exist before we run the first `ip netns add` command. Previously, "test-wrapper.sh" would mount a tmpfs on that directory, but that fails, if the directory doesn't exist. You will notice this, by deleting /var/run/netns (which only root can delete or create, and which is wiped on reboot). Instead, mount all of "/var/run". Then we can also create /var/run/netns directory. This means, any other content from /var/run is hidden too. That's probably desirable, because it means we don't depend on stuff that happens to be there. If we would require other content in /var/run, then the test runner needs to be aware of the requirement and ensure it's present. But best is just to not require anything. It's only iproute2 which insists on /var/run/netns. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: remove references to timeout in reset commandPablo Neira Ayuso2023-10-101-5/+5
| | | | | | | | | | After Linux kernel's patch ("netfilter: nf_tables: do not refresh timeout when resetting element") timers are not reset anymore, update documentation to keep this in sync. Fixes: 83e0f4402fb7 ("Implement 'reset {set,map,element}' commands") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add vlan match test caseFlorian Westphal2023-10-071-0/+50
| | | | | | | Check that we can match on the 8021ad header and vlan tag, see af84f9e447a6 ("netfilter: nft_payload: rebuild vlan header on h_proto access"). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test for dormant on/off/on bugFlorian Westphal2023-10-072-0/+52
| | | | | | | | | | | Disallow enabling/disabling a table in a single transaction. Make sure we still allow one update, either to dormant, or from active to dormant. Reported-by: "Lee, Cherie-Anne" <cherie.lee@starlabs.sg> Cc: Bing-Jhong Billy Jheng <billy@starlabs.sg> Cc: info@starlabs.sg Signed-off-by: Florian Westphal <fw@strlen.de>
* icmpv6: Allow matching target address in NS/NA, redirect and MLDNicolas Cavallari2023-10-069-7/+458
| | | | | | | | | | | | | | | It was currently not possible to match the target address of a neighbor solicitation or neighbor advertisement against a dynamic set, unlike in IPv4. Since they are many ICMPv6 messages with an address at the same offset, allow filtering on the target address for all icmp types that have one. While at it, also allow matching the destination address of an ICMPv6 redirect. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: never merge across non-expression statements redux 2Florian Westphal2023-10-062-0/+95
| | | | | | | Turns out I also love to forget about nft-test.py -j. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: sets/reset_command_0: Fix drop_seconds()Phil Sutter2023-09-291-1/+1
| | | | | | | | | | The function print_times() skips any time elements which are zero, so output may lack the ms part. Adjust the sed call dropping anything but the minutes value to not fail in that case. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: 255ec36a11525 ("tests: shell: Stabilize sets/reset_command_0 test") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: restrict include directive to regular filesFlorian Westphal2023-09-292-3/+67
| | | | | | | | | | | | | | Similar to previous change, also check all include "foo" and reject those if they refer to named fifos, block devices etc. Directories are still skipped, I don't think we can change this anymore. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1664 Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: refuse to open onput files other than named pipes or regular filesFlorian Westphal2023-09-291-0/+34
| | | | | | | | | | | Don't start e.g. parsing a block device. nftables is typically run as privileged user, exit early if we get unexpected input. Only exception: Allow character device if input is /dev/stdin. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1664 Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: never merge across non-expression statements reduxFlorian Westphal2023-09-293-0/+54
| | | | | | | Forgot to 'git add' inet/bridge/netdev payload records. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: never merge across non-expression statementsFlorian Westphal2023-09-296-4/+40
| | | | | | | | | | | | | | | | | | The existing logic can merge across non-expression statements, if there is only one payload expression. Example: ether saddr 00:11:22:33:44:55 counter ether type 8021q is turned into counter ether saddr 00:11:22:33:44:55 ether type 8021q which isn't the same thing. Fix this up and add test cases for adjacent vlan and ip header fields. 'Counter' serves as a non-merge fence. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Fix for failing nft-f/sample-rulesetPhil Sutter2023-09-281-2/+2
| | | | | | | | | | For whatever reason, my system lacks an entry for 'sip' in /etc/services. Assuming the service name is not relevant to the test, just replace it by the respective port number. Fixes: 68728014435d9 ("tests: shell: add sample ruleset reproducer") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: use xmalloc() for allocating datatype in datatype_clone()Thomas Haller2023-09-281-1/+1
| | | | | | | | The returned memory will be initialized. No need to zero it first. Use xmalloc() instead of xzalloc(). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add missing map statement stubPablo Neira Ayuso2023-09-281-0/+1
| | | | | | | Add map statement stub to restore compilation without json support. Fixes: 27a2da23d508 ("netlink_linearize: skip set element expression in map statement key") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: include <string.h> in <nft.h>Thomas Haller2023-09-2841-41/+1
| | | | | | | | <string.h> provides strcmp(), as such it's very basic and used everywhere. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: fix spurious errors in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-09-271-3/+7
| | | | | | | | | | | | | | | A number of changes to fix spurious errors: - Add seconds as expiration, otherwise 14m59 reports 14m in minute granularity, this ensures suficient time in a very slow environment with debugging instrumentation. - Provide expected output. - Update sed regular expression to make 'ms' optional and use -E mode. Fixes: adf38fd84257 ("tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mergesort: avoid cloning value in expr_msort_cmp()Thomas Haller2023-09-271-16/+15
| | | | | | | | If we have a plain EXPR_VALUE value, there is no need to copy it via mpz_set(). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>