summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY attributeHEADmasterPhil Sutter12 hours1-3/+4
| | | | | | | | If missing, the memcpy call ends up reading from address zero. Fixes: c7c94802679cd ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Properly fix JSON equivalents for netdev/reject.tPhil Sutter12 hours2-21/+126
| | | | | | | | | | | | | | Revert commit d1a7b9e19fe65 ("tests: py: update netdev reject test file"), the stored JSON equivalents were correct in that they matched the standard syntax input. In fact, we missed a .json.output file recording the expected deviation in JSON output. Fixes: d1a7b9e19fe65 ("tests: py: update netdev reject test file") Fixes: 7ca3368cd7575 ("reject: Unify inet, netdev and bridge delinearization") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Adjust to ifname-based hooksPhil Sutter12 hours5-2/+34
| | | | | | | | | | | | Interface specs won't disappear anymore upon device removal. Drop them manually if kernel has ifname-based hooks. Skip transactions/0050rule_1 if kernel has name-based hooks: The test relies upon the ruleset being rejected for non-existent interfaces, which obviously won't happen then. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: monitor: Fix for single flag array avoidancePhil Sutter12 hours7-8/+8
| | | | | | | | Missed to update the JSON monitor expected output. Fixes: 6bedb12af1658 ("json: Print single set flag as non-array") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Dump flowtable hook spec only if presentPhil Sutter12 hours2-9/+15
| | | | | | | | | | | | | If there is no priority.expr set, assume hook.num is bogus, too. While this is fixing JSON output, it's hard to tell what commit this is actually fixing: Before commit 627c451b23513 ("src: allow variables in the chain priority specification"), there was no way to detect flowtables missing hook specs (e.g. when printing flowtable delete monitor event). Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Correctly print flowtable updatesPhil Sutter12 hours1-5/+9
| | | | | | | | | An update deleting a hook from a flowtable was indistinguishable from a flowtable deletion. Fixes: 73a8adfc2432e ("monitor: Recognize flowtable add/del events") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Do not allocate a bogus flowtable priority exprPhil Sutter12 hours1-2/+4
| | | | | | | | | Code accidentally treats missing NFTNL_FLOWTABLE_PRIO attribute as zero prio value which may not be correct. Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fix for potential crash parsing a flowtablePhil Sutter12 hours1-1/+1
| | | | | | | | | | Kernel's flowtable message might not contain the NFTA_FLOWTABLE_HOOK_DEVS attribute. In that case, nftnl_flowtable_get() will return NULL for the respective nftnl attribute. Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: catch bogus expressions before crashingFlorian Westphal20 hours1-0/+11
| | | | | | | | | | | | | | | | | | | We can't recover from errors here, but we can abort with a more precise reason than 'segmentation fault', or stack corruptions that get caught way later, or not at all. expr->value is going to be read, we can't cope with other expression types here. We will copy to stack buffer of IFNAMSIZ size, abort if we would overflow. Check there is a NUL byte present too. This is a preemptive patch, I've seen one crash in this area but no reproducer yet. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Basic documentation of anonymous chainsPhil Sutter41 hours2-4/+18
| | | | | | | Joint work with Folsk Pratima. Signed-off-by: Folsk Pratima <folsk0pratima@cock.li> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add a test case for FTP helper combined with NAT.Yi Chen3 days4-0/+190
| | | | | | | | | This test verifies functionality of the FTP helper, for both passive, active FTP modes, and the functionality of the nf_nat_ftp module. Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: helpers: suppress mount error messagesFlorian Westphal7 days1-1/+1
| | | | | | Prevent repeated error messages from spamming the console. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: work around fuzzer-induced assert crashesFlorian Westphal8 days2-131/+146
| | | | | | | | | | | | | fuzzer can cause assert failures due to json_pack() returning a NULL value and therefore triggering the assert(out) in __json_pack macro. All instances I saw are due to invalid UTF-8 strings, i.e., table/chain names with non-text characters in them. Work around this for now, replace the assert with a plaintext error message and return NULL instead of abort(). Signed-off-by: Florian Westphal <fw@strlen.de>
* json: prevent null deref if chain->policy is not setFlorian Westphal9 days3-6/+26
| | | | | | | | | | | | | | The two commits mentioned below resolved null dererence crashes when the policy resp. priority keyword was missing in the chain/flowtable specification. Same issue exists in the json output path, so apply similar fix there and extend the existing test cases. Fixes: 5b37479b42b3 ("nftables: don't crash in 'list ruleset' if policy is not set") Fixes: b40bebbcee36 ("rule: do not crash if to-be-printed flowtable lacks priority") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* tests: py: fix json single-flag output for fib & synproxyFlorian Westphal9 days2-0/+49
| | | | | | | | | | Blamed commits change output format but did not adjust existing tests: inet/fib.t: WARNING: line 16: '{"nftables": .. Fixes: 38f99ee84fe6 ("json: Print single synproxy flags as non-array") Fixes: dbe5c44f2b89 ("json: Print single fib flag as non-array") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* tests: shell: check for features not available in 5.4Pablo Neira Ayuso2025-05-294-1/+5
| | | | | | | | | | | | | | | | | | | | | | 5.4 -stable kernels report failures in these tests, this kernel version is lacking these feature. The bitshift requirement is needed by this ruleset: table ip x { set s13 { typeof tcp option mptcp subtype elements = { mp-join, dss } } chain y { tcp option mptcp subtype @s13 accept } } which uses bitshift in its bytecode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: Tolerate object deserialization failuresPhil Sutter2025-05-251-6/+5
| | | | | | | | If netlink_delinearize_obj() fails, it will print an error message. Skip this object and keep going. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Keep going after set element parsing failuresPhil Sutter2025-05-251-1/+3
| | | | | | | | Print an error message and try to deserialize the remaining elements instead of calling BUG(). Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Pass netlink_ctx to netlink_delinearize_setelem()Phil Sutter2025-05-253-12/+12
| | | | | | | | | Prepare for calling netlink_io_error() which needs the context pointer. Trade this in for the cache pointer since no caller uses a special one. No functional change intended. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: Replace some BUG()s by error messagesPhil Sutter2025-05-251-6/+11
| | | | | | | | | | Netlink parser tries to keep going despite errors. Faced with an incompatible ruleset, this is much more user-friendly than exiting the program upon the first obstacle. This patch fixes three more spots to support this. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: check if kernel supports for cgroupsv2 matchingPablo Neira Ayuso2025-05-202-0/+8
| | | | | | Update packetpath/cgroupv2 to skip it if kernel does not support it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip egress in netdev chain release path testPablo Neira Ayuso2025-05-201-7/+11
| | | | | | Update test to skip egress coverage if kernel does not support it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Catch unknown types when deserializing objectsPhil Sutter2025-05-201-0/+4
| | | | | | | | | Print an error message and discard the object instead of returning it to the caller. At least when trying to print it, we would hit an assert() in obj_type_name() anyway. Fixes: 4756d92e517ae ("src: listing of stateful objects") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Avoid potential NULL-ptr deref parsing set elem expressionsPhil Sutter2025-05-201-1/+2
| | | | | | | | Since netlink_parse_set_expr() may return NULL, the following deref must be guarded. Fixes: e6d1d0d611958 ("src: add set element multi-statement support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Include kernel taint value in warningPhil Sutter2025-05-161-1/+1
| | | | | | | | | | | If kernel is already tainted, not all tests yield usable results. Printing the taint cause might help users tracking down the external cause. If a test taints the kernel, the value is stored in rc-failed-tainted file already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add test case for JSON 'flags' arraysPhil Sutter2025-05-131-0/+189
| | | | | | | Ensure these arrays are reduced if containing just a single item and parser interprets them correctly in any case. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Introduce json_add_array_new()Phil Sutter2025-05-131-75/+24
| | | | | | | | Propagate nat_stmt_add_array() to a generic helper for use in all spots adding an array property which may reduce to a single item or even not exist at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print single synproxy flags as non-arrayPhil Sutter2025-05-131-2/+6
| | | | Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print single fib flag as non-arrayPhil Sutter2025-05-131-1/+9
| | | | | | | | | | Check array size and reduce the array if possible. The zero array length check is dead code here due to the surrounding 'if (flags)' block, but it's a common idiom one could replace by a shared routine later. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print single set flag as non-arrayPhil Sutter2025-05-1373-289/+97
| | | | | | | | The code obviously intended to do this already but got the array length check wrong. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: Fix typo in nat statement 'prefix' descriptionPhil Sutter2025-05-131-1/+1
| | | | | | | No point in repeating 'to map' here. Fixes: 19d73ccdd39fa ("doc: add nat examples") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Introduce parse_flags_array()Phil Sutter2025-05-132-335/+136
| | | | | | | | | | | | | | | | Various objects support a 'flags' property with value usually being an array of strings. There is a special case, when merely a single flag is set: The value may be a string representing this flag. Introduce a function assisting in parsing this polymorphic value. Have callers pass a parser callback translating a single flag name into a corresponding value. Luckily, these single flag parsers are very common already. As a side-effect, enable the single flag spec for set flags as well and update the documentation accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: netlink: fix crash when ops doesn't support udataFlorian Westphal2025-05-111-1/+1
| | | | | | | | | | | | Whenever a new version adds udata support to an expression, then old versions of nft will crash when trying to list such a ruleset generated by a more recent version of nftables. Fix this by falling back to 'type' format. Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support') Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Skip netdev_chain_dev_addremove on tainted kernelsPhil Sutter2025-05-081-10/+11
| | | | | | | | | | The test checks taint state to indicate success or failure. Since this won't work if the kernel is already tainted at start, skip the test instead of failing it. Fixes: 02dbf86f39410 ("tests: shell: add a test case for netdev ruleset flush + parallel link down") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove bogus empty fileFlorian Westphal2025-04-251-0/+0
| | | | | | | | No idea how this happened, remove it. Reported-by: Sunny73Cr <Sunny73Cr@protonmail.com> Fixes: 058246016188 ("src: allow to map key to nfqueue number") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Update packetpath/flowtablesYi Chen2025-04-221-27/+50
| | | | | | | | | | | | 1. The socat receiver should not use the pipfile as output where the sender reads data from, this could create an infinite data loop. 2. Sending a packet right after establishing the connection helped uncover a new bug (see kernel commit d2d31ea8cd80, "netfilter: conntrack: fix erronous removal of offload bit"). 3. Optimize test log output Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: Bump version to 1.1.3v1.1.3Pablo Neira Ayuso2025-04-221-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: bogus concatenated set ranges with netlink message overrunPablo Neira Ayuso2025-04-213-5/+755
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building each component of the set element key, a late byteorder switch is performed to ensure that all components in the interval are represented in big endian, as required by the pipapo backend. In case that the set element does not fit into the netlink message, the byteorder switch happens twice, leading to inserting an element with a bogus component with large sets, so instead: "lo" . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" listing reports: 16777216 . 00:11:22:33:44:55 . 10.1.2.3 comment "123456789012345678901234567890" Note that 16777216 is 0x1000000, which should instead be 0x00000001 to represent "lo" as u32. Fix this by switching the value in a temporary variable and use it to set the set element key attribute in the netlink message. Later, revisit this to perform this byteorder switch from evaluation step. Add tests/shell unit to cover for this bug. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1792 Fixes: 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evalute: make vlan pcp updates workFlorian Westphal2025-04-222-4/+40
| | | | | | | | | | | | | | | | On kernel side, nft_payload_set_vlan() requires a 2 or 4 byte write to the vlan header. As-is, nft emits a 1 byte write: [ payload load 1b @ link header + 14 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000001f ) ^ 0x00000020 ] ... which the kernel doesn't support. Expand all vlan header updates to a 2 or 4 byte write and update the existing vlan id test case. Reported-by: Kevin Vigouroux <ke.vigouroux@laposte.net> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "intervals: do not merge intervals with different timeout"Pablo Neira Ayuso2025-04-171-5/+1
| | | | | | | | | | | This reverts commit da0bac050c8b2588242727f9915a1ea8bc48ceb2. This results in an error when adding an interval that overlaps an existing interval in the kernel, this defeats the purpose of the auto-merge feature. Reported-by: Slavko <linux@slavino.sk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to 1.1.2v1.1.2Pablo Neira Ayuso2025-04-141-3/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: add selector_expr rule to restrict typeof_exprPablo Neira Ayuso2025-04-112-17/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | typeof_expr allows for symbol, constant and bitwise expressions, restrict it to selector expressions. After this patch, input generated by fuzzer is rejected upfront: # nft -f test.nft test.nft:3:53-53: Error: syntax error, unexpected number typeof numgen inc mod 2 : ip daddr . 0 ^ test.nft:2:12-13: Error: set definition does not specify key map t2 { ^^ test.nft:8:65-67: Error: No such file or directory meta l4proto tcp dnat ip to numgen inc mod 2 map @t2 ^^^ test.nft:8:65-67: Error: No such file or directory meta l4proto tcp dnat ip to numgen inc mod 2 map @t2 ^^^ Revisit 4ab1e5e60779 ("src: allow use of 'verdict' in typeof definitions") to handle verdict as string, later a token can be added to the scanner and enable it via flex start conditions. Fixes: 14357cff40ed ("parser: add typeof keyword for declarations") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: invalidate merge in case of duplicated key in set/mapPablo Neira Ayuso2025-04-092-1/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -o/--optimize results in EEXIST error when merging two rules that lead to ambiguous set/map, for instance: table ip x { chain v4icmp {} chain v4icmpc {} chain y { ip protocol icmp jump v4icmp ip protocol icmp goto v4icmpc } } which is not possible because duplicated keys are not possible in set/map. This is how it shows when running a test: Merging: testcases/sets/dumps/sets_with_ifnames.nft:56:3-30: ip protocol icmp jump v4icmp testcases/sets/dumps/sets_with_ifnames.nft:57:3-31: ip protocol icmp goto v4icmpc into: ip protocol vmap { icmp : jump v4icmp, icmp : goto v4icmpc } internal:0:0-0: Error: Could not process rule: File exists Add a new step to compare rules that are candidate to be merged to detect colissions in set/map keys in order to skip them in the next final merging step. Add tests/shell unit to improve coverage. Fixes: fb298877ece2 ("src: add ruleset optimization infrastructure") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bail out if ct saddr/daddr dependency cannot be insertedFlorian Westphal2025-04-071-1/+2
| | | | | | | | | | | | | | | | | | | | | If we have an incomplete rule like "ct original saddr" in inet family, this function generates an error because it can't determine the required protocol dependency, hinting at missing ip/ip6 keyword. We should not go on in this case to avoid a redundant followup error: nft add rule inet f c ct original saddr 1.2.3.4 Error: cannot determine ip protocol version, use "ip saddr" or "ip6 saddr" instead add rule inet f c ct original saddr 1.2.3.4 ^^^^^^^^^^^^^^^^^ Error: Could not parse symbolic invalid expression add rule inet f c ct original saddr 1.2.3.4 After this change only the first error is shown. Fixes: 2b29ea5f3c3e ("src: ct: add eval part to inject dependencies for ct saddr/daddr") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: only allow concatenations with 2 or more expressionsFlorian Westphal2025-04-023-9/+41
| | | | | | | | | | | | | | | | | | | | | | | | | The bison parser enforces this implicitly by grammar rules. Because subkeys have to be conatenated via ".", notation, e.g. "mark . ip saddr", all concatenation expressions always consist of at least two elements. But this doesn't apply to the json frontend which just uses an array: it can be empty or only contain one element. The included reproducer makes the eval stage set the "concatenation" flag on the interval set. This prevents the needed conversion code to turn the element values into ranges from getting run. The reproducer asserts with: nft: src/intervals.c:786: setelem_to_interval: Assertion `key->etype == EXPR_RANGE_VALUE' failed. Convert the assertion to BUG() so we can see what element type got passed to the set interval code in case we have further issues in this area. Reject 0-or-1-element concatenations from the json parser. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix crash when generating reject statement errorFlorian Westphal2025-04-022-2/+46
| | | | | | | | | | | After patch, this gets rejected with: internal:0:0-0: Error: conflicting protocols specified: ip vs ip6 Without patch, we crash with a NULL dereference: we cannot use reject.expr->location unconditionally. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: remove unused expr function argumentFlorian Westphal2025-04-021-16/+10
| | | | | | | stmt_evaluate_reject passes cmd->expr argument but its never used. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: expand expression list when merging into concatenationPablo Neira Ayuso2025-04-014-0/+74
| | | | | | | | | | | | | | | | | The following rules: udp dport 137 ct state new,untracked accept udp dport 138 ct state new,untracked accept results in: nft: src/optimize.c:670: __merge_concat: Assertion `0' failed. The logic to expand to the new,untracked list in the concatenation is missing. Fixes: 187c6d01d357 ("optimize: expand implicit set element when merging into concatenation") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: prevent possible crash rule filter is NULLPablo Neira Ayuso2025-04-011-2/+4
| | | | | | | | | Similar to 3f0a47f9f00c ("cache: don't crash when filter is NULL"). No real crash observed but it is good to tigthen this. Fixes: dbff26bfba83 ("cache: consolidate reset command") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: bail out on malformed statement in setPablo Neira Ayuso2025-04-011-12/+27
| | | | | | | Propagate error to caller so it bails out on malformed set statements. Fixes: 07958ec53830 ("json: add set statement list support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-06-13 08:51:18 +0000