summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* src: add nft_ctx_new() and nft_ctx_free()Eric Leblond2017-08-241-25/+39
| | | | | | | | | | These new functions allows us to allocate and release the context structure. This is going to be useful for libnftables. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix error handling in mnl_batch_talkEric Leblond2017-08-242-3/+5
| | | | | | | | | | | | If one of the command is failing we should return an error. Pablo says: "This is not a real issue since nft_netlink() returns an error in case the list of errors is not empty. But we can indeed simplify things by removing that explicit assignment in nft_netlink() so mnl_batch_talk() consistently reports when if an error has happened. Signee-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Fix for memleak when commands failPhil Sutter2017-08-241-0/+2
| | | | | | | In case of failing command evaluation, commands need to be freed as their memory becomes orphaned afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Make use of yylex_init_extra()Phil Sutter2017-08-241-2/+1
| | | | | | This combines the calls to yylex_init() and yyset_extra(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Fix for wrong parameter type of scanner_destroy()Phil Sutter2017-08-241-1/+1
| | | | | | | | The function takes the scanner as argument, not the state. This wasn't a real issue since scanner is a void pointer, which means it's only casted around without need. So this fix is a rather cosmetic one. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Fix for memleak due to unclosed file pointerPhil Sutter2017-08-243-8/+8
| | | | | | | | | | | | | | | | | | | | When including a file, it is opened by fopen() and therefore needs to be closed after scanning has finished using fclose(), otherwise valgrind will report a memleak. This patch changes struct input_descriptor to track the opened FILE pointer instead of the file descriptor so the pointer is available for closing in scanner_destroy(). While at it, change erec_print() to work on the open FILE pointer so it doesn't have to call fileno() in beforehand. And as a little bonus, use C99 initializer of the buffer to get rid of the call to memset(). Note that it is necessary to call erec_print_list() prior to destroying the scanner, otherwise it will start manipulating an already freed FILE pointer (and therefore crash the program). Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: Fix debug_proto_ctx()Phil Sutter2017-08-241-1/+1
| | | | | | | | | Debug mask check was done against wrong flag, causing protocol context debug output being printed when only --debug=netlink was given. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Initialize struct stmt in _match and _target functions.Varsha Rao2017-08-241-0/+2
| | | | | | | | | | Initialize structure stmt with stmt_alloc in netlink_parse_target and netlink_parse_match functions. This patch fixes the gcc warning: ‘stmt’ may be used uninitialized in this function. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix typoPablo M. Bermudo Garay2017-08-241-37/+37
| | | | | | | Separator was misspelled as "seperator" in a symbol name. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add debugging mask to context structurePablo Neira Ayuso2017-08-2312-101/+130
| | | | | | | So this toggle is not global anymore. Update name that fits better with the semantics of this variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: pass struct netlink_ctx to mnl_nft_socket_sendmsg()Pablo Neira Ayuso2017-08-231-7/+6
| | | | | | Reduce function footprint. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add struct mnl_ctxPablo Neira Ayuso2017-08-231-38/+89
| | | | | | This new structure contains the netlink socket and the sequence number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove ifdef DEBUG pollutionPablo Neira Ayuso2017-08-237-46/+1
| | | | | | | | | | | | | | | Get rid of lots of ifdef DEBUG pollution in the code. The --debug= option is useful to get feedback from users, so it should be always there. And we really save nothing from keeping this code away from the control plane with a compile time option. Just running tests/shell/ before and after this patch, time shows almost no difference. So this patch leaves --enable-debug around to add debugging symbols in your builds, this is left set on by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add maximum number of parser errors to struct nft_ctxPablo Neira Ayuso2017-08-232-4/+4
| | | | | | Not a global variable anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add include_paths to struct nft_ctxPablo Neira Ayuso2017-08-233-13/+19
| | | | | | | Not convenient to keep this as static for the upcoming library, so let's move it where it belongs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Keep cache in struct nft_ctxPhil Sutter2017-08-232-21/+17
| | | | | | | This is preliminary work for Eric's libnftables patchset. Cc: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* rt: add path mtu supportFlorian Westphal2017-08-222-0/+6
| | | | | | | | | | Only use case is to allow similar behaviour to iptables TCPMSS --clamp-mss-to-pmtu, by combining this with exthdr statement: tcp option maxseg size set rt mtu Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp options set supportFlorian Westphal2017-08-225-3/+92
| | | | | | | | | | | | This adds support for tcp mss mangling: nft add rule filter input tcp option maxseg size 1200 Its also possible to change other tcp option fields, but maxseg is one of the more useful ones to change. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: Remove unused functions.Varsha Rao2017-08-171-94/+0
| | | | | | | | | | Functions mnl_nft_chain_get(), mnl_nft_rule_add(), mnl_nft_rule_delete(), mnl_nft_set_get(), mnl_nft_table_get(), set_get_cb(), table_get_cb() and chain_get_cb() are only defined but not used, so remove them. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove unused functions.Varsha Rao2017-08-171-104/+0
| | | | | | | | | | Remove netlink_add_rule_list(), netlink_dump_table(), netlink_get_chain(), netlink_get_set(), netlink_get_table(), netlink_list_chain() functions definitions as they are not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: cli: Remove cli_display() function.Varsha Rao2017-08-171-26/+0
| | | | | | | | Remove cli_display() function, as it is not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: gmputil: Remove mpz_get_be64() function.Varsha Rao2017-08-171-5/+0
| | | | | | | mpz_get_be64() is not used anywhere in source code. So remove it. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove xt_stmt_() functions.Varsha Rao2017-08-172-97/+0
| | | | | | | | | Remove functions xt_stmt_alloc(), xt_stmt_release(), xt_stmt_xlate(), xt_stmt_print(), xt_stmt_destroy() as they are not used. Similarly, remove structure xt_stmt_ops. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: shift immediate value when adjusting size for csum fixupFlorian Westphal2017-08-171-11/+14
| | | | | | | | | | | | | | | | | | | | | | | nft add rule .. ip ttl set 64 erronously mangles ip protocol instead of ttl. Because the kernel can't deal with odd-sized data (ttl is one byte) when doing checksum fixups, so the write to 'ttl' is turned into [ payload load 2b @ network header + 8 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000ff ) ^ $new_value ] [ payload write reg 1 => 2b @ network header + 8 csum_type 1 csum_off 10 csum_flags 0x0 ] While doing so, we did fail to shift the imm value, i.e. we clear the wrong half of the u16 (protocol) instead of csum. The correct mask is 0xff00, and $new_value needs to be shifted so we leave the protocol value (which is next to ttl) alone. Fixes: f9069cefdf ("netlink: make checksum fixup work with odd-sized header fields") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make netlink sequence number non-staticPablo Neira Ayuso2017-08-154-118/+136
| | | | | | | | | | | | Place sequence number that is allocated per-command on the struct netlink_ctx structure. This is allocated from nft_run() to correlate commands with netlink messages for error reporting. Batch support probing also shares this sequence numbers with commands. There is an inpendent cache sequence number though, this routine is called from a different path, usually from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* echo: Fix for added delays in rule updatesPhil Sutter2017-08-153-12/+31
| | | | | | | | | | | | | | | | The added cache update upon every command dealing with rules was a bummer. Instead, perform the needed cache update only if echo option was set. Initially, I tried to perform the cache update from within netlink_echo_callback(), but that turned into a mess since the shared socket between cache_init() and mnl_batch_talk() would receive unexpected new input. So instead update the cache from do_command_add(), netlink_replace_rule_batch() and do_comand_insert() so it completes before mnl_batch_talk() starts listening. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fix segfault when using --echo flagPhil Sutter2017-08-151-1/+3
| | | | | | | | | | | Commit 07b45939972eb ("src: introduce struct nft_cache") added cache pointer to struct netlink_mon_handler and the code assumes it is never NULL. Therefore initialize it in the dummy version of netlink_mon_handler in netlink_echo_callback(). Fixes: b99c4d072d996 ("Implement --echo option") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Drop --echo support for non-batch callsPhil Sutter2017-08-151-22/+1
| | | | | | | | | | | | | | | | | | Echo support in nft_mnl_talk() was broken: nft_mnl_talk_cb() passed cbdata->data as second parameter to netlink_echo_callback() which expected it to be of type struct netlink_ctx while in fact it was whatever callers of nft_mnl_talk() passed as callback data (in most cases a NULL pointer). I didn't notice this because I didn't test for kernels without support for transactions. This has been added to nftables in kernel version 3.16 back in 2014. Since then, user space which doesn't support it can't even add a table anymore. So adding this new feature to the old code path is really not feasible, therefore drop this broken attempt at supporting it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct nft_cacheVarsha Rao2017-08-147-107/+129
| | | | | | | | | | Pass variable cache_initialized and structure list_head as members of structure nft_cache. Joint work with Pablo Neira. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement --echo optionPhil Sutter2017-08-145-7/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When used with add, insert or replace commands, nft tool will print event notifications just like 'nft monitor' does for the same commands. Apart from seeing what a given command will turn out in the rule set, this allows to reliably retrieve a new rule's assigned handle (if used together with --handle option). Here are some examples of how it works: | # nft --echo --handle add table ip t | add table ip t | | # nft --echo --handle add chain ip t c \ | '{ type filter hook forward priority 0; }' | add chain ip t c { type filter hook forward priority 0; policy accept; } | | # nft --echo --handle add rule ip t c tcp dport '{22, 80}' accept | add rule ip t c tcp dport { ssh, http } accept # handle 2 | | # nft --echo --handle add set ip t ipset '{ type ipv4_addr; \ | elements = { 192.168.0.1, 192.168.0.2 }; }' | add set ip t ipset { type ipv4_addr; } | add element ip t ipset { 192.168.0.1 } | add element ip t ipset { 192.168.0.2 } Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Pass nlmsg flags from rule.cPhil Sutter2017-08-142-47/+43
| | | | | | | | There is no point in checking value of excl in each called function. Just do it in a single spot and pass resulting flags. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Subscribe nft monitor and nft monitor trace to respective groups.Varsha Rao2017-08-021-16/+20
| | | | | | | | | | | Subscribe nft monitor to both NFNLGRP_NFTABLES and NFNLGRP_NFTRACE. nft monitor trace subscribes only to NFNLGRP_NFTRACE. Other event reporting options to only NFNLGRP_NFTABLES. Joint work with Pablo Neira. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: handle rule tracing as an monitor objectPablo Neira Ayuso2017-08-023-27/+7
| | | | | | Traces are not an event type, they should be handled as an object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Consolidate mnl_batch_talk() parametersPhil Sutter2017-08-022-4/+4
| | | | | | | | | The single caller of this function passes struct netlink_ctx fields as the first two parameters. This can be simplified by passing the context object itself and having mnl_batch_talk() access it's fields instead. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: nft monitor rulesetVarsha Rao2017-07-312-0/+33
| | | | | | | | | | This patch adds event reporting for ruleset, which prints only ruleset events. Syntax : nft monitor ruleset Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix printing of set declarationsPhil Sutter2017-07-271-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | The optional attributes 'flags', 'gc-interval' and 'timeout' have to be delimited by stmt_separator (either newline or semicolon), not 'nl' which is set to whitespace by set_print_plain(). In order to restore readability, change stmt_separator to include a single whitespace after the semicolon. Here's monitor output for the following command: | # nft add set ip t testset { type inet_service; \ | timeout 60s; gc-interval 120s; } Before this patch: | add set ip t testset { type inet_service;timeout 1m gc-interval 2m } With this patch applied: | add set ip t testset { type inet_service; timeout 1m; gc-interval 2m; } Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Print NEWGEN eventsPhil Sutter2017-07-241-0/+42
| | | | | | | | | Now that they contain process information, they're actually interesting. For backwards compatibility, print process information only if it was present in the message. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix printing of range elements in named setsArturo Borrero Gonzalez2017-07-191-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If you add set elements to interval sets, the output is wrong. Fix this by caching first element of the range (first event), then wait for the second element of the range (second event) to print them both at the same time. We also avoid printing the first null element required in the RB tree. Before this patch: % nft add element t s {10-20, 30-40} add element ip t s { 0 } add element ip t s { 10 } add element ip t s { ftp } add element ip t s { 30 } add element ip t s { 41 } After this patch: % nft add element t s {10-20, 30-40} add element ip t s { 10-20 } add element ip t s { 30-40 } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Introduce flag for half-open range elementsPhil Sutter2017-07-192-21/+39
| | | | | | | | | This flag is required by userspace only, so can live within userdata. It's sole purpose is for 'nft monitor' to detect half-open ranges (which are comprised of a single element only). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove variable nf_mon_sock.Varsha Rao2017-07-193-28/+38
| | | | | | | | | | | Remove variable nf_mon_sock of type structure mnl_socket to avoid duplicity. Instead variable nf_sock of the same type is passed as argument to netlink_monitor(). Also remove netlink_open_mon_sock() function definition, which is no longer required. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow passing the parent set to set_expr_alloc()Phil Sutter2017-07-175-11/+17
| | | | | | | | | | | | | | | | | Usually one wants to at least initialize set_flags from the parent, so make allocation of a set's set expression more convenient. The idea to do this came when fixing an issue with output formatting of larger anonymous sets in nft monitor: Since netlink_events_cache_addset() didn't initialize set_flags, calculate_delim() didn't detect it's an anonymous set and therefore added newlines to the output. Reported-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Fixes: a9dc3ceabc10f ("expression: print sets and maps in pretty format") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix expr_value_cmp()Phil Sutter2017-07-171-4/+6
| | | | | | | | | Instead of returning the result of mpz_cmp(), this function returned 1 unless both elements were equal and the first one had EXPR_F_INTERVAL_END set. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: add debug messagesArturo Borrero Gonzalez2017-07-172-0/+46
| | | | | | | | | | Add some debug messages in the monitor/trace code paths to ease development and debugging in case of errors. After this patch, running 'nft monitor --debug=mnl,netlink' is more verbose. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: fix heap buffer overflowEric Leblond2017-07-171-0/+4
| | | | | | | | | | | | | | | | | | | | | | This patch fixes an invalid read when an empty command was sent. Found via nft running ASAN and entering an empty command: nft> ================================================================= ==19540==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000008c6f at pc 0x55e3b561704d bp 0x7fffe9a33ac0 sp 0x7fffe9a33ab8 READ of size 1 at 0x602000008c6f thread T0 #0 0x55e3b561704c in cli_append_multiline /home/eric/git/netfilter/nftables/src/cli.c:65 #1 0x55e3b561725b in cli_complete /home/eric/git/netfilter/nftables/src/cli.c:109 #2 0x7f6e0c2ccac2 in rl_callback_read_char (/lib/x86_64-linux-gnu/libreadline.so.7+0x2fac2) #3 0x55e3b5617ba6 in cli_init /home/eric/git/netfilter/nftables/src/cli.c:199 #4 0x55e3b5573b75 in main /home/eric/git/netfilter/nftables/src/main.c:381 #5 0x7f6e0bc9b2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) #6 0x55e3b55725a9 in _start (/usr/local/sbin/nft+0x445a9) Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: free filename when destroying scannerEric Leblond2017-07-172-2/+14
| | | | | | | | To be able to do so we duplicate the name in the indesc if it is set. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix build with clangEric Leblond2017-07-171-2/+1
| | | | | | | | | | | Building with a recent clang was failing due to the following error: src/evaluate.c|450 col 45| error: initializer element is not constant || static const unsigned int max_tcpoptlen = 15 * 4 * BITS_PER_BYTE - tcphdrlen; || ^~ Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: error if needed at EOFEric Leblond2017-07-171-0/+2
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix bison warningsEric Leblond2017-07-171-1/+2
| | | | | | | | | | | | | | | | | | | | | We had the following warnings parser_bison.y:1089:10: warning: variable 'cmd' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] if (erec != NULL) { ^~~~~~~~~~~~ parser_bison.y:1095:39: note: uninitialized use occurs here (yyval.cmd) = cmd_alloc(CMD_LIST, cmd, &(yyvsp[0].handle), &(yyloc), NULL); ^~~ parser_bison.y:1089:6: note: remove the 'if' if its condition is always true if (erec != NULL) { ^~~~~~~~~~~~~~~~~~ parser_bison.y:1080:12: note: initialize the variable 'cmd' to silence this warning int cmd; ^ = 0 Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix memory leak in set creationEric Leblond2017-07-171-0/+2
| | | | | | | | | | | | | | | | | | | | sudo ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-3.9/bin/llvm-symbolizer nft add set inet filter blacklisddddddddddddddddddddt {type inet_service \;} ================================================================= ==25152==ERROR: LeakSanitizer: detected memory leaks Direct leak of 13 byte(s) in 1 object(s) allocated from: #0 0x45cca0 in __interceptor_strdup (/usr/local/sbin/nft+0x45cca0) #1 0x593cb1 in xstrdup /home/eric/git/netfilter/nftables/src/utils.c:75:8 #2 0x5bccb2 in nft_lex /home/eric/git/netfilter/nftables/src/scanner.l:566:22 #3 0x5cb363 in nft_parse /home/eric/git/netfilter/nftables/src/parser_bison.c:4366:16 #4 0x505a37 in nft_run /home/eric/git/netfilter/nftables/src/main.c:246:8 #5 0x50771f in main /home/eric/git/netfilter/nftables/src/main.c:392:6 #6 0x7ff7befdb2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) SUMMARY: AddressSanitizer: 13 byte(s) leaked in 1 allocation(s). Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix memory leak when listing rulesEric Leblond2017-07-171-1/+3
| | | | | | | | | | | | | | | | | | | | | When listing rules we were calling strdup on the table name but variable was just used locally. Found via `nft list ruleset` run with ASAN: Direct leak of 4 byte(s) in 1 object(s) allocated from: #0 0x45cca0 in __interceptor_strdup (/usr/local/sbin/nft+0x45cca0) #1 0x593c71 in xstrdup /home/eric/git/netfilter/nftables/src/utils.c:75:8 #2 0x513b34 in do_list_ruleset /home/eric/git/netfilter/nftables/src/rule.c:1388:23 #3 0x50e178 in do_command_list /home/eric/git/netfilter/nftables/src/rule.c:1500:10 #4 0x50d3ea in do_command /home/eric/git/netfilter/nftables/src/rule.c:1696:10 #5 0x5061ae in nft_netlink /home/eric/git/netfilter/nftables/src/main.c:207:9 #6 0x505b87 in nft_run /home/eric/git/netfilter/nftables/src/main.c:255:8 #7 0x50771f in main /home/eric/git/netfilter/nftables/src/main.c:392:6 #8 0x7fa1f326d2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>