summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* optimize: fix incorrect expansion into concatenation with verdict mapPablo Neira Ayuso2023-11-021-11/+22
| | | | | | | | | | | | | | | | | | | | commit b691e2ea1d643adeb89c576a105f08cfff677cfb upstream. # nft -c -o -f ruleset.nft Merging: ruleset.nft:3:3-53: meta pkttype broadcast udp dport { 67, 547 } accept ruleset.nft:4:17-58: meta pkttype multicast udp dport 1900 drop into: meta pkttype . udp dport vmap { broadcast . { 67, 547 } : accept, multicast . 1900 : drop } ruleset.nft:3:38-39: Error: invalid data type, expected concatenation of (packet type, internet network service) meta pkttype broadcast udp dport { 67, 547 } accept ^^ Similar to 187c6d01d357 ("optimize: expand implicit set element when merging into concatenation") but for verdict maps. Reported-by: Simon G. Trajkovski <neur0armitage@proton.me> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: wrap code to build concatenation in helper functionPablo Neira Ayuso2023-11-021-7/+15
| | | | | | | | | | | commit 9dbbf397b2f3d9fa40454648cb98c13c7c5515b7 upstream. Move code to build concatenations into helper function, this routine includes support for expansion of implicit sets containing singleton values. This is preparation work to reuse existing code in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: set eval ctx for add/update statements with integer constantsFlorian Westphal2023-11-021-2/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 4cc6b20d31498d90e90ff574ce8b70276afcee8f upstream. Eric reports that nft asserts when using integer basetype constants with 'typeof' sets. Example: table netdev t { set s { typeof ether saddr . vlan id flags dynamic,timeout } chain c { } } loads fine. But adding a rule with add/update statement fails: nft 'add rule netdev t c set update ether saddr . 0 @s' nft: netlink_linearize.c:867: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. When the 'ether saddr . 0' concat expression is processed, there is no set definition available anymore to deduce the required size of the integer constant. nft eval step then derives the required length using the data types. '0' has integer basetype, so the deduced length is 0. The assertion triggers because serialization step finds that it needs one more register. 2 are needed to store the ethernet address, another register is needed for the vlan id. Update eval step to make the expression context store the set key information when processing the preceeding set reference, then let stmt_evaluate_set() preserve the existing context instead of zeroing it again via stmt_evaluate_arg(). This makes concat expression evaluation compute the total size needed based on the sets key definition. Reported-by: Eric Garver <eric@garver.life> Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: Do not return garbage from stackPhil Sutter2023-11-021-1/+1
| | | | | | | | | | | commit d4d47e5bdf943be494aeb5d5a29b8f5212acbddf upstream. If input does not contain a single 'add' command (unusual, but possible), 'ret' value was not initialized by nft_optimize() before returning its value. Fixes: fb298877ece27 ("src: add ruleset optimization infrastructure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* intervals: restrict check missing elements fix to sets with no auto-mergePablo Neira Ayuso2023-11-021-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit ce04d25b4a116ef04f27d0b71994f61a24114d6d upstream. If auto-merge is enabled, skip check for element mismatch introduced by 6d1ee9267e7e ("intervals: check for EXPR_F_REMOVE in case of element mismatch"), which is only relevant to sets with no auto-merge. The interval adjustment routine for auto-merge already checks for unexisting intervals in that case. Uncovered via ASAN: ==11946==ERROR: AddressSanitizer: heap-use-after-free on address 0x60d00000021c at pc 0x559ae160d5b3 bp 0x7ffc37bcb800 sp 0x7ffc37bcb7f8 READ of size 4 at 0x60d00000021c thread T0 #0 0x559ae160d5b2 in 0? /builddir/build/BUILD/nftables-1.0.6/src/intervals.c:424 #1 0x559ae15cb05a in interval_set_eval.lto_priv.0 (/usr/lib64/libnftables.so.1+0xaf05a) #2 0x559ae15e1c0d in setelem_evaluate.lto_priv.0 (/usr/lib64/libnftables.so.1+0xc5c0d) #3 0x559ae166b715 in nft_evaluate (/usr/lib64/libnftables.so.1+0x14f715) #4 0x559ae16749b4 in nft_run_cmd_from_buffer (/usr/lib64/libnftables.so.1+0x1589b4) #5 0x559ae20c0e7e in main (/usr/bin/nft+0x8e7e) #6 0x559ae1341146 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #7 0x559ae1341204 in __libc_start_main_impl ../csu/libc-start.c:381 #8 0x559ae20c1420 in _start ../sysdeps/x86_64/start.S:115 0x60d00000021c is located 60 bytes inside of 144-byte region [0x60d0000001e0,0x60d000000270) freed by thread T0 here: #0 0x559ae18ea618 in __interceptor_free ../../../../gcc-12.2.0/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x559ae160c315 in 4 /builddir/build/BUILD/nftables-1.0.6/src/intervals.c:349 #2 0x559ae160c315 in 0? /builddir/build/BUILD/nftables-1.0.6/src/intervals.c:420 previously allocated by thread T0 here: #0 0x559ae18eb927 in __interceptor_calloc ../../../../gcc-12.2.0/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x559ae15c5076 in set_elem_expr_alloc (/usr/lib64/libnftables.so.1+0xa9076) Fixes: 6d1ee9267e7e ("intervals: check for EXPR_F_REMOVE in case of element mismatch") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: dump_nf_hooks() leaks memory in error pathPhil Sutter2023-11-021-2/+9
| | | | | | | | | commit ef66f321e49b337c7e678bb90d6acb94f331dfc4 upstream. Have to free the basehook object before returning to caller. Fixes: 4694f7230195b ("src: add support for base hook dumping") Signed-off-by: Phil Sutter <phil@nwl.cc>
* meta: parse_iso_date() returns booleanPhil Sutter2023-11-021-1/+1
| | | | | | | | | | commit db6e97bd667bf205cee22049f9d0fd6550cb43a7 upstream. Returning ts if 'ts == (time_t) -1' signals success to caller despite failure. Fixes: 4460b839b945a ("meta: fix compiler warning in date_type_parse()") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink: Fix for potential NULL-pointer derefPhil Sutter2023-11-021-1/+2
| | | | | | | | | | | | commit 927d5674e7bf656428f97c54c9171006e8c3c75e upstream. If memory allocation fails, calloc() returns NULL which was not checked for. The code seems to expect zero array size though, so simply replacing this call by one of the x*calloc() ones won't work. So guard the call also by a check for 'len'. Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter <phil@nwl.cc>
* optimize: Clarify chain_optimize() array allocationsPhil Sutter2023-11-021-3/+4
| | | | | | | | | | | | | | commit b83a0416cdc881c6ac35739cd858e4fe5fb2e04f upstream. Arguments passed to sizeof() where deemed suspicious by covscan due to the different type. Consistently specify size of an array 'a' using 'sizeof(*a) * nmemb'. For the statement arrays in stmt_matrix, even use xzalloc_array() since the item count is fixed and therefore can't be zero. Fixes: fb298877ece27 ("src: add ruleset optimization infrastructure") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ct: use inet_service_type for proto-src and proto-dstPablo Neira Ayuso2023-11-021-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f470e181d8c6280ca031cfd9ee1ab52a2b21c93a upstream. Instead of using the invalid type. Problem was uncovered by this ruleset: table ip foo { map pinned { typeof ip daddr . ct original proto-dst : ip daddr . tcp dport size 65535 flags dynamic,timeout timeout 6m } chain pr { meta l4proto tcp update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } } } resulting in the following misleading error: map-broken.nft:10:51-82: Error: datatype mismatch: expected concatenation of (IPv4 address), expression has type concatenation of (IPv4 address, internet network service) meta l4proto tcp update @pinned { ip saddr . ct original proto-dst timeout 1m30s : ip daddr . tcp dport } ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix shift exponent underflow in concatenation evaluationPablo Neira Ayuso2023-11-021-1/+1
| | | | | | | | | | | | | | | | commit 0fe79458cb5ae36d838f0e5a5dc5cc6f332cac03 upstream. There is an underflow of the index that iterates over the concatenation: ../include/datatype.h:292:15: runtime error: shift exponent 4294967290 is too large for 32-bit type 'unsigned int' set the datatype to invalid which is fine to evaluate a concatenation in a set/map statement. Update b8e1940aa190 ("tests: add a test case for map update from packet path with concat") so it does not need a workaround to work. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: treat invalid octal strings as stringsJeremy Sowden2023-11-011-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit f0f9cd656c005ba9a17cd3cef5769c285064b202 upstream. The action associated with the `{numberstring}` pattern, passes `yytext` to `strtoull` with base 0: errno = 0; yylval->val = strtoull(yytext, NULL, 0); if (errno != 0) { yylval->string = xstrdup(yytext); return STRING; } return NUM; If `yytext` begins with '0', it will be parsed as octal. However, this has unexpected consequences if the token contains non-octal characters. `09` will be parsed as 0; `0308` will be parsed as 24, because `strtoull` and its siblings stop parsing as soon as they reach a character in the input which is not valid for the base. Replace the `{numberstring}` match with separate `{hexstring}` and `{decstring}` matches. For `{decstring}` set the base to 8 if the leading character is '0', and handle an incompletely parsed token in the same way as one that causes `strtoull` to set `errno`. Thus, instead of: $ sudo nft -f - <<<' table x { chain y { ip saddr 0308 continue comment "parsed as 0.0.0.24/32" } } ' $ sudo nft list chain x y table ip x { chain y { ip saddr 0.0.0.24 continue comment "parsed as 0.0.0.24/32" } } We get: $ sudo ./src/nft -f - <<<' > table x { > chain y { > ip saddr 0308 continue comment "error" > } > } > ' /dev/stdin:4:14-17: Error: Could not resolve hostname: Name or service not known ip saddr 0308 continue comment "error" ^^^^ Add a test-case. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=932880 Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1363 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* owner: Fix potential array out of bounds accessPablo Neira Ayuso2022-12-211-1/+1
| | | | | | | | | | | If the link target length exceeds 'sizeof(tmp)' bytes, readlink() will return 'sizeof(tmp)'. Using this value as index is illegal. Original update from Phil, for the conntrack-tools tree, which also has a copy of this function. Fixes: 6d085b22a8b5 ("table: support for the table owner flag") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: Fall back to generic printing from translationPhil Sutter2022-12-131-18/+13
| | | | | | | | If translation is not available or fails, print the generic format instead of calling the print callback (which does not respect output_fp) or silently failing. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt: Rewrite unsupported compat expression dumpingPhil Sutter2022-12-136-7/+47
| | | | | | | | | Choose a format which provides more information and is easily parseable. Then teach parsers about it and make it explicitly reject the ruleset giving a meaningful explanation. Also update the man pages with some more details. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt: Purify enum nft_xt_typePhil Sutter2022-12-131-2/+0
| | | | | | Remove NFT_XT_MAX from the enum, it is not a valid xt type. Signed-off-by: Phil Sutter <phil@nwl.cc>
* xt: Delay libxtables access until translationPhil Sutter2022-12-131-116/+76
| | | | | | | | | | | | | | | | | | There is no point in spending efforts setting up the xt match/target when it is not printed afterwards. So just store the statement data from libnftnl in struct xt_stmt and perform the extension lookup from xt_stmt_xlate() instead. This means some data structures are only temporarily allocated for the sake of passing to libxtables callbacks, no need to drag them around. Also no need to clone the looked up extension, it is needed only to call the functions it provides. While being at it, select numeric output in xt_xlate_*_params - otherwise there will be reverse DNS lookups which should not happen by default. Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_linearize: fix timeout with map updatesFlorian Westphal2022-12-122-0/+7
| | | | | | | | | | | | | | | | Map updates can use timeouts, just like with sets, but the linearization step did not pass this info to the kernel. meta l4proto tcp update @pinned { ip saddr . ct original proto-src timeout 90s : ip daddr . tcp dport Listing this won't show the "timeout 90s" because kernel never saw it to begin with. Also update evaluation step to reject a timeout that was set on the data part: Timeouts are only allowed for the key-value pair as a whole. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: fix decoding of concat data elementFlorian Westphal2022-12-121-0/+8
| | | | | | | | | | | | | | Its possible to use update as follows: meta l4proto tcp update @pinned { ip saddr . ct original proto-src : ip daddr . ct original proto-dst } ... but when listing, only the first element of the concatenation is shown. Check if the element size is too small and parse subsequent registers as well. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix compilation warningPablo Neira Ayuso2022-12-121-2/+2
| | | | | | | | | | | | | | | | | | | Set pointer to list of expression to NULL and check that it is set on before using it. In function ‘expr_evaluate_concat’, inlined from ‘expr_evaluate’ at evaluate.c:2488:10: evaluate.c:1338:20: warning: ‘expressions’ may be used uninitialized [-Wmaybe-uninitialized] 1338 | if (runaway) { | ^ evaluate.c: In function ‘expr_evaluate’: evaluate.c:1321:33: note: ‘expressions’ was declared here 1321 | const struct list_head *expressions; | ^~~~~~~~~~~ Reported-by: Florian Westphal <fw@strlen.de> Fixes: 508f3a270531 ("netlink: swap byteorder of value component in concatenation of intervals") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: match full comment line in case of tiePablo Neira Ayuso2022-12-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | add element ip filter public_services { # comment 1 tcp . 80 : jump log_accept, # comment 2 tcp . 443 : jump log_accept, } still fails with the error message: # nft -f filter_sets.ip In file included from filter_sets.ip:63:1-42: filter_sets.ip:4:12-12: Error: syntax error, unexpected newline, expecting comma or '}' # comment 2 ^ flex honors the first rule found in case of tie, place comment_line before comment rule. Fixes: 931737a17198 ("scanner: munch full comment lines") Reported-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: unfold function to generate concatenations for keys and dataPablo Neira Ayuso2022-12-101-10/+53
| | | | | | | | | | | | | | | | Add a specific function to generate concatenation with and without intervals in maps. This restores the original function added by 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") which is used by 66746e7dedeb ("src: support for nat with interval concatenation") to generate the data concatenations in maps. Only the set element key requires the byteswap introduced by 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations"). Therefore, better not to reuse the same function for key and data as the future might bring support for more kind of concatenations in data maps. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add function to generate set element key dataPablo Neira Ayuso2022-12-101-4/+22
| | | | | | | Add netlink_gen_key(), it is just like __netlink_gen_data() with no EXPR_VERDICT case, which should not ever happen for set element keys. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: statify __netlink_gen_data()Pablo Neira Ayuso2022-12-101-4/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not crash on runaway number of concatenation componentsPablo Neira Ayuso2022-12-081-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Display error message in case user specifies more data components than those defined by the concatenation of selectors. # cat example.nft table ip x { chain y { type filter hook prerouting priority 0; policy drop; ip saddr . meta mark { 1.2.3.4 . 0x00000100 . 1.2.3.6-1.2.3.8 } accept } } # nft -f example.nft example.nft:4:3-22: Error: too many concatenation components ip saddr . meta mark { 1.2.3.4 . 0x00000100 . 1.2.3.6-1.2.3.8 } accept ~~~~~~~~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Without this patch, nft crashes: ==464771==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d000000418 at pc 0x7fbc17513aa5 bp 0x7ffc73d33c90 sp 0x7ffc73d33c88 READ of size 8 at 0x60d000000418 thread T0 #0 0x7fbc17513aa4 in expr_evaluate_concat /home/pablo/devel/scm/git-netfilter/nftables/src/evaluate.c:1348 #1 0x7fbc1752a9da in expr_evaluate /home/pablo/devel/scm/git-netfilter/nftables/src/evaluate.c:2476 #2 0x7fbc175175e2 in expr_evaluate_set_elem /home/pablo/devel/scm/git-netfilter/nftables/src/evaluate.c:1504 #3 0x7fbc1752aa22 in expr_evaluate /home/pablo/devel/scm/git-netfilter/nftables/src/evaluate.c:2482 #4 0x7fbc17512cb5 in list_member_evaluate /home/pablo/devel/scm/git-netfilter/nftables/src/evaluate.c:1310 #5 0x7fbc17518ca0 in expr_evaluate_set /home/pablo/devel/scm/git-netfilter/nftables/src/evaluate.c:1590 [...] Fixes: 64bb3f43bb96 ("src: allow to use typeof of raw expressions in set declaration") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: swap byteorder of value component in concatenation of intervalsPablo Neira Ayuso2022-12-081-9/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") was incomplete. Switch byteorder of singleton values in a set that contains concatenation of intervals. This singleton value is actually represented as a range in the kernel. After this patch, if the set represents a concatenation of intervals: - EXPR_F_INTERVAL denotes the lhs of the interval. - EXPR_F_INTERVAL_END denotes the rhs of the interval (this flag was already used in this way before this patch). If none of these flags are set on, then the set contains concatenations of singleton values (no interval flag is set on), in such case, no byteorder swap is required. Update tests/shell and tests/py to cover the use-case breakage reported by Eric. Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Reported-by: Eric Garver <eric@garver.life> Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: munch full comment linesPablo Neira Ayuso2022-12-071-0/+4
| | | | | | | | | | | Munch lines full comment lines, regular expression matches lines that start by space or tab, then # follows, finally anything including one single line break. Call reset_pos() to ensure error reporting location is not puzzled. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1196 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix 'add flowtable' commandAlex Forster2022-12-021-1/+1
| | | | | | | | In `json_parse_cmd_add_flowtable`, the format arguments passed to `json_unpack` are incorrect: the object key name ("dev") is not provided. Fixes: da6cb40177da ("parser_json: permit empty device list") Signed-off-by: Alex Forster <aforster@cloudflare.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for selectors with different byteorder with interval concatenationsPablo Neira Ayuso2022-11-302-7/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Assuming the following interval set with concatenation: set test { typeof ip saddr . meta mark flags interval } then, the following rule: ip saddr . meta mark @test requires bytecode that swaps the byteorder for the meta mark selector in case the set contains intervals and concatenations. inet x y [ meta load nfproto => reg 1 ] [ cmp eq reg 1 0x00000002 ] [ payload load 4b @ network header + 12 => reg 1 ] [ meta load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] <----- this is required ! [ lookup reg 1 set test dreg 0 ] This patch updates byteorder_conversion() to add the unary expression that introduces the byteorder expression. Moreover, store the meta mark range component of the element tuple in the set in big endian as it is required for the range comparisons. Undo the byteorder swap in the netlink delinearize path to listing the meta mark values accordingly. Update tests/py to validate that byteorder expression is emitted in the bytecode. Update tests/shell to validate insertion and listing of a named map declaration. A similar commit 806ab081dc9a ("netlink: swap byteorder for host-endian concat data") already exists in the tree to handle this for strings with prefix (e.g. eth*). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Warn for tables with compat expressions in rulesPhil Sutter2022-11-182-3/+15
| | | | | | | | | | | | | | | | | | While being able to "look inside" compat expressions using nft is a nice feature, it is also (yet another) pitfall for unaware users, deceiving them into assuming interchangeability (or at least compatibility) between iptables-nft and nft. In reality, which involves 'nft list ruleset | nft -f -', any correctly translated compat expressions will turn into native nftables ones not understood by (the version of) iptables-nft which created them in the first place. Other compat expressions will vanish, potentially compromising the firewall ruleset. Emit a warning (as comment) to give users a chance to stop and reconsider before shooting their own foot. Signed-off-by: Phil Sutter <phil@nwl.cc>
* monitor: missing cache and set handle initializationPablo Neira Ayuso2022-11-111-0/+2
| | | | | | | | | | | | | | | | | This leads to a crash when adding stateful expressions to sets: netlink.c:928:38: runtime error: member access within null pointer of type 'struct nft_ctx' AddressSanitizer:DEADLYSIGNAL ================================================================= ==13781==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d0 (pc 0x7fc96fc2b6b2 bp 0x7ffc0e26b080 sp 0x7ffc0e26b020 T0) ==13781==The signal is caused by a READ memory access. ==13781==Hint: address points to the zero page. #0 0x7fc96fc2b6b2 in table_cache_find /home/pablo/devel/scm/git-netfilter/nftables/src/cache.c:456 #1 0x7fc96fd244d4 in netlink_parse_set_expr /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_delinearize.c:1857 #2 0x7fc96fcf1b4d in netlink_delinearize_set /home/pablo/devel/scm/git-netfilter/nftables/src/netlink.c:928 #3 0x7fc96fd41966 in netlink_events_cache_addset /home/pablo/devel/scm/git-netfilter/nftables/src/monitor.c:649 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: handle prefix and range when merging into set + concatenationPablo Neira Ayuso2022-11-051-0/+2
| | | | | | | | | | | | | | | | The following ruleset fails to be merged using set + concatenation: meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.3.0/24 accept meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.4.0-2.2.4.10 accept hitting the following assertion: nft: optimize.c:585: __merge_concat_stmts: Assertion `0' failed. Abort This patch also updates tests/shell. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: do not kill dependency for proto_unknownPablo Neira Ayuso2022-10-311-2/+4
| | | | | | | | | | | | | Unsupported meta match on layer 4 protocol sets on protocol context to proto_unknown, handle anything coming after it as a raw expression in payload_expr_expand(). Moreover, payload_dependency_kill() skips dependency removal if protocol is unknown, so raw payload expression leaves meta layer 4 protocol remains in place. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1641 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: complete payload expression in payload statementPablo Neira Ayuso2022-10-311-3/+4
| | | | | | | | | | | | | | Call payload_expr_complete() to complete payload expression in payload statement, otherwise expr->payload.desc is set to proto_unknown. Call stmt_payload_binop_postprocess() introduced by 50ca788ca4d0 ("netlink: decode payload statment") if payload_expr_complete() fails to provide a protocol description (eg. ip dscp). Follow up patch does not allow to remove redundant payload dependency if proto_unknown is used to deal with the raw payload expression case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: do not transfer binary operation to non-anonymous setsPablo Neira Ayuso2022-10-121-0/+3
| | | | | | | | | | | | | | | | Michael Braun says: This results for nft list ruleset in nft: netlink_delinearize.c:1945: binop_adjust_one: Assertion `value->len >= binop->right->len' failed. This is due to binop_adjust_one setting value->len to left->len, which is shorther than right->len. Additionally, it does not seem correct to alter set elements from parsing a rule, so remove that part all together. Reported-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: do not display handle for implicit chainPablo Neira Ayuso2022-10-071-0/+6
| | | | | | | | | Implicit chains do not allow for incremental updates, do not display rule handle since kernel refuses to update an implicit chain which is already bound. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1615 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: display too many levels of nesting errorPablo Neira Ayuso2022-10-071-4/+23
| | | | | | | | | | | | | Instead of hitting this assertion: nft: parser_bison.y:70: open_scope: Assertion `state->scope < array_size(state->scopes) - 1' failed. Aborted this is easier to trigger with implicit chains where one level of nesting from the existing chain scope is supported. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1615 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: datatype memleak after binop transferPablo Neira Ayuso2022-10-061-1/+0
| | | | | | | | | | | | | | The following ruleset: ip version vmap { 4 : jump t3, 6 : jump t4 } results in a memleak. expr_evaluate_shift() overrides the datatype which results in a datatype memleak after the binop transfer that triggers a left-shift of the constant (in the map). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus datatype assertion in binary operation evaluationPablo Neira Ayuso2022-10-061-1/+1
| | | | | | | | | | Use datatype_equal(), otherwise dynamically allocated datatype fails to fulfill the datatype pointer check, triggering the assertion: nft: evaluate.c:1249: expr_evaluate_binop: Assertion `expr_basetype(left) == expr_basetype(right)' failed. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1636 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Sanitize startup race conditionPhil Sutter2022-09-303-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | During startup, 'nft monitor' first fetches the current ruleset and then keeps this cache up to date based on received events. This is racey, as any ruleset changes in between the initial fetch and the socket opening are not recognized. This script demonstrates the problem: | #!/bin/bash | | while true; do | nft flush ruleset | iptables-nft -A FORWARD | done & | maniploop=$! | | trap "kill $maniploop; kill \$!; wait" EXIT | | while true; do | nft monitor rules >/dev/null & | sleep 0.2 | kill $! | done If the table add event is missed, the rule add event callback fails to deserialize the rule and calls abort(). Avoid the inconvenient program exit by returning NULL from netlink_delinearize_rule() instead of aborting and make callers check the return value. Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: add ethernet header size offset for implicit vlan dependencyFlorian Westphal2022-09-291-1/+19
| | | | | | | | | | 'vlan id 1' must also add a ethernet header dep, else nft fetches the payload from header offset 0 instead of 14. Reported-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: allow implicit ether -> vlan depFlorian Westphal2022-09-281-0/+1
| | | | | | | | | | nft add rule inet filter input vlan id 2 Error: conflicting protocols specified: ether vs. vlan Refresh the current dependency after superseding the dummy dependency to make this work. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc, src: make some spelling and grammatical improvementsJeremy Sowden2022-09-221-2/+2
| | | | | | | | | | | | | Fix a couple of spelling mistakes: 'expresion' -> 'expression' and correct some non-native usages: 'allows to' -> 'allows one to' Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: fix decomposition of unclosed intervals containing address prefixesJeremy Sowden2022-09-211-16/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The code which decomposes unclosed intervals doesn't check for prefixes. This leads to incorrect output for sets which contain these. For example, # nft -f - <<END table ip t { chain c { ip saddr 192.0.0.0/2 drop ip saddr 10.0.0.0/8 drop ip saddr { 192.0.0.0/2, 10.0.0.0/8 } drop } } table ip6 t { chain c { ip6 saddr ff00::/8 drop ip6 saddr fe80::/10 drop ip6 saddr { ff00::/8, fe80::/10 } drop } } END # nft list table ip6 t table ip6 t { chain c { ip6 saddr ff00::/8 drop ip6 saddr fe80::/10 drop ip6 saddr { fe80::/10, ff00::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff } drop } } # nft list table ip t table ip t { chain c { ip saddr 192.0.0.0/2 drop ip saddr 10.0.0.0/8 drop ip saddr { 10.0.0.0/8, 192.0.0.0-255.255.255.255 } drop } } Instead of treating the final unclosed interval as a special case, reuse the code which correctly handles closed intervals. Add a shell test-case. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1018156 Fixes: 86b965bdab8d ("segtree: fix decomposition of unclosed intervals") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: refactor decomposition of closed intervalsJeremy Sowden2022-09-211-33/+38
| | | | | | | | | | | Move the code in `interval_map_decompose` which adds a new closed interval to the set into a separate function. In addition to the moving of the code, there is one other change: `compound_expr_add` is called once, after the main conditional, instead of being called in each branch. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: un-break rule insert with intervalsFlorian Westphal2022-09-201-0/+1
| | | | | | | | | 'rule inet dscpclassify dscp_match meta l4proto { udp } th dport { 3478 } th sport { 3478-3497, 16384-16387 } goto ct_set_ef' works with 'nft add', but not 'nft insert', the latter yields: "BUG: unhandled op 4". Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add stateful object comment supportFernando Fernandez Mancera2022-09-162-0/+9
| | | | | | | | | | | | | | | | | | | | | | When listing a stateful object with JSON support, the comment was ignored. Output example: { "counter": { "family": "inet", "name": "mycounter", "table": "t", "handle": 1, "comment": "my comment in counter", "packets": 0, "bytes": 0 } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1611 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add secmark object reference supportFernando Fernandez Mancera2022-09-161-0/+18
| | | | | | | | | The secmark object reference requires a json parser function and it was missing. In addition, extends the shell testcases. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1630 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix empty statement list output in sets and mapsFernando Fernandez Mancera2022-09-051-29/+32
| | | | | | | | | | | | JSON output of sets and map should not include the statements list if is empty. The statement output should be stateless also. In addition, removes duplicated code. Fixes: 07958ec53830 ("json: add set statement list support") Fixes: e66f3187d891 ("json: add table map statement support") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix json schema version verificationFernando Fernandez Mancera2022-09-031-7/+8
| | | | | | | | | | nft should ignore malformed or missing entries of `json_schema_version` but check the value when it is integer. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1490 Fixes: 49e0f1dc6e52 ("JSON: Add metainfo object to all output") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-10-04 06:17:39 +0000