summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* expr: make range_low()/range_high() usable outside of segtreePatrick McHardy2014-09-242-40/+40
| | | | | | | Their functionality is also needed for set descriptions, move the functions to expressions.c and give them a more suitable name for global functions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* mnl: consistency checks across several netlink dumpsPablo Neira Ayuso2014-09-193-0/+57
| | | | | | | | | | | | Obtain the generation ID before dumping the object lists. Then, check for generation ID updates when dumping the several lists that this needs. In case of interference, nft has to remove the stale objects and retry from scratch. This is complementary to the NLM_F_DUMP_INTR flag which is local to one single netlink dump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: compact log level grammarPatrick McHardy2014-09-171-32/+8
| | | | | | Put rule and action on a single line as for other simple mappings. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: fix 'describe' command when passing wrong expressionsPablo Neira Ayuso2014-09-173-8/+23
| | | | | | | | | | | | | | | | | | Before this patch: # nft describe tcp foo value expression, datatype inet_proto (Internet protocol) (basetype integer), 8 bits Segmentation fault After this patch: # nft describe tcp foo <cmdline>:1:14-16: Error: syntax error, unexpected string, expecting end of file or newline or semicolon describe tcp foo ^^^ Reported-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: simplify monitor command parsingPatrick McHardy2014-09-172-145/+39
| | | | | | | Add tokens for "new" and "destroy". Split up the monitor flags into an event and an object to avoid lots of duplicated code. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add specific byteorder to the struct proto_hdr_templateAlvaro Neira Ayuso2014-09-173-5/+14
| | | | | | | | | | | | | | | | | | | | | If we try to add a rule like: nft add rule filter input udp length {55-9999} nftable shows: BUG: invalid byte order conversion 0 => 2 nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed. Some of the existing payload fields rely on BYTEORDER_INVALID. Therefore, if we try to convert it in evaluation step, we hit this bug. This patch allows to add a specific byteorder to the struct proto_hdr_template. If we create a expression with a invalid byteorder, we will use the byteorder added to the proto_hdr_template structure. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: include file and line in netlink ABI errorsArturo Borrero2014-09-161-2/+3
| | | | | | | Let's give some more information when netlink ABI errors happens. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: netlink_linearize: don't set level if user didn't specifyPablo Neira Ayuso2014-09-121-1/+4
| | | | | | | The kernel will default on LOG_WARNING, to mimic iptables behaviour. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh include/linux/nf_tables.h cached copyPablo Neira Ayuso2014-09-112-2/+2
| | | | | | | | | Keep in sync with nf_tables.h header file in net-next tree. Rename NFT_CT_LABEL to NFT_CT_LABELS, this probably slipped through when editing the header file by hand. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add `flush ruleset'Arturo Borrero2014-09-094-5/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix typo in chain hook parsingYanchuan Nian2014-09-091-1/+1
| | | | | | | Just a typo in chain hook parsing Signed-off-by: Yanchuan Nian <ycnian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add devgroup support in meta expresionAna Rey2014-09-033-0/+12
| | | | | | | | | | | | | | | | | | | This adds device group support in meta expresion. The new attributes of meta are "iffgroup" and "oifgroup" - iffgroup: Match device group of incoming device. - oifgroup: Match device group of outcoming device. Example of use: nft add rule ip test input meta iifgroup 2 counter nft add rule ip test output meta oifgroup 2 counter The kernel and libnftnl support were added in these commits: netfilter: nf_tables: add devgroup support in meta expresion src: meta: Add devgroup support to meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: meta: Fix the size of cpu attributeAna Rey2014-09-031-1/+1
| | | | | | | Fix the size of cpu attribute in meta_template struct. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for cpu in meta expresionAna Rey2014-08-243-0/+6
| | | | | | | | | | | | | This allows you to match cpu handling with a packet. This is an example of the syntax for this new attribute: nft add rule ip test input meta cpu 1 counter nft add rule ip test input meta cpu 1-3 counter nft add rule ip test input meta cpu { 1, 3} counter Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for pkttype in meta expresionAna Rey2014-08-243-0/+58
| | | | | | | | | | | | | | | If you want to match the pkttype field of the skbuff, you have to use the following syntax: nft add rule ip filter input meta pkttype PACKET_TYPE where PACKET_TYPE can be: unicast, broadcast and multicast. Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: use proto_unknown for raw protocol headerYuxuan Shui2014-08-201-0/+1
| | | | | | | Otherwise payload.desc would be NULL, which causes the crash in bug 915. Signed-off-by: Yuxuan Shui <yshuiv7@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't return error in netlink_linearize_rule()Pablo Neira Ayuso2014-08-192-12/+9
| | | | | | | | | This function converts the rule from the list of statements to the netlink message format. The only two possible errors that can make this function to fail are memory exhaustion and malformed statements which inmediately stop the execution of nft. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* verdict type: handle verdict flags and encoded additional informationPatrick McHardy2014-08-191-10/+13
| | | | | | The kernel can handle this, nftables should also. Signed-off-by: Patrick McHardy <kaber@trash.net>
* proto: fix byteorder of ETH_P_* valuesPatrick McHardy2014-08-191-12/+12
| | | | | | | The ethernet header type is in big endian byte order, the ETH_P_* values are in host byte order however. Fix this using __constant_htons(). Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: take endianess into account in symbolic_constant_print()Patrick McHardy2014-08-191-1/+7
| | | | | | | | | | | | symbolic_constant_print() uses mpz_cmp_ui() to find the matching symbol. Since GMP internally treats all values as being in host byte, this doesn't work when the constant value is non-host byteorder, such as the ethernet protocol type. Export the expression's value in its original byteorder for comparison to fix this. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: take endianess into account when updating the payload contextPatrick McHardy2014-08-191-1/+8
| | | | | | | | | | | | payload_expr_pctx_update() uses the numeric protocol value in host byte order to find the upper layer protocol. This obviously doesn't work for protocol expressions in other byte orders, such as the ethernet protocol on little endian. Export the protocol value in the correct byte order and use that value to look up the upper layer protocol. Signed-off-by: Patrick McHardy <kaber@trash.net>
* linealize: generate unary expression with the appropiate operationAlvaro Neira2014-08-191-1/+1
| | | | | | | | If we add a unary expression which the operation is ntoh, we use hton. This looks like a typo. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix memory leak in nft get operationYanchuan Nian2014-08-141-6/+11
| | | | | | | | | Some memories are forgotten to release on the error path in get operation. Just release them. Also, in netlink_get_chain, it's better to return immediately when a error is detected. Signed-off-by: Yanchuan Nian <ycnian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add level option to the log statementPablo Neira Ayuso2014-07-256-19/+136
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is required if you use upcoming Linux kernels >= 3.17 which come with a complete logging support for nf_tables. If you use 'log' without options, the kernel logging buffer is used: nft> add rule filter input log You can also specify the logging prefix string: nft> add rule filter input log prefix "input: " You may want to specify the log level: nft> add rule filter input log prefix "input: " level notice By default, if not specified, the default level is 'warn' (just like in iptables). If you specify the group, then nft uses the nfnetlink_log instead: nft> add rule filter input log prefix "input: " group 10 You can also specify the snaplen and qthreshold for the nfnetlink_log. But you cannot mix level and group at the same time, they are mutually exclusive. Default values for both snaplen and qthreshold are 0 (just like in iptables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix crashes when using sets with many elementsPablo Neira Ayuso2014-07-251-11/+32
| | | | | | | | | | | | | | | | | | | | | | nft crashes when adding many elements into a set for two reasons: 1) The overflow of the nla_len field for the NFTA_SET_ELEM_LIST_ELEMENTS attribute. 2) Out-of-bound memory writes to the reserved area for the netlink message, which is solved by the patch entitled ("mnl: introduce NFT_NLMSG_MAXSIZE"). This patch adds the corresponding nla_len overflow check for NFTA_SET_ELEM_LIST_ELEMENTS and it splits the elements in several netlink messages. This should be enough when set updates are handled by the transaction infrastructure. With this patch, nft should be now capable of adding an unlimited number of elements to a given set. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=898 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: introduce NFT_NLMSG_MAXSIZEPablo Neira Ayuso2014-07-251-5/+13
| | | | | | | | | | | | | | | | | | | The NFT_NLMSG_MAXSIZE constant defines the maximum nf_tables netlink message. Currently, the largest is the set element message, which contains the NFTA_SET_ELEM_LIST_ELEMENTS attribute. This attribute is a nest that describes the set elements. Given that the netlink attribute length (nla_len) is 16 bits, the largest message is a bit larger than 64 KBytes. Thus, the proposed value of NFT_NLMSG_MAXSIZE is set to (1 << 16) + getpagesize(). This new constant is used to calculate the length of: 1) the batch page length, when the batching mode is used. 2) the buffer that stores the netlink message in the send (when no batching is used) and receive paths. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: propagate error to shellPablo Neira Ayuso2014-07-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Before: # nft add rule ip test input ip hdrlength 3 <cmdline>:1:1-37: Error: Could not process rule: Invalid argument add rule ip test input ip hdrlength 3 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # echo $? 0 After: # nft add rule ip test input ip hdrlength 3 <cmdline>:1:1-37: Error: Could not process rule: Invalid argument add rule ip test input ip hdrlength 3 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # echo $? 1 Reported-by: Ana Rey Botello <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rework batching logic to fix possible use of uninitialized pagesPablo Neira Ayuso2014-07-223-49/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reworks the batching logic in several aspects: 1) New batch pages are now always added into the batch page list in first place. Then, in the send path, if the last batch page is empty, it is removed from the batch list. 2) nft_batch_page_add() is only called if the current batch page is full. Therefore, it is guaranteed to find a valid netlink message in the batch page when moving the tail that didn't fit into a new batch page. 3) The batch paging is initialized and released from the nft_netlink() path. 4) No more global struct mnl_nlmsg_batch *batch that points to the current batch page. Instead, it is retrieved from the tail of the batch list, which indicates the current batch page. This patch fixes a crash due to access of uninitialized memory area in due to calling batch_page_add() with an empty batch in the send path, and the memleak of the batch page contents. Reported in: http://patchwork.ozlabs.org/patch/367085/ http://patchwork.ozlabs.org/patch/367774/ The patch is larger, but this saves the zeroing of the batch page area. Reported-by: Yanchuan Nian <ycnian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add nft_nlmsg_batch_current() helperPablo Neira Ayuso2014-07-221-13/+18
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add nft_batch_continue() helperPablo Neira Ayuso2014-07-221-28/+17
| | | | | | | Save some LOC with this function that wraps typical handling after pushing the netlink message into the batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: monitor: fix how rules with intervals are printedArturo Borrero2014-07-211-0/+7
| | | | | | | | | | | | | Previous to this patch, if we add a rule like this: nft add rule filter test ip saddr { 1.1.1.1-2.2.2.2 } The monitor operation output shows: add rule ip filter test ip saddr { 0.0.0.0, 1.1.1.1, 2.2.2.3} The fix suggested by Pablo is to call interval_map_decompose(). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: monitor: add a helper function to handle sets referenced by a ruleArturo Borrero2014-07-211-31/+44
| | | | | | | | | This patch adds a helper function to handle lookup expressions with a callback, so we can make an action for each set referenced by the rule. Basically this is a refactorization, useful for follow-up patches. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* mnl: check for NLM_F_DUMP_INTR when dumping object listsPablo Neira Ayuso2014-07-143-33/+81
| | | | | | | | | This flag allows to detect that an update has ocurred while dumping any of the object lists. In case of interference, nft cancels the netlink socket to skip processing the remaining stale entries and it retries to obtain fresh list of objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: immediately return on errors in mnl_nft_ruleset_dump()Pablo Neira Ayuso2014-07-141-23/+24
| | | | | | If this fails to fetch any of the objects, stop handling inmediately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: initialize result expression in ethertype_parse()Pablo Neira Ayuso2014-07-141-0/+1
| | | | | | | | | Otherwise, you may crash in: nft add rule bridge filter input ether type ip Reported-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix concat expressions as map argumentsPatrick McHardy2014-07-101-0/+1
| | | | | | | | | | | | The type in the evaluation context needs to be reset to avoid treating the concatenation as a right hand side relational expression. # nft filter output mark set ip daddr . tcp dport map { 192.168.0.1 . 22 : 1 } <cmdline>:1:24-43: Error: datatype mismatch, expected packet mark, expression has type concatenation of (IPv4 address, internet network service) filter output mark set ip daddr . tcp dport map { 192.168.0.1 . 22 : 1 } ^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: check and handle errors from netlink_delinearize_set()Patrick McHardy2014-07-101-2/+11
| | | | | | | Fix segfaults when delinearizing the set fails and abort on error when listing sets. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: Correct initial value of bytes counter in nftables ruleYanchuan Nian2014-06-251-1/+1
| | | | | | | | | | | | | | Packages can be accounted by nftables through such command. % nft add rule filter output ip daddr 8.8.8.8 counter You can also give the initial values of packets and bytes. % nft add rule filter output ip daddr 8.8.8.8 counter packets 10 bytes 20 But packets and bytes are both initialized to 10 in above command for there is a mistake in the program. Signed-off-by: Yanchuan Nian <ycnian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revert broken reject icmp code supportPablo Neira Ayuso2014-06-206-84/+4
| | | | | | | | | | | | | | | | | This patch reverts Alvaro's 34040b1 ("reject: add ICMP code parameter for indicating the type of error") and 11b2bb2 ("reject: Use protocol context for indicating the reject type"). These patches are flawed by two things: 1) IPv6 support is broken, only ICMP codes are considered. 2) If you don't specify any transport context, the utility exits without adding the rule, eg. nft add rule ip filter input reject. The kernel is also flawed when it comes to the inet table. Let's revert this until we can provide decent reject reason support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: add ICMP code parameter for indicating the type of errorÁlvaro Neira Ayuso2014-06-166-6/+73
| | | | | | | | | | | | | | | | | | | | This patch allows to indicate the ICMP code field in case that we use to reject. Before, we have always sent network unreachable error as ICMP code, now we can explicitly indicate the ICMP code that we want to use. Examples: nft add rule filter input tcp dport 22 reject with host-unreach nft add rule filter input udp dport 22 reject with host-unreach In this case, it will use the host unreachable code to reject traffic. The default code field still is network unreachable and we can also use the rules without the with like that: nft add rule filter input udp dport 22 reject Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: Use protocol context for indicating the reject typeÁlvaro Neira Ayuso2014-06-162-0/+13
| | | | | | | | | This patch uses the protocol context to initialize the reject type considering if the transport protocol is tcp, udp, etc. Before this patch, this was left unset. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* queue: More compact syntaxÁlvaro Neira Ayuso2014-06-115-42/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use a new syntax more compact and break the current syntax. This new syntax is more similar than the nftables syntax that we use usually. We can use range like we have used in other case in nftables. Here, we have some examples: Before, If we want to declare a queue, we have used a syntax like this: nft add rule test input queue num 1 total 3 options bypass,fanout If we want to use the queue number 1 and the two next (total 3), we use a range in the new syntax, for example: nft add rule test input queue num 1-3 bypass fanout Also if we want to use only one queue, the new rules are like: nft add rule test input queue num 1 # queue 1 or nft add rule test input queue # queue 0 And if we want to add a specific flags we only need to put what flags we want to use: nft add rule test input queue bypass we don't need to use options and the comma for indicating the flags. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: fix nft -i command crashes when try to input multi line commandGuruswamy Basavaiah2014-06-101-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When try to input multiline command in "nft -i", it crashes. Issue is, function cli_append_multiline() return null in case of multiline command. But in the calling function cli_complete(), cli_exit is getting called, which in turn calls rl_callback_handler_remove() and the handler is getting removed. [root@localhost ~]# nft -i nft> add table filter nft> list table \ readline: readline_callback_read_char() called with no handler! Aborted (core dumped) [root@localhost ~]# After this patch, it shows: nft> list table \ .... filter table ip filter { } nft> The ".... " prompt is used to indicate a multiline command, similar to what Python does. Signed-off-by: Guruswamy Basavaiah <guru2018@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change type of chain.priority from unsigned int to intHendrik Schwartke2014-06-102-5/+5
| | | | | | | This removes a bug that displays strange hook priorities like "type route hook output priority 4294967146". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Allow to invert the rangesÁlvaro Neira Ayuso2014-06-051-6/+39
| | | | | | | | | | | | | | | | | | | | This patch fix the bug: http://bugzilla.netfilter.org/show_bug.cgi?id=924 Before, nftables doesn't permit invert ranges. This patch allows add rules like this: nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55 or nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55 Also, we still have the option for adding rules like this: sudo nft add rule ip test output frag id 33-45 Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: Update the context only in equality relationsÁlvaro Neira Ayuso2014-06-051-1/+2
| | | | | | | | | | | | | | | | | If we add this rule: sudo nft add rule ip test input ip protocol != icmp and we try to list the rules in the table test, nftables show this error: nft: src/payload.c:76: payload_expr_pctx_update: Assertion `expr->op == OP_EQ' failed. This patch change the function payload_match_postprocess for updating only the context in equality relations case. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: Add udplite tokenÁlvaro Neira Ayuso2014-05-281-0/+1
| | | | | | | | If we add a udplite rule, we can't because we have forgot to add this token in the scanner. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix crash if kernel doesn't support nfnetlink / nf_tablesPablo Neira Ayuso2014-05-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | When trying to close a descriptor which failed to be opened. ==6231== Process terminating with default action of signal 11 (SIGSEGV) ==6231== Access not within mapped region at address 0x0 ==6231== at 0x5503E21: mnl_socket_close (socket.c:248) ==6231== by 0x40517F: netlink_close_sock (netlink.c:68) ==6231== by 0x400EFEE: _dl_fini (dl-fini.c:253) ==6231== by 0x5740AA0: __run_exit_handlers (exit.c:77) ==6231== by 0x5740B24: exit (exit.c:99) ==6231== by 0x40F16F: netlink_open_error (netlink.c:105) ==6231== by 0x405642: netlink_open_sock (netlink.c:54) ==6231== by 0x424E6C: __libc_csu_init (in /usr/sbin/nft) ==6231== by 0x5728924: (below main) (libc-start.c:219) ==6231== If you believe this happened as a result of a stack ==6231== overflow in your program's main thread (unlikely but ==6231== possible), you can try to increase the size of the ==6231== main thread stack using the --main-stacksize= flag. ==6231== The main thread stack size used in this run was 8388608. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=881 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: use symbolic expression for ether tooPablo Neira Ayuso2014-05-271-4/+3
| | | | | | | | | | | | | | | | | | | Like in 0dbced3 ("parser: use symbolic expressions for parsing keywords as protocol values"), convert `ether' to use a symbolic expression. This fixes: # nft add rule ip filter input meta iiftype ether # nft list table filter table ip filter { ... iiftype 256 which was converted to network byte order. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't add table/chain/set to ctx->list in the event pathPablo Neira Ayuso2014-05-221-8/+16
| | | | | | | | | | | The delinearize functions for tables, chains and sets add these objects to the ctx->list. In the chain case, this is not required. Regarding tables and sets, those are added to the cache. This patch implicitly fixes an use chain object after free that result in random crashes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>