summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* parser_bison: Accept ASTERISK_STRING in flowtable_expr_memberPhil Sutter2 days1-10/+1
| | | | | | | | | All clauses are identical, so instead of adding a third one for ASTERISK_STRING, use a single one for 'string' (which combines all three variants). Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Support simple wildcards in netdev hooksPhil Sutter2 days1-3/+23
| | | | | | | | | | | | When building NFTA_{FLOWTABLE_,}HOOK_DEVS attributes, detect trailing asterisks in interface names and transmit the leading part in a NFTA_DEVICE_PREFIX attribute. Deserialization (i.e., appending asterisk to interface prefixes returned in NFTA_DEVICE_PREFIX atributes happens in libnftnl. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: do not re-add default include directory in include search pathPablo Neira Ayuso7 days1-0/+3
| | | | | | | | | Otherwise globbing might duplicate included files because include_path_glob() is called twice. Fixes: 7eb950a8e8fa ("libnftables: include canonical path to avoid duplicates") Tested-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Fix for existence check on Big EndianPhil Sutter2025-09-112-1/+4
| | | | | | | | | | | | | | | | | | | | | Adjust the expression size to 1B so cmp expression value is correct. Without this, the rule 'fib saddr . iif check exists' generates following byte code on BE: | [ fib saddr . iif oif present => reg 1 ] | [ cmp eq reg 1 0x00000001 ] Though with NFTA_FIB_F_PRESENT flag set, nft_fib.ko writes to the first byte of reg 1 only (using nft_reg_store8()). With this patch in place, byte code is correct: | [ fib saddr . iif oif present => reg 1 ] | [ cmp eq reg 1 0x01000000 ] Fixes: f686a17eafa0b ("fib: Support existence check") Cc: Yi Chen <yiche@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Inform JSON printer when reporting an object delete eventPhil Sutter2025-09-112-7/+13
| | | | | | | | | | | Since kernel commit a1050dd07168 ("netfilter: nf_tables: Reintroduce shortened deletion notifications"), type-specific data is no longer dumped when notifying for a deleted object. JSON output was not aware of this and tried to print bogus data. Fixes: 9e88aae28e9f4 ("monitor: Use libnftables JSON output") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Allow for updating devices on existing inet ingress hook chainsPhil Sutter2025-09-112-2/+19
| | | | | | | | | | | | | Complete commit a66b5ad9540dd ("src: allow for updating devices on existing netdev chain") in supporting inet family ingress hook chains as well. The kernel does already but nft has to add a proper hooknum attribute to pass the checks. Calling chain_evaluate() for populating the hook.num field is a bit over the top and has potentially unwanted side-effects. Introduce a minimal chain_del_evaluate() for this purpose. Signed-off-by: Phil Sutter <phil@nwl.cc>
* monitor: Quote device names in chain declarations, tooPhil Sutter2025-09-021-1/+1
| | | | | | | | Fixed commit missed the fact that there are two routines printing chain declarations. Fixes: eb30f236d91a8 ("rule: print chain and flowtable devices in quotes") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_bison: remove leftover utf-8 character in errorPablo Neira Ayuso2025-09-011-1/+1
| | | | | | | replace "‘" (UTF-8, 0xe280 0x98) with "'" (ASCII 0x27). Fixes: c92ec3b21979 ("src: remove utf-8 character in printf lines") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Embed creating nft version into userdataPhil Sutter2025-08-283-6/+52
| | | | | | | | | | Upon listing a table which was created by a newer version of nftables, warn about the potentially incomplete content. Suggested-by: Florian Westphal <fw@strlen.de> Cc: Dan Winship <danwinship@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: simplify set to list normalisation for device expressionsPablo Neira Ayuso2025-08-281-15/+1
| | | | | | | | | | | | | | | | | | | | | | When evaluating the list of devices, two expressions are possible: - EXPR_LIST, which is the expected expression type to store the list of chain/flowtable devices. - EXPR_SET, in case that a variable is used to express the device list. This is because it is not possible to know if the variable defines set elements or devices. Since sets are more common, EXPR_SET is used. In the latter case, this list expressed as EXPR_SET gets translated to EXPR_LIST. Before such translation, the EXPR_VARIABLE is evaluated, therefore all variables are gone and only EXPR_SET_ELEM are possible in expr_set_to_list(). Remove the EXPR_VALUE and EXPR_VARIABLE cases in expr_set_to_list() since those are never seen. Add BUG() in case any other expressions than EXPR_SET_ELEM is seen. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_alloc() by type safe functionPablo Neira Ayuso2025-08-274-20/+22
| | | | | | | Replace compound_expr_alloc() by {set,list,concat}_expr_alloc() to validate expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_print() by type safe functionPablo Neira Ayuso2025-08-271-15/+16
| | | | | | | Replace compound_expr_print() by {list,set,concat}_expr_print() to validate expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_destroy() by type safe funtionPablo Neira Ayuso2025-08-271-12/+23
| | | | | | Replace it by {set,list,concat}_expr_destroy() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_remove() by type safe functionPablo Neira Ayuso2025-08-272-9/+21
| | | | | | | Replace this function by {list,concat,set}_expr_remove() to validate expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: remove compound_expr_add()Pablo Neira Ayuso2025-08-271-6/+0
| | | | | | | No more users of this function after conversion to type safe variant, remove it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_clone() by type safe functionPablo Neira Ayuso2025-08-271-12/+30
| | | | | | | | | | | | Replace compound_expr_clone() by: - concat_expr_clone() - list_expr_clone() - set_expr_clone() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: rename set_compound_expr_add() to set_expr_add_splice()Pablo Neira Ayuso2025-08-271-6/+6
| | | | | | To avoid confusion when perfoming git grep to search for compound_expr_add() Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_add() by type safe list_expr_add()Pablo Neira Ayuso2025-08-275-19/+27
| | | | | | Replace compound_expr_add() by list_expr_add() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_add() by type safe concat_expr_add()Pablo Neira Ayuso2025-08-276-20/+28
| | | | | | Replace compound_expr_add by concat_expr_add() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_add() by type safe set_expr_add()Pablo Neira Ayuso2025-08-279-35/+48
| | | | | | | | Replace compound_expr_add() by set_expr_add() to validate type. Add __set_expr_add() to skip size updates in src/intervals.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add expr_type_catchall() helper and use itPablo Neira Ayuso2025-08-273-8/+8
| | | | | | Add helper function to check if this is a catchall expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tunnel: add tunnel object and statement json supportFernando Fernandez Mancera2025-08-273-8/+345
| | | | | Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tunnel: add geneve supportPablo Neira Ayuso2025-08-275-1/+166
| | | | | | | | | | | | | | | | | | | | | | | | This patch extends the tunnel metadata object to define geneve tunnel specific configurations: table netdev x { tunnel y { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 10 dport 20 ttl 10 geneve { class 0x1010 opt-type 0x1 data "0x12345678" class 0x1020 opt-type 0x2 data "0x87654321" class 0x2020 opt-type 0x3 data "0x87654321abcdeffe" } } } Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tunnel: add vxlan supportFernando Fernandez Mancera2025-08-275-1/+61
| | | | | | | | | | | | | | | | | | | | | | This patch extends the tunnel metadata object to define vxlan tunnel specific configurations: table netdev x { tunnel y { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 10 dport 20 ttl 10 vxlan { gbp 200 } } } Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tunnel statement and expression supportPablo Neira Ayuso2025-08-278-6/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to attach tunnel metadata through the tunnel statement. The following example shows how to redirect traffic to the erspan0 tunnel device which will take the tunnel configuration that is specified by the ruleset. table netdev x { tunnel y { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 10 dport 20 ttl 10 erspan { version 1 index 2 } } chain x { type filter hook ingress device veth0 priority 0; ip daddr 10.141.10.123 tunnel name y fwd to erspan0 } } This patch also allows to match on tunnel metadata via tunnel expression. Joint work with Fernando. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tunnel: add erspan supportPablo Neira Ayuso2025-08-275-1/+157
| | | | | | | | | | | | | | | | | | | | | | | | | This patch extends the tunnel metadata object to define erspan tunnel specific configurations: table netdev x { tunnel y { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 10 dport 20 ttl 10 erspan { version 1 index 2 } } } Joint work with Fernando. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tunnel template supportPablo Neira Ayuso2025-08-279-4/+350
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds tunnel template support, this allows to attach a metadata template that provides the configuration for the tunnel driver. Example of generic tunnel configuration: table netdev x { tunnel y { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 10 dport 20 ttl 10 } } This still requires the tunnel statement to attach this metadata template, this comes in a follow up patch. Joint work with Fernando. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: continue on ENOBUFS errors when processing batchPablo Neira Ayuso2025-08-261-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A user reports that: nft -f ruleset.nft fails with: netlink: Error: Could not process rule: No buffer space available This was triggered by: table ip6 fule { set domestic_ip6 { type ipv6_addr flags dynamic,interval elements = $domestic_ip6 } chain prerouting { type filter hook prerouting priority 0; ip6 daddr @domestic_ip6 counter } } where $domestic_ip6 contains a large number of IPv6 addresses. This set declaration is not supported currently, because dynamic sets with intervals are not supported, then every IPv6 address that is added triggers an error, overruning the userspace socket buffer with lots of NLMSG_ERROR messages (or too big NLMSG_ERROR message to fit into the socket buffer). In the particular context of batch processing, ENOBUFS is just an indication that too many errors have occurred. The kernel cannot store any more NLMSG_ERROR messages into the userspace socket buffer. However, there are still NLMSG_ERROR messages in the socket buffer to be processed that can provide a hint on what is going on. Instead of breaking on ENOBUFS in batches, continue error processing. After this patch, the ruleset above displays: ruleset.nft:2367:7-18: Error: Could not process rule: Operation not supported set domestic_ip6 { ^^^^^^^^^^^^ ruleset.nft:2367:7-18: Error: Could not process rule: No such file or directory set domestic_ip6 { ^^^^^^^^^^^^ Fixes: a72315d2bad4 ("src: add rule batching support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* trace: Fix for memleak in trace_alloc_list() error pathPhil Sutter2025-08-261-0/+1
| | | | | | | | | The allocated 'list_expr' may leak. Fixes: cfd768615235b ("src: add conntrack information to trace monitor mode") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: silence compiler warningFlorian Westphal2025-08-211-3/+2
| | | | | | | | | | | | | | | gcc 14.3.0 reports this: src/mnl.c: In function 'mnl_nft_chain_add': src/mnl.c:916:25: warning: 'nest' may be used uninitialized [-Wmaybe-uninitialized] 916 | mnl_attr_nest_end(nlh, nest); I guess its because compiler can't know that the conditions cannot change in-between and assumes nest_end() can be called without nest_start(). Fixes: 01277922fede ("src: ensure chain policy evaluation when specified") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: restore JSON output for relational expressionsPablo Neira Ayuso2025-08-202-8/+19
| | | | | | | | | | | | | | | | | | | JSON output for the fib expression changed: - "result": "check" + "result": "oif" This breaks third party JSON parsers, revert this change for relational expressions only via workaround until there are clear rules on how to proceed with JSON schema updates. As for set and map statements, keep this new "check" result type since it is not possible to peek on rhs in such case to guess if the NFT_FIB_F_PRESENT flag needs to be set on. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1806 Fixes: f4b646032acf ("fib: allow to check if route exists in maps") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix memory leak in anon chain error handlingFlorian Westphal2025-08-193-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | chain_stmt_destroy is called from bison destructor, but it turns out this function won't free the associated chain. There is no memory leak when bison can parse the input because the chain statement evaluation step queues the embedded anon chain via cmd_alloc. Then, a later cmd_free() releases the chain and the embedded statements. In case of a parser error, the evaluation step is never reached and the chain object leaks, e.g. in foo bar jump { return } Bison calls the right destructor but the anonon chain and all statements/expressions in it are not released: HEAP SUMMARY: in use at exit: 1,136 bytes in 4 blocks total heap usage: 98 allocs, 94 frees, 840,255 bytes allocated 1,136 (568 direct, 568 indirect) bytes in 1 blocks are definitely lost in loss record 4 of 4 at: calloc (vg_replace_malloc.c:1675) by: xzalloc (in libnftables.so.1.1.0) by: chain_alloc (in libnftables.so.1.1.0) by: nft_parse (in libnftables.so.1.1.0) by: __nft_run_cmd_from_filename (in libnftables.so.1.1.0) by: nft_run_cmd_from_filename (in libnftables.so.1.1.0) To resolve this, make chain_stmt_destroy also release the embedded chain. This in turn requires chain refcount increases whenever a chain is assocated with a chain statement, else we get double-free of the chain. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ensure chain policy evaluation when specifiedPablo Neira Ayuso2025-08-194-14/+25
| | | | | | | | | | | | | | | | | | | | | Set on CHAIN_F_BASECHAIN when policy is specified in chain, otherwise chain priority is not evaluated. Toggling this flag requires needs three adjustments to work though: 1) chain_evaluate() needs skip evaluation of hook name and priority if not specified to allow for updating the default chain policy, e.g. chain ip x y { policy accept; } 2) update netlink bytecode generation for chain to skip NFTA_CHAIN_HOOK so update path is exercised in the kernel. 3) error reporting needs to check if basechain priority and type is set on, otherwise skip further hints. Fixes: acdfae9c3126 ("src: allow to specify the default policy for base chains") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: incorrect type when aggregating concatenated set rangesPablo Neira Ayuso2025-08-191-1/+1
| | | | | | | | | | | | | Uncovered by the compound_expr_remove() replacement by type safe function coming after this patch. Add expression to the concatenation which is reachable via expr_value(). This bug is subtle, I could not spot any reproducible buggy behaviour when using the wrong type when running the existing tests. Fixes: 8ac2f3b2fca3 ("src: Add support for concatenated set ranges") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Do not reduce single-item arrays on outputPhil Sutter2025-08-181-6/+2
| | | | | | | | | | | | | | This is a partial revert of commit a740f2036ad0d ("json: Introduce json_add_array_new()"), keeping the function but eliminating its primary task which is to replace arrays of size 1 by their only item. While support for this on input is convenient for users, it means extra casing in JSON output parsers to cover for it. The minor reduction in output size does not justify that. Fixes: a740f2036ad0d ("json: Introduce json_add_array_new()") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1806 Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check XOR RHS operand is a constant valueFlorian Westphal2025-08-181-1/+5
| | | | | | | | | Now that we support non-constant RHS side in binary operations, reject XOR with non-constant key: we cannot transfer the expression. Fixes: 54bfc38c522b ("src: allow binop expressions with variable right-hand operands") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: netlink_delinearize_table() may return NULLPhil Sutter2025-08-132-1/+6
| | | | | | | Catch the error condition in callers to avoid crashes. Fixes: c156232a530b3 ("src: add comment support when adding tables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: Fix for 'meta hour' ranges spanning date boundariesPhil Sutter2025-07-311-5/+20
| | | | | | | | | | | | | | | | | | | | Introduction of EXPR_RANGE_SYMBOL type inadvertently disabled sanitizing of meta hour ranges where the lower boundary has a higher value than the upper boundary. This may happen outside of user control due to the fact that given ranges are converted to UTC which is the kernel's native timezone. Perform the conditional match and op inversion with the new RHS expression type as well after expanding it so values are comparable. Since this replaces the whole range expression, make it replace the relational's RHS entirely. While at it extend testsuites to cover these corner-cases. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1805 Fixes: 347039f64509e ("src: add symbol range expression to further compact intervals") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Parse into symbol range expression if possiblePhil Sutter2025-07-311-1/+11
| | | | | | | | | Apply the bison parser changes in commit 347039f64509e ("src: add symbol range expression to further compact intervals") to JSON parser as well. Fixes: 347039f64509e ("src: add symbol range expression to further compact intervals") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: Introduce is_symbol_value_expr() macroPhil Sutter2025-07-311-4/+2
| | | | | | | | | Annotate and combine the 'etype' and 'symtype' checks done in bison parser for readability and because JSON parser will start doing the same in a follow-up patch. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: fix memory leak when parsing flowtable hook declarationFlorian Westphal2025-07-241-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the hook location is invalid we error out but we do leak both the priority expression and the flowtable name. Example: valgrind --leak-check=full nft -f flowtable-parser-err-memleak [..] Error: unknown chain hook hook enoent priority filter + 10 ^^^^^^ [..] 2 bytes in 1 blocks are definitely lost in loss record 1 of 3 at: malloc (vg_replace_malloc.c:446) by: strdup (in libc.so.6) by: xstrdup (in libnftables.so.1.1.0) by: nft_lex (in libnftables.so.1.1.0) by: nft_parse (in libnftables.so.1.1.0) by: __nft_run_cmd_from_filename (in libnftables.so.1.1.0) by: nft_run_cmd_from_filename (in libnftables.so.1.1.0) First two reports are due to the priority expression: this needs to call expr_free(). Third report is due to the flowtable name, the destructor was missing so add one. After fix: All heap blocks were freed -- no leaks are possible Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: fix assert due to empty interface nameFlorian Westphal2025-07-221-11/+23
| | | | | | | | | | | | | Before: nft: src/mnl.c:744: nft_dev_add: Assertion `ifname_len > 0' failed. After: internal:0:0-0: Error: empty interface name Bison checks this upfront, do same in json. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: reject non-concat expressionFlorian Westphal2025-07-221-0/+7
| | | | | | | | | | | | | | Before "src: detach set, list and concatenation expression layout": internal:0:0-0: Error: Concatenation with 0 elements is illegal After this change, expr->size access triggers assert() failure, add explicit test for etype to avoid this and error out: internal:0:0-0: Error: Expected concat element, got symbol. Fixes: e0d92243be1c ("src: detach set, list and concatenation expression layout") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: maps: check element data mapping matches set data definitionFlorian Westphal2025-07-221-0/+20
| | | | | | | | | | | | | | | | | This change is similar to 7f4d7fef31bd ("evaluate: check element key vs. set definition") but this time for data mappings. The included bogon asserts with: BUG: invalid data expression type catch-all set element nft: src/netlink.c:596: __netlink_gen_data: Assertion `0' failed. after: internal:0:0-0: Error: Element mapping mismatches map definition, expected packet mark, not 'invalid' Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: BASECHAIN flag no longer implies presence of priority expressionFlorian Westphal2025-07-171-12/+20
| | | | | | | | This is a followup to 44ea19364637 ("src: BASECHAIN flag no longer implies presence of priority expression"): feeding the same bogon file into nft -j we get a very similar crash. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix crash with invalid elements in setFlorian Westphal2025-07-161-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | ctx->ectx.key can be cleared, causing a crash: src/nft --check -f tests/shell/testcases/bogons/nft-f/set_with_bad_elem AddressSanitizer:DEADLYSIGNAL #0 0x7ffb57098c0d in elem_key_compatible src/evaluate.c:1934 #1 0x7ffb5709926d in expr_evaluate_set_elem src/evaluate.c:1979 #2 0x7ffb570a540f in expr_evaluate src/evaluate.c:3159 #3 0x7ffb57095f33 in list_member_evaluate src/evaluate.c:1652 #4 0x7ffb57099f92 in expr_evaluate_set src/evaluate.c:2066 #5 0x7ffb570a53f7 in expr_evaluate src/evaluate.c:3157 .. AddressSanitizer: SEGV src/evaluate.c:1934 in elem_key_compatible After: set_with_bad_elem:4:39-46: Error: Element mismatches set definition, expected IPv4 address, not 'integer' elements = { 1.2.3.4, tcp << 8 } ^^^^^^^^ Use ctx->set->key instead. Fixes: 7f4d7fef31bd ("evaluate: check element key vs. set definition") Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: Call mnl_attr_nest_end() just oncePhil Sutter2025-07-161-1/+1
| | | | | | | | Calling the function after each added nested attribute is harmless but pointless. Fixes: a66b5ad9540dd ("src: allow for updating devices on existing netdev chain") Signed-off-by: Phil Sutter <phil@nwl.cc>
* mnl: Support NFNL_HOOK_TYPE_NFT_FLOWTABLEPhil Sutter2025-07-151-2/+10
| | | | | | | | New kernels dump info for flowtable hooks the same way as for base chains. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* evaluate: check element key vs. set definitionFlorian Westphal2025-07-131-7/+23
| | | | | | | | | | | | | | | Included bogon asserts with: src/datatype.c:253: symbolic_constant_print: Assertion `expr->len / BITS_PER_BYTE <= sizeof(val)' failed. Resolve this by validating that the set element key matches the set key definition. After this, loading the bogon file gives: Error: Element mismatches set definition, expected concatenation of (IPv4 address, integer), not 'ICMP type' elements = {redirect } ^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* src: detach set, list and concatenation expression layoutPablo Neira Ayuso2025-07-1016-184/+189
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These three expressions use the same layout, but they have a different purpose. Several fields are specific of a given expression: - set_flags is only required by set expressions. - field_len and field_count are only used by concatenation expressions. Add accessors to validate the expression type before accessing the union fields: #define expr_set(__expr) (assert((__expr)->etype == EXPR_SET), &(__expr)->expr_set) #define expr_concat(__expr) (assert((__expr)->etype == EXPR_CONCAT), &(__expr)->expr_concat) #define expr_list(__expr) (assert((__expr)->etype == EXPR_LIST), &(__expr)->expr_list) This should help catch subtle bugs due to type confusion. assert() could be later enabled only in debugging builds to run tests, keep it by now. compound_expr_*() still works and it needs the same initial layout for all of these expressions: struct list_head expressions; unsigned int size; This is implicitly reducing the size of one of the largest structs in the union area of struct expr, still EXPR_SET_ELEM remains the largest so no gain is achieved in this iteration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2025-10-03 05:18:51 +0000