summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* tests: py: complete icmp and icmpv6 updatePablo Neira Ayuso2024-04-045-14/+14
| | | | | | | Update json update and leftover payload update to complete 5fecd2a6ef61 ("src: disentangle ICMP code types"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: disentangle ICMP code typesPablo Neira Ayuso2024-04-042-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, ICMP{v4,v6,inet} code datatypes only describe those that are supported by the reject statement, but they can also be used for icmp code matching. Moreover, ICMP code types go hand-to-hand with ICMP types, that is, ICMP code symbols depend on the ICMP type. Thus, the output of: nft describe icmp_code look confusing because that only displays the values that are supported by the reject statement. Disentangle this by adding internal datatypes for the reject statement to handle the ICMP code symbol conversion to value as well as ruleset listing. The existing icmp_code, icmpv6_code and icmpx_code remain in place. For backward compatibility, a parser function is defined in case an existing ruleset relies on these symbols. As for the manpage, move existing ICMP code tables from the DATA TYPES section to the REJECT STATEMENT section, where this really belongs to. But the icmp_code and icmpv6_code table stubs remain in the DATA TYPES section because that describe that this is an 8-bit integer field. After this patch: # nft describe icmp_code datatype icmp_code (icmp code) (basetype integer), 8 bits # nft describe icmpv6_code datatype icmpv6_code (icmpv6 code) (basetype integer), 8 bits # nft describe icmpx_code datatype icmpx_code (icmpx code) (basetype integer), 8 bits do not display the symbol table of the reject statement anymore. icmpx_code_type is not used anymore, but keep it in place for backward compatibility reasons. And update tests/shell accordingly. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: unused code in reverse cross-day meta hour rangePablo Neira Ayuso2024-04-021-0/+8
| | | | | | | | | | | | | | | | | | | | | f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") reverses a cross-day range expressed as "22:00"-"02:00" UTC time into != "02:00"-"22:00" so meta hour ranges works. Listing is however confusing, hence, 44d144cd593e ("netlink_delinearize: reverse cross-day meta hour range") introduces code to reverse a cross-day. However, it also adds code to reverse a range in == to-from form (assuming OP_IMPLICIT) which is never exercised from the listing path because the range expression is not currently used, instead two instructions (cmp gte and cmp lte) are used to represent the range. Remove this branch otherwise a reversed notation will be used to display meta hour ranges once the range instruction is to represent this. Add test for cross-day scenario in EADT timezone. Fixes: 44d144cd593e ("netlink_delinearize: reverse cross-day meta hour range") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: packetpath/flowtables: open all temporary files in /tmpJeremy Sowden2024-04-021-1/+1
| | | | | | | | | | The test used to do I/O over a named pipe in $PWD, until Phil changed it to create the pipe in /tmp. However, he missed one `socat` command. Update that too. Fixes: 3a9f29e21726 ("tests: shell: packetpath/flowtables: Avoid spurious EPERM") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: meta_time: fix dump validation failureFlorian Westphal2024-04-022-32/+0
| | | | | | | | | | | | [DUMP FAIL] 1/1 tests/shell/testcases/listing/meta_time This dump file validates only correctly for TZ=UTC-1 (i.e., CET). Time dumps cannot be validated in a portable way, the dump depends on TZ. As the test already does dump valiation with different TZ values, remove the dump file again. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add regression test for double-free crash bugFlorian Westphal2024-04-023-0/+83
| | | | | | | | | | | | | | | | BUG: KASAN: slab-use-after-free in nf_tables_set_elem_destroy+0x55/0x160 Call Trace: nf_tables_set_elem_destroy+0x55/0x160 nf_tables_set_elem_destroy+0x55/0x160 nft_pipapo_destroy+0x3b4/0x5a0 nft_set_destroy+0x118/0x3a0 nf_tables_trans_destroy_work+0x4f2/0xa80 This is a test case for the bug fiex with kernel commit b0e256f3dd2b ("netfilter: nft_set_pipapo: release elements in clone only from destroy path"). Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: use DTYPE_F_PREFIX only for IP address datatypePablo Neira Ayuso2024-03-212-10/+10
| | | | | | | | | | | | | | | | | DTYPE_F_PREFIX flag provides a hint to the netlink delinearize path to use prefix notation. It seems use of prefix notation in meta mark causes confusion, users expect to see prefix in the listing only in IP address datatypes. Untoggle this flag so (more lengthy) binop output such as: meta mark & 0xffffff00 == 0xffffff00 is used instead. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1739 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: reverse cross-day meta hour rangePablo Neira Ayuso2024-03-203-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") reverses the hour range in case that a cross-day range is used, eg. meta hour "03:00"-"14:00" counter accept which results in (Sidney, Australia AEDT time): meta hour != "14:00"-"03:00" counter accept kernel handles time in UTC, therefore, cross-day range may not be obvious according to local time. The ruleset listing above is not very intuitive to the reader depending on their timezone, therefore, complete netlink delinearize path to reverse the cross-day meta range. Update manpage to recommend to use a range expression when matching meta hour range. Recommend range expression for meta time and meta day too. Extend testcases/listing/meta_time to cover for this scenario. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1737 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: restore binop syntax when listing ruleset for flagsPablo Neira Ayuso2024-03-206-36/+327
| | | | | | | | | | | c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") provides a similar syntax to iptables using a prefix representation for flag matching. Restore original representation using binop when listing the ruleset. The parser still accepts the prefix notation for backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not merge a set with a erroneous oneFlorian Westphal2024-03-201-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The included sample causes a crash because we attempt to range-merge a prefix expression with a symbolic expression. The first set is evaluated, the symbol expression evaluation fails and nft queues an error message ("Could not resolve hostname"). However, nft continues evaluation. nft then encounters the same set definition again and merges the new content with the preceeding one. But the first set structure is dodgy, it still contains the unresolved symbolic expression. That then makes nft crash (assert) in the set internals. There are various different incarnations of this issue, but the low level set processing code does not allow for any partially transformed expressions to still remain. Before: nft --check -f tests/shell/testcases/bogons/nft-f/invalid_range_expr_type_binop BUG: invalid range expression type binop nft: src/expression.c:1479: range_expr_value_low: Assertion `0' failed. After: nft --check -f tests/shell/testcases/bogons/nft-f/invalid_range_expr_type_binop invalid_range_expr_type_binop:4:18-25: Error: Could not resolve hostname: Name or service not known elements = { 1&.141.0.1 - 192.168.0.2} ^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix one json-nft dump for reordered outputPhil Sutter2024-03-201-16/+16
| | | | | | | Missed this one when regenerating all dumps. Fixes: 2a0fe52eca32a ("tests: shell: Regenerate all json-nft dumps") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Add missing json-nft dumpsPhil Sutter2024-03-1913-0/+1808
| | | | | | | | | Given that a bunch of issues got fixed, add some more dumps. Also add tests/shell/testcases/owner/dumps/0002-persist.nft while at it, even though it's really small. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Regenerate all json-nft dumpsPhil Sutter2024-03-1960-647/+647
| | | | | | | | Ordering of 'nft -j list ruleset' output has changed, Regenerate existing json-nft dumps. No functional change intended, merely the position of chain objects should have moved up in the "nftables" array. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: packetpath/flowtables: Avoid spurious EPERMPhil Sutter2024-03-191-3/+3
| | | | | | | | | On my system for testing, called socat is not allowed to create the pipe file in local directory (probably due to sshfs). Specify a likely unique path in /tmp to avoid such problems. Fixes: 419c0199774c6 ("tests: shell: add test to cover ct offload by using nft flowtables") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: move meter tests to tests/shellPablo Neira Ayuso2024-03-1310-182/+250
| | | | | | | | | Userspace performs an translation to dynamic set which does not fit well into tests/py, move them to tests/shell. Fixes: b8f8ddfff733 ("evaluate: translate meter into dynamic set") Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add payload merging test casesFlorian Westphal2024-03-133-0/+291
| | | | | | Add a test case that would fail without preceeding fix. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: translate meter into dynamic setPablo Neira Ayuso2024-03-126-24/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 129f9d153279 ("nft: migrate man page examples with `meter` directive to sets") already replaced meters by dynamic sets. This patch removes NFT_SET_ANONYMOUS flag from the implicit set that is instantiated via meter, so the listing shows a dynamic set instead which is the recommended approach these days. Therefore, a batch like this: add table t add chain t c add rule t c tcp dport 80 meter m size 128 { ip saddr timeout 1s limit rate 10/second } gets translated to a dynamic set: table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } chain c { tcp dport 80 update @m { ip saddr timeout 1s limit rate 10/second burst 5 packets } } } Check for NFT_SET_ANONYMOUS flag is also relaxed for list and flush meter commands: # nft list meter ip t m table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } } # nft flush meter ip t m As a side effect the legacy 'list meter' and 'flush meter' commands allow to flush a dynamic set to retain backward compatibility. This patch updates testcases/sets/0022type_selective_flush_0 and testcases/sets/0038meter_list_0 as well as the json output which now uses the dynamic set representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for named ct objectsFlorian Westphal2024-03-052-0/+165
| | | | | | | | | | Add a dedicated test for named conntrack objects: timeouts, helpers and expectations. A json dump file is not added because the json input code does not support "typeof" declarations for sets/maps. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: move test case to "maps" directoryFlorian Westphal2024-03-012-0/+0
| | | | | | | This tests named object maps, so this should reside in maps/ not sets/ directory. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: maps: add a test case for "limit" objref mapFlorian Westphal2024-03-013-0/+442
| | | | | | | | | check add, delete and removal operations for objref maps. Also check type vs. typeof declarations and use both interval and interval+concatenation (rbtree, pipapo). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add more json dumpsFlorian Westphal2024-02-2610-0/+2551
| | | | | | | | | | | | Those are expected to be stable, so add them. Some are not 100% correct, as "typeof" is misprinted as "type" (json output and input parser lack support for this), but for these files the "type" is valid too. This will allow better validation once proper "typeof" support is added to json.c and json-parser.c. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add missing json.output dataFlorian Westphal2024-02-261-0/+31
| | | | | | | Fixes: bridge/vlan.t: WARNING: line 56: ... Fixes: 8b9ae77598b4 ("tests: never merge across non-expression statements redux 2") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add regression test for catchall double-deleteFlorian Westphal2024-02-182-0/+36
| | | | | | | | Test case for: b1db244ffd04 ("netfilter: nf_tables: check if catch-all set element is active in next generation") Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: permit use of host-endian constant values in set lookup keysFlorian Westphal2024-02-143-0/+126
| | | | | | | | | | | extend an existing test case with the afl input to cover in/output. A new test case is added to test linearization, delinearization and matching Fixes: c0080feb0d03 ("evaluate: permit use of host-endian constant values in set lookup keys") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip byteorder conversion for selector smaller than 2 bytesPablo Neira Ayuso2024-02-094-0/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add unary expression to trigger byteorder conversion for host byteorder selectors only if selectors length is larger or equal than 2 bytes. # cat test.nft table ip x { set test { type ipv4_addr . ether_addr . inet_proto flags interval } chain y { ip saddr . ether saddr . meta l4proto @test counter } } # nft -f test.nft ip x y [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ payload load 4b @ network header + 12 => reg 1 ] [ payload load 6b @ link header + 6 => reg 9 ] [ meta load l4proto => reg 11 ] [ byteorder reg 11 = hton(reg 11, 2, 1) ] <--- should not be here [ lookup reg 1 set test ] [ counter pkts 0 bytes 0 ] Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: no longer support unprettified ".json-nft" filesThomas Haller2024-02-091-16/+3
| | | | | | | | | | By now, all ".json-nft" files are prettified and will be generated in that form. Drop the fallback code that accepts them in the previous form. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-08340-340/+41954
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: have .json-nft dumps prettified to wrap linesThomas Haller2024-02-082-15/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the .json-nft file in git contains the output of `nft -j list ruleset`. This is one long line and makes diffs harder to review. Instead, have the prettified .json-nft file committed to git. - the diff now operates on the prettified version. That means, it compares essentially - `nft -j list ruleset | json-sanitize-ruleset.sh | json-pretty.sh` - `cat "$TEST.json-nft" | json-pretty.sh` The script "json-diff-pretty.sh" is no longer used. It is kept however, because it might be a useful for manual comparing files. Note that "json-sanitize-ruleset.sh" and "json-pretty.sh" are still two separate scripts and called at different times. They also do something different. The former mangles the JSON to account for changes that are not stable (in the JSON data itself), while the latter only pretty prints it. - when generating a new .json-nft dump file, the file will be updated to use the new, prettified format, unless the file is in the old format and needs no update. This means, with DUMPGEN=y, old style is preserved unless an update becomes necessary. This requires "json-pretty.sh" having stable output, as those files are committed to git. This is probably fine. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: missing auto-merge in json outputPablo Neira Ayuso2024-02-073-3/+3
| | | | | | | | | Several tests reports DUMP_FAILED because it was missing the auto-merge flag. That is, the original json dump was not correct. Update tests accordingly now that json support provides an automerge flag. Fixes: a4034c66b03e ("json: Support sets' auto-merge option") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't assert on net/transport header conflictFlorian Westphal2024-02-071-0/+5
| | | | | | | | | | | | | | | | | | | | | | before: nft: evaluate.c:467: conflict_resolution_gen_dependency: Assertion `expr->payload.base == PROTO_BASE_LL_HDR' failed. Aborted (core dumped) conflict_resolution_gen_dependency() can only handle linklayer conflicts, hence the assert. Rename it accordingly. Also rename resolve_protocol_conflict, it doesn't do anything for != PROTO_BASE_LL_HDR and extend the assertion to that function too. Callers now enforce PROTO_BASE_LL_HDR prerequisite. after: Error: conflicting transport layer protocols specified: comp vs. udp ip6 nexthdr comp udp dport 4789 ^^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cover netns removal for netdev and inet/ingress basechainsPablo Neira Ayuso2024-02-074-0/+78
| | | | | | | Add two tests to exercise netns removal with netdev and inet/ingress basechains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: netdevice removal for inet familyPablo Neira Ayuso2024-02-072-6/+20
| | | | | | cover netdevice removal when such netdevice belongs to basechain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test to cover ct offload by using nft flowtablesYi Chen2024-01-231-0/+96
| | | | | | | To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove huge-limit test casesFlorian Westphal2024-01-194-100/+0
| | | | | | | These tests will fail once the kernel checks for overflow in the internal token bucken counter, so drop them. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix sym refcount assertionFlorian Westphal2024-01-151-0/+3
| | | | | | | | | | | | Scope release must happen last. afl provided a reproducer where policy is a define, because scope is released too early we get: nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed. ... because chain->policy is EXPR_SYMBOL. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: error out when store needs more than one 128bit register of align ↵Florian Westphal2024-01-151-0/+1
| | | | | | | | | | | | | | | | | | | | | fixup Else this gives: nft: evaluate.c:2983: stmt_evaluate_payload: Assertion `sizeof(data) * BITS_PER_BYTE >= masklen' failed. For loads, this is already prevented via expr_evaluate_bits() which has: if (masklen > NFT_REG_SIZE * BITS_PER_BYTE) return expr_error(ctx->msgs, expr, "mask length %u exceeds allowed maximum of %u\n", masklen, NFT_REG_SIZE * BITS_PER_BYTE); But for the store path this isn't called. The reproducer asks to store a 128 bit integer at bit offset 1, i.e. 17 bytes would need to be munged, but we can only handle up to 16 bytes (one pseudo-register). Fixes: 78936d50f306 ("evaluate: add support to set IPv6 non-byte header fields") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject raw payload expressions with 0 lengthFlorian Westphal2024-01-121-0/+1
| | | | | | | | Reject this at parser stage. Fix up the json input side too, else reproducer gives: nft: src/netlink.c:243: netlink_gen_raw_data: Assertion `len > 0' failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: only assert if l2 header base has no lengthFlorian Westphal2024-01-121-0/+1
| | | | | | | | | | nftables will assert in some cases because the sanity check is done even for network and transport header bases. However, stacked headers are only supported for the link layer. Move the assertion around and add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: bail out if anonymous concat set defines a non concat expressionPablo Neira Ayuso2024-01-123-0/+15
| | | | | | | | | | | | | Iterate over the element list in the anonymous set to validate that all expressions are concatenations, otherwise bail out. ruleset.nft:3:46-53: Error: expression is not a concatenation ip protocol . th dport vmap { tcp / 22 : accept, tcp . 80 : drop} ^^^^^^^^ This is based on a patch from Florian Westphal. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add missing range checks for dup,fwd and payload statementsFlorian Westphal2024-01-112-3/+19
| | | | | | | | | | Else we assert with: BUG: unknown expression type range nft: src/netlink_linearize.c:912: netlink_gen_expr: Assertion `0' failed. While at it, condense meta and exthdr to reuse the same helper. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: tproxy: move range error checks after arg evaluationFlorian Westphal2024-01-111-0/+8
| | | | | | | | | | Testing for range before evaluation will still crash us later during netlink linearization, prefixes turn into ranges, symbolic expression might hide a range/prefix. So move this after the argument has been evaluated. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend coverage for netdevice removalPablo Neira Ayuso2024-01-104-0/+59
| | | | | | Add two extra tests to exercise netdevice removal path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a test case for double-flush bug in pipapoFlorian Westphal2024-01-082-0/+34
| | | | | | | | Test for 'netfilter: nft_set_pipapo: skip inactive elements during set walk'. Reported-by: Xingyuan Mo <hdthky0@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: prefer project nft to system-wide nftFlorian Westphal2024-01-072-20/+20
| | | | | | | | Use $NFT (src/nft, in-tree binary), not the one installed by the distro. Else we may not find newly added bugs unless user did "make install" or bug has propagated to release. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: ensure all timeout policy names are releasedFlorian Westphal2023-12-221-0/+7
| | | | | | | | | | | | | | | | | | | We need to add a custom destructor for this structure, it contains the dynamically allocated names. a:5:55-55: Error: syntax error, unexpected '}', expecting string policy = { estabQisheestablished : 2m3s, cd : 2m3s, } ==562373==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 160 byte(s) in 2 object(s) allocated from: #1 0x5a565b in xmalloc src/utils.c:31:8 #2 0x5a565b in xzalloc src/utils.c:70:8 #3 0x3d9352 in nft_parse_bison_filename src/libnftables.c:520:8 [..] Fixes: c7c94802679c ("src: add ct timeout support") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: do not allow to chain more than 16 binopsFlorian Westphal2023-12-221-0/+5
| | | | | | | | | | | | | | | | | | | | | netlink_linearize.c has never supported more than 16 chained binops. Adding more is possible but overwrites the stack in netlink_gen_bitwise(). Add a recursion counter to catch this at eval stage. Its not enough to just abort once the counter hits NFT_MAX_EXPR_RECURSION. This is because there are valid test cases that exceed this. For example, evaluation of 1 | 2 will merge the constans, so even if there are a dozen recursive eval calls this will not end up with large binop chain post-evaluation. v2: allow more than 16 binops iff the evaluation function did constant-merging. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: fix stack overflow due to erroneous roundingFlorian Westphal2023-12-201-0/+6
| | | | | | | Byteorder switch in this function may undersize the conversion buffer by one byte, this needs to use div_round_up(). Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: don't crash if object map does not refer to a valueFlorian Westphal2023-12-201-0/+6
| | | | | | | | | | | Before: BUG: Value export of 512 bytes would overflownft: src/netlink.c:474: netlink_gen_prefix: Assertion `0' failed. After: 66: Error: Object mapping data should be a value, not prefix synproxy name ip saddr map { 192.168.1.0/24 : "v*" } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test to cover payload transport match and manglePablo Neira Ayuso2023-12-192-0/+180
| | | | | | | | | | Exercise payload transport match and mangle for inet, bridge and netdev families with IPv4 and IPv6 packets. To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tcpopt: don't create exthdr expression without datatypeFlorian Westphal2023-12-191-0/+1
| | | | | | | | | | | | | The reproducer crashes during concat evaluation, as the exthdr expression lacks a datatype. This should never happen, i->dtype must be set. In this case the culprit is tcp option parsing, it will wire up a non-existent template, because the "nop" option has no length field (1 byte only). Signed-off-by: Florian Westphal <fw@strlen.de>