summaryrefslogtreecommitdiffstats
path: root/tests
Commit message (Collapse)AuthorAgeFilesLines
* evaluate: skip byteorder conversion for selector smaller than 2 bytesPablo Neira Ayuso2024-02-094-0/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add unary expression to trigger byteorder conversion for host byteorder selectors only if selectors length is larger or equal than 2 bytes. # cat test.nft table ip x { set test { type ipv4_addr . ether_addr . inet_proto flags interval } chain y { ip saddr . ether saddr . meta l4proto @test counter } } # nft -f test.nft ip x y [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ payload load 4b @ network header + 12 => reg 1 ] [ payload load 6b @ link header + 6 => reg 9 ] [ meta load l4proto => reg 11 ] [ byteorder reg 11 = hton(reg 11, 2, 1) ] <--- should not be here [ lookup reg 1 set test ] [ counter pkts 0 bytes 0 ] Fixes: 1017d323cafa ("src: support for selectors with different byteorder with interval concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: no longer support unprettified ".json-nft" filesThomas Haller2024-02-091-16/+3
| | | | | | | | | | By now, all ".json-nft" files are prettified and will be generated in that form. Drop the fallback code that accepts them in the previous form. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Pretty-print all *.json-nft dumpsPhil Sutter2024-02-08340-340/+41954
| | | | | | | | | | | | | The problem with single line output as produced by 'nft -j list ruleset' is its incompatibility to unified diff format as any change in this single line will produce a diff which contains the old and new lines in total. This is not just unreadable but will blow up patches which may exceed mailinglists' mail size limits. Convert them all at once by feeding their contents to tests/shell/helpers/json-pretty.sh. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/shell: have .json-nft dumps prettified to wrap linesThomas Haller2024-02-082-15/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the .json-nft file in git contains the output of `nft -j list ruleset`. This is one long line and makes diffs harder to review. Instead, have the prettified .json-nft file committed to git. - the diff now operates on the prettified version. That means, it compares essentially - `nft -j list ruleset | json-sanitize-ruleset.sh | json-pretty.sh` - `cat "$TEST.json-nft" | json-pretty.sh` The script "json-diff-pretty.sh" is no longer used. It is kept however, because it might be a useful for manual comparing files. Note that "json-sanitize-ruleset.sh" and "json-pretty.sh" are still two separate scripts and called at different times. They also do something different. The former mangles the JSON to account for changes that are not stable (in the JSON data itself), while the latter only pretty prints it. - when generating a new .json-nft dump file, the file will be updated to use the new, prettified format, unless the file is in the old format and needs no update. This means, with DUMPGEN=y, old style is preserved unless an update becomes necessary. This requires "json-pretty.sh" having stable output, as those files are committed to git. This is probably fine. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: missing auto-merge in json outputPablo Neira Ayuso2024-02-073-3/+3
| | | | | | | | | Several tests reports DUMP_FAILED because it was missing the auto-merge flag. That is, the original json dump was not correct. Update tests accordingly now that json support provides an automerge flag. Fixes: a4034c66b03e ("json: Support sets' auto-merge option") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't assert on net/transport header conflictFlorian Westphal2024-02-071-0/+5
| | | | | | | | | | | | | | | | | | | | | | before: nft: evaluate.c:467: conflict_resolution_gen_dependency: Assertion `expr->payload.base == PROTO_BASE_LL_HDR' failed. Aborted (core dumped) conflict_resolution_gen_dependency() can only handle linklayer conflicts, hence the assert. Rename it accordingly. Also rename resolve_protocol_conflict, it doesn't do anything for != PROTO_BASE_LL_HDR and extend the assertion to that function too. Callers now enforce PROTO_BASE_LL_HDR prerequisite. after: Error: conflicting transport layer protocols specified: comp vs. udp ip6 nexthdr comp udp dport 4789 ^^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: cover netns removal for netdev and inet/ingress basechainsPablo Neira Ayuso2024-02-074-0/+78
| | | | | | | Add two tests to exercise netns removal with netdev and inet/ingress basechains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: netdevice removal for inet familyPablo Neira Ayuso2024-02-072-6/+20
| | | | | | cover netdevice removal when such netdevice belongs to basechain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test to cover ct offload by using nft flowtablesYi Chen2024-01-231-0/+96
| | | | | | | To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Yi Chen <yiche@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove huge-limit test casesFlorian Westphal2024-01-194-100/+0
| | | | | | | These tests will fail once the kernel checks for overflow in the internal token bucken counter, so drop them. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix sym refcount assertionFlorian Westphal2024-01-151-0/+3
| | | | | | | | | | | | Scope release must happen last. afl provided a reproducer where policy is a define, because scope is released too early we get: nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed. ... because chain->policy is EXPR_SYMBOL. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: error out when store needs more than one 128bit register of align ↵Florian Westphal2024-01-151-0/+1
| | | | | | | | | | | | | | | | | | | | | fixup Else this gives: nft: evaluate.c:2983: stmt_evaluate_payload: Assertion `sizeof(data) * BITS_PER_BYTE >= masklen' failed. For loads, this is already prevented via expr_evaluate_bits() which has: if (masklen > NFT_REG_SIZE * BITS_PER_BYTE) return expr_error(ctx->msgs, expr, "mask length %u exceeds allowed maximum of %u\n", masklen, NFT_REG_SIZE * BITS_PER_BYTE); But for the store path this isn't called. The reproducer asks to store a 128 bit integer at bit offset 1, i.e. 17 bytes would need to be munged, but we can only handle up to 16 bytes (one pseudo-register). Fixes: 78936d50f306 ("evaluate: add support to set IPv6 non-byte header fields") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject raw payload expressions with 0 lengthFlorian Westphal2024-01-121-0/+1
| | | | | | | | Reject this at parser stage. Fix up the json input side too, else reproducer gives: nft: src/netlink.c:243: netlink_gen_raw_data: Assertion `len > 0' failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: only assert if l2 header base has no lengthFlorian Westphal2024-01-121-0/+1
| | | | | | | | | | nftables will assert in some cases because the sanity check is done even for network and transport header bases. However, stacked headers are only supported for the link layer. Move the assertion around and add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: bail out if anonymous concat set defines a non concat expressionPablo Neira Ayuso2024-01-123-0/+15
| | | | | | | | | | | | | Iterate over the element list in the anonymous set to validate that all expressions are concatenations, otherwise bail out. ruleset.nft:3:46-53: Error: expression is not a concatenation ip protocol . th dport vmap { tcp / 22 : accept, tcp . 80 : drop} ^^^^^^^^ This is based on a patch from Florian Westphal. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add missing range checks for dup,fwd and payload statementsFlorian Westphal2024-01-112-3/+19
| | | | | | | | | | Else we assert with: BUG: unknown expression type range nft: src/netlink_linearize.c:912: netlink_gen_expr: Assertion `0' failed. While at it, condense meta and exthdr to reuse the same helper. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: tproxy: move range error checks after arg evaluationFlorian Westphal2024-01-111-0/+8
| | | | | | | | | | Testing for range before evaluation will still crash us later during netlink linearization, prefixes turn into ranges, symbolic expression might hide a range/prefix. So move this after the argument has been evaluated. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend coverage for netdevice removalPablo Neira Ayuso2024-01-104-0/+59
| | | | | | Add two extra tests to exercise netdevice removal path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add a test case for double-flush bug in pipapoFlorian Westphal2024-01-082-0/+34
| | | | | | | | Test for 'netfilter: nft_set_pipapo: skip inactive elements during set walk'. Reported-by: Xingyuan Mo <hdthky0@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: prefer project nft to system-wide nftFlorian Westphal2024-01-072-20/+20
| | | | | | | | Use $NFT (src/nft, in-tree binary), not the one installed by the distro. Else we may not find newly added bugs unless user did "make install" or bug has propagated to release. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: ensure all timeout policy names are releasedFlorian Westphal2023-12-221-0/+7
| | | | | | | | | | | | | | | | | | | We need to add a custom destructor for this structure, it contains the dynamically allocated names. a:5:55-55: Error: syntax error, unexpected '}', expecting string policy = { estabQisheestablished : 2m3s, cd : 2m3s, } ==562373==ERROR: LeakSanitizer: detected memory leaks Indirect leak of 160 byte(s) in 2 object(s) allocated from: #1 0x5a565b in xmalloc src/utils.c:31:8 #2 0x5a565b in xzalloc src/utils.c:70:8 #3 0x3d9352 in nft_parse_bison_filename src/libnftables.c:520:8 [..] Fixes: c7c94802679c ("src: add ct timeout support") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: do not allow to chain more than 16 binopsFlorian Westphal2023-12-221-0/+5
| | | | | | | | | | | | | | | | | | | | | netlink_linearize.c has never supported more than 16 chained binops. Adding more is possible but overwrites the stack in netlink_gen_bitwise(). Add a recursion counter to catch this at eval stage. Its not enough to just abort once the counter hits NFT_MAX_EXPR_RECURSION. This is because there are valid test cases that exceed this. For example, evaluation of 1 | 2 will merge the constans, so even if there are a dozen recursive eval calls this will not end up with large binop chain post-evaluation. v2: allow more than 16 binops iff the evaluation function did constant-merging. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: fix stack overflow due to erroneous roundingFlorian Westphal2023-12-201-0/+6
| | | | | | | Byteorder switch in this function may undersize the conversion buffer by one byte, this needs to use div_round_up(). Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: don't crash if object map does not refer to a valueFlorian Westphal2023-12-201-0/+6
| | | | | | | | | | | Before: BUG: Value export of 512 bytes would overflownft: src/netlink.c:474: netlink_gen_prefix: Assertion `0' failed. After: 66: Error: Object mapping data should be a value, not prefix synproxy name ip saddr map { 192.168.1.0/24 : "v*" } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test to cover payload transport match and manglePablo Neira Ayuso2023-12-192-0/+180
| | | | | | | | | | Exercise payload transport match and mangle for inet, bridge and netdev families with IPv4 and IPv6 packets. To cover kernel patch ("netfilter: nf_tables: set transport offset from mac header for netdev/egress"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tcpopt: don't create exthdr expression without datatypeFlorian Westphal2023-12-191-0/+1
| | | | | | | | | | | | | The reproducer crashes during concat evaluation, as the exthdr expression lacks a datatype. This should never happen, i->dtype must be set. In this case the culprit is tcp option parsing, it will wire up a non-existent template, because the "nop" option has no length field (1 byte only). Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix stack overflow with huge priority stringFlorian Westphal2023-12-151-0/+5
| | | | | | | | Alternative would be to refactor this and move this into the parsers (bison, json) instead of this hidden re-parsing. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: fix stack buffer overflow with sub-reg sized prefixesFlorian Westphal2023-12-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | | The calculation of the dynamic on-stack array is incorrect, the scratch space can be too low which gives stack corruption: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffdb454f064.. #1 0x7fabe92aaac4 in __mpz_export_data src/gmputil.c:108 #2 0x7fabe92d71b1 in netlink_export_pad src/netlink.c:251 #3 0x7fabe92d91d8 in netlink_gen_prefix src/netlink.c:476 div_round_up() cannot be used here, it fails to account for register padding. A 16 bit prefix will need 2 registers (start, end -- 8 bytes in total). Remove the dynamic sizing and add an assertion in case upperlayer ever passes invalid expr sizes down to us. After this fix, the combination is rejected by the kernel because of the maps' wrong data size, before the fix userspace may crash before. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: reject large raw payload and concat expressionsFlorian Westphal2023-12-152-0/+10
| | | | | | | | | | | | | | | | | | The kernel will reject this too, but unfortunately nft may try to cram the data into the underlying libnftnl expr. This causes heap corruption or BUG: nld buffer overflow: want to copy 132, max 64 After: Error: Concatenation of size 544 exceeds maximum size of 512 udp length . @th,0,512 . @th,512,512 { 47-63 . 0xe373135363130 . 0x33131303735353203 } ^^^^^^^^^ resp. same warning for an over-sized raw expression. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: exthdr: statement arg must be not be a rangeFlorian Westphal2023-12-141-0/+1
| | | | | | | | Else we get: BUG: unknown expression type range nft: src/netlink_linearize.c:909: netlink_gen_expr: Assertion `0' failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: don't crash if prefix for < byte is requestedFlorian Westphal2023-12-146-0/+61
| | | | | | | | | | | | | | If prefix is used with a datatype that has less than 8 bits an assertion is triggered: src/netlink.c:243: netlink_gen_raw_data: Assertion `len > 0' failed. This is esoteric, the alternative would be to restrict prefixes to ipv4/ipv6 addresses. Simpler fix is to use round_up instead of divide. Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "evaluate: error out when existing set has incompatible key"Florian Westphal2023-12-144-12/+30
| | | | | | | | | | This breaks existing behaviour, add a test case so this is caught in the future. The reverted test case will be brought back once a better fix is available. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix gmp assertion with too-large reject codeFlorian Westphal2023-12-141-0/+1
| | | | | | | | Before: nft: gmputil.c:77: mpz_get_uint8: Assertion `cnt <= 1' failed. After: Error: reject code must be integer in range 0-255 Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: fix tc classid parsing out-of-bounds accessFlorian Westphal2023-12-131-0/+6
| | | | | | | | | | | | | | | | | AddressSanitizer: heap-buffer-overflow on address 0x6020000003af ... #0 0x7f9a83cbb402 in tchandle_type_parse src/meta.c:89 #1 0x7f9a83c6753f in symbol_parse src/datatype.c:138 strlen() - 1 can underflow if length was 0. Simplify the function, there is no need to duplicate the string while scanning it. Expect the first strtol to stop at ':', scan for the minor number next. The second scan is required to stop at '\0'. Fixes: 6f2eb8548e0d ("src: meta priority support using tc classid") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: error out when existing set has incompatible keyFlorian Westphal2023-12-131-0/+12
| | | | | | | | | | | | | | Before: BUG: invalid range expression type symbol nft: expression.c:1494: range_expr_value_high: Assertion `0' failed. After: range_expr_value_high_assert:5:20-27: Error: Could not resolve protocol name elements = { 100-11.0.0.0, } ^^^^^^^^ range_expr_value_high_assert:7:6-7: Error: set definition has conflicting key (ipv4_addr vs inet_proto) Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: stmt_nat: set reference must point to a mapFlorian Westphal2023-12-131-0/+10
| | | | | | | | | | nat_concat_map() requires a datamap, else we crash: set->data is dereferenced. Also update expr_evaluate_map() so that EXPR_SET_REF is checked there too. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: fix memory leaks on hookspec error processingFlorian Westphal2023-12-131-0/+21
| | | | | | | prio_spec may contain an embedded expression, release it. We also need to release the device expr and the hook string. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: close chain scope before chain releaseFlorian Westphal2023-12-131-0/+5
| | | | | | | | | | | | | | | | cmd_alloc() will free the chain, so we must close the scope opened in chain_block_alloc beforehand. The included test file will cause a use-after-free because nft attempts to search for an identifier in a scope that has been freed: AddressSanitizer: heap-use-after-free on address 0x618000000368 at pc 0x7f1cbc0e6959 bp 0x7ffd3ccb7850 sp 0x7ffd3ccb7840 #0 0x7f1cbc0e6958 in symbol_lookup src/rule.c:629 #1 0x7f1cbc0e66a1 in symbol_get src/rule.c:588 #2 0x7f1cbc120d67 in nft_parse src/parser_bison.y:4325 Fixes: a66b5ad9540d ("src: allow for updating devices on existing netdev chain") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: fix ct scope underflow if ct helper section is duplicatedFlorian Westphal2023-12-121-0/+14
| | | | | | | | | | | | | | | | | | | | | table inet filter { ct helper sip-5060u { type "sip" protocol udp l3proto ip }5060t { type "sip" protocol tcp l3pownerip } Will close the 'ct' scope twice, it has to be closed AFTER the separator has been parsed. While not strictly needed, also error out if the protocol is already given, this provides a better error description. Also make sure we release the string in all error branches. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: make sure obj_free releases timeout policiesFlorian Westphal2023-12-121-0/+5
| | | | | | | | | obj_free() won't release them because ->type is still 0 at this point. Init this to CT_TIMEOUT. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix bogus assertion failure with boolean datatypeFlorian Westphal2023-12-122-0/+26
| | | | | | | | | | | | The assertion is too strict, as found by afl++: typeof iifname . ip saddr . meta ipsec elements = { "eth0" . 10.1.1.2 . 1 } meta ipsec is boolean (1 bit), but datasize of 1 is set at 8 bit. Fixes: 22b750aa6dc9 ("src: allow use of base integer types as set keys in concatenations") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: fix memleak in meta set error handlingFlorian Westphal2023-12-111-0/+5
| | | | | | | We must release the expression here, found via afl++ and -fsanitize-address build. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: fix objref statement corruptionFlorian Westphal2023-12-112-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Consider this: counter_stmt : counter_stmt_alloc | counter_stmt_alloc counter_args counter_stmt_alloc : COUNTER { $$ = counter_stmt_alloc(&@$); } | COUNTER NAME stmt_expr { $$ = objref_stmt_alloc(&@$); $$->objref.type = NFT_OBJECT_COUNTER; $$->objref.expr = $3; } ; counter_args : counter_arg { $<stmt>$ = $<stmt>0; } | counter_args counter_arg ; counter_arg : PACKETS NUM { $<stmt>0->counter.packets = $2; } [..] This has 'counter_stmt_alloc' EITHER return counter or objref statement. Both are the same structure but with different (union'd) trailer content. counter_stmt permits the 'packet' and 'byte' argument. But the 'counter_arg' directive only works with a statement coming from counter_stmt_alloc(). afl++ came up with following input: table inet x { chain y { counter name ip saddr bytes 1.1.1. 1024 } } This clobbers $<stmt>->objref.expr pointer, we then crash when calling expr_evaluate() on it. Split the objref related statements into their own directive. After this, the input will fail with: "syntax error, unexpected bytes, expecting newline or semicolon". Also split most of the other objref statements into their own blocks. synproxy seems to have same problem, limit and quota appeared to be ok. v1 added objref_stmt to stateful_stmt list, this is wrong, we will assert when generating the 'counter' statement. Place it in the normal statement list so netlink_gen_stmt_stateful_assert throws the expected parser error. Fixes: dccab4f646b4 ("parser_bison: consolidate stmt_expr rule") Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: validate chain max lengthFlorian Westphal2023-12-112-0/+12
| | | | | | | | | The includes test files cause: BUG: chain is too large (257, 256 max)nft: netlink.c:418: netlink_gen_chain: Assertion `0' failed. Error out in evaluation step instead. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: missing json output in meta.t with vlan mappingPablo Neira Ayuso2023-12-111-0/+60
| | | | | | | | | | Fix this warning due to missing coverage: tests/py/any/meta.t.json.got: WARNING: line 2: Wrote JSON equivalent for rule meta mark set vlan id map { 1 : 0x00000001, 4095 : 0x00004095 } ERROR: did not find JSON equivalent for rule 'meta mark set vlan id map @map1 Fixes: 8d3de823b622 ("evaluate: reset statement length context before evaluating statement") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reset statement length context before evaluating statementPablo Neira Ayuso2023-12-084-4/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch consolidates ctx->stmt_len reset in stmt_evaluate() to avoid this problem. Note that stmt_evaluate_meta() and stmt_evaluate_ct() already reset it after the statement evaluation. Moreover, statement dependency can be generated while evaluating a meta and ct statement. Payload statement dependency already manually stashes this before calling stmt_evaluate(). Add a new stmt_dependency_evaluate() function to stash statement length context when evaluating a new statement dependency and use it for all of the existing statement dependencies. Florian also says: 'meta mark set vlan id map { 1 : 0x00000001, 4095 : 0x00004095 }' will crash. Reason is that the l2 dependency generated here is errounously expanded to a 32bit-one, so the evaluation path won't recognize this as a L2 dependency. Therefore, pctx->stacked_ll_count is 0 and __expr_evaluate_payload() crashes with a null deref when dereferencing pctx->stacked_ll[0]. nft-test.py gains a fugly hack to tolerate '!map typeof vlan id : meta mark'. For more generic support we should find something more acceptable, e.g. !map typeof( everything here is a key or data ) timeout ... tests/py update and assert(pctx->stacked_ll_count) by Florian Westphal. Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: missing json output in never merge across non-expression statementsPablo Neira Ayuso2023-12-071-0/+31
| | | | | | | Add missing json output. Fixes: 99ab1b8feb16 ("rule: never merge across non-expression statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: rename file to lowercaseFlorian Westphal2023-12-061-0/+0
| | | | | | | Thanks to autocomplete i didn't notice this earlier, make this lowercase. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: tcpopt: fix tcp option parsing with NUM + length fieldFlorian Westphal2023-12-062-0/+55
| | | | | | | | | | | | | | | | | | | | | | tcp option 254 length ge 4 ... will segfault. The crash bug is that tcpopt_expr_alloc() can return NULL if we cannot find a suitable template for the requested kind + field combination, so add the needed error handling in the bison parser. However, we can handle this. NOP and EOL have templates, all other options (known or unknown) must also have a length field. So also add a fallback template to handle both kind and length, even if only a numeric option is given that nft doesn't recognize. Don't bother with output, above will be printed via raw syntax, i.e. tcp option @254,8,8 >= 4. Fixes: 24d8da308342 ("tcpopt: allow to check for presence of any tcp option") Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for sets without keyFlorian Westphal2023-12-061-0/+12
| | | | | | | | | | | tests/shell/testcases/bogons/nft-f/set_definition_with_no_key_assert BUG: unhandled key type 2 nft: src/intervals.c:59: setelem_expr_to_range: Assertion `0' failed. [ This bug doesn't trigger anymore due to 1949a63215b4 ("evaluate: reject set definition with no key") ] Signed-off-by: Florian Westphal <fw@strlen.de>