From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Subject: [PATCH nft 2/2,v3] evaluate: do not allow to list/flush anonymous sets via list command
Date: Tue, 18 Jun 2019 16:57:19 +0200 [thread overview]
Message-ID: <20190618145719.7866-1-pablo@netfilter.org> (raw)
Don't allow this:
# nft list set x __set0
table ip x {
set __set0 {
type ipv4_addr
flags constant
elements = { 1.1.1.1 }
}
}
Constant sets never change and they are attached to a rule (anonymous
flag is set on), do not list their content through this command. Do not
allow flush operation either.
After this patch:
# nft list set x __set0
Error: No such file or directory
list set x __set0
^^^^^^
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
v3: do not exercise misspell path on mismatching set flags.
src/evaluate.c | 34 ++++++++++++++++++++++-----
tests/shell/testcases/listing/0016anonymous_0 | 33 ++++++++++++++++++++++++++
2 files changed, 61 insertions(+), 6 deletions(-)
create mode 100755 tests/shell/testcases/listing/0016anonymous_0
diff --git a/src/evaluate.c b/src/evaluate.c
index 07617a7c94cb..dfdd3c242530 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -3587,9 +3587,12 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct cmd *cmd)
return table_not_found(ctx);
set = set_lookup(table, cmd->handle.set.name);
- if (set == NULL || set->flags & NFT_SET_MAP)
+ if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
+ else if (set->flags & (NFT_SET_MAP | NFT_SET_ANONYMOUS))
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ "%s", strerror(ENOENT));
return 0;
case CMD_OBJ_METER:
@@ -3598,9 +3601,13 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct cmd *cmd)
return table_not_found(ctx);
set = set_lookup(table, cmd->handle.set.name);
- if (set == NULL || !(set->flags & NFT_SET_EVAL))
+ if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
+ else if (!(set->flags & NFT_SET_EVAL) ||
+ !(set->flags & NFT_SET_ANONYMOUS))
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ "%s", strerror(ENOENT));
return 0;
case CMD_OBJ_MAP:
@@ -3609,9 +3616,13 @@ static int cmd_evaluate_list(struct eval_ctx *ctx, struct cmd *cmd)
return table_not_found(ctx);
set = set_lookup(table, cmd->handle.set.name);
- if (set == NULL || !(set->flags & NFT_SET_MAP))
+ if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
+ else if (!(set->flags & NFT_SET_MAP) ||
+ set->flags & NFT_SET_ANONYMOUS)
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ "%s", strerror(ENOENT));
return 0;
case CMD_OBJ_CHAIN:
@@ -3698,9 +3709,12 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
return table_not_found(ctx);
set = set_lookup(table, cmd->handle.set.name);
- if (set == NULL || set->flags & NFT_SET_MAP)
+ if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
+ else if (set->flags & (NFT_SET_MAP | NFT_SET_ANONYMOUS))
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ "%s", strerror(ENOENT));
return 0;
case CMD_OBJ_MAP:
@@ -3709,9 +3723,13 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
return table_not_found(ctx);
set = set_lookup(table, cmd->handle.set.name);
- if (set == NULL || !(set->flags & NFT_SET_MAP))
+ if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
+ else if (!(set->flags & NFT_SET_MAP) ||
+ set->flags & NFT_SET_ANONYMOUS)
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ "%s", strerror(ENOENT));
return 0;
case CMD_OBJ_METER:
@@ -3720,9 +3738,13 @@ static int cmd_evaluate_flush(struct eval_ctx *ctx, struct cmd *cmd)
return table_not_found(ctx);
set = set_lookup(table, cmd->handle.set.name);
- if (set == NULL || !(set->flags & NFT_SET_EVAL))
+ if (set == NULL)
return set_not_found(ctx, &ctx->cmd->handle.set.location,
ctx->cmd->handle.set.name);
+ else if (!(set->flags & NFT_SET_EVAL) ||
+ !(set->flags & NFT_SET_ANONYMOUS))
+ return cmd_error(ctx, &ctx->cmd->handle.set.location,
+ "%s", strerror(ENOENT));
return 0;
default:
diff --git a/tests/shell/testcases/listing/0016anonymous_0 b/tests/shell/testcases/listing/0016anonymous_0
new file mode 100755
index 000000000000..83acbccae7db
--- /dev/null
+++ b/tests/shell/testcases/listing/0016anonymous_0
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+$NFT add table x
+$NFT add chain x y
+$NFT add rule x y ip saddr { 1.1.1.1 }
+$NFT add rule x y meta mark set ip saddr map { 1.1.1.1 : 2 }
+
+$NFT list set x __set0 &>/dev/null
+ret=$?
+if [ $ret -eq 0 ]
+then
+ exit 1
+fi
+
+$NFT flush set x __set0 &>/dev/null
+ret=$?
+if [ $ret -eq 0 ]
+then
+ exit 1
+fi
+
+$NFT list map x __map0 &>/dev/null
+if [ $ret -eq 0 ]
+then
+ exit 1
+fi
+
+$NFT flush map x __map0 &>/dev/null
+ret=$?
+if [ $ret -eq 0 ]
+then
+ exit 1
+fi
--
2.11.0
reply other threads:[~2019-06-18 14:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190618145719.7866-1-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).