search for: segtree

https://bugzilla.netfilter.org/show_bug.cgi?id=1181 Bug ID: 1181 Summary: incorrect sort function at segtree.c Product: nftables Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: minor Priority: P5 Component: iptables over nftable Assignee: pablo at netfilter.org Reporter: cidjey1...

...datatype: fix double-free resulting in use-after-free in datatype_free tests: dump generated use new nft tool main: fix get_optstring truncating output datatype: add frag-needed (ipv4) to reject options evaluate: enable reject with 802.1q Pablo Neira Ayuso (32): segtree: broken error reporting with mappings parser_bison: proper ct timeout list initialization src: NAT support for intervals in maps include: resync nf_nat.h kernel header src: add netmap support src: add STMT_NAT_F_CONCAT flag and use it evaluate: fix crash when han...

...d the nft v0.8.2 with the debug info and then attached to it with gdb while it wastes CPU to get a backtrace: === (gdb) bt #0 0x00007fc9593d134b in __gmpz_cmp () from /usr/lib/libgmp.so.10 #1 0x00005600a1cb1097 in interval_overlap (e1=e1 at entry=0x5600aaf5efc0, e2=e2 at entry=0x5600addf0240) at segtree.c:350 #2 0x00005600a1cb1794 in intervals_overlap (keylen=<optimized out>, intervals=<optimized out>, msgs=<optimized out>) at segtree.c:386 #3 set_to_segtree (merge=<optimized out>, add=true, tree=0x7fff36409230, init=0x5600a2fdc590, set=0x5600a2fdbe10, msgs=0x7ff...

...e_lookup_global() from expr_evaluate_symbol() parser_bison: simplify hook_spec rule parser_bison: duplicate string returned by chain_type_name_lookup() parser_bison: release parsed type and hook name strings src: store parser location for handle and position specifiers segtree: perform stricter expression type validation from expr_value() segtree: clone full expression from interval_map_decompose() segtree: handle adjacent interval nodes from expr_value_cmp() segtree: explicit initialization via set_to_intervals() rule: support for incremental set...

...rnel bug evaluate: permit get element on maps netlink: fix concat range expansion in map case tests: extend 0043concatenated_ranges_0 to cover maps too nftables: dump raw element info from libnftnl when netlink debugging is on proto: add sctp crc32 checksum fixup segtree: copy expr data to closing element Gopal Yadav (2): json: Combining --terse with --json has no effect Solves Bug 1462 - `nft -j list set` does not show counters Jeremy Sowden (3): tests: py: add missing JSON output for ct test. tests: py: correct order of set elements in t...

...Vinson (1): nft: configure.ac: Replace magic dblatex dep. Pablo Neira (2): src: expose delinearize/linearize structures and stmt_error() src: trigger layer 4 checksum when pseudoheader fields are modified Pablo Neira Ayuso (71): src: use new definitions from libnftnl segtree: don't check for overlaps if set definition is empty tests: shell: cover transactions via nft -f using flat syntax datatype: time_type should send milliseconds to userspace parser_bison: restore parsing of dynamic set element updates netlink_linearize: skip NFTNL_EXPR_DY...

...timized out>) at mini-gmp.c:1819 1819 return mpn_cmp (a->_mp_d, b->_mp_d, asize); (gdb) bt #0 mpz_cmp (a=a at entry=0x555555654ce0, b=<optimized out>) at mini-gmp.c:1819 #1 0x00005555555ad790 in expr_value_cmp (p1=p1 at entry=0x5555556ac820, p2=p2 at entry=0x5555556ac828) at segtree.c:832 #2 0x00007ffff7d86f3d in msort_with_tmp (p=p at entry=0x7fffffffc9a0, b=b at entry=0x5555556ac820, n=n at entry=2) at msort.c:83 #3 0x00007ffff7d86ea4 in msort_with_tmp (n=2, b=0x5555556ac820, p=0x7fffffffc9a0) at msort.c:53 #4 msort_with_tmp (p=p at entry=0x7fffffffc9a0, b=b at entry=0x55...

...ort exthdr: prepare exthdr_gen_dependency for tcp support src: add TCP option matching payload: automatically kill dependencies for exthdr and tcpopt tests: py: Add basic tests for ip, ip6 and inet Oleksandr Natalenko (2): utils: provide array allocation wrapper segtree: allocate memory for arrays on heap Pablo M. Bermudo Garay (5): src: add new generic context structure nft_ctx src: add --check option flag parser: fix typo src: add stateful object support for limit tests: py: add tests for limit stateful object Pablo Neira Ayuso (6...

...-- Fabrice Fontaine (1): main: fix build with gcc <= 4.8 Pablo Neira Ayuso (8): evaluate: missing datatype definition in implicit_set_declaration() evaluate: remove superfluous check in set_evaluate() netlink: release dummy rule object from netlink_parse_set_expr() segtree: fix asan runtime error meta: fix asan runtime error in tc handle cmd: add misspelling suggestions for rule commands tests: shell: rename testcases/map/dump/0009vmap_0dump.nft build: Bump version to v0.9.6

https://bugzilla.netfilter.org/show_bug.cgi?id=1252 Bug ID: 1252 Summary: comment doesn't work with ranges in sets Product: nftables Version: unspecified Hardware: x86_64 OS: Gentoo Status: NEW Severity: normal Priority: P5 Component: nft Assignee: pablo at netfilter.org

https://bugzilla.netfilter.org/show_bug.cgi?id=1376 Bug ID: 1376 Summary: Verbosity Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 Component: nft Assignee: pablo at netfilter.org Reporter: s.egbert at

https://bugzilla.netfilter.org/show_bug.cgi?id=1304 Bug ID: 1304 Summary: issue with interval sets Product: nftables Version: unspecified Hardware: x86_64 OS: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: kernel Assignee: pablo at netfilter.org

...nt in symbolic_constant_print() proto: fix byteorder of ETH_P_* values verdict type: handle verdict flags and encoded additional information parser: simplify monitor command parsing parser: compact log level grammar expr: make range_low()/range_high() usable outside of segtree queue: clean up queue statement parser: rearrange monitor/export rules dtype: remove unnecessary icmp* parse/print functions stmt: rename nat "random-fully" option to "fully-random" meta: properly align types in meta_template table dtype: fix...

...te->indesc_idx tests: shell: add test for glob includes Luis Ressel (1): netlink: Show the handles of unknown rules in "nft monitor trace" Pablo Neira Ayuso (53): include: add nf_tables_compat.h to tarballs build: nftables 0.9.3 depends on libnftnl 1.1.5 segtree: don't remove nul-root element from interval set proto: add proto_desc_id enumeration expr: add expr_ops_by_type() parser: add typeof keyword for declarations meta: add parse and build userdata interface exthdr: add exthdr_desc_id enum and use it exthdr: add...

...evaluation expr: add comparison function for singleton expressions set: abort on interval conflicts netlink: use set location for IO errors parser: add grammatical distinction for verdict maps set: properly account set size when merging recursive set definitions segtree: sort set elements before decomposition utils: fix -Wcast-align warnings on sparc parser: fix ether keyword clash Merge branch 'master' of git.netfilter.org:nftables gmputil: use MSF/LSF in import/export functions dependant on host byte order netlink: fix lengt...

...es: search for default include path last tests: py: drop redundant JSON outputs src: add string preprocessor and use it for log prefix string tests: shell: check for removing table via handle with incorrect family evaluate: set on expr->len for catchall set elements segtree: set on EXPR_F_KERNEL flag for catchall elements in the cache intervals: fix element deletions with maps tests: shell: cover set element deletion in maps parser_bison: recursive table declaration in deprecated meter statement parser_bison: remove deprecated flow statement...