Skip to contentSkip to conversation

ruleset: crash in path error when we build the xml tree

PATCH Applied Alvaro Neira Ayuso 2 participants 4 messages Mar 2, 2015 – Mar 5, 2015 netfilter

lore
Share & tools
lore

Alvaro Neira Ayuso

author
#0 lore raw

PATCH v2 1/1 ruleset: crash in path error when we build the xml tree

Crash when we try to release a tree that is not initialized.

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
[changes in v2]
* Used the goto to make error paths without crash.

 src/ruleset.c |   24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)
src/ruleset.c +13 -11
index 89ea344..f56500b 100644
@@ -535,12 +535,12 @@ static int nft_ruleset_json_parse(const void *json,
 
 	root = nft_jansson_create_root(json, &error, err, input);
 	if (root == NULL)
-		goto err;
+		goto err1;
 
 	array = json_object_get(root, "nftables");
 	if (array == NULL) {
 		errno = EINVAL;
-		goto err;
+		goto err2;
 	}
 
 	len = json_array_size(array);

@@ -548,23 +548,24 @@ static int nft_ruleset_json_parse(const void *json,
 		node = json_array_get(array, i);
 		if (node == NULL) {
 			errno = EINVAL;
-			goto err;
+			goto err2;
 		}
 		ctx.json = node;
 		key = json_object_iter_key(json_object_iter(node));
 		if (key == NULL)
-			goto err;
+			goto err2;
 
 		if (nft_ruleset_json_parse_cmd(key, err, &ctx) < 0)
-			goto err;
+			goto err2;
 	}
 
 	nft_set_list_free(ctx.set_list);
 	nft_jansson_free_root(root);
 	return 0;
-err:
-	nft_set_list_free(ctx.set_list);
+err2:
 	nft_jansson_free_root(root);
+err1:
+	nft_set_list_free(ctx.set_list);
 	return -1;
 #else
 	errno = EOPNOTSUPP;

@@ -665,7 +666,7 @@ static int nft_ruleset_xml_parse(const void *xml, struct nft_parse_err *err,
 
 	tree = nft_mxml_build_tree(xml, "nftables", err, input);
 	if (tree == NULL)
-		goto err;
+		goto err1;
 
 	ctx.xml = tree;
 

@@ -673,16 +674,17 @@ static int nft_ruleset_xml_parse(const void *xml, struct nft_parse_err *err,
 	while (nodecmd != NULL) {
 		cmd = nodecmd->value.opaque;
 		if (nft_ruleset_xml_parse_cmd(cmd, err, &ctx) < 0)
-			goto err;
+			goto err2;
 		nodecmd = mxmlWalkNext(tree, tree, MXML_NO_DESCEND);
 	}
 
 	nft_set_list_free(ctx.set_list);
 	mxmlDelete(tree);
 	return 0;
-err:
-	nft_set_list_free(ctx.set_list);
+err2:
 	mxmlDelete(tree);
+err1:
+	nft_set_list_free(ctx.set_list);
 	return -1;
 #else
 	errno = EOPNOTSUPP;
Signature · 1 line
1.7.10.4
author
#1 lore raw

PATCH v10 1/1 example: : add nft-ruleset-parse-file.

With this example, we can parse the objects in the ruleset and create the netlink message with the action associated. For example:

- Flush ruleset
- Add, delete or flush tables/chains
- Add, delete sets
- Add, delete set elements
- Add, delete, replace or prepend rules

Signed-off-by Alvaro Neira Ayuso <[email protected]>

---
[changes in v10]
* Changed the title of the patch
* Changed the description: Replaced the word elements to objects
* Test if the filename length has large enough before to test if is finished with .json or .xml

 examples/Makefile.am              |    4 +
 examples/nft-ruleset-parse-file.c |  486 +++++++++++++++++++++++++++++++++++++
 2 files changed, 490 insertions(+)
 create mode 100644 examples/nft-ruleset-parse-file.c
examples/Makefile.am +4 -0
index fafcb76..e002d36 100644
@@ -22,6 +22,7 @@ check_PROGRAMS = nft-table-add		\
 		 nft-set-elem-get	\
 		 nft-set-elem-del	\
 		 nft-ruleset-get	\
+		 nft-ruleset-parse-file	\
 		 nft-compat-get
 
 nft_table_add_SOURCES = nft-table-add.c

@@ -90,5 +91,8 @@ nft_set_elem_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 nft_ruleset_get_SOURCES = nft-ruleset-get.c
 nft_ruleset_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
 
+nft_ruleset_parse_file_SOURCES = nft-ruleset-parse-file.c
+nft_ruleset_parse_file_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
+
 nft_compat_get_SOURCES = nft-compat-get.c
 nft_compat_get_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
examples/nft-ruleset-parse-file.c new file +486 -0

486 lines not on this page · raw message

Signature · 1 line
1.7.10.4
maintainer Applied
#2 lore raw

Re: [libnftnl PATCH v10] example: : add nft-ruleset-parse-file.

Quoted 8 lines · Alvaro Neira Ayuso

With this example, we can parse the objects in the ruleset and create the netlink message with the action associated. For example:

- Flush ruleset
- Add, delete or flush tables/chains
- Add, delete sets
- Add, delete set elements
- Add, delete, replace or prepend rules

Applied, thanks. Please add a filter in git commit to strip the full stop from the patch title.