[PATCH] test: shell: update shell/run-tests.sh to refer to relative path of testcase

2017-10-06 Thread Harsha Sharma
Refer to relative path for tests from any directory if path for testcases is specified. Signed-off-by: Harsha Sharma --- tests/shell/run-tests.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh index dbddd8d..fe30115 100755

[PATCH] src: Merge assignment with return

2017-10-06 Thread Harsha Sharma
Merge assignment with return statement to directly return the value. Done using following coccinelle semantic patch @@ local idexpression ret; expression e; @@ -ret = +return e; -return ret; Signed-off-by: Harsha Sharma --- src/mini-gmp.c | 3 +-- src/statement.c | 5 + 2 files chang

Re: [PATCH] netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'

2017-10-06 Thread Willem de Bruijn
On Fri, Oct 6, 2017 at 12:02 PM, Shmulik Ladkani wrote: > From: Shmulik Ladkani > > Commit 2c16d6033264 ("netfilter: xt_bpf: support ebpf") introduced > support for attaching an eBPF object by an fd, with the > 'bpf_mt_check_v1' ABI expecting the '.fd' to be specified upon each > IPT_SO_SET_REPLA

[PATCH] netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1'

2017-10-06 Thread Shmulik Ladkani
From: Shmulik Ladkani Commit 2c16d6033264 ("netfilter: xt_bpf: support ebpf") introduced support for attaching an eBPF object by an fd, with the 'bpf_mt_check_v1' ABI expecting the '.fd' to be specified upon each IPT_SO_SET_REPLACE call. However this breaks subsequent iptables calls: # iptable

[PATCH v2] nftables: make pointers in string arrays constant

2017-10-06 Thread Harsha Sharma
Static const char * array should be static const char * const array as per linux-kernel coding style Signed-off-by: Harsha Sharma --- Changes in v2:e -rebase against current tree and solve merge confilcts -Change log message src/erec.c | 2 +- src/evaluate.c | 4 ++-- src/rule.c |

nftables: 0040set_0 test in tests/shell/testcases/transactions fails

2017-10-06 Thread Harsha Sharma
Hello all, 0040set_0 test in tests/shell/testcases/transactions fails when trying to delete an empty chain with error "Could not process rule: Device or resource busy". The element referring to the chain is already deleted and the same error occurs even after explicitly adding rule to flush the cha

Re: [Outreachy kernel] [PATCH] nftables: make pointers in string arrays constant

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 02:16:47PM +0530, Harsha Sharma wrote: > static const char * array should probably be static const char * > const array as per linux-kernel coding style $ git am /tmp/nftables-make-pointers-in-string-arrays-constant.patch Applying: nftables: make pointers in string arrays c

Re: [PATCH net] netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 11:56:44AM +0200, Florian Westphal wrote: > Eric Dumazet wrote: > > From: Eric Dumazet > > > > syzkaller reports an out of bound read in strlcpy(), triggered > > by xt_copy_counters_from_user() > > > > Fix this by using memcpy(), then forcing a zero byte at the last posi

Re: [PATCH nftables] netlink_linearize: skip set element expression in set statement key

2017-10-06 Thread Pablo Neira Ayuso
On Wed, Oct 04, 2017 at 02:27:45PM +, Anders K. Pedersen | Cohaesio wrote: > From: Anders K. Pedersen > > Before this patch the following fails: > > # nft add rule ip6 filter x \ > set add ip6 saddr . ip6 daddr @test > nft: netlink_linearize.c:648: netlink_gen_expr: Assertion `dreg <

Re: man page nft.8 add chain synopsis

2017-10-06 Thread Pablo Neira Ayuso
Hi Duncan, On Fri, Oct 06, 2017 at 04:08:38PM +1100, Duncan Roe wrote: > Hi, > > The man page says this: > > > {add | create} chain [family] table chain [ { {type} {hook} [device] > > {priority} } [policy] ] > > But I suggest it should say this: > > > {add | create} chain [family] table chain

Re: [PATCH nft] tests: files: Remove old tests for chain rename.

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 01:36:47PM +0530, Varsha Rao wrote: > These tests are not required as new test cases are added in tests/shell > file. Also applied, thanks. It would be great if you can go over those tests/files/ to get rid of them. Just make a replacement that we can fit into tests/shell/

Re: [PATCH nft v2] tests: shell: Add tests for chain rename.

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 01:36:46PM +0530, Varsha Rao wrote: > This patch adds test cases for renaming chain with existing and non > existing chains. Applied, thanks Varsha. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.ker

Re: [PATCH] INSTALL: Update dependency list and configure with libxtables support

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 01:01:09PM +0530, Harsha Sharma wrote: > Add configure with lixtables in INSTALL and required dependencies for > the same Applied, thanks. I have mangled this a bit. Applying: INSTALL: Update dependency list and configure with libxtables support patch:29: space before tab

Re: [PATCH] tests: shell: add testcases for named objects

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 03:45:39PM +0530, Harsha Sharma wrote: > Add testcases for creating named objects with unique name, defined > by user and referencing them from rule. Also applied, thanks. Could you add another tests for 'limit' objects too? I think I posted an example to the mailing list.

Re: [PATCH] test: shell: execute shell/run-tests.sh from any directory

2017-10-06 Thread Pablo Neira Ayuso
On Thu, Oct 05, 2017 at 01:13:47PM +0530, Harsha Sharma wrote: > Update shell/run-tests.sh to refer /src/nft with a relative path Applied, thanks Harsha. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majord...@vger.kernel.org More majordo

Re: [nft PATCH] evaluate: Fix debug output

2017-10-06 Thread Pablo Neira Ayuso
On Wed, Oct 04, 2017 at 03:59:32PM +0200, Phil Sutter wrote: > When introducing output_fp, debug output in src/evaluate.c was not > adjusted and therefore broke. > > This patch restores eval debug output by applying the following changes: > > - Change erec_print() and erec_print_list() to take a

[ebtables PATCH] Use flock() for --concurrent option

2017-10-06 Thread Phil Sutter
The previous locking mechanism was not atomic, hence it was possible that a killed ebtables process would leave the lock file in place which in turn made future ebtables processes wait indefinitely for the lock to become free. Fix this by using flock(). This also simplifies code quite a bit becaus

[PATCH v2] nftables: Add support for reserved header and addrs for routing header type 0

2017-10-06 Thread Harsha Sharma
Add support for IPV6 routing header type 0 reserved field and addresses with corresponding tests Signed-off-by: Harsha Sharma --- For struct exthdr_rt0, I have specified type to be IPPROTO_ROUTING due to which when exthdr_init_raw is called in exthdr_find_template which initialises expr->exthdr.d