| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
|
|
| |
Signed-off-by: Volodymyr Bendiuga <volodymyr.bendiuga@westermo.com>
Fixes: ef46de143206 ('route/cls: add flower classifier')
https://github.com/thom311/libnl/pull/316
|
|
|
|
|
|
| |
https://bugzilla.redhat.com/show_bug.cgi?id=2081279
Fixes: b50be8fa869b ('rtnl/route: use cleanup attribute in "lib/route/route_obj.c"')
|
|
|
|
|
|
|
|
|
| |
The cache ops needs to be included in a cloned link for link methods
to work as expected.
Signed-off-by: Jacques de Laval <Jacques.De.Laval@westermo.com>
https://github.com/thom311/libnl/pull/311
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Error: REVERSE_INULL (CWE-476):
libnl-3.6.0/lib/route/nexthop_encap.c:35: deref_ptr: Directly dereferencing pointer "rtnh_encap->ops".
libnl-3.6.0/lib/route/nexthop_encap.c:37: check_after_deref: Null-checking "rtnh_encap->ops" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
# 35| nh_encap_type2str(rtnh_encap->ops->encap_type));
# 36|···
# 37|-> if (rtnh_encap->ops && rtnh_encap->ops->dump)
# 38| rtnh_encap->ops->dump(rtnh_encap->priv, dp);
# 39| }
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
rtnl_qdisc_mqprio_set_*()
rtnl_qdisc_mqprio_set_priomap() would access the input array prio after
len.
Also these setters did the wrong argument checking (arguably, the caller
is not supposed to provide an invalid argument, so that part is less
severe).
Coverity:
Error: OVERRUN (CWE-119):
libnl-3.6.0/lib/route/qdisc/mqprio.c:363: cond_at_most: Checking "len / 2UL > 16UL" implies that "len" may be up to 33 on the false branch.
libnl-3.6.0/lib/route/qdisc/mqprio.c:366: overrun-buffer-arg: Overrunning array "mqprio->qm_count" of 32 bytes by passing it to a function which accesses it at byte offset 65 using argument "len * 2UL" (which evaluates to 66). [Note: The source code implementation of the function has been overridden by a builtin model.]
# 364| return -NLE_RANGE;
# 365|···
# 366|-> memcpy(mqprio->qm_count, count, len * sizeof(uint16_t));
# 367| memcpy(mqprio->qm_offset, offset, len * sizeof(uint16_t));
# 368| mqprio->qm_mask |= SCH_MQPRIO_ATTR_QUEUE;
Error: OVERRUN (CWE-119):
libnl-3.6.0/lib/route/qdisc/mqprio.c:363: cond_at_most: Checking "len / 2UL > 16UL" implies that "len" may be up to 33 on the false branch.
libnl-3.6.0/lib/route/qdisc/mqprio.c:367: overrun-buffer-arg: Overrunning array "mqprio->qm_offset" of 32 bytes by passing it to a function which accesses it at byte offset 65 using argument "len * 2UL" (which evaluates to 66). [Note: The source code implementation of the function has been overridden by a builtin model.]
# 365|···
# 366| memcpy(mqprio->qm_count, count, len * sizeof(uint16_t));
# 367|-> memcpy(mqprio->qm_offset, offset, len * sizeof(uint16_t));
# 368| mqprio->qm_mask |= SCH_MQPRIO_ATTR_QUEUE;
# 369|···
Error: OVERRUN (CWE-119):
libnl-3.6.0/lib/route/qdisc/mqprio.c:496: cond_at_most: Checking "len / 8UL > 16UL" implies that "len" may be up to 135 on the false branch.
libnl-3.6.0/lib/route/qdisc/mqprio.c:499: overrun-buffer-arg: Overrunning array "mqprio->qm_min_rate" of 128 bytes by passing it to a function which accesses it at byte offset 1079 using argument "len * 8UL" (which evaluates to 1080). [Note: The source code implementation of the function has been overridden by a builtin model.]
# 497| return -NLE_RANGE;
# 498|···
# 499|-> memcpy(mqprio->qm_min_rate, min, len * sizeof(uint64_t));
# 500| mqprio->qm_mask |= SCH_MQPRIO_ATTR_MIN_RATE;
# 501|···
Error: OVERRUN (CWE-119):
libnl-3.6.0/lib/route/qdisc/mqprio.c:545: cond_at_most: Checking "len / 8UL > 16UL" implies that "len" may be up to 135 on the false branch.
libnl-3.6.0/lib/route/qdisc/mqprio.c:548: overrun-buffer-arg: Overrunning array "mqprio->qm_max_rate" of 128 bytes by passing it to a function which accesses it at byte offset 1079 using argument "len * 8UL" (which evaluates to 1080). [Note: The source code implementation of the function has been overridden by a builtin model.]
# 546| return -NLE_RANGE;
# 547|···
# 548|-> memcpy(mqprio->qm_max_rate, max, len * sizeof(uint64_t));
# 549| mqprio->qm_mask |= SCH_MQPRIO_ATTR_MAX_RATE;
# 550|···
Fixes: 25cf1d39eded ('route:qdisc: add MQPRIO Qdisc'
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Coverity:
Error: OVERRUN (CWE-119):
libnl-3.6.0/lib/route/link/sriov.c:653: overrun-buffer-arg: Overrunning array "stb" of 6 8-byte elements by passing it to a function which accesses it at element index 8 (byte offset 71) u
# 651|···
# 652| if (t[IFLA_VF_STATS]) {
# 653|-> err = nla_parse_nested(stb, IFLA_VF_STATS_MAX,
# 654| t[IFLA_VF_STATS],
# 655| sriov_stats_policy);
Fixes: 5d6e43ebef12 ('lib/route: SRIOV Parse and Read support')
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Error: SIZEOF_MISMATCH (CWE-398):
libnl-3.6.0/lib/route/link/sriov.c:125: suspicious_sizeof: Passing argument "dst_vlan_info" of type "nl_vf_vlan_info_t *" and argument "dst_vlans->size * 8UL /* sizeof (dst_vlan_info) */"
libnl-3.6.0/lib/route/link/sriov.c:125: remediation: Did you intend to use "sizeof (*dst_vlan_info)" instead of "sizeof (dst_vlan_info)"?
# 123| dst_vlan_info = dst_vlans->vlans;
# 124| memcpy(dst_vlans, src_vlans, sizeof(nl_vf_vlans_t));
# 125|-> memcpy(dst_vlan_info, src_vlan_info,
# 126| dst_vlans->size * sizeof(dst_vlan_info));
# 127| d_vf->vf_vlans = dst_vlans;
Fixes: a59cab6d0b0f ('lib/route: SRIOV Clone Support')
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This was wrong. Also, coverity warns about the trailing % in the format
string.
Error: PRINTF_ARGS (CWE-475):
libnl-3.6.0/lib/route/qdisc/netem.c:164: format_error: Format string ended in the middle of specifier "%".
# 162|···
# 163| if (netem->qnm_mask & SCH_NETEM_ATTR_DELAY_CORR && netem->qnm_corr.nmc_delay > 0)
# 164|-> nl_dump(p, " %d%", netem->qnm_corr.nmc_delay);
# 165| }
# 166| }
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The if statement was wrong and always true. Drop it,
the remaining code handles the cases of no flags already
correctly.
Error: DEADCODE (CWE-561):
libnl-3.6.0/lib/route/cls/u32.c:361: dead_error_condition: The condition "!(u->cu_mask & 0)" must be true.
libnl-3.6.0/lib/route/cls/u32.c:366: dead_error_line: Execution cannot reach this statement: "if (!(u->cu_mask & 0x20)) {...".
# 364| }
# 365|···
# 366|-> if (!(u->cu_mask & U32_ATTR_SELECTOR)) {
# 367| nl_dump(p, "no-selector");
# 368| } else {
|
|
|
|
|
|
|
|
|
|
|
|
| |
CONSTANT_EXPRESSION_RESULT
Error: CONSTANT_EXPRESSION_RESULT (CWE-569):
libnl-3.6.0/lib/route/link/vrf.c:237: result_independent_of_operands: "id > RT_TABLE_MAX" is always false regardless of the values of its operands. This occurs as the logical operand of "i
# 235|···
# 236| IS_VRF_LINK_ASSERT(link);
# 237|-> if(id > VRF_TABLE_ID_MAX)
# 238| return -NLE_INVAL;
# 239|···
|
|
|
|
|
|
|
|
|
|
|
|
| |
Coverity doesn't like this:
libnl-3.6.0/lib/route/link/ip6vti.c:209: invalid_type: Argument "ip6vti->remote" to format specifier "%#x" was expected to have type "unsigned int" but has type "struct in6_addr".
libnl-3.6.0/lib/route/link/ip6vti.c:201: invalid_type: Argument "ip6vti->local" to format specifier "%#x" was expected to have type "unsigned int" but has type "struct in6_addr".
libnl-3.6.0/lib/route/link/ip6gre.c:285: invalid_type: Argument "ip6gre->remote" to format specifier "%#x" was expected to have type "unsigned int" but has type "struct in6_addr".
libnl-3.6.0/lib/route/link/ip6gre.c:277: invalid_type: Argument "ip6gre->local" to format specifier "%#x" was expected to have type "unsigned int" but has type "struct in6_addr".
Coverity is right. But in practice, this code was unreachable
because there is no scenario when inet_ntop() will fail.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
I think the following warning is bogus. Still, warnings are annoying, so
let's try to workaround.
Error: CLANG_WARNING: [#def47]
libnl-3.6.0/lib/route/link.c:2566:11: warning[unix.Malloc]: Potential leak of memory pointed to by 'kind'
# 2564| if ( io->io_alloc
# 2565| && (err = io->io_alloc(link)) < 0)
# 2566|-> return err;
# 2567|
# 2568| link->l_info_ops = io;
|
|
|
|
|
|
|
|
|
|
|
|
| |
Workaround coverity warnings like:
Error: CLANG_WARNING:
libnl-3.6.0/lib/netfilter/exp.c:428:7: warning[deadcode.DeadStores]: Although the value stored to 'err' is used in the enclosing expression, the value is never actually read from 'err'
# 426| }
# 427|···
# 428|-> if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_NAT)) < 0)
# 429| goto nla_put_failure;
# 430|···
|
|
|
|
|
|
| |
Coverity says:
libnl-3.6.0/lib/route/mdb.c:198: check_return: Calling "nla_parse_nested" without checking return value (as is done elsewhere 43 out of 44 times).
|
| |
|
|
|
|
|
|
| |
Found by coverity:
libnl-3.6.0/lib/route/mdb.c:242: leaked_storage: Variable "entry" going out of scope leaks the storage it points to.
|
|
|
|
|
|
|
|
| |
Found by coverity:
4. libnl-3.6.0/lib/route/mdb.c:198: overrun-buffer-arg: Overrunning array "db_attr" of 1 8-byte elements by passing it to a function which accesses it at element index 1 (byte offset 15) using argument "1".
Fixes: 0ec6c6c2f023 ('mdb: support bridge multicast database notification')
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The kernel bridge now support (permanent) forwarding of MAC multicast
using the MDB. Internally the kernel use AF_UNSPEC, but we remap this
here to AF_LLC for the benefit for nl_addrs.
To test, put `nl-monitor mdb` in the background. Then, with a bridge
and at least one port, run the following command:
# nl-monitor mdb &
# bridge mdb add dev br0 port eth0 grp 01:02:03:c0:ff:ee vid 1 permanent
dev 9
port 3 vid 1 proto 0x0000 address 01:02:03:c0:ff:ee
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
|
|
|
|
|
|
|
|
| |
When using, e.g., nl-monitor to debug the bridge mdb the nl-monitor tool
did not dump anything. This change adds the missing stats dump callback
to rectify this issue, and also the details callback for completeness.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
|
|
|
|
|
|
|
|
| |
The enum macsec_validation_type in the Linux Kernel has values 0-2.
With the existing check >1, value STRICT (2) cannot be set.
The check should be done against the end marker of the enum instead.
https://github.com/thom311/libnl/pull/304
|
|
|
|
|
|
|
|
|
|
|
|
| |
Adds support for the new VLAN_FLAG_BRIDGE_BINDING, for VLAN interfaces
created on top of a VLAN aware bridge. For details, see the kernel
patch:
https://lore.kernel.org/netdev/20190418173535.22925-1-mmanning@vyatta.att-mail.com/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
https://github.com/thom311/libnl/pull/303
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
nl_object_clone() first does a shallow copy using memcpy().
That is useful, because it can correctly copy simple fields
(like numbers). For pointer values, we need to implement
oo_clone() to fixup the pointers and get the deep-copy correct.
Now, oo_clone() must always follow through, to un-alias the copied
pointer. In particular also in the error case. The oo_clone()
implementations sometimes fail (with ENOMEM) and just return.
In those cases, we must make sure that we don't leave the wrong pointers
there. The pointers must be cleared first.
Otherwise, any failure (which basically are ENOMEM) leave the object
in an inconsistent state, and we double-free/use-after-free the
pointers.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
nl_object_clone() first does a shallow copy, before calling
oo_clone() (link_clone()). That means, the pointer values
of the link object in link_clone() are invalid (as they alias
the pointers from the source object).
We need to get the ref-counting for dst->l_info_ops right.
It was not.
For example, previously when we called io_clone() handler, dst->l_info_ops
would still point to the one from src->l_info_ops, but without owning
the additional reference. Then we call io_clone(), for example
can_clone() for can devices. That one calls first rtnl_link_set_type(),
which first calls release_link_info() -- and unrefs the ops, without
having owned a reference.
Fix that, by getting the reference counting right, before calling
io_clone(). Arguably, we now do duplicate work. First taking a ref, then
calling rtnl_link_set_type() which releases and retakes the ref. But at
least, this way it's correct.
This probably did not cause issues before, because the entire
ref-counting is mostly useless anyway. It's only used for asserting
during rtnl_link_unregister_info() -- and then it checks that the ref
count is not positive (but we release too many references, not too few).
Anyway. *sigh*.
|
|
|
|
|
|
| |
If the object has no complex data (pointers!), then the base
implementation using memcpy() is enough. No need to implement
oo_clone().
|
|
|
|
| |
io_refcnt
|
| |
|
|
|
|
|
|
| |
The problem here is not really NOMEM (because rtnl_tc_data_peek() wouldn't
allocate new memory. The problem is, that the cls instance has no such data
field. Return -NLE_INVAL instead.
|
|
|
|
|
|
| |
nl_object_clone() already does a shallow clone using memcpy(). So all
simple fields are already initialized. We only need the oo_clone() implementation
to get the deep-copy right.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We often require that a valid output pointer is passed to the
getters. But here, let's be forgiving. Being more forgiving
may be inconsistent, but on the safe side: the user is still
welcome to assume they must provide a valid output pointer.
Also, we always need to initialize the output mask, not only
with `f->cf_mask & FLOWER_ATTR_DST_MAC_MASK`. The reason is that
the caller cannot know whether the mask is present, so conditionally
initializing the output is error prone (it requires the caller
to NUL initialize first). Also, "f->cf_dst_mac_mask" really should
be zero initialized, if the mask indicates that it's unset. This
means, we can just always memcpy the mask.
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds a subset of functions.
Implemented api:
rtnl_flower_set_proto;
rtnl_flower_get_proto;
rtnl_flower_set_vlan_id;
rtnl_flower_get_vlan_id;
rtnl_flower_set_vlan_prio;
rtnl_flower_get_vlan_prio;
rtnl_flower_set_vlan_ethtype;
rtnl_flower_set_dst_mac;
rtnl_flower_get_dst_mac;
rtnl_flower_set_src_mac;
rtnl_flower_get_src_mac;
rtnl_flower_set_ip_dscp;
rtnl_flower_get_ip_dscp;
rtnl_flower_set_flags;
rtnl_flower_append_action;
rtnl_flower_del_action;
rtnl_flower_get_action;
[thaller@redhat.com: squashed commit "route:cls:flower: use parentheses in
macro definitions"]
[thaller@redhat.com: squashed commit "cls:flower: add TCA_FLOWER_FLAGS
to flower_policy"]
[thaller@redhat.com: squashed commit "cls:flower: vlan priority is
uint8_t, not uint16_t"]
[thaller@redhat.com: squashed commit "route:cls:flower: substitute nl_data*
with uint8_t mac[ETH_ALEN]"]
[thaller@redhat.com: drop non-existing TCA_FLOWER_POLICE. That was
never merged to upstream kernel. While at it, use decimal numbers
for the bitshift.]
[thaller@redhat.com: fix build by including <linux/if_ether.h> in
"types.h".]
Signed-off-by: Volodymyr Bendiuga <volodymyr.bendiuga@westermo.se>
|
|
|
|
|
|
| |
The argument of the setters does not get modified. Make it const.
This change does not break API/ABI.
|
|
|
|
|
| |
In can_put_attrs(), we also put ci_data_bittiming_const. It is thus
necessary to be able to set it.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
These accessor functions just get/set a field of ci_data_bittiming,
which can already be get/set as a whole. It seems redundant, so drop it.
It's really important that things are principle at all (like, setting
ci_data_bittiming). It's not clear that we need such convenience
functions, if you can achieve the same result otherwise.
Yes, we have similar accessors already. I think that is not a good
approach though.
If they turn out very useful, we can still revert this patch.
|
|
|
|
|
|
| |
rtnl_link_can_get_data_bittiming_const()
It seems more consistent with the other names.
|
| |
|
|
|
|
|
|
|
| |
Add CAN FD support analog to the normal CAN support.
[thaller@redhat.com: second part of original commit. The first
part was merged as commit 5d925168a459]
|
|
|
|
|
|
|
| |
The default implementation of oo_clone() already clones the object
using memcpy(). So simple fields (like ifindex) are correct. What
is not correct (and for what we need the oo_clone() implementation)
are pointer values which require a deep clone.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- a `struct rtnl_mdb` has a list of `struct rtnl_mdb_entry`.
An attribute like MDB_ATTR_PORT is not really an attribute
of the MDB struct, but rather of one entry. It makes no sense
to mangle these. Having MDB_ATTR_PORT set in the change flags
would mean that at least one entry has the port set.
Instead, add MDB_ATTR_ENTRIES which is about the list of entries.
- drop unused `ce_mask` in `struct rtnl_mdb_entry`.
- rework mdb_compare(). When we compare the two lists of entries,
it's not right to have two nested loops. You can either
iterate both lists in step, and compare each element to do
a comparison that honors the order of the elements. Or, you
can compare the two lists accepting any order. The latter
is more complicated, and does not seem right. So do the former.
|
|
|
|
|
|
|
|
|
|
|
| |
"struct rtnl_mdb_entry" is a relatively simple object that keeps a few
data fields. But there are no public setters in the API, so it's not
useful to be able to allocate such an entry.
Hide from public API.
Also, it was already not listed in libnl-route-3.sym, and thus the
symbol was hidden anyway.
|
|
|
|
|
|
|
|
|
| |
mdb_free_data()
I think this was wrong before. We cannot use mdb_free_data() and
free the current element.
Use nl_list_for_each_entry_safe() and properly unlink the element.
|
|
|
|
|
|
|
|
|
|
|
| |
The Linux kernel has a notification system via Netlink that reports the
changes in the multicast database over the RTNLGRP_MDB multicast socket.
As such notifications such as RTM_NEWMDB, RTM_GETMDB can be processed in
userspace.
libnl must support the capability of processing these messages, e.g.
RTM_GETMDB.
This commit adds a new rtnl_mdb object as well as a route/mdb cache,
in order to expose the contents of the multicast database.
|
|
|
|
|
|
|
| |
rtnl_cls_find_by{handle,prio}()
The functions return the first matching object (of potentially several).
Rename them to "find", so that this is a bit clearer.
|
|
|
|
|
|
|
|
| |
API:
rtnl_cls_get()
rtnl_cls_get_by_prio()
These functions search for classifiers in classifier cache.
|