test: xml: fix malformed ruleset testfile

Give a new XML ruleset testfile. For some reason, the previous was truncated.
This passed silently as nft-parsing-test is not reporting some errors properly.

This new file provides:
 * 2 tables
 * 3 chains
 * 2 sets, with and without maps
 * 3 rules with mixed exprs

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
rule: remove NFT_RULE_ATTR_FLAGS

This is a leftover from the time we had per rule flags, obsoleted
by the new rule batching approach. Kill it as it is unused.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
expr: add reject

This patch adds support for the reject expression.

Tested-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tests: update to fit latest limit changes

Update tests to fit the latest limit changes in
commit [e91ea14] (expr: limit: operational limit match)

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src: fix possible null pointer dereference in nft_*_attr_get_*

As reported by John Sager, nft_set_attr_get_u32 can cause a
segfault because nft_set_attr_get can return NULL. Check for
a non-NULL pointer before dereferencing.

This closes netfilter bugzilla #868.

[ I have mangled this patch to solve possible null pointer
  dereference with get operations with rule objects --pablo ]

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include: fix missing struct nlmsghdr without definition

The definition of this structure belongs to the scope of
linux/netlink.h.

Based on patch from Jan Engelhardt.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>