summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* include: fix missing struct nlmsghdr without definitionPablo Neira Ayuso2013-10-274-0/+8
| | | | | | | | | The definition of this structure belongs to the scope of linux/netlink.h. Based on patch from Jan Engelhardt. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix possible null pointer dereference in nft_*_attr_get_*Phil Oester2013-10-272-8/+8
| | | | | | | | | | | | | | As reported by John Sager, nft_set_attr_get_u32 can cause a segfault because nft_set_attr_get can return NULL. Check for a non-NULL pointer before dereferencing. This closes netfilter bugzilla #868. [ I have mangled this patch to solve possible null pointer dereference with get operations with rule objects --pablo ] Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: update to fit latest limit changesArturo Borrero2013-10-272-2/+2
| | | | | | | | Update tests to fit the latest limit changes in commit [e91ea14] (expr: limit: operational limit match) Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add rejectPablo Neira Ayuso2013-10-273-0/+219
| | | | | | | This patch adds support for the reject expression. Tested-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove NFT_RULE_ATTR_FLAGSPablo Neira Ayuso2013-10-2797-120/+97
| | | | | | | This is a leftover from the time we had per rule flags, obsoleted by the new rule batching approach. Kill it as it is unused. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: xml: fix malformed ruleset testfileArturo Borrero2013-10-271-1/+1
| | | | | | | | | | | | | | Give a new XML ruleset testfile. For some reason, the previous was truncated. This passed silently as nft-parsing-test is not reporting some errors properly. This new file provides: * 2 tables * 3 chains * 2 sets, with and without maps * 3 rules with mixed exprs Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: limit: s/seconds/second/Florian Westphal2013-10-221-1/+1
| | | | | | my fault, spotted by Phil Oester. Signed-off-by: Florian Westphal <fw@strlen.de>
* expr: limit: avoid huge rodata arrayPablo Neira Ayuso2013-10-221-8/+13
| | | | | | | | | | commit 10e0890e ('src: operational limit match') creates huge array, increasing libnftables binary size. Use switch statement instead. Based on patch from Florian Westphal, for nft. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: limit: operational limit matchPhil Oester2013-10-223-25/+32
| | | | | | | | | | | | | | | | | | | | | The nft limit match currently does not work at all. Below patches to nftables, libnftables, and kernel address the issue. A few notes on the implementation: - Removed support for nano/micro/milli second limits. These seem pointless, given we are using jiffies in the limit match, not a hpet. And who really needs to limit items down to sub-second level?? - 'depth' member is removed as unnecessary. All we need in the kernel is the rate and the unit. - 'stamp' member becomes the time we need to next refresh the token bucket, instead of being updated on every packet which goes through the match. This closes netfilter bugzilla #827, reported by Eric Leblond. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: fix access after free in case of parsing errorsPablo Neira Ayuso2013-10-211-1/+3
| | | | | | If this fails to parse a set element, stop the processing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: remove spacesÁlvaro Neira Ayuso2013-10-1773-143/+139
| | | | | | | | | | | | Remove all the spaces from the JSON output to reduce the size of the output string, this also provides a consistent output in table, chain, rule and set. As Stephen Hemminger suggested, better to squash the output to consume as less bytes as possible. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: fix compilation warningPablo Neira Ayuso2013-10-021-0/+1
| | | | | | | Due to missing calloc definition in stdlib.h, spotted by gcc-4.8. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add low-level ruleset APIArturo Borrero2013-10-0113-5/+925
| | | | | | | | This patch adds a low level ruleset API for libnftables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: json: fix returned string lengthPablo Neira Ayuso2013-09-271-0/+2
| | | | | | | | Similar to (e7c068d rule: json: fix returned string length). Based on patch from Arturo. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: snprintf: fix buffer lengthsArturo Borrero2013-09-275-45/+45
| | | | | | | | Use 'len' instead of 'size' since we need the remaining unused bytes in the buffer, not its total size. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: xml: avoid code duplicationArturo Borrero2013-09-271-23/+9
| | | | | | | This patch removes 3x code duplication in the XML snprintf function. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: json: fix returned string lengthAlvaro Neira Ayuso2013-09-251-1/+3
| | | | | | | It was returning one byte more than the real string length. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-set-get: retrieve all sets per familyPablo Neira Ayuso2013-09-241-5/+6
| | | | | | | | | | | Likewise other nftables objects, this patch allows you to dump the sets per family. This is possible since kernel changes (netfilter: nf_tables: allow to dump all existing sets), we can get the full list of sets per family. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: json: fix wrong indentation in nft_rule_snprintf_jsonPablo Neira Ayuso2013-09-241-7/+7
| | | | | | Comestic cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: get rid of NFTA_RULE_FLAGSPablo Neira Ayuso2013-09-242-16/+0
| | | | | | | It has been removed after (netfilter: nf_tables: all rule updates are transactional). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace size_t by uint32_t in set/get interfacesPablo Neira Ayuso2013-09-1922-52/+52
| | | | | | | | | | | | This patch breaks the ABI to shrink the size parameter from 8 to 4 bytes in x86_64. The maximum length of netlink attributes is 2 bytes, so 4 bytes as attribute payload length should be enough. After this patch, size_t is only used in the nft_*_snprintf interfaces. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: don't put NFTA_RULE_EXPRESSION into messagesPablo Neira Ayuso2013-09-171-4/+6
| | | | | | | | If there are no expressions in this rule, skip the NFTA_RULE_EXPRESSION attribute, otherwise it will be empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_delPablo Neira Ayuso2013-09-178-1/+25
| | | | | | | This allows us to delete object from the list, note that nft_chain_list_del already existed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix build errorArturo Borrero Gonzalez2013-09-161-0/+4
| | | | | | | | This declaration was missing and is needed in case you compile libnftables without XML parsing support. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: refactor XML parsing codeArturo Borrero Gonzalez2013-09-167-105/+122
| | | | | | | | | | | This patch refactors nft_*_xml_parse to provide a new intermediate function nft_mxml_parse_* which will allow us to navigate an entire XML tree containing a ruleset without xml2text2xml conversions. While at it, I added a helper to build the XML tree and validate the top node name. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: xml: avoid unecessary tree to text to tree conversionsArturo Borrero Gonzalez2013-09-163-195/+50
| | | | | | | | This patch avoid several tree to text to tree conversions in the XML parsing helpers. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: add parsing optional/mandatory flagArturo Borrero Gonzalez2013-09-1624-130/+171
| | | | | | | | | | | Add an optional/mandatory flag to XML parsing. In some elements (ie regs), no flag is used because is always mandatory. DATA_NONE is created to indicate a non-parsed data_reg. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix compilation warningÁlvaro Neira Ayuso2013-09-151-0/+1
| | | | | Signed-off-by: Álvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: use real length when fetching attributesFlorian Westphal2013-09-141-2/+6
| | | | | | | | | | | | | NFTA_LOG_SNAPLEN is u32 and NFTA_LOG_QTHRESHOLD is u16. Without this, netlink messages from kernel fail mnl_validate step when QTHRESH or SNAPLEN was set. Also, nft_rule_expr_log_get must update data_length, else 'nft list' doesn't show log arguments (prefix, group ..) because the netlink message decoding uses nft_rule_expr_get_u16/32 etc. which validate the length, too. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: refactor json parsing to allow tree based navigationÁlvaro Neira Ayuso2013-09-134-44/+81
| | | | | | | | | | This patch refactors nft_*_json_parse to provide a new intermediate function nft_jansson_parse_chain which will allows us to navigate the entire json tree containing the ruleset. Signed-off-by: Álvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: use helper function nft_jansson_free_rootÁlvaro Neira Ayuso2013-09-131-2/+2
| | | | | Signed-off-by: Álvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: use human readable netfilter hookPablo Neira Ayuso2013-09-057-23/+49
| | | | | | | | | Since (108d9f6 src: Wrap netfilter hooks around human readable strings) in nft, we have to use human readable netfilter hooks. This patch also adapts the XML and JSON tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-{chain,rule,table}-get allows unspec familyPablo Neira Ayuso2013-09-053-3/+9
| | | | | | To obtain any table, chain and rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: display configuration after ./configurePablo Neira Ayuso2013-09-051-2/+12
| | | | | | | | libnftables configuration: XML support: no JSON support: no Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: xml: fix key_type parsingArturo Borrero2013-09-051-1/+1
| | | | | | | Bug introduced by myself at 44928cd5 [set: add XML parsing] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: xml: fix parsing of optional attributesArturo Borrero2013-09-044-50/+46
| | | | | | | This patch fixes the parsing of custom chains in XML. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: Add nft-set-json-addÁlvaro Neira Ayuso2013-08-282-0/+120
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: set: add json parsing supportÁlvaro Neira Ayuso2013-08-283-0/+13
| | | | | | | Test the functions for parsing set in JSON. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Add json parser supportÁlvaro Neira Ayuso2013-08-284-0/+138
| | | | | | | Add function for parsing set in format JSON. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: remove unnecessary variable initializationÁlvaro Neira Ayuso2013-08-281-10/+10
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: s/nft_jansson_value_parse_reg/nft_jansson_parse_reg/gPablo Neira Ayuso2013-08-2411-26/+21
| | | | | | | | This patch is a cleanup to save LOC. I have also changed it to use < 0 to check for error conditions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: s/nft_jansson_value_parse_val/nft_jansson_parse_val/gPablo Neira Ayuso2013-08-2415-60/+37
| | | | | | | | This patch is a cleanup to save LOC. I have also changed it to use < 0 to check for error conditions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: s/nft_jansson_value_parse_str/nft_jansson_parse_str/gPablo Neira Ayuso2013-08-2417-31/+30
| | | | | | Remove _value_ infix to make the function name smaller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: xml/json: support rule position attributeArturo Borrero2013-08-241-0/+32
| | | | | | | | Note that the position attr is optional as stated in net/netfilter/nf_tables_api.c Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify nft_*_parse input dataArturo Borrero Gonzalez2013-08-2211-20/+22
| | | | | | | Since the input string is not changing, let's make it constant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: Add nft-rule-json-addÁlvaro Neira Ayuso2013-08-202-0/+119
| | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
* tests: rule: add json parsing supportÁlvaro Neira Ayuso2013-08-2043-0/+53
| | | | | | Test the functions for parsing rules in JSON. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
* rule: Add json parser supportÁlvaro Neira Ayuso2013-08-2022-2/+839
| | | | | | | Add function for parsing rules in JSON format Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: fix error path for nft_strtoiArturo Borrero2013-08-201-3/+4
| | | | | | | | If the return of nft_get_value() is not evaluated, we don't know if the parsed value is between the limits of its type. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix memory leaks in jansson testÁlvaro Neira Ayuso2013-08-171-2/+4
| | | | | | | Fixed a string leak and a jansson leak. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>