summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* data: increase maximum possible data sizePatrick McHardy2015-04-143-2/+6
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* headers: resync headers for new register definitionsPatrick McHardy2015-04-141-1/+31
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: dynset: fix json/xml parsingArturo Borrero Gonzalez2015-04-131-14/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | expr/dynset.c: In function 'nft_rule_expr_dynset_json_parse': expr/dynset.c:194:3: warning: implicit declaration of function 'nft_rule_expr_dynset_str' [-Wimplicit-function-declaration] nft_rule_expr_dynset_str(e, NFT_EXPR_DYNSET_SET, set_name); ^ expr/dynset.c:194:31: error: 'NFT_EXPR_DYNSET_SET' undeclared (first use in this function) nft_rule_expr_dynset_str(e, NFT_EXPR_DYNSET_SET, set_name); ^ expr/dynset.c:194:31: note: each undeclared identifier is reported only once for each function it appears in expr/dynset.c:197:3: warning: implicit declaration of function 'nft_rule_expr_dynset_u32' [-Wimplicit-function-declaration] nft_rule_expr_dynset_u32(e, NFT_EXPR_DYNSET_SREG, sreg); ^ expr/dynset.c:197:31: error: 'NFT_EXPR_DYNSET_SREG' undeclared (first use in this function) nft_rule_expr_dynset_u32(e, NFT_EXPR_DYNSET_SREG, sreg); ^ expr/dynset.c:200:31: error: 'NFT_EXPR_DYNSET_DREG' undeclared (first use in this function) nft_rule_expr_dynset_u32(e, NFT_EXPR_DYNSET_DREG, dreg); ^ expr/dynset.c: In function 'nft_rule_expr_dynset_xml_parse': expr/dynset.c:220:31: error: 'NFT_EXPR_DYNSET_SET' undeclared (first use in this function) nft_rule_expr_dynset_str(e, NFT_EXPR_DYNSET_SET, set_name); ^ expr/dynset.c:224:31: error: 'NFT_EXPR_DYNSET_SREG' undeclared (first use in this function) nft_rule_expr_dynset_u32(e, NFT_EXPR_DYNSET_SREG, sreg); ^ expr/dynset.c:228:31: error: 'NFT_EXPR_DYNSET_DREG' undeclared (first use in this function) nft_rule_expr_dynset_u32(e, NFT_EXPR_DYNSET_DREG, dreg); ^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add support for the dynset exprPatrick McHardy2015-04-126-0/+359
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* set_elem: add support for userdataPatrick McHardy2015-04-124-0/+54
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: print set elem timeout informationPatrick McHardy2015-04-121-0/+13
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* set_elem: add timeout supportPatrick McHardy2015-04-095-0/+50
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add support for set timeoutsPatrick McHardy2015-04-095-0/+64
| | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* list: fix prefetch dummyPatrick McHardy2015-03-261-1/+1
| | | | | | | | | | ../include/linux_list.h:385:59: warning: right-hand operand of comma expression has no effect [-Wunused-value] for (pos = list_entry((head)->next, typeof(*pos), member), \ ^ set.c:266:2: note: in expansion of macro 'list_for_each_entry' list_for_each_entry(elem, &set->element_list, head) { Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: restore static array with expression operationsPablo Neira Ayuso2015-03-2322-108/+48
| | | | | | | | | | | | | We cannot use __attribute__((constructor)) to register the supported expressions in runtime when the library is statically linked. This lead us to some explicit libnftnl_init() function that needs to be called from the main() function of the client program. This patch reverts 4dd0772 ("expr: use __attribute__((constructor)) to register expression"). Reported-by: Laurent Bercot <ska-devel@skarnet.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Add operation not supported error messageAlvaro Neira2015-03-172-1/+12
| | | | | | | | | | | If we try to import a ruleset in json or xml and the library was not compile with support for those, this shows a misleading error. To resolve this problem, this patch sets up EOPNOTSUPP by default when we create the nft_parse_err structure. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: add nft_ruleset_ctx_freeAlvaro Neira2015-03-134-7/+26
| | | | | | | | | | This function releases the ruleset objects attached in the parse context structure, ie. struct nft_parse_ctx. Moreover, this patch updates the nft_parse_ruleset_file to use it. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: add nft-ruleset-parse-fileAlvaro Neira2015-03-052-0/+490
| | | | | | | | | | | | | | With this example, we can parse the objects in the ruleset and create the netlink message with the action associated. For example: - Flush ruleset - Add, delete or flush tables/chains - Add, delete sets - Add, delete set elements - Add, delete, replace or prepend rules Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xml: test if the root node name is initializedAlvaro Neira2015-03-051-1/+2
| | | | | | | If the root node name is missing, we have a crash. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: crash from error path when we build the xml/json treeAlvaro Neira2015-03-031-11/+13
| | | | | | | Fix crash when we try to release a tree that is not initialized. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: fix crash if we free sets included in the set_listAlvaro Neira2015-02-244-1/+59
| | | | | | | | | | | | | | | | | When we parse a ruleset which has a rule using a set. First step is to parse the set, set up an ID and add it to a set list. Later, we use this set list to find the set associated to the rule and we set up the set ID to the expression (lookup expression) of the rule. The problem is that if we return this set to the callback function nft_ruleset_parse_file_cb() and we free this set, we have a crash when we try to iterate in the set list. This patch solves it, cloning the set and adding the new set to the set list. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile: internal.h now resides in includePablo Neira Ayuso2015-02-191-2/+1
| | | | | | Remove reference to the former internal.h under src/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: split internal.h is smaller filesPablo Neira Ayuso2015-02-1740-349/+333
| | | | | | | | | The internal.h file started being a small file with private definitions. Its size has been increasing over time more and more, so let's split this in small header files that map to the corresponding class where the functions belong to. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: fix more leaks in error pathPablo Neira Ayuso2015-02-131-5/+10
| | | | | | | Shouldn't happen though, since you need to introduce an unsupported markup language. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: fix leak in json/xml in set listsAlvaro Neira2015-02-131-10/+14
| | | | | | | | | | | | | | ==18632== 285 (16 direct, 269 indirect) bytes in 1 blocks are definitely lost in loss record 6 of 6 ==18632== at 0x4C272B8: calloc (vg_replace_malloc.c:566) ==18632== by 0x5043822: nft_set_list_alloc (set.c:977) ==18632== by 0x5045483: nft_ruleset_json_parse (ruleset.c:442) ==18632== by 0x50458BE: nft_ruleset_do_parse (ruleset.c:696) ==18632== by 0x408AEC: do_command (rule.c:1317) ==18632== by 0x406B05: nft_run (main.c:194) ==18632== by 0x40667C: main (main.c:360) Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: don't release the tree parameter from nft_jansson_parse_rule()Alvaro Neira2015-02-131-3/+5
| | | | | | | | | | We release the tree that we receive from the parameter in nft_jansson_parse_rule. With this patch, we're going to release the tree where we create it. Therefore, we will have a code more traceable and readable. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add missing include in utils.cPablo Neira Ayuso2015-02-101-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: update JSON/XML tests with the new syntaxAlvaro Neira Ayuso2015-02-10125-124/+126
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support to import JSON/XML with the new command tagAlvaro Neira Ayuso2015-02-106-313/+553
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds support to parse the new command tag in XML/JSON. This patch adds two new functions: * nft_ruleset_parse_file_cb * nft_ruleset_parse_buffer_cb The idea is to invoke the callback function that is passed as parameter is called for each object that is parsed from the corresponding input. Each callback has access to the nft_parse_ctx structure that provides the necessary context such as the command, the object type and the object itself. This change also adds support to update the content of a set incrementally. {"nftables":[{"add":[{"element":{"name":"blackhole","table":"filter", "family":"ip","key_type":7,"key_len":4,"set_elem":[{"key":{ "reg":{"type":"value","len":4,"data0":"0x0403a8c0"}}}]}}]}]} This also patch consolidates the xml/json ruleset import path. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add command tag in JSON/XML export supportAlvaro Neira Ayuso2015-02-1013-104/+252
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, we can't do incremental updates via JSON/XML. This patch enriches the existing output to indicate the kind of update that you want to perform. So, if we have a ruleset like: table ip filter { chain input { type filter hook input priority 0; } } The new output looks like: {"nftables":[{"add":[{"table":{"name":"filter",...}}]}]} ^^^^^ Where we explicitly indicate that we want to add a table. We support all the actions that we can do with nft, they are: - Add, delete and flush tables and chains. - Add, delete, replace and insert rules. - Add and delete sets. - Add and delete set elements. - Flush ruleset. You only need to add the command tag: {"nftables":[{"delete":[{...}, {...},...}]}]} ^^^^^^^^ The possible command tags that you can use are "add", "delete", "insert", "replace" and "flush". - Flush table or chain, eg.: {"nftables":[{"flush":[{"table":{"name":...}}]}]} - Delete table, chain, set or rule: {"nftables":[{"delete":[{"chain":{"name":...}]}]} - Replace a rule (you have to specify the handle): {"nftables":[{"replace":[{"rule":{...}}]}]} - Insert a rule: {"nftables":[{"insert":[{"rule":{...}}]}]} Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* buffer: fix missing XML string tag in nft_buf_closeAlvaro Neira Ayuso2015-02-101-1/+1
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: refactor code in json parse functionAlvaro Neira2015-01-291-7/+15
| | | | | | | | | This patch refactors code to parse the set in two functions nft_jansson_parse_set_info and nft_jansson_parse_set. These changes are used in follow up patches. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: refactor nft_ruleset_*_parse_ruleset()Alvaro Neira2015-01-151-20/+38
| | | | | | | | | Refactor the parsing ruleset element functions calls in xml/json to do that calls in the functions nft_ruleset_*_parse_ruleset. This patch is used in follow up patches. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't create iterator with empty listAlvaro Neira2015-01-155-6/+44
| | | | | | | | | | Currently, we create iterator without test if the list is empty. If the list is empty, we have a crash when we set up the current element. With this patch, we test if the list is empty before to create the iterator. If the list is empty the iterator return NULL. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: clean up the variable names in the xml/json parsing functionsAlvaro Neira2015-01-101-50/+50
| | | | | | | Rename variables to use more intuitive name like table, chain, rule or set. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add missing gen.h to Makefile.amlibnftnl-1.0.3Pablo Neira Ayuso2014-12-161-1/+2
| | | | | | Fixes make distcheck. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bump version to 1.0.3Pablo Neira Ayuso2014-12-162-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* buffer: include stdarg headerGiuseppe Longo2014-11-201-0/+1
| | | | | | | | | | | | | | | This fixes the following warnings: buffer.c: In function 'nft_buf_put': buffer.c:53:2: warning: implicit declaration of function 'va_start' [-Wimplicit-function-declaration] va_start(ap, fmt); ^ buffer.c:56:2: warning: implicit declaration of function 'va_end' [-Wimplicit-function-declaration] va_end(ap); ^ Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-rule-parse-add: fix wrong buffer usage when building rule headerArturo Borrero2014-11-171-1/+2
| | | | | | | | | The libmnl helper returns a pointer where to start putting the rule data. Reported-by: Ian Bishop <ian@pace7.com> Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=983 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: data_reg: use 'reg' instead of 'data_reg'Pablo Neira Ayuso2014-11-1082-103/+92
| | | | | | | | | | | | data_reg is unnecessarily long name and it always has to be wrapped by another data node. This will allow us to represent data not only as registers if needed. Get rid of 'cmpdata' and 'immediatedata' too and use 'data' instead to wrap 'reg' so these are consistent with the bitwise expression. No reason for such specific tag per expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate XML/JSON exportationPablo Neira Ayuso2014-11-1031-1210/+573
| | | | | | | | | | | | | | Add new buffer class to consolidate the existing code to export objects in XML/JSON and use it. We save ~700 LOC with this change. The rule and set objects are not yet consolidated. It seems this would require some specific glue code per representation type since lists are arranged differently. This also consolidates the tag names, so we make sure the same are used from XML and JSON by placing them in include/buffer.h. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: nat: use 'nat_type' instead of 'type' in the parserPablo Neira Ayuso2014-11-103-3/+3
| | | | | | 'type' is already used from the expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Add cgroup supportAna Rey2014-11-102-2/+5
| | | | | | | | The kernel support is add in the commit: netfilter: nft_meta: add cgroup support Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* remove empty src/attr.cPablo Neira Ayuso2014-11-101-0/+0
| | | | | | This empty file slipped through the repository, remove it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add tests for nft_redir expressionArturo Borrero2014-10-305-0/+104
| | | | | | | This patch add some tests for the nft_redir expression. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for nft_redir expressionArturo Borrero2014-10-304-0/+347
| | | | | | | This patch adds support for the new nft_redir expression. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: deconstify _get interfaceArturo Borrero2014-10-242-2/+2
| | | | | | | | Having this interface returning a const pointer makes very hard to modificate the content of a chain contained in a nft_ruleset. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: fix arp family numberArturo Borrero2014-10-211-23/+20
| | | | | | | | | | | | | | | | | | NFPROTO_ARP = 3 in kernel space. We need the same value here in userspace in order to correctly communicate with the kernel. The failure solved by this patch made that {XML|JSON}-parsed tables of ARP family unable to be directly injected into kernel. To prevent future errors, this patch changes raw and AF_* values by the mathing NFPROTO_* couterpart as seen in linux/netfilter.h in both functions: * nft_family2str() * nft_str2family() Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix compilation without xml/json supportPablo Neira Ayuso2014-10-111-0/+2
| | | | | Fixes: c04175e ("src: internal set id allocation from nft_ruleset_parse*()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: cleanup in mxml and jansson regarding set_id parsingArturo Borrero2014-10-112-4/+4
| | | | | | | | | | | | | | | | | | jansson.c: In function 'nft_jansson_expr_parse': jansson.c:212:6: warning: pointer targets in passing argument 3 of 'nft_set_lookup_id' differ in signedness [-Wpointer-sign] In file included from jansson.c:10:0: ./internal.h:95:5: note: expected 'uint32_t *' but argument is of type 'int *' jansson.c:195:18: warning: unused variable 'set_cur' [-Wunused-variable] mxml.c: In function 'nft_mxml_expr_parse': mxml.c:97:6: warning: pointer targets in passing argument 3 of 'nft_set_lookup_id' differ in signedness [-Wpointer-sign] In file included from mxml.c:12:0: internal.h:95:5: note: expected 'uint32_t *' but argument is of type 'int *' mxml.c:68:18: warning: unused variable 'set_cur' [-Wunused-variable] Spotted with: gcc (Debian 4.7.2-5) 4.7.2 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: internal set id allocation from nft_ruleset_parse*()Alvaro Neira2014-10-096-22/+95
| | | | | | | | | Extends this function to attach the set to the rule through the set_idi. If it doesn't exist in the list, maybe the set already exists in the kernel. In that case, we don't set any id. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: add set id to parsed setsAlvaro Neira2014-10-091-0/+4
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: also test nat flags attributeArturo Borrero2014-10-033-2/+6
| | | | | | | The nat expression has a new attribute. Let's give some testing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add tests for the masq expressionArturo Borrero2014-10-035-0/+96
| | | | | | | The masq expression is lacking of tests. Let's add some. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: masq: optional printing of flags attr in snprintf_defaultArturo Borrero2014-10-031-2/+4
| | | | | | | | The flags attribute is optional. Thus we should print only if it was originally set. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 13:09:25 +0000