summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* expr: add conntrack label match supportFlorian Westphal2014-02-182-2/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: compile queue expression supportPablo Neira Ayuso2014-02-172-8/+14
| | | | | | | This got lost in 29fd6a1df9 when merging major changes in master to next-3.14. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: print usage counter for base chain via default output as wellPablo Neira Ayuso2014-02-111-4/+4
| | | | | | | For some reason this was only printed in custom chains. Print it for any chain, this is useful for debugging purposes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'master' into next-3.14Pablo Neira Ayuso2014-02-03217-1474/+2193
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch includes changes to adapt this branch to the library rename that happened in the master branch. Conflicts: src/Makefile.am src/expr/cmp.c src/expr/ct.c src/expr/data_reg.c src/expr/meta.c tests/jsonfiles/01-table.json tests/jsonfiles/02-table.json tests/jsonfiles/64-ruleset.json tests/xmlfiles/01-table.xml tests/xmlfiles/02-table.xml
| * include: add cached copy of linux/kernel.hPablo Neira Ayuso2014-01-221-0/+29
| | | | | | | | | | | | | | | | | | | | | | This fixes the following compilation warning when compiling with old kernel headers. CC expr/target.lo expr/target.c: In function ‘nft_rule_expr_target_build’: expr/target.c:127: warning: implicit declaration of function ‘__ALIGN_KERNEL’ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * include: add stdint.h to common.hArturo Borrero2014-01-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This fixes: /usr/local/include/libnftnl/common.h:25:49: error: unknown type name ‘uint16_t’ /usr/local/include/libnftnl/common.h:25:63: error: unknown type name ‘uint16_t’ /usr/local/include/libnftnl/common.h:26:10: error: unknown type name ‘uint16_t’ /usr/local/include/libnftnl/common.h:26:25: error: unknown type name ‘uint32_t’ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * build: fix final report after configurationPablo Neira Ayuso2014-01-211-6/+8
| | | | | | | | | | | | | | | | | | | | | | If no xml/json support is explicitly enabled, the final report does not show "no". This patch fixes this: libnftnl configuration: XML support: no JSON support: no Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * build: resolve compile error involving XT_EXTENSION_MAXNAMELENJan Engelhardt2014-01-211-0/+185
| | | | | | | | | | | | | | | | 2.6.32 headers in /usr/include/linux again. Ship a copy of x_tables.h from Linux 3.11. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * build: resolve build failure involving linux/netlink.hJan Engelhardt2014-01-211-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This was seen with a sufficiently-old /usr/include/linux (from Linux 2.6.32). In file included from common.c:10: /usr/include/linux/netlink.h:34: error: expected specifier-qualifier-list before 'sa_family_t' The solution is to include <linux/*> last of all system headers. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * build: Ensure pkg-config file provides the right informationsTomasz Bursztyka2014-01-201-4/+4
| | | | | | | | | | | | | | It's not -lnftables anymore but -lnftnl (among other details) Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * rename library to libnftnllibnftnl-1.0.0Pablo Neira Ayuso2014-01-2092-247/+247
| | | | | | | | | | | | We plan to use this library name for the higher layer library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * expr: ct: fix compilation warning when json/xml support is missingPablo Neira Ayuso2014-01-201-1/+1
| | | | | | | | | | | | | | CC expr/ct.lo expr/ct.c:194:12: warning: 'str2ctdir' defined but not used [-Wunused-function] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * ct: use a string with 'dir' attributeArturo Borrero2014-01-1812-22/+59
| | | | | | | | | | | | | | | | | | This patch implements a string to represent directions in the CT expression: * original (0) * reply (1) Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * data_reg: fix verdict format approachArturo Borrero2014-01-185-97/+110
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patrick reports that the XML/JSON formats of the data_reg object are not accuarate. This patch updates these formats, so they are now as follow: * <data_reg type=value> with raw data (this doesn't change). * <data_reg type=verdict> with a concrete verdict (eg drop accept) and an optional <chain>, with destination. In XML: <data_reg type="verdict"> <verdict>goto</verdict> <chain>output</chain> </data_reg> In JSON: "data_reg" : { "type" : "verdict", "verdict" : "goto" "chain" : "output", } The default output format is updated to reflect these changes (minor collateral thing). When parsing set_elems, to know if we need to add the NFT_SET_ELEM_ATTR_CHAIN flag, a basic check for the chain not being NULL is done, instead of evaluating if the result of the parsing was DATA_CHAIN. The DATA_CHAIN symbol is no longer used in the data_reg XML/JSON parsing zone. While at it, I updated the error reporting stuff regarding data_reg/verdict, in order to leave a consistent state in the library. A JSON testfile is updated as well. Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * utils: fix nft_str2verdict return valueArturo Borrero2014-01-184-21/+39
| | | | | | | | | | | | | | | | | | | | | | | | Some verdicts have a negative value. The caller of nft_str2verdict() checking if return was < 0 clash with enum nft_verdict. While at it, add error reporting of invalid verdicts. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * expr: meta: statify meta_key2str_arrayPablo Neira Ayuso2014-01-171-1/+1
| | | | | | | | | | | | It's not used out of the scope of expr/meta.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * expr: ct: direction is optionalArturo Borrero2014-01-171-16/+46
| | | | | | | | | | | | | | | | | | | | | | | | The 'dir' attribute is optional as stated in the kernel sources. Previous to this patch, using XML/JSON to manage this expr produces some undefined and erroneous behaviours. While at it, fix also the default output format. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * expr: ct: fix missing NFT_CT_L3PROTOCOL in ctkey2str_arrayArturo Borrero2014-01-161-0/+1
| | | | | | | | | | | | | | | | | | Due to missing NFT_CT_L3PROTOCOL key in ctkey2str_array, a segfault is produced when the str2ctkey() loop reaches that position, since strcmp() will try to compare a NULL value. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * tests: xml: delete commentsArturo Borrero2014-01-1548-48/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When building a XML tree, only one root node can be in place. This is a "feature" added in libmxml 2.7: <<< mxmlLoad... did not error out on XML with multiple root nodes (Bug #403) >>> In libmxml 2.6 the second root node was ignored, not because it was a comment but a bug. Our files had two root nodes, being comments or not. libmxml accept comments, but inside the root node. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * lookup: xml: conditional output of dregArturo Borrero2014-01-151-13/+30
| | | | | | | | | | | | | | | | The dreg attribute is optional as stated at: linux/net/netfilter/nft_lookup.c Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * mxml: add optional/mandatory flag to nft_mxml_reg_parseArturo Borrero2014-01-1512-57/+64
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are some cases where a reg is not mandatory, for example: * dreg in lookup * dreg/sreg in meta (last version) So, lets change the function nft_mxml_reg_parse() to add an optional/mandatory flag. dreg in lookup is optional as stated at: net/netfilter/nft_lookup.c:nft_lookup_init() Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * set: xml: data_type/data_len are optionalArturo Borrero2014-01-151-13/+20
| | | | | | | | | | | | | | | | | | | | Don't print data_type and data_len if they aren't set. Also, they are optional when parsing. Printing and parsing unconditionally leads to false values and other errors. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * update COPYINGPablo Neira Ayuso2014-01-151-4/+6
| | | | | | | | | | | | | | It includes the new FSF office address. Reported-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * expr: fix incorrect data type for several expression object fieldsPablo Neira Ayuso2014-01-105-11/+11
| | | | | | | | | | | | | | | | | | This patch fixes the incorrect data type (from uint8_t to uint32_t) in several private data area of the expressions. It also cleans up this by translating several unsigned int to uint32_t. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * tests: nft-parsing-test: use nft_ruleset_parse_file()Arturo Borrero2014-01-09112-338/+144
| | | | | | | | | | | | | | | | | | | | All testfiles are now enclosed in the corresponding top element, ie. * XML: <nftables>...</nftables> * JSON: {"nftables":[...]} Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add interface to parse from fileArturo Borrero2014-01-0915-2/+71
| | | | | | | | | | | | | | | | This patch adds a new API to parse rule-set expressed in XML/JSON from a file. A new enum nft_parse_input type is added for this purpose. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: rework and generalize the build/parse systemArturo Borrero2014-01-099-72/+141
| | | | | | | | | | | | | | | | | | | | | | The intention behind this patch is to prepare the introduction of the new API that will allow us to parse files that contain the rule-sets expressed in XML/JSON format. This adds the NFT_PARSE_BUFFER that indicates that the input is provided in a buffer, which is what we currently support. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * set_elem: add json parsing to APIArturo Borrero2014-01-084-5/+27
| | | | | | | | | | | | | | | | | | Add missing support in the API function to parse a JSON set_elem. I've renamed the main JSON parsing function to prevent clashing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * mxml: add error reference of the top nodeArturo Borrero2014-01-081-2/+5
| | | | | | | | | | | | | | We know the top node we are building. Let the user also know it. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: new error reporting approach for XML/JSON parsersÁlvaro Neira Ayuso2014-01-0645-417/+757
| | | | | | | | | | | | | | | | | | | | | | | | | | | | I have added a new structure for reporting some errors in parser that we can't cover with errno. In this patch, we have three errors that we can't cover with errno: NFT_PARSE_EBADINPUT : Bad XML/JSON format in the input NFT_PARSE_EMISSINGNODE : Missing node in our input NFT_PARSE_EBADTYPE : Wrong type value in a node Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: rename the parameter tag to node_name in jansson functionÁlvaro Neira Ayuso2014-01-032-24/+28
| | | | | | | | | | | | | | | | I have changed this parameter for having consistence with the xml helper function. This patch is a cleanup. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * build: properly handle --without-{xml,json}-parsingDouglas Freed2013-12-231-4/+2
| | | | | | | | | | | | | | | | | | | | This patch fixes how --without-{xml,json}-parsing (and subsequently --with-{xml,json}-parsing=no) is handled. Prior to this, --without-{xml,json}-parsing actually resulted in libnftables being built with that parsing enabled. Signed-off-by: Douglas Freed <dwfreed@mtu.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * include: update netlink.h to 3.13Tomasz Bursztyka2013-12-121-5/+84
| | | | | | | | | | | | | | | | Use kernel header from 3.13-rc upstream kernel, this includes documentation changes that were missing. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * examples: nft-rule-add: use existing batch infrastructurePablo Neira Ayuso2013-12-102-110/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reworks the existing example to add the rule: nft add rule ip filter input tcp dport 22 counter It uses the existing nfnl batching approach using the generic mnl netlink message batching infrastructure. It also removed the code that uses xtables compat code. Based on original patch by Arturo Borrero Gonzalez. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expr: ct: Add support for setting the markKristian Evensen2014-01-153-26/+104
| | | | | | | | | | | | | | | | | | This patch adds userspace support for setting properties of tracked connections. Currently, the connection mark is supported. This can be used to implemented the same functionality as iptables -j CONNMARK --save-mark. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | meta: Let user specify any combination of sreg/dregKristian Evensen2014-01-151-32/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | libnftables should not mask kernel errors. Let user specify any combination of parameters and leave the error-checking to the kernel. The kernel will return -EINVAL and users will know that they have to fix their code. This patch also a removes a redundant variable that was passed to the snprintf-functions (flag). A second iteration might be needed. I was not sure how to deal with snprintf_default in the case of both sreg and dreg. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expr/cmp: fix type sizePatrick McHardy2014-01-152-5/+5
| | | | | | | | | | | | | | | | | | Since nftables now uses nft_rule_expr_get_u32(), the internal size must also be a uint32_t. Fixes complete breakage of any cmp or meta expression. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | libnftables: replace netfilter.h by sanitized headerPatrick McHardy2014-01-151-6/+4
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | src: fix compilation due to missing NFPROTO_INET definitionPablo Neira Ayuso2014-01-102-4/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a copy of the include/linux/netfilter.h kernel header that defines NFPROTO_INET, so libnftables compiles with relatively old kernel headers in the system. chain.c: In function 'nft_hooknum2str': chain.c:53:7: error: 'NFPROTO_INET' undeclared (first use in this function) This required to reorder and remove unneeded headers in src/expr/data_reg.c to avoid a compilation warning due to redefinition of __visible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'next-3.14' of git.netfilter.org:libnftables into inetPatrick McHardy2014-01-089-7/+402
|\ \
| * | examples: add nft-ruleset-getArturo Borrero2014-01-042-0/+393
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This example prints the ruleset, using the ruleset API of nftables. The kernel patch c9c8e48 ("netfilter: nf_tables: dump sets in all existing families") is required. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | examples: nft-set-get: retrieve all sets via unspecArturo Borrero2014-01-041-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | Other nftables objects are allowed to be dumped with NFPROTO_UNSPEC. With sets is also possible since kernel patch c9c8e48 ("netfilter: nf_tables: dump sets in all existing families"). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
| * | tests: add table 'use' attr to testfilesArturo Borrero Gonzalez2014-01-036-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Parsing tests were failing because a missing 'use' attribute in tables. validating xmlfiles/02-table.xml: FAILED from file: 0</flags></table> f from snprintf: 0</flags><use>0</use ^ [...] validating jsonfiles/64-ruleset.json: FAILED from file: ,"flags":0}},{"chain from snprintf: ,"flags":0,"use":0}} ^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | libnftables: add support for inet family and mete nfproto/l4proto expressionsPatrick McHardy2014-01-084-1/+12
|/ / | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | src: update meta exprArturo Borrero2013-12-265-25/+98
| | | | | | | | | | | | | | | | | | | | This patch adds userspace support for the meta expression in the set flavour. This expression indicates that the packet has to be set with a property, currently one of mark, priority or nftrace. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | table: Add support for NFTA_TABLE_USE attributeTomasz Bursztyka2013-12-173-6/+31
| | | | | | | | | | | | | | | | This adds support for table's attribute "use" which let us know about how many chains are in the table, if any. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | test: add tests for expr queueEric Leblond2013-12-042-0/+103
| | | | | | | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expr: add support for nfnetlink queueEric Leblond2013-12-044-0/+280
|/ | | | | | | This patch adds a support of the queue target. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: expr-target: fix deprecation warningArturo Borrero2013-11-303-4/+23
| | | | | | | | | This fixes the following warning: In file included from nft-expr_target-test.c:19:0: /usr/include/linux/netfilter_ipv4/ipt_LOG.h:4:2: warning: #warning "Please update iptables, this file will be removed soon!" [-Wcpp] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: extend test-script.sh to run XML and JSON testsArturo Borrero2013-11-301-0/+2
| | | | | | | Let's test the XML/JSON parsing with test-script.sh as well. Singed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>