summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* src: remove nftnl_rule_cmp() and nftnl_expr_cmp()Pablo Neira Ayuso2018-10-2437-743/+4
| | | | | | | | | | | | | | These functions are not very useful, rule comparison from this layer does not work well with implicit set definitions. This infrastructure was added as an attempt to support for deletion by name from this layer, which should be done from higher level libnftables library. Finally, we never had a client for this code in git.netfilter.org. Let's remove it and bump libversion for safety reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-1949-191/+196
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: secmark: remove json stubPablo Neira Ayuso2018-10-151-22/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: add ttl option supportFernando Fernandez Mancera2018-10-151-0/+22
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-1555-4057/+25
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for new secmark objectChristian Göttsche2018-10-093-0/+161
| | | | | | | The new object will hold security context strings. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add xfrm supportFlorian Westphal2018-09-213-0/+328
| | | | | | | Joint work with Máté Eckl. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: rt: ipsec match supportFlorian Westphal2018-09-211-0/+1
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: don't skip zero value timeoutPablo Neira Ayuso2018-08-311-4/+3
| | | | | | It's a valid configuration, don't assume this means timeout is unset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: use fixed size arrayPablo Neira Ayuso2018-08-311-23/+5
| | | | | | | | | Use an internal array and expose maximum size so we can just use the same array size for all protocol timeouts. This simplifies handling a bit and we don't need to set NFTNL_OBJ_CT_TIMEOUT_L4PROTO in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: fix gcc4 build errorFlorian Westphal2018-08-211-1/+3
| | | | | | gcc 4.9 only allows for-loop initialisation declarations in C99 or C11 modes. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: remove cttimeout.h leftoverPablo Neira Ayuso2018-08-141-1/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ct timeout supportHarsha Sharma2018-08-133-0/+370
| | | | | | | | Add support for ct timeout objects, used to assign connection tracking timeout policies. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: modify _snprintf_default functionFernando Fernandez Mancera2018-08-071-1/+1
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add support for matching tunnel metadataPablo Neira Ayuso2018-08-063-0/+195
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: add tunnel supportPablo Neira Ayuso2018-08-063-0/+583
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: remove json codePablo Neira Ayuso2018-08-031-18/+0
| | | | | | This code, which is enabled via --with-json-parsing, doesn't compile. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add osf supportFernando Fernandez Mancera2018-07-303-0/+177
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: Add tproxy supportMáté Eckl2018-07-303-0/+208
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* socket: Expose socket mark via socket expressionMáté Eckl2018-07-301-0/+1
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr/exthdr: Fix JSON parsing on big endianPhil Sutter2018-06-261-1/+1
| | | | | | | | | | | When setting NFTNL_EXPR_EXTHDR_TYPE, one needs to call nftnl_expr_set_u8() and not nftnl_expr_set_u32(). Otherwise 'type' variable is assigned to uint32_t parameter before being passed to nftnl_expr_exthdr_set() as void pointer which casts it to uint8_t. On big endian systems, the latter would only consider the most significant byte instead of the least significant one. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr/data_reg: Fix JSON parsing on big endianPhil Sutter2018-06-261-2/+2
| | | | | | | | | | | Since reg->len is a 32bit variable, one needs to pass NFTNL_TYPE_U32 to nftnl_jansson_parse_val(). Otherwise, only the most significant byte in that variable is being written to. Since the value could potentially be larger than 255, increase node_name buffer to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc>
* utils: Fix nftnl_get_value() on big endianPhil Sutter2018-06-261-2/+42
| | | | | | | | | | | | This function basically did: | memcpy(out, val, <len of requested type>); which works only for little endian integer types. Fix this by assigning the 64bit input value to a variable of the right size and use that as input for above memcpy() call. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr: rt: print tcpmssPablo Neira Ayuso2018-06-071-1/+1
| | | | | | | | | | | | | | rt_key2str() should also return the 'tcpmss' case. Instead of: [ rt load unknown => reg 1 ] print: [ rt load tcpmss => reg 1 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: extend fwd to support address and protocolPablo Neira Ayuso2018-06-061-4/+56
| | | | | | To support forwarding through neighbour layer from ingress. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add connlimit supportPablo Neira Ayuso2018-06-063-0/+210
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for native socket matchingMáté Eckl2018-06-013-0/+211
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: updated nf_tables.hMáté Eckl2018-05-292-10/+2
| | | | | | | Joint work with Pablo. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add nftnl_rule_list_insert_at()Pablo Neira Ayuso2018-05-282-0/+10
| | | | | | Allow to add rule object before any existing rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add map lookups for hash statementsLaura Garcia Liebana2018-05-231-0/+49
| | | | | | | | | | | This patch introduces two new attributes for hash expression to allow map lookups where the hash is the key. The new attributes are NFTNL_EXPR_HASH_SET_NAME and NFTNL_EXPR_HASH_SET_ID in order to identify the given map. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add map lookups for numgen statementsLaura Garcia Liebana2018-05-081-0/+49
| | | | | | | | | | | This patch introduces two new attributes for numgen to allow map lookups where the number generator will be the key. Two new attributes needs to be included: NFTNL_EXPR_NG_SET_NAME and NFTNL_EXPR_NG_SET_ID in order to identify the given map. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* udata: refuse to put more than UINT8_MAX bytesFlorian Westphal2018-04-291-1/+1
| | | | | | ->len is uint8_t, so we can't handle more than this. Signed-off-by: Florian Westphal <fw@strlen.de>
* expr: objref: do not print idPablo Neira Ayuso2018-04-111-2/+2
| | | | | | | The lookup expression does not do this either, so let's be consistent and remove it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove set/get array apiFlorian Westphal2018-03-122-14/+0
| | | | | | one-line wrapper, callers can use nftnl_flowtable_get/set instead. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: support for NFT_CT_{SRC,DST}_{IP,IP6}Pablo Neira Ayuso2018-03-111-1/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix parsing for set handle attributesHarsha Sharma2018-03-111-1/+1
| | | | | | | Correct one typo for parsing set handles. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parse new handle attribute for objectsHarsha Sharma2018-03-051-1/+19
| | | | | | | | This patch add code to allocate object handles and delete objects via object handles. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parse new handle attribute for setsHarsha Sharma2018-03-051-0/+18
| | | | | | | This patch adds code to allocate set handles and delete sets via set handle. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
* src: parse new handle attribute for tablesHarsha Sharma2018-03-052-2/+38
| | | | | | | This patch adds code to parse new handle attribute for tables. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: support for flagsPablo Neira Ayuso2018-03-051-3/+20
| | | | | | This new attribute allows you to specify the flowtable flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: allow to specify sizePablo Neira Ayuso2018-03-051-2/+21
| | | | | | This new attribute allows you to specify the flowtable size. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add flow offload expressionPablo Neira Ayuso2018-03-053-0/+187
| | | | | | | This patch adds the new "flow_offload" expression to select what flows are offloaded to an existing flowtable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flowtable supportPablo Neira Ayuso2018-03-053-0/+825
| | | | | | | This patch allows you to add, delete and list flowtable through the existing netlink interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: nftnl_set_elems_parse() returns 0 if set is emptyPablo Neira Ayuso2018-02-141-1/+1
| | | | | | | Instead of -1, which results n misleading error propagate to the caller with errno == 0 (success). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: secpath supportFlorian Westphal2018-01-161-1/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Fix exporting symbols with clangArmin K2017-12-3013-269/+273
| | | | | | | | | | | | | When EXPORT_SYMBOL is located after function definition, clang won't properly export the function, resulting in a library with no symbols when built with clang. Based on libmnl commit dcdb47373a37 ("Move declaration of visibility attributes before definition.") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1205 Signed-off-by: Armin K <krejzi@email.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* data_reg: calm down compilation warning in nftnl_data_reg_value_json_parse()Pablo Neira Ayuso2017-12-281-3/+4
| | | | | | | | | | | | | | | | | | expr/data_reg.c: In function 'nftnl_data_reg_json_parse': expr/data_reg.c:69:27: warning: '%d' directive writing between 1 and 10 bytes into a region of size 2 [-Wformat-overflow=] sprintf(node_name, "data%d", i); ^~ expr/data_reg.c:69:22: note: directive argument in the range [0, 2147483647] sprintf(node_name, "data%d", i); Buffer overflow is triggerable when reg->len > 396, but len never goes over 128 due to type validation just a bit before. Use snprintf() and make sure buffer is large enough to store the "data256" string. Reported-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* trace: Check return value of mnl_attr_parse_nested()Phil Sutter2017-12-151-1/+2
| | | | | | | | This is done everywhere else as well, so certainly not a bad thing here either. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: Don't return garbage in nftnl_set_elems_parse()Phil Sutter2017-12-151-1/+1
| | | | | | | | | This might happen if netlink message is malformed (no nested attributes are present), so treat this as an error and return -1 instead of garbage to caller. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: Avoid reading garbage in nftnl_ruleset_cb()Phil Sutter2017-12-151-5/+5
| | | | | | | | | | If nftnl_ruleset_json_parse() is called with arg == NULL, ctx.data is left uninitialized and will later be used in nftnl_ruleset_cb(). Avoid this by using a C99-style initializer for 'ctx' which sets all omitted fields to zero. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>