summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* set: add NFTNL_SET_OBJ_TYPE attributePablo Neira Ayuso2016-12-091-0/+27
| | | | | | | | This new attribute specifies the stateful object type this set stores. Similar to data type, but specific to store objects. You must set the NFT_SET_OBJECT flag to use this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add stateful object reference expressionPablo Neira Ayuso2016-12-094-0/+223
| | | | | | | This patch adds a new "objref" expression that you can use to refer to stateful objects from rules. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for stateful objectsPablo Neira Ayuso2016-12-095-0/+996
| | | | | | | This patch allows you to add, to delete and to get stateful objects, this support two object types: counter and quota. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: nftnl_set_elems_nlmsg_build_payload_iter()Pablo Neira Ayuso2016-12-051-0/+4
| | | | | | | Similar to a24e4b21ee33 ("set_elem: don't add NFTA_SET_ELEM_LIST_ELEMENTS attribute if set is empty"). This is required by the set flush support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: payload: add NFTNL_EXPR_PAYLOAD_FLAGSPablo Neira Ayuso2016-12-041-2/+20
| | | | | | So we can include the new NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: call expr->ops->snprintf only if definedPablo Neira Ayuso2016-11-291-0/+3
| | | | | | | The notrack expression comes with no ->ops->snprintf, so skip this from nftnl_expr_snprintf() if not set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: missing offset handling for snprintf() in hash and numgenPablo Neira Ayuso2016-10-312-2/+2
| | | | | | Fix incorrect output when offset attribute is unset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add fib expressionFlorian Westphal2016-10-283-0/+276
| | | | | | | | | Allows to query fib for output interface and route type of a packets source or destination address. Scheduled for Linux 4.10. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: introduce rt expressionAnders K. Pedersen2016-10-283-0/+246
| | | | | | | | Introduce support for rt expression for routing related data as implemented in kernel. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add notrack expressionPablo Neira Ayuso2016-10-202-2/+10
| | | | | | | | Register this simple expression with no attributes. Make sure libnftnl doesn't crash when no build and parse indirections are defined, as it is the case for this expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: update Arturo Borrero Gonzalez emailArturo Borrero Gonzalez2016-10-174-4/+4
| | | | | | | Update Arturo Borrero Gonzalez email address. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: don't add NFTA_SET_ELEM_LIST_ELEMENTS attribute if set is emptyPablo Neira Ayuso2016-10-171-0/+3
| | | | | | | If the set is empty, don't send an empty NFTA_SET_ELEM_LIST_ELEMENTS netlink attributes with no elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add range expressionPablo Neira Ayuso2016-10-133-0/+291
| | | | | | | | Add range expression available that is scheduled for linux kernel 4.9. This range expression allows us to check if a given value placed in a register is within/outside a specified interval. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: complete log flags supportLiping Zhang2016-10-041-5/+30
| | | | | | | | | If NFTNL_EXPR_LOG_FLAGS is not set, it's unnecessary to print out the flags value. Furthermore, it's better to print out string message instead of the hex value. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: do not print prefix if it is not setLiping Zhang2016-10-041-2/+4
| | | | | | | | This will avoid the following ugly display output: [ log prefix (null) ] Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: fix typo in nftnl_expr_log_exportLiping Zhang2016-10-041-1/+1
| | | | | | | | After test NFTNL_EXPR_LOG_FLAGS is set, we should put "log->flags" instead of "log->level". Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: display offset only if present in hash and numgen expressionsPablo Neira Ayuso2016-09-232-9/+18
| | | | | | So nft payload python tests don't break. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove libmxml supportArturo Borrero2016-09-2335-2034/+29
| | | | | | | | | | | | | | | | | | | This patch removes the libmxml integration in libnftnl, since we have JSON in place and there is no need to support two at the same time. The JSON support is much better, for example libjansson has a better parsing error reporting. Moreover, libmxml 2.10 breaks the integration with libnftnl somehow, as reported in Debian bug #83870 [0]. Also, the XML support inside libnftnl has never been in good shape, with several tiny inconsitencies. [0] https://bugs.debian.org/838370 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: add NFTA_QUEUE_SREG_QNUM attr supportLiping Zhang2016-09-221-7/+50
| | | | | | | | | | After adding _SREG_QNUM attr, queuenum is not must option anymore, so we must test NFTNL_EXPR_QUEUE_NUM first before dumpping queue num in snprintf_default. Also add a tailing space in snprintf_default, this is consistent with other expressions. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: add number generation offsetLaura Garcia Liebana2016-09-221-6/+33
| | | | | | | | | | | | | | | | Add support to pass through an offset value to the counter initialization. With this feature, the sysadmin is able to apply a value to be added to the generated number. Example: meta mark set numgen inc mod 2 offset 100 This will generate marks with series 100, 101, 100, 101, ... Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: hash: Add offset to hash valueLaura Garcia Liebana2016-09-121-6/+33
| | | | | | | | | | | | | | | | Add support to pass through an offset to the hash value. With this feature, the sysadmin is able to generate a hash with a given started value. Example: meta mark set jhash ip saddr mod 2 seed 0xabcd offset 100 This option generates marks according to the source address from 100 to 101. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: remove redundant NFTNL_EXPR_QUEUE_NUM set in json parseLiping Zhang2016-09-121-1/+0
| | | | | | | | We have already set NFTNL_EXPR_QUEUE_NUM when parse "num" successfully, here is wrong and redundant, remove it. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: Rename until attribute by modulusLaura Garcia Liebana2016-09-071-28/+28
| | | | | | | | | | | The _modulus_ attribute will be reused as _until_, as it's similar to other expressions with value limits (ex. hash). Renaming is possible according to the kernel module ntf_numgen that has not been released yet. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* trace: use get_u32 to parse NFPROTO and POLICY attributeLiping Zhang2016-09-021-2/+2
| | | | | | | | NFTA_TRACE_NFPROTO and NFTA_TRACE_POLICY attribute is 32-bit value, so we should use mnl_attr_get_u32 and htonl here. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* include: resync nf_tables.h cache copyPablo Neira Ayuso2016-09-022-2/+4
| | | | | | | | | | Sync this with the kernel header file we currently have in tree. This patch addresses the compilation warning and breakage as result of this header update, specifically the "attibute" typo in trace and missing default case in expr/numgen.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix incorrect maximum set description attributePablo Neira Ayuso2016-08-301-1/+1
| | | | | | | Maximum set description attribute is NFTA_SET_DESC_MAX, instead of NFTA_SET_MAX. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: add missing nftnl_expr_ng_cmp()Pablo Neira Ayuso2016-08-301-0/+18
| | | | | | | | This patch adds the missing comparator interface, most likely due to race between the patchset that has added this and the introduction of numgen. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: hash: missing trailing space and modulus in hexadecimal in snprintfPablo Neira Ayuso2016-08-301-1/+1
| | | | | | | | | | | | Before patch: [ hash reg 1 = jhash(reg 2, 8, 3735928559) % modulus 2] After patch: [ hash reg 1 = jhash(reg 2, 8, 0xdeadbeef) % mod 2 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: add missing trailing whitespacePablo Neira Ayuso2016-08-301-2/+2
| | | | | | | | | | | | Before patch: [ numgen reg 1 = inc(2)] After patch: [ numgen reg 1 = inc(2) ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: use switch to handle numgen types from snprintfPablo Neira Ayuso2016-08-301-4/+5
| | | | | | Use switch instead of if branch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: immediate: Fix verdict comparisonCarlos Falgueras García2016-08-261-2/+9
| | | | | | | | | | | | An immediate expression of type 'DATA_VERDICT' can have set a chain (jump or goto), in this cases we must compare its 'union nftnl_data_reg' using 'DATA_CHAIN' flag instead of 'DATA_VERDICT' Before this patch compare expressions "jump -> chain_a" and "jump -> chain_b" returns they are equals. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: data_reg: Fix DATA_CHAIN comparisonCarlos Falgueras García2016-08-241-0/+1
| | | | | | | | Split DATA_VERDICT and DATA_CHAIN comparison. A verdict can have a NULL chain (accept, drop, etc) so segfault will happen when strcmp is called. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add number generation expressionLaura Garcia Liebana2016-08-223-0/+254
| | | | | | | Support for the nft ng expression within libnftnl. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add quota expressionPablo Neira Ayuso2016-08-223-0/+213
| | | | | | This patch adds support for the new quota expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Fix comparison between rules if number of expressions differCarlos Falgueras García2016-08-181-0/+1
| | | | | | | | | | | | | | Before this patch, comparison between rules with distinct number of expressions indicate that they are equals, however, they are not. Example: r1[e1, e2] == r2[e1, e2, e3] Fix this by checking that the number of expression is the same. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Implement rule comparisonCarlos Falgueras García2016-08-1727-0/+522
| | | | | | | | | | | | | | | | | | | | This patch implements the function: bool nftnl_rule_cmp(const struct nftnl_rule *r1, const struct nftnl_rule *r2) for rule comparison. Expressions within rules need to be compared, so also has been created the function: bool nftnl_expr_cmp(const struct nftnl_expr *e1, const struct nftnl_expr *e2); Also includes all expression comparators. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add hash expressionLaura Garcia Liebana2016-08-173-0/+297
| | | | | | | Support for the nft hash expression in libnftnl. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: cmp: Use cmp2str() instead of directly access to arrayCarlos Falgueras García2016-08-151-1/+1
| | | | | | | Uses cmp2str() which checks array bounds. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: Fix out of bound access in nftnl_family2strCarlos Falgueras García2016-08-151-1/+1
| | | | | | | Checks array limits before access it and adds a missed translation. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "common: Avoid integer overflow in nftnl_batch_is_supported()"Pablo Neira Ayuso2016-08-121-3/+0
| | | | | | | | | This patch accidentally slipped through. The sequence number (uint32_t)-1 is fine in case time() fails. So this reverts commit d26feca2c9c19b650b5a7554b5a412ceca990b7a. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: Initialize ctx.flags before calling nftnl_ruleset_ctx_set()Phil Sutter2016-08-121-0/+2
| | | | | | | The called function otherwise accesses uninitialized data. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Avoid returning uninitialized dataPhil Sutter2016-08-124-4/+4
| | | | | | | | | Although the 'err' pointer should be interesting for users only if the parser returned non-zero, having it point to uninitialized data is generally a bad thing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* common: Avoid integer overflow in nftnl_batch_is_supported()Phil Sutter2016-08-121-0/+3
| | | | | | | | | | | time() may return -1 which is then assigned to an unsigned integer type and used as sequence number. The following code increments that number multiple times, so it may overflow and get libmnl confused. To avoid this, fall back to a starting sequence number of zero in case the call to time() failed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr/limit: Drop unreachable code in limit_to_type()Phil Sutter2016-08-121-1/+0
| | | | | | | | | The function returns from inside the switch() in any case, so the final return statement is never reached. Fixes: 7769cbd9dfe69 ("expr: limit: add per-byte limiting support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr/ct: prevent array index overrun in ctkey2str()Phil Sutter2016-08-121-1/+1
| | | | | | | | | | The array has NFT_CT_MAX fields, so indices must be less than that number. Fixes: 977b7a1dbe1bd ("ct: xml: use key names instead of numbers") Cc: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: prevent memleak in nftnl_jansson_parse_set_info()Phil Sutter2016-08-121-5/+5
| | | | | | | | | During list populating, in error case the function returns without freeing the newly allocated 'elem' object, thereby losing any references to it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: Fix lookup builderCarlos Falgueras García2016-08-101-2/+1
| | | | | | Deleted wrong braces that cause unwanted behaviour. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
* rule: Implement internal iterator for expressionsCarlos Falgueras García2016-08-101-6/+12
| | | | | | | Introduce nftnl_expr_iter_init() to allow stack allocated iterators for internal use. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
* src: Constify iteratorsCarlos Falgueras García2016-08-105-18/+25
| | | | | | | | Iterators do not modify objects which they iterate, so input pointer must be const. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't set data_len to zero when returning pointersPablo Neira Ayuso2016-08-012-2/+0
| | | | | | | | nft already assumes that passing NULL as data_len is valid, otherwise it crashes. Fix this by leave data_len unset in this specific case. Fixes: bda7102 ("src: Fix nftnl_*_get_data() to return the real attribute length") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>