summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Bump version to v0.4v0.4Pablo Neira Ayuso2014-12-151-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: missing byteorder in string_typePablo Neira Ayuso2014-12-151-0/+1
| | | | | | | | | | | | | | nft add rule filter input iifname { "lo", "eth0" } counter Now the listing shows: iifname { "lo", "eth0"} instead of: iifname { "", ""} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: restore --disable-debugPablo Neira Ayuso2014-12-152-5/+10
| | | | | | | | Fix fallout from the automake conversion. Display after configuration if it is enabled or not. Reported-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: log.t: this works for bridge and arp since 3.17Pablo Neira Ayuso2014-12-141-5/+4
| | | | | | | So tests log statement for those two families too and remove the tests/selectors that are ip and ip6 specific, they don't belong here. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: simplify run_test_file() in case `-e' is usedPablo Neira Ayuso2014-12-141-15/+1
| | | | | | | Avoid copy&paste coding style pattern by simplifying the code that handles the `-e' option that allows us to run known broken tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix wrong number of test filesPablo Neira Ayuso2014-12-141-1/+2
| | | | | | Always increment the test file counter for each test file in the list. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: use 'redirect to PORT' instead of 'redirect :PORT'Pablo Neira Ayuso2014-12-125-24/+26
| | | | | | Small syntax update suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: redirect.t: fix bogus errorsPablo Neira Ayuso2014-12-122-2/+2
| | | | | | | Separate values in set, otherwise bash interprets the brackets and the test reports an error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: adapt nat tests to use random-fullyPablo Neira Ayuso2014-12-124-27/+27
| | | | | | | This adapts test to the change that happened in d9a9a79 ('stmt: rename nat "random-fully" option to "fully-random"'). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: print datatype name in datatype_print() BUG messagePatrick McHardy2014-12-111-1/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* dtype: fix memory leak in concat_type_destroy()Patrick McHardy2014-12-111-1/+3
| | | | | | Free allocated memory for ->desc. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: properly align types in meta_template tablePatrick McHardy2014-12-111-5/+5
| | | | | | | Don't use arbitrary amounts of spaces. The remaining table is properly aligned, fix the new types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* stmt: rename nat "random-fully" option to "fully-random"Patrick McHardy2014-12-113-4/+4
| | | | | | Use proper english for full randomization option. Signed-off-by: Patrick McHardy
* dtype: remove unnecessary icmp* parse/print functionsPatrick McHardy2014-12-101-39/+3
| | | | | | Just setting the .sym_tbl correctly is all we need. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix segmentation faults on kernels without nftables supportPablo Neira Ayuso2014-12-091-3/+4
| | | | | | | | | | | | | | | | # nft list sets Segmentation fault # nft list sets <cmdline>:1:1-9: Error: Could not receive sets from kernel: Protocol error list sets ^^^^^^^^^ Fix same bug in `nft list tables'. Don't cleanup the table object for these commands since it is NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix listing of range set elements in host byteorderPablo Neira Ayuso2014-12-091-1/+3
| | | | | | | | | | | We have to switch the byteorder of the element in netlink_delinearize_setelem() for non-range values only. This fixes the listing of: nft add rule filter input ct mark { 0x10-0x20 } counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix listing of set members in host byteorder using ↵Pablo Neira Ayuso2014-12-091-0/+29
| | | | | | | | | | integer_type nft list table filter ... cpu { 50331648, 33554432, 0, 16777216} counter packets 8 bytes 344 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: generate set members using integer_type in the appropriate byteorderPablo Neira Ayuso2014-12-092-3/+17
| | | | | | | | | | | | | | | | Rules with header fields that rely on the generic integer datatype from sets are not matching, eg. nft add rule filter input udp length { 9 } counter This set member is an integer represented in host byte order, which obviously doesn't match the header field (in network byte order). Since the integer datatype has no specific byteorder, we have to rely on the expression byteorder instead when configuring the context, before we evaluate the list of set members. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix endianess issue in payload_expr_pctx_update()Pablo Neira Ayuso2014-12-052-4/+4
| | | | | | | | Use constant_data_ptr() to point to the right memory position on big endian when exporting data that is stored in a larger variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Christophe Leroy <christophe.leroy@c-s.fr>
* datatype: fix name of icmp* codeEric Leblond2014-12-031-3/+3
| | | | | | | | | | | | The name of datatypes can be used in set definition so they should follow the same logic (and maybe not contain space to avoid problem with parsing). This patch adds an underscore to the name of the icmp* code datatype. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: don't bug on too large valuesPablo Neira Ayuso2014-12-012-5/+22
| | | | | | | | | | | | | Add a new ERROR symbol to handle scanning of too large values. <cmdline>:1:36-99: Error: bad value '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' add rule ip test-ip4 input ct mark 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ instead of: BUG: nft: scanner.l:470: nft_lex: Assertion `0' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: any/ct: remove wrong outputPablo Neira Ayuso2014-12-011-2/+2
| | | | | | | | | | | | | | | | | ct mark 0x32-0x45 displays: ct mark >= 0x00000032 ct mark <= 0x00000045 ^^^^^^^^^^ instead of ct mark <= 0x45000000 ^^^^^^^^^^ Remove the custom output so this displays a warning. nft should (at some point) merge the two statements into one single to express the range from the netlink_delinearize step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix "Listing is broken" instead of output mismatchPablo Neira Ayuso2014-12-011-9/+6
| | | | | | | If the output string doesn't match the input, indicate that the output mismatches instead of the misleading "Listing is broken". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: set base field on clonesPablo Neira Ayuso2014-12-011-0/+1
| | | | | | Set missing field on meta expression clone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: clone on netlink_get_register(), release previous on _set()Pablo Neira Ayuso2014-12-011-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | If we add this rule: nft add rule filter input meta length 33-55 the listing shows: meta length >= 33 meta length <= 754974720 The two meta statements share the same left-hand side, thus, only the first one is converted from network byte order to host byte order. Update netlink_get_register() to return a clone so each left-hand side has its own left-hand side. Moreover, release the existing register before overriding it with fresh expressions in netlink_set_register(). Thefore, if you manipulate a register from any of the existing parse functions, you have to re-set it again to place fresh modified clone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: fix reading of really long lineEric Leblond2014-12-011-1/+2
| | | | | | | | | | | | | | | Current code is causing a failure in adding a set containing a really long list of elements. The failure occurs as soon as the line is longer than flex read buffer. When a line is longer than scanner buffer size, the code in YY_INPUT forces a rewind to the beginning of the string because it does not find a end of line. The result is that the string is never parsed. This patch updates the code by rewinding till we found a space. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: relax datatype check in integer_type_parse()Pablo Neira Ayuso2014-11-304-44/+5
| | | | | | | | | | | | | | | | Otherwise parsing with basetypes doesn't work. Now nft displays an error when the symbolic constant is not correct: <cmdline>:1:29-31: Error: Could not parse conntrack state add rule test test ct state xxx accept ^^^ Use .sym_tbl instead and default on the symbol_constant_parse() function from the ethertype and pkttype, this simplifies the code and (more importantly) it avoids a breakage after the change in integer_type_parse(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix crash when using basetype instead of symbolic constantsPablo Neira Ayuso2014-11-282-13/+21
| | | | | | | | | | | | | | | | | | | | The following example: # nft add rule filter input ct state 8 accept Segmentation fault leads to a crash because we have the following datatype relation: ct_state -> bitmask -> integer The bitmask, which is an intermediate basetype, has no parse() function, this leads to a crash in symbolic_constant_parse(). Patrick suggested to walk down the chain until we find a parser function. Reported-by: leroy christophe <christophe.leroy@c-s.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix crash on NULL location with bridge and tcp resetAlvaro Neira2014-11-261-1/+1
| | | | | | | | | | | | | | | | | If we use tcp reset with a network protocol that tcp is not supported, we display an error. This error use the reject.expr location which is NULL, therefore we have a crash. This patch replaces it using the reject statement to display the error like: Rule: nft add bridge filter input ether type vlan reject with tcp reset Output: <cmdline>:1:46-51: Error: cannot reject this ether type add rule bridge filter input ether type vlan reject with tcp reset ~~~~~~~~~~~~~~~ ^^^^^^ Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add missing \ in src/Makefile.am (AM_CPPFLAGS)David Kozub2014-11-251-1/+1
| | | | | | | | The missing \ at the end of the line causes LIBMNL_CFLAGS and LIBNFTNL_CFLAGS to be ignored. This causes build failure if the libmnl or libnftnl headers are not in a path that's already searched by the C compiler. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: test masquerade from nat/postrouting tooPablo Neira Ayuso2014-11-242-0/+2
| | | | | | | We can specify several chains in the tests, so test this from postrouting too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix bogus error due to bashPablo Neira Ayuso2014-11-243-4/+4
| | | | | | | | | | | | | | This suppresses several superfluous errors: any/meta.t: ERROR: line 168: nft add rule ip test-ip4 input meta iifgroup {11,33}: This rule should not have failed. any/meta.t: ERROR: line 178: nft add rule ip test-ip4 input meta oifgroup {11,33}: This rule should not have failed. ip/masquerade.t: ERROR: line 23: nft add rule ip4 test-ip4 output tcp dport {1,2,3,4,5,6,7,8,101,202,303,1001,2002,3003} masquerade: This rule should not have failed. ip6/masquerade.t: ERROR: line 23: nft add rule ip6 test-ip6 output tcp dport {1,2,3,4,5,6,7,8,101,202,303,1001,2002,3003} masquerade: This rule should not have failed. This needs a space before the list of elements in the set, otherwise bash here misinterprets the set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: don't use -nnn for non-list commandsPablo Neira Ayuso2014-11-231-3/+3
| | | | | | Not useful, they just bloat the nft-tests.py output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: any/queue.t: use new syntaxPablo Neira Ayuso2014-11-231-1/+1
| | | | | | | queue options are now expressed as flags, so you have to use comma separated values. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: restore named vmapPablo Neira Ayuso2014-11-231-0/+11
| | | | | | | | | | | For example: nft add map filter my_vmap { type ipv4_addr : verdict\; } nft add element filter my_vmap { 1.0.0.0 : drop} nft add rule filter input ip saddr vmap @my_vmap Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: restore nft --debugPablo Neira Ayuso2014-11-231-1/+1
| | | | | | | | Add -DDEBUG to enable --debug option by default as it used to be before the autotools conversion. Fixes: 5fa8e49 ("build: autotools conversion") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't bug on unknown eventsPablo Neira Ayuso2014-11-141-4/+1
| | | | | | | | | | | | | | | | We will likely have new ones in the future, silently skip them. If the user wants to see them, it just needs to upgrade. This is currently causing us problems with kernels that deliver the generation counter event. term1# nft add table test term2# nft monitor nft: netlink.c:2063: netlink_events_cb: Assertion `0' failed. Aborted Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add autotools support for the 'files' subdirGiorgio Dal Molin2014-11-1213-14/+26
| | | | | | | | Added support to install some 'nft' scripts under '${sysconfdir}/nftables', typically '/etc/nftables'. Signed-off-by: Giorgio Dal Molin <giorgio.nicole@arcor.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add autotools support for the 'doc' subdirGiorgio Dal Molin2014-11-124-42/+38
| | | | | | | | | | | | | | | | | | | | 'nft' documentation is originally contained in the XML file 'doc/nft.xml'. Processing this file with the proper tools we can obtain a PDF document, 'nft.pdf', and a unix man page, 'nft.8'. To produce the PDF we need the tool 'dblatex' (current release pypi.python.org/pypi/dblatex/0.3.5). To produce the man page we use the tool 'docbook2man'; it is part of the package 'docbook2X' (docbook2x.sourceforge.net). On some linux distributions the tool can have slightly different names as 'docbook2x-man' or 'db2x_docbook2man' so we search for all three names and use the first one found and issue the command: # ${DB2MAN} --xinclude $< Signed-off-by: Giorgio Dal Molin <giorgio.nicole@arcor.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: autotools conversionPablo Neira Ayuso2014-11-1217-451/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) This removes former Makefiles and install-sh (which is now automagically imported via autoreconf). Makefile.defs.in Makefile.in Makefile.rules.in src/Makefile.in install-sh (now automagically imported via autoreconf). 2) CFLAGS are left almost same, they are integrated into Make_global.am. Use AM_CPPFLAGS to set the CFLAGS set by pkgconfig. 3) Add m4 directory to the tree which only contains the .gitignore file. Update .gitignore file to skip autogenerated files. 4) include <config.h> whenever required. 5) Minor adjustments to scanner.l and parser_bison.y to compile cleanly with autotools. 6) Add %option outfile=lex.yy.c to scanner.l, otherwise I hit this error here: gcc -DHAVE_CONFIG_H -I. -I.. -I../include -DDEFAULT_INCLUDE_PATH="\"/usr/etc\"" -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wdeclaration-after-statement -Wsign-compare -Winit-self -Wformat-nonliteral -Wformat-security -Wmissing-format-attribute -Wcast-align -Wundef -Wbad-function-cast -g -O2 -MT mnl.o -MD -MP -MF $depbase.Tpo -c -o mnl.o mnl.c &&\ mv -f $depbase.Tpo $depbase.Po /bin/sh ../build-aux/ylwrap scanner.l lex.yy.c scanner.c -- flex make[3]: *** [scanner.c] Error 1 make[3]: Leaving directory `/home/pablo/devel/scm/git-netfilter/nftables/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/pablo/devel/scm/git-netfilter/nftables/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/pablo/devel/scm/git-netfilter/nftables' make: *** [all] Error 2 7) Add Makefile.am for include/ (contributed by Giorgio Dal Molin). The doc/ and files/ conversion to automake will come in follow up patches but 'make distcheck' already works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add cli.hPablo Neira Ayuso2014-11-104-12/+22
| | | | | | Needed by follow up patches to use autotools. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rename parser.y to parser_bison.yPablo Neira Ayuso2014-11-103-4/+4
| | | | | | | | | The conversion to the autotools need this. Make sure you remove the autogenerated parser.c and parser.h from your tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use AC_PROG_YACC and AM_PROG_LEXPablo Neira Ayuso2014-11-101-12/+15
| | | | | | To check for bison and flex installed on the system. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use PKG_CHECK_MODULES to check for libmnl and libnftnlPablo Neira Ayuso2014-11-102-6/+3
| | | | | | Also check for required library versions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add cgroup support in meta expresionAna Rey2014-11-105-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | The new attribute of meta is "cgroup". Example of use in nft: # nft add rule ip test output meta cgroup != 0x100001 counter drop Moreover, this adds tests to the meta.t test file. The kernel support is addedin the commit: ce67417 ("netfilter: nft_meta: add cgroup support") The libnftnl support is add in the commit: 1d4a480 ("expr: meta: Add cgroup support") More information about the steps to use cgroup: https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt More info about cgroup in iptables: http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3 Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh cached copy of nf_tables.hPablo Neira Ayuso2014-11-101-4/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow both nat_flags and port specification in redirectArturo Borrero2014-11-093-8/+19
| | | | | | | | | | | | | | | | | | | | | | | | | This patch changes the parser to permit both nat_flags and port specification in the redirect expression. The resulting syntax is: % nft add rule nat prerouting redirect [port] [nat_flags] The port specification requires a bit of context regardin the transport protocol. Some examples: % nft add rule nat prerouting tcp dport 22 redirect :23 % nft add rule add prerouting udp dport 53 redirect :5353 The nat_flags argument is the last argument: % nft add rule nat prerouting tdp dport 80 redirect :8080 random The port specification can be a range: % nft add rule nat prerouting tcp dport 80 redirect :8080-8090 random While at it, the regression tests files are updated. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/regression: redirect: fix invalid syntaxArturo Borrero2014-11-092-55/+55
| | | | | | | | | This patch fixes invalid syntax in the redirect test files. I used ' ;ok' instead of ';ok', and ' ;nok' instead of ';fail'. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/regression: masquerade: fix invalid syntaxArturo Borrero2014-11-092-34/+34
| | | | | | | | | This patch fixes invalid syntax in the masquerade test files. I used ' ;ok' instead of ';ok', and ' ;nok' instead of ';fail'. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't resolve hostnames by defaultArturo Borrero2014-11-064-8/+28
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes the default behaviour of nft to not translate IP addresses to hostnames when printing rules if no options are passed. The options regarding translations after this patch are: <no -n/-N> show IP addresses numerically (default behaviour) -n show IP addresses numerically -nn show Internet services and uid/gid numerically -nnn show protocols numerically -N (--reversedns) translate IP addresses to names The idea is to avoid breaking existing scripts that most likely rely on '-n' to save the ruleset, so we reduce the impact of this patch and provide a default behaviour that doesn't generate network traffic when listing / saving the ruleset. Joint work with Pablo. Suggested-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>