summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: fix old parameters and update datatypesv0.6Laura Garcia Liebana2016-06-021-8/+8
| | | | | | | | Fix old identifiers like 'ipcomp' and 'op' with 'comp' and 'operation' instead. Update some FIXME datatypes. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Bump version to v0.6Pablo Neira Ayuso2016-06-011-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix "list set" unexpected behaviourPablo M. Bermudo Garay2016-06-011-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Special sets like maps and flow tables have their own commands to be listed and inspected. Before this patch, "nft list set" was able to display these special sets content: # nft list set filter test table ip filter { map test { type ipv4_addr : inet_service elements = { 192.168.1.101 : http-alt} } } Now an error is shown: # nft list set filter test <cmdline>:1:1-20: Error: Could not process rule: Set 'test' does not exist list set filter test ^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix compression parameter indexLaura Garcia Liebana2016-06-011-1/+1
| | | | | | | Fix the compression parameter index 'cpi' instead of 'cfi'. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for display maps contentPablo M. Bermudo Garay2016-05-314-0/+17
| | | | | | | | | | | | | | | | | | | | | | | This commit adds a new command that displays the definition of a single map: # nft list map [family] <table> <map> If no family is specified, ip is assumed. Example: # nft list map ip6 filter test table ip6 filter { map test { type ipv6_addr : inet_service elements = { 2001:db8::ff00:42:8329 : http} } } Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'list maps' supportPablo M. Bermudo Garay2016-05-315-1/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new command that lists maps: # nft list maps [family] Only the declaration is displayed. If no family is specified, all maps of all families are listed. Example: # nft list maps table ip filter { map test { type ipv4_addr : inet_service } } table ip6 filter { map test { type ipv6_addr : inet_service } } Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: cap comment length to 128 bytesCarlos Falgueras García2016-05-302-0/+7
| | | | | | | | | | | | | | | | | | | Pablo rewrites this description to: "The user data area available is 256 bytes (NFT_USERDATA_MAXLEN). We plan to allow storing other useful information such as datatypes in set elements, so make sure there is room for this." Example: > nft add table t > nft add chain t c > nft add rule t c ip saddr 1.1.1.1 counter comment "abc...xyz" # len > 128 <cmdline>:1:47-N: Error: Comment too long. 128 characters maximum allowed add rule t c ip saddr 1.1.1.1 counter comment abc...xyz ^^^^^^^^^ Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Consolidate comment productionCarlos Falgueras García2016-05-301-10/+15
| | | | | | | Use comment_spec both from rule and set element productions. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix crash if we add a chain with an error chain typeLiping Zhang2016-05-301-2/+4
| | | | | | | | | | | | | If we add a chain and specify the nonexistent chain type, chain_type_name_lookup will return a NULL pointer, and meet the assert condition in xstrdup. Fix crash like this: # nft add chain filter input {type none hook input priority 0\;} nft: utils.c:63: xstrdup: Assertion `s != ((void *)0)' failed. Aborted (core dumped) Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix a format error display when we set priority to root or noneLiping Zhang2016-05-301-2/+4
| | | | | | | | | | | | | | | | | | Also delete the redundant '\n'. This fixes: # nft add rule filter test meta priority set root # nft list chain filter test table ip filter { chain test { meta priority set root none ffff:ffff } } Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix endianness in priorityLiping Zhang2016-05-301-1/+1
| | | | | | | | | | | | | | | | For example, after we add rule to set priority 1:2, it will be displayed in network byte order as 0200:0100, this is wrong: # nft add rule filter test meta priority set 1:2 # nft list chain filter test table ip filter { chain test { meta priority set 0200:0100 } } Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: Use libnftnl/udata to store set element commentCarlos Falgueras García2016-05-301-4/+46
| | | | | | | | | The set element comment is stored in nftnl_set_elem->user.data using libnftnl/udata infrastructure. This allows store multiple variable length user data into set element. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinerize: don't use meta_match_postprocess for ct ppFlorian Westphal2016-05-251-7/+29
| | | | | | | | | | | meta_match_postprocess uses meta.base which is only accessible if left expression has EXPR_META type, so we can't use it to handle ct postprocessing. To reduce copy-pastry factor the common part into ct_meta_common_postprocess(), then call that from both meta and ct postprocessing. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: do not duplicate user data when linearizing user dataCarlos Falgueras García2016-05-251-8/+3
| | | | | | | | | | | | | Otherwise, we memory leak this area since nftnl_rule_set_data() now makes a copy of the user data which receives. This is happening since libnftnl's ("rule: Fix segfault due to invalid free of rule user data"), it is not necessary make a copy before call it. Note: Carlos originally posted this patch under the name of ("nftables: Fix memory leak linearizing user data"). Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add support for display flow tables contentPablo M. Bermudo Garay2016-05-204-0/+18
| | | | | | | | | | This commit adds a new command that displays the definition of a single flow table: If no family is specified, ip is assumed. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add 'list flow tables' supportPablo M. Bermudo Garay2016-05-204-2/+20
| | | | | | | | | | | | This commit adds a new command that lists flow tables: # nft list flow tables [family] Only the declaration is displayed. If no family is specified, all flow tables of all families are listed. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix crash if we add an error format ruleLiping Zhang2016-05-141-1/+1
| | | | | | | | | | | If we add a such nft rule: nft add rule filter input ip protocol icmp tcp dport 0 we will always meet the assert condition: nft: evaluate.c:536: resolve_protocol_conflict: Assertion `base < (__PROTO_BASE_MAX - 1)' failed. Aborted (core dumped) Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: add tests for frag more-fragments and frag reserved2Pablo Neira Ayuso2016-05-133-21/+44
| | | | | | | While at it, get rid of bug comments on ip6/frag.t, since they are not valid anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: constify nlexpr field in location structurePablo Neira Ayuso2016-05-131-1/+1
| | | | | | | | | | | | The location shouldn't ever alter the expression. And this fixes this compilation warning: netlink_delinearize.c: In function ‘netlink_parse_expr’: netlink_delinearize.c:1008:10: warning: assignment discards ‘const’ qualifier from pointer target type loc.nle = nle; ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: update flow table syntaxPablo Neira Ayuso2016-05-132-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before we release next nft version, update the syntax to wrap the flow table definition between brackets, eg. # nft add rule filter input tcp dport 22 ct state new \ flow table ssh { ip saddr limit rate 10/second } # nft add rule filter input \ flow table acct { iif . ip saddr timeout 60s counter } When playing around with this in your initial patchset I found very confusing that it may not look obvious to users that they can only use one single statement. For example: # nft add rule filter input \ flow table acct iif . ip saddr timeout 60s counter limit rate 10/second ~~~~~~~~~~~~~~~~~~~~ Note that this limit rate applies globally, so this patch resolves this ambiguity. This may cause us problems in the future too if we extend this to support more than one single statement per flowtable entry (Not telling we need this now, but if someone comes up with a useful usecase, we should be capable of extending this). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flow statementPatrick McHardy2016-05-1312-12/+245
| | | | | | | | | | | | | | | The flow statement allows to instantiate per flow statements for user defined flows. This can so far be used for per flow accounting or limiting, similar to what the iptables hashlimit provides. Flows can be aged using the timeout option. Examples: # nft filter input flow ip saddr . tcp dport limit rate 10/second # nft filter input flow table acct iif . ip saddr timeout 60s counter Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* stmt: support generating stateful statements outside of rule contextPatrick McHardy2016-05-133-32/+61
| | | | | | | | | | The flow statement contains a stateful per flow statement, which is not directly part of the rule. Allow generating these statements without adding them to the rule and mark the supported statements using a new flag STMT_F_STATEFUL. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: support parsing statements not contained within a rulePatrick McHardy2016-05-132-29/+43
| | | | | | | | Return the parsed statement instead of adding it to the rule in order to parse statements contained in the flow statement. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: update for changed set name in payloadPablo Neira Ayuso2016-05-1376-1917/+1917
| | | | | | | Original patch posted in the mailing list from Patrick, I have refreshed this so it applies on top of current HEAD. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: explicitly supply name to implicit set declarationsPatrick McHardy2016-05-131-3/+6
| | | | | | | | | | Support explicitly names implicitly declared sets. Also change the template names for literal sets and maps to use identifiers that can not clash with user supplied identifiers. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: allow non-constant implicit set declarationsPatrick McHardy2016-05-131-1/+3
| | | | | | | | | | Currently all implicitly declared sets are marked as constant. The flow statement needs to implicitly declare non-constant sets, so instead of unconditionally marking the set as constant, only do so if the declaring expression is itself a constant set. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: declare interval_map_decompose() from header filePablo Neira Ayuso2016-05-133-4/+1
| | | | | | Instead of having several extern function declarations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: several function constificationsPablo Neira Ayuso2016-05-132-16/+16
| | | | | | | | | | Constify: * netlink_dump*() * netlink_delinearize_*() * netlink_add_rule_list() Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell/run-tests.sh: print hint about testcase being executedArturo Borrero2016-05-131-0/+4
| | | | | | | | | | | Print a line with the name of the testcase being executed, and then delete it with the result. There are tests which may take a long time and its good to know what is doing the testsuite. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell/run-tests.sh: execute tests in sorted orderArturo Borrero2016-05-131-1/+6
| | | | | | | | | Let's sort tests files before iterating over them. Put the find string in a separated function so it's more readable. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add testcase to catch segfault if invalid syntax was usedArturo Borrero2016-05-131-0/+21
| | | | | | | | This helps to catch 5afa5a1 ("evaluate: check for NULL datatype in rhs in lookup expr"). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add testcase for 'nft -f' load with actionsArturo Borrero2016-05-131-0/+68
| | | | | | | Let's tests loading a ruleset with actions. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check for NULL datatype in rhs in lookup exprArturo Borrero2016-05-131-9/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we are evaluating an EXPR_SET_REF, check if right->dtype is not NULL. We can hit SEGFAULT if for whatever reason the referenced object does not exist. Using this testfile (note the invalid set syntax): % cat test.nft flush ruleset add table t add chain t c add set t s {type ipv4_addr\;} add rule t c ip saddr @s Without this patch: % nft -f test.nft Segmentation fault With this patch: % nft -f test.nft t.nft:4:28-28: Error: syntax error, unexpected junk, expecting newline or semicolon add set t s {type ipv4_addr\;} ^ t.nft:4:13-29: Error: set definition does not specify key data type add set t s {type ipv4_addr\;} ^^^^^^^^^^^^^^^^^ t.nft:5:23-24: Error: the referenced set does not exist add rule t c ip saddr @s ~~~~~~~~ ^^ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: fix payload of dccp type in set elementsPablo Neira Ayuso2016-05-114-4/+4
| | | | | | This value needs to be lshift one bit to be correct. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: fix fragment-offset fieldPablo Neira Ayuso2016-05-112-4/+4
| | | | | | | | | | | | | | | | | Set elements were miscalculated. After this patch: element 00000801 : 0 [end] ^^^^ Which looks correct according to my calculations: >>> print hex(socket.htons(33 << 3)) 0x801 ^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing netdev ip dscp payload testsPablo Neira Ayuso2016-05-111-0/+43
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ecn supportPablo Neira Ayuso2016-05-116-3/+51
| | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule ip filter forward ip ecn ce counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000003 ] [ counter pkts 0 bytes 0 ] For IPv6: # nft --debug=netlink add rule ip6 filter forward ip6 ecn ce counter ip6 filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000030 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000030 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dscp supportPablo Neira Ayuso2016-05-1112-17/+225
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: remove priority field definition from IPv6 headerPablo Neira Ayuso2016-05-112-9/+0
| | | | | | This is actually part of the traffic class field according to RFC2460. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: update IPv6 flowlabel offset and length according to RFC2460Pablo Neira Ayuso2016-05-114-2/+10
| | | | | | This is a 20 bit field according to Section 3. IPv6 Header Format. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: handle payload matching split in two bytesPablo Neira Ayuso2016-05-111-8/+16
| | | | | | | | | | | | | | When the bits are split between two bytes and the payload field is smaller than one byte, we need to extend the expression length on both sides (payload and constant) of the relational expression. The existing trimming from the delinerization step handles the listing for us, so no changes on that front. This patch allows us to match the IPv6 DSCP field which falls into the case that is described above. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move payload sub-byte matching to the evaluation stepPablo Neira Ayuso2016-05-112-107/+97
| | | | | | | | | | | | | | | | | | | | Generating the bitwise logic to match sub-byte payload fields from the linearize step has several problems: 1) When the bits are split between two bytes and the payload field is smaller than one byte, we need to extend the expression length on both sides (payload and constant) of the relational expression. 2) Explicit bitmask operations on sub-byte payload fields need to be merge to the implicit bitmask operation, otherwise we generate two bitwise instructions. This is not resolved by this patch, but we should have a look at some point to this. With this approach, we can benefit from the binary operation transfer for shifts to provide a generic way to adjust the constant side of the expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: transfer right shifts to set reference sidePablo Neira Ayuso2016-05-112-6/+94
| | | | | | | | This provides a generic way to transfer shifts from the left hand side to the right hand range side of a relational expression when performing transformations from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: transfer right shifts to range sidePablo Neira Ayuso2016-05-111-0/+12
| | | | | | | | This provides a generic way to transfer shifts from the left hand side to the right hand range side of a relational expression when performing transformations from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: transfer right shifts to constant sidePatrick McHardy2016-05-111-4/+26
| | | | | | | | | This provides a generic way to transfer shifts from the left hand side to the right hand constant side of a relational expression when performing transformations from the evaluation step. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* dist: include tests/ directory and files in tarballArturo Borrero2016-04-291-0/+2
| | | | | | | | | | | If we include tests/ in the release tarball, downstream distributors can run the testsuites themselves while developing the packages. This way, tests can be run in a more integrated environment and they can discover errors related to the integration with the given distribution itself. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: allow to run tests with other nft binariesArturo Borrero2016-04-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | Allow to run tests with other nft binaries by reading a 'NFT' environment variable, allowing arbitrary locations for the nft binary. This is what the tests/shell/run-tests.sh script does. Among other thing, this allow us to properly hook this testsuite from the Debian CI environment (https://ci.debian.net) where we can perform tests for packages 'as installed'. Examples: # run with default config (ie src/nft) % ./nft-test.py # run with installed binary (ie /usr/sbin/nft) % NFT=/usr/sbin/nft ./nft-test.py Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add interval testsPablo Neira Ayuso2016-04-272-0/+23
| | | | | | Add some initial tests to cover dynamic interval sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: explicitly indication of set type and flags from test definitionsPablo Neira Ayuso2016-04-273-32/+68
| | | | | | | | | This patch adds explicit set type in test definitions, as well as flags. This has triggered a rework that starts by introducing a Set class to make this whole code more extensible and maintainable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add more interval tests for anonymous setsPablo Neira Ayuso2016-04-274-0/+40
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>