summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add testcase for different defines usageArturo Borrero Gonzalez2016-11-291-0/+44
| | | | | | | | | | | | | | | | | | This testcase add some defines in a nft -f run and then uses them in different spots (which are not covered in previous testcases). * defines used to define another one * different datatypes (numbers, strings, bits, ranges) * usage in sets, maps, contatenatios * single rules with single statements, multiple statements * reuse define in same rule Perhaps this isn't testing many different code path, but I find this interesting to have given it will probably be one of the most common use cases of nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add a testcase for many definesArturo Borrero Gonzalez2016-11-291-0/+37
| | | | | | | Use many defines in a single nft -f run. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Unmask negative set lookupAnatole Denis2016-11-2985-226/+4690
| | | | | | | | Many testcases were masked because of bug #888. This series of patches unmasks them Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Interpret OP_NEQ against a set as OP_LOOKUPAnatole Denis2016-11-293-5/+33
| | | | | | | | | | Now that the support for inverted matching is in the kernel and in libnftnl, add it to nftables too. This fixes bug #888 Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "evaluate: check for NULL datatype in rhs in lookup expr"Anatole Denis2016-11-291-23/+8
| | | | | | | | | This reverts commit 5afa5a164ff1c066af1ec56d875b91562882bd50. This commit is obsoleted by removing the possibility for a NULL right->dtype in the first place, at set declaration. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add regression test for malformed setsAnatole Denis2016-11-291-0/+33
| | | | | | | | | | see: 5afa5a164ff1c066af1ec56d875b91562882bd50 When a malformed set is added, it was added before erroring out, causing a segfault further down when used. This tests for this case, ensuring that nftables doesn't segfault but errors correctly Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Add set to cache only when well-formedAnatole Denis2016-11-291-3/+3
| | | | | | | | | | | | | | | When creating a set (in set_evaluate), it is added to the table cache before being checked for correctness. When the set is ill-formed, the function returns without removing the (non-existent, since the function returned) set. Further references to this set will not result in an error (since the set is in the lookup table), but the malformed set will probably cause a segfault. The symptom (the segfault) was fixed by checking for NULL when evaluating a reference to the set (commit 5afa5a164ff1c066af1ec56d875b91562882bd50), this should fix the root cause. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add log flags syntax supportLiping Zhang2016-11-2411-6/+179
| | | | | | | | | | | | | | | | | | | | | Now NF_LOG_XXX is exposed to the userspace, we can set it explicitly. Like iptables LOG target, we can log TCP sequence numbers, TCP options, IP options, UID owning local socket and decode MAC header. Note the log flags are mutually exclusive with group. Some examples are listed below: # nft add rule t c log flags tcp sequence,options # nft add rule t c log flags ip options # nft add rule t c log flags skuid # nft add rule t c log flags ether # nft add rule t c log flags all # nft add rule t c log flags all group 1 <cmdline>:1:14-16: Error: flags and group are mutually exclusive add rule t c log flags all group 1 ^^^ Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: another testcase for deleting many set elementsArturo Borrero Gonzalez2016-11-241-0/+48
| | | | | | | | | This testcase adds and deletes many elements in a set. We add and delete 65.536 elements in two different nft -f runs. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: testcase for deleting many set elementsArturo Borrero Gonzalez2016-11-241-0/+46
| | | | | | | | | | This testcase adds and deletes many elements in a set. We add and delete 65.536 elements in a same batch of netlink messages, (single nft -f run). Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: testcase for adding many set elementsArturo Borrero Gonzalez2016-11-241-0/+32
| | | | | | | | This testcase adds many elements in a set. We add 65.356 elements. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: allow to execute a single testcaseArturo Borrero Gonzalez2016-11-241-0/+11
| | | | | | | | | | | | | Using, for example: % sudo ./run-tests.sh testcase/mytest_0 Will result in an execution of this single testcase rather than the complete suite. This is useful while working with a concrete testcase. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh nf_tables.h headerPablo Neira Ayuso2016-11-241-4/+12
| | | | | | Fetch what we have at 4.9-rc6. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "tests: py: nft-tests.py: Add function for loading and removing ↵Florian Westphal2016-11-171-32/+0
| | | | | | | | | | | | | | | | | kernel modules" Its not needed at the moment, all tests that need a network interface (meta iif/oif) use the lo interface. For iifname/oifname the network device doesn't have to exist. We can revisit this in case we need it in the future. (seems commit causes issues on kernels built without dummy module). Reported-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Manuel Messner <mm@skelett.io>
* mnl: use nftnl_set_elems_nlmsg_build_payload_iter() when deleting elementsPablo Neira Ayuso2016-11-141-14/+11
| | | | | | | | | Otherwise, nft crashes when deleting a very large number of elements. *** stack smashing detected ***: nft terminated Segmentation fault Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add notrack supportPablo Neira Ayuso2016-11-1410-0/+55
| | | | | | | This patch adds the notrack statement, to skip connection tracking for certain packets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing range conversion in icmpv6Pablo Neira Ayuso2016-11-141-2/+1
| | | | | | Use range expression to negate ranges. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add some testcases for log flagsPablo Neira Ayuso2016-11-143-17/+17
| | | | | | | Remove null and zero flags from tests, to reduce the noise when running tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for comments in set elementsArturo Borrero Gonzalez2016-11-093-0/+35
| | | | | | | | This patch adds a several testcases for comments in set elements. This includes the netfilter bug #1090 about comments in set interval elements. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: keep element comments in set intervalsPablo Neira Ayuso2016-11-091-3/+7
| | | | | | | | | The conversion from the set element range representation to element intervals doesn't keep the comment information around. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1090 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>
* src: add offset attribute for hash expressionLaura Garcia Liebana2016-11-099-9/+36
| | | | | | | | | | | Add support to add an offset to the hash generator, eg. ct mark set hash ip saddr mod 10 offset 100 This will generate marks with series between 100-109. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make hash seed attribute optionalLaura Garcia Liebana2016-11-093-0/+13
| | | | | | | | | | | | | | | | | | The hash expression requires a seed attribute to call the jhash operation, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef With this patch the seed attribute is optional and it's generated by a random function from userspace, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 The kernel will take care of generate a random seed. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add a new testcase for ruleset loading bugArturo Borrero Gonzalez2016-11-091-0/+27
| | | | | | | | | | | There seems to be a bug that prevent loading a ruleset twice in a row if the ruleset contains sets with intervals. This seems related to the nft cache. By the time of this commit, the bug is not fixed yet. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: introduce the cache testcases directoryArturo Borrero Gonzalez2016-11-091-0/+0
| | | | | | | This directory is for testcases related to the nft cache. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: delete useless stderr output in testcaseArturo Borrero Gonzalez2016-11-091-1/+1
| | | | | | | This stderr output is expected. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: update Arturo Borrero Gonzalez email addressArturo Borrero Gonzalez2016-11-091-1/+1
| | | | | | | Update email address to a new one in the copyright notice. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in flow table keyPablo Neira Ayuso2016-10-313-3/+25
| | | | | | | | | | | | | | | | | | | | | Anders reports that: # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} while the opposite doesn't work: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} netlink_gen_flow_stmt() relies on the flow table key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Reported-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix synopsis for ct expressionAnders K. Pedersen2016-10-311-10/+15
| | | | | | | | | | | | | | | | | | | The nft man page command synopsis for the ct expression is currently: ct {state | direction | status | mark | expiration | helper | label | bytes | packets} {original | reply | {l3proto | protocol | saddr | daddr | proto-src | proto-dst | bytes | packets}} which is not correct for the arguments that should be prefixed with "original" or "reply". Change this to ct {state | direction | status | mark | expiration | helper | label | l3proto | protocol | bytes | packets} ct {original | reply} {l3proto | protocol | saddr | daddr | proto-src | proto-dst | bytes | packets} Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Allow concatenation of rt nexthop etc.Anders K. Pedersen2016-10-311-7/+7
| | | | | | | | | | | | | | | | | | | Concatenations of rt nexthop or ct {orignal | reply} {saddr | daddr} fail due to # nft add rule ip filter postrouting flow table acct \{ ip saddr . rt nexthop counter \} <cmdline>:1:61-70: Error: can not use variable sized data types (invalid) in concat expressions add rule ip filter postrouting flow table acct { ip saddr . rt nexthop counter } ~~~~~~~~~~~^^^^^^^^^^ Fix this by reordering the check for variable size data types in expr_evaluate_concat() to happen after expr_evaluate() has been called (via list_member_evaluate()) for the sub expression. This allows expr_evaluate_[cr]t() to call [cr]t_expr_update_type() and set the data type before the check. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing payload test for numgen offsetPablo Neira Ayuso2016-10-311-0/+5
| | | | | | | | | | The new cover test for: ct mark set numgen inc mod 2 offset 100 was lacking the payload file chunk. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: rename the log level "warning" to "warn"Liping Zhang2016-10-311-1/+1
| | | | | | | | | This is to keep compatibility. The original keyword in grammer is "warn" instead of "warning". Fixes: 0423caa91ad2 ("src: don't need keyword for log level") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: fix "ct l3proto/protocol" syntax brokenLiping Zhang2016-10-301-1/+3
| | | | | | | | | | | | | | | "l3proto" and "protocol" are still keywords in our grammer, they are not STRING, so if the user input the following rule, nft will complain that the syntax is error: # nft add t c ct l3proto ipv4 <cmdline>:1:12-18: Error: syntax error, unexpected l3proto, expecting string or mark or packets or bytes add t c ct l3proto ipv4 ^^^^^^^ Fixes: c992153402c7 ("ct: allow resolving ct keys at run time") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Correct description of -n/--numeric optionJon Jensen2016-10-292-10/+7
| | | | | | | | | | | | "When used twice" was used twice in the manpage. :) And as Florian Westphal pointed out, it was also incorrect for the -nn case. Update the manpage and built-in help in main.c to match actual behavior. Signed-off-by: Jon Jensen <jon@endpoint.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Replace tests/files/expr-rt with Python based tests, and replace ether typeAnders K. Pedersen2016-10-2911-26/+61
| | | | | | | with meta nfproto, which generates a bit fewer instructions. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add fib expressionFlorian Westphal2016-10-2814-0/+395
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the 'fib' expression which can be used to obtain the output interface from the route table based on either source or destination address of a packet. This can be used to e.g. add reverse path filtering: # drop if not coming from the same interface packet # arrived on # nft add rule x prerouting fib saddr . iif oif eq 0 drop # accept only if from eth0 # nft add rule x prerouting fib saddr . iif oif eq "eth0" accept # accept if from any valid interface # nft add rule x prerouting fib saddr oif accept Querying of address type is also supported. This can be used to e.g. only accept packets to addresses configured in the same interface: # fib daddr . iif type local Its also possible to use mark and verdict map, e.g.: # nft add rule x prerouting meta mark set 0xdead fib daddr . mark type vmap { blackhole : drop, prohibit : drop, unicast : accept } Signed-off-by: Florian Westphal <fw@strlen.de>
* rt: introduce routing expressionAnders K. Pedersen2016-10-2813-1/+401
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce rt expression for routing related data with support for nexthop (i.e. the directly connected IP address that an outgoing packet is sent to), which can be used either for matching or accounting, eg. # nft add rule filter postrouting \ ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1. # nft add rule filter postrouting \ flow table acct { rt nexthop timeout 600s counter } # nft add rule ip6 filter postrouting \ flow table acct { rt nexthop timeout 600s counter } These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic is seen for this nexthop within 10 minutes. # nft add rule inet filter postrouting \ ether type ip \ flow table acct { rt nexthop timeout 600s counter } # nft add rule inet filter postrouting \ ether type ip6 \ flow table acct { rt nexthop timeout 600s counter } Same as above, but via the inet family, where the ether type must be specified explicitly. "rt classid" is also implemented identical to "meta rtclassid", since it is more logical to have this match in the routing expression going forward. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: allow resolving meta keys at run timeFlorian Westphal2016-10-274-7/+66
| | | | | | | | | use the meta template to translate the textual token to the enum value. This allows to remove two keywords from the scanner and also means we do not need to introduce new keywords when more meta keys get added. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: allow resolving ct keys at run timeFlorian Westphal2016-10-275-15/+69
| | | | | | | ... and remove those keywords we no longer need. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: provide snprintf helper macroFlorian Westphal2016-10-271-0/+10
| | | | | | | lifted from libnftnl, except that we will abort on snprintf errors. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add offset keyword and parser rulePablo Neira Ayuso2016-10-272-1/+7
| | | | | | This is required by the numgen and jhash expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix linearize numgen typeLaura Garcia Liebana2016-10-271-1/+1
| | | | | | | | Avoid to treat numgen type attribute as a register. Fixes: 345236211715 ("src: add hash expression") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add offset attribute for numgen expressionLaura Garcia Liebana2016-10-278-7/+20
| | | | | | | | | | | | | Add support to add an offset to the numgen generated value. Example: ct mark set numgen inc mod 2 offset 100 This will generate marks with serie like 100, 101, 100, ... Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix pkttype name and add 'other' symbolFlorian Westphal2016-10-273-5/+7
| | | | | | | | | | | | | | 'unicast' doesn't check for unicast packets; it checks for PACKET_HOST, i.e. a packet coming in for this host. A unicast address to some other machine (e.g. because nic is in promisc mode) will have PACKET_OTHER. So at best this is misleading, so this patch changes it to 'host'. The unicast entry is retained for compat purpose. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't need keyword for log levelPablo Neira Ayuso2016-10-212-16/+24
| | | | | | | We can handle log levels without keywords in our grammar, use string instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: update kernel modules to cleanArturo Borrero Gonzalez2016-10-211-2/+4
| | | | | | | | | | | | | | | Let's keep the kernel_cleanup() function updated with latest kernel changes: * added nft_quota, nft_queue, nft_numgen, nft_range * rename nft_hash to nft_set_hash * keep nft_hash as well * rename nft_rbtree to nft_set_rbtree The idea is to run each test in a clean evironment. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow to use variable to add/create/delete elementsPablo Neira Ayuso2016-10-212-3/+25
| | | | | | | | | | | | | | | | | | | | | | | Using variable definitions from element command doesn't work, eg. -test.nft- define whitelist_v4 = { 1.1.1.1 } table inet filter { set whitelist_v4 { type ipv4_addr; } } add element inet filter whitelist_v4 $whitelist_v4 -EOF- # nft -f test.nft test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{' add element inet filter whitelist_v4 $whitelist_v4 ^ Fix this by using set_block_expr rule for every element command. This patch also comes with a new regression test. Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix monitor trace crash with netdev familyFlorian Westphal2016-10-211-2/+5
| | | | | | | | | | | | | | | | | nft monitor trace crashes on first packet with: table netdev filter { chain foobar { type filter hook ingress device eth0 priority 0; udp sport 53 meta nftrace set 1 } } We did not handle netdev family and thus generated bogus payload statements without data types. Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=1092 Signed-off-by: Florian Westphal <fw@strlen.de>
* src: support ct l3proto/protocol without direction syntaxLiping Zhang2016-10-173-8/+10
| | | | | | | | | | | | | | | Acctually, ct l3proto and ct protocol are unrelated to direction, so it's unnecessary that we must specify dir if we want to use them. Now add support that we can match ct l3proto/protocol without direction: # nft add rule filter input ct l3proto ipv4 # nft add rule filter output ct protocol 17 Note: existing syntax is still preserved, so "ct reply l3proto ipv6" is still fine. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use new range expression for != [a,b] intervalsPablo Neira Ayuso2016-10-1758-421/+293
| | | | | | | Use new range expression in the kernel to fix wrong bytecode generation. This patch also adjust tests so we don't hit problems there. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: permit numeric interface typeFlorian Westphal2016-10-171-2/+13
| | | | | | | | | | | | | | If we can't translate an interface index back to a name we just print the number. This change allows using a number instead of an interface index to make this symmetric. If we can't find an interface with the given name check if its a numeric string and then use it instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 20:48:51 +0000