summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* man: add include statement documentation.Ismo Puustinen2017-06-281-2/+7
| | | | | | | Add to man page information about using the wildcard include statements. Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: update include directory tests to support wildcard syntax.Ismo Puustinen2017-06-2711-13/+171
| | | | | Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: support for wildcards in include statements.Ismo Puustinen2017-06-271-119/+107
| | | | | | | | | | | | | | | | Use glob() to find paths in include statements. The rules are these: 1. If no files can be found in the pattern with wildcards, do not return an error. 2. Do not match any files beginning with '.'. 3. Do not handle include directories anymore. For example, the statement: include "foo/" would now need to be rewritten: include "foo/*" Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Fail test forcefully when bug is not fixedShyam Saini2017-06-261-1/+1
| | | | | | | | | | | | | | | | | | | | When we have "fail" in the test cases then py test doesn't complain anything, but the test should complain if the fix is not applied. Before applying 986dea8a4a9d ("evaluate: avoid reference to multiple src data in statements which set values"), nft throws following error message and exits with error code 134. $ nft add rule x y tcp dport set { 0 , 1 } BUG: unknown expression type set reference nft: netlink_linearize.c:696: netlink_gen_expr: Assertion `0' failed. Aborted This commit enforces nft-test.py to throw error message when the fix is not applied. Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --check option flagPablo M. Bermudo Garay2017-06-263-2/+24
| | | | | | | | | Sometimes it can be useful to test if a command is valid without applying any change to the rule-set. This commit adds a new option flag (-c | --check) that performs a dry run execution of the commands. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add new generic context structure nft_ctxPablo M. Bermudo Garay2017-06-264-21/+25
| | | | | | | | | | | | | The new structure nft_ctx is meant to be used as a generic container of context information. This is a preparatory patch. So at the moment the struct just carry output_ctx on his path through main.c and cli.c. Based on original idea from Eric Leblond. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Test input descriptors for included filesShyam Saini2017-06-261-0/+52
| | | | | | | | | | | Before b14572f72aac ("erec: Fix input descriptors for included files"), nft error message was pointing to wrong file. But after this commit it points to right file. This patch adds a new test for this commit. Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add test for incomplete set add set commandShyam Saini2017-06-261-0/+16
| | | | | | | | | | | | | | | | | | | | | | | Before c6cd7c22548a ("src: fix crash when inputting an incomplete set add command") commit, if we run nft with incomplete "add set" command it caused segmentation fault and exit with error code 139 and further it didn't throw any error message. For example: $ sudo nft add set t s But after the aforementioned commit it throws syntax error message and exits with return value 1. For example: $ sudo nft add set t s <cmdline>:1:12-12: Error: syntax error, unexpected newline, expecting '{' add set t s ^ This commit tests changes made in such commit. Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Better error reporting for bad set referencesPablo Neira Ayuso2017-06-191-2/+3
| | | | | | | | | | | | | In case you refer to an unexisting set, bail out with: # nft add table x # nft add chain x y # nft add rule x y ip protocol vmap @reject_to_rule2; <cmdline>:1:31-46: Error: Set 'reject_to_rule2' does not exist add rule x y ip protocol vmap @reject_to_rule2 ^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: merge nested set flagsPablo Neira Ayuso2017-06-191-0/+1
| | | | | | | | | | | | | | | | | | | | | | | A set may contain a nested set element definition, merge the nested set flags so we don't hit: BUG: invalid data expression type range nft: netlink.c:400: netlink_gen_data: Assertion `0' failed. Aborted With the following example ruleset: define dnat_ports = { 1234-1567 } define port_allow = { 53, # dns $dnat_ports, # dnat } add rule x y tcp dport $port_allow accept Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1145 Fixes: a6b75b837f5e ("evaluate: set: Allow for set elems to be sets") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject meta nfproto outside of inet familyFlorian Westphal2017-06-182-2/+22
| | | | | | | | | | | | | | | meta nfproto loads the hook family type of the current rule context in the kernel, i.e. it will be NFPROTO_IPV6 for ip6 family, NFPROTO_BRIDGE for bridge and so on. The only case where this is useful is the inet pseudo family, where this is useful to determine the real hook family (NFPROTO_IPV4 or NFPROTO_IPV6). In all other families 'meta nfproto' is either always true or false. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: restrict meta nfproto test cases to inet familyFlorian Westphal2017-06-185-32/+36
| | | | | | | Followup patch will reject meta nfproto for non-inet families. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: remove two non-sensical rulesFlorian Westphal2017-06-182-25/+0
| | | | | | | | | | | | | | | meta nfproto returns the hook family that the current packet is being evaluted in, e.g. NFPROTO_NETDEV in case we're called from the netdev context. This makes no sense, if we add a rule to netdev, bridge, ip, ... table then thats where it will be evaluated, no runtime test needed. Only exception: inet family, in this case, nfproto will be either ipv4 or ipv6. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: restrict ct saddr test to inet familyFlorian Westphal2017-06-184-8/+23
| | | | | | | | | | | | | | | | any/ct.t: ERROR: line 94: src/nft add rule --debug=netlink ip6 test-ip6 output meta nfproto ipv4 ct original saddr 1.2.3.4: This rule should not have failed. Actually, this failure is "ok; we can't find upper layer protocol in this case, but even if we'd "fix" this it is still non-sensical, meta nfproto ipv4, but family is ipv6 --> rule would never match. First move this to an inet-specific test. A followup patch will reject meta nfproto for all families except inet. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add test for ambiguity while setting the valueShyam Saini2017-06-186-0/+16
| | | | | | | | | | | | | | | | | | | | | This test checks bug identified and fixed in the commit mentioned below In a statement if there are multiple src data then it would be totally ambiguous to decide which value to set. Before the commit was made it returned 134(BUG), but now it returns 1 i.e, an error message. Following rules tests ambiguity while setting the value: $ sudo nft add rule ip test-ip4 output ct mark set {0x11333, 0x11} <cmdline>:1:41-55: Error: you cannot use a set here, unknown value to use add rule ip test-ip4 output ct mark set {0x11333, 0x11} ~~~~~~~~~~~~^^^^^^^^^^^^^^^ Test: 986dea8 ("evaluate: avoid reference to multiple src data in statements which set values") Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Pass stateless, numeric, ip2name and handle variables as structure members.Varsha Rao2017-06-1825-230/+266
| | | | | | | | | | | | | | | | | libnftables library will be created soon. So declare numeric_output, stateless_output, ip2name_output and handle_output as members of structure output_ctx, instead of global variables. Rename these variables as following, numeric_output -> numeric stateless_output -> stateless ip2name_output -> ip2name handle_output -> handle Also add struct output_ctx *octx as member of struct netlink_ctx. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: error reporting for nested ruleset representationPablo Neira Ayuso2017-06-163-53/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you load a file using the nested ruleset representation, ie. the one you get via `nft list ruleset', error reporting doesn't help you much to find the problem. For example, the following ruleset points to an unexisting chain 'x': table test { chain test { type filter hook ingress priority 0; policy drop; ip saddr { 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 } jump x } } Error reporting is very sparse as it says: # nft -f /home/test/x /home/test/x:1:1-2: Error: Could not process rule: No such file or directory table netdev test{ ^^ So it's hard to know what is exactly missing. This patch enhances the existing logic, so nft points to the rule causing the problem, ie. # nft -f /home/test/x /home/test/x:4:17-70: Error: Could not process rule: No such file or directory ip saddr { 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 } jump x ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The idea behind this patch is to expand the single table command into a list of individual commands, one per nested object inside the table. This expanded list is spliced into the existing list of commands. Thus, each command gets a sequence number that helps us correlate the error with the command that triggers it. This patch also includes reference counting for rules and objects. This was already in place for table, chain and sets. We need this since now we hold references to them from both the command and the table object itself. So the last reference releases the object from memory. Note that table objects still keep the list of chain, sets, etc. since the existing cache logic needs this to work. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename ct eventmask to eventFlorian Westphal2017-06-074-17/+23
| | | | | | | | ct status isn't named 'statusmask' either. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: prefer ct event set foo,bar over 'set foo|bar'Florian Westphal2017-06-071-1/+6
| | | | | | | | Translates binop representation to a list-based one, so nft prints "ct event destroy,new" instead of 'ct event destroy|new'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: display default directory for file inclusion in -h/--helpPablo Neira Ayuso2017-06-072-2/+7
| | | | | | | | | | | If no explicit relative or absolute path is enforced by the user, nft relies on either -I/--includepath or the default include directory that is set at compile time. Given most of our users will rely on packaged versions of nft, provide a way to display the location of this default includepath directory. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: describe -I override behaviour when path starts by ./ and /Pablo Neira Ayuso2017-06-071-1/+4
| | | | | | | You can override -I by starting your path either using ./ for relative paths and / for absolute paths. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: added tests for ordering files in include dirs.Ismo Puustinen2017-06-072-0/+98
| | | | | | | | Test that the files are ordered properly by introducing included files which have internal dependencies. Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* man: add include directory documentation.Ismo Puustinen2017-06-071-0/+4
| | | | | | | Short include directory introduction is added to the man page. Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: add files in include dirs in alphabetical order.Ismo Puustinen2017-06-071-27/+70
| | | | | | | | | | | | | | | | | | This means that if you have a directory structure like this /foo /foo/02_rules.nft /foo/01_rules.nft where *.nft files in directory /foo are nft scripts, then an include statement in another nft script like this include "/foo/" guarantees that "01_rules.nft" is loaded before "02_rules.nft". Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow ct eventmask set new,relatedFlorian Westphal2017-06-071-3/+24
| | | | | | | | | | | | | | | | | | In case of bitmask types (tcp flags, ct eventmask) nft allows to use comma operator to test multiple values, i.e. tcp flags syn,ack ct event new,destroy etc. But currently nft fails to use this when used in a statement, i.e. ... ct eventmask set new,destroy gives: syntax error, unexpected comma This allows makes this work, it is the same as ct eventmask set new|destroy Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: permit meta nfproto ip in ip familyFlorian Westphal2017-06-061-2/+9
| | | | | | | | | | | | | | | | | | | works: add rule ip filter input ct original saddr 1.2.3.4 (family ctx init initialises network base to proto_ip). fails to parse 1.2.3.4 address: add rule ip filter input meta nfproto ipv4 ct original saddr 1.2.3.4 ... because meta_expr_pctx_update() won't find a dependency from "ip" to "ip" and then overwrites the correct base with proto_unknown. "meta nfproto ip" is useless in the ip family, as it will always match, i.e. a better (but more compliated) fix would be to remove the statement during evaluation. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: fix inet/bridge/netdev family handling for saddr/daddrFlorian Westphal2017-06-063-7/+31
| | | | | | | | | | | | | "ct orignal saddr" has an invalid data type, as the address can be either ipv4 or ipv6. For some cases we could infer it from the rhs, but there are cases where we don't have any information, e.g. when passing ct original saddr to jhash expression. So do the same thing that we do for "rt nexthop" -- error out and hint to user they need to specifiy the desired address type with "meta nfproto". Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove expire information from list stateless ruleset.Varsha Rao2017-06-061-1/+1
| | | | | | | | | | | | | | | | | As expires is stateful information. This patch removes expire information from list stateless ruleset. With nft -s option, the ruleset will be as following. table ip firewall { set host { type ipv4_addr flags timeout elements = { 10.0.0.2 timeout 10m } } } Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: test include directoriesIsmo Puustinen2017-06-066-0/+217
| | | | | | | | | | | | Add tests for: * including an empty directory * including directory with one or two files in it * testing for required trailing slash in directory name * testing for detecting non-existent directory * testing for a broken file in included directory Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: add support for include directoriesIsmo Puustinen2017-06-061-23/+109
| | | | | | | | | | | | | | | | If a string after "include" keyword points to a directory instead of a file, consider the directory to contain only nft rule files and try to load them all. This helps with a use case where services drop their own firewall configuration files into a directory and nft needs to include those without knowing the exact file names. File loading order from the include directory is not specified, so the files inside an include directory should not depend on each other. Fixes(Bug 1154 - Allow include statement to operate on directories and/or wildcards). Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove global nftnl_batch structure in mnl layerPablo Neira Ayuso2017-05-295-110/+124
| | | | | | | | The underlying mnl layer uses a global nftnl_batch structure. Instead, pass pointer as parameter to the functions that need this. The netlink layer stores a reference to this structure in struct netlink_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: don't trim off unary expression on delinearizationPablo Neira Ayuso2017-05-292-7/+1
| | | | | | | | | | | This transformation introduces an unnecessary asymmetry between the linearization and delinearization steps that prevent rule deletion by name to work fine. Moreover, do not print htonl and ntonl from unary expression, this syntax is not allowed by the parser. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: flush stdout on each test runPablo Neira Ayuso2017-05-291-0/+2
| | | | | | Useful when redirecting output to file and tail -f it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: avoid reference to multiple src data in statements which set valuesArturo Borrero Gonzalez2017-05-291-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Prevent this assert: % nft [..] tcp dport set { 0 , 1 } BUG: unknown expression type set reference nft: netlink_linearize.c:696: netlink_gen_expr: Assertion `0' failed. Aborted We can't use a set here because we will not known which value to use. With this patch, a proper error message is reported to users: % nft add rule t c tcp dport set {1, 2, 3, 4, 5} <cmdline>:1:28-42: Error: you cannot use a set here, unknown value to use add rule t c tcp dport set {1, 2, 3, 4, 5} ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^ % nft add rule t c tcp dport set @s <cmdline>:1:28-29: Error: you cannot reference a set here, unknown value to use add rule t c tcp dport set @s ~~~~~~~~~~~~~~^^ This error is reported to all statements which set values. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Fix typo in manpageBertrand Bonnefoy-Claudet2017-05-291-1/+1
| | | | | | | s/Simlar/Similar Signed-off-by: Bertrand Bonnefoy-Claudet <bertrandbc@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add size description for constant setsPablo Neira Ayuso2017-05-261-0/+2
| | | | | | | | The kernel side can make better decisions with this information when selecting the right backend, so add this information to the set netlink message. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: reset element size counter before adding intervals to setPablo Neira Ayuso2017-05-261-0/+2
| | | | | | | Otherwise we get double the real size in terms of set elements during the interval expansion to individual elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: adjust set expression size accordingly with intervalsPablo Neira Ayuso2017-05-261-6/+11
| | | | | | | For implicit sets, we have to call set_to_intervals() before we add the set so we have the net size in elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'meta_l4_dependency'Florian Westphal2017-05-2568-7037/+390
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently nft inserts different types of dependencies for l4 protocols, depending on the family. For inet, nft inserts 'meta l4proto' to e.g. check for tcp, for ip, nft uses 'ip protocol'. Both are fine. The ip6 family however uses 'ip6 nexthdr', and thats a problem because e.g. tcp dport 22 will not match packets that use ipv6 extension headers. The series switches both ipv6 and ipv4 to use meta l4 instead so ipv6 will always check the last transport header value. We could ignore ip as only ipv6 uses extension headers. However, switching ipv4 as well makes things a bit simpler because nft then creates the same l4 dependency for all families. Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
| * tests: fix up meta l4proto change for ip familyFlorian Westphal2017-05-1956-6881/+176
| | | | | | | | | | | | | | We can delete some of the payload files now as ip/ip6/inet produce same implicit meta l4proto dep. Signed-off-by: Florian Westphal <fw@strlen.de>
| * src: ip: switch implicit dependencies to meta l4proto tooFlorian Westphal2017-05-192-7/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | after ip6 nexthdr also switch ip to meta l4proto instead of ip protocol. While its needed for ipv6 (due to extension headers) this isn't needed for ip but it has the advantage that tcp dport 22 produces same expressions for ip/ip6/inet families. Signed-off-by: Florian Westphal <fw@strlen.de>
| * tests: fix up meta l4proto change for ip6 familyFlorian Westphal2017-05-1921-391/+391
| | | | | | | | | | | | | | | | | | | | | | | | After previous commit nft generates meta l4proto for ipv6 dependencies instead of checking the (first) nexthdr value. This fixes up all tests cases accordingly except one which fails with ip6/reject.t: ... 12: 'ip6 nexthdr 6 reject with tcp reset' mismatches 'meta l4proto 6 reject with tcp reset' This will be fixed by removing the implicit dependency in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
| * payload: enforce ip/ip6 protocol depending on icmp or icmpv6Florian Westphal2017-05-191-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After some discussion with Pablo we agreed to treat icmp/icmpv6 specially. in the case of a rule like 'tcp dport 22' the inet, bridge and netdev families only care about the lower layer protocol. In the icmpv6 case however we'd like to also enforce an ipv6 protocol check (and ipv4 check in icmp case). This extends payload_gen_special_dependency() to consider this. With this patch: add rule $pf filter input meta l4proto icmpv6 add rule $pf filter input meta l4proto icmpv6 icmpv6 type echo-request add rule $pf filter input icmpv6 type echo-request will work in all tables and all families. For inet/bridge/netdev, an ipv6 protocol dependency is added; this will not match ipv4 packets with ip->protocol == icmpv6, EXCEPT in the case of the ip family. Its still possible to match icmpv6-in-ipv4 in inet/bridge/netdev with an explicit dependency: add rule inet f i ip protocol ipv6-icmp meta l4proto ipv6-icmp icmpv6 type ... Implicit dependencies won't get removed at the moment, so bridge ... icmp type echo-request will be shown as ether type ip meta l4proto 1 icmp type echo-request Signed-off-by: Florian Westphal <fw@strlen.de>
| * src: ipv6: switch implicit dependencies to meta l4protoFlorian Westphal2017-05-192-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when using rule like ip6 filter input tcp dport 22 nft generates: [ payload load 1b @ network header + 6 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] which is: ip6 filter input ip6 nexthdr tcp dport 22 IOW, such a rule won't match if e.g. a fragment header is in place. This changes ip6_proto to use 'meta l4proto' which is the protocol header found by exthdr walk. A side effect is that for bridge we get a shorter dependency chain as it no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep. Only problem: ip6 nexthdr tcp tcp dport 22 will now inject a (useless) meta l4 dependency as ip6 nexthdr is no longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper that skips the unneded meta dependency in that case. Signed-off-by: Florian Westphal <fw@strlen.de>
| * src: allow update of net base w. meta l4proto icmpv6Florian Westphal2017-05-193-0/+9
| | | | | | | | | | | | | | | | | | | | nft add rule ip6 f i meta l4proto ipv6-icmp icmpv6 type nd-router-advert <cmdline>:1:50-60: Error: conflicting protocols specified: unknown vs. icmpv6 add icmpv6 to nexthdr list so base gets updated correctly. Reported-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
| * payload: split ll proto dependency into helperFlorian Westphal2017-05-181-11/+18
|/ | | | | | | will be re-used in folloup patch for icmp/icmpv6 depenency handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add ip reject with tcp and check for mark tooFlorian Westphal2017-05-188-6/+21
| | | | | | | ... to avoid resetting e.g. the ssh session to the vm that runs nft-test.py. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: reject: remove dependency for tcp-resetsFlorian Westphal2017-05-182-1/+7
| | | | | | We can remove a l4 dependency in ip/ipv6 families. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add a comment wrt. reject dependency insertionFlorian Westphal2017-05-181-0/+8
| | | | | | | | at first I thought this was a bug but this in fact seems the right thing, add a comment/example why adding dependency as first statement makes sense. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: delete the old cache when dumping is interruptedLiping Zhang2017-05-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the dumping operation is interrupted, we will restart the cache_init(), but unfortunatly, we forget to delete the old cache. So in extreme case, we will leak a huge amount of memory. Running the following commands can simulate the extreme case: # nft add table t # nft add set t s {type inet_service \;} # for i in $(seq 65000); do nft add element t s {$i} done & # while : ; do time nft list ruleset -nn done After a while, oom killer will be triggered: [ 2808.243537] Out of memory: Kill process 16975 (nft) score 649 or sacrifice child [ 2808.255372] Killed process 16975 (nft) total-vm:1955348kB, anon-rss:1952120kB, file-rss:0kB, shmem-rss:0kB [ 2858.353729] nft invoked oom-killer: gfp_mask=0x14201ca(GFP_HIGHUSER_ MOVABLE|__GFP_COLD), nodemask=(null), order=0, oom_score_adj=0 [ 2858.374521] nft cpuset=/ mems_allowed=0 ... Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-10-31 23:04:38 +0000