summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* examples: adjust new chain type syntax in sets_and_maps filePhil Oester2013-11-301-1/+1
| | | | | | | This example file has not been updated with new syntax. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: segfault in top scope definePhil Oester2013-11-301-0/+1
| | | | | | | | | | | | | | nft segfaults if a symbol is added in top_scope, because of a missing init_list_head. Trivial example: define ip_set = {192.168.1.2, 192.168.2.3} add rule filter output ip daddr $ip_set counter This closes netfilter bugzilla #877. Reported-by: Anand Raj Manickam <anandrm@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: relax restriction on UID/GID parsingPablo Neira Ayuso2013-11-291-20/+34
| | | | | | | | | | nft is currently rejecting unknown UID/GID if they don't exist in the system, relax this as Bjørnar Ness considers this is a valid scenario. Now this only reports an error if you pass an unknown user (expressed as string or if the UID/GID goes above 32 bits). Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix endianness in UID/GIDPablo Neira Ayuso2013-11-291-2/+2
| | | | | | | | | | | add rule filter output meta skuid vmap { 1000 => accept } list table filter meta skuid map { 3892510720 => accept} ^--------^ this is 1000 in network byte order Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: improve rule deletion per chainPablo Neira Ayuso2013-11-251-1/+1
| | | | | | | | | | | | | | With this patch, nft asks the kernel for deleting all rules in a chain. This replaces the current behaviour that requires to dump all the rules, then iterate over that list to delete one by one, which is prone to races and slowier. After this patch, the following two commands are equivalent: nft flush chain filter input nft delete rule filter input Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix missing nul-terminated string in string_type_printPablo Neira Ayuso2013-11-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Thomas Berger reported that he is seeing garbage after valid string values, eg. fwtest01 ~ # nft -i nft> table filter nft> add chain filter input nft> add rule filter input meta iifname "lo" accept nft> list table filter table ip filter { chain input { meta iifname "lo�.�" accept } ... The buffer that is allocated in the stack does not include room to nul-terminate the string accordingly. This patch fixes bugzilla report #872: https://bugzilla.netfilter.org/show_bug.cgi?id=872 Reported-by: Thomas Berger <loki@lokis-chaos.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: only display wanted chain in listingEric Leblond2013-11-191-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When specifying a chain to list, all created chains were displayed with a void content: # nft list chain filter table ip filter { chain input { } chain new { counter packets 17971 bytes 2380637 accept counter packets 0 bytes 0 accept } } With the attached patch, only the asked chain is displayed: # nft list chain filter table ip filter { chain new { counter packets 17971 bytes 2380637 accept # handle 36 counter packets 0 bytes 0 accept # handle 40 } } Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* verdict: fix delinearize in case of jumpEric Leblond2013-11-191-2/+6
| | | | | | | | | The name of the chain was not handled in case of a jump or a goto. This patch adds parsing of the chain. Reported-by: Alex Chapman <ajchapman88@hotmail.co.uk> Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* jump: fix logic in netlink linearizeEric Leblond2013-11-191-1/+2
| | | | | | | | | Logic in the test was inverted. The result was the jump string not to be set. Reported-by: Alex Chapman <ajchapman88@hotmail.co.uk> Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: fix indentEric Leblond2013-11-191-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: delete debian/ directoryArturo Borrero2013-11-187-49/+0
| | | | | | | | The debian/ dir does not belong here, we already discussed this with Debian maintainers many times before. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: relax compilation not to break on warningPablo Neira Ayuso2013-11-181-1/+1
| | | | | | | Remove -Werror, as bison and flex generate unclean code that may break compilation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix warning on deprecated directive in bisonPablo Neira Ayuso2013-11-181-1/+1
| | | | | | | | src/parser.y:93.1-13: warning: deprecated directive, use ‘%name-prefix’ [-Wdeprecated] %name-prefix="nft_" ^^^^^^^^^^^^^ Reported-by: Anatol Pomozov <anatol.pomozov@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix ethernet type protocol matchingPablo Neira Ayuso2013-11-041-1/+1
| | | | | | | | | This fixes ethernet type protocol matching, which is needed to match network layer information, eg. nft add rule bridge filter input ip protocol icmp counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: finish reject supportPablo Neira Ayuso2013-10-271-1/+3
| | | | | | | | This patch finishes the reject support. Reported-by: Jiri Benc <jbenc@redhat.com> Tested-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: avoid huge rodata arrayFlorian Westphal2013-10-221-9/+14
| | | | | | | | | commit b259d1a ('src: operational limit match') creates huge array, increasing nft binary size from ~240k to ~5m on x86_64. Use switch statement instead. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: operational limit matchPhil Oester2013-10-225-15/+19
| | | | | | | | | | | | | | | | | | | | The nft limit match currently does not work at all. Below patches to nftables, libnftables, and kernel address the issue. A few notes on the implementation: - Removed support for nano/micro/milli second limits. These seem pointless, given we are using jiffies in the limit match, not a hpet. And who really needs to limit items down to sub-second level?? - 'depth' member is removed as unnecessary. All we need in the kernel is the rate and the unit. - 'stamp' member becomes the time we need to next refresh the token bucket, instead of being updated on every packet which goes through the match. This closes netfilter bugzilla #827, reported by Eric Leblond. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix return codeArturo Borrero Gonzalez2013-10-171-3/+4
| | | | | | | | | | | | | | | | | | | Exit with NFT_EXIT_FAILURE if something went wrong in the netlink code. Before this patch: internal:0:0-0: Error: Could not find chain `asd' in table `filter': [...] 0 After this patch: internal:0:0-0: Error: Could not find chain `asd' in table `filter': [...] 1 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix nft flush operationEric Leblond2013-10-031-2/+0
| | | | | | | | | | nft_netlink function is already calling mnl_batch_end and mnl_batch_begin so it is not necessary to do it in the netlink_flush_rules function. Doing this result in a invalid netlink message which is discarded by the kernel. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: only flush asked table/chainEric Leblond2013-10-031-0/+8
| | | | | | | | | The flush operation was not limiting the flush to the table or chain specified on command line. The result was that all the rules for a given family are flush independantly of the flush command. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: suppress useless variableEric Leblond2013-10-031-3/+0
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix typo in commentEric Leblond2013-10-031-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for IPv6 NATEric Leblond2013-09-302-4/+20
| | | | | | | | This patch adds support for IPv6 NAT. It adds IPv6 support in evaluation and in delinearization which were the only missing parts. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix IPv6 prefix computationEric Leblond2013-09-301-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | The prefix building algorithm in netlink phase was incorrect in IPv6. For example, when adding the following rule nft add rule ip6 nat postrouting ip6 saddr 2::/64 --debug=all we had: ip6 nat postrouting 0 0 [ payload load 16b @ network header + 8 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000000 0x99361540 0x00007f8d 0x2e33a1eb ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ] [ cmp eq reg 1 0x00000200 0x00000000 0x00000000 0x00000000 ] With the patch the result is as expected: ip6 nat postrouting 0 0 [ payload load 16b @ network header + 8 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0xffffffff 0xffffffff 0x00000000 0x00000000 ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ] [ cmp eq reg 1 0x00000200 0x00000000 0x00000000 0x00000000 ] Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: cache a copy of nfnetlink.hTomasz Bursztyka2013-09-301-0/+64
| | | | | | | | | | | | | | | | | | | | If nft is compiled without nftables Linux kernel headers installed, we hit a compilation error: src/mnl.c: In function ‘mnl_batch_put’: src/mnl.c:117:16: error: ‘NFNL_SUBSYS_NFTABLES’ undeclared (first use in this function) src/mnl.c:117:16: note: each undeclared identifier is reported only once for each function it appears in src/mnl.c: In function ‘mnl_batch_begin’: src/mnl.c:125:16: error: ‘NFNL_MSG_BATCH_BEGIN’ undeclared (first use in this function) src/mnl.c: In function ‘mnl_batch_end’: src/mnl.c:130:16: error: ‘NFNL_MSG_BATCH_END’ undeclared (first use in this function) Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule batching supportPablo Neira Ayuso2013-09-237-40/+384
| | | | | | | | | | | | | | | | | | | | | | | This patch allows nft to put all rule update messages into one single batch that is sent to the kernel if `-f' option is used. In order to provide fine grain error reporting, I decided to to correlate the netlink message sequence number with the correspoding command sequence number, which is the same. Thus, nft can identify what rules trigger problems inside a batch and report them accordingly. Moreover, to avoid playing buffer size games at batch building stage, ie. guess what is the final size of the batch for this ruleset update will be, this patch collects batch pages that are converted to iovec to ensure linearization when the batch is sent to the kernel. This reduces the amount of unnecessary memory usage that is allocated for the batch. This patch uses the libmnl nlmsg batching infrastructure and it requires the kernel patch entitled (netfilter: nfnetlink: add batch support and use it from nf_tables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: iif/oifname should be host byte orderFlorian Westphal2013-09-233-5/+5
| | | | | | | | | | | | | | | | | | | | src/nft add rule filter output meta oifname eth0 doesn't work on x86. Problem is that nft declares these as BYTEORDER_INVALID, but when converting the string mpz_import_data treats INVALID like BIG_ENDIAN. [ cmp eq reg 1 0x00000000 0x00000000 0x65000000 0x00306874 ] as kernel nft_cmp_eval basically boils down to memcmp(reg, skb->dev->name, sizeof(reg) comparision fails. with patch: [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ] Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use uint32_t instead of size_t for attribute lengthPablo Neira Ayuso2013-09-191-2/+2
| | | | | | | According to libnftables change 437d610, now the length obtained via getter function is uint32_t, not size_t anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* display family in table listingEric Leblond2013-09-171-1/+19
| | | | | | | | As family was not displayed in table listing, it was not possible to restore an ipv6 table saved via 'nft list table ip6 TABLE'. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Update chain creation format.Eric Leblond2013-09-177-19/+23
| | | | | | | | | | | type keyword is now mandatory when creating a new chain. This patc halso implement the change required following the usage of human notation in hook. It also suppressed non currently supported mangle chains. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Suppress non working examples.Eric Leblond2013-09-174-26/+0
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nat: add mandatory family attributeEric Leblond2013-09-171-0/+4
| | | | | | | | NFT_EXPR_NAT_FAMILY is a mandatory attribute for NAT rules and it was not set by nftables. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: s/threshold/queue-threshold/Florian Westphal2013-09-141-1/+1
| | | | | | | | on input we expect "queue-threshold" token, so use the same name when printing the output. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix endianess of ARP operation codePablo Neira Ayuso2013-09-141-1/+1
| | | | | | | | | | So it display compatibility command: xtables-arp -A INPUT --opcode Reply -j DROP accordinly: arp plen 4 arp operation reply counter packets 0 bytes 0 drop
* src: Better error reporting if chain type is invalidTomasz Bursztyka2013-09-053-3/+33
| | | | | | | | | | | | | This patch verifies at command line parsing that given chain type is valid. Possibilities are: filter, nat, and route. nft add chain test test { type cheese hook input priority 0 }; <cmdline>:1:28-33: Error: unknown chain type cheese add chain test test { type cheese hook input priority 0 }; ^^^^^^ Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix mark parsing if string is usedPablo Neira Ayuso2013-09-041-0/+11
| | | | | | | | | | | | | | | | | | | This fixes string mark parsing. Note that /etc/iproute2/rt_marks may contain mapping between string and mark values. This fixes here: add rule filter output meta mark 0 counter Assumming that: cat /etc/iproute2/rt_marks says: 0 test Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix output display of meta lengthPablo Neira Ayuso2013-09-041-1/+1
| | | | | | | | | | | | | nft list table filter Before: meta len 1000 counter packets 0 bytes 0 After: meta length 1000 counter packets 0 bytes 0 Now it doesn't break with nft -f. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Update bate chain creation according to latest syntax changesTomasz Bursztyka2013-09-0411-11/+11
| | | | | | | Adding type, plain hook's name and priority keyword. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add priority keyword on base chain descriptionTomasz Bursztyka2013-09-042-5/+5
| | | | | | | | | | Instead of: add chain foo bar { type route hook input 0; } it should be now: add chain foo bar { type route hook input priority 0; } Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* src: Wrap netfilter hooks around human readable stringsTomasz Bursztyka2013-09-045-25/+122
| | | | | | | | | | | | | | | | | | | This allows to use unique, human readable, hook names for the command line and let the user being unaware of the complex netfilter's hook names and there difference depending on the netfilter family. So: add chain foo bar { type route hook NF_INET_LOCAL_IN 0; } becomes: add chain foo bar { type route hook input 0; } It also fixes then the difference in hook values between families. I.e. ARP family has different values for input, forward and output compared to IPv4, IPv6 or bridge. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* INSTALL: Update dependency list and repository URLsTomasz Bursztyka2013-08-311-2/+4
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix base chain printingTomasz Bursztyka2013-08-302-1/+2
| | | | | | | | | Relying on chain's hooknum to know whether the chain is a base one or not is bogus: having 0 as hooknum is a valid number. Thus setting the right flag and handling it is the way to go, as parser does already. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the base chain typePablo Neira Ayuso2013-08-274-15/+32
| | | | | | | | | | | | | | | | | | This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix wrong endianess in numeric portsPablo Neira Ayuso2013-08-241-1/+1
| | | | | | | | In (5075879 datatype: validate port number in inet_service_type_parse), conversion to network byte order was missing. Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: add additional --numeric levelPhil Oester2013-08-223-3/+5
| | | | | | | | | | | | | | Personally, I like seeing ports and IPs numerically, but prefer protocols to be shown by name. As such, add a third --numeric level which will show protocols by number, splitting them out from ports. -n/--numeric When specified once, show network addresses numerically. When specified twice, also show Internet services, user IDs and group IDs numerically. When specified thrice, also show protocols numerically. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: convert group and qthreshold to use u16Pablo Neira Ayuso2013-08-173-6/+6
| | | | | | | Required since (netfilter: nft_log: group and qthreshold are 2^16) kernel change. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: allow protocols by number in inet_protocol_type_parsePhil Oester2013-08-171-4/+18
| | | | | | | | nftables does not currently allow specifying protocols by number. Below patch adds this capability. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: validate port number in inet_service_type_parsePhil Oester2013-08-171-7/+20
| | | | | | | | | | | | | | | | At present, nft accepts out of range port values such as in this example: nft add rule ip filter input tcp dport 123456 accept Attached patch adds checks for both integer overflow and 16 bit overflow, and avoids getaddrinfo call in the (common) case of digit input. Example above now produces this output: <cmdline>:1:36-41: Error: Service out of range add rule ip filter input tcp dport 123456 accept ^^^^^^ Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add icmpv6 supportEric Leblond2013-07-315-3/+109
| | | | | | | | | | This patch adds ICMPv6 support to nftables. It is now possible to write rules such as: nft add rule ip6 filter input icmpv6 type nd-router-advert accept Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix crash if wrong integer type is passedPablo Neira Ayuso2013-07-241-2/+4
| | | | | | | | | | | | | | | | | | | | | | Eric Leblond reported that this command: nft add rule ip6 filter input position 4 meta protocol icmpv6 accept crashes nft. The problem is that 'icmpv6' is wrong there, as meta protocol is expecting an ethernet protocol, that can be expressed as an hexadecimal. Now this command displays the following error: <cmdline>:1:52-57: Error: This is not a valid Ethernet protocol add rule ip6 filter input position 4 meta protocol icmpv6 accept ^^^^^^ This closes bugzilla #834: https://bugzilla.netfilter.org/show_bug.cgi?id=834 Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 05:36:11 +0000