summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests/py: fix payload of dccp type in set elementsPablo Neira Ayuso2016-05-114-4/+4
| | | | | | This value needs to be lshift one bit to be correct. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: fix fragment-offset fieldPablo Neira Ayuso2016-05-112-4/+4
| | | | | | | | | | | | | | | | | Set elements were miscalculated. After this patch: element 00000801 : 0 [end] ^^^^ Which looks correct according to my calculations: >>> print hex(socket.htons(33 << 3)) 0x801 ^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing netdev ip dscp payload testsPablo Neira Ayuso2016-05-111-0/+43
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ecn supportPablo Neira Ayuso2016-05-116-3/+51
| | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule ip filter forward ip ecn ce counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000003 ] [ counter pkts 0 bytes 0 ] For IPv6: # nft --debug=netlink add rule ip6 filter forward ip6 ecn ce counter ip6 filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000030 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000030 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dscp supportPablo Neira Ayuso2016-05-1112-17/+225
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: remove priority field definition from IPv6 headerPablo Neira Ayuso2016-05-112-9/+0
| | | | | | This is actually part of the traffic class field according to RFC2460. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: update IPv6 flowlabel offset and length according to RFC2460Pablo Neira Ayuso2016-05-114-2/+10
| | | | | | This is a 20 bit field according to Section 3. IPv6 Header Format. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: handle payload matching split in two bytesPablo Neira Ayuso2016-05-111-8/+16
| | | | | | | | | | | | | | When the bits are split between two bytes and the payload field is smaller than one byte, we need to extend the expression length on both sides (payload and constant) of the relational expression. The existing trimming from the delinerization step handles the listing for us, so no changes on that front. This patch allows us to match the IPv6 DSCP field which falls into the case that is described above. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move payload sub-byte matching to the evaluation stepPablo Neira Ayuso2016-05-112-107/+97
| | | | | | | | | | | | | | | | | | | | Generating the bitwise logic to match sub-byte payload fields from the linearize step has several problems: 1) When the bits are split between two bytes and the payload field is smaller than one byte, we need to extend the expression length on both sides (payload and constant) of the relational expression. 2) Explicit bitmask operations on sub-byte payload fields need to be merge to the implicit bitmask operation, otherwise we generate two bitwise instructions. This is not resolved by this patch, but we should have a look at some point to this. With this approach, we can benefit from the binary operation transfer for shifts to provide a generic way to adjust the constant side of the expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: transfer right shifts to set reference sidePablo Neira Ayuso2016-05-112-6/+94
| | | | | | | | This provides a generic way to transfer shifts from the left hand side to the right hand range side of a relational expression when performing transformations from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: transfer right shifts to range sidePablo Neira Ayuso2016-05-111-0/+12
| | | | | | | | This provides a generic way to transfer shifts from the left hand side to the right hand range side of a relational expression when performing transformations from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: transfer right shifts to constant sidePatrick McHardy2016-05-111-4/+26
| | | | | | | | | This provides a generic way to transfer shifts from the left hand side to the right hand constant side of a relational expression when performing transformations from the evaluation step. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* dist: include tests/ directory and files in tarballArturo Borrero2016-04-291-0/+2
| | | | | | | | | | | If we include tests/ in the release tarball, downstream distributors can run the testsuites themselves while developing the packages. This way, tests can be run in a more integrated environment and they can discover errors related to the integration with the given distribution itself. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: allow to run tests with other nft binariesArturo Borrero2016-04-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | Allow to run tests with other nft binaries by reading a 'NFT' environment variable, allowing arbitrary locations for the nft binary. This is what the tests/shell/run-tests.sh script does. Among other thing, this allow us to properly hook this testsuite from the Debian CI environment (https://ci.debian.net) where we can perform tests for packages 'as installed'. Examples: # run with default config (ie src/nft) % ./nft-test.py # run with installed binary (ie /usr/sbin/nft) % NFT=/usr/sbin/nft ./nft-test.py Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add interval testsPablo Neira Ayuso2016-04-272-0/+23
| | | | | | Add some initial tests to cover dynamic interval sets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: explicitly indication of set type and flags from test definitionsPablo Neira Ayuso2016-04-273-32/+68
| | | | | | | | | This patch adds explicit set type in test definitions, as well as flags. This has triggered a rework that starts by introducing a Set class to make this whole code more extensible and maintainable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add more interval tests for anonymous setsPablo Neira Ayuso2016-04-274-0/+40
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for named sets with intervalsArturo Borrero2016-04-275-0/+97
| | | | | | | Let's add some testcases for named sets with intervals and ranges. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: add interval overlap detection for dynamic updatesPablo Neira Ayuso2016-04-271-3/+52
| | | | | | | Make sure the new intervals that we want to add are not overlapping with any of the existing ones. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: rename set expression set_to_segtree()Pablo Neira Ayuso2016-04-271-7/+7
| | | | | | | This function is modified by a follow up patch to take the set object, so rename it to init. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: add expr_to_intervals()Pablo Neira Ayuso2016-04-271-8/+26
| | | | | | | | | | | Refactor code to add the new expr_to_intervals(). This function takes the list of set element expressions and convert them to a list of half-closed intervals. This is useful for different purposes, such as interval overlap and conflicts detection. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: set expr->len for prefix expression from interval_map_decompose()Pablo Neira Ayuso2016-04-271-0/+1
| | | | | | This field needs to be set for the new interval overlap detection. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bail out on prefix or range to non-interval setPablo Neira Ayuso2016-04-271-0/+16
| | | | | | | | | | | | | | | | | | | | | | | If you declare a set with no interval flag, you get this bug message: # nft add element filter myset { 192.168.1.100/24 } BUG: invalid data expression type prefix nft: netlink.c:323: netlink_gen_data: Assertion `0' failed. Aborted After this patch, we provide a clue to the user: # nft add element filter myset { 192.168.1.100/24 } <cmdline>:1:23-38: Error: Set member cannot be prefix, missing interval flag on declaration add element filter myset { 192.168.1.100/24 } ^^^^^^^^^^^^^^^^ # nft add element filter myset { 192.168.1.100-192.168.1.200 } <cmdline>:1:23-49: Error: Set member cannot be range, missing interval flag on declaration add element filter myset { 192.168.1.100-192.168.1.200 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: special handling for the first non-matching segmentPablo Neira Ayuso2016-04-253-9/+43
| | | | | | | Add the first non-matching segment if the set is empty or if the set becomes empty after the element removal. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: support for incremental set interval element updatesPablo Neira Ayuso2016-04-251-10/+42
| | | | | | | | | | Introduce __do_add_setelems() and do_delete_setelems() to support incremental set interval element updates. From do_add_set(), use netlink_add_setelems() not to try to re-add the same elements again Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: explicit initialization via set_to_intervals()Pablo Neira Ayuso2016-04-253-9/+11
| | | | | | | Allow explicit compound expression to initialize the set intervals. Incremental updates to interval sets require this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: handle adjacent interval nodes from expr_value_cmp()Pablo Neira Ayuso2016-04-251-1/+8
| | | | | | | Named sets may contain adjacent interval nodes, when equal in key, look at the flags. Those with EXPR_F_INTERVAL_END should come in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: clone full expression from interval_map_decompose()Pablo Neira Ayuso2016-04-251-1/+1
| | | | | | | Instead of cloning just its value, expr_value() expects a set element or mapping. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: perform stricter expression type validation from expr_value()Pablo Neira Ayuso2016-04-251-2/+6
| | | | | | | | | | This helper function returns a expression value type that represents the set element key. This functions currently expects two kind of expressions: set elements and mappings. Bail out otherwise, if we see anything else, we have to fix our code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft monitor [ trace ]Patrick McHardy2016-04-246-10/+355
| | | | | | | | | | | | | | | | | | | | | | | | | ... can now display nftables nftrace debug information. $ nft filter input tcp dport 10000 nftrace set 1 $ nft filter input icmp type echo-request nftrace set 1 $ nft -nn monitor trace trace id e1f5055f ip filter input packet: iif eth0 ether saddr 63:f6:4b:00:54:52 ether daddr c9:4b:a9:00:54:52 ip saddr 192.168.122.1 ip daddr 192.168.122.83 ip tos 0 ip ttl 64 ip id 32315 ip length 84 icmp type echo-request icmp code 0 icmp id 10087 icmp sequence 1 trace id e1f5055f ip filter input rule icmp type echo-request nftrace set 1 (verdict continue) trace id e1f5055f ip filter input verdict continue trace id e1f5055f ip filter input trace id 74e47ad2 ip filter input packet: iif vlan0 ether saddr 63:f6:4b:00:54:52 ether daddr c9:4b:a9:00:54:52 vlan pcp 0 vlan cfi 1 vlan id 1000 ip saddr 10.0.0.1 ip daddr 10.0.0.2 ip tos 0 ip ttl 64 ip id 49030 ip length 84 icmp type echo-request icmp code 0 icmp id 10095 icmp sequence 1 trace id 74e47ad2 ip filter input rule icmp type echo-request nftrace set 1 (verdict continue) trace id 74e47ad2 ip filter input verdict continue trace id 74e47ad2 ip filter input trace id 3030de23 ip filter input packet: iif vlan0 ether saddr 63:f6:4b:00:54:52 ether daddr c9:4b:a9:00:54:52 vlan pcp 0 vlan cfi 1 vlan id 1000 ip saddr 10.0.0.1 ip daddr 10.0.0.2 ip tos 16 ip ttl 64 ip id 59062 ip length 60 tcp sport 55438 tcp dport 10000 tcp flags == syn tcp window 29200 trace id 3030de23 ip filter input rule tcp dport 10000 nftrace set 1 (verdict continue) trace id 3030de23 ip filter input verdict continue trace id 3030de23 ip filter input Based on a patch from Florian Westphal, which again was based on a patch from Markus Kötter. Signed-off-by: Patrick McHardy <kaber@trash.net>
* proto: add protocol header fields filter and ordering for packet decodingPatrick McHardy2016-04-242-0/+42
| | | | | | | | | The next patch introduces packet decoding for tracing messages based on the proto definitions. In order to provide a readable output, add a filter to surpress uninteresting header fields and allow to specify and explicit output order. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: add payload_is_stacked()Patrick McHardy2016-04-243-23/+27
| | | | | | | Add payload_is_stacked() to determine whether a protocol expression match defines a stacked protocol on the same layer. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: move payload depedency tracking to payload.cPatrick McHardy2016-04-243-50/+85
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* nft: resync kernel header filesPatrick McHardy2016-04-242-5/+90
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: fix stacked headers protocol context trackingPatrick McHardy2016-04-244-43/+26
| | | | | | | | | | | | | | | The code contains multiple scattered around fragments to fiddle with the protocol contexts to work around the fact that stacked headers update the context for the incorrect layer. Fix this by updating the correct layer in payload_expr_pctx_update() and also take care of offset adjustments there and only there. Remove all manual protocol context fiddling and change protocol context debugging to also print the offset for stacked headers. All previously successful testcases pass. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: only merge if adjacent and combined size fits into a registerFlorian Westphal2016-04-196-9/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add rule ip6 filter input ip6 saddr ::1/128 ip6 daddr ::1/128 fails, we ask to compare a 32byte immediate which is not supported: [ payload load 32b @ network header + 8 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 0x00000000 0x00000000 0x00000000 0x02000000 ] We would need to use two cmps in this case, i.e.: [ payload load 32b @ network header + 8 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] [ cmp eq reg 2 0x00000000 0x00000000 0x00000000 0x02000000 ] Seems however that this requires a bit more changes to how nft handles register allocations, we'd also need to undo the constant merge. Lets disable merging for now so that we generate [ payload load 16b @ network header + 8 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x01000000 ] [ payload load 16b @ network header + 24 => reg 1 ] [ cmp eq reg 1 0x00000000 0x00000000 0x00000000 0x02000000 ] ... if merge would bring us over the 128 bit register size. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1032 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: delete tempfile failover in testcasesArturo Borrero2016-04-157-49/+7
| | | | | | | | It seems both Debian/Fedora (and derivates) contains mktemp (from the coreutils package) so it makes no sense to have this failover, which looks buggy also. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add testcases for Netfilter bug #965Arturo Borrero2016-04-159-0/+174
| | | | | | | | | | | | | Testscases for Netfilter bug #965: * add rule at position * insert rule at position * replace rule with given handle * delete rule with given handle * don't allow to delete rules with position keyword Netfilter Bugzilla: http://bugzilla.netfilter.org/show_bug.cgi?id=965 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Use libnftnl user data TLV infrastructureCarlos Falgueras García2016-04-143-5/+62
| | | | | | | | | Now it is possible to store multiple variable length user data into rule. Modify the parser in order to fill the nftnl_udata with the comment, and the print function for extract these commentary and print it to user. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: shell: also unload NAT modulesArturo Borrero2016-04-131-0/+1
| | | | | | | Also unload NAT modules between tests. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: evaluate: Show error for fanout without balanceShivani Bhardwaj2016-04-132-0/+6
| | | | | | | | | | | | | | | | | | | | The idea of fanout option is to improve the performance by indexing CPU ID to map packets to the queues. This is used for load balancing. Fanout option is not required when there is a single queue specified. According to iptables, queue balance should be specified in order to use fanout. Following that, throw an error in nftables if the range of queues for load balancing is not specified with the fanout option. After this patch, $ sudo nft add rule ip filter forward counter queue num 0 fanout <cmdline>:1:46-46: Error: fanout requires a range to be specified add rule ip filter forward counter queue num 0 fanout ^^^^^ Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: improve rule management checksArturo Borrero2016-04-131-1/+67
| | | | | | | | | | | Improve checks (and error reporting) for basic rule management operations. This includes a fix for netfilter bug #965. Netfilter bug: http://bugzilla.netfilter.org/show_bug.cgi?id=965 Reported-by: Jesper Sander Lindgren <sander.contrib@gmail.com> Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add some tests for network namespacesArturo Borrero2016-04-073-0/+306
| | | | | | | | A basic tests to check we can perform operations in different network namespaces. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add new testcases for commit/rollbackArturo Borrero2016-04-074-0/+267
| | | | | | | | | | | New simple testcases for kernel commit/rollback operations. * ruleset A is loaded (good ruleset) * ruleset B is loaded (bad ruleset): fail is expected * ruleset A should remain in the kernel Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: store parser location for handle and position specifiersPablo Neira Ayuso2016-03-305-19/+50
| | | | | | | | | Store the parser location structure for handle and position IDs so we can use this information from the evaluation step, to provide better error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: don't print trailing statement whitespaceArturo Borrero2016-03-291-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | This trailing whitespace is annoying when working with the textual output of nft. Before: table t { chain c { ct state new ^ } } After: table t { chain c { ct state new } } Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add chain validations testsArturo Borrero2016-03-239-0/+120
| | | | | | | Some basic test regarding chains: jumps and validations. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell/run-tests.sh: tune kernel cleanupArturo Borrero2016-03-221-6/+5
| | | | | | | | | | | | | | | | | The modprobe call can return != 0 if, for example, a module was builtin and we are triying to remove it, so force return code of 0 at the end of the script. This patch also adds the '-a' switch to modprobe so it doesn't stop unloading modules if one of them fails (for example, it was builtin). While at it, fix several module names, for example: 'nft_bridge_reject' vs 'nft_reject_bridge', delete bogus module names. Reported-by: Piyush Pangtey <gokuvsvegita@gmail.com> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Tested-by: Piyush Pangtey <gokuvsvegita@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: unload modules between testsArturo Borrero2016-03-171-2/+23
| | | | | | | | | | | | | | | | | | | | | | | This patch adjusts the main test script so it unload all nftables kernel modules between tests. This way we achieve two interesting things: * avoid false errors in some testcases due to module loading order * test the module loading/unloading path itself The false positives is for example, listing ruleset per families, which depends on the loading order of nf_tables_xx modules. We can later add more modules to unload incrementally (for example nf_tables_switchdev). This patch assumes we are working with a kernel which is compiled with nf_tables =m, the case using =y is not supported and can still produce false positives in some testcases due to module ordering. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: include/mini-gmp.h is not included at "make dist"Magnus Öberg2016-03-171-0/+1
| | | | | | | Added missing dist. file mini-gmp.h in include/Makefile.am Signed-off-by: Magnus Öberg <magnus.oberg@westermo.se> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 12:03:21 +0000