summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build: Bump version to v1.0.0v1.0.0Pablo Neira Ayuso2021-08-172-3/+3
| | | | | | | Update libversion since new API has been added in 9edaa6a51eab ("src: add --define key=value"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: skip flags / mask notation for singleton bitmask againPablo Neira Ayuso2021-08-154-1/+31
| | | | | | | != operation should also be covered too. Fixes: 347a4aa16e64 ("netlink_delinearize: skip flags / mask notation for singleton bitmask") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: expand variable containing set into multiple mappingsPablo Neira Ayuso2021-08-123-0/+46
| | | | | | | | | | | | | | | | | | | | | | # cat x.nft define interfaces = { eth0, eth1 } table ip x { chain y { type filter hook input priority 0; policy accept; iifname vmap { lo : accept, $interfaces : drop } } } # nft -f x.nft # nft list ruleset table ip x { chain y { type filter hook input priority 0; policy accept; iifname vmap { "lo" : accept, "eth0" : drop, "eth1" : drop } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Make netns spawning more robustPhil Sutter2021-08-111-6/+34
| | | | | | | On systems without unshare Python module, try to call unshare binary with oneself as parameters. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tcpopt: bogus assertion on undefined optionsPablo Neira Ayuso2021-08-114-1/+25
| | | | | | | | | | # nft add rule x y tcp option 6 exists # nft list ruleset nft: tcpopt.c:208: tcpopt_init_raw: Assertion `expr->exthdr.desc != NULL' failed. Aborted Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1557 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: revisit hook listingPablo Neira Ayuso2021-08-065-120/+261
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update this command to display the hook datapath for a packet depending on its family. This patch also includes: - Group of existing hooks based on the hook location. - Order hooks by priority, from INT_MIN to INT_MAX. - Do not add sign to priority zero. - Refresh include/linux/netfilter/nfnetlink_hook.h cache copy. - Use NFNLA_CHAIN_* attributes to print the chain family, table and name. If NFNLA_CHAIN_* attributes are not available, display the hookfn name. - Update syntax: remove optional hook parameter, promote the 'device' argument. The following example shows the hook datapath for IPv4 packets coming in from netdevice 'eth0': # nft list hooks ip device eth0 family ip { hook ingress { +0000000010 chain netdev x y [nf_tables] +0000000300 chain inet m w [nf_tables] } hook input { -0000000100 chain ip a b [nf_tables] +0000000300 chain inet m z [nf_tables] } hook forward { -0000000225 selinux_ipv4_forward 0000000000 chain ip a c [nf_tables] } hook output { -0000000225 selinux_ipv4_output } hook postrouting { +0000000225 selinux_ipv4_postroute } } Note that the listing above includes the existing netdev and inet hooks/chains which *might* interfer in the travel of an incoming IPv4 packet. This allows users to debug the pipeline, basically, to understand in what order the hooks/chains are evaluated for the IPv4 packets. If the netdevice is not specified, then the ingress hooks are not shown. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: check more flag match transformations to compact syntaxPablo Neira Ayuso2021-07-283-0/+193
| | | | | | Add a few more tests to extend coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: tcp flags & (fin | syn | rst | ack) == synPablo Neira Ayuso2021-07-283-0/+36
| | | | | | Add a test case to cover translation to tcp flags syn / fin,syn,rst,ack. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: skip flags / mask notation for singleton bitmaskPablo Neira Ayuso2021-07-284-0/+39
| | | | | | | | Do not transform 'tcp flags & flag == flag' to 'flag / flag'. The parser does not accept this notation yet. Fixes: c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: idempotent tcp flags & syn != 0 to tcp flag synPablo Neira Ayuso2021-07-273-0/+25
| | | | | | Add a test to cover this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disallow negation with binary operationPablo Neira Ayuso2021-07-272-6/+11
| | | | | | | | | | | | | The negation was introduced to provide a simple shortcut. Extend e6c32b2fa0b8 ("src: add negation match on singleton bitmask value") to disallow negation with binary operations too. # nft add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) ! syn' Error: cannot combine negation with binary expression add rule meh tcp_flags tcp flags & (fin | syn | rst | ack) ! syn ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ~~~ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: incorrect netlink bytecode with binary operation and flagsPablo Neira Ayuso2021-07-274-15/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | nft generates incorrect bytecode when combining flag datatype and binary operations: # nft --debug=netlink add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) syn' ip [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 1b @ transport header + 13 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x00000017 ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 & 0x00000002 ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000000 ] Note the double bitwise expression. The last two expressions are not correct either since it should match on the syn flag, ie. 0x2. After this patch, netlink bytecode generation looks correct: # nft --debug=netlink add rule meh tcp_flags 'tcp flags & (fin | syn | rst | ack) syn' ip [ meta load l4proto => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 1b @ transport header + 13 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x00000017 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000002 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: missing != in flagcmp expression print functionPablo Neira Ayuso2021-07-274-1/+40
| | | | | | | Missing != when printing the expression. Fixes: c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing json update for numeric reject with icmp numericPablo Neira Ayuso2021-07-273-0/+30
| | | | | | | Add missing tests to cover json support for reject with icmp numeric. Fixes: 1ab1fcbc19a8 ("parser_bison: parse number as reject icmp code") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update new reject with icmp code syntax leftoverPablo Neira Ayuso2021-07-273-15/+15
| | | | | | | I forgot to update a few more spots in the json files. Fixes: 08d2f0493671 ("src: promote 'reject with icmp CODE' syntax") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: error reporting for missing statements in set/map declarationPablo Neira Ayuso2021-07-261-3/+5
| | | | | | | | | | | | | | | | | | Assuming this map: map y { type ipv4_addr : verdict } This patch slightly improves error reporting to refer to the missing 'counter' statement in the map declaration. # nft 'add element x y { 1.2.3.4 counter packets 1 bytes 1 : accept, * counter : drop }' Error: missing statement in map declaration add element x y { 1.2.3.4 counter packets 10 bytes 640 : accept, * counter : drop } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: promote 'reject with icmp CODE' syntaxPablo Neira Ayuso2021-07-2617-236/+256
| | | | | | | | | | | | | | | | | | | | | | | The kernel already assumes that that ICMP type to reject a packet is destination-unreachable, hence the user specifies the *ICMP code*. Simplify the syntax to: ... reject with icmp port-unreachable this removes the 'type' keyword before the ICMP code to reject the packet with. IIRC, the original intention is to leave room for future extensions that allow to specify both the ICMP type and the ICMP code, this is however not possible with the current inconsistent syntax. Update manpages which also refer to ICMP type. Adjust tests/py to the new syntax. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: parse number as reject icmp codePablo Neira Ayuso2021-07-267-20/+32
| | | | | | | | | | | | Extend parser to accept a numeric icmp code, instead of bailing out: # nft add rule inet filter input reject with icmpx type 3 Error: syntax error, unexpected number, expecting string add rule inet filter input reject with icmpx type 3 ^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1555 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: stateful statement support in mapPablo Neira Ayuso2021-07-263-0/+50
| | | | | | Missing parser extension to support for stateful statements in map. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Fix bogus testsuite failure with 100HzPhil Sutter2021-07-261-2/+2
| | | | | | | | | On kernels with CONFIG_HZ=100, clock granularity does not allow tracking timeouts in single digit ms range. Change sets/0031set_timeout_size_0 to not expose this detail. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* src: expose nft_ctx_clear_vars as APIPablo Neira Ayuso2021-07-243-1/+5
| | | | | | | | | This function might be useful to recycle the existing nft_ctx to use it with different external variable definitions. Moreover, reset ctx->num_vars to zero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix nft_ctx_clear_include_paths in libnftables.mapPablo Neira Ayuso2021-07-241-1/+1
| | | | | | | There a typo that prevents exposing the function as API. Fixes: 16543a0136c0 ("libnftables: export public symbols only") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: inconditionally initialize ct timeout listPablo Neira Ayuso2021-07-221-1/+1
| | | | | | The policy is optional, make sure this timeout list is initialized. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing initialization of ct timeout policy listPablo Neira Ayuso2021-07-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | rule.c:1715:3: runtime error: member access within null pointer of type 'struct timeout_state' AddressSanitizer:DEADLYSIGNAL ================================================================= ==29500==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f5bfd43c2a4 bp 0x7ffcb82f13b0 sp 0x7ffcb82f1360 T0) ==29500==The signal is caused by a READ memory access. ==29500==Hint: address points to the zero page. #0 0x7f5bfd43c2a3 in obj_free /home/test/nftables/src/rule.c:1715 #1 0x7f5bfd43875d in cmd_free /home/test/nftables/src/rule.c:1447 #2 0x7f5bfd58e6f2 in nft_run_cmd_from_filename /home/test/nftables/src/libnftables.c:628 #3 0x5645c48762b1 in main /home/test/nftables/src/main.c:512 #4 0x7f5bfc0eb09a in __libc_start_main ../csu/libc-start.c:308 #5 0x5645c4873459 in _start (/home/test/nftables/src/.libs/nft+0x9459) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/test/nftables/src/rule.c:1715 in obj_free ==29500==ABORTING Fixes: 7a0e26723496 ("rule: memleak of list of timeout policies") Signed-off-by: Pablo Neira Ayuso <test@netfilter.org>
* tests: py: add dnat to port without defining destination addressPablo Neira Ayuso2021-07-223-0/+28
| | | | | | | Add a test to cover dnat to port without destination address. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: missing nft_ctx_add_var() symbol map updatePablo Neira Ayuso2021-07-211-0/+4
| | | | | | | Add nft_ctx_add_var() to libnftables.map symbol map. Fixes: 9edaa6a51eab ("src: add --define key=value") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix inet nat with no layer 3 infoPablo Neira Ayuso2021-07-201-2/+3
| | | | | | | | | | | | | | nft currently reports: Error: Could not process rule: Protocol error add rule inet x y meta l4proto tcp dnat to :80 ^^^^ default to NFPROTO_INET family, otherwise kernel bails out EPROTO when trying to load the conntrack helper. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --define key=valuePablo Neira Ayuso2021-07-207-1/+158
| | | | | | | | | | | | | | | | | This patch adds a new option to define variables from the command line. # cat test.nft table netdev x { chain y { type filter hook ingress devices = $dev priority 0; counter accept } } # nft --define dev="{ eth0, eth1 }" -f test.nft You can only combine it with -f/--filename. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: extend coverage for dnat with classic range representationPablo Neira Ayuso2021-07-142-0/+43
| | | | | | Add a few more tests for the classic dnat range representation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for nat with interval concatenationPablo Neira Ayuso2021-07-1311-41/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to combine concatenation and interval in NAT mappings, e.g. add rule x y dnat to ip saddr . tcp dport map { 192.168.1.2 . 80 : 10.141.10.2-10.141.10.5 . 8888-8999 } This generates the following NAT expression: [ nat dnat ip addr_min reg 1 addr_max reg 10 proto_min reg 9 proto_max reg 11 ] which expects to obtain the following tuple: IP address (min), source port (min), IP address (max), source port (max) to be obtained from the map. This representation simplifies the delinearize path, since the datatype is specified as: ipv4_addr . inet_service. A few more notes on this update: - alloc_nftnl_setelem() needs a variant netlink_gen_data() to deal with the representation of the range on the rhs of the mapping. In contrast to interval concatenation in the key side, where the range is expressed as two netlink attributes, the data side of the set element mapping stores the interval concatenation in a contiguos memory area, see __netlink_gen_concat_expand() for reference. - add range_expr_postprocess() to postprocess the data mapping range. If either one single IP address or port is used, then the minimum and maximum value in the range is the same value, e.g. to avoid listing 80-80, this round simplify the range. This also invokes the range to prefix conversion routine. - add concat_elem_expr() helper function to consolidate code to build the concatenation expression on the rhs element data side. This patch also adds tests/py and tests/shell. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: infer NAT mapping with concatenation from setPablo Neira Ayuso2021-07-137-21/+56
| | | | | | | | | | | | If the map is anonymous, infer it from the set elements. Otherwise, the set definition already have an explicit concatenation definition in the data side of the mapping. This update simplifies the NAT mapping syntax with concatenations, e.g. snat ip to ip saddr map { 10.141.11.4 : 192.168.2.3 . 80 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove STMT_NAT_F_INTERVAL flags and interval keywordPablo Neira Ayuso2021-07-139-35/+6
| | | | | | | | | | | | | | | STMT_NAT_F_INTERVAL is not useful, the keyword interval can be removed to simplify the syntax, e.g. snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } This patch reworks 9599d9d25a6b ("src: NAT support for intervals in maps"). Do not remove STMT_NAT_F_INTERVAL yet since this flag is needed for interval concatenations coming in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: stmt and expr error path memleaksPablo Neira Ayuso2021-07-131-10/+10
| | | | | | | | Use stmt_free() and expr_free() to release these objects. Fixes: 671851617c8d ("netlink_delinearize: Fix resource leaks") Fixes: 3a8640672978 ("src: hash: support of symmetric hash") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: get `make distcheck` to pass againDuncan Roe2021-07-051-0/+1
| | | | | | | | Commit 4694f7230195 introduced nfnetlink_hook.h but didn't update the automake system to take account of the new file. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinarize: don't check for set element if set is not populatedFlorian Westphal2021-06-302-0/+14
| | | | | | | | | | | | 0065_icmp_postprocessing: line 13: Segmentation fault $NFT insert rule ip x foo index 1 accept Since no listing is done, cache isn't populated and 'nft insert' will trip over set->init == NULL during postprocessing of the existing 'icmp id 42' expression. Fixes: 9a5574e2d4e9 ("netlink_delinearize: add missing icmp id/sequence support") Reported-by: Eric Garver <eric@garver.life> Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* cmd: incorrect error reporting when table declaration existsPablo Neira Ayuso2021-06-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This example ruleset is missing the chain declaration: add table x add set x y { typeof ip saddr ; } add rule x y counter After this patch, error reporting provides suggestions for the missing chain: # nft -f ruleset.nft ruleset.nft:3:12-12: Error: No such file or directory; did you mean chain ‘INPUT’ in table ip ‘filter’? add rule x y counter ^ Before this patch, it incorrectly refers to the table: ruleset.nft:3:10-10: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x y counter ^ This patch invalidates the table that is found via fuzzy lookup if it exists in the cache. Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: incorrect table location in error reportingPablo Neira Ayuso2021-06-291-8/+8
| | | | | | | | | | | | | | | | | If the command refers to an inexisting table, then use the table location. ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ before this patch location is not correct: ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: obj_free() releases timeout state stringPablo Neira Ayuso2021-06-231-0/+1
| | | | | | | Missing free() on the timeout state string on object release. Fixes: 7a0e26723496 ("rule: memleak of list of timeout policies" Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: memleak in rate limit parserPablo Neira Ayuso2021-06-231-0/+1
| | | | | | | | | | Direct leak of 13 byte(s) in 1 object(s) allocated from: #0 0x7fb49ad79810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7fb496b8f63a in xstrdup /home/pablo/nftables/src/utils.c:85 #2 0x7fb496c9a79d in nft_lex /home/pablo/nftables/src/scanner.l:740 [...] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: string memleak in YYERROR pathPablo Neira Ayuso2021-06-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | Release dynamically allocated string by lex from the YYERROR path, e.g. # cat test.nft table x { map test { type ipv4_addr . foo . inet_service : ipv4_addr . inet_service } } # nft -f test.nft test.nft:3:20-22: Error: unknown datatype foo type ipv4_addr . foo . inet_service : ipv4_addr . inet_service ^^^ test.nft:6-9: Error: set definition does not specify key map test { ^^^^ ==29692==ERROR: LeakSanitizer: detected memory leaks Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x7f6c869e8810 in strdup (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x3a810) #1 0x7f6c8637f63a in xstrdup /home/test/nftables/src/utils.c:85 #2 0x7f6c8648a4d3 in nft_lex /home/test/nftables/src/scanner.l:740 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: fix memleak when first message in batch is used to report errorPablo Neira Ayuso2021-06-231-0/+6
| | | | | | | | | The err->seqnum == batch_seqnum case results in a memleak of mnl_err objects under some scenarios such as nf_tables kernel support is not available or user runs the nft executable as non-root. Fixes: f930cc500318 ("nftables: fix supression of "permission denied" errors") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix maps with key and data concatenationsPablo Neira Ayuso2021-06-233-6/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | expr_evaluate_concat() is overloaded, it deals with two cases: #1 set key and data definitions, this case uses the special dynamically created concatenation datatype which is taken from the context. #2 set elements, this case iterates over the set key and data expressions that are components of the concatenation tuple, to fetch the corresponding datatype. Add a new function to deal with case #1 specifically. This patch is implicitly fixing up map that include arbitrary concatenations. This is failing with a spurious error report such as: # cat bug.nft table x { map test { type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service } } # nft -f bug.nft bug.nft:3:48-71: Error: datatype mismatch, expected concatenation of (IPv4 address, Internet protocol, internet network service), expression has type concatenation of (IPv4 address, internet network service) type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service ^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: queue: allow use of MAP statement for queue number retrievalFlorian Westphal2021-06-215-2/+49
| | | | | | | | | This allows to chose a queue number at run time using map statements, e.g.: queue flags bypass to ip saddr map { 192.168.7/24 : 0, 192.168.0/24 : 1 } Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend queue testcases for new sreg supportFlorian Westphal2021-06-213-0/+82
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: queue: allow use of arbitrary queue expressionsFlorian Westphal2021-06-216-25/+93
| | | | | | | | | | | | | | | | | | | | | back in 2016 Liping Zhang added support to kernel and libnftnl to specify a source register containing the queue number to use. This was never added to nft itself, so allow this. On linearization side, check if attached expression is a range. If its not, allocate a new register and set NFTNL_EXPR_QUEUE_SREG_QNUM attribute after generating the lowlevel expressions for the kernel. On delinarization we need to check for presence of NFTNL_EXPR_QUEUE_SREG_QNUM and decode the expression(s) when present. Also need to do postprocessing for STMT_QUEUE so that the protocol context is set correctly, without this only raw payload expressions will be shown (@nh,32,...) instead of 'ip ...'. Next patch adds test cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: new queue flag input formatFlorian Westphal2021-06-214-11/+19
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: add queue_stmt_compatFlorian Westphal2021-06-211-8/+11
| | | | | | | | | | | | | | | | | | | | | Rename existing rules to _compat to make sure old rules using 'queue' statement will work. Next patch adds distinct input format where flags are explicitly provided: queue flags name,<nextflag> num 1 Without this, extension of queue expression to handle arbitrary expression instead of queue number or range results in parser errors. Example: queue num jhash ip saddr mod 4 and 1 bypass will fail because scanner is still in 'ip' state, not 'queue', when "bypass" is read. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add queue expr and flags to queue_stmt_allocFlorian Westphal2021-06-215-22/+25
| | | | | | Preparation patch to avoid too much $<stmt>$ references in the parser. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: restrict queue num expressivenessFlorian Westphal2021-06-211-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Else we run into trouble once we allow queue num symhash mod 4 and 1 and so on. Example problem: queue num jhash ip saddr mod 4 and 1 bypass This will fail to parse because the scanner is in the wrong state (ip, not queue), so 'bypass' is parsed as a string. Currently, while nft will eat the above just fine (minus 'bypass'), nft rejects this from the evaluation phase with Error: queue number is not constant So seems we are lucky and can restrict the supported expressions to integer and range. Furthermore, the line looks wrong because this statement: queue num jhash ip saddr mod 4 and 1 bypass doesn't specifiy a number, "queue num 4" does, or "queue num 1-2" do. For arbitrary expr support it seems sensible to enforce stricter ordering to avoid any problems with the flags, for example: queue bypass,futurekeyword to jhash ip saddr mod 42 Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: fix hash expression maxvalFlorian Westphal2021-06-181-2/+6
| | | | | | | | It needs to account for the offset too. Fixes: 9bee0c86f179 ("src: add offset attribute for hash expression") Fixes: d4f9a8fb9e9a ("src: add offset attribute for numgen expression") Signed-off-by: Florian Westphal <fw@strlen.de>