summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* tests: shell: extend catchall tests for mapsPablo Neira Ayuso2021-12-152-0/+11
| | | | | | Add a few tests for the catchall features and maps. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix autoconf warningsJeremy Sowden2021-12-151-5/+3
| | | | | | | | | | | | | | | | | | | | | | | autoconf complains about three obsolete macros. `AC_CONFIG_HEADER` has been superseded by `AC_CONFIG_HEADERS`, so replace it. `AM_PROG_LEX` calls `AC_PROG_LEX` with no arguments, but this usage is deprecated. The only difference between `AM_PROG_LEX` and `AC_PROG_LEX` is that the former defines `$LEX` as "./build-aux/missing lex" if no lex is found to ensure a useful error is reported when make is run. How- ever, the configure script checks that we have a working lex and exits with an error if none is available, so `$LEX` will never be called and we can replace `AM_PROG_LEX` with `AC_PROG_LEX`. `AM_PROG_LIBTOOL` has been superseded by `LT_INIT`, which is already in configure.ac, so remove it. We can also replace `AC_DISABLE_STATIC` with an argument to `LT_INIT`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: remove stray debug flag.Jeremy Sowden2021-12-151-1/+1
| | | | | | | 0040mark_shift_0 was passing --debug=eval to nft. Remove it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: support ethernet as L2 protocol for inet tableJeremy Sowden2021-12-154-1/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we are evaluating a `reject` statement in the `inet` family, we may have `ether` and `ip` or `ip6` as the L2 and L3 protocols in the evaluation context: table inet filter { chain input { type filter hook input priority filter; ether saddr aa:bb:cc:dd:ee:ff ip daddr 192.168.0.1 reject } } Since no `reject` option is given, nft attempts to infer one and fails: BUG: unsupported familynft: evaluate.c:2766:stmt_evaluate_reject_inet_family: Assertion `0' failed. Aborted The reason it fails is that the ethernet protocol numbers for IPv4 and IPv6 (`ETH_P_IP` and `ETH_P_IPV6`) do not match `NFPROTO_IPV4` and `NFPROTO_IPV6`. Add support for the ethernet protocol numbers. Replace the current `BUG("unsupported family")` error message with something more informative that tells the user to provide an explicit reject option. Add a Python test case. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001360 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: correct typo'sJeremy Sowden2021-12-151-2/+2
| | | | | | | There are a couple of mistakes in comments. Fix them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: short-circuit loops over upper protocolsJeremy Sowden2021-12-151-3/+7
| | | | | | | | | Each `struct proto_desc` contains a fixed-size array of higher layer protocols. Only the first few are not NULL. Therefore, we can stop iterating over the array once we reach a NULL member. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: zero shift removalFlorian Westphal2021-12-093-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | Remove shifts-by-0. These can occur after binop postprocessing has adjusted the RHS value to account for a mask operation. Example: frag frag-off @s4 Is internally represented via: [ exthdr load ipv6 2b @ 44 + 2 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000f8ff ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000003 ) ] [ lookup reg 1 set s ] First binop masks out unwanted parts of the 16-bit field. Second binop needs to left-shift so that lookups in the set will work. When decoding, the first binop is removed after the exthdr load has been adjusted accordingly. Constant propagation adjusts the shift-value to 0 on removal. This change then gets rid of the shift-by-0 entirely. After this change, 'frag frag-off @s4' input is shown as-is. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: and/shift postprocessingFlorian Westphal2021-12-091-0/+7
| | | | | | | | | | | | | | | | | Before this patch: in: frag frag-off @s4 in: ip version @s8 out: (@nh,0,8 & 0xf0) >> 4 == @s8 out: (frag unknown & 0xfff8 [invalid type]) >> 3 == @s4 after: out: frag frag-off >> 0 == @s4 out: ip version >> 0 == @s8 Next patch adds support for zero-shift removal. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: skip templates with meta key setFlorian Westphal2021-12-091-0/+3
| | | | | | | | | | | | | | | | | | | | meta templates are only there for ease of use (input/parsing). When listing, they should be ignored: set s4 { typeof ip version elements = { 1, } } chain c4 { ip version @s4 accept } gets listed as 'ip l4proto ...' which is nonsensical. after this patch we get: in: ip version @s4 out: (@nh,0,8 & 0xf0) >> 4 == @s4 .. which is (marginally) better. Next patch adds support for payload decoding. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add shift+and typeof test casesFlorian Westphal2021-12-092-0/+29
| | | | | | | | | | | | | | These tests work, but I omitted a few lines that do not: in: frag frag-off @s4 accept in: ip version @s8 out: (frag unknown & 0xfff8 [invalid type]) >> 3 == @s4 out: (ip l4proto & pfsync) >> 4 == @s8 Next patches resolve this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: better parameters for the interval stack overflow testŠtěpán Němec2021-12-081-2/+2
| | | | | | | | | | | | | | | | | | Wider testing has shown that 128 kB stack is too low (e.g. for systems with 64 kB page size), leading to false failures in some environments. Based on results from a matrix of RHEL 8 and RHEL 9 systems across x86_64, aarch64, ppc64le and s390x architectures as well as some anecdotal testing of other Linux distros on x86_64 machines, 400 kB seems safe: the normal nft stack (which should stay constant during this test) on all tested systems doesn't exceed 200 kB (stays around 100 kB on typical systems with 4 kB page size), while always growing beyond 500 kB in the failing case (nftables before baecd1cf2685) with the increased set size. Fixes: d8ccad2a2b73 ("tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set")") Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* iptopt: fix crash with invalid field/type comboFlorian Westphal2021-12-074-4/+18
| | | | | | | | | | | | | | | % nft describe ip option rr value segmentation fault after this fix, this exits with 'Error: unknown ip option type/field'. Problem is that 'rr' doesn't have a value template, so the template struct is all-zeroes, so we crash when trying to use tmpl->dtype (its NULL). Furthermore, expr_describe tries to print expr->identifier but expr is exthdr, not symbol: ->identifier contains garbage. Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: support ip/tcp options and sctp chunks in typeof expressionsFlorian Westphal2021-12-073-7/+94
| | | | | | | | | This did not store the 'op' member and listing always treated this as ipv6 extension header. Add test cases for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* ipopt: drop unused 'ptr' argumentFlorian Westphal2021-12-074-26/+7
| | | | | | | | | Its always 0, so remove it. Looks like this was intended to support variable options that have array-like members, but so far this isn't implemented, better remove dead code and implement it properly when such support is needed. Signed-off-by: Florian Westphal <fw@strlen.de>
* cache: Support filtering for a specific flowtablePhil Sutter2021-12-036-24/+103
| | | | | | | | | | Extend nft_cache_filter to hold a flowtable name so 'list flowtable' command causes fetching the requested flowtable only. Dump flowtables just once instead of for each table, merely assign fetched data to tables inside the loop. Signed-off-by: Phil Sutter <phil@nwl.cc>
* cache: Filter set list on server sidePhil Sutter2021-12-033-31/+49
| | | | | | | | | Fetch either all tables' sets at once, a specific table's sets or even a specific set if needed instead of iterating over the list of previously fetched tables and fetching for each, then ignoring anything returned that doesn't match the filter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* cache: Filter chain list on kernel sidePhil Sutter2021-12-033-23/+39
| | | | | | | | | | | | | When operating on a specific chain, add payload to NFT_MSG_GETCHAIN so kernel returns only relevant data. Since ENOENT is an expected return code, do not treat this as error. While being at it, improve code in chain_cache_cb() a bit: - Check chain's family first, it is a less expensive check than comparing table names. - Do not extract chain name of uninteresting chains. Signed-off-by: Phil Sutter <phil@nwl.cc>
* cache: Filter rule list on kernel sidePhil Sutter2021-12-033-24/+24
| | | | | | | | | | | Instead of fetching all existing rules in kernel's ruleset and filtering in user space, add payload to the dump request specifying the table and chain to filter for. Since list_rule_cb() no longer needs the filter, pass only netlink_ctx to the callback and drop struct rule_cache_dump_ctx. Signed-off-by: Phil Sutter <phil@nwl.cc>
* cache: Filter tables on kernel sidePhil Sutter2021-12-035-15/+33
| | | | | | | | | | | Instead of requesting a dump of all tables and filtering the data in user space, construct a non-dump request if filter contains a table so kernel returns only that single table. This should improve nft performance in rulesets with many tables present. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: add tcp subtype match test casesFlorian Westphal2021-12-013-0/+78
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: fix tcpopt_find_template to use length after mask adjustmentFlorian Westphal2021-12-013-30/+27
| | | | | | | | | | | | | | | | | | | | | | Unify binop handling for ipv6 extension header, ip option and tcp option processing. Pass the real offset and length expected, not the one used in the kernel. This was already done for extension headers and ip options, but tcp option parsing did not do this. This was fine before because no existing tcp option template had a non-byte sized member. With mptcp addition this isn't the case anymore, subtype field is only 4 bits wide, but tcp option delinearization passed 8bits instead. Pass the offset and mask delta, just like ip option/ipv6 exthdr. This makes nft show 'tcp option mptcp subtype 1' instead of 'tcp option mptcp unknown & 240 == 16'. Signed-off-by: Florian Westphal <fw@strlen.de>
* mptcp: add subtype matchingFlorian Westphal2021-12-014-1/+13
| | | | | | | | | | | | | | | | | | | | | | MPTCP multiplexes the various mptcp signalling data using the first 4 bits of the mptcp option. This allows to match on the mptcp subtype via: tcp option mptcp subtype 1 This misses delinearization support. mptcp subtype is the first tcp option field that has a length of less than one byte. Serialization processing will add a binop for this, but netlink delinearization can't remove them, yet. Also misses a new datatype/symbol table to allow to use mnemonics like 'mp_join' instead of raw numbers. For this reason, no tests are added yet. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: add test cases for md5sig, fastopen and mptcp mnemonicsFlorian Westphal2021-12-013-0/+63
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: add md5sig, fastopen and mptcp optionsFlorian Westphal2021-12-014-2/+49
| | | | | | | | | Allow to use "fastopen", "md5sig" and "mptcp" mnemonics rather than the raw option numbers. These new keywords are only recognized while scanner is in tcp state. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: split tcp option rulesFlorian Westphal2021-12-011-19/+61
| | | | | | | | | | | | | | | At this time the parser will accept nonsensical input like tcp option mss left 2 which will be treated as 'tcp option maxseg size 2'. This is because the enum space overlaps. Split the rules so that 'tcp option mss' will only accept field names specific to the mss/maxseg option kind. Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit 46168852c03d73c29b557c93029dc512ca6e233a)
* scanner: add tcp flex scopeFlorian Westphal2021-12-013-11/+18
| | | | | | | | This moves tcp options not used anywhere else (e.g. in synproxy) to a distinct scope. This will also allow to avoid exposing new option keywords in the ruleset context. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: remove KIND keywordFlorian Westphal2021-12-016-83/+56
| | | | | | | | | | | | | | | | tcp option <foo> kind ... never makes any sense, as "tcp option <foo>" already tells the kernel to look for the foo <kind>. "tcp option sack kind 5" matches if the sack option is present; its a more complicated form of the simpler "tcp option sack exists". "tcp option sack kind 1" (or any other value than 5) will never match. So remove this. Test cases are converted to "exists". Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: binop: make accesses to expr->left/right conditionalFlorian Westphal2021-12-011-19/+31
| | | | | | | | | | | This function can be called for different expression types, including some (EXPR_MAP) where expr->left/right alias to different member variables. This makes accesses to those members conditional by checking the expression type ahead of the access. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: rename misleading variableFlorian Westphal2021-12-011-12/+12
| | | | | | | | | | | | relational_binop_postprocess() is called for EXPR_RELATIONAL, so "expr->right" is safe to use. But the RHS can be something other than a value. This has been extended to handle other types, so rename to 'right'. No code changes intended. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: use correct member typeFlorian Westphal2021-12-011-1/+1
| | | | | | | expr is a map, so this should use expr->map, not expr->left. These fields are aliased, so this would break if that is ever changed. Signed-off-by: Florian Westphal <fw@strlen.de>
* cli: save history on ctrl-d with editlinePablo Neira Ayuso2021-11-301-7/+14
| | | | | | | | | | | Missing call to cli_exit() to save the history when ctrl-d is pressed in nft -i. Moreover, remove call to rl_callback_handler_remove() in cli_exit() for editline cli since it does not call rl_callback_handler_install(). Fixes: bc2d5f79c2ea ("cli: use plain readline() interface with libedit") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: Fix for escaped asterisk strings on Big EndianPhil Sutter2021-11-301-40/+17
| | | | | | | | | | | The original nul-char detection was not functional on Big Endian. Instead, go a simpler route by exporting the string and working on the exported data to check for a nul-char and escape a trailing asterisk if present. With the data export already happening in the caller, fold escaped_string_wildcard_expr_alloc() into it as well. Fixes: b851ba4731d9f ("src: add interface wildcard matching") Signed-off-by: Phil Sutter <phil@nwl.cc>
* ct: Fix ct label value parserPhil Sutter2021-11-301-3/+2
| | | | | | | | Size of array to export the bit value into was eight times too large, so on Big Endian the data written into the data reg was always zero. Fixes: 2fcce8b0677b3 ("ct: connlabel matching support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* datatype: Fix size of time_typePhil Sutter2021-11-301-2/+4
| | | | | | | | | Used by 'ct expiration', time_type is supposed to be 32bits. Passing a 64bits variable to constant_expr_alloc() causes the value to be always zero on Big Endian. Fixes: 0974fa84f162a ("datatype: seperate time parsing/printing from time_type") Signed-off-by: Phil Sutter <phil@nwl.cc>
* meta: Fix hour_type sizePhil Sutter2021-11-301-4/+5
| | | | | | | | | | | | In kernel as well as when parsing, hour_type is assumed to be 32bits. Having the struct datatype field set to 64bits breaks Big Endian and so does passing a 64bit value and 32 as length to constant_expr_alloc() as it makes it import the upper 32bits. Fix this by turning 'result' into a uint32_t and introduce a temporary uint64_t just for the call to time_parse() which expects that. Fixes: f8f32deda31df ("meta: Introduce new conditions 'time', 'day' and 'hour'") Signed-off-by: Phil Sutter <phil@nwl.cc>
* meta: Fix {g,u}id_type on Big EndianPhil Sutter2021-11-301-6/+10
| | | | | | | | | | | | Using a 64bit variable to temporarily hold the parsed value works only on Little Endian. uid_t and gid_t (and therefore also pw->pw_uid and gr->gr_gid) are 32bit. To fix this, use uid_t/gid_t for the temporary variable but keep the 64bit one for numeric parsing so values exceeding 32bits are still detected. Fixes: e0ed4c45d9ad2 ("meta: relax restriction on UID/GID parsing") Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: Fix payload statement mask on Big EndianPhil Sutter2021-11-301-2/+2
| | | | | | | | The mask used to select bits to keep must be exported in the same byteorder as the payload statement itself, also the length of the exported data must match the number of bytes extracted earlier. Signed-off-by: Phil Sutter <phil@nwl.cc>
* mnl: Fix for missing info in rule dumpsPhil Sutter2021-11-301-1/+12
| | | | | | | | | | | Commit 0e52cab1e64ab improved error reporting by adding rule's table and chain names to netlink message directly, prefixed by their location info. This in turn caused netlink dumps of the rule to not contain table and chain name anymore. Fix this by inserting the missing info before dumping and remove it afterwards to not cause duplicated entries in netlink message. Signed-off-by: Phil Sutter <phil@nwl.cc>
* exthdr: Fix for segfault with unknown exthdrPhil Sutter2021-11-301-5/+7
| | | | | | | | | Unknown exthdr type with NFT_EXTHDR_F_PRESENT flag set caused NULL-pointer deref. Fix this by moving the conditional exthdr.desc deref atop the function and use the result in all cases. Fixes: e02bd59c4009b ("exthdr: Implement existence check") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/py: Avoid duplicate records in *.got filesPhil Sutter2021-11-301-10/+19
| | | | | | | | | | If payloads don't contain family-specific bits, they may sit in a single *.payload file for all tested families. In such case, nft-test.py will consequently write dissenting payloads into a single *.got file. To avoid the duplicate entries, check if a matching record exists already before writing it out. Signed-off-by: Phil Sutter <phil@nwl.cc>
* exthdr: fix type number saved in udataFlorian Westphal2021-11-303-3/+11
| | | | | | | | | This should store the index of the protocol template, but &x[i] - &x[0] is always i, so remove the divide. Also add test case. Fixes: 01fbc1574b9e ("exthdr: add parse and build userdata interface") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* cli: remove #include <editline/history.h>Pablo Neira Ayuso2021-11-221-1/+0
| | | | | | | | This header is not required to compile nftables with editline, remove it, this unbreak compilation in several distros which have no symlink from history.h to editline.h Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: different signedness compilation warningPablo Neira Ayuso2021-11-191-1/+1
| | | | | | | | | mnl.c: In function ‘mnl_batch_talk’: mnl.c:417:17: warning: comparison of integer expressions of different signedness: ‘unsigned in’ and ‘long int’ [-Wsign-compare] if (rcvbufsiz < NFT_MNL_ECHO_RCVBUFF_DEFAULT) ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: do not skip populating anonymous set with -tPablo Neira Ayuso2021-11-183-6/+10
| | | | | | | | | | | | | | | | | | | --terse does not apply to anonymous set, add a NFT_CACHE_TERSE bit to skip named sets only. Moreover, prioritize specific listing filter over --terse to avoid a bogus: netlink: Error: Unknown set '__set0' in lookup expression when invoking: # nft -ta list set inet filter example Extend existing test to improve coverage. Fixes: 9628d52e46ac ("cache: disable NFT_CACHE_SETELEM_BIT on --terse listing only") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to 1.0.1v1.0.1Pablo Neira Ayuso2021-11-181-3/+3
| | | | | | Requires libnftnl 1.2.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: do not call interval_map_decompose() for concat intervalsFlorian Westphal2021-11-172-1/+11
| | | | | | | | | | | | | | Without this, nft monitor will either print garbage or even segfault when encountering a concat set because we pass expr->value to libgmp helpers for concat (non-value) expressions. Also, for concat case, we need to call concat_range_aggregate() helper. Add a test case for this. Without this patch, it gives: tests/monitor/run-tests.sh: line 98: 1163 Segmentation fault (core dumped) $nft -nn -e -f $command_file > $echo_output Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: add raw payload inner header match supportPablo Neira Ayuso2021-11-174-0/+27
| | | | | | | Add missing "ih" base raw payload and extend tests/py to cover this new usecase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow for string raw payload basePablo Neira Ayuso2021-11-162-3/+11
| | | | | | | Remove new 'ih' token, allow to represent the raw payload base with a string instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: remove netdev coverage in ip/ip_tcp.tPablo Neira Ayuso2021-11-122-96/+0
| | | | | | | | | | | | | The following tests shows a warning in the netdev family: ip/ip_tcp.t: WARNING: line 9: 'add rule netdev test-netdev ingress ip protocol tcp tcp dport 22': 'tcp dport 22' mismatches 'ip protocol 6 tcp dport 22' 'ip protocol tcp' can be removed in the ip family, but not in netdev. This test is specific of the ip family, remove the netdev lines. Fixes: 510c4fad7e78 ("src: Support netdev egress hook") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing json output update in ip6/meta.tPablo Neira Ayuso2021-11-121-0/+16
| | | | | | | Update json output for 'meta protocol ip6 udp dport 67'. Fixes: 646c5d02a5db ("rule: remove redundant meta protocol from the evaluation step") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>