summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* expression: Show the base which pre-defined constants are displayedElise Lennion2016-12-207-1/+24
| | | | | | | | | | so the user know how we express it. The base was added to all symbol tables, which are associated with datatype->sym_tbl, so they are displayed in the right base. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: fix IPv6 layer 4 checksum manglingPablo Neira Ayuso2016-12-161-5/+4
| | | | | | | In IPv6 there is no checksum field. We always have to trigger layer 4 checksum mangling if any of the layer 3 pseudoheader fields are updated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update quota and payloadPablo Neira Ayuso2016-12-1411-61/+61
| | | | | | Include new consumed field for quota, and check for csum_flags in payload. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: don't send empty set elements netlink message to kernelPablo Neira Ayuso2016-12-143-5/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following command: # nft --debug=mnl add rule x y flow table xyz { ip saddr timeout 30s counter } breaks with EINVAL. The following netlink message is causing the problem: ... ---------------- ------------------ | 0000000044 | | message length | | 02572 | R--- | | type | flags | | 0000000004 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 02 00 00 00 | | extra header | |00008|--|00002| |len |flags| type| | 78 79 7a 00 | | data | x y z |00008|--|00004| |len |flags| type| | 00 00 00 01 | | data | |00006|--|00001| |len |flags| type| | 78 00 00 00 | | data | x ---------------- ------------------ ... This is incorrect since this describes no elements at all, so it is useless. Add upfront check before iterating over the list of set elements so the netlink message is not placed in the batch. This patch also adds a set so flow tables are minimally covered. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: don't trigger error on exact overlapsPablo Neira Ayuso2016-12-131-0/+4
| | | | | | | | | | | | | | | | So adding the same element doesn't trigger any error: # nft add element filter bogons { 3.3.3.123/24 } # nft add element filter bogons { 3.3.3.123/24 } Still kernel reports an error if we use create instead: # nft create element filter bogons { 3.3.3.123/24 } <cmdline>:1:1-46: Error: Could not process rule: File exists create element filter bogons { 3.3.3.123/24 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: wrong prefix expression length on interval_map_decompose()Pablo Neira Ayuso2016-12-131-1/+2
| | | | | | | | | | | | | | | | | interval_map_decompose() sets expr->len to zero. This causes problems from expr_to_intervals() that calls range_expr_value_high() and calculates: expr->len - expr->prefix_len this operation underflows, then mpz_init_bitmask() allocates a huge bitmask. Use expr_value(i)->len given that we already use this to calculate the prefix length. Reported-by: Richard Mörbitz <richard.moerbitz@tu-dresden.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Display pre-defined inet_service values in decimal baseElise Lennion2016-12-113-4/+20
| | | | | | | | | because the convention is to represent ports in base 10. gcc-workaround is no longer needed and was removed. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Display pre-defined inet_service values in host byte orderElise Lennion2016-12-103-6/+26
| | | | | | | | | | | | nft describe displays, to the user, which values are available for a selector, then the values should be in host byte order. Variable size was replaced by len to better match the common pattern. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support to flush setsPablo Neira Ayuso2016-12-054-1/+16
| | | | | | | | | | You can use this new command to remove all existing elements in a set: # nft flush set filter xyz After this command, the set 'xyz' in table 'filter' becomes empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: trigger layer 4 checksum when pseudoheader fields are modifiedPablo Neira2016-12-044-0/+31
| | | | | | | | This patch sets the NFT_PAYLOAD_L4CSUM_PSEUDOHDR when any of the pseudoheader fields are modified. This implicitly enables stateless NAT, that can be useful under some circuntances. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add test case for inserting element into verdict mapLiping Zhang2016-12-041-0/+25
| | | | | | | | | | "dalegaard@gmail.com" reports that when inserting an element into a verdict map, kernel crash will happen. Now add this test case so we can avoid future regressions fail. Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Acked-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: return ctx->table from table_lookup_global()Pablo Neira Ayuso2016-12-011-1/+1
| | | | | | | | | | Instead of returning ctx->cmd->table. Note that ctx->cmd->table and ctx->table points to the same object when all commands are embedded into the table definition. But this is not true if we mix table definitions with linear list commands in one file that we load via nft -f. Reported-by: Martin Bednar <martin@serafean.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Update cache on flush rulesetAnatole Denis2016-12-011-1/+24
| | | | | | | | | | | | | | After a flush, the cache should be empty, otherwise the cache and the expected state are desynced, causing unwarranted errors. See tests/shell/testcases/cache/0002_interval_0. `flush table` and `flush chain` don't empty sets or destroy chains, so the cache does not need an update in those cases, since only chain names and set contents are held in cache for commands other than "list" Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Introduce helper function cache_flushAnatole Denis2016-12-012-1/+7
| | | | | | | | | cache_release empties the cache, and marks it as uninitialized. Add cache_flush, which does the same, except it keeps the cache initialized, eg. after a "nft flush ruleset" when empty is the correct state of the cache. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: honor -nn option from inet_service_type_print()Pablo Neira Ayuso2016-11-301-0/+4
| | | | | | | | If -nn is passed, we have to display ports in numbers, not as a symbol. Fixes: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Test TCP flags match with parenthesesPhil Sutter2016-11-305-0/+33
| | | | | | | | This should test the fix in commit 7222680eb328b ("parser_bison: Allow parens on RHS of relational_expr"). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* bison: remove old log level tokensFlorian Westphal2016-11-301-8/+0
| | | | | | | not used anymore since 0423caa91ad26e7 ("src: don't need keyword for log level") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Replace getnameinfo() by internal lookup tableElise Lennion2016-11-304-13/+348
| | | | | | | | | | | | | | | To avoid exceeding the inputs number limit of the flex scanner used, when calling getnameinfo() in inet_service_type_print(). The new symbol_table was associated with inet_service_type, to enable listing all pre-defined services using nft command line tool. The listed services are all well-known and registered ports of my local /etc/services file, from Ubuntu 16.04. Service numbers are converted to respect network byte order. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Allow parens on RHS of relational_exprPhil Sutter2016-11-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is useful to allow a construct such as: | tcp flags & (syn|fin) == (syn|fin) Before, only the parentheses on the left side were allowed, but via a quite funny path through the parser: * expr might be a concat_expr * concat_expr might be a basic_expr * basic_expr is an inclusive_or_expr * inclusive_or_expr might be an exclusive_or_expr * exclusive_or_expr might be an and_expr * and_expr might be 'and_expr AMPERSAND shift_expr' -> here we eliminate 'flags &' in above statement * shift_expr might be a primary_expr * primary_expr might be '( basic_expr )' Commit a3e60492a684b ("parser: restrict relational rhs expression recursion") introduced rhs_expr to disallow recursion on RHS, so just reverting that change for relational_expr is a no go. Allowing rhs_expr to be '( rhs_expr )' though seems way too intrusive to me since it's being used in all kinds of places, so this patch is the safest way to allow the above I could come up with. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcase for different defines usageArturo Borrero Gonzalez2016-11-291-0/+44
| | | | | | | | | | | | | | | | | | This testcase add some defines in a nft -f run and then uses them in different spots (which are not covered in previous testcases). * defines used to define another one * different datatypes (numbers, strings, bits, ranges) * usage in sets, maps, contatenatios * single rules with single statements, multiple statements * reuse define in same rule Perhaps this isn't testing many different code path, but I find this interesting to have given it will probably be one of the most common use cases of nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add a testcase for many definesArturo Borrero Gonzalez2016-11-291-0/+37
| | | | | | | Use many defines in a single nft -f run. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Unmask negative set lookupAnatole Denis2016-11-2985-226/+4690
| | | | | | | | Many testcases were masked because of bug #888. This series of patches unmasks them Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Interpret OP_NEQ against a set as OP_LOOKUPAnatole Denis2016-11-293-5/+33
| | | | | | | | | | Now that the support for inverted matching is in the kernel and in libnftnl, add it to nftables too. This fixes bug #888 Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "evaluate: check for NULL datatype in rhs in lookup expr"Anatole Denis2016-11-291-23/+8
| | | | | | | | | This reverts commit 5afa5a164ff1c066af1ec56d875b91562882bd50. This commit is obsoleted by removing the possibility for a NULL right->dtype in the first place, at set declaration. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add regression test for malformed setsAnatole Denis2016-11-291-0/+33
| | | | | | | | | | see: 5afa5a164ff1c066af1ec56d875b91562882bd50 When a malformed set is added, it was added before erroring out, causing a segfault further down when used. This tests for this case, ensuring that nftables doesn't segfault but errors correctly Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Add set to cache only when well-formedAnatole Denis2016-11-291-3/+3
| | | | | | | | | | | | | | | When creating a set (in set_evaluate), it is added to the table cache before being checked for correctness. When the set is ill-formed, the function returns without removing the (non-existent, since the function returned) set. Further references to this set will not result in an error (since the set is in the lookup table), but the malformed set will probably cause a segfault. The symptom (the segfault) was fixed by checking for NULL when evaluating a reference to the set (commit 5afa5a164ff1c066af1ec56d875b91562882bd50), this should fix the root cause. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add log flags syntax supportLiping Zhang2016-11-2411-6/+179
| | | | | | | | | | | | | | | | | | | | | Now NF_LOG_XXX is exposed to the userspace, we can set it explicitly. Like iptables LOG target, we can log TCP sequence numbers, TCP options, IP options, UID owning local socket and decode MAC header. Note the log flags are mutually exclusive with group. Some examples are listed below: # nft add rule t c log flags tcp sequence,options # nft add rule t c log flags ip options # nft add rule t c log flags skuid # nft add rule t c log flags ether # nft add rule t c log flags all # nft add rule t c log flags all group 1 <cmdline>:1:14-16: Error: flags and group are mutually exclusive add rule t c log flags all group 1 ^^^ Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: another testcase for deleting many set elementsArturo Borrero Gonzalez2016-11-241-0/+48
| | | | | | | | | This testcase adds and deletes many elements in a set. We add and delete 65.536 elements in two different nft -f runs. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: testcase for deleting many set elementsArturo Borrero Gonzalez2016-11-241-0/+46
| | | | | | | | | | This testcase adds and deletes many elements in a set. We add and delete 65.536 elements in a same batch of netlink messages, (single nft -f run). Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: testcase for adding many set elementsArturo Borrero Gonzalez2016-11-241-0/+32
| | | | | | | | This testcase adds many elements in a set. We add 65.356 elements. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: allow to execute a single testcaseArturo Borrero Gonzalez2016-11-241-0/+11
| | | | | | | | | | | | | Using, for example: % sudo ./run-tests.sh testcase/mytest_0 Will result in an execution of this single testcase rather than the complete suite. This is useful while working with a concrete testcase. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh nf_tables.h headerPablo Neira Ayuso2016-11-241-4/+12
| | | | | | Fetch what we have at 4.9-rc6. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "tests: py: nft-tests.py: Add function for loading and removing ↵Florian Westphal2016-11-171-32/+0
| | | | | | | | | | | | | | | | | kernel modules" Its not needed at the moment, all tests that need a network interface (meta iif/oif) use the lo interface. For iifname/oifname the network device doesn't have to exist. We can revisit this in case we need it in the future. (seems commit causes issues on kernels built without dummy module). Reported-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Manuel Messner <mm@skelett.io>
* mnl: use nftnl_set_elems_nlmsg_build_payload_iter() when deleting elementsPablo Neira Ayuso2016-11-141-14/+11
| | | | | | | | | Otherwise, nft crashes when deleting a very large number of elements. *** stack smashing detected ***: nft terminated Segmentation fault Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add notrack supportPablo Neira Ayuso2016-11-1410-0/+55
| | | | | | | This patch adds the notrack statement, to skip connection tracking for certain packets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: missing range conversion in icmpv6Pablo Neira Ayuso2016-11-141-2/+1
| | | | | | Use range expression to negate ranges. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add some testcases for log flagsPablo Neira Ayuso2016-11-143-17/+17
| | | | | | | Remove null and zero flags from tests, to reduce the noise when running tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add testcases for comments in set elementsArturo Borrero Gonzalez2016-11-093-0/+35
| | | | | | | | This patch adds a several testcases for comments in set elements. This includes the netfilter bug #1090 about comments in set interval elements. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: keep element comments in set intervalsPablo Neira Ayuso2016-11-091-3/+7
| | | | | | | | | The conversion from the set element range representation to element intervals doesn't keep the comment information around. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1090 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>
* src: add offset attribute for hash expressionLaura Garcia Liebana2016-11-099-9/+36
| | | | | | | | | | | Add support to add an offset to the hash generator, eg. ct mark set hash ip saddr mod 10 offset 100 This will generate marks with series between 100-109. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make hash seed attribute optionalLaura Garcia Liebana2016-11-093-0/+13
| | | | | | | | | | | | | | | | | | The hash expression requires a seed attribute to call the jhash operation, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef With this patch the seed attribute is optional and it's generated by a random function from userspace, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 The kernel will take care of generate a random seed. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add a new testcase for ruleset loading bugArturo Borrero Gonzalez2016-11-091-0/+27
| | | | | | | | | | | There seems to be a bug that prevent loading a ruleset twice in a row if the ruleset contains sets with intervals. This seems related to the nft cache. By the time of this commit, the bug is not fixed yet. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: introduce the cache testcases directoryArturo Borrero Gonzalez2016-11-091-0/+0
| | | | | | | This directory is for testcases related to the nft cache. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: delete useless stderr output in testcaseArturo Borrero Gonzalez2016-11-091-1/+1
| | | | | | | This stderr output is expected. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: update Arturo Borrero Gonzalez email addressArturo Borrero Gonzalez2016-11-091-1/+1
| | | | | | | Update email address to a new one in the copyright notice. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in flow table keyPablo Neira Ayuso2016-10-313-3/+25
| | | | | | | | | | | | | | | | | | | | | Anders reports that: # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} while the opposite doesn't work: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} netlink_gen_flow_stmt() relies on the flow table key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Reported-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix synopsis for ct expressionAnders K. Pedersen2016-10-311-10/+15
| | | | | | | | | | | | | | | | | | | The nft man page command synopsis for the ct expression is currently: ct {state | direction | status | mark | expiration | helper | label | bytes | packets} {original | reply | {l3proto | protocol | saddr | daddr | proto-src | proto-dst | bytes | packets}} which is not correct for the arguments that should be prefixed with "original" or "reply". Change this to ct {state | direction | status | mark | expiration | helper | label | l3proto | protocol | bytes | packets} ct {original | reply} {l3proto | protocol | saddr | daddr | proto-src | proto-dst | bytes | packets} Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Allow concatenation of rt nexthop etc.Anders K. Pedersen2016-10-311-7/+7
| | | | | | | | | | | | | | | | | | | Concatenations of rt nexthop or ct {orignal | reply} {saddr | daddr} fail due to # nft add rule ip filter postrouting flow table acct \{ ip saddr . rt nexthop counter \} <cmdline>:1:61-70: Error: can not use variable sized data types (invalid) in concat expressions add rule ip filter postrouting flow table acct { ip saddr . rt nexthop counter } ~~~~~~~~~~~^^^^^^^^^^ Fix this by reordering the check for variable size data types in expr_evaluate_concat() to happen after expr_evaluate() has been called (via list_member_evaluate()) for the sub expression. This allows expr_evaluate_[cr]t() to call [cr]t_expr_update_type() and set the data type before the check. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: add missing payload test for numgen offsetPablo Neira Ayuso2016-10-311-0/+5
| | | | | | | | | | The new cover test for: ct mark set numgen inc mod 2 offset 100 was lacking the payload file chunk. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: rename the log level "warning" to "warn"Liping Zhang2016-10-311-1/+1
| | | | | | | | | This is to keep compatibility. The original keyword in grammer is "warn" instead of "warning". Fixes: 0423caa91ad2 ("src: don't need keyword for log level") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-25 22:20:34 +0000