summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* src: get rid of printfPhil Sutter2017-09-2924-404/+495
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Refactor chain_print_declaration()Phil Sutter2017-09-291-12/+6
| | | | | | | | | Instead of having two nearly identical printf() calls for netdev and other chains, print the common parts separately and include the device bit only for netdev chains. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec_print: Pass output FILE pointer to netlink_dump_expr()Phil Sutter2017-09-293-4/+5
| | | | | | | | | | It was a bit odd that erec_print() outputs to a given FILE pointer but then calls netlink_dump_expr() which just prints to stdout. Fix this by passing the given FILE pointer along so output is guaranteed to go to the same destination. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Simplify tcp option printing a bitPhil Sutter2017-09-291-8/+4
| | | | | | | This eliminates the need for that temporary buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Use C99-style initializer in cache_init()Phil Sutter2017-09-291-9/+8
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bison: permit keywords in list_stmt_expressionsFlorian Westphal2017-09-273-4/+13
| | | | | | | | | | | | | 'ct event set label' and 'ct event set new or label' work, but 'ct event set new, label' did not: nft add rule filter input ct event set new,label Error: syntax error, unexpected label This changes the definition to also contain keyword symbol expressions. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parser_bison: rename ct_block to ct_helper_blockFlorian Westphal2017-09-271-8/+8
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: prepare for future ct timeout policy supportFlorian Westphal2017-09-275-96/+23
| | | | | | | | | | | | | | | | Change all places that expect ct helper tokens (ct helper configuration) to CT HELPER. ct_obj_kind is removed. When we add ct timeout support, we will add a new ct_timeout_block, plus extra rules. We won't extend ct_block, it prevents the parser from detecting bogus syntax that only makes sense for ct helper but not for something else for instance. ct_block should be renamed to ct_helper_block, will be done in followup patch. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ct: remove unused functionsFlorian Westphal2017-09-272-54/+0
| | | | | | | | | since commit b0c2606ed02fed828ab7c34227e355f5542bc925 ("parser_bison: use keywords in ct expression") we no longer abuse string for this, so there are no users of these helpers anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: store expression as set key instead of data typeFlorian Westphal2017-09-278-84/+100
| | | | | | | | | | | | Doing so retains legth information in case of unqualified data types, e.g. we now have 'meta iifname' expression instead of an (unqualified) string type. This allows to eventually use iifnames as set keys without adding yet another special data type for them. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: prepare to store expr key rather than datatypeFlorian Westphal2017-09-271-19/+23
| | | | | | | | | | | | | | | | | | | currently set definitions store a datatype rather than an expression. In order to support use of unqualified data types (string in particular), this prepares implicit set definition helper to expect an expression instead of plain data type. This also has the advantage that we can use EXPR_CONCAT to retain the original expressions when key concatentation is used, e.g. 'meta iifname . tcp dport'. The netlink serialization code can use this info to store individual key lengths independently of data types. Would also allow later on to store the original names of the expressions, e.g. "ip daddr", in the kernel to support a future typeof keyword, e.g. 'type typeof(ip daddr)' instead of 'type ipv4_addr'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow helper keyword in ct object kindPablo Neira Ayuso2017-09-271-5/+6
| | | | | | | The helper keyword clashes with the string rule, make sure we still accept ct helper object types from the parser. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: use keywords in ct expressionPablo Neira Ayuso2017-09-272-54/+44
| | | | | | | | Using string give us more chances to hit shift/reduce conflicts when extending this grammar, more specifically, from the stmt_expr rule, so add keywords for this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: consolidate stmt_expr rulePablo Neira Ayuso2017-09-271-27/+112
| | | | | | | | | | | | | | | | | | Extend stmt_expr and use it from all of our statement rules. Add more rules to describe what we take from statement expressions, instead of reusing rhs_expr which is allowing way more things that we actually need here. This is causing us problems when extending the grammar. After this patch, you will hit this: parser_bison.y: warning: 2 shift/reduce conflicts [-Wconflicts-sr] However, this is fixed by the follow up patches: parser_bison: allow helper keyword in ct object kind parser_bison: use keywords in ct expression Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: remove outdated commentJingPiao Chen2017-09-271-1/+0
| | | | | | | | Remove outdated comment, format field in struct cmd have moved in commit 788687b03e37 ("src: interpret the event type from the evaluation step"). Signed-off-by: JingPiao Chen <chenjingpiao@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix for incorrect debug_maskPhil Sutter2017-09-271-7/+8
| | | | | | | | | | | | | | The field 'debug_mask' of struct netlink_mon_handler was left uninitialized in do_command_monitor() so it contained garbage from the stack. Fix this by initializing it with the debug_mask value from struct netlink_ctx. While being at it, change the code to make use of C99-style initializer, which will also avoid things like this in future. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Fix for return of uninitialized variable in nft_run_cmd_from_filename()Phil Sutter2017-09-271-1/+3
| | | | | | | | | If scanner_read_file() failed, the function would return an uninitialized value. Fixes: 3db28321b64a6 ("src: add nft_run_cmd_*() functions") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: do not set NLM_F_CREATE in deletion requestsPablo Neira Ayuso2017-09-081-2/+5
| | | | | | | This flag is not legal there, it only makes sense for addition requests. This patch has no impact at all in any of the nf_tables kernel versions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add tests for limit stateful objectPablo M. Bermudo Garay2017-09-043-3/+35
| | | | | | | The patch also reorganizes ip/objects.t file. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flags fo nft_ctx_newEric Leblond2017-09-042-9/+14
| | | | | | | | | | | By adding flags to nft_ctx_new, we will have a minimum capabilities of changing the way the nft_ctx is created. For now, this patch uses a simple value that allow the user to specify that he will handle netlink by himself. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object support for limitPablo M. Bermudo Garay2017-09-049-6/+183
| | | | | | | | This patch adds support for a new type of stateful object: limit. Creation, deletion and listing operations are supported. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_netlink_init()Pablo Neira Ayuso2017-09-011-2/+10
| | | | | | | Add these two new functions to set up netlink sockets in the global context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove nfsock_open()Pablo Neira Ayuso2017-09-011-11/+5
| | | | | | Just merge this code to netlink_open_sock(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move nf_sock into nft_ctx structurePablo Neira Ayuso2017-09-012-15/+14
| | | | | | | | | | The idea is to provide a simplistic API for non-netlink wise people. Add a field in struct nft_ctx to store the socket. The advanced API that we're planning will just simply leave this unset, since netlink IO will be exposed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: Fix and enhance synopsis sectionPhil Sutter2017-08-281-24/+50
| | | | | | | | | | | | | | | | | | | This patch addresses shortcomings in the main synopsis section illustrating possible invocations of nft command: - Fix font styles to correctly put options into bold font and meta characters (brackets, pipes) into normal font. - Add missing options to synopsis line. - Use curly braces where either one of the alternatives is required. - Remove choice="opt" attribute since that is the default anyway. - Note that --includepath option is allowed to be given multiple times. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: convert expr_rt byteorder when evaluating statment argFlorian Westphal2017-08-283-2/+5
| | | | | | | | | | | | | | expr_rt might write data in host byte order, so make sure to convert if needed. This makes 'tcp option maxseg size rt mtu' actually work, right now such rules are no-ops because nft_exthdr never increases the mss. While at it, extend the example to not bother testing non-syn packets. Reported-by: Matteo Croce <technoboy85@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Fix memleaks for STRING token (and derived ones)Phil Sutter2017-08-282-10/+37
| | | | | | | | | | | | | | The common paradigm here is that all parser rules converting string tokens into symbols must free the string token if it's not used anymore. This is unrelated to the %destructor directive, since that will apply only if the parser discards the token, which is not the case then. While being at it, simplify error handling in parser rule for listing conntrack helpers (error() won't return NULL) and drop the unused extra parameter passed to error() in level_type rule. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: call nft_init() and nft_exit() from context routinesPablo Neira Ayuso2017-08-242-7/+4
| | | | | | | So we don't forget all these caches should be placed into struct nft_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: release caches from nft_ctx_free() pathEric Leblond2017-08-241-3/+2
| | | | | | | | | | Release existing caches from nft_ctx_free(). Still, the iface cache should be good to place it in the nft_ctx structure. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_run_cmd_*() functionsEric Leblond2017-08-241-22/+54
| | | | | | | | | | Add new function to read nftables command from a file and buffer, that we can expose as library. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_new() and nft_ctx_free()Eric Leblond2017-08-241-25/+39
| | | | | | | | | | These new functions allows us to allocate and release the context structure. This is going to be useful for libnftables. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix error handling in mnl_batch_talkEric Leblond2017-08-242-3/+5
| | | | | | | | | | | | If one of the command is failing we should return an error. Pablo says: "This is not a real issue since nft_netlink() returns an error in case the list of errors is not empty. But we can indeed simplify things by removing that explicit assignment in nft_netlink() so mnl_batch_talk() consistently reports when if an error has happened. Signee-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Fix for memleak when commands failPhil Sutter2017-08-241-0/+2
| | | | | | | In case of failing command evaluation, commands need to be freed as their memory becomes orphaned afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Make use of yylex_init_extra()Phil Sutter2017-08-241-2/+1
| | | | | | This combines the calls to yylex_init() and yyset_extra(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Fix for wrong parameter type of scanner_destroy()Phil Sutter2017-08-242-2/+2
| | | | | | | | The function takes the scanner as argument, not the state. This wasn't a real issue since scanner is a void pointer, which means it's only casted around without need. So this fix is a rather cosmetic one. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Fix for memleak due to unclosed file pointerPhil Sutter2017-08-244-9/+9
| | | | | | | | | | | | | | | | | | | | When including a file, it is opened by fopen() and therefore needs to be closed after scanning has finished using fclose(), otherwise valgrind will report a memleak. This patch changes struct input_descriptor to track the opened FILE pointer instead of the file descriptor so the pointer is available for closing in scanner_destroy(). While at it, change erec_print() to work on the open FILE pointer so it doesn't have to call fileno() in beforehand. And as a little bonus, use C99 initializer of the buffer to get rid of the call to memset(). Note that it is necessary to call erec_print_list() prior to destroying the scanner, otherwise it will start manipulating an already freed FILE pointer (and therefore crash the program). Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: Fix debug_proto_ctx()Phil Sutter2017-08-241-1/+1
| | | | | | | | | Debug mask check was done against wrong flag, causing protocol context debug output being printed when only --debug=netlink was given. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Initialize struct stmt in _match and _target functions.Varsha Rao2017-08-241-0/+2
| | | | | | | | | | Initialize structure stmt with stmt_alloc in netlink_parse_target and netlink_parse_match functions. This patch fixes the gcc warning: ‘stmt’ may be used uninitialized in this function. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix typoPablo M. Bermudo Garay2017-08-241-37/+37
| | | | | | | Separator was misspelled as "seperator" in a symbol name. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add debugging mask to context structurePablo Neira Ayuso2017-08-2320-115/+161
| | | | | | | So this toggle is not global anymore. Update name that fits better with the semantics of this variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: pass struct netlink_ctx to mnl_nft_socket_sendmsg()Pablo Neira Ayuso2017-08-231-7/+6
| | | | | | Reduce function footprint. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add struct mnl_ctxPablo Neira Ayuso2017-08-232-39/+94
| | | | | | This new structure contains the netlink socket and the sequence number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove ifdef DEBUG pollutionPablo Neira Ayuso2017-08-239-60/+3
| | | | | | | | | | | | | | | Get rid of lots of ifdef DEBUG pollution in the code. The --debug= option is useful to get feedback from users, so it should be always there. And we really save nothing from keeping this code away from the control plane with a compile time option. Just running tests/shell/ before and after this patch, time shows almost no difference. So this patch leaves --enable-debug around to add debugging symbols in your builds, this is left set on by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add maximum number of parser errors to struct nft_ctxPablo Neira Ayuso2017-08-233-5/+5
| | | | | | Not a global variable anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add include_paths to struct nft_ctxPablo Neira Ayuso2017-08-235-16/+24
| | | | | | | Not convenient to keep this as static for the upcoming library, so let's move it where it belongs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Keep cache in struct nft_ctxPhil Sutter2017-08-234-29/+26
| | | | | | | This is preliminary work for Eric's libnftables patchset. Cc: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* files: add arp filter and add in/output to nat skeletonFlorian Westphal2017-08-234-5/+16
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add tcp option set support / tcp mss mangling test casesFlorian Westphal2017-08-224-1/+15
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rt: add path mtu supportFlorian Westphal2017-08-224-0/+14
| | | | | | | | | | Only use case is to allow similar behaviour to iptables TCPMSS --clamp-mss-to-pmtu, by combining this with exthdr statement: tcp option maxseg size set rt mtu Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp options set supportFlorian Westphal2017-08-228-3/+120
| | | | | | | | | | | | This adds support for tcp mss mangling: nft add rule filter input tcp option maxseg size 1200 Its also possible to change other tcp option fields, but maxseg is one of the more useful ones to change. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>