summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: move man-pages to `dist_man_MANS`Jeremy Sowden2023-08-101-3/+3
| | | | | | | Removes the need to add them to `EXTRA_DIST`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Review test-cases for destroy commandPhil Sutter2023-08-0315-65/+32
| | | | | | | | | | | | | | Having separate files for successful destroy of existing and non-existing objects is a bit too much, just combine them into one. While being at it: * No bashisms, using /bin/sh is fine * Append '-e' to shebang itself instead of calling 'set' * Use 'nft -a -e' instead of assuming the created rule's handle value * Shellcheck warned about curly braces, quote them Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser: deduplicate map with data intervalFlorian Westphal2023-08-031-13/+7
| | | | | | | | | | Its copypasted, the copy is same as original except that it specifies a map key that maps to an interval. Add an exra rule that returns 0 or EXPR_F_INTERVAL, then use that in a single rule. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: allow ct timeouts to use time_spec valuesFlorian Westphal2023-08-035-9/+16
| | | | | | | | | | | | | | | For some reason the parser only allows raw numbers (seconds) for ct timeouts, e.g. ct timeout ttcp { protocol tcp; policy = { syn_sent : 3, ... Also permit time_spec, e.g. "established : 5d". Print the nicer time formats on output, but retain raw numbers support on input for compatibility. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add dynmap datapath add/delete test caseFlorian Westphal2023-08-032-0/+57
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: document add chain device parameterBrennan Paciorek2023-08-031-0/+5
| | | | | | | | | | | nft add chain lacked documentation of its optional device parameter, specifically what values the parameter accepted, what it did and when to use it. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1093 Suggested-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Brennan Paciorek <bpaciore@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: add pyproject.toml to support PEP-517-compatible build-systemsJeremy Sowden2023-08-033-2/+6
| | | | | | | | | | | | | This makes it possible to build and install the module without directly invoking setup.py which has been deprecated. Retain the setup.py script for backwards-compatibility. Update INSTALL to mention the new config-file. Link: https://blog.ganssle.io/articles/2021/10/setup-py-deprecated.html Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: use setup.cfg to configure setuptoolsJeremy Sowden2023-08-033-22/+27
| | | | | | | | | | | | | | | | | | Setuptools has had support for declarative configuration for several years. To quote their documentation: Setuptools allows using configuration files (usually setup.cfg) to define a package’s metadata and other options that are normally supplied to the setup() function (declarative config). This approach not only allows automation scenarios but also reduces boilerplate code in some cases. Additionally, this allows us to introduce support for PEP-517-compatible build-systems. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: move package source into src directoryJeremy Sowden2023-08-035-2/+2
| | | | | | | | | Separate the actual package source from the build files. In addition to being a bit tidier, this will prevent setup.py being erroneously installed when we introduce PEP-517 support in a later commit. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix inet nat prio testsFlorian Westphal2023-08-022-2/+2
| | | | | | | | | Its legal to DNAT in output and SNAT in input chain, so don't test for that being illegal. Fixes: 8beafab74c39 ("rule: allow src/dstnat prios in input and output") Fixes: 34ce4e4a7bb6 ("test: shell: Test cases for standard chain prios") Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: Drop cache in -c/--check modePablo Neira Ayuso2023-08-013-2/+27
| | | | | | | | | | | | | | | | | | | | | Extend e0aace943412 ("libnftables: Drop cache in error case") to also drop the cache with -c/--check, this is a dry run mode and kernel does not get any update. This fixes a bug with -o/--optimize, which first runs in an implicit -c/--check mode to validate that the ruleset is correct, then it provides the proposed optimization. In this case, if the cache is not emptied, old objects in the cache refer to scanner data that was already released, which triggers BUG like this: BUG: invalid input descriptor type 151665524 nft: erec.c:161: erec_print: Assertion `0' failed. Aborted This bug was triggered in a ruleset that contains a set for geoip filtering. This patch also extends tests/shell to cover this case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct expectation: fix 'list object x' vs. 'list objects in table' confusionFlorian Westphal2023-07-315-1/+5
| | | | | | | | | | Just like "ct timeout", "ct expectation" is in need of the same fix, we get segfault on "nft list ct expectation table t", if table t exists. This is the exact same pattern as resolved for "ct timeout" in commit 1d2e22fc0521 ("ct timeout: fix 'list object x' vs. 'list objects in table' confusion"). Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: allow src/dstnat prios in input and outputFlorian Westphal2023-07-311-2/+4
| | | | | | | | | | | | | | Dan Winship says: The "dnat" command is usable from either "prerouting" or "output", but the "dstnat" priority is only usable from "prerouting". (Likewise, "snat" is usable from either "postrouting" or "input", but "srcnat" is only usable from "postrouting".) No need to restrict those priorities to pre/postrouting. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1694 Signed-off-by: Florian Westphal <fw@strlen.de>
* py: remove setup.py integration with autotoolsPablo Neira Ayuso2023-07-314-57/+9
| | | | | | | | | | | | | With Python distutils and setuptools going deprecated, remove integration with autotools. This integration is causing issues in modern environments. Note that setup.py is still left in place under the py/ folder. Update INSTALL file to refer to Python support and setup.py. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: delinearize: copy set keytype if neededFlorian Westphal2023-07-271-0/+2
| | | | | | | | | | | | | Output before: add @dynmark { 0xa020304 [invalid type] timeout 1s : 0x00000002 } comment "also check timeout-gc" after: add @dynmark { 10.2.3.4 timeout 1s : 0x00000002 } comment "also check timeout-gc" This is a followup to 76c358ccfea0 ("src: maps: update data expression dtype based on set"), which did fix the map expression, but not the key. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: extend implicit chain map with flush commandPablo Neira Ayuso2023-07-211-0/+1
| | | | | | Add a rule flush command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* update INSTALL filePablo Neira Ayuso2023-07-211-12/+29
| | | | | | Update it to current library dependencies and existing options. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: auto-run kmemleak if its availableFlorian Westphal2023-07-201-1/+55
| | | | | | | | | | | | | | On my test vm a full scan takes almost 5s. As this would slowdown the test runs too much, only run them every couple of tests. This allows to detect when there is a leak reported at the end of the script, and it allows to narrow down the test case/group that triggers the issue. Add new -K flag to force kmemleak runs after each test if its available, this can then be used to find the exact test case. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: monitor: Summarize failures per test casePhil Sutter2023-07-201-1/+8
| | | | | | | Explicitly print when tests from a file fail in addition to the diff + "output differs" message. Signed-off-by: Phil Sutter <phil@nwl.cc>
* meta: stash context statement length when generating payload/meta dependencyPablo Neira Ayuso2023-07-194-0/+144
| | | | | | | | | | | | | | | | | | | | | | | | ... meta mark set ip dscp generates an implicit dependency from the inet family to match on meta nfproto ip. The length of this implicit expression is incorrectly adjusted to the statement length, ie. relational to compare meta nfproto takes 4 bytes instead of 1 byte. The evaluation of 'ip dscp' under the meta mark statement triggers this implicit dependency which should not consider the context statement length since it is added before the statement itself. This problem shows when listing the ruleset, since netlink_parse_cmp() where left->len < right->len, hence handling the implicit dependency as a concatenation, but it is actually a bug in the evaluation step that leads to incorrect bytecode. Fixes: 3c64ea7995cb ("evaluate: honor statement length in integer evaluation") Fixes: edecd58755a8 ("evaluate: support shifts larger than the width of the left operand") Tested-by: Brian Davidson <davidson.brian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: return boolean value from Nftables.__[gs]et_output_flag()Thomas Haller2023-07-191-2/+2
| | | | | | | | | | | | | | | | | | The callers of __get_output_flag() and __set_output_flag(), for example get_reversedns_output(), are all documented to return a "boolean" value. Instead, they returned the underlying, non-zero flags value. That number is not obviously useful to the caller, because there is no API so that the caller could do anything with it (except evaluating it in a boolean context). Adjust that, to match the documentation. The alternative would be to update the documentation, to indicate that the functions return a non-zero integer when the flag is set. That would preserve the previous behavior and maybe the number could be useful somehow(?). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc>
* exthdr: prefer raw_type instead of desc->typeFlorian Westphal2023-07-171-1/+1
| | | | | | | | | | | | | | | | | | On ancient kernels desc can be NULL, because such kernels do not understand NFTA_EXTHDR_TYPE. Thus they don't include it in the reverse dump, so the tcp/ip option gets treated like an ipv6 exthdr, but no matching description will be found. This then gives a crash due to the null deref. Just use the raw value here, this avoid a crash and at least print *something*, e.g.: unknown-exthdr unknown & 0xf0 [invalid type] == 0x0 [invalid type] Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/build/run-tests.sh: fix issues reported by shellcheckArturo Borrero Gonzalez2023-07-172-15/+20
| | | | | | | | | | | Improve a bit the script as reported by shellcheck, also including information about the log file. The log file, by the way, is added to the gitignore to reduce noise in the git tree. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to 1.0.8v1.0.8Pablo Neira Ayuso2023-07-141-3/+3
| | | | | | | Update dependency on libnftnl >= 1.2.6 which contains support for meta broute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: missing dccpopt.h breaks make distcheckPablo Neira Ayuso2023-07-141-0/+1
| | | | | | Add it to Makefile.am. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement 'reset {set,map,element}' commandsPhil Sutter2023-07-1313-23/+162
| | | | | | | | | | | All these are used to reset state in set/map elements, i.e. reset the timeout or zero quota and counter values. While 'reset element' expects a (list of) elements to be specified which should be reset, 'reset set/map' will reset all elements in the given set/map. Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: Cache looked up set for list commandsPhil Sutter2023-07-133-7/+15
| | | | | | | | | | Evaluation phase checks the given table and set exist in cache. Relieve execution phase from having to perform the lookup again by storing the set reference in cmd->set. Just have to increase the ref counter so cmd_free() does the right thing (which lacked handling of MAP and METER objects for some reason). Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: Merge some cases in cmd_evaluate_list()Phil Sutter2023-07-131-32/+4
| | | | | | | | The code for set, map and meter were almost identical apart from the specific last check. Fold them together and make the distinction in that spot only. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: cover old scanner bugPablo Neira Ayuso2023-07-112-0/+1132
| | | | | | | | Add a test to cover 423abaa40ec4 ("scanner: don't rely on fseek for input stream repositioning") that fixes the bug described in https://bugs.gentoo.org/675188. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: drop check for nf_sock in nft_ctx_free()Thomas Haller2023-07-101-2/+1
| | | | | | | | | | | | | | The "nft_ctx" API does not provide a way to change or reconnect the netlink socket. And none of the users would rely on that. Also note that nft_ctx_new() initializes nf_sock via nft_mnl_socket_open(), which panics of the socket could not be initialized. This means, the check is unnecessary and needlessly confusing. Drop it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: inline creation of nf_sock in nft_ctx_new()Thomas Haller2023-07-101-6/+1
| | | | | | | | | | | | The function only has one caller. It's not clear how to extend this in a useful way, so that it makes sense to keep the initialization in a separate function. Simplify the code, by inlining and dropping the static function nft_ctx_netlink_init(). There was only one caller. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: drop unused argument nf_sock from nft_netlink()Thomas Haller2023-07-101-4/+3
| | | | | Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: always initialize netlink socket in nft_ctx_new()Thomas Haller2023-07-101-2/+1
| | | | | | | | | | | | | | | | | nft_ctx_new() has a flags argument, but currently no flags are supported. The documentation suggests to pass 0 (NFT_CTX_DEFAULT). Initializing the netlink socket happens by default already, we should do it for all flags. Also because nft_ctx_netlink_init() is not public API so it's not clear how the user gets a functioning context instance otherwise. If we ever want to not initialize the netlink socket for a context instance, then there should be a dedicated flag for doing that (and additional API for making that mode of operation usable). Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: place byteorder conversion before rshift in payload statementPablo Neira Ayuso2023-07-083-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For bitfield that spans more than one byte, such as ip6 dscp, byteorder conversion needs to be done before rshift. Add unary expression for this conversion only in the case of meta and ct statements. Before this patch: # nft --debug=netlink add rule ip6 x y 'meta mark set ip6 dscp' ip6 x y [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <--------- incorrect [ meta set mark with reg 1 ] After this patch: # nft --debug=netlink add rule ip6 x y 'meta mark set ip6 dscp' ip6 x y [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] <-------- correct [ bitwise reg 1 = ( reg 1 >> 0x00000006 ) ] [ meta set mark with reg 1 ] For the matching case, binary transfer already deals with the rshift to adjust left and right hand side of the expression, the unary conversion is not needed in such case. Fixes: 8221d86e616b ("tests: py: add test-cases for ct and packet mark payload expressions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: use div_round_up in byteorder lengthPablo Neira Ayuso2023-07-063-8/+8
| | | | | | | | | Use div_round_up() to calculate the byteorder length, otherwise fields that take % BITS_PER_BYTE != 0 are not considered by the byteorder expression. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Introduce valgrind modePhil Sutter2023-07-041-0/+47
| | | | | | | | Pass flag '-V' to run-tests.sh to run all 'nft' invocations in valgrind leak checking environment. Code copied from iptables' shell-testsuite where it proved to be useful already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* cli: Make cli_init() return to callerPhil Sutter2023-07-042-22/+43
| | | | | | | | | | | | | | | Avoid direct exit() calls as that leaves the caller-allocated nft_ctx object in place. Making sure it is freed helps with valgrind-analyses at least. To signal desired exit from CLI, introduce global cli_quit boolean and make all cli_exit() implementations also set cli_rc variable to the appropriate return code. The logic is to finish CLI only if cli_quit is true which asserts proper cleanup as it is set only by the respective cli_exit() function. Signed-off-by: Phil Sutter <phil@nwl.cc>
* main: Call nft_ctx_free() before exitingPhil Sutter2023-07-041-17/+19
| | | | | | | | | | Introduce labels for failure and regular exit so all direct exit() calls after nft_ctx allocation may be replaced by a single goto statement. Simply drop that return call in interactive branch, code will continue at 'out' label naturally. Signed-off-by: Phil Sutter <phil@nwl.cc>
* main: Make 'buf' variable branch-localPhil Sutter2023-07-041-2/+4
| | | | | | | | It is used only to linearize non-option argv for passing to nft_run_cmd_from_buffer(), reduce its scope. Allows to safely move the free() call there, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: refcount memleak in map rhs with timeoutsPablo Neira Ayuso2023-07-041-0/+48
| | | | | | Extend coverage for refcount leaks on map element expiration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: define .clone for catchall set elementPablo Neira Ayuso2023-06-302-2/+34
| | | | | | | Otherwise reuse of catchall set element expression in variable triggers a null-pointer dereference. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Document JSON mode in READMEPhil Sutter2023-06-271-0/+31
| | | | | | | Mostly identify the various files that (may) appear or exist already and how to deal with them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: cover refcount leak of mapping rhsPablo Neira Ayuso2023-06-271-0/+38
| | | | | | | | Add a test to cover reference count leak in maps by adding twice same element, then flush. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: coverage for simple port knocking rulesetPablo Neira Ayuso2023-06-262-0/+59
| | | | | | Add a test to cover port knocking simple ruleset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: json: add missing/expected json outputFlorian Westphal2023-06-241-0/+14
| | | | | | | | | | | | | | nft-test.py generates following warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' This is because "last" expression is stateful; but nft-test.py explicitly asks for stateless output. Thus we need to provide a json.output file, without it, nft-test.py uses last.json as the expected output file. Fixes: ae8786756b0c ("src: add json support for last statement") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: avoid IPPROTO_MAX for array definitionsFlorian Westphal2023-06-213-5/+4
| | | | | | | | | | | | | | | ip header can only accomodate 8but value, but IPPROTO_MAX has been bumped due to uapi reasons to support MPTCP (262, which is used to toggle on multipath support in tcp). This results in: exthdr.c:349:11: warning: result of comparison of constant 263 with expression of type 'uint8_t' (aka 'unsigned char') is always true [-Wtautological-constant-out-of-range-compare] if (type < array_size(exthdr_protocols)) ~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ redude array sizes back to what can be used on-wire. Signed-off-by: Florian Westphal <fw@strlen.de>
* ct timeout: fix 'list object x' vs. 'list objects in table' confusionFlorian Westphal2023-06-205-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | <empty ruleset> $ nft list ct timeout table t Error: No such file or directory list ct timeout table t ^ This is expected to list all 'ct timeout' objects. The failure is correct, the table 't' does not exist. But now lets add one: $ nft add table t $ nft list ct timeout table t Segmentation fault (core dumped) ... and thats not expected, nothing should be shown and nft should exit normally. Because of missing TIMEOUTS command enum, the backend thinks it should do an object lookup, but as frontend asked for 'list of objects' rather than 'show this object', handle.obj.name is NULL, which then results in this crash. Update the command enums so that backend knows what the frontend asked for. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject zero-length interface names in flowtablesFlorian Westphal2023-06-202-8/+17
| | | | | | Previous patch wasn't enough, also disable this for flowtable device lists. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: reject zero-length interface namesFlorian Westphal2023-06-202-5/+36
| | | | | | | | | | | device "" results in an assertion during evaluation. Before: nft: expression.c:426: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed. After: zero_length_devicename_assert:3:42-49: Error: you cannot set an empty interface name type filter hook ingress device""lo" priority -1 ^^^^^^^^ Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: don't assert on scope underflowsFlorian Westphal2023-06-202-2/+7
| | | | | | | | | | | | | | | close_scope() gets called from the object destructors; imbalance can cause us to hit assert(). Before: nft: parser_bison.y:88: close_scope: Assertion `state->scope > 0' failed. After: assertion3:4:7-7: Error: too many levels of nesting jump { assertion3:5:8-8: Error: too many levels of nesting jump assertion3:5:9-9: Error: syntax error, unexpected newline, expecting '{' assertion3:7:1-1: Error: syntax error, unexpected end of file Signed-off-by: Florian Westphal <fw@strlen.de>