summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* payload: Update the context only in equality relationsÁlvaro Neira Ayuso2014-06-051-1/+2
| | | | | | | | | | | | | | | | | If we add this rule: sudo nft add rule ip test input ip protocol != icmp and we try to list the rules in the table test, nftables show this error: nft: src/payload.c:76: payload_expr_pctx_update: Assertion `expr->op == OP_EQ' failed. This patch change the function payload_match_postprocess for updating only the context in equality relations case. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: Add udplite tokenÁlvaro Neira Ayuso2014-05-281-0/+1
| | | | | | | | If we add a udplite rule, we can't because we have forgot to add this token in the scanner. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix crash if kernel doesn't support nfnetlink / nf_tablesPablo Neira Ayuso2014-05-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | When trying to close a descriptor which failed to be opened. ==6231== Process terminating with default action of signal 11 (SIGSEGV) ==6231== Access not within mapped region at address 0x0 ==6231== at 0x5503E21: mnl_socket_close (socket.c:248) ==6231== by 0x40517F: netlink_close_sock (netlink.c:68) ==6231== by 0x400EFEE: _dl_fini (dl-fini.c:253) ==6231== by 0x5740AA0: __run_exit_handlers (exit.c:77) ==6231== by 0x5740B24: exit (exit.c:99) ==6231== by 0x40F16F: netlink_open_error (netlink.c:105) ==6231== by 0x405642: netlink_open_sock (netlink.c:54) ==6231== by 0x424E6C: __libc_csu_init (in /usr/sbin/nft) ==6231== by 0x5728924: (below main) (libc-start.c:219) ==6231== If you believe this happened as a result of a stack ==6231== overflow in your program's main thread (unlikely but ==6231== possible), you can try to increase the size of the ==6231== main thread stack using the --main-stacksize= flag. ==6231== The main thread stack size used in this run was 8388608. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=881 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: use symbolic expression for ether tooPablo Neira Ayuso2014-05-271-4/+3
| | | | | | | | | | | | | | | | | | | Like in 0dbced3 ("parser: use symbolic expressions for parsing keywords as protocol values"), convert `ether' to use a symbolic expression. This fixes: # nft add rule ip filter input meta iiftype ether # nft list table filter table ip filter { ... iiftype 256 which was converted to network byte order. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't add table/chain/set to ctx->list in the event pathPablo Neira Ayuso2014-05-221-8/+16
| | | | | | | | | | | The delinearize functions for tables, chains and sets add these objects to the ctx->list. In the chain case, this is not required. Regarding tables and sets, those are added to the cache. This patch implicitly fixes an use chain object after free that result in random crashes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix double free in relational_binop_postprocess()Pablo Neira Ayuso2014-05-221-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | free(expr->right) and free(value) point to the same object, so one single free() is enough. This manifests in valgrind with: ==4020== Invalid read of size 4 ==4020== at 0x40A429: expr_free (expression.c:65) ==4020== by 0x414032: expr_postprocess (netlink_delinearize.c:747) ==4020== by 0x414C33: netlink_delinearize_rule (netlink_delinearize.c:883) ==4020== by 0x411305: netlink_events_cb (netlink.c:1692) ==4020== by 0x55040AD: mnl_cb_run (callback.c:77) ==4020== by 0x4171E4: nft_mnl_recv (mnl.c:45) ==4020== by 0x407B44: do_command (rule.c:895) ==4020== by 0x405C6C: nft_run (main.c:183) ==4020== by 0x405849: main (main.c:334) ==4020== Address 0x5d126f8 is 56 bytes inside a block of size 120 free'd ==4020== at 0x4C2AF5C: free (vg_replace_malloc.c:446) ==4020== by 0x41402A: expr_postprocess (netlink_delinearize.c:746) ==4020== by 0x414C33: netlink_delinearize_rule (netlink_delinearize.c:883) ==4020== by 0x411305: netlink_events_cb (netlink.c:1692) ==4020== by 0x55040AD: mnl_cb_run (callback.c:77) ==4020== by 0x4171E4: nft_mnl_recv (mnl.c:45) ==4020== by 0x407B44: do_command (rule.c:895) ==4020== by 0x405C6C: nft_run (main.c:183) ==4020== by 0x405849: main (main.c:334) ==4020== Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: remove the "new" and "destroy" tokens from the scannerPablo Neira Ayuso2014-05-202-48/+165
| | | | | | | | | | | | | | | | These new tokens were introduced in f9563c0 ("src: add events reporting") to allow filtering based on the event type. This confuses the parser when parsing the "new" token: test:32:33-35: Error: syntax error, unexpected new add rule filter output ct state new,established counter ^^^ This patch fixes this by replacing these event type tokens by the generic string token, which is then interpreted during the parsing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table netlink messages to the batchPablo Neira Ayuso2014-05-193-6/+111
| | | | | | | This patch moves the table messages to the netlink batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain netlink messages to the batchPablo Neira Ayuso2014-05-193-8/+161
| | | | | | | This patch moves the chain netlink messages to the big netlink batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set netlink message to the batchPablo Neira Ayuso2014-05-197-8/+313
| | | | | | | | | | | | | This patch moves the netlink set messages to the batch that contains the rules. This helps to speed up rule-set restoration time by changing the operational. To achieve this, an internal set ID which is unique to the batch is allocated as suggested by Patrick. To retain backward compatibility, nft initially guesses if the kernel supports set in batches. Otherwise, it falls back to the previous (slowier) operational. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: split talk() and recv() functionsArturo Borrero2014-04-281-30/+38
| | | | | | | | | | | Let's split talk() and recv() functions, so they can be used independently. While at it, lets rename mnl_talk() to nft_mnl_talk() so we avoid potential clashes with other functions in external libs. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add events reportingArturo Borrero2014-04-259-6/+755
| | | | | | | | | | This patch adds a basic events reporting option to nft. The syntax is: % nft monitor [new|destroy] [tables|chains|rules|sets|elements] [xml|json] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add socket error reporting helper functionArturo Borrero2014-04-253-1/+11
| | | | | | | | | | | | This patch adds a simple helper function to report errors while opening the Netlink socket. To help users to diagnose problems, a new NFT_EXIT_NONL exit code is included, which is 3. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: refactorize set_elem conversion from netlinkArturo Borrero2014-04-251-3/+8
| | | | | | | Lets refactorize set_elem handling. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add netlink_delinearize_table() funcArturo Borrero2014-04-251-2/+11
| | | | | | | This code is suitable to be reusable. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add netlink_delinearize_chain() funcArturo Borrero2014-04-251-25/+21
| | | | | | | Let's make this code reusable. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: generalize chain_print()Arturo Borrero2014-04-252-0/+15
| | | | | | | | Lest generalize the chain_print() function, so we can print a plain chain as the user typed in the basic CLI. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add netlink_delinearize_set() funcArturo Borrero2014-04-251-59/+53
| | | | | | | Let's factorize this code, so it can be reused. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: allow to print sets in plain formatArturo Borrero2014-04-252-10/+53
| | | | | | | | | | | | | Allow to print sets with or without format. This is useful in situations where we want to print more or less the same the user typed (IOW, in one single line, and with family/table info). While at it, make family2str() function public, so it can be used in other places. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-244-0/+16
| | | | | | | | Add support to get an input or output bridge interface name through the relevant meta keys. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Bump version to v0.2v0.2Patrick McHardy2014-04-141-2/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* doc: fix make install problemsPatrick McHardy2014-04-143-4/+4
| | | | | | | | | | | | -e INSTALL doc /usr/bin/install: cannot stat 'doc/nftables.8': No such file or directory make[1]: *** [install] Error 1 make: *** [doc] Error 2 Rename everything to nft.* to fix this up. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* doc: change documentation license to CC BY-SA 4.0Patrick McHardy2014-04-141-1/+6
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* doc: fix programlisting indentationPatrick McHardy2014-04-141-44/+45
| | | | | | Since programlistings are used literally, the should not be indented. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatypes: rename some types for more consistencyPatrick McHardy2014-04-143-11/+11
| | | | | | | Add some more consistency by using _addr for all address types, _proto for all protocol types and iface_ for all interface types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* doc: documentation updatePatrick McHardy2014-04-141-637/+1833
| | | | Signed-off-by: Patrick McHardy
* build: fix documentation buildPatrick McHardy2014-04-143-7/+20
| | | | | | | | Handle the docbook2x-man mess that is called differently on different distributions. Also switch to dblatex since db2pdf is unable to handle XML on Fedora (and probably other distributions). Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix length value of concat dataPatrick McHardy2014-04-141-1/+1
| | | | | | The length is measured in bytes, not bits. Signed-off-by: Patrick McHardy <kaber@trash.net>
* gmputil: use MSF/LSF in import/export functions dependant on host byte orderPatrick McHardy2014-04-122-2/+14
| | | | | | | For data of byteorder BYTEORDER_HOST_ENDIAN we need to set the word order dependant on the host byte order. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expression: fix constant expression allocation on big endianArturo Borrero Gonzalez2014-04-123-2/+17
| | | | | | | | | | | | | | | When allocating a constant expression, a pointer to the data is passed to the allocation function. When the variable used to store the data is larger than the size of the data type, this fails on big endian since the most significant bytes (being zero) come first. Add a helper function to calculate the proper address for the cases where this is needed. This currently affects symbolic tables for values < u64 and payload dependency generation for protocol values < u32. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge branch 'master' of git.netfilter.org:nftablesPatrick McHardy2014-04-111-2/+0
|\
| * build: drop AC_FUNC_MALLOC/REALLOCFlorian Westphal2014-04-101-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two issues with these: 1. They compile & run a test program, which won't work when cross-compiling 2. When libnftnl has just been installed and is not (yet) in linker path, the test fails since loader won't find libnftnl. In that case configure will succeed without obvious errors, but config.h re-defines malloc/realloc with rpl_ prefix, which then results in a linker error ("undefined reference to `rpl_realloc'") on 'make'. These macros are only useful to check that malloc(0) returns non-NULL and that realloc(NULL, ... works. For nftables the former is irrelevant and the latter a safe assumption, so lets just remove them. Signed-off-by: Florian Westphal <fw@strlen.de>
* | parser: fix ether keyword clashPatrick McHardy2014-04-111-0/+7
|/ | | | | | | | | | Due to the renaming of the "eth" keyword to "ether", parsing of arphrd type "ether" fails. Fix similar to TCP, UDP etc by allocating a constant arphrd expression for the ether keyword without a following key. Signed-off-by: Patrick McHardy <kaber@trash.net>
* utils: fix -Wcast-align warnings on sparcPatrick McHardy2014-04-091-1/+1
| | | | | | | | | | | The cast to char * in the container_of() marcro causes warnings for all list iteration helpers on sparc: warning: cast increases required alignment of target type [-Wcast-align] Fix by using a void * for address calculations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix crash in set listingAna Rey2014-04-081-1/+1
| | | | | | | | | | | | | It fixes an invalid read that is shown by valgrind. ==3962== Invalid read of size 4 ==3962== at 0x407040: do_command (rule.c:692) ==3962== by 0x40588C: nft_run (main.c:183) ==3962== by 0x405469: main (main.c:334) ==3962== Address 0x10 is not stack'd, malloc'd or (recently) free'd Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: do not suppress OP_EQ when RHS is bitmask typeFlorian Westphal2014-04-041-2/+10
| | | | | | | | | | | bitmask types default to flagcmp now, thus do not suppress OP_EQ. Else, rule filter output tcp flags syn rule filter output tcp flags == syn are both displayed as 'flags syn'. Signed-off-by: Florian Westphal <fw@strlen.de>
* nftables: Fix list of sets by familyAna Rey2014-03-282-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the result of command line 'nft list sets FAMILY'. It shows the following error message: "Error: syntax error, unexpected end of file, expecting string" Now, it is possible shows right this information: $ sudo nft -nna list sets ip set set_test { type ipv4_address elements = { 192.168.3.45, 192.168.3.43, 192.168.3.42, 192.168.3.4} } set set_test2 { type ipv4_address elements = { 192.168.3.43, 192.168.3.42, 192.168.3.4} } set set0 { type ipv4_address flags constant elements = { 127.0.0.12, 12.11.11.11} } Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* ct: add support for setting ct markArturo Borrero2014-03-136-3/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix expr_binary_error()-related compilation warningsArturo Borrero2014-03-121-38/+44
| | | | | | | | | | | | | | | | | | | | | | | | The commit e7b43ec0 [expr: make expr_binary_error() usable outside of evaluation] seem to change expr_binary_error() interface. Later, several compilation warning appears. The expr_binary_error() function and expr_error() macro both expect `struct list_head *', so I simply changed callers to send `ctx->msgs'. [...] src/evaluate.c: In function ‘byteorder_conversion’: src/evaluate.c:166:3: warning: passing argument 1 of ‘expr_binary_error’ from incompatible pointer type [enabled by default] In file included from src/evaluate.c:21:0: include/expression.h:275:12: note: expected ‘struct list_head *’ but argument is of type ‘struct eval_ctx *’ src/evaluate.c: In function ‘expr_evaluate_symbol’: src/evaluate.c:204:4: warning: passing argument 1 of ‘expr_binary_error’ from incompatible pointer type [enabled by default] In file included from src/evaluate.c:21:0: include/expression.h:275:12: note: expected ‘struct list_head *’ but argument is of type ‘struct eval_ctx *’ [...] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: don't leak file ptr on errorFlorian Westphal2014-03-091-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: sort set elements before decompositionPatrick McHardy2014-03-071-6/+22
| | | | | | | | The decomposition phase currently depends on the kernel returning elements in sorted order. This is a fragile assumption, change the code to sort the elements itself. Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: properly account set size when merging recursive set definitionsPatrick McHardy2014-03-071-0/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: add grammatical distinction for verdict mapsPatrick McHardy2014-03-071-13/+39
| | | | | | | | | | | | | | | | | | | | | | | | Currently the parser accepts verdicts in regular maps and non-verdicts in verdict maps and we have to check matching types during evaluation. Add grammar rules for verdict maps and seperate them from regular maps. This has a couple of advantages: - We recognize verdict maps completely in the parser and any attempt to mix verdicts and other expressions will result in a syntax error. So far this hasn't actually been checked. - Using verdicts in non-verdict mappings will also result in a syntax error instead of a datatype mismatch. - There's a grammatical distinction between dictionaries and verdict maps, which are actually statements. This is needed as preparation for a following patch to turn verdicts into pure statements, which in turn is needed to reinstate support for using the queue verdict in maps, which was broken by the introduction of the queue statement. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: use set location for IO errorsPatrick McHardy2014-03-071-1/+1
| | | | | | | We currently crash when reporting a permission denied error for set additions. This is due to using the wrong location, fix by passing in the set location. Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: abort on interval conflictsPatrick McHardy2014-03-073-9/+19
| | | | | | | | | | | We currently print a debug message (with debugging) and continue. Output a proper error message and abort. While at it, make sure we only report a conflict if there actually is one. This is not the case similar actions, IOW in case of sets, never, in case of maps, only if the mapping differs. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add comparison function for singleton expressionsPatrick McHardy2014-03-076-0/+64
| | | | Singed-off-by: Patrick McHardy <kaber@trash.net>
* expr: make expr_binary_error() usable outside of evaluationPatrick McHardy2014-03-073-9/+9
| | | | | | Turn the eval_ctx argument into a list_head to queue the error to. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add support for rule human-readable commentsPablo Neira Ayuso2014-02-276-4/+40
| | | | | | | | | | | | This patch adds support for human-readable comments: nft add rule filter input accept comment \"accept all traffic\" Note that comments *always* come at the end of the rule. This uses the new data area that allows you to attach information to the rule via netlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix chain attribute parsingArturo Borrero2014-02-271-1/+1
| | | | | | | | The handle's table was being set to the chain name instead of the chain table attribute. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: connlabel matching supportFlorian Westphal2014-02-185-0/+79
| | | | | | | | | | | Takes advantage of the fact that the current maximum label storage area is 128 bits, i.e. the dynamically allocated extension area in the kernel will always fit into a nft register. Currently this re-uses rt_symbol_table_init() to read connlabel.conf. This works since the format is pretty much the same. Signed-off-by: Florian Westphal <fw@strlen.de>