summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* examples: use current type namesFlorian Westphal2016-02-251-5/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: fix error checks in tc handle parserFlorian Westphal2016-02-171-3/+3
| | | | | | | | 'meta priority foobar' did not return an error -- instead we used min/max values with undefined content. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: use parameter-problem for icmpv6 typePablo Neira Ayuso2016-02-013-1/+10
| | | | | | | To keep it consistent with icmpv4 naming. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=911 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: prune implicit binop before payload_match_postprocess()Pablo Neira Ayuso2016-02-011-3/+2
| | | | | | | | | | | | payload_match_postprocess() expects a relational with payload of his lhs and value on the rhs. Moreover, payload_match_expand() releases the previous expression so valgrind reports an use-after-free when pruning the implicit binop. Fix this by calling payload_match_postprocess() in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: test vlan on ingressPablo Neira Ayuso2016-01-312-0/+237
| | | | | | | | | | This generates the same code as bridge does, but it includes this check in first place. [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: annotate follow up dependency just after killing anotherPablo Neira Ayuso2016-01-311-18/+27
| | | | | | | | The inet and netdev families generate two implicit dependencies to check for the interface type, so we have to check just after killing an implicit dependency if there is another that we should annotate to kill it as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: proto_dev_type() returns interface type for base protocols tooPablo Neira Ayuso2016-01-311-2/+10
| | | | | | | | | | | | | | | The device protocol definition provides a mapping between the interface type, ie. ARPHDR_*, and the overlying protocol base definition, eg. proto_eth. This patch updates proto_dev_type() so it also returns a mapping for these overlying ethernet protocol definitions, ie. ip, ip6, vlan, ip, arp. This patch required to resolve problems with automatic dependency generation for vlan in the netdev and inet families. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: generate ether type payload after meta iiftypePablo Neira Ayuso2016-01-311-7/+10
| | | | | | | | | | | | | | | Once the meta iiftype is generated, we shouldn't return from resolve_protocol_conflict() since we also need to generate the ether type payload implicit match after it. This gets rid of the manual proto-ctx update from meta_iiftype_gen_dependency() that we don't need since stmt_evaluate() already handles this for us. Moreover, skip error reporting once we verify that the protocol conflict has been resolved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: wrap protocol context debunk into functionPablo Neira Ayuso2016-01-311-6/+19
| | | | | | | | ether type vlan sets the network layer protocol context to vlan. This function debunks the existing link layer protocol context by setting it to vlan. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: assert on invalid base in resolve_protocol_conflict()Pablo Neira Ayuso2016-01-311-11/+11
| | | | | | | We already have similar code in the tree, we shouldn't see bases over transport yet. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: only try to replace dummy protocol from link-layer contextPablo Neira Ayuso2016-01-311-11/+14
| | | | | | | | | | | | | Add proto_is_dummy() that returns true for netdev and inet family, the only two using a dummy link-layer protocol base definition. Rename supersede_dep() to meta_iiftype_gen_dependency() since this is generating the implicit meta iiftype check for netdev and inet. This patch also gets rid of the have->length check. The tests pass fine without this so I suspect this is superfluos. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't adjust offset from resolve_protocol_conflict()Pablo Neira Ayuso2016-01-311-5/+8
| | | | | | This is not itself a conflict, move this check out of this function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if we have to resolve a conflict in first placePablo Neira Ayuso2016-01-311-11/+14
| | | | | | | So we enter resolve_protocol_conflict() only when we really have a conflict that we want to try to resolve. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: move inet/netdev protocol context supersede logic to supersede_dep()Pablo Neira Ayuso2016-01-311-23/+25
| | | | | | This is a cleanup to untangle this logic a bit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: resolve_protocol_conflict() should return intPablo Neira Ayuso2016-01-311-12/+14
| | | | | | | Instead of bool, expr_error() returns -1 if we fail to create dependencies. We need to propagate this error value. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: test port ranges and maps for redirectPablo Neira Ayuso2016-01-314-0/+47
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink_linearize: Fix bug for redirect targetShivani Bhardwaj2016-01-311-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | Before this patch, $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 ip nat post [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ immediate reg 1 0x00006400 ] [ immediate reg 2 0x0000c800 ] [ redir proto_min reg 1 proto_max reg 5 ] <cmdline>:1:1-56: Error: Could not process rule: Invalid argument add rule ip nat post ip protocol tcp redirect to 100-200 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After this patch, $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 ip nat post [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ immediate reg 1 0x00006400 ] [ immediate reg 2 0x0000c800 ] [ redir proto_min reg 1 proto_max reg 2 ] Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fwd statement for netdevPablo Neira Ayuso2016-01-319-1/+137
| | | | | | | | | | | This patch add support for the forward statement, only available at the netdev family. # nft add table netdev filter # nft add chain netdev filter ingress { type filter hook ingress device eth0 priority 0\; } # nft add rule netdev filter ingress fwd to dummy0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dup statement for netdevPablo Neira Ayuso2016-01-313-0/+36
| | | | | | | | | | | | This patch contains the missing chunk to add support for the netdev family. Part of the support slipped through in the original patch to add the dup statement for IPv4 and IPv6. # nft add table netdev filter # nft add chain netdev filter ingress { type filter hook ingress device eth0 priority 0\; } # nft add rule netdev filter ingress dup to dummy0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6: Add tests for icmpv6 packet typesShivani Bhardwaj2016-01-312-0/+10
| | | | | | | | Add tests for the icmpv6 packet types policy-fail and reject-route to be used with REJECT target. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: datatype: Modify symbol table for icmpv6 packet typesShivani Bhardwaj2016-01-311-5/+7
| | | | | | | | Add the missing symbols and correct the macros corresponding to the existing symbols. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: only remove protocol if equal cmp is usedFlorian Westphal2016-01-273-0/+25
| | | | | | | | | | | | | | | | | | Check for OP_EQ before removing a dependency, else we may zap wrong one, changing the meaning of the rule. Listing without patch: ip protocol udp udp dport ssh ip protocol udp udp dport ssh counter packets 1 bytes 308 ip protocol udp udp dport ssh With patch: ip protocol != tcp udp dport ssh ip protocol != udp udp dport ssh ip protocol != tcp counter packets 1 bytes 308 udp dport ssh Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: do binop postprocessing also for map lookupsFlorian Westphal2016-01-265-0/+55
| | | | | | | | | | old nft list: mark set unknown unknown & 0xfff [invalid type] map { 3 : 0x00000017, 1 : 0x0000002a} new: mark set vlan id map { 3 : 0x00000017, 1 : 0x0000002a} Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add two map test casesFlorian Westphal2016-01-266-0/+54
| | | | | | | | One normal map lookup, one with an explicit binop. The latter is supposed to also work with the followup patch applied. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: move binop postprocess to extra functionFlorian Westphal2016-01-261-28/+35
| | | | | | | | | Just move the payload trim part to a separate function. Next patch will add a second call site to deal with map ops that use a lookup based on a binop result. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update ct expressionFlorian Westphal2016-01-151-9/+36
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support limit rate over valuePablo Neira Ayuso2016-01-149-29/+135
| | | | | | | | | | | | | | | | | | So far it was only possible to match packet under a rate limit, this patch allows you to explicitly indicate if you want to match packets that goes over or until the rate limit, eg. ... limit rate over 3/second counter log prefix "OVERLIMIT: " drop ... limit rate over 3 mbytes/second counter log prefix "OVERLIMIT: " drop ... ct state invalid limit rate until 1/second counter log prefix "INVALID: " When listing rate limit until, this shows: ... ct state invalid limit rate 1/second counter log prefix "INVALID: " thus, the existing syntax is still valid (i.e. default to rate limit until). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: ct: remove BUG cases that work with current masterFlorian Westphal2016-01-071-33/+0
| | | | | | | | We have tests for these in ip/ct.t. (We cannot use ipv4 addresses e.g. in ipv6 family). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct regression tests for bytes, packetsFlorian Westphal2015-12-142-0/+27
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: use u64 conversion for 64bit quantitiesFlorian Westphal2016-01-081-1/+9
| | | | | | | | | | | | | | | | nft generated two 4-byte swaps for conntrack byte/packet counters, which are 64bit host-endian values: byteorder reg 1 = hton(reg 1, 4, 8) ] This makes the kernel perform two htonl() calls, but we need a cpu_to_be64 conversion instead (reg 1, 8, 8). Without this a rule like 'ct original packets > 10' matched when counter was between 1 and 10. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add packet/byte counter supportFlorian Westphal2015-12-123-1/+13
| | | | | | | | | | | | | | | | | packets and bytes need special treatment -- we want to be able to get packet/byte counter in either direction, but also express 'fetch in *BOTH* directions', i.e. ct packets original + ct packets reply > 1000 This either requires a '+' expression, a new 'both' direction, or keys where direction is optional, i.e. ct packets > 12345 ; original + reply ct original packets > 12345 ; original Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: swap key and direction in ct_dir syntaxFlorian Westphal2016-01-075-34/+41
| | | | | | | | | | | | | | | old: ct saddr original 1.2.3.4 new: ct original saddr 1.2.3.4 The advantage is that this allows to add ct keys where direction is optional without creating ambiguities in the parser. So we can have ct packets gt 42 ct original packets gt 42 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: netdev family with ingress chainPablo Neira Ayuso2016-01-1334-0/+2999
| | | | | | | This patch enables tests for the new netdev family and its ingress chain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: test udp from ip and ip6 familiesPablo Neira Ayuso2016-01-133-2/+446
| | | | | | The existing test was checking for the ip family three times, fix it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: don't test log statement from protocol matchPablo Neira Ayuso2016-01-1310-68/+24
| | | | | | | | | | | | I think this unit tests should be self-contained at some level. The shell/ directory should be used to catch regressions at ruleset level, ie. these kind of combinations. Another motivation is that I want that netdev/ingress gets tested (coming in a follow up patch), and we don't support log there yet, so I would need to skip this test for that case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: initializer_expr must use rhs_exprPablo Neira Ayuso2016-01-131-18/+2
| | | | | | | | | | | | Use rhs_expr and list_rhs_expr as possible occurrences of initializer_expr since we may only find constant expressions on the right hand side of the assignment. Fixes: 2a5d44d8b3c (parser: get rid of multiton_expr from lhs relational expression) Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Florian Westphal <fw@strlen.de> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* tests/py: update test files syntaxPablo M. Bermudo Garay2016-01-1252-120/+158
| | | | | | | | The test files have been adapted to the syntax defined in the previous commit "tests/py: modify supported test file syntax" Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: modify supported test file syntaxPablo M. Bermudo Garay2016-01-121-26/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until now, the syntax to represent tables and chains in test files was: *ip;test-ip4 *ip6;test-ip6 *inet;test-inet :input;type filter hook input priority 0 Where lines starting with * are tables and lines starting with : are chains. This commit change the test script to deal with new syntax: :input;type filter hook input priority 0 *ip;test-ip4;input *ip6;test-ip6;input *inet;test-inet;input Now the chains should be included before tables. Also, lines defining tables have a new third part (delimited by semicolon) where the chains needed by the table are declared. If table needs to include more than one chain, those must be separated by commas: :input;type filter hook input priority 0 :forward;type filter hook forward priority 0 :output;type filter hook output priority 0 *arp;test-arp;input,forward,output This new syntax allow to include in the same test file chains not supported by all families of tables tested. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: convert chains and tables to objectsPablo M. Bermudo Garay2016-01-121-58/+72
| | | | | | | | Now these concepts are represented by objects instead of lists or sparse parameters. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: simplify use of globalsPablo M. Bermudo Garay2016-01-121-18/+14
| | | | | | | | | | | The script made a messy use of globals, these was sometimes accessed directly and passed as parameter in other cases. Since is not expected having to deal with threads in the script, now the globals are always accessed directly for the sake of simplicity. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: fix stylePablo M. Bermudo Garay2016-01-121-100/+109
| | | | | | | | | | - Adjust lines to 80 columns style - Add two lines of separation between functions - Remove redundant parentheses and semicolons - Apply other minor style fixes Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: remove unused variablesPablo M. Bermudo Garay2016-01-121-30/+8
| | | | | | | Only that. The script had a lot of unused variables. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: don't list anonymous setsArturo Borrero2016-01-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't list anonymous sets when listing all sets. For example, using this ruleset: ==== 8< ==== table inet test { set set1 { type ipv4_addr } chain test { tcp dport { 80 } accept } } ==== 8< ==== Before this patch: % nft list sets table inet test { set set0 { type inet_service flags constant } set set1 { type ipv4_addr } } After this patch: % nft list sets table inet test { set set1 { type ipv4_addr } } Fixes: 8f297010 ("rule: `list sets' only displays declaration, not definition") Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add ct tests for ip familyFlorian Westphal2016-01-042-0/+85
| | | | | | | | | | Cannot check e.g. saddr for 192.168.0.1 for 'any' protocol, nft needs to expect arguments of a specific address type. So e.g. when using 'inet' we need to add a rule that makes the expected family explicit, e.g. 'meta nfproto ipv4'. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ct: make ct l3proto workFlorian Westphal2016-01-041-2/+2
| | | | | | | | | ct l3proto original == ipv6 <cmdline>:1:56-59: Error: Can't parse symbolic invalid expressions Its just the nf protocol number -- no dependencies. Just set right type. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: only drop mask if it matches left known-size operandFlorian Westphal2016-01-041-3/+5
| | | | | | | | | | | | During delinearization we attempt to remove masks, for instance ip saddr $x/32. (mask matches the entire size). However, in some special cases the lhs size is unknown (0), this happens f.e. with 'ct saddr original 1.2.3.4/24' which had its '/24' chopped off. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: don't handle lhs zero-length expression as concat typeFlorian Westphal2016-01-041-1/+1
| | | | | | | | | | | | | | | | | expr->len 0 can appear for some data types whose size can be different based on some external state, e.g. the conntrack src/dst addresses. The nft type is 'invalid/0-length' in the template definition, the size is set (on linearization) based on the network base family, i.e. the type is changed to ip or ipv6 address at a later stage. For delinarization, skip zero-length expression as concat type and give expr_postprocess a chance to fix the types. Without this change the previous patch will result in nft consuming all available memory when trying to display e.g. a 'ct saddr' rule. Signed-off-by: Florian Westphal <fw@strlen.de>
* ct: add support for directional keysFlorian Westphal2016-01-046-13/+83
| | | | | | | | | | | | | | A few keys in the ct expression are directional, i.e. we need to tell kernel if it should fetch REPLY or ORIGINAL direction. Split ct_keys into ct_keys & ct_keys_dir, the latter are those keys that the kernel rejects unless also given a direction. During postprocessing we also need to invoke ct_expr_update_type, problem is that e.g. ct saddr can be any family (ip, ipv6) so we need to update the expected data type based on the network base. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: update meta and ct expression keyword listsFlorian Westphal2016-01-041-0/+62
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: restore bitwise operations from the rhs of relational expressionsPablo Neira Ayuso2016-01-031-6/+41
| | | | | | | | Reintroduce bitwise operation on constants that was removed in ("parser: restrict relational rhs expression recursion") since we support this since the beginning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>