summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* netlink: move binop postprocess to extra functionFlorian Westphal2016-01-261-28/+35
| | | | | | | | | Just move the payload trim part to a separate function. Next patch will add a second call site to deal with map ops that use a lookup based on a binop result. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update ct expressionFlorian Westphal2016-01-151-9/+36
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support limit rate over valuePablo Neira Ayuso2016-01-149-29/+135
| | | | | | | | | | | | | | | | | | So far it was only possible to match packet under a rate limit, this patch allows you to explicitly indicate if you want to match packets that goes over or until the rate limit, eg. ... limit rate over 3/second counter log prefix "OVERLIMIT: " drop ... limit rate over 3 mbytes/second counter log prefix "OVERLIMIT: " drop ... ct state invalid limit rate until 1/second counter log prefix "INVALID: " When listing rate limit until, this shows: ... ct state invalid limit rate 1/second counter log prefix "INVALID: " thus, the existing syntax is still valid (i.e. default to rate limit until). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: ct: remove BUG cases that work with current masterFlorian Westphal2016-01-071-33/+0
| | | | | | | | We have tests for these in ip/ct.t. (We cannot use ipv4 addresses e.g. in ipv6 family). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct regression tests for bytes, packetsFlorian Westphal2015-12-142-0/+27
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: use u64 conversion for 64bit quantitiesFlorian Westphal2016-01-081-1/+9
| | | | | | | | | | | | | | | | nft generated two 4-byte swaps for conntrack byte/packet counters, which are 64bit host-endian values: byteorder reg 1 = hton(reg 1, 4, 8) ] This makes the kernel perform two htonl() calls, but we need a cpu_to_be64 conversion instead (reg 1, 8, 8). Without this a rule like 'ct original packets > 10' matched when counter was between 1 and 10. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add packet/byte counter supportFlorian Westphal2015-12-123-1/+13
| | | | | | | | | | | | | | | | | packets and bytes need special treatment -- we want to be able to get packet/byte counter in either direction, but also express 'fetch in *BOTH* directions', i.e. ct packets original + ct packets reply > 1000 This either requires a '+' expression, a new 'both' direction, or keys where direction is optional, i.e. ct packets > 12345 ; original + reply ct original packets > 12345 ; original Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: swap key and direction in ct_dir syntaxFlorian Westphal2016-01-075-34/+41
| | | | | | | | | | | | | | | old: ct saddr original 1.2.3.4 new: ct original saddr 1.2.3.4 The advantage is that this allows to add ct keys where direction is optional without creating ambiguities in the parser. So we can have ct packets gt 42 ct original packets gt 42 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: netdev family with ingress chainPablo Neira Ayuso2016-01-1334-0/+2999
| | | | | | | This patch enables tests for the new netdev family and its ingress chain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: test udp from ip and ip6 familiesPablo Neira Ayuso2016-01-133-2/+446
| | | | | | The existing test was checking for the ip family three times, fix it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: don't test log statement from protocol matchPablo Neira Ayuso2016-01-1310-68/+24
| | | | | | | | | | | | I think this unit tests should be self-contained at some level. The shell/ directory should be used to catch regressions at ruleset level, ie. these kind of combinations. Another motivation is that I want that netdev/ingress gets tested (coming in a follow up patch), and we don't support log there yet, so I would need to skip this test for that case. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: initializer_expr must use rhs_exprPablo Neira Ayuso2016-01-131-18/+2
| | | | | | | | | | | | Use rhs_expr and list_rhs_expr as possible occurrences of initializer_expr since we may only find constant expressions on the right hand side of the assignment. Fixes: 2a5d44d8b3c (parser: get rid of multiton_expr from lhs relational expression) Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Florian Westphal <fw@strlen.de> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* tests/py: update test files syntaxPablo M. Bermudo Garay2016-01-1252-120/+158
| | | | | | | | The test files have been adapted to the syntax defined in the previous commit "tests/py: modify supported test file syntax" Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: modify supported test file syntaxPablo M. Bermudo Garay2016-01-121-26/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until now, the syntax to represent tables and chains in test files was: *ip;test-ip4 *ip6;test-ip6 *inet;test-inet :input;type filter hook input priority 0 Where lines starting with * are tables and lines starting with : are chains. This commit change the test script to deal with new syntax: :input;type filter hook input priority 0 *ip;test-ip4;input *ip6;test-ip6;input *inet;test-inet;input Now the chains should be included before tables. Also, lines defining tables have a new third part (delimited by semicolon) where the chains needed by the table are declared. If table needs to include more than one chain, those must be separated by commas: :input;type filter hook input priority 0 :forward;type filter hook forward priority 0 :output;type filter hook output priority 0 *arp;test-arp;input,forward,output This new syntax allow to include in the same test file chains not supported by all families of tables tested. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: convert chains and tables to objectsPablo M. Bermudo Garay2016-01-121-58/+72
| | | | | | | | Now these concepts are represented by objects instead of lists or sparse parameters. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: simplify use of globalsPablo M. Bermudo Garay2016-01-121-18/+14
| | | | | | | | | | | The script made a messy use of globals, these was sometimes accessed directly and passed as parameter in other cases. Since is not expected having to deal with threads in the script, now the globals are always accessed directly for the sake of simplicity. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: fix stylePablo M. Bermudo Garay2016-01-121-100/+109
| | | | | | | | | | - Adjust lines to 80 columns style - Add two lines of separation between functions - Remove redundant parentheses and semicolons - Apply other minor style fixes Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: remove unused variablesPablo M. Bermudo Garay2016-01-121-30/+8
| | | | | | | Only that. The script had a lot of unused variables. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: don't list anonymous setsArturo Borrero2016-01-051-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't list anonymous sets when listing all sets. For example, using this ruleset: ==== 8< ==== table inet test { set set1 { type ipv4_addr } chain test { tcp dport { 80 } accept } } ==== 8< ==== Before this patch: % nft list sets table inet test { set set0 { type inet_service flags constant } set set1 { type ipv4_addr } } After this patch: % nft list sets table inet test { set set1 { type ipv4_addr } } Fixes: 8f297010 ("rule: `list sets' only displays declaration, not definition") Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add ct tests for ip familyFlorian Westphal2016-01-042-0/+85
| | | | | | | | | | Cannot check e.g. saddr for 192.168.0.1 for 'any' protocol, nft needs to expect arguments of a specific address type. So e.g. when using 'inet' we need to add a rule that makes the expected family explicit, e.g. 'meta nfproto ipv4'. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ct: make ct l3proto workFlorian Westphal2016-01-041-2/+2
| | | | | | | | | ct l3proto original == ipv6 <cmdline>:1:56-59: Error: Can't parse symbolic invalid expressions Its just the nf protocol number -- no dependencies. Just set right type. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: only drop mask if it matches left known-size operandFlorian Westphal2016-01-041-3/+5
| | | | | | | | | | | | During delinearization we attempt to remove masks, for instance ip saddr $x/32. (mask matches the entire size). However, in some special cases the lhs size is unknown (0), this happens f.e. with 'ct saddr original 1.2.3.4/24' which had its '/24' chopped off. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: don't handle lhs zero-length expression as concat typeFlorian Westphal2016-01-041-1/+1
| | | | | | | | | | | | | | | | | expr->len 0 can appear for some data types whose size can be different based on some external state, e.g. the conntrack src/dst addresses. The nft type is 'invalid/0-length' in the template definition, the size is set (on linearization) based on the network base family, i.e. the type is changed to ip or ipv6 address at a later stage. For delinarization, skip zero-length expression as concat type and give expr_postprocess a chance to fix the types. Without this change the previous patch will result in nft consuming all available memory when trying to display e.g. a 'ct saddr' rule. Signed-off-by: Florian Westphal <fw@strlen.de>
* ct: add support for directional keysFlorian Westphal2016-01-046-13/+83
| | | | | | | | | | | | | | A few keys in the ct expression are directional, i.e. we need to tell kernel if it should fetch REPLY or ORIGINAL direction. Split ct_keys into ct_keys & ct_keys_dir, the latter are those keys that the kernel rejects unless also given a direction. During postprocessing we also need to invoke ct_expr_update_type, problem is that e.g. ct saddr can be any family (ip, ipv6) so we need to update the expected data type based on the network base. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: update meta and ct expression keyword listsFlorian Westphal2016-01-041-0/+62
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: restore bitwise operations from the rhs of relational expressionsPablo Neira Ayuso2016-01-031-6/+41
| | | | | | | | Reintroduce bitwise operation on constants that was removed in ("parser: restrict relational rhs expression recursion") since we support this since the beginning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: rename multiton_expr to multiton_rhs_exprPablo Neira Ayuso2016-01-031-14/+14
| | | | | | | | | | | This rule catches occurrences from the constant rhs, rename it for readability reasons. Note that this rule is still used from the set lhs definition that is always constant (as it represents the key to look up for the corresponding element). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: get rid of multiton_expr from lhs relational expressionPablo Neira Ayuso2016-01-031-10/+44
| | | | | | | | | | | | | | | | The multiton_expr rule matches range, prefix and wildcard expressions which don't make sense from the non-constant lhs. This rule is there to handle the nat statement case, whose expression may be composed of address and port ranges (hence range expressions). To resolve this, this patch adds the stmt_expr rule to handle the possible occurrences of map, multiton and primary expressions from statements. This results in more rules but it narrows down what we can find from expressions that are part of action statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add redirect constant to rhs_expr rulePablo Neira Ayuso2016-01-033-1/+9
| | | | | | | So we can use the 'redirect' reserve word as constant from the rhs expression. Thus, we can use it as icmp type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: restrict relational rhs expression recursionPablo Neira Ayuso2016-01-031-108/+159
| | | | | | | | | | | | | | The relational expression allows recursion from both sides, this doesn't allow us to know what hand side the input is coming from. This patch adds a new expr_rhs rule that specifies what can be found on the constant side of the relational. Besides making it easier to understand what is actually supported, this allows us to use reserve words both as constant and statements. This is used by the following patch to allow to use redirect as constant from the icmp payload match. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: check set value from selector and mapPablo Neira Ayuso2016-01-032-0/+15
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add new netdev protocol descriptionPablo Neira Ayuso2015-12-255-4/+50
| | | | | | | | This relies on NFT_META_PROTOCOL instead of ethernet protocol type header field to prepare support for non-ethernet protocols in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add tests for handles and commentsArturo Borrero2015-12-254-0/+34
| | | | | | | Here some tests for optional things like rule handles and comments. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add test case for cache bugArturo Borrero2015-12-181-0/+35
| | | | | | | | | | | | | | | | | | | | | | | This testcase for sets catch a cache bug. By the time of this commit this test is failing, so the test suite shows: % sudo ./run-tests.sh I: using nft binary /usr/local/sbin/nft I: [OK] ./testcases/maps/anonymous_snat_map_0 I: [OK] ./testcases/maps/named_snat_map_0 W: [FAILED] ./testcases/sets/cache_handling_0 I: [OK] ./testcases/optionals/comments_0 I: [OK] ./testcases/optionals/comments_handles_monitor_0 I: [OK] ./testcases/optionals/handles_1 I: [OK] ./testcases/optionals/handles_0 I: [OK] ./testcases/optionals/comments_handles_0 I: results: [OK] 7 [FAILED] 1 [TOTAL] 8 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add maps tests casesArturo Borrero2015-12-182-0/+18
| | | | | | | Let's add some tests cases for maps. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/: add shell test-suiteArturo Borrero2015-12-182-0/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new test-suite is intended to perform tests of higher level than the other reggresion test-suite. It can run arbitrary executables which can perform any test apart of testing the nft syntax or netlink code (which is what the regression tests does). To run the test suite (as root): % cd tests/shell % ./run-tests.sh Test files are executables files with the pattern <<name_N>>, where N is the expected return code of the executable. Since they are located with `find', test-files can be spreaded in any sub-directories. You can turn on a verbose execution by calling: % ./run-tests.sh -v Before each call to the test-files, `nft flush ruleset' will be called. Also, test-files will receive the environment variable $NFT which contains the path to the nftables binary being tested. You can pass an arbitrary $NFT value as well: % NFT=../../src/nft ./run-tests.sh Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: add previous statement to rule_pp_ctxPablo Neira Ayuso2015-12-181-13/+17
| | | | | | | | | | | | | 564b0e7c13f9 ("netlink_delinearize: postprocess expression before range merge") crashes nft when the previous statement is removed via payload_dependency_kill() as this pointer is not valid anymore. Move the pointer to the previous statement to rule_pp_ctx and invalidate it when required. Reported-by: "Pablo M. Bermudo Garay" <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Reported-by: "Pablo M. Bermudo Garay" <pablombg@gmail.com>
* tests/: rearrange tests directoryArturo Borrero2015-12-15158-0/+0
| | | | | | | | | | | | | | | | | | Rearrange the directory to obtain a better organization of files and tests-suites. We end with a tree like this: tests | .--- py .--- shell .--- files This was suggested by Pablo. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: postprocess expression before range mergePablo Neira Ayuso2015-12-141-3/+3
| | | | | | | | | | Dependency statement go away after postprocess, so we should consider them for possible range merges. This problem was uncovered when adding support for sub-byte payload ranges. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix sub-byte protocol header definitionsPablo Neira Ayuso2015-12-147-52/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update bitfield definitions to match according to the way they are expressed in RFC and IEEE specifications. This required a bit of update for c3f0501 ("src: netlink_linearize: handle sub-byte lengths"). >From the linearize step, to calculate the shift based on the bitfield offset, we need to obtain the length of the word in bytes: len = round_up(expr->len, BITS_PER_BYTE); Then, we substract the offset bits and the bitfield length. shift = len - (offset + expr->len); From the delinearize, payload_expr_trim() needs to obtain the real offset through: off = round_up(mask->len, BITS_PER_BYTE) - mask_len; For vlan id (offset 12), this gets the position of the last bit set in the mask (ie. 12), then we substract the length we fetch in bytes (16), so we obtain the real bitfield offset (4). Then, we add that to the original payload offset that was expressed in bytes: payload_offset += off; Note that payload_expr_trim() now also adjusts the payload expression to its real length and offset so we don't need to propagate the mask expression. Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: vlan pcp and cfi are located in the first bytePablo Neira Ayuso2015-12-141-10/+10
| | | | | | | Adjust tests to fix wrong payloads, both pcp and cfi are located in the first nibble of the first byte. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix crash when rule test is malformedPablo M. Bermudo Garay2015-12-142-7/+6
| | | | | | | | | | | The tests script suffers a crash when a rule test line is malformed (e.g. if expected result is missing). This commit fixes these crashes and now the line is skipped and a warning is printed. While at it, fix a malformed test line too. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: remove useless logicPablo M. Bermudo Garay2015-12-145-8/+2
| | | | | | | | | | In the test files, some lines defining tables was commented out with a minus "-" sign, also used to mark broken rules. This commit replaces these signs with actual comments "#" and removes the code that handled the situation. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add *.got files to .gitignorePablo M. Bermudo Garay2015-12-102-26/+3
| | | | | | | | | | During tests execution, some *.payload.got files may be generated. To avoid annoyances, this commit adds the pattern to .gitignore. Also, the file "dup.t.payload.got", that was presumably included by mistake, has been deleted. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix use-after-freePablo Neira Ayuso2015-11-281-3/+3
| | | | | | | | | We have to clone the payload expression before attaching it to the lhs of the relational expression, this payload expression is located at the lhs of the binary operation that is released thereafter. Fixes: 39f15c2 ("nft: support listing expressions that use non-byte header fields") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix up indentation damagePatrick McHardy2015-11-273-112/+87
| | | | | | | The conversion to the net libnftnl API has left a lot of indentation damage in the netlink functions. Fix it up. Signed-off-by: Patrick McHardy <kaber@trash.net>
* tests: regression: fix arp.t expected payloadFlorian Westphal2015-11-271-17/+17
| | | | | | previous commit fixed arp header definition so fix payload as well. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: fix arpop symbol table endianessPatrick McHardy2015-11-251-7/+7
| | | | | | The symbols need to be in big endian. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: add payload statementPatrick McHardy2015-11-257-5/+167
| | | | | | | | | Add support for payload mangling using the payload statement. The syntax is similar to the other data changing statements: nft filter output tcp dport set 25 Signed-off-by: Patrick McHardy <kaber@trash.net>
* proto: add checksum key information to struct proto_descPatrick McHardy2015-11-252-0/+7
| | | | | | | The checksum key is used to determine the correct position where to update the checksum for the payload statement. Signed-off-by: Patrick McHardy <kaber@trash.net>