summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* tests: shell: add packetpath test for reject statementFlorian Westphal2025-10-161-0/+223
| | | | | | | | | Test case for: 91a79b792204 ("netfilter: nf_reject: don't leak dst refcount for loopback packets") and db99b2f2b3e2 ("netfilter: nf_reject: don't reply to icmp error messages") Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: clarify evaluation of chainsChristoph Anton Mitterer2025-10-151-2/+4
| | | | | | | | | | | | | | | | | | In particular: - Mention that grouping of chains in tables is irrelevant to the evaluation order. - Clarify that priorities only define the ordering of chains per hook. - Improved potentially ambiguous wording “lower priority values have precedence over higher ones”, which could be mistaken as that rules from lower priority chains might “win” over such from higher ones (which is however only the case if they drop/reject packets). The new wording merely describes which chains are evaluated first, implicitly referring the question which verdict “wins” to the section where verdicts are described, and also should work when lower priority chains mangle packets (in which case they might actually be considered as having “precedence”). Signed-off-by: Christoph Anton Mitterer <mail@christoph.anton.mitterer.name> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add packetpath test for meta ibrhwaddrFernando Fernandez Mancera2025-10-142-0/+110
| | | | | | | | The test checks that the packets are processed by the bridge device and not forwarded. Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce meta ibrhwaddr supportFernando Fernandez Mancera2025-10-146-0/+36
| | | | | | | | | | | | | | | Can be used in bridge prerouting hook to redirect the packet to the receiving physical device for processing. table bridge nat { chain PREROUTING { type filter hook prerouting priority 0; policy accept; ether daddr de:ad:00:00:be:ef meta pkttype set host ether daddr set meta ibrhwaddr accept } } Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix tcpdump exampleGeorg Pfuetzenreuter2025-10-131-2/+1
| | | | | | | | | | The expression needs to be enclosed in a single string and combined with a logical AND to have the desired effect. Fixes: 1188a69604c3 ("src: introduce SYNPROXY matching") Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: type_route_chain: use in-tree nftables, not system-wide oneFlorian Westphal2025-10-091-4/+4
| | | | | | Switch this to $NFT, which contains the locally-compiled binary. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix name based checks with CONFIG_MODULES=nFlorian Westphal2025-10-092-2/+2
| | | | | | | | | | | | | Don't include a trailing space, its only there if nftables is a module: hook ingress device foo2 { 0000000000 chain netdev t c [nf_tables] } with CONFIG_NF_TABLES=y, this gets listed as: '0000000000 chain netdev t c\n'. Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX stringsPhil Sutter2025-10-081-2/+9
| | | | | | | | | | The asterisk left in place becomes part of the prefix by accident and is thus both included when matching interface names as well as dumped back to user space. Fixes: c31e887504a90 ("mnl: Support simple wildcards in netdev hooks") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add regression tests for set flush+add bugsFlorian Westphal2025-10-0813-0/+333
| | | | | | | | | | | | | | | | | | | | | | | | | | Create a helper file to: 1. create client <-> router <-> server topology 2. floodping from client to server 3. add a chain + set that contains both client and server addresses 4. a control counter that should never match 5. then, flush the set (not the ruleset) and re-add the addresses in one transaction Report failure when counter had a match. The test cases for the set types are done in separate files to take advantage of run-tests.sh parallelization. The expected behavior is that every ping packet is matched by the set. The packet path should either match the old state, right before flush, or the new state, after re-add. As the flushed addresses are re-added in the same transaction we must not observe in-limbo state where existing elements are deactivated but new elements are not found. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: tunnel: handle tunnel delete commandFlorian Westphal2025-10-071-0/+3
| | | | | | | | 'delete tunnel foo bar' causes nft to bug out. Fixes: 35d9c77c5745 ("src: add tunnel template support") Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: objects.t: must use input, not outputFlorian Westphal2025-10-072-13/+13
| | | | | | | | | | | | | | | synproxy must never be used in output rules, doing so results in kernel crash due to infinite recursive calls back to nf_hook_slow() for the emitted reply packet. Up until recently kernel lacked this validation, and now that the kernel rejects this the test fails. Use input to make this pass again. A new test to ensure we reject synproxy in ouput should be added in the near future. Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Test ifname-based hooksPhil Sutter2025-09-307-0/+173
| | | | | | | | | | | | Assert that: - Non-matching interface specs are accepted - Existing interfaces are hooked into upon flowtable/chain creation - A new device matching the spec is hooked into immediately - No stale hooks remain in 'nft list hooks' output - Wildcard hooks basically work Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Accept ASTERISK_STRING in flowtable_expr_memberPhil Sutter2025-09-302-14/+27
| | | | | | | | | All clauses are identical, so instead of adding a third one for ASTERISK_STRING, use a single one for 'string' (which combines all three variants). Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Support simple wildcards in netdev hooksPhil Sutter2025-09-302-3/+25
| | | | | | | | | | | | When building NFTA_{FLOWTABLE_,}HOOK_DEVS attributes, detect trailing asterisks in interface names and transmit the leading part in a NFTA_DEVICE_PREFIX attribute. Deserialization (i.e., appending asterisk to interface prefixes returned in NFTA_DEVICE_PREFIX atributes happens in libnftnl. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: do not re-add default include directory in include search pathPablo Neira Ayuso2025-09-251-0/+3
| | | | | | | | | Otherwise globbing might duplicate included files because include_path_glob() is called twice. Fixes: 7eb950a8e8fa ("libnftables: include canonical path to avoid duplicates") Tested-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Fix for existence check on Big EndianPhil Sutter2025-09-112-1/+4
| | | | | | | | | | | | | | | | | | | | | Adjust the expression size to 1B so cmp expression value is correct. Without this, the rule 'fib saddr . iif check exists' generates following byte code on BE: | [ fib saddr . iif oif present => reg 1 ] | [ cmp eq reg 1 0x00000001 ] Though with NFTA_FIB_F_PRESENT flag set, nft_fib.ko writes to the first byte of reg 1 only (using nft_reg_store8()). With this patch in place, byte code is correct: | [ fib saddr . iif oif present => reg 1 ] | [ cmp eq reg 1 0x01000000 ] Fixes: f686a17eafa0b ("fib: Support existence check") Cc: Yi Chen <yiche@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Makefile: Enable support for 'make check'Phil Sutter2025-09-113-0/+27
| | | | | | | | | | | | | | | | | With all test suites running all variants by default, add the various testsuite runners to TESTS variable so 'make check' will execute them. Introduce --enable-distcheck configure flag for internal use during builds triggered by 'make distcheck'. This flag will force TESTS variable to remain empty, so 'make check' run as part of distcheck will not call any test suite: Most of the test suites require privileged execution, 'make distcheck' usually doesn't and probably shouldn't. Assuming the latter is used during the release process, it may even not run on a machine which is up to date enough to generate meaningful test suite results. Hence spare the release process from the likely pointless delay imposed by 'make check'. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: build: Avoid a recursive 'make check' runPhil Sutter2025-09-111-0/+4
| | | | | | | | | When called by 'make check', the test suite runs with a MAKEFLAGS variable in environment which defines TEST_LOGS variable with the test suites' corresponding logs as value. This in turn causes the called 'make distcheck' to run test suites although it is not supposed to. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: build: Do not assume caller's CWDPhil Sutter2025-09-111-0/+2
| | | | | | | Cover for being called from a different directory by changing into the test suite's directory first. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Skip packetpath/nat_ftp in fake root envPhil Sutter2025-09-111-0/+3
| | | | | | | The script relies upon a call to modprobe which does not work in fake root environments. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: json_echo: Skip if run as non-rootPhil Sutter2025-09-111-0/+4
| | | | | | | The test suite manipulates the kernel ruleset. Use the well-known return code 77 to indicate test execution being skipped. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: Prepare exit codes for automakePhil Sutter2025-09-113-13/+12
| | | | | | | | Make the test suite runners exit 77 when requiring root and running as regular user, exit 99 for internal errors (unrelated to test cases) and exit 1 (or any free non-zero value) to indicate test failures. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Enable JSON and JSON schema by defaultPhil Sutter2025-09-111-4/+12
| | | | | | | Introduce -J/--disable-json and -S/--no-schema to explicitly disable them if desired. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Excercise all syntaxes and variants by defaultPhil Sutter2025-09-111-55/+79
| | | | | | | | | | | Introduce -s/--standard flag to restrict execution to standard syntax and let users select a specific variant by means of -e/--echo and -m/--monitor flags. Run all four possible combinations by default. To keep indenting sane, introduce run_testcase() executing tests in a single test case for a given syntax and variant. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Extend testcases a bitPhil Sutter2025-09-113-0/+68
| | | | | | | | | | | Try to cover for reduced table and chain deletion notifications by creating them with data which is omitted by the kernel during deletion. Also try to expose the difference in reported flowtable hook deletion vs. flowtable deletion. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Inform JSON printer when reporting an object delete eventPhil Sutter2025-09-114-14/+21
| | | | | | | | | | | Since kernel commit a1050dd07168 ("netfilter: nf_tables: Reintroduce shortened deletion notifications"), type-specific data is no longer dumped when notifying for a deleted object. JSON output was not aware of this and tried to print bogus data. Fixes: 9e88aae28e9f4 ("monitor: Use libnftables JSON output") Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Allow for updating devices on existing inet ingress hook chainsPhil Sutter2025-09-112-2/+19
| | | | | | | | | | | | | Complete commit a66b5ad9540dd ("src: allow for updating devices on existing netdev chain") in supporting inet family ingress hook chains as well. The kernel does already but nft has to add a proper hooknum attribute to pass the checks. Calling chain_evaluate() for populating the hook.num field is a bit over the top and has potentially unwanted side-effects. Introduce a minimal chain_del_evaluate() for this purpose. Signed-off-by: Phil Sutter <phil@nwl.cc>
* Makefile: Fix for 'make CFLAGS=...'Phil Sutter2025-09-092-1/+2
| | | | | | | | | Appending to CFLAGS from configure.ac like this was too naive, passing custom CFLAGS in make arguments overwrites it. Extend AM_CFLAGS instead. Fixes: 64c07e38f0494 ("table: Embed creating nft version into userdata") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: skip two bitwise tests if multi-register support isn't availableFlorian Westphal2025-09-082-0/+2
| | | | | | | | | These tests fail in case kernel requires bitwise RHS to be a constant value. Fixes: 67d2a8d4c86f ("tests: shell: add parser and packetpath test") Reported-by: Yi Chen <yiche@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: monitor: Extend debug output a bitPhil Sutter2025-09-041-1/+11
| | | | | | | Dump echo output and output file, surrounded by markers to highlight empty files and extra newlines. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Test JSON echo mode as wellPhil Sutter2025-09-041-8/+19
| | | | | | | | | | Reuse the expected JSON monitor output for --echo testing as it is supposed to be "identical" - apart from formatting differences. To match lines of commands (monitor output) against a single line of JSON object (echo output), join the former's lines and drop the surrounding object in the latter since this seems to be the simplest way. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Fix regex collecting expected echo outputPhil Sutter2025-09-041-1/+1
| | | | | | | | | No input triggered this bug, but the match would accept "insert" and "replace" keywords anywhere in the line not just at the beginning as was intended. Fixes: b2506e5504fed ("tests: Merge monitor and echo test suites") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Label diffs to help usersPhil Sutter2025-09-041-1/+1
| | | | | | Clarify what was expected and what was actually received. Signed-off-by: Phil Sutter <phil@nwl.cc>
* monitor: Quote device names in chain declarations, tooPhil Sutter2025-09-021-1/+1
| | | | | | | | Fixed commit missed the fact that there are two routines printing chain declarations. Fixes: eb30f236d91a8 ("rule: print chain and flowtable devices in quotes") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tools: gitignore nftables.service filePhil Sutter2025-09-021-0/+1
| | | | | Fixes: c4b17cf830510 ("tools: add a systemd unit for static rulesets") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_bison: remove leftover utf-8 character in errorPablo Neira Ayuso2025-09-011-1/+1
| | | | | | | replace "‘" (UTF-8, 0xe280 0x98) with "'" (ASCII 0x27). Fixes: c92ec3b21979 ("src: remove utf-8 character in printf lines") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Embed creating nft version into userdataPhil Sutter2025-08-287-6/+81
| | | | | | | | | | Upon listing a table which was created by a newer version of nftables, warn about the potentially incomplete content. Suggested-by: Florian Westphal <fw@strlen.de> Cc: Dan Winship <danwinship@redhat.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: combine flowtable devices with variable expressionPablo Neira Ayuso2025-08-283-0/+84
| | | | | | | Expand test with flowtable devices defined with variables to improve coverage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: simplify set to list normalisation for device expressionsPablo Neira Ayuso2025-08-281-15/+1
| | | | | | | | | | | | | | | | | | | | | | When evaluating the list of devices, two expressions are possible: - EXPR_LIST, which is the expected expression type to store the list of chain/flowtable devices. - EXPR_SET, in case that a variable is used to express the device list. This is because it is not possible to know if the variable defines set elements or devices. Since sets are more common, EXPR_SET is used. In the latter case, this list expressed as EXPR_SET gets translated to EXPR_LIST. Before such translation, the EXPR_VARIABLE is evaluated, therefore all variables are gone and only EXPR_SET_ELEM are possible in expr_set_to_list(). Remove the EXPR_VALUE and EXPR_VARIABLE cases in expr_set_to_list() since those are never seen. Add BUG() in case any other expressions than EXPR_SET_ELEM is seen. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_alloc() by type safe functionPablo Neira Ayuso2025-08-275-22/+22
| | | | | | | Replace compound_expr_alloc() by {set,list,concat}_expr_alloc() to validate expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_print() by type safe functionPablo Neira Ayuso2025-08-271-15/+16
| | | | | | | Replace compound_expr_print() by {list,set,concat}_expr_print() to validate expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_destroy() by type safe funtionPablo Neira Ayuso2025-08-271-12/+23
| | | | | | Replace it by {set,list,concat}_expr_destroy() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_remove() by type safe functionPablo Neira Ayuso2025-08-273-10/+24
| | | | | | | Replace this function by {list,concat,set}_expr_remove() to validate expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: remove compound_expr_add()Pablo Neira Ayuso2025-08-272-7/+0
| | | | | | | No more users of this function after conversion to type safe variant, remove it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: replace compound_expr_clone() by type safe functionPablo Neira Ayuso2025-08-271-12/+30
| | | | | | | | | | | | Replace compound_expr_clone() by: - concat_expr_clone() - list_expr_clone() - set_expr_clone() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: rename set_compound_expr_add() to set_expr_add_splice()Pablo Neira Ayuso2025-08-271-6/+6
| | | | | | To avoid confusion when perfoming git grep to search for compound_expr_add() Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_add() by type safe list_expr_add()Pablo Neira Ayuso2025-08-276-19/+28
| | | | | | Replace compound_expr_add() by list_expr_add() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_add() by type safe concat_expr_add()Pablo Neira Ayuso2025-08-277-20/+29
| | | | | | Replace compound_expr_add by concat_expr_add() to validate type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace compound_expr_add() by type safe set_expr_add()Pablo Neira Ayuso2025-08-2710-35/+51
| | | | | | | | Replace compound_expr_add() by set_expr_add() to validate type. Add __set_expr_add() to skip size updates in src/intervals.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add expr_type_catchall() helper and use itPablo Neira Ayuso2025-08-274-8/+11
| | | | | | Add helper function to check if this is a catchall expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2026-01-08 23:24:45 +0000