summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* src: add debugging mask to context structurePablo Neira Ayuso2017-08-238-14/+31
| | | | | | | So this toggle is not global anymore. Update name that fits better with the semantics of this variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add struct mnl_ctxPablo Neira Ayuso2017-08-231-1/+5
| | | | | | This new structure contains the netlink socket and the sequence number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove ifdef DEBUG pollutionPablo Neira Ayuso2017-08-231-12/+0
| | | | | | | | | | | | | | | Get rid of lots of ifdef DEBUG pollution in the code. The --debug= option is useful to get feedback from users, so it should be always there. And we really save nothing from keeping this code away from the control plane with a compile time option. Just running tests/shell/ before and after this patch, time shows almost no difference. So this patch leaves --enable-debug around to add debugging symbols in your builds, this is left set on by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add maximum number of parser errors to struct nft_ctxPablo Neira Ayuso2017-08-231-1/+1
| | | | | | Not a global variable anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add include_paths to struct nft_ctxPablo Neira Ayuso2017-08-232-3/+5
| | | | | | | Not convenient to keep this as static for the upcoming library, so let's move it where it belongs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Keep cache in struct nft_ctxPhil Sutter2017-08-232-8/+9
| | | | | | | This is preliminary work for Eric's libnftables patchset. Cc: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* rt: add path mtu supportFlorian Westphal2017-08-221-0/+1
| | | | | | | | | | Only use case is to allow similar behaviour to iptables TCPMSS --clamp-mss-to-pmtu, by combining this with exthdr statement: tcp option maxseg size set rt mtu Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp options set supportFlorian Westphal2017-08-222-0/+12
| | | | | | | | | | | | This adds support for tcp mss mangling: nft add rule filter input tcp option maxseg size 1200 Its also possible to change other tcp option fields, but maxseg is one of the more useful ones to change. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: Remove unused functions.Varsha Rao2017-08-171-10/+0
| | | | | | | | | | Functions mnl_nft_chain_get(), mnl_nft_rule_add(), mnl_nft_rule_delete(), mnl_nft_set_get(), mnl_nft_table_get(), set_get_cb(), table_get_cb() and chain_get_cb() are only defined but not used, so remove them. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove unused functions.Varsha Rao2017-08-171-11/+0
| | | | | | | | | | Remove netlink_add_rule_list(), netlink_dump_table(), netlink_get_chain(), netlink_get_set(), netlink_get_table(), netlink_list_chain() functions definitions as they are not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: cli: Remove cli_display() function.Varsha Rao2017-08-171-1/+0
| | | | | | | | Remove cli_display() function, as it is not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: gmputil: Remove mpz_get_be64() function.Varsha Rao2017-08-171-1/+0
| | | | | | | mpz_get_be64() is not used anywhere in source code. So remove it. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove xt_stmt_() functions.Varsha Rao2017-08-172-9/+0
| | | | | | | | | Remove functions xt_stmt_alloc(), xt_stmt_release(), xt_stmt_xlate(), xt_stmt_print(), xt_stmt_destroy() as they are not used. Similarly, remove structure xt_stmt_ops. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove sequence number from struct eval_ctxPablo Neira Ayuso2017-08-151-2/+0
| | | | | | This field is unused, remove it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make netlink sequence number non-staticPablo Neira Ayuso2017-08-154-35/+41
| | | | | | | | | | | | Place sequence number that is allocated per-command on the struct netlink_ctx structure. This is allocated from nft_run() to correlate commands with netlink messages for error reporting. Batch support probing also shares this sequence numbers with commands. There is an inpendent cache sequence number though, this routine is called from a different path, usually from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct nft_cacheVarsha Rao2017-08-145-13/+26
| | | | | | | | | | Pass variable cache_initialized and structure list_head as members of structure nft_cache. Joint work with Pablo Neira. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement --echo optionPhil Sutter2017-08-142-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When used with add, insert or replace commands, nft tool will print event notifications just like 'nft monitor' does for the same commands. Apart from seeing what a given command will turn out in the rule set, this allows to reliably retrieve a new rule's assigned handle (if used together with --handle option). Here are some examples of how it works: | # nft --echo --handle add table ip t | add table ip t | | # nft --echo --handle add chain ip t c \ | '{ type filter hook forward priority 0; }' | add chain ip t c { type filter hook forward priority 0; policy accept; } | | # nft --echo --handle add rule ip t c tcp dport '{22, 80}' accept | add rule ip t c tcp dport { ssh, http } accept # handle 2 | | # nft --echo --handle add set ip t ipset '{ type ipv4_addr; \ | elements = { 192.168.0.1, 192.168.0.2 }; }' | add set ip t ipset { type ipv4_addr; } | add element ip t ipset { 192.168.0.1 } | add element ip t ipset { 192.168.0.2 } Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Pass nlmsg flags from rule.cPhil Sutter2017-08-141-5/+5
| | | | | | | | There is no point in checking value of excl in each called function. Just do it in a single spot and pass resulting flags. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: handle rule tracing as an monitor objectPablo Neira Ayuso2017-08-021-0/+1
| | | | | | Traces are not an event type, they should be handled as an object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Consolidate mnl_batch_talk() parametersPhil Sutter2017-08-021-2/+2
| | | | | | | | | The single caller of this function passes struct netlink_ctx fields as the first two parameters. This can be simplified by passing the context object itself and having mnl_batch_talk() access it's fields instead. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: nft monitor rulesetVarsha Rao2017-07-311-0/+1
| | | | | | | | | | This patch adds event reporting for ruleset, which prints only ruleset events. Syntax : nft monitor ruleset Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Print NEWGEN eventsPhil Sutter2017-07-241-0/+2
| | | | | | | | | Now that they contain process information, they're actually interesting. For backwards compatibility, print process information only if it was present in the message. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix printing of range elements in named setsArturo Borrero Gonzalez2017-07-191-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If you add set elements to interval sets, the output is wrong. Fix this by caching first element of the range (first event), then wait for the second element of the range (second event) to print them both at the same time. We also avoid printing the first null element required in the RB tree. Before this patch: % nft add element t s {10-20, 30-40} add element ip t s { 0 } add element ip t s { 10 } add element ip t s { ftp } add element ip t s { 30 } add element ip t s { 41 } After this patch: % nft add element t s {10-20, 30-40} add element ip t s { 10-20 } add element ip t s { 30-40 } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Introduce flag for half-open range elementsPhil Sutter2017-07-192-0/+17
| | | | | | | | | This flag is required by userspace only, so can live within userdata. It's sole purpose is for 'nft monitor' to detect half-open ranges (which are comprised of a single element only). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove variable nf_mon_sock.Varsha Rao2017-07-191-1/+2
| | | | | | | | | | | Remove variable nf_mon_sock of type structure mnl_socket to avoid duplicity. Instead variable nf_sock of the same type is passed as argument to netlink_monitor(). Also remove netlink_open_mon_sock() function definition, which is no longer required. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow passing the parent set to set_expr_alloc()Phil Sutter2017-07-171-1/+2
| | | | | | | | | | | | | | | | | Usually one wants to at least initialize set_flags from the parent, so make allocation of a set's set expression more convenient. The idea to do this came when fixing an issue with output formatting of larger anonymous sets in nft monitor: Since netlink_events_cache_addset() didn't initialize set_flags, calculate_delim() didn't detect it's an anonymous set and therefore added newlines to the output. Reported-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Fixes: a9dc3ceabc10f ("expression: print sets and maps in pretty format") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove __init and __exit macro definitions.Varsha Rao2017-07-172-2/+16
| | | | | | | | | | | | Add nft_init and nft_exit functions, which calls _init and _exit functions in main.c file. Remove __init and __exit macro definitions as libnftables library will be created soon. Rename realm_table_init() and realm_table_exit() functions to avoid ambiguity as realm_table_rt_init(), realm_table_meta_init, realm_table_rt_exit() and realm_table_meta_exit() in rt.c and meta.c files. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Pass nf_sock where needed as parameterPablo Neira Ayuso2017-07-176-9/+22
| | | | | | | | | | | | This socket should not be global, it is also hidden in many layers of code. Expose it as function parameters to decouple the netlink socket handling logic from the command parsing, evaluation and bytecode generation. Joint work with Varsha Rao. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rename struct ct to ct_helperFlorian Westphal2017-07-161-3/+3
| | | | | | | Its misleading, this structure holds members for ct_helper object infrastructure, rename it. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: make tcptopt structs staticFlorian Westphal2017-07-131-9/+0
| | | | | | | not used outside of tcpopt.c, so unexport from header file and make them static. Signed-off-by: Florian Westphal <fw@strlen.de>
* include: Remove datatype_register().Varsha Rao2017-06-307-3/+24
| | | | | | | | Remove datatype_register() function and its calling __init functions. Add arguments of datatype_register() function to datatype array. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --check option flagPablo M. Bermudo Garay2017-06-261-0/+1
| | | | | | | | | Sometimes it can be useful to test if a command is valid without applying any change to the rule-set. This commit adds a new option flag (-c | --check) that performs a dry run execution of the commands. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add new generic context structure nft_ctxPablo M. Bermudo Garay2017-06-262-4/+8
| | | | | | | | | | | | | The new structure nft_ctx is meant to be used as a generic container of context information. This is a preparatory patch. So at the moment the struct just carry output_ctx on his path through main.c and cli.c. Based on original idea from Eric Leblond. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Pass stateless, numeric, ip2name and handle variables as structure members.Varsha Rao2017-06-187-19/+29
| | | | | | | | | | | | | | | | | libnftables library will be created soon. So declare numeric_output, stateless_output, ip2name_output and handle_output as members of structure output_ctx, instead of global variables. Rename these variables as following, numeric_output -> numeric stateless_output -> stateless ip2name_output -> ip2name handle_output -> handle Also add struct output_ctx *octx as member of struct netlink_ctx. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: error reporting for nested ruleset representationPablo Neira Ayuso2017-06-161-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you load a file using the nested ruleset representation, ie. the one you get via `nft list ruleset', error reporting doesn't help you much to find the problem. For example, the following ruleset points to an unexisting chain 'x': table test { chain test { type filter hook ingress priority 0; policy drop; ip saddr { 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 } jump x } } Error reporting is very sparse as it says: # nft -f /home/test/x /home/test/x:1:1-2: Error: Could not process rule: No such file or directory table netdev test{ ^^ So it's hard to know what is exactly missing. This patch enhances the existing logic, so nft points to the rule causing the problem, ie. # nft -f /home/test/x /home/test/x:4:17-70: Error: Could not process rule: No such file or directory ip saddr { 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 } jump x ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The idea behind this patch is to expand the single table command into a list of individual commands, one per nested object inside the table. This expanded list is spliced into the existing list of commands. Thus, each command gets a sequence number that helps us correlate the error with the command that triggers it. This patch also includes reference counting for rules and objects. This was already in place for table, chain and sets. We need this since now we hold references to them from both the command and the table object itself. So the last reference releases the object from memory. Note that table objects still keep the list of chain, sets, etc. since the existing cache logic needs this to work. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove global nftnl_batch structure in mnl layerPablo Neira Ayuso2017-05-292-27/+29
| | | | | | | | The underlying mnl layer uses a global nftnl_batch structure. Instead, pass pointer as parameter to the functions that need this. The netlink layer stores a reference to this structure in struct netlink_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: don't kill dependencies accross statementsFlorian Westphal2017-05-081-0/+2
| | | | | | | | | | | | | | | | | | | | nft currently translates ip protocol tcp meta mark set 1 tcp dport 22 to mark set 0x00000001 tcp dport 22 This is wrong, the latter form is same as mark set 0x00000001 ip protocol tcp tcp dport 22 and thats not correct (original rule sets mark for tcp packets only). We need to clear the dependency stack whenever we see a statement other than stmt_expr, as these will have side effects (counter, payload mangling, logging and the like). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add conntrack event mask supportFlorian Westphal2017-04-243-64/+19
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hash: generate a random seed if seed option is emptyLiping Zhang2017-04-152-2/+5
| | | | | | | | | | | Typing the "nft add rule x y ct mark set jhash ip saddr mod 2" will not generate a random seed, instead, the seed will always be zero. So if seed option is empty, we shoulde not set the NFTA_HASH_SEED attribute, then a random seed will be generated in the kernel. Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: implement add/create/delete for ct helper objectsFlorian Westphal2017-03-161-0/+4
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow listing all ct helpersFlorian Westphal2017-03-161-0/+1
| | | | | | | | | | | this implements nft list ct helpers table filter table ip filter { ct helper ftp-standard { .. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add initial ct helper supportFlorian Westphal2017-03-163-1/+19
| | | | | | | | | | | | | | | | | This adds initial support for defining conntrack helper objects which can then be assigned to connections using the objref infrastructure: table ip filter { ct helper ftp-standard { type "ftp" protocol tcp } chain y { tcp dport 21 ct helper set "ftp-standard" } } Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Support existence checkPhil Sutter2017-03-132-0/+3
| | | | | | | | | | | | | | | | | This allows to check whether a FIB entry exists for a given packet by comparing the expression with a boolean keyword like so: | fib daddr oif exists The implementation requires introduction of a generic expression flag EXPR_F_BOOLEAN which allows relational expression to signal it's LHS that a boolean comparison is being done (indicated by boolean type on RHS). In contrast to exthdr existence checks, fib expression can't know this in beforehand because the LHS syntax is absolutely identical to a non-boolean comparison. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Implement existence checkPhil Sutter2017-03-101-0/+2
| | | | | | | | | | | This allows to check for existence of an IPv6 extension or TCP option header by using the following syntax: | exthdr frag exists | tcpopt window exists Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Add support for exthdr specific flagsPhil Sutter2017-03-103-2/+4
| | | | | | | | | This allows to have custom flags in exthdr expression, which is necessary for upcoming existence checks (of both IPv6 extension headers as well as TCP options). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Introduce boolean datatype and boolean expressionPhil Sutter2017-03-101-0/+2
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: hash: support of symmetric hashLaura Garcia Liebana2017-03-063-1/+15
| | | | | | | | | | | | | | | | | | | | | This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit tcp options supportPablo Neira Ayuso2017-02-281-3/+29
| | | | | | | | | | | | | | | | | | | Rework syntax, add tokens so we can extend the grammar more easily. This has triggered several syntax changes with regards to the original patch, specifically: tcp option sack0 left 1 There is no space between sack and the block number anymore, no more offset field, now they are a single field. Just like we do with rt, rt0 and rt2. This simplifies our grammar and that is good since it makes our life easier when extending it later on to accomodate new features. I have also renamed sack_permitted to sack-permitted. I couldn't find any option using underscore so far, so let's keep it consistent with what we have. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support zone set statement with optional directionFlorian Westphal2017-02-281-0/+2
| | | | | | | | | | | | nft automatically understands 'ct zone set 1' but when a direction is specified too we get a parser error since they are currently only allowed for plain ct expressions. This permits the existing syntax ('ct original zone') for all tokens with an optional direction also for set statements. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: store byteorder for set dataPablo Neira Ayuso2017-02-281-0/+1
| | | | | | | | | Add new UDATA_SET_DATABYTEORDER attribute for NFTA_SET_UDATA to store the datatype byteorder. This is required if integer_type is used on the rhs of the mapping given that this datatype comes with no specific byteorder. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>