summaryrefslogtreecommitdiffstats
path: root/src/main.c
Commit message (Collapse)AuthorAgeFilesLines
* meta: Introduce new conditions 'time', 'day' and 'hour'Ander Juaristi2019-09-061-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These keywords introduce new checks for a timestamp, an absolute date (which is converted to a timestamp), an hour in the day (which is converted to the number of seconds since midnight) and a day of week. When converting an ISO date (eg. 2019-06-06 17:00) to a timestamp, we need to substract it the GMT difference in seconds, that is, the value of the 'tm_gmtoff' field in the tm structure. This is because the kernel doesn't know about time zones. And hence the kernel manages different timestamps than those that are advertised in userspace when running, for instance, date +%s. The same conversion needs to be done when converting hours (e.g 17:00) to seconds since midnight as well. The result needs to be computed modulo 86400 in case GMT offset (difference in seconds from UTC) is negative. We also introduce a new command line option (-t, --seconds) to show the actual timestamps when printing the values, rather than the ISO dates, or the hour. Some usage examples: time < "2019-06-06 17:00" drop; time < "2019-06-06 17:20:20" drop; time < 12341234 drop; day "Saturday" drop; day 6 drop; hour >= 17:00 drop; hour >= "17:00:01" drop; hour >= 63000 drop; We need to convert an ISO date to a timestamp without taking into account the time zone offset, since comparison will be done in kernel space and there is no time zone information there. Overwriting TZ is portable, but will cause problems when parsing a ruleset that has 'time' and 'hour' rules. Parsing an 'hour' type must not do time zone conversion, but that will be automatically done if TZ has been overwritten to UTC. Hence, we use timegm() to parse the 'time' type, even though it's not portable. Overwriting TZ seems to be a much worse solution. Finally, be aware that timestamps are converted to nanoseconds when transferring to the kernel (as comparison is done with nanosecond precision), and back to seconds when retrieving them for printing. We swap left and right values in a range to properly handle cross-day hour ranges (e.g. 23:15-03:22). Signed-off-by: Ander Juaristi <a@juaristi.eus> Reviewed-by: Florian Westphal <fw@strlen.de>
* main: replace NFT_EXIT_NOMEM by EXIT_FAILUREPablo Neira Ayuso2019-07-051-2/+1
| | | | | | | The main.c file always uses either EXIT_FAILURE or EXIT_SUCCESS, replace this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use malloc() and free() from cli and mainPablo Neira Ayuso2019-07-051-1/+1
| | | | | | | | | xmalloc() and xfree() are internal symbols of the library, do not use them. Fixes: 16543a0136c0 ("libnftables: export public symbols only") Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't use xzalloc()Arturo Borrero Gonzalez2019-07-011-1/+7
| | | | | | | | | | | | In the current setup, nft (the frontend object) is using the xzalloc() function from libnftables, which does not makes sense, as this is typically an internal helper function. In order to don't use this public libnftables symbol (a later patch just removes it), let's use calloc() directly in the nft frontend. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Bail if non-available JSON was requestedPhil Sutter2019-06-251-0/+3
| | | | | | | | | | If user passes '-j' flag, falling back to standard syntax output probably causes more harm than good so instead print an error message and exit(1). Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -p to print layer 4 protocol numericallyPablo Neira Ayuso2018-10-301-1/+6
| | | | | | | | We keep printing layer 4 protocols as literals since we do not use /etc/protocols. Add -p option to print layer 4 protocols numerically. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of nft_ctx_output_{get,set}_numeric()Pablo Neira Ayuso2018-10-301-12/+2
| | | | | | | | | | | | | | | | | | | | | | | This patch adds NFT_CTX_OUTPUT_NUMERIC_SYMBOL, which replaces the last client of the numeric level approach. This patch updates `-n' option semantics to display all output numerically. Note that monitor code was still using the -n option to skip printing the process name, this patch updates that path too to print it inconditionally to simplify things. Given the numeric levels have no more clients after this patch, remove that code. Update several tests/shell not to use -nn. This patch adds NFT_CTX_OUTPUT_NUMERIC_ALL which enables all flags to provide a fully numerical output. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -y to priority base chain nummericallyPablo Neira Ayuso2018-10-291-2/+10
| | | | | | | | By default base chains are printed using default hook priority definitions. Add -y option to print them as numbers. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: default to numeric UID and GID listingPablo Neira Ayuso2018-10-291-1/+10
| | | | | | | | | | | | | Like iptables-save, print UID and GID as numeric values by default. Add a new option `-u' to print the UID and GID names as defined by /etc/passwd and /etc/group. Note that -n is ignored after this patch, since default are numeric printing for UID and GID. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_echo() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-291-1/+1
| | | | | | | | Add NFT_CTX_OUTPUT_ECHO flag and echo the command that has been send to the kernel. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_json() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-291-1/+3
| | | | | | | Add NFT_CTX_OUTPUT_JSON flag and display output in json format. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_handle() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-291-1/+1
| | | | | | | | Add NFT_CTX_OUTPUT_HANDLE flag and print handle that uniquely identify objects from new output flags interface. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_stateless() to ↵Pablo Neira Ayuso2018-10-291-1/+1
| | | | | | | | | | | | nft_ctx_output_{get,flags}_flags Add NFT_CTX_OUTPUT_STATELESS flag and enable stateless printing from new output flags interface. This patch adds nft_output_save_flags() and nft_output_restore_flags() to temporarily disable stateful printing Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Revert --literal, add -S/--servicePablo Neira Ayuso2018-10-291-20/+11
| | | | | | | | | | | | | | | | | | | | | | This is a partial revert of b0f6a45b25dd1 ("src: add --literal option") which was added during the development cycle before 0.9.1 is released. After looking at patch: https://patchwork.ozlabs.org/patch/969864/ that allows to print priority, uid, gid and protocols as numerics, I decided to revisit this to provide individual options to turn on literal printing. What I'm proposing is to provide a good default for everyone, and provide options to turn on literal/numeric printing. This patch adds nft_ctx_output_{set,get}_flags() and define two flags to enable reverse DNS lookups and to print ports as service names. This patch introduces -S/--services, to print service names as per /etc/services. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --literal optionPablo Neira Ayuso2018-07-071-2/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default not to print the service name as we discussed during the NFWS. # nft list ruleset table ip x { chain y { tcp dport 22 ip saddr 1.1.1.1 } } # nft -l list ruleset table ip x { chain y { tcp dport ssh ip saddr 1.1.1.1 } } # nft -ll list ruleset table ip x { chain y { tcp dport 22 ip saddr 1dot1dot1dot1.cloudflare-dns.com } } Then, -ll displays FQDN. just like the (now deprecated) --ip2name (-N) option. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Simplify nft_run_cmd_from_buffer footprintPhil Sutter2018-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | With libnftables documentation being upstream and one confirmed external user (nftlb), time to break the API! First of all, the command buffer passed to nft_run_cmd_from_buffer may (and should) be const. One should consider it a bug if that function ever changed it's content. On the other hand, there is no point in passing the buffer's length as separate argument: NULL bytes are not expected to occur in the input, so it is safe to rely upon strlen(). Also, the actual parsers don't require a buffer length passed to them, either. The only use-case for it is when reallocating the buffer to append a final newline character, there strlen() is perfectly sufficient. Suggested-by: Harald Welte <laforge@gnumonks.org> Cc: Laura Garcia Liebana <nevola@gmail.com> Cc: Eric Leblond <eric@regit.org> Cc: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Implement JSON output supportPhil Sutter2018-05-111-1/+10
| | | | | | | | | | | | Although technically there already is support for JSON output via 'nft export json' command, it is hardly useable since it exports all the gory details of nftables VM. Also, libnftables has no control over what is exported since the content comes directly from libnftnl. Instead, implement JSON format support for regular 'nft list' commands. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: fix header exportArturo Borrero Gonzalez2018-05-021-1/+1
| | | | | | | | | | | Instruct Make to actually install the header to the system, otherwise users won't see the header in their system after running 'make install'. Also, export main libnftables header with a proper name, since we have another private header called 'nftables.h' (i.e, let's be concrete with the naming). Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: Fix for input without trailing newlinePhil Sutter2018-04-111-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Input parser implementation requires a newline at end of input, otherwise the last pattern may not be recognized correctly. If input comes from a file, the culprit was YY_INPUT macro not expecting the last line not ending with a newline, so the last word wasn't accepted. This is easily fixed by checking for feof(yyin) in there. A simple test case for that is: | echo -en "table ip t {\nchain c {\n}\n}" >/tmp/foo | nft -f /tmp/foo Input from a string buffer is a bit more tricky: The culprit here is that detection of classid pattern is done by checking the character following it which makes it impossible to sit right at end of input and I haven't found an alternative to that. After dropping the manual newline appending when combining argv into a single buffer in main(), a rule like this won't be recognized anymore: | nft add rule ip t c meta priority feed:babe Since a direct call to run_cmd_from_buffer() via libnftables bypasses the sanitizing done in main() entirely, it has to happen in libnftables instead which means creating a newline-terminated duplicate of the input buffer. Note that main() created a buffer one byte longer than needed since it accounts for whitespace at end of each argv but doesn't add it to the buffer for the last one, so buffer length is reduced by two bytes instead of just one although only one less character is printed into it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Ensure output_fp is never NULLPhil Sutter2017-11-221-1/+0
| | | | | | | | | | | | | | Initialize output_fp to 'stdout' upon context creation and check output stream validity in nft_ctx_set_output(). This allows to drop checks in nft_{gmp_,}print() and do_command_export(). While doing so for the latter, simplify it a bit by using nft_print() which takes care of flushing the output stream. If applications desire to drop all output, they are supposed to open /dev/null and assign that. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Unexport enum nftables_exit_codesPhil Sutter2017-11-161-11/+11
| | | | | | | | | | | | | | | | Apart from SUCCESS/FAILURE, these codes were not used by library functions simply because NOMEM and NONL conditions lead to calling exit() instead of propagating the error condition back up the call stack. Instead, make nft_run_cmd_from_*() return either 0 or -1 on error. Usually errno will then contain more details about what happened and/or there are messages in erec. Calls to exit()/return in main() are adjusted to stay compatible. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ prefix to everything exposed through include/nftables/nftables.hPablo Neira Ayuso2017-10-241-13/+13
| | | | | | | | Prepend nft_ prefix before these are exposed, reduce chances we hit symbol namespace pollution problems when mixing libnftables with other existing libraries. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Introduce getters and setters for everythingPhil Sutter2017-10-241-13/+17
| | | | | | | | | | | | | | | | | | | | | | | | | This introduces getter/setter pairs for all parts in struct nft_ctx (and contained structs) which should be configurable. Most of them are simple ones, just allowing to get/set a given field: * nft_ctx_{get,set}_dry_run() -> ctx->check * nft_ctx_output_{get,set}_numeric() -> ctx->output.numeric * nft_ctx_output_{get,set}_stateless() -> ctx->output.stateless * nft_ctx_output_{get,set}_ip2name() -> ctx->output.ip2name * nft_ctx_output_{get,set}_debug() -> ctx->debug_mask * nft_ctx_output_{get,set}_handle() -> ctx->output.handle * nft_ctx_output_{get,set}_echo() -> ctx->output.echo A more complicated case is include paths handling: In order to keep the API simple, remove INCLUDE_PATHS_MAX restraint and dynamically allocate nft_ctx field include_paths instead. So there is: * nft_ctx_add_include_path() -> add an include path to the list * nft_ctx_clear_include_paths() -> flush the list of include paths Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: Use nft_run_cmd_from_buffer()Phil Sutter2017-10-241-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make CLI code adhere to intended libnftables API by not open coding what nft_run_cmd_from_buffer() does. This way, nft_run() has no users outside of src/libnftables.c anymore and therefore can become static. Since nft_run_cmd_from_buffer() takes care of scanner initialization and libmnl socket passed to cli_init() is present as nft_ctx field as well, signature of cli_init() can be reduced to just take nft_ctx pointer as single argument. Note that this change introduces two (possibly unwanted) side-effects: * Input descriptor passed to scanner_push_buffer() is changed from the CLI-specific one to the one used by nft_run_cmd_from_buffer(). In practice though, this doesn't make a difference: input descriptor types INDESC_CLI and INDESC_BUFFER are treated equally by erec_print(). Also, scanner_push_buffer() NULLs input descriptor name, so that is not used at all in latter code. * Error messages are printed to stderr instead of cli_nft->output. This could be fixed by introducing an 'error_output' field in nft_ctx for nft_run_cmd_from_buffer() to use when printing error messages. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Move library stuff out of main.cPhil Sutter2017-10-241-251/+1
| | | | | | | | This creates src/libnftables.c and include/nftables/nftables.h which will become the central elements of libnftables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Fix for wrong argument passed to cache_release in nft_ctx_freePhil Sutter2017-10-201-2/+2
| | | | | | | | | nft_ctx_free() should not refer to the global 'nft' variable, this will break as soon as the function is moved away from main.c. In order to use the cache reference from passed argument, the latter must not be const. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix debug outputPhil Sutter2017-10-061-2/+8
| | | | | | | | | | | | | | | | | | | When introducing output_fp, debug output in src/evaluate.c was not adjusted and therefore broke. This patch restores eval debug output by applying the following changes: - Change erec_print() and erec_print_list() to take a struct output_ctx pointer as first argument and use output_fp field as destination to print to. - Drop octx_debug_dummy variable and instead use octx pointer from struct eval_ctx for debug output. - Add missing calls to erec_destroy() in eval debug output which should eliminate another mem leak. Fixes: 2535ba7006f22 ("src: get rid of printf") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Drop stdout hack to expose nft_print() implementation issuesPhil Sutter2017-09-291-3/+1
| | | | | | | | | This was helpful when testing nft_print() implementation, but breaks 'nft --help' output. Also, with this in place typical printf-debugging would have to use stderr at all times which is confusing at least. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Flush output from nft_gmp_print()Phil Sutter2017-09-291-0/+1
| | | | | | | | | | This adds a missing call to fflush() to nft_gmp_print() just like in nft_print(). This is strictly not necessary since usually nft_gmp_print() is followed by a call to nft_print() but better not rely upon this assumption. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of printfPhil Sutter2017-09-291-3/+48
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Fix for return of uninitialized variable in nft_run_cmd_from_filename()Phil Sutter2017-09-271-1/+3
| | | | | | | | | If scanner_read_file() failed, the function would return an uninitialized value. Fixes: 3db28321b64a6 ("src: add nft_run_cmd_*() functions") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flags fo nft_ctx_newEric Leblond2017-09-041-9/+11
| | | | | | | | | | | By adding flags to nft_ctx_new, we will have a minimum capabilities of changing the way the nft_ctx is created. For now, this patch uses a simple value that allow the user to specify that he will handle netlink by himself. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_netlink_init()Pablo Neira Ayuso2017-09-011-2/+10
| | | | | | | Add these two new functions to set up netlink sockets in the global context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move nf_sock into nft_ctx structurePablo Neira Ayuso2017-09-011-15/+11
| | | | | | | | | | The idea is to provide a simplistic API for non-netlink wise people. Add a field in struct nft_ctx to store the socket. The advanced API that we're planning will just simply leave this unset, since netlink IO will be exposed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: call nft_init() and nft_exit() from context routinesPablo Neira Ayuso2017-08-241-5/+4
| | | | | | | So we don't forget all these caches should be placed into struct nft_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: release caches from nft_ctx_free() pathEric Leblond2017-08-241-3/+2
| | | | | | | | | | Release existing caches from nft_ctx_free(). Still, the iface cache should be good to place it in the nft_ctx structure. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_run_cmd_*() functionsEric Leblond2017-08-241-22/+54
| | | | | | | | | | Add new function to read nftables command from a file and buffer, that we can expose as library. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_new() and nft_ctx_free()Eric Leblond2017-08-241-25/+39
| | | | | | | | | | These new functions allows us to allocate and release the context structure. This is going to be useful for libnftables. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix error handling in mnl_batch_talkEric Leblond2017-08-241-1/+0
| | | | | | | | | | | | If one of the command is failing we should return an error. Pablo says: "This is not a real issue since nft_netlink() returns an error in case the list of errors is not empty. But we can indeed simplify things by removing that explicit assignment in nft_netlink() so mnl_batch_talk() consistently reports when if an error has happened. Signee-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: Fix for memleak due to unclosed file pointerPhil Sutter2017-08-241-1/+1
| | | | | | | | | | | | | | | | | | | | When including a file, it is opened by fopen() and therefore needs to be closed after scanning has finished using fclose(), otherwise valgrind will report a memleak. This patch changes struct input_descriptor to track the opened FILE pointer instead of the file descriptor so the pointer is available for closing in scanner_destroy(). While at it, change erec_print() to work on the open FILE pointer so it doesn't have to call fileno() in beforehand. And as a little bonus, use C99 initializer of the buffer to get rid of the call to memset(). Note that it is necessary to call erec_print_list() prior to destroying the scanner, otherwise it will start manipulating an already freed FILE pointer (and therefore crash the program). Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add debugging mask to context structurePablo Neira Ayuso2017-08-231-6/+7
| | | | | | | So this toggle is not global anymore. Update name that fits better with the semantics of this variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove ifdef DEBUG pollutionPablo Neira Ayuso2017-08-231-10/+0
| | | | | | | | | | | | | | | Get rid of lots of ifdef DEBUG pollution in the code. The --debug= option is useful to get feedback from users, so it should be always there. And we really save nothing from keeping this code away from the control plane with a compile time option. Just running tests/shell/ before and after this patch, time shows almost no difference. So this patch leaves --enable-debug around to add debugging symbols in your builds, this is left set on by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add maximum number of parser errors to struct nft_ctxPablo Neira Ayuso2017-08-231-1/+1
| | | | | | Not a global variable anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add include_paths to struct nft_ctxPablo Neira Ayuso2017-08-231-6/+11
| | | | | | | Not convenient to keep this as static for the upcoming library, so let's move it where it belongs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Keep cache in struct nft_ctxPhil Sutter2017-08-231-13/+11
| | | | | | | This is preliminary work for Eric's libnftables patchset. Cc: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: make netlink sequence number non-staticPablo Neira Ayuso2017-08-151-5/+5
| | | | | | | | | | | | Place sequence number that is allocated per-command on the struct netlink_ctx structure. This is allocated from nft_run() to correlate commands with netlink messages for error reporting. Batch support probing also shares this sequence numbers with commands. There is an inpendent cache sequence number though, this routine is called from a different path, usually from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce struct nft_cacheVarsha Rao2017-08-141-11/+18
| | | | | | | | | | Pass variable cache_initialized and structure list_head as members of structure nft_cache. Joint work with Pablo Neira. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement --echo optionPhil Sutter2017-08-141-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When used with add, insert or replace commands, nft tool will print event notifications just like 'nft monitor' does for the same commands. Apart from seeing what a given command will turn out in the rule set, this allows to reliably retrieve a new rule's assigned handle (if used together with --handle option). Here are some examples of how it works: | # nft --echo --handle add table ip t | add table ip t | | # nft --echo --handle add chain ip t c \ | '{ type filter hook forward priority 0; }' | add chain ip t c { type filter hook forward priority 0; policy accept; } | | # nft --echo --handle add rule ip t c tcp dport '{22, 80}' accept | add rule ip t c tcp dport { ssh, http } accept # handle 2 | | # nft --echo --handle add set ip t ipset '{ type ipv4_addr; \ | elements = { 192.168.0.1, 192.168.0.2 }; }' | add set ip t ipset { type ipv4_addr; } | add element ip t ipset { 192.168.0.1 } | add element ip t ipset { 192.168.0.2 } Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove __init and __exit macro definitions.Varsha Rao2017-07-171-0/+24
| | | | | | | | | | | | Add nft_init and nft_exit functions, which calls _init and _exit functions in main.c file. Remove __init and __exit macro definitions as libnftables library will be created soon. Rename realm_table_init() and realm_table_exit() functions to avoid ambiguity as realm_table_rt_init(), realm_table_meta_init, realm_table_rt_exit() and realm_table_meta_exit() in rt.c and meta.c files. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Pass nf_sock where needed as parameterPablo Neira Ayuso2017-07-171-10/+14
| | | | | | | | | | | | This socket should not be global, it is also hidden in many layers of code. Expose it as function parameters to decouple the netlink socket handling logic from the command parsing, evaluation and bytecode generation. Joint work with Varsha Rao. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>