summaryrefslogtreecommitdiffstats
path: root/src/netlink.c
Commit message (Collapse)AuthorAgeFilesLines
* src: add obj_specPablo Neira Ayuso2018-05-061-4/+4
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set_specPablo Neira Ayuso2018-05-061-3/+3
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain_specPablo Neira Ayuso2018-05-061-7/+7
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table_specPablo Neira Ayuso2018-05-061-20/+20
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix --debug mnl not producing outputDuncan Roe2018-04-261-1/+1
| | | | | | | | | cache_update() needs to accept the full debug mask instead of a boolean of NFT_DEBUG_NETLINK, because called functions may wish to check other bits (NFT_DEBUG_MNL in particular). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: no EINTR handling from netlink_get_setelem()Pablo Neira Ayuso2018-04-241-11/+4
| | | | | | This cannot happen, this call does not set the NLM_F_DUMP flag. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: centralize netlink error reportingPablo Neira Ayuso2018-04-241-30/+4
| | | | | | Consolidate error reporting from do_command() call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify netlink_get_setelems() and rename it to netlink_list_setelems()Pablo Neira Ayuso2018-04-241-9/+6
| | | | | | | | This is called from cache population path, remove netlink_io_error() call since this is not needed. Rename it for consistency with similar netlink_list_*() NLM_F_DUMP functions. Get rid of location parameter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't pass location to netlink_list_*() functionPablo Neira Ayuso2018-04-241-15/+8
| | | | | | Not needed anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: netlink_list_chains() callers always wants all existing chainsPablo Neira Ayuso2018-04-241-15/+1
| | | | | | | Remove dead code, callers always need this to dump all of the existing chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: pass cmd object to netlink function callsPablo Neira Ayuso2018-04-241-69/+58
| | | | | | Simplify function footprint. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove dead netlink_io_error() callsPablo Neira Ayuso2018-04-201-58/+4
| | | | | | | | | This error path is never entered since mnl_nft_*_batch_{add,del,replace} calls never fail, and if they ever do fail it will be because we are hitting OOM, in such case we can display a more generic non-netlink error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: floating point exception with concatenationsPablo Neira Ayuso2018-04-031-1/+1
| | | | | | | If the length is less than 1 byte, this codepath hits a floating point exception, use div_round_up() as everywhere else in the code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use nftnl_flowtable_get/setFlorian Westphal2018-03-121-4/+4
| | | | | | | the '_array' variant is just a wrapper for get/set api; this allows the array variant to be removed from libnftnl. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: don't not dump set content from netlink_get_setelems()Pablo Neira Ayuso2018-03-071-1/+0
| | | | | | | This causes python tests to report payload mismatching errors. Fixes: a43cc8d53096 ("src: support for get element command") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unused batch support checksPablo Neira Ayuso2018-03-071-8/+0
| | | | | | Follow up after cc8c5fd02448 ("netlink: remove non-batching routine"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move monitor code to src/monitor.cPablo Neira Ayuso2018-03-071-919/+12
| | | | | | | | netlink.c is rather large file, move the monitor code to its own file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* src: support for get element commandPablo Neira Ayuso2018-03-071-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | You need a Linux kernel >= 4.15 to use this feature. This patch allows us to dump the content of an existing set. # nft list ruleset table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 3.3.3.3, 5.5.5.5-6.6.6.6 } } } You check if a single element exists in the set: # nft get element x x { 1.1.1.5 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } Output means '1.1.1.5' belongs to the '1.1.1.1-2.2.2.2' interval. You can also check for intervals: # nft get element x x { 1.1.1.1-2.2.2.2 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } If you try to check for an element that doesn't exist, an error is displayed. # nft get element x x { 1.1.1.0 } Error: Could not receive set elements: No such file or directory get element x x { 1.1.1.0 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ You can also check for multiple elements in one go: # nft get element x x { 1.1.1.5, 5.5.5.10 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 5.5.5.5-6.6.6.6 } } } You can also use this to fetch the existing timeout for specific elements, in case you have a set with timeouts in place: # nft get element w z { 2.2.2.2 } table ip w { set z { type ipv4_addr timeout 30s elements = { 2.2.2.2 expires 17s } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: extend nft to list object handle and delete objects via handleHarsha Sharma2018-03-051-0/+5
| | | | | | | | | | | Print handle attributes in objects when listing via '-a' option and delete objects via their unique object handles. For e.g. nft delete [<object-type>] [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: print table handle with --echo --handlePablo Neira Ayuso2018-03-051-1/+6
| | | | | | | # nft --echo --handle add table x add table ip x # handle 80 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: list set handle and delete set via set handleHarsha Sharma2018-03-051-0/+4
| | | | | | | | | | | Print 'handle' attribute in sets when listing via '-a' option and delete sets via their unique set handles listed with '-a' option. For e.g. nft delete set [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: print 'handle' attribute in tablesHarsha Sharma2018-03-051-1/+5
| | | | | | | | | | | | | | | | | | | | | | | Print 'handle' attribute in tables, when listing via '-a' option For eg. nft list ruleset -a table ip test-ip4 { chain input { ip saddr 8.8.8.8 counter packets 0 bytes 0 # handle 3 } # handle 1} table ip filter { chain output { tcp dport ssh counter packets 0 bytes 0 # handle 4 } # handle 2} table ip xyz { # handle 3} Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: delete flowtablePablo Neira Ayuso2018-03-051-0/+18
| | | | | | | | This patch allows you to delete an existing flowtable: # nft delete flowtable x m Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support to add flowtablesPablo Neira Ayuso2018-03-051-0/+58
| | | | | | | | | | | | | | | | | This patch allows you to create flowtable: # nft add table x # nft add flowtable x m { hook ingress priority 10\; devices = { eth0, wlan0 }\; } You have to specify hook and priority. So far, only the ingress hook is supported. The priority represents where this flowtable is placed in the ingress hook, which is registered to the devices that the user specifies. You can also use the 'create' command instead to bail out in case that there is an existing flowtable with this name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for flowtable listingPablo Neira Ayuso2018-03-051-0/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to dump existing flowtable. # nft list ruleset table ip x { flowtable x { hook ingress priority 10 devices = { eth0, tap0 } } } You can also list existing flowtables via: # nft list flowtables table ip x { flowtable x { hook ingress priority 10 devices = { eth0, tap0 } } } You need a Linux kernel >= 4.16-rc to test this new feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use snprintf() over strncpy()Harsha Sharma2018-03-031-2/+2
| | | | | | | Use snprintf() over strncpy() functions as the buffer is not null terminated in strncpy(). Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
* netlink: remove non-batching routinesPablo Neira Ayuso2018-03-031-308/+23
| | | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: Complain if setting O_NONBLOCK failsPhil Sutter2018-03-021-1/+2
| | | | | | | | | Assuming that code is not aware that reads from netlink socket may block, treat inability to set O_NONBLOCK flag as fatal initialization error aborting program execution. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make JSON/XML output respect output_fpPhil Sutter2018-02-281-19/+18
| | | | | | | | | | | | Make sure events callbacks print to output_ctx-defined stream for any type of output format. Since all of them use nft_print() as last call (if anything is printed at all), the final call to fflush() in netlink_events_cb() can be dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make trace events respect output_fpPhil Sutter2018-02-281-17/+21
| | | | | | | | Seems like this was incompletely converted, part of the output went to output_fp already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass family to payload_dependency_kill()Pablo Neira Ayuso2018-02-151-1/+1
| | | | | | | | | This context information is very relevant when deciding if a redundant dependency needs to be removed or not, specifically for the inet, bridge and netdev families. This new parameter is used by follow up patch entitled ("payload: add payload_may_dependency_kill()"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'auto-merge' option to setsPablo Neira Ayuso2018-01-221-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After discussions with Karel here: https://bugzilla.netfilter.org/show_bug.cgi?id=1184 And later on with Phil Sutter, we decided to disable the automatic merge feature in sets with intervals. This feature is problematic because it introduces an inconsistency between what we add and what we later on get. This is going to get worse with the upcoming timeout support for intervals. Therefore, we turned off this by default. However, Jeff Kletsky and folks like this feature, so let's restore this behaviour on demand with this new 'auto-merge' statement, that you can place on the set definition, eg. # nft list ruleset table ip x { ... set y { type ipv4_addr flags interval auto-merge } } # nft add element x z { 1.1.1.1-2.2.2.2, 1.1.1.2 } Regarding implementation details: Given this feature only makes sense from userspace, let's store this in the set user data area, so nft knows it has to do automatic merge of adjacent/overlapping elements as per user request. # nft add set x z { type ipv4_addr\; auto-merge\; } Error: auto-merge only works with interval sets add set x z { type ipv4_addr; auto-merge; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1216 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add import command for low level jsonShyam Saini2018-01-171-0/+285
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This new operation allows to import low level virtual machine ruleset in json to make incremental changes using the parse functions of libnftnl. A basic way to test this new functionality is: $ cat file.json | nft import vm json where the file.json is a ruleset exported in low level json format. To export json rules in low level virtual machine format we need to specify "vm" token before json. See below $ nft export vm json and $ nft export/import json will do no operations. Same goes with "$nft monitor" Highly based on work from Alvaro Neira <alvaroneay@gmail.com> and Arturo Borrero <arturo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh nf_tables.h cached copyPablo Neira Ayuso2018-01-081-1/+1
| | | | | | Refresh it to fetch what we have in 4.15-rc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix protocol context update on big-endian systemsPhil Sutter2017-12-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an obscure bug on big-endian systems when trying to list a rule containing the expression 'ct helper tftp' which triggers the assert() call in mpz_get_type(). Florian identified the cause: ct_expr_pctx_update() is called for the relational expression which calls mpz_get_uint32() to get RHS value (assuming it is a protocol number). On big-endian systems, the misinterpreted value exceeds UINT_MAX. Expressions' pctx_update() callback should only be called for protocol matches, so ct_meta_common_postprocess() lacked a check for 'left->flags & EXPR_F_PROTOCOL' like the one already present in payload_expr_pctx_update(). In order to fix this in a clean way, this patch introduces a wrapper relational_expr_pctx_update() to be used instead of directly calling LHS's pctx_update() callback which unifies the necessary checks (and adds one more assert): - assert(expr->ops->type == EXPR_RELATIONAL) -> This is new, just to ensure the wrapper is called properly. - assert(expr->op == OP_EQ) -> This was moved from {ct,meta,payload}_expr_pctx_update(). - left->ops->pctx_update != NULL -> This was taken from expr_evaluate_relational(), a necessary requirement for the introduced wrapper to function at all. - (left->flags & EXPR_F_PROTOCOL) != 0 -> The crucial missing check which led to the problem. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Eliminate struct mnl_ctxPhil Sutter2017-11-161-26/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The issue leading to this patch was that debug output in nft_mnl_talk() bypasses the application-defined output_fp. While investigating, another problem was discovered: Most of the ad-hoc defined mnl_ctx objects have their field 'debug_mask' set to zero regardless of what netlink_ctx contains (this affects non-batch code path only). The intuitive solution to both of those issues required to extend function parameters of all the non-batch functions as well as the common nft_mnl_talk() one. Instead of complicating them even further, this patch instead makes them accept a pointer to netlink_ctx as first parameter to gather both the old (nf_sock, seqnum) and the new values (debug_mask, octx) from. Since after the above change struct mnl_ctx was not really used anymore, so the remaining places were adjusted as well to allow for removing the struct altogether. Note that cache routines needed special treatment: Although parameters of cache_update() make it a candidate for the same change, it can't be converted since it is called in evaluation phase sometimes in which there is no netlink context available (but just eval context instead). Since netlink_genid_get() needs a netlink context though, the ad-hoc netlink_ctx definition from cache_init() is moved into cache_update() to have it available there already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Get rid of explicit cache flushesPhil Sutter2017-10-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the past, CLI as a potentially long running process had to make sure it kept it's cache up to date with kernel's rule set. A simple test case is this: | shell a | shell b | | # nft -i | # nft add table ip t | | | nft> list ruleset | | table ip t { | | } | # nft flush ruleset | | | nft> list ruleset | | nft> In order to make sure interactive CLI wouldn't incorrectly list the table again in the second 'list' command, it immediately flushed it's cache after every command execution. This patch eliminates the need for that by making cache updates depend on kernel's generation ID: A cache update stores the current rule set's ID in struct nft_cache, consecutive calls to cache_update() compare that stored value to the current generation ID received from kernel - if the stored value is zero (i.e. no previous cache update did happen) or if it doesn't match the kernel's value (i.e. cache is outdated) the cache is flushed and fully initialized again. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ prefix to everything exposed through include/nftables/nftables.hPablo Neira Ayuso2017-10-241-7/+7
| | | | | | | | Prepend nft_ prefix before these are exposed, reduce chances we hit symbol namespace pollution problems when mixing libnftables with other existing libraries. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use nftnl_expr_fprintf() in netlink_dump_expr()Phil Sutter2017-10-171-4/+2
| | | | | | | This gets rid of the temporary buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix element addition to map with stateful objectPablo Neira Ayuso2017-10-171-3/+8
| | | | | | | | | | | | | | | Expressions with EXPR_F_INTERVAL_END flag set on have no right hand side, so they store no stateful object. Skip them so we don't crash on this. # nft add map x testmap { type inet_service: counter\; flags interval\;} # nft add counter x testcounter # nft add element x testmap { 0-100 : "testcounter" } Segmentation fault This patch also fixes the listing codepath. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1190 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of printfPhil Sutter2017-09-291-62/+64
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec_print: Pass output FILE pointer to netlink_dump_expr()Phil Sutter2017-09-291-2/+3
| | | | | | | | | | It was a bit odd that erec_print() outputs to a given FILE pointer but then calls netlink_dump_expr() which just prints to stdout. Fix this by passing the given FILE pointer along so output is guaranteed to go to the same destination. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: store expression as set key instead of data typeFlorian Westphal2017-09-271-12/+15
| | | | | | | | | | | | Doing so retains legth information in case of unqualified data types, e.g. we now have 'meta iifname' expression instead of an (unqualified) string type. This allows to eventually use iifnames as set keys without adding yet another special data type for them. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object support for limitPablo M. Bermudo Garay2017-09-041-0/+19
| | | | | | | | This patch adds support for a new type of stateful object: limit. Creation, deletion and listing operations are supported. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove nfsock_open()Pablo Neira Ayuso2017-09-011-11/+5
| | | | | | Just merge this code to netlink_open_sock(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add debugging mask to context structurePablo Neira Ayuso2017-08-231-33/+39
| | | | | | | So this toggle is not global anymore. Update name that fits better with the semantics of this variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove ifdef DEBUG pollutionPablo Neira Ayuso2017-08-231-14/+0
| | | | | | | | | | | | | | | Get rid of lots of ifdef DEBUG pollution in the code. The --debug= option is useful to get feedback from users, so it should be always there. And we really save nothing from keeping this code away from the control plane with a compile time option. Just running tests/shell/ before and after this patch, time shows almost no difference. So this patch leaves --enable-debug around to add debugging symbols in your builds, this is left set on by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove unused functions.Varsha Rao2017-08-171-104/+0
| | | | | | | | | | Remove netlink_add_rule_list(), netlink_dump_table(), netlink_get_chain(), netlink_get_set(), netlink_get_table(), netlink_list_chain() functions definitions as they are not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make netlink sequence number non-staticPablo Neira Ayuso2017-08-151-26/+28
| | | | | | | | | | | | Place sequence number that is allocated per-command on the struct netlink_ctx structure. This is allocated from nft_run() to correlate commands with netlink messages for error reporting. Batch support probing also shares this sequence numbers with commands. There is an inpendent cache sequence number though, this routine is called from a different path, usually from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* echo: Fix for added delays in rule updatesPhil Sutter2017-08-151-1/+10
| | | | | | | | | | | | | | | | The added cache update upon every command dealing with rules was a bummer. Instead, perform the needed cache update only if echo option was set. Initially, I tried to perform the cache update from within netlink_echo_callback(), but that turned into a mess since the shared socket between cache_init() and mnl_batch_talk() would receive unexpected new input. So instead update the cache from do_command_add(), netlink_replace_rule_batch() and do_comand_insert() so it completes before mnl_batch_talk() starts listening. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>