summaryrefslogtreecommitdiffstats
path: root/src/parser_bison.y
Commit message (Collapse)AuthorAgeFilesLines
* src: add notrack supportPablo Neira Ayuso2016-11-141-0/+6
| | | | | | | This patch adds the notrack statement, to skip connection tracking for certain packets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add offset attribute for hash expressionLaura Garcia Liebana2016-11-091-4/+4
| | | | | | | | | | | Add support to add an offset to the hash generator, eg. ct mark set hash ip saddr mod 10 offset 100 This will generate marks with series between 100-109. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make hash seed attribute optionalLaura Garcia Liebana2016-11-091-0/+5
| | | | | | | | | | | | | | | | | | The hash expression requires a seed attribute to call the jhash operation, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef With this patch the seed attribute is optional and it's generated by a random function from userspace, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 The kernel will take care of generate a random seed. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: rename the log level "warning" to "warn"Liping Zhang2016-10-311-1/+1
| | | | | | | | | This is to keep compatibility. The original keyword in grammer is "warn" instead of "warning". Fixes: 0423caa91ad2 ("src: don't need keyword for log level") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: fix "ct l3proto/protocol" syntax brokenLiping Zhang2016-10-301-1/+3
| | | | | | | | | | | | | | | "l3proto" and "protocol" are still keywords in our grammer, they are not STRING, so if the user input the following rule, nft will complain that the syntax is error: # nft add t c ct l3proto ipv4 <cmdline>:1:12-18: Error: syntax error, unexpected l3proto, expecting string or mark or packets or bytes add t c ct l3proto ipv4 ^^^^^^^ Fixes: c992153402c7 ("ct: allow resolving ct keys at run time") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add fib expressionFlorian Westphal2016-10-281-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the 'fib' expression which can be used to obtain the output interface from the route table based on either source or destination address of a packet. This can be used to e.g. add reverse path filtering: # drop if not coming from the same interface packet # arrived on # nft add rule x prerouting fib saddr . iif oif eq 0 drop # accept only if from eth0 # nft add rule x prerouting fib saddr . iif oif eq "eth0" accept # accept if from any valid interface # nft add rule x prerouting fib saddr oif accept Querying of address type is also supported. This can be used to e.g. only accept packets to addresses configured in the same interface: # fib daddr . iif type local Its also possible to use mark and verdict map, e.g.: # nft add rule x prerouting meta mark set 0xdead fib daddr . mark type vmap { blackhole : drop, prohibit : drop, unicast : accept } Signed-off-by: Florian Westphal <fw@strlen.de>
* rt: introduce routing expressionAnders K. Pedersen2016-10-281-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce rt expression for routing related data with support for nexthop (i.e. the directly connected IP address that an outgoing packet is sent to), which can be used either for matching or accounting, eg. # nft add rule filter postrouting \ ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1. # nft add rule filter postrouting \ flow table acct { rt nexthop timeout 600s counter } # nft add rule ip6 filter postrouting \ flow table acct { rt nexthop timeout 600s counter } These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic is seen for this nexthop within 10 minutes. # nft add rule inet filter postrouting \ ether type ip \ flow table acct { rt nexthop timeout 600s counter } # nft add rule inet filter postrouting \ ether type ip6 \ flow table acct { rt nexthop timeout 600s counter } Same as above, but via the inet family, where the ether type must be specified explicitly. "rt classid" is also implemented identical to "meta rtclassid", since it is more logical to have this match in the routing expression going forward. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: allow resolving meta keys at run timeFlorian Westphal2016-10-271-5/+26
| | | | | | | | | use the meta template to translate the textual token to the enum value. This allows to remove two keywords from the scanner and also means we do not need to introduce new keywords when more meta keys get added. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: allow resolving ct keys at run timeFlorian Westphal2016-10-271-9/+27
| | | | | | | ... and remove those keywords we no longer need. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add offset keyword and parser rulePablo Neira Ayuso2016-10-271-1/+6
| | | | | | This is required by the numgen and jhash expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add offset attribute for numgen expressionLaura Garcia Liebana2016-10-271-2/+2
| | | | | | | | | | | | | Add support to add an offset to the numgen generated value. Example: ct mark set numgen inc mod 2 offset 100 This will generate marks with serie like 100, 101, 100, ... Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't need keyword for log levelPablo Neira Ayuso2016-10-211-8/+24
| | | | | | | We can handle log levels without keywords in our grammar, use string instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow to use variable to add/create/delete elementsPablo Neira Ayuso2016-10-211-3/+3
| | | | | | | | | | | | | | | | | | | | | | | Using variable definitions from element command doesn't work, eg. -test.nft- define whitelist_v4 = { 1.1.1.1 } table inet filter { set whitelist_v4 { type ipv4_addr; } } add element inet filter whitelist_v4 $whitelist_v4 -EOF- # nft -f test.nft test.nft:7:38-38: Error: syntax error, unexpected '$', expecting '{' add element inet filter whitelist_v4 $whitelist_v4 ^ Fix this by using set_block_expr rule for every element command. This patch also comes with a new regression test. Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support ct l3proto/protocol without direction syntaxLiping Zhang2016-10-171-0/+2
| | | | | | | | | | | | | | | Acctually, ct l3proto and ct protocol are unrelated to direction, so it's unnecessary that we must specify dir if we want to use them. Now add support that we can match ct l3proto/protocol without direction: # nft add rule filter input ct l3proto ipv4 # nft add rule filter output ct protocol 17 Note: existing syntax is still preserved, so "ct reply l3proto ipv6" is still fine. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow variable references in set elements definitionPablo Neira Ayuso2016-08-291-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Andreas reports that he cannot use variables in set definitions: define s-ext-2-int = 10.10.10.10 . 25, 10.10.10.10 . 143 set s-ext-2-int { type ipv4_addr . inet_service elements = { $s-ext-2-int } } This syntax is not correct though, since the curly braces should be placed in the variable definition itself, so we have context to handle this variable as a list of set elements. The correct syntax that works after this patch is: define s-ext-2-int = { 10.10.10.10 . 25, 10.10.10.10 . 143 } table inet forward { set s-ext-2-int { type ipv4_addr . inet_service elements = $s-ext-2-int } } Reported-by: Andreas Hainke <andreas.hainke@foteviken.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: add variable_expr rulePablo Neira Ayuso2016-08-291-10/+13
| | | | | | | This patch adds a rule for variable expression so we can reuse it in a follow up patch to allow set element initialization from variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add hash expressionPablo Neira Ayuso2016-08-291-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is special expression that transforms an input expression into a 32-bit unsigned integer. This expression takes a modulus parameter to scale the result and the random seed so the hash result becomes harder to predict. You can use it to set the packet mark, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 seed 0xdeadbeef You can combine this with maps too, eg. # nft add rule x y dnat to jhash ip saddr mod 2 seed 0xdeadbeef map { \ 0 : 192.168.20.100, \ 1 : 192.168.30.100 \ } Currently, this expression implements the jenkins hash implementation available in the Linux kernel: http://lxr.free-electrons.com/source/include/linux/jhash.h But it should be possible to extend it to support any other hash function type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add numgen expressionPablo Neira Ayuso2016-08-291-3/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new expression allows us to generate incremental and random numbers bound to a specified modulus value. The following rule sets the conntrack mark of 0 to the first packet seen, then 1 to second packet, then 0 again to the third packet and so on: # nft add rule x y ct mark set numgen inc mod 2 A more useful example is a simple load balancing scenario, where you can also use maps to set the destination NAT address based on this new numgen expression: # nft add rule nat prerouting \ dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 } So this is distributing new connections in a round-robin fashion between 192.168.10.100 and 192.168.20.200. Don't forget the special NAT chain semantics: Only the first packet evaluates the rule, follow up packets rely on conntrack to apply the NAT information. You can also emulate flow distribution with different backend weights using intervals: # nft add rule nat prerouting \ dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 } So 192.168.10.100 gets 60% of the workload, while 192.168.20.200 gets 40%. We can also be mixed with dynamic sets, thus weight can be updated in runtime. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add quota statementPablo Neira Ayuso2016-08-291-5/+33
| | | | | | | | | | | | | This new statement is stateful, so it can be used from flow tables, eg. # nft add rule filter input \ flow table http { ip saddr timeout 60s quota over 50 mbytes } drop This basically sets a quota per source IP address of 50 mbytes after which packets are dropped. Note that the timeout releases the entry if no traffic is seen from this IP after 60 seconds. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: create element commandPablo Neira Ayuso2016-08-251-0/+4
| | | | | | | | | | | | | | | This patch adds the create command, that send the NLM_F_EXCL flag so nf_tables bails out if the element already exists, eg. # nft add element x y { 1.1.1.1 } # nft create element x y { 1.1.1.1 } <cmdline>:1:1-31: Error: Could not process rule: File exists create element x y { 1.1.1.1 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ This update requires nf_tables kernel patches to honor the NLM_F_EXCL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add create set commandPablo Neira Ayuso2016-08-241-0/+14
| | | | | | | | | | | | | | | | | | | | | | Add support for the 'create' command, we already support this in other existing objects, so support this for sets too, eg. # nft add set x y { type ipv4_addr\; } # nft create set x y { type ipv4_addr\; } <cmdline>:1:1-35: Error: Could not process rule: File exists create set x y { type ipv4_addr; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # nft add set x y { type ipv4_addr\; } # This command sets the NLM_F_EXCL netlink flag, so if the object already exists, nf_tables returns -EEXIST. This is changing the existing behaviour of 'nft add set' which was setting this flag, this is inconsistent with regards to the way other objects behave. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: explicit indication on export rulesetPablo Neira Ayuso2016-08-231-1/+7
| | | | | | | | | | | | | | | This patch modifies the grammar to explicitly indicate what you want to export, eg. # nft export ruleset json This leaves room to extend this later on to support other object types, such as integrating conntrack into nft. This also leaves the syntax in consistent state wrt. other existing objects. The existing syntax is still preserved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Simplify parser rule_spec treeCarlos Falgueras García2016-08-231-22/+21
| | | | | | | | | | This patch separates the rule identification from the rule localization, so the logic moves from the evaluator to the parser. This allows to revert the patch "evaluate: improve rule managment checks" (4176c7d30c2ff1b3f52468fc9c08b8df83f979a8) and saves a lot of code. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: keep snat/dnat existing syntax unchangedLiping Zhang2016-08-221-1/+14
| | | | | | | | | | | | | | | | | | | We should keep existing syntax unchanged, and this was emphasized in the commit 850f0a56b6ad ("src: add 'to' for snat and dnat")'s commit log: "Existing syntax is still preserved, but the listing shows the one including 'to'." This problem was found by running shell test: # ./run-tests.sh [ ... ] W: [FAILED] ./testcases/maps/anonymous_snat_map_0 I: [OK] ./testcases/maps/map_with_flags_0 W: [FAILED] ./testcases/maps/named_snat_map_0 [ ... ] Fixes: 850f0a56b6ad ("src: add 'to' for snat and dnat") Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: redirect to :port for consistency with nat/masq statementPablo Neira Ayuso2016-08-181-0/+9
| | | | | | | Use the colon port syntax for consistency with other statements. Existing syntax is still preserved but the output displays the colon. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing token string in QUOTED_ASTERISK and ASTERISK_STRINGPablo Neira Ayuso2016-08-181-2/+2
| | | | | | | | <cmdline>:1:24-24: Error: syntax error, unexpected newline, expecting string or QUOTED_STRING or ASTERISK_STRING add rule x y log prefix ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'to' for snat and dnatPablo Neira Ayuso2016-08-181-7/+7
| | | | | | | | | | | This is extra syntaxtic sugar to get this consistent with other statements such as redirect, masquerade, dup and fwd that indicates where to go. Existing syntax is still preserved, but the listing shows the one including 'to'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: keep map flag around when flags are specifiedPablo Neira Ayuso2016-07-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | If you add a map with timeouts, eg. # nft add table x # nft add map x y { type ipv4_addr : ipv4_addr\; flags timeout\; } The listing shows a set instead of a map: # nft list ruleset table ip x { set y { type ipv4_addr flags timeout } } This patch fixes the parser to keep the map flag around when timeout flag (or any other flags) are specified. This patch also comes with a regression test. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add random supportFlorian Westphal2016-07-191-0/+1
| | | | | | | | | | | | | "meta random" fills a register with a 32bit pseudo-random number. For instance one can now use meta random <= 2147483647 ... to match every 2nd packet on average. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: fix typo in symbol redefinition error reportingPablo Neira Ayuso2016-07-131-1/+1
| | | | | | "redefinition" instead of "redfinition". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: restore parsing of dynamic set element updatesPablo Neira Ayuso2016-07-121-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new set_elem_expr_stmt production to handle dynamic set element updates from rules. Quickly tested this here through: # nft add table filter # nft add chain filter input { type filter hook input priority 0\; } # nft add set filter myset { type inet_service\; flags timeout\; } # nft add rule filter input set add tcp sport timeout 60s @myset # nft list ruleset table ip filter { set myset { type inet_service flags timeout elements = { http expires 9s} } chain input { type filter hook input priority 0; policy accept; set add tcp dport timeout 1m @myset } } Fixes: a3e60492a684 ("parser: restrict relational rhs expression recursion") Reported-by: Anders K. Pedersen <akp@akp.dk> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for display maps contentPablo M. Bermudo Garay2016-05-311-0/+4
| | | | | | | | | | | | | | | | | | | | | | | This commit adds a new command that displays the definition of a single map: # nft list map [family] <table> <map> If no family is specified, ip is assumed. Example: # nft list map ip6 filter test table ip6 filter { map test { type ipv6_addr : inet_service elements = { 2001:db8::ff00:42:8329 : http} } } Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'list maps' supportPablo M. Bermudo Garay2016-05-311-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new command that lists maps: # nft list maps [family] Only the declaration is displayed. If no family is specified, all maps of all families are listed. Example: # nft list maps table ip filter { map test { type ipv4_addr : inet_service } } table ip6 filter { map test { type ipv6_addr : inet_service } } Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: cap comment length to 128 bytesCarlos Falgueras García2016-05-301-0/+5
| | | | | | | | | | | | | | | | | | | Pablo rewrites this description to: "The user data area available is 256 bytes (NFT_USERDATA_MAXLEN). We plan to allow storing other useful information such as datatypes in set elements, so make sure there is room for this." Example: > nft add table t > nft add chain t c > nft add rule t c ip saddr 1.1.1.1 counter comment "abc...xyz" # len > 128 <cmdline>:1:47-N: Error: Comment too long. 128 characters maximum allowed add rule t c ip saddr 1.1.1.1 counter comment abc...xyz ^^^^^^^^^ Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Consolidate comment productionCarlos Falgueras García2016-05-301-10/+15
| | | | | | | Use comment_spec both from rule and set element productions. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix crash if we add a chain with an error chain typeLiping Zhang2016-05-301-2/+4
| | | | | | | | | | | | | If we add a chain and specify the nonexistent chain type, chain_type_name_lookup will return a NULL pointer, and meet the assert condition in xstrdup. Fix crash like this: # nft add chain filter input {type none hook input priority 0\;} nft: utils.c:63: xstrdup: Assertion `s != ((void *)0)' failed. Aborted (core dumped) Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add support for display flow tables contentPablo M. Bermudo Garay2016-05-201-0/+4
| | | | | | | | | | This commit adds a new command that displays the definition of a single flow table: If no family is specified, ip is assumed. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add 'list flow tables' supportPablo M. Bermudo Garay2016-05-201-0/+4
| | | | | | | | | | | | This commit adds a new command that lists flow tables: # nft list flow tables [family] Only the declaration is displayed. If no family is specified, all flow tables of all families are listed. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: update flow table syntaxPablo Neira Ayuso2016-05-131-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before we release next nft version, update the syntax to wrap the flow table definition between brackets, eg. # nft add rule filter input tcp dport 22 ct state new \ flow table ssh { ip saddr limit rate 10/second } # nft add rule filter input \ flow table acct { iif . ip saddr timeout 60s counter } When playing around with this in your initial patchset I found very confusing that it may not look obvious to users that they can only use one single statement. For example: # nft add rule filter input \ flow table acct iif . ip saddr timeout 60s counter limit rate 10/second ~~~~~~~~~~~~~~~~~~~~ Note that this limit rate applies globally, so this patch resolves this ambiguity. This may cause us problems in the future too if we extend this to support more than one single statement per flowtable entry (Not telling we need this now, but if someone comes up with a useful usecase, we should be capable of extending this). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flow statementPatrick McHardy2016-05-131-0/+57
| | | | | | | | | | | | | | | The flow statement allows to instantiate per flow statements for user defined flows. This can so far be used for per flow accounting or limiting, similar to what the iptables hashlimit provides. Flows can be aged using the timeout option. Examples: # nft filter input flow ip saddr . tcp dport limit rate 10/second # nft filter input flow table acct iif . ip saddr timeout 60s counter Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ecn supportPablo Neira Ayuso2016-05-111-0/+10
| | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule ip filter forward ip ecn ce counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000003 ] [ counter pkts 0 bytes 0 ] For IPv6: # nft --debug=netlink add rule ip6 filter forward ip6 ecn ce counter ip6 filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000030 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000030 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dscp supportPablo Neira Ayuso2016-05-111-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: evaluate: Show error for fanout without balanceShivani Bhardwaj2016-04-131-0/+1
| | | | | | | | | | | | | | | | | | | | The idea of fanout option is to improve the performance by indexing CPU ID to map packets to the queues. This is used for load balancing. Fanout option is not required when there is a single queue specified. According to iptables, queue balance should be specified in order to use fanout. Following that, throw an error in nftables if the range of queues for load balancing is not specified with the fanout option. After this patch, $ sudo nft add rule ip filter forward counter queue num 0 fanout <cmdline>:1:46-46: Error: fanout requires a range to be specified add rule ip filter forward counter queue num 0 fanout ^^^^^ Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: store parser location for handle and position specifiersPablo Neira Ayuso2016-03-301-5/+14
| | | | | | | | | Store the parser location structure for handle and position IDs so we can use this information from the evaluation step, to provide better error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* parser_bison: release parsed type and hook name stringsPablo Neira Ayuso2016-03-151-0/+4
| | | | | | | | | | | | | | | | The scanner allocates memory for this, so release them given that we don't attach them to any object. ==6277== 42 bytes in 6 blocks are definitely lost in loss record 2 of 4 ==6277== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==6277== by 0x57AC9D9: strdup (strdup.c:42) ==6277== by 0x41B82D: xstrdup (utils.c:64) ==6277== by 0x41F510: nft_lex (scanner.l:511) ==6277== by 0x427FD1: nft_parse (parser_bison.c:3690) ==6277== by 0x4063AC: nft_run (main.c:231) ==6277== by 0x40600C: main (main.c:361) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: duplicate string returned by chain_type_name_lookup()Pablo Neira Ayuso2016-03-151-1/+1
| | | | | | | | | This chain type string is released via chain_free() since b7cb6915a88f, so duplicate it so we don't try to release statically allocated memory. Fixes: b7cb6915a88f ("rule: Remove memory leak") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: simplify hook_spec rulePablo Neira Ayuso2016-03-151-51/+15
| | | | | | | Consolidate this rule by introducing the dev_spec and prio_spec, we save 50 LOC with this patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow 'snat' and 'dnat' keywords from the right-hand sidePablo Neira Ayuso2016-03-091-0/+12
| | | | | | | | | | Parse 'snat' and 'dnat' reserved keywords from the right-hand side as symbols. Thus, we can use them as values from ct status. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=950 Reported-by: Ana Rey <anarey@gmail.com> Reported-by: Karol Babioch <karol@babioch.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: remove 'reset' as reserve keywordPablo Neira Ayuso2016-03-071-3/+8
| | | | | | | | | The 'reset' keyword can be used as dccp type, so don't qualify it as reserve keyword to avoid a conflict with this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1055 Reported-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for masquerade port selectionShivani Bhardwaj2016-03-031-6/+17
| | | | | | | | | Provide full support for masquerading by allowing port range selection, eg. # nft add rule nat postrouting ip protocol tcp masquerade to :1024-10024 Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>