summaryrefslogtreecommitdiffstats
path: root/src/payload.c
Commit message (Collapse)AuthorAgeFilesLines
* payload: do not remove icmp echo dependencyFlorian Westphal2021-06-171-24/+37
| | | | | | | | | | | "icmp type echo-request icmp id 2" and "icmp id 2" are not the same, the latter gains an implicit dependency on both echo-request and echo-reply. Change payload dependency tracking to not store dependency in case the value type is ICMP(6)_ECHO(REPLY). Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: be careful on vlan dependency removalFlorian Westphal2021-04-031-3/+26
| | | | | | | 'vlan ...' implies 8021Q frame. In case the expression tests something else (802.1AD for example) its not an implictly added one, so keep it. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: check icmp dependency before removing previous icmp expressionFlorian Westphal2021-02-021-21/+42
| | | | | | | | | | | | | | | nft is too greedy when removing icmp dependencies. 'icmp code 1 type 2' did remove the type when printing. Be more careful and check that the icmp type dependency of the candidate expression (earlier icmp payload expression) has the same type dependency as the new expression. Reported-by: Eric Garver <eric@garver.life> Reported-by: Michael Biebl <biebl@debian.org> Tested-by: Eric Garver <eric@garver.life> Fixes: d0f3b9eaab8d77e ("payload: auto-remove simple icmp/icmpv6 dependency expressions") Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: auto-remove simple icmp/icmpv6 dependency expressionsFlorian Westphal2020-12-091-3/+47
| | | | | | | | | | | | Instead of: icmpv6 type packet-too-big icmpv6 mtu 1280 display just icmpv6 mtu 1280 The dependency added for id/sequence is still kept, its handled by a anon set instead to cover both the echo 'request' and 'reply' cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add auto-dependencies for ipv6 icmp6Florian Westphal2020-12-091-0/+33
| | | | | | Extend the earlier commit to also cover icmpv6. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add auto-dependencies for ipv4 icmpFlorian Westphal2020-12-091-1/+128
| | | | | | | | | | | | | | The ICMP header has field values that are only exist for certain types. Mark the icmp proto 'type' field as a nextheader field and add a new th description to store the icmp type dependency. This can later be re-used for other protocol dependend definitions such as mptcp options -- which are all share the same tcp option number and have a special 4 bit marker inside the mptcp option space that tells how the remaining option looks like. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Support odd-sized payload matchesPhil Sutter2020-11-041-0/+5
| | | | | | | | | | | | When expanding a payload match, don't disregard oversized templates at the right offset. A more flexible user may extract less bytes from the packet if only parts of a field are interesting, e.g. only the prefix of source/destination address. Support that by using the template, but fix the length. Later when creating a relational expression for it, detect the unusually small payload expression length and turn the RHS value into a prefix expression. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: context tracking for multiple transport protocolsPablo Neira Ayuso2020-09-151-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch extends the protocol context infrastructure to track multiple transport protocols when they are specified from sets. This removes errors like: "transport protocol mapping is only valid after transport protocol match" when invoking: # nft add rule x z meta l4proto { tcp, udp } dnat to 1.1.1.1:80 This patch also catches conflicts like: # nft add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 Error: conflicting protocols specified: udp vs. tcp add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 ^^^^^^^^^ and: # nft add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 Error: conflicting protocols specified: udp vs. tcp add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 ^^^^^^^^^ Note that: - the singleton protocol context tracker is left in place until the existing users are updated to use this new multiprotocol tracker. Moving forward, it would be good to consolidate things around this new multiprotocol context tracker infrastructure. - link and network layers are not updated to use this infrastructure yet. The code that deals with vlan conflicts relies on forcing protocol context updates to the singleton protocol base. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add "typeof" build/parse/print supportFlorian Westphal2019-12-171-0/+75
| | | | | | | | | | | | | | | | | | | | This patch adds two new expression operations to build and to parse the userdata area that describe the set key and data typeof definitions. For maps, the grammar enforces either "type data_type : data_type" or or "typeof expression : expression". Check both key and data for valid user typeof info first. If they check out, flag set->key_typeof_valid as true and use it for printing the key info. This patch comes with initial support for using payload expressions with the 'typeof' keyword, followup patches will add support for other expressions as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Fix dumping vlan rulesM. Braun2019-07-311-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Given the following bridge rules: 1. ip protocol icmp accept 2. ether type vlan vlan type ip ip protocol icmp accept The are currently both dumped by "nft list ruleset" as 1. ip protocol icmp accept 2. ip protocol icmp accept Though, the netlink code actually is different bridge filter FORWARD 4 [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ immediate reg 0 accept ] bridge filter FORWARD 5 4 [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000081 ] [ payload load 2b @ link header + 16 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000001 ] [ immediate reg 0 accept ] What happens here is that: 1. vlan type ip kills ether type vlan 2. ip protocol icmp kills vlan type ip Fix this by avoiding the removal of all vlan statements in the given example. Signed-off-by: Michael Braun <michael-dev@fami-braun.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: add pseudo th protocol to match d/sport in generic wayFlorian Westphal2019-07-151-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: Its not possible to easily match both udp and tcp in a single rule. ... input ip protocol { tcp,udp } dport 53 will not work, as bison expects "tcp dport" or "sctp dport", or any other transport protocol name. Its possible to match the sport and dport via raw payload expressions, e.g.: ... input ip protocol { tcp,udp } @th,16,16 53 but its not very readable. Furthermore, its not possible to use this for set definitions: table inet filter { set myset { type ipv4_addr . inet_proto . inet_service } chain forward { type filter hook forward priority filter; policy accept; ip daddr . ip protocol . @th,0,16 @myset } } # nft -f test test:7:26-35: Error: can not use variable sized data types (integer) in concat expressions During the netfilter workshop Pablo suggested to add an alias to do raw sport/dport matching more readable, and make it use the inet_service type automatically. So, this change makes @th,0,16 work for the set definition case by setting the data type to inet_service. A new "th s|dport" syntax is provided as readable alternative: ip protocol { tcp, udp } th dport 53 As "th" is an alias for the raw expression, no dependency is generated -- its the users responsibility to add a suitable test to select the l4 header types that should be matched. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: add support for matching IPv4 optionsStephen Suryaputra2019-07-041-0/+4
| | | | | | | | | Add capability to have rules matching IPv4 options. This is developed mainly to support dropping of IP packets with loose and/or strict source route route options. Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: prefer meta protocol as bridge l3 dependencyFlorian Westphal2019-06-191-0/+18
| | | | | | | | | | | | | | | | | | | On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: missing destroy function in statement definitionsPablo Neira Ayuso2019-04-051-0/+7
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: remove expr_ops from struct exprFlorian Westphal2019-02-081-2/+2
| | | | | | | | size of struct expr changes from 144 to 128 bytes on x86_64. This doesn't look like much, but large rulesets can have tens of thousands of expressions (each set element is represented by an expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: add expression etypeFlorian Westphal2019-02-081-5/+5
| | | | | | | | Temporary kludge to remove all the expr->ops->type == ... patterns. Followup patch will remove expr->ops, and make expr_ops() lookup the correct expr_ops struct instead to reduce struct expr size. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: payload: export and use payload_expr_cmpFlorian Westphal2019-02-081-1/+1
| | | | | | | expr->ops is going away, so export payload cmp and use it directly. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: refine payload expr mergingFlorian Westphal2019-01-111-1/+27
| | | | | | | | | | | | | | | | | | | nf_tables can handle payload exprs for sizes <= sizeof(u32) via a direct operation from the eval loop, rather than a a call to the payload expression. Two loads for four byte quantities are thus faster than a single load for an 8 byte load. ip saddr 1.2.3.4 ip daddr 2.3.4.5 is faster with this applied, even though it involves two payload and two two compare expressions, just because all can be handled from the main loop without any calls to expression ops. Keep merging for linklayer and when at least one of the expressions already exceeded the 4 byte "limit" anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add igmp supportPablo Neira Ayuso2019-01-091-2/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Implement JSON output supportPhil Sutter2018-05-111-0/+3
| | | | | | | | | | | | Although technically there already is support for JSON output via 'nft export json' command, it is hardly useable since it exports all the gory details of nftables VM. Also, libnftables has no control over what is exported since the content comes directly from libnftnl. Instead, implement JSON format support for regular 'nft list' commands. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "payload: don't remove icmp family dependency in special cases"Florian Westphal2018-03-281-9/+0
| | | | | | | | This reverts commit 126706c23c0458b07d54550dc27561b30f8a43f2. As its now ok to use icmp-in-ip6 family we can remove the dependency. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't remove icmp family dependency in special casesFlorian Westphal2018-03-271-0/+9
| | | | | | | | | | | | | | | | | | | | | | | When using nftables to filter icmp-in-ipv6 or icmpv6-in-ipv4 we erronously removed the dependency, i.e. "lis ruleset" shows table ip6 filter { chain output { type filter hook output priority 0; policy accept; icmp type destination-unreachable } } but that won't restore because of ip vs ipv6 conflict. After this patch, this lists as meta l4proto icmp icmp type destination-unreachable instead. We still remove the dependency in "ip" family. Same applies to icmpv6-in-ip. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: make raw payloads workFlorian Westphal2018-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | make syntax consistent between print and parse. No dependency handling -- once you use raw expression, you need to make sure the raw expression only sees the packets that you'd want it to see. based on an earlier patch from Laurent Fasnacht <l@libres.ch>. Laurents patch added a different syntax: @<protocol>,<base>,<data type>,<offset>,<length> data_type is useful to make nftables not err when asking for "@payload,32,32 192.168.0.1", this patch still requires manual convsersion to an integer type (hex or decimal notation). data_type should probably be added later by adding an explicit cast expression, independent of the raw payload syntax. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't resolve expressions using the inet pseudoheaderFlorian Westphal2018-02-261-1/+1
| | | | | | | Else, '@ll,0,8' will be mapped to 'inet nfproto', but thats not correct (inet is a pseudo header). Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: use integer_type when initializing a raw expressionFlorian Westphal2018-02-261-0/+1
| | | | | | | The invalid type prints prominent "[invalid]", so prefer integer type in raw expressions. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't decode past last valid templateFlorian Westphal2018-02-151-0/+4
| | | | | | | | | | | | When trying to decode payload header fields, be sure to bail out when having exhausted all available templates. Otherwise, we allocate invalid payload expressions (no dataype, header length of 0) and then crash when trying to print them. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1226 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Spelling fixesVille Skyttä2018-02-151-2/+2
| | | | | Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload_may_dependency_kill()Pablo Neira Ayuso2018-02-151-2/+29
| | | | | | | | Payload protocol key expressions at network base are meaningful in the netdev, bridge and inet families, do not exercise the redundant dependency removal in those cases since it breaks rule semantics. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of __payload_dependency_kill()Pablo Neira Ayuso2018-02-151-10/+5
| | | | | | Use payload_dependency_release() instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add payload_dependency_exists()Pablo Neira Ayuso2018-02-151-9/+25
| | | | | | | | | | | | | | | This helper function tells us if there is already a protocol key payload expression, ie. those with EXPR_F_PROTOCOL flag set on, that we might want to remove since we can infer from another expression in the upper protocol base, eg. ip protocol tcp tcp dport 22 'ip protocol tcp' can be removed in the ip family since it is redundant, but not in the netdev, bridge and inet families, where we cannot make assumptions on the layer 3 protocol. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload_dependency_release() helper functionPablo Neira Ayuso2018-02-151-9/+13
| | | | | | | Wrap code that releases existing dependencies that we have just annotated in the context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass family to payload_dependency_kill()Pablo Neira Ayuso2018-02-151-6/+8
| | | | | | | | | This context information is very relevant when deciding if a redundant dependency needs to be removed or not, specifically for the inet, bridge and netdev families. This new parameter is used by follow up patch entitled ("payload: add payload_may_dependency_kill()"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix protocol context update on big-endian systemsPhil Sutter2017-12-121-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an obscure bug on big-endian systems when trying to list a rule containing the expression 'ct helper tftp' which triggers the assert() call in mpz_get_type(). Florian identified the cause: ct_expr_pctx_update() is called for the relational expression which calls mpz_get_uint32() to get RHS value (assuming it is a protocol number). On big-endian systems, the misinterpreted value exceeds UINT_MAX. Expressions' pctx_update() callback should only be called for protocol matches, so ct_meta_common_postprocess() lacked a check for 'left->flags & EXPR_F_PROTOCOL' like the one already present in payload_expr_pctx_update(). In order to fix this in a clean way, this patch introduces a wrapper relational_expr_pctx_update() to be used instead of directly calling LHS's pctx_update() callback which unifies the necessary checks (and adds one more assert): - assert(expr->ops->type == EXPR_RELATIONAL) -> This is new, just to ensure the wrapper is called properly. - assert(expr->op == OP_EQ) -> This was moved from {ct,meta,payload}_expr_pctx_update(). - left->ops->pctx_update != NULL -> This was taken from expr_evaluate_relational(), a necessary requirement for the introduced wrapper to function at all. - (left->flags & EXPR_F_PROTOCOL) != 0 -> The crucial missing check which led to the problem. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: get rid of printfPhil Sutter2017-09-291-5/+5
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Pass stateless, numeric, ip2name and handle variables as structure members.Varsha Rao2017-06-181-4/+4
| | | | | | | | | | | | | | | | | libnftables library will be created soon. So declare numeric_output, stateless_output, ip2name_output and handle_output as members of structure output_ctx, instead of global variables. Rename these variables as following, numeric_output -> numeric stateless_output -> stateless ip2name_output -> ip2name handle_output -> handle Also add struct output_ctx *octx as member of struct netlink_ctx. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ip: switch implicit dependencies to meta l4proto tooFlorian Westphal2017-05-191-6/+11
| | | | | | | | | | | | | after ip6 nexthdr also switch ip to meta l4proto instead of ip protocol. While its needed for ipv6 (due to extension headers) this isn't needed for ip but it has the advantage that tcp dport 22 produces same expressions for ip/ip6/inet families. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: enforce ip/ip6 protocol depending on icmp or icmpv6Florian Westphal2017-05-191-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After some discussion with Pablo we agreed to treat icmp/icmpv6 specially. in the case of a rule like 'tcp dport 22' the inet, bridge and netdev families only care about the lower layer protocol. In the icmpv6 case however we'd like to also enforce an ipv6 protocol check (and ipv4 check in icmp case). This extends payload_gen_special_dependency() to consider this. With this patch: add rule $pf filter input meta l4proto icmpv6 add rule $pf filter input meta l4proto icmpv6 icmpv6 type echo-request add rule $pf filter input icmpv6 type echo-request will work in all tables and all families. For inet/bridge/netdev, an ipv6 protocol dependency is added; this will not match ipv4 packets with ip->protocol == icmpv6, EXCEPT in the case of the ip family. Its still possible to match icmpv6-in-ipv4 in inet/bridge/netdev with an explicit dependency: add rule inet f i ip protocol ipv6-icmp meta l4proto ipv6-icmp icmpv6 type ... Implicit dependencies won't get removed at the moment, so bridge ... icmp type echo-request will be shown as ether type ip meta l4proto 1 icmp type echo-request Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ipv6: switch implicit dependencies to meta l4protoFlorian Westphal2017-05-191-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | when using rule like ip6 filter input tcp dport 22 nft generates: [ payload load 1b @ network header + 6 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00001600 ] which is: ip6 filter input ip6 nexthdr tcp dport 22 IOW, such a rule won't match if e.g. a fragment header is in place. This changes ip6_proto to use 'meta l4proto' which is the protocol header found by exthdr walk. A side effect is that for bridge we get a shorter dependency chain as it no longer needs to prepend 'ether proto ipv6' for old 'ip6 nexthdr' dep. Only problem: ip6 nexthdr tcp tcp dport 22 will now inject a (useless) meta l4 dependency as ip6 nexthdr is no longer flagged as EXPR_F_PROTOCOL, to avoid this add a small helper that skips the unneded meta dependency in that case. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: split ll proto dependency into helperFlorian Westphal2017-05-181-11/+18
| | | | | | | will be re-used in folloup patch for icmp/icmpv6 depenency handling. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: don't kill dependencies accross statementsFlorian Westphal2017-05-081-0/+5
| | | | | | | | | | | | | | | | | | | | nft currently translates ip protocol tcp meta mark set 1 tcp dport 22 to mark set 0x00000001 tcp dport 22 This is wrong, the latter form is same as mark set 0x00000001 ip protocol tcp tcp dport 22 and thats not correct (original rule sets mark for tcp packets only). We need to clear the dependency stack whenever we see a statement other than stmt_expr, as these will have side effects (counter, payload mangling, logging and the like). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: automatically kill dependencies for exthdr and tcpoptManuel Messner2017-02-121-0/+14
| | | | | | | | | | | | | | | | | | | This patch automatically removes the dependencies for exthdr and tcpopt. # nft add rule filter input tcp option maxseg kind 3 counter. # nft list table filter input Before: # ip protocol 6 tcp option maxseg kind 3 counter After: # tcp option maxseg kind 3 counter Thus allowing to write tests as follows: # tcp option maxseg kind 3;ok Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: insert implicit meta tcp dependency when matching tcp optionsFlorian Westphal2017-02-121-1/+15
| | | | | | | | | | | nft add rule inet filter input tcp option sack 4 left 1 <cmdline>:1:28-49: Error: Cannot generate dependency: no network layer protocol specified Users can avoid this via 'meta l4proto tcp', this enables implicit dependency injection for the inet/bridge/netdev families. Reviewed-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: prepare exthdr_gen_dependency for tcp supportManuel Messner2017-02-121-4/+5
| | | | | | | | | | | | currently exthdr always needs ipv6 dependency (i.e. link layer), but with upcomming TCP option matching we also need to include TCP at the network layer. This patch prepares this change by adding two parameters to exthdr_gen_dependency. Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: explicit network ctx assignment for icmp/icmp6 in special familiesArturo Borrero Gonzalez2017-01-271-40/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the inet, bridge and netdev families, we can add rules like these: % nft add rule inet t c ip protocol icmp icmp type echo-request % nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request However, when we print the ruleset: % nft list ruleset table inet t { chain c { icmpv6 type echo-request icmp type echo-request } } These rules we obtain can't be added again: % nft add rule inet t c icmp type echo-request <cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp add rule inet t c icmp type echo-request ^^^^^^^^^ % nft add rule inet t c icmpv6 type echo-request <cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6 add rule inet t c icmpv6 type echo-request ^^^^^^^^^^^ Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet carrying ICMP, if the link layer is inet, the network layer protocol context can be safely update to 'ip' or 'ip6'. Moreover, nft currently generates a 'meta nfproto ipvX' depedency when using icmp or icmp6 in the inet family, and similar in netdev and bridge families. While at it, a bit of code factorization is introduced. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1073 Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: print base and raw values for unknown payloadsFlorian Westphal2016-08-011-1/+13
| | | | | | | | | | | | | | | | | We currently print 'unknown' rather than the raw offset values for unrecognized header values. If its unknown, prefer to print payload @nh,0,16 set payload @nh,0,16 rather than 'unknown'. Also add a helper to check if payload expression has a description assigned to it. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: don't update protocol context if we can't find a descriptionFlorian Westphal2016-06-071-0/+3
| | | | | | | | | | | | | | Since commit 20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking") we deref null pointer if we can't find a description for the desired protocol, so "ip protocol 254" crashes while testing protocols 6 or 17 (tcp, udp) works. Also add a test case for this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft monitor [ trace ]Patrick McHardy2016-04-241-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | ... can now display nftables nftrace debug information. $ nft filter input tcp dport 10000 nftrace set 1 $ nft filter input icmp type echo-request nftrace set 1 $ nft -nn monitor trace trace id e1f5055f ip filter input packet: iif eth0 ether saddr 63:f6:4b:00:54:52 ether daddr c9:4b:a9:00:54:52 ip saddr 192.168.122.1 ip daddr 192.168.122.83 ip tos 0 ip ttl 64 ip id 32315 ip length 84 icmp type echo-request icmp code 0 icmp id 10087 icmp sequence 1 trace id e1f5055f ip filter input rule icmp type echo-request nftrace set 1 (verdict continue) trace id e1f5055f ip filter input verdict continue trace id e1f5055f ip filter input trace id 74e47ad2 ip filter input packet: iif vlan0 ether saddr 63:f6:4b:00:54:52 ether daddr c9:4b:a9:00:54:52 vlan pcp 0 vlan cfi 1 vlan id 1000 ip saddr 10.0.0.1 ip daddr 10.0.0.2 ip tos 0 ip ttl 64 ip id 49030 ip length 84 icmp type echo-request icmp code 0 icmp id 10095 icmp sequence 1 trace id 74e47ad2 ip filter input rule icmp type echo-request nftrace set 1 (verdict continue) trace id 74e47ad2 ip filter input verdict continue trace id 74e47ad2 ip filter input trace id 3030de23 ip filter input packet: iif vlan0 ether saddr 63:f6:4b:00:54:52 ether daddr c9:4b:a9:00:54:52 vlan pcp 0 vlan cfi 1 vlan id 1000 ip saddr 10.0.0.1 ip daddr 10.0.0.2 ip tos 16 ip ttl 64 ip id 59062 ip length 60 tcp sport 55438 tcp dport 10000 tcp flags == syn tcp window 29200 trace id 3030de23 ip filter input rule tcp dport 10000 nftrace set 1 (verdict continue) trace id 3030de23 ip filter input verdict continue trace id 3030de23 ip filter input Based on a patch from Florian Westphal, which again was based on a patch from Markus Kötter. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: add payload_is_stacked()Patrick McHardy2016-04-241-0/+20
| | | | | | | Add payload_is_stacked() to determine whether a protocol expression match defines a stacked protocol on the same layer. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: move payload depedency tracking to payload.cPatrick McHardy2016-04-241-0/+44
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: fix stacked headers protocol context trackingPatrick McHardy2016-04-241-2/+6
| | | | | | | | | | | | | | | The code contains multiple scattered around fragments to fiddle with the protocol contexts to work around the fact that stacked headers update the context for the incorrect layer. Fix this by updating the correct layer in payload_expr_pctx_update() and also take care of offset adjustments there and only there. Remove all manual protocol context fiddling and change protocol context debugging to also print the offset for stacked headers. All previously successful testcases pass. Signed-off-by: Patrick McHardy <kaber@trash.net>