summaryrefslogtreecommitdiffstats
path: root/src/rule.c
Commit message (Collapse)AuthorAgeFilesLines
* rule: fix chain details align indentationsArturo Borrero2015-03-191-1/+1
| | | | | | | | | | f.i: type filter hook output priority 0; policy accept; ip daddr @test counter packets 14 bytes 1176 Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: delete extra space in rule indentationArturo Borrero2015-03-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Annoying extra space in rule indentation: Example before this patch: table ip6 test_table { chain test_chain { counter tcp dport { 22, 80, 443} accept # handle 1 ^ } } Example after this patch: table ip6 test_table { chain test_chain { counter tcp dport { 22, 80, 443} accept # handle 1 } } Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the default policy for base chainsPablo Neira Ayuso2015-03-171-4/+19
| | | | | | | | | | | | | | | | | | The new syntax is: nft add chain filter input { hook input type filter priority 0\; policy accept\; } but the previous syntax is still allowed: nft add chain filter input { hook input type filter priority 0\; } this assumes default policy to accept. If the base chain already exists, you can update the policy via: nft add chain filter input { policy drop\; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expose table flagsPablo Neira Ayuso2015-03-171-0/+30
| | | | | | | | | | | | | | | | | | | The nf_tables kernel API provides a way to disable a table using the dormant flag. This patch adds the missing code to expose this feature through nft. Basically, if you want to disable a table and all its chains from seen any traffic, you have to type: nft add table filter { flags dormant\; } to re-enable the table, you have to: nft add table filter this clears the flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix object order via nft -fPablo Neira Ayuso2015-02-181-2/+7
| | | | | | | | | | | | | | | | | | The objects need to be loaded in the following order: #1 tables #2 chains #3 sets #4 rules We have to make sure that chains are in place by when we add rules with jumps/gotos. Similarly, we have to make sure that the sets are in place by when rules reference them. Without this patch, you may hit ENOENT errors depending on your ruleset configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: remove unused set_clone() functionPatrick McHardy2015-01-121-18/+0
| | | | | | | | The set_clone() function was added by the event monitor patchset and is unused. It is also broken since it simply initializes the list head to the list of the original set, so remove it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix memory leaksPatrick McHardy2015-01-111-0/+2
| | | | | | | Fix two memory leaks in netlink event monitor. Also fix a leak related to all sets, the ->init expression is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix segmentation faults on kernels without nftables supportPablo Neira Ayuso2014-12-091-3/+4
| | | | | | | | | | | | | | | | # nft list sets Segmentation fault # nft list sets <cmdline>:1:1-9: Error: Could not receive sets from kernel: Protocol error list sets ^^^^^^^^^ Fix same bug in `nft list tables'. Don't cleanup the table object for these commands since it is NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: interpret the event type from the evaluation stepPablo Neira Ayuso2014-10-091-6/+45
| | | | | | | | | | | Postpone the event type interpretation to the evaluation step. This patch also fixes the combination of event and object types, which was broken. The export code needed to be adjusted too. The new and destroy are not tokens that can be recognized by the scanner anymore, so this also implicitly restores 'ct state'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add list ruleset commandArturo Borrero2014-09-291-0/+28
| | | | | | | | | | | | | | | | | This patch adds a new command to nft: % nft list ruleset [family] Which list the entire ruleset. If no family is specified, all tables of all families are listed. Users can now make several operations at ruleset level: % nft list ruleset > ruleset.nft % nft -f ruleset.nft % nft flush ruleset Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: factorize chain and table listing codeArturo Borrero2014-09-291-32/+35
| | | | | | | Let's factorize common code. This is also useful in follow-up patches. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: rename do_command_list_cleanup() to table_cleanup()Arturo Borrero2014-09-291-3/+3
| | | | | | | | Let's use a more generic name for this functions, since it has nothing to do with commands. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set optimization optionsArturo Borrero2014-09-291-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds options to choose set optimization mechanisms. Two new statements are added to the set syntax, and they can be mixed: nft add set filter set1 { type ipv4_addr ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; } nft add set filter set1 { type ipv4_addr ; policy memory ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy performance ; } Also valid for maps: nft add map filter map1 { type ipv4_addr : verdict ; policy performace ; } [...] This is the output format, which can be imported later with `nft -f': table filter { set set1 { type ipv4_addr policy memory size 1024 } } In this approach the parser accepts default options such as 'performance', given they are a valid configurations, but aren't sent to the kernel. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix 'describe' command when passing wrong expressionsPablo Neira Ayuso2014-09-171-0/+11
| | | | | | | | | | | | | | | | | | Before this patch: # nft describe tcp foo value expression, datatype inet_proto (Internet protocol) (basetype integer), 8 bits Segmentation fault After this patch: # nft describe tcp foo <cmdline>:1:14-16: Error: syntax error, unexpected string, expecting end of file or newline or semicolon describe tcp foo ^^^ Reported-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add `flush ruleset'Arturo Borrero2014-09-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: check for NLM_F_DUMP_INTR when dumping object listsPablo Neira Ayuso2014-07-141-26/+38
| | | | | | | | | This flag allows to detect that an update has ocurred while dumping any of the object lists. In case of interference, nft cancels the netlink socket to skip processing the remaining stale entries and it retries to obtain fresh list of objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change type of chain.priority from unsigned int to intHendrik Schwartke2014-06-101-2/+2
| | | | | | | This removes a bug that displays strange hook priorities like "type route hook output priority 4294967146". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add events reportingArturo Borrero2014-04-251-0/+89
| | | | | | | | | | This patch adds a basic events reporting option to nft. The syntax is: % nft monitor [new|destroy] [tables|chains|rules|sets|elements] [xml|json] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: generalize chain_print()Arturo Borrero2014-04-251-0/+14
| | | | | | | | Lest generalize the chain_print() function, so we can print a plain chain as the user typed in the basic CLI. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: allow to print sets in plain formatArturo Borrero2014-04-251-10/+50
| | | | | | | | | | | | | Allow to print sets with or without format. This is useful in situations where we want to print more or less the same the user typed (IOW, in one single line, and with family/table info). While at it, make family2str() function public, so it can be used in other places. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix crash in set listingAna Rey2014-04-081-1/+1
| | | | | | | | | | | | | It fixes an invalid read that is shown by valgrind. ==3962== Invalid read of size 4 ==3962== at 0x407040: do_command (rule.c:692) ==3962== by 0x40588C: nft_run (main.c:183) ==3962== by 0x405469: main (main.c:334) ==3962== Address 0x10 is not stack'd, malloc'd or (recently) free'd Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: Fix list of sets by familyAna Rey2014-03-281-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the result of command line 'nft list sets FAMILY'. It shows the following error message: "Error: syntax error, unexpected end of file, expecting string" Now, it is possible shows right this information: $ sudo nft -nna list sets ip set set_test { type ipv4_address elements = { 192.168.3.45, 192.168.3.43, 192.168.3.42, 192.168.3.4} } set set_test2 { type ipv4_address elements = { 192.168.3.43, 192.168.3.42, 192.168.3.4} } set set0 { type ipv4_address flags constant elements = { 127.0.0.12, 12.11.11.11} } Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: abort on interval conflictsPatrick McHardy2014-03-071-2/+3
| | | | | | | | | | | We currently print a debug message (with debugging) and continue. Output a proper error message and abort. While at it, make sure we only report a conflict if there actually is one. This is not the case similar actions, IOW in case of sets, never, in case of maps, only if the mapping differs. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add support for rule human-readable commentsPablo Neira Ayuso2014-02-271-1/+7
| | | | | | | | | | | | This patch adds support for human-readable comments: nft add rule filter input accept comment \"accept all traffic\" Note that comments *always* come at the end of the rule. This uses the new data area that allows you to attach information to the rule via netlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: initialize cmd list and use list_splice_tail() for adding to command listPatrick McHardy2014-02-051-0/+1
| | | | | | | | | | | | With incremental evaluation we're first evaluating the command before adding it to the global command list, so the command's list_head is uninitialized during evaluation. We need to initialize it to handle the case that an implicit set declaration will prepend a command to the list. Also list_splice_tail() needs to be used instead of list_add_tail() to add the entire list of commands. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Revert "set: add abstract set descriptions"Patrick McHardy2014-01-231-4/+1
| | | | | | This reverts commit 2f61f093c3149465f2a68764b25c817adbe87fcd. Crap, accidentally committed this.
* ruleset: add XML/JSON exportArturo Borrero Gonzalez2014-01-231-0/+20
| | | | | | | | | | | | | | | | | | | | This patch adds the following operation: :~# nft export <xml|json> The XML/JSON output is provided raw by libnftnl, thus without format. In case of XML, you can give format with the `xmllint' tool from libxml2-tools: :~# nft list ruleset xml | xmllint --format - In case of JSON, you can use `json_pp' from perl standar package: :~# nft list ruleset json | json_pp A format field is added in struct cmd, and it will be reused in the import operation. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: add abstract set descriptionsPatrick McHardy2014-01-221-1/+4
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd: add create command for tables and chainsPatrick McHardy2014-01-211-9/+13
| | | | | | | | | We currently always use NLM_F_EXCL for add, which makes adding existing chains or tables fail. There's usually no reason why you would care about this, so change "add" to not use NLM_F_EXCL and add a new "create" command in case you do care. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-161-7/+14
|\ | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * set: make set initializer parsablePatrick McHardy2014-01-161-1/+5
| | | | | | | | | | | | | | | | | | If a set contains elements, the output is not parsable since the elements = { ... } is not understood by the parser. Fix this and also add support for creating constant sets (which only makes sense when using an initializer). Signed-off-by: Patrick McHardy <kaber@trash.net>
| * set: make set flags output parsablePatrick McHardy2014-01-161-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes two problems: - the output of "nft list table ..." is not parsable if sets are included because the parser can't parse the flags. - set flags can't be specified during set creation. To fix this, the set output is changed to: - not print each flag on a single line - prefix the flags with "flags " - only show the interval flag since all others are for internal use only The parser is changed to parse the flags specified in a set declaration. This allows to parse empty sets. The following patch will take care of parsing sets that are already populated. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * src: use ':' instead of '=>' in dictionariesPablo Neira Ayuso2014-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Replace => by : to make it easier for most shell users, as > implies a redirection, let's avoid possible confusion that may result if you forget to escape it. This works fine if you don't forget to add space between the key and the value. If you forget to add the space, depending on the case, the scanner may recognize it correctly or process it as a string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | nftables: add support for the "inet" familyPatrick McHardy2014-01-081-0/+3
|/ | | | | | | | | | Add support for the mixed IPv4/IPv6 "inet" family. This mainly consist of adding the "inet" <-> NFPROTO_INET mapping in the parser and netlink support functions. Additionally add the definitions for the inet filter table. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: missing set cleanup in do_command_listPhil Oester2013-11-301-0/+5
| | | | | | | | | | When listing a table in interactive mode, the set list is not cleaned up. Thus the number of displayed sets grows with each successive listing. Attached patch adds the necessary list cleanup to do_command_list. Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule batching supportPablo Neira Ayuso2013-09-231-11/+8
| | | | | | | | | | | | | | | | | | | | | | | This patch allows nft to put all rule update messages into one single batch that is sent to the kernel if `-f' option is used. In order to provide fine grain error reporting, I decided to to correlate the netlink message sequence number with the correspoding command sequence number, which is the same. Thus, nft can identify what rules trigger problems inside a batch and report them accordingly. Moreover, to avoid playing buffer size games at batch building stage, ie. guess what is the final size of the batch for this ruleset update will be, this patch collects batch pages that are converted to iovec to ensure linearization when the batch is sent to the kernel. This reduces the amount of unnecessary memory usage that is allocated for the batch. This patch uses the libmnl nlmsg batching infrastructure and it requires the kernel patch entitled (netfilter: nfnetlink: add batch support and use it from nf_tables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* display family in table listingEric Leblond2013-09-171-1/+19
| | | | | | | | As family was not displayed in table listing, it was not possible to restore an ipv6 table saved via 'nft list table ip6 TABLE'. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Better error reporting if chain type is invalidTomasz Bursztyka2013-09-051-0/+19
| | | | | | | | | | | | | This patch verifies at command line parsing that given chain type is valid. Possibilities are: filter, nat, and route. nft add chain test test { type cheese hook input priority 0 }; <cmdline>:1:28-33: Error: unknown chain type cheese add chain test test { type cheese hook input priority 0 }; ^^^^^^ Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add priority keyword on base chain descriptionTomasz Bursztyka2013-09-041-1/+1
| | | | | | | | | | Instead of: add chain foo bar { type route hook input 0; } it should be now: add chain foo bar { type route hook input priority 0; } Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* src: Wrap netfilter hooks around human readable stringsTomasz Bursztyka2013-09-041-14/+60
| | | | | | | | | | | | | | | | | | | This allows to use unique, human readable, hook names for the command line and let the user being unaware of the complex netfilter's hook names and there difference depending on the netfilter family. So: add chain foo bar { type route hook NF_INET_LOCAL_IN 0; } becomes: add chain foo bar { type route hook input 0; } It also fixes then the difference in hook values between families. I.e. ARP family has different values for input, forward and output compared to IPv4, IPv6 or bridge. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix base chain printingTomasz Bursztyka2013-08-301-1/+1
| | | | | | | | | Relying on chain's hooknum to know whether the chain is a base one or not is bogus: having 0 as hooknum is a valid number. Thus setting the right flag and handling it is the way to go, as parser does already. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the base chain typePablo Neira Ayuso2013-08-271-3/+2
| | | | | | | | | | | | | | | | | | This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for insertion inside rule listEric Leblond2013-07-191-0/+2
| | | | | | | | | | | | | | This patch adds support to insert and to add rule using a rule handle as reference. The rule handle syntax has an new optional position field which take a handle as argument. Two examples: nft add rule filter output position 5 ip daddr 1.2.3.1 drop nft insert rule filter output position 5 ip daddr 1.2.3.1 drop Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: display hook infoEric Leblond2013-06-121-0/+23
| | | | | | | | | | | | It was not possible to restore a ruleset because of missing hook information. This patch adds hooknum output to list operation. [ Mangled this patch to use a string array mapping hook numbers and name --pablo ] Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: list elements in set in any caseEric Leblond2013-06-081-2/+1
| | | | | | | "nft list table" command was not displaying the elements of named set. This was thus not possible to restore a ruleset by using the listing output. This patch modifies the code to display the elements of set in all cases.
* rule: add flag to display rule handle as commentEric Leblond2013-05-311-0/+3
| | | | | | | | | | | Knowing the rule handle is necessary to be able to delete a single rule. It was not displayed till now in the output and it was thus impossible to remove a single rule. This patch modify the listing output to add a comment containing the handle when the -a/--handle flag is provided. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: complete basic functionality of the interactive modePablo Neira Ayuso2013-05-191-6/+19
| | | | | | | | | | This patch adds missing code to get basic interactive mode operative via `nft -i', including parsing, evaluation, command execution via netlink and error reporting. Autocomplete is not yet implemented. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd/netlink: make sure we always have a location in netlink operationsPatrick McHardy2013-04-181-33/+42
| | | | | | Improve error reporting by always using a location in netlink operations. Signed-off-by: Patrick McHardy<kaber@trash.net>
* rule: fix nft list chainPablo Neira Ayuso2013-04-181-1/+4
| | | | | | | | | | | | | | | | Use netlink_list_chains instead of netlink_list_chain (note the final `s') After "nft list table filter" shows: table filter { chain input { } } "nft list chain filter input" shows: table filter { }
* rule: allow to list of existing tablesPablo Neira Ayuso2013-04-181-0/+13
| | | | | | | | You can now specify: nft list tables ip to obtain the list of all existing tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 19:26:05 +0000