summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* src: datatype: prefer sscanf, avoid strncpyFlorian Westphal2018-03-031-11/+10
| | | | | | similar to previous patch, but replace strncpy+atoi by sscanf. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Use snprintf() over strncpy()Harsha Sharma2018-03-032-4/+4
| | | | | | | Use snprintf() over strncpy() functions as the buffer is not null terminated in strncpy(). Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
* netlink: remove non-batching routinesPablo Neira Ayuso2018-03-032-319/+36
| | | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: misc updatesPablo Neira Ayuso2018-03-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the following macros: * AC_PREREQ checks for 2.61, which is not supported any contemporary distribution. * AC_COPYRIGHT, autoconf documentation states "in addition to the Free Software Foundation's copyright on the Autoconf macros, parts of your configure are covered by the copyright-notice.". This only refers to the autoconf infrastructure: we are doing simple and standard usage of autoconf infrastructure, we also don't use this macro in other existing userspace software available at netfilter.org. The comment above at the beginning of this file shows text that is available in many configure.ac templates on the Internet. * AC_CANONICAL_HOST, we don't need the canonical host-system type to build this software. * AC_CONFIG_SRCDIR is not used in other userspace software in the tree. * AC_DEFINE _GNU_SOURCE, define this where it's needed instead. * AC_DEFINE _STDC_FORMAT_MACROS is not used in this codebase. * AC_HEADER_STDC checks for ANSI C89 headers, however, we need more than just this C standard, so this doesn't guarantee anything at all. * Remove "Checks for libraries" comment, it's obvious. * AC_HEADER_ASSERT allows us to disable assertions, this is bad because this is helping us to diagnose bugs and incomplete features. * AC_CHECK_HEADERS is checking for an arbitrary list of headers, this still doesn't even guarantee that we can actually do a successful compilation in a broken system. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: use nf_key_protoFlorian Westphal2018-03-031-9/+7
| | | | | | Consolidate into one so it can be reused by new users. Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: don't crash when no commands are specifiedHarsha Sharma2018-03-031-0/+3
| | | | | | | | For e.g. nft -c " " Without this patch it segfaults. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: support of maps with timeoutLaura Garcia Liebana2018-03-021-0/+5
| | | | | | | | | | | | | | | | | | | | | Support of key and value association with a certain timeout. Example: nft add map nftlb mapa { type inet_service: ipv4_addr\; timeout 5s\; } Results in: table ip nftlb { map mapa { type inet_service : ipv4_addr timeout 5s } } Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: Fix resource leaksPhil Sutter2018-03-021-52/+92
| | | | | | | | | | | | | | | | | | Most of the cases are basically the same: Error path fails to free the previously allocated statement or expression. A few cases received special treatment though: - In netlink_parse_payload_stmt(), the leak is easily avoided by code reordering. - In netlink_parse_exthdr(), there's no point in introducing a goto label since there is but a single affected error check. - In netlink_parse_hash() non-error path leaked as well if sreg contained a concatenated expression. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Complain if setting O_NONBLOCK failsPhil Sutter2018-03-021-1/+2
| | | | | | | | | Assuming that code is not aware that reads from netlink socket may block, treat inability to set O_NONBLOCK flag as fatal initialization error aborting program execution. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hash: Fix potential null-pointer dereference in hash_expr_cmp()Phil Sutter2018-03-021-1/+1
| | | | | | | | | | | | | | | | | The first part of the conditional: | (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr)) will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer dereference. This is probably a typo, the intention when introducing this was to avoid the call to expr_cmp() for symmetric hash expressions which don't use expr->hash.expr. Inverting the existence check should fix this. Fixes: 3a86406729782 ("src: hash: support of symmetric hash") Cc: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix memleak in stmt_reject_gen_dependency()Phil Sutter2018-03-021-3/+7
| | | | | | | | | | | | | | The allocated payload expression is not used after returning from that function, so it needs to be freed again. Simple test case: | nft add rule inet t c reject with tcp reset Valgrind reports definitely lost 144 bytes. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: Avoid passing negative offset to fseek()Phil Sutter2018-03-021-5/+5
| | | | | | | | If the initial call to ftell() fails, variable orig_offset is set to -1. Avoid passing this to fseek() later on. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: Drop pointless check in cli_append_multiline()Phil Sutter2018-03-021-10/+2
| | | | | | | | | | | | | The function is called from cli_complete after it has checked for line to be != NULL. The other part of the conditional, namely multiline being NULL, is perfectly valid (if the last read line didn't end with backslash. Hence drop the conditional completely. Since variable eof is not used anywhere outside of the dropped conditional, get rid of it completely. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make JSON/XML output respect output_fpPhil Sutter2018-02-281-19/+18
| | | | | | | | | | | | Make sure events callbacks print to output_ctx-defined stream for any type of output format. Since all of them use nft_print() as last call (if anything is printed at all), the final call to fflush() in netlink_events_cb() can be dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make trace events respect output_fpPhil Sutter2018-02-281-17/+21
| | | | | | | | Seems like this was incompletely converted, part of the output went to output_fp already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Review switch statements for unmarked fall through casesPhil Sutter2018-02-285-4/+7
| | | | | | | | | | | | | | While revisiting all of them, clear a few oddities as well: - There's no point in marking empty fall through cases: They are easy to spot and a common concept when using switch(). - Fix indenting of break statement in one occasion. - Drop needless braces around one case which doesn't declare variables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Added undefine/redefine keywordsDavid Fabian2018-02-263-0/+39
| | | | | | | | | | | | | | | | | This is a small patch to nft which adds two new keywords - undefine and redefine. undefine simply undefines a variable from the current scope. redefine allows one to change a variable definition. We have a firewall written in bash (using iptables) that is organized by customer VLANs. Each VLAN has its own set of bash variables holding things like uplink iface names, gateway IPs, etc. We want to rewrite the firewall to nftables but are stuck on the fact that nft variables cannot be overridden in the same scope. We have each VLAN configuration in a separate file containing pre/post-routing, input, output and forward rules,and we include those files to a master firewall configuration. One solution is to rename all the variables with some VLAN specific (pre/su)ffix. But that is cumbersome. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make raw payloads workFlorian Westphal2018-02-263-1/+7
| | | | | | | | | | | | | | | | | | | | make syntax consistent between print and parse. No dependency handling -- once you use raw expression, you need to make sure the raw expression only sees the packets that you'd want it to see. based on an earlier patch from Laurent Fasnacht <l@libres.ch>. Laurents patch added a different syntax: @<protocol>,<base>,<data type>,<offset>,<length> data_type is useful to make nftables not err when asking for "@payload,32,32 192.168.0.1", this patch still requires manual convsersion to an integer type (hex or decimal notation). data_type should probably be added later by adding an explicit cast expression, independent of the raw payload syntax. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't resolve expressions using the inet pseudoheaderFlorian Westphal2018-02-261-1/+1
| | | | | | | Else, '@ll,0,8' will be mapped to 'inet nfproto', but thats not correct (inet is a pseudo header). Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: use integer_type when initializing a raw expressionFlorian Westphal2018-02-261-0/+1
| | | | | | | The invalid type prints prominent "[invalid]", so prefer integer type in raw expressions. Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce datatype ifname_typeArturo Borrero Gonzalez2018-02-255-16/+26
| | | | | | | | | | | | | | | | | | | | | | | | This new datatype is a string subtype. It will allow us to build named maps/sets using meta keys like 'iifname', 'oifname', 'ibriport' or 'obriport'. Example: table inet t { set s { type ifname elements = { "eth0", "eth1" } } chain c { iifname @s accept oifname @s accept } } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: check for overlapping elements at insertionPablo Neira Ayuso2018-02-251-44/+16
| | | | | | | This speeds up element overlap checks quite a bit. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1228 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: bail out when exporting ruleset with unsupported outputPablo Neira Ayuso2018-02-152-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | Display error message and propagate error to shell when running command with unsupported output: # nft export ruleset json Error: this output type is not supported export ruleset json ^^^^^^^^^^^^^^^^^^^^ # echo $? 1 When displaying the output in json using the low-level VM representation, it shows: # nft export ruleset vm json ... low-level VM json output # echo $? 0 While at it, do the same with obsoleted XML output. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1224 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: don't decode past last valid templateFlorian Westphal2018-02-151-0/+4
| | | | | | | | | | | | When trying to decode payload header fields, be sure to bail out when having exhausted all available templates. Otherwise, we allocate invalid payload expressions (no dataype, header length of 0) and then crash when trying to print them. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1226 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Spelling fixesVille Skyttä2018-02-153-5/+5
| | | | | Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: add meta_may_dependency_kill()Pablo Neira Ayuso2018-02-151-1/+71
| | | | | | | | | | | | | Do not exercise dependency removal for protocol key network payload expressions in bridge, netdev and inet families from meta expressions, more specifically: * inet: nfproto and ether type. * netdev and bridge: meta protocol and ether type. need to be left in place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload_may_dependency_kill()Pablo Neira Ayuso2018-02-151-2/+29
| | | | | | | | Payload protocol key expressions at network base are meaningful in the netdev, bridge and inet families, do not exercise the redundant dependency removal in those cases since it breaks rule semantics. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of __payload_dependency_kill()Pablo Neira Ayuso2018-02-152-16/+8
| | | | | | Use payload_dependency_release() instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add payload_dependency_exists()Pablo Neira Ayuso2018-02-152-15/+34
| | | | | | | | | | | | | | | This helper function tells us if there is already a protocol key payload expression, ie. those with EXPR_F_PROTOCOL flag set on, that we might want to remove since we can infer from another expression in the upper protocol base, eg. ip protocol tcp tcp dport 22 'ip protocol tcp' can be removed in the ip family since it is redundant, but not in the netdev, bridge and inet families, where we cannot make assumptions on the layer 3 protocol. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload_dependency_release() helper functionPablo Neira Ayuso2018-02-151-9/+13
| | | | | | | Wrap code that releases existing dependencies that we have just annotated in the context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass family to payload_dependency_kill()Pablo Neira Ayuso2018-02-153-14/+20
| | | | | | | | | This context information is very relevant when deciding if a redundant dependency needs to be removed or not, specifically for the inet, bridge and netdev families. This new parameter is used by follow up patch entitled ("payload: add payload_may_dependency_kill()"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Enable automerge feature for anonymous setsPhil Sutter2018-02-151-0/+1
| | | | | | | | | | | Automatic merging of adjacent/overlapping ranges upon insertion has clear benefits performance- and readability-wise. The drawbacks which led to disabling it by default don't apply to anonymous sets since they are read-only anyway, so enable this feature for them again. Cc: Jeff Kletsky <netfilter@allycomm.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix build with older glibcBaruch Siach2018-02-091-0/+1
| | | | | | | | | | | | | | | | glibc before 2.19 missed the definition of IPPROTO_MH. This leads to build failure: parser_bison.y: In function 'nft_parse': parser_bison.y:3793:21: error: 'IPPROTO_MH' undeclared (first use in this function) | MH { $$ = IPPROTO_MH; } ^ Since we have a local definition of IPPROTO_MH in headers.h use that to fix the build. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: add assertion to prevent infinite loopPablo Neira Ayuso2018-02-021-1/+4
| | | | | | | | | | | | | | | | | | | | | | | The following configuration: table inet filter { chain input { ct original ip daddr {1.2.3.4} accept } } is triggering an infinite loop. This problem also exists with concatenations and ct ip {s,d}addr. Until we have a solution for this, let's just prevent infinite loops. Now we hit this: # nft list ruleset nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed. Abort Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'auto-merge' option to setsPablo Neira Ayuso2018-01-226-4/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After discussions with Karel here: https://bugzilla.netfilter.org/show_bug.cgi?id=1184 And later on with Phil Sutter, we decided to disable the automatic merge feature in sets with intervals. This feature is problematic because it introduces an inconsistency between what we add and what we later on get. This is going to get worse with the upcoming timeout support for intervals. Therefore, we turned off this by default. However, Jeff Kletsky and folks like this feature, so let's restore this behaviour on demand with this new 'auto-merge' statement, that you can place on the set definition, eg. # nft list ruleset table ip x { ... set y { type ipv4_addr flags interval auto-merge } } # nft add element x z { 1.1.1.1-2.2.2.2, 1.1.1.2 } Regarding implementation details: Given this feature only makes sense from userspace, let's store this in the set user data area, so nft knows it has to do automatic merge of adjacent/overlapping elements as per user request. # nft add set x z { type ipv4_addr\; auto-merge\; } Error: auto-merge only works with interval sets add set x z { type ipv4_addr; auto-merge; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1216 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert ("src: Remove xt_stmt_() functions").Pablo Neira Ayuso2018-01-202-2/+97
| | | | | | | | | Revert commit bce55916b51ec1a4c23322781e3b0c698ecc9561, we need this code in place to properly make translation when iptables-compat loads rules. Reported-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add import command for low level jsonShyam Saini2018-01-175-22/+356
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This new operation allows to import low level virtual machine ruleset in json to make incremental changes using the parse functions of libnftnl. A basic way to test this new functionality is: $ cat file.json | nft import vm json where the file.json is a ruleset exported in low level json format. To export json rules in low level virtual machine format we need to specify "vm" token before json. See below $ nft export vm json and $ nft export/import json will do no operations. Same goes with "$nft monitor" Highly based on work from Alvaro Neira <alvaroneay@gmail.com> and Arturo Borrero <arturo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add secpath supportFlorian Westphal2018-01-161-0/+3
| | | | | | | | | This can be used to check if a packet has a secpath attached to it, i.e. was subject to ipsec processing. Example: add rule inet raw prerouting meta secpath exists accept Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Don't merge adjacent/overlapping rangesPhil Sutter2018-01-113-9/+38
| | | | | | | | | | | | | | | | | | | | | Previously, when adding multiple ranges to a set they were merged if overlapping or adjacent. This might cause inconvenience though since it is afterwards not easily possible anymore to remove one of the merged ranges again while keeping the others in place. Since it is not possible to have overlapping ranges, this patch adds a check for newly added ranges to make sure they don't overlap if merging is turned off. Note that it is not possible (yet?) to enable range merging using nft tool. Testsuite had to be adjusted as well: One test in tests/py changed avoid adding overlapping ranges and the test in tests/shell which explicitly tests for this feature dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Restore per object CFLAGSPhil Sutter2018-01-101-10/+17
| | | | | | | | As per the automake manual, create internal libraries for parser and mini-gmp sources so per-object flags can be set. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh nf_tables.h cached copyPablo Neira Ayuso2018-01-081-1/+1
| | | | | | Refresh it to fetch what we have in 4.15-rc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not print limit keyword inside object definitionPablo M. Bermudo Garay2017-12-221-2/+2
| | | | | | | | | | | | | | | | table ip limits { limit foo { limit rate 5/second ^^^^^ } } This behaviour is inconsistent and breaks the restoration of saved rule-sets with "nft -f". Fixes: c0697eabe832 ("src: add stateful object support for limit") Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix protocol context update on big-endian systemsPhil Sutter2017-12-127-17/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an obscure bug on big-endian systems when trying to list a rule containing the expression 'ct helper tftp' which triggers the assert() call in mpz_get_type(). Florian identified the cause: ct_expr_pctx_update() is called for the relational expression which calls mpz_get_uint32() to get RHS value (assuming it is a protocol number). On big-endian systems, the misinterpreted value exceeds UINT_MAX. Expressions' pctx_update() callback should only be called for protocol matches, so ct_meta_common_postprocess() lacked a check for 'left->flags & EXPR_F_PROTOCOL' like the one already present in payload_expr_pctx_update(). In order to fix this in a clean way, this patch introduces a wrapper relational_expr_pctx_update() to be used instead of directly calling LHS's pctx_update() callback which unifies the necessary checks (and adds one more assert): - assert(expr->ops->type == EXPR_RELATIONAL) -> This is new, just to ensure the wrapper is called properly. - assert(expr->op == OP_EQ) -> This was moved from {ct,meta,payload}_expr_pctx_update(). - left->ops->pctx_update != NULL -> This was taken from expr_evaluate_relational(), a necessary requirement for the introduced wrapper to function at all. - (left->flags & EXPR_F_PROTOCOL) != 0 -> The crucial missing check which led to the problem. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_linearize: exthdr op must be u32Florian Westphal2017-12-111-2/+2
| | | | | | | | libnftnl casts this to u32. Broke exthdr expressions on bigendian. Reported-by: Li Shuang <shuali@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Make libnftables a local static libraryPhil Sutter2017-12-042-1/+2
| | | | | | | | | This changes Makefiles so that libnftables is built into a static library which is not installed. This allows for incompatible changes while still providing a library to link to for testing purposes. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: don't print newline if label bit cannot be mappedFlorian Westphal2017-11-271-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: print error for null stringHarsha Sharma2017-11-271-1/+4
| | | | | | | | | | | | Print error "Empty string is not allowed", eg. # nft add rule filter input meta iifname '""' add rule filter input meta iifname "" ^^ Error: Empty String is not allowed Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: no need for 'name' token for metersPablo Neira Ayuso2017-11-241-13/+16
| | | | | | | Rework grammar to skip the 'name' token after 'meter' for named meters. For consistency with sets and maps in terms of syntax. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: dismiss anonymous metersPablo Neira Ayuso2017-11-242-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The former 'flow table' syntax allows flow tables with no name: # nft add rule x y flow { ip saddr counter } However, when listing, it leaks the name that it is autoallocating. # nft list ruleset table ip x { chain y { flow table __mt0 { ip saddr counter} } } Which is odd since then restoring will use such a name. Remove anonymous flow table/meters, so everyone needs to specify a name. There is no way to fix this, given anonymous flag tells us that the set behind this meter is bound to a rule, hence, released once the rule is going - the term "anonymous" was not good choice as a flag in first place. Only possibility is to strcmp for __ft to identify this is a nameless meter, which is a hack. Moreover, having no name means you cannot flush the set behind this meter, which criples this feature for no reason. On top of it, the wiki only documents named meters, and we have a record of users complaining on this behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Florian Westphal <fw@strlen.de>
* src: deprecate "flow table" syntax, replace it by "meter"Pablo Neira Ayuso2017-11-248-87/+111
| | | | | | | | | | | | | | | | | | | | | | | | | According to bugzilla 1137: "flow tables" should not be syntactically unique. "Flow tables are always named, but they don't conform to the way sets, maps, and dictionaries work in terms of "add" and "delete" and all that. They are also "flow tables" instead of one word like "flows" or "throttle" or something. It seems weird to just have these break the syntactic expectations." Personally, I never liked the reference to "table" since we have very specific semantics in terms of what a "table" is netfilter for long time. This patch promotes "meter" as the new keyword. The former syntax is still accepted for a while, just to reduce chances of breaking things. At some point the former syntax will just be removed. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1137 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>