summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
| * mnl: fix chain type autoloadingPablo Neira Ayuso2014-01-171-1/+1
| | | | | | | | | | | | | | | | Add missing NLM_F_CREATE flag when creating new chains to trigger module autoloading in the kernel. Reported-by: Ana Rey Botello <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * datatype: add time type parser and adapt outputPablo Neira Ayuso2014-01-171-16/+118
| | | | | | | | | | | | | | | | This patch allows to specify a string to indicate the time, eg. nft add rule filter output ct expiration \"1d2h3m4s\" counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-167-16/+72
|\| | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * set: make set initializer parsablePatrick McHardy2014-01-164-2/+27
| | | | | | | | | | | | | | | | | | If a set contains elements, the output is not parsable since the elements = { ... } is not understood by the parser. Fix this and also add support for creating constant sets (which only makes sense when using an initializer). Signed-off-by: Patrick McHardy <kaber@trash.net>
| * set: make set flags output parsablePatrick McHardy2014-01-163-6/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes two problems: - the output of "nft list table ..." is not parsable if sets are included because the parser can't parse the flags. - set flags can't be specified during set creation. To fix this, the set output is changed to: - not print each flag on a single line - prefix the flags with "flags " - only show the interval flag since all others are for internal use only The parser is changed to parse the flags specified in a set declaration. This allows to parse empty sets. The following patch will take care of parsing sets that are already populated. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * src: use ':' instead of '=>' in dictionariesPablo Neira Ayuso2014-01-164-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Replace => by : to make it easier for most shell users, as > implies a redirection, let's avoid possible confusion that may result if you forget to escape it. This works fine if you don't forget to add space between the key and the value. If you forget to add the space, depending on the case, the scanner may recognize it correctly or process it as a string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add new --debug=mnl option to enable libmnl debuggingPablo Neira Ayuso2014-01-162-3/+7
| | | | | | | | | | | | | | This allows you to dump the netlink message that is send via libmnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | parser: use symbolic expressions for parsing keywords as protocol valuesPatrick McHardy2014-01-161-16/+12
| | | | | | | | | | | | | | | | | | | | | | For "meta protocol" and the "meta nfproto" expressions, we need to be able to parse "ip", "ip6", "vlan" and "arp" as protocol values. Since the interpretation depends on the LHS of the relaltional expression, we need to use symbolic expressions instead of constants to defer parsing to the evaluation phase. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-166-12/+72
|\| | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/payload.c
| * segtree: fix decomposition of unclosed intervalsPatrick McHardy2014-01-161-9/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If intervals are directly adjacent or extend to the right end of the dimension, they are not closed by a EXPR_F_INTERVAL_END entry. This leads to multiple errors when decomposing the intervals: - the last unclosed interval is not shown at all. - if a range is unclosed and the set is a map, the starting point of the next interval is set to the data, not the key, leading to nonsensical output. - if a prefix is unclosed, the interval is assumed to be a prefix as well and the same starting point is kept. This makes sense for cases like 192.168.0.0/24, 192.168.0.0/16, but leads to hard to understand results if the next interval is not representable as a prefix. Fix this by doing two things: - add an EXPR_F_INTERVAL_END element for each unclosed interval during preprocessing. - process the final unclosed interval extending to the right end of the dimension, if present. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * segtree: only use prefix expressions for ranges for selected datatypesPatrick McHardy2014-01-163-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is uncommon to represent f.i. port number ranges as prefix expressions. Introduce a datatype DTYPE_F_PREFIX flag to indicate that the preferred representation of a range is a prefix and use it for segtree decomposition to decide whether to use a range or prefix expression. The ipaddr, ip6addr, mark and realm datatypes are changed to include the DTYPE_F_PREFIX flag. This fixes completely unreadable output in cases where the ranges are representable as prefixes, f.i. in case of port number: { 0/6 => jump chain1, 0/5 => jump chain2, 0/4 => continue} becomes: { 0-1023 => jump chain1, 1024-2047 => jump chain2, 2048-4095 => continue} Signed-off-by: Patrick McHardy <kaber@trash.net>
| * parser: fix compilation breakagePatrick McHardy2014-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | Commit 0bd59cf4da (parser: fix parsing of ethernet protocol types) broke compilation: src/parser.y:26:22: fatal error: if_ether.h: No such file or directory Should be netinet/if_ether.h. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * expression: fix output of verdict mapsPablo Neira2014-01-161-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | % nft list table filter table ip filter { ... chain output { ... ip saddr map { 1.1.1.1 => accept} } } It displays 'map' instead of 'vmap'. Fix it by checking the mapping type in map_expr_print(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * payload: fix inconsistency in ethertype outputPablo Neira Ayuso2014-01-161-1/+1
| | | | | | | | | | | | Use ip6 instead of ipv6. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * payload: fix crash when wrong ethernet protocol type is usedPablo Neira Ayuso2014-01-161-0/+1
| | | | | | | | | | | | | | | | | | | | nft add rule ip filter output meta protocol xyz counter ^^^ This fix is similar to 4097ad7 ("meta: fix crash when parsing unresolvable mark values"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * parser: fix parsing of ethernet protocol typesPablo Neira Ayuso2014-01-161-0/+29
| | | | | | | | | | | | | | | | | | This allows us to use the protocol type keyword, eg. nft add rule ip filter output meta protocol ip6 counter ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-154-18/+47
|\| | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * expr: relational: don't surpress '==' for LHS binops in outputPatrick McHardy2014-01-151-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch changes the output of relational expressions to not surpress the '==' when the LHS is a binop, f.i. ... meta mark & 0x00000003 0x00000001 becomes ... meta mark & 0x00000003 == 0x00000001 Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink: use stdout for debuggingPablo Neira Ayuso2014-01-151-5/+5
| | | | | | | | | | Suggested-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * segtree: add new segtree debugging optionPablo Neira Ayuso2014-01-152-11/+38
| | | | | | | | | | | | | | | | | | Currently, nft displays the debugging information if it's compiled with --enable-debug (which seems a good idea) and when intervals are used in maps. Add a new option to enable debugging to segtree, so we only get this information when explicitly requested. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge branch 'master' into next-3.14Patrick McHardy2014-01-151-1/+1
|\| | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/payload.c
| * payload: fix name of eth_protoPatrick McHardy2014-01-151-1/+1
| | | | | | | | | | | | It's "ether" now since we've changed the keyword. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge branch 'master' into next-3.14Patrick McHardy2014-01-152-28/+40
|\| | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/meta.c src/parser.y
| * meta: fix mismergePatrick McHardy2014-01-151-2/+0
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * meta: don't require "meta" keyword for a subset of meta expressionsPatrick McHardy2014-01-152-4/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | Don't require the meta keyword for mark, iif, oif, iifname, oifname, skuid, skgid, nftrace, rtclassid and secmark. The protocol and length types still need the meta keyword to avoid grammar conflicts. Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/parser.y
| * expr: remove secmark from ct and meta expressionPatrick McHardy2014-01-154-9/+0
| | | | | | | | | | | | The secctx should be used instead of the secmark. Remove for now. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * scanner: add aliases to symbols for easier interaction with most shellsPablo Neira Ayuso2014-01-151-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | These symbols need to be escaped in bash and if you use them without escaping then, it can lead to confusion. This patch adds nominal aliases, eg. nft add rule filter output meta mark and 0x3 eq 0x1 as an alternative to: nft add rule filter output meta mark \& 0x3 == 0x1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nft: scanner: fixed problem with ipv6 addressAna Rey2014-01-151-25/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a problem with the follow ipv6 address combination: nft add rule ip6 t_ip61 filter-input ip6 saddr ::1234:1234:1234:1234:1234:1234:1234 1234::1234:1234:1234:1234:1234:1234 1234:1234::1234:1234:1234:1234:1234 1234:1234:1234::1234:1234:1234:1234 1234:1234:1234:1234::1234:1234:1234 1234:1234:1234:1234:1234::1234:1234 ::1234:1234:1234:1234:1234:1234 1234::1234:1234:1234:1234:1234 1234:1234::1234:1234:1234:1234 1234:1234:1234::1234:1234:1234 1234:1234:1234:1234::1234:1234 ::1234:1234:1234:1234:1234 1234::1234:1234:1234:1234 1234:1234::1234:1234:1234 1234:1234:1234::1234:1234 ::1234:1234:1234:1234 1234::1234:1234:1234 1234:1234::1234:1234 ::1234:1234:1234 1234::1234:1234 The problem was in the scanner (src/scanner.l). Several brackets were missed and the result was an incorrect interpretation. Fix it by adding some brackets in a regular expression in src/scanner.l Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
| * scanner: rename address selector from 'eth' to 'ether'Pablo Neira Ayuso2014-01-142-3/+3
| | | | | | | | | | | | | | | | | | eth may easily occur when using ifname masks. This could be also fixed by interpreting 'eth' as a simple string in the parser but I think this selector also looks more similar to what we use in tcpdump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | meta: don't require "meta" keyword for a subset of meta expressionsPatrick McHardy2014-01-152-4/+29
| | | | | | | | | | | | | | | | | | | | Don't require the meta keyword for mark, iif, oif, iifname, oifname, skuid, skgid, nftrace, rtclassid and secmark. The protocol and length types still need the meta keyword to avoid grammar conflicts. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | expr: remove secmark from ct and meta expressionPatrick McHardy2014-01-154-9/+0
| | | | | | | | | | | | The secctx should be used instead of the secmark. Remove for now. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-142-1/+3
|\|
| * Revert "parser: replace "vmap" keyword by "map""Patrick McHardy2014-01-142-1/+3
| | | | | | | | | | | | This reverts commit 5e8f8a1807917f92e568437598670b0026462c1c. I missed that this introduces shift-reduce conflicts. Revert for now.
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-144-14/+12
|\|
| * parser: replace "vmap" keyword by "map"Patrick McHardy2014-01-142-3/+1
| | | | | | | | | | | | Consistently use "map" to express mappings. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink: fix wrong type in attributesPablo Neira Ayuso2014-01-102-11/+11
| | | | | | | | | | | | | | | | Fix inconsistent attribute types in meta and cmp expressions, use uint32_t. This problem was added when converting nft to use libmnl and libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-103-7/+7
|\|
| * meta: fix crash when parsing unresolvable mark valuesPatrick McHardy2014-01-101-0/+1
| | | | | | | | | | | | | | *res has undefined contents, set to NULL before invoking the parse function to make sure the test for != NULL doesn't falsely return true. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * datatype: revert "fix crash if wrong integer type is passed"Patrick McHardy2014-01-101-4/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Revert commit a320531e7: We have generic type checks that handle this case just fine and indeed the bugzilla entry mentioned in the reverted patch states: BUG: invalid input descriptor type 538976288 nft: src/erec.c:100: erec_print: Assertion `0' failed. Abandon So the problem is not related to datatypes at all and generic type checking works perfectly fine: <cmdline>:1:52-57: Error: datatype mismatch, expected Ethernet protocol, expression has type Internet protocol add rule ip6 filter input position 4 meta protocol icmpv6 accept ~~~~~~~~~~~~~ ^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
| * erec: fix error markup for errors starting at column 0Patrick McHardy2014-01-101-1/+2
| | | | | | | | | | | | For errors starting at column 0, we must not subtract 1 to avoid underflow. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * nftables: shorten "could not process rule in batch" messagePatrick McHardy2014-01-101-2/+2
| | | | | | | | | | | | | | Remove the "in batch" part, it makes most messages exceed a single line, the user doesn't care about this and we process even single rules in "batches". Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netlink_delinearize: fix compiler warningPatrick McHardy2014-01-091-1/+1
| | | | | | | | | | | | | | | | src/netlink_delinearize.c: In function ‘meta_match_postprocess’: src/netlink_delinearize.c:660:3: warning: passing argument 1 of ‘expr->left->ops->pctx_update’ from incompatible pointer type [enabled by default] src/netlink_delinearize.c:660:3: note: expected ‘struct proto_ctx *’ but argument is of type ‘struct rule_pp_ctx *’ Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-092-7/+13
|\|
| * nftables: fix supression of "permission denied" errorsPatrick McHardy2014-01-092-7/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduction of batch support broke displaying of EPERM since those are generated by the kernel before batch processing starts and thus have the sequence number of the NFNL_MSG_BATCH_BEGIN message instead of the command messages. Also only a single error message is generated for the entire batch. This patch fixes this by noting the batch sequence number and displaying the error for all commands since this is what would happen if the permission check was inside batch processing as every other check. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add l4proto supportPatrick McHardy2014-01-085-0/+48
| | | | | | | | | | | | | | | | | | Add support for the meta l4proto type. This is used in the inet table to match on the transport layer protocol without requiring the network layer protocol to be known, allowing to use transport header matches that apply to both IPv4 and IPv6. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add nfproto supportPatrick McHardy2014-01-086-10/+66
| | | | | | | | | | | | | | | | Add support for the meta nfproto type, which refers to the AF from the netfilter hook ops. This is needed to get the actual family of a packet in the dummy NFPROTO_INET family. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | proto: add support for meta templatesPatrick McHardy2014-01-081-1/+5
| | | | | | | | | | | | | | | | | | The following two patches will add two new meta expression types that are used as dependencies in the inet table. To reuse the existing dependency generation code, add a slightly hackish way to specify meta expressions as payload dependencies. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netlink_delinearize: remove implied meta expressionsPatrick McHardy2014-01-081-6/+23
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | nftables: add support for the "inet" familyPatrick McHardy2014-01-084-0/+9
| | | | | | | | | | | | | | | | | | | | Add support for the mixed IPv4/IPv6 "inet" family. This mainly consist of adding the "inet" <-> NFPROTO_INET mapping in the parser and netlink support functions. Additionally add the definitions for the inet filter table. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | ct expr: protocol context updates and dynamic typingPatrick McHardy2014-01-082-1/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Include the protocols defined through relational ct expressions in the protocol context and use the protocol context to dynamically determine the types of network and transport layer ct expression types. Before: $ nft filter output ct proto-dst ssh <cmdline>:1:28-30: Error: Can't parse symbolic invalid expressions filter output ct proto-dst ssh ^^^ $ nft filter output ip protocol tcp ct proto-dst ssh <cmdline>:1:44-46: Error: Can't parse symbolic invalid expressions filter output ip protocol tcp ct proto-dst ssh ^^^ $ nft filter output ct protocol tcp ct proto-dst ssh <cmdline>:1:44-46: Error: Can't parse symbolic invalid expressions filter output ct protocol tcp ct proto-dst ssh ^^^ After: $ nft filter output ct proto-dst ssh <cmdline>:1:28-30: Error: Can't parse symbolic invalid expressions filter output ct proto-dst ssh ^^^ $ nft filter output ip protocol tcp ct proto-dst ssh $ nft filter output ct protocol tcp ct proto-dst ssh Signed-off-by: Patrick McHardy <kaber@trash.net>