summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* netlink_delinearize: fix binary operation postprocessing with setsPablo Neira Ayuso2021-05-131-0/+1
| | | | | | | | | | | | | | If the right-hand side expression of the binary expression is a set, then, skip the postprocessing step otherwise the tests/py report the following warning: # ./nft-test.py inet/tcp.t inet/tcp.t: WARNING: line 80: 'add rule ip test-ip4 input tcp flags & (syn|fin) == (syn|fin)': 'tcp flags & (fin | syn) == fin | syn' mismatches 'tcp flags ! fin,syn' inet/tcp.t: WARNING: line 83: 'add rule ip test-ip4 input tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack }': 'tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack }' mismatches 'tcp flags ! fin,syn,rst,psh,ack,urg' This listing is not correct. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't crash on set definition with incorrect datatypePablo Neira Ayuso2021-05-111-1/+1
| | | | | | | | | | Cache updates have resurrected the bug described in 5afa5a164ff1 ("evaluate: check for NULL datatype in rhs in lookup expr"). This is triggered by testcases/cache/0008_delete_by_handle_0. Fixes: df48e56e987f ("cache: add hashtable cache for sets") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set element catch-all supportPablo Neira Ayuso2021-05-116-43/+118
| | | | | | | | | | | | | | | | | | | | | | | | | Add a catchall expression (EXPR_SET_ELEM_CATCHALL). Use the asterisk (*) to represent the catch-all set element, e.g. table x { set y { type ipv4_addr counter elements = { 1.2.3.4 counter packets 0 bytes 0, * counter packets 0 bytes 0 } } } Special handling for segtree: zap the catch-all element from the set element list and re-add it after processing. Remove wildcard_expr deadcode in src/parser_bison.y This patch also adds several tests for the tests/py and tests/shell infrastructures. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: add set_elem_key_expr rulePablo Neira Ayuso2021-05-111-2/+8
| | | | | | | Add a rule to specify the set key expression in preparation for the catch-all element support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix range_mask_len() for subnet ranges exceeding unsigned intStefano Brivio2021-05-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | As concatenated ranges are fetched from kernel sets and displayed to the user, range_mask_len() evaluates whether the range is suitable for display as netmask, and in that case it calculates the mask length by right-shifting the endpoints until no set bits are left, but in the existing version the temporary copies of the endpoints are derived by copying their unsigned int representation, which doesn't suffice for IPv6 netmask lengths, in general. PetrB reports that, after inserting a /56 subnet in a concatenated set element, it's listed as a /64 range. In fact, this happens for any IPv6 mask shorter than 64 bits. Fix this issue by simply sourcing the range endpoints provided by the caller and setting the temporary copies with mpz_init_set(), instead of fetching the unsigned int representation. The issue only affects displaying of the masks, setting elements already works as expected. Reported-by: PetrB <petr.boltik@gmail.com> Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1520 Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add cgroupsv2 supportPablo Neira Ayuso2021-05-037-7/+119
| | | | | | Add support for matching on the cgroups version 2. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove object from cache on delete object commandPablo Neira Ayuso2021-05-021-0/+37
| | | | | | Update the cache to remove this object from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove flowtable from cache on delete flowtable commandPablo Neira Ayuso2021-05-022-0/+29
| | | | | | | Update the cache to remove this flowtable from the evaluation phase. Add flowtable_cache_del() function for this purpose. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove set from cache on delete set commandPablo Neira Ayuso2021-05-021-0/+24
| | | | | | Update the cache to remove this set from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove chain from cache on delete chain commandPablo Neira Ayuso2021-05-022-0/+29
| | | | | | | Update the cache to remove this chain from the evaluation phase. Add chain_cache_del() function for this purpose. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for tablePablo Neira Ayuso2021-05-028-111/+168
| | | | | | | | | | | | Add a hashtable for fast table lookups. Tables that reside in the cache use the table->cache_hlist and table->cache_list heads. Table that are created from command line / ruleset are also added to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add object to the cachePablo Neira Ayuso2021-05-021-0/+10
| | | | | | | | | | | If the cache does not contain this object that is defined in this batch, add it to the cache. This allows for references to this new object in the same batch. This patch also adds missing handle_merge() to set the object name, otherwise object name is NULL and obj_cache_find() crashes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: missing table cache for several policy objectsPablo Neira Ayuso2021-05-021-0/+4
| | | | | | Populate the cache with tables for several policy objects types. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add flowtable to the cachePablo Neira Ayuso2021-05-021-0/+3
| | | | | | | | If the cache does not contain this flowtable that is defined in this batch, then add it to the cache. This allows for references to this new flowtable in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add set to the cachePablo Neira Ayuso2021-05-021-0/+4
| | | | | | | | If the cache does not contain the set that is defined in this batch, add it to the cache. This allows for references to this new set in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add set_cache_del() and use itPablo Neira Ayuso2021-05-022-1/+6
| | | | | | | | Update set_cache_del() from the monitor path to remove sets in the cache. Fixes: df48e56e987f ("cache: add hashtable cache for sets") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for flowtablePablo Neira Ayuso2021-05-025-31/+104
| | | | | | | | | | Add flowtable hashtable cache. Actually I am not expecting that many flowtables to benefit from the hashtable to be created by streamline this code with tables, chains, sets and policy objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for objectPablo Neira Ayuso2021-05-026-52/+117
| | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for object lookups. This patch also splits table->objs in two: - Sets that reside in the cache are stored in the new tables->cache_obj and tables->cache_obj_ht. - Set that defined via command line / ruleset file reside in tables->obj. Sets in the cache (already in the kernel) are not placed in the table->objs list. By keeping separated lists, objs defined via command line / ruleset file can be added to cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate object cache infrastructurePablo Neira Ayuso2021-05-023-42/+56
| | | | | | | This patch consolidates the object cache infrastructure. Update set and chains to use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate nft_cache infrastructurePablo Neira Ayuso2021-05-024-24/+25
| | | | | | | | - prepend nft_ prefix to nft_cache API and internal functions - move declarations to cache.h (and remove redundant declarations) - move struct nft_cache definition to cache.h Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass chain name to chain_cache_find()Pablo Neira Ayuso2021-05-024-12/+11
| | | | | | | | You can identify chains through the unique handle in deletions, update this interface to take a string instead of the handle to prepare for the introduction of 64-bit handle chain lookups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: skip fuzzy lookup for unexisting 64-bit handlePablo Neira Ayuso2021-05-021-0/+15
| | | | | | | | Deletion by handle, if incorrect, should not exercise the misspell lookup functions. Fixes: 3a0e07106f66 ("src: combine extended netlink error reporting with mispelling support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: unbreak deletion by table handlePablo Neira Ayuso2021-05-022-1/+4
| | | | | | | | | Use NFTA_TABLE_HANDLE instead of NFTA_TABLE_NAME to refer to the table 64-bit unique handle. Fixes: 7840b9224d5b ("evaluate: remove table from cache on delete table") Fixes: f8aec603aa7e ("src: initial extended netlink error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing relational operation on flag listPablo Neira Ayuso2021-05-021-0/+4
| | | | | | | | | | | | | | | Complete e6c32b2fa0b8 ("src: add negation match on singleton bitmask value") which was missing comma-separated list of flags. This patch provides a shortcut for: tcp flags and fin,rst == 0 which allows to check for the packet whose fin and rst bits are unset: # nft add rule x y tcp flags not fin,rst counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow to load stateful ct connlimit elements in setsLaura Garcia Liebana2021-05-021-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a syntax error after loading a nft dump with a set including stateful ct connlimit elements. Having a nft dump as per below: table ip nftlb { set connlimit-set { type ipv4_addr size 65535 flags dynamic elements = { 84.245.120.167 ct count over 20 , 86.111.207.45 ct count over 20 , 173.212.220.26 ct count over 20 , 200.153.13.235 ct count over 20 } } } The syntax error is shown when loading the ruleset. root# nft -f connlimit.nft connlimit.nft:15997:31-32: Error: syntax error, unexpected ct, expecting comma or '}' elements = { 84.245.120.167 ct count over 20 , 86.111.207.45 ct count over 20 , ^^ connlimit.nft:16000:9-22: Error: syntax error, unexpected string 173.212.220.26 ct count over 20 , 200.153.13.235 ct count over 20 } ^^^^^^^^^^^^^^ After applying this patch a kernel panic is raised running nft_rhash_gc() although no packet reaches the set. The following patch [0] should be used as well: 4d8f9065830e5 ("netfilter: nftables: clone set element expression template") Note that the kernel patch will produce the emptying of the connection tracking, so the restore of the conntrack states should be considered. [0]: https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/?id=4d8f9065830e526c83199186c5f56a6514f457d2 Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if nat statement map specifies a transport header exprFlorian Westphal2021-04-291-1/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | Importing the systemd nat table fails: table ip io.systemd.nat { map map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service elements = { tcp . 8088 : 192.168.162.117 . 80 } } chain prerouting { type nat hook prerouting priority dstnat + 1; policy accept; fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } } ruleset:9:48-59: Error: transport protocol mapping is only valid after transport protocol match To resolve this (no transport header base specified), check if the map itself contains a network base protocol expression. This allows nft to import the ruleset. Import still fails with same error if 'inet_service' is removed from the map, as it should. Reported-by: Henning Reich <henning.reich@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: Increase BATCH_PAGE_SIZE to support huge rulesetsPhil Sutter2021-04-211-4/+4
| | | | | | | Apply the same change from iptables-nft to nftables to keep them in sync with regards to max supported transaction sizes. Signed-off-by: Phil Sutter <phil@nwl.cc>
* cache: bail out if chain list cannot be fetched from kernelPablo Neira Ayuso2021-04-031-1/+1
| | | | | | Do not report success if chain cache list cannot be built. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for setsPablo Neira Ayuso2021-04-037-72/+122
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for set lookups. This patch also splits table->sets in two: - Sets that reside in the cache are stored in the new tables->cache_set and tables->cache_set_ht. - Set that defined via command line / ruleset file reside in tables->set. Sets in the cache (already in the kernel) are not placed in the table->sets list. By keeping separated lists, sets defined via command line / ruleset file can be added to cache. Adding 10000 sets, before: # time nft -f x real 0m6,415s user 0m3,126s sys 0m3,284s After: # time nft -f x real 0m3,949s user 0m0,743s sys 0m3,205s Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: check for NULL chain in cache_init()Pablo Neira Ayuso2021-04-031-0/+5
| | | | | | | | | | | | | Another process might race to add chains after chain_cache_init(). The generation check does not help since it comes after cache_init(). NLM_F_DUMP_INTR only guarantees consistency within one single netlink dump operation, so it does not help either (cache population requires several netlink dump commands). Let's be safe and do not assume the chain exists in the cache when populating the rule cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: statify chain_cache_dump()Pablo Neira Ayuso2021-04-031-1/+2
| | | | | | Only used internally in cache.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use chain hashtable for lookupsPablo Neira Ayuso2021-04-033-17/+6
| | | | | | | | | | | | | | | | | | | | | Instead of the linear list lookup. Before this patch: real 0m21,735s user 0m20,329s sys 0m1,384s After: real 0m10,910s user 0m9,448s sys 0m1,434s chain_lookup() is removed since linear list lookups are only used by the fuzzy chain name matching for error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: split chain list in tablePablo Neira Ayuso2021-04-033-13/+17
| | | | | | | | | | | | | | | | | | | This patch splits table->lists in two: - Chains that reside in the cache are stored in the new tables->cache_chain and tables->cache_chain_ht. The hashtable chain cache allows for fast chain lookups. - Chains that defined via command line / ruleset file reside in tables->chains. Note that chains in the cache (already in the kernel) are not placed in the table->chains. By keeping separated lists, chains defined via command line / ruleset file can be added to cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: rename chain_htable to cache_chain_htPablo Neira Ayuso2021-04-032-6/+6
| | | | | | Rename the hashtable chain that is used for fast cache lookups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: replace vlan ether type with 8021qFlorian Westphal2021-04-032-1/+5
| | | | | | | | | | | | | Previous patches added "8021ad" mnemonic for IEEE 802.1AD frame type. This adds the 8021q shorthand for the existing 'vlan' frame type. nft will continue to recognize 'ether type vlan', but listing will now print 8021q. Adjust all test cases accordingly. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: be careful on vlan dependency removalFlorian Westphal2021-04-031-3/+26
| | | | | | | 'vlan ...' implies 8021Q frame. In case the expression tests something else (802.1AD for example) its not an implictly added one, so keep it. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: add 8021ad as mnemonic for IEEE 802.1AD (0x88a8) ether typeFlorian Westphal2021-04-032-0/+2
| | | | | Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: vlan: allow matching vlan id insider 802.1ad frameFlorian Westphal2021-04-031-0/+3
| | | | | | | | | This makes "ether type 0x88a8 vlan id 342" work. Before this change, nft would still insert a dependency on 802.1q so the rule would never match. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: don't crash when set elements are not evaluated as expectedFlorian Westphal2021-04-012-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | define foo = 2001:db8:123::/48 table inet filter { set foo { typeof ip6 saddr elements = $foo } } gives crash. This now exits with: stdin:1:14-30: Error: Unexpected initial set type prefix define foo = 2001:db8:123::/48 ^^^^^^^^^^^^^^^^^ For literals, bison parser protects us, as it enforces 'elements = { 2001:... '. For 'elements = $foo' we can't detect it at parsing stage as the '$foo' symbol might as well evaluate to "{ 2001, ...}" (i.e. we can't do a set element allocation). So at least detect this from set instantiaton. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: simplify flowtable offload flag parserPablo Neira Ayuso2021-03-311-7/+4
| | | | | | Remove ft_flags_spec rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: do not set flowtable flags twicePablo Neira Ayuso2021-03-311-5/+0
| | | | | | | | Flags are already set on from mnl_nft_flowtable_add(), remove duplicated code. Fixes: e6cc9f37385 ("nftables: add flags offload to flowtable") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove semicolon in flowtable offloadPablo Neira Ayuso2021-03-251-1/+1
| | | | | | opts->stmt_separator already prints the semicolon when needed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix scope closure of COUNTER tokenFlorian Westphal2021-03-251-3/+3
| | | | | | | | | It is closed after allocation, which is too early: this stopped 'packets' and 'bytes' from getting parsed correctly. Also add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add datatype->describe()Pablo Neira Ayuso2021-03-252-0/+17
| | | | | | | | | | | | As an alternative to print the datatype values when no symbol table is available. Use it to print protocols available via getprotobynumber() which actually refers to /etc/protocols. Not very efficient, getprotobynumber() causes a series of open()/close() calls on /etc/protocols, but this is called from a non-critical path. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1503 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: add flags offload to flowtableFrank Wunderlich2021-03-254-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | allow flags (currently only offload) in flowtables like it is stated here: https://lwn.net/Articles/804384/ tested on mt7622/Bananapi-R64 table ip filter { flowtable f { hook ingress priority filter + 1 devices = { lan3, lan0, wan } flags offload; } chain forward { type filter hook forward priority filter; policy accept; ip protocol { tcp, udp } flow add @f } } table ip nat { chain post { type nat hook postrouting priority filter; policy accept; oifname "wan" masquerade } } Signed-off-by: Frank Wunderlich <frank-w@public-files.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: release single element already contained in an intervalPablo Neira Ayuso2021-03-241-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | Before this patch: table ip x { chain y { ip saddr { 1.1.1.1-1.1.1.2, 1.1.1.1 } } } results in: table ip x { chain y { ip saddr { 1.1.1.1 } } } due to incorrect interval merge logic. If the element 1.1.1.1 is already contained in an existing interval 1.1.1.1-1.1.1.2, release it. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1512 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add missing scope_close annotation for RT keywordFlorian Westphal2021-03-241-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* scanner: log: move to own scopeFlorian Westphal2021-03-242-5/+11
| | | | | | | GROUP and PREFIX are used by igmp and nat, so they can't be moved out of INITIAL scope yet. Signed-off-by: Florian Westphal <fw@strlen.de>
* scanner: counter: move to own scopeFlorian Westphal2021-03-242-18/+20
| | | | | | move bytes/packets away from initial state. Signed-off-by: Florian Westphal <fw@strlen.de>
* scanner: add support for scope nestingFlorian Westphal2021-03-241-1/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adding a COUNTER scope introduces parsing errors. Example: add rule ... counter ip saddr 1.2.3.4 This is supposed to be COUNTER IP SADDR SYMBOL but it will be parsed as COUNTER IP STRING SYMBOL ... and rule fails with unknown saddr. This is because IP state change gets popped right after it was pushed. bison parser invokes scanner_pop_start_cond() helper via 'close_scope_counter' rule after it has processed the entire 'counter' rule. But that happens *after* flex has executed the 'IP' rule. IOW, the sequence of events is not the exepcted "COUNTER close_scope_counter IP SADDR SYMBOL close_scope_ip", it is "COUNTER IP close_scope_counter". close_scope_counter pops the just-pushed SCANSTATE_IP and returns the scanner to SCANSTATE_COUNTER, so next input token (saddr) gets parsed as a string, which gets then rejected from bison. To resolve this, defer the pop operation until the current state is done. scanner_pop_start_cond() already gets the scope that it has been completed as an argument, so we can compare it to the active state. If those are not the same, just defer the pop operation until the bison reports its done with the active flex scope. This leads to following sequence of events: 1. flex switches to SCANSTATE_COUNTER 2. flex switches to SCANSTATE_IP 3. bison calls scanner_pop_start_cond(SCANSTATE_COUNTER) 4. flex remains in SCANSTATE_IP, bison continues 5. bison calls scanner_pop_start_cond(SCANSTATE_IP) once the entire ip rule has completed: this pops both IP and COUNTER. Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-01 05:22:31 +0000