summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* main: display errors through stderrPablo Neira Ayuso2015-03-021-1/+1
| | | | | Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1000 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix object order via nft -fPablo Neira Ayuso2015-02-181-2/+7
| | | | | | | | | | | | | | | | | | The objects need to be loaded in the following order: #1 tables #2 chains #3 sets #4 rules We have to make sure that chains are in place by when we add rules with jumps/gotos. Similarly, we have to make sure that the sets are in place by when rules reference them. Without this patch, you may hit ENOENT errors depending on your ruleset configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: register pkttype_type datatypePablo Neira Ayuso2015-02-011-0/+1
| | | | | Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=995 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use stmt_evaluate_arg() in all casesPatrick McHardy2015-01-121-4/+3
| | | | | | | | | When using a symbolic vmap expression, we fail to verify that the map actually contains verdicts. Use stmt_evaluate_arg() everywhere to fix this. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: check that map expressions' datatype matches mappingsPatrick McHardy2015-01-121-0/+7
| | | | | | | | | | | | Catch type errors in map expressions using named maps: # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set tcp dport map @test <cmdline>:1:38-42: Error: datatype mismatch, map expects IPv4 address, mapping expression has type internet network service filter output mark set tcp dport map @test ~~~~~~~~~ ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: properly set datatype of map expressionPatrick McHardy2015-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | The datatype of the map expression is the datatype of the mappings. # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set ip daddr map @test Before: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type IPv4 address filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type internet network service filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: verify named map is actually a mapPatrick McHardy2015-01-121-1/+2
| | | | | | | | | | | | | | | | | | | # nft add set filter test { type ipv4_addr; } # nft filter input ip daddr vmap @test Before: <cmdline>:0:0-32: Error: Could not process rule: Invalid argument filter input ip daddr vmap @test ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:28-32: Error: Expression is not a map filter input ip daddr vmap @test ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: don't print meta keyword for unqualified meta stmtsPatrick McHardy2015-01-121-7/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: clean up unused variables (pctx)Alvaro Neira Ayuso2015-01-121-3/+0
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: fix crash when listing non-verdict mappingsPatrick McHardy2015-01-121-0/+6
| | | | | | | | | | | | | | | | Fix regression introduced by commit 87c2a2205: netlink_delinearize: clone on netlink_get_register(), release previous on _set() When using a non-verdict mapping, the set ref expression is assigned to the destination register. The next get_register() will attempt to clone it and crash because of the missing ->clone() callback. # nft filter input meta mark set ip daddr map { 192.168.0.1 : 123 } # nft list table filter Segmentation fault (core dumped) Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: remove unused set_clone() functionPatrick McHardy2015-01-121-18/+0
| | | | | | | | The set_clone() function was added by the event monitor patchset and is unused. It is also broken since it simply initializes the list head to the list of the original set, so remove it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: properly fix handling of large integer valuesPatrick McHardy2015-01-112-16/+3
| | | | | | | | | | | | | | | Introduction of the ERROR symbol is an ugly hack. There's no reason to special case large integer values, the NUM token only exists for small values that are needed immediately, everything else is passed as EXPR_SYMBOL to evaluation anyways. Additionally the error reporting is different from what we'd usually report, the token is easy to confuse with the bison internal error token and it even has a name, messing up bison internal diagnostics. Simply return values to large to be handled by strtoull as STRING. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_linearize: add register dumping helper functionPatrick McHardy2015-01-111-34/+40
| | | | | | | Add a helper function to dump netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: add register parsing helper functionPatrick McHardy2015-01-111-20/+26
| | | | | | | Add a helper function to parse netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* concat: add concat subtype lookup/id helpersPatrick McHardy2015-01-113-10/+6
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: cleanup hard to read codePatrick McHardy2015-01-111-60/+79
| | | | | | | | | | | The netlink parsing code is full of long function calls spawning multiple lines and in some cases parses netlink attributes multiple times. Use local variables for the registers and other data required to reconstruct the expressions and statements and reorder the code in some cases to move related processing next to each other. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: rename netlink_parse_*_sreg/dreg functionsPatrick McHardy2015-01-111-8/+8
| | | | | | These are really badly chosen names, use parse_expr and parse_stmt instead. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: readability fixesPatrick McHardy2015-01-111-56/+71
| | | | | | | | | Improve readability by using local variables for netlink attributes, ordering variables more logically, don't arbitrarily initialize some variables in the definition section and in the body and generally make similar functions look similar. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-24/+15
| | | | | | | | | Remove style discrepancies between different netlink I/O functions: - we don't use brackets for single line statements - most functions don't have a newline between error reporting and exit Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-12/+18
| | | | | | We include an empty line between variable definitions and code. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: remove unnecessary temporary variablePatrick McHardy2015-01-111-54/+18
| | | | | | | Waste less space and return the results of the batch/compat functions directly. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix memory leaksPatrick McHardy2015-01-112-1/+6
| | | | | | | Fix two memory leaks in netlink event monitor. Also fix a leak related to all sets, the ->init expression is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: fix error handling for invalid registersPatrick McHardy2015-01-101-1/+4
| | | | | | | | | | | netlink_delinearize is prepared to deal with malformed expressions from the kernel that it doesn't understand. However since expressions are now cloned unconditionally by netlink_get_register(), we crash before such errors can be detected for invalid inputs. Fix by only cloning non-NULL expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: add missing datatype compat checks for statement argumentsPatrick McHardy2015-01-101-23/+43
| | | | | | | | | | | | | | Add a helper function to evaluate expressions used as arguments for statements and report datatype mismatches. Fixes acceptance of mismatching expressions like: $ nft filter output meta mark set ip daddr <cmdline>:1:29-36: Error: datatype mismatch: expected packet mark. expression has type IPv4 address filter output meta mark set ip daddr ~~~~~~~~~~~~~~^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* eval: refactor NAT evaluation functionsPatrick McHardy2015-01-101-56/+54
| | | | | | | | | | The redir and masq evaluation functions include some useless context updates and checks. Refactor the NAT code to have a single instance of address and transport evaluation functions for simplicity and unified error reporting. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: modify pr_debug() to use printf and introduce to pr_gmp_debug()Pablo Neira Ayuso2015-01-081-11/+11
| | | | | | | | | | | | | Modify pr_debug() to use printf so we get debugging traces for proto-ctx when --with-mini-gmp is enabled. Add pr_gmp_debug(), this is disabled with --with-mini-gmp since it relies on the gmp_printf(), which is not available in the mini-gmp implementation. Suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wno-sign-compare to avoid compilation warning in mini-gmp.cPablo Neira Ayuso2015-01-081-0/+2
| | | | | | | | | | | | | | | | CC mini-gmp.o mini-gmp.c: In function ‘mpn_get_str_bits’: mini-gmp.c:1176:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_and’: mini-gmp.c:3650:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_ior’: mini-gmp.c:3723:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_xor’: mini-gmp.c:3792:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_set_str’: mini-gmp.c:4167:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add --with-mini-gmp switch to disable linking libgmpSteven Barth2015-01-083-2/+4446
| | | | | | | | | | This allows to disable linking the >400 KB big libgmp and replace it with the builtin mini-gmp which only increases size by ~30KB. Enabling this selectively decreases debugging verbosity (pr_debug). Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: use stdio vasprintf instead of gmp_vasprintfSteven Barth2015-01-072-3/+11
| | | | | | | | | Use stdio's vasprintf instead of gmp_vasprintf which is not part of the mini-gmp function subset. Furthermore convert the only gmp-specific user and allow the compiler to verify format-strings. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: use mpz_set_str instead of gmp_sscanfSteven Barth2015-01-071-3/+1
| | | | | | | | This simplifies the integer parsing logic and restricts it to functions being part of the mini-gmp subset. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: rename VERSION token to HDRVERSIONSteven Barth2015-01-072-4/+4
| | | | | | | | | A token name of VERSION results in a macro being defined with the same name. This prevents inclusion of config.h in commonly used headers. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix dependency generation from nft -fPablo Neira Ayuso2015-01-061-1/+2
| | | | | | | | | | | | | | | When nft -f is used, ctx->cmd points to the table object, which contains the corresponding chain, set and rule lists. The reject statement evaluator relies on ctx->cmd->rule to add the payload dependencies, which is doesn't point to the rule in that case. This patch adds the rule context to the eval_ctx structure to update the rule list of statements when generating dependencies, as the reject statement needs. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=993 Reported-by: Ting-Wei Lan <lantw44@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: assert when accessing inner transport headerPablo Neira Ayuso2015-01-041-0/+1
| | | | | | | | | | Instead of segfaulting due to out of bound access access to protocol context array ctx->protocol[base].location from proto_ctx_update(). # nft add rule filter input ah nexthdr tcp nft: payload.c:88: payload_expr_pctx_update: Assertion `left->payload.base + 1 <= (__PROTO_BASE_MAX - 1)' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: alloc specifying concat types in set declarationsPatrick McHardy2014-12-162-22/+43
| | | | | | | | | | | | Support specification of concat types in set declarations: add set filter test { type ipv4_addr . inet_service } Netlink delinearization is changed to reconstruct the type from the id. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: change concat_type_alloc() to construct type from idPatrick McHardy2014-12-162-14/+18
| | | | | | | The kernel only stored the id so we need to be able to reconstruct the datatype from the id only. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add define for maximum number of bits and mask of datatype idPatrick McHardy2014-12-162-2/+3
| | | | | | | | | | | | | | | | | The id of concat datatypes is composed of the ids of the individual datatypes. Add a define for the number of bits for each datatype id and a mask. The number of bits is chosen as 6, allowing for 63 datatypes, or twice as much as we currently have. This allows for concatenations of 5 types using 32 bits. The value is statically chosen instead of basing it on the current numbers of datatypes since we don't want the maximum concatenation size to vary between versions, also new versions are supposed to be able to propery parse a ruleset generated by an older version. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add new subtypes field to account number of concat data typesPatrick McHardy2014-12-162-5/+9
| | | | | | | | Using the size is confusing since it usually holds the size of the data. Add a new "subtypes" member, which holds the number of datatypes the concat type is made of. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: generate name for concat typesPatrick McHardy2014-12-161-1/+7
| | | | | | | The name of a concat type is the names of the individual types concatenated using a '.'. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: missing byteorder in string_typePablo Neira Ayuso2014-12-151-0/+1
| | | | | | | | | | | | | | nft add rule filter input iifname { "lo", "eth0" } counter Now the listing shows: iifname { "lo", "eth0"} instead of: iifname { "", ""} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: restore --disable-debugPablo Neira Ayuso2014-12-151-1/+4
| | | | | | | | Fix fallout from the automake conversion. Display after configuration if it is enabled or not. Reported-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: use 'redirect to PORT' instead of 'redirect :PORT'Pablo Neira Ayuso2014-12-123-3/+5
| | | | | | Small syntax update suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: print datatype name in datatype_print() BUG messagePatrick McHardy2014-12-111-1/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* dtype: fix memory leak in concat_type_destroy()Patrick McHardy2014-12-111-1/+3
| | | | | | Free allocated memory for ->desc. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: properly align types in meta_template tablePatrick McHardy2014-12-111-5/+5
| | | | | | | Don't use arbitrary amounts of spaces. The remaining table is properly aligned, fix the new types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* stmt: rename nat "random-fully" option to "fully-random"Patrick McHardy2014-12-113-4/+4
| | | | | | Use proper english for full randomization option. Signed-off-by: Patrick McHardy
* dtype: remove unnecessary icmp* parse/print functionsPatrick McHardy2014-12-101-39/+3
| | | | | | Just setting the .sym_tbl correctly is all we need. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix segmentation faults on kernels without nftables supportPablo Neira Ayuso2014-12-091-3/+4
| | | | | | | | | | | | | | | | # nft list sets Segmentation fault # nft list sets <cmdline>:1:1-9: Error: Could not receive sets from kernel: Protocol error list sets ^^^^^^^^^ Fix same bug in `nft list tables'. Don't cleanup the table object for these commands since it is NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix listing of range set elements in host byteorderPablo Neira Ayuso2014-12-091-1/+3
| | | | | | | | | | | We have to switch the byteorder of the element in netlink_delinearize_setelem() for non-range values only. This fixes the listing of: nft add rule filter input ct mark { 0x10-0x20 } counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix listing of set members in host byteorder using ↵Pablo Neira Ayuso2014-12-091-0/+29
| | | | | | | | | | integer_type nft list table filter ... cpu { 50331648, 33554432, 0, 16777216} counter packets 8 bytes 344 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: generate set members using integer_type in the appropriate byteorderPablo Neira Ayuso2014-12-091-1/+3
| | | | | | | | | | | | | | | | Rules with header fields that rely on the generic integer datatype from sets are not matching, eg. nft add rule filter input udp length { 9 } counter This set member is an integer represented in host byte order, which obviously doesn't match the header field (in network byte order). Since the integer datatype has no specific byteorder, we have to rely on the expression byteorder instead when configuring the context, before we evaluate the list of set members. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 15:22:28 +0000