summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* rule: `list sets' only displays declaration, not definitionPablo Neira Ayuso2015-10-121-3/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft list sets table ip nat { set libssh { type ipv4_addr } } table inet filter { set set0 { type inet_service flags constant } set set1 { type inet_service flags constant } set set2 { type icmpv6_type flags constant } } So in case you want to inspect the definition, you have to use `list set' and the specific set that you want to inspect: # nft list set inet filter set0 table inet filter { set set0 { type inet_service flags constant elements = { 2200, ssh} } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* evaluate: check if set exists before listing itPablo Neira Ayuso2015-10-121-1/+11
| | | | | | | | | | | | | | After this patch, we obtain: # nft list set ip6 test pepe <cmdline>:1:1-22: Error: Could not process rule: Set 'foo' does not exist list set ip6 test foo ^^^^^^^^^^^^^^^^^^^^^ So we get things aligned with table and chain listing commands. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: display table when listing one setPablo Neira Ayuso2015-10-121-3/+11
| | | | | | | | | | | | | | | | | | | | | After: # nft list set ip6 test foo table ip6 test { set foo { type ipv4_addr } } Before: # nft list set ip6 test foo set foo { type ipv4_addr } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: add `list chains' commandPablo Neira Ayuso2015-10-123-3/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft list chains table ip filter { chain test1 { } chain test2 { } chain input { type filter hook input priority 0; policy accept; } } table ip6 filter { chain test1 { } chain input { type filter hook input priority 0; policy accept; } } You can also filter out per family: # nft list chains ip table ip x { chain y { } chain xz { } chain input { type filter hook input priority 0; policy accept; } } # nft list chains ip6 table ip6 filter { chain x { } chain input { type filter hook input priority 0; policy accept; } } This command only shows the chain declarations, so the content (the definition) is omitted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: display table when listing setsPablo Neira Ayuso2015-10-121-0/+10
| | | | | | | | | | | | | | | | | | | | | After this patch: # nft list sets ip table ip test { set pepe { type ipv4_addr } } Before: # nft list sets ip set pepe { type ipv4_addr } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: fix printing of rule commentsArturo Borrero Gonzalez2015-10-081-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several fixes: * handles are printed last * simplify space games (an extra space was being printed) * comments are shown with `nft monitor' as well (missing before this patch) Before this patch: % nft list ruleset -a [...] chain test { iifname eth0 # handle 1 comment "test" } [...] % nft list ruleset [...] chain test { iifname eth0 comment "test" ^^ } [...] % nft monitor & % nft add rule test test iifname eth0 comment "test" add rule test test iifname eth0 After this patch: % nft list ruleset -a chain test { iifname eth0 comment "test" # handle 1 ^ } % nft monitor -a & % nft add rule test test iifname eth0 comment "test" add rule test test iifname eth0 comment "test" # handle 1 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: provide clone operation for set element opsFlorian Westphal2015-10-061-0/+10
| | | | | | | | | | | | | | | | define addrs={ 1.2.3.4 } table ip filter { chain input { type filter hook input priority 0; ip saddr $addrs accept } } segfaults. Using saddr { 1.2.3.4 } instead of $addrs works. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801087 Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add dup statement supportPablo Neira Ayuso2015-09-307-3/+175
| | | | | | | | | | This allows you to clone packets to destination address, eg. ... dup to 172.20.0.2 ... dup to 172.20.0.2 device eth1 ... dup to ip saddr map { 192.168.0.2 : 172.20.0.2, ... } device eth1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: show all tables via list tables with no familyPablo Neira Ayuso2015-09-231-1/+1
| | | | | | | | | | | | | | | | | Default to the same behaviour that we get through `list ruleset', ie. # nft list tables table ip filter table ip6 filter # nft list tables ip table ip filter # nft list tables ip6 table ip6 filter Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1033 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: filter out tables depending on familyPablo Neira Ayuso2015-09-231-1/+6
| | | | | | | | | | | # nft list tables ip table ip filter # nft list tables ip6 table ip6 filter Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1033 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add burst parameter to limitPablo Neira Ayuso2015-09-236-5/+39
| | | | | | | | | | | ... limit rate 1024 mbytes/second burst 10240 bytes ... limit rate 1/second burst 3 packets This parameter is optional. You need a Linux kernel >= 4.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add per-bytes limitPablo Neira Ayuso2015-09-235-2/+115
| | | | | | | | | | This example show how to accept packets below the ratelimit: ... limit rate 1024 mbytes/second counter accept You need a Linux kernel >= 4.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* vlan: make != tests workFlorian Westphal2015-09-181-0/+1
|
* nft: support listing expressions that use non-byte header fieldsFlorian Westphal2015-09-183-13/+156
| | | | | | | This allows to list rules that check fields that are not aligned on byte boundary. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: cmp: shift rhs constant if lhs offset doesn't start on byte boundaryFlorian Westphal2015-09-181-0/+10
| | | | | | | | | | | | | | if we have payload(someoffset) == 42, then shift 42 in case someoffset doesn't start on a byte boundary. We already insert a mask instruction to only load those bits into the register that we were interested in, but the cmp will fail without also adjusting rhs accordingly. Needs additional patch in reverse direction to undo the shift again when dumping ruleset. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fill in doff and fix ihl/version template entriesFlorian Westphal2015-09-181-4/+6
| | | | | | | | | | | | This allows to use nft add rule ip filter input tcp doff 8 or similar. Furhermore, ip version looked at hdrlen and vice versa. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: netlink: don't truncate set key lengthsFlorian Westphal2015-09-181-2/+2
| | | | | | | If key is e.g. 12 bits, pretend its 16 instead of 8. This is needed to make sets work with header fields with size not divisible by 8. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: netlink_linearize: handle sub-byte lengthsFlorian Westphal2015-09-181-2/+44
| | | | | | | | | | | | | | Currently length is expr->len / BITS_PER_BYTE, i.e. expr->len has to be a multiple of 8. When core asks for e.g. '9 bits', we truncate this to 8. Round up to 16 and inject a 9-bit mask to zero out the parts we're not interested in. This will also need change to the delinarization step to remove the extra op when dumping rules from kernel. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: disable payload merge if offsets are not on byte boundary.Florian Westphal2015-09-181-0/+4
| | | | | | | | | | | | | | | | | | ... because it doesn't work, we attempt to merge it into wrong place, we would have to merge the second value at a specific location. F.e. vlan hdr 4094 gives us 0xfe0f Merging in the CFI should yield 0xfe1f, but the constant merging doesn't know how to achive that; at the moment 'vlan id 4094' and 'vlan id 4094 vlan cfi 1' give same result -- 0xfe0f. For now just turn off the optimization step unless everything is byte divisible (the common case). Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: allow stacking vlan header on top of ethernetFlorian Westphal2015-09-183-10/+117
| | | | | | | | | | | | | | | | | | | | currently 'vlan id 42' or even 'vlan type ip' doesn't work since we expect ethernet header but get vlan. So if we want to add another protocol header to the same base, we attempt to figure out if the new header can fit on top of the existing one (i.e. proto_find_num gives a protocol number when asking to find link between the two). We also annotate protocol description for eth and vlan with the full header size and track the offset from the current base. Otherwise, 'vlan type ip' fetches the protocol field from mac header offset 0, which is some mac address. Instead, we must consider full size of ethernet header. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: use new symbols in libnftnlPablo Neira Ayuso2015-09-166-834/+834
| | | | | | | | | Adapt the nftables code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use existing table object from evaluation contextPablo Neira Ayuso2015-09-111-4/+18
| | | | | | | | | | | | | Skip table object lookup if we are in the context of table declaration already, ctx->table already points to the right table we have to use during the evalution. Otherwise, a list corruption occurs when using the wrong table object when it already exists in the kernel. http://marc.info/?l=netfilter-devel&m=144179814209295&w=2 Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* mnl: rework netlink socket receive path for eventsPablo Neira Ayuso2015-09-071-1/+37
| | | | | | | | | | | | | This patch reworks two aspects of the netlink socket event receive path: 1) In case of ENOBUFS, stay in the loop to keep receiving messages. The tool displays a message so the user knows that we got lost event messages. 2) Rise the default size of the receive socket buffer up to 16 MBytes to reduce chances of hitting ENOBUFS. Asumming that the netlink event message size is ~150 bytes, we can bear with ~111848 rules without message loss. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: flush stdout after each event in monitor modePablo Neira Ayuso2015-09-071-0/+1
| | | | | | | | So we get all events when redirecting them to file, ie. # nftables monitor > file Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix build with debug offFlorian Westphal2015-09-071-1/+1
| | | | | | mnl.c:241:1: error: expected identifier or '(' before '}' token Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: don't call netlink_dump_*() from listing functions with --debug=netlinkPablo Neira Ayuso2015-08-181-4/+0
| | | | | | | | | | Now that we always retrieve the object list to build a cache before executing the command, this results in fully listing of existing objects in the kernel. This is confusing when adding a simple rule, so better not to call netlink_dump_*() from listing functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: display error on unexisting chain when listingPablo Neira Ayuso2015-08-181-1/+11
| | | | | | | | | nft list chain ip test output <cmdline>:1:1-25: Error: Could not process rule: Chain 'output' does not exist list chain ip test output ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of EINTR handling for nft_netlink()Pablo Neira Ayuso2015-08-182-9/+6
| | | | | | | | | The only remaining caller that needs this is netlink_dump_ruleset(), that is used to export the ruleset using markup representation. We can remove it and handle this from do_command_export() now that we have a centralized point to build up the object cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set element objectsPablo Neira Ayuso2015-08-181-25/+11
| | | | | | Populate the cache iff the user requests a ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for rule objectsPablo Neira Ayuso2015-08-181-10/+12
| | | | | | Populate the cache iff the user requests a ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain declarations to cachePablo Neira Ayuso2015-08-181-2/+18
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add cmd_evaluate_rename()Pablo Neira Ayuso2015-08-181-0/+22
| | | | | | | Make sure the table that we want to rename already exist. This is required by the follow up patch that that adds chains to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for chain objectsPablo Neira Ayuso2015-08-181-39/+16
| | | | | | The chain list is obtained if the user requests a listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add chain reference counterPablo Neira Ayuso2015-08-181-0/+9
| | | | | | | When adding declared chains to the cache, we may hold more than one single reference from struct cmd and the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: early allocation of the set IDPablo Neira Ayuso2015-08-182-4/+4
| | | | | | | By when the set is created, so element in the batch use this set ID as reference. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set declaration to cachePablo Neira Ayuso2015-08-181-0/+9
| | | | | | | This patch adds set objects to the cache if they don't exist in the kernel, so they can be referenced from this batch. This occurs from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set objectsPablo Neira Ayuso2015-08-182-86/+79
| | | | | | | | | | | | | | | | This patch populates the cache only once through netlink_list_sets() during evaluation. As a result, there is a single call to netlink_list_sets(). After this change, we can rid of get_set(). This function was fine by the time we had no transaction support, but this doesn't work for set objects that are declared in this batch, so inquiring the kernel doesn't help since they are not yet available. As a result from this update, the monitor code gets simplified quite a lot since it can rely of the set cache. Moreover, we can now validate that the table and set exists from evaluation path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table declaration to cachePablo Neira Ayuso2015-08-182-15/+15
| | | | | | | | | | Add declared table objects to the cache, thus we can refer to objects that come in this batch but that are not yet available in the kernel. This happens from the evaluation step. Get rid of code that is doing this from the later do_command_*() stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add reference counter to the table objectPablo Neira Ayuso2015-08-181-0/+10
| | | | | | | We may hold multiple references to table objects in follow up patches when adding object declarations to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cmd_evaluate_list()Pablo Neira Ayuso2015-08-181-0/+23
| | | | | | | | | | This function validates that the table that we want to list already exists by looking it up from the cache. This also adds cmd_error() to display an error from the evaluation step, when the objects that the rule indicates do not exist. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cache infrastructure and use it for table objectsPablo Neira Ayuso2015-08-184-28/+84
| | | | | | | | | | This patch introduces the generic object cache that is populated during the evaluation phase. The first client of this infrastructure are table objects. As a result, there is a single call to netlink_list_tables(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next-4.2'Pablo Neira Ayuso2015-08-187-3/+71
|\ | | | | | | | | | | | | | | | | | | This branch adds support for the new 'netdev' family. This also resolves a simple conflict with the default chain policy printing. Conflicts: src/rule.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add netdev family supportPablo Neira Ayuso2015-06-167-4/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for the new 'netdev' table. So far, this table allows you to create filter chains from ingress. The following example shows a very simple base configuration with one table that contains a basechain that is attached to the 'eth0': # nft list table netdev filter table netdev filter { chain eth0-ingress { type filter hook ingress device eth0 priority 0; policy accept; } } You can test that this works by adding a simple rule with counters: # nft add rule netdev filter eth0-ingress counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: restore nft list tablesPablo Neira Ayuso2015-08-031-1/+1
| | | | | | | | | | | | | | | | Iterate over the ctx->list which is where the table objects are after calling netlink_list_tables(). Fixes: e4d21958c835 ("rule: add do_list_tables()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netlink_delinearize: meta l4proto range printing broken on 32bitPablo Neira Ayuso2015-07-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Florian Westphal says: 09565a4b1ed4863d44c4509a93c50f44efd12771 ("netlink_delinearize: consolidate range printing") causes nft to segfault on 32bit machine when printing l4proto ranges. The problem is that meta_expr_pctx_update() assumes that right is a value, but after this change it can also be a range. Thus, expr->value contents are undefined (its union). On x86_64 this is also broken but by virtue of struct layout and pointer sizes, value->_mp_size will almost always be 0 so mpz_get_uint8() returns 0. But on x86-32 _mp_size will be huge value (contains expr->right pointer of range), so we crash in libgmp. Pablo says: We shouldn't call pctx_update(), before the transformation we had there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never entered that path as the assert in payload_expr_pctx_update() indicates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Florian Westphal <fw@strlen.de>
* | main: return error to shell on evaluation problemsPablo Neira Ayuso2015-07-141-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft add chain filter input { type filter hook inputt priority 0\; } <cmdline>:1:43-48: Error: unknown chain hook inputt add chain filter input { type filter hook inputt priority 0; } ^^^^^^ Before: # echo $? 0 After: # echo $? 1 Note that nft_parse() returns 1 on parsing errors and 0 + state->errs on evaluation problems, so return -1 as other functions do here to pass up the error to the main routine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netlink: release table object via table_free() in netlink_get_table()Pablo Neira Ayuso2015-07-141-1/+1
| | | | | | | | | | | | Instead of xfree(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | rule: add do_list_tables()Pablo Neira Ayuso2015-07-141-15/+17
| | | | | | | | | | | | Wrap code to list existing tables in a function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: set chain->hookstr from delinearizationPablo Neira Ayuso2015-07-062-5/+5
| | | | | | | | | | | | Set human readable hookname chain->hookstr field from delinearize. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | rule: missing family when listing of tablesPablo Neira Ayuso2015-07-031-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | # nft list tables table ip nat instead of: # nft list tables table nat Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-26 02:49:36 +0000