summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* netlink_delinearize: release expressions in context registersPablo Neira Ayuso2019-06-101-3/+3
| | | | | | | | | netlink_release_registers() needs to go a bit further to release the expressions in the register array. This should be safe since netlink_get_register() clones expressions in the context registers. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: use expr_clone() from verdict_expr_clone()Pablo Neira Ayuso2019-06-101-1/+1
| | | | | | | | | | | | | | | | | | | Chains are now expressions, do not assume a constant value is used. ==26302== Process terminating with default action of signal 11 (SIGSEGV) ==26302== Access not within mapped region at address 0x50 ==26302== at 0x67D7EE7: __gmpz_init_set (in /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2) ==26302== by 0x4E61224: expr_clone (expression.c:65) ==26302== by 0x4E7898B: interval_map_decompose (segtree.c:943) ==26302== by 0x4E6DDA0: netlink_list_setelems (netlink.c:882) ==26302== by 0x4E5A806: cache_init_objects (rule.c:166) ==26302== by 0x4E5A806: cache_init (rule.c:216) ==26302== by 0x4E5A806: cache_update (rule.c:266) ==26302== by 0x4E7E0EE: nft_evaluate (libnftables.c:388) ==26302== by 0x4E7E8AB: nft_run_cmd_from_buffer (libnftables.c:428) Fixes: f1e8a129ee42 ("src: Introduce chain_expr in jump and goto statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: invalid read when importing chain name (trace and json)Pablo Neira Ayuso2019-06-102-3/+2
| | | | | | | Update trace and json too. Fixes: 142350f154c7 ("src: invalid read when importing chain name") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: invalid read when importing chain namePablo Neira Ayuso2019-06-102-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | Use strlen(), otherwise mpz_import_data() reads too much beyond the real chain string. Valgrind reports the following error: ==2759== Invalid read of size 1 ==2759== at 0x67D68D6: __gmpz_import (in /usr/lib/x86_64-linux-gnu/libgmp.so.10.3.2) ==2759== by 0x4E79467: mpz_import_data (gmputil.c:133) ==2759== by 0x4E60A12: constant_expr_alloc (expression.c:375) ==2759== by 0x4E8ED65: nft_parse (parser_bison.y:3825) ==2759== by 0x4E7E850: nft_parse_bison_buffer (libnftables.c:357) ==2759== by 0x4E7E850: nft_run_cmd_from_buffer (libnftables.c:424) ==2759== by 0x1095D4: main (in /tmp/a.out) ==2759== Address 0x6ee1b4a is 0 bytes after a block of size 10 alloc'd ==2759== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==2759== by 0x59FD3B9: strdup (strdup.c:42) ==2759== by 0x4E7963D: xstrdup (utils.c:75) ==2759== by 0x4E9C233: nft_lex (scanner.l:626) ==2759== by 0x4E8E382: nft_parse (parser_bison.c:5297) ==2759== by 0x4E7E850: nft_parse_bison_buffer (libnftables.c:357) ==2759== by 0x4E7E850: nft_run_cmd_from_buffer (libnftables.c:424) Fixes: f1e8a129ee42 ("src: Introduce chain_expr in jump and goto statements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Support intra-transaction rule referencesPhil Sutter2019-06-072-20/+78
| | | | | | | | | | | | | | | | | | | | | | | A rule may be added before or after another one using index keyword. To support for the other rule being added within the same batch, one has to make use of NFTNL_RULE_ID and NFTNL_RULE_POSITION_ID attributes. This patch does just that among a few more crucial things: * If cache is complete enough to contain rules, update cache when evaluating rule commands so later index references resolve correctly. * Reduce rule_translate_index() to its core code which is the actual linking of rules and consequently rename the function. The removed bits are pulled into the calling rule_evaluate() to reduce code duplication in between cache updates with and without rule reference. * Pass the current command op to rule_evaluate() as indicator whether to insert before or after a referenced rule or at beginning or end of chain in cache. Exploit this from chain_evaluate() to avoid adding the chain's rules a second time. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Make cache_is_complete() publicPhil Sutter2019-06-071-1/+1
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Introduce rule_lookup_by_index()Phil Sutter2019-06-071-0/+11
| | | | | | | | In contrast to rule_lookup(), this function returns a chain's rule at a given index instead of by handle. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: Fix evaluation for rules with index referencePhil Sutter2019-06-071-7/+1
| | | | | | | | | After parsing input, rule location data (index or handle) is contained in cmd->handle, not yet in cmd->rule->handle. Fixes: 7df42800cf89e ("src: single cache_update() call to build cache before evaluation") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: check for errors after evaluationsPablo Neira Ayuso2019-06-071-0/+3
| | | | | | | | Check for state->nerrs after evaluation to restore error reporting when evaluation fails. Fixes: df2f746fb4cf ("libnftables: keep evaluating until parser_max_errors") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: bogus error when running monitor modePablo Neira Ayuso2019-06-071-3/+1
| | | | | | | | | | Fix bogus error message: # nft monitor Cannot set up netlink socket buffer size to 16777216 bytes, falling back to 16777216 bytes Fixes: bcf60fb819bf ("mnl: add mnl_set_rcvbuffer() and use it") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: keep evaluating until parser_max_errorsPablo Neira Ayuso2019-06-071-1/+2
| | | | | | | | | | | | | | | | | | Bail out after parser_max_errors has been reached, eg. # nft -f /tmp/errors.nft /tmp/errors.nft:1:23-23: Error: syntax error, unexpected newline filter input tcp dport ^ /tmp/errors.nft:2:24-26: Error: datatype mismatch, expected internet network service, expression has type Internet protocol filter input tcp dport tcp ~~~~~~~~~ ^^^ /tmp/errors.nft:3:24-26: Error: datatype mismatch, expected internet network service, expression has type Internet protocol filter input tcp sport udp ~~~~~~~~~ ^^^ Fixes: f211921e25e6 ("src: perform evaluation after parsing") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use-after-free in implicit setPablo Neira Ayuso2019-06-071-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # cat example.nft table inet test { chain test { ip daddr { 2.2.2.2, 4.4.4.4} counter accept } } # valgrind nft -f example.nft valgrind reports: ==2272== Invalid read of size 4 ==2272== at 0x4E612A5: expr_free (expression.c:86) ==2272== by 0x4E58EA2: set_free (rule.c:367) ==2272== by 0x4E612DA: expr_destroy (expression.c:79) ==2272== by 0x4E612DA: expr_free (expression.c:93) ==2272== by 0x4E612DA: expr_destroy (expression.c:79) ==2272== by 0x4E612DA: expr_free (expression.c:93) ==2272== by 0x4E5D7E7: stmt_free (statement.c:50) ==2272== by 0x4E5D8B7: stmt_list_free (statement.c:60) ==2272== by 0x4E590FF: rule_free (rule.c:610) ==2272== by 0x4E5C094: cmd_free (rule.c:1420) ==2272== by 0x4E7E7EF: nft_run_cmd_from_filename (libnftables.c:490) ==2272== by 0x109A53: main (main.c:310) ==2272== Address 0x65d94c8 is 56 bytes inside a block of size 128 free'd ==2272== at 0x4C2CDDB: free (vg_replace_malloc.c:530) ==2272== by 0x4E6143C: mapping_expr_destroy (expression.c:966) ==2272== by 0x4E612DA: expr_destroy (expression.c:79) ==2272== by 0x4E612DA: expr_free (expression.c:93) ==2272== by 0x4E5D7E7: stmt_free (statement.c:50) ==2272== by 0x4E5D8B7: stmt_list_free (statement.c:60) ==2272== by 0x4E590FF: rule_free (rule.c:610) ==2272== by 0x4E5C094: cmd_free (rule.c:1420) ==2272== by 0x4E7E7EF: nft_run_cmd_from_filename (libnftables.c:490) ==2272== by 0x109A53: main (main.c:310) ==2272== Block was alloc'd at ==2272== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==2272== by 0x4E79248: xmalloc (utils.c:36) ==2272== by 0x4E7932D: xzalloc (utils.c:65) ==2272== by 0x4E60690: expr_alloc (expression.c:45) ==2272== by 0x4E68B1D: payload_expr_alloc (payload.c:159) ==2272== by 0x4E91013: nft_parse (parser_bison.y:4242) ==2272== by 0x4E7E722: nft_parse_bison_filename (libnftables.c:374) ==2272== by 0x4E7E722: nft_run_cmd_from_filename (libnftables.c:471) ==2272== by 0x109A53: main (main.c:310) Fixes: cc7b37d18a68 ("src: Interpret OP_NEQ against a set as OP_LOOKUP") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: ensure cache consistencyPablo Neira Ayuso2019-06-071-1/+8
| | | | | | | Check for generation ID after the cache is populated. In case of interference, release the inconsistent cache and retry. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: generation ID is 32-bit longPablo Neira Ayuso2019-06-072-6/+10
| | | | | | | | Update mnl_genid_get() to return 32-bit long generation ID. Add nft_genid_u16() which allows us to catch ruleset updates from the netlink dump path via 16-bit long nfnetlink resource ID field. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Drop cache in error casePhil Sutter2019-06-061-0/+4
| | | | | | | | | | | | | | | | | | | | | | | If a transaction is rejected by the kernel (for instance due to a semantic error), cache contents are potentially invalid. Release the cache in that case to avoid the inconsistency. The problem is easy to reproduce in an interactive session: | nft> list ruleset | table ip t { | chain c { | } | } | nft> flush ruleset; add rule ip t c accept | Error: No such file or directory | flush ruleset; add rule ip t c accept | ^ | nft> list ruleset | nft> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix cache_flush() in cache_needs_more() logicPhil Sutter2019-06-061-0/+3
| | | | | | | | | | | | | | | Commit 34a20645d54fa enabled cache updates depending on command causing it. As a side-effect, this disabled measures in cache_flush() preventing a later cache update. Re-establish this by setting cache->cmd in addition to cache->genid after dropping cache entries. While being at it, set cache->cmd in cache_release() as well. This shouldn't be necessary since zeroing cache->genid should suffice for cache_update(), but better be consistent (and future-proof) here. Fixes: eeda228c2d17 ("src: update cache if cmd is more specific") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: single cache_update() call to build cache before evaluationPablo Neira Ayuso2019-06-066-102/+143
| | | | | | | | | | | | | | | This patch allows us to make one single cache_update() call. Thus, there is not need to rebuild an incomplete cache from the middle of the batch processing. Note that nft_run_cmd_from_filename() does not need a full netlink dump to build the cache anymore, this should speed nft -f with incremental updates and very large rulesets. cache_evaluate() calculates the netlink dump to populate the cache that this batch needs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Display parser and evaluate errors in one shotPablo Neira Ayuso2019-06-052-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch restores 61236968b7a1 ("parser: evaluate commands immediately after parsing") following a different approach. In this patch, the evaluation phase is done if the parsing phase fails, hence the user gets parsing and evaluation errors in one shot, which is the purpose of 61236968b7a1. Note that evaluation errors are now shown after parser errors, the example available in 61236968b7a1 displays with this patch the following error: # nft -f /tmp/bad.nft /tmp/bad.nft:3:32-32: Error: syntax error, unexpected newline add rule filter input tcp dport ^ /tmp/bad.nft:5:37-41: Error: syntax error, unexpected dport, expecting end of file or newline or semicolon add rule filter input tcp dport tcp dport ^^^^^ /tmp/bad.nft:4:33-35: Error: datatype mismatch, expected internet network service, expression has type Internet protocol add rule filter input tcp dport tcp ~~~~~~~~~ ^^^ So evaluation pointing to line 4 happens after line error reporting generated by the parser that points to line 3, while 61236968b7a1 was showing errors per line in order. As a future work, we can sort the error reporting list to restore exactly the same behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: perform evaluation after parsingPablo Neira Ayuso2019-06-052-30/+27
| | | | | | | | | | | | | | | | | Since 61236968b7a1 ("parser: evaluate commands immediately after parsing"), evaluation is invoked from the parsing phase in order to improve error reporting. However, this approach is problematic from the cache perspective since we don't know if a full or partial netlink dump from the kernel is needed. If the number of objects in the kernel is significant, the netlink dump operation to build the cache may significantly slow down commands. This patch moves the evaluation phase after the parsing phase as a preparation update to allow for a better strategy to build the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: dynamic input_descriptor allocationPablo Neira Ayuso2019-06-053-55/+44
| | | | | | | | | | | | | This patch introduces the input descriptor list, that stores the existing input descriptor objects. These objects are now dynamically allocated and release from scanner_destroy() path. Follow up patches that decouple the parsing and the evaluation phases require this for error reporting as described by b14572f72aac ("erec: Fix input descriptors for included files"), this patch partially reverts such partial. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Simplify mnl_batch_talk()Phil Sutter2019-05-311-16/+13
| | | | | | | | | | | | | | | | | | By mimicking mnl_nft_event_listener() code, mnl_batch_talk() may be simplified quite a bit: * Turn the conditional loop into an unconditional one. * Call select() at loop start, which merges the two call sites. * Check readfds content after select() returned instead of in loop condition - if fd is not set, break to return error state stored in 'err' variable. * Old code checked that select() return code is > 0, but that was redundant: if FD_ISSET() returns true, select return code was 1. * Move 'nlh' helper variable definition into error handling block, it is not used outside of it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Initialize fd_set before select(), not afterPhil Sutter2019-05-311-3/+3
| | | | | | | | | | Calling FD_SET() in between return of select() and call to FD_ISSET() effectively renders the whole thing useless: FD_ISSET() will always return true no matter what select() actually did. Fixes: a72315d2bad47 ("src: add rule batching support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: remove double \n on error when internal_netlink is usedPablo Neira Ayuso2019-05-311-1/+0
| | | | | | Remove double empty line linebreak when printing internal errors. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: mnl_batch_talk() returns -1 on internal netlink errorsPablo Neira Ayuso2019-05-312-5/+10
| | | | | | Display an error in case internal netlink plumbing hits problems. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: estimate receiver buffer sizePablo Neira Ayuso2019-05-312-4/+10
| | | | | | | | | | | | | | | | | Set a receiver buffer size based on the number of commands and the average message size, this is useful for the --echo option in order to avoid ENOBUFS errors. On the kernel side, each skbuff consumes truesize from the socket queue (although it uses NLMSG_GOODSIZE to allocate it), which is approximately four times the estimated size per message that we get in turn for each echo message to ensure enough receiver buffer space. We could also explore increasing the buffer and retry if mnl_nft_socket_sendmsg() hits ENOBUFS if we ever hit this problem again. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add mnl_nft_batch_to_msg()Pablo Neira Ayuso2019-05-311-18/+36
| | | | | | This function transforms the batch into a msghdr object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: call mnl_set_sndbuffer() from mnl_batch_talk()Pablo Neira Ayuso2019-05-311-1/+2
| | | | | | Instead of mnl_nft_socket_sendmsg(), just a cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: mnl_set_rcvbuffer() skips buffer size update if it is too smallPablo Neira Ayuso2019-05-311-0/+11
| | | | | | | Check for existing buffer size, if this is larger than the newer buffer size, skip this size update. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add mnl_set_rcvbuffer() and use itPablo Neira Ayuso2019-05-311-14/+23
| | | | | | This new function allows us to set the netlink receiver buffer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix and simplify verdict expression parsingPhil Sutter2019-05-271-12/+13
| | | | | | | | | | | | Parsing of the "target" property was flawed in two ways: * The value was extracted twice. Drop the first unconditional one. * Expression allocation required since commit f1e8a129ee428 was broken, The expression was allocated only if the property was not present. Fixes: f1e8a129ee428 ("src: Introduce chain_expr in jump and goto statements") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cache_is_complete() and cache_is_updated()Pablo Neira Ayuso2019-05-271-5/+10
| | | | | | | Just a few functions to help clarify cache update logic. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* src: Allow goto and jump to a variableFernando Fernandez Mancera2019-05-243-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces the use of nft input files variables in 'jump' and 'goto' statements, e.g. define dest = ber add table ip foo add chain ip foo bar {type filter hook input priority 0;} add chain ip foo ber add rule ip foo ber counter add rule ip foo bar jump $dest table ip foo { chain bar { type filter hook input priority filter; policy accept; jump ber } chain ber { counter packets 71 bytes 6664 } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Introduce chain_expr in jump and goto statementsFernando Fernandez Mancera2019-05-247-22/+74
| | | | | | | | | Introduce expressions as a chain in jump and goto statements. This is going to be used to support variables as a chain in the following patches. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for arp sender and target ethernet and IPv4 addressesPablo Neira Ayuso2019-05-242-8/+18
| | | | | | | | | | | | | | | | | | | | | | | | # nft add table arp x # nft add chain arp x y { type filter hook input priority 0\; } # nft add rule arp x y arp saddr ip 192.168.2.1 counter Testing this: # ip neigh flush dev eth0 # ping 8.8.8.8 # nft list ruleset table arp x { chain y { type filter hook input priority filter; policy accept; arp saddr ip 192.168.2.1 counter packets 1 bytes 46 } } You can also specify hardware sender address, eg. # nft add rule arp x y arp saddr ether aa:bb:cc:aa:bb:cc drop counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: update cache if cmd is more specificEric Garver2019-05-241-0/+20
| | | | | | | | | | | | | | | | | If we've done a partial fetch of the cache and the genid is the same the cache update will be skipped without fetching the needed items. This change flushes the cache if the new request is more specific than the current cache - forcing a cache update which includes the needed items. Introduces a simple scoring system which reflects how cache_init_objects() looks at the current command to decide if it is finished already or not. Then use that in cache_needs_more(): If current command's score is higher than old command's, cache needs an update. Fixes: 816d8c7659c1 ("Support 'add/insert rule index <IDX>'") Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use definitions in include/linux/netfilter/nf_tables.hPablo Neira Ayuso2019-05-123-28/+29
| | | | | | | | | | | | | | | Use NFT_LOGLEVEL_* definitions in UAPI. Make an internal definition of NFT_OSF_F_VERSION, this was originally defined in the UAPI header in the initial patch version, however, this is not available anymore. Add a bison rule to deal with the timeout case. Otherwise, compilation breaks. Fixes: d3869cae9d62 ("include: refresh nf_tables.h cached copy") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "proto: support for draft-ietf-tsvwg-le-phb-10.txt"Pablo Neira Ayuso2019-05-091-1/+0
| | | | | | | | This reverts commit 55715486efba424e97361c81d8d47e854f45a5a6. This breaks tests/py. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix ct timeout object supportPhil Sutter2019-05-091-0/+2
| | | | | | | | Seems like it wasn't possible to add or list ct timeout objects. Fixes: c82a26ebf7e9f ("json: Add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix tproxy support regarding latest changesPhil Sutter2019-05-092-22/+17
| | | | | | | | | | | | | | | | | | | Family may be specified also if no address is given at the same time, make parser/printer tolerant to that. Also fix for missing/incorrect JSON equivalents in tests/py. While being at it, fix two issues in non-JSON tests: * Ruleset is printed in numeric mode, so use 'l4proto 6' instead of 'l4proto tcp' in rules to avoid having to specify expected output for that unrelated bit. * In ip and ip6 family tables, family parameter is not deserialized on output. Fixes: 3edb96200690b ("parser_bison: missing tproxy syntax with port only for inet family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fix printing of zero-length prefixesPhil Sutter2019-05-091-1/+3
| | | | | | | | | | | | | | | | | | | When delinearizing, an all-zero mask didn't qualify as prefix. Therefore a statement: | ip daddr 0.0.0.0/0 would be printed as: | ip daddr & 0.0.0.0 == 0.0.0.0 To fix this, expr_mask_is_prefix() must return true if the initial 1-bit search fails (the given value must be zero in this case). Additionally, a shortcut is needed in conversion algorithm of expr_mask_to_prefix() to not turn the zero prefix into a 1 by accident. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix igmp supportPhil Sutter2019-05-091-0/+1
| | | | | | | | | Parser didn't know about that protocol, also testsuite bits were missing. Fixes: bad27ca386276 ("src: add igmp support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support nat in inet familyPhil Sutter2019-05-092-1/+14
| | | | | | | | Add the missing bits to JSON parser, printer, man page and testsuite. Fixes: fbe27464dee45 ("src: add nat support for the inet family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use UDATA defines from libnftnlPhil Sutter2019-05-037-44/+50
| | | | | | | | | | | | | Userdata attribute names have been added to libnftnl, use them instead of the local copy. While being at it, rename udata_get_comment() in netlink_delinearize.c and the callback it uses since the function is specific to rules. Also integrate the existence check for NFTNL_RULE_USERDATA into it along with the call to nftnl_rule_get_data(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: fix crash on add rule to bad referencesEric Garver2019-05-031-1/+5
| | | | | | | | | | | Pass the location via the handle so the error leg in rule_translate_index() can reference it. Applies to invalid references to tables, chains, and indexes. Fixes: 586ad210368b ("libnftables: Implement JSON parser") Signed-off-by: Eric Garver <eric@garver.life> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: fix off by one index on rule add/replaceEric Garver2019-05-031-2/+6
| | | | | | | | | We need to increment the index by one just as the CLI does. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Eric Garver <eric@garver.life> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: support for draft-ietf-tsvwg-le-phb-10.txtLoganaden Velvindron2019-05-031-0/+1
| | | | | | | | | | Upcoming dscp codepoint for background traffic of low precendence such as bulk data transfers with low priority in time, non time-critical backups, larger software updates, web search engines while gathering information from web servers and so on. Signed-off-by: Loganaden Velvindron <logan@cyberstorm.mu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: default to unspecified l3proto for ct helper/timeoutEric Garver2019-05-031-1/+1
| | | | | | | | | | As per the man page, if the user does not specify the l3proto it should be derived from the table family. Fixes: 586ad210368b ("libnftables: Implement JSON parser") Signed-off-by: Eric Garver <eric@garver.life> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix double free on xt stmt destructionFlorian Westphal2019-05-012-7/+1
| | | | | | | | | | | | 'nft monitor' dies with: *** Error in `/sbin/nft': double free or corruption (fasttop): 0x000055f8ba57b750 *** ... when the iptables-nft test suite is running in parallel, because xfree(stmt->xt.name) gets called twice. Fixes: 4ac11b890fe870 ("src: missing destroy function in statement definitions") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix parser for list maps commandPhil Sutter2019-04-301-1/+1
| | | | | | | | Wrong callback in json_parse_cmd_list() for "maps" key. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix typo in ct timeout policy parserPhil Sutter2019-04-301-1/+1
| | | | | | | | | Parser expects an object in policy property and json_is_object() returns true if given parameter is an object. The check was inverse by accident. Fixes: c82a26ebf7e9f ("json: Add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>