summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* statement: Fix get_rate() for zero byte_ratePhil Sutter2018-04-241-0/+5
| | | | | | | | | The algorithm didn't detect whether given byte_rate was zero, pointlessly iterating through data units. Make it exit early in this case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Free flowtable in handle_free()Phil Sutter2018-04-241-0/+1
| | | | | | Fixes: db0697ce7f602 ("src: support for flowtable listing") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: no EINTR handling from netlink_get_setelem()Pablo Neira Ayuso2018-04-241-11/+4
| | | | | | This cannot happen, this call does not set the NLM_F_DUMP flag. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: centralize netlink error reportingPablo Neira Ayuso2018-04-243-39/+11
| | | | | | Consolidate error reporting from do_command() call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify netlink_get_setelems() and rename it to netlink_list_setelems()Pablo Neira Ayuso2018-04-242-11/+7
| | | | | | | | This is called from cache population path, remove netlink_io_error() call since this is not needed. Rename it for consistency with similar netlink_list_*() NLM_F_DUMP functions. Get rid of location parameter. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't pass location to netlink_list_*() functionPablo Neira Ayuso2018-04-242-26/+15
| | | | | | Not needed anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: netlink_list_chains() callers always wants all existing chainsPablo Neira Ayuso2018-04-241-15/+1
| | | | | | | Remove dead code, callers always need this to dump all of the existing chains. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: pass cmd object to netlink function callsPablo Neira Ayuso2018-04-242-118/+96
| | | | | | Simplify function footprint. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove dead netlink_io_error() callsPablo Neira Ayuso2018-04-201-58/+4
| | | | | | | | | This error path is never entered since mnl_nft_*_batch_{add,del,replace} calls never fail, and if they ever do fail it will be because we are hitting OOM, in such case we can display a more generic non-netlink error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove non-batch netlink codePablo Neira Ayuso2018-04-201-133/+0
| | | | | | This functions have no clients anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: clear expression context before cmd evaluationFlorian Westphal2018-04-191-0/+2
| | | | | | | | | | | | We also need to clear expr ctx before we eval a command. This is a followup fix to 'evaluate: reset eval context when evaluating set definitions'. The first patch only fixed set evaluation when dealing with a complete table representation rather than individual commands. Reported-by: David Fabian <david.fabian@bosson.cz> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: use ibrname and obrnamePablo Neira Ayuso2018-04-193-6/+6
| | | | | | | | | Legacy tool name is 'brctl' and so the 'br' prefix is already known. If we use ibrname and obrname it looks consistent with iifname and oifname. So let's this instead of ibridgename and obridgename since Florian likes this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing rules for IBRIDGENAME and OBRIDGENAMEPablo Neira Ayuso2018-04-191-0/+2
| | | | | Fixes: 3baa28f24b3d ("src: rename ibrportname, obrportname") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reset eval context when evaluating set definitionsFlorian Westphal2018-04-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | David reported nft chokes on this: nft -f /tmp/A /tmp/A:9:22-45: Error: datatype mismatch, expected concatenation of (IPv4 address, internet network service, IPv4 address), expression has type concatenation of (IPv4 address, internet network service) cat /tmp/A flush ruleset; table ip filter { set setA { type ipv4_addr . inet_service . ipv4_addr flags timeout } set setB { type ipv4_addr . inet_service flags timeout } } Problem is we leak set definition details of setA to setB via eval context, so reset this. Also add test case for this. Reported-by: David Fabian <david.fabian@bosson.cz> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rename ibrportname, obrportnameFlorian Westphal2018-04-173-2/+17
| | | | | | | | | | | | | | | For bridge, iifname is the port name, whereas 'ibrport' is the logical name of the bridge ("br0") the port ("iifname") is enslaved to. So, 'ibrport' is a misnomer. libnftl calls these 'bri_iifname' and 'bri_oifname', which is good but using 'briiifname' in nft is rather ugly, so use 'ibridgename' and 'obridgename' instead. Old names are still recognized, listing shows the new names. Signed-off-by: Florian Westphal <fw@strlen.de>
* scanner: add helpers tokenFlorian Westphal2018-04-171-0/+1
| | | | | | | | | without it, you get: nft list ct helpers table filter Error: syntax error, unexpected string, expecting helper or helpers Fixes: 14fd3ad720f6e ("src: prepare for future ct timeout policy support") Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: Pass struct nft_ctx to parser_init()Phil Sutter2018-04-142-12/+8
| | | | | | | | | Signature of parser_init() got quite huge, so simply pass the whole context pointer to it - most of the parameters are just taken from there anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Keep cmds list outside of parser_statePhil Sutter2018-04-142-18/+26
| | | | | | | | | | | | | | | Parser basically turns input into a list of commands and error messages. Having the commands list being part of struct parser_state does not make sense from this point of view, also it will have to go away with upcoming JSON support anyway. While being at it, change nft_netlink() to take just the list of commands instead of the whole parser state as parameter, also take care of command freeing in nft_run_cmd_from_* functions (where the list resides as auto-variable) instead of from inside nft_run(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: Remove duplicate include of gmputil.hPhil Sutter2018-04-141-1/+0
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Review .gitignore files contentsPhil Sutter2018-04-141-4/+8
| | | | | | | | | | | | | * Move entries belonging to src/ into src/.gitignore. * Drop lines for files inside build-aux/ since that is ignored already. * No need to ignore src/Makefile.in, the entry 'Makefile.in' catches that already. * Remove entry for '.*.d', (recent?) autotools doesn't create any matching files. * Drop entries for non-existent parser.c and parser.h files. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix for last elem at interval endPhil Sutter2018-04-141-8/+12
| | | | | | | | | | | | | | Unclosed interval check at end of interval_map_decompose() missed to check whether interval start is the last possible element in given set before creating a range expression. This led to the last element incorrectly printed as range from itself to itself. Fix this by comparing the upper boundary against the lower one. In order to keep indenting level low, invert the entry check and jump to the end if it matches. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Review raw payload allocation pointsPhil Sutter2018-04-142-6/+1
| | | | | | | | | | | | In parser_bison.y, call payload_init_raw() instead of assigning all fields manually. Also drop manual initialization of flags field: it is not touched in allocation path, so no need for that. In stmt_evaluate_payload(), setting dtype field is redundant since payload_init_raw() does that already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix memory leaksPhil Sutter2018-04-141-6/+21
| | | | | | | | | | | | | | | | | | | This fixes memory leaks in three places: * set_overlap(): The allocated intervals have to be freed again before returning to caller. While being at it, reduce indenting level in said function to stay below 80 columns boundary. * range_is_prefix(): * interval_map_decompose(): GMP documentation suggests to call mpz_clear() for all mpz_t type variables once they are not used anymore to free the space they occupy. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Free table->objs in table_free()Phil Sutter2018-04-141-0/+3
| | | | | | | This fixes a memory leak identified by valgrind. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Fix forgotten bit after introducing error_fpPhil Sutter2018-04-141-3/+0
| | | | | | | | | Like nft_run_cmd_from_buffer, nft_run_cmd_from_filename doesn't need to change output_fp temporarily when printing error records anymore. Fixes: 4176e24e14f07 ("libnftables: Introduce nft_ctx_set_error()") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: Review erec_print()Phil Sutter2018-04-142-38/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A new requirement to erec for the upcoming JSON support is printing records with file input descriptors without open stream. The approach is to treat 'name' field as file name, open it, extract the offending line and close it again. Further changes to libnftables input parsing routines though have shown that the whole concept of file pointer reuse in erec is tedious and not worth keeping: * Closed files are to be supported as well, so there needs to be fallback code for opening the file anyway. * When input descriptor is duplicated from parser state into an error record, the file pointer is copied as well. Therefore care has to be taken to not free the parser state before any error records have been printed. This is the only point where old and duplicated input descriptors are connected. Therefore drop struct input_descriptor's 'fp' field and just always open the file by name. This way also the old stream offset doesn't have to be restored after reading. While being at it, this patch fixes two other (potential) problems: * If the offending line from input contains tabs, add them at the right position in the marker buffer as well to avoid misalignment. * The input file may not be seekable (/dev/stdin for instance), so skip printing of offending line and markers if it couldn't be read properly. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: Drop String termination workaroundPhil Sutter2018-04-111-9/+1
| | | | | | | | | | This spot was missed by commit 2b3f18e0cf7a7 ("libnftables: Fix for input without trailing newline") - since line termination is now added in nft_run_cmd_from_buffer(), cli is relieved from doing so. Fixes: 2b3f18e0cf7a7 ("libnftables: Fix for input without trailing newline") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Simplify cookie integrationPhil Sutter2018-04-111-61/+34
| | | | | | | | | This increases the size of struct output_ctx quite a bit, but allows to simplify internal functions dealing with the cookies mainly because output_fp becomes accessible from struct cookie. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Support buffering output and errorPhil Sutter2018-04-111-0/+137
| | | | | | | | | | | When integrating libnftables into Python code using ctypes module, having to use a FILE pointer for output becomes a show-stopper. Therefore make Python hackers' lives (a little) less painful by providing convenience functions to setup buffering output and error streams using fopencookie() and retrieving the buffers. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Introduce nft_ctx_set_error()Phil Sutter2018-04-112-4/+14
| | | | | | | | Analogous to nft_ctx_set_output(), this allows to set a custom file pointer for writing error messages to. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Fix for input without trailing newlinePhil Sutter2018-04-113-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Input parser implementation requires a newline at end of input, otherwise the last pattern may not be recognized correctly. If input comes from a file, the culprit was YY_INPUT macro not expecting the last line not ending with a newline, so the last word wasn't accepted. This is easily fixed by checking for feof(yyin) in there. A simple test case for that is: | echo -en "table ip t {\nchain c {\n}\n}" >/tmp/foo | nft -f /tmp/foo Input from a string buffer is a bit more tricky: The culprit here is that detection of classid pattern is done by checking the character following it which makes it impossible to sit right at end of input and I haven't found an alternative to that. After dropping the manual newline appending when combining argv into a single buffer in main(), a rule like this won't be recognized anymore: | nft add rule ip t c meta priority feed:babe Since a direct call to run_cmd_from_buffer() via libnftables bypasses the sanitizing done in main() entirely, it has to happen in libnftables instead which means creating a newline-terminated duplicate of the input buffer. Note that main() created a buffer one byte longer than needed since it accounts for whitespace at end of each argv but doesn't add it to the buffer for the last one, so buffer length is reduced by two bytes instead of just one although only one less character is printed into it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: Fix output_fp bypass in ct_print()Phil Sutter2018-04-101-1/+1
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: use recursive call for SET_REF handlingFlorian Westphal2018-04-031-29/+1
| | | | | | We can now call the helper again, with set->init as new RHS expression. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: handle EXPR_MAPPINGFlorian Westphal2018-04-031-0/+4
| | | | | | | | Needed by followup patch. EXPR_SET_REF handling is bonkers, it "works" when using { key : value } because ->key and ->left are aliased in struct expr to the same location. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: split binop xfer to separate functionFlorian Westphal2018-04-031-16/+31
| | | | | | to reuse this in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: move lhs fixup to a helperFlorian Westphal2018-04-031-19/+28
| | | | | | ... to reuse this in a followup patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: floating point exception with concatenationsPablo Neira Ayuso2018-04-031-1/+1
| | | | | | | If the length is less than 1 byte, this codepath hits a floating point exception, use div_round_up() as everywhere else in the code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: propagate binop_transfer() adjustment to set key sizePablo Neira Ayuso2018-04-031-1/+2
| | | | | | | | | The right shift transfer may be result in adjusting the set key size, eg. ip6 dscp results in fetching 6 bits that are splitted between two bytes, hence the set element ends up being 16 bytes long. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not inconditionally update cache from flush commandPablo Neira Ayuso2018-04-011-5/+15
| | | | | | This is only required by sets, maps and meters, skip cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use mini-gmp 6.1.2 stable releasePablo Neira Ayuso2018-04-011-66/+52
| | | | | | Instead of a snapshot from the gmp hg repository. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: kill dependency before eval of 'redirect' stmtFlorian Westphal2018-04-011-1/+3
| | | | | | | | | | | | | ip protocol 6 redirect to :tcp dport map { 22 : 8000, 80 : 8080} is printed as redirect to :tcp dport map { 22 : 8000, 80 : 8080} but that input yields: Error: transport protocol mapping is only valid after transport protocol match so kill dependencies beforehand so nft won't remove it. Signed-off-by: Florian Westphal <fw@strlen.de>
* statement: print space before "{" in set addFlorian Westphal2018-04-011-1/+1
| | | | | | | | | old: add @set5{ ip6 saddr . ip6 daddr} new: add @set5 { ip6 saddr . ip6 daddr} Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Updates for mini-gmp.{c,h}Harsha Sharma2018-03-311-198/+238
| | | | | | | updates from latest stable release of libgmp to get in sync with them Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "payload: don't remove icmp family dependency in special cases"Florian Westphal2018-03-281-9/+0
| | | | | | | | This reverts commit 126706c23c0458b07d54550dc27561b30f8a43f2. As its now ok to use icmp-in-ip6 family we can remove the dependency. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: permit icmp-in-ipv6 and icmpv6-in-ipv4Florian Westphal2018-03-281-0/+2
| | | | | | | | | | | | | | | | | Jozsef points out that meta l4proto icmp icmp type destination-unreachable is hard to read. So, lets just add icmp/icmpv6 to ip/ip6 protocol base so users can just go with icmp type destination-unreachable and let nft fill in needed dependency. After this patch, the recent patch to not remove the dependency can be reverted again. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't remove icmp family dependency in special casesFlorian Westphal2018-03-271-0/+9
| | | | | | | | | | | | | | | | | | | | | | | When using nftables to filter icmp-in-ipv6 or icmpv6-in-ipv4 we erronously removed the dependency, i.e. "lis ruleset" shows table ip6 filter { chain output { type filter hook output priority 0; policy accept; icmp type destination-unreachable } } but that won't restore because of ip vs ipv6 conflict. After this patch, this lists as meta l4proto icmp icmp type destination-unreachable instead. We still remove the dependency in "ip" family. Same applies to icmpv6-in-ip. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: avoid errouneous assert with map+concatFlorian Westphal2018-03-271-0/+8
| | | | | | | | | | | | | | | | | | Phil reported following assert: add rule ip6 f o mark set ip6 saddr . ip6 daddr . tcp dport \ map { dead::beef . f00::. 22 : 1 } nft: netlink_linearize.c:655: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. This happens because "mark set" will allocate one register (the dreg), but netlink_gen_concat_expr will populate a lot more register space if the concat expression strings a lot of expressions together. As the assert is useful pseudo-reserve the register space as per concat->len and undo after generating the expressions. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Export libnftables (again)Phil Sutter2018-03-212-3/+2
| | | | | | | | | | | | | | This reverts commits d572d59788143945c2a638f12a5227d9b21ce489 and 9f5e49e147219cd161de8cd80cadf8a444969ef0. Current libnftables API should be stable enough to release it into the public, and after 4aba100e593f ("rule: reset cache iff there is an existing cache") we have a simple way to batch commands through this API. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Make parsing a little more robustPhil Sutter2018-03-202-1/+7
| | | | | | | | | | It was surprisingly easy to crash nft with invalid syntax in 'add flowtable' command. Catch at least three possible ways (illustrated in provided test case) by making evaluation phase survive so that bison gets a chance to complain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Support 'nft -f -' to read from stdinPhil Sutter2018-03-201-0/+3
| | | | | | | | | | | | | | | | | | In libnftables, detect if given filename is '-' and treat it as the common way of requesting to read from stdin, then open /dev/stdin instead. (Calling 'nft -f /dev/stdin' worked before as well, but this makes it official.) With this in place and bash's support for here strings, review all tests in tests/shell for needless use of temp files. Note that two categories of test cases were intentionally left unchanged: - Tests creating potentially large rulesets to avoid running into shell parameter length limits. - Tests for 'include' directive for obvious reasons. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>