summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* JSON: Fix add rule with indexPhil Sutter2018-06-031-1/+1
| | | | | | | | | This was missed by commit fb557b5546084 ("JSON: Sort out rule position and handles in general"): When adding a rule, the parser would still expect "pos" property instead of "index". Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify verdict statement parsingPhil Sutter2018-06-031-36/+3
| | | | | | | | Reuse verdict expression parsing routine. Since the statement simply wraps an expression, this change is an obvious one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify wildcard expressionPhil Sutter2018-06-031-12/+11
| | | | | | | | Instead of dedicating an object for it ('{ "*": null }'), just use a string consisting of an asterisk as sole character. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Merge wildcard_rhs_expr and wildcard_stmt_exprPhil Sutter2018-06-031-18/+7
| | | | | | | | The two are absolutely identical, just referenced at different places. Since there is no need for the distinction, just merge them into one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify immediate value parsingPhil Sutter2018-06-011-45/+31
| | | | | | | | | | | | | | | Since an explicit "immediate" expression doesn't exist in JSON (the values are represented as plain JSON string/integer/boolean types), there is no need for json_parse_immediate_expr() to comply to the common expression parser parameter format. Apart from that: * Drop CTX_F_RHS checks - caller assures sane context already. * Improve error message a bit for denied JSON types. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Fix parsing of meter statement keyPhil Sutter2018-06-011-2/+2
| | | | | | | | | The key must be a set elem expression, but if a "regular" expression was provided (which should be commonly accepted in case no set elem specific properties are required), the resulting object tree crashed libnftables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Improve prefix expression parsing error message a bitPhil Sutter2018-06-011-1/+1
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify tcp option expression parsing a bitPhil Sutter2018-06-011-3/+2
| | | | | | | | When parsing the optional "field" property, use return code of json_unpack() directly to check if it was present or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Fix parsing and printing of limit objectsPhil Sutter2018-06-012-44/+48
| | | | | | | | Fix parsing and printing of named limit objects by aligning the code with parser/printer of anonymous ones. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Review set elem expressionsPhil Sutter2018-06-012-14/+7
| | | | | | | | | | | | * There is no need to prefix element-specific properties with 'elem_', they can't conflict. * In json_parse_set_stmt(), searching for above properties is pointless since that's already done by called function. * Fix potential NULL-pointer deref in json_parse_set_elem_expr_stmt(): json_parse_flagged_expr() may return NULL. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Review meter statement supportPhil Sutter2018-06-012-7/+9
| | | | | | | | | Meter name being optional seems to come from old flow statement, so don't support this. Also add size support as was recently added to standard syntax. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Sort out rule position and handles in generalPhil Sutter2018-06-012-29/+22
| | | | | | | | | | | | | | | | | | | | | | | | First of all, don't print the position property when listing rules. This was there only because libnftnl JSON output has it too, but since the preferred way to *add* a rule at some location is via 'handle' keyword, keeping "position" in output would be non-intuitive. Changing "position" property name to "handle" instead is also a no-go since that would clash with the real rule handle. Secondly, turn all handle output on regardless of octx->handle setting. For a programmatic API like JSON, this should be fine. Thirdly, fix rule locations when parsing JSON: Respect "handle" property for CMD_INSERT and CMD_ADD and ignore "pos" at all (actually even a typo, should have read "position"). Also support "index" property recently added to standard syntax. Finally, adjust nft-test.py for the above changes: There is no "position" property to drop from rule output, and "handle" property will always be present. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Disallow non-array concat expression valuesPhil Sutter2018-06-011-3/+1
| | | | | | | | Concat expressions with just a single element don't make sense, so there's no point in supporting a shorter syntax for this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Use "type" for CT helper objectPhil Sutter2018-06-012-3/+3
| | | | | | | Property name "helper" was a bit unclear, "type" is better. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* objref: Use "ct helper" for NFT_OBJECT_CT_HELPERPhil Sutter2018-06-012-2/+2
| | | | | | | | | Change name of NFT_OBJECT_CT_HELPER in objref_type table to "ct helper" for consistency. Note that this is not used in regular nft output since objref_stmt_print() treats this object type separately. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: old kernels are allowing burst zero, don't print itPablo Neira Ayuso2018-05-301-1/+1
| | | | | | | | Don't print limit burst zero which was the default value in old kernels, this is not allowed in more recent kernels that now operate like iptables xt_limit which is what users are expecting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: don't print burst if equals 5Pablo Neira Ayuso2018-05-291-1/+1
| | | | | | | This is the default value we use if not specified, don't print it just like we do in iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meters: do not set a defaut meter size from userspaceFlorian Westphal2018-05-291-1/+1
| | | | | | | doing this breaks with older kernels as it will pick a set without and update callback. Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: incorrect handling of comments and timeouts with mappingPablo Neira Ayuso2018-05-251-21/+46
| | | | | | | | | Check if expression is a mapping to do the right handling. Fixes: 35fedcf540bf ("segtree: missing comments in range and prefix expressions in sets") Fixes: be90e03dd1fa ("segtree: add timeout for range and prefix expressions in sets") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix printing of "tcp flags syn" and "tcp flags == syn" expressionsSabrina Dubroca2018-05-252-1/+6
| | | | | | | | | | | | | | | | | | | | | | Commit 6979625686ec ("relational: Eliminate meta OPs") introduced some bugs when printing bitmask types. First, during the post-processing phase of delinearization, the expression for "tcp flags syn" (PAYLOAD & flag != 0) gets converted to PAYLOAD == flag, which is not equivalent. This should be PAYLOAD (IMPL) flag. Then, during output, the "==" sign from "tcp flags == syn" is dropped, because the bitmask condition in must_print_eq_op() was removed. Let's restore it, so that "tcp flags == syn" doesn't get printed as "tcp flags syn". An extra check for value types is added, so that we don't start printing "==" for sets such as "tcp flags {syn,ack}" Finally, add a regression test for this particular case. Fixes: 6979625686ec ("relational: Eliminate meta OPs") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: add timeout for range and prefix expressions in setsPablo Neira Ayuso2018-05-241-0/+10
| | | | | | | | | | | | | | | | # nft add table x # nft add set x y { type ipv4_addr\; flags timeout,interval\; } # nft add element x y { 7.4.4.5-8.8.8.8 comment "good guy" timeout 30s} # nft list ruleset table ip x { set y { type ipv4_addr flags interval,timeout elements = { 7.4.4.5-8.8.8.8 timeout 30s expires 27s956ms comment "good guy" } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: missing comments in range and prefix expressions in setsPablo Neira Ayuso2018-05-161-0/+6
| | | | | | | | | | | | table inet filter { set spamhaus { type ipv4_addr flags interval elements = { 1.2.3.8/31 comment "evil people", 3.3.3.16-3.3.3.20 comment "more than evil" } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Move scanner object into struct nft_ctxPhil Sutter2018-05-151-22/+21
| | | | | | | | | | | | | | The initial approach of keeping as much of lex/yacc-specific data local to the relevant parsing routines was flawed in that input descriptors which parsed commands' location information points at were freed after parsing (in scanner_destroy()) although they were required later for error reporting in case a command was rejected by the kernel. To overcome this, keep the scanner pointer in struct nft_ctx so that it can be kept in place until kernel communication has finished. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: xt: don't use hard-coded AF_INETFlorian Westphal2018-05-141-4/+20
| | | | | | | | | | We need to check which revision type is requested (match, target) and wheter its ipv4 or ipv6, then set family based on that. This allows nft ipv6 family to display compat entries if a translation is available. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: Return ENOENT if rule index is too largePhil Sutter2018-05-111-1/+1
| | | | | | | | | Since EINVAL usually indicates errors from kernel, avoid using it here too. Instead return ENOENT to indicate there's no entry to append or prepend the rule to. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Implement JSON parserPhil Sutter2018-05-113-4/+3152
| | | | | | | | | If JSON output setting is active in current context, try parsing any input as JSON. If the initial loading of the buffer or filename by libjansson fails, fall back to regular syntax parser. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Implement JSON output supportPhil Sutter2018-05-1116-1/+1657
| | | | | | | | | | | | Although technically there already is support for JSON output via 'nft export json' command, it is hardly useable since it exports all the gory details of nftables VM. Also, libnftables has no control over what is exported since the content comes directly from libnftnl. Instead, implement JSON format support for regular 'nft list' commands. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Introduce a few helper functionsPhil Sutter2018-05-112-15/+50
| | | | | | | | | | | | | | | This adds a bunch of functions for conversion of different values into string (and vice-versa). * log_level_parse(): A simple helper to turn log level string representation into log level value. * nat_etype2str(): Translate nat statement type into string representation. * ct_dir2str(): Convert IP_CT_DIR_* values into string representation. * ct_label2str(): Convert ct_label values into string representation. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Make some functions globally accessiblePhil Sutter2018-05-114-6/+6
| | | | | | | | | | | | | | | This removes static flag and adds header prototype for the following functions: * must_print_eq_op() from src/expression.c * fib_result_str() from src/fib.c * set_policy2str() and chain_policy2str from src/rule.c In fib.h, include linux/netfilter/nf_tables.h to make sure enum nft_fib_result is known when including this file. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Make some arrays globally accessiblePhil Sutter2018-05-117-9/+9
| | | | | | | | | | | | | | | This removes static flag and adds declarations in headers for the following arrays: * ct_templates from src/ct.c * mark_tbl from src/datatype.c * meta_templates and devgroup_tbl from src/meta.c * table_flags_name from src/rule.c * set_stmt_op_names from src/statement.c * tcpopthdr_protocols from src/tcpopt.c Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Put bison parsing into dedicated functionsPhil Sutter2018-05-111-39/+62
| | | | | | | | Preparing for an alternative JSON parser, put bison specific details into separate functions. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Support 'add/insert rule index <IDX>'Phil Sutter2018-05-094-2/+64
| | | | | | | | | | | Allow to specify an absolute rule position in add/insert commands like with iptables. The translation to rule handle takes place in userspace, so no kernel support for this is needed. Possible undesired effects are pointed out in man page to make users aware that this way of specifying a rule location might not be ideal. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Copy locations in handle_merge()Phil Sutter2018-05-091-3/+9
| | | | | | | | This allows to make error messages point to the right part of the command after handles were merged. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Deprecate add/insert rule 'position' argumentPhil Sutter2018-05-091-0/+8
| | | | | | | | | | Instead, use 'handle' keyword for the same effect since that is more consistent with respect to replace/delete commands. The old keyword is still supported for backwards compatibility and also listed in man page along with a hint that it shouldn't be used anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support timeouts in millisecondsFlorian Westphal2018-05-095-23/+43
| | | | | | | | | | currently the frontend uses seconds everywhere and multiplies/divides by 1000. Pass milliseconds around instead and extend the scanner to accept 'ms' in timestrings. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: don't BUG if we can't find an extensionsFlorian Westphal2018-05-081-6/+8
| | | | | | it seems a bit harsh to just exit. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: added missing semicolonMáté Eckl2018-05-081-0/+1
| | | | | | | It did not make any harm, but it was certainly missing. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* scanner: Support rfc4291 IPv4-compatible addressesPhil Sutter2018-05-061-1/+2
| | | | | | | | | | | These are defined in section 2.5.5.1. Although it is stated that they are deprecated and new implementations are not required to support them, they occur in ruleset output if an address in the form '::feed:babe' was given in input. In order to support reinsertion of that rule, we have to support those deprecated addresses as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: Fix wrong token in proto_icmp6Phil Sutter2018-05-061-1/+1
| | | | | | | | | | | | 'token' value of ICMP6HDR_MTU field must be 'mtu', not 'packet-too-big'. This went unnoticed because rule delinearization for icmp/icmpv6 payload expressions is problematic anyway in that different fields point to the same offset and therefore are indistinguishable. In this case, an expression like e.g. 'icmpv6 mtu 1500' will be printed later as 'icmpv6 parameter-problem 1500'. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use location to display error messagesPablo Neira Ayuso2018-05-061-62/+94
| | | | | | | | | # nft add chain foo bar Error: Could not process rule: No such file or directory add chain foo bar ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add obj_specPablo Neira Ayuso2018-05-064-17/+19
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set_specPablo Neira Ayuso2018-05-067-41/+43
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain_specPablo Neira Ayuso2018-05-065-21/+23
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table_specPablo Neira Ayuso2018-05-066-66/+67
| | | | | | Store location object in handle to improve error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Removed LOOKUP tokenMáté Eckl2018-05-051-1/+0
| | | | | | | It is never used. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* meter: enforce presence of a max sizeFlorian Westphal2018-05-024-1/+13
| | | | | | | | | | meters are updated dynamically, so we don't know in advance how large this structure can be. Add a 'size' keyword to specifiy an upper limit and update the old syntax to assume a default max value of 65535. Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: fix header exportArturo Borrero Gonzalez2018-05-022-2/+2
| | | | | | | | | | | Instruct Make to actually install the header to the system, otherwise users won't see the header in their system after running 'make install'. Also, export main libnftables header with a proper name, since we have another private header called 'nftables.h' (i.e, let's be concrete with the naming). Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: do not hardcode ingress when printing flowtablePablo Neira Ayuso2018-04-261-1/+2
| | | | | | Call hook number to string function instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: missing flowtable evaluation from nested notationPablo Neira Ayuso2018-04-261-0/+7
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix --debug mnl not producing outputDuncan Roe2018-04-263-18/+18
| | | | | | | | | cache_update() needs to accept the full debug mask instead of a boolean of NFT_DEBUG_NETLINK, because called functions may wish to check other bits (NFT_DEBUG_MNL in particular). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>