summaryrefslogtreecommitdiffstats
path: root/iptables/nft.c
Commit message (Collapse)AuthorAgeFilesLines
* nft: Drop stale include directivePhil Sutter2019-08-011-1/+0
| | | | | | | | This is a leftover, the file does not exist in fresh clones. Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Drop support for /etc/xtables.confPhil Sutter2019-07-291-154/+8
| | | | | | | | As decided upon at NFWS2019, drop support for configurable nftables base chains to use with iptables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Set errno in nft_rule_flush()Phil Sutter2019-07-291-1/+3
| | | | | | | | | | | When trying to flush a non-existent chain, errno gets set in nft_xtables_config_load(). That is an unintended side-effect and when support for xtables.conf is later removed, iptables-nft will emit the generic "Incompatible with this kernel." error message instead of "No chain/target/match by that name." as it should. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Make nft_for_each_table() more versatilePhil Sutter2019-07-231-3/+3
| | | | | | | Support passing arbitrary data (via void pointer) to the callback. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: exit in case we can't fetch current genidFlorian Westphal2019-07-151-2/+8
| | | | | | | | | | | When running iptables -nL as non-root user, iptables would loop indefinitely. With this change, it will fail with iptables v1.8.3 (nf_tables): Could not fetch rule set generation id: Permission denied (you must be root) Reported-by: Amish <anon.amish@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Move send/receive buffer sizes into nft_handlePhil Sutter2019-07-031-10/+7
| | | | | | | | | Store them next to the mnl_socket pointer. While being at it, add a comment to mnl_set_rcvbuffer() explaining why the buffer size is changed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Pass nft_handle down to mnl_batch_talk()Phil Sutter2019-07-031-23/+18
| | | | | | | | | >From there, pass it along to mnl_nft_socket_sendmsg() and further down to mnl_set_{snd,rcv}buffer(). This prepares the code path for keeping stored socket buffer sizes in struct nft_handle. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Set socket receive bufferPhil Sutter2019-07-031-4/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to delete user-defined chains in a large ruleset, iptables-nft aborts with "No buffer space available". This can be reproduced using the following script: | #! /bin/bash | iptables-nft-restore <( | | echo "*filter" | for i in $(seq 0 200000);do | printf ":chain_%06x - [0:0]\n" $i | done | for i in $(seq 0 200000);do | printf -- "-A INPUT -j chain_%06x\n" $i | printf -- "-A INPUT -j chain_%06x\n" $i | done | echo COMMIT | | ) | iptables-nft -X The problem seems to be the sheer amount of netlink error messages sent back to user space (one EBUSY for each chain). To solve this, set receive buffer size depending on number of commands sent to kernel. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: reset netlink sender buffer size of socket restartPablo Neira Ayuso2019-05-201-0/+1
| | | | | | | | Otherwise, mnl_set_sndbuffer() skips the buffer update after socket restart. Then, sendmsg() fails with EMSGSIZE later on when sending the batch to the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: do not retry on EINTRPablo Neira Ayuso2019-05-201-21/+5
| | | | | | | Patch ab1cd3b510fa ("nft: ensure cache consistency") already handles consistency via generation ID. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't care about previous state in ERESTARTPablo Neira Ayuso2019-05-201-7/+10
| | | | | | | We need to re-evalute based on the existing cache generation. Fixes: 58d7de0181f6 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't skip table addition from ERESTARTPablo Neira Ayuso2019-05-201-9/+1
| | | | | | | I don't find a scenario that trigger this case. Fixes: 58d7de0181f6 ("xtables: handle concurrent ruleset modifications") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for explicit rule flushesPhil Sutter2019-05-201-1/+1
| | | | | | | | | | | The commit this fixes added a new parameter to __nft_rule_flush() to mark a rule flush job as implicit or not. Yet the code added to that function ignores the parameter and instead always sets batch job's 'implicit' flag to 1. Fixes: 77e6a93d5c9dc ("xtables: add and set "implict" flag on transaction objects") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: keep original cache in case of ERESTARTPablo Neira Ayuso2019-05-201-3/+20
| | | | | | | | | | | | | | | Phil Sutter says: "The problem is that data in h->obj_list potentially sits in cache, too. At least rules have to be there so insert with index works correctly. If the cache is flushed before regenerating the batch, use-after-free occurs which crashes the program." This patch keeps around the original cache until we have refreshed the batch. Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: ensure cache consistencyPablo Neira Ayuso2019-05-201-6/+16
| | | | | | | Check for generation ID before and after fetching the cache to ensure consistency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: cache table listPablo Neira Ayuso2019-05-201-45/+57
| | | | | | | nft_table_find() uses the table list cache to look up for existing tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add flush_cache()Pablo Neira Ayuso2019-05-191-11/+19
| | | | | | | | | This new function takes a struct nft_cache as parameter. This patch also introduces __nft_table_builtin_find() which is required to look up for built-in tables without the nft_handle structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add __nft_table_builtin_find()Pablo Neira Ayuso2019-05-191-6/+12
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: statify nft_rebuild_cache()Pablo Neira Ayuso2019-05-191-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: add struct nft_cachePablo Neira Ayuso2019-05-191-15/+16
| | | | | | Add new structure that encloses the cache and update the code to use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Don't leak iter in error path of __nft_chain_zero_counters()Phil Sutter2019-05-151-1/+3
| | | | | | | | | If batch_rule_add() fails, this function leaked the rule iterator object. Fixes: 4c54c892443c2 ("xtables: Catch errors when zeroing rule rounters") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: handle concurrent ruleset modificationsFlorian Westphal2019-04-271-4/+127
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently race when several xtables-nft-restore processes attempt to handle rules in parallel. For instance, when no rules are present at all, then iptables-nft-restore < X & iptables-nft-restore < X ... can cause rules to be restored twice. Reason is that both processes might detect 'no rules exist', so neither issues a flush operation. We can't unconditionally issue the flush, because it would cause kernel to fail with -ENOENT unless the to-be-flushed table exists. This change passes the generation id that was used to build the transaction to the kernel. In case another process changed *any* rule somewhere, the transaction will now fail with -ERESTART. We then flush the cache, re-fetch the ruleset and refresh our transaction. For example, in the above 'parallel restore' case, the iptables-restore instance that lost the race would detect that the table has been created already, and would add the needed flush. In a similar vein, in case --noflush is used, we will add the flush op for user-defined chains that were created in the mean-time. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add and set "implict" flag on transaction objectsFlorian Westphal2019-04-271-19/+24
| | | | | | | | | | | | | | | | | | | | | | Its used to flag the rule flushes that get added in user-defined-chains that get redefined with --noflush. IOW, those objects that are added not by explicit instruction but to keep semantics. With --noflush, iptables-legacy-restore will behave as if -F USERCHAIN was given, in case USERCHAIN exists and USERCHAIN gets redefined, i.e.: iptables-save v1.8.2 on Thu Apr 18 17:11:05 2019 *filter :USERCHAIN - [0:0] COMMIT ... will remove all existing rules from USERCHAIN. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add and use nft_build_cacheFlorian Westphal2019-04-271-5/+23
| | | | | | | | | | | | Will be used with the "generation id" infrastructure. When we're told that the commit failed because someone else made changes, we can use this to re-initialize the cache and then revalidate the transaction list (e.g. to detect that we now have to flush the user-defined chain 'foo' that we wanted to create, but was added just now by someone else). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add skip flag to objectsFlorian Westphal2019-04-271-18/+31
| | | | | | | | | | | | This will be used to skip transaction objects when committing to kernel. This is needed for example when we restore a table that doesn't exist yet. In such a case we would already build a flush operation so we can just enable it when we hit problem with the generation id and we find that the table/chain was already created in the mean time. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: unify user chain add/flush for restore caseFlorian Westphal2019-04-271-43/+39
| | | | | | | | | | | | The idea here is to move the 'flush' decision into the core, rather than have the decision in the frontend. This will be required later when "generation id" is passed to kernel. In this case, we might have to add the flush when re-trying the transaction. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error message for chain renamingPhil Sutter2019-02-131-1/+7
| | | | | | | | | If the new name already exists, legacy iptables prints "File exists.". This is a bit exotic, but more appropriate than "No chain/target/match by that name." printed by iptables-nft without this patch. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error messages in commands with rule numberPhil Sutter2019-02-131-6/+6
| | | | | | | | | | | | Use E2BIG if rule identified by given number is not found. ENOENT is used if referenced chain is not found. Without this, a command specifying a non-existing chain in combination with a rule number like e.g.: 'iptables-nft -I nonexist 23 -j ACCEPT' returns "Index of insertion too big." instead of "No chain/target/match by that name." like legacy iptables does. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Move new chain check to where it belongsPhil Sutter2019-02-131-0/+5
| | | | | | | | Instead of checking chain existence in xtables.c, do it in nft_chain_user_add() and reuse predefined error message. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error message when zeroing a non-existent chainPhil Sutter2019-02-131-1/+3
| | | | | | | | | | | | | Previously, error message was a bit misleading: | # iptables-nft -Z noexist | iptables: Incompatible with this kernel. Set errno value so that the typical "No chain/target/match by that name." is printed instead. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Eliminate dead code in __nft_rule_listPhil Sutter2019-02-111-12/+1
| | | | | | | | | | | If passed a rulenum > 0, the function uses nftnl_rule_lookup_byindex() and returns early. Negative rulenum values are not supposed to happen, so the remaining code which iterates over the full list of rules does not need to respect rulenum anymore. Fixes: 039b048965210 ("nft: Make use of nftnl_rule_lookup_byindex()") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: Support user-defined chain policiesPhil Sutter2019-02-081-2/+226
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Legacy ebtables supports policies for user-defined chains - and what's worse, they default to ACCEPT unlike anywhere else. So lack of support for this braindead feature in ebtables-nft is actually a change of behaviour which very likely affects all ebtables users out there. The solution implemented here uses an implicit (and transparent) last rule in all user-defined ebtables-nft chains with policy other than RETURN. This rule is identified by an nft comment "XTABLES_EB_INTERNAL_POLICY_RULE" (since commit ccf154d7420c0 ("xtables: Don't use native nftables comments") nft comments are not used otherwise). To minimize interference with existing code, this policy rule is removed from chains during cache population and the policy is saved in NFTNL_CHAIN_POLICY attribute. When committing changes to the kernel, nft_commit() traverses through the list of chains and (re-)creates policy rules if required. In ebtables-nft-restore, table flushes are problematic. To avoid weird kernel error responses, introduce a custom 'table_flush' callback which removes any pending policy rule add/remove jobs prior to creating the NFT_COMPAT_TABLE_FLUSH one. I've hidden all this mess behind checks for h->family, so hopefully impact on {ip,ip6,arp}tables-nft should be negligible. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Introduce UDATA_TYPE_EBTABLES_POLICYPhil Sutter2019-02-081-0/+3
| | | | | | | | | This will be used later to identify ebtables user-defined chain policy rules. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Catch errors when zeroing rule rountersPhil Sutter2019-02-011-1/+3
| | | | | | | Covscan complained about call to batch_rule_add() not being checked. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Speed up chain deletion in large rulesetsPhil Sutter2019-01-291-0/+2
| | | | | | | | | | Kernel prefers to identify chain by handle if it was given which causes manual traversal of the chain list. In contrast, chain lookup by name in kernel makes use of a hash table so is considerably faster. Force this code path by removing the cached chain's handle when removing it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for inserting rule at wrong positionPhil Sutter2019-01-281-10/+20
| | | | | | | | | | | | | | | | | | | iptables-restore allows to insert rules at a certain position which is problematic for iptables-nft to realize since rule position is not determined by number but handle of previous or following rule and in case the rules surrounding the new one are new as well, they don't have a handle to refer to yet. Fix this by making use of NFTNL_RULE_POSITION_ID attribute: When inserting before a rule which does not have a handle, refer to it using its NFTNL_RULE_ID value. If the latter doesn't exist either, assign a new one to it. The last used rule ID value is tracked in a new field of struct nft_handle which is incremented before each use. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix position of replaced rules in cachePhil Sutter2019-01-181-17/+17
| | | | | | | | | | | When replacing a rule, the replacement was simply appended to the chain's rule list. Instead, insert it where the rule it replaces was. This also fixes for zero counters command to remove the old rule from cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Add new builtin chains to cache immediatelyPhil Sutter2019-01-181-21/+9
| | | | | | | | | | | | Newly created builtin chains missing from cache was the sole reason for the immediate calls to nft_commit(). With nft_chain_builtin_add() inserting the new chain into the table's chain list, this is not needed anymore. Just make sure batch_obj_del() doesn't free the payload of NFT_COMPAT_CHAIN_ADD jobs since it contains the new chain which has been added to cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Set errno in nft_rule_check() if chain not foundPhil Sutter2019-01-111-5/+7
| | | | | | | | | | | | With this, the explicit check for chain existence can be removed from xtables.c since all related commands do this now. Note that this effectively changes the error message printed by iptables-nft when given a non-existing chain, but the new error message(s) conform with those printed by legacy iptables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify flush_chain_cache()Phil Sutter2019-01-091-13/+11
| | | | | | | | | | | | With all the checks for 'tablename' being non-NULL, this code was rather stupid and really hard to read. And the fix is indeed quite simple: If a table name was given, use nft_table_builtin_find() and just flush its chain cache. Otherwise iterate over all builtin tables without any conditionals for 'tablename'. Fixes: d4b0d248cc057 ("nft: Reduce indenting level in flush_chain_cache()") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify nft_is_chain_compatible()Phil Sutter2019-01-091-25/+9
| | | | | | | | | | Make use of nft_{table,chain}_builtin_find() instead of open-coding the list traversal. Since code is pretty obvious now, drop the comments added earlier. Fixes: e774b15299c27 ("nft: Review is_*_compatible() routines") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Make use of nftnl_rule_lookup_byindex()Phil Sutter2018-12-271-13/+18
| | | | | | | | Use the function where suitable to potentially speedup rule cache lookup by rule number. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize list rules command with given chainPhil Sutter2018-12-271-50/+43
| | | | | | | | | | | If a chain name was given, make use of nftnl_chain_list_lookup_byname(). Likewise in nftnl_rule_list_chain_save(), but introduce __nftnl_rule_list_chain_save() suitable for passing to nftnl_chain_list_foreach(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize list command with given chainPhil Sutter2018-12-271-46/+32
| | | | | | | | | Make use of nftnl_chain_list_lookup_byname() even if not listing a specific rule. Introduce __nft_print_header() to consolidate chain value extraction for printing with ops->print_header(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize user-defined chain deletionPhil Sutter2018-12-271-43/+46
| | | | | | | | | Make use of nftnl_chain_list_lookup_byname() if a chain name was given. Move the actual chain deleting code into a callback suitable for passing to nftnl_chain_list_foreach(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize nft_chain_zero_counters()Phil Sutter2018-12-271-36/+36
| | | | | | | | | | | | | If a chain name was given, make use of nftnl_chain_list_lookup_byname(). Streamline nft_chain_zero_rule_counters() to be suitable for calling from nftnl_chain_list_foreach(). There is an unrelated optimization in here, too: Add batch job NFT_COMPAT_CHAIN_ZERO only if it is a base chain. Since user-defined chains don't have counters, there is no need to do anything for them. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize flushing a specific chainPhil Sutter2018-12-271-13/+17
| | | | | | | | If a chain name is given to nft_rule_flush(), make use of nftnl_chain_list_lookup_byname(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Drop nft_chain_list_find()Phil Sutter2018-12-271-29/+2
| | | | | | | | Replace the function by nftnl_chain_list_lookup_byname() as provided by libnftnl. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Implement per chain rule cachePhil Sutter2018-12-271-221/+165
| | | | | | | | | | | | | | | Use recently introduced support for rules inside chains in libnftnl to introduce a rule cache per chain instead of a global one. A tricky bit is to decide if cache should be updated or not. Previously, the global rule cache was populated just once and then reused unless being flushed completely (via call to flush_rule_cache() with NULL-pointer table argument). Resemble this behaviour by introducing a boolean indicating cache status and fetch rules for all chains when updating the chain cache in nft_chain_list_get(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Move nft_rule_list_get() above nft_chain_list_get()Phil Sutter2018-12-271-55/+55
| | | | | | | | | | Later when introducing per chain rule caches, nft_rule_list_get() will be removed. But nftnl_rule_list_cb() which it uses will be reused to update each chain's rule cache from inside nftnl_chain_list_get(), so move both into position. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>