summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build: libnftnl 1.1.3 releaselibnftnl-1.1.3Pablo Neira Ayuso2019-05-273-2/+3
| | | | | | Moreover, add missing include/rule.h file to Makefile.am. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Remove redundant declaration of nftnl_gen_nlmsg_parse()Phil Sutter2019-05-141-1/+0
| | | | | | | | | The duplicated declaration was there since the functions initial introduction as 'nft_gen_nlmsg_parse()'. Fixes: 2e66fb09d6936 ("src: add ruleset generation class") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: add version option supportFernando Fernandez Mancera2019-04-083-0/+20
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: libnftnl: export genid functions againFlorian Westphal2019-03-131-8/+8
| | | | | | | | Can't use them currently: they are exported only under their old names. Fixes: 44d11498479a08 ("src: get rid of _attr_ infix in new nftnl_ definitions") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* udata: add NFTNL_UDATA_* definitionsPablo Neira Ayuso2019-02-121-0/+33
| | | | | | | | Place them in the library, so iptables and nftables do not need to redefine them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* set_elem: close a padding holeFlorian Westphal2019-02-081-1/+1
| | | | | | 224 -> 216 bytes on x86_64. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rule: Support NFTA_RULE_POSITION_ID attributePhil Sutter2019-01-284-0/+24
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "expr: add map lookups for hash statements"Laura Garcia Liebana2019-01-283-47/+4
| | | | | | | | | A better way to implement this from userspace has been found without specific code in the kernel side, revert this. Fixes: bb4b75aea5c0 ("expr: add map lookups for hash statements") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "expr: add map lookups for numgen statements"Laura Garcia Liebana2019-01-283-47/+4
| | | | | | | | | A better way to implement this from userspace has been found without specific code in the kernel side, revert this. Fixes: b97f45c2ebaa ("expr: add map lookups for numgen statements") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: chain: Fix nftnl_chain_rule_insert_at()Phil Sutter2019-01-143-0/+8
| | | | | | | | | | Extrapolating from iptables nomenclature, one would expect that "insert" means to prepend the new item to the referenced one, not append. Change nftnl_chain_rule_insert_at() to do just that and introduce nftnl_chain_rule_append_at() to insert a rule after the referenced one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: chain: Add missing nftnl_chain_rule_del()Phil Sutter2019-01-143-0/+8
| | | | | | | | | | | Although identical to nftnl_rule_list_del(), this function adheres to the common naming style of per chain rule list routines introduced earlier, therefore helps with deprecating the global rule list API at a later point. Fixes: e33798478176f ("chain: Support per chain rules list") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Fix for reading garbagePhil Sutter2018-12-211-2/+2
| | | | | | | | | nftnl_flowtable_get_data() doesn't assign to passt data_len pointer destination in all cases, so initialize it to 0. Fixes: eb58f53372e74 ("src: add flowtable support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Fix memleak in nftnl_flowtable_parse_devs()Phil Sutter2018-12-211-3/+7
| | | | | | | | | | Allocated strings in dev_array were not freed. Fix this by freeing them on error path and assigning them to c->dev_array directly in regular path. Fixes: eb58f53372e74 ("src: add flowtable support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Fix use after free in two spotsPhil Sutter2018-12-211-6/+4
| | | | | | | | | When freeing flowtable devices array, the loop freeing each device string incorrectly included the call to free the device array itself. Fixes: eb58f53372e74 ("src: add flowtable support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Add missing breakPhil Sutter2018-12-211-0/+1
| | | | | | | | | | In nftnl_flowtable_set_data(), when setting flowtable size, the switch() case fell through and the same value was copied into ft_flags field. This can't be right. Fixes: 41fe3d38ba34b ("flowtable: support for flags") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* object: Avoid obj_ops array overrunPhil Sutter2018-12-211-1/+1
| | | | | | | | | In version 1.1.1, obj_ops array was smaller than __NFT_OBJECT_MAX since there are no ops for NFT_OBJECT_CONNLIMIT. Avoid this potential issue in the future by defining the array size. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Hash chain list by namePhil Sutter2018-12-121-1/+29
| | | | | | | | | | | | | | | | | | | | | | | | Introduce a hash table to speedup nftnl_chain_list_lookup_byname(). In theory this could replace the linked list completely but has been left in place so that nftnl_chain_list_add_tail() still does what it's supposed to and iterators return chains in original order. Speed was tested using a simple script which creates a dump file containing a number of custom chains and for each of them two rules in INPUT chain jumping to it. The following table compares run-time of iptables-legacy-restore with iptables-nft-restore before and after this patch: count legacy nft-old nft-new ---------------------------------------------- 10000 26s 38s 31s 50000 137s 339s 149s So while it is still not as quick, it now scales nicely (at least in this very primitive test). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Add lookup functions for chain list and rules in chainPhil Sutter2018-12-073-0/+33
| | | | | | | | | For now, these lookup functions simply iterate over the linked list until they find the right entry. In future, they may make use of more optimized data structures behind the curtains. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Support per chain rules listPhil Sutter2018-12-076-23/+155
| | | | | | | The implementation basically copies expr_list in struct nftnl_rule. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: libnftnl 1.1.2 releaselibnftnl-1.1.2Pablo Neira Ayuso2018-11-131-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove nftnl_rule_cmp() and nftnl_expr_cmp()Pablo Neira Ayuso2018-10-2442-751/+5
| | | | | | | | | | | | | | These functions are not very useful, rule comparison from this layer does not work well with implicit set definitions. This infrastructure was added as an attempt to support for deletion by name from this layer, which should be done from higher level libnftables library. Finally, we never had a client for this code in git.netfilter.org. Let's remove it and bump libversion for safety reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use memcpy() to handle potentially unaligned dataMatt Turner2018-10-1949-191/+196
| | | | | | | | | | | | Rolf Eike Beer <eike@sf-mail.de> reported that nft-expr_quota-test fails with a SIGBUS on SPARC due to unaligned accesses. This patch resolves that and fixes additional sources of unaligned accesses matching the same pattern. Both nft-expr_quota-test and nft-expr_objref-test generated unaligned accesses on DEC Alpha. Bug: https://bugs.gentoo.org/666448 Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Remove test-script.shMatt Turner2018-10-182-34/+0
| | | | | | | All tests are now run with make check. Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Run regression tests from make checkMatt Turner2018-10-181-0/+2
| | | | | | | | The existing test-script.sh does not check the return values of the tests so it is not very good for automated testing. Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Execute nft-flowtable-test in test-script.shMatt Turner2018-10-181-0/+1
| | | | | | | | Seems to have been forgotten in commit 4d472c225ba0 ("tests: add flowtable regression test") Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: secmark: remove json stubPablo Neira Ayuso2018-10-151-22/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: add ttl option supportFernando Fernandez Mancera2018-10-153-1/+26
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-15139-5716/+38
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for new secmark objectChristian Göttsche2018-10-096-1/+186
| | | | | | | The new object will hold security context strings. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add xfrm supportFlorian Westphal2018-09-215-0/+365
| | | | | | | Joint work with Máté Eckl. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: rt: ipsec match supportFlorian Westphal2018-09-212-0/+3
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: fix error in building testsHarsha Sharma2018-09-201-0/+1
| | | | | | | | | Add include header for NFTNL_CTTIMEOUT_ARRAY_MAX. Fixes compilation error "../include/obj.h:43:21: error: ‘NFTNL_CTTIMEOUT_ARRAY_MAX’ undeclared here (not in a function); Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: don't skip zero value timeoutPablo Neira Ayuso2018-08-311-4/+3
| | | | | | It's a valid configuration, don't assume this means timeout is unset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: use fixed size arrayPablo Neira Ayuso2018-08-313-24/+8
| | | | | | | | | Use an internal array and expose maximum size so we can just use the same array size for all protocol timeouts. This simplifies handling a bit and we don't need to set NFTNL_OBJ_CT_TIMEOUT_L4PROTO in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: fix gcc4 build errorFlorian Westphal2018-08-211-1/+3
| | | | | | gcc 4.9 only allows for-loop initialisation declarations in C99 or C11 modes. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: remove cttimeout.h leftoverPablo Neira Ayuso2018-08-142-2/+0
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: Add test for assigning timeout objects via ruleHarsha Sharma2018-08-132-1/+159
| | | | | | | | | | | | | | | | | | Usage: ./nft-rule-ct-timeout-add ip filter input some-name ./nft-rule-get ip filter ip filter input 4 [ objref type 7 name some-name ] nft list ruleset ... chain input { ct timeout set "some-name" } Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: add nft-ct-timeout-{add,del,get}Harsha Sharma2018-08-134-0/+437
| | | | | | | | | | | | | | | Add, list and delete ct timeout objects from specified table Usage e.g.: % ./nft-ct-timeout-add ip filter some-name tcp % ./nft-ct-timeout-get ip filter table filter name some-name use 0 [ ct_timeout family 2 protocol 6 policy = {ESTABLISHED = 111,CLOSE_WAIT = 14, CLOSE = 16}] % ./nft-ct-timeout-del ip filter some-name Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ct timeout supportHarsha Sharma2018-08-136-1/+416
| | | | | | | | Add support for ct timeout objects, used to assign connection tracking timeout policies. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: modify _snprintf_default functionFernando Fernandez Mancera2018-08-071-1/+1
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add support for matching tunnel metadataPablo Neira Ayuso2018-08-065-0/+215
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: add tunnel supportPablo Neira Ayuso2018-08-066-1/+699
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: remove json codePablo Neira Ayuso2018-08-031-18/+0
| | | | | | This code, which is enabled via --with-json-parsing, doesn't compile. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add osf supportFernando Fernandez Mancera2018-07-305-0/+193
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: Add tproxy supportMáté Eckl2018-07-305-0/+230
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* socket: Expose socket mark via socket expressionMáté Eckl2018-07-302-1/+4
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: missing C++ linkage in headersPablo Neira Ayuso2018-07-034-0/+32
| | | | | | | | A few files (batch.h / common.h / set.h / udata.h) are missing the usual. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1268 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr/exthdr: Fix JSON parsing on big endianPhil Sutter2018-06-261-1/+1
| | | | | | | | | | | When setting NFTNL_EXPR_EXTHDR_TYPE, one needs to call nftnl_expr_set_u8() and not nftnl_expr_set_u32(). Otherwise 'type' variable is assigned to uint32_t parameter before being passed to nftnl_expr_exthdr_set() as void pointer which casts it to uint8_t. On big endian systems, the latter would only consider the most significant byte instead of the least significant one. Signed-off-by: Phil Sutter <phil@nwl.cc>
* expr/data_reg: Fix JSON parsing on big endianPhil Sutter2018-06-261-2/+2
| | | | | | | | | | | Since reg->len is a 32bit variable, one needs to pass NFTNL_TYPE_U32 to nftnl_jansson_parse_val(). Otherwise, only the most significant byte in that variable is being written to. Since the value could potentially be larger than 255, increase node_name buffer to avoid a compiler warning. Signed-off-by: Phil Sutter <phil@nwl.cc>
* utils: Fix nftnl_get_value() on big endianPhil Sutter2018-06-261-2/+42
| | | | | | | | | | | | This function basically did: | memcpy(out, val, <len of requested type>); which works only for little endian integer types. Fix this by assigning the 64bit input value to a variable of the right size and use that as input for above memcpy() call. Signed-off-by: Phil Sutter <phil@nwl.cc>