summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* nft: support listing expressions that use non-byte header fieldsFlorian Westphal2015-09-184-13/+159
| | | | | | | This allows to list rules that check fields that are not aligned on byte boundary. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add tests for ip version/hdrlength/tcp doffFlorian Westphal2015-09-187-0/+78
| | | | | | | Header fields of 4 bit lengths. Requires implicit masks and shifting of RHS constant. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: cmp: shift rhs constant if lhs offset doesn't start on byte boundaryFlorian Westphal2015-09-181-0/+10
| | | | | | | | | | | | | | if we have payload(someoffset) == 42, then shift 42 in case someoffset doesn't start on a byte boundary. We already insert a mask instruction to only load those bits into the register that we were interested in, but the cmp will fail without also adjusting rhs accordingly. Needs additional patch in reverse direction to undo the shift again when dumping ruleset. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: fill in doff and fix ihl/version template entriesFlorian Westphal2015-09-181-4/+6
| | | | | | | | | | | | This allows to use nft add rule ip filter input tcp doff 8 or similar. Furhermore, ip version looked at hdrlen and vice versa. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: netlink: don't truncate set key lengthsFlorian Westphal2015-09-181-2/+2
| | | | | | | If key is e.g. 12 bits, pretend its 16 instead of 8. This is needed to make sets work with header fields with size not divisible by 8. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: netlink_linearize: handle sub-byte lengthsFlorian Westphal2015-09-181-2/+44
| | | | | | | | | | | | | | Currently length is expr->len / BITS_PER_BYTE, i.e. expr->len has to be a multiple of 8. When core asks for e.g. '9 bits', we truncate this to 8. Round up to 16 and inject a 9-bit mask to zero out the parts we're not interested in. This will also need change to the delinarization step to remove the extra op when dumping rules from kernel. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: disable payload merge if offsets are not on byte boundary.Florian Westphal2015-09-181-0/+4
| | | | | | | | | | | | | | | | | | ... because it doesn't work, we attempt to merge it into wrong place, we would have to merge the second value at a specific location. F.e. vlan hdr 4094 gives us 0xfe0f Merging in the CFI should yield 0xfe1f, but the constant merging doesn't know how to achive that; at the moment 'vlan id 4094' and 'vlan id 4094 vlan cfi 1' give same result -- 0xfe0f. For now just turn off the optimization step unless everything is byte divisible (the common case). Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: allow stacking vlan header on top of ethernetFlorian Westphal2015-09-184-10/+121
| | | | | | | | | | | | | | | | | | | | currently 'vlan id 42' or even 'vlan type ip' doesn't work since we expect ethernet header but get vlan. So if we want to add another protocol header to the same base, we attempt to figure out if the new header can fit on top of the existing one (i.e. proto_find_num gives a protocol number when asking to find link between the two). We also annotate protocol description for eth and vlan with the full header size and track the offset from the current base. Otherwise, 'vlan type ip' fetches the protocol field from mac header offset 0, which is some mac address. Instead, we must consider full size of ethernet header. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: don't depend on set element orderFlorian Westphal2015-09-182-1/+30
| | | | | | | | | | | | | Pablo reported test failures because the order of returned set entries is not deterministic. This sorts set elements before comparision. Patrick suggested to move ordering into libnftnl (since we could f.e. also get duplicate entries due to how netlink dumps work), but thats a bit more work. Hence this quick workaround. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* Bump version to v0.5v0.5Pablo Neira Ayuso2015-09-161-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use new symbols in libnftnlPablo Neira Ayuso2015-09-169-877/+877
| | | | | | | | | Adapt the nftables code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add concatenations and maps; combine them tooPablo Neira Ayuso2015-09-118-0/+118
| | | | | | | This patch adds simple tests for concatenation and maps, including more advanced tests that combine them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use existing table object from evaluation contextPablo Neira Ayuso2015-09-111-4/+18
| | | | | | | | | | | | | Skip table object lookup if we are in the context of table declaration already, ctx->table already points to the right table we have to use during the evalution. Otherwise, a list corruption occurs when using the wrong table object when it already exists in the kernel. http://marc.info/?l=netfilter-devel&m=144179814209295&w=2 Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* mnl: rework netlink socket receive path for eventsPablo Neira Ayuso2015-09-071-1/+37
| | | | | | | | | | | | | This patch reworks two aspects of the netlink socket event receive path: 1) In case of ENOBUFS, stay in the loop to keep receiving messages. The tool displays a message so the user knows that we got lost event messages. 2) Rise the default size of the receive socket buffer up to 16 MBytes to reduce chances of hitting ENOBUFS. Asumming that the netlink event message size is ~150 bytes, we can bear with ~111848 rules without message loss. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: flush stdout after each event in monitor modePablo Neira Ayuso2015-09-071-0/+1
| | | | | | | | So we get all events when redirecting them to file, ie. # nftables monitor > file Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: display error when trying to run tests out of the root directoryPablo Neira Ayuso2015-09-071-0/+5
| | | | | | | | | | Since 357d8cfcceb2 ("tests: use the src/nft binary instead of $PATH one"), the tests fail if you try to run them if you are not under the root directory of the nftables repository. Display an error so I don't forget I have to do it like this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix build with debug offFlorian Westphal2015-09-071-1/+1
| | | | | | mnl.c:241:1: error: expected identifier or '(' before '}' token Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add 'awkward' prefix match expressionFlorian Westphal2015-08-233-0/+17
| | | | | | Its just a more complicated way of saying 'ip saddr 255.255.0.0/16'. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: use the src/nft binary instead of $PATH oneFlorian Westphal2015-08-231-17/+18
| | | | | | | ... so one doesn't need to install new binary into $PATH (or change PATH... ) during development. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: redirect: fix payload displayPablo Neira Ayuso2015-08-182-33/+33
| | | | | | | This has to be related to libnftnl's 0edeb667a2cf ("expr: redir: fix snprintf to return the number of bytes printed"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: sets: don't include listing in payload testsPablo Neira Ayuso2015-08-184-6/+0
| | | | | | | | Since e715f6d1241c ("netlink: don't call netlink_dump_*() from listing functions with --debug=netlink"), there is no debugging from the listing path. Thus, we can remove the set line from the test files. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't call netlink_dump_*() from listing functions with --debug=netlinkPablo Neira Ayuso2015-08-181-4/+0
| | | | | | | | | | Now that we always retrieve the object list to build a cache before executing the command, this results in fully listing of existing objects in the kernel. This is confusing when adding a simple rule, so better not to call netlink_dump_*() from listing functions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: display error on unexisting chain when listingPablo Neira Ayuso2015-08-181-1/+11
| | | | | | | | | nft list chain ip test output <cmdline>:1:1-25: Error: Could not process rule: Chain 'output' does not exist list chain ip test output ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of EINTR handling for nft_netlink()Pablo Neira Ayuso2015-08-182-9/+6
| | | | | | | | | The only remaining caller that needs this is netlink_dump_ruleset(), that is used to export the ruleset using markup representation. We can remove it and handle this from do_command_export() now that we have a centralized point to build up the object cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set element objectsPablo Neira Ayuso2015-08-181-25/+11
| | | | | | Populate the cache iff the user requests a ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for rule objectsPablo Neira Ayuso2015-08-181-10/+12
| | | | | | Populate the cache iff the user requests a ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain declarations to cachePablo Neira Ayuso2015-08-181-2/+18
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add cmd_evaluate_rename()Pablo Neira Ayuso2015-08-181-0/+22
| | | | | | | Make sure the table that we want to rename already exist. This is required by the follow up patch that that adds chains to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for chain objectsPablo Neira Ayuso2015-08-181-39/+16
| | | | | | The chain list is obtained if the user requests a listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add chain reference counterPablo Neira Ayuso2015-08-182-0/+12
| | | | | | | When adding declared chains to the cache, we may hold more than one single reference from struct cmd and the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: early allocation of the set IDPablo Neira Ayuso2015-08-182-4/+4
| | | | | | | By when the set is created, so element in the batch use this set ID as reference. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set declaration to cachePablo Neira Ayuso2015-08-181-0/+9
| | | | | | | This patch adds set objects to the cache if they don't exist in the kernel, so they can be referenced from this batch. This occurs from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set objectsPablo Neira Ayuso2015-08-182-86/+79
| | | | | | | | | | | | | | | | This patch populates the cache only once through netlink_list_sets() during evaluation. As a result, there is a single call to netlink_list_sets(). After this change, we can rid of get_set(). This function was fine by the time we had no transaction support, but this doesn't work for set objects that are declared in this batch, so inquiring the kernel doesn't help since they are not yet available. As a result from this update, the monitor code gets simplified quite a lot since it can rely of the set cache. Moreover, we can now validate that the table and set exists from evaluation path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table declaration to cachePablo Neira Ayuso2015-08-182-15/+15
| | | | | | | | | | Add declared table objects to the cache, thus we can refer to objects that come in this batch but that are not yet available in the kernel. This happens from the evaluation step. Get rid of code that is doing this from the later do_command_*() stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add reference counter to the table objectPablo Neira Ayuso2015-08-182-0/+13
| | | | | | | We may hold multiple references to table objects in follow up patches when adding object declarations to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cmd_evaluate_list()Pablo Neira Ayuso2015-08-181-0/+23
| | | | | | | | | | This function validates that the table that we want to list already exists by looking it up from the cache. This also adds cmd_error() to display an error from the evaluation step, when the objects that the rule indicates do not exist. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cache infrastructure and use it for table objectsPablo Neira Ayuso2015-08-185-28/+87
| | | | | | | | | | This patch introduces the generic object cache that is populated during the evaluation phase. The first client of this infrastructure are table objects. As a result, there is a single call to netlink_list_tables(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next-4.2'Pablo Neira Ayuso2015-08-1810-3/+123
|\ | | | | | | | | | | | | | | | | | | This branch adds support for the new 'netdev' family. This also resolves a simple conflict with the default chain policy printing. Conflicts: src/rule.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add netdev family supportPablo Neira Ayuso2015-06-1610-4/+122
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for the new 'netdev' table. So far, this table allows you to create filter chains from ingress. The following example shows a very simple base configuration with one table that contains a basechain that is attached to the 'eth0': # nft list table netdev filter table netdev filter { chain eth0-ingress { type filter hook ingress device eth0 priority 0; policy accept; } } You can test that this works by adding a simple rule with counters: # nft add rule netdev filter eth0-ingress counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | tests: add two test cases using binop w. payloadFlorian Westphal2015-08-073-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | [ payload load 4b @ network header + 12 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0xff000000 ) ^ 0x00000000 ] [ cmp eq reg 1 ... .. to make sure that later support to match header elements that have odd (non-byte aligned) lengths/offsets doesn't erronously eliminate explicitly added binops while searching expressions for implicit binops. Signed-off-by: Florian Westphal <fw@strlen.de>
* | src: restore nft list tablesPablo Neira Ayuso2015-08-031-1/+1
| | | | | | | | | | | | | | | | Iterate over the ctx->list which is where the table objects are after calling netlink_list_tables(). Fixes: e4d21958c835 ("rule: add do_list_tables()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | tests: validate generated netlink instructionsFlorian Westphal2015-07-2065-5/+11259
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | compare netlink instructions generated by given nft command line with recorded version. Example: udp dport 80 accept in ip family should look like ip test-ip4 input [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000011 ] [ payload load 2b @ transport header + 2 => reg 1 ] [ cmp eq reg 1 0x00005000 ] [ immediate reg 0 accept ] This is stored in udp.t.payload.ip Other suffixes: .payload.ip6 .payload.inet .payload ('any') The test script first looks for 'testname.t.payload.$family', if that doesn't exist 'testname.t.payload' is used. This allows for family independent test (e.g. meta), where we don't expect/have any family specific expressions. Signed-off-by: Florian Westphal <fw@strlen.de>
* | netlink_delinearize: meta l4proto range printing broken on 32bitPablo Neira Ayuso2015-07-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Florian Westphal says: 09565a4b1ed4863d44c4509a93c50f44efd12771 ("netlink_delinearize: consolidate range printing") causes nft to segfault on 32bit machine when printing l4proto ranges. The problem is that meta_expr_pctx_update() assumes that right is a value, but after this change it can also be a range. Thus, expr->value contents are undefined (its union). On x86_64 this is also broken but by virtue of struct layout and pointer sizes, value->_mp_size will almost always be 0 so mpz_get_uint8() returns 0. But on x86-32 _mp_size will be huge value (contains expr->right pointer of range), so we crash in libgmp. Pablo says: We shouldn't call pctx_update(), before the transformation we had there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never entered that path as the assert in payload_expr_pctx_update() indicates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Florian Westphal <fw@strlen.de>
* | tests: meta: use root for uid/gid checksFlorian Westphal2015-07-161-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | I get failures here since 'man' has different uid vs. what test suite expects. Furthermore, this box does not have a 'backup' user. Switch to root/bin/daemon -- those exist on both debian and fedora. After this meta.t passes on all my machines. Signed-off-by: Florian Westphal <fw@strlen.de>
* | tests: avoid more warningsFlorian Westphal2015-07-155-11/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ... 2001:838:35f:1::-2001:838:35f:2:: :80-100' mismatches ... 2001:838:35f:1::-2001:838:35f:2:::80-100' nft accepts both, so just alter test to not complain. Also, fix test script to display the expected output rather than the input. Otherwise, a rule like some_input;ok;expected_output may display nonsensical message like warning: some_input mismatches some_input This also fixes the icmpv6 test accordingly, nft displays ranges correctly. Signed-off-by: Florian Westphal <fw@strlen.de>
* | main: return error to shell on evaluation problemsPablo Neira Ayuso2015-07-141-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft add chain filter input { type filter hook inputt priority 0\; } <cmdline>:1:43-48: Error: unknown chain hook inputt add chain filter input { type filter hook inputt priority 0; } ^^^^^^ Before: # echo $? 0 After: # echo $? 1 Note that nft_parse() returns 1 on parsing errors and 0 + state->errs on evaluation problems, so return -1 as other functions do here to pass up the error to the main routine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | configure: fix --enable-debugPablo Neira Ayuso2015-07-141-2/+2
| | | | | | | | | | | | | | | | | | | | As the documentation indicates "The most common mistake for this macro is to consider the two actions as action-if-enabled and action-if-disabled." Use AS_IF in the action-if-present to check the real argument that we're getting from the user. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netlink: release table object via table_free() in netlink_get_table()Pablo Neira Ayuso2015-07-141-1/+1
| | | | | | | | | | | | Instead of xfree(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | rule: add do_list_tables()Pablo Neira Ayuso2015-07-141-15/+17
| | | | | | | | | | | | Wrap code to list existing tables in a function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: set chain->hookstr from delinearizationPablo Neira Ayuso2015-07-063-5/+6
| | | | | | | | | | | | Set human readable hookname chain->hookstr field from delinearize. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>