summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: Always print range expressions numericallyElise Lennion2017-02-052-1/+9
| | | | | | | | | | | Because the rules are more legible this way. Also, the parser doesn't accept strings on ranges, so, printing ranges numerically better match the rules definition. Fixes(Bug 1046 - mobility header with range gives illegible rule). Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Validate the number of numeric optionsElise Lennion2017-02-051-1/+6
| | | | | | | | The number of numeric options influences the behavior and the user should be warned if a invalid number is used. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix typoManuel Messner2017-02-021-1/+1
| | | | | Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Add tests for stateful objectsElise Lennion2017-01-273-0/+59
| | | | | | | | These test for adding counters and quotas, to tables of different families, and for referencing the objects in rules. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Add suport for stateful objects in python testsElise Lennion2017-01-271-0/+131
| | | | | | | | | | | | | | This allows to write pytests using the new stateful objects. To add an object use the symbol '%', followed by the name, type and specifications (currently used in quota): %cnt1 type counter;ok # Adds the counter cnt1 to all tables %qt1 type quota over 25 mbytes;ok # Adds the quota qt1 to all tables Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow list stateful objects in a tableElise Lennion2017-01-272-2/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, stateful objects can be listed by: listing all objects in all tables; listing a single object in a table. Now it's allowed to list all objects in a table. $ nft list counters table filter table ip filter { counter https-traffic { packets 14825 bytes 950063 } counter http-traffic { packets 117 bytes 9340 } } $ nft list quotas table filter table ip filter { quota https-quota { 25 mbytes used 2 mbytes } quota http-quota { 25 mbytes used 10 kbytes } } Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Evaluate table name before reset stateful objects in a tableElise Lennion2017-01-271-3/+4
| | | | | | | | Reseting stateful objects in a single table is already implemented and cmd_evaluate_reset() now tests for the table name. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow list single stateful objectElise Lennion2017-01-272-1/+25
| | | | | | | | | | | | | | | | | | | | | | Currently the stateful objects can only be listed in groups. With this patch listing a single object is allowed: $ nft list counter filter https-traffic table ip filter { counter https-traffic { packets 4014 bytes 228948 } } $ nft list quota filter https-quota table ip filter { quota https-quota { 25 mbytes used 278 kbytes } } Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow reset single stateful objectElise Lennion2017-01-277-12/+54
| | | | | | | | | | | | | | | | | | | | | | | | Currently the stateful objects can only be reseted in groups. With this patch reseting a single object is allowed: $ nft reset counter filter https-traffic table ip filter { counter https-traffic { packets 8774 bytes 542668 } } $ nft list counter filter https-traffic table ip filter { counter https-traffic { packets 0 bytes 0 } } Heavily based on work from Pablo Neira Ayuso <pablo@netfilter.org>. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: explicit network ctx assignment for icmp/icmp6 in special familiesArturo Borrero Gonzalez2017-01-277-40/+162
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the inet, bridge and netdev families, we can add rules like these: % nft add rule inet t c ip protocol icmp icmp type echo-request % nft add rule inet t c ip6 nexthdr icmpv6 icmpv6 type echo-request However, when we print the ruleset: % nft list ruleset table inet t { chain c { icmpv6 type echo-request icmp type echo-request } } These rules we obtain can't be added again: % nft add rule inet t c icmp type echo-request <cmdline>:1:19-27: Error: conflicting protocols specified: inet-service vs. icmp add rule inet t c icmp type echo-request ^^^^^^^^^ % nft add rule inet t c icmpv6 type echo-request <cmdline>:1:19-29: Error: conflicting protocols specified: inet-service vs. icmpv6 add rule inet t c icmpv6 type echo-request ^^^^^^^^^^^ Since I wouldn't expect an IP packet carrying ICMPv6, or IPv6 packet carrying ICMP, if the link layer is inet, the network layer protocol context can be safely update to 'ip' or 'ip6'. Moreover, nft currently generates a 'meta nfproto ipvX' depedency when using icmp or icmp6 in the inet family, and similar in netdev and bridge families. While at it, a bit of code factorization is introduced. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1073 Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: validate set sizePablo Neira Ayuso2017-01-242-0/+28
| | | | | | | | | | Add two tests to make sure that set size checks work fine: 1) Check if set size is indeed working, this is a simple one. 2) Check if set size is correct after ENFILE error, there is bug that adds a new spare slot everytime we hit this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Add test for flush bug on sets with sizeElise Lennion2017-01-241-0/+12
| | | | | | | | This tests for a bug where elements can't be added after flushing a full set with the flag NFTNL_SET_DESC_SIZE set. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: check for errors from cache_init_objects() for stateful objectsPablo Neira Ayuso2017-01-231-4/+3
| | | | | | Catch -1 case, so we have a chance to handle EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't bail out on dump errorsPablo Neira Ayuso2017-01-231-15/+5
| | | | | | | | | | | | | | This patch removes the existing error messages on netlink dump errors. These functions used to be called from list commands. These days they are called from the cache cache population path. Note that nft breaks with older kernels at netlink_list_objs() since we have no stateful objects support there. Silence errors at this stage and return an empty list, thus, nft bails out on explicit user commands if no nf_tables support is available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Honor obligatory stateless printing of flow tablesElise Lennion2017-01-233-3/+8
| | | | | | | | Always print flow statement as stateless expressions, given that this just defines the flow table statement instance that is allocated per entry. Signed-off-by: Elise Lennion <elise.lennion@gmail.com>
* tests: shell: Add test for set element leak bugElise Lennion2017-01-231-0/+11
| | | | | | | This tests for a bug where a repeated element is added and the set elements counter is incorrectly increased. Signed-off-by: Elise Lennion <elise.lennion@gmail.com>
* tests: py: Use stateless option on testsElise Lennion2017-01-1812-15/+15
| | | | | | | | | | | To don't trigger false errors because of unrelated traffic on the tested machine. Tests, which have rules with counter and 'ok' result, are updated to avoid new Warnings. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Include stateless optionElise Lennion2017-01-181-0/+11
| | | | | Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix export length and data corruptionFlorian Westphal2017-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | Pablo reported that ipv6 tests would fail on some systems: WARNING: 'add rule --debug=netlink ip6 test-ip6 input ip6 flowlabel set 0': '[ bitwise reg 1 = (reg=1 & 0x000000f0 ) ^ 0x00000000 ]' mismatches '[ bitwise reg 1 = (reg=1 & 0x00000000 ) ^ 0x00000000 ]' ^ should be 'f' Problem is that mpz_export_data expects the size of the output buffer in bytes, but this gave bit-based size. Then, when mpz_export_data clears the output buffer it will also clear 8 extra bytes on stack; depending on compiler version (stack layout) this will then clear the bitmask value that we want to export. Fixes: 78936d50f306c ("evaluate: add support to set IPv6 non-byte header fields") Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Tested-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow to list ruleset without stateful informationElise Lennion2017-01-164-4/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently only counter and quota have stateful information. For named counters, packets and bytes are displayed as 0. Standard list ruleset: table ip filter { counter https { packets 161942 bytes 10253353 } chain output { type filter hook output priority 0; policy accept; counter name tcp dport map { https : "https"} tcp dport https counter packets 171211 bytes 10869045 tcp dport https quota 25 mbytes used 10 mbytes } } With stateless option, -s: table ip filter { counter https { packets 0 bytes 0 } chain output { type filter hook output priority 0; policy accept; counter name tcp dport map { https : "https"} tcp dport https counter tcp dport https quota 25 mbytes } } Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add average bytes per packet counter supportLiping Zhang2017-01-167-3/+35
| | | | | | | | | | | | | | | | | Similar to connbytes extension in iptables, now you can use it to match average bytes per packet a connection has transferred so far. For example, match avgpkt in "BOTH" diretion: # nft add rule x y ct avgpkt \> 100 Match avgpkt in reply direction: # nft add rule x y ct reply avgpkt \< 900 Or match avgpkt in original direction: # nft add rule x y ct original avgpkt \> 200 Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add missing backslash to list of CFLAGSTobias Klauser2017-01-161-1/+1
| | | | | | | | | Due to a missing backslash in the AM_CFLAGS list some warning flags do not get added to the generated default CLFAGS. Add the missing backslash to include them as well. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add maps testsElise Lennion2017-01-104-0/+228
| | | | | | | | | Test adding elements to simple and interval maps. Based on original work from Richard Mörbitz and Pablo Neira. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: sort set elements in netlink_get_setelems()Elise Lennion2017-01-104-0/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So users can better track their ruleset via git. Without sorting, the elements can be listed in a different order every time the set is created, generating unnecessary git changes. Mergesort is used. Doesn't sort sets with 'flags interval' set on. Pablo appends to this changelog description: Currently these interval set elements are dumped in order. We'll likely get new representations soon that may not guarantee this anymore, so let's revisit this later in case we need it. Without this patch, nft list ruleset with a set containing 40000 elements takes on my laptop: real 0m2.742s user 0m0.112s sys 0m0.280s With this patch: real 0m2.846s user 0m0.180s sys 0m0.284s Difference is small, so don't get nft more complicated with yet another getopt() option, enable this by default. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: cover cache flush on flush rulesetPablo Neira Ayuso2017-01-101-0/+26
| | | | | | | | This tests covers 530a82a72d15 ("evaluate: Update cache on flush ruleset"). Make sure loading twice including an upfront ruleset flush leaves us with an empty cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: use nftnl_nlmsg_build_hdr()Pablo Neira Ayuso2017-01-101-106/+103
| | | | | | | | Instead of nftnl_.*_nlmsg_build_hdr() since they rely on this generic function. This also helps us clean up source code indentation around this function call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: remove obsolete tokensFlorian Westphal2017-01-081-6/+0
| | | | | | removed in c992153402c78d91e8be ("ct: allow resolving ct keys at run time"). Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: printf format warnings on 32-bit buildDuncan Roe2017-01-031-1/+1
| | | | | | | | This is %lu with uint64_t again. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1109 Signed-off-by: Duncan Roe <duncan_roe@acslink.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: fix search_in_include_path testAnatole Denis2017-01-031-2/+2
| | | | | | | | | | | clang emits a warning in this function as we're using a boolean as the third argument to strncmp. Indeed, this function only checks the first byte of the path as is, so files beginning with . will be incorrectly included from the current working directory instead of the include directory. Fixes: f92a1a5c4a87 ("scanner: honor absolute and relative paths via include file") Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for stateful object monitoringPablo Neira Ayuso2017-01-033-0/+162
| | | | | | | This patch extends the event monitoring infrastructure to catch events of addition and removal of stateful objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for stateful object mapsPablo Neira Ayuso2017-01-037-14/+182
| | | | | | | | | | | | | | | | | | | | | | | | | | | | You can create these maps using explicit map declarations: # nft add table filter # nft add chain filter input { type filter hook input priority 0\; } # nft add map filter badguys { type ipv4_addr : counter \; } # nft add rule filter input counter name ip saddr map @badguys # nft add counter filter badguy1 # nft add counter filter badguy2 # nft add element filter badguys { 192.168.2.3 : "badguy1" } # nft add element filter badguys { 192.168.2.4 : "badguy2" } Or through implicit map definitions: table ip filter { counter http-traffic { packets 8 bytes 672 } chain input { type filter hook input priority 0; policy accept; counter name tcp dport map { 80 : "http-traffic", 443 : "http-traffic"} } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object reference expressionPablo Neira Ayuso2017-01-037-0/+122
| | | | | | | | | This patch adds a new objref statement to refer to existing stateful objects from rules, eg. # nft add rule filter input counter name test counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow RESET token from rhsPablo Neira Ayuso2017-01-031-8/+8
| | | | | | | | | | Stateful objects have introduced a RESET token in the parser. This breaks the use of RESET from the rhs, to fix this: 1) I added a new rule to catch this case, thus, dccp doesn't break. 2) Update reject_opts so reject with tcp reset still works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: reset internal stateful objectsPablo Neira Ayuso2017-01-039-14/+104
| | | | | | | | | | | | | | | | | | | | | This patch allows you to atomically dump and reset stateful objects, eg. # nft list counters table ip filter { counter test { packets 1024 bytes 100000 } } # nft reset quotas table filter counter test { packets 1024 bytes 100000 } # nft reset quotas table filter counter test { packets 0 bytes 0 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add/create/delete stateful objectsPablo Neira Ayuso2017-01-038-3/+322
| | | | | | | | | | | | | | | | This patch allows you to add and to delete objects, eg. # nft add quota filter test 1234567 bytes # nft list quotas table ip filter { quota test { 1234567 bytes } } # nft delete quota filter test Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: listing of stateful objectsPablo Neira Ayuso2017-01-0311-3/+360
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to dump existing stateful objects, eg. # nft list ruleset table ip filter { counter test { packets 64 bytes 1268 } quota test { over 1 mbytes used 1268 bytes } chain input { type filter hook input priority 0; policy accept; quota name test drop counter name test } } # nft list quotas table ip filter { quota test { over 1 mbytes used 1268 bytes } } # nft list counters table ip filter { counter test { packets 64 bytes 1268 } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add used quota supportPablo Neira Ayuso2017-01-036-3/+30
| | | | | | | | | | | | | table ip x { chain y { type filter hook forward priority 0; policy accept; quota over 200 mbytes used 1143 kbytes drop } } This patch allows us to list and to restore used quota. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove SET_F_* flag definitionsPablo Neira Ayuso2017-01-037-59/+44
| | | | | | | They map exactly one to one to we have in the kernel headers, so use kernel definitions instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: fetch nf_tables.h updatesPablo Neira Ayuso2017-01-031-0/+64
| | | | | | Get header in sync with recent updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: allocate memory for arrays on heapOleksandr Natalenko2017-01-031-1/+10
| | | | | | | | | Huge sets may cause stack to be exhausted. So, put allocate memory for arrays in interval_map_decompose() function on heap. Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name> Signed-off-by: Florian Westphal <fw@strlen.de>
* utils: provide array allocation wrapperOleksandr Natalenko2017-01-032-0/+12
| | | | | | | | This will be used for allocating memory for arrays in heap instead of keeping them on stack. Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name> Signed-off-by: Florian Westphal <fw@strlen.de>
* include: Missing noinst_HEADERS updatesv0.7Pablo Neira Ayuso2016-12-202-1/+6
| | | | | | From recent updates, otherwise make distcheck breaks. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: Bump version to v0.7Pablo Neira Ayuso2016-12-201-4/+4
| | | | | | | | | Update libnftnl dependency up to latest (1.0.7). Update my copyright statements. Dedicate this release to Scroodge McDuck [1]. [1] https://en.wikipedia.org/wiki/Scrooge_McDuck#/media/File:ScroogeFirst.jpg Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: use NFTNL_* definitionsPablo Neira Ayuso2016-12-201-6/+6
| | | | | | Do not use obsolete definitions in libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add mnl_nft_setelem_batch_flush() and use it from netlink_flush_setelems()Pablo Neira Ayuso2016-12-203-1/+30
| | | | | | | | | | | | | Commit 8bd99f2fca7e ("mnl: don't send empty set elements netlink message to kernel") broke set flush because we still need to send the netlink message with no elements to flush sets. To avoid more whack-a-mole games, add a new explicit function mnl_nft_setelem_batch_flush() that is used to request a set flush, instead of reusing the one that allows us to explicitly delete given set elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: Show the base which pre-defined constants are displayedElise Lennion2016-12-207-1/+24
| | | | | | | | | | so the user know how we express it. The base was added to all symbol tables, which are associated with datatype->sym_tbl, so they are displayed in the right base. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: fix IPv6 layer 4 checksum manglingPablo Neira Ayuso2016-12-161-5/+4
| | | | | | | In IPv6 there is no checksum field. We always have to trigger layer 4 checksum mangling if any of the layer 3 pseudoheader fields are updated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: update quota and payloadPablo Neira Ayuso2016-12-1411-61/+61
| | | | | | Include new consumed field for quota, and check for csum_flags in payload. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: don't send empty set elements netlink message to kernelPablo Neira Ayuso2016-12-143-5/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following command: # nft --debug=mnl add rule x y flow table xyz { ip saddr timeout 30s counter } breaks with EINVAL. The following netlink message is causing the problem: ... ---------------- ------------------ | 0000000044 | | message length | | 02572 | R--- | | type | flags | | 0000000004 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 02 00 00 00 | | extra header | |00008|--|00002| |len |flags| type| | 78 79 7a 00 | | data | x y z |00008|--|00004| |len |flags| type| | 00 00 00 01 | | data | |00006|--|00001| |len |flags| type| | 78 00 00 00 | | data | x ---------------- ------------------ ... This is incorrect since this describes no elements at all, so it is useless. Add upfront check before iterating over the list of set elements so the netlink message is not placed in the batch. This patch also adds a set so flow tables are minimally covered. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: don't trigger error on exact overlapsPablo Neira Ayuso2016-12-131-0/+4
| | | | | | | | | | | | | | | | So adding the same element doesn't trigger any error: # nft add element filter bogons { 3.3.3.123/24 } # nft add element filter bogons { 3.3.3.123/24 } Still kernel reports an error if we use create instead: # nft create element filter bogons { 3.3.3.123/24 } <cmdline>:1:1-46: Error: Could not process rule: File exists create element filter bogons { 3.3.3.123/24 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>