summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* netlink_delinarize: fix merge conflictPatrick McHardy2015-06-131-1/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/next-4.1'Patrick McHardy2015-06-137-54/+288
|\
| * netlink: handle concat expressions in set dataPatrick McHardy2015-06-022-1/+33
| | | | | | | | | | | | | | Reconstruct the concat expressions in set data by splicing off the subtype values based on the keytype of the set. Signed-off-by: Patrick McHardy
| * netlink_delinearize: handle relational and lookup concat expressionsPatrick McHardy2015-06-021-9/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the RHS length differs from the LHS length (which is only the first expression), both expressions are assumed to be concat expressions. The LHS concat expression is reconstructed from the available register values, advancing by the number of registers required by the subexpressions' register space, until the RHS length has been reached. The RHS concat expression is reconstructed by splitting the data value into multiple subexpressions based on the LHS concat expressions types. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink_delinearize: introduce register translation helperPatrick McHardy2015-06-021-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a helper function to translate register numbers from the kernel from the compat values to the NFT_REG32 values. Internally we use the register numbers 0-16: * 0 is the verdict register in both old and new addressing modes. * 1-16 are the 32 bit data registers The NFT_REG32_00 values are mapped to 1-16, the NFT_REG_1-NFT_REG_4 values are each use up 4 registers starting at 1 (1, 5, 9, 13). Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink: pad constant concat sub-expressionsPatrick McHardy2015-06-023-9/+18
| | | | | | | | | | | | Pad all but the last sub-expressions of a concat expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink_linearize: generate concat expressionsPatrick McHardy2015-06-021-3/+11
| | | | | | | | | | | | | | Use the real length for reserving/releasing registers when generating concat expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink_linearize: use NFT_REG32 values internallyPatrick McHardy2015-06-022-4/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prepare netlink_linearize for 32 bit register usage: Switch to use 16 data registers of 32 bit each. A helper function takes care of mapping the registers to the NFT_REG32 values and, if the register refers to the beginning of an 128 bit area, the old NFT_REG_1-4 values for compatibility. New register reservation and release helper function take the size into account and reserve the required amount of registers. The reservation and release functions will so far still always allocate 128 bit. If no other expression in a rule uses a 32 bit register directly, these will be mapped to the old register values, meaning everything continues to work with old kernel versions. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink: pass expression to register allocation/release functionsPatrick McHardy2015-06-021-26/+28
| | | | | | | | | | | | Prepare for taking the expression size into account. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * headers: sync headers for new register valuesPatrick McHardy2015-06-021-1/+33
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * eval: prohibit variable sized types in concat expressionsPatrick McHardy2015-06-021-0/+7
| | | | | | | | | | | | | | | | | | | | Since we need to calculate the length of the entire concat type, we can not support variable sized types where the length can't be determined by the type. This only affects base types since all higher types include a length. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge remote-tracking branch 'origin/master' into next-4.1Patrick McHardy2015-06-024-97/+43
| |\
* | | proto: use bitmask_type for comp flagsPablo Neira Ayuso2015-06-052-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I think flags should be displayed in hexadecimal and should be handled as a bitmask. inet/comp.t: WARNING: line: 15: 'nft add rule ip test-ip4 input comp flags 0x00': 'comp flags 0x00' mismatches 'comp flags 0' inet/comp.t: WARNING: line: 16: 'nft add rule ip test-ip4 input comp flags != 0x23': 'comp flags != 0x23' mismatches 'comp flags != 35' inet/comp.t: WARNING: line: 17: 'nft add rule ip test-ip4 input comp flags 0x33-0x45': 'comp flags 0x33-0x45' mismatches 'comp flags 51-69' inet/comp.t: WARNING: line: 18: 'nft add rule ip test-ip4 input comp flags != 0x33-0x45': 'comp flags != 0x33-0x45' mismatches 'comp flags != 51-69' inet/comp.t: WARNING: line: 19: 'nft add rule ip test-ip4 input comp flags {0x33, 0x55, 0x67, 0x88}': 'comp flags {0x33, 0x55, 0x67, 0x88}' mismatches 'comp flags { 103, 85, 51, 136}' inet/comp.t: WARNING: line: 21: 'nft add rule ip test-ip4 input comp flags { 0x33-0x55}': 'comp flags { 0x33-0x55}' mismatches 'comp flags { 51-85}' rfc3173 says that this is unused for future use though. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | datatype: default to display bitmask in hexadecimalPablo Neira Ayuso2015-06-051-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of a plain integer. This updates integer_type_print() to look up some basefmt in the change of datatype, the first we find will be used to format the output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | netlink_delinearize: restore listing of host byteorder set elementsPablo Neira2015-06-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | before: table ip filter { chain test { cpu { 67108864, 50331648, 33554432} } } after: table ip filter { chain test { cpu { 4, 3, 2 } } } Related to 525323352904 ("expr: add set_elem_expr as container for set element attributes"). We'll have to revisit this once we have support to use integer datatypes from set declarations, see: http://patchwork.ozlabs.org/patch/480068/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | Merge branch 'next-4.1'Pablo Neira Ayuso2015-06-0445-355/+845
|\ \ \ | |_|/ |/| |
| * | tests: regression: fix NAT testsPablo Neira Ayuso2015-06-024-9/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | snat can be only used from prerouting and input, and dnat from output and postrouting. ip/nat.t: ERROR: line 12: nft add rule ip test-ip4 output iifname eth0 tcp sport 23-34 snat 192.168.3.2: This rule should not have failed. Split the test file as they require different chain configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | tests: regression: fix warnings related to range listingPablo Neira Ayuso2015-06-0224-182/+180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix lots of warnings, mostly related to the listing of ranges in many of the tests that we have, eg. any/meta.t: WARNING: line: 30: 'nft add rule ip test-ip4 input meta l4proto 33-45': 'meta l4proto 33-45' mismatches 'meta l4proto 33-45' any/meta.t: WARNING: line: 31: 'nft add rule ip test-ip4 input meta l4proto != 33-45': 'meta l4proto != 33-45' mismatches 'meta l4proto != 33-45' any/meta.t: WARNING: line: 99: 'nft add rule ip test-ip4 input meta skuid 3001-3005 accept': 'meta skuid 3001-3005 accept' mismatches 'skuid 3001-3005 accept' any/meta.t: WARNING: line: 100: 'nft add rule ip test-ip4 input meta skuid != 2001-2005 accept': 'meta skuid != 2001-2005 accept' mismatches 'skuid != 2001-2005 accept' any/meta.t: WARNING: line: 111: 'nft add rule ip test-ip4 input meta skgid 2001-2005 accept': 'meta skgid 2001-2005 accept' mismatches 'skgid 2001-2005 accept' any/meta.t: WARNING: line: 112: 'nft add rule ip test-ip4 input meta skgid != 2001-2005 accept': 'meta skgid != 2001-2005 accept' mismatches 'skgid != 2001-2005 accept' any/meta.t: WARNING: line: 156: 'nft add rule ip test-ip4 input meta cpu 1-3': 'meta cpu 1-3' mismatches 'cpu 1-3' any/meta.t: WARNING: line: 158: 'nft add rule ip test-ip4 input meta cpu != 1-2': 'meta cpu != 1-2' mismatches 'cpu != 1-2' any/meta.t: WARNING: line: 187: 'nft add rule ip test-ip4 input meta cgroup 0x100001 - 0x100003': 'meta cgroup 0x100001 - 0x100003' mismatches 'cgroup 1048577-1048579' ... Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | tests: regression: reduce code duplication a bit on error reportingPablo Neira Ayuso2015-06-021-12/+7
| | | | | | | | | | | | | | | | | | | | | Consolidate print_err() and print_warning() into print_msg() to reduce code duplication. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: consolidate range printingPablo Neira Ayuso2015-06-021-4/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a routine to the postprocess stage to check if the previous expression statement and the current actually represent a range, so we can provide a more compact listing, eg. # nft -nn list table test table ip test { chain test { tcp dport 22 tcp dport 22-23 tcp dport != 22-23 ct mark != 0x00000016-0x00000017 ct mark 0x00000016-0x00000017 mark 0x00000016-0x00000017 mark != 0x00000016-0x00000017 } } To do so, the context state stores a pointer to the current statement. This pointer needs to be invalidated in case the current statement is replaced. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: add payload_match_expand()Pablo Neira Ayuso2015-06-021-32/+37
| | | | | | | | | | | | | | | | | | | | | This function encapsulates the payload expansion logic. This change in required by the follow up patch to consolidate range printing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: keep pointer to current statement from rule_pp_ctxPablo Neira Ayuso2015-06-021-34/+37
| | | | | | | | | | | | | | | | | | | | | This patch is required by the range postprocess routine that comes in follow up patches. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: pass ctx pointer to stmt_reject_postprocess()Pablo Neira Ayuso2015-05-301-9/+9
| |/ | | | | | | | | | | Instead of a copy of the context variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nftables: add set statemetPatrick McHardy2015-04-128-1/+177
| | | | | | | | | | | | | | | | | | | | | | | | The set statement is used to dynamically add or update elements in a set. Syntax: # nft filter input set add tcp dport @myset # nft filter input set add ip saddr timeout 10s @myset # nft filter input set update ip saddr timeout 10s @myset Signed-off-by: Patrick McHardy <kaber@trash.net>
| * setelem: add support for attaching comments to set elementsPatrick McHardy2015-04-125-0/+21
| | | | | | | | | | | | | | | | Syntax: # nft add element filter test { 192.168.0.1 comment "some host" } Signed-off-by: Patrick McHardy <kaber@trash.net>
| * setelem: add timeout support for set elementsPatrick McHardy2015-04-125-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Support specifying per element timeout values and displaying the expiration time. If an element should not use the default timeout value of the set, an element specific value can be specified as follows: # nft add element filter test { 192.168.0.1, 192.168.0.2 timeout 10m} For listing of elements that use the default timeout value, just the expiration time is shown, otherwise the element specific timeout value is also displayed: set test { type ipv4_addr timeout 1h elements = { 192.168.0.2 timeout 10m expires 9m59s, 192.168.0.1 expires 59m59s} } Signed-off-by: Patrick McHardy <kaber@trash.net>
| * set: add timeout support for setsPatrick McHardy2015-04-127-1/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Timeout support can be enabled in one of two ways: 1. Using a default timeout value: set test { type ipv4_addr; timeout 1h; } 2. Using the timeout flag without a default: set test { type ipv4_addr; flags timeout; } Optionally a garbage collection interval can be specified using gc-interval <interval>; Signed-off-by: Patrick McHardy <kaber@trash.net>
| * expr: add set_elem_expr as container for set element attributesPatrick McHardy2015-04-128-30/+109
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new expression type "set_elem_expr" that is used as container for the key in order to attach different attributes, such as timeout values, to the key. The expression hierarchy is as follows: Sets: elem | key Maps: mapping / \ elem data | key Signed-off-by: Patrick McHardy <kaber@trash.net>
| * parser: fix inconsistencies in set expression rulesPatrick McHardy2015-04-121-13/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set keys are currently defined as a regular expr for pure sets and map_lhs_expr for maps. map_lhs_expr is what can actually be used for a single member, namely a concat_expr or a multiton_expr. The reason why pure sets use expr for the key is to allow recursive set specifications, which doesn't make sense for maps since every element needs a mapping. However, the rule is too wide and also allows map expressions as a key, which obviously doesn't make sense. Rearrange the rules so we have: set_lhs_expr: concat or multiton set_rhs_expr: concat or verdict and special case the recursive set specifications, as they deserve. Besides making it a lot easier to understand what is actually supported, this will be used by the following patch to support timeouts and comments for keys in a uniform way. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * parser: add a time_spec rulePatrick McHardy2015-04-121-0/+16
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * datatype: seperate time parsing/printing from time_typePatrick McHardy2015-04-122-25/+45
| | | | | | | | | | | | | | Seperate relative time parsing and printing from the time_type to make it usable for set and set element time related parameters. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * datatype: less strict time parsingPatrick McHardy2015-04-121-12/+0
| | | | | | | | | | | | | | | | Don't require hours to be in range 0-23 and minutes/seconds in range 0-59. The time_type is used for relative times where it is entirely reasonable to specify 180s instead of 3m. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * datatype: fix parsing of time typePatrick McHardy2015-04-122-4/+7
| | | | | | | | | | | | Properly detect time strings in the lexer without quotation marks. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netlink_delinearize: remove obsolete fixmePatrick McHardy2015-06-021-3/+1
| | | | | | | | | | | | | | | | The FIXME was related to exclusion of string types from cmp length checks. Since with fixed sized helper names the last case where this could happen is gone, remove the FIXME and perform length checks on strings as well. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | ct: add maximum helper length valuePatrick McHardy2015-06-021-1/+6
| | | | | | | | | | | | | | | | | | The current kernel restricts ct helper names to 16 bytes length. Specify this limit in the ct expression table to catch oversized strings in userspace. Since older versions of nft didn't support larger values, this does not negatively affect interaction with old kernel versions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netlink_linearize: fix range cmp instruction generationPatrick McHardy2015-06-021-2/+3
| | | | | | | | | | | | | | The LHS expression is generated twice and the register not properly released. Fix by calling netlink_gen_range() before generating the LHS. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | mnl: use new libnftnl batch APIPablo Neira Ayuso2015-04-141-91/+33
|/ | | | | | | | Each batch page has a size of 320 Kbytes, and the limit has been set to 256 KBytes, so the overrun area is 64 KBytes long to accomodate the largest netlink message (sets). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: restore interface to index cachePablo Neira Ayuso2015-04-117-3/+175
| | | | | | | | | | | | | | | | nftables used to have a cache to speed up interface name <-> index lookup, restore it using libmnl. This reduces netlink traffic since if_nametoindex() and if_indextoname() open, send a request, receive the list of interface and close a netlink socket for each call. I think this is also good for consistency since nft -f will operate with the same index number when reloading the ruleset. The cache is populated by when nft_if_nametoindex() and nft_if_indextoname() are used for first time. Then, it it released in the output path. In the interactive mode, it is invalidated after each command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce netlink_init_error()Pablo Neira Ayuso2015-04-092-5/+8
| | | | | | | | Based on the existing netlink_open_error(), but indicate file and line where the error happens. This will help us to diagnose what is going wrong when users can back to us to report problems. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: fix missing space after chain nameArturo Borrero2015-04-081-1/+1
| | | | | | | | | | | | | | | | Due to change f3ff9e9 ("rule: delete extra space in rule indentation") in function rule_print(), a missing space happens in monitor. before this patch: % nft monitor add rule ip test-table test-chainip protocol tcp after this patch: % nft monitor add rule ip test-table test-chain ip protocol tcp Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: remove duplicated grammar for chain policyPatrick McHardy2015-03-251-12/+7
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinarize: fix payload dependency killing of link layer dependenciesPatrick McHardy2015-03-251-2/+2
| | | | | | | | | | | | | | | | | | | | | payload_dependency_kill() does not properly handle dependencies for link layer expressions. Since those dependencies are logically defined on an even lower layer (device layer), we don't have a payload base for them, meaning they will use PROTO_BASE_INVALID, which is skipped. So instead of storing the payload base on which the dependency is defined, we store the base of the layer for which the dependency applies, meaning dependencies defined by the device layer will properly work. This fixes killing the dependency of ether saddr, instead of iiftype ether ether ether saddr ... we now only display ether saddr ... Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix use after free in netlink_get_table()Patrick McHardy2015-03-251-4/+4
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* nft-test: don't use colors if output is not a ttyPatrick McHardy2015-03-251-6/+12
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* set_elem: convert flag value to inclusive-OR binops during delinearizePatrick McHardy2015-03-231-0/+4
| | | | | | | | | | | | | | When a set contains combined flag values, they are displayed as numeric value since they don't match any of the single flag values: tcp flags { 18, psh, syn} Convert to a series of inclusive-OR binops of the single flag values for improved readability: tcp flags { syn | ack, psh, syn} Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix chain details align indentationsArturo Borrero2015-03-191-1/+1
| | | | | | | | | | f.i: type filter hook output priority 0; policy accept; ip daddr @test counter packets 14 bytes 1176 Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix bogus warnings in any/mark.tPablo Neira Ayuso2015-03-181-8/+8
| | | | | | | 'meta mark set 10' is a valid input, but the expected output is 'mark set 10'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: masquerade is only allowed from postroutingPablo Neira Ayuso2015-03-182-2/+0
| | | | | | | Disable the tests from the output chain, the kernel rejects this with operation not supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: consider policy in base chainArturo Borrero2015-03-181-2/+2
| | | | | | | | nft now prints the default chain policy, consider this when parsing the output to find mismatches. Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix crash when adding new non-base chainPablo Neira Ayuso2015-03-181-20/+24
| | | | | | | Fix crash when adding a non-base chain introduced by acdfae9 ("src: allow to specify the default policy for base chains"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>