summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* nft-test: don't use colors if output is not a ttyPatrick McHardy2015-03-251-6/+12
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* set_elem: convert flag value to inclusive-OR binops during delinearizePatrick McHardy2015-03-231-0/+4
| | | | | | | | | | | | | | When a set contains combined flag values, they are displayed as numeric value since they don't match any of the single flag values: tcp flags { 18, psh, syn} Convert to a series of inclusive-OR binops of the single flag values for improved readability: tcp flags { syn | ack, psh, syn} Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix chain details align indentationsArturo Borrero2015-03-191-1/+1
| | | | | | | | | | f.i: type filter hook output priority 0; policy accept; ip daddr @test counter packets 14 bytes 1176 Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix bogus warnings in any/mark.tPablo Neira Ayuso2015-03-181-8/+8
| | | | | | | 'meta mark set 10' is a valid input, but the expected output is 'mark set 10'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: masquerade is only allowed from postroutingPablo Neira Ayuso2015-03-182-2/+0
| | | | | | | Disable the tests from the output chain, the kernel rejects this with operation not supported. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: consider policy in base chainArturo Borrero2015-03-181-2/+2
| | | | | | | | nft now prints the default chain policy, consider this when parsing the output to find mismatches. Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix crash when adding new non-base chainPablo Neira Ayuso2015-03-181-20/+24
| | | | | | | Fix crash when adding a non-base chain introduced by acdfae9 ("src: allow to specify the default policy for base chains"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: delete extra space in rule indentationArturo Borrero2015-03-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Annoying extra space in rule indentation: Example before this patch: table ip6 test_table { chain test_chain { counter tcp dport { 22, 80, 443} accept # handle 1 ^ } } Example after this patch: table ip6 test_table { chain test_chain { counter tcp dport { 22, 80, 443} accept # handle 1 } } Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: missing break; in str2hooknum()Pablo Neira Ayuso2015-03-171-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the default policy for base chainsPablo Neira Ayuso2015-03-175-5/+55
| | | | | | | | | | | | | | | | | | The new syntax is: nft add chain filter input { hook input type filter priority 0\; policy accept\; } but the previous syntax is still allowed: nft add chain filter input { hook input type filter priority 0\; } this assumes default policy to accept. If the base chain already exists, you can update the policy via: nft add chain filter input { policy drop\; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expose table flagsPablo Neira Ayuso2015-03-176-5/+69
| | | | | | | | | | | | | | | | | | | The nf_tables kernel API provides a way to disable a table using the dormant flag. This patch adds the missing code to expose this feature through nft. Basically, if you want to disable a table and all its chains from seen any traffic, you have to type: nft add table filter { flags dormant\; } to re-enable the table, you have to: nft add table filter this clears the flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix typo in READMEEric Leblond2015-03-021-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: display errors through stderrPablo Neira Ayuso2015-03-021-1/+1
| | | | | Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1000 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix object order via nft -fPablo Neira Ayuso2015-02-181-2/+7
| | | | | | | | | | | | | | | | | | The objects need to be loaded in the following order: #1 tables #2 chains #3 sets #4 rules We have to make sure that chains are in place by when we add rules with jumps/gotos. Similarly, we have to make sure that the sets are in place by when rules reference them. Without this patch, you may hit ENOENT errors depending on your ruleset configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: register pkttype_type datatypePablo Neira Ayuso2015-02-012-1/+2
| | | | | Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=995 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use stmt_evaluate_arg() in all casesPatrick McHardy2015-01-121-4/+3
| | | | | | | | | When using a symbolic vmap expression, we fail to verify that the map actually contains verdicts. Use stmt_evaluate_arg() everywhere to fix this. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: check that map expressions' datatype matches mappingsPatrick McHardy2015-01-121-0/+7
| | | | | | | | | | | | Catch type errors in map expressions using named maps: # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set tcp dport map @test <cmdline>:1:38-42: Error: datatype mismatch, map expects IPv4 address, mapping expression has type internet network service filter output mark set tcp dport map @test ~~~~~~~~~ ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: properly set datatype of map expressionPatrick McHardy2015-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | The datatype of the map expression is the datatype of the mappings. # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set ip daddr map @test Before: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type IPv4 address filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type internet network service filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: verify named map is actually a mapPatrick McHardy2015-01-121-1/+2
| | | | | | | | | | | | | | | | | | | # nft add set filter test { type ipv4_addr; } # nft filter input ip daddr vmap @test Before: <cmdline>:0:0-32: Error: Could not process rule: Invalid argument filter input ip daddr vmap @test ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:28-32: Error: Expression is not a map filter input ip daddr vmap @test ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: don't print meta keyword for unqualified meta stmtsPatrick McHardy2015-01-121-7/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: clean up unused variables (pctx)Alvaro Neira Ayuso2015-01-121-3/+0
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: fix crash when listing non-verdict mappingsPatrick McHardy2015-01-121-0/+6
| | | | | | | | | | | | | | | | Fix regression introduced by commit 87c2a2205: netlink_delinearize: clone on netlink_get_register(), release previous on _set() When using a non-verdict mapping, the set ref expression is assigned to the destination register. The next get_register() will attempt to clone it and crash because of the missing ->clone() callback. # nft filter input meta mark set ip daddr map { 192.168.0.1 : 123 } # nft list table filter Segmentation fault (core dumped) Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: remove unused set_clone() functionPatrick McHardy2015-01-122-19/+0
| | | | | | | | The set_clone() function was added by the event monitor patchset and is unused. It is also broken since it simply initializes the list head to the list of the original set, so remove it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: properly fix handling of large integer valuesPatrick McHardy2015-01-112-16/+3
| | | | | | | | | | | | | | | Introduction of the ERROR symbol is an ugly hack. There's no reason to special case large integer values, the NUM token only exists for small values that are needed immediately, everything else is passed as EXPR_SYMBOL to evaluation anyways. Additionally the error reporting is different from what we'd usually report, the token is easy to confuse with the bison internal error token and it even has a name, messing up bison internal diagnostics. Simply return values to large to be handled by strtoull as STRING. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_linearize: add register dumping helper functionPatrick McHardy2015-01-111-34/+40
| | | | | | | Add a helper function to dump netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: add register parsing helper functionPatrick McHardy2015-01-111-20/+26
| | | | | | | Add a helper function to parse netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* concat: add concat subtype lookup/id helpersPatrick McHardy2015-01-114-10/+22
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: cleanup hard to read codePatrick McHardy2015-01-111-60/+79
| | | | | | | | | | | The netlink parsing code is full of long function calls spawning multiple lines and in some cases parses netlink attributes multiple times. Use local variables for the registers and other data required to reconstruct the expressions and statements and reorder the code in some cases to move related processing next to each other. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: rename netlink_parse_*_sreg/dreg functionsPatrick McHardy2015-01-111-8/+8
| | | | | | These are really badly chosen names, use parse_expr and parse_stmt instead. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: readability fixesPatrick McHardy2015-01-111-56/+71
| | | | | | | | | Improve readability by using local variables for netlink attributes, ordering variables more logically, don't arbitrarily initialize some variables in the definition section and in the body and generally make similar functions look similar. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-24/+15
| | | | | | | | | Remove style discrepancies between different netlink I/O functions: - we don't use brackets for single line statements - most functions don't have a newline between error reporting and exit Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-12/+18
| | | | | | We include an empty line between variable definitions and code. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: remove unnecessary temporary variablePatrick McHardy2015-01-111-54/+18
| | | | | | | Waste less space and return the results of the batch/compat functions directly. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix memory leaksPatrick McHardy2015-01-112-1/+6
| | | | | | | Fix two memory leaks in netlink event monitor. Also fix a leak related to all sets, the ->init expression is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: fix error handling for invalid registersPatrick McHardy2015-01-101-1/+4
| | | | | | | | | | | netlink_delinearize is prepared to deal with malformed expressions from the kernel that it doesn't understand. However since expressions are now cloned unconditionally by netlink_get_register(), we crash before such errors can be detected for invalid inputs. Fix by only cloning non-NULL expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: add missing datatype compat checks for statement argumentsPatrick McHardy2015-01-101-23/+43
| | | | | | | | | | | | | | Add a helper function to evaluate expressions used as arguments for statements and report datatype mismatches. Fixes acceptance of mismatching expressions like: $ nft filter output meta mark set ip daddr <cmdline>:1:29-36: Error: datatype mismatch: expected packet mark. expression has type IPv4 address filter output meta mark set ip daddr ~~~~~~~~~~~~~~^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* eval: refactor NAT evaluation functionsPatrick McHardy2015-01-101-56/+54
| | | | | | | | | | The redir and masq evaluation functions include some useless context updates and checks. Refactor the NAT code to have a single instance of address and transport evaluation functions for simplicity and unified error reporting. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: modify pr_debug() to use printf and introduce to pr_gmp_debug()Pablo Neira Ayuso2015-01-082-13/+19
| | | | | | | | | | | | | Modify pr_debug() to use printf so we get debugging traces for proto-ctx when --with-mini-gmp is enabled. Add pr_gmp_debug(), this is disabled with --with-mini-gmp since it relies on the gmp_printf(), which is not available in the mini-gmp implementation. Suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wno-sign-compare to avoid compilation warning in mini-gmp.cPablo Neira Ayuso2015-01-081-0/+2
| | | | | | | | | | | | | | | | CC mini-gmp.o mini-gmp.c: In function ‘mpn_get_str_bits’: mini-gmp.c:1176:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_and’: mini-gmp.c:3650:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_ior’: mini-gmp.c:3723:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_xor’: mini-gmp.c:3792:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_set_str’: mini-gmp.c:4167:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add --with-mini-gmp switch to disable linking libgmpSteven Barth2015-01-089-9/+4770
| | | | | | | | | | This allows to disable linking the >400 KB big libgmp and replace it with the builtin mini-gmp which only increases size by ~30KB. Enabling this selectively decreases debugging verbosity (pr_debug). Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add a reference to the wiki page in the man pageArturo Borrero2015-01-071-0/+3
| | | | | | | | Let's add a pointer in the man page to the wiki page. Requested-by: Dan Jacobson <jidanni@jidanni.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: use stdio vasprintf instead of gmp_vasprintfSteven Barth2015-01-072-3/+11
| | | | | | | | | Use stdio's vasprintf instead of gmp_vasprintf which is not part of the mini-gmp function subset. Furthermore convert the only gmp-specific user and allow the compiler to verify format-strings. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: use mpz_set_str instead of gmp_sscanfSteven Barth2015-01-071-3/+1
| | | | | | | | This simplifies the integer parsing logic and restricts it to functions being part of the mini-gmp subset. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: rename VERSION token to HDRVERSIONSteven Barth2015-01-072-4/+4
| | | | | | | | | A token name of VERSION results in a macro being defined with the same name. This prevents inclusion of config.h in commonly used headers. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix dependency generation from nft -fPablo Neira Ayuso2015-01-062-1/+4
| | | | | | | | | | | | | | | When nft -f is used, ctx->cmd points to the table object, which contains the corresponding chain, set and rule lists. The reject statement evaluator relies on ctx->cmd->rule to add the payload dependencies, which is doesn't point to the rule in that case. This patch adds the rule context to the eval_ctx structure to update the rule list of statements when generating dependencies, as the reject statement needs. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=993 Reported-by: Ting-Wei Lan <lantw44@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: assert when accessing inner transport headerPablo Neira Ayuso2015-01-041-0/+1
| | | | | | | | | | Instead of segfaulting due to out of bound access access to protocol context array ctx->protocol[base].location from proto_ctx_update(). # nft add rule filter input ah nexthdr tcp nft: payload.c:88: payload_expr_pctx_update: Assertion `left->payload.base + 1 <= (__PROTO_BASE_MAX - 1)' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: revisit chain testsPablo Neira Ayuso2014-12-224-14/+8
| | | | | | | | Make sure support chain don't stop working. Remove some minor mistakes and out of scope tests from chain*.t Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: named sets workPablo Neira Ayuso2014-12-221-4/+3
| | | | | | Those tests work already, enable them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: alloc specifying concat types in set declarationsPatrick McHardy2014-12-162-22/+43
| | | | | | | | | | | | Support specification of concat types in set declarations: add set filter test { type ipv4_addr . inet_service } Netlink delinearization is changed to reconstruct the type from the id. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: change concat_type_alloc() to construct type from idPatrick McHardy2014-12-163-15/+19
| | | | | | | The kernel only stored the id so we need to be able to reconstruct the datatype from the id only. Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-10 18:02:07 +0000