summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: remove nft.xml from CLEANFILESFlorian Westphal2018-07-261-1/+1
| | | | | | | This file doesn't exist. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: doc: Convert man page source to asciidocArushi Singhal2018-07-269-5743/+2435
| | | | | | | This patch converts nft.xml into asciidoc markup. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: fix a typo in socket.hFernando Fernandez Mancera2018-07-221-3/+1
| | | | | | | Fix a typo in socket_template struct description. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: meta: always prefix 'meta' for almost all tokensFlorian Westphal2018-07-2119-117/+114
| | | | | | | | | | | | | | | | | | got following bug report: nft add ... ct mark set mark and 0x10 ... always sets 0. What reporter meant to write instead was 'ct mark', not 'mark'. We can't just remove support for 'mark' and force 'meta mark', but we can start to discourage it by printing meta prefix too. Later on, we could start to print deprecation warning if needed. Followup patch can also change "iifname" etc. to "meta iifname". Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test case for rename-to-same-nameFlorian Westphal2018-07-182-14/+19
| | | | | | | kernel currently permits chains with same name when a transaction renames 2 chains to the same new name. Add a test case for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: validate maximum chain depthPablo Neira Ayuso2018-07-161-0/+22
| | | | | | Original script from Taehee Yoo. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: add tests for listing objectsHarsha Sharma2018-07-162-0/+57
| | | | | | | | Add tests for listing specific object for a given table name and all objects of a table. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: list only the table containing objectHarsha Sharma2018-07-101-7/+5
| | | | | | | | | | | | | | | | | | | For e.g. % nft list ct helper ip raw cthelp1 table ip filter { } table ip raw { ct helper cthelp1 { type "ftp" protocol tcp l3proto ip } } With this patch, print only table raw. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: check ifname use in concatenated setsFlorian Westphal2018-07-072-0/+12
| | | | | | | | | | | error was: nft create set inet filter keepalived_ranges4 { type inet_service . ifname \; } Error: Empty string is not allowed This was fixed in 6b00b9537e181 ("evaluate: skip evaluation of datatype concatenations"). Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: set: print dynamic flag when setFlorian Westphal2018-07-071-1/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: describe dynamic flag and caveats for packet-path updatesFlorian Westphal2018-07-071-6/+8
| | | | | | | | | | | | | | | This fails: nft add table ip filter nft add chain ip filter input '{' type filter hook input priority 0 ';' '}' nft add set ip filter protocols '{' type inet_proto ';' '}' nft add rule ip filter input iifname lo set add ip protocol @protocols ^^^^^^^^^^^^^^^^^^^ ...as wrong set type gets chosen. Describe dynamic flag and that sets should have both timeout and max size set. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: skip evaluation of datatype concatenationsPablo Neira Ayuso2018-07-071-4/+5
| | | | | | | | | These are not really expressions, so there is not value in place. The expr_evaluate_concat() is called from set_evaluate() to calculate the total length of the tuple. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1265 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update manpage to document --literal optionPablo Neira Ayuso2018-07-071-4/+8
| | | | | | | | This patch describe the new --literal option. Remove documentation on -N to prepare it for deprecation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --literal optionPablo Neira Ayuso2018-07-0716-32/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default not to print the service name as we discussed during the NFWS. # nft list ruleset table ip x { chain y { tcp dport 22 ip saddr 1.1.1.1 } } # nft -l list ruleset table ip x { chain y { tcp dport ssh ip saddr 1.1.1.1 } } # nft -ll list ruleset table ip x { chain y { tcp dport 22 ip saddr 1dot1dot1dot1.cloudflare-dns.com } } Then, -ll displays FQDN. just like the (now deprecated) --ip2name (-N) option. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: limit: don't print default burst valueFlorian Westphal2018-07-041-1/+1
| | | | | | | | | | | | limit http-traffic { rate 1/second } gets printed as limit http-traffic { rate 1/second burst 5 packets } caused tests/shell/run-tests.sh tests/shell/testcases/sets/0026named_limit_0 to return 'DUMP FAIL'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add socket expression to man pageMáté Eckl2018-07-031-0/+56
| | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com>
* nftables: tests: shell: Replace "%" with "#" or "$"Arushi Singhal2018-07-021-5/+5
| | | | | | | | | | | Shell prompt ends with: "%", indicates a C shell. "$", indicates shell that's compatible with the Bash. "#", indicates shell is running as the system's root. So, "%" is replaced with "$" or "#". Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: Refactor meta_may_dependency_kill()Phil Sutter2018-06-265-40/+259
| | | | | | | | | | | | | | | | The original intent was to fix a bug: The following rule in inet table: | meta nfproto ipv4 icmpv6 type echo-reply Was added correctly but when printing the meta match was falsely removed. The fix is to deny dependency killing if RHS family of nfproto match doesn't match RHS family of l4proto match. Adding this to the already large conditional led to even more unreadable code, therefore this patch tries to clean that up (and also removes the partial code duplication. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: trace: fix policy printingFlorian Westphal2018-06-261-1/+30
| | | | | | | | | | | | | | | | | | | | policy type is erronously handled via verdict, this is wrong. It is a different event type and needs to be handled as such. before: trace id 42b54e71 inet filter input packet: iif "lo" ip saddr 127.0.0.1 .. trace id 42b54e71 inet filter input rule ip protocol icmp nftrace set 1 (verdict continue) trace id 42b54e71 inet filter input verdict continue trace id 42b54e71 inet filter input after: trace id 9f40c5c7 inet filter input packet: iif "lo" ip saddr 127.0.0.1 .. trace id 9f40c5c7 inet filter input rule ip protocol icmp nftrace set 1 (verdict continue) trace id 9f40c5c7 inet filter input verdict continue trace id 9f40c5c7 inet filter input policy drop Reported-by: vtol@gmx.net Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: fix import when run from other directoryEric Leblond2018-06-211-2/+2
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: minor cleaningEric Leblond2018-06-201-4/+5
| | | | | | | Move import and use explicit parameter in object creation. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix make distcheckEric Leblond2018-06-201-4/+4
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* python: set license and author in nftables.pyEric Leblond2018-06-201-0/+16
| | | | | | | | It will be distributed separately so this worth setting things correctly. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* python: installation of binding via make installEric Leblond2018-06-207-1/+87
| | | | | | | | | setup.py is used to build and install the python binding. Call to setup.py are done in Makefile to proceed to build and installation. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: docbook2man invalid syntax errorEric Leblond2018-06-201-6/+3
| | | | | | | | | docbook2man can not be used with the same option so let's remove it from the alternative. Fedora and debian seems to be fine with that. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: remove useless braces in messagesEric Leblond2018-06-201-2/+2
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure.ac: better message when a2x is missingEric Leblond2018-06-201-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: Fix typos/Grammatical ErrorsArushi Singhal2018-06-191-4/+4
| | | | | | | | typos/Grammatical errors are corrected. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* Makefile: Introduce Make_global.amPhil Sutter2018-06-182-1/+24
| | | | | | | | | Analogous to libnftnl's build system, define libnftables interface version in a variable in Make_global.am. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: libnftables-json: Review asciidoc syntaxPhil Sutter2018-06-181-184/+142
| | | | | | | | | | | | | | | | | | | | This changes asciidoc markup according to a few best practices recommended in [1] and a quick review of html output: * Use atx-style headings everywhere apart from the document title. This requires to explicitly disable compat-mode after the latter. * Use only the minimum number of dashes for listings. * Enclose verses with empty lines in a verse block instead of having multiple verses for it. * Indent continued lines in synopsis for added readability. [1] https://asciidoctor.org/docs/asciidoc-recommended-practices/ Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: Do not convert tabs into spacesPhil Sutter2018-06-181-15/+1
| | | | | | | | | | | | | | | | | | | | | Commit 2f86dd5a43baf ("erec: Review erec_print()") changed erec_print() function to expect tabs in input by replacing the whitespace character in the marker line at the same offset with a tab character so that the marker aligns with the offending part of input. The need for that came from JSON input not having its tabs converted to spaces, which erec_print() didn't expect. Above change though has a shortcoming: When reading standard syntax input from a file, Flex code converts tabs into spaces. Location information is taken from this converted input, but when printing an error message, the offending input line is read from the input file directly (which still contains tabs). The solution is to simply drop said tab conversion from scanner.l. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Simplify nft_run_cmd_from_buffer footprintPhil Sutter2018-06-189-21/+20
| | | | | | | | | | | | | | | | | | | | | | | With libnftables documentation being upstream and one confirmed external user (nftlb), time to break the API! First of all, the command buffer passed to nft_run_cmd_from_buffer may (and should) be const. One should consider it a bug if that function ever changed it's content. On the other hand, there is no point in passing the buffer's length as separate argument: NULL bytes are not expected to occur in the input, so it is safe to rely upon strlen(). Also, the actual parsers don't require a buffer length passed to them, either. The only use-case for it is when reallocating the buffer to append a final newline character, there strlen() is perfectly sufficient. Suggested-by: Harald Welte <laforge@gnumonks.org> Cc: Laura Garcia Liebana <nevola@gmail.com> Cc: Eric Leblond <eric@regit.org> Cc: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Fix exit_cookie()Phil Sutter2018-06-181-0/+2
| | | | | | | | | | | | | | | | | | The output and error buffer feature depends on cookie->orig_fp to indicate the current status of buffering: If it is set, a prior call to init_cookie() is assumed. Though exit_cookie() missed to reset that pointer to NULL. causing weird behaviour in applications if they do: | nft = nft_ctx_new(0); | nft_ctx_buffer_output(nft); | nft_ctx_unbuffer_output(nft); | nft_ctx_buffer_output(nft); While being at it, apply the same fix to error path in init_cookie() as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Fix typo in Makefile.amPhil Sutter2018-06-161-1/+1
| | | | | | | | Previous patch adding libnftables man page missed a backslash. Fixes: 3c57ff87b1b2b ("doc: Add libnftables man page") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Add libnftables man pagePhil Sutter2018-06-153-3/+324
| | | | | | | | For now, use a single man page to describe all the functions exported by libnftables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dynamic flag and use itPablo Neira Ayuso2018-06-124-4/+7
| | | | | | | We need to signal the kernel to use a set backend that supports dynamic updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add stolen verdictFlorian Westphal2018-06-121-1/+5
| | | | | | | | | | | | | | | using fwd statement causes crash when using nft trace: trace id ddbbaae2 netdev vpn ingress_out packet: iif "enp2s0" ether saddr 78:54:00:29:bb:aa ether daddr 52:54:00:01:53:9f ip saddr 85.14.236.41 ip daddr 17.25.63.98 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49036 ip length 84 icmp type echo-reply icmp code 0 icmp id 16947 icmp sequence 4 trace id ddbbaae2 netdev vpn ingress_out rule ip saddr 85.14.236.41 nftrace set 1 (verdict continue) trace id ddbbaae2 netdev vpn ingress_out rule ip saddr 85.14.236.41 ether saddr set aa:bb:00:18:cc:dd ether daddr set 00:00:5e:00:00:11 fwd to "enp1s0" BUG: invalid verdict value 2 nft: datatype.c:282: verdict_type_print: Assertion `0' failed. ADd stolen verdict (2) and remove the BUG statement. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1261 Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Add JSON schema documentationPhil Sutter2018-06-114-4/+1261
| | | | | | | | | | The document is written as man page in asciidoc which means this adds another dependency to the build system. Though since the (long-term) plan is to replace the docbook-based nft man page with an asciidoc one anyway, we might ultimately get rid of docbook dependency in exchange. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Support latest enhancements of fwd statementPhil Sutter2018-06-116-33/+102
| | | | | | | | | | | | | JSON equivalent of fwd statement was too primitive to support the added address and family parameters, so make its value an object and accept the device expression as value of a "dev" property in there. Then add optional "addr" and "family" properties to it. While being at it, add a testcase to make sure the extended syntax works right. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Add support for connlimit statementPhil Sutter2018-06-114-0/+32
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Add support for socket expressionPhil Sutter2018-06-116-0/+63
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Don't print burst if equal to 5Phil Sutter2018-06-111-1/+1
| | | | | | | | Analogous to commit 3dddef928d80d ("statement: don't print burst if equals 5"), don't print the default burst value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix JSON for flowtable testsPhil Sutter2018-06-114-28/+7
| | | | | | | | | Changing the reference lines is not enough, the actual JSON has to be adjusted as well. Since after the changes output for ip/flowtable.t is now symmetric, ip/flowtable.t.json.output can be removed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Call verdict maps 'vmap' in JSON as wellPhil Sutter2018-06-1117-74/+80
| | | | | | | This way JSON format is more consistent with the standard one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: build: cover --with-json tooPablo Neira Ayuso2018-06-101-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: timeout: fix output for HZ=250v0.9.0Florian Westphal2018-06-081-2/+2
| | | | | | 4s5ms gets rounded to 4s8ms with HZ=250, which is a common setting. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add quotes when using <<<-style here documentFlorian Westphal2018-06-0852-59/+59
| | | | | | | | | bash 4.3.30 removes newlines in RULESET when "" are omitted, which then causes nft -f to complain about invalid syntax. As a result, all test cases that use this here-doc style fail. Signed-off-by: Florian Westphal <fw@strlen.de>
* build: missing headers file in Makefile.amFlorian Westphal2018-06-081-0/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* build: Bump version to v0.9.0Florian Westphal2018-06-081-2/+2
| | | | | | Update dependency on libnftnl. Signed-off-by: Florian Westphal <fw@strlen.de>
* build: update release namePablo Neira Ayuso2018-06-081-1/+1
| | | | | | | | Dedicated to Al Capp cartoonist: https://en.wikipedia.org/wiki/Fearless_Fosdick Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 14:17:40 +0000