summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: nft: ct id does not allow for original|replyPablo Neira Ayuso2021-06-041-2/+2
| | | | | | This is a singleton ct key, move it to where it belongs to. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: connlimit: remove extra whitespace in print functionPablo Neira Ayuso2021-06-042-2/+2
| | | | | | | | | | | | | | | Instead of: ct count 2 accept ^^ simply print: ct count 2 accept While at it, add incomplete reference 'ct count' to manpage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: catchall element supportFlorian Westphal2021-06-025-10/+92
| | | | | | | Treat '*' as catchall element, not as a symbol. Also add missing json test cases for wildcard set support. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: fix error messageFlorian Westphal2021-06-021-1/+5
| | | | | | | This should say "should have failed" only if the set add operation was supposed to fail, not when its supposed to work. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix parse of flagcmp expressionFlorian Westphal2021-06-022-1/+28
| | | | | | | | | | | | The json test case for the flagcmp notation ('tcp flags syn,fin / syn,fin') fails with: command: {"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"match": {"left": {"&": [{"payload": {"field": "flags", "protocol": "tcp"}}, ["fin", "syn"]]}, "op": "==", "right": ["fin", "syn"]}}]}}}]} internal:0:0-0: Error: List expression only allowed on RHS or in statement expression. internal:0:0-0: Error: Failed to parse RHS of binop expression. internal:0:0-0: Error: Invalid LHS of relational. internal:0:0-0: Error: Parsing expr array at index 0 failed. internal:0:0-0: Error: Parsing command array at index 0 failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix base chain outputFlorian Westphal2021-06-021-1/+1
| | | | | | | | | | | nft-test.py -j fails with python: json.c:243: chain_print_json: Assertion `__out' failed. The member was changed from char * to a struct, pass the name again. Fixes: 5008798157e2114f ("libnftables: location-based error reporting for chain type") Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit cabe8992b3ee4eb0001a07075b317d966df6bcbd)
* build: Bump version to v0.9.9v0.9.9Pablo Neira Ayuso2021-05-251-3/+3
| | | | | | | | Update release name based on the Fearless Fosdick series: Prudence Pimpleton. Bump dependencies on libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: tiny spelling fix in stateful object section s/an/aFlorian Westphal2021-05-251-1/+1
| | | | | | | | Quoting Duncan Roe: Tiny nit: suggest "by a unique" instead of "by an unique". "a" reads better to this native en-GB speaker at least. Signed-off-by: Florian Westphal <fw@strlen.de>
* include: missing sctp_chunk.h in Makefile.amPablo Neira Ayuso2021-05-251-0/+1
| | | | | | | Fix make distcheck. Fixes: 0e3871cfd9a1 ("exthdr: Implement SCTP Chunk matching") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: display an error on unknown datatypePablo Neira Ayuso2021-05-241-1/+4
| | | | | | | | # nft describe foo datatype foo is invalid Fixes: 21cbab5b6ffe ("expression: extend 'nft describe' to allow listing data types") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: allow == and != in the new shortcut syntax to match for flagsPablo Neira Ayuso2021-05-241-0/+4
| | | | | | | | | | | | The flags / mask syntax only allows for ==, != and the implicit operation (which is == in this case). # nft add rule x y tcp flags ! syn / syn,ack Error: either == or != is allowed add rule x y tcp flags ! syn / syn,ack ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: improve secmark.nft exampleDominick Grift2021-05-241-5/+5
| | | | | | | use proper priorities to ensure that ct works properly Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr_postprocess: Avoid an unintended fall throughPhil Sutter2021-05-201-0/+1
| | | | | | | | | Parsing a range expression, the switch case fell through to prefix expression case, thereby recursing once more for expr->left. This seems not to have caused harm, but is certainly not intended. Fixes: ee4391d0ac1e7 ("nat: transform range to prefix expression when possible") Signed-off-by: Phil Sutter <phil@nwl.cc>
* rule: skip exact matches on fuzzy lookupPablo Neira Ayuso2021-05-201-19/+0
| | | | | | | | The fuzzy lookup is exercised from the error path, when no object is found. Remove branch that checks for exact matching since that should not ever happen. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: typo in chain fuzzy lookupPablo Neira Ayuso2021-05-202-2/+2
| | | | | | | | | | | | | | | | Refer to chain, not table. Error: No such file or directory; did you mean table ‘z’ in family ip? add chain x y { type filter nat prerouting priority dstnat; } ^ It should say instead: Error: No such file or directory; did you mean chain ‘z’ in table ip ‘x’? [ Florian added args check for fmt to the netlink_io_error() prototype. ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: location-based error reporting for chain typePablo Neira Ayuso2021-05-206-8/+20
| | | | | | | | | | | | | | | | | Store the location of the chain type for better error reporting. Several users that compile custom kernels reported that error reporting is misleading when accidentally selecting CONFIG_NFT_NAT=n. After this patch, a better hint is provided: # nft 'add chain x y { type nat hook prerouting priority dstnat; }' Error: Could not process rule: No such file or directory add chain x y { type nat hook prerouting priority dstnat; } ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft.8: Extend monitor description by tracePhil Sutter2021-05-191-3/+22
| | | | | | Briefly describe 'nft monitor trace' command functionality. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: document cgroupv2Pablo Neira Ayuso2021-05-191-1/+16
| | | | | | This patch adds documentation for cgroupsv2 support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Implement SCTP Chunk matchingPhil Sutter2021-05-1916-2/+1332
| | | | | | | | Extend exthdr expression to support scanning through SCTP packet chunks and matching on fixed fields' values. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* json: Simplify non-tcpopt exthdr printing a bitPhil Sutter2021-05-191-11/+7
| | | | | | This was just duplicate code apart from the object's name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: sctp: Move to own scopePhil Sutter2021-05-193-4/+10
| | | | | | | This isolates only "vtag" token for now. Signed-off-by: Phil Sutter <phil@nwl.cc> Reviewed-by: Florian Westphal <fw@strlen.de>
* datatype: skip cgroupv2 rootfs in listingPablo Neira Ayuso2021-05-181-1/+2
| | | | | | | | | | | | | | | | cgroupv2 path is expressed from the /sys/fs/cgroup folder, update listing to skip it. # nft add rule x y socket cgroupv2 level 1 "user.slice" counter # nft list ruleset table ip x { chain y { type filter hook input priority filter; policy accept; socket cgroupv2 level 1 "user.slice" counter } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use PRIu64 formatPablo Neira Ayuso2021-05-182-2/+2
| | | | | | | | | | | | | | | | | | Fix the following compilation warnings on x86_32. datatype.c: In function ‘cgroupv2_type_print’: datatype.c:1387:22: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Wformat=] nft_print(octx, "%lu", id); ~~^ ~~ %llu meta.c: In function ‘date_type_print’: meta.c:411:21: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘uint64_t’ {aka ‘long long unsigned int’} [-Wformat=] nft_print(octx, "%lu", tstamp); ~~^ ~~~~~~ %llu Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: add shortcut syntax for matching flags without binary operationsPablo Neira Ayuso2021-05-169-24/+155
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following shortcut syntax: expression flags / flags instead of: expression and flags == flags For example: tcp flags syn,ack / syn,ack,fin,rst ^^^^^^^ ^^^^^^^^^^^^^^^ value mask instead of: tcp flags and (syn|ack|fin|rst) == syn|ack The second list of comma-separated flags represents the mask which are examined and the first list of comma-separated flags must be set. You can also use the != operator with this syntax: tcp flags != fin,rst / syn,ack,fin,rst This shortcut is based on the prefix notation, but it is also similar to the iptables tcp matching syntax. This patch introduces the flagcmp expression to print the tcp flags in this new notation. The delinearize path transforms the binary expression to this new flagcmp expression whenever possible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: check errno before invoking cache_release()Marco Oliverio2021-05-141-2/+4
| | | | | | | | | | | | if genid changes during cache_init(), check_genid() sets errno to EINTR to force a re-init of the cache. cache_release() may inadvertly change errno by calling free(). Indeed free() may invoke madvise() that changes errno to ENOSYS on system where kernel is configured without support for this syscall. Signed-off-by: Marco Oliverio <marco.oliverio@tanaza.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix binary operation postprocessing with setsPablo Neira Ayuso2021-05-131-0/+1
| | | | | | | | | | | | | | If the right-hand side expression of the binary expression is a set, then, skip the postprocessing step otherwise the tests/py report the following warning: # ./nft-test.py inet/tcp.t inet/tcp.t: WARNING: line 80: 'add rule ip test-ip4 input tcp flags & (syn|fin) == (syn|fin)': 'tcp flags & (fin | syn) == fin | syn' mismatches 'tcp flags ! fin,syn' inet/tcp.t: WARNING: line 83: 'add rule ip test-ip4 input tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack }': 'tcp flags & (fin | syn | rst | psh | ack | urg) == { fin, ack, psh | ack, fin | psh | ack }' mismatches 'tcp flags ! fin,syn,rst,psh,ack,urg' This listing is not correct. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: don't assume fixed handle value in cache/0008_delete_by_handle_0Pablo Neira Ayuso2021-05-121-5/+10
| | | | | | | | This test is occasionally reporting warning in one of my test boxes. Update this test to extract the handle from ruleset listing, use rudimentary invocation of the cut command to work around this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't crash on set definition with incorrect datatypePablo Neira Ayuso2021-05-111-1/+1
| | | | | | | | | | Cache updates have resurrected the bug described in 5afa5a164ff1 ("evaluate: check for NULL datatype in rhs in lookup expr"). This is triggered by testcases/cache/0008_delete_by_handle_0. Fixes: df48e56e987f ("cache: add hashtable cache for sets") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set element catch-all supportPablo Neira Ayuso2021-05-1116-43/+278
| | | | | | | | | | | | | | | | | | | | | | | | | Add a catchall expression (EXPR_SET_ELEM_CATCHALL). Use the asterisk (*) to represent the catch-all set element, e.g. table x { set y { type ipv4_addr counter elements = { 1.2.3.4 counter packets 0 bytes 0, * counter packets 0 bytes 0 } } } Special handling for segtree: zap the catch-all element from the set element list and re-add it after processing. Remove wildcard_expr deadcode in src/parser_bison.y This patch also adds several tests for the tests/py and tests/shell infrastructures. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: add set_elem_key_expr rulePablo Neira Ayuso2021-05-111-2/+8
| | | | | | | Add a rule to specify the set key expression in preparation for the catch-all element support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Reduce size of NAT statement synopsisPhil Sutter2021-05-111-15/+10
| | | | | | | | | Introduce non-terminals representing address and port which may represent ranges as well. Combined with dropping the distinction between PR_FLAGS and PRF_FLAGS, all the lines for each nat statement type can be combined. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: Introduce 0043_concatenated_ranges_1 for subnets of different sizesStefano Brivio2021-05-081-0/+23
| | | | | | | | | | | The report from https://bugzilla.netfilter.org/show_bug.cgi?id=1520 showed a display issue with particular IPv6 mask lengths in elements of sets with concatenations. Make sure we cover insertion and listing of different mask lengths in concatenated set elements for IPv4 and IPv6. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: Fix range_mask_len() for subnet ranges exceeding unsigned intStefano Brivio2021-05-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | As concatenated ranges are fetched from kernel sets and displayed to the user, range_mask_len() evaluates whether the range is suitable for display as netmask, and in that case it calculates the mask length by right-shifting the endpoints until no set bits are left, but in the existing version the temporary copies of the endpoints are derived by copying their unsigned int representation, which doesn't suffice for IPv6 netmask lengths, in general. PetrB reports that, after inserting a /56 subnet in a concatenated set element, it's listed as a /64 range. In fact, this happens for any IPv6 mask shorter than 64 bits. Fix this issue by simply sourcing the range endpoints provided by the caller and setting the temporary copies with mpz_init_set(), instead of fetching the unsigned int representation. The issue only affects displaying of the masks, setting elements already works as expected. Reported-by: PetrB <petr.boltik@gmail.com> Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1520 Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add cgroupsv2 supportPablo Neira Ayuso2021-05-0311-8/+126
| | | | | | Add support for matching on the cgroups version 2. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove object from cache on delete object commandPablo Neira Ayuso2021-05-021-0/+37
| | | | | | Update the cache to remove this object from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove flowtable from cache on delete flowtable commandPablo Neira Ayuso2021-05-023-0/+30
| | | | | | | Update the cache to remove this flowtable from the evaluation phase. Add flowtable_cache_del() function for this purpose. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove set from cache on delete set commandPablo Neira Ayuso2021-05-021-0/+24
| | | | | | Update the cache to remove this set from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove chain from cache on delete chain commandPablo Neira Ayuso2021-05-023-0/+31
| | | | | | | Update the cache to remove this chain from the evaluation phase. Add chain_cache_del() function for this purpose. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for tablePablo Neira Ayuso2021-05-0210-121/+182
| | | | | | | | | | | | Add a hashtable for fast table lookups. Tables that reside in the cache use the table->cache_hlist and table->cache_list heads. Table that are created from command line / ruleset are also added to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add object to the cachePablo Neira Ayuso2021-05-021-0/+10
| | | | | | | | | | | If the cache does not contain this object that is defined in this batch, add it to the cache. This allows for references to this new object in the same batch. This patch also adds missing handle_merge() to set the object name, otherwise object name is NULL and obj_cache_find() crashes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: missing table cache for several policy objectsPablo Neira Ayuso2021-05-021-0/+4
| | | | | | Populate the cache with tables for several policy objects types. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add flowtable to the cachePablo Neira Ayuso2021-05-021-0/+3
| | | | | | | | If the cache does not contain this flowtable that is defined in this batch, then add it to the cache. This allows for references to this new flowtable in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add set to the cachePablo Neira Ayuso2021-05-021-0/+4
| | | | | | | | If the cache does not contain the set that is defined in this batch, add it to the cache. This allows for references to this new set in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add set_cache_del() and use itPablo Neira Ayuso2021-05-023-1/+7
| | | | | | | | Update set_cache_del() from the monitor path to remove sets in the cache. Fixes: df48e56e987f ("cache: add hashtable cache for sets") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for flowtablePablo Neira Ayuso2021-05-028-33/+112
| | | | | | | | | | Add flowtable hashtable cache. Actually I am not expecting that many flowtables to benefit from the hashtable to be created by streamline this code with tables, chains, sets and policy objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for objectPablo Neira Ayuso2021-05-028-55/+124
| | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for object lookups. This patch also splits table->objs in two: - Sets that reside in the cache are stored in the new tables->cache_obj and tables->cache_obj_ht. - Set that defined via command line / ruleset file reside in tables->obj. Sets in the cache (already in the kernel) are not placed in the table->objs list. By keeping separated lists, objs defined via command line / ruleset file can be added to cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate object cache infrastructurePablo Neira Ayuso2021-05-025-50/+75
| | | | | | | This patch consolidates the object cache infrastructure. Update set and chains to use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate nft_cache infrastructurePablo Neira Ayuso2021-05-027-43/+43
| | | | | | | | - prepend nft_ prefix to nft_cache API and internal functions - move declarations to cache.h (and remove redundant declarations) - move struct nft_cache definition to cache.h Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass chain name to chain_cache_find()Pablo Neira Ayuso2021-05-025-14/+12
| | | | | | | | You can identify chains through the unique handle in deletions, update this interface to take a string instead of the handle to prepare for the introduction of 64-bit handle chain lookups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: skip fuzzy lookup for unexisting 64-bit handlePablo Neira Ayuso2021-05-022-0/+23
| | | | | | | | Deletion by handle, if incorrect, should not exercise the misspell lookup functions. Fixes: 3a0e07106f66 ("src: combine extended netlink error reporting with mispelling support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 17:52:20 +0000