summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* nft: Modified punctuation used in nft's show_helpPiyush Pangtey2016-03-091-7/+7
| | | | | | | Replaced '/' between shortopt and longopt with ',' , as used by other utilities. Signed-off-by: Piyush Pangtey <gokuvsvegita@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: Fixed a typo and added/changed punctuationPiyush Pangtey2016-03-091-16/+16
| | | | | | | | | | | In nft's man page , instead of using '/' between shortopt and longopt in the "SYNOPSIS" and "OPTIONS" section , use '|' and ',' respectively. (just like the man pages of iptables, etc.) Fixed a typo and added missing ',' . Signed-off-by: Piyush Pangtey <gokuvsvegita@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: enable tests for dccp typesPablo Neira Ayuso2016-03-075-4/+111
| | | | | | This patch make sure we test dccp type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: remove 'reset' as reserve keywordPablo Neira Ayuso2016-03-072-4/+8
| | | | | | | | | The 'reset' keyword can be used as dccp type, so don't qualify it as reserve keyword to avoid a conflict with this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1055 Reported-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: simplify ("rule: delete extra space in sets printing")Pablo Neira Ayuso2016-03-041-4/+1
| | | | | | | | | This simplifies bd23f7628570 ("rule: delete extra space in sets printing") by passing the whitespace from set_print_plain() called from the monitoring path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* tests/py: extend masquerade to cover ports tooPablo Neira Ayuso2016-03-034-0/+38
| | | | | | Tests new masquerade port range support (available since 4.6-rc). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/listing: add some listing testsArturo Borrero2016-03-0312-0/+329
| | | | | | | | | | Let's test what is shown with the 'list' command, for ruleset, tables and sets. In order to ease debug in case of failure, if the diff tool is in the system, then a textual diff is printed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: add first `nft -f' testsArturo Borrero2016-03-031-0/+25
| | | | | | | This patch add some basic initial tests. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: delete extra space in sets printingArturo Borrero2016-03-031-1/+4
| | | | | | | | | | | | | | | | The extra space is printed when sets are printed in tabulated format. table inet test { set test { ^ type ipv4_addr } } However, the space is still required in printing in plain format (ie, monitor). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for masquerade port selectionShivani Bhardwaj2016-03-036-8/+86
| | | | | | | | | Provide full support for masquerading by allowing port range selection, eg. # nft add rule nat postrouting ip protocol tcp masquerade to :1024-10024 Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: handle extension header templates with odd sizesFlorian Westphal2016-03-023-4/+41
| | | | | | | | | | | | | | | | | | This enables nft to display frag frag-off 33 ... by considering a mask during binop postprocess in case the initial template lookup done when the exthdr expression was created did not yield a match. In the above example, kernel netlink data specifies 16bits, but the frag field is only 13bits wide. We use the implicit binop mask to re-do the template lookup with corrected offset and size information. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: prepare binop_postprocess for exthdr demuxFlorian Westphal2016-03-021-8/+7
| | | | | | | | | | | | | | | binop_postprocess takes care of removing masks if we're dealing with payload expressions that have non-byte divisible sizes or offsets. Same can happen when matching some extension header fields, i.e. this also needs to handle exthdr expression, not just payload. So rename payload to left and move test for left type to binop_postprocess. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: store offset for later useFlorian Westphal2016-03-022-0/+3
| | | | | | | | Its possible that we cannot find the template without also considering an implicit mask. For this we need to store the offset. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: remove implicit dependenciesFlorian Westphal2016-03-021-3/+10
| | | | | | | | exthdr expression requires a dependency on ipv6; we can thus remove an ipv6 protocol test if its present. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add/fix inet+exthdr testsFlorian Westphal2016-03-025-0/+327
| | | | | | | | exhdr needs to be treated as if we'd test an ipv6 header field, i.e. inet, bridge, netdev need to add a dependency on ipv6 protocol. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: generate dependencies for inet/bridge/netdev familyFlorian Westphal2016-03-023-3/+31
| | | | | | | Should treat this as if user would have asked to match ipv6 header field. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: move payload_gen_dependency generic part to helperFlorian Westphal2016-03-021-28/+38
| | | | | | | | | | | | | | | We should treat exthdr just as if user asked for e.g. ip6 saddr and inject the needed dependency statement. payload_gen_dependency cannot be used since the *expr needs to be a payload expression, but the actual dependency generation doesn't depend on a particular expression type. In order to reuse this part for future exthdr dependency injection move it to a helper. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add and use netlink_gen_exthdr_maskFlorian Westphal2016-03-021-3/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | rule ip6 filter input frag frag-off 33 before patch: [ exthdr load 1b @ 44 + 2 => reg 1 ] [ cmp eq reg 1 0x00002100 ] We truncated 13bit field to 1 byte. after patch: [ exthdr load 2b @ 44 + 2 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000f8ff ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000801 ] - ask for 2 bytes - mask out the 3 lower bits - shift the value by 3 so equality test will pass for 33 This causes test failures, will be fixed up in a later patch (the test suite expects the old, broken input). It also misses the reverse translation to remove the binop, find the right template and undo the shift of the value. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: split generic part of netlink_gen_payload_mask into helperFlorian Westphal2016-03-021-12/+23
| | | | | | | | | | | netlink_gen_payload_mask assumes expr is a payload expression, but most of this function would work fine with exthdr too. So split the gernic part into a helper, followup patch will add netlink_gen_exthdr_mask. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: enforce ip6 proto with exthdr expressionFlorian Westphal2016-03-023-33/+45
| | | | | | | | | | | | | | Don't allow use of exthdr with e.g. ip family. Move frag.t to ip6 directory and don't use it with ipv4 anymore. This change causes major test failures for all exthdr users since they now fail with inet/bridge/netdev families. Will be resolved in a later patch -- we need to add an ipv6 dependency for them. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject set references in set elementsFlorian Westphal2016-03-021-0/+5
| | | | | | | | | | | | | | | | | | | | | given table filter { set local { type iface_index elements = { lo } } chain input { type filter hook input priority 0; iif { @lan, } accept; } } nft BUG()s. I don't see how we could support sets-in-set; add a sanity check and error out instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: use current type namesFlorian Westphal2016-02-251-5/+5
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: fix error checks in tc handle parserFlorian Westphal2016-02-171-3/+3
| | | | | | | | 'meta priority foobar' did not return an error -- instead we used min/max values with undefined content. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: use parameter-problem for icmpv6 typePablo Neira Ayuso2016-02-013-1/+10
| | | | | | | To keep it consistent with icmpv4 naming. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=911 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: prune implicit binop before payload_match_postprocess()Pablo Neira Ayuso2016-02-011-3/+2
| | | | | | | | | | | | payload_match_postprocess() expects a relational with payload of his lhs and value on the rhs. Moreover, payload_match_expand() releases the previous expression so valgrind reports an use-after-free when pruning the implicit binop. Fix this by calling payload_match_postprocess() in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: test vlan on ingressPablo Neira Ayuso2016-01-312-0/+237
| | | | | | | | | | This generates the same code as bridge does, but it includes this check in first place. [ meta load iiftype => reg 1 ] [ cmp eq reg 1 0x00000001 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: annotate follow up dependency just after killing anotherPablo Neira Ayuso2016-01-311-18/+27
| | | | | | | | The inet and netdev families generate two implicit dependencies to check for the interface type, so we have to check just after killing an implicit dependency if there is another that we should annotate to kill it as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: proto_dev_type() returns interface type for base protocols tooPablo Neira Ayuso2016-01-311-2/+10
| | | | | | | | | | | | | | | The device protocol definition provides a mapping between the interface type, ie. ARPHDR_*, and the overlying protocol base definition, eg. proto_eth. This patch updates proto_dev_type() so it also returns a mapping for these overlying ethernet protocol definitions, ie. ip, ip6, vlan, ip, arp. This patch required to resolve problems with automatic dependency generation for vlan in the netdev and inet families. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: generate ether type payload after meta iiftypePablo Neira Ayuso2016-01-311-7/+10
| | | | | | | | | | | | | | | Once the meta iiftype is generated, we shouldn't return from resolve_protocol_conflict() since we also need to generate the ether type payload implicit match after it. This gets rid of the manual proto-ctx update from meta_iiftype_gen_dependency() that we don't need since stmt_evaluate() already handles this for us. Moreover, skip error reporting once we verify that the protocol conflict has been resolved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: wrap protocol context debunk into functionPablo Neira Ayuso2016-01-311-6/+19
| | | | | | | | ether type vlan sets the network layer protocol context to vlan. This function debunks the existing link layer protocol context by setting it to vlan. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: assert on invalid base in resolve_protocol_conflict()Pablo Neira Ayuso2016-01-311-11/+11
| | | | | | | We already have similar code in the tree, we shouldn't see bases over transport yet. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: only try to replace dummy protocol from link-layer contextPablo Neira Ayuso2016-01-311-11/+14
| | | | | | | | | | | | | Add proto_is_dummy() that returns true for netdev and inet family, the only two using a dummy link-layer protocol base definition. Rename supersede_dep() to meta_iiftype_gen_dependency() since this is generating the implicit meta iiftype check for netdev and inet. This patch also gets rid of the have->length check. The tests pass fine without this so I suspect this is superfluos. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't adjust offset from resolve_protocol_conflict()Pablo Neira Ayuso2016-01-311-5/+8
| | | | | | This is not itself a conflict, move this check out of this function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if we have to resolve a conflict in first placePablo Neira Ayuso2016-01-311-11/+14
| | | | | | | So we enter resolve_protocol_conflict() only when we really have a conflict that we want to try to resolve. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: move inet/netdev protocol context supersede logic to supersede_dep()Pablo Neira Ayuso2016-01-311-23/+25
| | | | | | This is a cleanup to untangle this logic a bit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: resolve_protocol_conflict() should return intPablo Neira Ayuso2016-01-311-12/+14
| | | | | | | Instead of bool, expr_error() returns -1 if we fail to create dependencies. We need to propagate this error value. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: test port ranges and maps for redirectPablo Neira Ayuso2016-01-314-0/+47
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink_linearize: Fix bug for redirect targetShivani Bhardwaj2016-01-311-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | Before this patch, $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 ip nat post [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ immediate reg 1 0x00006400 ] [ immediate reg 2 0x0000c800 ] [ redir proto_min reg 1 proto_max reg 5 ] <cmdline>:1:1-56: Error: Could not process rule: Invalid argument add rule ip nat post ip protocol tcp redirect to 100-200 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After this patch, $ sudo nft --debug=netlink add rule ip nat post ip protocol tcp redirect to 100-200 ip nat post [ payload load 1b @ network header + 9 => reg 1 ] [ cmp eq reg 1 0x00000006 ] [ immediate reg 1 0x00006400 ] [ immediate reg 2 0x0000c800 ] [ redir proto_min reg 1 proto_max reg 2 ] Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fwd statement for netdevPablo Neira Ayuso2016-01-319-1/+137
| | | | | | | | | | | This patch add support for the forward statement, only available at the netdev family. # nft add table netdev filter # nft add chain netdev filter ingress { type filter hook ingress device eth0 priority 0\; } # nft add rule netdev filter ingress fwd to dummy0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dup statement for netdevPablo Neira Ayuso2016-01-313-0/+36
| | | | | | | | | | | | This patch contains the missing chunk to add support for the netdev family. Part of the support slipped through in the original patch to add the dup statement for IPv4 and IPv6. # nft add table netdev filter # nft add chain netdev filter ingress { type filter hook ingress device eth0 priority 0\; } # nft add rule netdev filter ingress dup to dummy0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip6: Add tests for icmpv6 packet typesShivani Bhardwaj2016-01-312-0/+10
| | | | | | | | Add tests for the icmpv6 packet types policy-fail and reject-route to be used with REJECT target. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: datatype: Modify symbol table for icmpv6 packet typesShivani Bhardwaj2016-01-311-5/+7
| | | | | | | | Add the missing symbols and correct the macros corresponding to the existing symbols. Signed-off-by: Shivani Bhardwaj <shivanib134@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: only remove protocol if equal cmp is usedFlorian Westphal2016-01-273-0/+25
| | | | | | | | | | | | | | | | | | Check for OP_EQ before removing a dependency, else we may zap wrong one, changing the meaning of the rule. Listing without patch: ip protocol udp udp dport ssh ip protocol udp udp dport ssh counter packets 1 bytes 308 ip protocol udp udp dport ssh With patch: ip protocol != tcp udp dport ssh ip protocol != udp udp dport ssh ip protocol != tcp counter packets 1 bytes 308 udp dport ssh Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: do binop postprocessing also for map lookupsFlorian Westphal2016-01-265-0/+55
| | | | | | | | | | old nft list: mark set unknown unknown & 0xfff [invalid type] map { 3 : 0x00000017, 1 : 0x0000002a} new: mark set vlan id map { 3 : 0x00000017, 1 : 0x0000002a} Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add two map test casesFlorian Westphal2016-01-266-0/+54
| | | | | | | | One normal map lookup, one with an explicit binop. The latter is supposed to also work with the followup patch applied. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: move binop postprocess to extra functionFlorian Westphal2016-01-261-28/+35
| | | | | | | | | Just move the payload trim part to a separate function. Next patch will add a second call site to deal with map ops that use a lookup based on a binop result. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update ct expressionFlorian Westphal2016-01-151-9/+36
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support limit rate over valuePablo Neira Ayuso2016-01-149-29/+135
| | | | | | | | | | | | | | | | | | So far it was only possible to match packet under a rate limit, this patch allows you to explicitly indicate if you want to match packets that goes over or until the rate limit, eg. ... limit rate over 3/second counter log prefix "OVERLIMIT: " drop ... limit rate over 3 mbytes/second counter log prefix "OVERLIMIT: " drop ... ct state invalid limit rate until 1/second counter log prefix "INVALID: " When listing rate limit until, this shows: ... ct state invalid limit rate 1/second counter log prefix "INVALID: " thus, the existing syntax is still valid (i.e. default to rate limit until). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: ct: remove BUG cases that work with current masterFlorian Westphal2016-01-071-33/+0
| | | | | | | | We have tests for these in ip/ct.t. (We cannot use ipv4 addresses e.g. in ipv6 family). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct regression tests for bytes, packetsFlorian Westphal2015-12-142-0/+27
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 15:00:21 +0000