summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* parser: compact map RHS typeFlorian Westphal2021-03-061-29/+9
| | | | | | Similar to previous patch, we can avoid duplication. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: squash duplicated spec/specid rulesFlorian Westphal2021-03-061-44/+38
| | | | | | | No need to have duplicate CMD rules for spec and specid: add and use a common rule for those cases. Signed-off-by: Florian Westphal <fw@strlen.de>
* expression: memleak in verdict_expr_parse_udata()Pablo Neira Ayuso2021-03-051-1/+1
| | | | | | | Remove unnecessary verdict_expr_alloc() invocation. Fixes: 4ab1e5e60779 ("src: allow use of 'verdict' in typeof definitions") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: memleak list of chainPablo Neira Ayuso2021-03-051-13/+26
| | | | | | Release chain list from the error path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove nft_mnl_socket_reopen()Pablo Neira Ayuso2021-03-053-17/+19
| | | | | | | | | | | | | | nft_mnl_socket_reopen() was introduced to deal with the EINTR case. By reopening the netlink socket, pending netlink messages that are part of a stale netlink dump are implicitly drop. This patch replaces the nft_mnl_socket_reopen() strategy by pulling out all of the remaining netlink message to restart in a clean state. This is implicitly fixing up a bug in the table ownership support, which assumes that the netlink socket remains open until nft_ctx_free() is invoked. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: support for the table owner flagPablo Neira Ayuso2021-03-027-3/+196
| | | | | | | | | | | | | | | | | | | | | | | | Add new flag to allow userspace process to own tables: Tables that have an owner can only be updated/destroyed by the owner. The table is destroyed either if the owner process calls nft_ctx_free() or owner process is terminated (implicit table release). The ruleset listing includes the program name that owns the table: nft> list ruleset table ip x { # progname nft flags owner chain y { type filter hook input priority filter; policy accept; counter packets 1 bytes 309 } } Original code to pretty print the netlink portID to program name has been extracted from the conntrack userspace utility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: rework flags printingPablo Neira Ayuso2021-03-023-15/+26
| | | | | | | Simplify routine to print the table flags. Add table_flag_name() and use it from json too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: re-enable support for concatentation on map RHSFlorian Westphal2021-02-231-0/+9
| | | | | | | | | "typeof .... : ip saddr . tcp dport" is legal. This makes 'testcases/maps/nat_addr_port' pass again. Fixes: 4ab1e5e6077918 ("src: allow use of 'verdict' in typeof definitions") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: allow use of 'verdict' in typeof definitionsFlorian Westphal2021-02-224-3/+51
| | | | | | | | | | | | | | | 'verdict' cannot be used as part of a map typeof-based key definition, its a datatype and not an expression, e.g.: typeof iifname . ip protocol . th dport : verdic ... will fail. Make the parser convert a 'verdict' symbol to a verdict expression and allow to store its presence as part of the typeof key definition. Reported-by: Frank Myhr <fmyhr@fhmtech.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: nft: fix some typos and formatting issuesŠtěpán Němec2021-02-221-11/+11
| | | | | | | | Trying to escape asciidoc (9.1.0) * with \ preserves the backslash in the formatted man page. Bare * works as expected. Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: fix nft --help output fallout from 719e4427Štěpán Němec2021-02-221-3/+4
| | | | | | | | | Long options were missing the double dash. Fixes: 719e44277f8e ("main: use one data-structure to initialize getopt_long(3) arguments and help.") Cc: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: init parser state for every new buffer/fileEric Garver2021-02-191-0/+2
| | | | | | | | Otherwise invalid error states cause subsequent json parsing to fail when it should not. Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* monitor: Don't print newgen message with JSON outputPhil Sutter2021-02-171-0/+3
| | | | | | | | | Iff this should be printed, it must adhere to output format settings. In its current form it breaks JSON syntax, so skip it for non-default output formats. Fixes: cb7e02f44d6a6 ("src: enable json echo output when reading native syntax") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: set evaluation context for set elementsFlorian Westphal2021-02-161-2/+9
| | | | | | | | | | | | | This resolves same issue as previous patch when such expression is used as a set key: set z { typeof ct zone - elements = { 1, 512, 768, 1024, 1280, 1536 } + elements = { 1, 2, 3, 4, 5, 6 } } Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: pick data element byte order, not dtype oneFlorian Westphal2021-02-161-1/+1
| | | | | | | | | | | | | Some expressions have integer base type, not a specific one, e.g. 'ct zone'. In that case nft used the wrong byte order. Without this, nft adds elements = { "eth0" : 256, "eth1" : 512, "veth4" : 256 } instead of 1, 2, 3. This is not a 'display bug', the added elements have wrong byte order. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend dtype test case to cover expression with integer typeFlorian Westphal2021-02-162-2/+83
| | | | | | | | | ... nft doesn't handle this correctly at the moment: they are added as network byte order (invalid byte order). ct zone has integer_type, the byte order has to be taken from the expression. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: incorrect usage of stmt_binary_error() in rejectPablo Neira Ayuso2021-02-091-3/+2
| | | | | | | Don't pass ctx->pctx.protocol[PROTO_BASE_LL_HDR] to stmt_binary_error(), it's not useful for the error reporting as location is not available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: Sanitize erec location indescPhil Sutter2021-02-091-1/+2
| | | | | | | erec_print() unconditionally dereferences erec->locations->indesc, so make sure it is valid when either creating an erec or adding a location. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: extend 0025empty_dynset_0 to cover multi-statement supportPablo Neira Ayuso2021-02-092-0/+12
| | | | | | Add a test to cover multi-statement support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* trace: do not remove icmp type from packet dumpFlorian Westphal2021-02-081-1/+3
| | | | | | | | | | | | | | | | | As of 0.9.8 the icmp type is marked as a protocol field, so its elided in 'nft monitor trace' output: icmp code 0 icmp id 44380 .. Restore it. Unlike tcp, where 'tcp sport' et. al in the dump will make the 'ip protocol tcp' redundant this case isn't obvious in the icmp case: icmp type 8 code 0 id ... Reported-by: Martin Gignac <martin.gignac@gmail.com> Fixes: 98b871512c4677 ("src: add auto-dependencies for ipv4 icmp") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add negation match on singleton bitmask valuePablo Neira Ayuso2021-02-058-5/+36
| | | | | | | | | | | | | | | | | This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not crash if dynamic set has no statementsFlorian Westphal2021-02-051-4/+6
| | | | | | | | list_first_entry() returns garbage when the list is empty. There is no need to run the following loop if we have no statements, so just return 0. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add empty dynamic setFlorian Westphal2021-02-052-0/+28
| | | | | | nft crashes on restore. Signed-off-by: Florian Westphal <fw@strlen.de>
* testcases: move two dump files to correct locationFlorian Westphal2021-02-052-0/+0
| | | | | | | The test cases were moved but the dumps remained in the old location. Fixes: eb14363d44cea5 ("tests: shell: move chain priority and policy to chain folder") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Add a test sanitizer and fix its findingsPhil Sutter2021-02-0439-780/+160
| | | | | | | | | | | | | | | | This is just basic housekeeping: - Remove duplicate tests in any of the *.t files - Remove explicit output if equal to command itself in *.t files - Remove duplicate payload records in any of the *.t.payload* files - Remove stale payload records (for which no commands exist in the respective *.t file - Remove duplicate/stale entries in any of the *.t.json files In some cases, tests were added instead of removing a stale payload record if it fit nicely into the sequence of tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/py: Write dissenting payload into the right filePhil Sutter2021-02-041-1/+4
| | | | | | | | | | | | The testsuite supports diverging payloads depending on table family. This is necessary since for some families, dependency matches are created. If a payload mismatch happens, record it into a "got"-file which matches the family-specific payload file, not the common one. This eases use of diff-tools a lot as the extra other families' payloads confuse the tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Do not abbreviate reject statement objectPhil Sutter2021-02-035-120/+47
| | | | | | | | | No need to reduce output size, also this way output is more predictable. While being at it, drop some pointless chunks from tests/py/bridge/reject.t.json.output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* payload: check icmp dependency before removing previous icmp expressionFlorian Westphal2021-02-021-21/+42
| | | | | | | | | | | | | | | nft is too greedy when removing icmp dependencies. 'icmp code 1 type 2' did remove the type when printing. Be more careful and check that the icmp type dependency of the candidate expression (earlier icmp payload expression) has the same type dependency as the new expression. Reported-by: Eric Garver <eric@garver.life> Reported-by: Michael Biebl <biebl@debian.org> Tested-by: Eric Garver <eric@garver.life> Fixes: d0f3b9eaab8d77e ("payload: auto-remove simple icmp/icmpv6 dependency expressions") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add icmp/6 test where dependency should be left aloneFlorian Westphal2021-02-016-0/+73
| | | | | | These tests fail: nft should leave the type as-is. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: limit: Always include burst valuePhil Sutter2021-01-272-7/+282
| | | | | | The default burst value is non-zero, so JSON output should include it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* reject: Unify inet, netdev and bridge delinearizationPhil Sutter2021-01-276-216/+296
| | | | | | | | | | | | | | Postprocessing for inet family did not attempt to kill any existing payload dependency, although it is perfectly fine to do so. The mere culprit is to not abbreviate default code rejects as that would drop needed protocol info as a side-effect. Since postprocessing is then almost identical to that of bridge and netdev families, merge them. While being at it, extend tests/py/netdev/reject.t by a few more tests taken from inet/reject.t so this covers icmpx rejects as well. Cc: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* reject: Fix for missing dependencies in netdev familyPhil Sutter2021-01-275-22/+187
| | | | | | | | | | | | | | | Like with bridge family, rejecting with either icmp or icmpv6 must create a dependency match on meta protocol. Upon delinearization, treat netdev reject identical to bridge as well so no family info is lost. This makes reject statement in netdev family fully symmetric so fix the tests in tests/py/netdev/reject.t, adjust the related payload dumps and add JSON equivalents which were missing altogether. Fixes: 0c42a1f2a0cc5 ("evaluate: add netdev support for reject default") Fixes: a51a0bec1f698 ("tests: py: add netdev folder and reject.t icmp cases") Cc: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: use correct $nft value in EXIT trapŠtěpán Němec2021-01-271-1/+1
| | | | | | | | | | With double quotes, $nft was being expanded to the default value even in presence of the -H option. Signed-off-by: Štěpán Němec <snemec@redhat.com> Helped-by: Tomáš Doležal <todoleza@redhat.com> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: evaluate: reset context maxlen value before prio evaluationFlorian Westphal2021-01-263-2/+26
| | | | | | | | | | unshare -n tests/shell/run-tests.sh tests/shell/testcases/nft-f/0024priority_0 W: [FAILED] tests/shell/testcases/nft-f/0024priority_0: got 1 /dev/stdin:8:47-49: Error: Value 100 exceeds valid range 0-15 type filter hook postrouting priority 100 Reported-by: Andreas Schultz <andreas.schultz@travelping.com Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: remove tcp dependency for tcp option matchingFlorian Westphal2021-01-262-63/+1
| | | | | | Kernel won't search for tcp options in non-tcp packets. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: ct: add missing test inputFlorian Westphal2021-01-261-0/+79
| | | | | | | ERROR: did not find JSON equivalent for rule 'meta mark set ct original ip saddr . meta mark map { 1.1.1.1 . 0x00000014 : 0x0000001e }' ERROR: did not find JSON equivalent for rule 'ct original ip saddr . meta mark { 1.1.1.1 . 0x00000014 }' Signed-off-by: Florian Westphal <fw@strlen.de>
* json: icmp: move expected parts to json.outputFlorian Westphal2021-01-262-109/+98
| | | | | | | | | | | | Phil Sutter says: In general, *.t.json files should contain JSON equivalents for rules as they are *input* into nft. So we want them to be as close to the introductory standard syntax comment as possible. Undo earlier change and place the expected dependency added by nft internals to json.output rather than icmp.t.json. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: disallow ct original {s,d}ddr from concatenationsPablo Neira Ayuso2021-01-253-0/+40
| | | | | | | | | | | | | | | | Extend 8b043938e77b ("evaluate: disallow ct original {s,d}ddr from maps") to cover concatenations too. Error: specify either ip or ip6 for address matching add rule x y meta mark set ct original saddr . meta mark map { 1.1.1.1 . 20 : 30 } ^^^^^^^^^^^^^^^^^ The old syntax for ct original saddr without either ip or ip6 results in unknown key size, which breaks the listing. The old syntax is only allowed in simple rules for backward compatibility. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1489 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: icmp: refresh json outputFlorian Westphal2021-01-211-80/+568
| | | | | | | nft inserts dependencies for icmp header types, but I forgot to update the json test files to reflect this change. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: ct: add missing ruleFlorian Westphal2021-01-211-0/+30
| | | | | | ERROR: did not find JSON equivalent for rule 'meta mark set ct original ip daddr map { 1.1.1.1 : 0x00000011 }' Signed-off-by: Florian Westphal <fw@strlen.de>
* json: limit: set default burst to 5Florian Westphal2021-01-211-1/+1
| | | | | | | The tests fail because json printing omits a burst of 5 and the parser treats that as 'burst 0'. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix icmpv6.t test casesFlorian Westphal2021-01-212-16/+597
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* build: Bump version to v0.9.8v0.9.8Pablo Neira Ayuso2021-01-151-3/+3
| | | | | | | | | | | Update release name based on the Fearless Fosdick series: E.D.S. E.D.S. is the robotic "Electronic Detective Substitute" appearing in the "Hole Story". Bump dependencies on libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disallow ct original {s,d}ddr from mapsPablo Neira Ayuso2021-01-153-0/+18
| | | | | | | | | test.nft:6:55-71: Error: specify either ip or ip6 for address matching add rule ip mangle manout ct direction reply mark set ct original daddr map { $ext1_ip : 0x11, $ext2_ip : 0x12 } ^^^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1489 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: honor set element expirationPablo Neira Ayuso2021-01-061-20/+14
| | | | | | | | Extend c1f0476fd590 ("segtree: copy expr data to closing element") to use interval_expr_copy() from the linearization path. Reported-by: Mike Dillinger <miked@softtalker.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: resync nf_tables.h cache copyPablo Neira Ayuso2021-01-061-1/+25
| | | | | | Get this header in sync with nf-next as of 5.11-rc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: fix typo in cli definitionPablo Neira Ayuso2021-01-061-1/+1
| | | | | | | | 9420423900a2 ("cli: add libedit support") updated HAVE_LIBREADLINE to HAVE_READLINE by mistake. Fixes: 9420423900a2 ("cli: add libedit support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: use plain readline() interface with libeditPablo Neira Ayuso2021-01-061-4/+35
| | | | | | | | | | | | | | | | | | | | | | | | | Instead of the alternate interface [1]. I spent a bit of time debugging an issue with libedit support 9420423900a2 ("cli: add libedit support") that broke tests/shell. This is the reproducer: # nft -i << EOF list ruleset EOF which makes rl_callback_read_char() loop forever on read() as shown by strace. The rl_line_buffer variable does not accumulate the typed characters as it should when redirecting the standard input for some reason. Given our interactive interface is fairly simple at this stage, switch to use the readline() interface instead of rl_callback_read_char(). [1] https://docs.freebsd.org/info/readline/readline.info.Alternate_Interface.html Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: add libedit supportPablo Neira Ayuso2021-01-055-12/+39
| | | | | | | | Extend cli to support for libedit readline shim code: ./configure --with-cli=editline Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set on flags to request multi-statement supportPablo Neira Ayuso2021-01-043-0/+13
| | | | | | | Old kernel reject requests for element with multiple statements because userspace sets on the flags for multi-statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-14 21:49:49 +0000