summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* evaluate: reject: enhance the error support throwing message with more detailsAlvaro Neira2014-10-241-17/+26
| | | | | | | | | | | | | | | | | | | | If we add a rule like: nft add rule bridge filter input ether type ip reject with icmpv6 type no-route We throw an error like: <cmdline>:1:44-49: Error: conflicting protocols specified: ip vs ip6 add rule bridge filter input ether type ip reject with icmpv6 type no-route Now, we are going to show in which part of the rule, we have the conflict: <cmdline>:1:51-75: Error: conflicting protocols specified: ip vs ip6 add rule bridge filter input ether type ip reject with icmpv6 type no-route ~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: check the context in reject without reason for bridge and ↵Alvaro Neira2014-10-243-2/+48
| | | | | | | | | | | | | | | | | | | | | | | | inet tables In rules like: nft add rule inet filter input reject or nft add rule bridge filter input reject we use icmpx to reject it. But if we have network context, we also use type of reject. With this patch, we check the network context. If we don't have context, we still use icmpx. However, if we have rules with network context like: nft add rule inet meta nfproto ipv4 reject or nft add rule bridge ether type ipv6 reject We are going to use icmp or icmpv6 to reject it taking into account the network context. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: check in bridge and inet the network context in rejectAlvaro Neira2014-10-241-51/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | In Inet tables, we have to check the network context in rules that we use icmp or icmpv6 reason in reject. To be sure that the context is the correct. However, for icmpx and tcp reject, we don't need to check it. In Bridge tables, ee have vlan and arp traffic and they are not supported. For this things, we have to check the network context. For example: nft add rule bridge test-bridge input \ ether type arp reject with icmp type host-unreachable or nft add rule bridge test-bridge input \ ether type vlan reject with tcp reset In that cases, we have to throw an error. Moreover, we have to accept rules that the network context is Ipv4 and Ipv6. For example: nft add rule -nnn bridge test-bridge input \ ip protocol tcp reject with tcp reset Moreover, this patch refactor the code for check the family for bridge and inet tables. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: accept a reject reason with incorrect network contextAlvaro Neira2014-10-241-0/+2
| | | | | | | | | | | | nft add rule bridge test-bridge input ether type ip \ reject with icmpv6 type no-route This rule pass the evaluation step but the network context is incompatible with the reject reason. In that cases, we have to throw an error like "conflicting protocols specified: ip vs ip6" Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: delete useless parameter nf_sock in batch functionsArturo Borrero2014-10-243-34/+34
| | | | | | | The 'struct mnl_socket *nf_sock' parameter is useless and perturbing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: update and add the reject tests for ip, ip6, bridge and inet.Alvaro Neira2014-10-224-2/+85
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix crash if we have transport protocol conflict from inetAlvaro Neira2014-10-211-1/+6
| | | | | | | | | | | | Example: nft add rule inet filter input meta l4proto udp reject with tcp reset If we try to check if the transport protocol is tcp, we use the network context. If we don't have this network context, we have a crash. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix crash if we specify ether type or meta nfprotoAlvaro Neira2014-10-211-7/+7
| | | | | | | | | | | | | | | | | | If we use this rule: nft add rule bridge filter input \ ether type ip reject with icmp type host-unreachable or that: nft add rule inet filter input \ meta nfproto ipv4 reject with icmp type host-unreachable we have a segfault because we add a network dependency when we already have network context. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add tests for masqueradeArturo Borrero2014-10-172-0/+50
| | | | | | | Let's test the new masquerade option in nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* delinearize: list the icmpx reason with the string associatedAlvaro Neira2014-10-171-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | If you add the rule: nft add rule inet filter input reject with icmpx type host-unreachable nft list table inet filter shows: table inet filter { chain input { reject with icmpx type 2 } } We have to attach the icmpx datatype when we list the rules that use it. With this patch if we list the ruleset, the output is: table inet filter { chain input { reject with icmpx type host-unreachable } } Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix a crash if we specify ether type or meta nfproto in rejectAlvaro Neira2014-10-111-1/+50
| | | | | | | | | | | | | | | | | If we use a rule: nft add rule bridge filter input \ ether type ip reject with icmp type host-unreachable or this: nft add rule inet filter input \ meta nfproto ipv4 reject with icmp type host-unreachable we have a segfault because we add a network dependency when we already have network context. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove unnecessary libintl.h checkSteven Barth2014-10-101-1/+1
| | | | | | | | | | | | configure.ac checks for libintl.h which is not used and may cause unnecessary trouble with e.g. embedded toolchains. The only reference to libintl.h can be found in parser.c as generated by bison however an include does not happen as parser.h defines YYENABLE_NLS to be 0. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: allow disabling libreadline-supportSteven Barth2014-10-104-1/+20
| | | | | | | This makes nftables a bit more embedded-friendly. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: Delete an unnecessary whitespace in an output messagesAna Rey2014-10-091-1/+1
| | | | | | | | | | | | If the script is run with the -e option, the output messages show an unnecessary white-space. This path fixes this mistake. sudo ./nft-test.py -e [...] "line 34: nft add rule -nnn arp test-arp input arp plen != {33-55} " [...] ^^^^ Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: Delete all reference to wlan0 in test filesAna Rey2014-10-091-8/+8
| | | | | | | | | | | There are false errors if you run the automated regression testing without a wlan0 device in the system. Delete references to 'wlan0' in test files or replaces 'wlan0' by 'lo' or 'eth0' in the test files if it is possible. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add masquerade supportArturo Borrero2014-10-097-2/+101
| | | | | | | | | | | | | | | | | This patch adds masquerade support for nft. The syntax is: % nft add rule nat postrouting masquerade [flags] Currently, flags are: random, random-fully, persistent Example: % nft add rule nat postrouting masquerade random,persistent Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use switch whenever possible in the monitor codePablo Neira Ayuso2014-10-091-29/+58
| | | | | | | | This is more robust than the current 'else' fallback. If we run a newer kernel with old nft binaries, unknown messages will be misinterpreted as deletions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: interpret the event type from the evaluation stepPablo Neira Ayuso2014-10-095-88/+165
| | | | | | | | | | | Postpone the event type interpretation to the evaluation step. This patch also fixes the combination of event and object types, which was broken. The export code needed to be adjusted too. The new and destroy are not tokens that can be recognized by the scanner anymore, so this also implicitly restores 'ct state'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nat persistent and random optionsArturo Borrero2014-10-098-2/+130
| | | | | | | | | | | | | | | | | This patch adds more configuration options to the nat expression. The syntax is as follow: % nft add rule nat postrouting <snat|dnat> <nat_arguments> [flags] Flags are: random, persistent, random-fully. Example: % nft add rule nat postrouting dnat 1.1.1.1 random,persistent A requirement is to cache some [recent] copies of kernel headers. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: complete reject supportAlvaro Neira2014-10-0912-10/+504
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use the reject action in rules. For example: nft add rule filter input udp dport 22 reject In this rule, we assume that the reason is network unreachable. Also we can specify the reason with the option "with" and the reason. For example: nft add rule filter input tcp dport 22 reject with icmp type host-unreachable In the bridge tables and inet tables, we can use this action too. For example: nft add rule inet filter input reject with icmp type host-unreachable In this rule above, this generates a meta nfproto dependency to match ipv4 traffic because we use a icmpv4 reason to reject. If the reason is not specified, we infer it from the context. Moreover, we have the new icmpx datatype. You can use this datatype for the bridge and the inet tables to simplify your ruleset. For example: nft add rule inet filter input reject with icmpx type host-unreachable We have four icmpx reason and the mapping is: ICMPX reason | ICMPv6 | ICMPv4 | | admin-prohibited | admin-prohibited | admin-prohibited port-unreachable | port-unreachable | port-unreachable no-route | no-route | net-unreachable host-unreachable | addr-unreachable | host-unreachable Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Enhance symbolic_constant_parse()Alvaro Neira2014-10-091-20/+10
| | | | | | | | | | | With this patch, this function finds the symbol inside the table. If the symbol doesn't exist we use the basetype to parse it and create the constant expression. Otherwise, return an error message. This a refactorization to reuse this code in a follow up patch. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Enhance payload_gen_dependency()Alvaro Neira2014-10-094-11/+20
| | | | | | | | | | With this patch, this function returns a statement with the new dependency that we want to add, instead of an expression. This change is needed in a follow up patch. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: generate dependency in the appropriate byteorderAlvaro Neira2014-10-091-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we add a dependency, the constant expression on the right hand side must be represented in the appropriate order. Example without this patch: nft add rule bridge filter input reject with icmp-host-unreach --debug netlink [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000800 ] [ reject type 0 code 1 ] When we create the payload expression we have the right value in host endian but this has to be in big endian. With this patch, if we add the same rule: nft add rule bridge filter input reject with icmp-host-unreach --debug netlink [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 1 ] The new dependency is converted to big endian. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: use nft_batch_begin and nft_batch_end from libnftnlPablo Neira Ayuso2014-09-301-19/+6
| | | | | | Use the existing functions in libnftnl to begin and end a batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add list ruleset commandArturo Borrero2014-09-292-0/+32
| | | | | | | | | | | | | | | | | This patch adds a new command to nft: % nft list ruleset [family] Which list the entire ruleset. If no family is specified, all tables of all families are listed. Users can now make several operations at ruleset level: % nft list ruleset > ruleset.nft % nft -f ruleset.nft % nft flush ruleset Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: factorize chain and table listing codeArturo Borrero2014-09-291-32/+35
| | | | | | | Let's factorize common code. This is also useful in follow-up patches. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: rename do_command_list_cleanup() to table_cleanup()Arturo Borrero2014-09-291-3/+3
| | | | | | | | Let's use a more generic name for this functions, since it has nothing to do with commands. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set optimization optionsArturo Borrero2014-09-295-0/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds options to choose set optimization mechanisms. Two new statements are added to the set syntax, and they can be mixed: nft add set filter set1 { type ipv4_addr ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; } nft add set filter set1 { type ipv4_addr ; policy memory ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy performance ; } Also valid for maps: nft add map filter map1 { type ipv4_addr : verdict ; policy performace ; } [...] This is the output format, which can be imported later with `nft -f': table filter { set set1 { type ipv4_addr policy memory size 1024 } } In this approach the parser accepts default options such as 'performance', given they are a valid configurations, but aren't sent to the kernel. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: rearrange monitor/export rulesPatrick McHardy2014-09-241-12/+11
| | | | | | | Move the output format rules next to the monitor and export command rules, format them similar to other simple value mappings and unify their naming. Signed-off-by: Patrick McHardy <kaber@trash.net>
* queue: clean up queue statementPatrick McHardy2014-09-247-72/+75
| | | | | | | | | | | | | | | | | | - Rename keyword tokens to their actual keyword - Change the grammar to follow the standard schema for statements and arguments - Use actual expression for the queue numbers to support using normal range expressions, symbolic expression and so on. - restore comma seperation of flag keywords The result is that its possible to use standard ranges, prefix expressions, symbolic expressions etc for the queue number. We get checks for overflow, negative ranges and so on automatically. The comma seperation of flags is more similar to what we have for other flag values. It is still possible to use spaces, however this could be removed since we never had a release supporting that. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: make range_low()/range_high() usable outside of segtreePatrick McHardy2014-09-243-40/+44
| | | | | | | Their functionality is also needed for set descriptions, move the functions to expressions.c and give them a more suitable name for global functions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* mnl: consistency checks across several netlink dumpsPablo Neira Ayuso2014-09-196-0/+75
| | | | | | | | | | | | Obtain the generation ID before dumping the object lists. Then, check for generation ID updates when dumping the several lists that this needs. In case of interference, nft has to remove the stale objects and retry from scratch. This is complementary to the NLM_F_DUMP_INTR flag which is local to one single netlink dump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add any folder with test files.Ana Rey2014-09-186-0/+383
| | | | | | | | | | "any" folder contains the test files that are executed in ipv4, ipv6, inet, arp, bridge family of tables. These test files are executed with nft-tests.py Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add bridge folder with test files.Ana Rey2014-09-181-0/+7
| | | | | | | | | "bridge" folder contains the test files that are executed in bridge tables. These test files are executed with nft-tests.py Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add arp folder with test files.Ana Rey2014-09-182-0/+58
| | | | | | | | | "arp" folder contains the test files that are executed in arp tables. These test files are executed with nft-tests.py Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add inet folder with test files.Ana Rey2014-09-188-0/+380
| | | | | | | | | | "inet" folder contains the test files that are executed in ipv4, ipv6 and inet family of tables. These test files are executed with nft-tests.py Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add ip6 folder with test files.Ana Rey2014-09-1811-0/+487
| | | | | | | | | | "ip6" folder contains the test files that are executed in ip6 and inet family of tables. These test files are executed with nft-tests.py Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add ip folder with test filesAna Rey2014-09-186-0/+276
| | | | | | | | | | "ip" folder contains the test files that are executed in ip and inet family of tables. These test files are executed with nft-tests.py Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add automated regression testingAna Rey2014-09-182-0/+1000
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Here, the automated regression testing for nftables and some test files. This script checks that the rule input and output of nft matches. More details here below. A) What is this testing? This script tests two different paths: * The rule input from the command-line. This checks the different steps from the command line to the kernel. This includes the parsing, evaluation and netlink generation steps. * The output listing that is obtained from the kernel. This checks the different steps from the kernel to the command line: The netlink message parsing, postprocess and textify steps to display the rule listing. As a final step, this script compares that the rule that is added can be listed by nft. B) What options are available? The script offers the following options: * Execute test files: ./nft-test.py # Run all test files ./nft-test.py path/file.t # Run this test file If there is a problem, it shows the differences between the rule that is added and the rule that is listed by nft. In case you hit an error, the script doesn't keep testing for more families. Unless you specify the --force-family option. * Execute broken tests: ./nft-test.sh -e This runs tests for rules that need a fix: This mode runs the lines that that start with a "-" symbol. * Debugging: ./nft-test.sh -d This shows all the commands that the script executes, so you can watch its internal behaviour. * Keep testing all families on error. ./nft-test.sh -f Don't stop testing for more families in case of error. C) What is the structure of the test file? A test file contains a set of rules that are added in the system. Here, an example of a test file: *ip;test-ipv4 # line 1 *ip6;test-ipv6 # line 2 *inet;test-inet # line 3 :input;type filter hook input priority 0 # line 4 ah hdrlength != 11-23;ok;ah hdrlength < 11 ah hdrlength > 23 # line 5 - tcp dport != {22-25} # line 6 !set1 ipv4_addr;ok # line 7 ?set1 192.168.3.8 192.168.3.9;ok # line 8 # This is a commented-line. # line 9 Line 1 defines a table. The name of the table is 'test-ip' and the family is ip. Lines 2 and 3 defines more tables for different families so the rules in this test file are also tested there. Line 4 defines the chain. The name of this chain is "input". The type is "filter", the hook is "input" and the priority is 0. Line 5 defines the rule, the ";" character is used as separator of several parts: * Part 1: "ah hdrlength != 11-23" is the rule to check. * Part 2: "ok" is the result expected with the execute of this rule. * Part 3: "ah hdrlength < 11 ah hdrlength > 23". This is the expected output. You can leave this empty if the output is the same as the input. Line 6 is a marked line. This means that this rule is tested if '-e' is passed as argument to nft-test.py. Line 7 adds a new set. The name of this set is "set1" and the type of this set is "ipv4_add". Line 8 adds two elements into the 'set1' set: "192.168.3.8" and "192.168.3.9". A whitespace separates the elements of the set. Line 9 uses the "#" symbol that means that this line is commented out. D) The test folders The test files are divided in several directories: ip, ip6, inet, arp, bridge and any. * "ip" folder contains the test files that are executed in ip and inet table. * "ip" folder contains the test files that are executed in ip6 and inet table. * "inet" folder contains the test files that are executed in the ip, ip6 and inet table. * "arp" folder contains the test files that are executed in the arp table. * "bridge" folder: Here are the test files are executed in bridge tables. * "any" folder: Here are the test files are executed in ip, ip6, inet, arp and bridge tables. E) Meaning of messages: * A warning message means the rule input and output of nft mismatches. * An error message means the nft-tool shows an error when we add it or the listing is broken after the rule is added. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: compact log level grammarPatrick McHardy2014-09-171-32/+8
| | | | | | Put rule and action on a single line as for other simple mappings. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: fix 'describe' command when passing wrong expressionsPablo Neira Ayuso2014-09-174-8/+27
| | | | | | | | | | | | | | | | | | Before this patch: # nft describe tcp foo value expression, datatype inet_proto (Internet protocol) (basetype integer), 8 bits Segmentation fault After this patch: # nft describe tcp foo <cmdline>:1:14-16: Error: syntax error, unexpected string, expecting end of file or newline or semicolon describe tcp foo ^^^ Reported-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: simplify monitor command parsingPatrick McHardy2014-09-172-145/+39
| | | | | | | Add tokens for "new" and "destroy". Split up the monitor flags into an event and an object to avoid lots of duplicated code. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add specific byteorder to the struct proto_hdr_templateAlvaro Neira Ayuso2014-09-174-6/+18
| | | | | | | | | | | | | | | | | | | | | If we try to add a rule like: nft add rule filter input udp length {55-9999} nftable shows: BUG: invalid byte order conversion 0 => 2 nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed. Some of the existing payload fields rely on BYTEORDER_INVALID. Therefore, if we try to convert it in evaluation step, we hit this bug. This patch allows to add a specific byteorder to the struct proto_hdr_template. If we create a expression with a invalid byteorder, we will use the byteorder added to the proto_hdr_template structure. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: include file and line in netlink ABI errorsArturo Borrero2014-09-162-3/+6
| | | | | | | Let's give some more information when netlink ABI errors happens. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: netlink_linearize: don't set level if user didn't specifyPablo Neira Ayuso2014-09-121-1/+4
| | | | | | | The kernel will default on LOG_WARNING, to mimic iptables behaviour. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh include/linux/nf_tables.h cached copyPablo Neira Ayuso2014-09-113-5/+60
| | | | | | | | | Keep in sync with nf_tables.h header file in net-next tree. Rename NFT_CT_LABEL to NFT_CT_LABELS, this probably slipped through when editing the header file by hand. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add `flush ruleset'Arturo Borrero2014-09-095-5/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix typo in chain hook parsingYanchuan Nian2014-09-091-1/+1
| | | | | | | Just a typo in chain hook parsing Signed-off-by: Yanchuan Nian <ycnian@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add devgroup support in meta expresionAna Rey2014-09-034-0/+16
| | | | | | | | | | | | | | | | | | | This adds device group support in meta expresion. The new attributes of meta are "iffgroup" and "oifgroup" - iffgroup: Match device group of incoming device. - oifgroup: Match device group of outcoming device. Example of use: nft add rule ip test input meta iifgroup 2 counter nft add rule ip test output meta oifgroup 2 counter The kernel and libnftnl support were added in these commits: netfilter: nf_tables: add devgroup support in meta expresion src: meta: Add devgroup support to meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: meta: Fix the size of cpu attributeAna Rey2014-09-031-1/+1
| | | | | | | Fix the size of cpu attribute in meta_template struct. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>