summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* netlink_delinearize: cleanup hard to read codePatrick McHardy2015-01-111-60/+79
| | | | | | | | | | | The netlink parsing code is full of long function calls spawning multiple lines and in some cases parses netlink attributes multiple times. Use local variables for the registers and other data required to reconstruct the expressions and statements and reorder the code in some cases to move related processing next to each other. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: rename netlink_parse_*_sreg/dreg functionsPatrick McHardy2015-01-111-8/+8
| | | | | | These are really badly chosen names, use parse_expr and parse_stmt instead. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: readability fixesPatrick McHardy2015-01-111-56/+71
| | | | | | | | | Improve readability by using local variables for netlink attributes, ordering variables more logically, don't arbitrarily initialize some variables in the definition section and in the body and generally make similar functions look similar. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-24/+15
| | | | | | | | | Remove style discrepancies between different netlink I/O functions: - we don't use brackets for single line statements - most functions don't have a newline between error reporting and exit Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-12/+18
| | | | | | We include an empty line between variable definitions and code. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: remove unnecessary temporary variablePatrick McHardy2015-01-111-54/+18
| | | | | | | Waste less space and return the results of the batch/compat functions directly. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix memory leaksPatrick McHardy2015-01-112-1/+6
| | | | | | | Fix two memory leaks in netlink event monitor. Also fix a leak related to all sets, the ->init expression is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: fix error handling for invalid registersPatrick McHardy2015-01-101-1/+4
| | | | | | | | | | | netlink_delinearize is prepared to deal with malformed expressions from the kernel that it doesn't understand. However since expressions are now cloned unconditionally by netlink_get_register(), we crash before such errors can be detected for invalid inputs. Fix by only cloning non-NULL expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: add missing datatype compat checks for statement argumentsPatrick McHardy2015-01-101-23/+43
| | | | | | | | | | | | | | Add a helper function to evaluate expressions used as arguments for statements and report datatype mismatches. Fixes acceptance of mismatching expressions like: $ nft filter output meta mark set ip daddr <cmdline>:1:29-36: Error: datatype mismatch: expected packet mark. expression has type IPv4 address filter output meta mark set ip daddr ~~~~~~~~~~~~~~^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* eval: refactor NAT evaluation functionsPatrick McHardy2015-01-101-56/+54
| | | | | | | | | | The redir and masq evaluation functions include some useless context updates and checks. Refactor the NAT code to have a single instance of address and transport evaluation functions for simplicity and unified error reporting. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: modify pr_debug() to use printf and introduce to pr_gmp_debug()Pablo Neira Ayuso2015-01-082-13/+19
| | | | | | | | | | | | | Modify pr_debug() to use printf so we get debugging traces for proto-ctx when --with-mini-gmp is enabled. Add pr_gmp_debug(), this is disabled with --with-mini-gmp since it relies on the gmp_printf(), which is not available in the mini-gmp implementation. Suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wno-sign-compare to avoid compilation warning in mini-gmp.cPablo Neira Ayuso2015-01-081-0/+2
| | | | | | | | | | | | | | | | CC mini-gmp.o mini-gmp.c: In function ‘mpn_get_str_bits’: mini-gmp.c:1176:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_and’: mini-gmp.c:3650:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_ior’: mini-gmp.c:3723:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_xor’: mini-gmp.c:3792:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_set_str’: mini-gmp.c:4167:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add --with-mini-gmp switch to disable linking libgmpSteven Barth2015-01-089-9/+4770
| | | | | | | | | | This allows to disable linking the >400 KB big libgmp and replace it with the builtin mini-gmp which only increases size by ~30KB. Enabling this selectively decreases debugging verbosity (pr_debug). Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add a reference to the wiki page in the man pageArturo Borrero2015-01-071-0/+3
| | | | | | | | Let's add a pointer in the man page to the wiki page. Requested-by: Dan Jacobson <jidanni@jidanni.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: use stdio vasprintf instead of gmp_vasprintfSteven Barth2015-01-072-3/+11
| | | | | | | | | Use stdio's vasprintf instead of gmp_vasprintf which is not part of the mini-gmp function subset. Furthermore convert the only gmp-specific user and allow the compiler to verify format-strings. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: use mpz_set_str instead of gmp_sscanfSteven Barth2015-01-071-3/+1
| | | | | | | | This simplifies the integer parsing logic and restricts it to functions being part of the mini-gmp subset. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: rename VERSION token to HDRVERSIONSteven Barth2015-01-072-4/+4
| | | | | | | | | A token name of VERSION results in a macro being defined with the same name. This prevents inclusion of config.h in commonly used headers. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix dependency generation from nft -fPablo Neira Ayuso2015-01-062-1/+4
| | | | | | | | | | | | | | | When nft -f is used, ctx->cmd points to the table object, which contains the corresponding chain, set and rule lists. The reject statement evaluator relies on ctx->cmd->rule to add the payload dependencies, which is doesn't point to the rule in that case. This patch adds the rule context to the eval_ctx structure to update the rule list of statements when generating dependencies, as the reject statement needs. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=993 Reported-by: Ting-Wei Lan <lantw44@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: assert when accessing inner transport headerPablo Neira Ayuso2015-01-041-0/+1
| | | | | | | | | | Instead of segfaulting due to out of bound access access to protocol context array ctx->protocol[base].location from proto_ctx_update(). # nft add rule filter input ah nexthdr tcp nft: payload.c:88: payload_expr_pctx_update: Assertion `left->payload.base + 1 <= (__PROTO_BASE_MAX - 1)' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: revisit chain testsPablo Neira Ayuso2014-12-224-14/+8
| | | | | | | | Make sure support chain don't stop working. Remove some minor mistakes and out of scope tests from chain*.t Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: named sets workPablo Neira Ayuso2014-12-221-4/+3
| | | | | | Those tests work already, enable them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: alloc specifying concat types in set declarationsPatrick McHardy2014-12-162-22/+43
| | | | | | | | | | | | Support specification of concat types in set declarations: add set filter test { type ipv4_addr . inet_service } Netlink delinearization is changed to reconstruct the type from the id. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: change concat_type_alloc() to construct type from idPatrick McHardy2014-12-163-15/+19
| | | | | | | The kernel only stored the id so we need to be able to reconstruct the datatype from the id only. Signed-off-by: Patrick McHardy <kaber@trash.net>
* utils: add fls()Patrick McHardy2014-12-161-0/+37
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add define for maximum number of bits and mask of datatype idPatrick McHardy2014-12-163-2/+6
| | | | | | | | | | | | | | | | | The id of concat datatypes is composed of the ids of the individual datatypes. Add a define for the number of bits for each datatype id and a mask. The number of bits is chosen as 6, allowing for 63 datatypes, or twice as much as we currently have. This allows for concatenations of 5 types using 32 bits. The value is statically chosen instead of basing it on the current numbers of datatypes since we don't want the maximum concatenation size to vary between versions, also new versions are supposed to be able to propery parse a ruleset generated by an older version. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add new subtypes field to account number of concat data typesPatrick McHardy2014-12-163-5/+11
| | | | | | | | Using the size is confusing since it usually holds the size of the data. Add a new "subtypes" member, which holds the number of datatypes the concat type is made of. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: generate name for concat typesPatrick McHardy2014-12-161-1/+7
| | | | | | | The name of a concat type is the names of the individual types concatenated using a '.'. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Bump version to v0.4v0.4Pablo Neira Ayuso2014-12-151-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: missing byteorder in string_typePablo Neira Ayuso2014-12-151-0/+1
| | | | | | | | | | | | | | nft add rule filter input iifname { "lo", "eth0" } counter Now the listing shows: iifname { "lo", "eth0"} instead of: iifname { "", ""} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: restore --disable-debugPablo Neira Ayuso2014-12-152-5/+10
| | | | | | | | Fix fallout from the automake conversion. Display after configuration if it is enabled or not. Reported-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: log.t: this works for bridge and arp since 3.17Pablo Neira Ayuso2014-12-141-5/+4
| | | | | | | So tests log statement for those two families too and remove the tests/selectors that are ip and ip6 specific, they don't belong here. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: simplify run_test_file() in case `-e' is usedPablo Neira Ayuso2014-12-141-15/+1
| | | | | | | Avoid copy&paste coding style pattern by simplifying the code that handles the `-e' option that allows us to run known broken tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix wrong number of test filesPablo Neira Ayuso2014-12-141-1/+2
| | | | | | Always increment the test file counter for each test file in the list. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: use 'redirect to PORT' instead of 'redirect :PORT'Pablo Neira Ayuso2014-12-125-24/+26
| | | | | | Small syntax update suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: redirect.t: fix bogus errorsPablo Neira Ayuso2014-12-122-2/+2
| | | | | | | Separate values in set, otherwise bash interprets the brackets and the test reports an error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: adapt nat tests to use random-fullyPablo Neira Ayuso2014-12-124-27/+27
| | | | | | | This adapts test to the change that happened in d9a9a79 ('stmt: rename nat "random-fully" option to "fully-random"'). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: print datatype name in datatype_print() BUG messagePatrick McHardy2014-12-111-1/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* dtype: fix memory leak in concat_type_destroy()Patrick McHardy2014-12-111-1/+3
| | | | | | Free allocated memory for ->desc. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: properly align types in meta_template tablePatrick McHardy2014-12-111-5/+5
| | | | | | | Don't use arbitrary amounts of spaces. The remaining table is properly aligned, fix the new types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* stmt: rename nat "random-fully" option to "fully-random"Patrick McHardy2014-12-113-4/+4
| | | | | | Use proper english for full randomization option. Signed-off-by: Patrick McHardy
* dtype: remove unnecessary icmp* parse/print functionsPatrick McHardy2014-12-101-39/+3
| | | | | | Just setting the .sym_tbl correctly is all we need. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix segmentation faults on kernels without nftables supportPablo Neira Ayuso2014-12-091-3/+4
| | | | | | | | | | | | | | | | # nft list sets Segmentation fault # nft list sets <cmdline>:1:1-9: Error: Could not receive sets from kernel: Protocol error list sets ^^^^^^^^^ Fix same bug in `nft list tables'. Don't cleanup the table object for these commands since it is NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix listing of range set elements in host byteorderPablo Neira Ayuso2014-12-091-1/+3
| | | | | | | | | | | We have to switch the byteorder of the element in netlink_delinearize_setelem() for non-range values only. This fixes the listing of: nft add rule filter input ct mark { 0x10-0x20 } counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix listing of set members in host byteorder using ↵Pablo Neira Ayuso2014-12-091-0/+29
| | | | | | | | | | integer_type nft list table filter ... cpu { 50331648, 33554432, 0, 16777216} counter packets 8 bytes 344 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: generate set members using integer_type in the appropriate byteorderPablo Neira Ayuso2014-12-092-3/+17
| | | | | | | | | | | | | | | | Rules with header fields that rely on the generic integer datatype from sets are not matching, eg. nft add rule filter input udp length { 9 } counter This set member is an integer represented in host byte order, which obviously doesn't match the header field (in network byte order). Since the integer datatype has no specific byteorder, we have to rely on the expression byteorder instead when configuring the context, before we evaluate the list of set members. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix endianess issue in payload_expr_pctx_update()Pablo Neira Ayuso2014-12-052-4/+4
| | | | | | | | Use constant_data_ptr() to point to the right memory position on big endian when exporting data that is stored in a larger variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Christophe Leroy <christophe.leroy@c-s.fr>
* datatype: fix name of icmp* codeEric Leblond2014-12-031-3/+3
| | | | | | | | | | | | The name of datatypes can be used in set definition so they should follow the same logic (and maybe not contain space to avoid problem with parsing). This patch adds an underscore to the name of the icmp* code datatype. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: don't bug on too large valuesPablo Neira Ayuso2014-12-012-5/+22
| | | | | | | | | | | | | Add a new ERROR symbol to handle scanning of too large values. <cmdline>:1:36-99: Error: bad value '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' add rule ip test-ip4 input ct mark 0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ instead of: BUG: nft: scanner.l:470: nft_lex: Assertion `0' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: any/ct: remove wrong outputPablo Neira Ayuso2014-12-011-2/+2
| | | | | | | | | | | | | | | | | ct mark 0x32-0x45 displays: ct mark >= 0x00000032 ct mark <= 0x00000045 ^^^^^^^^^^ instead of ct mark <= 0x45000000 ^^^^^^^^^^ Remove the custom output so this displays a warning. nft should (at some point) merge the two statements into one single to express the range from the netlink_delinearize step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix "Listing is broken" instead of output mismatchPablo Neira Ayuso2014-12-011-9/+6
| | | | | | | If the output string doesn't match the input, indicate that the output mismatches instead of the misleading "Listing is broken". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>