summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: expr: add and use expr_name helperFlorian Westphal2019-02-089-23/+29
| | | | | | | | Currently callers use expr->ops->name, but follouwp patch will remove the ops pointer from struct expr. So add this helper and use it everywhere. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: exercise abort path with anonymous set that is bound to rulePablo Neira Ayuso2019-02-081-0/+14
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add cplusplus guards for externPablo Neira Ayuso2019-01-281-0/+8
| | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* meta: add iifkind and oifkind supportwenxu2019-01-283-1/+17
| | | | | | | | | | This can be used to match the kind type of iif or oif interface of the packet. Example: add rule inet raw prerouting meta iifkind "vrf" accept Signed-off-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix up expected payloads after expr merge changeFlorian Westphal2019-01-258-20/+38
| | | | | | | | nft currently doesn't do payload merging anymore in some cases, so fix up the expected output. Fixes: ce2651222911 ("payload: refine payload expr merging") Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix non-working exampleFlorian Westphal2019-01-251-1/+1
| | | | | | | nft doesn't have the context to translate "dns" or "http" as being service names here. Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: name is ignored when deleting a tableFlorian Westphal2019-01-182-4/+35
| | | | | | | | | | | | | nlt is reallocated, leaking first allocation and also removing the table name/handle that was set on nlt object. Add a test case for this as well, the batch is supposed to fail when trying to delete a non-existant table, rather than wiping all tables in the same address family. Fixes: 12c362e2214a0 ("mnl: remove alloc_nftnl_table()") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: refine payload expr mergingFlorian Westphal2019-01-112-2/+28
| | | | | | | | | | | | | | | | | | | nf_tables can handle payload exprs for sizes <= sizeof(u32) via a direct operation from the eval loop, rather than a a call to the payload expression. Two loads for four byte quantities are thus faster than a single load for an 8 byte load. ip saddr 1.2.3.4 ip daddr 2.3.4.5 is faster with this applied, even though it involves two payload and two two compare expressions, just because all can be handled from the main loop without any calls to expression ops. Keep merging for linklayer and when at least one of the expressions already exceeded the 4 byte "limit" anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix netdev family device name parsingFlorian Westphal2019-01-093-7/+7
| | | | | | | | Should use accept/use quotes, else you can't use this with a device name that is shared with a key word, e.g. 'device vm'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add igmp supportPablo Neira Ayuso2019-01-0910-5/+517
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: remove RETURNCODE_SEPARATORFlorian Westphal2019-01-043-10/+4
| | | | | | | | | | | | test files are located via find + a pattern search that looks for _[0-9]. Previous change makes all test scripts return 0 when the test case is supposed to pass, so the foo_$retval name is no longer needed. Update script to look for all executeables in the 'testcases' directory. This makes it necessary to make two dump-files non-executeable. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix up redefine test caseFlorian Westphal2019-01-041-6/+6
| | | | | | | | The '$' has to be escaped, else it gets replaced with an empty value by the shell. As 'set -e' is used, that caused the first nft command to fail. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: change all test scripts to return 0Florian Westphal2019-01-0447-87/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The shell-based tests currently encode a return value in the file name, i.e. foo_1 expects that the script should return '1' for the test case to pass. This is very error prone, and one test case is even broken (i.e., it returns 1, but because of a different, earlier error). do_something || exit 1 or 'set -e' are both pretty common patterns, in both cases tests should fail. In those test-cases that deliberately test for an error, nft something_should_fail || exit 0 nft something_should_fail && exit 1 or a similar constructs should be used. This initial commit modififies all '_1' scripts to return 0 on success, usually via 'nft wrong || exit 0'. All tests pass, except the one broken test case that hasn't worked before either, but where 'set -e' use made it pass (the failing command is supposed to work, and the command that is supposed to fail is never run). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for leaking of stateful object refcountFlorian Westphal2019-01-041-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | Taehee Yoo fixed a bug in error path handling for object refcounts. Quoting patch description: | $nft add table ip filter | $nft add counter ip filter c1 | $nft add map ip filter m1 { type ipv4_addr : counter \;} | $nft add element ip filter m1 { 1 : c1 } | $nft add element ip filter m1 { 1 : c1 } | $nft delete element ip filter m1 { 1 } | $nft delete counter ip filter c1 |Result: | Error: Could not process rule: Device or resource busy | delete counter ip filter c1 | |At the second 'nft add element ip filter m1 { 1 : c1 }', the reference |count of the 'c1' is increased then it tries to insert into the 'm1'. but |the 'm1' already has same element so it returns -EEXIST. |But it doesn't decrease the reference count of the 'c1' in the error path. |Due to a leak of the reference count of the 'c1', the 'c1' can't be |removed by 'nft delete counter ip filter c1'. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix object listing when no table is givenFlorian Westphal2019-01-022-5/+15
| | | | | | | 'nft list quotas' would not print anything at all anymore. Fixes: 88456a7ef01172 ("rule: list only the table containing object") Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: fix build with --with-xtablesFlorian Westphal2018-12-291-3/+4
| | | | | | | | | | | | The previous change is bonkers, it fixes build when libxtables isn't even installed, but broke build when --with-xtables is provided to configure. Reason is that the include guard comes too early, so xtables.h is never included, causing build to fail because no libxtables function prototypes and definitions are available. Fixes: 9e84f3f083bb ("xt: fix build when libxtables is not installed") Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: refer to meta protocol in icmp and icmpv6Pablo Neira Ayuso2018-12-291-2/+2
| | | | | | Instead of meta nftproto, which is a typo. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove deprecated code for export/import commandsPablo Neira Ayuso2018-12-277-125/+4
| | | | | | | | | | | | | | | | | | Update parser to display this error message: # nft export json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export json ^^^^^^^^^^^^ Just like: # nft export vm json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export vm json ^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Reject 'export vm json' commandPhil Sutter2018-12-213-11/+14
| | | | | | | | | | | | | | | | | | Since libnftnl recently dropped JSON output support, this form of JSON export is not available anymore. Point at 'nft -j list ruleset' command for a replacement in error message. Since 'export' command is not useable anymore, remove it from documentation. Instead point out that 'list ruleset' command serves well for dumping and later restoring. To not cause pointless inconvenience for users wishing to store their ruleset in JSON format, make JSON parser fallback to CMD_ADD if no recognized command property was found. This allows to feed the output of 'nft -j list ruleset' into 'nft -f' without any modification. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: fix build when libxtables is not installedFlorian Westphal2018-12-041-0/+5
| | | | | | | | | | | | If libxtables is not even installed, build fails due to to missing include file. ifdef LIBXTABLES guard fixes the first error, but results in two followup failures: 1. missing IFNAMSIZ definition 2. dereference of unknown struct. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: bail out on incorrect burst unitPablo Neira Ayuso2018-12-032-6/+11
| | | | | | | | | | | | Burst can be either bytes or packets, depending on the rate limit unit. # nft add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets Error: syntax error, unexpected packets, expecting string or bytes add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets ^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1306 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: document ct countPablo Neira Ayuso2018-12-011-0/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect identifierPablo Neira Ayuso2018-12-013-2/+30
| | | | | | | | | | | | | | | | | # cat test.nft define test = "1.2.3.4" table ip x { chain y { ip saddr $text } } # nft -f test.nft test.nft:5:13-16: Error: unknown identifier 'text'; did you mean identifier ‘test’? ip saddr $text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect objectPablo Neira Ayuso2018-12-013-3/+47
| | | | | | | | | | # nft add counter x test # nft list counter x test Error: No such file or directory; did you mean obj ‘test’ in table ip ‘x’? list counter x text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* misspell: add distance threshold for suggestionsPablo Neira Ayuso2018-11-301-3/+18
| | | | | | Restrict suggestions to threshold, like gcc does. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: provide suggestion for misspelled object namePablo Neira Ayuso2018-11-304-3/+127
| | | | | | | | | | | | Use this from the lookup path, to check for misspellings: # nft add table filter # nft add chain filtre test Error: No such file or directory; did you mean table ‘filter’ in family ip? add chain filtre test ^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: remove type checks in min() and max()Pablo Neira Ayuso2018-11-301-11/+5
| | | | | | So we can pass functions as parameters, needed by follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix return codesArturo Borrero Gonzalez2018-11-283-3/+3
| | | | | | | Try to return != 0 if a testsuite fails. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for rule replacement expression deactivationFlorian Westphal2018-11-281-0/+12
| | | | | | | | | | | | When a rule is replaced, all of the expressions that are in use need to be deactivated. Kernel missed to do this on replace. In this example, this would result in a leak of the chain use counter ("jump" expression deactivation is not called). This then either resulted in a BUG or WARN, depending on kernel version. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: introduce simple hints on incorrect setPablo Neira Ayuso2018-11-193-27/+62
| | | | | | | | | # nft rule x y ip saddr @y Error: No such file or directory; did you mean set ‘y’ in table inet ‘x’? rule x y ip saddr @y ^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect chainPablo Neira Ayuso2018-11-193-9/+43
| | | | | | | | | # nft list chain x y Error: No such file or directory; did you mean chain ‘y’ in table inet ‘x’? list chain x y ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect tablePablo Neira Ayuso2018-11-193-57/+62
| | | | | | | | | | | This patch adds simple infrastructure to provide a hints to user on references to incorrect table. While at it, remove "Could not process rule:" which I think it is implicit in the error. # nft rule x y ip saddr @y Error: No such file or directory; did you mean table ‘x’ in family inet? Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: grammar fixesJan Engelhardt2018-11-135-96/+97
| | | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Spelling and grammar fixesVille Skyttä2018-11-136-9/+9
| | | | | Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: always build with a minimal support for xt match/target decodeFlorian Westphal2018-11-123-13/+24
| | | | | | | | | | When building without libxtables, nft would just silently omit any presence of nft_compat in the output. This adds ifdef-ry to at least print name of target/match involved when libxtables isn't available for decoding. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: pass octx to translate functionFlorian Westphal2018-11-123-6/+7
| | | | | | | We can't use it when no translation is available as libxtables will use plain printf(), but when translation is available we can. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft.8: Clarify 'index' option of add rule commandPhil Sutter2018-11-121-4/+2
| | | | | | | | | | | | | | | | Documentation for add rule command might trick readers into believing the optional 'index' argument does not need to be that of an existing rule. This false assumption is fueled by the fact that iptables allows to insert with last rule number + 1 to actually append to a chain. Change the relevant sentence to clarify that. While being at it, drop the deprecated 'position' option from documentation - since this will likely go away at some point, don't encourage users to use it although they should notice that they shoudn't. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* documentation: clarify iif vs. iifnameFlorian Westphal2018-11-051-1/+24
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: libnftables.adoc misc cleanupsDuncan Roe2018-11-051-12/+14
| | | | | | | | | | | | Ensure split-off fragments of long lines start with <TAB> if the original long line did. Split 1 remaining long line at sentence boundary. Fix spelling of "eg." to "e.g." Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Fix for make distcheckPhil Sutter2018-11-011-1/+1
| | | | | | | | | When building from a separate build directory, a2x did not find the source file nft.txt. Using '$<' instead fixes this. Fixes: 3bacae9e4a1e3 ("doc: Review man page building in Makefile.am") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: Adjust Nftables class to output flags changesPhil Sutter2018-10-312-96/+153
| | | | | | | | | | | | | Introduce setter/getter methods for each introduced output flag. Ignore NFT_CTX_OUTPUT_NUMERIC_ALL for now since it's main purpose is for internal use. Adjust the script in tests/py accordingly: Due to the good defaults, only numeric proto output has to be selected - this is not a must, but allows for the test cases to remain unchanged. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix json_events_cb() declaration when libjansson is not presentLaura Garcia Liebana2018-10-311-1/+2
| | | | | | | | | | | | | | | | | When nftables is configured without libjansson support, the following compilation error is shown: monitor.c: In function ‘netlink_echo_callback’: monitor.c:910:10: error: too many arguments to function ‘json_events_cb’ return json_events_cb(nlh, &echo_monh); ^~~~~~~~~~~~~~ This patch makes a declaration of the json_events_cb() function consistent. Fixes: bb32d8db9a12 ("JSON: Add support for echo option") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: remove unnecessary extra asterisk at the end of option linePablo Neira Ayuso2018-10-301-3/+3
| | | | | | For --guid, --numeric-protocol and --numeric-priority. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: always print range expression numericallyPablo Neira Ayuso2018-10-301-2/+4
| | | | | | | | | | Otherwise we end up displaying things that we cannot parse as input. Moreover, in a range, it's relevant to the user the values that are enclosed in the range, so let's print this numerically. Fixes: baa4e0e3fa5f ("src: add NFT_CTX_OUTPUT_NUMERIC_PROTO") Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -p to print layer 4 protocol numericallyPablo Neira Ayuso2018-10-302-2/+11
| | | | | | | | We keep printing layer 4 protocols as literals since we do not use /etc/protocols. Add -p option to print layer 4 protocols numerically. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of nft_ctx_output_{get,set}_numeric()Pablo Neira Ayuso2018-10-3012-82/+24
| | | | | | | | | | | | | | | | | | | | | | | This patch adds NFT_CTX_OUTPUT_NUMERIC_SYMBOL, which replaces the last client of the numeric level approach. This patch updates `-n' option semantics to display all output numerically. Note that monitor code was still using the -n option to skip printing the process name, this patch updates that path too to print it inconditionally to simplify things. Given the numeric levels have no more clients after this patch, remove that code. Update several tests/shell not to use -nn. This patch adds NFT_CTX_OUTPUT_NUMERIC_ALL which enables all flags to provide a fully numerical output. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -y to priority base chain nummericallyPablo Neira Ayuso2018-10-296-12/+33
| | | | | | | | By default base chains are printed using default hook priority definitions. Add -y option to print them as numbers. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add NFT_CTX_OUTPUT_NUMERIC_PROTOPablo Neira Ayuso2018-10-296-2/+13
| | | | | | | | | | | We keep printing layer 4 protocols as literals since we do not use /etc/protocols. This new flag allows us to print it as a number. libnftables internally uses this to print layer 4 protocol as numbers when part of a range. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: default to numeric UID and GID listingPablo Neira Ayuso2018-10-297-5/+27
| | | | | | | | | | | | | Like iptables-save, print UID and GID as numeric values by default. Add a new option `-u' to print the UID and GID names as defined by /etc/passwd and /etc/group. Note that -n is ignored after this patch, since default are numeric printing for UID and GID. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_echo() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-299-34/+23
| | | | | | | | Add NFT_CTX_OUTPUT_ECHO flag and echo the command that has been send to the kernel. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>