summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: add "typeof" build/parse/print supportFlorian Westphal2019-12-177-20/+262
| | | | | | | | | | | | | | | | | | | | This patch adds two new expression operations to build and to parse the userdata area that describe the set key and data typeof definitions. For maps, the grammar enforces either "type data_type : data_type" or or "typeof expression : expression". Check both key and data for valid user typeof info first. If they check out, flag set->key_typeof_valid as true and use it for printing the key info. This patch comes with initial support for using payload expressions with the 'typeof' keyword, followup patches will add support for other expressions as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: add typeof keyword for declarationsPablo Neira Ayuso2019-12-172-2/+38
| | | | | | | | | | | | | | | | | | Add a typeof keyword to automatically use the correct type in set and map declarations. table filter { set blacklist { typeof ip saddr } chain input { ip saddr @blacklist counter drop } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* expr: add expr_ops_by_type()Pablo Neira Ayuso2019-12-162-0/+13
| | | | | | | Fetch expression operation from the expression type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: add proto_desc_id enumerationPablo Neira Ayuso2019-12-162-0/+73
| | | | | | | This allows to uniquely identify the protocol description. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: store expr, not dtype to track data in setsFlorian Westphal2019-12-1614-63/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will be needed once we add support for the 'typeof' keyword to handle maps that could e.g. store 'ct helper' "type" values. Instead of: set foo { type ipv4_addr . mark; this would allow set foo { typeof(ip saddr) . typeof(ct mark); (exact syntax TBD). This would be needed to allow sets that store variable-sized data types (string, integer and the like) that can't be used at at the moment. Adding special data types for everything is problematic due to the large amount of different types needed. For anonymous sets, e.g. "string" can be used because the needed size can be inferred from the statement, e.g. 'osf name { "Windows", "Linux }', but in case of named sets that won't work because 'type string' lacks the context needed to derive the size information. With 'typeof(osf name)' the context is there, but at the moment it won't help because the expression is discarded instantly and only the data type is retained. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: add a helper for concat expression handlingFlorian Westphal2019-12-161-56/+43
| | | | | | Cull the repeated copy&paste snippets and add/use a helper for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* py: load the SONAME-versioned shared objectArturo Borrero Gonzalez2019-12-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Instruct the python module to load the SONAME versioned shared object. Normal end-user systems may only have available libnftables.so.1.0.0 and not libnftables.so which is usually only present in developer systems. In Debian systems, for example: % dpkg -L libnftables1 | grep so.1 /usr/lib/x86_64-linux-gnu/libnftables.so.1.0.0 /usr/lib/x86_64-linux-gnu/libnftables.so.1 % dpkg -L libnftables-dev | grep so /usr/lib/x86_64-linux-gnu/libnftables.so The "1" is not a magic number, is the SONAME of libnftables in the current version, as stated in Make_global.am. Reported-by: Michael Biebl <biebl@debian.org> Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: don't remove nul-root element from interval setPablo Neira Ayuso2019-12-095-10/+33
| | | | | | | | | | | | | Check from the delinearize set element path if the nul-root element already exists in the interval set. Hence, the element insertion path skips the implicit nul-root interval insertion. Under some circunstances, nft bogusly fails to delete the last element of the interval set and to create an element in an existing empty internal set. This patch includes a test that reproduces the issue. Fixes: 4935a0d561b5 ("segtree: special handling for the first non-matching segment") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove repeated paragraph and fix typonl67202019-12-091-7/+1
| | | | | | | [ Florian: Expand "ininterface" to "incoming interface" ] Signed-off-by: nl6720 <nl6720@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Clarify conditions under which a reject verdict is permissibleDuncan Roe2019-12-061-2/+3
| | | | | | | | | A phrase like "input chain" is a throwback to xtables documentation. In nft, chains are containers for rules. They do have a type, but what's important here is which hook each uses. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: nftables 0.9.3 depends on libnftnl 1.1.5Pablo Neira Ayuso2019-12-051-1/+1
| | | | | | | | nftables 0.9.3 requires libnftnl 1.1.5, otherwise compilation breaks: https://bugs.gentoo.org/701976. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* include: add nf_tables_compat.h to tarballsPablo Neira Ayuso2019-12-031-0/+1
| | | | | | Add it to Makefile.am so make distcheck adds this header to tarballs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to v0.9.3v0.9.3Pablo Neira Ayuso2019-12-021-2/+2
| | | | | | | | Update release name based on Jazz series, Count Basie's "Topsy": https://www.youtube.com/watch?v=Up78NJHESKE Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: off-by-one write in netdev chain device arrayPablo Neira Ayuso2019-12-021-2/+2
| | | | | | | | | | | | | | | | | | ==728473== Invalid write of size 8 ==728473== at 0x48960F2: netlink_delinearize_chain (netlink.c:422) ==728473== by 0x4896252: list_chain_cb (netlink.c:459) ==728473== by 0x4896252: list_chain_cb (netlink.c:441) ==728473== by 0x4F2C654: nftnl_chain_list_foreach (chain.c:1011) ==728473== by 0x489629F: netlink_list_chains (netlink.c:478) ==728473== by 0x4882303: cache_init_objects (rule.c:177) ==728473== by 0x4882303: cache_init (rule.c:222) ==728473== by 0x4882303: cache_update (rule.c:272) ==728473== by 0x48A7DCE: nft_evaluate (libnftables.c:408) ==728473== by 0x48A86D9: nft_run_cmd_from_buffer (libnftables.c:449) ==728473== by 0x10A5D6: main (main.c:338) Fixes: 3fdc7541fba0 ("src: add multidevice support for netdev chain") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix inconsistency in set statement documentation.Jeremy Sowden2019-12-021-4/+9
| | | | | | | | | | | | | | The description of the set statement asserts that the set must have been created with the "dynamic" flag. However, this is not the case, and it is contradicted by the following example in which the "dynamic" flag does not appear. In fact, one or both of the "dynamic" or the "timeout" flags need to be used, depending on what the set statement contains. Amend the description to explain this more accurately. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: fix out-of-bound memory write in include_file()Eric Jallot2019-12-022-12/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before patch: # echo 'include "/tmp/rules.nft"' > /tmp/rules.nft # nft -f /tmp/rules.nft In file included from /tmp/rules.nft:1:1-25: from /tmp/rules.nft:1:1-25: [snip] from /tmp/rules.nft:1:1-25: /tmp/rules.nft:1:1-25: Error: Include nested too deeply, max 16 levels include "/tmp/rules.nft" ^^^^^^^^^^^^^^^^^^^^^^^^^ double free or corruption (out) Aborted (core dumped) valgrind reports: ==8856== Invalid write of size 8 ==8856== at 0x4E8FCAF: include_file (scanner.l:718) ==8856== by 0x4E8FEF6: include_glob (scanner.l:793) ==8856== by 0x4E9985D: scanner_include_file (scanner.l:875) ==8856== by 0x4E89D7A: nft_parse (parser_bison.y:828) ==8856== by 0x4E765E1: nft_parse_bison_filename (libnftables.c:394) ==8856== by 0x4E765E1: nft_run_cmd_from_filename (libnftables.c:497) ==8856== by 0x40172D: main (main.c:340) So perform bounds checking on MAX_INCLUDE_DEPTH before writing. After patch: # nft -f /tmp/rules.nft In file included from /tmp/rules.nft:1:1-25: from /tmp/rules.nft:1:1-25: [snip] from /tmp/rules.nft:1:1-25: /tmp/rules.nft:1:1-25: Error: Include nested too deeply, max 16 levels include "/tmp/rules.nft" ^^^^^^^^^^^^^^^^^^^^^^^^^ # echo $? 1 Also: Update scanner_push_file() function definition accordingly. Fixes: 32325e3c3fab4 ("libnftables: Store top_scope in struct nft_ctx") Signed-off-by: Eric Jallot <ejallot@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: restore automergePablo Neira Ayuso2019-12-021-1/+1
| | | | | | | | Always close interval in non-anonymous sets unless the auto-merge feature is set on. Fixes: a4ec05381261 ("segtree: always close interval in non-anonymous sets") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix add and delete of element in same batchPhil Sutter2019-12-021-0/+8
| | | | | | | | | | | | | | | | | The commit this fixes accidentally broke a rather exotic use-case which is but used in set-simple.t of tests/monitor: | # nft 'add element t s { 22-25 }; delete element t s { 22-25 }' Since ranges are now checked for existence in userspace before delete command is submitted to kernel, the second command above was rejected because the range in question wasn't present in cache yet. Fix this by adding new interval set elements to cache after creating the batch job for them. Fixes: decc12ec2dc31 ("segtree: Check ranges when deleting elements") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Set a fixed timezone in nft-test.pyPhil Sutter2019-11-293-2/+3
| | | | | | | | | | | | Payload generated for 'meta time' matches depends on host's timezone and DST setting. To produce constant output, set a fixed timezone in nft-test.py. Choose UTC-2 since most payloads are correct then, adjust the remaining two tests. Fixes: 0518ea3f70d8c ("tests: add meta time test cases") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Ander Juaristi <a@juaristi.eus> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft.8: Fix nat family spec positionPhil Sutter2019-11-271-2/+2
| | | | | | | | | | In inet family nat statements, ip/ip6 keyword must come before 'to' keyword, not after. Fixes: fbe27464dee45 ("src: add nat support for the inet family") Cc: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft.8: Describe numgen expressionPhil Sutter2019-11-271-0/+26
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: add example secmark configChristian Göttsche2019-11-252-0/+88
| | | | | Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ability to set/get secmarks to/from connectionChristian Göttsche2019-11-254-5/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Labeling established and related packets requires the secmark to be stored in the connection. Add the ability to store and retrieve secmarks like: ... chain input { ... # label new incoming packets ct state new meta secmark set tcp dport map @secmapping_in # add label to connection ct state new ct secmark set meta secmark # set label for est/rel packets from connection ct state established,related meta secmark set ct secmark ... } ... chain output { ... # label new outgoing packets ct state new meta secmark set tcp dport map @secmapping_out # add label to connection ct state new ct secmark set meta secmark # set label for est/rel packets from connection ct state established,related meta secmark set ct secmark ... } ... This patch also disallow constant value on the right hand side. # nft add rule x y meta secmark 12 Error: Cannot be used with right hand side constant value add rule x y meta secmark 12 ~~~~~~~~~~~~ ^^ # nft add rule x y ct secmark 12 Error: Cannot be used with right hand side constant value add rule x y ct secmark 12 ~~~~~~~~~~ ^^ # nft add rule x y ct secmark set 12 Error: ct secmark must not be set to constant value add rule x y ct secmark set 12 ^^^^^^^^^^^^^^^^^ This patch improves 3bc84e5c1fdd ("src: add support for setting secmark"). Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Fix -Wimplicit-function-declaration warningsMichal Rostecki2019-11-211-0/+1
| | | | | | | | | | | | | | | | | | | | This change fixes the following warnings: mnl.c: In function ‘mnl_nft_flowtable_add’: mnl.c:1442:14: warning: implicit declaration of function ‘calloc’ [-Wimplicit-function-declaration] dev_array = calloc(len, sizeof(char *)); ^~~~~~ mnl.c:1442:14: warning: incompatible implicit declaration of built-in function ‘calloc’ mnl.c:1442:14: note: include ‘<stdlib.h>’ or provide a declaration of ‘calloc’ mnl.c:1449:2: warning: implicit declaration of function ‘free’ [-Wimplicit-function-declaration] free(dev_array); ^~~~ mnl.c:1449:2: warning: incompatible implicit declaration of built-in function ‘free’ mnl.c:1449:2: note: include ‘<stdlib.h>’ or provide a declaration of ‘free’ Signed-off-by: Michal Rostecki <mrostecki@opensuse.org> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: make secmark statements idempotentChristian Göttsche2019-11-211-0/+3
| | | | | | | | | | | | | | | | Currently lines like ct state new meta secmark set tcp dport map @secmapping_in becomes ct state new secmark name tcp dport map @secmapping_in which is not correct. Fixes: 3bc84e5c1fdd ("src: add support for setting secmark") Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: Introduce numberstringPhil Sutter2019-11-191-11/+2
| | | | | | | | | This token combines decstring and hexstring. The latter two had identical action blocks (which were not completely trivial), this allows to merge them. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: Drop shebangs from config filesPhil Sutter2019-11-1915-33/+2
| | | | | | | | | | | | | | | These are not meant to be executed as is but instead loaded via 'nft -f' - all-in-one.nft even points this out in header comment. While being at it, drop two spelling mistakes found along the way. Consequently remove executable bits - being registered in automake as dist_pkgsysconf_DATA, they're changed to 644 upon installation anyway. Also there is obviously no need for replacement of nft binary path anymore, drop that bit from Makefile.am. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: Install sample scripts from files/examplesPhil Sutter2019-11-193-0/+6
| | | | | | | | | Assuming these are still relevant and useful as a source of inspiration, install them into DATAROOTDIR/doc/nftables/examples. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: set reference from variable definitionPablo Neira Ayuso2019-11-181-0/+21
| | | | | | | | Allow to define variable using set reference, eg. define x = @z Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Avoid set references in odd placesPhil Sutter2019-11-181-14/+17
| | | | | | | | | | | | | | | | | | With set references being recognized by symbol_expr and that being part of primary_expr as well as primary_rhs_expr, they could basically occur anywhere while in fact they are allowed only in quite a few spots. Untangle things a bit by introducing set_ref_expr and adding that only in places where it is needed to pass testsuites. Make sure users can define variables as set references, eg. define xyz = @setref And allow to use them from set expressions and statements too. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add stateful object update operation testFernando Fernandez Mancera2019-11-161-0/+25
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: Reduce caching for get commandPhil Sutter2019-11-151-0/+17
| | | | | | | | | Introduce a function to distinguish which command object was given and request only the necessary bits to have sets and their elements available for 'get element' command. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Fix get element for little endian rangesPhil Sutter2019-11-152-5/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes get element command for interval sets with host byte order data type, like e.g. mark. During serializing of the range (or element) to query, data was exported in wrong byteorder and consequently not found in kernel. The mystery part is that code seemed correct: When calling constant_expr_alloc() from set_elem_add(), the set key's byteorder was passed with correct value of BYTEORDER_HOST_ENDIAN. Comparison with delete/add element code paths though turned out that in those use-cases, constant_expr_alloc() is called with BYTEORDER_INVALID: - seg_tree_init() takes byteorder field value of first element in init->expressions (i.e., the elements requested on command line) and assigns that to tree->byteorder - tree->byteorder is passed to constant_expr_alloc() in set_insert_interval() - the elements' byteorder happens to be the default value This patch may not fix the right side, but at least it aligns get with add/delete element codes. Fixes: a43cc8d53096d ("src: support for get element command") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Check ranges when deleting elementsPhil Sutter2019-11-142-11/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure any intervals to delete actually exist, otherwise reject the command. Without this, it is possible to mess up rbtree contents: | # nft list ruleset | table ip t { | set s { | type ipv4_addr | flags interval | auto-merge | elements = { 192.168.1.0-192.168.1.254, 192.168.1.255 } | } | } | # nft delete element t s '{ 192.168.1.0/24 }' | # nft list ruleset | table ip t { | set s { | type ipv4_addr | flags interval | auto-merge | elements = { 192.168.1.255-255.255.255.255 } | } | } Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Rewrite hour_type_print()Phil Sutter2019-11-121-30/+19
| | | | | | | | | | | | | | There was no point in this recursively called __hour_type_print_r() at all, it takes only four lines of code to split the number of seconds into hours, minutes and seconds. While being at it, inverse the conditional to reduce indenting for the largest part of the function's body. Also introduce SECONDS_PER_DAY macro to avoid magic numbers. Fixes: f8f32deda31df ("meta: Introduce new conditions 'time', 'day' and 'hour'") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Store top_scope in struct nft_ctxPhil Sutter2019-11-077-7/+50
| | | | | | | | | | | | | | | | Allow for interactive sessions to make use of defines. Since parser is initialized for each line, top scope defines didn't persist although they are actually useful for stuff like: | # nft -i | define goodports = { 22, 23, 80, 443 } | add rule inet t c tcp dport $goodports accept | add rule inet t c tcp sport $goodports accept While being at it, introduce scope_alloc() and scope_free(). Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Drop incorrect requirement for nft configsPhil Sutter2019-11-061-2/+1
| | | | | | The shebang is not needed in files to be used with --file parameter. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add and use `set_is_meter` helperJeremy Sowden2019-11-066-18/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sets constructed for meters are flagged as anonymous and dynamic. However, in some places there are only checks that they are dynamic, which can lead to normal sets being classified as meters. For example: # nft add table t # nft add set t s { type ipv4_addr; size 256; flags dynamic,timeout; } # nft add chain t c # nft add rule t c tcp dport 80 meter m size 128 { ip saddr limit rate 10/second } # nft list meters table ip t { set s { type ipv4_addr size 256 flags dynamic,timeout } meter m { type ipv4_addr size 128 flags dynamic } } # nft list meter t m table ip t { meter m { type ipv4_addr size 128 flags dynamic } } # nft list meter t s Error: No such file or directory list meter t s ^ Add a new helper `set_is_meter` and use it wherever there are checks for meters. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: flowtable: add support for delete command by handleEric Jallot2019-11-069-12/+69
| | | | | | | Also, display handle when listing with '-a'. Signed-off-by: Eric Jallot <ejallot@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix missing family in plural forms list command.Eric Jallot2019-10-311-6/+7
| | | | | | Fixes: 067ac215e93f ("doc: update nft list plural form parameters") Signed-off-by: Eric Jallot <ejallot@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: flowtable: add support for named flowtable listingEric Jallot2019-10-3110-19/+157
| | | | | | | | | | | | | | | | | | | | This patch allows you to dump a named flowtable. # nft list flowtable inet t f table inet t { flowtable f { hook ingress priority filter + 10 devices = { eth0, eth1 } } } Also: libnftables-json.adoc: fix missing quotes. Fixes: db0697ce7f60 ("src: support for flowtable listing") Fixes: 872f373dc50f ("doc: Add JSON schema documentation") Signed-off-by: Eric Jallot <ejallot@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Replace use of untyped nftnl data settersPhil Sutter2019-10-301-6/+10
| | | | | | | | | Setting strings won't make a difference, but passing data length to *_set_data() functions allows for catching accidental changes on either side. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove artifical cap on 8 devices per flowtableSven Auhagen2019-10-301-2/+7
| | | | | | | Currently assuming a maximum of 8 devices, remove this artificial cap. Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add multidevice support for netdev chainPablo Neira Ayuso2019-10-307-27/+109
| | | | | | | | | | | | | | This patch allows you to specify multiple netdevices to be bound to the netdev basechain, eg. # nft add chain netdev x y { \ type filter hook ingress devices = { eth0, eth1 } priority 0\; } json codebase has been updated to support for one single device with the existing representation, no support for multidevice is included in this patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Fix test script for Python3 tempfilePhil Sutter2019-10-291-4/+4
| | | | | | | | | | | | | When instantiating a temporary file using tempfile's TemporaryFile() constructor, the resulting object's 'name' attribute is of type int. This in turn makes print_msg() puke while trying to concatenate string and int using '+' operator. Fix this by using format strings consequently, thereby cleaning up code a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: add missing output flags.Jeremy Sowden2019-10-241-0/+35
| | | | | | | | `terse` and `numeric_time` are missing from the `output_flags` dict. Add them and getters and setters for them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* main: remove duplicate output flag assignment.Jeremy Sowden2019-10-231-1/+0
| | | | | | | | | `NFT_CTX_OUTPUT_NUMERIC_TIME` is implicit in `NFT_CTX_OUTPUT_NUMERIC_ALL`: there are is no need explicitly to OR it into output_flags when `--numeric` is passed. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: add missing `OPT_NUMERIC_PROTO` long option.Jeremy Sowden2019-10-231-0/+4
| | | | | | | | The `options` array is missing an entry for `OPT_NUMERIC_PROTO`. Add a new option, `--numeric-protocol`, consistent with the documentation. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add missing output flag documentation.Jeremy Sowden2019-10-231-0/+6
| | | | | | | | The documentation for NFT_CTX_OUTPUT_FLAG_NUMERIC_TIME and NFT_CTX_OUTPUT_FLAG_NUMERIC_ALL is incomplete. Add the missing bits. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "main: Fix for misleading error with negative chain priority"Phil Sutter2019-10-232-9/+1
| | | | | | | | | | | This reverts commit 9fc71bc6b602c8706d1214e0100bcd7638c257e3. Given that this change breaks typical commands like 'nft list ruleset -a' while on the other hand escaping of semicolons and (depending on shell) curly braces is still required, decision was made to not go with this solution. Signed-off-by: Phil Sutter <phil@nwl.cc>