summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* src: file descriptor leak in include_file()Pablo Neira Ayuso2019-03-154-25/+32
| | | | | | | | File that contains the ruleset is never closed, track open files through the nft_ctx object and close them accordingly. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: no need for statement separator for ct object commandsPablo Neira Ayuso2019-03-141-4/+4
| | | | | | | | | | | | | Otherwise, this forces user to place a double semi-colon to skip a parser error in a multi-line commands: # nft add "ct helper ip filter test { type \"ftp\" protocol tcp; };add rule filter test ct helper set \"ftp\"" Error: syntax error, unexpected add, expecting end of file or newline or semicolon add ct helper ip filter test { type "ftp" protocol tcp; };add rule filter test ct helper set "ftp" ^^^ Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY on helper deletion from transactionPablo Neira Ayuso2019-03-141-0/+15
| | | | | Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus ENOENT on element deletion in interval setPablo Neira Ayuso2019-03-121-0/+26
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: bogus EBUSY in set deletion after flushPablo Neira Ayuso2019-03-081-0/+18
| | | | | | | | | | | | | | | | flush chain ip filter group_7933 Removes all rules, including references to set 'group_7933', however: delete map ip filter group_7933 results in: delete.nft:6:1-32: Error: Could not process rule: Device or resource busy delete map ip filter group_7933 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for anon set abort.Florian Westphal2019-03-071-0/+10
| | | | | | | This triggers kernel crash in 5.0, see https://bugzilla.netfilter.org/show_bug.cgi?id=1325 Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: misleading error reporting with sets and mapsPablo Neira Ayuso2019-03-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to list a map content, if set is used, nft reports: # nft list set filter group_7933 Error: No such file or directory; did you mean set ‘group_7933’ in table ip ‘filter’? list set filter group_7933 ^^^^^^^^^^ Which is confusing in case user wants to list an existing map: # nft list map filter group_7933 table ip filter { map group_7933 { type ipv4_addr : classid flags interval elements = { 10.4.22.0/24 : 1:c7cb } } } Instead, give a hint to user that probably wants to list a map, not a set: # nft list set filter group_7933 Error: No such file or directory; did you mean map ‘group_7933’ in table ip ‘filter’? list set filter group_7933 ^^^^^^^^^^ Fixes: 285bb67a11ad ("src: introduce simple hints on incorrect set") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: add missing non-matching segment to set in flat representationPablo Neira Ayuso2019-03-062-3/+16
| | | | | | | | | | | | | | | | | # cat test.nft add set x y { type ipv4_addr; } add element x y { 10.0.24.0/24 } # nft -f test.nft # nft delete element x y { 10.0.24.0/24 } bogusly returns -ENOENT. The non-matching segment (0.0.0.0 with end-flag set on) is not added to the set in the example above. This patch also adds a test to cover this case. Fixes: 4935a0d561b5 ("segtree: special handling for the first non-matching segment") Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: remove dummy debug_octxPablo Neira Ayuso2019-03-063-10/+10
| | | | | | | | Breaks custom-defined configuration in library mode, ie. user may want to store output in a file, instead of stderr. Fixes: 35f6cd327c2e ("src: Pass stateless, numeric, ip2name and handle variables as structure members.") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: fix crash when debug mode is activeFlorian Westphal2019-03-041-2/+5
| | | | | | | We must set output_fp to sensible filep, else crash. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: update goto/jump help textFlorian Westphal2019-03-011-3/+18
| | | | | | | | pointed out by redsh on #netfilter: uses "of" instead of "or". While at it, explain continue and update return statement. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Respect base chain priorityPhil Sutter2019-02-271-0/+1
| | | | | | | | Priority value was parsed but not assigned to allocated chain object. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix memleaks in echo supportPhil Sutter2019-02-271-10/+18
| | | | | | | | | | | | | When extracting netlink message data for populating JSON objects with handles, allocated nftnl objects were not freed. Though since freeing these objects also frees retrieved string attributes, copy them using strdupa() which takes care of memory deallocation upon function return. This is ideal since these strings are used only to find the right JSON object to insert the handle into. Fixes: bb32d8db9a125 ("JSON: Add support for echo option") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Use xstrdup() when parsing rule commentPhil Sutter2019-02-271-1/+1
| | | | | | | | | Use xstrdup() instead of plain strdup() for consistency (and implicit ENOMEM checking). Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Duplicate chain name when parsing jump verdictPhil Sutter2019-02-271-1/+2
| | | | | | | | | | Since verdict expression frees the chain name, pass a newly allocated string to it. Otherwise double free happens because json_decref() frees the string property value as well. Fixes: d1057a5feb5fd ("JSON: Simplify verdict statement parsing") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Print errors before freeing commandsPhil Sutter2019-02-271-2/+2
| | | | | | | | | Commands may contain data printed by an error record, so make sure cmd_free() is not called before erec_print_list() has returned. Fixes: 778de37d82e7b ("libnftables: Keep cmds list outside of parser_state") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: flush after rule deletionPablo Neira Ayuso2019-02-151-0/+22
| | | | | | Flush after rule deletion should hit no ENOENT. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: fix build failure with json supportFlorian Westphal2019-02-123-6/+8
| | | | | | Fixes: e3f195777ee54 ("src: expr: remove expr_ops from struct expr") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: remove expr_ops from struct exprFlorian Westphal2019-02-0816-61/+109
| | | | | | | | size of struct expr changes from 144 to 128 bytes on x86_64. This doesn't look like much, but large rulesets can have tens of thousands of expressions (each set element is represented by an expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: add expression etypeFlorian Westphal2019-02-0818-142/+143
| | | | | | | | Temporary kludge to remove all the expr->ops->type == ... patterns. Followup patch will remove expr->ops, and make expr_ops() lookup the correct expr_ops struct instead to reduce struct expr size. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: add and use internal expr_ops helperFlorian Westphal2019-02-081-9/+29
| | | | | | | | This helper will eventually lookup the correct expr_ops struct, so we can get rid of the expr->ops pointer. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: payload: export and use payload_expr_cmpFlorian Westphal2019-02-083-2/+4
| | | | | | | expr->ops is going away, so export payload cmp and use it directly. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: add and use expr_name helperFlorian Westphal2019-02-089-23/+29
| | | | | | | | Currently callers use expr->ops->name, but follouwp patch will remove the ops pointer from struct expr. So add this helper and use it everywhere. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: exercise abort path with anonymous set that is bound to rulePablo Neira Ayuso2019-02-081-0/+14
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add cplusplus guards for externPablo Neira Ayuso2019-01-281-0/+8
| | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* meta: add iifkind and oifkind supportwenxu2019-01-283-1/+17
| | | | | | | | | | This can be used to match the kind type of iif or oif interface of the packet. Example: add rule inet raw prerouting meta iifkind "vrf" accept Signed-off-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: fix up expected payloads after expr merge changeFlorian Westphal2019-01-258-20/+38
| | | | | | | | nft currently doesn't do payload merging anymore in some cases, so fix up the expected output. Fixes: ce2651222911 ("payload: refine payload expr merging") Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: fix non-working exampleFlorian Westphal2019-01-251-1/+1
| | | | | | | nft doesn't have the context to translate "dns" or "http" as being service names here. Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: name is ignored when deleting a tableFlorian Westphal2019-01-182-4/+35
| | | | | | | | | | | | | nlt is reallocated, leaking first allocation and also removing the table name/handle that was set on nlt object. Add a test case for this as well, the batch is supposed to fail when trying to delete a non-existant table, rather than wiping all tables in the same address family. Fixes: 12c362e2214a0 ("mnl: remove alloc_nftnl_table()") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: refine payload expr mergingFlorian Westphal2019-01-112-2/+28
| | | | | | | | | | | | | | | | | | | nf_tables can handle payload exprs for sizes <= sizeof(u32) via a direct operation from the eval loop, rather than a a call to the payload expression. Two loads for four byte quantities are thus faster than a single load for an 8 byte load. ip saddr 1.2.3.4 ip daddr 2.3.4.5 is faster with this applied, even though it involves two payload and two two compare expressions, just because all can be handled from the main loop without any calls to expression ops. Keep merging for linklayer and when at least one of the expressions already exceeded the 4 byte "limit" anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix netdev family device name parsingFlorian Westphal2019-01-093-7/+7
| | | | | | | | Should use accept/use quotes, else you can't use this with a device name that is shared with a key word, e.g. 'device vm'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add igmp supportPablo Neira Ayuso2019-01-0910-5/+517
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: remove RETURNCODE_SEPARATORFlorian Westphal2019-01-043-10/+4
| | | | | | | | | | | | test files are located via find + a pattern search that looks for _[0-9]. Previous change makes all test scripts return 0 when the test case is supposed to pass, so the foo_$retval name is no longer needed. Update script to look for all executeables in the 'testcases' directory. This makes it necessary to make two dump-files non-executeable. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix up redefine test caseFlorian Westphal2019-01-041-6/+6
| | | | | | | | The '$' has to be escaped, else it gets replaced with an empty value by the shell. As 'set -e' is used, that caused the first nft command to fail. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: change all test scripts to return 0Florian Westphal2019-01-0447-87/+130
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The shell-based tests currently encode a return value in the file name, i.e. foo_1 expects that the script should return '1' for the test case to pass. This is very error prone, and one test case is even broken (i.e., it returns 1, but because of a different, earlier error). do_something || exit 1 or 'set -e' are both pretty common patterns, in both cases tests should fail. In those test-cases that deliberately test for an error, nft something_should_fail || exit 0 nft something_should_fail && exit 1 or a similar constructs should be used. This initial commit modififies all '_1' scripts to return 0 on success, usually via 'nft wrong || exit 0'. All tests pass, except the one broken test case that hasn't worked before either, but where 'set -e' use made it pass (the failing command is supposed to work, and the command that is supposed to fail is never run). Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for leaking of stateful object refcountFlorian Westphal2019-01-041-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | Taehee Yoo fixed a bug in error path handling for object refcounts. Quoting patch description: | $nft add table ip filter | $nft add counter ip filter c1 | $nft add map ip filter m1 { type ipv4_addr : counter \;} | $nft add element ip filter m1 { 1 : c1 } | $nft add element ip filter m1 { 1 : c1 } | $nft delete element ip filter m1 { 1 } | $nft delete counter ip filter c1 |Result: | Error: Could not process rule: Device or resource busy | delete counter ip filter c1 | |At the second 'nft add element ip filter m1 { 1 : c1 }', the reference |count of the 'c1' is increased then it tries to insert into the 'm1'. but |the 'm1' already has same element so it returns -EEXIST. |But it doesn't decrease the reference count of the 'c1' in the error path. |Due to a leak of the reference count of the 'c1', the 'c1' can't be |removed by 'nft delete counter ip filter c1'. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: fix object listing when no table is givenFlorian Westphal2019-01-022-5/+15
| | | | | | | 'nft list quotas' would not print anything at all anymore. Fixes: 88456a7ef01172 ("rule: list only the table containing object") Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: fix build with --with-xtablesFlorian Westphal2018-12-291-3/+4
| | | | | | | | | | | | The previous change is bonkers, it fixes build when libxtables isn't even installed, but broke build when --with-xtables is provided to configure. Reason is that the include guard comes too early, so xtables.h is never included, causing build to fail because no libxtables function prototypes and definitions are available. Fixes: 9e84f3f083bb ("xt: fix build when libxtables is not installed") Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: refer to meta protocol in icmp and icmpv6Pablo Neira Ayuso2018-12-291-2/+2
| | | | | | Instead of meta nftproto, which is a typo. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove deprecated code for export/import commandsPablo Neira Ayuso2018-12-277-125/+4
| | | | | | | | | | | | | | | | | | Update parser to display this error message: # nft export json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export json ^^^^^^^^^^^^ Just like: # nft export vm json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export vm json ^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Reject 'export vm json' commandPhil Sutter2018-12-213-11/+14
| | | | | | | | | | | | | | | | | | Since libnftnl recently dropped JSON output support, this form of JSON export is not available anymore. Point at 'nft -j list ruleset' command for a replacement in error message. Since 'export' command is not useable anymore, remove it from documentation. Instead point out that 'list ruleset' command serves well for dumping and later restoring. To not cause pointless inconvenience for users wishing to store their ruleset in JSON format, make JSON parser fallback to CMD_ADD if no recognized command property was found. This allows to feed the output of 'nft -j list ruleset' into 'nft -f' without any modification. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: fix build when libxtables is not installedFlorian Westphal2018-12-041-0/+5
| | | | | | | | | | | | If libxtables is not even installed, build fails due to to missing include file. ifdef LIBXTABLES guard fixes the first error, but results in two followup failures: 1. missing IFNAMSIZ definition 2. dereference of unknown struct. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: bail out on incorrect burst unitPablo Neira Ayuso2018-12-032-6/+11
| | | | | | | | | | | | Burst can be either bytes or packets, depending on the rate limit unit. # nft add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets Error: syntax error, unexpected packets, expecting string or bytes add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets ^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1306 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: document ct countPablo Neira Ayuso2018-12-011-0/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect identifierPablo Neira Ayuso2018-12-013-2/+30
| | | | | | | | | | | | | | | | | # cat test.nft define test = "1.2.3.4" table ip x { chain y { ip saddr $text } } # nft -f test.nft test.nft:5:13-16: Error: unknown identifier 'text'; did you mean identifier ‘test’? ip saddr $text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect objectPablo Neira Ayuso2018-12-013-3/+47
| | | | | | | | | | # nft add counter x test # nft list counter x test Error: No such file or directory; did you mean obj ‘test’ in table ip ‘x’? list counter x text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* misspell: add distance threshold for suggestionsPablo Neira Ayuso2018-11-301-3/+18
| | | | | | Restrict suggestions to threshold, like gcc does. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: provide suggestion for misspelled object namePablo Neira Ayuso2018-11-304-3/+127
| | | | | | | | | | | | Use this from the lookup path, to check for misspellings: # nft add table filter # nft add chain filtre test Error: No such file or directory; did you mean table ‘filter’ in family ip? add chain filtre test ^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: remove type checks in min() and max()Pablo Neira Ayuso2018-11-301-11/+5
| | | | | | So we can pass functions as parameters, needed by follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: fix return codesArturo Borrero Gonzalez2018-11-283-3/+3
| | | | | | | Try to return != 0 if a testsuite fails. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>