summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* evaluate: do not pass EXPR_SET_ELEM to stmt_evaluate_arg() for set/map ↵Pablo Neira Ayuso2018-10-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | evaluation Otherwise, we cannot validate mismatching length size when combining raw expressions with sets and maps, eg. # cat /tmp/test table ip nftlb { map persistency { type ipv4_addr : mark size 65535 timeout 1h } chain pre { type filter hook prerouting priority filter; policy accept; ip protocol { tcp, udp } update @persistency { @th,0,16 : numgen inc mod 2 offset 100 } } } # nft -f /tmp/test /tmp/test:10:68-75: Error: datatype mismatch: expected IPv4 address, expression has type integer with length 16 ip protocol { tcp, udp } update @persistency { @th,0,16 : numgen inc mod 2 offset 100 } ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Pass inner expression instead, instead of the wrapping set element expression. Fixes: 0e90798e9812 ("src: simplify map statement") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Work around segfault when encountering xt stmtPhil Sutter2018-10-242-0/+13
| | | | | | | | | | | | | | | | When trying to convert an xt stmt into JSON, print() callback was called. Though the code in src/xt.c does not respect output_fp, therefore buffer wasn't filled as expected making libjansson to puke: | # nft -j list ruleset | warning: stmt ops xt have no json callback | nft: json.c:169: stmt_print_json: Assertion `__out' failed. | Aborted (core dumped) Avoid this by detecting xt stmt ops and returning a stub. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove netlink_batch_send()Pablo Neira Ayuso2018-10-243-8/+1
| | | | | | Replace it by direct call to mnl_batch_talk(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_flowtable()Pablo Neira Ayuso2018-10-245-88/+62
| | | | | | | We can remove alloc_nftnl_flowtable() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Improve error checking in mnl_nft_event_listener()Phil Sutter2018-10-241-2/+5
| | | | | | | | When trying to adjust receive buffer size, the second call to setsockopt() was not error-checked. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix for recent changes to context structsPhil Sutter2018-10-242-37/+37
| | | | | | | | | | Commits introducing nft_ctx pointer to netlink and eval contexts did not update JSON code accordingly. Fixes: 00f777bfc414a ("src: pass struct nft_ctx through struct eval_ctx") Fixes: 2dc07bcd7eaa5 ("src: pass struct nft_ctx through struct netlink_ctx") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix osf ttl supportPhil Sutter2018-10-244-8/+83
| | | | | | | | | | | | | | Having to use numerical values for ttl property in JSON is not practical as these values are arbitrary and meaningful only in netfilter. Instead align JSON output/input with standard API, accepting names for TTL matching strategy. Also add missing documentation in libnftables-json man page and fix JSON equivalent in tests/py. Fixes: 03eafe098d5ee ("osf: add ttl option support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Fix comment for struct eval_ctxPhil Sutter2018-10-241-1/+1
| | | | | | | | Previous change to that struct missed to update the comment. Fixes: 00f777bfc414a ("src: pass struct nft_ctx through struct eval_ctx") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: use either name or handle to refer to objectsPablo Neira Ayuso2018-10-231-4/+5
| | | | | | We can only specify either name or handle to refer to objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_obj()Pablo Neira Ayuso2018-10-235-140/+101
| | | | | | | We can remove alloc_nftnl_obj() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move socket open and reopen to mnl.cPablo Neira Ayuso2018-10-236-33/+27
| | | | | | | These functions are part of the mnl backend, move them there. Remove netlink_close_sock(), use direct call to mnl_socket_close(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: osf: add ttl option to man pageFernando Fernandez Mancera2018-10-231-4/+16
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add ttl option supportFernando Fernandez Mancera2018-10-2312-11/+133
| | | | | | | | | | | | | | Add support for ttl option in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: reset mnl_socket field in struct nft_ctx on EINTRPablo Neira Ayuso2018-10-223-5/+4
| | | | | | Otherwise we keep using the old netlink socket if we hit EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass struct nft_ctx through struct netlink_ctxPablo Neira Ayuso2018-10-2210-195/+156
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass struct nft_ctx through struct eval_ctxPablo Neira Ayuso2018-10-223-75/+69
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Extend get element testPhil Sutter2018-10-221-0/+7
| | | | | | | | | Despite the recent fixes, the test still fails. While trying to address the remaining issues, I found more potentially problematic inputs so extend the test by those. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Document ct timeout supportHarsha Sharma2018-10-182-5/+106
| | | | | | | | Add documentation for creating ct timeout objects and assigning timeout policies via rules. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus bail out with raw expression from dynamic setsPablo Neira Ayuso2018-10-172-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following ruleset that uses raw expressions: table ip nftlb { map persistency { type inet_service : mark size 65535 timeout 1h elements = { 53 expires 59m55s864ms : 0x00000064, 80 expires 59m58s924ms : 0x00000065, 443 expires 59m56s220ms : 0x00000064 } } chain pre { type filter hook prerouting priority filter; policy accept; ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } } } bogusly bails out with: /tmp/test:9:57-64: Error: datatype mismatch: expected internet network service, expression has type integer ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix the problem by evaluating expression basetype and length in this case. Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove opts field from struct xt_stmtPablo Neira Ayuso2018-10-173-8/+2
| | | | | | | | This is never used, ie. always NULL. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* src: add support for setting secmarkChristian Göttsche2018-10-1510-6/+187
| | | | | | | | | | | | | | | | | | | | | | | | | Add support for new nft object secmark holding security context strings. The following should demonstrate its usage (based on SELinux context): # define a tag containing a context string nft add secmark inet filter sshtag \"system_u:object_r:ssh_server_packet_t:s0\" nft list secmarks # set the secmark nft add rule inet filter input tcp dport 22 meta secmark set sshtag # map usage nft add map inet filter secmapping { type inet_service : secmark \; } nft add element inet filter secmapping { 22 : sshtag } nft list maps nft list map inet filter secmapping nft add rule inet filter input meta secmark set tcp dport map @secmapping [ Original patch based on v0.9.0. Rebase on top on git HEAD. --pablo ] Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix memleak in dup_stmt_json()Phil Sutter2018-10-151-1/+1
| | | | | | | | | The variable 'root' is always assigned to after initialization, so there is no point in initializing it upon declaration. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix for ineffective family value checksPhil Sutter2018-10-151-99/+70
| | | | | | | | | | | | | Since handle->family is unsigned, checking for value < 0 never yields true. Overcome this by changing parse_family() to return an error code and write the parsed family value into a pointer passed as parameter. The above change required a bit more cleanup to avoid passing pointers to signed variables to the function. Also leverage json_parse_family() a bit more to reduce code side. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Fix memleak in nft_parse_bison_filename()Phil Sutter2018-10-151-4/+3
| | | | | | | | | Allocated scanner object leaks when returning to caller. For some odd reason, this was missed by the commit referenced below. Fixes: bd82e03e15df8 ("libnftables: Move scanner object into struct nft_ctx") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix memleak in netlink_parse_fwd() error pathPhil Sutter2018-10-151-5/+8
| | | | | | | | Make sure allocated 'stmt' is freed before returning to caller. Fixes: 30d45266bf38b ("expr: extend fwd statement to support address and family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: monitor: Test JSON output as wellPhil Sutter2018-10-158-11/+117
| | | | | | | | Enhance monitor test suite to test check JSON output as well. Note that for now there is no support for --echo output testing with JSON. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Use libnftables JSON outputPhil Sutter2018-10-154-140/+251
| | | | | | | | This switches 'nft monitor' JSON output from using libnftnl's to libnftables' implementation. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix printing of ct objectsPhil Sutter2018-10-156-25/+63
| | | | | | | | | | | | | | | Monitor output is supposed to be single lined without tabs, but ct object were printed with newlines and tabs hard-coded. Fixing this wasn't too hard given that there is 'stmt_separator' to also include semi-colons where required if newline was removed. A more obvious mistake was position of object type in monitor output: Like with other object types, it has to occur between command and table spec. As a positive side-effect, this aligns ct objects better with others (see obj_type_name_array for instance). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Drop 'update table' and 'update chain' casesPhil Sutter2018-10-151-8/+2
| | | | | | | | | There seems to be no situation where this comes to play. Also, since there is no 'nft update table/chain' command, this is inconsistent with input. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Drop fake XML supportPhil Sutter2018-10-151-6/+0
| | | | | | | | Since libnftnl doesn't support XML formatting, pretending to do so in nft monitor is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Add ct timeout supportPhil Sutter2018-10-153-1/+117
| | | | | | | Add support for printing and parsing ct timeout objects to JSON API. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Drop unused symbolic_constant_json() stubPhil Sutter2018-10-151-6/+0
| | | | | | | | | This seems like a left-over from day 1: Said function is static in json.c, so there is no point in providing a stub when compiling with JSON disabled. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing JSON bits for inet/meta.tPhil Sutter2018-10-152-3/+20
| | | | | | | | Those were forgotten when renaming meta secpath to meta ipsec. Fixes: 8f55ed41d0070 ("src: rename meta secpath to meta ipsec") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: set proper error cause on existing elementsPablo Neira Ayuso2018-10-101-0/+2
| | | | | | | | | | | | | | | | | | Adding new elements result in a confusing "Success" error message. # nft add element x y { 0-3 } [...] Error: Could not process rule: Success add element x y { 0-3 } ^^^^^^^^^^^^^^^^^^^^^^^^ after this patch, this reports: Error: Could not process rule: File exists add element x y { 0-3 } ^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: incorrect handling of last element in get_set_decompose()Pablo Neira Ayuso2018-10-101-1/+1
| | | | | | | Add range to the list of matching elements. Fixes: 95629758a5ec ("segtree: bogus range via get set element on existing elements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove netlink_flush_chain()Pablo Neira Ayuso2018-10-103-8/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove netlink_flush_table()Pablo Neira Ayuso2018-10-103-12/+1
| | | | | | | Just a simple wrapper function, replace it by direct call to mnl_nft_rule_del(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_set()Pablo Neira Ayuso2018-10-105-210/+209
| | | | | | | We can remove alloc_nftnl_set() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_rule()Pablo Neira Ayuso2018-10-105-110/+84
| | | | | | | We can remove alloc_nftnl_rule() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_chain()Pablo Neira Ayuso2018-10-045-107/+96
| | | | | | | | The netlink layer sits in between the mnl and the rule layers, remove it. We can remove alloc_nftnl_chain() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_table()Pablo Neira Ayuso2018-10-045-85/+52
| | | | | | | | The netlink layer sits in between the mnl and the rule layers, remove it. We can remove alloc_nftnl_table() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of netlink_genid_get()Pablo Neira Ayuso2018-10-043-8/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove markup json parsing codePablo Neira Ayuso2018-10-042-327/+2
| | | | | | | | We have better json support these days, remove libnftnl json support. While at it, remove test file for this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Fix for ECN keyword in LHS of relationalPhil Sutter2018-10-045-9/+54
| | | | | | | | | | | | | | | | | | | | Of all possible TCP flags, 'ecn' is special since it is recognized by lex as a keyword (there is a a field in IPv4 and IPv6 headers with the same name). Therefore it is listed in keyword_expr, but that was sufficient for RHS only. The following statement reproduces the issue: | tcp flags & (syn | ecn) == (syn | ecn) The solution is to limit binop expressions to accept an RHS expression on RHS ("real" LHS expressions don't make much sense there anyway), which then allows keyword_expr to occur there. In order to maintain the recursive behaviour if braces are present, allow primary_rhs_expr to consist of a basic_rhs_expr enclosed in braces. This in turn requires for braced RHS part in relational_expr to be dropped, otherwise bison complains about shift/reduce conflict. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: stop iteration on existing elements in case range is foundPablo Neira Ayuso2018-10-031-4/+6
| | | | | | No need to keep iterating once the range object has been allocated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix memleak in do_get_setelems()Pablo Neira Ayuso2018-10-031-5/+3
| | | | | | Release set and elements in case of error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: memleak in get_set_decompose()Pablo Neira Ayuso2018-10-031-0/+2
| | | | | | | Release set content on error. Moreover, release input set content in case we finally manage to decompose it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: disantangle get_set_interval_end()Pablo Neira Ayuso2018-10-031-15/+22
| | | | | | | | | | This function overrides the left pointer. Instead update this function to return the range that we found to enclose the left element. Note that we may not find a closing right element - therefore, it is a standalone element - in that case this function returns NULL. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: bogus range via get set element on existing elementsPablo Neira Ayuso2018-10-033-5/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | table ip x { set y { type inet_service flags interval elements = { 10, 20-30, 40, 50-60 } } } # nft get element x y { 20-40 } table ip x { set y { type inet_service flags interval elements = { 20-40 } } } 20 and 40 exist in the tree, but they are part of different ranges. This patch adds a new get_set_decompose() function to validate that the left and the right side of the range. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Test 'get element' commandPhil Sutter2018-10-031-0/+37
| | | | | | | | This command is currently broken when used in sets with ranges. Test various variants against known data and check if output is as expected. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>