summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* datatype: avoid cast-align warning with struct sockaddr result from ↵Thomas Haller2023-08-291-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | getaddrinfo() With CC=clang we get datatype.c:625:11: error: cast from 'struct sockaddr *' to 'struct sockaddr_in *' increases required alignment from 2 to 4 [-Werror,-Wcast-align] addr = ((struct sockaddr_in *)ai->ai_addr)->sin_addr; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ datatype.c:690:11: error: cast from 'struct sockaddr *' to 'struct sockaddr_in6 *' increases required alignment from 2 to 4 [-Werror,-Wcast-align] addr = ((struct sockaddr_in6 *)ai->ai_addr)->sin6_addr; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ datatype.c:826:11: error: cast from 'struct sockaddr *' to 'struct sockaddr_in *' increases required alignment from 2 to 4 [-Werror,-Wcast-align] port = ((struct sockaddr_in *)ai->ai_addr)->sin_port; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix that by casting to (void*) first. Also, add an assertion that the type is as expected. For inet_service_type_parse(), differentiate between AF_INET and AF_INET6. It might not have been a problem in practice, because the struct offsets of sin_port/sin6_port are identical. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: avoid "-Wenum-conversion" warning in parser_bison.yThomas Haller2023-08-291-2/+2
| | | | | | | | | | | | | | Clang warns: parser_bison.y:3658:83: error: implicit conversion from enumeration type 'enum nft_nat_types' to different enumeration type 'enum nft_nat_etypes' [-Werror,-Wenum-conversion] { (yyval.stmt) = nat_stmt_alloc(&(yyloc), NFT_NAT_SNAT); } ~~~~~~~~~~~~~~ ^~~~~~~~~~~~ parser_bison.y:3659:83: error: implicit conversion from enumeration type 'enum nft_nat_types' to different enumeration type 'enum nft_nat_etypes' [-Werror,-Wenum-conversion] { (yyval.stmt) = nat_stmt_alloc(&(yyloc), NFT_NAT_DNAT); } ~~~~~~~~~~~~~~ ^~~~~~~~~~~~ Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: avoid "-Wenum-conversion" warning in dtype_map_from_kernel()Thomas Haller2023-08-291-1/+1
| | | | | | | | | | | Clang warns: netlink.c:806:26: error: implicit conversion from enumeration type 'enum nft_data_types' to different enumeration type 'enum datatypes' [-Werror,-Wenum-conversion] return datatype_lookup(type); ~~~~~~~~~~~~~~~ ^~~~ Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: expand vmap test case to also cause batch abortFlorian Westphal2023-08-292-6/+22
| | | | | | | | | | Let the last few batches also push an update that contains elements twice. This is expected to cause the batch to be aborted, which increases code coverage on kernel side. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: permit gc-interval in map declarationsFlorian Westphal2023-08-291-0/+5
| | | | | | | Maps support timeouts, so allow to set the gc interval as well. Fixes: 949cc39eb93f ("parser: support of maps with timeout") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: monitor: Fix for wrong ordering in expected JSON outputPhil Sutter2023-08-291-1/+1
| | | | | | | | Adjust JSON for delete before add for replace after respective kernel fix, too. Fixes: ba786ac758fba ("tests: monitor: update insert and replace commands") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Fix for wrong syntax in set-interval.tPhil Sutter2023-08-291-1/+1
| | | | | | | Expected JSON output must be prefixed 'J'. Fixes: 7ab453a033c9a ("monitor: do not call interval_map_decompose() for concat intervals") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Fix time format in ct timeout testPhil Sutter2023-08-291-1/+1
| | | | | | | | | The old "plain" numbers are still accepted (and assumed to be in seconds), but output will use units which is unexpected due to 'O -'. Adjust input instead of adding this subtly different output line. Fixes: 5c25c5a35cbd2 ("parser: allow ct timeouts to use time_spec values") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: Fix monitor JSON output for insert commandPhil Sutter2023-08-291-1/+1
| | | | | | | | Looks like commit ba786ac758fba ("tests: monitor: update insert and replace commands") missed to also fix expected JSON output. Fixes: 48d20b8cf162e ("monitor: honor NLM_F_APPEND flag for rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: Drop dead code from expr_evaluate_mapping()Phil Sutter2023-08-291-11/+8
| | | | | | | | | | | | | Since commit 343a51702656a ("src: store expr, not dtype to track data in sets"), set->data is allocated for object maps in set_evaluate(), all other map types have set->data initialized by the parser already, set_evaluate() also checks that. Drop the confusing check, later in the function set->data is dereferenced unconditionally. Fixes: 343a51702656a ("src: store expr, not dtype to track data in sets") Signed-off-by: Phil Sutter <phil@nwl.cc>
* configure: drop AM_PROG_CC_C_O autoconf checkThomas Haller2023-08-251-1/+0
| | | | | | | | | | | | This macro is obsolete since automake 1.14 (2013). It might have been unnecessary even before, in practice only gcc/clang are supported compilers. [1] https://www.gnu.org/software/automake/manual/html_node/Public-Macros.html#index-AM_005fPROG_005fCC_005fC_005fO [2] https://lists.gnu.org/archive/html/info-gnu/2013-06/msg00009.html Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: include <std{bool,int}.h> via <nft.h>Thomas Haller2023-08-2524-24/+3
| | | | | | | | | | | | | | | | | | | | There is a minimum base that all our sources will end up needing. This is what <nft.h> provides. Add <stdbool.h> and <stdint.h> there. It's unlikely that we want to implement anything, without having "bool" and "uint32_t" types available. Yes, this means the internal headers are not self-contained, with respect to what <nft.h> provides. This is the exception to the rule, and our internal headers should rely to have <nft.h> included for them. They should not include <nft.h> themselves, because <nft.h> needs always be included as first. So when an internal header would include <nft.h> it would be unnecessary, because the header is *always* included already. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: use AC_USE_SYSTEM_EXTENSIONS to get _GNU_SOURCEThomas Haller2023-08-252-2/+3
| | | | | | | | | | | | | | | | | Let "configure" detect which features are available. Also, nftables is a Linux project, so portability beyond gcc/clang and glibc/musl is less relevant. And even if it were, then feature detection by "configure" would still be preferable. Use AC_USE_SYSTEM_EXTENSIONS ([1]). Available since autoconf 2.60, from 2006 ([2]). [1] https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/Posix-Variants.html#index-AC_005fUSE_005fSYSTEM_005fEXTENSIONS-1046 [2] https://lists.gnu.org/archive/html/autoconf/2006-06/msg00111.html Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: don't define _GNU_SOURCE in public headerThomas Haller2023-08-251-1/+0
| | | | | | | | | | | | | | _GNU_SOURCE is supposed to be defined as first thing, before including any libc headers. Defining it in the public header of nftables is wrong, because it would only (somewhat) work if the user includes the nftables header as first thing too. But that is not what users commonly would do, in particular with autotools projects, where users would include <config.h> first. It's also unnecessary. Nothing in "nftables/libnftables.h" itself requires _GNU_SOURCE. Drop it. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add <nft.h> header and include it as firstThomas Haller2023-08-2554-13/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <config.h> is generated by the configure script. As it contains our feature detection, it want to use it everywhere. Likewise, in some of our sources, we define _GNU_SOURCE. This defines the C variant we want to use. Such a define need to come before anything else, and it would be confusing if different source files adhere to a different C variant. It would be good to use autoconf's AC_USE_SYSTEM_EXTENSIONS, in which case we would also need to ensure that <config.h> is always included as first. Instead of going through all source files and include <config.h> as first, add a new header "include/nft.h", which is supposed to be included in all our sources (and as first). This will also allow us later to prepare some common base, like include <stdbool.h> everywhere. We aim that headers are self-contained, so that they can be included in any order. Which, by the way, already didn't work because some headers define _GNU_SOURCE, which would only work if the header gets included as first. <nft.h> is however an exception to the rule: everything we compile shall rely on having <nft.h> header included as first. This applies to source files (which explicitly include <nft.h>) and to internal header files (which are only compiled indirectly, by being included from a source file). Note that <config.h> has no include guards, which is at least ugly to include multiple times. It doesn't cause problems in practice, because it only contains defines and the compiler doesn't warn about redefining a macro with the same value. Still, <nft.h> also ensures to include <config.h> exactly once. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: define _GNU_SOURCE to get strptime() from <time.h>Thomas Haller2023-08-251-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To use `strptime()`, the documentation indicates #define _XOPEN_SOURCE #include <time.h> However, previously this was done wrongly. For example, when building with musl we got a warning: CC meta.lo meta.c:40: warning: "_XOPEN_SOURCE" redefined 40 | #define _XOPEN_SOURCE | In file included from /usr/include/errno.h:8, from meta.c:13: /usr/include/features.h:16: note: this is the location of the previous definition 16 | #define _XOPEN_SOURCE 700 | Defining "__USE_XOPEN" is wrong. This is a glibc internal define not for the user. Note that if we just set _XOPEN_SOURCE (or _XOPEN_SOURCE=700), we won't get other things like "struct tm.tm_gmtoff". Instead, we already define _GNU_SOURCE at other places. Do that here too, it will give us strptime() and all is good. Also, those directives should be defined as first thing (or via "-D" command line). See [1]. This is also important, because to use "time_t" in a header, we would need to include <time.h>. That only works, if we get the feature test macros right. That is, define the _?_SOURCE macro as first thing. [1] https://www.gnu.org/software/libc/manual/html_node/Feature-Test-Macros.html Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: 30s-stress: add failslab and abort phase testsFlorian Westphal2023-08-241-15/+375
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo suggested to also cover abort phase by intentionally deleting non-existent or adding clashing keys. While at it: add rules with anon sets and jumps to anonymous chains and a few constant sets. Pick different key sizes so there is a higher chance kernel picks different backend storages such as bitmap or hash_fast. add failslab support, this also covers unlikely or "impossible" cases like failing GFP_KERNEL allocations. randomly spawn 'nft monitor' in the background for a random duration to cover notification path. Try to randomly delete a set or chain from control plane. Randomly set a table as dormant (and back to normal). Allow to pass the test runtime as argument, so one can now do ./30s-stress 3600 to have the test run for one hour. For such long test durations, make sure the ruleset gets regenerated periodically. Signed-off-by: Florian Westphal <fw@strlen.de>
* py: add Nftables.{get,set}_input_flags() APIThomas Haller2023-08-241-0/+43
| | | | | | | | | | | | | | | Similar to the existing Nftables.{get,set}_debug() API. Only notable (internal) difference is that nft_ctx_input_set_flags() returns the old value already, so we don't need to call Nftables.get_input_flags() first. The benefit of this API, is that it follows the existing API for debug flags. Also, when future flags are added it requires few changes to the python code. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: extract flags helper functions for set_debug()/get_debug()Thomas Haller2023-08-241-21/+31
| | | | | | | | | | | | | | | | | | | | | | | | | Will be re-used for nft_ctx_input_set_flags() and nft_ctx_input_get_flags(). There are changes in behavior here. - when passing an unrecognized string (e.g. `ctx.set_debug('foo')` or `ctx.set_debug(['foo'])`), a ValueError is now raised instead of a KeyError. - when passing an out-of-range integer, now a ValueError is no raised. Previously the integer was truncated to 32bit. Changing the exception is an API change, but most likely nobody will care or try to catch a KeyError to find out whether a flag is supported. Especially, since such a check would be better performed via `'foo' in ctx.debug_flags`. In other cases, a TypeError is raised as before. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: fix exception during cleanup of half-initialized NftablesThomas Haller2023-08-241-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we create a Nftables instance against an older library version, we might not find a symbol and fail with an exception when initializing the context object. Then, __del__() is still called, but resulting in a second exception because self.__ctx is not set. Avoid that second exception. $ python -c 'import nftables; nftables.Nftables()' Traceback (most recent call last): File "<string>", line 1, in <module> File "/data/src/nftables/py/nftables.py", line 90, in __init__ self.nft_ctx_input_get_flags = lib.nft_ctx_input_get_flags ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.11/ctypes/__init__.py", line 389, in __getattr__ func = self.__getitem__(name) ^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib64/python3.11/ctypes/__init__.py", line 394, in __getitem__ func = self._FuncPtr((name_or_ordinal, self)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ AttributeError: /lib64/libnftables.so.1: undefined symbol: nft_ctx_input_get_flags Exception ignored in: <function Nftables.__del__ at 0x7f6315a2c540> Traceback (most recent call last): File "/data/src/nftables/py/nftables.py", line 166, in __del__ self.nft_ctx_free(self.__ctx) ^^^^^^^^^^^^^^^^^ AttributeError: 'Nftables' object has no attribute 'nft_ctx_free' Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add input flag NFT_CTX_INPUT_JSON to enable JSON parsingThomas Haller2023-08-244-3/+16
| | | | | | | | | | | | | | By default, the input is parsed using the nftables grammar. When setting NFT_CTX_OUTPUT_JSON flag, nftables will first try to parse the input as JSON before falling back to the nftables grammar. But NFT_CTX_OUTPUT_JSON flag also turns on JSON for the output. Add a flag NFT_CTX_INPUT_JSON which allows to treat only the input as JSON, but keep the output mode unchanged. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add input flag NFT_CTX_INPUT_NO_DNS to avoid blockingThomas Haller2023-08-246-31/+67
| | | | | | | | | | | | | | | | | | | getaddrinfo() blocks while trying to resolve the name. Blocking the caller of the library is in many cases undesirable. Also, while reconfiguring the firewall, it's not clear that resolving names via the network will work or makes sense. Add a new input flag NFT_CTX_INPUT_NO_DNS to opt-out from getaddrinfo() and only accept plain IP addresses. We could also use AI_NUMERICHOST with getaddrinfo() instead of inet_pton(). By parsing via inet_pton(), we are better aware of what we expect and can generate a better error message in case of failure. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add input flags for nft_ctxThomas Haller2023-08-245-0/+42
| | | | | | | | | | | | Similar to the existing output flags, add input flags. No flags are yet implemented, that will follow. One difference to nft_ctx_output_set_flags(), is that the setter for input flags returns the previously set flags. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gitignore: ignore cscope filesThomas Haller2023-08-231-0/+3
| | | | | | | Cscope is useful. Ignore the files it creates. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: use minutes granularity in sets/0036add_set_element_expiration_0Pablo Neira Ayuso2023-08-231-2/+6
| | | | | | | Use minute granularity to fix bogus failures of this test on slow testbed. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: error out on meter overlap with an existing set/map declarationPablo Neira Ayuso2023-08-231-0/+18
| | | | | | | | | | | | | | | | | | | One of the problems with meters is that they use the set/map infrastructure behind the scenes which might be confusing to users. This patch errors out in case user declares a meter whose name overlaps with an existing set/map: meter.nft:15:18-91: Error: File exists; meter ‘syn4-meter’ overlaps an existing set ‘syn4-meter’ in family inet tcp dport 22 meter syn4-meter { ip saddr . tcp dport timeout 5m limit rate 20/minute } counter accept ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ An old 5.10 kernel bails out simply with EEXIST, with this patch a better hint is provided. Dynamic sets are preferred over meters these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: chain listing implicitly sets on terse optionPablo Neira Ayuso2023-08-231-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If user specifies a chain to be listed (which is internally handled via filtering options), then toggle NFT_CACHE_TERSE to skip fetching set content from kernel for non-anonymous sets. With a large IPv6 set with bogons, before this patch: # time nft list chain inet raw x table inet raw { chain x { ip6 saddr @bogons6 ip6 saddr { aaaa::, bbbb:: } } } real 0m2,913s user 0m1,345s sys 0m1,568s After this patch: # time nft list chain inet raw prerouting table inet raw { chain x { ip6 saddr @bogons6 ip6 saddr { aaaa::, bbbb:: } } } real 0m0,056s user 0m0,018s sys 0m0,039s This speeds up chain listing in the presence of a large set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Stabilize sets/0043concatenated_ranges_0 testPhil Sutter2023-08-231-2/+6
| | | | | | | | | | | On a slow system, one of the 'delete element' commands would occasionally fail. Assuming it can only happen if the 2s timeout passes "too quickly", work around it by adding elements with a 2m timeout instead and when wanting to test the element expiry just drop and add the element again with a short timeout. Fixes: 6231d3fa4af1e ("tests: shell: Fix for unstable sets/0043concatenated_ranges_0") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: Stabilize sets/reset_command_0 testPhil Sutter2023-08-231-39/+48
| | | | | | | | | | | | | | | | | | Timeout/expiry value testing based on seconds is way too fragile, especially with slow debug kernels. Rewrite the unit to test minute-based values. This means it is no longer feasible to wait for values to sufficiently change, so instead specify an 'expires' value when creating the ruleset and drop the 'sleep' call. While being at it: - Combine 'get element' and 'reset element' calls into one, assert the relevant (sanitized) line appears twice in output instead of comparing with 'diff'. - Turn comments into 'echo' calls to help debugging if the test fails. Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc>
* meta: use reentrant localtime_r()/gmtime_r() functionsThomas Haller2023-08-221-19/+22
| | | | | | | | | | These functions are POSIX.1-2001. We should have them in all environments we care about. Use them as they are thread-safe. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: don't assume time_t is 64 bit in date_type_print()Thomas Haller2023-08-221-5/+8
| | | | | | | | | time_t on 32bit arch is not uint64_t. Even if it always were, it would be ugly to make such an assumption (without a static assert). Copy the value to a time_t variable first. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* INSTALL: provide examples to install python bindingsPablo Neira Ayuso2023-08-211-3/+9
| | | | | | | | | Provide a bit more details on how to install python bindings with legacy setup.py and pip with .toml file. Original text from Jeremy Sowden <jeremy@azazel.net>. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftutils: add and use wrappers for getprotoby{name,number}_r(), ↵Thomas Haller2023-08-207-30/+161
| | | | | | | | | | | | | | | getservbyport_r() We should aim to use the thread-safe variants of getprotoby{name,number} and getservbyport(). However, they may not be available with other libc, so it requires a configure check. As that is cumbersome, add wrappers that do that at one place. These wrappers are thread-safe, if libc provides the reentrant versions. Use them. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: use strtok_r() instead of strtok()Thomas Haller2023-08-181-2/+3
| | | | | | | | | strtok_r() is probably(?) everywhere available where we care. Use it. It is thread-safe, and libnftables shouldn't make assumptions about what other threads of the process are doing. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: update bad_expression test caseFlorian Westphal2023-08-171-0/+9
| | | | | | | | Check that the ruleset also fails to validate if there is another table that passes validation checks. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add table validation checkFlorian Westphal2023-08-171-0/+29
| | | | | | | | | | Pablo noticed problems with commit validation, investigation shows nfnetlink can retry forever in infinite -EAGAIN cycle, test for this. The process is killable, this only hogs cpu. Add a test for this. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add one more chain jump in vmap testFlorian Westphal2023-08-151-0/+5
| | | | | | | | | | | This triggers a splat on kernels that lack 314c82841602 ("netfilter: nf_tables: can't schedule in nft_chain_validate"). There is another test case that triggers this splat (optimize/ruleset), but that test uses some more advanced features that don't exist on older kernels, so the splat is never seen. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add transaction stress test with parallel delete/add/flush and netns ↵Florian Westphal2023-08-151-0/+225
| | | | | | | | | | deletion Based on nft_trans_stress.sh from kernel selftests, changed to run from run-tests.sh, plus additional ideas from Pablo Neira, such as del+readd of the netns. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test with concatenation, vmap and timeoutFlorian Westphal2023-08-132-0/+62
| | | | | | | | | Add 4k elements to map, with timeouts in range 1..3s, also add a catchall element with timeout. Check that all elements are no longer included in set list after 4s. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: add test case for double-deactivationFlorian Westphal2023-08-122-0/+15
| | | | | Reported-by: lonial con <kongln9170@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: move man-pages to `MAINTAINERCLEANFILES`Jeremy Sowden2023-08-101-1/+1
| | | | | | | | Since the man-pages are built and included in the distribution tar-balls, the appropriate clean target is `maintainer-clean`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: move man-pages to `dist_man_MANS`Jeremy Sowden2023-08-101-3/+3
| | | | | | | Removes the need to add them to `EXTRA_DIST`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: Review test-cases for destroy commandPhil Sutter2023-08-0315-65/+32
| | | | | | | | | | | | | | Having separate files for successful destroy of existing and non-existing objects is a bit too much, just combine them into one. While being at it: * No bashisms, using /bin/sh is fine * Append '-e' to shebang itself instead of calling 'set' * Use 'nft -a -e' instead of assuming the created rule's handle value * Shellcheck warned about curly braces, quote them Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser: deduplicate map with data intervalFlorian Westphal2023-08-031-13/+7
| | | | | | | | | | Its copypasted, the copy is same as original except that it specifies a map key that maps to an interval. Add an exra rule that returns 0 or EXPR_F_INTERVAL, then use that in a single rule. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: allow ct timeouts to use time_spec valuesFlorian Westphal2023-08-035-9/+16
| | | | | | | | | | | | | | | For some reason the parser only allows raw numbers (seconds) for ct timeouts, e.g. ct timeout ttcp { protocol tcp; policy = { syn_sent : 3, ... Also permit time_spec, e.g. "established : 5d". Print the nicer time formats on output, but retain raw numbers support on input for compatibility. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add dynmap datapath add/delete test caseFlorian Westphal2023-08-032-0/+57
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: document add chain device parameterBrennan Paciorek2023-08-031-0/+5
| | | | | | | | | | | nft add chain lacked documentation of its optional device parameter, specifically what values the parameter accepted, what it did and when to use it. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1093 Suggested-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Brennan Paciorek <bpaciore@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: add pyproject.toml to support PEP-517-compatible build-systemsJeremy Sowden2023-08-033-2/+6
| | | | | | | | | | | | | This makes it possible to build and install the module without directly invoking setup.py which has been deprecated. Retain the setup.py script for backwards-compatibility. Update INSTALL to mention the new config-file. Link: https://blog.ganssle.io/articles/2021/10/setup-py-deprecated.html Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: use setup.cfg to configure setuptoolsJeremy Sowden2023-08-033-22/+27
| | | | | | | | | | | | | | | | | | Setuptools has had support for declarative configuration for several years. To quote their documentation: Setuptools allows using configuration files (usually setup.cfg) to define a package’s metadata and other options that are normally supplied to the setup() function (declarative config). This approach not only allows automation scenarios but also reduces boilerplate code in some cases. Additionally, this allows us to introduce support for PEP-517-compatible build-systems. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: move package source into src directoryJeremy Sowden2023-08-035-2/+2
| | | | | | | | | Separate the actual package source from the build files. In addition to being a bit tidier, this will prevent setup.py being erroneously installed when we introduce PEP-517 support in a later commit. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>