summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: expose table flagsPablo Neira Ayuso2015-03-176-5/+69
| | | | | | | | | | | | | | | | | | | The nf_tables kernel API provides a way to disable a table using the dormant flag. This patch adds the missing code to expose this feature through nft. Basically, if you want to disable a table and all its chains from seen any traffic, you have to type: nft add table filter { flags dormant\; } to re-enable the table, you have to: nft add table filter this clears the flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix typo in READMEEric Leblond2015-03-021-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: display errors through stderrPablo Neira Ayuso2015-03-021-1/+1
| | | | | Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1000 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix object order via nft -fPablo Neira Ayuso2015-02-181-2/+7
| | | | | | | | | | | | | | | | | | The objects need to be loaded in the following order: #1 tables #2 chains #3 sets #4 rules We have to make sure that chains are in place by when we add rules with jumps/gotos. Similarly, we have to make sure that the sets are in place by when rules reference them. Without this patch, you may hit ENOENT errors depending on your ruleset configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: register pkttype_type datatypePablo Neira Ayuso2015-02-012-1/+2
| | | | | Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=995 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use stmt_evaluate_arg() in all casesPatrick McHardy2015-01-121-4/+3
| | | | | | | | | When using a symbolic vmap expression, we fail to verify that the map actually contains verdicts. Use stmt_evaluate_arg() everywhere to fix this. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: check that map expressions' datatype matches mappingsPatrick McHardy2015-01-121-0/+7
| | | | | | | | | | | | Catch type errors in map expressions using named maps: # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set tcp dport map @test <cmdline>:1:38-42: Error: datatype mismatch, map expects IPv4 address, mapping expression has type internet network service filter output mark set tcp dport map @test ~~~~~~~~~ ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: properly set datatype of map expressionPatrick McHardy2015-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | The datatype of the map expression is the datatype of the mappings. # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set ip daddr map @test Before: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type IPv4 address filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type internet network service filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: verify named map is actually a mapPatrick McHardy2015-01-121-1/+2
| | | | | | | | | | | | | | | | | | | # nft add set filter test { type ipv4_addr; } # nft filter input ip daddr vmap @test Before: <cmdline>:0:0-32: Error: Could not process rule: Invalid argument filter input ip daddr vmap @test ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:28-32: Error: Expression is not a map filter input ip daddr vmap @test ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: don't print meta keyword for unqualified meta stmtsPatrick McHardy2015-01-121-7/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: clean up unused variables (pctx)Alvaro Neira Ayuso2015-01-121-3/+0
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: fix crash when listing non-verdict mappingsPatrick McHardy2015-01-121-0/+6
| | | | | | | | | | | | | | | | Fix regression introduced by commit 87c2a2205: netlink_delinearize: clone on netlink_get_register(), release previous on _set() When using a non-verdict mapping, the set ref expression is assigned to the destination register. The next get_register() will attempt to clone it and crash because of the missing ->clone() callback. # nft filter input meta mark set ip daddr map { 192.168.0.1 : 123 } # nft list table filter Segmentation fault (core dumped) Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: remove unused set_clone() functionPatrick McHardy2015-01-122-19/+0
| | | | | | | | The set_clone() function was added by the event monitor patchset and is unused. It is also broken since it simply initializes the list head to the list of the original set, so remove it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: properly fix handling of large integer valuesPatrick McHardy2015-01-112-16/+3
| | | | | | | | | | | | | | | Introduction of the ERROR symbol is an ugly hack. There's no reason to special case large integer values, the NUM token only exists for small values that are needed immediately, everything else is passed as EXPR_SYMBOL to evaluation anyways. Additionally the error reporting is different from what we'd usually report, the token is easy to confuse with the bison internal error token and it even has a name, messing up bison internal diagnostics. Simply return values to large to be handled by strtoull as STRING. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_linearize: add register dumping helper functionPatrick McHardy2015-01-111-34/+40
| | | | | | | Add a helper function to dump netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: add register parsing helper functionPatrick McHardy2015-01-111-20/+26
| | | | | | | Add a helper function to parse netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* concat: add concat subtype lookup/id helpersPatrick McHardy2015-01-114-10/+22
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: cleanup hard to read codePatrick McHardy2015-01-111-60/+79
| | | | | | | | | | | The netlink parsing code is full of long function calls spawning multiple lines and in some cases parses netlink attributes multiple times. Use local variables for the registers and other data required to reconstruct the expressions and statements and reorder the code in some cases to move related processing next to each other. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: rename netlink_parse_*_sreg/dreg functionsPatrick McHardy2015-01-111-8/+8
| | | | | | These are really badly chosen names, use parse_expr and parse_stmt instead. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: readability fixesPatrick McHardy2015-01-111-56/+71
| | | | | | | | | Improve readability by using local variables for netlink attributes, ordering variables more logically, don't arbitrarily initialize some variables in the definition section and in the body and generally make similar functions look similar. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-24/+15
| | | | | | | | | Remove style discrepancies between different netlink I/O functions: - we don't use brackets for single line statements - most functions don't have a newline between error reporting and exit Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: style fixesPatrick McHardy2015-01-111-12/+18
| | | | | | We include an empty line between variable definitions and code. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: remove unnecessary temporary variablePatrick McHardy2015-01-111-54/+18
| | | | | | | Waste less space and return the results of the batch/compat functions directly. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix memory leaksPatrick McHardy2015-01-112-1/+6
| | | | | | | Fix two memory leaks in netlink event monitor. Also fix a leak related to all sets, the ->init expression is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: fix error handling for invalid registersPatrick McHardy2015-01-101-1/+4
| | | | | | | | | | | netlink_delinearize is prepared to deal with malformed expressions from the kernel that it doesn't understand. However since expressions are now cloned unconditionally by netlink_get_register(), we crash before such errors can be detected for invalid inputs. Fix by only cloning non-NULL expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: add missing datatype compat checks for statement argumentsPatrick McHardy2015-01-101-23/+43
| | | | | | | | | | | | | | Add a helper function to evaluate expressions used as arguments for statements and report datatype mismatches. Fixes acceptance of mismatching expressions like: $ nft filter output meta mark set ip daddr <cmdline>:1:29-36: Error: datatype mismatch: expected packet mark. expression has type IPv4 address filter output meta mark set ip daddr ~~~~~~~~~~~~~~^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* eval: refactor NAT evaluation functionsPatrick McHardy2015-01-101-56/+54
| | | | | | | | | | The redir and masq evaluation functions include some useless context updates and checks. Refactor the NAT code to have a single instance of address and transport evaluation functions for simplicity and unified error reporting. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: modify pr_debug() to use printf and introduce to pr_gmp_debug()Pablo Neira Ayuso2015-01-082-13/+19
| | | | | | | | | | | | | Modify pr_debug() to use printf so we get debugging traces for proto-ctx when --with-mini-gmp is enabled. Add pr_gmp_debug(), this is disabled with --with-mini-gmp since it relies on the gmp_printf(), which is not available in the mini-gmp implementation. Suggested by Patrick. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use -Wno-sign-compare to avoid compilation warning in mini-gmp.cPablo Neira Ayuso2015-01-081-0/+2
| | | | | | | | | | | | | | | | CC mini-gmp.o mini-gmp.c: In function ‘mpn_get_str_bits’: mini-gmp.c:1176:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_and’: mini-gmp.c:3650:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_ior’: mini-gmp.c:3723:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_xor’: mini-gmp.c:3792:8: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] mini-gmp.c: In function ‘mpz_set_str’: mini-gmp.c:4167:17: warning: comparison between signed and unsigned integer expressions [-Wsign-compare] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add --with-mini-gmp switch to disable linking libgmpSteven Barth2015-01-089-9/+4770
| | | | | | | | | | This allows to disable linking the >400 KB big libgmp and replace it with the builtin mini-gmp which only increases size by ~30KB. Enabling this selectively decreases debugging verbosity (pr_debug). Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add a reference to the wiki page in the man pageArturo Borrero2015-01-071-0/+3
| | | | | | | | Let's add a pointer in the man page to the wiki page. Requested-by: Dan Jacobson <jidanni@jidanni.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: use stdio vasprintf instead of gmp_vasprintfSteven Barth2015-01-072-3/+11
| | | | | | | | | Use stdio's vasprintf instead of gmp_vasprintf which is not part of the mini-gmp function subset. Furthermore convert the only gmp-specific user and allow the compiler to verify format-strings. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: use mpz_set_str instead of gmp_sscanfSteven Barth2015-01-071-3/+1
| | | | | | | | This simplifies the integer parsing logic and restricts it to functions being part of the mini-gmp subset. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: rename VERSION token to HDRVERSIONSteven Barth2015-01-072-4/+4
| | | | | | | | | A token name of VERSION results in a macro being defined with the same name. This prevents inclusion of config.h in commonly used headers. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix dependency generation from nft -fPablo Neira Ayuso2015-01-062-1/+4
| | | | | | | | | | | | | | | When nft -f is used, ctx->cmd points to the table object, which contains the corresponding chain, set and rule lists. The reject statement evaluator relies on ctx->cmd->rule to add the payload dependencies, which is doesn't point to the rule in that case. This patch adds the rule context to the eval_ctx structure to update the rule list of statements when generating dependencies, as the reject statement needs. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=993 Reported-by: Ting-Wei Lan <lantw44@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: assert when accessing inner transport headerPablo Neira Ayuso2015-01-041-0/+1
| | | | | | | | | | Instead of segfaulting due to out of bound access access to protocol context array ctx->protocol[base].location from proto_ctx_update(). # nft add rule filter input ah nexthdr tcp nft: payload.c:88: payload_expr_pctx_update: Assertion `left->payload.base + 1 <= (__PROTO_BASE_MAX - 1)' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: revisit chain testsPablo Neira Ayuso2014-12-224-14/+8
| | | | | | | | Make sure support chain don't stop working. Remove some minor mistakes and out of scope tests from chain*.t Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: named sets workPablo Neira Ayuso2014-12-221-4/+3
| | | | | | Those tests work already, enable them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: alloc specifying concat types in set declarationsPatrick McHardy2014-12-162-22/+43
| | | | | | | | | | | | Support specification of concat types in set declarations: add set filter test { type ipv4_addr . inet_service } Netlink delinearization is changed to reconstruct the type from the id. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: change concat_type_alloc() to construct type from idPatrick McHardy2014-12-163-15/+19
| | | | | | | The kernel only stored the id so we need to be able to reconstruct the datatype from the id only. Signed-off-by: Patrick McHardy <kaber@trash.net>
* utils: add fls()Patrick McHardy2014-12-161-0/+37
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add define for maximum number of bits and mask of datatype idPatrick McHardy2014-12-163-2/+6
| | | | | | | | | | | | | | | | | The id of concat datatypes is composed of the ids of the individual datatypes. Add a define for the number of bits for each datatype id and a mask. The number of bits is chosen as 6, allowing for 63 datatypes, or twice as much as we currently have. This allows for concatenations of 5 types using 32 bits. The value is statically chosen instead of basing it on the current numbers of datatypes since we don't want the maximum concatenation size to vary between versions, also new versions are supposed to be able to propery parse a ruleset generated by an older version. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add new subtypes field to account number of concat data typesPatrick McHardy2014-12-163-5/+11
| | | | | | | | Using the size is confusing since it usually holds the size of the data. Add a new "subtypes" member, which holds the number of datatypes the concat type is made of. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: generate name for concat typesPatrick McHardy2014-12-161-1/+7
| | | | | | | The name of a concat type is the names of the individual types concatenated using a '.'. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Bump version to v0.4v0.4Pablo Neira Ayuso2014-12-151-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: missing byteorder in string_typePablo Neira Ayuso2014-12-151-0/+1
| | | | | | | | | | | | | | nft add rule filter input iifname { "lo", "eth0" } counter Now the listing shows: iifname { "lo", "eth0"} instead of: iifname { "", ""} Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: restore --disable-debugPablo Neira Ayuso2014-12-152-5/+10
| | | | | | | | Fix fallout from the automake conversion. Display after configuration if it is enabled or not. Reported-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: log.t: this works for bridge and arp since 3.17Pablo Neira Ayuso2014-12-141-5/+4
| | | | | | | So tests log statement for those two families too and remove the tests/selectors that are ip and ip6 specific, they don't belong here. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: simplify run_test_file() in case `-e' is usedPablo Neira Ayuso2014-12-141-15/+1
| | | | | | | Avoid copy&paste coding style pattern by simplifying the code that handles the `-e' option that allows us to run known broken tests. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: regression: fix wrong number of test filesPablo Neira Ayuso2014-12-141-1/+2
| | | | | | Always increment the test file counter for each test file in the list. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>