summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: shell: add crash reproducerFlorian Westphal2018-06-071-0/+4
| | | | | | | | | | | | | | | | | | | Two reports point to a crash in nft when 'flush' is provided on existing ruleset. In that case, nft will crash with a null-ptr dereference. "evaluate: do not inconditionally update cache from flush command" causes the commit to fail due to a cache inconsistency, we then trip over NULL location->indesc. Cause of 2nd bug not known yet, not sure how to fix cache issue either, so only adding reproducer so this can be fixed later. Without erec bug, the (errnoeous) error message would be Could not process rule: File exists Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name> Reported-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: do not reset generation ID on ruleset flushPablo Neira Ayuso2018-06-073-4/+24
| | | | | | | | If 'flush ruleset' command is done, release the cache but still keep the generation ID around. Hence, follow up calls to cache_update() will assume that cache is updated and will not perform a netlink dump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: py: Add test cases for socket matchingMáté Eckl2018-06-062-0/+39
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: update linux/netfilter_ipv4.hMáté Eckl2018-06-061-4/+10
| | | | | | | | | | | Update file from <kerneldir>/usr/include/linux/netfilter_ipv4.h. Reasons: - New values have been introduced in nf_ip_hook_priorities. - include limits.h was missing Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Introduce socket matchingMáté Eckl2018-06-0610-0/+176
| | | | | | | | | | | | | | | | For now it can only match sockets with IP(V6)_TRANSPARENT socket option set. Example: table inet sockin { chain sockchain { type filter hook prerouting priority -150; policy accept; socket transparent 1 mark set 0x00000001 nftrace set 1 counter packets 9 bytes 504 accept } } Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: extend fwd statement to support address and familyPablo Neira Ayuso2018-06-069-20/+124
| | | | | | | | Allow to forward packets through to explicit destination and interface. nft add rule netdev x y fwd ip to 192.168.2.200 device eth0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: connlimit supportPablo Neira Ayuso2018-06-067-3/+102
| | | | | | | | | | | | | | This patch adds support for the new connlimit stateful expression, that provides a mapping with the connlimit iptables extension through meters. eg. nft add rule filter input tcp dport 22 \ meter test { ip saddr ct count over 2 } counter reject This limits the maximum amount incoming of SSH connections per source address up to 2 simultaneous connections. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nat: Eliminate misuse of AF_*Máté Eckl2018-06-062-5/+5
| | | | | | | | | Although the value of AF_INET and NFPROTO_IPV4 is the same, the use of AF_INET was misleading when checking the proto family. Same with AF_INET6. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: explicitly deny concatenated types in interval setsPhil Sutter2018-06-061-0/+4
| | | | | | | | | | | | | | | | | | | | | Previously, this triggered a program abort: | # nft add table ip t | # nft add set ip t my_set '{ type ipv4_addr . inet_service ; flags interval ; }' | # nft add element ip t my_set '{10.0.0.1 . tcp }' | BUG: invalid range expression type concat | nft: expression.c:1085: range_expr_value_low: Assertion `0' failed. With this patch in place, the 'add set' command above gives an error message: | # nft add set ip t my_set3 '{ type ipv4_addr . inet_service ; flags interval ; }' | Error: concatenated types not supported in interval sets | add set ip t my_set3 { type ipv4_addr . inet_service ; flags interval ; } | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft.8: Fix reject statement documentationPhil Sutter2018-06-061-5/+5
| | | | | | | | | | First of all, 'with icmp6' is invalid, expected is 'with icmpv6'. In addition to that, parameter 'type' expects an icmp*_code type, not icmp*_type. The respective table column was already correct, but in synopsis it was wrong. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure.ac: fix typo in docbook2x error messageFernando Fernandez Mancera2018-06-051-1/+1
| | | | | | | The correct name is "docbook2x-man" not "docbookx2-man". Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* log: Add support for audit loggingPhil Sutter2018-06-037-3/+36
| | | | | | | | | | | This is implemented via a pseudo log level. The kernel ignores any other parameter, so reject those at evaluation stage. Audit logging is therefore simply a matter of: | log level audit Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: ip6/flowtable.t: Add missing JSON expected outputPhil Sutter2018-06-031-0/+62
| | | | | | | The output differs from input in added size property. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Review large number parsing/printingPhil Sutter2018-06-032-25/+29
| | | | | | | | | When parsing large (uint64_t) values, capital 'I' has to be used in format string. While being at it, make sure JSON output code handles those variables correctly, too. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Fix replace command parserPhil Sutter2018-06-031-1/+2
| | | | | | | | This was completely broken. Yet another indicator the JSON API part of testsuite is insufficient. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Fix add rule with indexPhil Sutter2018-06-031-1/+1
| | | | | | | | | This was missed by commit fb557b5546084 ("JSON: Sort out rule position and handles in general"): When adding a rule, the parser would still expect "pos" property instead of "index". Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify verdict statement parsingPhil Sutter2018-06-031-36/+3
| | | | | | | | Reuse verdict expression parsing routine. Since the statement simply wraps an expression, this change is an obvious one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify wildcard expressionPhil Sutter2018-06-031-12/+11
| | | | | | | | Instead of dedicating an object for it ('{ "*": null }'), just use a string consisting of an asterisk as sole character. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Merge wildcard_rhs_expr and wildcard_stmt_exprPhil Sutter2018-06-031-18/+7
| | | | | | | | The two are absolutely identical, just referenced at different places. Since there is no need for the distinction, just merge them into one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing JSON equivalent for rule in inet/tcp.tPhil Sutter2018-06-011-0/+16
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Add missing JSON equivalent for inet/sets.tPhil Sutter2018-06-011-0/+37
| | | | | | | | | This adds the missing JSON variant for the two rules which are supposed to work. Fixes: 2efbdf7b8fcf7 ("tests: py: allow to specify sets with a timeout") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/py: Adjust JSON for changes in any/ct.tPhil Sutter2018-06-012-4/+94
| | | | | | | | | | Commit 71624f25f22b1 ("tests: py: add expires tests with different time bases") removed two testcases and added five other ones, adjust JSON equivalent and recorded output to those changes. Fixes: 71624f25f22b1 ("tests: py: add expires tests with different time bases") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify immediate value parsingPhil Sutter2018-06-011-45/+31
| | | | | | | | | | | | | | | Since an explicit "immediate" expression doesn't exist in JSON (the values are represented as plain JSON string/integer/boolean types), there is no need for json_parse_immediate_expr() to comply to the common expression parser parameter format. Apart from that: * Drop CTX_F_RHS checks - caller assures sane context already. * Improve error message a bit for denied JSON types. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Fix parsing of meter statement keyPhil Sutter2018-06-011-2/+2
| | | | | | | | | The key must be a set elem expression, but if a "regular" expression was provided (which should be commonly accepted in case no set elem specific properties are required), the resulting object tree crashed libnftables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Improve prefix expression parsing error message a bitPhil Sutter2018-06-011-1/+1
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Simplify tcp option expression parsing a bitPhil Sutter2018-06-011-3/+2
| | | | | | | | When parsing the optional "field" property, use return code of json_unpack() directly to check if it was present or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Fix parsing and printing of limit objectsPhil Sutter2018-06-012-44/+48
| | | | | | | | Fix parsing and printing of named limit objects by aligning the code with parser/printer of anonymous ones. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Review set elem expressionsPhil Sutter2018-06-015-17/+34
| | | | | | | | | | | | * There is no need to prefix element-specific properties with 'elem_', they can't conflict. * In json_parse_set_stmt(), searching for above properties is pointless since that's already done by called function. * Fix potential NULL-pointer deref in json_parse_set_elem_expr_stmt(): json_parse_flagged_expr() may return NULL. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Review meter statement supportPhil Sutter2018-06-012-7/+9
| | | | | | | | | Meter name being optional seems to come from old flow statement, so don't support this. Also add size support as was recently added to standard syntax. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Sort out rule position and handles in generalPhil Sutter2018-06-013-37/+24
| | | | | | | | | | | | | | | | | | | | | | | | First of all, don't print the position property when listing rules. This was there only because libnftnl JSON output has it too, but since the preferred way to *add* a rule at some location is via 'handle' keyword, keeping "position" in output would be non-intuitive. Changing "position" property name to "handle" instead is also a no-go since that would clash with the real rule handle. Secondly, turn all handle output on regardless of octx->handle setting. For a programmatic API like JSON, this should be fine. Thirdly, fix rule locations when parsing JSON: Respect "handle" property for CMD_INSERT and CMD_ADD and ignore "pos" at all (actually even a typo, should have read "position"). Also support "index" property recently added to standard syntax. Finally, adjust nft-test.py for the above changes: There is no "position" property to drop from rule output, and "handle" property will always be present. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Disallow non-array concat expression valuesPhil Sutter2018-06-011-3/+1
| | | | | | | | Concat expressions with just a single element don't make sense, so there's no point in supporting a shorter syntax for this. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Use "type" for CT helper objectPhil Sutter2018-06-012-3/+3
| | | | | | | Property name "helper" was a bit unclear, "type" is better. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* objref: Use "ct helper" for NFT_OBJECT_CT_HELPERPhil Sutter2018-06-013-4/+4
| | | | | | | | | Change name of NFT_OBJECT_CT_HELPER in objref_type table to "ct helper" for consistency. Note that this is not used in regular nft output since objref_stmt_print() treats this object type separately. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: old kernels are allowing burst zero, don't print itPablo Neira Ayuso2018-05-301-1/+1
| | | | | | | | Don't print limit burst zero which was the default value in old kernels, this is not allowed in more recent kernels that now operate like iptables xt_limit which is what users are expecting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: remove nft_objref module on cleanupPablo Neira Ayuso2018-05-301-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: don't print burst if equals 5Pablo Neira Ayuso2018-05-291-1/+1
| | | | | | | This is the default value we use if not specified, don't print it just like we do in iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meters: do not set a defaut meter size from userspaceFlorian Westphal2018-05-297-10/+10
| | | | | | | doing this breaks with older kernels as it will pick a set without and update callback. Signed-off-by: Florian Westphal <fw@strlen.de>
* include: update nf_tables.hMáté Eckl2018-05-291-7/+89
| | | | | | | | | | | It seems tracing ABI got broken because the header file has been manually updated. Joint work with Pablo. Fixes: 0f8302635ad3 ("src: print 'handle' attribute in tables") Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix race in deleting elementPablo Neira Ayuso2018-05-251-1/+1
| | | | | | | | | Sometimes we may hit this because script is too slow to remove the element with timeout from the set. inet/sets.t: ERROR: line 18: I cannot delete element dead::beef timeout 1s from the set set2 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: incorrect handling of comments and timeouts with mappingPablo Neira Ayuso2018-05-251-21/+46
| | | | | | | | | Check if expression is a mapping to do the right handling. Fixes: 35fedcf540bf ("segtree: missing comments in range and prefix expressions in sets") Fixes: be90e03dd1fa ("segtree: add timeout for range and prefix expressions in sets") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix printing of "tcp flags syn" and "tcp flags == syn" expressionsSabrina Dubroca2018-05-254-1/+14
| | | | | | | | | | | | | | | | | | | | | | Commit 6979625686ec ("relational: Eliminate meta OPs") introduced some bugs when printing bitmask types. First, during the post-processing phase of delinearization, the expression for "tcp flags syn" (PAYLOAD & flag != 0) gets converted to PAYLOAD == flag, which is not equivalent. This should be PAYLOAD (IMPL) flag. Then, during output, the "==" sign from "tcp flags == syn" is dropped, because the bitmask condition in must_print_eq_op() was removed. Let's restore it, so that "tcp flags == syn" doesn't get printed as "tcp flags syn". An extra check for value types is added, so that we don't start printing "==" for sets such as "tcp flags {syn,ack}" Finally, add a regression test for this particular case. Fixes: 6979625686ec ("relational: Eliminate meta OPs") Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* segtree: add timeout for range and prefix expressions in setsPablo Neira Ayuso2018-05-241-0/+10
| | | | | | | | | | | | | | | | # nft add table x # nft add set x y { type ipv4_addr\; flags timeout,interval\; } # nft add element x y { 7.4.4.5-8.8.8.8 comment "good guy" timeout 30s} # nft list ruleset table ip x { set y { type ipv4_addr flags interval,timeout elements = { 7.4.4.5-8.8.8.8 timeout 30s expires 27s956ms comment "good guy" } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: chain dependency validation with mapsPablo Neira Ayuso2018-05-231-0/+10
| | | | | | | Just like 4b6fb07de07a ("tests: shell: more chain dependency validation") but test chain dependency in jumps from maps. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: non-base chain loopsPablo Neira Ayuso2018-05-231-0/+10
| | | | | | Detect more non-base chain loops. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: more chain dependency validationPablo Neira Ayuso2018-05-231-0/+10
| | | | | | | More exercising for the chain dependency validation. Reported-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft.8: Document limitation of reject statement in bridge familyPhil Sutter2018-05-171-0/+4
| | | | | | | | Bridge family allows reject statement in prerouting and input chains only. Users can't know without looking at kernel code. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Make diff functions use print_* functionsMáté Eckl2018-05-171-6/+4
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Added paylad file description to READMEMáté Eckl2018-05-171-3/+26
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: print path of the logfileMáté Eckl2018-05-172-1/+6
| | | | | | | | | | It is good to know that a log is generated even without browsing the nft-test.py source code. Also print_info function is introduced. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: print_msg refactorMáté Eckl2018-05-171-6/+8
| | | | | | | | | | | | | | | The errstr attribute was hard-coded to "ERROR:" errstr has been moved in the parameter list. As print_msg is only used from the other print_* this is not an issue, and as there is a print_error function, I don't think that strerr should default to "ERROR:". Also this kind of messages now get written to stderr. This can be beneficial if someone wants to redirect output to a file. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>