summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* evaluate: init cmd pointer for new on-stack contextFlorian Westphal2022-03-042-0/+7
| | | | | | | else, this will segfault when trying to print the "table 'x' doesn't exist" error message. Signed-off-by: Florian Westphal <fw@strlen.de>
* optimize: do not assume log prefixPablo Neira Ayuso2022-03-043-3/+14
| | | | | | ... log prefix might not be present in log statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: do not merge unsupported statement expressionsPablo Neira Ayuso2022-03-031-0/+21
| | | | | | Only value, range, prefix, set and list are supported at this stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: incorrect assert() for unexpected expression typePablo Neira Ayuso2022-03-031-3/+3
| | | | | | | assert(1) is noop, this should be assert(0) instead. Fixes: 561aa3cfa8da ("optimize: merge verdict maps with same lookup key") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: more robust statement merge with vmapPablo Neira Ayuso2022-03-033-3/+18
| | | | | | | | | | | | | | Check expressions that are expected on the rhs rather than using a catch-all default case. Actually, lists and sets need to be their own routine, because this needs the set element key expression to be merged. This is a follow up to 99eb46969f3d ("optimize: fix vmap with anonymous sets"). Fixes: 1542082e259b ("optimize: merge same selector with different verdict into verdict map") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: fix vmap with anonymous setsPablo Neira Ayuso2022-03-033-2/+14
| | | | | | | | | | | | | | | | The following example ruleset crashes: table inet a { chain b { tcp dport { 1 } accept tcp dport 2-3 drop } } because handling for EXPR_SET is missing. Fixes: 1542082e259b ("optimize: merge same selector with different verdict into verdict map") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: Fix for ipportmap nat statementsPhil Sutter2022-03-021-1/+1
| | | | | | | | Due to lookahead, "addr" keyword is still found in IP/IP6 scope, not STMT_NAT one. Fixes: a67fce7ffe7e4 ("scanner: nat: Move to own scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: dup, fwd, tproxy: Move to own scopesPhil Sutter2022-03-013-7/+16
| | | | | | With these three scopes in place, keyword 'to' may be isolated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: meta: Move to own scopePhil Sutter2022-03-013-7/+10
| | | | | | | This allows to isolate 'length' and 'protocol' keywords shared by other scopes as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: at: Move to own scopePhil Sutter2022-03-013-10/+15
| | | | | | | Modification of raw TCP option rule is a bit more complicated to avoid pushing tcp_hdr_option_type into the introduced scope by accident. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: nat: Move to own scopePhil Sutter2022-03-013-15/+20
| | | | | | | | | | Unify nat, masquerade and redirect statements, they widely share their syntax. Note the workaround of adding "prefix" to SCANSTATE_IP. This is required to fix for 'snat ip prefix ...' style expressions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: policy: move to own scopePhil Sutter2022-03-013-6/+11
| | | | | | Isolate 'performance' and 'memory' keywords. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: flags: move to own scopePhil Sutter2022-03-013-20/+26
| | | | | | This isolates at least 'constant', 'dynamic' and 'all' keywords. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: reject: Move to own scopePhil Sutter2022-03-013-4/+9
| | | | | | Two more keywords isolated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: import, export: Move to own scopesPhil Sutter2022-03-013-7/+15
| | | | | | | In theory, one could use a common scope for both import and export commands, their parameters are identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: reset: move to own ScopePhil Sutter2022-03-013-6/+11
| | | | | | Isolate two more keywords shared with list command. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: monitor: Move to own ScopePhil Sutter2022-03-013-7/+14
| | | | | | Some keywords are shared with list command. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: rt: Extend scope over rt0, rt2 and srhPhil Sutter2022-03-012-9/+9
| | | | | | | These are technically all just routing headers with different types, so unify them under the same scope. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: type: Move to own scopePhil Sutter2022-03-013-36/+45
| | | | | | As a side-effect, this fixes for use of 'classid' as set data type. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: dst, frag, hbh, mh: Move to own scopesPhil Sutter2022-03-013-19/+41
| | | | | | | These are the remaining IPv6 extension header expressions, only rt expression was scoped already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: ah, esp: Move to own scopesPhil Sutter2022-03-013-8/+16
| | | | | | They share 'sequence' keyword with icmp and tcp expressions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: osf: Move to own scopePhil Sutter2022-03-013-6/+13
| | | | | | It shares two keywords with PARSER_SC_IP. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: dccp, th: Move to own scopesPhil Sutter2022-03-013-8/+18
| | | | | | | With them in place, heavily shared keywords 'sport' and 'dport' may be isolated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: udp{,lite}: Move to own scopePhil Sutter2022-03-013-7/+16
| | | | | | | All used keywords are shared with others, so no separation for now apart from 'csumcov' which was actually missing from scanner.l. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: comp: Move to own scope.Phil Sutter2022-03-013-4/+9
| | | | | | Isolates only 'cpi' keyword for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: synproxy: Move to own scopePhil Sutter2022-03-013-14/+22
| | | | | | Quite a few keywords are shared with PARSER_SC_TCP. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: tcp: Move to own scopePhil Sutter2022-03-012-26/+36
| | | | | | | Apart from header fields, this isolates TCP option types and fields, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: igmp: Move to own scopePhil Sutter2022-03-013-4/+10
| | | | | | | At least isolates 'mrt' and 'group' keywords, the latter is shared with log statement. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: icmp{,v6}: Move to own scopePhil Sutter2022-03-013-14/+19
| | | | | | Unify the two, header fields are almost identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add tcp option reset supportFlorian Westphal2022-02-2813-2/+156
| | | | | | | This allows to replace a tcp option with nops, similar to the TCPOPTSTRIP feature of iptables. Signed-off-by: Florian Westphal <fw@strlen.de>
* build: explicitly pass --version-script to linkerSam James2022-02-251-1/+1
| | | | | | | | | | | | --version-script is a linker option, so let's use -Wl, so that libtool handles it properly. It seems like the previous method gets silently ignored with GNU libtool in some cases(?) and downstream in Gentoo, we had to apply this change to make the build work with slibtool anyway. But it's indeed correct in any case, so let's swap. Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables.map: export new nft_ctx_{get,set}_optimize APISam James2022-02-251-2/+2
| | | | | | | | | | | | | | | | [ Remove incorrect symbol names were exported via .map file ] Without this, we're not explicitly saying this is part of the public API. This new API was added in 1.0.2 and is used by e.g. the main nft binary. Noticed when fixing the version-script option (separate patch) which picked up this problem when .map was missing symbols (related to when symbol visibility options get set). Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add test case for flowtable with owner flagFlorian Westphal2022-02-221-0/+22
| | | | | | | | | | | | | | | BUG: KASAN: use-after-free in nf_hook_entries_grow+0x675/0x980 Read of size 4 at ... nft/19662 nf_hook_entries_grow+0x675/0x980 This is fixed by kernel commit 6069da443bf ("netfilter: nf_tables: unregister flowtable hooks on netns exit"). The test case here uses owner flag, netlink event handler doesn't release the flowtable, next attempt to add one then causes uaf because of dangling ingress hook reference. Signed-off-by: Florian Westphal <fw@strlen.de>
* examples: compile with `make check' and add AM_CPPFLAGSPablo Neira Ayuso2022-02-221-1/+3
| | | | | | | | | | | | | Compile examples via `make check' like libnftnl does. Use AM_CPPFLAGS to specify local headers via -I. Unfortunately, `make distcheck' did not catch this compile time error in my system, since it was using the nftables/libnftables.h file of the previous nftables release. Fixes: 5b364657a35f ("build: missing SUBIRS update") Fixes: caf2a6ad2d22 ("examples: add libnftables example program") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: missing SUBIRS updatev1.0.2Pablo Neira Ayuso2022-02-211-1/+2
| | | | | | | Add new examples folder, other `make distcheck' fails. Fixes: caf2a6ad2d22 ("examples: add libnftables example program") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Bump version to 1.0.2Pablo Neira Ayuso2022-02-211-2/+2
| | | | | | Still requires libnftnl 1.2.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: rt: Move seg-left keyword into scopePhil Sutter2022-02-201-1/+1
| | | | | | | It's not used outside of rt_hdr_expr, so move it out of INIT scope. Fixes: 8861db1b771a6 ("scanner: rt: move to own scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Some time units are only used in limit scopePhil Sutter2022-02-201-3/+5
| | | | | | | | 'hour' and 'day' are allowed as unqualified meta expressions, so leave them alone. Fixes: eae2525685252 ("scanner: limit: move to own scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Move 'maps' keyword into list cmd scopePhil Sutter2022-02-201-1/+1
| | | | | | | | This was missed when introducing SCANSTATE_CMD_LIST, no other command operates on "maps". Fixes: 6a24ffb04642e ("scanner: add list cmd parser scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: py: Test connlimit statementPhil Sutter2022-02-203-0/+30
| | | | | | This wasn't covered at all. Signed-off-by: Phil Sutter <phil@nwl.cc>
* segtree: memleak get element commandPablo Neira Ayuso2022-02-171-0/+2
| | | | | | | | | Release removed interval expressions before get_set_interval_find() fails. The memleak can be triggered through: testcases/sets/0034get_element_0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: check key is EXPR_CONCAT before accessing fieldPablo Neira Ayuso2022-02-171-1/+2
| | | | | | | alloc_nftnl_setelem() needs to check for EXPR_CONCAT before accessing field_count. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: load ruleset from JSONPablo Neira Ayuso2022-02-173-1/+75
| | | | | | Add an example to load a ruleset file expressed in JSON. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: add libnftables example programPablo Neira Ayuso2022-02-173-0/+38
| | | | | | | Create an example folder to add example source code files to show how to use libnftables. Add first example program using the buffer API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: permit empty device listFlorian Westphal2022-02-071-10/+13
| | | | | | | | | | | Normal input parser allows flowtables without 'devices' token, which makes the json export part elide 'dev' entirely, this then breaks on re-import: $ nft -j -f json.dump /tmp/json_1:1:14-14: Error: Object item not found: dev Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: fix flowtable device datatypeFlorian Westphal2022-02-071-2/+6
| | | | | | | Failed with: BUG: invalid expresion type symbol Fixes: 78bbe7f7a55be489 ("mnl: do not use expr->identifier to fetch device name") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: add flow statement json export + parserFlorian Westphal2022-02-074-0/+33
| | | | | | | | | | | flow statement has no export, its shown as: ".. }, "flow add @ft" ] } }" With this patch: ".. }, {"flow": {"op": "add", "flowtable": "@ft"}}]}}" Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: add undefine and redefine keywordsPierre Ducroquet2022-02-071-0/+6
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* iface: handle EINTR case when creating the cachePablo Neira Ayuso2022-01-281-12/+38
| | | | | | | | | | If interface netlink dump is interrupted, then retry. Before this patch, the netlink socket is reopened to drop stale dump messages, instead empty the netlink queue and retry. Reviewed-by: Eugene Crosser <crosser@average.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: do not merge raw payload expressionsPablo Neira Ayuso2022-01-261-0/+3
| | | | | | | | | | | Merging raw expressions results in a valid concatenation which throws: Error: can not use variable sized data types (integer) in concat expressions Disable merging raw expressions until this is supported by skipping raw expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>