summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* main: fix nft --help output fallout from 719e4427Štěpán Němec2021-02-221-3/+4
| | | | | | | | | Long options were missing the double dash. Fixes: 719e44277f8e ("main: use one data-structure to initialize getopt_long(3) arguments and help.") Cc: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Štěpán Němec <snemec@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: init parser state for every new buffer/fileEric Garver2021-02-191-0/+2
| | | | | | | | Otherwise invalid error states cause subsequent json parsing to fail when it should not. Signed-off-by: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc>
* monitor: Don't print newgen message with JSON outputPhil Sutter2021-02-171-0/+3
| | | | | | | | | Iff this should be printed, it must adhere to output format settings. In its current form it breaks JSON syntax, so skip it for non-default output formats. Fixes: cb7e02f44d6a6 ("src: enable json echo output when reading native syntax") Signed-off-by: Phil Sutter <phil@nwl.cc>
* evaluate: set evaluation context for set elementsFlorian Westphal2021-02-161-2/+9
| | | | | | | | | | | | | This resolves same issue as previous patch when such expression is used as a set key: set z { typeof ct zone - elements = { 1, 512, 768, 1024, 1280, 1536 } + elements = { 1, 2, 3, 4, 5, 6 } } Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: pick data element byte order, not dtype oneFlorian Westphal2021-02-161-1/+1
| | | | | | | | | | | | | Some expressions have integer base type, not a specific one, e.g. 'ct zone'. In that case nft used the wrong byte order. Without this, nft adds elements = { "eth0" : 256, "eth1" : 512, "veth4" : 256 } instead of 1, 2, 3. This is not a 'display bug', the added elements have wrong byte order. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: extend dtype test case to cover expression with integer typeFlorian Westphal2021-02-162-2/+83
| | | | | | | | | ... nft doesn't handle this correctly at the moment: they are added as network byte order (invalid byte order). ct zone has integer_type, the byte order has to be taken from the expression. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: incorrect usage of stmt_binary_error() in rejectPablo Neira Ayuso2021-02-091-3/+2
| | | | | | | Don't pass ctx->pctx.protocol[PROTO_BASE_LL_HDR] to stmt_binary_error(), it's not useful for the error reporting as location is not available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: Sanitize erec location indescPhil Sutter2021-02-091-1/+2
| | | | | | | erec_print() unconditionally dereferences erec->locations->indesc, so make sure it is valid when either creating an erec or adding a location. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: shell: extend 0025empty_dynset_0 to cover multi-statement supportPablo Neira Ayuso2021-02-092-0/+12
| | | | | | Add a test to cover multi-statement support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* trace: do not remove icmp type from packet dumpFlorian Westphal2021-02-081-1/+3
| | | | | | | | | | | | | | | | | As of 0.9.8 the icmp type is marked as a protocol field, so its elided in 'nft monitor trace' output: icmp code 0 icmp id 44380 .. Restore it. Unlike tcp, where 'tcp sport' et. al in the dump will make the 'ip protocol tcp' redundant this case isn't obvious in the icmp case: icmp type 8 code 0 id ... Reported-by: Martin Gignac <martin.gignac@gmail.com> Fixes: 98b871512c4677 ("src: add auto-dependencies for ipv4 icmp") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add negation match on singleton bitmask valuePablo Neira Ayuso2021-02-058-5/+36
| | | | | | | | | | | | | | | | | This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not crash if dynamic set has no statementsFlorian Westphal2021-02-051-4/+6
| | | | | | | | list_first_entry() returns garbage when the list is empty. There is no need to run the following loop if we have no statements, so just return 0. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add empty dynamic setFlorian Westphal2021-02-052-0/+28
| | | | | | nft crashes on restore. Signed-off-by: Florian Westphal <fw@strlen.de>
* testcases: move two dump files to correct locationFlorian Westphal2021-02-052-0/+0
| | | | | | | The test cases were moved but the dumps remained in the old location. Fixes: eb14363d44cea5 ("tests: shell: move chain priority and policy to chain folder") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/py: Add a test sanitizer and fix its findingsPhil Sutter2021-02-0439-780/+160
| | | | | | | | | | | | | | | | This is just basic housekeeping: - Remove duplicate tests in any of the *.t files - Remove explicit output if equal to command itself in *.t files - Remove duplicate payload records in any of the *.t.payload* files - Remove stale payload records (for which no commands exist in the respective *.t file - Remove duplicate/stale entries in any of the *.t.json files In some cases, tests were added instead of removing a stale payload record if it fit nicely into the sequence of tests. Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests/py: Write dissenting payload into the right filePhil Sutter2021-02-041-1/+4
| | | | | | | | | | | | The testsuite supports diverging payloads depending on table family. This is necessary since for some families, dependency matches are created. If a payload mismatch happens, record it into a "got"-file which matches the family-specific payload file, not the common one. This eases use of diff-tools a lot as the extra other families' payloads confuse the tools. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Do not abbreviate reject statement objectPhil Sutter2021-02-035-120/+47
| | | | | | | | | No need to reduce output size, also this way output is more predictable. While being at it, drop some pointless chunks from tests/py/bridge/reject.t.json.output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* payload: check icmp dependency before removing previous icmp expressionFlorian Westphal2021-02-021-21/+42
| | | | | | | | | | | | | | | nft is too greedy when removing icmp dependencies. 'icmp code 1 type 2' did remove the type when printing. Be more careful and check that the icmp type dependency of the candidate expression (earlier icmp payload expression) has the same type dependency as the new expression. Reported-by: Eric Garver <eric@garver.life> Reported-by: Michael Biebl <biebl@debian.org> Tested-by: Eric Garver <eric@garver.life> Fixes: d0f3b9eaab8d77e ("payload: auto-remove simple icmp/icmpv6 dependency expressions") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add icmp/6 test where dependency should be left aloneFlorian Westphal2021-02-016-0/+73
| | | | | | These tests fail: nft should leave the type as-is. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: limit: Always include burst valuePhil Sutter2021-01-272-7/+282
| | | | | | The default burst value is non-zero, so JSON output should include it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* reject: Unify inet, netdev and bridge delinearizationPhil Sutter2021-01-276-216/+296
| | | | | | | | | | | | | | Postprocessing for inet family did not attempt to kill any existing payload dependency, although it is perfectly fine to do so. The mere culprit is to not abbreviate default code rejects as that would drop needed protocol info as a side-effect. Since postprocessing is then almost identical to that of bridge and netdev families, merge them. While being at it, extend tests/py/netdev/reject.t by a few more tests taken from inet/reject.t so this covers icmpx rejects as well. Cc: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* reject: Fix for missing dependencies in netdev familyPhil Sutter2021-01-275-22/+187
| | | | | | | | | | | | | | | Like with bridge family, rejecting with either icmp or icmpv6 must create a dependency match on meta protocol. Upon delinearization, treat netdev reject identical to bridge as well so no family info is lost. This makes reject statement in netdev family fully symmetric so fix the tests in tests/py/netdev/reject.t, adjust the related payload dumps and add JSON equivalents which were missing altogether. Fixes: 0c42a1f2a0cc5 ("evaluate: add netdev support for reject default") Fixes: a51a0bec1f698 ("tests: py: add netdev folder and reject.t icmp cases") Cc: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* tests: monitor: use correct $nft value in EXIT trapŠtěpán Němec2021-01-271-1/+1
| | | | | | | | | | With double quotes, $nft was being expanded to the default value even in presence of the -H option. Signed-off-by: Štěpán Němec <snemec@redhat.com> Helped-by: Tomáš Doležal <todoleza@redhat.com> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: evaluate: reset context maxlen value before prio evaluationFlorian Westphal2021-01-263-2/+26
| | | | | | | | | | unshare -n tests/shell/run-tests.sh tests/shell/testcases/nft-f/0024priority_0 W: [FAILED] tests/shell/testcases/nft-f/0024priority_0: got 1 /dev/stdin:8:47-49: Error: Value 100 exceeds valid range 0-15 type filter hook postrouting priority 100 Reported-by: Andreas Schultz <andreas.schultz@travelping.com Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: remove tcp dependency for tcp option matchingFlorian Westphal2021-01-262-63/+1
| | | | | | Kernel won't search for tcp options in non-tcp packets. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: ct: add missing test inputFlorian Westphal2021-01-261-0/+79
| | | | | | | ERROR: did not find JSON equivalent for rule 'meta mark set ct original ip saddr . meta mark map { 1.1.1.1 . 0x00000014 : 0x0000001e }' ERROR: did not find JSON equivalent for rule 'ct original ip saddr . meta mark { 1.1.1.1 . 0x00000014 }' Signed-off-by: Florian Westphal <fw@strlen.de>
* json: icmp: move expected parts to json.outputFlorian Westphal2021-01-262-109/+98
| | | | | | | | | | | | Phil Sutter says: In general, *.t.json files should contain JSON equivalents for rules as they are *input* into nft. So we want them to be as close to the introductory standard syntax comment as possible. Undo earlier change and place the expected dependency added by nft internals to json.output rather than icmp.t.json. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: disallow ct original {s,d}ddr from concatenationsPablo Neira Ayuso2021-01-253-0/+40
| | | | | | | | | | | | | | | | Extend 8b043938e77b ("evaluate: disallow ct original {s,d}ddr from maps") to cover concatenations too. Error: specify either ip or ip6 for address matching add rule x y meta mark set ct original saddr . meta mark map { 1.1.1.1 . 20 : 30 } ^^^^^^^^^^^^^^^^^ The old syntax for ct original saddr without either ip or ip6 results in unknown key size, which breaks the listing. The old syntax is only allowed in simple rules for backward compatibility. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1489 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: icmp: refresh json outputFlorian Westphal2021-01-211-80/+568
| | | | | | | nft inserts dependencies for icmp header types, but I forgot to update the json test files to reflect this change. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: ct: add missing ruleFlorian Westphal2021-01-211-0/+30
| | | | | | ERROR: did not find JSON equivalent for rule 'meta mark set ct original ip daddr map { 1.1.1.1 : 0x00000011 }' Signed-off-by: Florian Westphal <fw@strlen.de>
* json: limit: set default burst to 5Florian Westphal2021-01-211-1/+1
| | | | | | | The tests fail because json printing omits a burst of 5 and the parser treats that as 'burst 0'. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix icmpv6.t test casesFlorian Westphal2021-01-212-16/+597
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* build: Bump version to v0.9.8v0.9.8Pablo Neira Ayuso2021-01-151-3/+3
| | | | | | | | | | | Update release name based on the Fearless Fosdick series: E.D.S. E.D.S. is the robotic "Electronic Detective Substitute" appearing in the "Hole Story". Bump dependencies on libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disallow ct original {s,d}ddr from mapsPablo Neira Ayuso2021-01-153-0/+18
| | | | | | | | | test.nft:6:55-71: Error: specify either ip or ip6 for address matching add rule ip mangle manout ct direction reply mark set ct original daddr map { $ext1_ip : 0x11, $ext2_ip : 0x12 } ^^^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1489 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: honor set element expirationPablo Neira Ayuso2021-01-061-20/+14
| | | | | | | | Extend c1f0476fd590 ("segtree: copy expr data to closing element") to use interval_expr_copy() from the linearization path. Reported-by: Mike Dillinger <miked@softtalker.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: resync nf_tables.h cache copyPablo Neira Ayuso2021-01-061-1/+25
| | | | | | Get this header in sync with nf-next as of 5.11-rc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: fix typo in cli definitionPablo Neira Ayuso2021-01-061-1/+1
| | | | | | | | 9420423900a2 ("cli: add libedit support") updated HAVE_LIBREADLINE to HAVE_READLINE by mistake. Fixes: 9420423900a2 ("cli: add libedit support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: use plain readline() interface with libeditPablo Neira Ayuso2021-01-061-4/+35
| | | | | | | | | | | | | | | | | | | | | | | | | Instead of the alternate interface [1]. I spent a bit of time debugging an issue with libedit support 9420423900a2 ("cli: add libedit support") that broke tests/shell. This is the reproducer: # nft -i << EOF list ruleset EOF which makes rl_callback_read_char() loop forever on read() as shown by strace. The rl_line_buffer variable does not accumulate the typed characters as it should when redirecting the standard input for some reason. Given our interactive interface is fairly simple at this stage, switch to use the readline() interface instead of rl_callback_read_char(). [1] https://docs.freebsd.org/info/readline/readline.info.Alternate_Interface.html Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: add libedit supportPablo Neira Ayuso2021-01-055-12/+39
| | | | | | | | Extend cli to support for libedit readline shim code: ./configure --with-cli=editline Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set on flags to request multi-statement supportPablo Neira Ayuso2021-01-043-0/+13
| | | | | | | Old kernel reject requests for element with multiple statements because userspace sets on the flags for multi-statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: set element multi-statement supportPablo Neira Ayuso2020-12-184-0/+93
| | | | | | | | | This patch adds two tests to add multistatement support: - Dynamic set updates from packet path. - Set that is updated from the control plane. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: disallow burst 0 in ratelimitsPablo Neira Ayuso2020-12-184-26/+48
| | | | | | | | | | | | The ratelimiter in nftables is similar to the one in iptables, and iptables disallows a zero burst. Update the byte rate limiter not to print burst 5 (default value). Update tests/py payloads to print burst 5 instead of zero when the burst is unspecified. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set element multi-statement supportPablo Neira Ayuso2020-12-1811-75/+219
| | | | | | | | Extend the set element infrastructure to support for several statements. This patch places the statements right after the key when printing it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for multi-statement in dynamic sets and mapsPablo Neira Ayuso2020-12-177-48/+157
| | | | | | | | This patch allows for two statements for dynamic set updates, e.g. nft rule x y add @y { ip daddr limit rate 1/second counter } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: search for python3Pablo Neira Ayuso2020-12-151-1/+1
| | | | | | | Eric Garver says: "It would probably be better to use the automake macro AM_PATH_PYTHON. [...] The above is fine for now." Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: don't leave dangling pointers on hlistFlorian Westphal2020-12-151-1/+3
| | | | | | | | | | | | | unshare -n tests/json_echo/run-test.py [..] Adding chain c free(): double free detected in tcache 2 Aborted (core dumped) The element must be deleted from the hlist prior to freeing it. Fixes: 389a0e1edc89a ("json: echo: Speedup seqnum_to_json()") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: py: Fix for changed concatenated ranges outputPhil Sutter2020-12-153-3/+3
| | | | | | | Payload didn't change but libnftnl was fixed to print the key_end data reg of concat-range elements, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* nft: trace: print packet unconditionallyFlorian Westphal2020-12-121-4/+4
| | | | | | | | | | | The kernel includes the packet dump once for each base hook. This means that in case a table contained no matching rule(s), the packet dump will be included in the base policy dump. Simply move the packet dump request out of the switch statement so the debug output shows current packet even with no matched rule. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: icmp, icmpv6: check we don't add second dependencyFlorian Westphal2020-12-094-0/+23
| | | | | | If dependency is already fulfilled, do not add another one. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: ip: add one test case to cover both id and sequenceFlorian Westphal2020-12-092-0/+14
| | | | | | | | | These are two 2-byte matches, so nft will merge the accesses to a single 4-byte load+compare. Check this is properly demangled. Signed-off-by: Florian Westphal <fw@strlen.de>