summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: extend tests for destroy commandFernando Fernandez Mancera2023-06-0118-0/+74
Extend tests to cover destroy command for chains, flowtables, sets, maps. In addition rename a destroy command test for rules with a duplicated number. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add nft_ctx_add_var() and nft_ctx_clear_vars() docsFernando Fernandez Mancera2022-09-161-0/+11
| | | | | | | | Add missing documentation for nft_ctx_add_var() and nft_ctx_clear_vars() functions. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* py: support variables management and fix formattingFernando Fernandez Mancera2022-09-161-13/+30
Add nft_ctx_add_var() and nft_ctx_clear_vars() support through add_var() and clear_vars(). Also, fix some functions documentation and drop unnecesary comments. In addition, modify get_dry_run() to return the previous value set. This is needed to be consistent with the rest of the python API. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1591 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add stateful object comment supportFernando Fernandez Mancera2022-09-164-0/+24
| | | | | | | | | | | | | | | | | | | | | | When listing a stateful object with JSON support, the comment was ignored. Output example: { "counter": { "family": "inet", "name": "mycounter", "table": "t", "handle": 1, "comment": "my comment in counter", "packets": 0, "bytes": 0 } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1611 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add secmark object reference supportFernando Fernandez Mancera2022-09-163-0/+45
The secmark object reference requires a json parser function and it was missing. In addition, extends the shell testcases. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1630 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix empty statement list output in sets and mapsFernando Fernandez Mancera2022-09-051-29/+32
| | | | | | | | | | | | JSON output of sets and map should not include the statements list if is empty. The statement output should be stateless also. In addition, removes duplicated code. Fixes: 07958ec53830 ("json: add set statement list support") Fixes: e66f3187d891 ("json: add table map statement support") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix json schema version verificationFernando Fernandez Mancera2022-09-035-7/+28
| | | | | | | | | | nft should ignore malformed or missing entries of `json_schema_version` but check the value when it is integer. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1490 Fixes: 49e0f1dc6e52 ("JSON: Add metainfo object to all output") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add table map statement supportFernando Fernandez Mancera2022-09-034-29/+61
When listing a map with statements with JSON support, the statement list were ignored. Output example: { "map": { "family": "ip", "name": "m", "table": "t", "type": "ipv4_addr", "handle": 1, "map": "mark", "stmt": [ { "counter": { "packets": 0, "bytes": 0 } } ] } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1588 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add set statement list supportFernando Fernandez Mancera2022-09-014-2/+67
When listing a set with statements with JSON support, the statements were ignored. Output example: { "set": { "op": "add", "elem": { "payload": { "protocol": "ip", "field": "saddr" } }, "stmt": [ { "limit": { "rate": 10, "burst": 5, "per": "second" } }, { "counter": { "packets": 0, "bytes": 0 } } ], "set": "@my_ssh_meter" } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1495 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add stateful object update operation testFernando Fernandez Mancera2019-11-161-0/+25
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: tests: fix typo in ct expectation json testFernando Fernandez Mancera2019-09-151-1/+1
The correct form is "ct expectation" not "ct expect". That was causing the tests/py/ip/object.t json test to fail. Fixes: 1dd08fcfa07a ("src: add ct expectations support") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix type mismatch on "ct expect" json exportingFernando Fernandez Mancera2019-09-131-1/+1
| | | | | | | | | | The size field in ct_expect struct should be parsed as json integer and not as a string. Also, l3proto field is parsed as string and not as an integer. That was causing a segmentation fault when exporting "ct expect" objects as json. Fixes: 1dd08fcfa07a ("src: add ct expectations support") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add synproxy stateful object supportFernando Fernandez Mancera2019-09-1314-8/+312
Add support for "synproxy" stateful object. For example (for TCP port 80 and using maps with saddr): table ip foo { synproxy https-synproxy { mss 1460 wscale 7 timestamp sack-perm } synproxy other-synproxy { mss 1460 wscale 5 } chain bar { tcp dport 80 synproxy name "https-synproxy" synproxy name ip saddr map { 192.168.1.0/24 : "https-synproxy", 192.168.2.0/24 : "other-synproxy" } } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix wrong conversion to "list" in ct markFernando Fernandez Mancera2019-09-103-1/+9
We only prefer "list" representation in "ct event". For any other type of "ct" use the "or" representation so nft prints "ct mark set ct mark | 0x00000001" instead of "ct mark set ct mark,0x00000001". Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1364 Fixes: cb8f81ac3079 ("netlink_delinearize: prefer ct event set foo,bar over 'set foo|bar'") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow variable in chain policyFernando Fernandez Mancera2019-08-0816-18/+194
| | | | | | | | | | | | This patch allows you to use variables in chain policy definition, e.g. define default_policy = "accept" add table ip foo add chain ip foo bar {type filter hook input priority filter; policy $default_policy} Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow variables in the chain priority specificationFernando Fernandez Mancera2019-08-0816-46/+250
This patch allows you to use variables in chain priority definitions, e.g. define prio = filter define prionum = 10 define prioffset = "filter - 150" add table ip foo add chain ip foo bar { type filter hook input priority $prio; } add chain ip foo ber { type filter hook input priority $prionum; } add chain ip foo bor { type filter hook input priority $prioffset; } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: osf: fix snprintf -Wformat-truncation warningFernando Fernandez Mancera2019-07-221-9/+10
Fedora 30 uses very recent gcc (version 9.1.1 20190503 (Red Hat 9.1.1-1)), osf produces following warnings: -Wformat-truncation warning have been introduced in the version 7.1 of gcc. Also, remove a unneeded address check of "tmp + 1" in nf_osf_strchr(). nfnl_osf.c: In function ‘nfnl_osf_load_fingerprints’: nfnl_osf.c:292:39: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 128 [-Wformat-truncation=] 292 | cnt = snprintf(obuf, sizeof(obuf), "%s,", pbeg); | ^~ nfnl_osf.c:292:9: note: ‘snprintf’ output between 2 and 1025 bytes into a destination of size 128 292 | cnt = snprintf(obuf, sizeof(obuf), "%s,", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ nfnl_osf.c:302:46: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 32 [-Wformat-truncation=] 302 | cnt = snprintf(f.genre, sizeof(f.genre), "%s", pbeg); | ^~ nfnl_osf.c:302:10: note: ‘snprintf’ output between 1 and 1024 bytes into a destination of size 32 302 | cnt = snprintf(f.genre, sizeof(f.genre), "%s", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ nfnl_osf.c:309:49: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 32 [-Wformat-truncation=] 309 | cnt = snprintf(f.version, sizeof(f.version), "%s", pbeg); | ^~ nfnl_osf.c:309:9: note: ‘snprintf’ output between 1 and 1024 bytes into a destination of size 32 309 | cnt = snprintf(f.version, sizeof(f.version), "%s", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ nfnl_osf.c:317:47: warning: ‘%s’ directive output may be truncated writing up to 1023 bytes into a region of size 32 [-Wformat-truncation=] 317 | snprintf(f.subtype, sizeof(f.subtype), "%s", pbeg); | ^~ nfnl_osf.c:317:7: note: ‘snprintf’ output between 1 and 1024 bytes into a destination of size 32 317 | snprintf(f.subtype, sizeof(f.subtype), "%s", pbeg); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* include: json: add missing synproxy stmt print stubFernando Fernandez Mancera2019-07-181-0/+1
| | | | | | | | | | | statement.c:930:11: error: ‘synproxy_stmt_json’ undeclared here (not in a function); did you mean ‘tproxy_stmt_json’? .json = synproxy_stmt_json, ^~~~~~~~~~~~~~~~~~ tproxy_stmt_json Fixes: 1188a69604c3 ("src: introduce SYNPROXY matching") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add missing json outputsFernando Fernandez Mancera2019-07-171-0/+25
| | | | | | Fixes: 1188a69604c3 ("src: introduce SYNPROXY matching") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix synproxy flag parser typoFernando Fernandez Mancera2019-07-171-4/+4
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce SYNPROXY matchingFernando Fernandez Mancera2019-07-1716-0/+570
Add support for "synproxy" statement. For example (for TCP port 8888): table ip x { chain y { type filter hook prerouting priority raw; policy accept; tcp dport 8888 tcp flags syn notrack } chain z { type filter hook input priority filter; policy accept; tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm ct state invalid drop } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow goto and jump to a variableFernando Fernandez Mancera2019-05-247-1/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | This patch introduces the use of nft input files variables in 'jump' and 'goto' statements, e.g. define dest = ber add table ip foo add chain ip foo bar {type filter hook input priority 0;} add chain ip foo ber add rule ip foo ber counter add rule ip foo bar jump $dest table ip foo { chain bar { type filter hook input priority filter; policy accept; jump ber } chain ber { counter packets 71 bytes 6664 } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Introduce chain_expr in jump and goto statementsFernando Fernandez Mancera2019-05-248-24/+76
Introduce expressions as a chain in jump and goto statements. This is going to be used to support variables as a chain in the following patches. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: pf.os: merge the signatures splitted by versionFernando Fernandez Mancera2019-04-081-26/+14
| | | | | | | | | | | | | | | | | | In order to be able to identify the OS version we need to merge the signatures split by version. eg. 65535:64:1:60:M*,N,W1,N,N,T: FreeBSD:4.7-4.11::FreeBSD 4.7-5.2 65535:64:1:60:M*,N,W1,N,N,T: FreeBSD:5.0-5.2::FreeBSD 4.7-5.2 65535:64:1:60:M*,N,W1,N,N,T: FreeBSD:4.7-5.2::FreeBSD 4.7-5.2 Fingerprints need to be unique to make this fit into the set/map infrastructure for exact matches. Having multiples fingerprints with same signature is a problem, since it forces users to add multiple rules. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: osf: update pf.os with newer OS fingerprintsFernando Fernandez Mancera2019-04-081-0/+6
| | | | | | | | After notice that some fingerprints are outdated we have updated the most common of them. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add osf version option to man pageFernando Fernandez Mancera2019-04-081-0/+2
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add osf tests with versionsFernando Fernandez Mancera2019-04-083-0/+85
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: osf: add version json supportFernando Fernandez Mancera2019-04-082-3/+13
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add version fingerprint supportFernando Fernandez Mancera2019-04-087-7/+29
| | | | | | | | | | | | | | | Add support for version fingerprint in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" osf ttl skip version "Linux:4.20" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update nft list plural form parametersFernando Fernandez Mancera2019-04-081-0/+6
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: osf: add ttl option to man pageFernando Fernandez Mancera2018-10-231-4/+16
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add ttl option supportFernando Fernandez Mancera2018-10-2312-11/+133
Add support for ttl option in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add missing xfrm.h to Makefile.amFernando Fernandez Mancera2018-09-301-0/+1
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: osf: load pf.os from expr_evaluate_osf()Fernando Fernandez Mancera2018-08-315-9/+12
Remove osf_init variable and call nfnl_osf_load_fingerprints() from expr_evaluate_osf() instead of doing that from do_command_add() path. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: osf: import nfnl_osf.c to load osf fingerprintsFernando Fernandez Mancera2018-08-247-1/+527
| | | | | | | | Import iptables/utils/nfnl_osf.c into nftables tree with some changes in order to load OS fingerprints automatically from pf.os file. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: make nft_mnl_talk() publicFernando Fernandez Mancera2018-08-232-1/+5
| | | | | | | | As we are going to use the function nft_mnl_talk() from the incoming nftnl_osf.c, we make it public. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: osf: copy iptables/utils/pf.os into nftables treeFernando Fernandez Mancera2018-08-235-2/+715
As we are going to need pf.os file to load OS fingerprints from the incoming nfnl_osf.c, we copy it into the nftables tree directory "files/osf/". Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: improve test cases for osfFernando Fernandez Mancera2018-08-072-2/+15
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use NFT_OSF_MAXGENRELEN instead of IFNAMSIZ in osf.cFernando Fernandez Mancera2018-08-072-3/+2
As no "genre" in pf.os exceed 16 bytes of length, we reduce NFT_OSF_MAXGENRELEN parameter to 16 bytes and use it instead of IFNAMSIZ. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: py: fix osf testcases warningFernando Fernandez Mancera2018-08-042-3/+3
Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add osf expression to man pageFernando Fernandez Mancera2018-08-041-0/+29
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add test cases for "osf" matchingFernando Fernandez Mancera2018-08-042-0/+10
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce passive OS fingerprint matchingFernando Fernandez Mancera2018-08-049-0/+99
Add support for "osf" expression. Example: table ip foo { chain bar { type filter hook input priority 0; policy accept; osf name "Linux" counter packets 3 bytes 132 } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix a typo in socket.hFernando Fernandez Mancera2018-07-221-3/+1
Fix a typo in socket_template struct description. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure.ac: fix typo in docbook2x error messageFernando Fernandez Mancera2018-06-051-1/+1
The correct name is "docbook2x-man" not "docbookx2-man". Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>