summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
...
* src: add `flush ruleset'Arturo Borrero2014-09-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add devgroup support in meta expresionAna Rey2014-09-031-0/+4
| | | | | | | | | | | | | | | | | | | This adds device group support in meta expresion. The new attributes of meta are "iffgroup" and "oifgroup" - iffgroup: Match device group of incoming device. - oifgroup: Match device group of outcoming device. Example of use: nft add rule ip test input meta iifgroup 2 counter nft add rule ip test output meta oifgroup 2 counter The kernel and libnftnl support were added in these commits: netfilter: nf_tables: add devgroup support in meta expresion src: meta: Add devgroup support to meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for cpu in meta expresionAna Rey2014-08-241-0/+2
| | | | | | | | | | | | | This allows you to match cpu handling with a packet. This is an example of the syntax for this new attribute: nft add rule ip test input meta cpu 1 counter nft add rule ip test input meta cpu 1-3 counter nft add rule ip test input meta cpu { 1, 3} counter Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for pkttype in meta expresionAna Rey2014-08-242-0/+4
| | | | | | | | | | | | | | | If you want to match the pkttype field of the skbuff, you have to use the following syntax: nft add rule ip filter input meta pkttype PACKET_TYPE where PACKET_TYPE can be: unicast, broadcast and multicast. Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't return error in netlink_linearize_rule()Pablo Neira Ayuso2014-08-191-3/+3
| | | | | | | | | This function converts the rule from the list of statements to the netlink message format. The only two possible errors that can make this function to fail are memory exhaustion and malformed statements which inmediately stop the execution of nft. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add level option to the log statementPablo Neira Ayuso2014-07-251-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is required if you use upcoming Linux kernels >= 3.17 which come with a complete logging support for nf_tables. If you use 'log' without options, the kernel logging buffer is used: nft> add rule filter input log You can also specify the logging prefix string: nft> add rule filter input log prefix "input: " You may want to specify the log level: nft> add rule filter input log prefix "input: " level notice By default, if not specified, the default level is 'warn' (just like in iptables). If you specify the group, then nft uses the nfnetlink_log instead: nft> add rule filter input log prefix "input: " group 10 You can also specify the snaplen and qthreshold for the nfnetlink_log. But you cannot mix level and group at the same time, they are mutually exclusive. Default values for both snaplen and qthreshold are 0 (just like in iptables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: check for NLM_F_DUMP_INTR when dumping object listsPablo Neira Ayuso2014-07-141-0/+2
| | | | | | | | | This flag allows to detect that an update has ocurred while dumping any of the object lists. In case of interference, nft cancels the netlink socket to skip processing the remaining stale entries and it retries to obtain fresh list of objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revert broken reject icmp code supportPablo Neira Ayuso2014-06-201-1/+0
| | | | | | | | | | | | | | | | | This patch reverts Alvaro's 34040b1 ("reject: add ICMP code parameter for indicating the type of error") and 11b2bb2 ("reject: Use protocol context for indicating the reject type"). These patches are flawed by two things: 1) IPv6 support is broken, only ICMP codes are considered. 2) If you don't specify any transport context, the utility exits without adding the rule, eg. nft add rule ip filter input reject. The kernel is also flawed when it comes to the inet table. Let's revert this until we can provide decent reject reason support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: add ICMP code parameter for indicating the type of errorÁlvaro Neira Ayuso2014-06-161-0/+1
| | | | | | | | | | | | | | | | | | | | This patch allows to indicate the ICMP code field in case that we use to reject. Before, we have always sent network unreachable error as ICMP code, now we can explicitly indicate the ICMP code that we want to use. Examples: nft add rule filter input tcp dport 22 reject with host-unreach nft add rule filter input udp dport 22 reject with host-unreach In this case, it will use the host unreachable code to reject traffic. The default code field still is network unreachable and we can also use the rules without the with like that: nft add rule filter input udp dport 22 reject Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* queue: More compact syntaxÁlvaro Neira Ayuso2014-06-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use a new syntax more compact and break the current syntax. This new syntax is more similar than the nftables syntax that we use usually. We can use range like we have used in other case in nftables. Here, we have some examples: Before, If we want to declare a queue, we have used a syntax like this: nft add rule test input queue num 1 total 3 options bypass,fanout If we want to use the queue number 1 and the two next (total 3), we use a range in the new syntax, for example: nft add rule test input queue num 1-3 bypass fanout Also if we want to use only one queue, the new rules are like: nft add rule test input queue num 1 # queue 1 or nft add rule test input queue # queue 0 And if we want to add a specific flags we only need to put what flags we want to use: nft add rule test input queue bypass we don't need to use options and the comma for indicating the flags. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change type of chain.priority from unsigned int to intHendrik Schwartke2014-06-101-1/+1
| | | | | | | This removes a bug that displays strange hook priorities like "type route hook output priority 4294967146". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table netlink messages to the batchPablo Neira Ayuso2014-05-191-1/+5
| | | | | | | This patch moves the table messages to the netlink batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain netlink messages to the batchPablo Neira Ayuso2014-05-191-0/+4
| | | | | | | This patch moves the chain netlink messages to the big netlink batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set netlink message to the batchPablo Neira Ayuso2014-05-193-0/+16
| | | | | | | | | | | | | This patch moves the netlink set messages to the batch that contains the rules. This helps to speed up rule-set restoration time by changing the operational. To achieve this, an internal set ID which is unique to the batch is allocated as suggested by Patrick. To retain backward compatibility, nft initially guesses if the kernel supports set in batches. Otherwise, it falls back to the previous (slowier) operational. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add events reportingArturo Borrero2014-04-253-0/+19
| | | | | | | | | | This patch adds a basic events reporting option to nft. The syntax is: % nft monitor [new|destroy] [tables|chains|rules|sets|elements] [xml|json] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add socket error reporting helper functionArturo Borrero2014-04-252-0/+2
| | | | | | | | | | | | This patch adds a simple helper function to report errors while opening the Netlink socket. To help users to diagnose problems, a new NFT_EXIT_NONL exit code is included, which is 3. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: generalize chain_print()Arturo Borrero2014-04-251-0/+1
| | | | | | | | Lest generalize the chain_print() function, so we can print a plain chain as the user typed in the basic CLI. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: allow to print sets in plain formatArturo Borrero2014-04-251-0/+3
| | | | | | | | | | | | | Allow to print sets with or without format. This is useful in situations where we want to print more or less the same the user typed (IOW, in one single line, and with family/table info). While at it, make family2str() function public, so it can be used in other places. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-241-0/+4
| | | | | | | | Add support to get an input or output bridge interface name through the relevant meta keys. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gmputil: use MSF/LSF in import/export functions dependant on host byte orderPatrick McHardy2014-04-121-0/+9
| | | | | | | For data of byteorder BYTEORDER_HOST_ENDIAN we need to set the word order dependant on the host byte order. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expression: fix constant expression allocation on big endianArturo Borrero Gonzalez2014-04-121-0/+14
| | | | | | | | | | | | | | | When allocating a constant expression, a pointer to the data is passed to the allocation function. When the variable used to store the data is larger than the size of the data type, this fails on big endian since the most significant bytes (being zero) come first. Add a helper function to calculate the proper address for the cases where this is needed. This currently affects symbolic tables for values < u64 and payload dependency generation for protocol values < u32. Signed-off-by: Patrick McHardy <kaber@trash.net>
* utils: fix -Wcast-align warnings on sparcPatrick McHardy2014-04-091-1/+1
| | | | | | | | | | | The cast to char * in the container_of() marcro causes warnings for all list iteration helpers on sparc: warning: cast increases required alignment of target type [-Wcast-align] Fix by using a void * for address calculations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* ct: add support for setting ct markArturo Borrero2014-03-131-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: abort on interval conflictsPatrick McHardy2014-03-071-1/+1
| | | | | | | | | | | We currently print a debug message (with debugging) and continue. Output a proper error message and abort. While at it, make sure we only report a conflict if there actually is one. This is not the case similar actions, IOW in case of sets, never, in case of maps, only if the mapping differs. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add comparison function for singleton expressionsPatrick McHardy2014-03-071-0/+4
| | | | Singed-off-by: Patrick McHardy <kaber@trash.net>
* expr: make expr_binary_error() usable outside of evaluationPatrick McHardy2014-03-071-3/+3
| | | | | | Turn the eval_ctx argument into a list_head to queue the error to. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add support for rule human-readable commentsPablo Neira Ayuso2014-02-271-0/+2
| | | | | | | | | | | | This patch adds support for human-readable comments: nft add rule filter input accept comment \"accept all traffic\" Note that comments *always* come at the end of the rule. This uses the new data area that allows you to attach information to the rule via netlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: connlabel matching supportFlorian Westphal2014-02-182-0/+4
| | | | | | | | | | | Takes advantage of the fact that the current maximum label storage area is 128 bits, i.e. the dynamically allocated extension area in the kernel will always fit into a nft register. Currently this re-uses rt_symbol_table_init() to read connlabel.conf. This works since the format is pretty much the same. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinarize: convert *all* bitmask values into individual bit valuesPatrick McHardy2014-02-171-0/+6
| | | | | | | | | | | | | | We're currently only converting bitmask types as direct argument to a relational expression in the form of a flagcmp (expr & mask neq 0) back into a list of bit values. This means expressions like: tcp flags & (syn | ack) == syn | ack won't be shown symbolically. Convert *all* bitmask values back to a sequence of inclusive or expressions of the individual bits. In case of a flagcmp, this sequence is further converted to a list (tcp flags syn,ack). Signed-off-by: Patrick McHardy <kaber@trash.net>
* binop: take care of operator precedence when printing binop argumentsPatrick McHardy2014-02-171-0/+2
| | | | | | | | | | | | | | | | | When the argument of a binop is a binop itself, we may need to add parens if the precedence of the argument is lower then the binop. Before: tcp flags & syn | ack == syn | ack tcp flags & syn | ack != syn | ack After: tcp flags & (syn | ack) == syn | ack tcp flags & (syn | ack) != syn | ack Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: add netlink specific locationPatrick McHardy2014-02-051-0/+3
| | | | | | | | | | Add a netlink_location and use it for error messages instead of internal_location. internal:0:0-0: Error: Could not add set: Operation not permitted => netlink: Error: Could not add set: Operation not permitted Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: evaluate commands immediately after parsingPatrick McHardy2014-02-042-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | We currently do parsing and evaluation in two seperate stages. This means that if any error occurs during parsing, we won't evaluate the syntactical correct commands and detect possible evaluation errors in them. In order to improve error reporting, change this to evaluate every command as soon as it is fully parsed. With this in place, the ruleset can be fully validated and all errors reported in one step: tests/error.1:6:23-23: Error: syntax error, unexpected newline filter input tcp dport ^ tests/error.1:7:24-26: Error: datatype mismatch, expected internet network service, expression has type Internet protocol filter input tcp dport tcp ~~~~~~~~~ ^^^ tests/error.1:8:24-32: Error: Right hand side of relational expression (==) must be constant filter input tcp dport tcp dport ~~~~~~~~~~^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: recover from errors in any blockPatrick McHardy2014-02-042-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Move error recovery to the common_block definition to handle errors in any block. Queue those errors and abort parsing once a threshold is reached. With this in place, we can continue parsing when errors occur and show all of them to the user at once. tests/error.1:3:8-8: Error: syntax error, unexpected '{', expecting string filter { ^ tests/error.1:4:13-13: Error: syntax error, unexpected newline filter input ^ tests/error.1:5:17-17: Error: syntax error, unexpected newline filter input tcp ^ tests/error.1:6:23-23: Error: syntax error, unexpected newline filter input tcp dport Signed-off-by: Patrick McHardy <kaber@trash.net>
* ruleset: add XML/JSON exportArturo Borrero Gonzalez2014-01-233-0/+11
| | | | | | | | | | | | | | | | | | | | This patch adds the following operation: :~# nft export <xml|json> The XML/JSON output is provided raw by libnftnl, thus without format. In case of XML, you can give format with the `xmllint' tool from libxml2-tools: :~# nft list ruleset xml | xmllint --format - In case of JSON, you can use `json_pp' from perl standar package: :~# nft list ruleset json | json_pp A format field is added in struct cmd, and it will be reused in the import operation. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd: add create command for tables and chainsPatrick McHardy2014-01-212-3/+5
| | | | | | | | | We currently always use NLM_F_EXCL for add, which makes adding existing chains or tables fail. There's usually no reason why you would care about this, so change "add" to not use NLM_F_EXCL and add a new "create" command in case you do care. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-201-5/+5
|\
| * use new libnftnl library namePablo Neira Ayuso2014-01-201-5/+5
| | | | | | | | | | | | Adapt the current code to use the new library name libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-162-3/+4
|\| | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * src: use ':' instead of '=>' in dictionariesPablo Neira Ayuso2014-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Replace => by : to make it easier for most shell users, as > implies a redirection, let's avoid possible confusion that may result if you forget to escape it. This works fine if you don't forget to add space between the key and the value. If you forget to add the space, depending on the case, the scanner may recognize it correctly or process it as a string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add new --debug=mnl option to enable libmnl debuggingPablo Neira Ayuso2014-01-161-0/+1
| | | | | | | | | | | | | | This allows you to dump the netlink message that is send via libmnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-161-0/+7
|\| | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/payload.c
| * segtree: only use prefix expressions for ranges for selected datatypesPatrick McHardy2014-01-161-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is uncommon to represent f.i. port number ranges as prefix expressions. Introduce a datatype DTYPE_F_PREFIX flag to indicate that the preferred representation of a range is a prefix and use it for segtree decomposition to decide whether to use a range or prefix expression. The ipaddr, ip6addr, mark and realm datatypes are changed to include the DTYPE_F_PREFIX flag. This fixes completely unreadable output in cases where the ranges are representable as prefixes, f.i. in case of port number: { 0/6 => jump chain1, 0/5 => jump chain2, 0/4 => continue} becomes: { 0-1023 => jump chain1, 1024-2047 => jump chain2, 2048-4095 => continue} Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-151-0/+1
|\| | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * segtree: add new segtree debugging optionPablo Neira Ayuso2014-01-151-0/+1
| | | | | | | | | | | | | | | | | | Currently, nft displays the debugging information if it's compiled with --enable-debug (which seems a good idea) and when intervals are used in maps. Add a new option to enable debugging to segtree, so we only get this information when explicitly requested. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-091-1/+1
|\|
| * nftables: fix supression of "permission denied" errorsPatrick McHardy2014-01-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduction of batch support broke displaying of EPERM since those are generated by the kernel before batch processing starts and thus have the sequence number of the NFNL_MSG_BATCH_BEGIN message instead of the command messages. Also only a single error message is generated for the entire batch. This patch fixes this by noting the batch sequence number and displaying the error for all commands since this is what would happen if the permission check was inside batch processing as every other check. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add l4proto supportPatrick McHardy2014-01-081-0/+1
| | | | | | | | | | | | | | | | | | Add support for the meta l4proto type. This is used in the inet table to match on the transport layer protocol without requiring the network layer protocol to be known, allowing to use transport header matches that apply to both IPv4 and IPv6. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add nfproto supportPatrick McHardy2014-01-082-0/+5
| | | | | | | | | | | | | | | | Add support for the meta nfproto type, which refers to the AF from the netfilter hook ops. This is needed to get the actual family of a packet in the dummy NFPROTO_INET family. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | proto: add support for meta templatesPatrick McHardy2014-01-081-0/+11
| | | | | | | | | | | | | | | | | | The following two patches will add two new meta expression types that are used as dependencies in the inet table. To reuse the existing dependency generation code, add a slightly hackish way to specify meta expressions as payload dependencies. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netlink_delinearize: remove implied meta expressionsPatrick McHardy2014-01-081-0/+1
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>