summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* include: refresh nf_tables.h cached copyPablo Neira Ayuso2019-05-121-1/+1
| | | | | | Fetch fix for NFT_LOGLEVEL_MAX. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use definitions in include/linux/netfilter/nf_tables.hPablo Neira Ayuso2019-05-121-0/+2
| | | | | | | | | | | | | | | Use NFT_LOGLEVEL_* definitions in UAPI. Make an internal definition of NFT_OSF_F_VERSION, this was originally defined in the UAPI header in the initial patch version, however, this is not available anymore. Add a bison rule to deal with the timeout case. Otherwise, compilation breaks. Fixes: d3869cae9d62 ("include: refresh nf_tables.h cached copy") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh nf_tables.h cached copyPablo Neira Ayuso2019-05-121-38/+140
| | | | | | Refresh it to fetch what we have in 5.2-rc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gmputil: Add missing header for va_listRosen Penev2019-05-061-0/+1
| | | | | | | Otherwise it errors with unknown type name when using uClibc. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use UDATA defines from libnftnlPhil Sutter2019-05-031-32/+0
| | | | | | | | | | | | | Userdata attribute names have been added to libnftnl, use them instead of the local copy. While being at it, rename udata_get_comment() in netlink_delinearize.c and the callback it uses since the function is specific to rules. Also integrate the existence check for NFTNL_RULE_USERDATA into it along with the call to nftnl_rule_get_data(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix double free on xt stmt destructionFlorian Westphal2019-05-011-1/+1
| | | | | | | | | | | | 'nft monitor' dies with: *** Error in `/sbin/nft': double free or corruption (fasttop): 0x000055f8ba57b750 *** ... when the iptables-nft test suite is running in parallel, because xfree(stmt->xt.name) gets called twice. Fixes: 4ac11b890fe870 ("src: missing destroy function in statement definitions") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nat support for the inet familyFlorian Westphal2019-04-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | consider a simple ip6 nat table: table ip6 nat { chain output { type nat hook output priority 0; policy accept; dnat to dead:2::99 } Now consider same ruleset, but using 'table inet nat': nft now lacks context to determine address family to parse 'to $address'. This adds code to make the following work: table inet nat { [ .. ] # detect af from network protocol context: ip6 daddr dead::2::1 dnat to dead:2::99 # use new dnat ip6 keyword: dnat ip6 to dead:2::99 } On list side, the keyword is only shown in the inet family, else the short version (dnat to ...) is used as the family is redundant when the table already mandates the ip protocol version supported. Address mismatches such as table ip6 { .. dnat ip to 1.2.3.4 are detected/handled during the evaluation phase. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add version fingerprint supportFernando Fernandez Mancera2019-04-083-1/+9
| | | | | | | | | | | | | | | Add support for version fingerprint in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" osf ttl skip version "Linux:4.20" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: missing misspell.h in Makefile.amPablo Neira Ayuso2019-03-201-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: file descriptor leak in include_file()Pablo Neira Ayuso2019-03-152-3/+6
| | | | | | | | File that contains the ruleset is never closed, track open files through the nft_ctx object and close them accordingly. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: remove dummy debug_octxPablo Neira Ayuso2019-03-061-1/+2
| | | | | | | | Breaks custom-defined configuration in library mode, ie. user may want to store output in a file, instead of stderr. Fixes: 35f6cd327c2e ("src: Pass stateless, numeric, ip2name and handle variables as structure members.") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: fix build failure with json supportFlorian Westphal2019-02-121-0/+2
| | | | | | Fixes: e3f195777ee54 ("src: expr: remove expr_ops from struct expr") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: remove expr_ops from struct exprFlorian Westphal2019-02-081-5/+4
| | | | | | | | size of struct expr changes from 144 to 128 bytes on x86_64. This doesn't look like much, but large rulesets can have tens of thousands of expressions (each set element is represented by an expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: add expression etypeFlorian Westphal2019-02-081-1/+2
| | | | | | | | Temporary kludge to remove all the expr->ops->type == ... patterns. Followup patch will remove expr->ops, and make expr_ops() lookup the correct expr_ops struct instead to reduce struct expr size. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: payload: export and use payload_expr_cmpFlorian Westphal2019-02-081-0/+2
| | | | | | | expr->ops is going away, so export payload cmp and use it directly. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: add and use expr_name helperFlorian Westphal2019-02-081-0/+2
| | | | | | | | Currently callers use expr->ops->name, but follouwp patch will remove the ops pointer from struct expr. So add this helper and use it everywhere. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add cplusplus guards for externPablo Neira Ayuso2019-01-281-0/+8
| | | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* meta: add iifkind and oifkind supportwenxu2019-01-281-0/+4
| | | | | | | | | | This can be used to match the kind type of iif or oif interface of the packet. Example: add rule inet raw prerouting meta iifkind "vrf" accept Signed-off-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add igmp supportPablo Neira Ayuso2019-01-092-0/+12
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove deprecated code for export/import commandsPablo Neira Ayuso2018-12-272-7/+0
| | | | | | | | | | | | | | | | | | Update parser to display this error message: # nft export json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export json ^^^^^^^^^^^^ Just like: # nft export vm json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export vm json ^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect identifierPablo Neira Ayuso2018-12-011-0/+2
| | | | | | | | | | | | | | | | | # cat test.nft define test = "1.2.3.4" table ip x { chain y { ip saddr $text } } # nft -f test.nft test.nft:5:13-16: Error: unknown identifier 'text'; did you mean identifier ‘test’? ip saddr $text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect objectPablo Neira Ayuso2018-12-011-0/+3
| | | | | | | | | | # nft add counter x test # nft list counter x test Error: No such file or directory; did you mean obj ‘test’ in table ip ‘x’? list counter x text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: provide suggestion for misspelled object namePablo Neira Ayuso2018-11-301-0/+13
| | | | | | | | | | | | Use this from the lookup path, to check for misspellings: # nft add table filter # nft add chain filtre test Error: No such file or directory; did you mean table ‘filter’ in family ip? add chain filtre test ^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: remove type checks in min() and max()Pablo Neira Ayuso2018-11-301-11/+5
| | | | | | So we can pass functions as parameters, needed by follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect setPablo Neira Ayuso2018-11-191-0/+3
| | | | | | | | | # nft rule x y ip saddr @y Error: No such file or directory; did you mean set ‘y’ in table inet ‘x’? rule x y ip saddr @y ^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect chainPablo Neira Ayuso2018-11-191-0/+3
| | | | | | | | | # nft list chain x y Error: No such file or directory; did you mean chain ‘y’ in table inet ‘x’? list chain x y ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect tablePablo Neira Ayuso2018-11-191-0/+2
| | | | | | | | | | | This patch adds simple infrastructure to provide a hints to user on references to incorrect table. While at it, remove "Could not process rule:" which I think it is implicit in the error. # nft rule x y ip saddr @y Error: No such file or directory; did you mean table ‘x’ in family inet? Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: always build with a minimal support for xt match/target decodeFlorian Westphal2018-11-121-12/+1
| | | | | | | | | | When building without libxtables, nft would just silently omit any presence of nft_compat in the output. This adds ifdef-ry to at least print name of target/match involved when libxtables isn't available for decoding. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: pass octx to translate functionFlorian Westphal2018-11-121-2/+3
| | | | | | | We can't use it when no translation is available as libxtables will use plain printf(), but when translation is available we can. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix json_events_cb() declaration when libjansson is not presentLaura Garcia Liebana2018-10-311-1/+2
| | | | | | | | | | | | | | | | | When nftables is configured without libjansson support, the following compilation error is shown: monitor.c: In function ‘netlink_echo_callback’: monitor.c:910:10: error: too many arguments to function ‘json_events_cb’ return json_events_cb(nlh, &echo_monh); ^~~~~~~~~~~~~~ This patch makes a declaration of the json_events_cb() function consistent. Fixes: bb32d8db9a12 ("JSON: Add support for echo option") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of nft_ctx_output_{get,set}_numeric()Pablo Neira Ayuso2018-10-302-10/+9
| | | | | | | | | | | | | | | | | | | | | | | This patch adds NFT_CTX_OUTPUT_NUMERIC_SYMBOL, which replaces the last client of the numeric level approach. This patch updates `-n' option semantics to display all output numerically. Note that monitor code was still using the -n option to skip printing the process name, this patch updates that path too to print it inconditionally to simplify things. Given the numeric levels have no more clients after this patch, remove that code. Update several tests/shell not to use -nn. This patch adds NFT_CTX_OUTPUT_NUMERIC_ALL which enables all flags to provide a fully numerical output. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -y to priority base chain nummericallyPablo Neira Ayuso2018-10-292-0/+6
| | | | | | | | By default base chains are printed using default hook priority definitions. Add -y option to print them as numbers. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add NFT_CTX_OUTPUT_NUMERIC_PROTOPablo Neira Ayuso2018-10-292-0/+6
| | | | | | | | | | | We keep printing layer 4 protocols as literals since we do not use /etc/protocols. This new flag allows us to print it as a number. libnftables internally uses this to print layer 4 protocol as numbers when part of a range. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: default to numeric UID and GID listingPablo Neira Ayuso2018-10-292-0/+6
| | | | | | | | | | | | | Like iptables-save, print UID and GID as numeric values by default. Add a new option `-u' to print the UID and GID names as defined by /etc/passwd and /etc/group. Note that -n is ignored after this patch, since default are numeric printing for UID and GID. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_echo() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-292-3/+6
| | | | | | | | Add NFT_CTX_OUTPUT_ECHO flag and echo the command that has been send to the kernel. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_json() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-292-3/+6
| | | | | | | Add NFT_CTX_OUTPUT_JSON flag and display output in json format. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_handle() to nft_ctx_output_{get,set}_flagsPablo Neira Ayuso2018-10-292-3/+6
| | | | | | | | Add NFT_CTX_OUTPUT_HANDLE flag and print handle that uniquely identify objects from new output flags interface. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_output_{get,set}_stateless() to ↵Pablo Neira Ayuso2018-10-292-3/+6
| | | | | | | | | | | | nft_ctx_output_{get,flags}_flags Add NFT_CTX_OUTPUT_STATELESS flag and enable stateless printing from new output flags interface. This patch adds nft_output_save_flags() and nft_output_restore_flags() to temporarily disable stateful printing Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Revert --literal, add -S/--servicePablo Neira Ayuso2018-10-292-9/+20
| | | | | | | | | | | | | | | | | | | | | | This is a partial revert of b0f6a45b25dd1 ("src: add --literal option") which was added during the development cycle before 0.9.1 is released. After looking at patch: https://patchwork.ozlabs.org/patch/969864/ that allows to print priority, uid, gid and protocols as numerics, I decided to revisit this to provide individual options to turn on literal printing. What I'm proposing is to provide a good default for everyone, and provide options to turn on literal/numeric printing. This patch adds nft_ctx_output_{set,get}_flags() and define two flags to enable reverse DNS lookups and to print ports as service names. This patch introduces -S/--services, to print service names as per /etc/services. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* JSON: Add support for echo optionPhil Sutter2018-10-293-0/+22
| | | | | | | | | | | | | | | | The basic principle is to not return a JSON object freshly created from netlink responses, but just update the existing user-provided one to make sure callers get back exactly what they expect. To achieve that, keep the parsed JSON object around in a global variable ('cur_root') and provide a custom callback to insert handles into it from received netlink messages. The tricky bit here is updating rules since unique identification is problematic. Therefore drop possibly present handles from input and later assume updates are received in order so the first rule not having a handle set is the right one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove netlink_batch_send()Pablo Neira Ayuso2018-10-241-2/+0
| | | | | | Replace it by direct call to mnl_batch_talk(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_flowtable()Pablo Neira Ayuso2018-10-242-10/+4
| | | | | | | We can remove alloc_nftnl_flowtable() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Fix comment for struct eval_ctxPhil Sutter2018-10-241-1/+1
| | | | | | | | Previous change to that struct missed to update the comment. Fixes: 00f777bfc414a ("src: pass struct nft_ctx through struct eval_ctx") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_obj()Pablo Neira Ayuso2018-10-232-8/+3
| | | | | | | We can remove alloc_nftnl_obj() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move socket open and reopen to mnl.cPablo Neira Ayuso2018-10-232-3/+2
| | | | | | | These functions are part of the mnl backend, move them there. Remove netlink_close_sock(), use direct call to mnl_socket_close(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add ttl option supportFernando Fernandez Mancera2018-10-233-1/+7
| | | | | | | | | | | | | | Add support for ttl option in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: reset mnl_socket field in struct nft_ctx on EINTRPablo Neira Ayuso2018-10-221-1/+1
| | | | | | Otherwise we keep using the old netlink socket if we hit EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass struct nft_ctx through struct netlink_ctxPablo Neira Ayuso2018-10-222-13/+6
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass struct nft_ctx through struct eval_ctxPablo Neira Ayuso2018-10-221-4/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus bail out with raw expression from dynamic setsPablo Neira Ayuso2018-10-171-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following ruleset that uses raw expressions: table ip nftlb { map persistency { type inet_service : mark size 65535 timeout 1h elements = { 53 expires 59m55s864ms : 0x00000064, 80 expires 59m58s924ms : 0x00000065, 443 expires 59m56s220ms : 0x00000064 } } chain pre { type filter hook prerouting priority filter; policy accept; ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } } } bogusly bails out with: /tmp/test:9:57-64: Error: datatype mismatch: expected internet network service, expression has type integer ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix the problem by evaluating expression basetype and length in this case. Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>