summaryrefslogtreecommitdiffstats
path: root/src/cmd.c
Commit message (Collapse)AuthorAgeFilesLines
* include: include <stdlib.h> in <nft.h>Thomas Haller2023-09-111-1/+0
| | | | | | | | | | | | | | It provides malloc()/free(), which is so basic that we need it everywhere. Include via <nft.h>. The ultimate purpose is to define more things in <nft.h>. While it has not corresponding C sources, <nft.h> can contain macros and static inline functions, and is a good place for things that we shall have everywhere. Since <stdlib.h> provides malloc()/free() and size_t, that is a very basic dependency, that will be needed for that. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add <nft.h> header and include it as firstThomas Haller2023-08-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <config.h> is generated by the configure script. As it contains our feature detection, it want to use it everywhere. Likewise, in some of our sources, we define _GNU_SOURCE. This defines the C variant we want to use. Such a define need to come before anything else, and it would be confusing if different source files adhere to a different C variant. It would be good to use autoconf's AC_USE_SYSTEM_EXTENSIONS, in which case we would also need to ensure that <config.h> is always included as first. Instead of going through all source files and include <config.h> as first, add a new header "include/nft.h", which is supposed to be included in all our sources (and as first). This will also allow us later to prepare some common base, like include <stdbool.h> everywhere. We aim that headers are self-contained, so that they can be included in any order. Which, by the way, already didn't work because some headers define _GNU_SOURCE, which would only work if the header gets included as first. <nft.h> is however an exception to the rule: everything we compile shall rely on having <nft.h> header included as first. This applies to source files (which explicitly include <nft.h>) and to internal header files (which are only compiled indirectly, by being included from a source file). Note that <config.h> has no include guards, which is at least ugly to include multiple times. It doesn't cause problems in practice, because it only contains defines and the compiler doesn't warn about redefining a macro with the same value. Still, <nft.h> also ensures to include <config.h> exactly once. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: move command functions to src/cmd.cPablo Neira Ayuso2023-03-111-0/+206
| | | | | | Move several command functions to src/cmd.c to debloat src/rule.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: improve error reporting for unsupported chain typePablo Neira Ayuso2023-03-111-0/+36
| | | | | | | | | | | | | | | | 8c75d3a16960 ("Reject invalid chain priority values in user space") provides error reporting from the evaluation phase. Instead, this patch infers the error after the kernel reports EOPNOTSUPP. test.nft:3:28-40: Error: Chains of type "nat" must have a priority value above -200 type nat hook prerouting priority -300; ^^^^^^^^^^^^^ This patch also adds another common issue for users compiling their own kernels if they forget to enable CONFIG_NFT_NAT in their .config file. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add GPLv2+ header to .c files of recent creationPablo Neira Ayuso2023-01-021-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch comes after a proposal of mine at NFWS 2022 that resulted in agreement to license recent .c files under GPLv2+ by the attendees at this meeting: - Stefano Brivio - Fernando F. Mancera - Phil Sutter - Jozsef Kadlecsik - Florian Westphal - Laura Garcia - Arturo Borrero - Pablo Neira It has already happened that one of the external library dependencies was moved to GPLv3+ (libreadline), resulting in a change to libedit by default in b4dded0ca78d ("configure: default to libedit for cli"). I have added the GPLv2+ header to the following files: Authors ------- src/cmd.c Pablo src/fib.c Florian src/hash.c Pablo src/iface.c Pablo src/json.c Phil + fixes from occasional contributors src/libnftables.c Eric Leblond and Phil src/mergesort.c Elise Lenion src/misspell.c Pablo src/mnl.c Pablo + fixes from occasional contributors src/monitor.c Arturo src/numgen.c Pablo src/osf.c Fernando src/owner.c Pablo src/parser_json.c Phil + fixes from occasional contributors src/print.c Phil src/xfrm.c Florian src/xt.c Pablo Eric Leblond and Elise Lennion did not attend NFWS 2022, but they acknowledged this license update already in the past when I proposed this to them in private emails. Update COPYING file too to refer that we are now moving towards GPLv2 or any later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove NFT_NLATTR_LOC_MAX limit for netlink location error reportingPablo Neira Ayuso2022-06-271-1/+1
| | | | | | | Set might have more than 16 elements, use a runtime array to store netlink error location. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: filter out tables that are not requestedPablo Neira Ayuso2021-09-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not fetch table content for list commands that specify a table name, e.g. # nft list table filter This speeds up listing of a given table by not populating the cache with tables that are not needed. - Full ruleset (huge with ~100k lines). # sudo nft list ruleset &> /dev/null real 0m3,049s user 0m2,080s sys 0m0,968s - Listing per table is now faster: # nft list table nat &> /dev/null real 0m1,969s user 0m1,412s sys 0m0,556s # nft list table filter &> /dev/null real 0m0,697s user 0m0,478s sys 0m0,220s Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1326 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: incorrect error reporting when table declaration existsPablo Neira Ayuso2021-06-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This example ruleset is missing the chain declaration: add table x add set x y { typeof ip saddr ; } add rule x y counter After this patch, error reporting provides suggestions for the missing chain: # nft -f ruleset.nft ruleset.nft:3:12-12: Error: No such file or directory; did you mean chain ‘INPUT’ in table ip ‘filter’? add rule x y counter ^ Before this patch, it incorrectly refers to the table: ruleset.nft:3:10-10: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x y counter ^ This patch invalidates the table that is found via fuzzy lookup if it exists in the cache. Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: incorrect table location in error reportingPablo Neira Ayuso2021-06-291-8/+8
| | | | | | | | | | | | | | | | | If the command refers to an inexisting table, then use the table location. ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ before this patch location is not correct: ruleset.nft:3:12-12: Error: No such file or directory; did you mean table ‘filter’ in family ip? add rule x x ip saddr @x log prefix "Anti SSH-Bruteforce: " drop ^ Fixes: 0276c2fee939 ("cmd: check for table mismatch first in error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: check for table mismatch first in error reportingPablo Neira Ayuso2021-06-081-14/+57
| | | | | | | | | | | | | | | | | | | | | | | | | If the fuzzy lookup provides a table, check if it is an inexact matching, in that case, report that the table does not exist and provide a mispelling suggestion for the non-existing table. Initialize table to NULL since the fuzzy lookup might return no table at all. This patch fixes misleading error reporting: # nft delete chain xxx yyy Error: No such file or directory; did you mean chain ‘B’ in table ip ‘A’? delete chain xxx yyy ^^^ This refers to table 'xxx' but the suggestion refers to the chain instead. Therefore, if the fuzzy lookup provides an exact matching table, then do the fuzzy lookup for the next non-existing object (either chain, set, ...). Fixes: 3a0e07106f66 ("src: combine extended netlink error reporting with mispelling support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: typo in chain fuzzy lookupPablo Neira Ayuso2021-05-201-1/+1
| | | | | | | | | | | | | | | | Refer to chain, not table. Error: No such file or directory; did you mean table ‘z’ in family ip? add chain x y { type filter nat prerouting priority dstnat; } ^ It should say instead: Error: No such file or directory; did you mean chain ‘z’ in table ip ‘x’? [ Florian added args check for fmt to the netlink_io_error() prototype. ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate nft_cache infrastructurePablo Neira Ayuso2021-05-021-1/+1
| | | | | | | | - prepend nft_ prefix to nft_cache API and internal functions - move declarations to cache.h (and remove redundant declarations) - move struct nft_cache definition to cache.h Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: skip fuzzy lookup for unexisting 64-bit handlePablo Neira Ayuso2021-05-021-0/+15
| | | | | | | | Deletion by handle, if incorrect, should not exercise the misspell lookup functions. Fixes: 3a0e07106f66 ("src: combine extended netlink error reporting with mispelling support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify location parameter in cmd_add_loc()Pablo Neira Ayuso2020-10-191-8/+9
| | | | | | | Constify pointer to location object to compile check for unintentional updates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd: add misspelling suggestions for rule commandsPablo Neira Ayuso2020-06-081-0/+38
| | | | | | | | | # nft add rule foo ber counter Error: No such file or directory; did you mean chain ‘bar’ in table ip ‘foo’? add rule foo ber counter ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: combine extended netlink error reporting with mispelling supportPablo Neira Ayuso2020-02-191-0/+159
Preliminary support: only for the deletion command, e.g. # nft delete table twst Error: No such file or directory; did you mean table ‘test’ in family ip? delete table twst ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>