summaryrefslogtreecommitdiffstats
path: root/src/evaluate.c
Commit message (Collapse)AuthorAgeFilesLines
* evaluate: generate ether type payload after meta iiftypePablo Neira Ayuso2016-01-311-7/+10
| | | | | | | | | | | | | | | Once the meta iiftype is generated, we shouldn't return from resolve_protocol_conflict() since we also need to generate the ether type payload implicit match after it. This gets rid of the manual proto-ctx update from meta_iiftype_gen_dependency() that we don't need since stmt_evaluate() already handles this for us. Moreover, skip error reporting once we verify that the protocol conflict has been resolved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: wrap protocol context debunk into functionPablo Neira Ayuso2016-01-311-6/+19
| | | | | | | | ether type vlan sets the network layer protocol context to vlan. This function debunks the existing link layer protocol context by setting it to vlan. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: assert on invalid base in resolve_protocol_conflict()Pablo Neira Ayuso2016-01-311-11/+11
| | | | | | | We already have similar code in the tree, we shouldn't see bases over transport yet. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: only try to replace dummy protocol from link-layer contextPablo Neira Ayuso2016-01-311-11/+14
| | | | | | | | | | | | | Add proto_is_dummy() that returns true for netdev and inet family, the only two using a dummy link-layer protocol base definition. Rename supersede_dep() to meta_iiftype_gen_dependency() since this is generating the implicit meta iiftype check for netdev and inet. This patch also gets rid of the have->length check. The tests pass fine without this so I suspect this is superfluos. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: don't adjust offset from resolve_protocol_conflict()Pablo Neira Ayuso2016-01-311-5/+8
| | | | | | This is not itself a conflict, move this check out of this function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if we have to resolve a conflict in first placePablo Neira Ayuso2016-01-311-11/+14
| | | | | | | So we enter resolve_protocol_conflict() only when we really have a conflict that we want to try to resolve. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: move inet/netdev protocol context supersede logic to supersede_dep()Pablo Neira Ayuso2016-01-311-23/+25
| | | | | | This is a cleanup to untangle this logic a bit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: resolve_protocol_conflict() should return intPablo Neira Ayuso2016-01-311-12/+14
| | | | | | | Instead of bool, expr_error() returns -1 if we fail to create dependencies. We need to propagate this error value. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fwd statement for netdevPablo Neira Ayuso2016-01-311-0/+24
| | | | | | | | | | | This patch add support for the forward statement, only available at the netdev family. # nft add table netdev filter # nft add chain netdev filter ingress { type filter hook ingress device eth0 priority 0\; } # nft add rule netdev filter ingress fwd to dummy0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dup statement for netdevPablo Neira Ayuso2016-01-311-0/+15
| | | | | | | | | | | | This patch contains the missing chunk to add support for the netdev family. Part of the support slipped through in the original patch to add the dup statement for IPv4 and IPv6. # nft add table netdev filter # nft add chain netdev filter ingress { type filter hook ingress device eth0 priority 0\; } # nft add rule netdev filter ingress dup to dummy0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add new netdev protocol descriptionPablo Neira Ayuso2015-12-251-1/+1
| | | | | | | | This relies on NFT_META_PROTOCOL instead of ethernet protocol type header field to prepare support for non-ethernet protocols in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload statementPatrick McHardy2015-11-251-2/+23
| | | | | | | | | Add support for payload mangling using the payload statement. The syntax is similar to the other data changing statements: nft filter output tcp dport set 25 Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: fix string matching on big endianPablo Neira Ayuso2015-11-111-3/+14
| | | | | | | | | | We need to reallocate the constant expression with the right expression length when evaluating the string. Otherwise the linearization step generates a wrong comparison on big endian. We cannot do this any earlier since we don't know the maximum string length for this datatype at the parsing stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow filtering on L2 header in inet familyFlorian Westphal2015-11-061-1/+46
| | | | | | | | | | | | | | | | | | Error: conflicting protocols specified: inet vs. ether tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 ^^^^^^^^^^^ This allows the implicit inet proto dependency to get replaced by an ethernet one. This is possible since by the time we detect the conflict the meta dependency for the network protocol has already been added. So we only need to add another dependency on the Linklayer frame type. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=981 Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add interface wildcard matchingPablo Neira Ayuso2015-11-021-14/+77
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Contrary to iptables, we use the asterisk character '*' as wildcard. # nft --debug=netlink add rule test test iifname eth\* ip test test [ meta load iifname => reg 1 ] [ cmp eq reg 1 0x00687465 ] Note that this generates an optimized comparison without bitwise. In case you want to match a device that contains an asterisk, you have to escape the asterisk, ie. # nft add rule test test iifname eth\\* The wildcard string handling occurs from the evaluation step, where we convert from: relational / \ / \ meta value oifname eth* to: relational / \ / \ meta prefix ofiname As Patrick suggested, this not actually a wildcard but a prefix since it only applies to the string when placed at the end. More comments: * This relaxes the left->size > right->size from netlink_parse_cmp() for strings since the optimization that this patch applies may now result in bogus errors. * This patch can be later on extended to apply a similar optimization to payload expressions when: expr->len % BITS_PER_BYTE == 0 For meta and ct, the kernel checks for the exact length of the attributes (it expects integer 32 bits) so we can't do it unless we relax that. * Wildcard strings are not supported from sets and maps yet. Error reporting is not very good at this stage since expr_evaluate_prefix() doesn't have enough context (ctx->set is NULL, the set object is currently created later after evaluating the lhs and rhs of the relational). I'll be following up on this later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add command "replace" for rulesCarlos Falgueras García2015-11-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | Modify the parser and add necessary functions to provide the command "nft replace rule <ruleid_spec> <new_rule>" Example of use: # nft list ruleset -a table ip filter { chain output { ip daddr 8.8.8.7 counter packets 0 bytes 0 # handle 3 } } # nft replace rule filter output handle 3 ip daddr 8.8.8.8 counter # nft list ruleset -a table ip filter { chain output { ip daddr 8.8.8.8 counter packets 0 bytes 0 # handle 3 } } Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: fix mapping evaluationPablo Neira Ayuso2015-10-231-12/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # cat ruleset.file table ip mangle { map CLASS05 { type ipv4_addr : mark elements = { 192.168.0.10 : 0x00000001} } chain OUTPUT { type route hook output priority 0; policy accept; mark set ip saddr map @CLASS05 } } # nft -f ruleset.file ruleset.file:4:28-54: Error: mapping outside of map context elements = { 192.168.0.10 : 0x00000001} ^^^^^^^^^^^^^^^^^^^^^^^^^^^ This actually is fixing two problems: 1) Validate datatype of the rhs before evaluating the map definition, this is also setting set->datalen which is needed for the element evaluation. 2) Add missing set context. Reported-by: Andreas Schultz <aschultz@tpip.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if table and chain exists when adding rulesPablo Neira Ayuso2015-10-181-0/+11
| | | | | | | | | | | | | | | Assuming a table 'test' that contains a chain 'test': # nft add rule test1 test2 counter <cmdline>:1:1-28: Error: Could not process rule: Table 'test1' does not exist add rule test1 test2 counter ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # nft add rule test test2 counter <cmdline>:1:1-27: Error: Could not process rule: Chain 'test2' does not exist add rule test test2 counter ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if set exists before listing itPablo Neira Ayuso2015-10-121-1/+11
| | | | | | | | | | | | | | After this patch, we obtain: # nft list set ip6 test pepe <cmdline>:1:1-22: Error: Could not process rule: Set 'foo' does not exist list set ip6 test foo ^^^^^^^^^^^^^^^^^^^^^ So we get things aligned with table and chain listing commands. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: add `list chains' commandPablo Neira Ayuso2015-10-121-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft list chains table ip filter { chain test1 { } chain test2 { } chain input { type filter hook input priority 0; policy accept; } } table ip6 filter { chain test1 { } chain input { type filter hook input priority 0; policy accept; } } You can also filter out per family: # nft list chains ip table ip x { chain y { } chain xz { } chain input { type filter hook input priority 0; policy accept; } } # nft list chains ip6 table ip6 filter { chain x { } chain input { type filter hook input priority 0; policy accept; } } This command only shows the chain declarations, so the content (the definition) is omitted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: add dup statement supportPablo Neira Ayuso2015-09-301-2/+31
| | | | | | | | | | This allows you to clone packets to destination address, eg. ... dup to 172.20.0.2 ... dup to 172.20.0.2 device eth1 ... dup to ip saddr map { 192.168.0.2 : 172.20.0.2, ... } device eth1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: support listing expressions that use non-byte header fieldsFlorian Westphal2015-09-181-0/+6
| | | | | | | This allows to list rules that check fields that are not aligned on byte boundary. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: allow stacking vlan header on top of ethernetFlorian Westphal2015-09-181-1/+77
| | | | | | | | | | | | | | | | | | | | currently 'vlan id 42' or even 'vlan type ip' doesn't work since we expect ethernet header but get vlan. So if we want to add another protocol header to the same base, we attempt to figure out if the new header can fit on top of the existing one (i.e. proto_find_num gives a protocol number when asking to find link between the two). We also annotate protocol description for eth and vlan with the full header size and track the offset from the current base. Otherwise, 'vlan type ip' fetches the protocol field from mac header offset 0, which is some mac address. Instead, we must consider full size of ethernet header. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: use existing table object from evaluation contextPablo Neira Ayuso2015-09-111-4/+18
| | | | | | | | | | | | | Skip table object lookup if we are in the context of table declaration already, ctx->table already points to the right table we have to use during the evalution. Otherwise, a list corruption occurs when using the wrong table object when it already exists in the kernel. http://marc.info/?l=netfilter-devel&m=144179814209295&w=2 Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* evaluate: display error on unexisting chain when listingPablo Neira Ayuso2015-08-181-1/+11
| | | | | | | | | nft list chain ip test output <cmdline>:1:1-25: Error: Could not process rule: Chain 'output' does not exist list chain ip test output ^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain declarations to cachePablo Neira Ayuso2015-08-181-2/+18
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add cmd_evaluate_rename()Pablo Neira Ayuso2015-08-181-0/+22
| | | | | | | Make sure the table that we want to rename already exist. This is required by the follow up patch that that adds chains to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set declaration to cachePablo Neira Ayuso2015-08-181-0/+9
| | | | | | | This patch adds set objects to the cache if they don't exist in the kernel, so they can be referenced from this batch. This occurs from the evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set objectsPablo Neira Ayuso2015-08-181-35/+18
| | | | | | | | | | | | | | | | This patch populates the cache only once through netlink_list_sets() during evaluation. As a result, there is a single call to netlink_list_sets(). After this change, we can rid of get_set(). This function was fine by the time we had no transaction support, but this doesn't work for set objects that are declared in this batch, so inquiring the kernel doesn't help since they are not yet available. As a result from this update, the monitor code gets simplified quite a lot since it can rely of the set cache. Moreover, we can now validate that the table and set exists from evaluation path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table declaration to cachePablo Neira Ayuso2015-08-181-2/+13
| | | | | | | | | | Add declared table objects to the cache, thus we can refer to objects that come in this batch but that are not yet available in the kernel. This happens from the evaluation step. Get rid of code that is doing this from the later do_command_*() stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cmd_evaluate_list()Pablo Neira Ayuso2015-08-181-0/+23
| | | | | | | | | | This function validates that the table that we want to list already exists by looking it up from the cache. This also adds cmd_error() to display an error from the evaluation step, when the objects that the rule indicates do not exist. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cache infrastructure and use it for table objectsPablo Neira Ayuso2015-08-181-0/+6
| | | | | | | | | | This patch introduces the generic object cache that is populated during the evaluation phase. The first client of this infrastructure are table objects. As a result, there is a single call to netlink_list_tables(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add netdev family supportPablo Neira Ayuso2015-06-161-0/+4
| | | | | | | | | | | | | | | | | | | | | This patch adds support for the new 'netdev' table. So far, this table allows you to create filter chains from ingress. The following example shows a very simple base configuration with one table that contains a basechain that is attached to the 'eth0': # nft list table netdev filter table netdev filter { chain eth0-ingress { type filter hook ingress device eth0 priority 0; policy accept; } } You can test that this works by adding a simple rule with counters: # nft add rule netdev filter eth0-ingress counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* eval: prohibit variable sized types in concat expressionsPatrick McHardy2015-06-021-0/+7
| | | | | | | | | | Since we need to calculate the length of the entire concat type, we can not support variable sized types where the length can't be determined by the type. This only affects base types since all higher types include a length. Signed-off-by: Patrick McHardy <kaber@trash.net>
* nftables: add set statemetPatrick McHardy2015-04-121-1/+27
| | | | | | | | | | | | The set statement is used to dynamically add or update elements in a set. Syntax: # nft filter input set add tcp dport @myset # nft filter input set add ip saddr timeout 10s @myset # nft filter input set update ip saddr timeout 10s @myset Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: add timeout support for setsPatrick McHardy2015-04-121-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | Timeout support can be enabled in one of two ways: 1. Using a default timeout value: set test { type ipv4_addr; timeout 1h; } 2. Using the timeout flag without a default: set test { type ipv4_addr; flags timeout; } Optionally a garbage collection interval can be specified using gc-interval <interval>; Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add set_elem_expr as container for set element attributesPatrick McHardy2015-04-121-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | Add a new expression type "set_elem_expr" that is used as container for the key in order to attach different attributes, such as timeout values, to the key. The expression hierarchy is as follows: Sets: elem | key Maps: mapping / \ elem data | key Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: missing break; in str2hooknum()Pablo Neira Ayuso2015-03-171-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use stmt_evaluate_arg() in all casesPatrick McHardy2015-01-121-4/+3
| | | | | | | | | When using a symbolic vmap expression, we fail to verify that the map actually contains verdicts. Use stmt_evaluate_arg() everywhere to fix this. Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: check that map expressions' datatype matches mappingsPatrick McHardy2015-01-121-0/+7
| | | | | | | | | | | | Catch type errors in map expressions using named maps: # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set tcp dport map @test <cmdline>:1:38-42: Error: datatype mismatch, map expects IPv4 address, mapping expression has type internet network service filter output mark set tcp dport map @test ~~~~~~~~~ ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: properly set datatype of map expressionPatrick McHardy2015-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | The datatype of the map expression is the datatype of the mappings. # nft add map filter test { type ipv4_addr : inet_service; } # nft filter output mark set ip daddr map @test Before: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type IPv4 address filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:24-41: Error: datatype mismatch: expected packet mark, expression has type internet network service filter output mark set ip daddr map @test ~~~~~~~~~^^^^^^^^^^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: verify named map is actually a mapPatrick McHardy2015-01-121-1/+2
| | | | | | | | | | | | | | | | | | | # nft add set filter test { type ipv4_addr; } # nft filter input ip daddr vmap @test Before: <cmdline>:0:0-32: Error: Could not process rule: Invalid argument filter input ip daddr vmap @test ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ After: <cmdline>:1:28-32: Error: Expression is not a map filter input ip daddr vmap @test ^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: clean up unused variables (pctx)Alvaro Neira Ayuso2015-01-121-3/+0
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* concat: add concat subtype lookup/id helpersPatrick McHardy2015-01-111-6/+3
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: add missing datatype compat checks for statement argumentsPatrick McHardy2015-01-101-23/+43
| | | | | | | | | | | | | | Add a helper function to evaluate expressions used as arguments for statements and report datatype mismatches. Fixes acceptance of mismatching expressions like: $ nft filter output meta mark set ip daddr <cmdline>:1:29-36: Error: datatype mismatch: expected packet mark. expression has type IPv4 address filter output meta mark set ip daddr ~~~~~~~~~~~~~~^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* eval: refactor NAT evaluation functionsPatrick McHardy2015-01-101-56/+54
| | | | | | | | | | The redir and masq evaluation functions include some useless context updates and checks. Refactor the NAT code to have a single instance of address and transport evaluation functions for simplicity and unified error reporting. Signed-off-by: Patrick McHardy <kaber@trash.net>
* erec: use stdio vasprintf instead of gmp_vasprintfSteven Barth2015-01-071-2/+6
| | | | | | | | | Use stdio's vasprintf instead of gmp_vasprintf which is not part of the mini-gmp function subset. Furthermore convert the only gmp-specific user and allow the compiler to verify format-strings. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: fix dependency generation from nft -fPablo Neira Ayuso2015-01-061-1/+2
| | | | | | | | | | | | | | | When nft -f is used, ctx->cmd points to the table object, which contains the corresponding chain, set and rule lists. The reject statement evaluator relies on ctx->cmd->rule to add the payload dependencies, which is doesn't point to the rule in that case. This patch adds the rule context to the eval_ctx structure to update the rule list of statements when generating dependencies, as the reject statement needs. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=993 Reported-by: Ting-Wei Lan <lantw44@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: change concat_type_alloc() to construct type from idPatrick McHardy2014-12-161-5/+6
| | | | | | | The kernel only stored the id so we need to be able to reconstruct the datatype from the id only. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add define for maximum number of bits and mask of datatype idPatrick McHardy2014-12-161-1/+1
| | | | | | | | | | | | | | | | | The id of concat datatypes is composed of the ids of the individual datatypes. Add a define for the number of bits for each datatype id and a mask. The number of bits is chosen as 6, allowing for 63 datatypes, or twice as much as we currently have. This allows for concatenations of 5 types using 32 bits. The value is statically chosen instead of basing it on the current numbers of datatypes since we don't want the maximum concatenation size to vary between versions, also new versions are supposed to be able to propery parse a ruleset generated by an older version. Signed-off-by: Patrick McHardy <kaber@trash.net>