summaryrefslogtreecommitdiffstats
path: root/src/json.c
Commit message (Collapse)AuthorAgeFilesLines
* json: Accept more than two operands in binary expressionsPhil Sutter13 days1-3/+16
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Support maps with concatenated dataPhil Sutter2024-03-191-5/+5
| | | | | | | Dump such maps with an array of types in "map" property, make the parser aware of this. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Order output like nft_cmd_expand()Phil Sutter2024-03-191-3/+5
| | | | | | | | Print empty chain add commands early in list so following verdict maps and rules referring to them won't cause spurious errors when loading the resulting ruleset dump. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Support sets' auto-merge optionPhil Sutter2024-01-311-0/+2
| | | | | | | | If enabled, list the option as additional attribute with boolean value. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1734 Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: deal appropriately with multidevice in chainPablo Neira Ayuso2023-11-231-12/+13
| | | | | | | | | | | | | | | | Chain device support is broken in JSON: listing does not include devices and parser only deals with one single device. Use existing json_parse_flowtable_devs() function, rename it to json_parse_devs() to parse the device array. Use the dev_array that contains the device names (as string) for the listing. Update incorrect .json-nft files in tests/shell. Fixes: 3fdc7541fba0 ("src: add multidevice support for netdev chain") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix use after free in table_flags_json()Thomas Haller2023-11-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add `$NFT -j list ruleset` to the end of "tests/shell/testcases/transactions/table_onoff". Then valgrind will find this issue: $ make -j && ./tests/shell/run-tests.sh tests/shell/testcases/transactions/table_onoff -V Gives: ==286== Invalid read of size 4 ==286== at 0x49B0261: do_dump (dump.c:211) ==286== by 0x49B08B8: do_dump (dump.c:378) ==286== by 0x49B08B8: do_dump (dump.c:378) ==286== by 0x49B04F7: do_dump (dump.c:273) ==286== by 0x49B08B8: do_dump (dump.c:378) ==286== by 0x49B0E84: json_dump_callback (dump.c:465) ==286== by 0x48AF22A: do_command_list_json (json.c:2016) ==286== by 0x48732F1: do_command_list (rule.c:2335) ==286== by 0x48737F5: do_command (rule.c:2605) ==286== by 0x48A867D: nft_netlink (libnftables.c:42) ==286== by 0x48A92B1: nft_run_cmd_from_buffer (libnftables.c:597) ==286== by 0x402CBA: main (main.c:533) Fixes: e70354f53e9f ("libnftables: Implement JSON output support") Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove xfree() and use plain free()Thomas Haller2023-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xmalloc() (and similar x-functions) are used for allocation. They wrap malloc()/realloc() but will abort the program on ENOMEM. The meaning of xmalloc() is that it wraps malloc() but aborts on failure. I don't think x-functions should have the notion, that this were potentially a different memory allocator that must be paired with a particular xfree(). Even if the original intent was that the allocator is abstracted (and possibly not backed by standard malloc()/free()), then that doesn't seem a good idea. Nowadays libc allocators are pretty good, and we would need a very special use cases to switch to something else. In other words, it will never happen that xmalloc() is not backed by malloc(). Also there were a few places, where a xmalloc() was already "wrongly" paired with free() (for example, iface_cache_release(), exit_cookie(), nft_run_cmd_from_buffer()). Or note how pid2name() returns an allocated string from fscanf(), which needs to be freed with free() (and not xfree()). This requirement bubbles up the callers portid2name() and name_by_portid(). This case was actually handled correctly and the buffer was freed with free(). But it shows that mixing different allocators is cumbersome to get right. Of course, we don't actually have different allocators and whether to use free() or xfree() makes no different. The point is that xfree() serves no actual purpose except raising irrelevant questions about whether x-functions are correctly paired with xfree(). Note that xfree() also used to accept const pointers. It is bad to unconditionally for all deallocations. Instead prefer to use plain free(). To free a const pointer use free_const() which obviously wraps free, as indicated by the name. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: include <string.h> in <nft.h>Thomas Haller2023-09-281-1/+0
| | | | | | | | <string.h> provides strcmp(), as such it's very basic and used everywhere. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in map statement keyPablo Neira Ayuso2023-09-271-0/+19
| | | | | | | | | | | | | | | | | This fix is similar to 22d201010919 ("netlink_linearize: skip set element expression in set statement key") to fix map statement. netlink_gen_map_stmt() relies on the map key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. This includes JSON support to make this feature complete and it updates tests/shell to cover for this support. Reported-by: Luci Stanescu <luci@cnix.ro> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: expose dynamic flagPablo Neira Ayuso2023-09-271-0/+2
| | | | | | | | | | The dynamic flag is not exported via JSON, this triggers spurious ENOTSUPP errors when restoring rulesets in JSON with dynamic flags set on. Fixes: 6e45b102650a2 ("nft: set: print dynamic flag when set") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add <nft.h> header and include it as firstThomas Haller2023-08-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | <config.h> is generated by the configure script. As it contains our feature detection, it want to use it everywhere. Likewise, in some of our sources, we define _GNU_SOURCE. This defines the C variant we want to use. Such a define need to come before anything else, and it would be confusing if different source files adhere to a different C variant. It would be good to use autoconf's AC_USE_SYSTEM_EXTENSIONS, in which case we would also need to ensure that <config.h> is always included as first. Instead of going through all source files and include <config.h> as first, add a new header "include/nft.h", which is supposed to be included in all our sources (and as first). This will also allow us later to prepare some common base, like include <stdbool.h> everywhere. We aim that headers are self-contained, so that they can be included in any order. Which, by the way, already didn't work because some headers define _GNU_SOURCE, which would only work if the header gets included as first. <nft.h> is however an exception to the rule: everything we compile shall rely on having <nft.h> header included as first. This applies to source files (which explicitly include <nft.h>) and to internal header files (which are only compiled indirectly, by being included from a source file). Note that <config.h> has no include guards, which is at least ugly to include multiple times. It doesn't cause problems in practice, because it only contains defines and the compiler doesn't warn about redefining a macro with the same value. Still, <nft.h> also ensures to include <config.h> exactly once. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftutils: add and use wrappers for getprotoby{name,number}_r(), ↵Thomas Haller2023-08-201-11/+11
| | | | | | | | | | | | | | | getservbyport_r() We should aim to use the thread-safe variants of getprotoby{name,number} and getservbyport(). However, they may not be available with other libc, so it requires a configure check. As that is cumbersome, add wrappers that do that at one place. These wrappers are thread-safe, if libc provides the reentrant versions. Use them. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: use strtok_r() instead of strtok()Thomas Haller2023-08-181-2/+3
| | | | | | | | | strtok_r() is probably(?) everywhere available where we care. Use it. It is thread-safe, and libnftables shouldn't make assumptions about what other threads of the process are doing. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: Cache looked up set for list commandsPhil Sutter2023-07-131-3/+6
| | | | | | | | | | Evaluation phase checks the given table and set exist in cache. Relieve execution phase from having to perform the lookup again by storing the set reference in cmd->set. Just have to increase the ref counter so cmd_free() does the right thing (which lacked handling of MAP and METER objects for some reason). Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: add inner payload supportPablo Neira Ayuso2023-06-201-5/+13
| | | | | | Add support for vxlan, geneve, gre and gretap. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add json support for last statementPablo Neira Ayuso2023-06-201-0/+8
| | | | | | | | | | This patch adds json support for the last statement, it works for me here. However, tests/py still displays a warning: any/last.t: WARNING: line 12: '{"nftables": [{"add": {"rule": {"family": "ip", "table": "test-ip4", "chain": "input", "expr": [{"last": {"used": 300000}}]}}}]}': '[{"last": {"used": 300000}}]' mismatches '[{"last": null}]' Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: add boolean DCCP option matchingJeremy Sowden2023-06-011-0/+5
| | | | | | | | | | Iptables supports the matching of DCCP packets based on the presence or absence of DCCP options. Extend exthdr expressions to add this functionality to nftables. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=930 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: allow to specify comment on chainPablo Neira Ayuso2023-04-251-0/+3
| | | | | | Allow users to add a comment when declaring a chain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: allow to specify comment on tablePablo Neira Ayuso2023-04-241-0/+3
| | | | | | | | | | | | | | | | | | | | Allow users to add a comment when declaring a table: # sudo nft add table inet test3 '{comment "this is a comment";}' # nft list ruleset table inet test3 { comment "this is a comment" } # nft -j list ruleset {"nftables": [{"metainfo": {"version": "1.0.7", "release_name": "Old Doc Yak", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "test3", "handle": 3, "comment": "this is a comment"}}]} # nft -j list ruleset > test.json # nft flush ruleset # nft -j -f test.json # nft -j list ruleset {"nftables": [{"metainfo": {"version": "1.0.7", "release_name": "Old Doc Yak", "json_schema_version": 1}}, {"table": {"family": "inet", "name": "test3", "handle": 4, "comment": "this is a comment"}}]} Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1670 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement 'reset rule' and 'reset rules' commandsPhil Sutter2023-01-181-0/+1
| | | | | | | | Reset rule counters and quotas in kernel, i.e. without having to reload them. Requires respective kernel patch to support NFT_MSG_GETRULE_RESET message type. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: Add GPLv2+ header to .c files of recent creationPablo Neira Ayuso2023-01-021-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch comes after a proposal of mine at NFWS 2022 that resulted in agreement to license recent .c files under GPLv2+ by the attendees at this meeting: - Stefano Brivio - Fernando F. Mancera - Phil Sutter - Jozsef Kadlecsik - Florian Westphal - Laura Garcia - Arturo Borrero - Pablo Neira It has already happened that one of the external library dependencies was moved to GPLv3+ (libreadline), resulting in a change to libedit by default in b4dded0ca78d ("configure: default to libedit for cli"). I have added the GPLv2+ header to the following files: Authors ------- src/cmd.c Pablo src/fib.c Florian src/hash.c Pablo src/iface.c Pablo src/json.c Phil + fixes from occasional contributors src/libnftables.c Eric Leblond and Phil src/mergesort.c Elise Lenion src/misspell.c Pablo src/mnl.c Pablo + fixes from occasional contributors src/monitor.c Arturo src/numgen.c Pablo src/osf.c Fernando src/owner.c Pablo src/parser_json.c Phil + fixes from occasional contributors src/print.c Phil src/xfrm.c Florian src/xt.c Pablo Eric Leblond and Elise Lennion did not attend NFWS 2022, but they acknowledged this license update already in the past when I proposed this to them in private emails. Update COPYING file too to refer that we are now moving towards GPLv2 or any later. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: Rewrite unsupported compat expression dumpingPhil Sutter2022-12-131-6/+13
| | | | | | | | | Choose a format which provides more information and is easily parseable. Then teach parsers about it and make it explicitly reject the ruleset giving a meaningful explanation. Also update the man pages with some more details. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: add stateful object comment supportFernando Fernandez Mancera2022-09-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | When listing a stateful object with JSON support, the comment was ignored. Output example: { "counter": { "family": "inet", "name": "mycounter", "table": "t", "handle": 1, "comment": "my comment in counter", "packets": 0, "bytes": 0 } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1611 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: fix empty statement list output in sets and mapsFernando Fernandez Mancera2022-09-051-29/+32
| | | | | | | | | | | | JSON output of sets and map should not include the statements list if is empty. The statement output should be stateless also. In addition, removes duplicated code. Fixes: 07958ec53830 ("json: add set statement list support") Fixes: e66f3187d891 ("json: add table map statement support") Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add table map statement supportFernando Fernandez Mancera2022-09-031-28/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When listing a map with statements with JSON support, the statement list were ignored. Output example: { "map": { "family": "ip", "name": "m", "table": "t", "type": "ipv4_addr", "handle": 1, "map": "mark", "stmt": [ { "counter": { "packets": 0, "bytes": 0 } } ] } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1588 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: add set statement list supportFernando Fernandez Mancera2022-09-011-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When listing a set with statements with JSON support, the statements were ignored. Output example: { "set": { "op": "add", "elem": { "payload": { "protocol": "ip", "field": "saddr" } }, "stmt": [ { "limit": { "rate": 10, "burst": 5, "per": "second" } }, { "counter": { "packets": 0, "bytes": 0 } } ], "set": "@my_ssh_meter" } } Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1495 Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: update json output ordering to place rules after chainsChander Govindarajan2022-05-241-2/+5
| | | | | | | | | | | | | | | | | | Currently the json output of `nft -j list ruleset` interleaves rules with chains. As reported in this bug: https://bugzilla.netfilter.org/show_bug.cgi?id=1580 the json cannot be fed into `nft -j -f <file>` since rules may reference chains that are created later Instead create rules after all chains are output. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1580 Signed-off-by: ChanderG <mail@chandergovind.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp option reset supportFlorian Westphal2022-02-281-0/+6
| | | | | | | This allows to replace a tcp option with nops, similar to the TCPOPTSTRIP feature of iptables. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: add flow statement json export + parserFlorian Westphal2022-02-071-0/+7
| | | | | | | | | | | flow statement has no export, its shown as: ".. }, "flow add @ft" ] } }" With this patch: ".. }, {"flow": {"op": "add", "flowtable": "@ft"}}]}}" Signed-off-by: Florian Westphal <fw@strlen.de>
* src: infer NAT mapping with concatenation from setPablo Neira Ayuso2021-07-131-2/+0
| | | | | | | | | | | | If the map is anonymous, infer it from the set elements. Otherwise, the set definition already have an explicit concatenation definition in the data side of the mapping. This update simplifies the NAT mapping syntax with concatenations, e.g. snat ip to ip saddr map { 10.141.11.4 : 192.168.2.3 . 80 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove STMT_NAT_F_INTERVAL flags and interval keywordPablo Neira Ayuso2021-07-131-2/+0
| | | | | | | | | | | | | | | STMT_NAT_F_INTERVAL is not useful, the keyword interval can be removed to simplify the syntax, e.g. snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } This patch reworks 9599d9d25a6b ("src: NAT support for intervals in maps"). Do not remove STMT_NAT_F_INTERVAL yet since this flag is needed for interval concatenations coming in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Drop pointless assignment in exthdr_expr_json()Phil Sutter2021-06-141-1/+0
| | | | | | | The updated value of 'is_exists' is no longer read at this point. Fixes: cb21869649208 ("json: tcp: add raw tcp option match support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Print warnings to stderr rather than stdoutKerin Millar2021-06-091-3/+5
| | | | | | | | Unsurprisingly, printing warnings to stdout results in malformed JSON. Signed-off-by: Kerin Millar <kfm@plushkava.net> Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1511 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: catchall element supportFlorian Westphal2021-06-021-0/+5
| | | | | | | Treat '*' as catchall element, not as a symbol. Also add missing json test cases for wildcard set support. Signed-off-by: Florian Westphal <fw@strlen.de>
* json: fix base chain outputFlorian Westphal2021-06-021-1/+1
| | | | | | | | | | | nft-test.py -j fails with python: json.c:243: chain_print_json: Assertion `__out' failed. The member was changed from char * to a struct, pass the name again. Fixes: 5008798157e2114f ("libnftables: location-based error reporting for chain type") Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit cabe8992b3ee4eb0001a07075b317d966df6bcbd)
* exthdr: Implement SCTP Chunk matchingPhil Sutter2021-05-191-0/+2
| | | | | | | | Extend exthdr expression to support scanning through SCTP packet chunks and matching on fixed fields' values. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Florian Westphal <fw@strlen.de>
* json: Simplify non-tcpopt exthdr printing a bitPhil Sutter2021-05-191-11/+7
| | | | | | This was just duplicate code apart from the object's name. Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_bison: add shortcut syntax for matching flags without binary operationsPablo Neira Ayuso2021-05-161-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the following shortcut syntax: expression flags / flags instead of: expression and flags == flags For example: tcp flags syn,ack / syn,ack,fin,rst ^^^^^^^ ^^^^^^^^^^^^^^^ value mask instead of: tcp flags and (syn|ack|fin|rst) == syn|ack The second list of comma-separated flags represents the mask which are examined and the first list of comma-separated flags must be set. You can also use the != operator with this syntax: tcp flags != fin,rst / syn,ack,fin,rst This shortcut is based on the prefix notation, but it is also similar to the iptables tcp matching syntax. This patch introduces the flagcmp expression to print the tcp flags in this new notation. The delinearize path transforms the binary expression to this new flagcmp expression whenever possible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for tablePablo Neira Ayuso2021-05-021-7/+9
| | | | | | | | | | | | Add a hashtable for fast table lookups. Tables that reside in the cache use the table->cache_hlist and table->cache_list heads. Table that are created from command line / ruleset are also added to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for flowtablePablo Neira Ayuso2021-05-021-4/+4
| | | | | | | | | | Add flowtable hashtable cache. Actually I am not expecting that many flowtables to benefit from the hashtable to be created by streamline this code with tables, chains, sets and policy objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for objectPablo Neira Ayuso2021-05-021-2/+2
| | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for object lookups. This patch also splits table->objs in two: - Sets that reside in the cache are stored in the new tables->cache_obj and tables->cache_obj_ht. - Set that defined via command line / ruleset file reside in tables->obj. Sets in the cache (already in the kernel) are not placed in the table->objs list. By keeping separated lists, objs defined via command line / ruleset file can be added to cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate object cache infrastructurePablo Neira Ayuso2021-05-021-5/+5
| | | | | | | This patch consolidates the object cache infrastructure. Update set and chains to use it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for setsPablo Neira Ayuso2021-04-031-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for set lookups. This patch also splits table->sets in two: - Sets that reside in the cache are stored in the new tables->cache_set and tables->cache_set_ht. - Set that defined via command line / ruleset file reside in tables->set. Sets in the cache (already in the kernel) are not placed in the table->sets list. By keeping separated lists, sets defined via command line / ruleset file can be added to cache. Adding 10000 sets, before: # time nft -f x real 0m6,415s user 0m3,126s sys 0m3,284s After: # time nft -f x real 0m3,949s user 0m0,743s sys 0m3,205s Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: split chain list in tablePablo Neira Ayuso2021-04-031-3/+3
| | | | | | | | | | | | | | | | | | | This patch splits table->lists in two: - Chains that reside in the cache are stored in the new tables->cache_chain and tables->cache_chain_ht. The hashtable chain cache allows for fast chain lookups. - Chains that defined via command line / ruleset file reside in tables->chains. Note that chains in the cache (already in the kernel) are not placed in the table->chains. By keeping separated lists, chains defined via command line / ruleset file can be added to cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: rework flags printingPablo Neira Ayuso2021-03-021-1/+1
| | | | | | | Simplify routine to print the table flags. Add table_flag_name() and use it from json too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Do not abbreviate reject statement objectPhil Sutter2021-02-031-8/+0
| | | | | | | | | No need to reduce output size, also this way output is more predictable. While being at it, drop some pointless chunks from tests/py/bridge/reject.t.json.output. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: limit: Always include burst valuePhil Sutter2021-01-271-7/+5
| | | | | | The default burst value is non-zero, so JSON output should include it. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add set element multi-statement supportPablo Neira Ayuso2020-12-181-3/+7
| | | | | | | | Extend the set element infrastructure to support for several statements. This patch places the statements right after the key when printing it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: enable json echo output when reading native syntaxJose M. Guisado Gomez2020-12-021-2/+15
| | | | | | | | | | | | | | | | | | | | This patch fixes a bug in which nft did not print any output when specifying --echo and --json and reading nft native syntax. This patch respects behavior when input is json, in which the output would be the identical input plus the handles. Adds a json_echo member inside struct nft_ctx to build and store the json object containing the json command objects, the object is built using a mock monitor to reuse monitor json code. This json object is only used when we are sure we have not read json from input. [ added json_alloc_echo() to compile without json support --pablo ] Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1446 Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Tested-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: tcp: add raw tcp option match supportFlorian Westphal2020-11-091-10/+12
| | | | | | | | | To similar change as in previous one, this time for the jason (de)serialization. Re-uses the raw payload match syntax, i.e. base,offset,length. Signed-off-by: Florian Westphal <fw@strlen.de>