summaryrefslogtreecommitdiffstats
path: root/src/main.c
Commit message (Collapse)AuthorAgeFilesLines
* src: add set netlink message to the batchPablo Neira Ayuso2014-05-191-0/+2
| | | | | | | | | | | | | This patch moves the netlink set messages to the batch that contains the rules. This helps to speed up rule-set restoration time by changing the operational. To achieve this, an internal set ID which is unique to the batch is allocated as suggested by Patrick. To retain backward compatibility, nft initially guesses if the kernel supports set in batches. Otherwise, it falls back to the previous (slowier) operational. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: evaluate commands immediately after parsingPatrick McHardy2014-02-041-7/+1
| | | | | | | | | | | | | | | | | | | | | | | | We currently do parsing and evaluation in two seperate stages. This means that if any error occurs during parsing, we won't evaluate the syntactical correct commands and detect possible evaluation errors in them. In order to improve error reporting, change this to evaluate every command as soon as it is fully parsed. With this in place, the ruleset can be fully validated and all errors reported in one step: tests/error.1:6:23-23: Error: syntax error, unexpected newline filter input tcp dport ^ tests/error.1:7:24-26: Error: datatype mismatch, expected internet network service, expression has type Internet protocol filter input tcp dport tcp ~~~~~~~~~ ^^^ tests/error.1:8:24-32: Error: Right hand side of relational expression (==) must be constant filter input tcp dport tcp dport ~~~~~~~~~~^^^^^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: recover from errors in any blockPatrick McHardy2014-02-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | Move error recovery to the common_block definition to handle errors in any block. Queue those errors and abort parsing once a threshold is reached. With this in place, we can continue parsing when errors occur and show all of them to the user at once. tests/error.1:3:8-8: Error: syntax error, unexpected '{', expecting string filter { ^ tests/error.1:4:13-13: Error: syntax error, unexpected newline filter input ^ tests/error.1:5:17-17: Error: syntax error, unexpected newline filter input tcp ^ tests/error.1:6:23-23: Error: syntax error, unexpected newline filter input tcp dport Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-161-1/+5
|\ | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * src: add new --debug=mnl option to enable libmnl debuggingPablo Neira Ayuso2014-01-161-1/+5
| | | | | | | | | | | | | | This allows you to dump the netlink message that is send via libmnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-151-1/+5
|\| | | | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: include/nftables.h src/main.c
| * segtree: add new segtree debugging optionPablo Neira Ayuso2014-01-151-1/+5
| | | | | | | | | | | | | | | | | | Currently, nft displays the debugging information if it's compiled with --enable-debug (which seems a good idea) and when intervals are used in maps. Add a new option to enable debugging to segtree, so we only get this information when explicitly requested. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-101-2/+2
|\|
| * nftables: shorten "could not process rule in batch" messagePatrick McHardy2014-01-101-2/+2
| | | | | | | | | | | | | | Remove the "in batch" part, it makes most messages exceed a single line, the user doesn't care about this and we process even single rules in "batches". Signed-off-by: Patrick McHardy <kaber@trash.net>
* | Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-091-4/+8
|\|
| * nftables: fix supression of "permission denied" errorsPatrick McHardy2014-01-091-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduction of batch support broke displaying of EPERM since those are generated by the kernel before batch processing starts and thus have the sequence number of the NFNL_MSG_BATCH_BEGIN message instead of the command messages. Also only a single error message is generated for the entire batch. This patch fixes this by noting the batch sequence number and displaying the error for all commands since this is what would happen if the permission check was inside batch processing as every other check. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | proto: add debugging for protocol context updatesPatrick McHardy2014-01-081-1/+5
|/ | | | | | | | | | | | | | | | | | Add a new debugging level to debug updates to the protocol context. Sample output: <cmdline>:1:15-23: Evaluate filter output tcp dport ssh ^^^^^^^^^ tcp update transport layer protocol context: link layer : none network layer : ip transport layer : tcp <- Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: fix return codeArturo Borrero Gonzalez2013-10-171-3/+4
| | | | | | | | | | | | | | | | | | | Exit with NFT_EXIT_FAILURE if something went wrong in the netlink code. Before this patch: internal:0:0-0: Error: Could not find chain `asd' in table `filter': [...] 0 After this patch: internal:0:0-0: Error: Could not find chain `asd' in table `filter': [...] 1 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule batching supportPablo Neira Ayuso2013-09-231-18/+50
| | | | | | | | | | | | | | | | | | | | | | | This patch allows nft to put all rule update messages into one single batch that is sent to the kernel if `-f' option is used. In order to provide fine grain error reporting, I decided to to correlate the netlink message sequence number with the correspoding command sequence number, which is the same. Thus, nft can identify what rules trigger problems inside a batch and report them accordingly. Moreover, to avoid playing buffer size games at batch building stage, ie. guess what is the final size of the batch for this ruleset update will be, this patch collects batch pages that are converted to iovec to ensure linearization when the batch is sent to the kernel. This reduces the amount of unnecessary memory usage that is allocated for the batch. This patch uses the libmnl nlmsg batching infrastructure and it requires the kernel patch entitled (netfilter: nfnetlink: add batch support and use it from nf_tables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: add additional --numeric levelPhil Oester2013-08-221-2/+3
| | | | | | | | | | | | | | Personally, I like seeing ports and IPs numerically, but prefer protocols to be shown by name. As such, add a third --numeric level which will show protocols by number, splitting them out from ports. -n/--numeric When specified once, show network addresses numerically. When specified twice, also show Internet services, user IDs and group IDs numerically. When specified thrice, also show protocols numerically. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add flag to display rule handle as commentEric Leblond2013-05-311-1/+11
| | | | | | | | | | | Knowing the rule handle is necessary to be able to delete a single rule. It was not displayed till now in the output and it was thus impossible to remove a single rule. This patch modify the listing output to add a comment containing the handle when the -a/--handle flag is provided. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: complete basic functionality of the interactive modePablo Neira Ayuso2013-05-191-31/+40
| | | | | | | | | | This patch adds missing code to get basic interactive mode operative via `nft -i', including parsing, evaluation, command execution via netlink and error reporting. Autocomplete is not yet implemented. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix crash if nft -f wrong_file is passedPablo Neira Ayuso2013-04-191-1/+1
| | | | | | | | | Now it displays: nft -f wrong_file internal:0:0-0: Error: Could not open file "wrong_file": No such file or directory Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: fix error checking in nft_parsePablo Neira Ayuso2013-04-181-1/+1
| | | | | | | The bison parser returns 0 in case of success and it returns 1 in case of error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* help: fix of the -I option in help displayRomain Bignon2010-07-061-1/+1
| | | | | | | Trivial patch which fixes typo. Signed-off-by: Romain Bignon <romain@peerfuse.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* don't use internal_location for files specified on command linePatrick McHardy2010-07-061-1/+1
| | | | | | | | | Fixes strange error messages like: In file included from internal:0:0-0: files/examples/sets_and_maps:55:2-2: Error: syntax error, unexpected newline, expecting string Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: properly parse debug levelsPatrick McHardy2010-07-061-2/+54
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: allow runtime control of debugging outputPatrick McHardy2009-07-281-0/+19
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Fix some memory leaksPatrick McHardy2009-03-201-2/+4
| | | | | | Free nested chain handles and command structures when done. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Release scopes during cleanupPatrick McHardy2009-03-201-0/+1
| | | | | | Properly release the user-defined symbols. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+202