summaryrefslogtreecommitdiffstats
path: root/src/parser.y
Commit message (Collapse)AuthorAgeFilesLines
* set: make set initializer parsablePatrick McHardy2014-01-161-1/+14
| | | | | | | | | If a set contains elements, the output is not parsable since the elements = { ... } is not understood by the parser. Fix this and also add support for creating constant sets (which only makes sense when using an initializer). Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: make set flags output parsablePatrick McHardy2014-01-161-0/+24
| | | | | | | | | | | | | | | | | | | | | | This patch fixes two problems: - the output of "nft list table ..." is not parsable if sets are included because the parser can't parse the flags. - set flags can't be specified during set creation. To fix this, the set output is changed to: - not print each flag on a single line - prefix the flags with "flags " - only show the interval flag since all others are for internal use only The parser is changed to parse the flags specified in a set declaration. This allows to parse empty sets. The following patch will take care of parsing sets that are already populated. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: use ':' instead of '=>' in dictionariesPablo Neira Ayuso2014-01-161-4/+3
| | | | | | | | | | | | | Replace => by : to make it easier for most shell users, as > implies a redirection, let's avoid possible confusion that may result if you forget to escape it. This works fine if you don't forget to add space between the key and the value. If you forget to add the space, depending on the case, the scanner may recognize it correctly or process it as a string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix compilation breakagePatrick McHardy2014-01-161-1/+1
| | | | | | | | | | | Commit 0bd59cf4da (parser: fix parsing of ethernet protocol types) broke compilation: src/parser.y:26:22: fatal error: if_ether.h: No such file or directory Should be netinet/if_ether.h. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: fix parsing of ethernet protocol typesPablo Neira Ayuso2014-01-161-0/+29
| | | | | | | | | This allows us to use the protocol type keyword, eg. nft add rule ip filter output meta protocol ip6 counter ^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: don't require "meta" keyword for a subset of meta expressionsPatrick McHardy2014-01-151-3/+17
| | | | | | | | | | | | | Don't require the meta keyword for mark, iif, oif, iifname, oifname, skuid, skgid, nftrace, rtclassid and secmark. The protocol and length types still need the meta keyword to avoid grammar conflicts. Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/parser.y
* expr: remove secmark from ct and meta expressionPatrick McHardy2014-01-151-3/+0
| | | | | | The secctx should be used instead of the secmark. Remove for now. Signed-off-by: Patrick McHardy <kaber@trash.net>
* scanner: rename address selector from 'eth' to 'ether'Pablo Neira Ayuso2014-01-141-2/+2
| | | | | | | | | eth may easily occur when using ifname masks. This could be also fixed by interpreting 'eth' as a simple string in the parser but I think this selector also looks more similar to what we use in tcpdump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "parser: replace "vmap" keyword by "map""Patrick McHardy2014-01-141-1/+2
| | | | | | This reverts commit 5e8f8a1807917f92e568437598670b0026462c1c. I missed that this introduces shift-reduce conflicts. Revert for now.
* parser: replace "vmap" keyword by "map"Patrick McHardy2014-01-141-2/+1
| | | | | | Consistently use "map" to express mappings. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: add 'delete map' syntaxPhil Oester2013-11-301-0/+4
| | | | | | | | | | | | | | Creating a map is done via "add map". However, to delete a map requires using "delete set", which is confusing. Add the appropriate synonym to parser. The downside to this is that one can now delete a set with "delete map", but this seems a minor issue. It could of course be fixed by adding a new CMD_OBJ_MAP. This closes netfilter bugzilla #879. Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: segfault in top scope definePhil Oester2013-11-301-0/+1
| | | | | | | | | | | | | | nft segfaults if a symbol is added in top_scope, because of a missing init_list_head. Trivial example: define ip_set = {192.168.1.2, 192.168.2.3} add rule filter output ip daddr $ip_set counter This closes netfilter bugzilla #877. Reported-by: Anand Raj Manickam <anandrm@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix warning on deprecated directive in bisonPablo Neira Ayuso2013-11-181-1/+1
| | | | | | | | src/parser.y:93.1-13: warning: deprecated directive, use ‘%name-prefix’ [-Wdeprecated] %name-prefix="nft_" ^^^^^^^^^^^^^ Reported-by: Anatol Pomozov <anatol.pomozov@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: operational limit matchPhil Oester2013-10-221-8/+5
| | | | | | | | | | | | | | | | | | | | The nft limit match currently does not work at all. Below patches to nftables, libnftables, and kernel address the issue. A few notes on the implementation: - Removed support for nano/micro/milli second limits. These seem pointless, given we are using jiffies in the limit match, not a hpet. And who really needs to limit items down to sub-second level?? - 'depth' member is removed as unnecessary. All we need in the kernel is the rate and the unit. - 'stamp' member becomes the time we need to next refresh the token bucket, instead of being updated on every packet which goes through the match. This closes netfilter bugzilla #827, reported by Eric Leblond. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Better error reporting if chain type is invalidTomasz Bursztyka2013-09-051-3/+13
| | | | | | | | | | | | | This patch verifies at command line parsing that given chain type is valid. Possibilities are: filter, nat, and route. nft add chain test test { type cheese hook input priority 0 }; <cmdline>:1:28-33: Error: unknown chain type cheese add chain test test { type cheese hook input priority 0 }; ^^^^^^ Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add priority keyword on base chain descriptionTomasz Bursztyka2013-09-041-4/+4
| | | | | | | | | | Instead of: add chain foo bar { type route hook input 0; } it should be now: add chain foo bar { type route hook input priority 0; } Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* src: Wrap netfilter hooks around human readable stringsTomasz Bursztyka2013-09-041-5/+16
| | | | | | | | | | | | | | | | | | | This allows to use unique, human readable, hook names for the command line and let the user being unaware of the complex netfilter's hook names and there difference depending on the netfilter family. So: add chain foo bar { type route hook NF_INET_LOCAL_IN 0; } becomes: add chain foo bar { type route hook input 0; } It also fixes then the difference in hook values between families. I.e. ARP family has different values for input, forward and output compared to IPv4, IPv6 or bridge. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the base chain typePablo Neira Ayuso2013-08-271-6/+8
| | | | | | | | | | | | | | | | | | This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add icmpv6 supportEric Leblond2013-07-311-3/+30
| | | | | | | | | | This patch adds ICMPv6 support to nftables. It is now possible to write rules such as: nft add rule ip6 filter input icmpv6 type nd-router-advert accept Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for insertion inside rule listEric Leblond2013-07-191-2/+15
| | | | | | | | | | | | | | This patch adds support to insert and to add rule using a rule handle as reference. The rule handle syntax has an new optional position field which take a handle as argument. Two examples: nft add rule filter output position 5 ip daddr 1.2.3.1 drop nft insert rule filter output position 5 ip daddr 1.2.3.1 drop Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix counter restorationEric Leblond2013-06-121-3/+25
| | | | | | | | | | | | It was not possible to restore a ruleset countaining counter. The packets and bytes fields were not known from the parser but they were in the output of the list command. This patch fixes the issue by restoring correctly the counters if they are present in the command. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix size of internet protocol expressions matching keywordsPatrick McHardy2013-04-231-9/+9
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: include leading '.' in concat subexpression locationPatrick McHardy2013-04-221-0/+6
| | | | | | | | | | | | | | | | Make error messages point to the entire subexpression. Before: filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^ After: filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd/netlink: make sure we always have a location in netlink operationsPatrick McHardy2013-04-181-24/+24
| | | | | | Improve error reporting by always using a location in netlink operations. Signed-off-by: Patrick McHardy<kaber@trash.net>
* rule: allow to list of existing tablesPablo Neira Ayuso2013-04-181-2/+15
| | | | | | | | You can now specify: nft list tables ip to obtain the list of all existing tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add rule insertion (prepend) supportPatrick McHardy2012-12-141-2/+10
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* chains: add chain rename supportPatrick McHardy2012-12-141-3/+12
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: fix parsing protocol names for protocols which are also keywordsPatrick McHardy2012-12-051-0/+63
| | | | | | "ip protocol tcp" will currently produce a syntax error since tcp is also a keyword which is expected ot be followed by a tcp header field. Allow to use protocol names that are also keywords and allocate a constant expression for them.
* netlink: fix creation of base chains with hooknum and priority 0Patrick McHardy2010-07-061-0/+2
| | | | | | | | Base chains with both a hook number and priority of zero are created as regular chains. Fix by adding a BASECHAIN flag indicating that the chain should be created as a base chain. Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: properly parse debug levelsPatrick McHardy2010-07-061-3/+5
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: support bison >= 2.4Patrick McHardy2010-07-061-1/+19
| | | | | | | | | Work around stange behaviour in bison >= 2.4 (see large comment in parser.y for details) and remove the skeleton file since it does not work with 2.4 anymore. Its only purpose was to increase the amount of possible tokens reported in error messages anyways. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: add DCCP packet type definitionsPatrick McHardy2009-07-281-0/+1
| | | | | | | | | | | | | | | | | | | # nft describe dccp type payload expression, datatype dccp_pkttype (DCCP packet type) (basetype integer), 4 bits pre-defined symbolic constants: request 0x0 response 0x1 data 0x2 ack 0x3 dataack 0x4 closereq 0x5 close 0x6 reset 0x7 sync 0x8 syncack 0x9 Signed-off-by: Patrick McHardy <kaber@trash.net>
* add support for new set API and standalone setsPatrick McHardy2009-07-281-98/+193
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* ct: resync netlink header and properly add ct l3protocol supportPatrick McHardy2009-03-311-2/+4
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Fix some memory leaksPatrick McHardy2009-03-201-0/+1
| | | | | | Free nested chain handles and command structures when done. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add support for user-defined symbolic constantsPatrick McHardy2009-03-201-7/+20
| | | | | | | | | | | | | | | | | | User-defined constants can be used like this: define allowed_hosts = { 192.168.0.0/24, 10.0.0.20-10.0.0.30 } define udp_services = domain define tcp_services = { ssh, domain } ip saddr $allowed_hosts udp dport $udp_services counter accept ip saddr $allowed_hosts tcp dport $tcp_services counter accept Recursive definitions are possible, but currently not fully handled. Anything requiring transformations (sets using ranges) can not be used more than once currently since the expressions need to be COW'ed previously. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add support for scoping and symbol bindingPatrick McHardy2009-03-201-2/+30
| | | | | | | | | | | | As a first step towards stand-alone sets, add support for scoping and binding symbols. This will be used for user-defined constants, as well as declarations of modifiable (stand-alone) sets once the kernel side is ready. Scopes are currently limited to three nesting levels: the global scope, table block scopes and chain block scopes. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: consistently use $@ for location of entire groupingPatrick McHardy2009-03-201-15/+15
| | | | | | Replace use of specific location references for single-element rules. Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: fix common_block usage in chain and table blocksPatrick McHardy2009-03-201-2/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Allow newlines in regular mapsPatrick McHardy2009-03-181-3/+5
| | | | | | The previous patch only handled sets and verdict maps. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Allow newlines in sets and mapsPatrick McHardy2009-03-181-11/+29
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+1386