summaryrefslogtreecommitdiffstats
path: root/src/payload.c
Commit message (Collapse)AuthorAgeFilesLines
* payload: assert when accessing inner transport headerPablo Neira Ayuso2015-01-041-0/+1
| | | | | | | | | | Instead of segfaulting due to out of bound access access to protocol context array ctx->protocol[base].location from proto_ctx_update(). # nft add rule filter input ah nexthdr tcp nft: payload.c:88: payload_expr_pctx_update: Assertion `left->payload.base + 1 <= (__PROTO_BASE_MAX - 1)' failed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix endianess issue in payload_expr_pctx_update()Pablo Neira Ayuso2014-12-051-2/+2
| | | | | | | | Use constant_data_ptr() to point to the right memory position on big endian when exporting data that is stored in a larger variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Christophe Leroy <christophe.leroy@c-s.fr>
* nft: complete reject supportAlvaro Neira2014-10-091-5/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use the reject action in rules. For example: nft add rule filter input udp dport 22 reject In this rule, we assume that the reason is network unreachable. Also we can specify the reason with the option "with" and the reason. For example: nft add rule filter input tcp dport 22 reject with icmp type host-unreachable In the bridge tables and inet tables, we can use this action too. For example: nft add rule inet filter input reject with icmp type host-unreachable In this rule above, this generates a meta nfproto dependency to match ipv4 traffic because we use a icmpv4 reason to reject. If the reason is not specified, we infer it from the context. Moreover, we have the new icmpx datatype. You can use this datatype for the bridge and the inet tables to simplify your ruleset. For example: nft add rule inet filter input reject with icmpx type host-unreachable We have four icmpx reason and the mapping is: ICMPX reason | ICMPv6 | ICMPv4 | | admin-prohibited | admin-prohibited | admin-prohibited port-unreachable | port-unreachable | port-unreachable no-route | no-route | net-unreachable host-unreachable | addr-unreachable | host-unreachable Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Enhance payload_gen_dependency()Alvaro Neira2014-10-091-3/+15
| | | | | | | | | | With this patch, this function returns a statement with the new dependency that we want to add, instead of an expression. This change is needed in a follow up patch. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: generate dependency in the appropriate byteorderAlvaro Neira2014-10-091-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we add a dependency, the constant expression on the right hand side must be represented in the appropriate order. Example without this patch: nft add rule bridge filter input reject with icmp-host-unreach --debug netlink [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000800 ] [ reject type 0 code 1 ] When we create the payload expression we have the right value in host endian but this has to be in big endian. With this patch, if we add the same rule: nft add rule bridge filter input reject with icmp-host-unreach --debug netlink [ payload load 2b @ link header + 12 => reg 1 ] [ cmp eq reg 1 0x00000008 ] [ reject type 0 code 1 ] The new dependency is converted to big endian. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add specific byteorder to the struct proto_hdr_templateAlvaro Neira Ayuso2014-09-171-1/+1
| | | | | | | | | | | | | | | | | | | | | If we try to add a rule like: nft add rule filter input udp length {55-9999} nftable shows: BUG: invalid byte order conversion 0 => 2 nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed. Some of the existing payload fields rely on BYTEORDER_INVALID. Therefore, if we try to convert it in evaluation step, we hit this bug. This patch allows to add a specific byteorder to the struct proto_hdr_template. If we create a expression with a invalid byteorder, we will use the byteorder added to the proto_hdr_template structure. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: use proto_unknown for raw protocol headerYuxuan Shui2014-08-201-0/+1
| | | | | | | Otherwise payload.desc would be NULL, which causes the crash in bug 915. Signed-off-by: Yuxuan Shui <yshuiv7@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: take endianess into account when updating the payload contextPatrick McHardy2014-08-191-1/+8
| | | | | | | | | | | | payload_expr_pctx_update() uses the numeric protocol value in host byte order to find the upper layer protocol. This obviously doesn't work for protocol expressions in other byte orders, such as the ethernet protocol on little endian. Export the protocol value in the correct byte order and use that value to look up the upper layer protocol. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expression: fix constant expression allocation on big endianArturo Borrero Gonzalez2014-04-121-1/+2
| | | | | | | | | | | | | | | When allocating a constant expression, a pointer to the data is passed to the allocation function. When the variable used to store the data is larger than the size of the data type, this fails on big endian since the most significant bytes (being zero) come first. Add a helper function to calculate the proper address for the cases where this is needed. This currently affects symbolic tables for values < u64 and payload dependency generation for protocol values < u32. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add comparison function for singleton expressionsPatrick McHardy2014-03-071-0/+9
| | | | Singed-off-by: Patrick McHardy <kaber@trash.net>
* expr: make expr_binary_error() usable outside of evaluationPatrick McHardy2014-03-071-4/+4
| | | | | | Turn the eval_ctx argument into a list_head to queue the error to. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: add l4proto supportPatrick McHardy2014-01-081-0/+6
| | | | | | | | | Add support for the meta l4proto type. This is used in the inet table to match on the transport layer protocol without requiring the network layer protocol to be known, allowing to use transport header matches that apply to both IPv4 and IPv6. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: add nfproto supportPatrick McHardy2014-01-081-1/+1
| | | | | | | | Add support for the meta nfproto type, which refers to the AF from the netfilter hook ops. This is needed to get the actual family of a packet in the dummy NFPROTO_INET family. Signed-off-by: Patrick McHardy <kaber@trash.net>
* proto: add support for meta templatesPatrick McHardy2014-01-081-1/+5
| | | | | | | | | The following two patches will add two new meta expression types that are used as dependencies in the inet table. To reuse the existing dependency generation code, add a slightly hackish way to specify meta expressions as payload dependencies. Signed-off-by: Patrick McHardy <kaber@trash.net>
* proto: add helper function to update protocol contextPatrick McHardy2014-01-081-2/+1
| | | | | | Add a helper function which is to be used to update the protocol update. Signed-off-by: Patrick McHardy <ksber@trash.net<
* expr: add protocol context update callbackPatrick McHardy2014-01-081-24/+26
| | | | | | | | | | Add a callback function to the expression ops to update the protocol context for relational protocol expressions (EXPR_F_PROTOCOL). Also set the EXPR_F_PROTOCOL flag for IIFTYPE meta expressions to make sure the callback is invoked when necessary. Signed-off-by: Patrick McHardy <kaber@trash.net>
* nftables: generic procotol contextsPatrick McHardy2014-01-081-768/+31
| | | | | | | | | | | | | | | Currently the context of higher layer protocols is specific to payload expressions with some special cases for meta IIFTYPE expressions. This approach has a few shortcomings, concretely there are more expression types which define upper layer protocols like the ct expression and two upcoming new types for the meta expression. Replace the payload context by a generic protocol context to deal with this. This patch just splits off the requires parts from the payload expression without any functional changes, the following patches will add further functionality for other expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: replace PAYLOAD_PROTOCOL_EXPR by generic flagPatrick McHardy2014-01-081-4/+5
| | | | | | | Introduce a generic flag to indicate that an expression describes the upper layer protocol as replacement for the payload specific flag. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: fix ethernet type protocol matchingPablo Neira Ayuso2013-11-041-1/+1
| | | | | | | | | This fixes ethernet type protocol matching, which is needed to match network layer information, eg. nft add rule bridge filter input ip protocol icmp counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix endianess of ARP operation codePablo Neira Ayuso2013-09-141-1/+1
| | | | | | | | | | So it display compatibility command: xtables-arp -A INPUT --opcode Reply -j DROP accordinly: arp plen 4 arp operation reply counter packets 0 bytes 0 drop
* src: Add icmpv6 supportEric Leblond2013-07-311-0/+59
| | | | | | | | | | This patch adds ICMPv6 support to nftables. It is now possible to write rules such as: nft add rule ip6 filter input icmpv6 type nd-router-advert accept Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: accept ethertype in hexadecimalPablo Neira Ayuso2013-04-201-1/+21
| | | | | | | You can use the symbols ip, ip6, arp and vlan, or alternatively the ethertype protocol number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* types: add ethernet address typePatrick McHardy2013-04-181-1/+10
| | | | | | | | Add a new type for ethernet addresses. This is needed since for concatenations we need fixed sized data types, the generic link layer address doesn't have a fixed length. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: fix crash with uncombinable protocolsPatrick McHardy2010-07-061-5/+10
| | | | | | | | The dependency of non-combinable protocols (f.i. arp + tcp) results in a relational dependency expression without a datatype, causing a segfault later on. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix byteorder of RHS of relational meta expressionPatrick McHardy2010-07-061-1/+1
| | | | | | | The RHS needs to be postprocessed before updating the payload context for byteorder conversion. Fixes iiftype match reconstruction. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: fix two datatypesPatrick McHardy2009-07-281-1/+2
| | | | | | Fix typo in URG-flag and missing end-of-list marker for the arpop constants. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: add DCCP packet type definitionsPatrick McHardy2009-07-281-0/+29
| | | | | | | | | | | | | | | | | | | # nft describe dccp type payload expression, datatype dccp_pkttype (DCCP packet type) (basetype integer), 4 bits pre-defined symbolic constants: request 0x0 response 0x1 data 0x2 ack 0x3 dataack 0x4 closereq 0x5 close 0x6 reset 0x7 sync 0x8 syncack 0x9 Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add/move size and byte order information into data typesPatrick McHardy2009-03-311-8/+8
| | | | | | | | | | Add size and type information to non-basetype types and remove the now redundant information from the symbol tables. This will be used to determine size and byteorder of set members without analyzing the ruleset for incremental update operations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: maintain table of all datatypes and add registration/lookup functionPatrick McHardy2009-03-311-4/+16
| | | | | | | | | | | Add a table containing all available datatypes and registration/lookup functions. This will be used to associate a stand-alone set in the kernel with the correct type without parsing the entire ruleset. Additionally it would now be possible to remove the global declarations for the core types. Not done yet though. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add support for cloning expressionsPatrick McHardy2009-03-201-0/+10
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+908