summaryrefslogtreecommitdiffstats
path: root/src/rule.c
Commit message (Collapse)AuthorAgeFilesLines
* src: Add command "replace" for rulesCarlos Falgueras García2015-11-021-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | Modify the parser and add necessary functions to provide the command "nft replace rule <ruleid_spec> <new_rule>" Example of use: # nft list ruleset -a table ip filter { chain output { ip daddr 8.8.8.7 counter packets 0 bytes 0 # handle 3 } } # nft replace rule filter output handle 3 ip daddr 8.8.8.8 counter # nft list ruleset -a table ip filter { chain output { ip daddr 8.8.8.8 counter packets 0 bytes 0 # handle 3 } } Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: rework list chainPablo Neira Ayuso2015-10-121-1/+21
| | | | | | | | | | | | | | | | | | After this patch: # nft list chain inet filter forward table inet filter { chain forward { type filter hook forward priority 0; policy drop; ct state established,related counter packets 39546074 bytes 11566126287 accept } } Before this patch, this was showing the full table definition, including all chains, which is not what the user is asking for. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: `list sets' only displays declaration, not definitionPablo Neira Ayuso2015-10-121-3/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft list sets table ip nat { set libssh { type ipv4_addr } } table inet filter { set set0 { type inet_service flags constant } set set1 { type inet_service flags constant } set set2 { type icmpv6_type flags constant } } So in case you want to inspect the definition, you have to use `list set' and the specific set that you want to inspect: # nft list set inet filter set0 table inet filter { set set0 { type inet_service flags constant elements = { 2200, ssh} } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: display table when listing one setPablo Neira Ayuso2015-10-121-3/+11
| | | | | | | | | | | | | | | | | | | | | After: # nft list set ip6 test foo table ip6 test { set foo { type ipv4_addr } } Before: # nft list set ip6 test foo set foo { type ipv4_addr } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* src: add `list chains' commandPablo Neira Ayuso2015-10-121-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | # nft list chains table ip filter { chain test1 { } chain test2 { } chain input { type filter hook input priority 0; policy accept; } } table ip6 filter { chain test1 { } chain input { type filter hook input priority 0; policy accept; } } You can also filter out per family: # nft list chains ip table ip x { chain y { } chain xz { } chain input { type filter hook input priority 0; policy accept; } } # nft list chains ip6 table ip6 filter { chain x { } chain input { type filter hook input priority 0; policy accept; } } This command only shows the chain declarations, so the content (the definition) is omitted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: display table when listing setsPablo Neira Ayuso2015-10-121-0/+10
| | | | | | | | | | | | | | | | | | | | | After this patch: # nft list sets ip table ip test { set pepe { type ipv4_addr } } Before: # nft list sets ip set pepe { type ipv4_addr } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* rule: fix printing of rule commentsArturo Borrero Gonzalez2015-10-081-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Several fixes: * handles are printed last * simplify space games (an extra space was being printed) * comments are shown with `nft monitor' as well (missing before this patch) Before this patch: % nft list ruleset -a [...] chain test { iifname eth0 # handle 1 comment "test" } [...] % nft list ruleset [...] chain test { iifname eth0 comment "test" ^^ } [...] % nft monitor & % nft add rule test test iifname eth0 comment "test" add rule test test iifname eth0 After this patch: % nft list ruleset -a chain test { iifname eth0 comment "test" # handle 1 ^ } % nft monitor -a & % nft add rule test test iifname eth0 comment "test" add rule test test iifname eth0 comment "test" # handle 1 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: filter out tables depending on familyPablo Neira Ayuso2015-09-231-1/+6
| | | | | | | | | | | # nft list tables ip table ip filter # nft list tables ip6 table ip6 filter Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=1033 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use new symbols in libnftnlPablo Neira Ayuso2015-09-161-4/+4
| | | | | | | | | Adapt the nftables code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of EINTR handling for nft_netlink()Pablo Neira Ayuso2015-08-181-4/+6
| | | | | | | | | The only remaining caller that needs this is netlink_dump_ruleset(), that is used to export the ruleset using markup representation. We can remove it and handle this from do_command_export() now that we have a centralized point to build up the object cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set element objectsPablo Neira Ayuso2015-08-181-25/+11
| | | | | | Populate the cache iff the user requests a ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for rule objectsPablo Neira Ayuso2015-08-181-10/+12
| | | | | | Populate the cache iff the user requests a ruleset listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for chain objectsPablo Neira Ayuso2015-08-181-39/+16
| | | | | | The chain list is obtained if the user requests a listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add chain reference counterPablo Neira Ayuso2015-08-181-0/+9
| | | | | | | When adding declared chains to the cache, we may hold more than one single reference from struct cmd and the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: early allocation of the set IDPablo Neira Ayuso2015-08-181-0/+4
| | | | | | | By when the set is created, so element in the batch use this set ID as reference. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use cache infrastructure for set objectsPablo Neira Ayuso2015-08-181-51/+61
| | | | | | | | | | | | | | | | This patch populates the cache only once through netlink_list_sets() during evaluation. As a result, there is a single call to netlink_list_sets(). After this change, we can rid of get_set(). This function was fine by the time we had no transaction support, but this doesn't work for set objects that are declared in this batch, so inquiring the kernel doesn't help since they are not yet available. As a result from this update, the monitor code gets simplified quite a lot since it can rely of the set cache. Moreover, we can now validate that the table and set exists from evaluation path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table declaration to cachePablo Neira Ayuso2015-08-181-13/+2
| | | | | | | | | | Add declared table objects to the cache, thus we can refer to objects that come in this batch but that are not yet available in the kernel. This happens from the evaluation step. Get rid of code that is doing this from the later do_command_*() stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add reference counter to the table objectPablo Neira Ayuso2015-08-181-0/+10
| | | | | | | We may hold multiple references to table objects in follow up patches when adding object declarations to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add cache infrastructure and use it for table objectsPablo Neira Ayuso2015-08-181-27/+76
| | | | | | | | | | This patch introduces the generic object cache that is populated during the evaluation phase. The first client of this infrastructure are table objects. As a result, there is a single call to netlink_list_tables(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next-4.2'Pablo Neira Ayuso2015-08-181-3/+22
|\ | | | | | | | | | | | | | | | | | | This branch adds support for the new 'netdev' family. This also resolves a simple conflict with the default chain policy printing. Conflicts: src/rule.c Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add netdev family supportPablo Neira Ayuso2015-06-161-4/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for the new 'netdev' table. So far, this table allows you to create filter chains from ingress. The following example shows a very simple base configuration with one table that contains a basechain that is attached to the 'eth0': # nft list table netdev filter table netdev filter { chain eth0-ingress { type filter hook ingress device eth0 priority 0; policy accept; } } You can test that this works by adding a simple rule with counters: # nft add rule netdev filter eth0-ingress counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: restore nft list tablesPablo Neira Ayuso2015-08-031-1/+1
| | | | | | | | | | | | | | | | Iterate over the ctx->list which is where the table objects are after calling netlink_list_tables(). Fixes: e4d21958c835 ("rule: add do_list_tables()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | rule: add do_list_tables()Pablo Neira Ayuso2015-07-141-15/+17
| | | | | | | | | | | | Wrap code to list existing tables in a function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: set chain->hookstr from delinearizationPablo Neira Ayuso2015-07-061-5/+3
| | | | | | | | | | | | Set human readable hookname chain->hookstr field from delinearize. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | rule: missing family when listing of tablesPablo Neira Ayuso2015-07-031-1/+3
|/ | | | | | | | | | | | # nft list tables table ip nat instead of: # nft list tables table nat Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add timeout support for setsPatrick McHardy2015-04-121-1/+22
| | | | | | | | | | | | | | | | | | | | | | | | Timeout support can be enabled in one of two ways: 1. Using a default timeout value: set test { type ipv4_addr; timeout 1h; } 2. Using the timeout flag without a default: set test { type ipv4_addr; flags timeout; } Optionally a garbage collection interval can be specified using gc-interval <interval>; Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix chain details align indentationsArturo Borrero2015-03-191-1/+1
| | | | | | | | | | f.i: type filter hook output priority 0; policy accept; ip daddr @test counter packets 14 bytes 1176 Reported-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: delete extra space in rule indentationArturo Borrero2015-03-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | Annoying extra space in rule indentation: Example before this patch: table ip6 test_table { chain test_chain { counter tcp dport { 22, 80, 443} accept # handle 1 ^ } } Example after this patch: table ip6 test_table { chain test_chain { counter tcp dport { 22, 80, 443} accept # handle 1 } } Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the default policy for base chainsPablo Neira Ayuso2015-03-171-4/+19
| | | | | | | | | | | | | | | | | | The new syntax is: nft add chain filter input { hook input type filter priority 0\; policy accept\; } but the previous syntax is still allowed: nft add chain filter input { hook input type filter priority 0\; } this assumes default policy to accept. If the base chain already exists, you can update the policy via: nft add chain filter input { policy drop\; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expose table flagsPablo Neira Ayuso2015-03-171-0/+30
| | | | | | | | | | | | | | | | | | | The nf_tables kernel API provides a way to disable a table using the dormant flag. This patch adds the missing code to expose this feature through nft. Basically, if you want to disable a table and all its chains from seen any traffic, you have to type: nft add table filter { flags dormant\; } to re-enable the table, you have to: nft add table filter this clears the flags. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix object order via nft -fPablo Neira Ayuso2015-02-181-2/+7
| | | | | | | | | | | | | | | | | | The objects need to be loaded in the following order: #1 tables #2 chains #3 sets #4 rules We have to make sure that chains are in place by when we add rules with jumps/gotos. Similarly, we have to make sure that the sets are in place by when rules reference them. Without this patch, you may hit ENOENT errors depending on your ruleset configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: remove unused set_clone() functionPatrick McHardy2015-01-121-18/+0
| | | | | | | | The set_clone() function was added by the event monitor patchset and is unused. It is also broken since it simply initializes the list head to the list of the original set, so remove it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix memory leaksPatrick McHardy2015-01-111-0/+2
| | | | | | | Fix two memory leaks in netlink event monitor. Also fix a leak related to all sets, the ->init expression is not freed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: fix segmentation faults on kernels without nftables supportPablo Neira Ayuso2014-12-091-3/+4
| | | | | | | | | | | | | | | | # nft list sets Segmentation fault # nft list sets <cmdline>:1:1-9: Error: Could not receive sets from kernel: Protocol error list sets ^^^^^^^^^ Fix same bug in `nft list tables'. Don't cleanup the table object for these commands since it is NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: interpret the event type from the evaluation stepPablo Neira Ayuso2014-10-091-6/+45
| | | | | | | | | | | Postpone the event type interpretation to the evaluation step. This patch also fixes the combination of event and object types, which was broken. The export code needed to be adjusted too. The new and destroy are not tokens that can be recognized by the scanner anymore, so this also implicitly restores 'ct state'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add list ruleset commandArturo Borrero2014-09-291-0/+28
| | | | | | | | | | | | | | | | | This patch adds a new command to nft: % nft list ruleset [family] Which list the entire ruleset. If no family is specified, all tables of all families are listed. Users can now make several operations at ruleset level: % nft list ruleset > ruleset.nft % nft -f ruleset.nft % nft flush ruleset Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: factorize chain and table listing codeArturo Borrero2014-09-291-32/+35
| | | | | | | Let's factorize common code. This is also useful in follow-up patches. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: rename do_command_list_cleanup() to table_cleanup()Arturo Borrero2014-09-291-3/+3
| | | | | | | | Let's use a more generic name for this functions, since it has nothing to do with commands. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set optimization optionsArturo Borrero2014-09-291-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds options to choose set optimization mechanisms. Two new statements are added to the set syntax, and they can be mixed: nft add set filter set1 { type ipv4_addr ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; } nft add set filter set1 { type ipv4_addr ; policy memory ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy performance ; } Also valid for maps: nft add map filter map1 { type ipv4_addr : verdict ; policy performace ; } [...] This is the output format, which can be imported later with `nft -f': table filter { set set1 { type ipv4_addr policy memory size 1024 } } In this approach the parser accepts default options such as 'performance', given they are a valid configurations, but aren't sent to the kernel. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix 'describe' command when passing wrong expressionsPablo Neira Ayuso2014-09-171-0/+11
| | | | | | | | | | | | | | | | | | Before this patch: # nft describe tcp foo value expression, datatype inet_proto (Internet protocol) (basetype integer), 8 bits Segmentation fault After this patch: # nft describe tcp foo <cmdline>:1:14-16: Error: syntax error, unexpected string, expecting end of file or newline or semicolon describe tcp foo ^^^ Reported-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add `flush ruleset'Arturo Borrero2014-09-091-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: check for NLM_F_DUMP_INTR when dumping object listsPablo Neira Ayuso2014-07-141-26/+38
| | | | | | | | | This flag allows to detect that an update has ocurred while dumping any of the object lists. In case of interference, nft cancels the netlink socket to skip processing the remaining stale entries and it retries to obtain fresh list of objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change type of chain.priority from unsigned int to intHendrik Schwartke2014-06-101-2/+2
| | | | | | | This removes a bug that displays strange hook priorities like "type route hook output priority 4294967146". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add events reportingArturo Borrero2014-04-251-0/+89
| | | | | | | | | | This patch adds a basic events reporting option to nft. The syntax is: % nft monitor [new|destroy] [tables|chains|rules|sets|elements] [xml|json] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: generalize chain_print()Arturo Borrero2014-04-251-0/+14
| | | | | | | | Lest generalize the chain_print() function, so we can print a plain chain as the user typed in the basic CLI. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: allow to print sets in plain formatArturo Borrero2014-04-251-10/+50
| | | | | | | | | | | | | Allow to print sets with or without format. This is useful in situations where we want to print more or less the same the user typed (IOW, in one single line, and with family/table info). While at it, make family2str() function public, so it can be used in other places. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix crash in set listingAna Rey2014-04-081-1/+1
| | | | | | | | | | | | | It fixes an invalid read that is shown by valgrind. ==3962== Invalid read of size 4 ==3962== at 0x407040: do_command (rule.c:692) ==3962== by 0x40588C: nft_run (main.c:183) ==3962== by 0x405469: main (main.c:334) ==3962== Address 0x10 is not stack'd, malloc'd or (recently) free'd Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: Fix list of sets by familyAna Rey2014-03-281-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the result of command line 'nft list sets FAMILY'. It shows the following error message: "Error: syntax error, unexpected end of file, expecting string" Now, it is possible shows right this information: $ sudo nft -nna list sets ip set set_test { type ipv4_address elements = { 192.168.3.45, 192.168.3.43, 192.168.3.42, 192.168.3.4} } set set_test2 { type ipv4_address elements = { 192.168.3.43, 192.168.3.42, 192.168.3.4} } set set0 { type ipv4_address flags constant elements = { 127.0.0.12, 12.11.11.11} } Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: abort on interval conflictsPatrick McHardy2014-03-071-2/+3
| | | | | | | | | | | We currently print a debug message (with debugging) and continue. Output a proper error message and abort. While at it, make sure we only report a conflict if there actually is one. This is not the case similar actions, IOW in case of sets, never, in case of maps, only if the mapping differs. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add support for rule human-readable commentsPablo Neira Ayuso2014-02-271-1/+7
| | | | | | | | | | | | This patch adds support for human-readable comments: nft add rule filter input accept comment \"accept all traffic\" Note that comments *always* come at the end of the rule. This uses the new data area that allows you to attach information to the rule via netlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>