summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* evaluate: fix range and comparison evaluationPablo Neira Ayuso2013-06-121-2/+2
| | | | | | | | | This patch fixes these two commands: nft add rule ip test test ip saddr 1.1.1.1-2.2.2.2 nft add rule ip test test ip saddr < 1.1.1.1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix counter restorationEric Leblond2013-06-123-3/+31
| | | | | | | | | | | | It was not possible to restore a ruleset countaining counter. The packets and bytes fields were not known from the parser but they were in the output of the list command. This patch fixes the issue by restoring correctly the counters if they are present in the command. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: display hook infoEric Leblond2013-06-121-0/+23
| | | | | | | | | | | | It was not possible to restore a ruleset because of missing hook information. This patch adds hooknum output to list operation. [ Mangled this patch to use a string array mapping hook numbers and name --pablo ] Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: concat expression only releases dynamically allocated datatypePablo Neira Ayuso2013-06-081-2/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Eric Leblond reports a crash with the following invalid command: nft add rule global filter ip daddr . tcp dport { 192.168.0.1 . 22\; 192.168.0.3 . 89 } drop Note that the semicolon is incorrect in that concatenation, it should be a comma. The backtrace shows: (gdb) bt #0 0x00007ffff6f39295 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff6f3c438 in __GI_abort () at abort.c:90 #2 0x00007ffff6f7486b in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff7070d28 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199 #3 0x00007ffff6f7eac6 in malloc_printerr (action=3, str=0x7ffff706ccca "free(): invalid pointer", ptr=<optimized out>) at malloc.c:4902 #4 0x00007ffff6f7f843 in _int_free (av=<optimized out>, p=0x428530, have_lock=0) at malloc.c:3758 #5 0x000000000041aae8 in xfree (ptr=0x428540 <invalid_type>) at src/utils.c:29 #6 0x000000000040bc43 in concat_type_destroy (dtype=0x428540 <invalid_type>) at src/datatype.c:690 #7 0x000000000040cebf in concat_expr_destroy (expr=0x643b90) at src/expression.c:571 [...] It's trying to release 'invalid_type', which was not dynamically allocated. Note that before the evaluation step, the invalid type is attached to the expressions. Since nftables allocates a dynamic datatype for concatenations in case that needs to be released in the exit path. All datatypes except this, are allocated in the BSS. Since we have no way to differenciate between these two, add a flag so we can recognize dynamically allocated datatypes. While at it, rename dtype->type from enum to explicit uint32_t, as it is used to store the concatenation type mask as well. Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: reset terminal when CTRL+d is pressedEric Leblond2013-06-081-1/+4
| | | | | The terminal was not correctly resetted when CTRL+d was pressed. The result was that reset has to be called from shell after exit.
* cli: add quit commandEric Leblond2013-06-081-0/+5
|
* rule: list elements in set in any caseEric Leblond2013-06-081-2/+1
| | | | | | | "nft list table" command was not displaying the elements of named set. This was thus not possible to restore a ruleset by using the listing output. This patch modifies the code to display the elements of set in all cases.
* rule: add flag to display rule handle as commentEric Leblond2013-05-312-1/+14
| | | | | | | | | | | Knowing the rule handle is necessary to be able to delete a single rule. It was not displayed till now in the output and it was thus impossible to remove a single rule. This patch modify the listing output to add a comment containing the handle when the -a/--handle flag is provided. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: complete basic functionality of the interactive modePablo Neira Ayuso2013-05-193-42/+66
| | | | | | | | | | This patch adds missing code to get basic interactive mode operative via `nft -i', including parsing, evaluation, command execution via netlink and error reporting. Autocomplete is not yet implemented. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix size of internet protocol expressions matching keywordsPatrick McHardy2013-04-231-9/+9
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* parser: include leading '.' in concat subexpression locationPatrick McHardy2013-04-221-0/+6
| | | | | | | | | | | | | | | | Make error messages point to the entire subexpression. Before: filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^ After: filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: catch missing and excess elements in concatenationsPatrick McHardy2013-04-222-4/+19
| | | | | | | | | | | | | | # nft -nn filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh } <cmdline>:1:50-66: Error: datatype mismatch, expected concatenation of (IPv4 address, internet network service, internet network service), expression has type concatenation of (IPv4 address, internet network service) filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh } ^^^^^^^^^^^^^^^^^ # nft -nn filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} <cmdline>:1:76-78: Error: unexpected concat component, expecting concatenation of (IPv4 address, internet network service, internet network service) filter output ip daddr . tcp dport . tcp dport { 192.168.0.1 . ssh . ssh . ssh} ~~~~~~~~~~~~~~~~~~~~~~~~~~^^^ Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: accept uid/gid in numericalPablo Neira Ayuso2013-04-201-4/+12
| | | | | | You can use the user/group name or alternatively the uid/gid. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: accept ethertype in hexadecimalPablo Neira Ayuso2013-04-201-1/+21
| | | | | | | You can use the symbols ip, ip6, arp and vlan, or alternatively the ethertype protocol number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix crash if nft -f wrong_file is passedPablo Neira Ayuso2013-04-191-1/+1
| | | | | | | | | Now it displays: nft -f wrong_file internal:0:0-0: Error: Could not open file "wrong_file": No such file or directory Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mark: fix numeric mark value parsingPatrick McHardy2013-04-181-0/+7
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd/netlink: make sure we always have a location in netlink operationsPatrick McHardy2013-04-184-104/+132
| | | | | | Improve error reporting by always using a location in netlink operations. Signed-off-by: Patrick McHardy<kaber@trash.net>
* main: fix error checking in nft_parsePablo Neira Ayuso2013-04-181-1/+1
| | | | | | | The bison parser returns 0 in case of success and it returns 1 in case of error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: return error if chain not foundPablo Neira Ayuso2013-04-181-1/+16
| | | | | | | | | | | | | | | Before this patch: nft list chain filter xxx table filter { } After this patch: nft list chain filter xxx internal:0:0-0: Error: Could not find chain `xxx' in table `filter: Object not found Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix nft list chainPablo Neira Ayuso2013-04-181-1/+4
| | | | | | | | | | | | | | | | Use netlink_list_chains instead of netlink_list_chain (note the final `s') After "nft list table filter" shows: table filter { chain input { } } "nft list chain filter input" shows: table filter { }
* rule: allow to list of existing tablesPablo Neira Ayuso2013-04-184-3/+31
| | | | | | | | You can now specify: nft list tables ip to obtain the list of all existing tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: fix concat expression type propagationPatrick McHardy2013-04-183-7/+65
| | | | | Dynamically instantiate a data type to represent all types of a concatenation and use that for type propagation.
* types: add ethernet address typePatrick McHardy2013-04-182-1/+11
| | | | | | | | Add a new type for ethernet addresses. This is needed since for concatenations we need fixed sized data types, the generic link layer address doesn't have a fixed length. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: parse/print in all basetypes subsequentlyPatrick McHardy2013-04-181-9/+15
| | | | | | | | Go down the chain of basetypes until we find a ->parse()/->print() callback or symbol table. Needed to invoke the generic link layer address parsing function for the etheraddr_type. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: kill EXPR_F_PRIMARYPatrick McHardy2013-04-151-3/+1
| | | | | | Not used anymore, kill it. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: don't reset source register after readPatrick McHardy2013-01-041-1/+0
| | | | | | | | | | Range expression use a single load and two comparisons. Don't reset the source register in netlink_delinearize when reading it. Fixes: "Relational expression has no left hand side" for range (x-y) expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: add rule insertion (prepend) supportPatrick McHardy2012-12-145-6/+31
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* chains: add chain rename supportPatrick McHardy2012-12-145-5/+65
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix query requestsPatrick McHardy2012-12-141-6/+10
| | | | | | | The callback needs to be set before sending the query since nl_wait_for_ack() already does message reception. Signed-off-by: Patrick McHardy <kaber@trash.net>
* cmd: fix handle use after free for implicit set declarationsPatrick McHardy2012-12-101-1/+4
| | | | | | | | The implicit set declaration passes the set's handle to cmd_alloc(), which copies the pointers to the allocated strings. Later on both the set's handle and the commands handle are freed, resulting in a use after free. Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: reenable adjacent payload mergingPatrick McHardy2012-12-092-1/+8
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* sets: fix sets using intervalsPatrick McHardy2012-12-091-1/+3
| | | | | | | | When using intervals, the initializers set_flags are set to SET_F_INTERVAL, however that is not propagated back to the set, so the segtree construction is not performed. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix endless loop on 64 bit when parsing binopsPatrick McHardy2012-12-091-1/+1
| | | | | | | | mpz_scan1() returns ULONG_MAX when no more bits are found. Due to assignment to an unsigned int, this value was truncated on 64 bit and the loop never terminated. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expression: fix constant expression splicingPatrick McHardy2012-12-091-1/+3
| | | | | | Fix reversed order during constant splicing. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: kill redundant payload protocol expressions during netlink ↵Patrick McHardy2012-12-091-5/+34
| | | | | | | | | postprocessing Kill payload protocol expressions like "ip protocol tcp" if a higher layer payload expression already implies this, like "tcp dport 22". Signed-off-by: Patrick McHardy <kaber@trash.net>
* seqtree: update mapping data when keeping the basePatrick McHardy2012-12-081-3/+8
| | | | | | | | When a prefix expression is followed by another prefix expression using the same base but a wider prefix, we need to update the mapping data to that of the second expression. Signed-off-by: Patrick McHardy <kaber@trash.net>
* segtree: fix segtree to properly support mappingsPatrick McHardy2012-12-082-33/+60
| | | | | | | Requires to use proper types for keys and data and using the key values for reverse transformation. Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: include verbose message in all BUG statementsroot2012-12-088-37/+39
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* evaluate: reintroduce type chekcs for relational expressionsPatrick McHardy2012-12-051-0/+27
| | | | | | | Since the parser can now generate constant expressions of a specific type not determinaed by the LHS, we need to check that relational expressions are actually using the correct types to avoid accepting stupid things like "tcp dport tcp".
* parser: fix parsing protocol names for protocols which are also keywordsPatrick McHardy2012-12-051-0/+63
| | | | | | "ip protocol tcp" will currently produce a syntax error since tcp is also a keyword which is expected ot be followed by a tcp header field. Allow to use protocol names that are also keywords and allocate a constant expression for them.
* expression: Differentiate expr among anonymous structures in struct exprTomasz Bursztyka2012-08-035-24/+24
| | | | | | | This fixes compilation with gcc-4.7 Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: Handle returned value properly in erec_printTomasz Bursztyka2012-08-031-3/+4
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Remove useless variable in expr_evaluate_bitwise()Tomasz Bursztyka2012-08-031-2/+1
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use the right datatype for verdictTomasz Bursztyka2012-08-031-1/+1
| | | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* help: fix of the -I option in help displayRomain Bignon2010-07-061-1/+1
| | | | | | | Trivial patch which fixes typo. Signed-off-by: Romain Bignon <romain@peerfuse.org> Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: reject incompletely parsed integers in integer_type_parse()Patrick McHardy2010-07-061-1/+3
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* don't use internal_location for files specified on command linePatrick McHardy2010-07-061-1/+1
| | | | | | | | | Fixes strange error messages like: In file included from internal:0:0-0: files/examples/sets_and_maps:55:2-2: Error: syntax error, unexpected newline, expecting string Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: add debugging for missing objectsPatrick McHardy2010-07-061-1/+4
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* nat: validate protocol context when performing transport protocol mappingsPatrick McHardy2010-07-061-8/+19
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: fix nat stmt linearization/parsingPatrick McHardy2010-07-062-26/+29
| | | | | | | | Fix invalid register use when parsing NAT statements and handle range expressions during postprocessing. When linearizing, allocate all registers for both proto and address expressions at once to avoid double use. Signed-off-by: Patrick McHardy <kaber@trash.net>