summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* monitor: do not call interval_map_decompose() for concat intervalsFlorian Westphal2021-11-171-1/+6
| | | | | | | | | | | | | | Without this, nft monitor will either print garbage or even segfault when encountering a concat set because we pass expr->value to libgmp helpers for concat (non-value) expressions. Also, for concat case, we need to call concat_range_aggregate() helper. Add a test case for this. Without this patch, it gives: tests/monitor/run-tests.sh: line 98: 1163 Segmentation fault (core dumped) $nft -nn -e -f $command_file > $echo_output Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: add raw payload inner header match supportPablo Neira Ayuso2021-11-171-0/+2
| | | | | | | Add missing "ih" base raw payload and extend tests/py to cover this new usecase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow for string raw payload basePablo Neira Ayuso2021-11-162-3/+11
| | | | | | | Remove new 'ih' token, allow to represent the raw payload base with a string instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: filter out rules by chainPablo Neira Ayuso2021-11-112-45/+81
| | | | | | | | | | | | | | | | | | | | With an autogenerated ruleset with ~20k chains. # time nft list ruleset &> /dev/null real 0m1,712s user 0m1,258s sys 0m0,454s Speed up listing of a specific chain: # time nft list chain nat MWDG-UGR-234PNG3YBUOTS5QD &> /dev/null real 0m0,542s user 0m0,251s sys 0m0,292s Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: missing family in cache filteringPablo Neira Ayuso2021-11-111-4/+8
| | | | | | | | Check family when filtering out listing of tables and sets. Fixes: 3f1d3912c3a6 ("cache: filter out tables that are not requested") Fixes: 635ee1cad8aa ("cache: filter out sets and maps that are not requested") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: do not populate cache if it is going to be flushedPablo Neira Ayuso2021-11-112-5/+77
| | | | | | | Skip set element netlink dump if set is flushed, this speeds up set flush + add element operation in a batch file for an existing set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: move list filter under structPablo Neira Ayuso2021-11-111-11/+11
| | | | | | | Wrap the table and set fields for list filtering to prepare for the introduction element filters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update ct timeout section with the state namesFlorian Westphal2021-11-081-1/+1
| | | | | | | | docs are too terse and did not have the list of valid timeout states. While at it, adjust default stream timeout of udp to 120, this is the current kernel default. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: grab reference in set expression evaluationPablo Neira Ayuso2021-11-081-2/+2
| | | | | | | Do not clone expression when evaluation a set expression, grabbing the reference counter to reuse the object is sufficient. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: clone variable expression if there is more than one referencePablo Neira Ayuso2021-11-081-1/+10
| | | | | | | | | Clone the expression that defines the variable value if there are multiple references to it in the ruleset. This saves heap memory consumption in case the variable defines a set with a huge number of elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: do not build nftnl_set element listPablo Neira Ayuso2021-11-082-25/+91
| | | | | | | | | | | | Do not call alloc_setelem_cache() to build the set element list in nftnl_set. Instead, translate one single set element expression to nftnl_set_elem object at a time and use this object to build the netlink header. Using a huge test set containing 1.1 million element blocklist, this patch is reducing userspace memory consumption by 40%. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: raw payload match and mangle on inner header / payload dataPablo Neira Ayuso2021-11-085-2/+11
| | | | | | | | | | | | | | | This patch adds support to match on inner header / payload data: # nft add rule x y @ih,32,32 0x14000000 counter you can also mangle payload data: # nft add rule x y @ih,32,32 set 0x14000000 counter This update triggers a checksum update at the layer 4 header via csum_flags, mangling odd bytes is also aligned to 16-bits. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add xinteger_type alias to print in hexadecimalPablo Neira Ayuso2021-11-032-1/+17
| | | | | | | | | Add an alias of the integer type to print raw payload expressions in hexadecimal. Update tests/py. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: postpone transport protocol match check after nat expression ↵Pablo Neira Ayuso2021-11-031-6/+7
| | | | | | | | | evaluation Fix bogus error report when using transport protocol as map key. Fixes: 50780456a01a ("evaluate: check for missing transport protocol match in nat map with concatenations") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: extend limit syntaxJeremy Sowden2021-11-031-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The documentation describes the syntax of limit statements thus: limit rate [over] packet_number / TIME_UNIT [burst packet_number packets] limit rate [over] byte_number BYTE_UNIT / TIME_UNIT [burst byte_number BYTE_UNIT] TIME_UNIT := second | minute | hour | day BYTE_UNIT := bytes | kbytes | mbytes From this one might infer that a limit may be specified by any of the following: limit rate 1048576/second limit rate 1048576 mbytes/second limit rate 1048576 / second limit rate 1048576 mbytes / second However, the last does not currently parse: $ sudo /usr/sbin/nft add filter input limit rate 1048576 mbytes / second Error: wrong rate format add filter input limit rate 1048576 mbytes / second ^^^^^^^^^^^^^^^^^^^^^^^^^ Extend the `limit_rate_bytes` parser rule to support it, and add some new Python test-cases. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add `limit_rate_pkts` and `limit_rate_bytes` rulesJeremy Sowden2021-11-031-62/+59
| | | | | | | | | Factor the `N / time-unit` and `N byte-unit / time-unit` expressions from limit expressions out into separate `limit_rate_pkts` and `limit_rate_bytes` rules respectively. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add new `limit_bytes` ruleJeremy Sowden2021-11-031-6/+9
| | | | | | | | Refactor the `N byte-unit` expression out of the `limit_bytes_burst` rule into a separate `limit_bytes` rule. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Support netdev egress hookLukas Wunner2021-10-282-0/+5
| | | | | | | | | Add userspace support for the netdev egress hook which is queued up for v5.16-rc1, complete with documentation and tests. Usage is identical to the ingress hook. Signed-off-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: disable NFT_CACHE_SETELEM_BIT on --terse listing onlyPablo Neira Ayuso2021-10-281-2/+2
| | | | | | | Instead of NFT_CACHE_SETELEM which also disables set dump. Fixes: 6bcd0d576a60 ("cache: unset NFT_CACHE_SETELEM with --terse listing") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: ensure evaluate_cache_list flags are set correctlyChris Arges2021-10-271-0/+1
| | | | | | | | | This change ensures that when listing rulesets with the terse flag that the terse flag is maintained. Fixes: 6bcd0d576a60 ("cache: unset NFT_CACHE_SETELEM with --terse listing") Signed-off-by: Chris Arges <carges@cloudflare.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: honor table in set filteringPablo Neira Ayuso2021-10-271-1/+2
| | | | | | | | Check if table mismatch, in case the same set name is used in different tables. Fixes: 635ee1cad8aa ("cache: filter out sets and maps that are not requested") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: honor filter in set listing commandsPablo Neira Ayuso2021-10-271-0/+2
| | | | | | | | Fetch table, set and set elements only for set listing commands, e.g. nft list set inet filter ipv4_bogons. Fixes: 635ee1cad8aa ("cache: filter out sets and maps that are not requested") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: always set on NFT_CACHE_REFRESH for listingPablo Neira Ayuso2021-10-271-6/+7
| | | | | | | | This flag forces a refresh of the cache on list commands, several object types are missing this flag, this fixes nft --interactive mode. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: _exit() if setuidFlorian Westphal2021-10-191-0/+4
| | | | | | | | | | | | | Apparently some people think its a good idea to make nft setuid so unrivilged users can change settings. "nft -f /etc/shadow" is just one example of why this is a bad idea. Disable this. Do not print anything, fd cannot be trusted. This change intentionally doesn't affect libnftables, on the off-chance that somebody creates an suid program and knows what they're doing. Signed-off-by: Florian Westphal <fw@strlen.de>
* rule: replace three conditionals with oneJeremy Sowden2021-10-121-5/+3
| | | | | | | | When outputting set definitions, merge three consecutive `if (!list_empty(&set->stmt_list))` conditionals. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix stateless output after listing sets containing countersJeremy Sowden2021-10-121-1/+3
| | | | | | | | | | | | | Before outputting counters in set definitions the `NFT_CTX_OUTPUT_STATELESS` flag was set to suppress output of the counter state and unconditionally cleared afterwards, regardless of whether it had been originally set. Record the original set of flags and restore it. Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994273 Fixes: 6d80e0f15492 ("src: support for counter in set definition") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove fake stateless output of named countersJeremy Sowden2021-10-121-7/+6
| | | | | | | | | When `-s` is passed, no state is output for named quotas and counter and quota rules, but fake zero state is output for named counters. Remove the output of named counters to match the remaining stateful objects. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: unset NFT_CACHE_SETELEM with --terse listingPablo Neira Ayuso2021-10-021-3/+12
| | | | | | Skip populating the set element cache in this case to speed up listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: filter out sets and maps that are not requestedPablo Neira Ayuso2021-09-301-2/+19
| | | | | | | Do not fetch set content for list commands that specify a set name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: filter out tables that are not requestedPablo Neira Ayuso2021-09-303-13/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not fetch table content for list commands that specify a table name, e.g. # nft list table filter This speeds up listing of a given table by not populating the cache with tables that are not needed. - Full ruleset (huge with ~100k lines). # sudo nft list ruleset &> /dev/null real 0m3,049s user 0m2,080s sys 0m0,968s - Listing per table is now faster: # nft list table nat &> /dev/null real 0m1,969s user 0m1,412s sys 0m0,556s # nft list table filter &> /dev/null real 0m0,697s user 0m0,478s sys 0m0,220s Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1326 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: finer grain cache population for list commandsPablo Neira Ayuso2021-09-291-2/+23
| | | | | | Skip full cache population for list commands to speed up listing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: set on cache flags for nested notationPablo Neira Ayuso2021-09-291-0/+10
| | | | | | | | | Set on the cache flags for the nested notation too, this is fixing nft -f with two files, one that contains the set declaration and another that adds a rule that refers to such set. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1474 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check for missing transport protocol match in nat map with ↵Pablo Neira Ayuso2021-09-291-0/+12
| | | | | | | | | | | | | | | | concatenations Restore this error with NAT maps: # nft add rule 'ip ipfoo c dnat to ip daddr map @y' Error: transport protocol mapping is only valid after transport protocol match add rule ip ipfoo c dnat to ip daddr map @y ~~~~ ^^^^^^^^^^^^^^^ Allow for transport protocol match in the map too, which is implicitly pulling in a transport protocol dependency. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check for concatenation in set data datatypePablo Neira Ayuso2021-09-291-1/+2
| | | | | | | | | | | | | When adding this rule with an existing map: add rule nat x y meta l4proto { tcp, udp } dnat ip to ip daddr . th dport map @fwdtoip_th reports a bogus: Error: datatype mismatch: expected IPv4 address, expression has type concatenation of (IPv4 address, internet network service) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: honor NLM_F_EXCL netlink flagPablo Neira Ayuso2021-09-291-1/+7
| | | | | | This allow to report for the create command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: honor NLM_F_APPEND flag for rulesPablo Neira Ayuso2021-09-291-14/+26
| | | | | | Print 'add' or 'insert' according to this netlink flag. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: display rule position handlePablo Neira Ayuso2021-09-291-1/+4
| | | | | | This allow to locate the incremental update in the ruleset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: dynset: set compound expr dtype based on set key definitionFlorian Westphal2021-09-291-1/+45
| | | | | | | | | | | | | | | | | "nft add rule ... add @t { ip saddr . 22 ..." will be listed as 'ip saddr . 0x16 [ invalid type]". This is a display bug, the compound expression created during netlink deserialization lacks correct datatypes for the value expression. Avoid this by setting the individual expressions' datatype. The set key has the needed information, so walk over the types and set them in the dynset statment. Also add a test case. Reported-by: Paulo Ricardo Bruck <paulobruck1@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't adjust offsets of autogenerated dependency expressionsFlorian Westphal2021-09-292-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pablo says: user reports that this is broken: nft --debug=netlink add rule bridge filter forward vlan id 100 vlan id set 200 [..] [ payload load 2b @ link header + 14 => reg 1 ] [..] [ payload load 2b @ link header + 28 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x000000f0 ) ^ 0x0000c800 ] [ payload write reg 1 => 2b @ link header + 14 csum_type 0 csum_off 0 csum_flags 0x0 ] offset says 28, it is assuming q-in-q, in this case it is mangling the existing header. The problem here is that 'vlan id set 200' needs a read-modify-write cycle because 'vlan id set' has to preserve bits located in the same byte area as the vlan id. The first 'payload load' at offset 14 is generated via 'vlan id 100', this part is ok. The second 'payload load' at offset 28 is the bogus one. Its added as a dependency, but then adjusted because nft evaluation considers this identical to 'vlan id 1 vlan id '2, where nft assumes q-in-q. To fix this, skip offset adjustments for raw expressions and mark the dependency-generated payload instruction as such. This is fine because raw payload operations assume that user specifies base/offset/length manually. Also add a test case for this. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink: reset temporary set element stmt list after list splicePablo Neira Ayuso2021-09-161-1/+1
| | | | | | | | Reset temporary stmt list to deal with the key_end case which might result in a jump backward to handle the rhs of the interval. Reported-by: Martin Zatloukal <slezi2@pvfree.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revert hashtable for expression handlersPablo Neira Ayuso2021-09-152-32/+10
| | | | | | | | | | | | | | | | | | | | | Partially revert 913979f882d1 ("src: add expression handler hashtable") which is causing a crash with two instances of the nftables handler. $ sudo python [sudo] password for echerkashin: Python 3.9.7 (default, Sep 3 2021, 06:18:44) [GCC 11.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from nftables import Nftables >>> n1=Nftables() >>> n2=Nftables() >>> <Ctrl-D> double free or corruption (top) Aborted Reported-by: Eugene Crosser <crosser@average.org> Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: rework range_expr_to_prefix()Pablo Neira Ayuso2021-09-091-30/+36
| | | | | | | | | Consolidate prefix calculation in range_expr_is_prefix(). Add tests/py for 9208fb30dc49 ("src: Check range bounds before converting to prefix"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: skip -T for hour and date formatPablo Neira Ayuso2021-09-091-24/+9
| | | | | | | | | | | | | | | | If -T is used: - meta hour displays the hours in seconds based on your timezone. - meta time displays the UNIX time since 1970 in nanoseconds. Better, skip -T for these two datatypes and use the formatted output instead, ie. - meta hour "00:00:20" - meta time "1970-01-01 01:00:01" Fixes: f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Check range bounds before converting to prefixXiao Liang2021-09-061-6/+9
| | | | | | | | | | The lower bound must be the first value of the prefix to be coverted. For example, range "10.0.0.15-10.0.0.240" can not be converted to "10.0.0.15/24". Validate it by checking if the lower bound value has enough trailing zeros. Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: time_print() ignores -TPablo Neira Ayuso2021-09-061-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | Honor NFT_CTX_OUTPUT_NUMERIC_TIME. # nft list ruleset table ip x { set y { type ipv4_addr flags timeout elements = { 1.1.1.1 timeout 5m expires 1m49s40ms } } } # sudo nft -T list ruleset table ip x { set y { type ipv4_addr flags timeout elements = { 1.1.1.1 timeout 300s expires 108s } } } Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1561 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove redundant meta protocol from the evaluation stepPablo Neira Ayuso2021-09-031-23/+54
| | | | | | | | | | | | | 567ea4774e13 ("netlink_delinearize: incorrect meta protocol dependency kill") does not document two cases that are handled in this patch: - 'meta protocol ip' is removed if used in the ip family. - 'meta protocol ip6' is removed if used in the ip6 family. This patch removes this redundancy earlier, from the evaluation step before netlink bytecode generation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: incorrect meta protocol dependency kill againPablo Neira Ayuso2021-09-031-45/+61
| | | | | | | | | | | | | This patch adds __meta_dependency_may_kill() to consolidate inspection of the meta protocol, nfproto and ether type expression to validate dependency removal on listings. Phil reports that 567ea4774e13 includes an update on the ip and ip6 families that is not described in the patch, moreover, it flips the default verdict from true to false. Fixes: 567ea4774e13 ("netlink_delinearize: incorrect meta protocol dependency kill") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix error reporting for invalid syntaxPhil Sutter2021-09-011-10/+8
| | | | | | | | | | | | | | | Errors emitted by the JSON parser caused BUG() in erec_print() due to input descriptor values being bogus. Due to lack of 'include' support, JSON parser uses a single input descriptor only and it lived inside the json_ctx object on stack of nft_parse_json_*() functions. By the time errors are printed though, that scope is not valid anymore. Move the static input descriptor object to avoid this. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc>
* netlink_delinearize: incorrect meta protocol dependency killPablo Neira Ayuso2021-08-261-3/+19
| | | | | | | | meta protocol is meaningful in bridge, netdev and inet families, do not remove this. Fixes: 056aaa3e6dc6 ("netlink_delinearize: Refactor meta_may_dependency_kill()") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: provide a empty list for flowtables and objects when request failsPablo Neira Ayuso2021-08-261-16/+20
| | | | | | | | | Old kernels do not support for dumping the flowtable and object lists, provide an empty list instead to unbreak the cache initialization. Fixes: 560963c4d41e ("cache: add hashtable cache for flowtable") Fixes: 45a84088ecbd ("cache: add hashtable cache for object") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>