summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* netlink: remove netlink_batch_send()Pablo Neira Ayuso2018-10-242-6/+1
| | | | | | Replace it by direct call to mnl_batch_talk(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_flowtable()Pablo Neira Ayuso2018-10-243-78/+58
| | | | | | | We can remove alloc_nftnl_flowtable() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: Improve error checking in mnl_nft_event_listener()Phil Sutter2018-10-241-2/+5
| | | | | | | | When trying to adjust receive buffer size, the second call to setsockopt() was not error-checked. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix for recent changes to context structsPhil Sutter2018-10-242-37/+37
| | | | | | | | | | Commits introducing nft_ctx pointer to netlink and eval contexts did not update JSON code accordingly. Fixes: 00f777bfc414a ("src: pass struct nft_ctx through struct eval_ctx") Fixes: 2dc07bcd7eaa5 ("src: pass struct nft_ctx through struct netlink_ctx") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix osf ttl supportPhil Sutter2018-10-242-5/+27
| | | | | | | | | | | | | | Having to use numerical values for ttl property in JSON is not practical as these values are arbitrary and meaningful only in netfilter. Instead align JSON output/input with standard API, accepting names for TTL matching strategy. Also add missing documentation in libnftables-json man page and fix JSON equivalent in tests/py. Fixes: 03eafe098d5ee ("osf: add ttl option support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: use either name or handle to refer to objectsPablo Neira Ayuso2018-10-231-4/+5
| | | | | | We can only specify either name or handle to refer to objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_obj()Pablo Neira Ayuso2018-10-233-132/+98
| | | | | | | We can remove alloc_nftnl_obj() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move socket open and reopen to mnl.cPablo Neira Ayuso2018-10-234-30/+25
| | | | | | | These functions are part of the mnl backend, move them there. Remove netlink_close_sock(), use direct call to mnl_socket_close(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* osf: add ttl option supportFernando Fernandez Mancera2018-10-236-8/+54
| | | | | | | | | | | | | | Add support for ttl option in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: reset mnl_socket field in struct nft_ctx on EINTRPablo Neira Ayuso2018-10-222-4/+3
| | | | | | Otherwise we keep using the old netlink socket if we hit EINTR. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass struct nft_ctx through struct netlink_ctxPablo Neira Ayuso2018-10-228-182/+150
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass struct nft_ctx through struct eval_ctxPablo Neira Ayuso2018-10-222-71/+68
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus bail out with raw expression from dynamic setsPablo Neira Ayuso2018-10-171-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following ruleset that uses raw expressions: table ip nftlb { map persistency { type inet_service : mark size 65535 timeout 1h elements = { 53 expires 59m55s864ms : 0x00000064, 80 expires 59m58s924ms : 0x00000065, 443 expires 59m56s220ms : 0x00000064 } } chain pre { type filter hook prerouting priority filter; policy accept; ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } } } bogusly bails out with: /tmp/test:9:57-64: Error: datatype mismatch: expected internet network service, expression has type integer ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix the problem by evaluating expression basetype and length in this case. Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove opts field from struct xt_stmtPablo Neira Ayuso2018-10-172-7/+2
| | | | | | | | This is never used, ie. always NULL. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* src: add support for setting secmarkChristian Göttsche2018-10-158-5/+161
| | | | | | | | | | | | | | | | | | | | | | | | | Add support for new nft object secmark holding security context strings. The following should demonstrate its usage (based on SELinux context): # define a tag containing a context string nft add secmark inet filter sshtag \"system_u:object_r:ssh_server_packet_t:s0\" nft list secmarks # set the secmark nft add rule inet filter input tcp dport 22 meta secmark set sshtag # map usage nft add map inet filter secmapping { type inet_service : secmark \; } nft add element inet filter secmapping { 22 : sshtag } nft list maps nft list map inet filter secmapping nft add rule inet filter input meta secmark set tcp dport map @secmapping [ Original patch based on v0.9.0. Rebase on top on git HEAD. --pablo ] Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix memleak in dup_stmt_json()Phil Sutter2018-10-151-1/+1
| | | | | | | | | The variable 'root' is always assigned to after initialization, so there is no point in initializing it upon declaration. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Fix for ineffective family value checksPhil Sutter2018-10-151-99/+70
| | | | | | | | | | | | | Since handle->family is unsigned, checking for value < 0 never yields true. Overcome this by changing parse_family() to return an error code and write the parsed family value into a pointer passed as parameter. The above change required a bit more cleanup to avoid passing pointers to signed variables to the function. Also leverage json_parse_family() a bit more to reduce code side. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Fix memleak in nft_parse_bison_filename()Phil Sutter2018-10-151-4/+3
| | | | | | | | | Allocated scanner object leaks when returning to caller. For some odd reason, this was missed by the commit referenced below. Fixes: bd82e03e15df8 ("libnftables: Move scanner object into struct nft_ctx") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix memleak in netlink_parse_fwd() error pathPhil Sutter2018-10-151-5/+8
| | | | | | | | Make sure allocated 'stmt' is freed before returning to caller. Fixes: 30d45266bf38b ("expr: extend fwd statement to support address and family") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Use libnftables JSON outputPhil Sutter2018-10-153-140/+200
| | | | | | | | This switches 'nft monitor' JSON output from using libnftnl's to libnftables' implementation. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix printing of ct objectsPhil Sutter2018-10-152-22/+27
| | | | | | | | | | | | | | | Monitor output is supposed to be single lined without tabs, but ct object were printed with newlines and tabs hard-coded. Fixing this wasn't too hard given that there is 'stmt_separator' to also include semi-colons where required if newline was removed. A more obvious mistake was position of object type in monitor output: Like with other object types, it has to occur between command and table spec. As a positive side-effect, this aligns ct objects better with others (see obj_type_name_array for instance). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Drop 'update table' and 'update chain' casesPhil Sutter2018-10-151-8/+2
| | | | | | | | | There seems to be no situation where this comes to play. Also, since there is no 'nft update table/chain' command, this is inconsistent with input. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Drop fake XML supportPhil Sutter2018-10-151-6/+0
| | | | | | | | Since libnftnl doesn't support XML formatting, pretending to do so in nft monitor is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Add ct timeout supportPhil Sutter2018-10-152-1/+110
| | | | | | | Add support for printing and parsing ct timeout objects to JSON API. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: set proper error cause on existing elementsPablo Neira Ayuso2018-10-101-0/+2
| | | | | | | | | | | | | | | | | | Adding new elements result in a confusing "Success" error message. # nft add element x y { 0-3 } [...] Error: Could not process rule: Success add element x y { 0-3 } ^^^^^^^^^^^^^^^^^^^^^^^^ after this patch, this reports: Error: Could not process rule: File exists add element x y { 0-3 } ^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: incorrect handling of last element in get_set_decompose()Pablo Neira Ayuso2018-10-101-1/+1
| | | | | | | Add range to the list of matching elements. Fixes: 95629758a5ec ("segtree: bogus range via get set element on existing elements") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove netlink_flush_chain()Pablo Neira Ayuso2018-10-102-7/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove netlink_flush_table()Pablo Neira Ayuso2018-10-102-11/+1
| | | | | | | Just a simple wrapper function, replace it by direct call to mnl_nft_rule_del(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_set()Pablo Neira Ayuso2018-10-103-190/+197
| | | | | | | We can remove alloc_nftnl_set() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_rule()Pablo Neira Ayuso2018-10-103-95/+79
| | | | | | | We can remove alloc_nftnl_rule() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_chain()Pablo Neira Ayuso2018-10-043-95/+90
| | | | | | | | The netlink layer sits in between the mnl and the rule layers, remove it. We can remove alloc_nftnl_chain() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: remove alloc_nftnl_table()Pablo Neira Ayuso2018-10-043-74/+47
| | | | | | | | The netlink layer sits in between the mnl and the rule layers, remove it. We can remove alloc_nftnl_table() and consolidate infrastructure in the src/mnl.c file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of netlink_genid_get()Pablo Neira Ayuso2018-10-042-7/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove markup json parsing codePablo Neira Ayuso2018-10-041-274/+2
| | | | | | | | We have better json support these days, remove libnftnl json support. While at it, remove test file for this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Fix for ECN keyword in LHS of relationalPhil Sutter2018-10-041-9/+6
| | | | | | | | | | | | | | | | | | | | Of all possible TCP flags, 'ecn' is special since it is recognized by lex as a keyword (there is a a field in IPv4 and IPv6 headers with the same name). Therefore it is listed in keyword_expr, but that was sufficient for RHS only. The following statement reproduces the issue: | tcp flags & (syn | ecn) == (syn | ecn) The solution is to limit binop expressions to accept an RHS expression on RHS ("real" LHS expressions don't make much sense there anyway), which then allows keyword_expr to occur there. In order to maintain the recursive behaviour if braces are present, allow primary_rhs_expr to consist of a basic_rhs_expr enclosed in braces. This in turn requires for braced RHS part in relational_expr to be dropped, otherwise bison complains about shift/reduce conflict. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: stop iteration on existing elements in case range is foundPablo Neira Ayuso2018-10-031-4/+6
| | | | | | No need to keep iterating once the range object has been allocated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix memleak in do_get_setelems()Pablo Neira Ayuso2018-10-031-5/+3
| | | | | | Release set and elements in case of error. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: memleak in get_set_decompose()Pablo Neira Ayuso2018-10-031-0/+2
| | | | | | | Release set content on error. Moreover, release input set content in case we finally manage to decompose it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: disantangle get_set_interval_end()Pablo Neira Ayuso2018-10-031-15/+22
| | | | | | | | | | This function overrides the left pointer. Instead update this function to return the range that we found to enclose the left element. Note that we may not find a closing right element - therefore, it is a standalone element - in that case this function returns NULL. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: bogus range via get set element on existing elementsPablo Neira Ayuso2018-10-032-4/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | table ip x { set y { type inet_service flags interval elements = { 10, 20-30, 40, 50-60 } } } # nft get element x y { 20-40 } table ip x { set y { type inet_service flags interval elements = { 20-40 } } } 20 and 40 exist in the tree, but they are part of different ranges. This patch adds a new get_set_decompose() function to validate that the left and the right side of the range. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Fix for chain prio name 'out'Phil Sutter2018-09-261-3/+12
| | | | | | | | | | | Since 'out' is defined as a keyword in scanner.l, using it as a chain priority name without quotes is not possible. Fix this by introducing 'extended_prio_name' in bison which may be either a string (as before) or OUT, which is then converted into a string. Fixes: c8a0e8c90e2d1 ("src: Set/print standard chain prios with textual names") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add ipsec (xfrm) expressionMáté Eckl2018-09-219-11/+388
| | | | | | | | | | | | | | | | This allows matching on ipsec tunnel/beet addresses in xfrm state associated with a packet, ipsec request id and the SPI. Examples: ipsec in ip saddr 192.168.1.0/24 ipsec out ip6 daddr @endpoints ipsec in spi 1-65536 Joint work with Florian Westphal. Cc: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rename meta secpath to meta ipsecFlorian Westphal2018-09-212-1/+5
| | | | | | | for symmetry with 'rt ipsec'. "meta secpath" still works. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rt: add support to check if route will perform ipsec transformationFlorian Westphal2018-09-214-0/+9
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: throw distinct error if map exists but contains no objectsFlorian Westphal2018-09-201-2/+4
| | | | | | | | | | | | | | | | | | | | | nft would throw misleading error in case map exists but doesn't contain expected objects. nft add rule filter in ct helper set tcp dport map @foo Error: Expression is not a map add rule filter in ct helper set tcp dport map @foo ^^^^ nft list table filter table ip filter { map foo { type inet_service : ifname } ... clarify this. Reported-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: Print range expressions numericallyPhil Sutter2018-09-131-1/+7
| | | | | | | | This applies the same change as in commit 85b1e3c0052ef ("src: Always print range expressions numerically") to JSON output for consistency. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: Make inet_service_type_json() respect literal levelPhil Sutter2018-09-131-1/+17
| | | | | | | | | | | This brings inet_service_type_json() on par with inet_service_type_print(). Despite datatype_print()'s ability to use the 'print' callback, a dedicated 'json' callback is required to make port numbers appear as numbers in JSON output instead of strings. Therefore go with a bit of code duplication here. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* json: Fix datatype_json() for literal levelPhil Sutter2018-09-131-4/+5
| | | | | | | | | | If a datatype doesn't provide a 'json' callback, datatype_json() uses fmemopen() to grab the output from 'print' callback. When doing so, reuse the existing output context instead of creating a dedicated one to make sure all output-related settings are exactly as expected. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Fix literal check for inet_service typePhil Sutter2018-09-101-1/+1
| | | | | | | | | | | | Since literal option is supposed to be a level, matching for equality is not correct here since the level may be higher than NFT_LITERAL_PORT. This fixes for ports being printed numerically if '-l' option was given twice. Fixes: b0f6a45b25dd1 ("src: add --literal option") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: fix icmp/icmpv6 code datatypeFlorian Westphal2018-09-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Andrew A. Sabitov says: I'd like to use a set (concatenation) of icmpv6 type and icmpv6 code and check incoming icmpv6 traffic against it: add set inet fw in_icmpv6_types { type icmpv6_type . icmpv6_code; } add element inet fw in_icmpv6_types { 1 . 0 } # no route to destination add element inet fw in_icmpv6_types { 1 . 1 } # communication with destination administratively prohibited # ... add rule inet fw in_icmpv6 icmpv6 type . icmpv6 code @in_icmpv6_types \ limit rate 15/minute accept yields: Error: can not use variable sized data types (integer) in concat expressions icmpv6 type . icmpv6 code @in_icmpv6_types ~~~~~~~~~~~~~~^^^^^^^^^^^ Change 'code' type to the icmp/icmpv6 code type. Needs minor change to test suite as nft will now display human-readable names instead of numeric codes. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1276 Signed-off-by: Florian Westphal <fw@strlen.de>