summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* erec_print: Pass output FILE pointer to netlink_dump_expr()Phil Sutter2017-09-292-3/+4
| | | | | | | | | | It was a bit odd that erec_print() outputs to a given FILE pointer but then calls netlink_dump_expr() which just prints to stdout. Fix this by passing the given FILE pointer along so output is guaranteed to go to the same destination. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Simplify tcp option printing a bitPhil Sutter2017-09-291-8/+4
| | | | | | | This eliminates the need for that temporary buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Use C99-style initializer in cache_init()Phil Sutter2017-09-291-9/+8
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bison: permit keywords in list_stmt_expressionsFlorian Westphal2017-09-271-4/+7
| | | | | | | | | | | | | 'ct event set label' and 'ct event set new or label' work, but 'ct event set new, label' did not: nft add rule filter input ct event set new,label Error: syntax error, unexpected label This changes the definition to also contain keyword symbol expressions. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parser_bison: rename ct_block to ct_helper_blockFlorian Westphal2017-09-271-8/+8
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: prepare for future ct timeout policy supportFlorian Westphal2017-09-273-93/+22
| | | | | | | | | | | | | | | | Change all places that expect ct helper tokens (ct helper configuration) to CT HELPER. ct_obj_kind is removed. When we add ct timeout support, we will add a new ct_timeout_block, plus extra rules. We won't extend ct_block, it prevents the parser from detecting bogus syntax that only makes sense for ct helper but not for something else for instance. ct_block should be renamed to ct_helper_block, will be done in followup patch. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ct: remove unused functionsFlorian Westphal2017-09-271-50/+0
| | | | | | | | | since commit b0c2606ed02fed828ab7c34227e355f5542bc925 ("parser_bison: use keywords in ct expression") we no longer abuse string for this, so there are no users of these helpers anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: store expression as set key instead of data typeFlorian Westphal2017-09-277-80/+98
| | | | | | | | | | | | Doing so retains legth information in case of unqualified data types, e.g. we now have 'meta iifname' expression instead of an (unqualified) string type. This allows to eventually use iifnames as set keys without adding yet another special data type for them. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: prepare to store expr key rather than datatypeFlorian Westphal2017-09-271-19/+23
| | | | | | | | | | | | | | | | | | | currently set definitions store a datatype rather than an expression. In order to support use of unqualified data types (string in particular), this prepares implicit set definition helper to expect an expression instead of plain data type. This also has the advantage that we can use EXPR_CONCAT to retain the original expressions when key concatentation is used, e.g. 'meta iifname . tcp dport'. The netlink serialization code can use this info to store individual key lengths independently of data types. Would also allow later on to store the original names of the expressions, e.g. "ip daddr", in the kernel to support a future typeof keyword, e.g. 'type typeof(ip daddr)' instead of 'type ipv4_addr'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow helper keyword in ct object kindPablo Neira Ayuso2017-09-271-5/+6
| | | | | | | The helper keyword clashes with the string rule, make sure we still accept ct helper object types from the parser. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: use keywords in ct expressionPablo Neira Ayuso2017-09-272-54/+44
| | | | | | | | Using string give us more chances to hit shift/reduce conflicts when extending this grammar, more specifically, from the stmt_expr rule, so add keywords for this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: consolidate stmt_expr rulePablo Neira Ayuso2017-09-271-27/+112
| | | | | | | | | | | | | | | | | | Extend stmt_expr and use it from all of our statement rules. Add more rules to describe what we take from statement expressions, instead of reusing rhs_expr which is allowing way more things that we actually need here. This is causing us problems when extending the grammar. After this patch, you will hit this: parser_bison.y: warning: 2 shift/reduce conflicts [-Wconflicts-sr] However, this is fixed by the follow up patches: parser_bison: allow helper keyword in ct object kind parser_bison: use keywords in ct expression Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix for incorrect debug_maskPhil Sutter2017-09-271-7/+8
| | | | | | | | | | | | | | The field 'debug_mask' of struct netlink_mon_handler was left uninitialized in do_command_monitor() so it contained garbage from the stack. Fix this by initializing it with the debug_mask value from struct netlink_ctx. While being at it, change the code to make use of C99-style initializer, which will also avoid things like this in future. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Fix for return of uninitialized variable in nft_run_cmd_from_filename()Phil Sutter2017-09-271-1/+3
| | | | | | | | | If scanner_read_file() failed, the function would return an uninitialized value. Fixes: 3db28321b64a6 ("src: add nft_run_cmd_*() functions") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: do not set NLM_F_CREATE in deletion requestsPablo Neira Ayuso2017-09-081-2/+5
| | | | | | | This flag is not legal there, it only makes sense for addition requests. This patch has no impact at all in any of the nf_tables kernel versions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flags fo nft_ctx_newEric Leblond2017-09-041-9/+11
| | | | | | | | | | | By adding flags to nft_ctx_new, we will have a minimum capabilities of changing the way the nft_ctx is created. For now, this patch uses a simple value that allow the user to specify that he will handle netlink by himself. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object support for limitPablo M. Bermudo Garay2017-09-046-5/+167
| | | | | | | | This patch adds support for a new type of stateful object: limit. Creation, deletion and listing operations are supported. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_netlink_init()Pablo Neira Ayuso2017-09-011-2/+10
| | | | | | | Add these two new functions to set up netlink sockets in the global context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove nfsock_open()Pablo Neira Ayuso2017-09-011-11/+5
| | | | | | Just merge this code to netlink_open_sock(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move nf_sock into nft_ctx structurePablo Neira Ayuso2017-09-011-15/+11
| | | | | | | | | | The idea is to provide a simplistic API for non-netlink wise people. Add a field in struct nft_ctx to store the socket. The advanced API that we're planning will just simply leave this unset, since netlink IO will be exposed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: convert expr_rt byteorder when evaluating statment argFlorian Westphal2017-08-281-0/+2
| | | | | | | | | | | | | | expr_rt might write data in host byte order, so make sure to convert if needed. This makes 'tcp option maxseg size rt mtu' actually work, right now such rules are no-ops because nft_exthdr never increases the mss. While at it, extend the example to not bother testing non-syn packets. Reported-by: Matteo Croce <technoboy85@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Fix memleaks for STRING token (and derived ones)Phil Sutter2017-08-282-10/+37
| | | | | | | | | | | | | | The common paradigm here is that all parser rules converting string tokens into symbols must free the string token if it's not used anymore. This is unrelated to the %destructor directive, since that will apply only if the parser discards the token, which is not the case then. While being at it, simplify error handling in parser rule for listing conntrack helpers (error() won't return NULL) and drop the unused extra parameter passed to error() in level_type rule. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: call nft_init() and nft_exit() from context routinesPablo Neira Ayuso2017-08-241-5/+4
| | | | | | | So we don't forget all these caches should be placed into struct nft_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: release caches from nft_ctx_free() pathEric Leblond2017-08-241-3/+2
| | | | | | | | | | Release existing caches from nft_ctx_free(). Still, the iface cache should be good to place it in the nft_ctx structure. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_run_cmd_*() functionsEric Leblond2017-08-241-22/+54
| | | | | | | | | | Add new function to read nftables command from a file and buffer, that we can expose as library. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_new() and nft_ctx_free()Eric Leblond2017-08-241-25/+39
| | | | | | | | | | These new functions allows us to allocate and release the context structure. This is going to be useful for libnftables. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix error handling in mnl_batch_talkEric Leblond2017-08-242-3/+5
| | | | | | | | | | | | If one of the command is failing we should return an error. Pablo says: "This is not a real issue since nft_netlink() returns an error in case the list of errors is not empty. But we can indeed simplify things by removing that explicit assignment in nft_netlink() so mnl_batch_talk() consistently reports when if an error has happened. Signee-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Fix for memleak when commands failPhil Sutter2017-08-241-0/+2
| | | | | | | In case of failing command evaluation, commands need to be freed as their memory becomes orphaned afterwards. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Make use of yylex_init_extra()Phil Sutter2017-08-241-2/+1
| | | | | | This combines the calls to yylex_init() and yyset_extra(). Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Fix for wrong parameter type of scanner_destroy()Phil Sutter2017-08-241-1/+1
| | | | | | | | The function takes the scanner as argument, not the state. This wasn't a real issue since scanner is a void pointer, which means it's only casted around without need. So this fix is a rather cosmetic one. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Fix for memleak due to unclosed file pointerPhil Sutter2017-08-243-8/+8
| | | | | | | | | | | | | | | | | | | | When including a file, it is opened by fopen() and therefore needs to be closed after scanning has finished using fclose(), otherwise valgrind will report a memleak. This patch changes struct input_descriptor to track the opened FILE pointer instead of the file descriptor so the pointer is available for closing in scanner_destroy(). While at it, change erec_print() to work on the open FILE pointer so it doesn't have to call fileno() in beforehand. And as a little bonus, use C99 initializer of the buffer to get rid of the call to memset(). Note that it is necessary to call erec_print_list() prior to destroying the scanner, otherwise it will start manipulating an already freed FILE pointer (and therefore crash the program). Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: Fix debug_proto_ctx()Phil Sutter2017-08-241-1/+1
| | | | | | | | | Debug mask check was done against wrong flag, causing protocol context debug output being printed when only --debug=netlink was given. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Initialize struct stmt in _match and _target functions.Varsha Rao2017-08-241-0/+2
| | | | | | | | | | Initialize structure stmt with stmt_alloc in netlink_parse_target and netlink_parse_match functions. This patch fixes the gcc warning: ‘stmt’ may be used uninitialized in this function. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix typoPablo M. Bermudo Garay2017-08-241-37/+37
| | | | | | | Separator was misspelled as "seperator" in a symbol name. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add debugging mask to context structurePablo Neira Ayuso2017-08-2312-101/+130
| | | | | | | So this toggle is not global anymore. Update name that fits better with the semantics of this variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: pass struct netlink_ctx to mnl_nft_socket_sendmsg()Pablo Neira Ayuso2017-08-231-7/+6
| | | | | | Reduce function footprint. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add struct mnl_ctxPablo Neira Ayuso2017-08-231-38/+89
| | | | | | This new structure contains the netlink socket and the sequence number. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove ifdef DEBUG pollutionPablo Neira Ayuso2017-08-237-46/+1
| | | | | | | | | | | | | | | Get rid of lots of ifdef DEBUG pollution in the code. The --debug= option is useful to get feedback from users, so it should be always there. And we really save nothing from keeping this code away from the control plane with a compile time option. Just running tests/shell/ before and after this patch, time shows almost no difference. So this patch leaves --enable-debug around to add debugging symbols in your builds, this is left set on by default. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add maximum number of parser errors to struct nft_ctxPablo Neira Ayuso2017-08-232-4/+4
| | | | | | Not a global variable anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add include_paths to struct nft_ctxPablo Neira Ayuso2017-08-233-13/+19
| | | | | | | Not convenient to keep this as static for the upcoming library, so let's move it where it belongs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Keep cache in struct nft_ctxPhil Sutter2017-08-232-21/+17
| | | | | | | This is preliminary work for Eric's libnftables patchset. Cc: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc>
* rt: add path mtu supportFlorian Westphal2017-08-222-0/+6
| | | | | | | | | | Only use case is to allow similar behaviour to iptables TCPMSS --clamp-mss-to-pmtu, by combining this with exthdr statement: tcp option maxseg size set rt mtu Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add tcp options set supportFlorian Westphal2017-08-225-3/+92
| | | | | | | | | | | | This adds support for tcp mss mangling: nft add rule filter input tcp option maxseg size 1200 Its also possible to change other tcp option fields, but maxseg is one of the more useful ones to change. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: Remove unused functions.Varsha Rao2017-08-171-94/+0
| | | | | | | | | | Functions mnl_nft_chain_get(), mnl_nft_rule_add(), mnl_nft_rule_delete(), mnl_nft_set_get(), mnl_nft_table_get(), set_get_cb(), table_get_cb() and chain_get_cb() are only defined but not used, so remove them. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove unused functions.Varsha Rao2017-08-171-104/+0
| | | | | | | | | | Remove netlink_add_rule_list(), netlink_dump_table(), netlink_get_chain(), netlink_get_set(), netlink_get_table(), netlink_list_chain() functions definitions as they are not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: cli: Remove cli_display() function.Varsha Rao2017-08-171-26/+0
| | | | | | | | Remove cli_display() function, as it is not called anywhere in source code. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: gmputil: Remove mpz_get_be64() function.Varsha Rao2017-08-171-5/+0
| | | | | | | mpz_get_be64() is not used anywhere in source code. So remove it. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove xt_stmt_() functions.Varsha Rao2017-08-172-97/+0
| | | | | | | | | Remove functions xt_stmt_alloc(), xt_stmt_release(), xt_stmt_xlate(), xt_stmt_print(), xt_stmt_destroy() as they are not used. Similarly, remove structure xt_stmt_ops. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: shift immediate value when adjusting size for csum fixupFlorian Westphal2017-08-171-11/+14
| | | | | | | | | | | | | | | | | | | | | | | nft add rule .. ip ttl set 64 erronously mangles ip protocol instead of ttl. Because the kernel can't deal with odd-sized data (ttl is one byte) when doing checksum fixups, so the write to 'ttl' is turned into [ payload load 2b @ network header + 8 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000ff ) ^ $new_value ] [ payload write reg 1 => 2b @ network header + 8 csum_type 1 csum_off 10 csum_flags 0x0 ] While doing so, we did fail to shift the imm value, i.e. we clear the wrong half of the u16 (protocol) instead of csum. The correct mask is 0xff00, and $new_value needs to be shifted so we leave the protocol value (which is next to ttl) alone. Fixes: f9069cefdf ("netlink: make checksum fixup work with odd-sized header fields") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make netlink sequence number non-staticPablo Neira Ayuso2017-08-154-118/+136
| | | | | | | | | | | | Place sequence number that is allocated per-command on the struct netlink_ctx structure. This is allocated from nft_run() to correlate commands with netlink messages for error reporting. Batch support probing also shares this sequence numbers with commands. There is an inpendent cache sequence number though, this routine is called from a different path, usually from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>