summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* erec: Avoid passing negative offset to fseek()Phil Sutter2018-03-021-5/+5
| | | | | | | | If the initial call to ftell() fails, variable orig_offset is set to -1. Avoid passing this to fseek() later on. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: Drop pointless check in cli_append_multiline()Phil Sutter2018-03-021-10/+2
| | | | | | | | | | | | | The function is called from cli_complete after it has checked for line to be != NULL. The other part of the conditional, namely multiline being NULL, is perfectly valid (if the last read line didn't end with backslash. Hence drop the conditional completely. Since variable eof is not used anywhere outside of the dropped conditional, get rid of it completely. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make JSON/XML output respect output_fpPhil Sutter2018-02-281-19/+18
| | | | | | | | | | | | Make sure events callbacks print to output_ctx-defined stream for any type of output format. Since all of them use nft_print() as last call (if anything is printed at all), the final call to fflush() in netlink_events_cb() can be dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make trace events respect output_fpPhil Sutter2018-02-281-17/+21
| | | | | | | | Seems like this was incompletely converted, part of the output went to output_fp already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Review switch statements for unmarked fall through casesPhil Sutter2018-02-285-4/+7
| | | | | | | | | | | | | | While revisiting all of them, clear a few oddities as well: - There's no point in marking empty fall through cases: They are easy to spot and a common concept when using switch(). - Fix indenting of break statement in one occasion. - Drop needless braces around one case which doesn't declare variables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Added undefine/redefine keywordsDavid Fabian2018-02-263-0/+39
| | | | | | | | | | | | | | | | | This is a small patch to nft which adds two new keywords - undefine and redefine. undefine simply undefines a variable from the current scope. redefine allows one to change a variable definition. We have a firewall written in bash (using iptables) that is organized by customer VLANs. Each VLAN has its own set of bash variables holding things like uplink iface names, gateway IPs, etc. We want to rewrite the firewall to nftables but are stuck on the fact that nft variables cannot be overridden in the same scope. We have each VLAN configuration in a separate file containing pre/post-routing, input, output and forward rules,and we include those files to a master firewall configuration. One solution is to rename all the variables with some VLAN specific (pre/su)ffix. But that is cumbersome. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make raw payloads workFlorian Westphal2018-02-263-1/+7
| | | | | | | | | | | | | | | | | | | | make syntax consistent between print and parse. No dependency handling -- once you use raw expression, you need to make sure the raw expression only sees the packets that you'd want it to see. based on an earlier patch from Laurent Fasnacht <l@libres.ch>. Laurents patch added a different syntax: @<protocol>,<base>,<data type>,<offset>,<length> data_type is useful to make nftables not err when asking for "@payload,32,32 192.168.0.1", this patch still requires manual convsersion to an integer type (hex or decimal notation). data_type should probably be added later by adding an explicit cast expression, independent of the raw payload syntax. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't resolve expressions using the inet pseudoheaderFlorian Westphal2018-02-261-1/+1
| | | | | | | Else, '@ll,0,8' will be mapped to 'inet nfproto', but thats not correct (inet is a pseudo header). Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: use integer_type when initializing a raw expressionFlorian Westphal2018-02-261-0/+1
| | | | | | | The invalid type prints prominent "[invalid]", so prefer integer type in raw expressions. Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce datatype ifname_typeArturo Borrero Gonzalez2018-02-255-16/+26
| | | | | | | | | | | | | | | | | | | | | | | | This new datatype is a string subtype. It will allow us to build named maps/sets using meta keys like 'iifname', 'oifname', 'ibriport' or 'obriport'. Example: table inet t { set s { type ifname elements = { "eth0", "eth1" } } chain c { iifname @s accept oifname @s accept } } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: check for overlapping elements at insertionPablo Neira Ayuso2018-02-251-44/+16
| | | | | | | This speeds up element overlap checks quite a bit. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1228 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: bail out when exporting ruleset with unsupported outputPablo Neira Ayuso2018-02-152-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | Display error message and propagate error to shell when running command with unsupported output: # nft export ruleset json Error: this output type is not supported export ruleset json ^^^^^^^^^^^^^^^^^^^^ # echo $? 1 When displaying the output in json using the low-level VM representation, it shows: # nft export ruleset vm json ... low-level VM json output # echo $? 0 While at it, do the same with obsoleted XML output. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1224 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: don't decode past last valid templateFlorian Westphal2018-02-151-0/+4
| | | | | | | | | | | | When trying to decode payload header fields, be sure to bail out when having exhausted all available templates. Otherwise, we allocate invalid payload expressions (no dataype, header length of 0) and then crash when trying to print them. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1226 Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Spelling fixesVille Skyttä2018-02-153-5/+5
| | | | | Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: add meta_may_dependency_kill()Pablo Neira Ayuso2018-02-151-1/+71
| | | | | | | | | | | | | Do not exercise dependency removal for protocol key network payload expressions in bridge, netdev and inet families from meta expressions, more specifically: * inet: nfproto and ether type. * netdev and bridge: meta protocol and ether type. need to be left in place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload_may_dependency_kill()Pablo Neira Ayuso2018-02-151-2/+29
| | | | | | | | Payload protocol key expressions at network base are meaningful in the netdev, bridge and inet families, do not exercise the redundant dependency removal in those cases since it breaks rule semantics. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of __payload_dependency_kill()Pablo Neira Ayuso2018-02-152-16/+8
| | | | | | Use payload_dependency_release() instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add payload_dependency_exists()Pablo Neira Ayuso2018-02-152-15/+34
| | | | | | | | | | | | | | | This helper function tells us if there is already a protocol key payload expression, ie. those with EXPR_F_PROTOCOL flag set on, that we might want to remove since we can infer from another expression in the upper protocol base, eg. ip protocol tcp tcp dport 22 'ip protocol tcp' can be removed in the ip family since it is redundant, but not in the netdev, bridge and inet families, where we cannot make assumptions on the layer 3 protocol. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: add payload_dependency_release() helper functionPablo Neira Ayuso2018-02-151-9/+13
| | | | | | | Wrap code that releases existing dependencies that we have just annotated in the context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass family to payload_dependency_kill()Pablo Neira Ayuso2018-02-153-14/+20
| | | | | | | | | This context information is very relevant when deciding if a redundant dependency needs to be removed or not, specifically for the inet, bridge and netdev families. This new parameter is used by follow up patch entitled ("payload: add payload_may_dependency_kill()"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Enable automerge feature for anonymous setsPhil Sutter2018-02-151-0/+1
| | | | | | | | | | | Automatic merging of adjacent/overlapping ranges upon insertion has clear benefits performance- and readability-wise. The drawbacks which led to disabling it by default don't apply to anonymous sets since they are read-only anyway, so enable this feature for them again. Cc: Jeff Kletsky <netfilter@allycomm.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix build with older glibcBaruch Siach2018-02-091-0/+1
| | | | | | | | | | | | | | | | glibc before 2.19 missed the definition of IPPROTO_MH. This leads to build failure: parser_bison.y: In function 'nft_parse': parser_bison.y:3793:21: error: 'IPPROTO_MH' undeclared (first use in this function) | MH { $$ = IPPROTO_MH; } ^ Since we have a local definition of IPPROTO_MH in headers.h use that to fix the build. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: add assertion to prevent infinite loopPablo Neira Ayuso2018-02-021-1/+4
| | | | | | | | | | | | | | | | | | | | | | | The following configuration: table inet filter { chain input { ct original ip daddr {1.2.3.4} accept } } is triggering an infinite loop. This problem also exists with concatenations and ct ip {s,d}addr. Until we have a solution for this, let's just prevent infinite loops. Now we hit this: # nft list ruleset nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed. Abort Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add 'auto-merge' option to setsPablo Neira Ayuso2018-01-226-4/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After discussions with Karel here: https://bugzilla.netfilter.org/show_bug.cgi?id=1184 And later on with Phil Sutter, we decided to disable the automatic merge feature in sets with intervals. This feature is problematic because it introduces an inconsistency between what we add and what we later on get. This is going to get worse with the upcoming timeout support for intervals. Therefore, we turned off this by default. However, Jeff Kletsky and folks like this feature, so let's restore this behaviour on demand with this new 'auto-merge' statement, that you can place on the set definition, eg. # nft list ruleset table ip x { ... set y { type ipv4_addr flags interval auto-merge } } # nft add element x z { 1.1.1.1-2.2.2.2, 1.1.1.2 } Regarding implementation details: Given this feature only makes sense from userspace, let's store this in the set user data area, so nft knows it has to do automatic merge of adjacent/overlapping elements as per user request. # nft add set x z { type ipv4_addr\; auto-merge\; } Error: auto-merge only works with interval sets add set x z { type ipv4_addr; auto-merge; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1216 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert ("src: Remove xt_stmt_() functions").Pablo Neira Ayuso2018-01-202-2/+97
| | | | | | | | | Revert commit bce55916b51ec1a4c23322781e3b0c698ecc9561, we need this code in place to properly make translation when iptables-compat loads rules. Reported-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add import command for low level jsonShyam Saini2018-01-175-22/+356
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This new operation allows to import low level virtual machine ruleset in json to make incremental changes using the parse functions of libnftnl. A basic way to test this new functionality is: $ cat file.json | nft import vm json where the file.json is a ruleset exported in low level json format. To export json rules in low level virtual machine format we need to specify "vm" token before json. See below $ nft export vm json and $ nft export/import json will do no operations. Same goes with "$nft monitor" Highly based on work from Alvaro Neira <alvaroneay@gmail.com> and Arturo Borrero <arturo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Shyam Saini <mayhs11saini@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add secpath supportFlorian Westphal2018-01-161-0/+3
| | | | | | | | | This can be used to check if a packet has a secpath attached to it, i.e. was subject to ipsec processing. Example: add rule inet raw prerouting meta secpath exists accept Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Don't merge adjacent/overlapping rangesPhil Sutter2018-01-113-9/+38
| | | | | | | | | | | | | | | | | | | | | Previously, when adding multiple ranges to a set they were merged if overlapping or adjacent. This might cause inconvenience though since it is afterwards not easily possible anymore to remove one of the merged ranges again while keeping the others in place. Since it is not possible to have overlapping ranges, this patch adds a check for newly added ranges to make sure they don't overlap if merging is turned off. Note that it is not possible (yet?) to enable range merging using nft tool. Testsuite had to be adjusted as well: One test in tests/py changed avoid adding overlapping ranges and the test in tests/shell which explicitly tests for this feature dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: Restore per object CFLAGSPhil Sutter2018-01-101-10/+17
| | | | | | | | As per the automake manual, create internal libraries for parser and mini-gmp sources so per-object flags can be set. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh nf_tables.h cached copyPablo Neira Ayuso2018-01-081-1/+1
| | | | | | Refresh it to fetch what we have in 4.15-rc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not print limit keyword inside object definitionPablo M. Bermudo Garay2017-12-221-2/+2
| | | | | | | | | | | | | | | | table ip limits { limit foo { limit rate 5/second ^^^^^ } } This behaviour is inconsistent and breaks the restoration of saved rule-sets with "nft -f". Fixes: c0697eabe832 ("src: add stateful object support for limit") Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix protocol context update on big-endian systemsPhil Sutter2017-12-127-17/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an obscure bug on big-endian systems when trying to list a rule containing the expression 'ct helper tftp' which triggers the assert() call in mpz_get_type(). Florian identified the cause: ct_expr_pctx_update() is called for the relational expression which calls mpz_get_uint32() to get RHS value (assuming it is a protocol number). On big-endian systems, the misinterpreted value exceeds UINT_MAX. Expressions' pctx_update() callback should only be called for protocol matches, so ct_meta_common_postprocess() lacked a check for 'left->flags & EXPR_F_PROTOCOL' like the one already present in payload_expr_pctx_update(). In order to fix this in a clean way, this patch introduces a wrapper relational_expr_pctx_update() to be used instead of directly calling LHS's pctx_update() callback which unifies the necessary checks (and adds one more assert): - assert(expr->ops->type == EXPR_RELATIONAL) -> This is new, just to ensure the wrapper is called properly. - assert(expr->op == OP_EQ) -> This was moved from {ct,meta,payload}_expr_pctx_update(). - left->ops->pctx_update != NULL -> This was taken from expr_evaluate_relational(), a necessary requirement for the introduced wrapper to function at all. - (left->flags & EXPR_F_PROTOCOL) != 0 -> The crucial missing check which led to the problem. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_linearize: exthdr op must be u32Florian Westphal2017-12-111-2/+2
| | | | | | | | libnftnl casts this to u32. Broke exthdr expressions on bigendian. Reported-by: Li Shuang <shuali@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Make libnftables a local static libraryPhil Sutter2017-12-042-1/+2
| | | | | | | | | This changes Makefiles so that libnftables is built into a static library which is not installed. This allows for incompatible changes while still providing a library to link to for testing purposes. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: don't print newline if label bit cannot be mappedFlorian Westphal2017-11-271-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: print error for null stringHarsha Sharma2017-11-271-1/+4
| | | | | | | | | | | | Print error "Empty string is not allowed", eg. # nft add rule filter input meta iifname '""' add rule filter input meta iifname "" ^^ Error: Empty String is not allowed Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: no need for 'name' token for metersPablo Neira Ayuso2017-11-241-13/+16
| | | | | | | Rework grammar to skip the 'name' token after 'meter' for named meters. For consistency with sets and maps in terms of syntax. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: dismiss anonymous metersPablo Neira Ayuso2017-11-242-9/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The former 'flow table' syntax allows flow tables with no name: # nft add rule x y flow { ip saddr counter } However, when listing, it leaks the name that it is autoallocating. # nft list ruleset table ip x { chain y { flow table __mt0 { ip saddr counter} } } Which is odd since then restoring will use such a name. Remove anonymous flow table/meters, so everyone needs to specify a name. There is no way to fix this, given anonymous flag tells us that the set behind this meter is bound to a rule, hence, released once the rule is going - the term "anonymous" was not good choice as a flag in first place. Only possibility is to strcmp for __ft to identify this is a nameless meter, which is a hack. Moreover, having no name means you cannot flush the set behind this meter, which criples this feature for no reason. On top of it, the wiki only documents named meters, and we have a record of users complaining on this behaviour. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Florian Westphal <fw@strlen.de>
* src: deprecate "flow table" syntax, replace it by "meter"Pablo Neira Ayuso2017-11-248-87/+111
| | | | | | | | | | | | | | | | | | | | | | | | | According to bugzilla 1137: "flow tables" should not be syntactically unique. "Flow tables are always named, but they don't conform to the way sets, maps, and dictionaries work in terms of "add" and "delete" and all that. They are also "flow tables" instead of one word like "flows" or "throttle" or something. It seems weird to just have these break the syntactic expectations." Personally, I never liked the reference to "table" since we have very specific semantics in terms of what a "table" is netfilter for long time. This patch promotes "meter" as the new keyword. The former syntax is still accepted for a while, just to reduce chances of breaking things. At some point the former syntax will just be removed. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1137 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* gmputil: turn mpz_printf into mpz_vfprintf to restore --with-mini-gmpPablo Neira Ayuso2017-11-221-6/+8
| | | | | | | | | | 2535ba7006f2 ("src: get rid of printf") uses gmp_vfprintf() which doesn't exists in mini-gmp.c, this breaks compilation with --mini-gmp. This patch implements poor man's gmp_vfprintf that takes one single argument which is what we need. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Ensure output_fp is never NULLPhil Sutter2017-11-223-12/+5
| | | | | | | | | | | | | | Initialize output_fp to 'stdout' upon context creation and check output stream validity in nft_ctx_set_output(). This allows to drop checks in nft_{gmp_,}print() and do_command_export(). While doing so for the latter, simplify it a bit by using nft_print() which takes care of flushing the output stream. If applications desire to drop all output, they are supposed to open /dev/null and assign that. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Make 'nft export' respect output_fpPhil Sutter2017-11-161-2/+7
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Split code into frontend and libraryPhil Sutter2017-11-163-9/+20
| | | | | | | | | | | | | | | | | | | | | | | This finally creates the libnftables shared object. For some reason, this causes two compiler warnings to appear: | parser_bison.y: In function 'nft_parse': | parser_bison.y:131:3: warning: implicit declaration of function 'nft_set_debug' [-Wimplicit-function-declaration] | nft_set_debug(1, scanner); | ^~~~~~~~~~~~~ | parser_bison.c:64:25: warning: implicit declaration of function 'nft_lex' [-Wimplicit-function-declaration] | #define yylex nft_lex | ^ | parser_bison.c:4745:16: note: in expansion of macro 'yylex' | yychar = yylex (&yylval, &yylloc, scanner); So this patch contains a workaround, namely declaring both functions in src/parser_bison.y. During linking the objects are found, so this is rather a matter of cosmetics. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Unexport enum nftables_exit_codesPhil Sutter2017-11-162-16/+16
| | | | | | | | | | | | | | | | Apart from SUCCESS/FAILURE, these codes were not used by library functions simply because NOMEM and NONL conditions lead to calling exit() instead of propagating the error condition back up the call stack. Instead, make nft_run_cmd_from_*() return either 0 or -1 on error. Usually errno will then contain more details about what happened and/or there are messages in erec. Calls to exit()/return in main() are adjusted to stay compatible. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Eliminate struct mnl_ctxPhil Sutter2017-11-163-181/+116
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The issue leading to this patch was that debug output in nft_mnl_talk() bypasses the application-defined output_fp. While investigating, another problem was discovered: Most of the ad-hoc defined mnl_ctx objects have their field 'debug_mask' set to zero regardless of what netlink_ctx contains (this affects non-batch code path only). The intuitive solution to both of those issues required to extend function parameters of all the non-batch functions as well as the common nft_mnl_talk() one. Instead of complicating them even further, this patch instead makes them accept a pointer to netlink_ctx as first parameter to gather both the old (nf_sock, seqnum) and the new values (debug_mask, octx) from. Since after the above change struct mnl_ctx was not really used anymore, so the remaining places were adjusted as well to allow for removing the struct altogether. Note that cache routines needed special treatment: Although parameters of cache_update() make it a candidate for the same change, it can't be converted since it is called in evaluation phase sometimes in which there is no netlink context available (but just eval context instead). Since netlink_genid_get() needs a netlink context though, the ad-hoc netlink_ctx definition from cache_init() is moved into cache_update() to have it available there already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Flush iface cache after command executionPhil Sutter2017-11-131-0/+2
| | | | | | | | | | | | | | Commit 94a945ffa81b7 ("libnftables: Get rid of explicit cache flushes") was a bit too optimistic in that it missed the remaining need to flush interface cache after each command in interactive mode - otherwise, newly added interfaces won't be recognized. Although cli.c only calls nft_run_cmd_from_buffer(), flush caches in nft_run_cmd_from_filename() as well for matters of consistency. Fixes: 94a945ffa81b7 ("libnftables: Get rid of explicit cache flushes") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow classid as set keyArturo Borrero Gonzalez2017-11-051-0/+1
| | | | | | | | | Allow TC classid as set key. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Reported-by: Tomas Mudrunka <mudrunka@spoje.net> Tested-by: Tomas Mudrunka <mudrunka@spoje.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Get rid of explicit cache flushesPhil Sutter2017-10-265-16/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In the past, CLI as a potentially long running process had to make sure it kept it's cache up to date with kernel's rule set. A simple test case is this: | shell a | shell b | | # nft -i | # nft add table ip t | | | nft> list ruleset | | table ip t { | | } | # nft flush ruleset | | | nft> list ruleset | | nft> In order to make sure interactive CLI wouldn't incorrectly list the table again in the second 'list' command, it immediately flushed it's cache after every command execution. This patch eliminates the need for that by making cache updates depend on kernel's generation ID: A cache update stores the current rule set's ID in struct nft_cache, consecutive calls to cache_update() compare that stored value to the current generation ID received from kernel - if the stored value is zero (i.e. no previous cache update did happen) or if it doesn't match the kernel's value (i.e. cache is outdated) the cache is flushed and fully initialized again. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ prefix to everything exposed through include/nftables/nftables.hPablo Neira Ayuso2017-10-2412-51/+52
| | | | | | | | Prepend nft_ prefix before these are exposed, reduce chances we hit symbol namespace pollution problems when mixing libnftables with other existing libraries. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Introduce getters and setters for everythingPhil Sutter2017-10-243-18/+117
| | | | | | | | | | | | | | | | | | | | | | | | | This introduces getter/setter pairs for all parts in struct nft_ctx (and contained structs) which should be configurable. Most of them are simple ones, just allowing to get/set a given field: * nft_ctx_{get,set}_dry_run() -> ctx->check * nft_ctx_output_{get,set}_numeric() -> ctx->output.numeric * nft_ctx_output_{get,set}_stateless() -> ctx->output.stateless * nft_ctx_output_{get,set}_ip2name() -> ctx->output.ip2name * nft_ctx_output_{get,set}_debug() -> ctx->debug_mask * nft_ctx_output_{get,set}_handle() -> ctx->output.handle * nft_ctx_output_{get,set}_echo() -> ctx->output.echo A more complicated case is include paths handling: In order to keep the API simple, remove INCLUDE_PATHS_MAX restraint and dynamically allocate nft_ctx field include_paths instead. So there is: * nft_ctx_add_include_path() -> add an include path to the list * nft_ctx_clear_include_paths() -> flush the list of include paths Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>