summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Export libnftables (again)Phil Sutter2018-03-212-3/+2
| | | | | | | | | | | | | | This reverts commits d572d59788143945c2a638f12a5227d9b21ce489 and 9f5e49e147219cd161de8cd80cadf8a444969ef0. Current libnftables API should be stable enough to release it into the public, and after 4aba100e593f ("rule: reset cache iff there is an existing cache") we have a simple way to batch commands through this API. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Make parsing a little more robustPhil Sutter2018-03-202-1/+7
| | | | | | | | | | It was surprisingly easy to crash nft with invalid syntax in 'add flowtable' command. Catch at least three possible ways (illustrated in provided test case) by making evaluation phase survive so that bison gets a chance to complain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Support 'nft -f -' to read from stdinPhil Sutter2018-03-201-0/+3
| | | | | | | | | | | | | | | | | | In libnftables, detect if given filename is '-' and treat it as the common way of requesting to read from stdin, then open /dev/stdin instead. (Calling 'nft -f /dev/stdin' worked before as well, but this makes it official.) With this in place and bash's support for here strings, review all tests in tests/shell for needless use of temp files. Note that two categories of test cases were intentionally left unchanged: - Tests creating potentially large rulesets to avoid running into shell parameter length limits. - Tests for 'include' directive for obvious reasons. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: reset cache iff there is an existing cachePablo Neira Ayuso2018-03-191-1/+3
| | | | | | | | | | | | | | If genid is unset, then do not reset existing cache. In the kernel, generation ID is assumed to be always != zero. This patch fixes: nft 'add table x; add chain x y;' that allow us to send several commands in one single batch from the command line. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Combine redir and masq statements into natPhil Sutter2018-03-175-240/+79
| | | | | | | | | | | | | | | | | | | All these statements are very similar, handling them with the same code is obvious. The only thing required here is a custom extension of enum nft_nat_types which is used in nat_stmt to distinguish between snat and dnat already. Though since enum nft_nat_types is part of kernel uAPI, create a local extended version containing the additional fields. Note that nat statement printing got a bit more complicated to get the number of spaces right for every possible combination of attributes. Note also that there wasn't a case for STMT_MASQ in rule_parse_postprocess(), which seems like a bug. Since STMT_MASQ became just a variant of STMT_NAT, postprocessing will take place for it now anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: evaluate: add preliminary binop transfer support for vmapsFlorian Westphal2018-03-171-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | nftables doesn't support vmap with bit-sized headers, such as flow label or dscp: nft add rule ip filter input ip dscp vmap \{ 4 : accept, 63 : continue \} BUG: invalid binary operation 5 Unlike plain "ip dscp { 4, 63 }", we don't have a relational operation in case of vmap. Binop fixups need to be done when evaluating map statements. This patch is incomplete. 'ip dscp' works, but this won't: nft add rule --debug=netlink ip6 test-ip6 input ip6 dscp vmap { 0x04 : accept, 0x3f : continue } The generated expressions look sane, however there is disagreement on the sets key size vs. the sizes of the individual elements in the set. This is because ip6 dscp spans a byte boundary. Key set size is still set to one byte (dscp type is 6bits). However, binop expansion requirements result in 2 byte loads, i.e. set members will be 2 bytes in size as well. This can hopefully get addressed in an incremental patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: handle binop adjustment recursivelyFlorian Westphal2018-03-171-21/+32
| | | | | | | | | | | | | | | currently this is fine, but a followup commit will add EXPR_SET_ELEM handling. And unlike RANGE we cannot assume the key is a value. Therefore make binop_can_transfer and binop_transfer_one handle right hand recursively if needed. For RANGE, call it again with from/to. For future SET_ELEM, we can then just call the function recursively again with right->key as new RHS. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: segtree: use value expression lengthFlorian Westphal2018-03-171-1/+1
| | | | | | | | | | In case of EXPR_MAPPING, expr->len is 0, we need to use the length of the key instead. Without this we can get assertion failure later on: nft: netlink_delinearize.c:1484: binop_adjust_one: Assertion `value->len >= binop->right->len' failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: netlink_delinearize: don't assume element contains a valueFlorian Westphal2018-03-171-1/+1
| | | | | | | | | | | We cannot assume i->key->key is EXPR_VALUE, we could look e.g. at a range, which will trigger an assertion failure in binop_adjust_one(). We should call __binop_adjust recursively again in the EXPR_SET_ELEM case, using key as new input. Fixes: b8b8e7b6ae10 ("evaluate: transfer right shifts to set reference side") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: fix routing header supportFlorian Westphal2018-03-171-22/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can't use nft_exthdr_op to encode routing header, it breaks ipv6 extension header support. When encountering RT header, userspace did now set a new ipv6 exthdr mode, but old kernel doesn't know about this, so this failed with -EOPNOTSUPP. Revert that part and use NFT_EXTHDR_OP_IPV6. When decoding a routing extension header, try the various route types until we find a match. Note this patch isn't complete: 'srh tag 127' creates following expressions: [ exthdr load 2b @ 43 + 6 => reg 1 ] [ cmp eq reg 1 0x00007f00 ] It should instead insert a dependency test ("rt type 4"): [ exthdr load 1b @ 43 + 2 => reg 1 ] [ cmp eq reg 1 0x00000004 ] [ exthdr load 2b @ 43 + 6 => reg 1 ] [ cmp eq reg 1 0x00007e00 ] nft should then use this to infer the routing header type. While add it, document the srh option. Fixes: 1400288f6d39d ("src: handle rt0 and rt2 properly") Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Ahmed Abdelsalam <amsalam20@gmail.com>
* src: revisit syntax to update sets and maps from packet pathPablo Neira Ayuso2018-03-162-7/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For sets, we allow this: nft add rule x y ip protocol tcp update @y { ip saddr} For maps: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; update @persistencia \ { @nh,96,32 : numgen inc mod 2 offset 100 } } } nft --debug=netlink add rule ip nftlb pre add @persistencia \ { ip saddr : numgen inc mod 2 offset 100 } More compact and it doesn't gets it confused with a simple map update command (interesting that bison didn't spew any conflict error). Former syntax for sets is preserved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fold netlink_gen_cmp() into netlink_gen_relational()Phil Sutter2018-03-161-65/+53
| | | | | | | | | Since netlink_gen_relational() didn't do much anymore after meta OP treating had been removed, it makes sense to merge it with the only function it dispached to. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* relational: Eliminate meta OPsPhil Sutter2018-03-166-125/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With a bit of code reorganization, relational meta OPs OP_RANGE, OP_FLAGCMP and OP_LOOKUP become unused and can be removed. The only meta OP left is OP_IMPLICIT which is usually treated as alias to OP_EQ. Though it needs to stay in place for one reason: When matching against a bitmask (e.g. TCP flags or conntrack states), it has a different meaning: | nft --debug=netlink add rule ip t c tcp flags syn | ip t c | [ meta load l4proto => reg 1 ] | [ cmp eq reg 1 0x00000006 ] | [ payload load 1b @ transport header + 13 => reg 1 ] | [ bitwise reg 1 = (reg=1 & 0x00000002 ) ^ 0x00000000 ] | [ cmp neq reg 1 0x00000000 ] | nft --debug=netlink add rule ip t c tcp flags == syn | ip t c | [ meta load l4proto => reg 1 ] | [ cmp eq reg 1 0x00000006 ] | [ payload load 1b @ transport header + 13 => reg 1 ] | [ cmp eq reg 1 0x00000002 ] OP_IMPLICIT creates a match which just checks the given flag is present, while OP_EQ creates a match which ensures the given flag and no other is present. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "src: update dynamic set updates from packet path syntax"Pablo Neira Ayuso2018-03-162-9/+2
| | | | | This reverts commit 9047cc7ae746b1c9abd4e11ed476e37d8716d400, this is breaking tests.
* src: update dynamic set updates from packet path syntaxPablo Neira Ayuso2018-03-152-2/+9
| | | | | | | | | | | | | | | | | | | New prefered syntax is: {add,update} set { key } @name # nft list ruleset table ip x { set y { type ipv4_addr } chain y { ip protocol tcp add set { ip saddr} @y } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support of dynamic map addition and update of elementsLaura Garcia Liebana2018-03-155-2/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The support of dynamic adds and updates are only available for sets and meters. This patch gives such abilities to maps as well. This patch is useful in cases where dynamic population of maps are required, for example, to maintain a persistence during some period of time. Example: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; map update \ { @nh,96,32 : numgen inc mod 2 offset 100 } @persistencia } } An example of the netlink generated sequence: nft --debug=netlink add rule ip nftlb pre map add \ { ip saddr : numgen inc mod 2 offset 100 } @persistencia ip nftlb pre [ payload load 4b @ network header + 12 => reg 1 ] [ numgen reg 2 = inc mod 2 offset 100 ] [ dynset add reg_key 1 set persistencia sreg_data 2 ] Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use nftnl_flowtable_get/setFlorian Westphal2018-03-121-4/+4
| | | | | | | the '_array' variant is just a wrapper for get/set api; this allows the array variant to be removed from libnftnl. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Adding support for segment routing header 'srh'Ahmed Abdelsalam2018-03-113-3/+50
| | | | | | | | | | | | | | Segment Routing Header "SRH" is new type of IPv6 Routing extension header (type 4). SRH contains a list of segments (each is represented as an IPv6 address) to be visited by packets during the journey from source to destination. The SRH specification are defined in the below IETF SRH draft. https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: handle rt0 and rt2 properlyAhmed Abdelsalam2018-03-111-1/+22
| | | | | | | | | | | | | | | | | | | | | | | Type 0 and 2 of the IPv6 Routing extension header are not handled properly by exthdr_init_raw() in src/exthdr.c In order to fix the bug, we extended the "enum nft_exthdr_op" to differentiate between rt, rt0, and rt2. This patch should fix the bug. We tested the patch against the same configuration reported in the bug and the output is as shown below. table ip6 filter { chain input { type filter hook input priority 0; policy accept; rt0 addr[1] a::2 } } Fixes: Bugzilla #1219 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: print handle attribute in more clearer mannerHarsha Sharma2018-03-091-31/+32
| | | | | | | | | | | Print handles in this way: table ip filter { # handle 2 } Similarly, for chain, set and object handles Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't not dump set content from netlink_get_setelems()Pablo Neira Ayuso2018-03-071-1/+0
| | | | | | | This causes python tests to report payload mismatching errors. Fixes: a43cc8d53096 ("src: support for get element command") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unused batch support checksPablo Neira Ayuso2018-03-073-74/+0
| | | | | | Follow up after cc8c5fd02448 ("netlink: remove non-batching routine"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move monitor code to src/monitor.cPablo Neira Ayuso2018-03-073-919/+961
| | | | | | | | netlink.c is rather large file, move the monitor code to its own file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* src: support for get element commandPablo Neira Ayuso2018-03-077-7/+313
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | You need a Linux kernel >= 4.15 to use this feature. This patch allows us to dump the content of an existing set. # nft list ruleset table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 3.3.3.3, 5.5.5.5-6.6.6.6 } } } You check if a single element exists in the set: # nft get element x x { 1.1.1.5 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } Output means '1.1.1.5' belongs to the '1.1.1.1-2.2.2.2' interval. You can also check for intervals: # nft get element x x { 1.1.1.1-2.2.2.2 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } If you try to check for an element that doesn't exist, an error is displayed. # nft get element x x { 1.1.1.0 } Error: Could not receive set elements: No such file or directory get element x x { 1.1.1.0 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ You can also check for multiple elements in one go: # nft get element x x { 1.1.1.5, 5.5.5.10 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 5.5.5.5-6.6.6.6 } } } You can also use this to fetch the existing timeout for specific elements, in case you have a set with timeouts in place: # nft get element w z { 2.2.2.2 } table ip w { set z { type ipv4_addr timeout 30s elements = { 2.2.2.2 expires 17s } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: broken handle listing of table and named objectsPablo Neira Ayuso2018-03-051-3/+8
| | | | | | | | | | | | Now listing looks good: table ip test-ip { counter https-traffic { packets 0 bytes 0 } # handle 1 } # handle 847 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: extend nft to list object handle and delete objects via handleHarsha Sharma2018-03-052-2/+27
| | | | | | | | | | | Print handle attributes in objects when listing via '-a' option and delete objects via their unique object handles. For e.g. nft delete [<object-type>] [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: print object handle with --echo --handlePablo Neira Ayuso2018-03-051-0/+3
| | | | | | | # nft --echo --handle add counter x y add counter ip x y { packets 0 bytes 0 } # handle 0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: print table handle with --echo --handlePablo Neira Ayuso2018-03-051-1/+6
| | | | | | | # nft --echo --handle add table x add table ip x # handle 80 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: print chain handle with --echo --handlePablo Neira Ayuso2018-03-051-0/+2
| | | | | | | # nft add --echo --handle chain x y add chain ip x y # handle 1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: list set handle and delete set via set handleHarsha Sharma2018-03-053-3/+23
| | | | | | | | | | | Print 'handle' attribute in sets when listing via '-a' option and delete sets via their unique set handles listed with '-a' option. For e.g. nft delete set [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: delete chain via chain handleHarsha Sharma2018-03-051-2/+14
| | | | | | | | | | | This patch allows deletion of chains via unique chain handles which can be listed with '-a' option and table name and family. For eg. nft delete chain [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Print handle attribute in chainsHarsha Sharma2018-03-051-1/+4
| | | | | | | Print handle attribute in chains when listing via '-a' option. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: delete table via table handleHarsha Sharma2018-03-051-2/+15
| | | | | | | | | | This patch allows deletion of table via unique table handles and table family which can be listed with '-a' option. For.eg. nft delete table [<family>] [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: print 'handle' attribute in tablesHarsha Sharma2018-03-052-1/+7
| | | | | | | | | | | | | | | | | | | | | | | Print 'handle' attribute in tables, when listing via '-a' option For eg. nft list ruleset -a table ip test-ip4 { chain input { ip saddr 8.8.8.8 counter packets 0 bytes 0 # handle 3 } # handle 1} table ip filter { chain output { tcp dport ssh counter packets 0 bytes 0 # handle 4 } # handle 2} table ip xyz { # handle 3} Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: flow offload supportPablo Neira Ayuso2018-03-056-0/+54
| | | | | | | | | | | | This patch allows us to refer to existing flowtables: # nft add rule x x flow offload @m Packets matching this rule create an entry in the flow table 'm', hence, follow up packets that get to the flowtable at ingress bypass the classic forwarding path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: delete flowtablePablo Neira Ayuso2018-03-055-0/+42
| | | | | | | | This patch allows you to delete an existing flowtable: # nft delete flowtable x m Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support to add flowtablesPablo Neira Ayuso2018-03-057-7/+228
| | | | | | | | | | | | | | | | | This patch allows you to create flowtable: # nft add table x # nft add flowtable x m { hook ingress priority 10\; devices = { eth0, wlan0 }\; } You have to specify hook and priority. So far, only the ingress hook is supported. The priority represents where this flowtable is placed in the ingress hook, which is registered to the devices that the user specifies. You can also use the 'create' command instead to bail out in case that there is an existing flowtable with this name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for flowtable listingPablo Neira Ayuso2018-03-056-0/+254
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to dump existing flowtable. # nft list ruleset table ip x { flowtable x { hook ingress priority 10 devices = { eth0, tap0 } } } You can also list existing flowtables via: # nft list flowtables table ip x { flowtable x { hook ingress priority 10 devices = { eth0, tap0 } } } You need a Linux kernel >= 4.16-rc to test this new feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add variable expression and use it to allow redefinitionsPablo Neira Ayuso2018-03-044-20/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new variable expression that we can use to attach symbols in runtime, this allows us to redefine variables via new keyword, eg. table ip x { chain y { define address = { 1.1.1.1, 2.2.2.2 } ip saddr $address redefine address = { 3.3.3.3 } ip saddr $address } } # nft list ruleset table ip x { chain y { ip saddr { 1.1.1.1, 2.2.2.2 } ip saddr { 3.3.3.3 } } } Note that redefinition just places a new symbol version before the existing one, so symbol lookups always find the latest version. The undefine keyword decrements the reference counter and removes the symbol from the list, so it cannot be used anymore. Still, previous references to this symbol via variable expression are still valid. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: datatype: prefer sscanf, avoid strncpyFlorian Westphal2018-03-031-11/+10
| | | | | | similar to previous patch, but replace strncpy+atoi by sscanf. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Use snprintf() over strncpy()Harsha Sharma2018-03-032-4/+4
| | | | | | | Use snprintf() over strncpy() functions as the buffer is not null terminated in strncpy(). Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
* netlink: remove non-batching routinesPablo Neira Ayuso2018-03-032-319/+36
| | | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: misc updatesPablo Neira Ayuso2018-03-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the following macros: * AC_PREREQ checks for 2.61, which is not supported any contemporary distribution. * AC_COPYRIGHT, autoconf documentation states "in addition to the Free Software Foundation's copyright on the Autoconf macros, parts of your configure are covered by the copyright-notice.". This only refers to the autoconf infrastructure: we are doing simple and standard usage of autoconf infrastructure, we also don't use this macro in other existing userspace software available at netfilter.org. The comment above at the beginning of this file shows text that is available in many configure.ac templates on the Internet. * AC_CANONICAL_HOST, we don't need the canonical host-system type to build this software. * AC_CONFIG_SRCDIR is not used in other userspace software in the tree. * AC_DEFINE _GNU_SOURCE, define this where it's needed instead. * AC_DEFINE _STDC_FORMAT_MACROS is not used in this codebase. * AC_HEADER_STDC checks for ANSI C89 headers, however, we need more than just this C standard, so this doesn't guarantee anything at all. * Remove "Checks for libraries" comment, it's obvious. * AC_HEADER_ASSERT allows us to disable assertions, this is bad because this is helping us to diagnose bugs and incomplete features. * AC_CHECK_HEADERS is checking for an arbitrary list of headers, this still doesn't even guarantee that we can actually do a successful compilation in a broken system. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: use nf_key_protoFlorian Westphal2018-03-031-9/+7
| | | | | | Consolidate into one so it can be reused by new users. Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: don't crash when no commands are specifiedHarsha Sharma2018-03-031-0/+3
| | | | | | | | For e.g. nft -c " " Without this patch it segfaults. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: support of maps with timeoutLaura Garcia Liebana2018-03-021-0/+5
| | | | | | | | | | | | | | | | | | | | | Support of key and value association with a certain timeout. Example: nft add map nftlb mapa { type inet_service: ipv4_addr\; timeout 5s\; } Results in: table ip nftlb { map mapa { type inet_service : ipv4_addr timeout 5s } } Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: Fix resource leaksPhil Sutter2018-03-021-52/+92
| | | | | | | | | | | | | | | | | | Most of the cases are basically the same: Error path fails to free the previously allocated statement or expression. A few cases received special treatment though: - In netlink_parse_payload_stmt(), the leak is easily avoided by code reordering. - In netlink_parse_exthdr(), there's no point in introducing a goto label since there is but a single affected error check. - In netlink_parse_hash() non-error path leaked as well if sreg contained a concatenated expression. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Complain if setting O_NONBLOCK failsPhil Sutter2018-03-021-1/+2
| | | | | | | | | Assuming that code is not aware that reads from netlink socket may block, treat inability to set O_NONBLOCK flag as fatal initialization error aborting program execution. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hash: Fix potential null-pointer dereference in hash_expr_cmp()Phil Sutter2018-03-021-1/+1
| | | | | | | | | | | | | | | | | The first part of the conditional: | (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr)) will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer dereference. This is probably a typo, the intention when introducing this was to avoid the call to expr_cmp() for symmetric hash expressions which don't use expr->hash.expr. Inverting the existence check should fix this. Fixes: 3a86406729782 ("src: hash: support of symmetric hash") Cc: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix memleak in stmt_reject_gen_dependency()Phil Sutter2018-03-021-3/+7
| | | | | | | | | | | | | | The allocated payload expression is not used after returning from that function, so it needs to be freed again. Simple test case: | nft add rule inet t c reject with tcp reset Valgrind reports definitely lost 144 bytes. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>