summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* src: fix routing header supportFlorian Westphal2018-03-171-22/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can't use nft_exthdr_op to encode routing header, it breaks ipv6 extension header support. When encountering RT header, userspace did now set a new ipv6 exthdr mode, but old kernel doesn't know about this, so this failed with -EOPNOTSUPP. Revert that part and use NFT_EXTHDR_OP_IPV6. When decoding a routing extension header, try the various route types until we find a match. Note this patch isn't complete: 'srh tag 127' creates following expressions: [ exthdr load 2b @ 43 + 6 => reg 1 ] [ cmp eq reg 1 0x00007f00 ] It should instead insert a dependency test ("rt type 4"): [ exthdr load 1b @ 43 + 2 => reg 1 ] [ cmp eq reg 1 0x00000004 ] [ exthdr load 2b @ 43 + 6 => reg 1 ] [ cmp eq reg 1 0x00007e00 ] nft should then use this to infer the routing header type. While add it, document the srh option. Fixes: 1400288f6d39d ("src: handle rt0 and rt2 properly") Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Ahmed Abdelsalam <amsalam20@gmail.com>
* src: revisit syntax to update sets and maps from packet pathPablo Neira Ayuso2018-03-162-7/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For sets, we allow this: nft add rule x y ip protocol tcp update @y { ip saddr} For maps: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; update @persistencia \ { @nh,96,32 : numgen inc mod 2 offset 100 } } } nft --debug=netlink add rule ip nftlb pre add @persistencia \ { ip saddr : numgen inc mod 2 offset 100 } More compact and it doesn't gets it confused with a simple map update command (interesting that bison didn't spew any conflict error). Former syntax for sets is preserved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fold netlink_gen_cmp() into netlink_gen_relational()Phil Sutter2018-03-161-65/+53
| | | | | | | | | Since netlink_gen_relational() didn't do much anymore after meta OP treating had been removed, it makes sense to merge it with the only function it dispached to. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* relational: Eliminate meta OPsPhil Sutter2018-03-166-125/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With a bit of code reorganization, relational meta OPs OP_RANGE, OP_FLAGCMP and OP_LOOKUP become unused and can be removed. The only meta OP left is OP_IMPLICIT which is usually treated as alias to OP_EQ. Though it needs to stay in place for one reason: When matching against a bitmask (e.g. TCP flags or conntrack states), it has a different meaning: | nft --debug=netlink add rule ip t c tcp flags syn | ip t c | [ meta load l4proto => reg 1 ] | [ cmp eq reg 1 0x00000006 ] | [ payload load 1b @ transport header + 13 => reg 1 ] | [ bitwise reg 1 = (reg=1 & 0x00000002 ) ^ 0x00000000 ] | [ cmp neq reg 1 0x00000000 ] | nft --debug=netlink add rule ip t c tcp flags == syn | ip t c | [ meta load l4proto => reg 1 ] | [ cmp eq reg 1 0x00000006 ] | [ payload load 1b @ transport header + 13 => reg 1 ] | [ cmp eq reg 1 0x00000002 ] OP_IMPLICIT creates a match which just checks the given flag is present, while OP_EQ creates a match which ensures the given flag and no other is present. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "src: update dynamic set updates from packet path syntax"Pablo Neira Ayuso2018-03-162-9/+2
| | | | | This reverts commit 9047cc7ae746b1c9abd4e11ed476e37d8716d400, this is breaking tests.
* src: update dynamic set updates from packet path syntaxPablo Neira Ayuso2018-03-152-2/+9
| | | | | | | | | | | | | | | | | | | New prefered syntax is: {add,update} set { key } @name # nft list ruleset table ip x { set y { type ipv4_addr } chain y { ip protocol tcp add set { ip saddr} @y } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support of dynamic map addition and update of elementsLaura Garcia Liebana2018-03-155-2/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The support of dynamic adds and updates are only available for sets and meters. This patch gives such abilities to maps as well. This patch is useful in cases where dynamic population of maps are required, for example, to maintain a persistence during some period of time. Example: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; map update \ { @nh,96,32 : numgen inc mod 2 offset 100 } @persistencia } } An example of the netlink generated sequence: nft --debug=netlink add rule ip nftlb pre map add \ { ip saddr : numgen inc mod 2 offset 100 } @persistencia ip nftlb pre [ payload load 4b @ network header + 12 => reg 1 ] [ numgen reg 2 = inc mod 2 offset 100 ] [ dynset add reg_key 1 set persistencia sreg_data 2 ] Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use nftnl_flowtable_get/setFlorian Westphal2018-03-121-4/+4
| | | | | | | the '_array' variant is just a wrapper for get/set api; this allows the array variant to be removed from libnftnl. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Adding support for segment routing header 'srh'Ahmed Abdelsalam2018-03-113-3/+50
| | | | | | | | | | | | | | Segment Routing Header "SRH" is new type of IPv6 Routing extension header (type 4). SRH contains a list of segments (each is represented as an IPv6 address) to be visited by packets during the journey from source to destination. The SRH specification are defined in the below IETF SRH draft. https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: handle rt0 and rt2 properlyAhmed Abdelsalam2018-03-111-1/+22
| | | | | | | | | | | | | | | | | | | | | | | Type 0 and 2 of the IPv6 Routing extension header are not handled properly by exthdr_init_raw() in src/exthdr.c In order to fix the bug, we extended the "enum nft_exthdr_op" to differentiate between rt, rt0, and rt2. This patch should fix the bug. We tested the patch against the same configuration reported in the bug and the output is as shown below. table ip6 filter { chain input { type filter hook input priority 0; policy accept; rt0 addr[1] a::2 } } Fixes: Bugzilla #1219 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: print handle attribute in more clearer mannerHarsha Sharma2018-03-091-31/+32
| | | | | | | | | | | Print handles in this way: table ip filter { # handle 2 } Similarly, for chain, set and object handles Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't not dump set content from netlink_get_setelems()Pablo Neira Ayuso2018-03-071-1/+0
| | | | | | | This causes python tests to report payload mismatching errors. Fixes: a43cc8d53096 ("src: support for get element command") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unused batch support checksPablo Neira Ayuso2018-03-073-74/+0
| | | | | | Follow up after cc8c5fd02448 ("netlink: remove non-batching routine"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move monitor code to src/monitor.cPablo Neira Ayuso2018-03-073-919/+961
| | | | | | | | netlink.c is rather large file, move the monitor code to its own file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* src: support for get element commandPablo Neira Ayuso2018-03-077-7/+313
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | You need a Linux kernel >= 4.15 to use this feature. This patch allows us to dump the content of an existing set. # nft list ruleset table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 3.3.3.3, 5.5.5.5-6.6.6.6 } } } You check if a single element exists in the set: # nft get element x x { 1.1.1.5 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } Output means '1.1.1.5' belongs to the '1.1.1.1-2.2.2.2' interval. You can also check for intervals: # nft get element x x { 1.1.1.1-2.2.2.2 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } If you try to check for an element that doesn't exist, an error is displayed. # nft get element x x { 1.1.1.0 } Error: Could not receive set elements: No such file or directory get element x x { 1.1.1.0 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ You can also check for multiple elements in one go: # nft get element x x { 1.1.1.5, 5.5.5.10 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 5.5.5.5-6.6.6.6 } } } You can also use this to fetch the existing timeout for specific elements, in case you have a set with timeouts in place: # nft get element w z { 2.2.2.2 } table ip w { set z { type ipv4_addr timeout 30s elements = { 2.2.2.2 expires 17s } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: broken handle listing of table and named objectsPablo Neira Ayuso2018-03-051-3/+8
| | | | | | | | | | | | Now listing looks good: table ip test-ip { counter https-traffic { packets 0 bytes 0 } # handle 1 } # handle 847 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: extend nft to list object handle and delete objects via handleHarsha Sharma2018-03-052-2/+27
| | | | | | | | | | | Print handle attributes in objects when listing via '-a' option and delete objects via their unique object handles. For e.g. nft delete [<object-type>] [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: print object handle with --echo --handlePablo Neira Ayuso2018-03-051-0/+3
| | | | | | | # nft --echo --handle add counter x y add counter ip x y { packets 0 bytes 0 } # handle 0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: print table handle with --echo --handlePablo Neira Ayuso2018-03-051-1/+6
| | | | | | | # nft --echo --handle add table x add table ip x # handle 80 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: print chain handle with --echo --handlePablo Neira Ayuso2018-03-051-0/+2
| | | | | | | # nft add --echo --handle chain x y add chain ip x y # handle 1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: list set handle and delete set via set handleHarsha Sharma2018-03-053-3/+23
| | | | | | | | | | | Print 'handle' attribute in sets when listing via '-a' option and delete sets via their unique set handles listed with '-a' option. For e.g. nft delete set [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: delete chain via chain handleHarsha Sharma2018-03-051-2/+14
| | | | | | | | | | | This patch allows deletion of chains via unique chain handles which can be listed with '-a' option and table name and family. For eg. nft delete chain [<family>] <table-name> [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Print handle attribute in chainsHarsha Sharma2018-03-051-1/+4
| | | | | | | Print handle attribute in chains when listing via '-a' option. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: delete table via table handleHarsha Sharma2018-03-051-2/+15
| | | | | | | | | | This patch allows deletion of table via unique table handles and table family which can be listed with '-a' option. For.eg. nft delete table [<family>] [handle <handle>] Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: print 'handle' attribute in tablesHarsha Sharma2018-03-052-1/+7
| | | | | | | | | | | | | | | | | | | | | | | Print 'handle' attribute in tables, when listing via '-a' option For eg. nft list ruleset -a table ip test-ip4 { chain input { ip saddr 8.8.8.8 counter packets 0 bytes 0 # handle 3 } # handle 1} table ip filter { chain output { tcp dport ssh counter packets 0 bytes 0 # handle 4 } # handle 2} table ip xyz { # handle 3} Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: flow offload supportPablo Neira Ayuso2018-03-056-0/+54
| | | | | | | | | | | | This patch allows us to refer to existing flowtables: # nft add rule x x flow offload @m Packets matching this rule create an entry in the flow table 'm', hence, follow up packets that get to the flowtable at ingress bypass the classic forwarding path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: delete flowtablePablo Neira Ayuso2018-03-055-0/+42
| | | | | | | | This patch allows you to delete an existing flowtable: # nft delete flowtable x m Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support to add flowtablesPablo Neira Ayuso2018-03-057-7/+228
| | | | | | | | | | | | | | | | | This patch allows you to create flowtable: # nft add table x # nft add flowtable x m { hook ingress priority 10\; devices = { eth0, wlan0 }\; } You have to specify hook and priority. So far, only the ingress hook is supported. The priority represents where this flowtable is placed in the ingress hook, which is registered to the devices that the user specifies. You can also use the 'create' command instead to bail out in case that there is an existing flowtable with this name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for flowtable listingPablo Neira Ayuso2018-03-056-0/+254
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to dump existing flowtable. # nft list ruleset table ip x { flowtable x { hook ingress priority 10 devices = { eth0, tap0 } } } You can also list existing flowtables via: # nft list flowtables table ip x { flowtable x { hook ingress priority 10 devices = { eth0, tap0 } } } You need a Linux kernel >= 4.16-rc to test this new feature. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add variable expression and use it to allow redefinitionsPablo Neira Ayuso2018-03-044-20/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add new variable expression that we can use to attach symbols in runtime, this allows us to redefine variables via new keyword, eg. table ip x { chain y { define address = { 1.1.1.1, 2.2.2.2 } ip saddr $address redefine address = { 3.3.3.3 } ip saddr $address } } # nft list ruleset table ip x { chain y { ip saddr { 1.1.1.1, 2.2.2.2 } ip saddr { 3.3.3.3 } } } Note that redefinition just places a new symbol version before the existing one, so symbol lookups always find the latest version. The undefine keyword decrements the reference counter and removes the symbol from the list, so it cannot be used anymore. Still, previous references to this symbol via variable expression are still valid. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: datatype: prefer sscanf, avoid strncpyFlorian Westphal2018-03-031-11/+10
| | | | | | similar to previous patch, but replace strncpy+atoi by sscanf. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Use snprintf() over strncpy()Harsha Sharma2018-03-032-4/+4
| | | | | | | Use snprintf() over strncpy() functions as the buffer is not null terminated in strncpy(). Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com>
* netlink: remove non-batching routinesPablo Neira Ayuso2018-03-032-319/+36
| | | | | | | | This is only needed by 3.16, which was released 8 months after nftables was merged upstream. That kernel version supports a reduced featureset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* configure: misc updatesPablo Neira Ayuso2018-03-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch removes the following macros: * AC_PREREQ checks for 2.61, which is not supported any contemporary distribution. * AC_COPYRIGHT, autoconf documentation states "in addition to the Free Software Foundation's copyright on the Autoconf macros, parts of your configure are covered by the copyright-notice.". This only refers to the autoconf infrastructure: we are doing simple and standard usage of autoconf infrastructure, we also don't use this macro in other existing userspace software available at netfilter.org. The comment above at the beginning of this file shows text that is available in many configure.ac templates on the Internet. * AC_CANONICAL_HOST, we don't need the canonical host-system type to build this software. * AC_CONFIG_SRCDIR is not used in other userspace software in the tree. * AC_DEFINE _GNU_SOURCE, define this where it's needed instead. * AC_DEFINE _STDC_FORMAT_MACROS is not used in this codebase. * AC_HEADER_STDC checks for ANSI C89 headers, however, we need more than just this C standard, so this doesn't guarantee anything at all. * Remove "Checks for libraries" comment, it's obvious. * AC_HEADER_ASSERT allows us to disable assertions, this is bad because this is helping us to diagnose bugs and incomplete features. * AC_CHECK_HEADERS is checking for an arbitrary list of headers, this still doesn't even guarantee that we can actually do a successful compilation in a broken system. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: use nf_key_protoFlorian Westphal2018-03-031-9/+7
| | | | | | Consolidate into one so it can be reused by new users. Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: don't crash when no commands are specifiedHarsha Sharma2018-03-031-0/+3
| | | | | | | | For e.g. nft -c " " Without this patch it segfaults. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: support of maps with timeoutLaura Garcia Liebana2018-03-021-0/+5
| | | | | | | | | | | | | | | | | | | | | Support of key and value association with a certain timeout. Example: nft add map nftlb mapa { type inet_service: ipv4_addr\; timeout 5s\; } Results in: table ip nftlb { map mapa { type inet_service : ipv4_addr timeout 5s } } Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: Fix resource leaksPhil Sutter2018-03-021-52/+92
| | | | | | | | | | | | | | | | | | Most of the cases are basically the same: Error path fails to free the previously allocated statement or expression. A few cases received special treatment though: - In netlink_parse_payload_stmt(), the leak is easily avoided by code reordering. - In netlink_parse_exthdr(), there's no point in introducing a goto label since there is but a single affected error check. - In netlink_parse_hash() non-error path leaked as well if sreg contained a concatenated expression. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Complain if setting O_NONBLOCK failsPhil Sutter2018-03-021-1/+2
| | | | | | | | | Assuming that code is not aware that reads from netlink socket may block, treat inability to set O_NONBLOCK flag as fatal initialization error aborting program execution. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hash: Fix potential null-pointer dereference in hash_expr_cmp()Phil Sutter2018-03-021-1/+1
| | | | | | | | | | | | | | | | | The first part of the conditional: | (e1->hash.expr || expr_cmp(e1->hash.expr, e2->hash.expr)) will call expr_cmp() in case e1->hash.expr is NULL, causing null-pointer dereference. This is probably a typo, the intention when introducing this was to avoid the call to expr_cmp() for symmetric hash expressions which don't use expr->hash.expr. Inverting the existence check should fix this. Fixes: 3a86406729782 ("src: hash: support of symmetric hash") Cc: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix memleak in stmt_reject_gen_dependency()Phil Sutter2018-03-021-3/+7
| | | | | | | | | | | | | | The allocated payload expression is not used after returning from that function, so it needs to be freed again. Simple test case: | nft add rule inet t c reject with tcp reset Valgrind reports definitely lost 144 bytes. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec: Avoid passing negative offset to fseek()Phil Sutter2018-03-021-5/+5
| | | | | | | | If the initial call to ftell() fails, variable orig_offset is set to -1. Avoid passing this to fseek() later on. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: Drop pointless check in cli_append_multiline()Phil Sutter2018-03-021-10/+2
| | | | | | | | | | | | | The function is called from cli_complete after it has checked for line to be != NULL. The other part of the conditional, namely multiline being NULL, is perfectly valid (if the last read line didn't end with backslash. Hence drop the conditional completely. Since variable eof is not used anywhere outside of the dropped conditional, get rid of it completely. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make JSON/XML output respect output_fpPhil Sutter2018-02-281-19/+18
| | | | | | | | | | | | Make sure events callbacks print to output_ctx-defined stream for any type of output format. Since all of them use nft_print() as last call (if anything is printed at all), the final call to fflush() in netlink_events_cb() can be dropped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Make trace events respect output_fpPhil Sutter2018-02-281-17/+21
| | | | | | | | Seems like this was incompletely converted, part of the output went to output_fp already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Review switch statements for unmarked fall through casesPhil Sutter2018-02-285-4/+7
| | | | | | | | | | | | | | While revisiting all of them, clear a few oddities as well: - There's no point in marking empty fall through cases: They are easy to spot and a common concept when using switch(). - Fix indenting of break statement in one occasion. - Drop needless braces around one case which doesn't declare variables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Added undefine/redefine keywordsDavid Fabian2018-02-263-0/+39
| | | | | | | | | | | | | | | | | This is a small patch to nft which adds two new keywords - undefine and redefine. undefine simply undefines a variable from the current scope. redefine allows one to change a variable definition. We have a firewall written in bash (using iptables) that is organized by customer VLANs. Each VLAN has its own set of bash variables holding things like uplink iface names, gateway IPs, etc. We want to rewrite the firewall to nftables but are stuck on the fact that nft variables cannot be overridden in the same scope. We have each VLAN configuration in a separate file containing pre/post-routing, input, output and forward rules,and we include those files to a master firewall configuration. One solution is to rename all the variables with some VLAN specific (pre/su)ffix. But that is cumbersome. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make raw payloads workFlorian Westphal2018-02-263-1/+7
| | | | | | | | | | | | | | | | | | | | make syntax consistent between print and parse. No dependency handling -- once you use raw expression, you need to make sure the raw expression only sees the packets that you'd want it to see. based on an earlier patch from Laurent Fasnacht <l@libres.ch>. Laurents patch added a different syntax: @<protocol>,<base>,<data type>,<offset>,<length> data_type is useful to make nftables not err when asking for "@payload,32,32 192.168.0.1", this patch still requires manual convsersion to an integer type (hex or decimal notation). data_type should probably be added later by adding an explicit cast expression, independent of the raw payload syntax. Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't resolve expressions using the inet pseudoheaderFlorian Westphal2018-02-261-1/+1
| | | | | | | Else, '@ll,0,8' will be mapped to 'inet nfproto', but thats not correct (inet is a pseudo header). Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: use integer_type when initializing a raw expressionFlorian Westphal2018-02-261-0/+1
| | | | | | | The invalid type prints prominent "[invalid]", so prefer integer type in raw expressions. Signed-off-by: Florian Westphal <fw@strlen.de>