summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* proto: add debugging for protocol context updatesPatrick McHardy2014-01-082-1/+29
| | | | | | | | | | | | | | | | | | Add a new debugging level to debug updates to the protocol context. Sample output: <cmdline>:1:15-23: Evaluate filter output tcp dport ssh ^^^^^^^^^ tcp update transport layer protocol context: link layer : none network layer : ip transport layer : tcp <- Signed-off-by: Patrick McHardy <kaber@trash.net>
* proto: add helper function to update protocol contextPatrick McHardy2014-01-083-4/+18
| | | | | | Add a helper function which is to be used to update the protocol update. Signed-off-by: Patrick McHardy <ksber@trash.net<
* expr: add protocol context update callbackPatrick McHardy2014-01-084-38/+47
| | | | | | | | | | Add a callback function to the expression ops to update the protocol context for relational protocol expressions (EXPR_F_PROTOCOL). Also set the EXPR_F_PROTOCOL flag for IIFTYPE meta expressions to make sure the callback is invoked when necessary. Signed-off-by: Patrick McHardy <kaber@trash.net>
* nftables: generic procotol contextsPatrick McHardy2014-01-088-815/+839
| | | | | | | | | | | | | | | Currently the context of higher layer protocols is specific to payload expressions with some special cases for meta IIFTYPE expressions. This approach has a few shortcomings, concretely there are more expression types which define upper layer protocols like the ct expression and two upcoming new types for the meta expression. Replace the payload context by a generic protocol context to deal with this. This patch just splits off the requires parts from the payload expression without any functional changes, the following patches will add further functionality for other expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: replace PAYLOAD_PROTOCOL_EXPR by generic flagPatrick McHardy2014-01-082-5/+6
| | | | | | | Introduce a generic flag to indicate that an expression describes the upper layer protocol as replacement for the payload specific flag. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add support for queueEric Leblond2014-01-046-6/+139
| | | | | | | | | | | This patch adds support for the queue target. It is now possible to specify rule sending packet to a given queue and using load balancing: nft add rule filter output queue num 3 total 2 options fanout Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add support to set meta keysPablo Neira Ayuso2013-12-282-3/+36
| | | | | | | | | | | | | | | | | | | | Arturo Borrero added kernel support to set meta keys in http://patchwork.ozlabs.org/patch/305281/ and the corresponding library support in http://patchwork.ozlabs.org/patch/305283/. This patch enhances nft to use this new kernel feature. The following example shows how to set the packet mark. % nft add rule ip filter input meta mark set 22 % nft list table filter table ip filter { chain input { type filter hook input priority 0; meta mark set 0x00000016 } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix dictionary feature with data mappingsPablo Neira Ayuso2013-12-281-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | This patch fixes dictionary feature, that allows you to conditionally set packet fields based on a given selector, eg. add rule ip filter input meta dnat set tcp dport map { 22 => 1.1.1.1, 23 => 2.2.2.2 } This means that traffic flowing to tcp port 22 is dnatted to address 1.1.1.1 and tcp port 23 is dnatted to address 2.2.2.2. This feature was partially broken by aae836a ("src: use libnftables") although it also needs the kernel fix ("netfilter: nf_tables: fix wrong datatype in nft_validate_data_load()"). This patch also fixes endianness issues when displaying the mark via `list table' related to list_setelem_cb() since the byteorder was left unset for the data part of a set element. meta mark set tcp dport map { telnet => 0x02000000, ssh => 0x01000000} ^ ^ Note the wrong endianness in the example above. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: print netlink message if if --debug=netlink in mnl_talk()Pablo Neira Ayuso2013-12-281-0/+5
| | | | | | Useful for debugging purposes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: don't set NLM_F_ACK flag in mnl_nft_rule_batch_[add|del]Pablo Neira Ayuso2013-12-071-2/+2
| | | | | | | | If the NLM_F_ACK flag is unset, the kernel still explicitly reports errors. Thus, we can save the handling of many explicit (useless) ack messages that indicate success. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix rule flushing atomicallyPablo Neira Ayuso2013-12-061-34/+1
| | | | | | | | | | | | nft is currently retrieving the list of rule from the kernel, then deleting each rule one by one. This is slow and not safe. Fix it by sending a deletion command in a batch without specifying the chain. This change requires the kernel fix entitled: netfilter: nf_tables: fix missing rules flushing per table Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix inconsistent name usage in nft_*_nlmsg_build_hdr callsArturo Borrero2013-12-041-22/+22
| | | | | | | Minor fix, given that all those functions are aliases. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add 'delete map' syntaxPhil Oester2013-11-301-0/+4
| | | | | | | | | | | | | | Creating a map is done via "add map". However, to delete a map requires using "delete set", which is confusing. Add the appropriate synonym to parser. The downside to this is that one can now delete a set with "delete map", but this seems a minor issue. It could of course be fixed by adding a new CMD_OBJ_MAP. This closes netfilter bugzilla #879. Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: missing set cleanup in do_command_listPhil Oester2013-11-301-0/+5
| | | | | | | | | | When listing a table in interactive mode, the set list is not cleaned up. Thus the number of displayed sets grows with each successive listing. Attached patch adds the necessary list cleanup to do_command_list. Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: segfault in top scope definePhil Oester2013-11-301-0/+1
| | | | | | | | | | | | | | nft segfaults if a symbol is added in top_scope, because of a missing init_list_head. Trivial example: define ip_set = {192.168.1.2, 192.168.2.3} add rule filter output ip daddr $ip_set counter This closes netfilter bugzilla #877. Reported-by: Anand Raj Manickam <anandrm@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: relax restriction on UID/GID parsingPablo Neira Ayuso2013-11-291-20/+34
| | | | | | | | | | nft is currently rejecting unknown UID/GID if they don't exist in the system, relax this as Bjørnar Ness considers this is a valid scenario. Now this only reports an error if you pass an unknown user (expressed as string or if the UID/GID goes above 32 bits). Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix endianness in UID/GIDPablo Neira Ayuso2013-11-291-2/+2
| | | | | | | | | | | add rule filter output meta skuid vmap { 1000 => accept } list table filter meta skuid map { 3892510720 => accept} ^--------^ this is 1000 in network byte order Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: improve rule deletion per chainPablo Neira Ayuso2013-11-251-1/+1
| | | | | | | | | | | | | | With this patch, nft asks the kernel for deleting all rules in a chain. This replaces the current behaviour that requires to dump all the rules, then iterate over that list to delete one by one, which is prone to races and slowier. After this patch, the following two commands are equivalent: nft flush chain filter input nft delete rule filter input Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix missing nul-terminated string in string_type_printPablo Neira Ayuso2013-11-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | Thomas Berger reported that he is seeing garbage after valid string values, eg. fwtest01 ~ # nft -i nft> table filter nft> add chain filter input nft> add rule filter input meta iifname "lo" accept nft> list table filter table ip filter { chain input { meta iifname "lo�.�" accept } ... The buffer that is allocated in the stack does not include room to nul-terminate the string accordingly. This patch fixes bugzilla report #872: https://bugzilla.netfilter.org/show_bug.cgi?id=872 Reported-by: Thomas Berger <loki@lokis-chaos.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: only display wanted chain in listingEric Leblond2013-11-191-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When specifying a chain to list, all created chains were displayed with a void content: # nft list chain filter table ip filter { chain input { } chain new { counter packets 17971 bytes 2380637 accept counter packets 0 bytes 0 accept } } With the attached patch, only the asked chain is displayed: # nft list chain filter table ip filter { chain new { counter packets 17971 bytes 2380637 accept # handle 36 counter packets 0 bytes 0 accept # handle 40 } } Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* verdict: fix delinearize in case of jumpEric Leblond2013-11-191-2/+6
| | | | | | | | | The name of the chain was not handled in case of a jump or a goto. This patch adds parsing of the chain. Reported-by: Alex Chapman <ajchapman88@hotmail.co.uk> Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* jump: fix logic in netlink linearizeEric Leblond2013-11-191-1/+2
| | | | | | | | | Logic in the test was inverted. The result was the jump string not to be set. Reported-by: Alex Chapman <ajchapman88@hotmail.co.uk> Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: fix indentEric Leblond2013-11-191-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: fix warning on deprecated directive in bisonPablo Neira Ayuso2013-11-181-1/+1
| | | | | | | | src/parser.y:93.1-13: warning: deprecated directive, use ‘%name-prefix’ [-Wdeprecated] %name-prefix="nft_" ^^^^^^^^^^^^^ Reported-by: Anatol Pomozov <anatol.pomozov@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix ethernet type protocol matchingPablo Neira Ayuso2013-11-041-1/+1
| | | | | | | | | This fixes ethernet type protocol matching, which is needed to match network layer information, eg. nft add rule bridge filter input ip protocol icmp counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: finish reject supportPablo Neira Ayuso2013-10-271-1/+3
| | | | | | | | This patch finishes the reject support. Reported-by: Jiri Benc <jbenc@redhat.com> Tested-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: avoid huge rodata arrayFlorian Westphal2013-10-221-9/+14
| | | | | | | | | commit b259d1a ('src: operational limit match') creates huge array, increasing nft binary size from ~240k to ~5m on x86_64. Use switch statement instead. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: operational limit matchPhil Oester2013-10-224-14/+19
| | | | | | | | | | | | | | | | | | | | The nft limit match currently does not work at all. Below patches to nftables, libnftables, and kernel address the issue. A few notes on the implementation: - Removed support for nano/micro/milli second limits. These seem pointless, given we are using jiffies in the limit match, not a hpet. And who really needs to limit items down to sub-second level?? - 'depth' member is removed as unnecessary. All we need in the kernel is the rate and the unit. - 'stamp' member becomes the time we need to next refresh the token bucket, instead of being updated on every packet which goes through the match. This closes netfilter bugzilla #827, reported by Eric Leblond. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix return codeArturo Borrero Gonzalez2013-10-171-3/+4
| | | | | | | | | | | | | | | | | | | Exit with NFT_EXIT_FAILURE if something went wrong in the netlink code. Before this patch: internal:0:0-0: Error: Could not find chain `asd' in table `filter': [...] 0 After this patch: internal:0:0-0: Error: Could not find chain `asd' in table `filter': [...] 1 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix nft flush operationEric Leblond2013-10-031-2/+0
| | | | | | | | | | nft_netlink function is already calling mnl_batch_end and mnl_batch_begin so it is not necessary to do it in the netlink_flush_rules function. Doing this result in a invalid netlink message which is discarded by the kernel. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: only flush asked table/chainEric Leblond2013-10-031-0/+8
| | | | | | | | | The flush operation was not limiting the flush to the table or chain specified on command line. The result was that all the rules for a given family are flush independantly of the flush command. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: suppress useless variableEric Leblond2013-10-031-3/+0
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix typo in commentEric Leblond2013-10-031-1/+1
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for IPv6 NATEric Leblond2013-09-302-4/+20
| | | | | | | | This patch adds support for IPv6 NAT. It adds IPv6 support in evaluation and in delinearization which were the only missing parts. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix IPv6 prefix computationEric Leblond2013-09-301-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | The prefix building algorithm in netlink phase was incorrect in IPv6. For example, when adding the following rule nft add rule ip6 nat postrouting ip6 saddr 2::/64 --debug=all we had: ip6 nat postrouting 0 0 [ payload load 16b @ network header + 8 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000000 0x99361540 0x00007f8d 0x2e33a1eb ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ] [ cmp eq reg 1 0x00000200 0x00000000 0x00000000 0x00000000 ] With the patch the result is as expected: ip6 nat postrouting 0 0 [ payload load 16b @ network header + 8 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0xffffffff 0xffffffff 0x00000000 0x00000000 ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ] [ cmp eq reg 1 0x00000200 0x00000000 0x00000000 0x00000000 ] Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule batching supportPablo Neira Ayuso2013-09-234-40/+343
| | | | | | | | | | | | | | | | | | | | | | | This patch allows nft to put all rule update messages into one single batch that is sent to the kernel if `-f' option is used. In order to provide fine grain error reporting, I decided to to correlate the netlink message sequence number with the correspoding command sequence number, which is the same. Thus, nft can identify what rules trigger problems inside a batch and report them accordingly. Moreover, to avoid playing buffer size games at batch building stage, ie. guess what is the final size of the batch for this ruleset update will be, this patch collects batch pages that are converted to iovec to ensure linearization when the batch is sent to the kernel. This reduces the amount of unnecessary memory usage that is allocated for the batch. This patch uses the libmnl nlmsg batching infrastructure and it requires the kernel patch entitled (netfilter: nfnetlink: add batch support and use it from nf_tables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: iif/oifname should be host byte orderFlorian Westphal2013-09-233-5/+5
| | | | | | | | | | | | | | | | | | | | src/nft add rule filter output meta oifname eth0 doesn't work on x86. Problem is that nft declares these as BYTEORDER_INVALID, but when converting the string mpz_import_data treats INVALID like BIG_ENDIAN. [ cmp eq reg 1 0x00000000 0x00000000 0x65000000 0x00306874 ] as kernel nft_cmp_eval basically boils down to memcmp(reg, skb->dev->name, sizeof(reg) comparision fails. with patch: [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ] Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* display family in table listingEric Leblond2013-09-171-1/+19
| | | | | | | | As family was not displayed in table listing, it was not possible to restore an ipv6 table saved via 'nft list table ip6 TABLE'. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nat: add mandatory family attributeEric Leblond2013-09-171-0/+4
| | | | | | | | NFT_EXPR_NAT_FAMILY is a mandatory attribute for NAT rules and it was not set by nftables. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: s/threshold/queue-threshold/Florian Westphal2013-09-141-1/+1
| | | | | | | | on input we expect "queue-threshold" token, so use the same name when printing the output. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: fix endianess of ARP operation codePablo Neira Ayuso2013-09-141-1/+1
| | | | | | | | | | So it display compatibility command: xtables-arp -A INPUT --opcode Reply -j DROP accordinly: arp plen 4 arp operation reply counter packets 0 bytes 0 drop
* src: Better error reporting if chain type is invalidTomasz Bursztyka2013-09-052-3/+32
| | | | | | | | | | | | | This patch verifies at command line parsing that given chain type is valid. Possibilities are: filter, nat, and route. nft add chain test test { type cheese hook input priority 0 }; <cmdline>:1:28-33: Error: unknown chain type cheese add chain test test { type cheese hook input priority 0 }; ^^^^^^ Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix mark parsing if string is usedPablo Neira Ayuso2013-09-041-0/+11
| | | | | | | | | | | | | | | | | | | This fixes string mark parsing. Note that /etc/iproute2/rt_marks may contain mapping between string and mark values. This fixes here: add rule filter output meta mark 0 counter Assumming that: cat /etc/iproute2/rt_marks says: 0 test Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix output display of meta lengthPablo Neira Ayuso2013-09-041-1/+1
| | | | | | | | | | | | | nft list table filter Before: meta len 1000 counter packets 0 bytes 0 After: meta length 1000 counter packets 0 bytes 0 Now it doesn't break with nft -f. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add priority keyword on base chain descriptionTomasz Bursztyka2013-09-042-5/+5
| | | | | | | | | | Instead of: add chain foo bar { type route hook input 0; } it should be now: add chain foo bar { type route hook input priority 0; } Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* src: Wrap netfilter hooks around human readable stringsTomasz Bursztyka2013-09-044-25/+119
| | | | | | | | | | | | | | | | | | | This allows to use unique, human readable, hook names for the command line and let the user being unaware of the complex netfilter's hook names and there difference depending on the netfilter family. So: add chain foo bar { type route hook NF_INET_LOCAL_IN 0; } becomes: add chain foo bar { type route hook input 0; } It also fixes then the difference in hook values between families. I.e. ARP family has different values for input, forward and output compared to IPv4, IPv6 or bridge. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix base chain printingTomasz Bursztyka2013-08-302-1/+2
| | | | | | | | | Relying on chain's hooknum to know whether the chain is a base one or not is bogus: having 0 as hooknum is a valid number. Thus setting the right flag and handling it is the way to go, as parser does already. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the base chain typePablo Neira Ayuso2013-08-273-15/+30
| | | | | | | | | | | | | | | | | | This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: fix wrong endianess in numeric portsPablo Neira Ayuso2013-08-241-1/+1
| | | | | | | | In (5075879 datatype: validate port number in inet_service_type_parse), conversion to network byte order was missing. Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: add additional --numeric levelPhil Oester2013-08-222-3/+4
| | | | | | | | | | | | | | Personally, I like seeing ports and IPs numerically, but prefer protocols to be shown by name. As such, add a third --numeric level which will show protocols by number, splitting them out from ports. -n/--numeric When specified once, show network addresses numerically. When specified twice, also show Internet services, user IDs and group IDs numerically. When specified thrice, also show protocols numerically. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>