summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* osf: add version fingerprint supportFernando Fernandez Mancera2019-04-084-6/+20
| | | | | | | | | | | | | | | Add support for version fingerprint in "osf" expression. Example: table ip foo { chain bar { type filter hook input priority filter; policy accept; osf ttl skip name "Linux" osf ttl skip version "Linux:4.20" } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: missing destroy function in statement definitionsPablo Neira Ayuso2019-04-056-0/+54
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: type_identifier string memleakPablo Neira Ayuso2019-04-051-1/+1
| | | | | | | | | | | | | ==6297== 24 bytes in 3 blocks are definitely lost in loss record 2 of 13 ==6297== at 0x4C2BBAF: malloc (vg_replace_malloc.c:299) ==6297== by 0x56193B9: strdup (strdup.c:42) ==6297== by 0x4E758BD: xstrdup (utils.c:75) ==6297== by 0x4E7F9D3: nft_parse (parser_bison.y:1895) ==6297== by 0x4E7AAE1: nft_parse_bison_filename (libnftables.c:370) ==6297== by 0x4E7AAE1: nft_run_cmd_from_filename (libnftables.c:438) ==6297== by 0x109A33: main (main.c:310) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: use nft_print() instead of printf()Pablo Neira Ayuso2019-04-051-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: improve error reporting in tproxy with inet familyPablo Neira Ayuso2019-04-041-2/+5
| | | | | | | | | | | | | | | | | # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: conflicting protocols specified: ip vs. unknown. You must specify ip or ip6 family in tproxy statement add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ~~~~~~~~ ^^^^^^^^^^^^^^^ instead of: # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: Conflicting network layer protocols. add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing tproxy syntax with port only for inet familyPablo Neira Ayuso2019-04-041-0/+6
| | | | | | | | | | | | | | | | | # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy ip to :2000 Error: syntax error, unexpected colon add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy ip to :2000 ^ Syntax with no protocol for tproxy complains with: # nft add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 Error: Conflicting network layer protocols. add rule inet filter divert ip daddr 0.0.0.0/0 meta l4proto tcp tproxy to :2000 ^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1310 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Rewrite echo supportPhil Sutter2019-04-031-188/+95
| | | | | | | | | | | | | | | | | Instead of guessing which object to update with retrieved handle, introduce a list containing struct cmd <-> json_t associations. Upon batch commit, allocated cmd objects are assigned a unique netlink sequence number. Monitor events contain that number as well, so they may be associated to the cmd object which triggered them. Using json_cmd_assoc list the event may in turn be associated to the input's JSON object which should receive the handle value. This also fixes incorrect behaviour if JSON input contained "insert" commands. Fixes: bb32d8db9a125 ("JSON: Add support for echo option") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: skip binary transfer for named setsPablo Neira Ayuso2019-03-261-0/+3
| | | | | | | | Set may be empty, content might be yet unknown, we cannot do any transfer in this case. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1327 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use 'flow add' syntaxPablo Neira Ayuso2019-03-202-1/+5
| | | | | | As discussed during NFWS 2018. Old syntax is stilled allowed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: file descriptor leak in include_file()Pablo Neira Ayuso2019-03-152-22/+26
| | | | | | | | File that contains the ruleset is never closed, track open files through the nft_ctx object and close them accordingly. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: no need for statement separator for ct object commandsPablo Neira Ayuso2019-03-141-4/+4
| | | | | | | | | | | | | Otherwise, this forces user to place a double semi-colon to skip a parser error in a multi-line commands: # nft add "ct helper ip filter test { type \"ftp\" protocol tcp; };add rule filter test ct helper set \"ftp\"" Error: syntax error, unexpected add, expecting end of file or newline or semicolon add ct helper ip filter test { type "ftp" protocol tcp; };add rule filter test ct helper set "ftp" ^^^ Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: misleading error reporting with sets and mapsPablo Neira Ayuso2019-03-061-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When trying to list a map content, if set is used, nft reports: # nft list set filter group_7933 Error: No such file or directory; did you mean set ‘group_7933’ in table ip ‘filter’? list set filter group_7933 ^^^^^^^^^^ Which is confusing in case user wants to list an existing map: # nft list map filter group_7933 table ip filter { map group_7933 { type ipv4_addr : classid flags interval elements = { 10.4.22.0/24 : 1:c7cb } } } Instead, give a hint to user that probably wants to list a map, not a set: # nft list set filter group_7933 Error: No such file or directory; did you mean map ‘group_7933’ in table ip ‘filter’? list set filter group_7933 ^^^^^^^^^^ Fixes: 285bb67a11ad ("src: introduce simple hints on incorrect set") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: add missing non-matching segment to set in flat representationPablo Neira Ayuso2019-03-061-3/+6
| | | | | | | | | | | | | | | | | # cat test.nft add set x y { type ipv4_addr; } add element x y { 10.0.24.0/24 } # nft -f test.nft # nft delete element x y { 10.0.24.0/24 } bogusly returns -ENOENT. The non-matching segment (0.0.0.0 with end-flag set on) is not added to the set in the example above. This patch also adds a test to cover this case. Fixes: 4935a0d561b5 ("segtree: special handling for the first non-matching segment") Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: remove dummy debug_octxPablo Neira Ayuso2019-03-062-9/+8
| | | | | | | | Breaks custom-defined configuration in library mode, ie. user may want to store output in a file, instead of stderr. Fixes: 35f6cd327c2e ("src: Pass stateless, numeric, ip2name and handle variables as structure members.") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: fix crash when debug mode is activeFlorian Westphal2019-03-041-2/+5
| | | | | | | We must set output_fp to sensible filep, else crash. Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: Respect base chain priorityPhil Sutter2019-02-271-0/+1
| | | | | | | | Priority value was parsed but not assigned to allocated chain object. Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix memleaks in echo supportPhil Sutter2019-02-271-10/+18
| | | | | | | | | | | | | When extracting netlink message data for populating JSON objects with handles, allocated nftnl objects were not freed. Though since freeing these objects also frees retrieved string attributes, copy them using strdupa() which takes care of memory deallocation upon function return. This is ideal since these strings are used only to find the right JSON object to insert the handle into. Fixes: bb32d8db9a125 ("JSON: Add support for echo option") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Use xstrdup() when parsing rule commentPhil Sutter2019-02-271-1/+1
| | | | | | | | | Use xstrdup() instead of plain strdup() for consistency (and implicit ENOMEM checking). Fixes: 586ad210368b7 ("libnftables: Implement JSON parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: Duplicate chain name when parsing jump verdictPhil Sutter2019-02-271-1/+2
| | | | | | | | | | Since verdict expression frees the chain name, pass a newly allocated string to it. Otherwise double free happens because json_decref() frees the string property value as well. Fixes: d1057a5feb5fd ("JSON: Simplify verdict statement parsing") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Print errors before freeing commandsPhil Sutter2019-02-271-2/+2
| | | | | | | | | Commands may contain data printed by an error record, so make sure cmd_free() is not called before erec_print_list() has returned. Fixes: 778de37d82e7b ("libnftables: Keep cmds list outside of parser_state") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: fix build failure with json supportFlorian Westphal2019-02-122-6/+6
| | | | | | Fixes: e3f195777ee54 ("src: expr: remove expr_ops from struct expr") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: remove expr_ops from struct exprFlorian Westphal2019-02-0815-56/+105
| | | | | | | | size of struct expr changes from 144 to 128 bytes on x86_64. This doesn't look like much, but large rulesets can have tens of thousands of expressions (each set element is represented by an expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: add expression etypeFlorian Westphal2019-02-0817-141/+141
| | | | | | | | Temporary kludge to remove all the expr->ops->type == ... patterns. Followup patch will remove expr->ops, and make expr_ops() lookup the correct expr_ops struct instead to reduce struct expr size. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: expr: add and use internal expr_ops helperFlorian Westphal2019-02-081-9/+29
| | | | | | | | This helper will eventually lookup the correct expr_ops struct, so we can get rid of the expr->ops pointer. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: payload: export and use payload_expr_cmpFlorian Westphal2019-02-082-2/+2
| | | | | | | expr->ops is going away, so export payload cmp and use it directly. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: add and use expr_name helperFlorian Westphal2019-02-088-23/+27
| | | | | | | | Currently callers use expr->ops->name, but follouwp patch will remove the ops pointer from struct expr. So add this helper and use it everywhere. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add iifkind and oifkind supportwenxu2019-01-281-0/+6
| | | | | | | | | | This can be used to match the kind type of iif or oif interface of the packet. Example: add rule inet raw prerouting meta iifkind "vrf" accept Signed-off-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Florian Westphal <fw@strlen.de>
* mnl: name is ignored when deleting a tableFlorian Westphal2019-01-181-4/+0
| | | | | | | | | | | | | nlt is reallocated, leaking first allocation and also removing the table name/handle that was set on nlt object. Add a test case for this as well, the batch is supposed to fail when trying to delete a non-existant table, rather than wiping all tables in the same address family. Fixes: 12c362e2214a0 ("mnl: remove alloc_nftnl_table()") Reported-by: Mikhail Morfikov <mmorfikov@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: refine payload expr mergingFlorian Westphal2019-01-111-1/+27
| | | | | | | | | | | | | | | | | | | nf_tables can handle payload exprs for sizes <= sizeof(u32) via a direct operation from the eval loop, rather than a a call to the payload expression. Two loads for four byte quantities are thus faster than a single load for an 8 byte load. ip saddr 1.2.3.4 ip daddr 2.3.4.5 is faster with this applied, even though it involves two payload and two two compare expressions, just because all can be handled from the main loop without any calls to expression ops. Keep merging for linklayer and when at least one of the expressions already exceeded the 4 byte "limit" anyway. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix netdev family device name parsingFlorian Westphal2019-01-092-2/+2
| | | | | | | | Should use accept/use quotes, else you can't use this with a device name that is shared with a key word, e.g. 'device vm'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add igmp supportPablo Neira Ayuso2019-01-095-5/+86
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix object listing when no table is givenFlorian Westphal2019-01-021-5/+8
| | | | | | | 'nft list quotas' would not print anything at all anymore. Fixes: 88456a7ef01172 ("rule: list only the table containing object") Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: fix build with --with-xtablesFlorian Westphal2018-12-291-3/+4
| | | | | | | | | | | | The previous change is bonkers, it fixes build when libxtables isn't even installed, but broke build when --with-xtables is provided to configure. Reason is that the include guard comes too early, so xtables.h is never included, causing build to fail because no libxtables function prototypes and definitions are available. Fixes: 9e84f3f083bb ("xt: fix build when libxtables is not installed") Signed-off-by: Florian Westphal <fw@strlen.de>
* src: remove deprecated code for export/import commandsPablo Neira Ayuso2018-12-275-118/+4
| | | | | | | | | | | | | | | | | | Update parser to display this error message: # nft export json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export json ^^^^^^^^^^^^ Just like: # nft export vm json Error: JSON export is no longer supported, use 'nft -j list ruleset' instead export vm json ^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Reject 'export vm json' commandPhil Sutter2018-12-212-2/+5
| | | | | | | | | | | | | | | | | | Since libnftnl recently dropped JSON output support, this form of JSON export is not available anymore. Point at 'nft -j list ruleset' command for a replacement in error message. Since 'export' command is not useable anymore, remove it from documentation. Instead point out that 'list ruleset' command serves well for dumping and later restoring. To not cause pointless inconvenience for users wishing to store their ruleset in JSON format, make JSON parser fallback to CMD_ADD if no recognized command property was found. This allows to feed the output of 'nft -j list ruleset' into 'nft -f' without any modification. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: fix build when libxtables is not installedFlorian Westphal2018-12-041-0/+5
| | | | | | | | | | | | If libxtables is not even installed, build fails due to to missing include file. ifdef LIBXTABLES guard fixes the first error, but results in two followup failures: 1. missing IFNAMSIZ definition 2. dereference of unknown struct. Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: bail out on incorrect burst unitPablo Neira Ayuso2018-12-031-6/+9
| | | | | | | | | | | | Burst can be either bytes or packets, depending on the rate limit unit. # nft add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets Error: syntax error, unexpected packets, expecting string or bytes add rule x y iif eth0 limit rate 512 kbytes/second burst 5 packets ^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1306 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect identifierPablo Neira Ayuso2018-12-012-2/+28
| | | | | | | | | | | | | | | | | # cat test.nft define test = "1.2.3.4" table ip x { chain y { ip saddr $text } } # nft -f test.nft test.nft:5:13-16: Error: unknown identifier 'text'; did you mean identifier ‘test’? ip saddr $text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect objectPablo Neira Ayuso2018-12-012-3/+44
| | | | | | | | | | # nft add counter x test # nft list counter x test Error: No such file or directory; did you mean obj ‘test’ in table ip ‘x’? list counter x text ^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* misspell: add distance threshold for suggestionsPablo Neira Ayuso2018-11-301-3/+18
| | | | | | Restrict suggestions to threshold, like gcc does. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: provide suggestion for misspelled object namePablo Neira Ayuso2018-11-303-3/+114
| | | | | | | | | | | | Use this from the lookup path, to check for misspellings: # nft add table filter # nft add chain filtre test Error: No such file or directory; did you mean table ‘filter’ in family ip? add chain filtre test ^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect setPablo Neira Ayuso2018-11-192-27/+59
| | | | | | | | | # nft rule x y ip saddr @y Error: No such file or directory; did you mean set ‘y’ in table inet ‘x’? rule x y ip saddr @y ^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect chainPablo Neira Ayuso2018-11-192-9/+40
| | | | | | | | | # nft list chain x y Error: No such file or directory; did you mean chain ‘y’ in table inet ‘x’? list chain x y ^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce simple hints on incorrect tablePablo Neira Ayuso2018-11-192-57/+60
| | | | | | | | | | | This patch adds simple infrastructure to provide a hints to user on references to incorrect table. While at it, remove "Could not process rule:" which I think it is implicit in the error. # nft rule x y ip saddr @y Error: No such file or directory; did you mean table ‘x’ in family inet? Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: always build with a minimal support for xt match/target decodeFlorian Westphal2018-11-122-1/+23
| | | | | | | | | | When building without libxtables, nft would just silently omit any presence of nft_compat in the output. This adds ifdef-ry to at least print name of target/match involved when libxtables isn't available for decoding. Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: pass octx to translate functionFlorian Westphal2018-11-122-4/+4
| | | | | | | We can't use it when no translation is available as libxtables will use plain printf(), but when translation is available we can. Signed-off-by: Florian Westphal <fw@strlen.de>
* expression: always print range expression numericallyPablo Neira Ayuso2018-10-301-2/+4
| | | | | | | | | | Otherwise we end up displaying things that we cannot parse as input. Moreover, in a range, it's relevant to the user the values that are enclosed in the range, so let's print this numerically. Fixes: baa4e0e3fa5f ("src: add NFT_CTX_OUTPUT_NUMERIC_PROTO") Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -p to print layer 4 protocol numericallyPablo Neira Ayuso2018-10-301-1/+6
| | | | | | | | We keep printing layer 4 protocols as literals since we do not use /etc/protocols. Add -p option to print layer 4 protocols numerically. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of nft_ctx_output_{get,set}_numeric()Pablo Neira Ayuso2018-10-305-30/+7
| | | | | | | | | | | | | | | | | | | | | | | This patch adds NFT_CTX_OUTPUT_NUMERIC_SYMBOL, which replaces the last client of the numeric level approach. This patch updates `-n' option semantics to display all output numerically. Note that monitor code was still using the -n option to skip printing the process name, this patch updates that path too to print it inconditionally to simplify things. Given the numeric levels have no more clients after this patch, remove that code. Update several tests/shell not to use -nn. This patch adds NFT_CTX_OUTPUT_NUMERIC_ALL which enables all flags to provide a fully numerical output. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add -y to priority base chain nummericallyPablo Neira Ayuso2018-10-292-12/+20
| | | | | | | | By default base chains are printed using default hook priority definitions. Add -y option to print them as numbers. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>