examples: nft-rule-add: use existing batch infrastructure

This patch reworks the existing example to add the rule:

  nft add rule ip filter input tcp dport 22 counter

It uses the existing nfnl batching approach using the generic mnl
netlink message batching infrastructure. It also removed the code
that uses xtables compat code.

Based on original patch by Arturo Borrero Gonzalez.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include: update netlink.h to 3.13

Use kernel header from 3.13-rc upstream kernel, this includes
documentation changes that were missing.

Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
build: properly handle --without-{xml,json}-parsing

This patch fixes how --without-{xml,json}-parsing (and subsequently
--with-{xml,json}-parsing=no) is handled.  Prior to this,
--without-{xml,json}-parsing actually resulted in libnftables being
built with that parsing enabled.

Signed-off-by: Douglas Freed <dwfreed@mtu.edu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src: rename the parameter tag to node_name in jansson function

I have changed this parameter for having consistence with the
xml helper function. This patch is a cleanup.

Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src: new error reporting approach for XML/JSON parsers

I have added a new structure for reporting some errors in parser
that we can't cover with errno.

In this patch, we have three errors that we can't cover with errno:

NFT_PARSE_EBADINPUT : Bad XML/JSON format in the input
NFT_PARSE_EMISSINGNODE : Missing node in our input
NFT_PARSE_EBADTYPE : Wrong type value in a node

Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
mxml: add error reference of the top node

We know the top node we are building. Let the user also know it.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
set_elem: add json parsing to API

Add missing support in the API function to parse a JSON set_elem.

I've renamed the main JSON parsing function to prevent clashing.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src: rework and generalize the build/parse system

The intention behind this patch is to prepare the introduction of
the new API that will allow us to parse files that contain the rule-sets
expressed in XML/JSON format. This adds the NFT_PARSE_BUFFER that
indicates that the input is provided in a buffer, which is what we
currently support.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
src: add interface to parse from file

This patch adds a new API to parse rule-set expressed in XML/JSON from
a file. A new enum nft_parse_input type is added for this purpose.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tests: nft-parsing-test: use nft_ruleset_parse_file()

All testfiles are now enclosed in the corresponding top element, ie.

* XML: <nftables>...</nftables>
* JSON: {"nftables":[...]}

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
expr: fix incorrect data type for several expression object fields

This patch fixes the incorrect data type (from uint8_t to uint32_t) in
several private data area of the expressions.

It also cleans up this by translating several unsigned int to uint32_t.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
update COPYING

It includes the new FSF office address.

Reported-by: Kevin Fenzi <kevin@scrye.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
set: xml: data_type/data_len are optional

Don't print data_type and data_len if they aren't set.
Also, they are optional when parsing.

Printing and parsing unconditionally leads to false values and other errors.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
mxml: add optional/mandatory flag to nft_mxml_reg_parse

There are some cases where a reg is not mandatory, for example:
 * dreg in lookup
 * dreg/sreg in meta (last version)

So, lets change the function nft_mxml_reg_parse() to add
an optional/mandatory flag.

dreg in lookup is optional as stated at:
 net/netfilter/nft_lookup.c:nft_lookup_init()

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
lookup: xml: conditional output of dreg

The dreg attribute is optional as stated at:
linux/net/netfilter/nft_lookup.c

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
tests: xml: delete comments

When building a XML tree, only one root node can be in place. This is
a "feature" added in libmxml 2.7:

<<<
mxmlLoad... did not error out on XML with multiple root nodes (Bug #403)
>>>

In libmxml 2.6 the second root node was ignored, not because it was a
comment but a bug. Our files had two root nodes, being comments or not.
libmxml accept comments, but inside the root node.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
expr: ct: fix missing NFT_CT_L3PROTOCOL in ctkey2str_array

Due to missing NFT_CT_L3PROTOCOL key in ctkey2str_array, a segfault is
produced when the str2ctkey() loop reaches that position, since strcmp()
will try to compare a NULL value.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
expr: ct: direction is optional

The 'dir' attribute is optional as stated in the kernel sources.

Previous to this patch, using XML/JSON to manage this expr produces some
undefined and erroneous behaviours.

While at it, fix also the default output format.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
expr: meta: statify meta_key2str_array

It's not used out of the scope of expr/meta.c

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
utils: fix nft_str2verdict return value

Some verdicts have a negative value.

The caller of nft_str2verdict() checking if return was < 0 clash with
enum nft_verdict.

While at it, add error reporting of invalid verdicts.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>