summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
Diffstat (limited to 'include')
-rw-r--r--include/Makefile.am1
-rw-r--r--include/buffer.h109
-rw-r--r--include/data_reg.h10
-rw-r--r--include/expr_ops.h10
-rw-r--r--include/internal.h1
-rw-r--r--include/libnftnl/chain.h9
-rw-r--r--include/libnftnl/expr.h65
-rw-r--r--include/libnftnl/flowtable.h7
-rw-r--r--include/libnftnl/object.h40
-rw-r--r--include/libnftnl/rule.h1
-rw-r--r--include/libnftnl/set.h21
-rw-r--r--include/libnftnl/table.h2
-rw-r--r--include/libnftnl/udata.h35
-rw-r--r--include/linux/netfilter/nf_log.h3
-rw-r--r--include/linux/netfilter/nf_tables.h173
-rw-r--r--include/obj.h10
-rw-r--r--include/set.h3
-rw-r--r--include/set_elem.h6
-rw-r--r--include/utils.h27
19 files changed, 364 insertions, 169 deletions
diff --git a/include/Makefile.am b/include/Makefile.am
index b31aa10..738f807 100644
--- a/include/Makefile.am
+++ b/include/Makefile.am
@@ -2,7 +2,6 @@ SUBDIRS = libnftnl linux
noinst_HEADERS = internal.h \
linux_list.h \
- buffer.h \
data_reg.h \
expr_ops.h \
obj.h \
diff --git a/include/buffer.h b/include/buffer.h
deleted file mode 100644
index f6626a6..0000000
--- a/include/buffer.h
+++ /dev/null
@@ -1,109 +0,0 @@
-#ifndef _NFTNL_BUFFER_H_
-#define _NFTNL_BUFFER_H_
-
-#include <stdint.h>
-#include <stdbool.h>
-
-struct nftnl_expr;
-
-struct nftnl_buf {
- char *buf;
- size_t size;
- size_t len;
- uint32_t off;
- bool fail;
-};
-
-#define NFTNL_BUF_INIT(__b, __buf, __len) \
- struct nftnl_buf __b = { \
- .buf = __buf, \
- .len = __len, \
- };
-
-int nftnl_buf_update(struct nftnl_buf *b, int ret);
-int nftnl_buf_done(struct nftnl_buf *b);
-
-union nftnl_data_reg;
-
-int nftnl_buf_open(struct nftnl_buf *b, int type, const char *tag);
-int nftnl_buf_close(struct nftnl_buf *b, int type, const char *tag);
-
-int nftnl_buf_open_array(struct nftnl_buf *b, int type, const char *tag);
-int nftnl_buf_close_array(struct nftnl_buf *b, int type, const char *tag);
-
-int nftnl_buf_u32(struct nftnl_buf *b, int type, uint32_t value, const char *tag);
-int nftnl_buf_s32(struct nftnl_buf *b, int type, uint32_t value, const char *tag);
-int nftnl_buf_u64(struct nftnl_buf *b, int type, uint64_t value, const char *tag);
-int nftnl_buf_str(struct nftnl_buf *b, int type, const char *str, const char *tag);
-int nftnl_buf_reg(struct nftnl_buf *b, int type, union nftnl_data_reg *reg,
- int reg_type, const char *tag);
-int nftnl_buf_expr_open(struct nftnl_buf *b, int type);
-int nftnl_buf_expr_close(struct nftnl_buf *b, int type);
-int nftnl_buf_expr(struct nftnl_buf *b, int type, uint32_t flags,
- struct nftnl_expr *expr);
-
-#define BASE "base"
-#define BYTES "bytes"
-#define BURST "burst"
-#define CHAIN "chain"
-#define CODE "code"
-#define COMPAT_FLAGS "compat_flags"
-#define COMPAT_PROTO "compat_proto"
-#define CONSUMED "consumed"
-#define COUNT "count"
-#define DATA "data"
-#define DEVICE "device"
-#define DIR "dir"
-#define DREG "dreg"
-#define EXTHDR_TYPE "exthdr_type"
-#define FAMILY "family"
-#define FLAGS "flags"
-#define GROUP "group"
-#define HANDLE "handle"
-#define HOOKNUM "hooknum"
-#define KEY "key"
-#define LEN "len"
-#define LEVEL "level"
-#define MASK "mask"
-#define NAT_TYPE "nat_type"
-#define NAME "name"
-#define NUM "num"
-#define OFFSET "offset"
-#define OP "op"
-#define PACKETS "packets"
-#define PKTS "pkts"
-#define POLICY "policy"
-#define POSITION "position"
-#define PREFIX "prefix"
-#define PRIO "prio"
-#define QTHRESH "qthreshold"
-#define RATE "rate"
-#define RULE "rule"
-#define SET "set"
-#define SET_NAME "set_name"
-#define SIZE "size"
-#define SNAPLEN "snaplen"
-#define SREG_ADDR_MAX "sreg_addr_max"
-#define SREG_ADDR_MIN "sreg_addr_min"
-#define SREG_PROTO_MAX "sreg_proto_max"
-#define SREG_PROTO_MIN "sreg_proto_min"
-#define SREG_KEY "sreg_key"
-#define SREG_DATA "sreg_data"
-#define SREG_QNUM "sreg_qnum"
-#define SREG "sreg"
-#define TABLE "table"
-#define TOTAL "total"
-#define TYPE "type"
-#define UNIT "unit"
-#define USE "use"
-#define XOR "xor"
-#define ADD "add"
-#define INSERT "insert"
-#define DELETE "delete"
-#define REPLACE "replace"
-#define FLUSH "flush"
-#define MODULUS "modulus"
-#define SEED "seed"
-#define ID "id"
-
-#endif
diff --git a/include/data_reg.h b/include/data_reg.h
index 10517ba..946354d 100644
--- a/include/data_reg.h
+++ b/include/data_reg.h
@@ -13,6 +13,10 @@ enum {
DATA_CHAIN,
};
+enum {
+ DATA_F_NOPFX = 1 << 0,
+};
+
union nftnl_data_reg {
struct {
uint32_t val[NFT_DATA_VALUE_MAXLEN / sizeof(uint32_t)];
@@ -21,16 +25,16 @@ union nftnl_data_reg {
struct {
uint32_t verdict;
const char *chain;
+ uint32_t chain_id;
};
};
int nftnl_data_reg_snprintf(char *buf, size_t size,
const union nftnl_data_reg *reg,
- uint32_t output_format, uint32_t flags,
- int reg_type);
+ uint32_t flags, int reg_type);
struct nlattr;
int nftnl_parse_data(union nftnl_data_reg *data, struct nlattr *attr, int *type);
-void nftnl_free_verdict(const union nftnl_data_reg *data);
+int nftnl_data_cpy(union nftnl_data_reg *dreg, const void *src, uint32_t len);
#endif
diff --git a/include/expr_ops.h b/include/expr_ops.h
index a7f1b9a..6cfb3b5 100644
--- a/include/expr_ops.h
+++ b/include/expr_ops.h
@@ -8,16 +8,22 @@ struct nlattr;
struct nlmsghdr;
struct nftnl_expr;
+struct attr_policy {
+ uint32_t maxlen;
+};
+
struct expr_ops {
const char *name;
uint32_t alloc_len;
- int max_attr;
+ int nftnl_max_attr;
+ struct attr_policy *attr_policy;
+ void (*init)(const struct nftnl_expr *e);
void (*free)(const struct nftnl_expr *e);
int (*set)(struct nftnl_expr *e, uint16_t type, const void *data, uint32_t data_len);
const void *(*get)(const struct nftnl_expr *e, uint16_t type, uint32_t *data_len);
int (*parse)(struct nftnl_expr *e, struct nlattr *attr);
void (*build)(struct nlmsghdr *nlh, const struct nftnl_expr *e);
- int (*snprintf)(char *buf, size_t len, uint32_t type, uint32_t flags, const struct nftnl_expr *e);
+ int (*output)(char *buf, size_t len, uint32_t flags, const struct nftnl_expr *e);
};
struct expr_ops *nftnl_expr_ops_lookup(const char *name);
diff --git a/include/internal.h b/include/internal.h
index a61b725..1f96731 100644
--- a/include/internal.h
+++ b/include/internal.h
@@ -11,7 +11,6 @@
#include "set_elem.h"
#include "expr.h"
#include "expr_ops.h"
-#include "buffer.h"
#include "rule.h"
#endif /* _LIBNFTNL_INTERNAL_H_ */
diff --git a/include/libnftnl/chain.h b/include/libnftnl/chain.h
index 33d04e1..bac1f5f 100644
--- a/include/libnftnl/chain.h
+++ b/include/libnftnl/chain.h
@@ -32,6 +32,9 @@ enum nftnl_chain_attr {
NFTNL_CHAIN_TYPE,
NFTNL_CHAIN_DEV,
NFTNL_CHAIN_DEVICES,
+ NFTNL_CHAIN_FLAGS,
+ NFTNL_CHAIN_ID,
+ NFTNL_CHAIN_USERDATA,
__NFTNL_CHAIN_MAX
};
#define NFTNL_CHAIN_MAX (__NFTNL_CHAIN_MAX - 1)
@@ -46,6 +49,7 @@ void nftnl_chain_set_u32(struct nftnl_chain *t, uint16_t attr, uint32_t data);
void nftnl_chain_set_s32(struct nftnl_chain *t, uint16_t attr, int32_t data);
void nftnl_chain_set_u64(struct nftnl_chain *t, uint16_t attr, uint64_t data);
int nftnl_chain_set_str(struct nftnl_chain *t, uint16_t attr, const char *str);
+int nftnl_chain_set_array(struct nftnl_chain *t, uint16_t attr, const char **data);
const void *nftnl_chain_get(const struct nftnl_chain *c, uint16_t attr);
const void *nftnl_chain_get_data(const struct nftnl_chain *c, uint16_t attr,
@@ -55,6 +59,7 @@ uint8_t nftnl_chain_get_u8(const struct nftnl_chain *c, uint16_t attr);
uint32_t nftnl_chain_get_u32(const struct nftnl_chain *c, uint16_t attr);
int32_t nftnl_chain_get_s32(const struct nftnl_chain *c, uint16_t attr);
uint64_t nftnl_chain_get_u64(const struct nftnl_chain *c, uint16_t attr);
+const char *const *nftnl_chain_get_array(const struct nftnl_chain *c, uint16_t attr);
void nftnl_chain_rule_add(struct nftnl_rule *rule, struct nftnl_chain *c);
void nftnl_chain_rule_del(struct nftnl_rule *rule);
@@ -66,10 +71,6 @@ struct nlmsghdr;
void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_chain *t);
-int nftnl_chain_parse(struct nftnl_chain *c, enum nftnl_parse_type type,
- const char *data, struct nftnl_parse_err *err);
-int nftnl_chain_parse_file(struct nftnl_chain *c, enum nftnl_parse_type type,
- FILE *fp, struct nftnl_parse_err *err);
int nftnl_chain_snprintf(char *buf, size_t size, const struct nftnl_chain *t, uint32_t type, uint32_t flags);
int nftnl_chain_fprintf(FILE *fp, const struct nftnl_chain *c, uint32_t type, uint32_t flags);
diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h
index 3e0f5b0..fba1210 100644
--- a/include/libnftnl/expr.h
+++ b/include/libnftnl/expr.h
@@ -36,6 +36,14 @@ uint32_t nftnl_expr_get_u32(const struct nftnl_expr *expr, uint16_t type);
uint64_t nftnl_expr_get_u64(const struct nftnl_expr *expr, uint16_t type);
const char *nftnl_expr_get_str(const struct nftnl_expr *expr, uint16_t type);
+void nftnl_expr_build_payload(struct nlmsghdr *nlh, struct nftnl_expr *expr);
+
+/* For dynset expressions. */
+void nftnl_expr_add_expr(struct nftnl_expr *expr, uint32_t type, struct nftnl_expr *e);
+int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
+ int (*cb)(struct nftnl_expr *e, void *data),
+ void *data);
+
int nftnl_expr_snprintf(char *buf, size_t buflen, const struct nftnl_expr *expr, uint32_t type, uint32_t flags);
int nftnl_expr_fprintf(FILE *fp, const struct nftnl_expr *expr, uint32_t type, uint32_t flags);
@@ -48,6 +56,7 @@ enum {
NFTNL_EXPR_PAYLOAD_CSUM_TYPE,
NFTNL_EXPR_PAYLOAD_CSUM_OFFSET,
NFTNL_EXPR_PAYLOAD_FLAGS,
+ __NFTNL_EXPR_PAYLOAD_MAX
};
enum {
@@ -57,33 +66,40 @@ enum {
NFTNL_EXPR_NG_OFFSET,
NFTNL_EXPR_NG_SET_NAME, /* deprecated */
NFTNL_EXPR_NG_SET_ID, /* deprecated */
+ __NFTNL_EXPR_NG_MAX
};
enum {
NFTNL_EXPR_META_KEY = NFTNL_EXPR_BASE,
NFTNL_EXPR_META_DREG,
NFTNL_EXPR_META_SREG,
+ __NFTNL_EXPR_META_MAX
};
enum {
NFTNL_EXPR_RT_KEY = NFTNL_EXPR_BASE,
NFTNL_EXPR_RT_DREG,
+ __NFTNL_EXPR_RT_MAX
};
enum {
NFTNL_EXPR_SOCKET_KEY = NFTNL_EXPR_BASE,
NFTNL_EXPR_SOCKET_DREG,
+ NFTNL_EXPR_SOCKET_LEVEL,
+ __NFTNL_EXPR_SOCKET_MAX
};
enum {
NFTNL_EXPR_TUNNEL_KEY = NFTNL_EXPR_BASE,
NFTNL_EXPR_TUNNEL_DREG,
+ __NFTNL_EXPR_TUNNEL_MAX
};
enum {
NFTNL_EXPR_CMP_SREG = NFTNL_EXPR_BASE,
NFTNL_EXPR_CMP_OP,
NFTNL_EXPR_CMP_DATA,
+ __NFTNL_EXPR_CMP_MAX
};
enum {
@@ -91,6 +107,7 @@ enum {
NFTNL_EXPR_RANGE_OP,
NFTNL_EXPR_RANGE_FROM_DATA,
NFTNL_EXPR_RANGE_TO_DATA,
+ __NFTNL_EXPR_RANGE_MAX
};
enum {
@@ -98,16 +115,20 @@ enum {
NFTNL_EXPR_IMM_DATA,
NFTNL_EXPR_IMM_VERDICT,
NFTNL_EXPR_IMM_CHAIN,
+ NFTNL_EXPR_IMM_CHAIN_ID,
+ __NFTNL_EXPR_IMM_MAX
};
enum {
NFTNL_EXPR_CTR_PACKETS = NFTNL_EXPR_BASE,
NFTNL_EXPR_CTR_BYTES,
+ __NFTNL_EXPR_CTR_MAX
};
enum {
NFTNL_EXPR_CONNLIMIT_COUNT = NFTNL_EXPR_BASE,
NFTNL_EXPR_CONNLIMIT_FLAGS,
+ __NFTNL_EXPR_CONNLIMIT_MAX
};
enum {
@@ -116,18 +137,23 @@ enum {
NFTNL_EXPR_BITWISE_LEN,
NFTNL_EXPR_BITWISE_MASK,
NFTNL_EXPR_BITWISE_XOR,
+ NFTNL_EXPR_BITWISE_OP,
+ NFTNL_EXPR_BITWISE_DATA,
+ __NFTNL_EXPR_BITWISE_MAX
};
enum {
NFTNL_EXPR_TG_NAME = NFTNL_EXPR_BASE,
NFTNL_EXPR_TG_REV,
NFTNL_EXPR_TG_INFO,
+ __NFTNL_EXPR_TG_MAX
};
enum {
NFTNL_EXPR_MT_NAME = NFTNL_EXPR_BASE,
NFTNL_EXPR_MT_REV,
NFTNL_EXPR_MT_INFO,
+ __NFTNL_EXPR_MT_MAX
};
enum {
@@ -138,12 +164,14 @@ enum {
NFTNL_EXPR_NAT_REG_PROTO_MIN,
NFTNL_EXPR_NAT_REG_PROTO_MAX,
NFTNL_EXPR_NAT_FLAGS,
+ __NFTNL_EXPR_NAT_MAX
};
enum {
NFTNL_EXPR_TPROXY_FAMILY = NFTNL_EXPR_BASE,
NFTNL_EXPR_TPROXY_REG_ADDR,
NFTNL_EXPR_TPROXY_REG_PORT,
+ __NFTNL_EXPR_TPROXY_MAX
};
enum {
@@ -152,6 +180,7 @@ enum {
NFTNL_EXPR_LOOKUP_SET,
NFTNL_EXPR_LOOKUP_SET_ID,
NFTNL_EXPR_LOOKUP_FLAGS,
+ __NFTNL_EXPR_LOOKUP_MAX
};
enum {
@@ -162,6 +191,9 @@ enum {
NFTNL_EXPR_DYNSET_SET_NAME,
NFTNL_EXPR_DYNSET_SET_ID,
NFTNL_EXPR_DYNSET_EXPR,
+ NFTNL_EXPR_DYNSET_EXPRESSIONS,
+ NFTNL_EXPR_DYNSET_FLAGS,
+ __NFTNL_EXPR_DYNSET_MAX
};
enum {
@@ -171,6 +203,7 @@ enum {
NFTNL_EXPR_LOG_QTHRESHOLD,
NFTNL_EXPR_LOG_LEVEL,
NFTNL_EXPR_LOG_FLAGS,
+ __NFTNL_EXPR_LOG_MAX
};
enum {
@@ -181,6 +214,7 @@ enum {
NFTNL_EXPR_EXTHDR_FLAGS,
NFTNL_EXPR_EXTHDR_OP,
NFTNL_EXPR_EXTHDR_SREG,
+ __NFTNL_EXPR_EXTHDR_MAX
};
enum {
@@ -188,6 +222,7 @@ enum {
NFTNL_EXPR_CT_KEY,
NFTNL_EXPR_CT_DIR,
NFTNL_EXPR_CT_SREG,
+ __NFTNL_EXPR_CT_MAX
};
enum {
@@ -196,6 +231,7 @@ enum {
NFTNL_EXPR_BYTEORDER_OP,
NFTNL_EXPR_BYTEORDER_LEN,
NFTNL_EXPR_BYTEORDER_SIZE,
+ __NFTNL_EXPR_BYTEORDER_MAX
};
enum {
@@ -204,11 +240,13 @@ enum {
NFTNL_EXPR_LIMIT_BURST,
NFTNL_EXPR_LIMIT_TYPE,
NFTNL_EXPR_LIMIT_FLAGS,
+ __NFTNL_EXPR_LIMIT_MAX
};
enum {
NFTNL_EXPR_REJECT_TYPE = NFTNL_EXPR_BASE,
NFTNL_EXPR_REJECT_CODE,
+ __NFTNL_EXPR_REJECT_MAX
};
enum {
@@ -216,39 +254,46 @@ enum {
NFTNL_EXPR_QUEUE_TOTAL,
NFTNL_EXPR_QUEUE_FLAGS,
NFTNL_EXPR_QUEUE_SREG_QNUM,
+ __NFTNL_EXPR_QUEUE_MAX
};
enum {
NFTNL_EXPR_QUOTA_BYTES = NFTNL_EXPR_BASE,
NFTNL_EXPR_QUOTA_FLAGS,
NFTNL_EXPR_QUOTA_CONSUMED,
+ __NFTNL_EXPR_QUOTA_MAX
};
enum {
NFTNL_EXPR_MASQ_FLAGS = NFTNL_EXPR_BASE,
NFTNL_EXPR_MASQ_REG_PROTO_MIN,
NFTNL_EXPR_MASQ_REG_PROTO_MAX,
+ __NFTNL_EXPR_MASQ_MAX
};
enum {
NFTNL_EXPR_REDIR_REG_PROTO_MIN = NFTNL_EXPR_BASE,
NFTNL_EXPR_REDIR_REG_PROTO_MAX,
NFTNL_EXPR_REDIR_FLAGS,
+ __NFTNL_EXPR_REDIR_MAX
};
enum {
NFTNL_EXPR_DUP_SREG_ADDR = NFTNL_EXPR_BASE,
NFTNL_EXPR_DUP_SREG_DEV,
+ __NFTNL_EXPR_DUP_MAX
};
enum {
NFTNL_EXPR_FLOW_TABLE_NAME = NFTNL_EXPR_BASE,
+ __NFTNL_EXPR_FLOW_MAX
};
enum {
NFTNL_EXPR_FWD_SREG_DEV = NFTNL_EXPR_BASE,
NFTNL_EXPR_FWD_SREG_ADDR,
NFTNL_EXPR_FWD_NFPROTO,
+ __NFTNL_EXPR_FWD_MAX
};
enum {
@@ -261,12 +306,14 @@ enum {
NFTNL_EXPR_HASH_TYPE,
NFTNL_EXPR_HASH_SET_NAME, /* deprecated */
NFTNL_EXPR_HASH_SET_ID, /* deprecated */
+ __NFTNL_EXPR_HASH_MAX
};
enum {
NFTNL_EXPR_FIB_DREG = NFTNL_EXPR_BASE,
NFTNL_EXPR_FIB_RESULT,
NFTNL_EXPR_FIB_FLAGS,
+ __NFTNL_EXPR_FIB_MAX
};
enum {
@@ -275,12 +322,14 @@ enum {
NFTNL_EXPR_OBJREF_SET_SREG,
NFTNL_EXPR_OBJREF_SET_NAME,
NFTNL_EXPR_OBJREF_SET_ID,
+ __NFTNL_EXPR_OBJREF_MAX
};
enum {
NFTNL_EXPR_OSF_DREG = NFTNL_EXPR_BASE,
NFTNL_EXPR_OSF_TTL,
NFTNL_EXPR_OSF_FLAGS,
+ __NFTNL_EXPR_OSF_MAX
};
enum {
@@ -289,12 +338,28 @@ enum {
NFTNL_EXPR_XFRM_KEY,
NFTNL_EXPR_XFRM_DIR,
NFTNL_EXPR_XFRM_SPNUM,
+ __NFTNL_EXPR_XFRM_MAX
};
enum {
NFTNL_EXPR_SYNPROXY_MSS = NFTNL_EXPR_BASE,
NFTNL_EXPR_SYNPROXY_WSCALE,
NFTNL_EXPR_SYNPROXY_FLAGS,
+ __NFTNL_EXPR_SYNPROXY_MAX
+};
+
+enum {
+ NFTNL_EXPR_LAST_MSECS = NFTNL_EXPR_BASE,
+ NFTNL_EXPR_LAST_SET,
+ __NFTNL_EXPR_LAST_MAX
+};
+
+enum {
+ NFTNL_EXPR_INNER_TYPE = NFTNL_EXPR_BASE,
+ NFTNL_EXPR_INNER_FLAGS,
+ NFTNL_EXPR_INNER_HDRSIZE,
+ NFTNL_EXPR_INNER_EXPR,
+ __NFTNL_EXPR_INNER_MAX
};
#ifdef __cplusplus
diff --git a/include/libnftnl/flowtable.h b/include/libnftnl/flowtable.h
index 028095e..168f833 100644
--- a/include/libnftnl/flowtable.h
+++ b/include/libnftnl/flowtable.h
@@ -27,6 +27,7 @@ enum nftnl_flowtable_attr {
NFTNL_FLOWTABLE_DEVICES,
NFTNL_FLOWTABLE_SIZE,
NFTNL_FLOWTABLE_FLAGS,
+ NFTNL_FLOWTABLE_HANDLE,
__NFTNL_FLOWTABLE_MAX
};
#define NFTNL_FLOWTABLE_MAX (__NFTNL_FLOWTABLE_MAX - 1)
@@ -38,8 +39,9 @@ int nftnl_flowtable_set_data(struct nftnl_flowtable *t, uint16_t attr,
const void *data, uint32_t data_len);
void nftnl_flowtable_set_u32(struct nftnl_flowtable *t, uint16_t attr, uint32_t data);
void nftnl_flowtable_set_s32(struct nftnl_flowtable *t, uint16_t attr, int32_t data);
+void nftnl_flowtable_set_u64(struct nftnl_flowtable *t, uint16_t attr, uint64_t data);
int nftnl_flowtable_set_str(struct nftnl_flowtable *t, uint16_t attr, const char *str);
-void nftnl_flowtable_set_array(struct nftnl_flowtable *t, uint16_t attr, const char **data);
+int nftnl_flowtable_set_array(struct nftnl_flowtable *t, uint16_t attr, const char **data);
const void *nftnl_flowtable_get(const struct nftnl_flowtable *c, uint16_t attr);
const void *nftnl_flowtable_get_data(const struct nftnl_flowtable *c, uint16_t attr,
@@ -47,7 +49,8 @@ const void *nftnl_flowtable_get_data(const struct nftnl_flowtable *c, uint16_t a
const char *nftnl_flowtable_get_str(const struct nftnl_flowtable *c, uint16_t attr);
uint32_t nftnl_flowtable_get_u32(const struct nftnl_flowtable *c, uint16_t attr);
int32_t nftnl_flowtable_get_s32(const struct nftnl_flowtable *c, uint16_t attr);
-const char **nftnl_flowtable_get_array(const struct nftnl_flowtable *t, uint16_t attr);
+uint64_t nftnl_flowtable_get_u64(const struct nftnl_flowtable *c, uint16_t attr);
+const char *const *nftnl_flowtable_get_array(const struct nftnl_flowtable *t, uint16_t attr);
struct nlmsghdr;
diff --git a/include/libnftnl/object.h b/include/libnftnl/object.h
index 221b15c..9930355 100644
--- a/include/libnftnl/object.h
+++ b/include/libnftnl/object.h
@@ -19,6 +19,7 @@ enum {
NFTNL_OBJ_FAMILY,
NFTNL_OBJ_USE,
NFTNL_OBJ_HANDLE,
+ NFTNL_OBJ_USERDATA,
NFTNL_OBJ_BASE = 16,
__NFTNL_OBJ_MAX
};
@@ -27,18 +28,21 @@ enum {
enum {
NFTNL_OBJ_CTR_PKTS = NFTNL_OBJ_BASE,
NFTNL_OBJ_CTR_BYTES,
+ __NFTNL_OBJ_CTR_MAX,
};
enum {
NFTNL_OBJ_QUOTA_BYTES = NFTNL_OBJ_BASE,
NFTNL_OBJ_QUOTA_CONSUMED,
NFTNL_OBJ_QUOTA_FLAGS,
+ __NFTNL_OBJ_QUOTA_MAX,
};
enum {
NFTNL_OBJ_CT_HELPER_NAME = NFTNL_OBJ_BASE,
NFTNL_OBJ_CT_HELPER_L3PROTO,
NFTNL_OBJ_CT_HELPER_L4PROTO,
+ __NFTNL_OBJ_CT_HELPER_MAX,
};
enum nftnl_cttimeout_array_tcp {
@@ -68,6 +72,7 @@ enum {
NFTNL_OBJ_CT_TIMEOUT_L3PROTO = NFTNL_OBJ_BASE,
NFTNL_OBJ_CT_TIMEOUT_L4PROTO,
NFTNL_OBJ_CT_TIMEOUT_ARRAY,
+ __NFTNL_OBJ_CT_TIMEOUT_MAX,
};
enum {
@@ -76,6 +81,7 @@ enum {
NFTNL_OBJ_CT_EXPECT_DPORT,
NFTNL_OBJ_CT_EXPECT_TIMEOUT,
NFTNL_OBJ_CT_EXPECT_SIZE,
+ __NFTNL_OBJ_CT_EXPECT_MAX,
};
enum {
@@ -84,12 +90,14 @@ enum {
NFTNL_OBJ_LIMIT_BURST,
NFTNL_OBJ_LIMIT_TYPE,
NFTNL_OBJ_LIMIT_FLAGS,
+ __NFTNL_OBJ_LIMIT_MAX,
};
enum {
NFTNL_OBJ_SYNPROXY_MSS = NFTNL_OBJ_BASE,
NFTNL_OBJ_SYNPROXY_WSCALE,
NFTNL_OBJ_SYNPROXY_FLAGS,
+ __NFTNL_OBJ_SYNPROXY_MAX,
};
enum {
@@ -109,10 +117,12 @@ enum {
NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX,
NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID,
NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR,
+ __NFTNL_OBJ_TUNNEL_MAX,
};
enum {
NFTNL_OBJ_SECMARK_CTX = NFTNL_OBJ_BASE,
+ __NFTNL_OBJ_SECMARK_MAX,
};
struct nftnl_obj;
@@ -122,22 +132,22 @@ void nftnl_obj_free(const struct nftnl_obj *ne);
bool nftnl_obj_is_set(const struct nftnl_obj *ne, uint16_t attr);
void nftnl_obj_unset(struct nftnl_obj *ne, uint16_t attr);
-void nftnl_obj_set_data(struct nftnl_obj *ne, uint16_t attr, const void *data,
- uint32_t data_len);
+int nftnl_obj_set_data(struct nftnl_obj *ne, uint16_t attr, const void *data,
+ uint32_t data_len);
void nftnl_obj_set(struct nftnl_obj *ne, uint16_t attr, const void *data) __attribute__((deprecated));
-void nftnl_obj_set_u8(struct nftnl_obj *ne, uint16_t attr, uint8_t val);
-void nftnl_obj_set_u16(struct nftnl_obj *ne, uint16_t attr, uint16_t val);
-void nftnl_obj_set_u32(struct nftnl_obj *ne, uint16_t attr, uint32_t val);
-void nftnl_obj_set_u64(struct nftnl_obj *obj, uint16_t attr, uint64_t val);
-void nftnl_obj_set_str(struct nftnl_obj *ne, uint16_t attr, const char *str);
-const void *nftnl_obj_get_data(struct nftnl_obj *ne, uint16_t attr,
+int nftnl_obj_set_u8(struct nftnl_obj *ne, uint16_t attr, uint8_t val);
+int nftnl_obj_set_u16(struct nftnl_obj *ne, uint16_t attr, uint16_t val);
+int nftnl_obj_set_u32(struct nftnl_obj *ne, uint16_t attr, uint32_t val);
+int nftnl_obj_set_u64(struct nftnl_obj *obj, uint16_t attr, uint64_t val);
+int nftnl_obj_set_str(struct nftnl_obj *ne, uint16_t attr, const char *str);
+const void *nftnl_obj_get_data(const struct nftnl_obj *ne, uint16_t attr,
uint32_t *data_len);
-const void *nftnl_obj_get(struct nftnl_obj *ne, uint16_t attr);
-uint8_t nftnl_obj_get_u8(struct nftnl_obj *ne, uint16_t attr);
-uint16_t nftnl_obj_get_u16(struct nftnl_obj *obj, uint16_t attr);
-uint32_t nftnl_obj_get_u32(struct nftnl_obj *ne, uint16_t attr);
-uint64_t nftnl_obj_get_u64(struct nftnl_obj *obj, uint16_t attr);
-const char *nftnl_obj_get_str(struct nftnl_obj *ne, uint16_t attr);
+const void *nftnl_obj_get(const struct nftnl_obj *ne, uint16_t attr);
+uint8_t nftnl_obj_get_u8(const struct nftnl_obj *ne, uint16_t attr);
+uint16_t nftnl_obj_get_u16(const struct nftnl_obj *obj, uint16_t attr);
+uint32_t nftnl_obj_get_u32(const struct nftnl_obj *ne, uint16_t attr);
+uint64_t nftnl_obj_get_u64(const struct nftnl_obj *obj, uint16_t attr);
+const char *nftnl_obj_get_str(const struct nftnl_obj *ne, uint16_t attr);
void nftnl_obj_nlmsg_build_payload(struct nlmsghdr *nlh,
const struct nftnl_obj *ne);
@@ -167,7 +177,7 @@ struct nftnl_obj_list_iter *nftnl_obj_list_iter_create(struct nftnl_obj_list *l)
struct nftnl_obj *nftnl_obj_list_iter_next(struct nftnl_obj_list_iter *iter);
void nftnl_obj_list_iter_destroy(struct nftnl_obj_list_iter *iter);
-#ifdef __cplusplusg
+#ifdef __cplusplus
} /* extern "C" */
#endif
diff --git a/include/libnftnl/rule.h b/include/libnftnl/rule.h
index e5d1ca0..b6b93c6 100644
--- a/include/libnftnl/rule.h
+++ b/include/libnftnl/rule.h
@@ -51,6 +51,7 @@ uint32_t nftnl_rule_get_u32(const struct nftnl_rule *r, uint16_t attr);
uint64_t nftnl_rule_get_u64(const struct nftnl_rule *r, uint16_t attr);
void nftnl_rule_add_expr(struct nftnl_rule *r, struct nftnl_expr *expr);
+void nftnl_rule_del_expr(struct nftnl_expr *expr);
struct nlmsghdr;
diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h
index db3fa68..e2e5795 100644
--- a/include/libnftnl/set.h
+++ b/include/libnftnl/set.h
@@ -29,6 +29,9 @@ enum nftnl_set_attr {
NFTNL_SET_USERDATA,
NFTNL_SET_OBJ_TYPE,
NFTNL_SET_HANDLE,
+ NFTNL_SET_DESC_CONCAT,
+ NFTNL_SET_EXPR,
+ NFTNL_SET_EXPRESSIONS,
__NFTNL_SET_MAX
};
#define NFTNL_SET_MAX (__NFTNL_SET_MAX - 1)
@@ -78,6 +81,12 @@ int nftnl_set_list_foreach(struct nftnl_set_list *set_list, int (*cb)(struct nft
struct nftnl_set *nftnl_set_list_lookup_byname(struct nftnl_set_list *set_list,
const char *set);
+struct nftnl_expr;
+void nftnl_set_add_expr(struct nftnl_set *s, struct nftnl_expr *expr);
+int nftnl_set_expr_foreach(const struct nftnl_set *s,
+ int (*cb)(struct nftnl_expr *e, void *data),
+ void *data);
+
struct nftnl_set_list_iter;
struct nftnl_set_list_iter *nftnl_set_list_iter_create(const struct nftnl_set_list *l);
struct nftnl_set *nftnl_set_list_iter_cur(const struct nftnl_set_list_iter *iter);
@@ -104,6 +113,8 @@ enum {
NFTNL_SET_ELEM_USERDATA,
NFTNL_SET_ELEM_EXPR,
NFTNL_SET_ELEM_OBJREF,
+ NFTNL_SET_ELEM_KEY_END,
+ NFTNL_SET_ELEM_EXPRESSIONS,
__NFTNL_SET_ELEM_MAX
};
#define NFTNL_SET_ELEM_MAX (__NFTNL_SET_ELEM_MAX - 1)
@@ -133,13 +144,21 @@ bool nftnl_set_elem_is_set(const struct nftnl_set_elem *s, uint16_t attr);
#define nftnl_set_elem_nlmsg_build_hdr nftnl_nlmsg_build_hdr
void nftnl_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s);
void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set_elem *e);
+struct nlattr *nftnl_set_elem_nlmsg_build(struct nlmsghdr *nlh,
+ struct nftnl_set_elem *elem, int i);
int nftnl_set_elem_parse(struct nftnl_set_elem *e, enum nftnl_parse_type type,
const char *data, struct nftnl_parse_err *err);
int nftnl_set_elem_parse_file(struct nftnl_set_elem *e, enum nftnl_parse_type type,
FILE *fp, struct nftnl_parse_err *err);
int nftnl_set_elem_snprintf(char *buf, size_t size, const struct nftnl_set_elem *s, uint32_t type, uint32_t flags);
-int nftnl_set_elem_fprintf(FILE *fp, struct nftnl_set_elem *se, uint32_t type, uint32_t flags);
+int nftnl_set_elem_fprintf(FILE *fp, const struct nftnl_set_elem *se, uint32_t type, uint32_t flags);
+
+struct nftnl_expr;
+void nftnl_set_elem_add_expr(struct nftnl_set_elem *e, struct nftnl_expr *expr);
+int nftnl_set_elem_expr_foreach(struct nftnl_set_elem *e,
+ int (*cb)(struct nftnl_expr *e, void *data),
+ void *data);
int nftnl_set_elem_foreach(struct nftnl_set *s, int (*cb)(struct nftnl_set_elem *e, void *data), void *data);
diff --git a/include/libnftnl/table.h b/include/libnftnl/table.h
index 5faec81..d28c375 100644
--- a/include/libnftnl/table.h
+++ b/include/libnftnl/table.h
@@ -23,6 +23,8 @@ enum nftnl_table_attr {
NFTNL_TABLE_FLAGS,
NFTNL_TABLE_USE,
NFTNL_TABLE_HANDLE,
+ NFTNL_TABLE_USERDATA,
+ NFTNL_TABLE_OWNER,
__NFTNL_TABLE_MAX
};
#define NFTNL_TABLE_MAX (__NFTNL_TABLE_MAX - 1)
diff --git a/include/libnftnl/udata.h b/include/libnftnl/udata.h
index dd2f3df..dbf3a60 100644
--- a/include/libnftnl/udata.h
+++ b/include/libnftnl/udata.h
@@ -9,6 +9,18 @@
extern "C" {
#endif
+enum nftnl_udata_table_types {
+ NFTNL_UDATA_TABLE_COMMENT,
+ __NFTNL_UDATA_TABLE_MAX
+};
+#define NFTNL_UDATA_TABLE_MAX (__NFTNL_UDATA_TABLE_MAX - 1)
+
+enum nftnl_udata_chain_types {
+ NFTNL_UDATA_CHAIN_COMMENT,
+ __NFTNL_UDATA_CHAIN_MAX
+};
+#define NFTNL_UDATA_CHAIN_MAX (__NFTNL_UDATA_CHAIN_MAX - 1)
+
enum nftnl_udata_rule_types {
NFTNL_UDATA_RULE_COMMENT,
NFTNL_UDATA_RULE_EBTABLES_POLICY,
@@ -16,16 +28,34 @@ enum nftnl_udata_rule_types {
};
#define NFTNL_UDATA_RULE_MAX (__NFTNL_UDATA_RULE_MAX - 1)
+enum nftnl_udata_obj_types {
+ NFTNL_UDATA_OBJ_COMMENT,
+ __NFTNL_UDATA_OBJ_MAX
+};
+#define NFTNL_UDATA_OBJ_MAX (__NFTNL_UDATA_OBJ_MAX - 1)
+
#define NFTNL_UDATA_COMMENT_MAXLEN 128
enum nftnl_udata_set_types {
NFTNL_UDATA_SET_KEYBYTEORDER,
NFTNL_UDATA_SET_DATABYTEORDER,
NFTNL_UDATA_SET_MERGE_ELEMENTS,
+ NFTNL_UDATA_SET_KEY_TYPEOF,
+ NFTNL_UDATA_SET_DATA_TYPEOF,
+ NFTNL_UDATA_SET_EXPR,
+ NFTNL_UDATA_SET_DATA_INTERVAL,
+ NFTNL_UDATA_SET_COMMENT,
__NFTNL_UDATA_SET_MAX
};
#define NFTNL_UDATA_SET_MAX (__NFTNL_UDATA_SET_MAX - 1)
+enum {
+ NFTNL_UDATA_SET_TYPEOF_EXPR,
+ NFTNL_UDATA_SET_TYPEOF_DATA,
+ __NFTNL_UDATA_SET_TYPEOF_MAX,
+};
+#define NFTNL_UDATA_SET_TYPEOF_MAX (__NFTNL_UDATA_SET_TYPEOF_MAX - 1)
+
enum nftnl_udata_set_elem_types {
NFTNL_UDATA_SET_ELEM_COMMENT,
NFTNL_UDATA_SET_ELEM_FLAGS,
@@ -66,6 +96,11 @@ bool nftnl_udata_put_u32(struct nftnl_udata_buf *buf, uint8_t type,
bool nftnl_udata_put_strz(struct nftnl_udata_buf *buf, uint8_t type,
const char *strz);
+/* nest */
+struct nftnl_udata *nftnl_udata_nest_start(struct nftnl_udata_buf *buf,
+ uint8_t type);
+void nftnl_udata_nest_end(struct nftnl_udata_buf *buf, struct nftnl_udata *ud);
+
/* nftnl_udata_attr */
uint8_t nftnl_udata_type(const struct nftnl_udata *attr);
uint8_t nftnl_udata_len(const struct nftnl_udata *attr);
diff --git a/include/linux/netfilter/nf_log.h b/include/linux/netfilter/nf_log.h
index 8be21e0..2ae0093 100644
--- a/include/linux/netfilter/nf_log.h
+++ b/include/linux/netfilter/nf_log.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _NETFILTER_NF_LOG_H
#define _NETFILTER_NF_LOG_H
@@ -9,4 +10,6 @@
#define NF_LOG_MACDECODE 0x20 /* Decode MAC header */
#define NF_LOG_MASK 0x2f
+#define NF_LOG_PREFIXLEN 128
+
#endif /* _NETFILTER_NF_LOG_H */
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 81c27d3..c48b193 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -48,6 +48,7 @@ enum nft_registers {
#define NFT_REG_SIZE 16
#define NFT_REG32_SIZE 4
+#define NFT_REG32_COUNT (NFT_REG32_15 - NFT_REG32_00 + 1)
/**
* enum nft_verdicts - nf_tables internal verdicts
@@ -132,7 +133,7 @@ enum nf_tables_msg_types {
* @NFTA_LIST_ELEM: list element (NLA_NESTED)
*/
enum nft_list_attributes {
- NFTA_LIST_UNPEC,
+ NFTA_LIST_UNSPEC,
NFTA_LIST_ELEM,
__NFTA_LIST_MAX
};
@@ -163,7 +164,10 @@ enum nft_hook_attributes {
*/
enum nft_table_flags {
NFT_TABLE_F_DORMANT = 0x1,
+ NFT_TABLE_F_OWNER = 0x2,
};
+#define NFT_TABLE_F_MASK (NFT_TABLE_F_DORMANT | \
+ NFT_TABLE_F_OWNER)
/**
* enum nft_table_attributes - nf_tables table netlink attributes
@@ -171,6 +175,8 @@ enum nft_table_flags {
* @NFTA_TABLE_NAME: name of the table (NLA_STRING)
* @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
* @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
+ * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
+ * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
*/
enum nft_table_attributes {
NFTA_TABLE_UNSPEC,
@@ -179,10 +185,21 @@ enum nft_table_attributes {
NFTA_TABLE_USE,
NFTA_TABLE_HANDLE,
NFTA_TABLE_PAD,
+ NFTA_TABLE_USERDATA,
+ NFTA_TABLE_OWNER,
__NFTA_TABLE_MAX
};
#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
+enum nft_chain_flags {
+ NFT_CHAIN_BASE = (1 << 0),
+ NFT_CHAIN_HW_OFFLOAD = (1 << 1),
+ NFT_CHAIN_BINDING = (1 << 2),
+};
+#define NFT_CHAIN_FLAGS (NFT_CHAIN_BASE | \
+ NFT_CHAIN_HW_OFFLOAD | \
+ NFT_CHAIN_BINDING)
+
/**
* enum nft_chain_attributes - nf_tables chain netlink attributes
*
@@ -195,6 +212,8 @@ enum nft_table_attributes {
* @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
* @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
* @NFTA_CHAIN_FLAGS: chain flags
+ * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
+ * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
*/
enum nft_chain_attributes {
NFTA_CHAIN_UNSPEC,
@@ -208,6 +227,8 @@ enum nft_chain_attributes {
NFTA_CHAIN_COUNTERS,
NFTA_CHAIN_PAD,
NFTA_CHAIN_FLAGS,
+ NFTA_CHAIN_ID,
+ NFTA_CHAIN_USERDATA,
__NFTA_CHAIN_MAX
};
#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
@@ -237,6 +258,7 @@ enum nft_rule_attributes {
NFTA_RULE_PAD,
NFTA_RULE_ID,
NFTA_RULE_POSITION_ID,
+ NFTA_RULE_CHAIN_ID,
__NFTA_RULE_MAX
};
#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
@@ -275,6 +297,8 @@ enum nft_rule_compat_attributes {
* @NFT_SET_TIMEOUT: set uses timeouts
* @NFT_SET_EVAL: set can be updated from the evaluation path
* @NFT_SET_OBJECT: set contains stateful objects
+ * @NFT_SET_CONCAT: set contains a concatenation
+ * @NFT_SET_EXPR: set contains expressions
*/
enum nft_set_flags {
NFT_SET_ANONYMOUS = 0x1,
@@ -284,6 +308,8 @@ enum nft_set_flags {
NFT_SET_TIMEOUT = 0x10,
NFT_SET_EVAL = 0x20,
NFT_SET_OBJECT = 0x40,
+ NFT_SET_CONCAT = 0x80,
+ NFT_SET_EXPR = 0x100,
};
/**
@@ -301,15 +327,29 @@ enum nft_set_policies {
* enum nft_set_desc_attributes - set element description
*
* @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
+ * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
*/
enum nft_set_desc_attributes {
NFTA_SET_DESC_UNSPEC,
NFTA_SET_DESC_SIZE,
+ NFTA_SET_DESC_CONCAT,
__NFTA_SET_DESC_MAX
};
#define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1)
/**
+ * enum nft_set_field_attributes - attributes of concatenated fields
+ *
+ * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
+ */
+enum nft_set_field_attributes {
+ NFTA_SET_FIELD_UNSPEC,
+ NFTA_SET_FIELD_LEN,
+ __NFTA_SET_FIELD_MAX
+};
+#define NFTA_SET_FIELD_MAX (__NFTA_SET_FIELD_MAX - 1)
+
+/**
* enum nft_set_attributes - nf_tables set netlink attributes
*
* @NFTA_SET_TABLE: table name (NLA_STRING)
@@ -327,6 +367,8 @@ enum nft_set_desc_attributes {
* @NFTA_SET_USERDATA: user data (NLA_BINARY)
* @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
* @NFTA_SET_HANDLE: set handle (NLA_U64)
+ * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
+ * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
*/
enum nft_set_attributes {
NFTA_SET_UNSPEC,
@@ -346,6 +388,8 @@ enum nft_set_attributes {
NFTA_SET_PAD,
NFTA_SET_OBJ_TYPE,
NFTA_SET_HANDLE,
+ NFTA_SET_EXPR,
+ NFTA_SET_EXPRESSIONS,
__NFTA_SET_MAX
};
#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
@@ -354,9 +398,11 @@ enum nft_set_attributes {
* enum nft_set_elem_flags - nf_tables set element flags
*
* @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
+ * @NFT_SET_ELEM_CATCHALL: special catch-all element
*/
enum nft_set_elem_flags {
NFT_SET_ELEM_INTERVAL_END = 0x1,
+ NFT_SET_ELEM_CATCHALL = 0x2,
};
/**
@@ -370,6 +416,8 @@ enum nft_set_elem_flags {
* @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
* @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
* @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
+ * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
+ * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
*/
enum nft_set_elem_attributes {
NFTA_SET_ELEM_UNSPEC,
@@ -382,6 +430,8 @@ enum nft_set_elem_attributes {
NFTA_SET_ELEM_EXPR,
NFTA_SET_ELEM_PAD,
NFTA_SET_ELEM_OBJREF,
+ NFTA_SET_ELEM_KEY_END,
+ NFTA_SET_ELEM_EXPRESSIONS,
__NFTA_SET_ELEM_MAX
};
#define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
@@ -447,11 +497,13 @@ enum nft_data_attributes {
*
* @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
* @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
+ * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
*/
enum nft_verdict_attributes {
NFTA_VERDICT_UNSPEC,
NFTA_VERDICT_CODE,
NFTA_VERDICT_CHAIN,
+ NFTA_VERDICT_CHAIN_ID,
__NFTA_VERDICT_MAX
};
#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
@@ -485,6 +537,20 @@ enum nft_immediate_attributes {
#define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1)
/**
+ * enum nft_bitwise_ops - nf_tables bitwise operations
+ *
+ * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
+ * XOR boolean operations
+ * @NFT_BITWISE_LSHIFT: left-shift operation
+ * @NFT_BITWISE_RSHIFT: right-shift operation
+ */
+enum nft_bitwise_ops {
+ NFT_BITWISE_BOOL,
+ NFT_BITWISE_LSHIFT,
+ NFT_BITWISE_RSHIFT,
+};
+
+/**
* enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
*
* @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
@@ -492,16 +558,20 @@ enum nft_immediate_attributes {
* @NFTA_BITWISE_LEN: length of operands (NLA_U32)
* @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
* @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
+ * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
+ * @NFTA_BITWISE_DATA: argument for non-boolean operations
+ * (NLA_NESTED: nft_data_attributes)
*
- * The bitwise expression performs the following operation:
+ * The bitwise expression supports boolean and shift operations. It implements
+ * the boolean operations by performing the following operation:
*
* dreg = (sreg & mask) ^ xor
*
- * which allow to express all bitwise operations:
+ * with these mask and xor values:
*
* mask xor
* NOT: 1 1
- * OR: 0 x
+ * OR: ~x x
* XOR: 1 x
* AND: x 0
*/
@@ -512,6 +582,8 @@ enum nft_bitwise_attributes {
NFTA_BITWISE_LEN,
NFTA_BITWISE_MASK,
NFTA_BITWISE_XOR,
+ NFTA_BITWISE_OP,
+ NFTA_BITWISE_DATA,
__NFTA_BITWISE_MAX
};
#define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1)
@@ -643,6 +715,7 @@ enum nft_dynset_ops {
enum nft_dynset_flags {
NFT_DYNSET_F_INV = (1 << 0),
+ NFT_DYNSET_F_EXPR = (1 << 1),
};
/**
@@ -656,6 +729,7 @@ enum nft_dynset_flags {
* @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
* @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
* @NFTA_DYNSET_FLAGS: flags (NLA_U32)
+ * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
*/
enum nft_dynset_attributes {
NFTA_DYNSET_UNSPEC,
@@ -668,6 +742,7 @@ enum nft_dynset_attributes {
NFTA_DYNSET_EXPR,
NFTA_DYNSET_PAD,
NFTA_DYNSET_FLAGS,
+ NFTA_DYNSET_EXPRESSIONS,
__NFTA_DYNSET_MAX,
};
#define NFTA_DYNSET_MAX (__NFTA_DYNSET_MAX - 1)
@@ -678,11 +753,14 @@ enum nft_dynset_attributes {
* @NFT_PAYLOAD_LL_HEADER: link layer header
* @NFT_PAYLOAD_NETWORK_HEADER: network header
* @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
+ * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
*/
enum nft_payload_bases {
NFT_PAYLOAD_LL_HEADER,
NFT_PAYLOAD_NETWORK_HEADER,
NFT_PAYLOAD_TRANSPORT_HEADER,
+ NFT_PAYLOAD_INNER_HEADER,
+ NFT_PAYLOAD_TUN_HEADER,
};
/**
@@ -690,16 +768,43 @@ enum nft_payload_bases {
*
* @NFT_PAYLOAD_CSUM_NONE: no checksumming
* @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
+ * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
*/
enum nft_payload_csum_types {
NFT_PAYLOAD_CSUM_NONE,
NFT_PAYLOAD_CSUM_INET,
+ NFT_PAYLOAD_CSUM_SCTP,
};
enum nft_payload_csum_flags {
NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
};
+enum nft_inner_type {
+ NFT_INNER_UNSPEC = 0,
+ NFT_INNER_VXLAN,
+};
+
+enum nft_inner_flags {
+ NFT_INNER_HDRSIZE = (1 << 0),
+ NFT_INNER_LL = (1 << 1),
+ NFT_INNER_NH = (1 << 2),
+ NFT_INNER_TH = (1 << 3),
+};
+#define NFT_INNER_MASK (NFT_INNER_HDRSIZE | NFT_INNER_LL | \
+ NFT_INNER_NH | NFT_INNER_TH)
+
+enum nft_inner_attributes {
+ NFTA_INNER_UNSPEC,
+ NFTA_INNER_NUM,
+ NFTA_INNER_TYPE,
+ NFTA_INNER_FLAGS,
+ NFTA_INNER_HDRSIZE,
+ NFTA_INNER_EXPR,
+ __NFTA_INNER_MAX
+};
+#define NFTA_INNER_MAX (__NFTA_INNER_MAX - 1)
+
/**
* enum nft_payload_attributes - nf_tables payload expression netlink attributes
*
@@ -736,11 +841,13 @@ enum nft_exthdr_flags {
* @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
* @NFT_EXTHDR_OP_TCP: match against tcp options
* @NFT_EXTHDR_OP_IPV4: match against ipv4 options
+ * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
*/
enum nft_exthdr_op {
NFT_EXTHDR_OP_IPV6,
NFT_EXTHDR_OP_TCPOPT,
NFT_EXTHDR_OP_IPV4,
+ NFT_EXTHDR_OP_SCTP,
__NFT_EXTHDR_OP_MAX
};
#define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1)
@@ -805,6 +912,9 @@ enum nft_exthdr_attributes {
* @NFT_META_TIME_NS: time since epoch (in nanoseconds)
* @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
* @NFT_META_TIME_HOUR: hour of day (in seconds)
+ * @NFT_META_SDIF: slave device interface index
+ * @NFT_META_SDIFNAME: slave device interface name
+ * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -815,7 +925,8 @@ enum nft_meta_keys {
NFT_META_OIF,
NFT_META_IIFNAME,
NFT_META_OIFNAME,
- NFT_META_IIFTYPE,
+ NFT_META_IFTYPE,
+#define NFT_META_IIFTYPE NFT_META_IFTYPE
NFT_META_OIFTYPE,
NFT_META_SKUID,
NFT_META_SKGID,
@@ -840,6 +951,10 @@ enum nft_meta_keys {
NFT_META_TIME_NS,
NFT_META_TIME_DAY,
NFT_META_TIME_HOUR,
+ NFT_META_SDIF,
+ NFT_META_SDIFNAME,
+ NFT_META_BRI_BROUTE,
+ __NFT_META_IIFTYPE,
};
/**
@@ -935,11 +1050,13 @@ enum nft_rt_attributes {
*
* @NFTA_SOCKET_KEY: socket key to match
* @NFTA_SOCKET_DREG: destination register
+ * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
*/
enum nft_socket_attributes {
NFTA_SOCKET_UNSPEC,
NFTA_SOCKET_KEY,
NFTA_SOCKET_DREG,
+ NFTA_SOCKET_LEVEL,
__NFTA_SOCKET_MAX
};
#define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1)
@@ -949,10 +1066,14 @@ enum nft_socket_attributes {
*
* @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
* @NFT_SOCKET_MARK: Value of the socket mark
+ * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
+ * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
*/
enum nft_socket_keys {
NFT_SOCKET_TRANSPARENT,
NFT_SOCKET_MARK,
+ NFT_SOCKET_WILDCARD,
+ NFT_SOCKET_CGROUPV2,
__NFT_SOCKET_MAX
};
#define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1)
@@ -1107,6 +1228,21 @@ enum nft_counter_attributes {
#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
/**
+ * enum nft_last_attributes - nf_tables last expression netlink attributes
+ *
+ * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
+ * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
+ */
+enum nft_last_attributes {
+ NFTA_LAST_UNSPEC,
+ NFTA_LAST_SET,
+ NFTA_LAST_MSECS,
+ NFTA_LAST_PAD,
+ __NFTA_LAST_MAX
+};
+#define NFTA_LAST_MAX (__NFTA_LAST_MAX - 1)
+
+/**
* enum nft_log_attributes - nf_tables log expression netlink attributes
*
* @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
@@ -1496,6 +1632,7 @@ enum nft_ct_expectation_attributes {
* @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
* @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
* @NFTA_OBJ_HANDLE: object handle (NLA_U64)
+ * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
*/
enum nft_object_attributes {
NFTA_OBJ_UNSPEC,
@@ -1506,11 +1643,25 @@ enum nft_object_attributes {
NFTA_OBJ_USE,
NFTA_OBJ_HANDLE,
NFTA_OBJ_PAD,
+ NFTA_OBJ_USERDATA,
__NFTA_OBJ_MAX
};
#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
/**
+ * enum nft_flowtable_flags - nf_tables flowtable flags
+ *
+ * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
+ * @NFT_FLOWTABLE_COUNTER: enable flow counters
+ */
+enum nft_flowtable_flags {
+ NFT_FLOWTABLE_HW_OFFLOAD = 0x1,
+ NFT_FLOWTABLE_COUNTER = 0x2,
+ NFT_FLOWTABLE_MASK = (NFT_FLOWTABLE_HW_OFFLOAD |
+ NFT_FLOWTABLE_COUNTER)
+};
+
+/**
* enum nft_flowtable_attributes - nf_tables flow table netlink attributes
*
* @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
@@ -1518,7 +1669,6 @@ enum nft_object_attributes {
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
* @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
- * @NFTA_FLOWTABLE_SIZE: maximum size (NLA_U32)
* @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
*/
enum nft_flowtable_attributes {
@@ -1529,7 +1679,6 @@ enum nft_flowtable_attributes {
NFTA_FLOWTABLE_USE,
NFTA_FLOWTABLE_HANDLE,
NFTA_FLOWTABLE_PAD,
- NFTA_FLOWTABLE_SIZE,
NFTA_FLOWTABLE_FLAGS,
__NFTA_FLOWTABLE_MAX
};
@@ -1731,6 +1880,7 @@ enum nft_tunnel_opts_attributes {
NFTA_TUNNEL_KEY_OPTS_UNSPEC,
NFTA_TUNNEL_KEY_OPTS_VXLAN,
NFTA_TUNNEL_KEY_OPTS_ERSPAN,
+ NFTA_TUNNEL_KEY_OPTS_GENEVE,
__NFTA_TUNNEL_KEY_OPTS_MAX
};
#define NFTA_TUNNEL_KEY_OPTS_MAX (__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
@@ -1752,6 +1902,15 @@ enum nft_tunnel_opts_erspan_attributes {
};
#define NFTA_TUNNEL_KEY_ERSPAN_MAX (__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
+enum nft_tunnel_opts_geneve_attributes {
+ NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
+ NFTA_TUNNEL_KEY_GENEVE_CLASS,
+ NFTA_TUNNEL_KEY_GENEVE_TYPE,
+ NFTA_TUNNEL_KEY_GENEVE_DATA,
+ __NFTA_TUNNEL_KEY_GENEVE_MAX
+};
+#define NFTA_TUNNEL_KEY_GENEVE_MAX (__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
+
enum nft_tunnel_flags {
NFT_TUNNEL_F_ZERO_CSUM_TX = (1 << 0),
NFT_TUNNEL_F_DONT_FRAGMENT = (1 << 1),
diff --git a/include/obj.h b/include/obj.h
index 10f806c..d217737 100644
--- a/include/obj.h
+++ b/include/obj.h
@@ -22,6 +22,11 @@ struct nftnl_obj {
uint32_t flags;
uint64_t handle;
+ struct {
+ void *data;
+ uint32_t len;
+ } user;
+
union {
struct nftnl_obj_counter {
uint64_t pkts;
@@ -99,12 +104,13 @@ struct obj_ops {
const char *name;
uint32_t type;
size_t alloc_len;
- int max_attr;
+ int nftnl_max_attr;
+ struct attr_policy *attr_policy;
int (*set)(struct nftnl_obj *e, uint16_t type, const void *data, uint32_t data_len);
const void *(*get)(const struct nftnl_obj *e, uint16_t type, uint32_t *data_len);
int (*parse)(struct nftnl_obj *e, struct nlattr *attr);
void (*build)(struct nlmsghdr *nlh, const struct nftnl_obj *e);
- int (*snprintf)(char *buf, size_t len, uint32_t type, uint32_t flags, const struct nftnl_obj *e);
+ int (*output)(char *buf, size_t len, uint32_t flags, const struct nftnl_obj *e);
};
extern struct obj_ops obj_ops_counter;
diff --git a/include/set.h b/include/set.h
index 446acd2..55018b6 100644
--- a/include/set.h
+++ b/include/set.h
@@ -25,12 +25,15 @@ struct nftnl_set {
enum nft_set_policies policy;
struct {
uint32_t size;
+ uint8_t field_len[NFT_REG32_COUNT];
+ uint8_t field_count;
} desc;
struct list_head element_list;
uint32_t flags;
uint32_t gc_interval;
uint64_t timeout;
+ struct list_head expr_list;
};
struct nftnl_set_list;
diff --git a/include/set_elem.h b/include/set_elem.h
index cc4d529..7628005 100644
--- a/include/set_elem.h
+++ b/include/set_elem.h
@@ -8,8 +8,9 @@ struct nftnl_set_elem {
uint32_t set_elem_flags;
uint32_t flags;
union nftnl_data_reg key;
+ union nftnl_data_reg key_end;
union nftnl_data_reg data;
- struct nftnl_expr *expr;
+ struct list_head expr_list;
uint64_t timeout;
uint64_t expiration;
const char *objref;
@@ -19,4 +20,7 @@ struct nftnl_set_elem {
} user;
};
+int nftnl_set_elem_snprintf_default(char *buf, size_t size,
+ const struct nftnl_set_elem *e);
+
#endif
diff --git a/include/utils.h b/include/utils.h
index 91fbebb..eed6127 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -12,6 +12,7 @@
# define __visible __attribute__((visibility("default")))
# define EXPORT_SYMBOL(x) typeof(x) (x) __visible;
#else
+# define __visible
# define EXPORT_SYMBOL
#endif
@@ -36,9 +37,9 @@ void __nftnl_assert_fail(uint16_t attr, const char *filename, int line);
#define nftnl_assert_validate(data, _validate_array, _attr, _data_len) \
({ \
if (!data) \
- __nftnl_assert_fail(attr, __FILE__, __LINE__); \
+ __nftnl_assert_fail(_attr, __FILE__, __LINE__); \
if (_validate_array[_attr]) \
- nftnl_assert(data, attr, _validate_array[_attr] == _data_len); \
+ nftnl_assert(data, _attr, _validate_array[_attr] == _data_len); \
})
void __nftnl_assert_attr_exists(uint16_t attr, uint16_t attr_max,
@@ -67,27 +68,8 @@ void __nftnl_assert_attr_exists(uint16_t attr, uint16_t attr_max,
#define array_size(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
const char *nftnl_family2str(uint32_t family);
-int nftnl_str2family(const char *family);
-
-enum nftnl_type {
- NFTNL_TYPE_U8,
- NFTNL_TYPE_U16,
- NFTNL_TYPE_U32,
- NFTNL_TYPE_U64,
- NFTNL_TYPE_S8,
- NFTNL_TYPE_S16,
- NFTNL_TYPE_S32,
- NFTNL_TYPE_S64,
-};
-
-int nftnl_strtoi(const char *string, int base, void *number, enum nftnl_type type);
-int nftnl_get_value(enum nftnl_type type, void *val, void *out);
const char *nftnl_verdict2str(uint32_t verdict);
-int nftnl_str2verdict(const char *verdict, int *verdict_num);
-
-const char *nftnl_cmd2tag(enum nftnl_cmd_type cmd);
-uint32_t nftnl_str2cmd(const char *cmd);
enum nftnl_cmd_type nftnl_flag2cmd(uint32_t flags);
@@ -97,4 +79,7 @@ int nftnl_fprintf(FILE *fpconst, const void *obj, uint32_t cmd, uint32_t type,
uint32_t cmd, uint32_t type,
uint32_t flags));
+int nftnl_set_str_attr(const char **dptr, uint32_t *flags,
+ uint16_t attr, const void *data, uint32_t data_len);
+
#endif