summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* chain: remove duplicated policy2strÁlvaro Neira Ayuso2013-07-311-15/+2
| | | | | | | Use nft_verdict2str function instead. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove version from XML and JSON representationsPablo Neira Ayuso2013-07-2667-146/+73
| | | | | | | | | | | | | | | | | | | | | | This patch removes the version XML node and the version JSON field in all our existing objects. The current versioning approach consists of adding a version field to every object representation in XML and JSON. While listing my entire rule-set, one can notice that this approach is too bloated. Once the library enters stable stage, if we need to obsolete a XML node and a JSON field, we can follow this procedure: 1) Remove the XML node and the JSON field from the output, so fresh outputs will not contain the old ones anymore. 2) Do not remove the parsing of the old XML node and the JSON field inmediately. We have to keep supporting the parsing for a while to avoid breaking the interpretion of old XML/JSON files. We can spot a warning to warn about it, so users generate a fresh output again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add XML parsingArturo Borrero2013-07-269-1/+367
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sets are now parsed, following this previous snprintf pattern: <set> <set_name>string</set_name> <set_table>table</set_table> <set_xml_version>int</set_xml_version> <set_flags>uint32_t</set_flags> <key_type>uint32_t</key_type> <key_len>size_t</key_len> <data_type>uint32_t</data_type> <data_len>size_t</data_len> <set_elem> <set_elem_flags>uint32_t</set_elem_flags> <set_elem_key> <data_reg type="value"> <len></len> <dataN></dataN> </data_reg> </set_elem_key> <set_elem_data> <data_reg type="xx"> [...] </data_reg> </set_elem_data> </set_elem> </set> Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: xml: change XML attributes to nodes.Arturo Borrero2013-07-261-14/+12
| | | | | | | | | | | | | | | | This patch changes all XML attributes to XML nodes in nft_set. In order to avoid issues regarding XML nodes with the same name but different meanings, I've followed this pattern for the new elements: <set> <set_table>string</set_table> <set_name>string</set_name> [...] </set> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: json: fix returned errno value while parsingPablo Neira Ayuso2013-07-252-21/+20
| | | | | | | Instead of returning ERANGE all the time, let functions set errno accordingly and set EINVAL otherwise. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: Add nft-table-json-addÁlvaro Neira Ayuso2013-07-252-0/+120
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: table: test json parsing supportÁlvaro Neira Ayuso2013-07-254-1/+52
| | | | | | | Test the functions for parsing tables in JSON Support Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Add json parser supportÁlvaro Neira Ayuso2013-07-257-26/+206
| | | | | | | Add function for parsing tables in format JSON Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: xml: add realistic XML tests filesArturo Borrero2013-07-2552-120/+1295
| | | | | | | | | | | | | | | | | | | | This patch refresh current XML testfiles with some realworld expressions extracted from rules. The nft instruction itself is added as a comment for future references. All XMl files are now indented with tabs instead of spaces. Also, a bunch of new realworld rules with mixed expressions are added. I used this command to get the XML formatted with tabs: $ export XMLLINT_INDENT=$'\t' $ xmllint --format file.xml The xmllint tool is included in the libxml2-utils package (at least on debian systems). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* immediate: xml: fix name inconsistencyArturo Borrero2013-07-251-1/+2
| | | | | | | | | | <immdata> should be <immediatedata> instead. This bug was introduced at (1e8e5d4 src: xml: consolidate parsing of data_reg via nft_mxml_data_reg_parse). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: nft_str2family sets errnoPablo Neira Ayuso2013-07-251-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: utils: add verdict2str and use itArturo Borrero2013-07-253-31/+62
| | | | | | | | | | | | Add verdict2str() and str2verdict() helper functions and use in XML. While at it, I've fixed a small style issue in the data_reg JSON output and a bug in the data_reg XML parser: The parser walked the top level tree, instead of single <data_reg> node. Introduced in (51370f0 src: add support for XML parsing). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: don't override errno value if nft_mxml_num_parse is usedPablo Neira Ayuso2013-07-253-13/+9
| | | | | | That function already sets errno for us. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mxml: nft_mxml_str_parse returns copy of the stringPablo Neira Ayuso2013-07-252-2/+2
| | | | | | | | | | | Otherwise, the string points to an invalid memory position somewhere in the XML tree that is released after the parsing. This problem was there before the conversion to the new helper function nft_mxml_str_parse. Reported-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: ct: use nft_mxml_str_parsePablo Neira Ayuso2013-07-251-5/+5
| | | | | | Replace existing code to use this function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: payload: use nft_mxml_num_parsePablo Neira Ayuso2013-07-251-22/+8
| | | | | | Replace existing code to use this function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: consolidate common XML code via nft_mxml_str_parsePablo Neira Ayuso2013-07-2512-105/+109
| | | | | | This patch moves common XML string parsing code to nft_mxml_str_parse(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: cmp: cmpdata is mandatory nodePablo Neira Ayuso2013-07-251-8/+4
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: counter: use nft_mxml_num_parsePablo Neira Ayuso2013-07-251-25/+10
| | | | | | Put this code on a diet by using the new helper function nft_mxml_num_parse. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: consolidate common XML code via nft_mxml_num_parseArturo Borrero2013-07-2513-149/+158
| | | | | | | | | | | This patch moves common XML parsing code to nft_mxml_num_parse(). To handle this, the nft_strtoi() helper fuction is included. I've changed some MXML_DESCEND[_FIRST] flags to avoid match a nested node under some circumstances, ie, matching two nodes with the same name that are descendant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: refactor nft_rule_expr_getPablo Neira Ayuso2013-07-211-8/+6
| | | | | | Merge common checking for attribute set in nft_rule_expr_get. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove default case from nft_*_attr_unsetPablo Neira Ayuso2013-07-213-29/+28
| | | | | | | | This patch removes the default case in nft_*_attr_unset, thus, the compiler will spot a warning if we add a new attribute in the future and you forget to handle it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify parameter of nft_*_is_setEric Leblond2013-07-199-10/+10
| | | | | | | | The functions nft_*_attr_is_set() is doing no modification so it is possible to type it to const. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: display position in default printfEric Leblond2013-07-191-2/+2
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: add insert rule exampleEric Leblond2013-07-192-0/+208
| | | | | | | | This program can insert a rule after a rule given by its handle. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add support for position attributeEric Leblond2013-07-193-0/+21
| | | | | | | | This patch adds support for position attribute which can be used to insert a rule at a given position. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify getter logicPablo Neira Ayuso2013-07-1821-477/+160
| | | | | | | | This patch refactors the getter code to simplify it. The default cases have been removed so gcc will spot a warning if an attribute is not handled appropriately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-add: allow to create custom chainsPablo Neira Ayuso2013-07-181-18/+23
| | | | | | | So far, it was only possible to create base chains. This patch allows you to create custom chains as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-get: allow to list chain from all familiesPablo Neira Ayuso2013-07-181-23/+23
| | | | | | So far, it was restricted to AF_INET. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: add arp supportPablo Neira Ayuso2013-07-1815-60/+103
| | | | | | While at it, convert all examples to use NFPROTO_*. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: ARP family is number 3Pablo Neira Ayuso2013-07-181-1/+1
| | | | | | | Netfilter uses family number 3 for ARP since AF_ARP does not exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: json: fix wrong display of table and familyÁlvaro Neira Ayuso2013-07-181-2/+2
| | | | | | | | | In (74ccff7 chain: json: use string to identify policy), the json support for chain was unintentionally swapping the table name and the family. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_add_tailPablo Neira Ayuso2013-07-169-4/+36
| | | | | | | This redefines the meaning of nft_*_list_add to prepend, before this patch it was appending, which was semantically wrong. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: json: use string to identify policyÁlvaro Neira Ayuso2013-07-161-26/+40
| | | | | | | | | * if we don't have hooknum we don't need to print the policy tag * If we have hooknum, i have used the policy2str function for printing the policy with "accept" string or "drop" string Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: json: fix incomplete outputÁlvaro Neira Ayuso2013-07-163-28/+46
| | | | | | | | | | | In (bf39c53 set: add json output), the json support for sets was incomplete: * version, family, key_type, key_len, data_type, data_len were not included. * Now I use nft_data_reg_snprintf for printing the key and data Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: limit: fix getterPablo Neira Ayuso2013-07-151-4/+6
| | | | | | Set missing data length via getter, otherwise it returns zero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_is_empty() functionsArturo Borrero2013-07-159-0/+32
| | | | | | | | | This functions check if a given nft_*_list is empty or not. I found this quite useful while working with a full ruleset. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: update include/linux/netfilter/nf_tables.hPablo Neira Ayuso2013-07-131-3/+211
| | | | | | Get it in sync with the current kernel tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add nft_expr_data to replace explicit casting to obtain expression dataPablo Neira Ayuso2013-07-1316-98/+97
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: use __attribute__((constructor)) to register expressionPablo Neira Ayuso2013-07-1318-39/+89
| | | | | | Instead of manual array registration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-{table,chain,rule}-xml-add: fix missing NLM_F_CREATEPablo Neira Ayuso2013-07-103-20/+22
| | | | | | | | | | | | | | | | | | Thus, automodule loading was not working. While at it, apply not so relevant comestic cleanups and fix some inconsistencies between examples. * Fix copyright header, this is code heavily based on existing nft-*-add examples. * Remove unrequired extern struct nft_table definition. * Make sure we close file descriptor once we don't need it anymore. * Remove unrequired casting. * Remove comment that provides nothing interesting. I considered a patch to address each on those was too much burden. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: payload: fix incorrect length and base in default outputEric Leblond2013-07-101-2/+2
| | | | | | | | This patch fixes an accidental swapping of the dreg and length payload fields. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: remove LIBXML_LIBS from LDADDPablo Neira Ayuso2013-07-101-21/+21
| | | | | | | | Remove it from the example files, we don't need it. There is no explicit reference to any of the libmxml functions in those files, so the linker does not need that library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: payload: fix printing of basePablo Neira Ayuso2013-07-091-2/+16
| | | | | | | In (f95e859 src: improve default text output), it assumes all bases are network, but we may have link and transport as well. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bitwise: xml: export len nodeArturo Borrero2013-07-082-2/+4
| | | | | | | Fix missing length, it was not being exported in XML. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@soleta.eu>
* set: add xml outputArturo Borrero2013-07-066-5/+114
| | | | | | | This patch adds XML output for sets. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: consolidate parsing of data_reg via nft_mxml_data_reg_parseArturo Borrero2013-07-065-80/+74
| | | | | | | | Move common code for XML parsing of data_reg to the new nft_mxml_data_reg_parse function. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-get: add json supportÁlvaro Neira Ayuso2013-07-061-5/+22
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add json outputÁlvaro Neira Ayuso2013-07-065-14/+128
| | | | | | | This patch allows you to dump set and their content in json format. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix printing of key and data registersPablo Neira Ayuso2013-07-061-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>