summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* set: add set ID supportPablo Neira Ayuso2014-05-193-0/+8
| | | | | | | Add the set ID (u32) which allows us to uniquely identify the set in the batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: synchronize nf_tables.h with nftables treePablo Neira Ayuso2014-05-191-2/+28
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flag to add event wrapping in output functionsArturo Borrero2014-04-261-0/+6
| | | | | | | | | | | | | | This patch uses the flag option of each output function to print an event wrapper string in each object. In order to use this functionality, the caller must pass the corresponding flags: NFT_OF_EVENT_NEW / NFT_OF_EVENT_DEL. (I have slightly refactorized the original code to add the xml/json header and footer --pablo). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-241-0/+4
| | | | | | | | | Add support for dedicated bridge meta key, related to device names: - NFT_META_BRI_IIFNAME - NFT_META_BRI_OIFNAME Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add missing netfilter.hPablo Neira Ayuso2014-04-171-0/+2
| | | | | | | | | | | | | | | | CC chain.lo ../../src/chain.c: In function 'nft_hooknum2str': ../../src/chain.c:53:7: error: 'NFPROTO_INET' undeclared (first use in this function) ../../src/chain.c:53:7: note: each undeclared identifier is reported only once for each function it appears in make[3]: *** [chain.lo] Error 1 make[3]: se sale del directorio `/home/pablo/devel/scm/git-netfilter/libnftnl/libnftnl-1.0.1/_build/src' make[2]: *** [all-recursive] Error 1 make[2]: se sale del directorio `/home/pablo/devel/scm/git-netfilter/libnftnl/libnftnl-1.0.1/_build' make[1]: *** [all] Error 2 make[1]: se sale del directorio `/home/pablo/devel/scm/git-netfilter/libnftnl/libnftnl-1.0.1/_build' make: *** [distcheck] Error 1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elems: delete unexisting exported symbolArturo Borrero2014-03-261-2/+0
| | | | | | | There is no function called 'nft_set_elem_nlmsg_parse()' Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add NFT_RULE_ATTR_USERDATA supportPablo Neira Ayuso2014-02-272-1/+5
| | | | | | This allows us to manipulate the user data area of the rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: get linux/netfilter/nf_tables.h in sync with kernel headerPablo Neira Ayuso2014-02-271-1/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_attr_{set|get}_data interfacePablo Neira Ayuso2014-02-275-0/+18
| | | | | | | | | | | | This patch adds two functions that allows you to validate the size of the attribute. This new functions provide a replacement for nft_rule_attr_set and nft_rule_attr_get. The data_len parameter was already passed to the {_set|_get} funcion in expressions. For consistency, add nft_rule_expr_{set|get}_data alias. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: early attribute type validation in nft_*_attr_setPablo Neira Ayuso2014-02-274-0/+8
| | | | | | | | This allows us to remove the default case in the switch, which show help to spot missing attribute support since gcc will spot a compilation warning. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add conntrack label match supportFlorian Westphal2014-02-181-0/+2
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* Merge branch 'master' into next-3.14Pablo Neira Ayuso2014-02-0314-55/+384
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch includes changes to adapt this branch to the library rename that happened in the master branch. Conflicts: src/Makefile.am src/expr/cmp.c src/expr/ct.c src/expr/data_reg.c src/expr/meta.c tests/jsonfiles/01-table.json tests/jsonfiles/02-table.json tests/jsonfiles/64-ruleset.json tests/xmlfiles/01-table.xml tests/xmlfiles/02-table.xml
| * include: add cached copy of linux/kernel.hPablo Neira Ayuso2014-01-221-0/+29
| | | | | | | | | | | | | | | | | | | | | | This fixes the following compilation warning when compiling with old kernel headers. CC expr/target.lo expr/target.c: In function ‘nft_rule_expr_target_build’: expr/target.c:127: warning: implicit declaration of function ‘__ALIGN_KERNEL’ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * include: add stdint.h to common.hArturo Borrero2014-01-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This fixes: /usr/local/include/libnftnl/common.h:25:49: error: unknown type name ‘uint16_t’ /usr/local/include/libnftnl/common.h:25:63: error: unknown type name ‘uint16_t’ /usr/local/include/libnftnl/common.h:26:10: error: unknown type name ‘uint16_t’ /usr/local/include/libnftnl/common.h:26:25: error: unknown type name ‘uint32_t’ Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * build: resolve compile error involving XT_EXTENSION_MAXNAMELENJan Engelhardt2014-01-211-0/+185
| | | | | | | | | | | | | | | | 2.6.32 headers in /usr/include/linux again. Ship a copy of x_tables.h from Linux 3.11. Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * rename library to libnftnllibnftnl-1.0.0Pablo Neira Ayuso2014-01-209-26/+26
| | | | | | | | | | | | We plan to use this library name for the higher layer library. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: add interface to parse from fileArturo Borrero2014-01-095-0/+12
| | | | | | | | | | | | | | | | This patch adds a new API to parse rule-set expressed in XML/JSON from a file. A new enum nft_parse_input type is added for this purpose. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * src: new error reporting approach for XML/JSON parsersÁlvaro Neira Ayuso2014-01-066-6/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | I have added a new structure for reporting some errors in parser that we can't cover with errno. In this patch, we have three errors that we can't cover with errno: NFT_PARSE_EBADINPUT : Bad XML/JSON format in the input NFT_PARSE_EMISSINGNODE : Missing node in our input NFT_PARSE_EBADTYPE : Wrong type value in a node Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * include: update netlink.h to 3.13Tomasz Bursztyka2013-12-121-5/+84
| | | | | | | | | | | | | | | | Use kernel header from 3.13-rc upstream kernel, this includes documentation changes that were missing. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * examples: nft-rule-add: use existing batch infrastructurePablo Neira Ayuso2013-12-101-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reworks the existing example to add the rule: nft add rule ip filter input tcp dport 22 counter It uses the existing nfnl batching approach using the generic mnl netlink message batching infrastructure. It also removed the code that uses xtables compat code. Based on original patch by Arturo Borrero Gonzalez. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expr: ct: Add support for setting the markKristian Evensen2014-01-152-0/+3
| | | | | | | | | | | | | | | | | | This patch adds userspace support for setting properties of tracked connections. Currently, the connection mark is supported. This can be used to implemented the same functionality as iptables -j CONNMARK --save-mark. Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libnftables: replace netfilter.h by sanitized headerPatrick McHardy2014-01-151-6/+4
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | src: fix compilation due to missing NFPROTO_INET definitionPablo Neira Ayuso2014-01-101-0/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds a copy of the include/linux/netfilter.h kernel header that defines NFPROTO_INET, so libnftables compiles with relatively old kernel headers in the system. chain.c: In function 'nft_hooknum2str': chain.c:53:7: error: 'NFPROTO_INET' undeclared (first use in this function) This required to reorder and remove unneeded headers in src/expr/data_reg.c to avoid a compilation warning due to redefinition of __visible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | libnftables: add support for inet family and mete nfproto/l4proto expressionsPatrick McHardy2014-01-081-0/+4
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* | src: update meta exprArturo Borrero2013-12-262-1/+4
| | | | | | | | | | | | | | | | | | | | This patch adds userspace support for the meta expression in the set flavour. This expression indicates that the packet has to be set with a property, currently one of mark, priority or nftrace. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | table: Add support for NFTA_TABLE_USE attributeTomasz Bursztyka2013-12-172-0/+2
| | | | | | | | | | | | | | | | This adds support for table's attribute "use" which let us know about how many chains are in the table, if any. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | expr: add support for nfnetlink queueEric Leblond2013-12-042-0/+25
|/ | | | | | | This patch adds a support of the queue target. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: expr-target: fix deprecation warningArturo Borrero2013-11-302-1/+20
| | | | | | | | | This fixes the following warning: In file included from nft-expr_target-test.c:19:0: /usr/include/linux/netfilter_ipv4/ipt_LOG.h:4:2: warning: #warning "Please update iptables, this file will be removed soon!" [-Wcpp] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate netlink build header functionPablo Neira Ayuso2013-11-245-5/+9
| | | | | | | | | Add new function nft_nlmsg_build_hdr which consolidates all existing functions to build headers per object. They basically look the same. This patch still provides aliases for consistency in the naming approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: fix possible clash in ifdef namespacePablo Neira Ayuso2013-11-247-20/+20
| | | | | | | | Use _LIBNFTABLES_ prefix to avoid possible clash with headers that are defined in other libraries that may be used by third party applications. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table/chain: add u8 setter and getter for family valuesAna Rey2013-11-202-0/+4
| | | | | | | These are needed to set the family value for chain and table. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix make distcheckPablo Neira Ayuso2013-11-181-1/+1
| | | | | | | | | | Fix missing files that were not included in the tarball that distcheck generates. This also includes AC_EXEEXT, otherwise configure complains about undefined CHECK_GCC_FVISIBILITY. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: unify parse and output typesÁlvaro Neira Ayuso2013-11-147-72/+34
| | | | | | | | | Unify parse and output types that are redundant to all existing nftables objects. Thus, all NFT_*_O_[XML|JSON|DEFAULT] are merged into NFT_OUTPUT_[JSON|XML] and NFT_PARSE_[JSON|XML]. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: resolve build errors in dependent programsJan Engelhardt2013-11-056-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | The headers do not compile standalone which may cause compilation problems to third party programs. $ gcc -x c -Wall -c *.h chain.h:62:35: error: unknown type name ‘size_t’ expr.h:40:39: error: unknown type name ‘size_t’ rule.h:60:34: error: unknown type name ‘size_t’ ruleset.h:20:1: error: unknown type name ‘bool’ ruleset.h:20:59: error: unknown type name ‘uint16_t’ ruleset.h:21:52: error: unknown type name ‘uint16_t’ ruleset.h:22:50: error: unknown type name ‘uint16_t’ ruleset.h:23:63: error: unknown type name ‘uint16_t’ ruleset.h:39:37: error: unknown type name ‘size_t’ ruleset.h:39:80: error: unknown type name ‘uint32_t’ ruleset.h:39:95: error: unknown type name ‘uint32_t’ set.h:40:33: error: unknown type name ‘size_t’ set.h:110:38: error: unknown type name ‘size_t’ table.h:50:35: error: unknown type name ‘size_t’ Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fprintf API functionsArturo Borrero2013-11-035-0/+12
| | | | | | | | | | | | | | Now it's possible to print directly from libnftables to a file or other stream. The caller must explicitly print the trailing '\n' in this call. The error reporting of fprintf (< 0) is respected. However, we have already print some information in case that the default (plain text) output is used, that output is mostly intended for debugging so it should not be a problem. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: fix missing struct nlmsghdr without definitionPablo Neira Ayuso2013-10-274-0/+8
| | | | | | | | | The definition of this structure belongs to the scope of linux/netlink.h. Based on patch from Jan Engelhardt. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add rejectPablo Neira Ayuso2013-10-271-0/+5
| | | | | | | This patch adds support for the reject expression. Tested-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: remove NFT_RULE_ATTR_FLAGSPablo Neira Ayuso2013-10-271-1/+0
| | | | | | | This is a leftover from the time we had per rule flags, obsoleted by the new rule batching approach. Kill it as it is unused. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: limit: operational limit matchPhil Oester2013-10-222-3/+3
| | | | | | | | | | | | | | | | | | | | | The nft limit match currently does not work at all. Below patches to nftables, libnftables, and kernel address the issue. A few notes on the implementation: - Removed support for nano/micro/milli second limits. These seem pointless, given we are using jiffies in the limit match, not a hpet. And who really needs to limit items down to sub-second level?? - 'depth' member is removed as unnecessary. All we need in the kernel is the rate and the unit. - 'stamp' member becomes the time we need to next refresh the token bucket, instead of being updated on every packet which goes through the match. This closes netfilter bugzilla #827, reported by Eric Leblond. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add low-level ruleset APIArturo Borrero2013-10-012-1/+47
| | | | | | | | This patch adds a low level ruleset API for libnftables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: get rid of NFTA_RULE_FLAGSPablo Neira Ayuso2013-09-241-8/+0
| | | | | | | It has been removed after (netfilter: nf_tables: all rule updates are transactional). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: replace size_t by uint32_t in set/get interfacesPablo Neira Ayuso2013-09-192-4/+4
| | | | | | | | | | | | This patch breaks the ABI to shrink the size parameter from 8 to 4 bytes in x86_64. The maximum length of netlink attributes is 2 bytes, so 4 bytes as attribute payload length should be enough. After this patch, size_t is only used in the nft_*_snprintf interfaces. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_delPablo Neira Ayuso2013-09-174-1/+4
| | | | | | | This allows us to delete object from the list, note that nft_chain_list_del already existed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Add json parser supportÁlvaro Neira Ayuso2013-08-281-0/+1
| | | | | | | Add function for parsing set in format JSON. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify nft_*_parse input dataArturo Borrero Gonzalez2013-08-224-5/+5
| | | | | | | Since the input string is not changing, let's make it constant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Add json parser supportÁlvaro Neira Ayuso2013-08-201-0/+1
| | | | | | | Add function for parsing rules in JSON format Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add nft_rule_expr_get_u16 and nft_rule_expr_set_u16Pablo Neira Ayuso2013-08-171-0/+2
| | | | | | Now required since log has two u16 fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: constify nft_set_elem_attr_get_strPablo Neira Ayuso2013-08-061-1/+1
| | | | | | | Should have been done in (ec75831 src: fully constify nft_*_get functions) Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fully constify nft_*_get functionsPablo Neira Ayuso2013-08-062-2/+2
| | | | | | | | | We have several char * field that were not constify to avoid gcc compilation warnings when calling free. Since (99d2574 src: add xfree and use it), we can fully constify these objects fields without trouble. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Add json parser supportÁlvaro Neira Ayuso2013-07-311-0/+1
| | | | | | | Add function for parsing chains in format JSON. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-13 17:20:35 +0000