summaryrefslogtreecommitdiffstats
path: root/src/rule.c
Commit message (Collapse)AuthorAgeFilesLines
* rule: xml: consolidate error pathPablo Neira Ayuso2013-08-141-45/+23
| | | | | | Save a good bunch of lines of code with this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: don't duplicate string in nft_table_xml_parsePablo Neira Ayuso2013-08-141-2/+2
| | | | | | | | | | | With this patch, nft_table_xml_parse does not duplicate the string anymore, which is what most callers seem to need. This fixes memleaks in several places in the code. Thus, this patch also adapts the code to duplicate it when needed. Based on patch from Arturo Borrero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: release expressions that are part of rulesPablo Neira Ayuso2013-08-141-0/+5
| | | | | | | | | | | | ==11917== 96 bytes in 1 blocks are definitely lost in loss record 1 of 1 ==11917== at 0x4C272B8: calloc (vg_replace_malloc.c:566) ==11917== by 0x4E3A46F: nft_rule_expr_alloc (expr.c:38) ==11917== by 0x4E3A331: nft_jansson_expr_parse (jansson.c:165) ==11917== by 0x4E36F66: nft_rule_json_parse (rule.c:542) ==11917== by 0x400EA4: main (nft-rule-json-add.c:68) Reported-by: Álvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: json: delete unneeded JSON prefixesÁlvaro Neira Ayuso2013-08-091-2/+1
| | | | | | | This patch adapts JSON nodes to mimic current XML node tags. Signed-off-by: Alvaro Neira Ayuso Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix display of compat_flag and compat_protoÁlvaro Neira Ayuso2013-08-091-4/+5
| | | | | | | Fixed display compat_proto value and compat_flag if available. Signed-off-by: Alvaro Neira Ayuso Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: delete unneeded XML prefixesArturo Borrero Gonzalez2013-08-071-7/+3
| | | | | | | | | | | | | | | | | | | | This patch changes some XML nodes with prefixes, as the example below ilustrates. Before: <rule> <rule_flags/> <rule_family/> <rule> After: <rule> <flags> <family> </rule> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: constify char * fieldsPablo Neira Ayuso2013-08-061-4/+4
| | | | | | | Should have been done in (ec75831 src: fully constify nft_*_get functions). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: use nodes instead of attributesArturo Borrero Gonzalez2013-08-061-32/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When working with XML, it's desirable to work with nodes better than attributes. Table/chain/rules had attributes in their XML representation, and this patch transform those to nodes, ie: Before: <table name="filter"> <family>ip</family> <table_flags>0</table_flags> </table> After: <table> <name>filter</name> <family>ip</family> <table_flags>0</table_flags> </table> While at it: * There was a lot of redundant code that is now collapsed with the new nft_mxml_family_parse() helper function. * I've added a small fix: additional validation for the name of the current XML object, and also replace raw strtol calls to nft_strtoi. * Also, all XML testfiles are updated to keep passing the parsing tests and mantain the repo in consisten state. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add xfree and use itPablo Neira Ayuso2013-08-061-13/+13
| | | | | | | | This patch adds xfree, a replacement of free that accepts const pointers. This helps to remove ugly castings that you usually need to calm down gcc. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove version from XML and JSON representationsPablo Neira Ayuso2013-07-261-17/+4
| | | | | | | | | | | | | | | | | | | | | | This patch removes the version XML node and the version JSON field in all our existing objects. The current versioning approach consists of adding a version field to every object representation in XML and JSON. While listing my entire rule-set, one can notice that this approach is too bloated. Once the library enters stable stage, if we need to obsolete a XML node and a JSON field, we can follow this procedure: 1) Remove the XML node and the JSON field from the output, so fresh outputs will not contain the old ones anymore. 2) Do not remove the parsing of the old XML node and the JSON field inmediately. We have to keep supporting the parsing for a while to avoid breaking the interpretion of old XML/JSON files. We can spot a warning to warn about it, so users generate a fresh output again. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: consolidate common XML code via nft_mxml_num_parseArturo Borrero2013-07-251-9/+2
| | | | | | | | | | | This patch moves common XML parsing code to nft_mxml_num_parse(). To handle this, the nft_strtoi() helper fuction is included. I've changed some MXML_DESCEND[_FIRST] flags to avoid match a nested node under some circumstances, ie, matching two nodes with the same name that are descendant. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove default case from nft_*_attr_unsetPablo Neira Ayuso2013-07-211-12/+11
| | | | | | | | This patch removes the default case in nft_*_attr_unset, thus, the compiler will spot a warning if we add a new attribute in the future and you forget to handle it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify parameter of nft_*_is_setEric Leblond2013-07-191-1/+1
| | | | | | | | The functions nft_*_attr_is_set() is doing no modification so it is possible to type it to const. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: display position in default printfEric Leblond2013-07-191-2/+2
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add support for position attributeEric Leblond2013-07-191-0/+19
| | | | | | | | This patch adds support for position attribute which can be used to insert a rule at a given position. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify getter logicPablo Neira Ayuso2013-07-181-37/+12
| | | | | | | | This patch refactors the getter code to simplify it. The default cases have been removed so gcc will spot a warning if an attribute is not handled appropriately. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_add_tailPablo Neira Ayuso2013-07-161-1/+7
| | | | | | | This redefines the meaning of nft_*_list_add to prepend, before this patch it was appending, which was semantically wrong. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_is_empty() functionsArturo Borrero2013-07-151-0/+6
| | | | | | | | | This functions check if a given nft_*_list is empty or not. I found this quite useful while working with a full ruleset. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: improve default text outputGiuseppe Longo2013-07-051-4/+7
| | | | | | | | | | | | | This patch improves default plain text output by mimicing the default output of libnl-nft. While at it, several %lu has been translated to use %"PRIu64" for correctness. [ I have added the policy to string translation --pablo ] Signed-off-by: Giuseppe Longo <giuseppelng@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate XML parsing of expressions via nft_mxml_expr_parsePablo Neira Ayuso2013-07-041-21/+2
| | | | | | | | | Move common code for XML parsing of expressions to the new nft_mxml_expr_parse function. This patch reduces the XML parsing code in 300 LOC. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support JSON format in chain, rule and expressionsÁlvaro Neira Ayuso2013-06-291-2/+50
| | | | | | | While at it, order possible switch cases of _snprintf. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: convert family values to stringArturo Borrero2013-06-271-7/+8
| | | | | | | | | | | | This patch translates family values to display a string: * ip if AF_INET * ip6 if AF_INET6 * bridge if AF_BRIDGE * arp if 0 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: xml: conditional display of compat infoArturo Borrero Gonzalez2013-06-271-29/+30
| | | | | | | | The compat XML info is now conditional both when printing and parsing. It is only used by iptables-nftables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add nft_rule_expr_snprintfPablo Neira Ayuso2013-06-191-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: xml: delete trailing spaceArturo Borrero2013-06-171-1/+1
| | | | | | | This patch fixes a trailing space in rule xml_snprintf. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify first parameter of all nft_*_getPablo Neira Ayuso2013-06-171-5/+5
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_attr_is_setPablo Neira Ayuso2013-06-171-0/+6
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_list_foreachPablo Neira Ayuso2013-06-171-0/+32
| | | | | | This patch adds a simplied iterator interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix nft_*_unset function attribute that don't release dataPablo Neira Ayuso2013-06-071-0/+6
| | | | | | | | | | | In (dde2039 src: add nft_*_unset functions), I mangled Arturo's patch to add a default case, but he was intentionally not adding it to unset attributes that require no memory releases. I prefered to add the attributes explicitly in the switch rather on failing back on the default action. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_*_unset functionsArturo Borrero Gonzalez2013-06-071-0/+25
| | | | | | | | These functions unset the given attribute in each object and release the data if needed. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: xml: add versioningArturo Borrero Gonzalez2013-06-061-2/+15
| | | | | | | Add version to XML chunks in case of future changes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix bad offset returned by _snprintfArturo Borrero Gonzalez2013-06-051-2/+2
| | | | | | | Noted while calling _snprintf functions consecutively. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix table flag not being set at XML parsingArturo Borrero Gonzalez2013-05-291-0/+1
| | | | | | | Added in (51370f0 src: add support for XML parsing). Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: delete useless castingsArturo Borrero2013-05-261-1/+1
| | | | | | | These casting were useless. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for XML parsingArturo Borrero Gonzalez2013-05-231-0/+184
| | | | | | | | | | | | | | | | | | | This patch adds capabilities for parsing a XML table/chain/rule. Some comments: * The XML data is case sensitive (so <chain>asd</chain> != <chain>ASD</chain> != <CHAIN>asd</CHAIN>) * All exported functions receive XML and return an object (table|chain|rule). * To compile the lib with XML parsing support, run './configure --with-xml-parsing' * XML parsing is done with libmxml (http://minixml.org). XML parsing depends on this external lib, this dependency is optional at compile time. NOTE: expr/target and expr/match binary data are exported. [ Fixed to compile without --with-xml-parsing --pablo ] Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com>
* src: remove trailing \n from all nft_*_snprintf functionsPablo Neira Ayuso2013-04-191-2/+0
| | | | | | The caller should add it in case it needs it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove trailing newlines, tabs and spaces from XML formatArturo Borrero Gonzalez2013-04-191-3/+3
| | | | | | | | Delete all \n and \t from XML output, any reasonable XML viewer already does the nifty formatting for us. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix snprintf XML output offset for rule.Arturo Borrero Gonzalez2013-04-191-1/+1
| | | | | Signed-off-by: Arturo Borrero González <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rule: fix compat XML outputArturo Borrero Gonzalez2013-04-191-0/+7
| | | | | | | | The compat struct was not printed in XML. So, I think give output format is the first step to parse it. Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: constify nft_*_attr_set and nft_*_attr_set_strPablo Neira Ayuso2013-04-141-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix wrong symbol exportPablo Neira Ayuso2013-04-141-1/+1
| | | | | | Exported symbol should be nft_rule_attr_get_u32, not nft_rule_attr_get_u64. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to get and to set NFT_*_ATTR_FAMILYArturo Borrero Gonzalez2013-04-021-0/+3
| | | | | | | | | | This patch adds support to get and set the attribute NFT_{TABLE|CHAIN|RULE}_ATTR_FAMILY. I found this useful when parsing a XML table|chain|rule (future patch). Signed-off-by: Arturo Borrero <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add XML output supportArturo Borrero Gonzalez2013-02-081-4/+48
| | | | | Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add protocol and flags support for xtables over nftablesPablo Neira Ayuso2013-01-251-0/+83
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add support for rule flagsPablo Neira Ayuso2013-01-231-2/+34
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add type and flags to snprintf interfacePablo Neira Ayuso2013-01-151-1/+1
| | | | | | | Propagate the type and flags parameter to the expressions, so we can implement outputs in different formats. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Add a function to get rule's familyTomasz Bursztyka2013-01-131-0/+14
| | | | | | Add nft_rule_attr_get_u8 to obtain the family number. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* rule: use 64-bits handle instead of 16-bitsPablo Neira Ayuso2012-11-031-12/+13
| | | | | | 5c4d30c nf_tables: use 64-bits rule handle instead of 16-bits Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* initial version of libnftablesPablo Neira Ayuso2012-10-111-0/+452
It adds support for table, chain and rule handling. This also includes expression handling for each rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>