summaryrefslogtreecommitdiffstats
path: root/src/meta.c
Commit message (Collapse)AuthorAgeFilesLines
* src: prefer meta protocol as bridge l3 dependencyFlorian Westphal2019-06-191-1/+5
| | | | | | | | | | | | | | | | | | | On families other than 'ip', the rule ip protocol icmp needs a dependency on the ip protocol so we do not treat e.g. an ipv6 header as ip. Bridge currently uses eth_hdr.type for this, but that will cause the rule above to not match in case the ip packet is within a VLAN tagged frame -- ether.type will appear as ETH_P_8021Q. Due to vlan tag stripping, skb->protocol will be ETH_P_IP -- so prefer to use this instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: missing destroy function in statement definitionsPablo Neira Ayuso2019-04-051-0/+6
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expr: remove expr_ops from struct exprFlorian Westphal2019-02-081-2/+2
| | | | | | | | size of struct expr changes from 144 to 128 bytes on x86_64. This doesn't look like much, but large rulesets can have tens of thousands of expressions (each set element is represented by an expression). Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: add iifkind and oifkind supportwenxu2019-01-281-0/+6
| | | | | | | | | | This can be used to match the kind type of iif or oif interface of the packet. Example: add rule inet raw prerouting meta iifkind "vrf" accept Signed-off-by: wenxu <wenxu@ucloud.cn> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: default to numeric UID and GID listingPablo Neira Ayuso2018-10-291-2/+2
| | | | | | | | | | | | | Like iptables-save, print UID and GID as numeric values by default. Add a new option `-u' to print the UID and GID names as defined by /etc/passwd and /etc/group. Note that -n is ignored after this patch, since default are numeric printing for UID and GID. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename meta secpath to meta ipsecFlorian Westphal2018-09-211-1/+4
| | | | | | | for symmetry with 'rt ipsec'. "meta secpath" still works. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: meta: always prefix 'meta' for almost all tokensFlorian Westphal2018-07-211-16/+13
| | | | | | | | | | | | | | | | | | got following bug report: nft add ... ct mark set mark and 0x10 ... always sets 0. What reporter meant to write instead was 'ct mark', not 'mark'. We can't just remove support for 'mark' and force 'meta mark', but we can start to discourage it by printing meta prefix too. Later on, we could start to print deprecation warning if needed. Followup patch can also change "iifname" etc. to "meta iifname". Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: Implement JSON output supportPhil Sutter2018-05-111-0/+6
| | | | | | | | | | | | Although technically there already is support for JSON output via 'nft export json' command, it is hardly useable since it exports all the gory details of nftables VM. Also, libnftables has no control over what is exported since the content comes directly from libnftnl. Instead, implement JSON format support for regular 'nft list' commands. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Make some arrays globally accessiblePhil Sutter2018-05-111-2/+3
| | | | | | | | | | | | | | | This removes static flag and adds declarations in headers for the following arrays: * ct_templates from src/ct.c * mark_tbl from src/datatype.c * meta_templates and devgroup_tbl from src/meta.c * table_flags_name from src/rule.c * set_stmt_op_names from src/statement.c * tcpopthdr_protocols from src/tcpopt.c Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use ibrname and obrnamePablo Neira Ayuso2018-04-191-2/+2
| | | | | | | | | Legacy tool name is 'brctl' and so the 'br' prefix is already known. If we use ibrname and obrname it looks consistent with iifname and oifname. So let's this instead of ibridgename and obridgename since Florian likes this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename ibrportname, obrportnameFlorian Westphal2018-04-171-2/+13
| | | | | | | | | | | | | | | For bridge, iifname is the port name, whereas 'ibrport' is the logical name of the bridge ("br0") the port ("iifname") is enslaved to. So, 'ibrport' is a misnomer. libnftl calls these 'bri_iifname' and 'bri_oifname', which is good but using 'briiifname' in nft is rather ugly, so use 'ibridgename' and 'obridgename' instead. Old names are still recognized, listing shows the new names. Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce datatype ifname_typeArturo Borrero Gonzalez2018-02-251-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | This new datatype is a string subtype. It will allow us to build named maps/sets using meta keys like 'iifname', 'oifname', 'ibriport' or 'obriport'. Example: table inet t { set s { type ifname elements = { "eth0", "eth1" } } chain c { iifname @s accept oifname @s accept } } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add secpath supportFlorian Westphal2018-01-161-0/+3
| | | | | | | | | This can be used to check if a packet has a secpath attached to it, i.e. was subject to ipsec processing. Example: add rule inet raw prerouting meta secpath exists accept Signed-off-by: Florian Westphal <fw@strlen.de>
* src: fix protocol context update on big-endian systemsPhil Sutter2017-12-121-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is an obscure bug on big-endian systems when trying to list a rule containing the expression 'ct helper tftp' which triggers the assert() call in mpz_get_type(). Florian identified the cause: ct_expr_pctx_update() is called for the relational expression which calls mpz_get_uint32() to get RHS value (assuming it is a protocol number). On big-endian systems, the misinterpreted value exceeds UINT_MAX. Expressions' pctx_update() callback should only be called for protocol matches, so ct_meta_common_postprocess() lacked a check for 'left->flags & EXPR_F_PROTOCOL' like the one already present in payload_expr_pctx_update(). In order to fix this in a clean way, this patch introduces a wrapper relational_expr_pctx_update() to be used instead of directly calling LHS's pctx_update() callback which unifies the necessary checks (and adds one more assert): - assert(expr->ops->type == EXPR_RELATIONAL) -> This is new, just to ensure the wrapper is called properly. - assert(expr->op == OP_EQ) -> This was moved from {ct,meta,payload}_expr_pctx_update(). - left->ops->pctx_update != NULL -> This was taken from expr_evaluate_relational(), a necessary requirement for the introduced wrapper to function at all. - (left->flags & EXPR_F_PROTOCOL) != 0 -> The crucial missing check which led to the problem. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add nft_ prefix to everything exposed through include/nftables/nftables.hPablo Neira Ayuso2017-10-241-2/+2
| | | | | | | | Prepend nft_ prefix before these are exposed, reduce chances we hit symbol namespace pollution problems when mixing libnftables with other existing libraries. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of printfPhil Sutter2017-09-291-13/+19
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove __init and __exit macro definitions.Varsha Rao2017-07-171-4/+4
| | | | | | | | | | | | Add nft_init and nft_exit functions, which calls _init and _exit functions in main.c file. Remove __init and __exit macro definitions as libnftables library will be created soon. Rename realm_table_init() and realm_table_exit() functions to avoid ambiguity as realm_table_rt_init(), realm_table_meta_init, realm_table_rt_exit() and realm_table_meta_exit() in rt.c and meta.c files. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Remove datatype_register().Varsha Rao2017-06-301-39/+5
| | | | | | | | Remove datatype_register() function and its calling __init functions. Add arguments of datatype_register() function to datatype array. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Pass stateless, numeric, ip2name and handle variables as structure members.Varsha Rao2017-06-181-17/+19
| | | | | | | | | | | | | | | | | libnftables library will be created soon. So declare numeric_output, stateless_output, ip2name_output and handle_output as members of structure output_ctx, instead of global variables. Rename these variables as following, numeric_output -> numeric stateless_output -> stateless ip2name_output -> ip2name handle_output -> handle Also add struct output_ctx *octx as member of struct netlink_ctx. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: permit meta nfproto ip in ip familyFlorian Westphal2017-06-061-2/+9
| | | | | | | | | | | | | | | | | | | works: add rule ip filter input ct original saddr 1.2.3.4 (family ctx init initialises network base to proto_ip). fails to parse 1.2.3.4 address: add rule ip filter input meta nfproto ipv4 ct original saddr 1.2.3.4 ... because meta_expr_pctx_update() won't find a dependency from "ip" to "ip" and then overwrites the correct base with proto_unknown. "meta nfproto ip" is useless in the ip family, as it will always match, i.e. a better (but more compliated) fix would be to remove the statement during evaluation. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: Show the base which pre-defined constants are displayedElise Lennion2016-12-201-0/+2
| | | | | | | | | | so the user know how we express it. The base was added to all symbol tables, which are associated with datatype->sym_tbl, so they are displayed in the right base. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: allow resolving meta keys at run timeFlorian Westphal2016-10-271-0/+36
| | | | | | | | | use the meta template to translate the textual token to the enum value. This allows to remove two keywords from the scanner and also means we do not need to introduce new keywords when more meta keys get added. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix pkttype name and add 'other' symbolFlorian Westphal2016-10-271-1/+3
| | | | | | | | | | | | | | 'unicast' doesn't check for unicast packets; it checks for PACKET_HOST, i.e. a packet coming in for this host. A unicast address to some other machine (e.g. because nic is in promisc mode) will have PACKET_OTHER. So at best this is misleading, so this patch changes it to 'host'. The unicast entry is retained for compat purpose. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: permit numeric interface typeFlorian Westphal2016-10-171-2/+13
| | | | | | | | | | | | | | If we can't translate an interface index back to a name we just print the number. This change allows using a number instead of an interface index to make this symmetric. If we can't find an interface with the given name check if its a numeric string and then use it instead. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix memory leak in tc classid parserLiping Zhang2016-08-301-1/+2
| | | | | | | | We forgot to free the str which was allocated by xstrdup, so memory leak will happen. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: meta priority support using tc classidPablo Neira Ayuso2016-08-181-11/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the missing bits to scan and parse the meta priority handle as expressed by tc classid major:minor syntax. The :minor syntax is not support for two reason: major is always >= 1 and this clashes with port syntax in nat. Here below, several example on how to match the packet priority field: nft add rule filter forward meta priority abcd:0 nft add rule filter forward meta priority abcd:1234 and to set it, you have to: nft add rule filter forward meta priority set abcd:1234 The priority expression in flex looks ahead to restrict the pattern to avoid problems with mappings: {classid}/[ \t\n:\-},] So the following doesn't break: ... vmap { 25:accept } ^^^^^ The lookahead expression requires a slight change to extend the input string in one byte. This patch is conservative as you always have to explicity indicate major and minor numbers even if zero. We could consider supporting this shortcut in the future: abcd: However, with regards to this: :abcd We don't need to support it since major number is assumed to be >= 1. However, if we ever decide to support this, we'll have problems since this clashes with our port representation in redirect and mangle. So let's keep this simple and start with this approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify classid printing using %x instead of %04xPablo Neira Ayuso2016-08-181-8/+1
| | | | | | | | | No need to print this in iptables CLASSIFY target format, eg. 0004:1230, this is innecessarily large. And always print major and minor numbers. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename datatype name from tc_handle to classidPablo Neira Ayuso2016-08-181-3/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: quote user-defined strings when used from rule selectorsPablo Neira Ayuso2016-08-181-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The following selectors display strings using quotes: * meta iifname * meta oifname * meta ibriport * meta obriport However, the following do not: * meta oif * meta iif * meta skuid * meta skgid * meta iifgroup * meta oifgroup * meta rtclassid * ct label Given they refer to user-defined values, neither keywords nor internal built-in known values, let's quote the output of this. This patch modifies symbolic_constant_print() so we can signal this to indicate if the string needs to be quoted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: add random supportFlorian Westphal2016-07-191-0/+4
| | | | | | | | | | | | | "meta random" fills a register with a 32bit pseudo-random number. For instance one can now use meta random <= 2147483647 ... to match every 2nd packet on average. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix a format error display when we set priority to root or noneLiping Zhang2016-05-301-2/+4
| | | | | | | | | | | | | | | | | | Also delete the redundant '\n'. This fixes: # nft add rule filter test meta priority set root # nft list chain filter test table ip filter { chain test { meta priority set root none ffff:ffff } } Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix endianness in priorityLiping Zhang2016-05-301-1/+1
| | | | | | | | | | | | | | | | For example, after we add rule to set priority 1:2, it will be displayed in network byte order as 0200:0100, this is wrong: # nft add rule filter test meta priority set 1:2 # nft list chain filter test table ip filter { chain test { meta priority set 0200:0100 } } Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix error checks in tc handle parserFlorian Westphal2016-02-171-3/+3
| | | | | | | | 'meta priority foobar' did not return an error -- instead we used min/max values with undefined content. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add new netdev protocol descriptionPablo Neira Ayuso2015-12-251-1/+17
| | | | | | | | This relies on NFT_META_PROTOCOL instead of ethernet protocol type header field to prepare support for non-ethernet protocols in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow filtering on L2 header in inet familyFlorian Westphal2015-11-061-1/+23
| | | | | | | | | | | | | | | | | | Error: conflicting protocols specified: inet vs. ether tcp dport 22 iiftype ether ether saddr 00:0f:54:0c:11:4 ^^^^^^^^^^^ This allows the implicit inet proto dependency to get replaced by an ethernet one. This is possible since by the time we detect the conflict the meta dependency for the network protocol has already been added. So we only need to add another dependency on the Linklayer frame type. Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=981 Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add dup statement supportPablo Neira Ayuso2015-09-301-1/+1
| | | | | | | | | | This allows you to clone packets to destination address, eg. ... dup to 172.20.0.2 ... dup to 172.20.0.2 device eth1 ... dup to ip saddr map { 192.168.0.2 : 172.20.0.2, ... } device eth1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: restore interface to index cachePablo Neira Ayuso2015-04-111-2/+3
| | | | | | | | | | | | | | | | nftables used to have a cache to speed up interface name <-> index lookup, restore it using libmnl. This reduces netlink traffic since if_nametoindex() and if_indextoname() open, send a request, receive the list of interface and close a netlink socket for each call. I think this is also good for consistency since nft -f will operate with the same index number when reloading the ruleset. The cache is populated by when nft_if_nametoindex() and nft_if_indextoname() are used for first time. Then, it it released in the output path. In the interactive mode, it is invalidated after each command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: register pkttype_type datatypePablo Neira Ayuso2015-02-011-0/+1
| | | | | Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=995 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: don't print meta keyword for unqualified meta stmtsPatrick McHardy2015-01-121-7/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: properly align types in meta_template tablePatrick McHardy2014-12-111-5/+5
| | | | | | | Don't use arbitrary amounts of spaces. The remaining table is properly aligned, fix the new types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: set base field on clonesPablo Neira Ayuso2014-12-011-0/+1
| | | | | | Set missing field on meta expression clone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: relax datatype check in integer_type_parse()Pablo Neira Ayuso2014-11-301-27/+1
| | | | | | | | | | | | | | | | Otherwise parsing with basetypes doesn't work. Now nft displays an error when the symbolic constant is not correct: <cmdline>:1:29-31: Error: Could not parse conntrack state add rule test test ct state xxx accept ^^^ Use .sym_tbl instead and default on the symbol_constant_parse() function from the ethertype and pkttype, this simplifies the code and (more importantly) it avoids a breakage after the change in integer_type_parse(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add cgroup support in meta expresionAna Rey2014-11-101-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | The new attribute of meta is "cgroup". Example of use in nft: # nft add rule ip test output meta cgroup != 0x100001 counter drop Moreover, this adds tests to the meta.t test file. The kernel support is addedin the commit: ce67417 ("netfilter: nft_meta: add cgroup support") The libnftnl support is add in the commit: 1d4a480 ("expr: meta: Add cgroup support") More information about the steps to use cgroup: https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt More info about cgroup in iptables: http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3 Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for datatype devgroupAna Rey2014-10-241-2/+37
| | | | | | | | | | | | | | | This adds the new devgroup datatype to get the group name from /etc/iproute2/group file. Example of use: nft add rule ip test input meta iifgroup 0 counter nft add rule ip test input meta iifgroup default counter Moreover, It adds tests in meta.t test file. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add devgroup support in meta expresionAna Rey2014-09-031-0/+6
| | | | | | | | | | | | | | | | | | | This adds device group support in meta expresion. The new attributes of meta are "iffgroup" and "oifgroup" - iffgroup: Match device group of incoming device. - oifgroup: Match device group of outcoming device. Example of use: nft add rule ip test input meta iifgroup 2 counter nft add rule ip test output meta oifgroup 2 counter The kernel and libnftnl support were added in these commits: netfilter: nf_tables: add devgroup support in meta expresion src: meta: Add devgroup support to meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: meta: Fix the size of cpu attributeAna Rey2014-09-031-1/+1
| | | | | | | Fix the size of cpu attribute in meta_template struct. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for cpu in meta expresionAna Rey2014-08-241-0/+3
| | | | | | | | | | | | | This allows you to match cpu handling with a packet. This is an example of the syntax for this new attribute: nft add rule ip test input meta cpu 1 counter nft add rule ip test input meta cpu 1-3 counter nft add rule ip test input meta cpu { 1, 3} counter Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for pkttype in meta expresionAna Rey2014-08-241-0/+55
| | | | | | | | | | | | | | | If you want to match the pkttype field of the skbuff, you have to use the following syntax: nft add rule ip filter input meta pkttype PACKET_TYPE where PACKET_TYPE can be: unicast, broadcast and multicast. Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-241-0/+6
| | | | | | | | Add support to get an input or output bridge interface name through the relevant meta keys. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatypes: rename some types for more consistencyPatrick McHardy2014-04-141-4/+4
| | | | | | | Add some more consistency by using _addr for all address types, _proto for all protocol types and iface_ for all interface types. Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-12 18:21:03 +0000