summaryrefslogtreecommitdiffstats
path: root/src/meta.c
Commit message (Collapse)AuthorAgeFilesLines
...
* | meta: don't require "meta" keyword for a subset of meta expressionsPatrick McHardy2014-01-151-1/+12
| | | | | | | | | | | | | | | | | | | | Don't require the meta keyword for mark, iif, oif, iifname, oifname, skuid, skgid, nftrace, rtclassid and secmark. The protocol and length types still need the meta keyword to avoid grammar conflicts. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | expr: remove secmark from ct and meta expressionPatrick McHardy2014-01-151-2/+0
| | | | | | | | | | | | The secctx should be used instead of the secmark. Remove for now. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add l4proto supportPatrick McHardy2014-01-081-0/+14
| | | | | | | | | | | | | | | | | | Add support for the meta l4proto type. This is used in the inet table to match on the transport layer protocol without requiring the network layer protocol to be known, allowing to use transport header matches that apply to both IPv4 and IPv6. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add nfproto supportPatrick McHardy2014-01-081-9/+26
| | | | | | | | | | | | | | | | Add support for the meta nfproto type, which refers to the AF from the netfilter hook ops. This is needed to get the actual family of a packet in the dummy NFPROTO_INET family. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | proto: add helper function to update protocol contextPatrick McHardy2014-01-081-2/+1
| | | | | | | | | | | | Add a helper function which is to be used to update the protocol update. Signed-off-by: Patrick McHardy <ksber@trash.net<
* | expr: add protocol context update callbackPatrick McHardy2014-01-081-1/+12
| | | | | | | | | | | | | | | | | | | | Add a callback function to the expression ops to update the protocol context for relational protocol expressions (EXPR_F_PROTOCOL). Also set the EXPR_F_PROTOCOL flag for IIFTYPE meta expressions to make sure the callback is invoked when necessary. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | nftables: generic procotol contextsPatrick McHardy2014-01-081-0/+29
|/ | | | | | | | | | | | | | | Currently the context of higher layer protocols is specific to payload expressions with some special cases for meta IIFTYPE expressions. This approach has a few shortcomings, concretely there are more expression types which define upper layer protocols like the ct expression and two upcoming new types for the meta expression. Replace the payload context by a generic protocol context to deal with this. This patch just splits off the requires parts from the payload expression without any functional changes, the following patches will add further functionality for other expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: relax restriction on UID/GID parsingPablo Neira Ayuso2013-11-291-20/+34
| | | | | | | | | | nft is currently rejecting unknown UID/GID if they don't exist in the system, relax this as Bjørnar Ness considers this is a valid scenario. Now this only reports an error if you pass an unknown user (expressed as string or if the UID/GID goes above 32 bits). Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix endianness in UID/GIDPablo Neira Ayuso2013-11-291-2/+2
| | | | | | | | | | | add rule filter output meta skuid vmap { 1000 => accept } list table filter meta skuid map { 3892510720 => accept} ^--------^ this is 1000 in network byte order Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: iif/oifname should be host byte orderFlorian Westphal2013-09-231-2/+2
| | | | | | | | | | | | | | | | | | | | src/nft add rule filter output meta oifname eth0 doesn't work on x86. Problem is that nft declares these as BYTEORDER_INVALID, but when converting the string mpz_import_data treats INVALID like BIG_ENDIAN. [ cmp eq reg 1 0x00000000 0x00000000 0x65000000 0x00306874 ] as kernel nft_cmp_eval basically boils down to memcmp(reg, skb->dev->name, sizeof(reg) comparision fails. with patch: [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ] Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix output display of meta lengthPablo Neira Ayuso2013-09-041-1/+1
| | | | | | | | | | | | | nft list table filter Before: meta len 1000 counter packets 0 bytes 0 After: meta length 1000 counter packets 0 bytes 0 Now it doesn't break with nft -f. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: replace rtnl_tc_handle2str and rtnl_tc_str2handlePablo Neira Ayuso2013-06-241-10/+43
| | | | | | | Provide replacements for rtnl_tc_handle2str and rtnl_tc_str2handle, it removes the dependency with libnl-route. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: use if_nametoindex and if_indextonamePablo Neira Ayuso2013-06-241-44/+4
| | | | | | | Instead of having a cache of ifindex based on libnl. Those functions basically use rtnetlink as well to perform the translation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: accept uid/gid in numericalPablo Neira Ayuso2013-04-201-4/+12
| | | | | | You can use the user/group name or alternatively the uid/gid. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expressions: kill seperate sym_type datatype for symbolsPatrick McHardy2009-04-011-5/+5
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add/move size and byte order information into data typesPatrick McHardy2009-03-311-2/+12
| | | | | | | | | | Add size and type information to non-basetype types and remove the now redundant information from the symbol tables. This will be used to determine size and byteorder of set members without analyzing the ruleset for incremental update operations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: maintain table of all datatypes and add registration/lookup functionPatrick McHardy2009-03-311-7/+22
| | | | | | | | | | | Add a table containing all available datatypes and registration/lookup functions. This will be used to associate a stand-alone set in the kernel with the correct type without parsing the entire ruleset. Additionally it would now be possible to remove the global declarations for the core types. Not done yet though. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add support for cloning expressionsPatrick McHardy2009-03-201-0/+6
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+347