summaryrefslogtreecommitdiffstats
path: root/src/netlink_delinearize.c
Commit message (Collapse)AuthorAgeFilesLines
...
* src: add dup statement supportPablo Neira Ayuso2015-09-301-0/+53
| | | | | | | | | | This allows you to clone packets to destination address, eg. ... dup to 172.20.0.2 ... dup to 172.20.0.2 device eth1 ... dup to ip saddr map { 192.168.0.2 : 172.20.0.2, ... } device eth1 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add burst parameter to limitPablo Neira Ayuso2015-09-231-0/+1
| | | | | | | | | | | ... limit rate 1024 mbytes/second burst 10240 bytes ... limit rate 1/second burst 3 packets This parameter is optional. You need a Linux kernel >= 4.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add per-bytes limitPablo Neira Ayuso2015-09-231-0/+1
| | | | | | | | | | This example show how to accept packets below the ratelimit: ... limit rate 1024 mbytes/second counter accept You need a Linux kernel >= 4.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* vlan: make != tests workFlorian Westphal2015-09-181-0/+1
|
* nft: support listing expressions that use non-byte header fieldsFlorian Westphal2015-09-181-10/+70
| | | | | | | This allows to list rules that check fields that are not aligned on byte boundary. Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: allow stacking vlan header on top of ethernetFlorian Westphal2015-09-181-9/+38
| | | | | | | | | | | | | | | | | | | | currently 'vlan id 42' or even 'vlan type ip' doesn't work since we expect ethernet header but get vlan. So if we want to add another protocol header to the same base, we attempt to figure out if the new header can fit on top of the existing one (i.e. proto_find_num gives a protocol number when asking to find link between the two). We also annotate protocol description for eth and vlan with the full header size and track the offset from the current base. Otherwise, 'vlan type ip' fetches the protocol field from mac header offset 0, which is some mac address. Instead, we must consider full size of ethernet header. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: use new symbols in libnftnlPablo Neira Ayuso2015-09-161-117/+117
| | | | | | | | | Adapt the nftables code to use the new symbols in libnftnl. This patch contains quite some renaming to reserve the nft_ prefix for our high level library. Explicitly request libnftnl 1.0.5 at configure stage. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: meta l4proto range printing broken on 32bitPablo Neira Ayuso2015-07-171-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Florian Westphal says: 09565a4b1ed4863d44c4509a93c50f44efd12771 ("netlink_delinearize: consolidate range printing") causes nft to segfault on 32bit machine when printing l4proto ranges. The problem is that meta_expr_pctx_update() assumes that right is a value, but after this change it can also be a range. Thus, expr->value contents are undefined (its union). On x86_64 this is also broken but by virtue of struct layout and pointer sizes, value->_mp_size will almost always be 0 so mpz_get_uint8() returns 0. But on x86-32 _mp_size will be huge value (contains expr->right pointer of range), so we crash in libgmp. Pablo says: We shouldn't call pctx_update(), before the transformation we had there a expr->op == { OP_GT, OP_GTE, OP_LT, OP_LTE }. So we never entered that path as the assert in payload_expr_pctx_update() indicates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Florian Westphal <fw@strlen.de>
* netlink_delinarize: fix merge conflictPatrick McHardy2015-06-131-1/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/next-4.1'Patrick McHardy2015-06-131-13/+117
|\
| * netlink_delinearize: handle relational and lookup concat expressionsPatrick McHardy2015-06-021-9/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When the RHS length differs from the LHS length (which is only the first expression), both expressions are assumed to be concat expressions. The LHS concat expression is reconstructed from the available register values, advancing by the number of registers required by the subexpressions' register space, until the RHS length has been reached. The RHS concat expression is reconstructed by splitting the data value into multiple subexpressions based on the LHS concat expressions types. Signed-off-by: Patrick McHardy <kaber@trash.net>
| * netlink_delinearize: introduce register translation helperPatrick McHardy2015-06-021-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce a helper function to translate register numbers from the kernel from the compat values to the NFT_REG32 values. Internally we use the register numbers 0-16: * 0 is the verdict register in both old and new addressing modes. * 1-16 are the 32 bit data registers The NFT_REG32_00 values are mapped to 1-16, the NFT_REG_1-NFT_REG_4 values are each use up 4 registers starting at 1 (1, 5, 9, 13). Signed-off-by: Patrick McHardy <kaber@trash.net>
| * Merge remote-tracking branch 'origin/master' into next-4.1Patrick McHardy2015-06-021-3/+1
| |\
* | | netlink_delinearize: restore listing of host byteorder set elementsPablo Neira2015-06-051-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | before: table ip filter { chain test { cpu { 67108864, 50331648, 33554432} } } after: table ip filter { chain test { cpu { 4, 3, 2 } } } Related to 525323352904 ("expr: add set_elem_expr as container for set element attributes"). We'll have to revisit this once we have support to use integer datatypes from set declarations, see: http://patchwork.ozlabs.org/patch/480068/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | | Merge branch 'next-4.1'Pablo Neira Ayuso2015-06-041-66/+189
|\ \ \ | |_|/ |/| |
| * | netlink_delinearize: consolidate range printingPablo Neira Ayuso2015-06-021-4/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a routine to the postprocess stage to check if the previous expression statement and the current actually represent a range, so we can provide a more compact listing, eg. # nft -nn list table test table ip test { chain test { tcp dport 22 tcp dport 22-23 tcp dport != 22-23 ct mark != 0x00000016-0x00000017 ct mark 0x00000016-0x00000017 mark 0x00000016-0x00000017 mark != 0x00000016-0x00000017 } } To do so, the context state stores a pointer to the current statement. This pointer needs to be invalidated in case the current statement is replaced. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: add payload_match_expand()Pablo Neira Ayuso2015-06-021-32/+37
| | | | | | | | | | | | | | | | | | | | | This function encapsulates the payload expansion logic. This change in required by the follow up patch to consolidate range printing. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: keep pointer to current statement from rule_pp_ctxPablo Neira Ayuso2015-06-021-34/+37
| | | | | | | | | | | | | | | | | | | | | This patch is required by the range postprocess routine that comes in follow up patches. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * | netlink_delinearize: pass ctx pointer to stmt_reject_postprocess()Pablo Neira Ayuso2015-05-301-9/+9
| |/ | | | | | | | | | | Instead of a copy of the context variable. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| * nftables: add set statemetPatrick McHardy2015-04-121-0/+38
| | | | | | | | | | | | | | | | | | | | | | | | The set statement is used to dynamically add or update elements in a set. Syntax: # nft filter input set add tcp dport @myset # nft filter input set add ip saddr timeout 10s @myset # nft filter input set update ip saddr timeout 10s @myset Signed-off-by: Patrick McHardy <kaber@trash.net>
| * expr: add set_elem_expr as container for set element attributesPatrick McHardy2015-04-121-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new expression type "set_elem_expr" that is used as container for the key in order to attach different attributes, such as timeout values, to the key. The expression hierarchy is as follows: Sets: elem | key Maps: mapping / \ elem data | key Signed-off-by: Patrick McHardy <kaber@trash.net>
* | netlink_delinearize: remove obsolete fixmePatrick McHardy2015-06-021-3/+1
|/ | | | | | | | The FIXME was related to exclusion of string types from cmp length checks. Since with fixed sized helper names the last case where this could happen is gone, remove the FIXME and perform length checks on strings as well. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinarize: fix payload dependency killing of link layer dependenciesPatrick McHardy2015-03-251-2/+2
| | | | | | | | | | | | | | | | | | | | | payload_dependency_kill() does not properly handle dependencies for link layer expressions. Since those dependencies are logically defined on an even lower layer (device layer), we don't have a payload base for them, meaning they will use PROTO_BASE_INVALID, which is skipped. So instead of storing the payload base on which the dependency is defined, we store the base of the layer for which the dependency applies, meaning dependencies defined by the device layer will properly work. This fixes killing the dependency of ether saddr, instead of iiftype ether ether ether saddr ... we now only display ether saddr ... Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: add register parsing helper functionPatrick McHardy2015-01-111-20/+26
| | | | | | | Add a helper function to parse netlink register numbers in preparation of concat support. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: cleanup hard to read codePatrick McHardy2015-01-111-60/+79
| | | | | | | | | | | The netlink parsing code is full of long function calls spawning multiple lines and in some cases parses netlink attributes multiple times. Use local variables for the registers and other data required to reconstruct the expressions and statements and reorder the code in some cases to move related processing next to each other. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: rename netlink_parse_*_sreg/dreg functionsPatrick McHardy2015-01-111-8/+8
| | | | | | These are really badly chosen names, use parse_expr and parse_stmt instead. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: fix error handling for invalid registersPatrick McHardy2015-01-101-1/+4
| | | | | | | | | | | netlink_delinearize is prepared to deal with malformed expressions from the kernel that it doesn't understand. However since expressions are now cloned unconditionally by netlink_get_register(), we crash before such errors can be detected for invalid inputs. Fix by only cloning non-NULL expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinearize: fix listing of set members in host byteorder using ↵Pablo Neira Ayuso2014-12-091-0/+29
| | | | | | | | | | integer_type nft list table filter ... cpu { 50331648, 33554432, 0, 16777216} counter packets 8 bytes 344 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: clone on netlink_get_register(), release previous on _set()Pablo Neira Ayuso2014-12-011-1/+13
| | | | | | | | | | | | | | | | | | | | | | | | If we add this rule: nft add rule filter input meta length 33-55 the listing shows: meta length >= 33 meta length <= 754974720 The two meta statements share the same left-hand side, thus, only the first one is converted from network byte order to host byte order. Update netlink_get_register() to return a clone so each left-hand side has its own left-hand side. Moreover, release the existing register before overriding it with fresh expressions in netlink_set_register(). Thefore, if you manipulate a register from any of the existing parse functions, you have to re-set it again to place fresh modified clone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add redirect supportArturo Borrero2014-11-041-0/+52
| | | | | | | | | | | This patch adds redirect support for nft. The syntax is: % nft add rule nat prerouting redirect [port] [nat_flags] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* delinearize: list the icmpx reason with the string associatedAlvaro Neira2014-10-171-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | If you add the rule: nft add rule inet filter input reject with icmpx type host-unreachable nft list table inet filter shows: table inet filter { chain input { reject with icmpx type 2 } } We have to attach the icmpx datatype when we list the rules that use it. With this patch if we list the ruleset, the output is: table inet filter { chain input { reject with icmpx type host-unreachable } } Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add masquerade supportArturo Borrero2014-10-091-0/+16
| | | | | | | | | | | | | | | | | This patch adds masquerade support for nft. The syntax is: % nft add rule nat postrouting masquerade [flags] Currently, flags are: random, random-fully, persistent Example: % nft add rule nat postrouting masquerade random,persistent Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nat persistent and random optionsArturo Borrero2014-10-091-0/+4
| | | | | | | | | | | | | | | | | This patch adds more configuration options to the nat expression. The syntax is as follow: % nft add rule nat postrouting <snat|dnat> <nat_arguments> [flags] Flags are: random, persistent, random-fully. Example: % nft add rule nat postrouting dnat 1.1.1.1 random,persistent A requirement is to cache some [recent] copies of kernel headers. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: complete reject supportAlvaro Neira2014-10-091-0/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use the reject action in rules. For example: nft add rule filter input udp dport 22 reject In this rule, we assume that the reason is network unreachable. Also we can specify the reason with the option "with" and the reason. For example: nft add rule filter input tcp dport 22 reject with icmp type host-unreachable In the bridge tables and inet tables, we can use this action too. For example: nft add rule inet filter input reject with icmp type host-unreachable In this rule above, this generates a meta nfproto dependency to match ipv4 traffic because we use a icmpv4 reason to reject. If the reason is not specified, we infer it from the context. Moreover, we have the new icmpx datatype. You can use this datatype for the bridge and the inet tables to simplify your ruleset. For example: nft add rule inet filter input reject with icmpx type host-unreachable We have four icmpx reason and the mapping is: ICMPX reason | ICMPv6 | ICMPv4 | | admin-prohibited | admin-prohibited | admin-prohibited port-unreachable | port-unreachable | port-unreachable no-route | no-route | net-unreachable host-unreachable | addr-unreachable | host-unreachable Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* queue: clean up queue statementPatrick McHardy2014-09-241-6/+15
| | | | | | | | | | | | | | | | | | - Rename keyword tokens to their actual keyword - Change the grammar to follow the standard schema for statements and arguments - Use actual expression for the queue numbers to support using normal range expressions, symbolic expression and so on. - restore comma seperation of flag keywords The result is that its possible to use standard ranges, prefix expressions, symbolic expressions etc for the queue number. We get checks for overflow, negative ranges and so on automatically. The comma seperation of flags is more similar to what we have for other flag values. It is still possible to use spaces, however this could be removed since we never had a release supporting that. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: add level option to the log statementPablo Neira Ayuso2014-07-251-5/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is required if you use upcoming Linux kernels >= 3.17 which come with a complete logging support for nf_tables. If you use 'log' without options, the kernel logging buffer is used: nft> add rule filter input log You can also specify the logging prefix string: nft> add rule filter input log prefix "input: " You may want to specify the log level: nft> add rule filter input log prefix "input: " level notice By default, if not specified, the default level is 'warn' (just like in iptables). If you specify the group, then nft uses the nfnetlink_log instead: nft> add rule filter input log prefix "input: " group 10 You can also specify the snaplen and qthreshold for the nfnetlink_log. But you cannot mix level and group at the same time, they are mutually exclusive. Default values for both snaplen and qthreshold are 0 (just like in iptables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revert broken reject icmp code supportPablo Neira Ayuso2014-06-201-3/+0
| | | | | | | | | | | | | | | | | This patch reverts Alvaro's 34040b1 ("reject: add ICMP code parameter for indicating the type of error") and 11b2bb2 ("reject: Use protocol context for indicating the reject type"). These patches are flawed by two things: 1) IPv6 support is broken, only ICMP codes are considered. 2) If you don't specify any transport context, the utility exits without adding the rule, eg. nft add rule ip filter input reject. The kernel is also flawed when it comes to the inet table. Let's revert this until we can provide decent reject reason support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: add ICMP code parameter for indicating the type of errorÁlvaro Neira Ayuso2014-06-161-0/+2
| | | | | | | | | | | | | | | | | | | | This patch allows to indicate the ICMP code field in case that we use to reject. Before, we have always sent network unreachable error as ICMP code, now we can explicitly indicate the ICMP code that we want to use. Examples: nft add rule filter input tcp dport 22 reject with host-unreach nft add rule filter input udp dport 22 reject with host-unreach In this case, it will use the host unreachable code to reject traffic. The default code field still is network unreachable and we can also use the rules without the with like that: nft add rule filter input udp dport 22 reject Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: Use protocol context for indicating the reject typeÁlvaro Neira Ayuso2014-06-161-0/+1
| | | | | | | | | This patch uses the protocol context to initialize the reject type considering if the transport protocol is tcp, udp, etc. Before this patch, this was left unset. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* queue: More compact syntaxÁlvaro Neira Ayuso2014-06-111-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use a new syntax more compact and break the current syntax. This new syntax is more similar than the nftables syntax that we use usually. We can use range like we have used in other case in nftables. Here, we have some examples: Before, If we want to declare a queue, we have used a syntax like this: nft add rule test input queue num 1 total 3 options bypass,fanout If we want to use the queue number 1 and the two next (total 3), we use a range in the new syntax, for example: nft add rule test input queue num 1-3 bypass fanout Also if we want to use only one queue, the new rules are like: nft add rule test input queue num 1 # queue 1 or nft add rule test input queue # queue 0 And if we want to add a specific flags we only need to put what flags we want to use: nft add rule test input queue bypass we don't need to use options and the comma for indicating the flags. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: Update the context only in equality relationsÁlvaro Neira Ayuso2014-06-051-1/+2
| | | | | | | | | | | | | | | | | If we add this rule: sudo nft add rule ip test input ip protocol != icmp and we try to list the rules in the table test, nftables show this error: nft: src/payload.c:76: payload_expr_pctx_update: Assertion `expr->op == OP_EQ' failed. This patch change the function payload_match_postprocess for updating only the context in equality relations case. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: fix double free in relational_binop_postprocess()Pablo Neira Ayuso2014-05-221-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | free(expr->right) and free(value) point to the same object, so one single free() is enough. This manifests in valgrind with: ==4020== Invalid read of size 4 ==4020== at 0x40A429: expr_free (expression.c:65) ==4020== by 0x414032: expr_postprocess (netlink_delinearize.c:747) ==4020== by 0x414C33: netlink_delinearize_rule (netlink_delinearize.c:883) ==4020== by 0x411305: netlink_events_cb (netlink.c:1692) ==4020== by 0x55040AD: mnl_cb_run (callback.c:77) ==4020== by 0x4171E4: nft_mnl_recv (mnl.c:45) ==4020== by 0x407B44: do_command (rule.c:895) ==4020== by 0x405C6C: nft_run (main.c:183) ==4020== by 0x405849: main (main.c:334) ==4020== Address 0x5d126f8 is 56 bytes inside a block of size 120 free'd ==4020== at 0x4C2AF5C: free (vg_replace_malloc.c:446) ==4020== by 0x41402A: expr_postprocess (netlink_delinearize.c:746) ==4020== by 0x414C33: netlink_delinearize_rule (netlink_delinearize.c:883) ==4020== by 0x411305: netlink_events_cb (netlink.c:1692) ==4020== by 0x55040AD: mnl_cb_run (callback.c:77) ==4020== by 0x4171E4: nft_mnl_recv (mnl.c:45) ==4020== by 0x407B44: do_command (rule.c:895) ==4020== by 0x405C6C: nft_run (main.c:183) ==4020== by 0x405849: main (main.c:334) ==4020== Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add support for setting ct markArturo Borrero2014-03-131-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for rule human-readable commentsPablo Neira Ayuso2014-02-271-0/+11
| | | | | | | | | | | | This patch adds support for human-readable comments: nft add rule filter input accept comment \"accept all traffic\" Note that comments *always* come at the end of the rule. This uses the new data area that allows you to attach information to the rule via netlink. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: meta: fix wrong type in attributesFlorian Westphal2014-02-171-2/+2
| | | | | | | | We segfault on 'list filter' when meta expr is used as _u8 returns invalid register 0. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix prefix expression handlingPatrick McHardy2014-02-171-29/+23
| | | | | | | | | | | | | | | | | | | | | | The prefix expression handling is full of bugs: - netlink_gen_data() is used to construct the prefix mask from the full prefix expression. This is both conceptually wrong, the prefix expression is *not* data, and buggy, it only assumes network masks and thus only handles big endian types. - Prefix expression reconstruction doesn't check whether the mask is a valid prefix and reconstructs crap otherwise. It doesn't reconstruct prefixes for anything but network addresses. On top of that its needlessly complicated, using the mpz values directly its a simple matter of finding the sequence of 1's that extend up to the full width. - Unnecessary cloning of expressions where a simple refcount increase would suffice. Rewrite that code properly. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_delinarize: convert *all* bitmask values into individual bit valuesPatrick McHardy2014-02-171-17/+37
| | | | | | | | | | | | | | We're currently only converting bitmask types as direct argument to a relational expression in the form of a flagcmp (expr & mask neq 0) back into a list of bit values. This means expressions like: tcp flags & (syn | ack) == syn | ack won't be shown symbolically. Convert *all* bitmask values back to a sequence of inclusive or expressions of the individual bits. In case of a flagcmp, this sequence is further converted to a list (tcp flags syn,ack). Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: add netlink specific locationPatrick McHardy2014-02-051-6/+1
| | | | | | | | | | Add a netlink_location and use it for error messages instead of internal_location. internal:0:0-0: Error: Could not add set: Operation not permitted => netlink: Error: Could not add set: Operation not permitted Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-141-4/+4
|\
| * netlink: fix wrong type in attributesPablo Neira Ayuso2014-01-101-4/+4
| | | | | | | | | | | | | | | | Fix inconsistent attribute types in meta and cmp expressions, use uint32_t. This problem was added when converting nft to use libmnl and libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>