summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* libnftables: Introduce getters and setters for everythingPhil Sutter2017-10-243-18/+117
| | | | | | | | | | | | | | | | | | | | | | | | | This introduces getter/setter pairs for all parts in struct nft_ctx (and contained structs) which should be configurable. Most of them are simple ones, just allowing to get/set a given field: * nft_ctx_{get,set}_dry_run() -> ctx->check * nft_ctx_output_{get,set}_numeric() -> ctx->output.numeric * nft_ctx_output_{get,set}_stateless() -> ctx->output.stateless * nft_ctx_output_{get,set}_ip2name() -> ctx->output.ip2name * nft_ctx_output_{get,set}_debug() -> ctx->debug_mask * nft_ctx_output_{get,set}_handle() -> ctx->output.handle * nft_ctx_output_{get,set}_echo() -> ctx->output.echo A more complicated case is include paths handling: In order to keep the API simple, remove INCLUDE_PATHS_MAX restraint and dynamically allocate nft_ctx field include_paths instead. So there is: * nft_ctx_add_include_path() -> add an include path to the list * nft_ctx_clear_include_paths() -> flush the list of include paths Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: Use nft_run_cmd_from_buffer()Phil Sutter2017-10-243-25/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make CLI code adhere to intended libnftables API by not open coding what nft_run_cmd_from_buffer() does. This way, nft_run() has no users outside of src/libnftables.c anymore and therefore can become static. Since nft_run_cmd_from_buffer() takes care of scanner initialization and libmnl socket passed to cli_init() is present as nft_ctx field as well, signature of cli_init() can be reduced to just take nft_ctx pointer as single argument. Note that this change introduces two (possibly unwanted) side-effects: * Input descriptor passed to scanner_push_buffer() is changed from the CLI-specific one to the one used by nft_run_cmd_from_buffer(). In practice though, this doesn't make a difference: input descriptor types INDESC_CLI and INDESC_BUFFER are treated equally by erec_print(). Also, scanner_push_buffer() NULLs input descriptor name, so that is not used at all in latter code. * Error messages are printed to stderr instead of cli_nft->output. This could be fixed by introducing an 'error_output' field in nft_ctx for nft_run_cmd_from_buffer() to use when printing error messages. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Introduce nft_ctx_flush_cache()Phil Sutter2017-10-242-4/+8
| | | | | | | | | | | | | | | | This allows an application to explicitly flush caches associated with a given nft context, as seen in cli_complete(). Note that this is a bit inconsistent in that it releases the global interface cache, but nft_ctx_free() does the same so at least it's not a regression. Note that there is no need for explicit cache update routine since cache is populated during command execution depending on whether it is needed or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Move library stuff out of main.cPhil Sutter2017-10-243-252/+265
| | | | | | | | This creates src/libnftables.c and include/nftables/nftables.h which will become the central elements of libnftables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Fix for wrong argument passed to cache_release in nft_ctx_freePhil Sutter2017-10-201-2/+2
| | | | | | | | | nft_ctx_free() should not refer to the global 'nft' variable, this will break as soon as the function is moved away from main.c. In order to use the cache reference from passed argument, the latter must not be const. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: fix netlink debug flag when listing table/rulesFlorian Westphal2017-10-191-2/+2
| | | | | | | | | | | | | | | nft --debug=netlink list table ... has no effect anymore. Callers pass in debug_mask & DEBUG_NETLINK, which gets converted to 0/1 because the arg is a boolean. Later on this bool is converted back to an integer, but that won't have the desired result. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use nftnl_expr_fprintf() in netlink_dump_expr()Phil Sutter2017-10-171-4/+2
| | | | | | | This gets rid of the temporary buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix element addition to map with stateful objectPablo Neira Ayuso2017-10-171-3/+8
| | | | | | | | | | | | | | | Expressions with EXPR_F_INTERVAL_END flag set on have no right hand side, so they store no stateful object. Skip them so we don't crash on this. # nft add map x testmap { type inet_service: counter\; flags interval\;} # nft add counter x testcounter # nft add element x testmap { 0-100 : "testcounter" } Segmentation fault This patch also fixes the listing codepath. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1190 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: make pointers in string arrays constantHarsha Sharma2017-10-094-8/+8
| | | | | | | | Static const char * array should be static const char * const array as per linux-kernel coding style. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: IPv4-Mapped IPv6 addresses supportPablo Neira Ayuso2017-10-091-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The scanner rejects IPv4-Mapped IPv6 addresses, eg. # cat test #!/usr/sbin/nft -f flush ruleset table inet global { set blackhole_ipv6 { type ipv6_addr flags interval elements = { ::ffff:0.0.0.0/96 } } } # nft -f test test:8:30-38: Error: syntax error, unexpected string, expecting comma or '}' elements = { ::ffff:0.0.0.0/96 } ^^^^^^^^^^ According to RFC4291, Sect. 2.5.5.2. IPv4-Mapped IPv6 Address: | 80 bits | 16 | 32 bits | +--------------------------------------+--------------------------+ |0000..............................0000|FFFF| IPv4 address | +--------------------------------------+----+---------------------+ Update scanner bits to parse this. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1188 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in set statement keyAnders K. Pedersen2017-10-061-3/+3
| | | | | | | | | | | | | | | | | | | | Before this patch the following fails: # nft add rule ip6 filter x \ set add ip6 saddr . ip6 daddr @test nft: netlink_linearize.c:648: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Aborted This is was previously fixed for flow statements in fbea4a6f4449 ("netlink_linearize: skip set element expression in flow table key"), and this patch implements the same change for set statements by using the set element key in netlink_gen_set_stmt(). nft-test.py is updated to support set types with concatenated data types in order to support testing of this. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Fix debug outputPhil Sutter2017-10-064-16/+29
| | | | | | | | | | | | | | | | | | | When introducing output_fp, debug output in src/evaluate.c was not adjusted and therefore broke. This patch restores eval debug output by applying the following changes: - Change erec_print() and erec_print_list() to take a struct output_ctx pointer as first argument and use output_fp field as destination to print to. - Drop octx_debug_dummy variable and instead use octx pointer from struct eval_ctx for debug output. - Add missing calls to erec_destroy() in eval debug output which should eliminate another mem leak. Fixes: 2535ba7006f22 ("src: get rid of printf") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow to used named limit from dictionaries tooPablo Neira Ayuso2017-10-021-0/+9
| | | | | | | Allow to use limit objects from dictionaries. Fixes: c0697eabe832 ("src: add stateful object support for limit") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: fix broken sequence number allocationPablo Neira Ayuso2017-10-021-1/+1
| | | | | | | | Wrong arithmetics with pointer. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1178 Fixes: 0d9d04c31481 ("src: make netlink sequence number non-static") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rt: add keyword distinction for nexthop vs nexthop6Florian Westphal2017-09-293-15/+46
| | | | | | | | | | | | | | | | | | | | | the rt expression currently always sets NFT_RT_NEXTHOP4 and then uses the network base to determine if its really supposed to be NEXTHOP6. For inet, this will fail because the network base is not known, so this currently enforces need for "meta nfproto" to dermine the type. Allow following syntax instead: rt ip nexthop rt ip6 nexthop There is no need for a dependency anymore, as rt expression checks the hook protocol, ie. NEXTHOP4 will break if the hook pf is not NFPROTO_IPV4. Cc: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ct: print nfproto name for some header fieldsFlorian Westphal2017-09-291-5/+24
| | | | | | | this prints "original saddr|daddr $NFPROTO" to make output symmetric with the syntax that we now prefer on input side. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: unifiy meta and ct postprocessingFlorian Westphal2017-09-291-28/+22
| | | | | | | | | From postprocess point of view meta and ct are logically the same, except that their storage area overlaps (union type), so if we extract the relevant fields we can move all of it into a single helper and support dependency store/kill for both expressions. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ct: add eval part to inject dependencies for ct saddr/daddrFlorian Westphal2017-09-292-19/+77
| | | | | | | | | | | | | | | | | nft has enough context to determine if a dependeny is needed. add rule ip filter ct original ip6 saddr allows nft to generate an error due to conflicting bases (ip vs ip6). add rule inet filter ct original ip6 saddr allows nft to inject an ipv6 dependency expression. add rule inet filter ct original saddr will print an error and will suggest to add ip/ip6 keyword. Delinerize and print support will be added in followup patches. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ct: store proto base of ct key, if anyFlorian Westphal2017-09-291-0/+13
| | | | | | | | | | | ct keys can match on network and tranasport header protocol elements, such as port numbers or ip addresses. Store this base type so a followup commit can store and kill dependencies, e.g. if bsae is network header we might be able to kill an earlier expression because the dependency is implicit. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add alternate syntax for ct saddrFlorian Westphal2017-09-293-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | current syntax is: ct original saddr $address problem is that in inet, bridge etc. we lack context to figure out if this should fetch ipv6 or ipv4 from the conntrack structure. $address might not exist, rhs could e.g. be a set reference. One way to do this is to have users manually specifiy the dependeny: ct l3proto ipv4 ct original saddr $address Thats ugly, and, moreover, only needed for table families other than ip or ipv6. Pablo suggested to instead specify ip saddr, ip6 saddr: ct original ip saddr $address and let nft handle the dependency injection. This adds the required parts to the scanner and the grammar, next commit adds code to eval step to make use of this. Signed-off-by: Florian Westphal <fw@strlen.de>
* main: Drop stdout hack to expose nft_print() implementation issuesPhil Sutter2017-09-291-3/+1
| | | | | | | | | This was helpful when testing nft_print() implementation, but breaks 'nft --help' output. Also, with this in place typical printf-debugging would have to use stderr at all times which is confusing at least. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Flush output from nft_gmp_print()Phil Sutter2017-09-291-0/+1
| | | | | | | | | | This adds a missing call to fflush() to nft_gmp_print() just like in nft_print(). This is strictly not necessary since usually nft_gmp_print() is followed by a call to nft_print() but better not rely upon this assumption. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of printfPhil Sutter2017-09-2918-394/+475
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Refactor chain_print_declaration()Phil Sutter2017-09-291-12/+6
| | | | | | | | | Instead of having two nearly identical printf() calls for netdev and other chains, print the common parts separately and include the device bit only for netdev chains. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* erec_print: Pass output FILE pointer to netlink_dump_expr()Phil Sutter2017-09-292-3/+4
| | | | | | | | | | It was a bit odd that erec_print() outputs to a given FILE pointer but then calls netlink_dump_expr() which just prints to stdout. Fix this by passing the given FILE pointer along so output is guaranteed to go to the same destination. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Simplify tcp option printing a bitPhil Sutter2017-09-291-8/+4
| | | | | | | This eliminates the need for that temporary buffer. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Use C99-style initializer in cache_init()Phil Sutter2017-09-291-9/+8
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bison: permit keywords in list_stmt_expressionsFlorian Westphal2017-09-271-4/+7
| | | | | | | | | | | | | 'ct event set label' and 'ct event set new or label' work, but 'ct event set new, label' did not: nft add rule filter input ct event set new,label Error: syntax error, unexpected label This changes the definition to also contain keyword symbol expressions. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: parser_bison: rename ct_block to ct_helper_blockFlorian Westphal2017-09-271-8/+8
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: prepare for future ct timeout policy supportFlorian Westphal2017-09-273-93/+22
| | | | | | | | | | | | | | | | Change all places that expect ct helper tokens (ct helper configuration) to CT HELPER. ct_obj_kind is removed. When we add ct timeout support, we will add a new ct_timeout_block, plus extra rules. We won't extend ct_block, it prevents the parser from detecting bogus syntax that only makes sense for ct helper but not for something else for instance. ct_block should be renamed to ct_helper_block, will be done in followup patch. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ct: remove unused functionsFlorian Westphal2017-09-271-50/+0
| | | | | | | | | since commit b0c2606ed02fed828ab7c34227e355f5542bc925 ("parser_bison: use keywords in ct expression") we no longer abuse string for this, so there are no users of these helpers anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: store expression as set key instead of data typeFlorian Westphal2017-09-277-80/+98
| | | | | | | | | | | | Doing so retains legth information in case of unqualified data types, e.g. we now have 'meta iifname' expression instead of an (unqualified) string type. This allows to eventually use iifnames as set keys without adding yet another special data type for them. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: prepare to store expr key rather than datatypeFlorian Westphal2017-09-271-19/+23
| | | | | | | | | | | | | | | | | | | currently set definitions store a datatype rather than an expression. In order to support use of unqualified data types (string in particular), this prepares implicit set definition helper to expect an expression instead of plain data type. This also has the advantage that we can use EXPR_CONCAT to retain the original expressions when key concatentation is used, e.g. 'meta iifname . tcp dport'. The netlink serialization code can use this info to store individual key lengths independently of data types. Would also allow later on to store the original names of the expressions, e.g. "ip daddr", in the kernel to support a future typeof keyword, e.g. 'type typeof(ip daddr)' instead of 'type ipv4_addr'. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow helper keyword in ct object kindPablo Neira Ayuso2017-09-271-5/+6
| | | | | | | The helper keyword clashes with the string rule, make sure we still accept ct helper object types from the parser. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: use keywords in ct expressionPablo Neira Ayuso2017-09-272-54/+44
| | | | | | | | Using string give us more chances to hit shift/reduce conflicts when extending this grammar, more specifically, from the stmt_expr rule, so add keywords for this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: consolidate stmt_expr rulePablo Neira Ayuso2017-09-271-27/+112
| | | | | | | | | | | | | | | | | | Extend stmt_expr and use it from all of our statement rules. Add more rules to describe what we take from statement expressions, instead of reusing rhs_expr which is allowing way more things that we actually need here. This is causing us problems when extending the grammar. After this patch, you will hit this: parser_bison.y: warning: 2 shift/reduce conflicts [-Wconflicts-sr] However, this is fixed by the follow up patches: parser_bison: allow helper keyword in ct object kind parser_bison: use keywords in ct expression Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* monitor: Fix for incorrect debug_maskPhil Sutter2017-09-271-7/+8
| | | | | | | | | | | | | | The field 'debug_mask' of struct netlink_mon_handler was left uninitialized in do_command_monitor() so it contained garbage from the stack. Fix this by initializing it with the debug_mask value from struct netlink_ctx. While being at it, change the code to make use of C99-style initializer, which will also avoid things like this in future. Fixes: be441e1ffdc24 ("src: add debugging mask to context structure") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* main: Fix for return of uninitialized variable in nft_run_cmd_from_filename()Phil Sutter2017-09-271-1/+3
| | | | | | | | | If scanner_read_file() failed, the function would return an uninitialized value. Fixes: 3db28321b64a6 ("src: add nft_run_cmd_*() functions") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: do not set NLM_F_CREATE in deletion requestsPablo Neira Ayuso2017-09-081-2/+5
| | | | | | | This flag is not legal there, it only makes sense for addition requests. This patch has no impact at all in any of the nf_tables kernel versions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add flags fo nft_ctx_newEric Leblond2017-09-041-9/+11
| | | | | | | | | | | By adding flags to nft_ctx_new, we will have a minimum capabilities of changing the way the nft_ctx is created. For now, this patch uses a simple value that allow the user to specify that he will handle netlink by himself. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object support for limitPablo M. Bermudo Garay2017-09-046-5/+167
| | | | | | | | This patch adds support for a new type of stateful object: limit. Creation, deletion and listing operations are supported. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_netlink_init()Pablo Neira Ayuso2017-09-011-2/+10
| | | | | | | Add these two new functions to set up netlink sockets in the global context structure. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: remove nfsock_open()Pablo Neira Ayuso2017-09-011-11/+5
| | | | | | Just merge this code to netlink_open_sock(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move nf_sock into nft_ctx structurePablo Neira Ayuso2017-09-011-15/+11
| | | | | | | | | | The idea is to provide a simplistic API for non-netlink wise people. Add a field in struct nft_ctx to store the socket. The advanced API that we're planning will just simply leave this unset, since netlink IO will be exposed. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: convert expr_rt byteorder when evaluating statment argFlorian Westphal2017-08-281-0/+2
| | | | | | | | | | | | | | expr_rt might write data in host byte order, so make sure to convert if needed. This makes 'tcp option maxseg size rt mtu' actually work, right now such rules are no-ops because nft_exthdr never increases the mss. While at it, extend the example to not bother testing non-syn packets. Reported-by: Matteo Croce <technoboy85@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: Fix memleaks for STRING token (and derived ones)Phil Sutter2017-08-282-10/+37
| | | | | | | | | | | | | | The common paradigm here is that all parser rules converting string tokens into symbols must free the string token if it's not used anymore. This is unrelated to the %destructor directive, since that will apply only if the parser discards the token, which is not the case then. While being at it, simplify error handling in parser rule for listing conntrack helpers (error() won't return NULL) and drop the unused extra parameter passed to error() in level_type rule. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: call nft_init() and nft_exit() from context routinesPablo Neira Ayuso2017-08-241-5/+4
| | | | | | | So we don't forget all these caches should be placed into struct nft_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: release caches from nft_ctx_free() pathEric Leblond2017-08-241-3/+2
| | | | | | | | | | Release existing caches from nft_ctx_free(). Still, the iface cache should be good to place it in the nft_ctx structure. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_run_cmd_*() functionsEric Leblond2017-08-241-22/+54
| | | | | | | | | | Add new function to read nftables command from a file and buffer, that we can expose as library. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nft_ctx_new() and nft_ctx_free()Eric Leblond2017-08-241-25/+39
| | | | | | | | | | These new functions allows us to allocate and release the context structure. This is going to be useful for libnftables. Joint work with Pablo Neira. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>