summaryrefslogtreecommitdiffstats
path: root/iptables/nft.c
Commit message (Collapse)AuthorAgeFilesLines
* nft: load tables and chains based on /etc/xtables.confPablo Neira Ayuso2013-12-301-3/+93
| | | | | | | | | If /etc/xtables.conf is available, use the configuration there to autoload the xtables built-in table and chain so you can define custom configurations. Otherwise, rely on default common table/chain configuration. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add -4 and -6 supportPablo Neira Ayuso2013-12-301-1/+1
| | | | | | | | | | Now you can specify: xtables-restore -6 < my-ip6tables-ruleset to restore the IPv6 rule-set. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Split nft core to become family independantTomasz Bursztyka2013-12-301-878/+18
| | | | | | | | | | | | This makes nft core code independant from the family. Each family needs to implement and provide a struct nft_family_ops {}. This split will ease the future support of bridge and arp rules manipulations. [ updated header files and rebased upon the current tree --pablo ] Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add xtables-eventsPablo Neira Ayuso2013-12-301-5/+14
| | | | | | | | | | | | | | Add new program to listen to rule updates: shell$ xtables-events -A INPUT -m state --state ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -D INPUT -p tcp -m tcp --dport 22 -j ACCEPT -D INPUT -m state --state ESTABLISHED -j ACCEPT You can use `-c' option to display counters. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: fix -D with -pPablo Neira Ayuso2013-12-301-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: ipv6: add missing break in nft_parse_payload_ipv6Pablo Neira Ayuso2013-12-301-0/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix crash if TRACE is usedPablo Neira Ayuso2013-12-301-2/+4
| | | | | | And any other match and target with no save function defined. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: nft: add protocol and flags for xtables over nf_tablesPablo Neira Ayuso2013-12-301-0/+8
| | | | | | Add protocol and flags for the compatibility layer. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: support atomic commitPablo Neira Ayuso2013-12-301-0/+56
| | | | | | | | | | | | | Use new services in nf_tables to support atomic commit. Commit per table, although we support global commit at once, call commit for each table to emulate iptables-restore behaviour by now. Keep table dormant/wake up code in iptables/nft.c as it can be used in the future. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: purge out user-define chains from the kernelPablo Neira Ayuso2013-12-301-9/+54
| | | | | | | xtables-restore has to purge out user-defined chains that are not defined in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add IPv6 supportTomasz Bursztyka2013-12-301-173/+482
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary of changes to add IPv6 support to the xtables utility: * modify all commands (add, delete, replace, check and listing) to support IPv6 addresses. And for the internal nft library: * add family to struct nft_handle and modify all caller to use this family instead of the hardcoded AF_INET. * move code that we can re-use for IPv4 and IPv6 into helper functions. * add IPv6 rule printing support. * add support to parse IPv6 address. Pablo added several improvements to this patch: * added basic xtables-save and xtables-restore support (so it defaults to IPv4) * fixed a couple of bugs found while testing * added reference when -f is used to point to -m frag (until we can make this consistent with IPv4). Note that we use one single xtables binary utility for IPv4 and IPv6. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: adapt chain rename to recent Patrick's updatesPablo Neira Ayuso2013-12-301-3/+52
| | | | | | | This patch gets existing code in sync with Patrick's chain renaming new approach. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: add support for dormant tablesPablo Neira Ayuso2013-12-301-3/+52
| | | | | | This patch adds support for dormant tables for xtables-restore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use chain typesPablo Neira Ayuso2013-12-301-3/+49
| | | | | | We use the new special chain types defined in the kernel. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: use 64-bits handlePablo Neira Ayuso2013-12-301-4/+5
| | | | | | Now that we use that in kernel space and in libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: remove __nft_check_rulePablo Neira Ayuso2013-12-301-38/+104
| | | | | | | Rework code to remove __nft_check_rule and split it into logical fragments. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: move priority to chain instead of tablePablo Neira Ayuso2013-12-301-34/+43
| | | | | | | NAT table uses different chain priorities, adapt the existing code to allow this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: fix missing rule listing in custom chains with -LPablo Neira Ayuso2013-12-301-5/+1
| | | | | Reported-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* iptables: nft: Add support for -R optionTomasz Bursztyka2013-12-301-10/+18
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: Refactor __nft_rule_check to return rule handle when relevantTomasz Bursztyka2013-12-301-6/+9
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: Fix -D chain rulenum optionTomasz Bursztyka2013-12-301-3/+4
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* nft: Add support for chain rename options (-E)Tomasz Bursztyka2013-12-301-5/+28
| | | | Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* iptables: nft: add -f supportPablo Neira Ayuso2013-12-301-0/+90
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rework automatic creation of built-in table and chainsPablo Neira Ayuso2013-12-301-93/+112
| | | | | | | | | | | | | | | This patch reworks the automatic creation of built-in table and chains. Now it initializes all built-in chains belonging a table at once. This happens with commands: -P, -A, -I, -N Note that xtables skips chain initialization if it notices that the table already exists in the kernel. Thanks to Tomasz Bursztyka for spotting problems with -N. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* automatic creation of built-in table and chainsPablo Neira Ayuso2013-12-301-38/+105
| | | | | | | | | | | | | | | | | | | | | In order to emulate the iptables behaviour, this patch changes the current behaviour to: 1st) check if the table and chains are built-in. 2nd) If they don't exists, create them. If they exists, don't touch them. The automatic creation happens in the -I and -P paths. We should provide a new command to allow to delete (unregister) built-in tables and chains. It would be similar to unloading the iptable_X module that registers the custom table. This is not done for other commands like -C or -D since they will fail while trying to find the rule in the kernel if such combination of chain and table does not exists. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* use nf_tables and nf_tables compatibility interfacePablo Neira Ayuso2013-12-301-0/+2764
This patch adds the following utilities: * xtables * xtables-restore * xtables-save * xtables-config They all use Patrick's nf_tables infrastructure plus my compatibility layer. xtables, xtables-restore and xtables-save are syntax compatible with ip[6]tables, ip[6]tables-restore and ip[6]tables-save. Semantics aims to be similar, still the main exception is that there is no commit operation. Thus, we incrementally add/delete rules without entire table locking. The following options are also not yet implemented: -Z (this requires adding expr->ops->reset(...) so nft_counters can reset internal state of expressions while dumping it) -R and -E (this requires adding this feature to nf_tables) -f (can be implemented with expressions: payload 6 (2-bytes) + bitwise a&b^!b + cmp neq 0) -IPv6 support. But those are a matter of time to get them done. A new utility, xtables-config, is available to register tables and chains. By default there is a configuration file that adds backward compatible tables and chains under iptables/etc/xtables.conf. You have to call this utility first to register tables and chains. However, it would be possible to automagically register tables and chains while using xtables and xtables-restore to get similar operation than with iptables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>