summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* src: internal set id allocation from nft_ruleset_parse*()Alvaro Neira2014-10-096-22/+95
| | | | | | | | | Extends this function to attach the set to the rule through the set_idi. If it doesn't exist in the list, maybe the set already exists in the kernel. In that case, we don't set any id. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ruleset: add set id to parsed setsAlvaro Neira2014-10-091-0/+4
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: also test nat flags attributeArturo Borrero2014-10-033-2/+6
| | | | | | | The nat expression has a new attribute. Let's give some testing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add tests for the masq expressionArturo Borrero2014-10-035-0/+96
| | | | | | | The masq expression is lacking of tests. Let's add some. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: masq: optional printing of flags attr in snprintf_defaultArturo Borrero2014-10-031-2/+4
| | | | | | | | The flags attribute is optional. Thus we should print only if it was originally set. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-add: fix wrong buffer pointerArturo Borrero2014-09-301-1/+2
| | | | | | | We should point to the batch buffer as returned by the libmnl helper. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-set-parse-add: add batching supportArturo Borrero2014-09-301-8/+35
| | | | | | | Batching is needed in current kernels. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-set-json-add: generalize parsing format supportArturo Borrero2014-09-292-29/+52
| | | | | | Let's create a single code example with XML/JSON support. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* examples: nft-rule-parse-add: add batching supportArturo Borrero2014-09-231-6/+29
| | | | | | | Let's add support for current kernels. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: merge nft-rule-{xml|json}-add.cArturo Borrero2014-09-233-156/+54
| | | | | | | Merge the two examples in just one. An input argument choose the format to use. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ruleset generation classPablo Neira Ayuso2014-09-196-2/+310
| | | | | | | | | | | | | | The generation object currently only contains the uint32_t that indicates the generation ID. I could have just add the API to return the uint32_t ID instead, but I think this API is easier to extend without adding new APIs. We can probably include meaningful statistics in the generation message in the future without much hassle. This patch also extends examples/nft-events.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix set nlmsg desc parsingArturo Borrero2014-09-181-20/+2
| | | | | | | | In commit ff62959("set: add support for set mechanism selection") the support for parsing the nested attribute (NFTA_SET_DESC) was incorrect. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: nft_fprintf: prevent an empty buffer from being printedArturo Borrero2014-09-161-2/+2
| | | | | | | | | | If the snprintf_cb() printed 0 characters, no \0 exists in the buffer. Also, in that case fprintf() is meant to print nothing, so we can just exit. This patch addresses new cases of textual output by libnftnl with trash. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nf_tables.h: add NFTA_MASQ_UNSPECArturo Borrero2014-09-121-0/+1
| | | | | | | To keep this consistent with other nft_*_attributes. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add new nft_masq expressionArturo Borrero2014-09-094-0/+226
| | | | | | | | This patch adds userspace support to nft_masq, the new expression to perform masquerade. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: nat: add support for the new flags attributeArturo Borrero2014-09-093-3/+48
| | | | | | | This patchs adds support for the new flags attribute in the nft_nat expression. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* expr: meta: Add devgroup supportAna Rey2014-09-032-1/+7
| | | | | | | | The kernel support is add in commit: netfilter: nf_tables: add devgroup support in meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of cached copies of x_tables.h and xt_LOG.hPablo Neira Ayuso2014-08-317-233/+12
| | | | | | | | | | Keeping the full cached copy the of x_tables.h file in tree is too much for just the XT_EXTENSION_MAXNAMELEN constant. Similarly, xt_LOG.h is not actually required by the tests, we can use any whatever syntetic data to make sure the setter and getter provide the same result. So, let's get rid of these headers from the library tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix printing of XML/JSON event wrapper header/footerArturo Borrero2014-08-251-16/+18
| | | | | | | | | | Use the nft_fprintf() helper. The helper handles \0 properly. Before this patch, we get trash in the output due to the buffer being printed without any \0. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-del: add batching supportArturo Borrero2014-08-241-6/+30
| | | | | | | Add batching support so this code example works with current kernels. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-del: add table_del_parse()Arturo Borrero2014-08-241-20/+35
| | | | | | | This new function parses the input arguments and generates the nft_table. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-add: add batching supportArturo Borrero2014-08-241-5/+28
| | | | | | | Adds batching support to this code example, so it works with current kernels. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-add: add table_add_parse()Arturo Borrero2014-08-241-20/+35
| | | | | | | This fucntion parses the command line options and creates the nft_table object. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-table-parse-add: add batching supportArturo Borrero2014-08-241-8/+32
| | | | | | | Add batching support to operate with recent kernels. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: merge nft-table-{xml|json}-add.cArturo Borrero2014-08-243-159/+55
| | | | | | | Merge the two examples in one. An input argument choose the format to use. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Add cpu support for meta expresionAna Rey2014-08-242-2/+5
| | | | | Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Add pkttype supportAna Rey2014-08-242-1/+4
| | | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: define xfree() as macroPablo Neira Ayuso2014-08-202-7/+2
| | | | | | | | | | | | | | | | | | | | | | Original description from Thomas Petazzoni: When ELF binaries and shared libraries are used, the internal functions of libnftnl such as xfree() are not visible to the outside world (their visibility is 'hidden'). Therefore, the fact that other programs (especially nftables) may have symbols with the same name does not cause any problem. However, when doing static linking on a non-ELF platform (such as Blackfin, which uses the FLAT binary format), there is no way of encoding this visibility. Therefore, the xfree() symbols of libnftnl becomes visible to the outside world, causing a conflict with the xfree() symbol defined by nftables. To solve this, this patch convers xfree as a macro instead of a function. Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-parse-add: add batching supportArturo Borrero2014-08-181-8/+29
| | | | | | | Add batching support to operate with current kernels. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: merge nft-chain-{xml|json}-add.cArturo Borrero2014-08-183-168/+61
| | | | | | | | Merge the two examples in one. Use an input argument to choose the format to parse. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: use proper free functionArturo Borrero2014-08-181-1/+1
| | | | | | | | Let's use the proper free function to liberate the set_elem, so we avoid potential memory leaks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-del: support new batching interfaceArturo Borrero2014-08-181-7/+30
| | | | | | | | Chains are included in the batch since 3.16. Add support to delete chains dependending on the available interface. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-del: add chain_del_parse()Arturo Borrero2014-08-181-6/+19
| | | | | | | | This function parses the command line options and creates the nft_chain object. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-add: support new batching interfacePablo Neira Ayuso2014-08-141-5/+29
| | | | | | | Chains are included in the batch since 3.16. Add support for adding the chains dependending on the available interface. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-chain-add: add chain_add_parse()Pablo Neira Ayuso2014-08-141-30/+43
| | | | | | | This function parses the command line options and it creates the nft_chain object. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* common: add batching interfacesPablo Neira Ayuso2014-08-143-0/+98
| | | | | | | | | | | | | | This patch adds the following new interfaces: int nft_batch_is_supported(void); void nft_batch_begin(char *buf, uint32_t seq); void nft_batch_end(char *buf, uint32_t seq); Quite likely this is going to be reused by third party applications requiring to put things in the batch. We already have potential clients for this code in nft and iptables-compat. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add nft_set_elems_nlmsg_build_payload_iter()Pablo Neira Ayuso2014-07-253-11/+79
| | | | | | | | | This new interface allows you to put as many set elements as possible into a netlink message. The iterator stores the last element that has fit into a netlink message, so you can continue adding more set elements across several netlink messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nft-set-add: use batch infraestructureArturo Borrero2014-07-241-44/+84
| | | | | | | | It uses the existing nfnl batching approach using the generic mnl netlink message batching infrastructure. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add support for set mechanism selectionArturo Borrero2014-07-243-3/+167
| | | | | | | | | | This patch adds support to select the set mechanism. The kernel support was added in commit: c50b960 netfilter: nf_tables: implement proper set selection Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-2026-229/+128
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: define variable flags in xml parserÁlvaro Neira Ayuso2014-07-151-1/+1
| | | | | | | | | | | In the xml parser, we have used a variable flags for parsing it but we have forgot define it. This patch solves a compile error like: expr/log.c:263:12: error: 'flags' undeclared (first use in this function) Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: add support for level and flagsPablo Neira Ayuso2014-07-013-6/+91
| | | | | | This is required by changes scheduled for Linux kernel 3.17. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Do not print unset attributes in jsonAna Rey2014-06-301-71/+95
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Rename variables in nft_jansson_parse_chain functionsAna Rey2014-06-301-32/+32
| | | | | | | Renames some variables for code readability reasons. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Do not print unset attributes in xmlAna Rey2014-06-301-46/+77
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Add all support of use attributeAna Rey2014-06-301-6/+18
| | | | | | | | | Add set, unset, get, parse and build payload implementation for use value. These changes are neeeded for a correct import/export of xml/json file Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Do not print unset values in json fileAna Rey2014-06-301-22/+42
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Do not print unset values in xml fileAna Rey2014-06-301-13/+34
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Add set, unset and parse implementation for the use attributeAna Rey2014-06-301-6/+12
| | | | | | | | | Add some parts of the implemention of 'use' vualue in table that miss it. These changes are neeeded for a correct import/export of xml/json file Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Use nft_table_attr_set_* in the xml functionsAna Rey2014-06-301-13/+5
| | | | | | | Code refactoring to use nft_table_attr_set_* in parse xml functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>