summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* utils: Define __visible even if not supported by compilerPhil Sutter2019-11-211-0/+1
| | | | | | | | | Since __visible is now used directly, provide a fallback empty definition if HAVE_VISIBILITY_HIDDEN is not defined. Fixes: 7349a70634fa0 ("Deprecate untyped data setters") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: remove NFTA_FLOWTABLE_SIZEPablo Neira Ayuso2019-11-181-2/+0
| | | | | | | | Never defined in upstream Linux kernel uAPI, remove it. Reported-by: Eric Garver <eric@garver.life> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Eric Garver <eric@garver.life>
* flowtable: add support for handle attributeEric Jallot2019-11-061-0/+3
| | | | | | | Add code to implement NFTA_FLOWTABLE_HANDLE Signed-off-by: Eric Jallot <ejallot@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Deprecate untyped data settersPhil Sutter2019-10-317-7/+7
| | | | | | | | | These functions make assumptions on size of passed data pointer and therefore tend to hide programming mistakes. Instead either one of the type-specific setters or the generic *_set_data() setter should be used. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: multi-device supportPablo Neira Ayuso2019-10-282-0/+3
| | | | | | Add support for NFTA_HOOK_DEVS. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: Validate nftnl_set_elem_set() parametersPhil Sutter2019-10-162-1/+3
| | | | | | | | | | | | | Copying from nftnl_table_set_data(), validate input to nftnl_set_elem_set() as well. Given that for some attributes the function assumes passed data size, this seems necessary. Since data size expected for NFTNL_SET_ELEM_VERDICT attribute is sizeof(uint32_t), change type of 'verdict' field in union nftnl_data_reg accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data()Phil Sutter2019-10-151-0/+8
| | | | | | | | | | Array 'tb' has only 'attr_max' elements, the loop overstepped its boundary by one. Copy array_size() macro from include/utils.h in nftables.git to make sure code does the right thing. Fixes: 0adceeab1597a ("src: add ct timeout support") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: Export nftnl_set_list_lookup_byname()Phil Sutter2019-10-102-0/+3
| | | | | | | | | Rename and optimize internal function nftnl_set_lookup() for external use. Just like with nftnl_chain_list, use a hash table for fast set name lookups. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: synproxy stateful object supportFernando Fernandez Mancera2019-09-103-1/+14
| | | | | | | This patch adds synproxy stateful object support. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Make NFT_DYNSET_OP_DELETE knownAnder Juaristi2019-08-271-0/+1
| | | | | Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Make NFT_META_TIME_{NS, DAY, HOUR} knownAnder Juaristi2019-08-271-0/+6
| | | | | Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: resync nf_tables.h cache copyPablo Neira Ayuso2019-08-131-38/+82
| | | | | | Get this header in sync with 5.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Make NFT_META_{I,O}IFKIND knownPhil Sutter2019-07-181-0/+4
| | | | | | | | This only affects debug output, the key was properly handled in productive code paths already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add synproxy supportFernando Fernandez Mancera2019-07-062-0/+23
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for matching IPv4 optionsStephen Suryaputra2019-07-041-0/+2
| | | | | | | | | Add capability to have rules matching IPv4 options. This is developed mainly to support dropping of IP packets with loose and/or strict source route route options. Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add ct id supportBrett Mastbergen2019-06-211-0/+2
| | | | | | | The 'id' key returns the id of the connection entry Signed-off-by: Brett Mastbergen <bmastbergen@untangle.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ct expectation supportStéphane Veyret2019-06-193-1/+29
| | | | | | | | Add support for ct expectation objects, used to define specific expectations. Signed-off-by: Stéphane Veyret <sveyret@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: libnftnl 1.1.3 releaselibnftnl-1.1.3Pablo Neira Ayuso2019-05-271-0/+1
| | | | | | Moreover, add missing include/rule.h file to Makefile.am. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Remove redundant declaration of nftnl_gen_nlmsg_parse()Phil Sutter2019-05-141-1/+0
| | | | | | | | | The duplicated declaration was there since the functions initial introduction as 'nft_gen_nlmsg_parse()'. Fixes: 2e66fb09d6936 ("src: add ruleset generation class") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: add version option supportFernando Fernandez Mancera2019-04-082-0/+3
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* udata: add NFTNL_UDATA_* definitionsPablo Neira Ayuso2019-02-121-0/+33
| | | | | | | | Place them in the library, so iptables and nftables do not need to redefine them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc>
* set_elem: close a padding holeFlorian Westphal2019-02-081-1/+1
| | | | | | 224 -> 216 bytes on x86_64. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rule: Support NFTA_RULE_POSITION_ID attributePhil Sutter2019-01-283-0/+4
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "expr: add map lookups for hash statements"Laura Garcia Liebana2019-01-282-4/+4
| | | | | | | | | A better way to implement this from userspace has been found without specific code in the kernel side, revert this. Fixes: bb4b75aea5c0 ("expr: add map lookups for hash statements") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "expr: add map lookups for numgen statements"Laura Garcia Liebana2019-01-282-4/+4
| | | | | | | | | A better way to implement this from userspace has been found without specific code in the kernel side, revert this. Fixes: b97f45c2ebaa ("expr: add map lookups for numgen statements") Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: chain: Fix nftnl_chain_rule_insert_at()Phil Sutter2019-01-141-0/+1
| | | | | | | | | | Extrapolating from iptables nomenclature, one would expect that "insert" means to prepend the new item to the referenced one, not append. Change nftnl_chain_rule_insert_at() to do just that and introduce nftnl_chain_rule_append_at() to insert a rule after the referenced one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: chain: Add missing nftnl_chain_rule_del()Phil Sutter2019-01-141-0/+1
| | | | | | | | | | | Although identical to nftnl_rule_list_del(), this function adheres to the common naming style of per chain rule list routines introduced earlier, therefore helps with deprecating the global rule list API at a later point. Fixes: e33798478176f ("chain: Support per chain rules list") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Add lookup functions for chain list and rules in chainPhil Sutter2018-12-071-0/+2
| | | | | | | | | For now, these lookup functions simply iterate over the linked list until they find the right entry. In future, they may make use of more optimized data structures behind the curtains. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Support per chain rules listPhil Sutter2018-12-073-0/+42
| | | | | | | The implementation basically copies expr_list in struct nftnl_rule. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove nftnl_rule_cmp() and nftnl_expr_cmp()Pablo Neira Ayuso2018-10-244-7/+0
| | | | | | | | | | | | | | These functions are not very useful, rule comparison from this layer does not work well with implicit set definitions. This infrastructure was added as an attempt to support for deletion by name from this layer, which should be done from higher level libnftables library. Finally, we never had a client for this code in git.netfilter.org. Let's remove it and bump libversion for safety reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: osf: add ttl option supportFernando Fernandez Mancera2018-10-152-1/+4
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove json supportPablo Neira Ayuso2018-10-156-75/+0
| | | | | | We have better json support in libnftables these days. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for new secmark objectChristian Göttsche2018-10-093-1/+25
| | | | | | | The new object will hold security context strings. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add xfrm supportFlorian Westphal2018-09-212-0/+37
| | | | | | | Joint work with Máté Eckl. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: rt: ipsec match supportFlorian Westphal2018-09-211-0/+2
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: fix error in building testsHarsha Sharma2018-09-201-0/+1
| | | | | | | | | Add include header for NFTNL_CTTIMEOUT_ARRAY_MAX. Fixes compilation error "../include/obj.h:43:21: error: ‘NFTNL_CTTIMEOUT_ARRAY_MAX’ undeclared here (not in a function); Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: ct_timeout: use fixed size arrayPablo Neira Ayuso2018-08-312-1/+3
| | | | | | | | | Use an internal array and expose maximum size so we can just use the same array size for all protocol timeouts. This simplifies handling a bit and we don't need to set NFTNL_OBJ_CT_TIMEOUT_L4PROTO in first place. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ct timeout supportHarsha Sharma2018-08-133-1/+46
| | | | | | | | Add support for ct timeout objects, used to assign connection tracking timeout policies. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add support for matching tunnel metadataPablo Neira Ayuso2018-08-062-0/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* obj: add tunnel supportPablo Neira Ayuso2018-08-063-1/+116
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add osf supportFernando Fernandez Mancera2018-07-302-0/+16
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: Add tproxy supportMáté Eckl2018-07-302-0/+22
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* socket: Expose socket mark via socket expressionMáté Eckl2018-07-301-1/+3
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: missing C++ linkage in headersPablo Neira Ayuso2018-07-034-0/+32
| | | | | | | | A few files (batch.h / common.h / set.h / udata.h) are missing the usual. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1268 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: extend fwd to support address and protocolPablo Neira Ayuso2018-06-062-0/+6
| | | | | | To support forwarding through neighbour layer from ingress. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add connlimit supportPablo Neira Ayuso2018-06-063-1/+26
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for native socket matchingMáté Eckl2018-06-012-0/+30
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: updated nf_tables.hMáté Eckl2018-05-291-7/+17
| | | | | | | Joint work with Pablo. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add nftnl_rule_list_insert_at()Pablo Neira Ayuso2018-05-281-0/+1
| | | | | | Allow to add rule object before any existing rule. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add map lookups for hash statementsLaura Garcia Liebana2018-05-232-0/+6
| | | | | | | | | | | This patch introduces two new attributes for hash expression to allow map lookups where the hash is the key. The new attributes are NFTNL_EXPR_HASH_SET_NAME and NFTNL_EXPR_HASH_SET_ID in order to identify the given map. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>