summaryrefslogtreecommitdiffstats
path: root/src/expr
Commit message (Collapse)AuthorAgeFilesLines
* exthdr: remove unused variable uval8Alexander Alemayhu2017-02-231-1/+0
| | | | | | | | | | | | | Was added but not used in d7b451fe1a45 (src: add TCP option matching requirements, 2017-02-07). Fixes the following warning: expr/exthdr.c: In function ‘nftnl_expr_exthdr_json_parse’: expr/exthdr.c:244:10: warning: unused variable ‘uval8’ [-Wunused-variable] uint8_t uval8; ^~~~~ Signed-off-by: Alexander Alemayhu <alexander@alemayhu.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: ct: add zone supportFlorian Westphal2017-02-191-1/+2
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Add missing exthdr flags casesPhil Sutter2017-02-161-0/+4
| | | | | | | | | Looks like some chunks went by the board while merging with exthdr->op patch. Fixes: 4196376330468 ("exthdr: Add support for exthdr flags") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: Add support for exthdr flagsPhil Sutter2017-02-151-0/+17
| | | | | | | | Along with the actual support for exthdr expression specific flags, this also declares NFT_EXTHDR_F_PRESENT used for exthdr existence match. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add TCP option matching requirementsManuel Messner2017-02-121-4/+45
| | | | | | | This patch is a requirement of the TCP option patch. Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* expr: Add const qualifiers to *2str translation arraysTobias Klauser2017-01-165-5/+5
| | | | | | | | | | | | | | | | Add const qualifiers to the "to string" translation arrays used by various *2str() functions. This fixes GCC warnings such as the following when compiling with -Wwrite-strings: expr/byteorder.c:176:25: warning: initialization discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers] In order to catch these in the future, also add -Wwrite-strings to default CFLAGS. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ct: add average bytes per packet counter supportLiping Zhang2017-01-031-1/+2
| | | | | | | Similar to ct packets/bytes ... Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* quota: support for consumed bytesPablo Neira Ayuso2016-12-091-3/+23
| | | | | | This patch extends the quota support to account for consumed bytes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: objref: add support for stateful object mapsPablo Neira Ayuso2016-12-091-2/+70
| | | | | | | | If the NFT_SET_OBJECT flag is set, then this set stores a mapping between any random user-defined arbitrary key and one stateful object. Very useful for performance lookups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add stateful object reference expressionPablo Neira Ayuso2016-12-091-0/+215
| | | | | | | This patch adds a new "objref" expression that you can use to refer to stateful objects from rules. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: payload: add NFTNL_EXPR_PAYLOAD_FLAGSPablo Neira Ayuso2016-12-041-2/+20
| | | | | | So we can include the new NFT_PAYLOAD_L4CSUM_PSEUDOHDR flag. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: missing offset handling for snprintf() in hash and numgenPablo Neira Ayuso2016-10-312-2/+2
| | | | | | Fix incorrect output when offset attribute is unset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add fib expressionFlorian Westphal2016-10-281-0/+273
| | | | | | | | | Allows to query fib for output interface and route type of a packets source or destination address. Scheduled for Linux 4.10. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: introduce rt expressionAnders K. Pedersen2016-10-281-0/+243
| | | | | | | | Introduce support for rt expression for routing related data as implemented in kernel. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: update Arturo Borrero Gonzalez emailArturo Borrero Gonzalez2016-10-172-2/+2
| | | | | | | Update Arturo Borrero Gonzalez email address. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add range expressionPablo Neira Ayuso2016-10-131-0/+288
| | | | | | | | Add range expression available that is scheduled for linux kernel 4.9. This range expression allows us to check if a given value placed in a register is within/outside a specified interval. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: complete log flags supportLiping Zhang2016-10-041-5/+30
| | | | | | | | | If NFTNL_EXPR_LOG_FLAGS is not set, it's unnecessary to print out the flags value. Furthermore, it's better to print out string message instead of the hex value. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: do not print prefix if it is not setLiping Zhang2016-10-041-2/+4
| | | | | | | | This will avoid the following ugly display output: [ log prefix (null) ] Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: fix typo in nftnl_expr_log_exportLiping Zhang2016-10-041-1/+1
| | | | | | | | After test NFTNL_EXPR_LOG_FLAGS is set, we should put "log->flags" instead of "log->level". Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: display offset only if present in hash and numgen expressionsPablo Neira Ayuso2016-09-232-9/+18
| | | | | | So nft payload python tests don't break. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove libmxml supportArturo Borrero2016-09-2326-1000/+2
| | | | | | | | | | | | | | | | | | | This patch removes the libmxml integration in libnftnl, since we have JSON in place and there is no need to support two at the same time. The JSON support is much better, for example libjansson has a better parsing error reporting. Moreover, libmxml 2.10 breaks the integration with libnftnl somehow, as reported in Debian bug #83870 [0]. Also, the XML support inside libnftnl has never been in good shape, with several tiny inconsitencies. [0] https://bugs.debian.org/838370 Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: add NFTA_QUEUE_SREG_QNUM attr supportLiping Zhang2016-09-221-7/+50
| | | | | | | | | | After adding _SREG_QNUM attr, queuenum is not must option anymore, so we must test NFTNL_EXPR_QUEUE_NUM first before dumpping queue num in snprintf_default. Also add a tailing space in snprintf_default, this is consistent with other expressions. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: add number generation offsetLaura Garcia Liebana2016-09-221-6/+33
| | | | | | | | | | | | | | | | Add support to pass through an offset value to the counter initialization. With this feature, the sysadmin is able to apply a value to be added to the generated number. Example: meta mark set numgen inc mod 2 offset 100 This will generate marks with series 100, 101, 100, 101, ... Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: hash: Add offset to hash valueLaura Garcia Liebana2016-09-121-6/+33
| | | | | | | | | | | | | | | | Add support to pass through an offset to the hash value. With this feature, the sysadmin is able to generate a hash with a given started value. Example: meta mark set jhash ip saddr mod 2 seed 0xabcd offset 100 This option generates marks according to the source address from 100 to 101. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: queue: remove redundant NFTNL_EXPR_QUEUE_NUM set in json parseLiping Zhang2016-09-121-1/+0
| | | | | | | | We have already set NFTNL_EXPR_QUEUE_NUM when parse "num" successfully, here is wrong and redundant, remove it. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: Rename until attribute by modulusLaura Garcia Liebana2016-09-071-28/+28
| | | | | | | | | | | The _modulus_ attribute will be reused as _until_, as it's similar to other expressions with value limits (ex. hash). Renaming is possible according to the kernel module ntf_numgen that has not been released yet. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: resync nf_tables.h cache copyPablo Neira Ayuso2016-09-021-1/+3
| | | | | | | | | | Sync this with the kernel header file we currently have in tree. This patch addresses the compilation warning and breakage as result of this header update, specifically the "attibute" typo in trace and missing default case in expr/numgen.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: add missing nftnl_expr_ng_cmp()Pablo Neira Ayuso2016-08-301-0/+18
| | | | | | | | This patch adds the missing comparator interface, most likely due to race between the patchset that has added this and the introduction of numgen. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: hash: missing trailing space and modulus in hexadecimal in snprintfPablo Neira Ayuso2016-08-301-1/+1
| | | | | | | | | | | | Before patch: [ hash reg 1 = jhash(reg 2, 8, 3735928559) % modulus 2] After patch: [ hash reg 1 = jhash(reg 2, 8, 0xdeadbeef) % mod 2 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: add missing trailing whitespacePablo Neira Ayuso2016-08-301-2/+2
| | | | | | | | | | | | Before patch: [ numgen reg 1 = inc(2)] After patch: [ numgen reg 1 = inc(2) ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: numgen: use switch to handle numgen types from snprintfPablo Neira Ayuso2016-08-301-4/+5
| | | | | | Use switch instead of if branch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: immediate: Fix verdict comparisonCarlos Falgueras García2016-08-261-2/+9
| | | | | | | | | | | | An immediate expression of type 'DATA_VERDICT' can have set a chain (jump or goto), in this cases we must compare its 'union nftnl_data_reg' using 'DATA_CHAIN' flag instead of 'DATA_VERDICT' Before this patch compare expressions "jump -> chain_a" and "jump -> chain_b" returns they are equals. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: data_reg: Fix DATA_CHAIN comparisonCarlos Falgueras García2016-08-241-0/+1
| | | | | | | | Split DATA_VERDICT and DATA_CHAIN comparison. A verdict can have a NULL chain (accept, drop, etc) so segfault will happen when strcmp is called. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add number generation expressionLaura Garcia Liebana2016-08-221-0/+251
| | | | | | | Support for the nft ng expression within libnftnl. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add quota expressionPablo Neira Ayuso2016-08-221-0/+210
| | | | | | This patch adds support for the new quota expression. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Implement rule comparisonCarlos Falgueras García2016-08-1724-0/+477
| | | | | | | | | | | | | | | | | | | | This patch implements the function: bool nftnl_rule_cmp(const struct nftnl_rule *r1, const struct nftnl_rule *r2) for rule comparison. Expressions within rules need to be compared, so also has been created the function: bool nftnl_expr_cmp(const struct nftnl_expr *e1, const struct nftnl_expr *e2); Also includes all expression comparators. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add hash expressionLaura Garcia Liebana2016-08-171-0/+294
| | | | | | | Support for the nft hash expression in libnftnl. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: cmp: Use cmp2str() instead of directly access to arrayCarlos Falgueras García2016-08-151-1/+1
| | | | | | | Uses cmp2str() which checks array bounds. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr/limit: Drop unreachable code in limit_to_type()Phil Sutter2016-08-121-1/+0
| | | | | | | | | The function returns from inside the switch() in any case, so the final return statement is never reached. Fixes: 7769cbd9dfe69 ("expr: limit: add per-byte limiting support") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr/ct: prevent array index overrun in ctkey2str()Phil Sutter2016-08-121-1/+1
| | | | | | | | | | The array has NFT_CT_MAX fields, so indices must be less than that number. Fixes: 977b7a1dbe1bd ("ct: xml: use key names instead of numbers") Cc: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: Fix lookup builderCarlos Falgueras García2016-08-101-2/+1
| | | | | | Deleted wrong braces that cause unwanted behaviour. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net>
* src: don't set data_len to zero when returning pointersPablo Neira Ayuso2016-08-011-1/+0
| | | | | | | | nft already assumes that passing NULL as data_len is valid, otherwise it crashes. Fix this by leave data_len unset in this specific case. Fixes: bda7102 ("src: Fix nftnl_*_get_data() to return the real attribute length") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: lookup: print flags only if they are availablePablo Neira Ayuso2016-07-211-2/+4
| | | | | | Follow same approach as with other objects, print what it is set only. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix nftnl_*_get_data() to return the real attribute lengthCarlos Falgueras García2016-07-112-0/+6
| | | | | | | | | | | All getters must set the memory size of the attributes, ie. this includes the nul-termination in strings. For references to opaque objects hidden behind the curtain, report a zero size. Signed-off-by: Carlos Falgueras García <carlosfg@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: lookup: give support for inverted matchingArturo Borrero2016-06-241-3/+29
| | | | | | | | Inverted matching support was included in the kernel, let's give support here as well. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for flags before releasing attributesPablo Neira Ayuso2016-06-154-5/+5
| | | | | | | Now that unsetters don't set pointers to NULL, check if the attribute is set before trying to release it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: data_reg: get rid of leftover perror() callsPablo Neira Ayuso2016-06-151-6/+3
| | | | | | Let the client of this library decide when to display error messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: check for strdup() errors from setters and parsersPablo Neira Ayuso2016-06-155-0/+17
| | | | | | And pass up an error to the caller. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: payload: don't use deprecated definition NFT_EXPR_PAYLOAD_SREGPablo Neira Ayuso2016-06-101-1/+1
| | | | | | Use NFTNL_EXPR_PAYLOAD_SREG instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: missing static in several array definitionsPablo Neira Ayuso2016-05-091-1/+1
| | | | | | | They are not used out of the scope of the C file where they are defined, so we can statify them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>