summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* ruleset: add set id to parsed setsAlvaro Neira2014-10-091-0/+4
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: masq: optional printing of flags attr in snprintf_defaultArturo Borrero2014-10-031-2/+4
| | | | | | | | The flags attribute is optional. Thus we should print only if it was originally set. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ruleset generation classPablo Neira Ayuso2014-09-193-0/+214
| | | | | | | | | | | | | | The generation object currently only contains the uint32_t that indicates the generation ID. I could have just add the API to return the uint32_t ID instead, but I think this API is easier to extend without adding new APIs. We can probably include meaningful statistics in the generation message in the future without much hassle. This patch also extends examples/nft-events.c. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: fix set nlmsg desc parsingArturo Borrero2014-09-181-20/+2
| | | | | | | | In commit ff62959("set: add support for set mechanism selection") the support for parsing the nested attribute (NFTA_SET_DESC) was incorrect. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: nft_fprintf: prevent an empty buffer from being printedArturo Borrero2014-09-161-2/+2
| | | | | | | | | | If the snprintf_cb() printed 0 characters, no \0 exists in the buffer. Also, in that case fprintf() is meant to print nothing, so we can just exit. This patch addresses new cases of textual output by libnftnl with trash. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: add new nft_masq expressionArturo Borrero2014-09-092-0/+209
| | | | | | | | This patch adds userspace support to nft_masq, the new expression to perform masquerade. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: nat: add support for the new flags attributeArturo Borrero2014-09-091-3/+45
| | | | | | | This patchs adds support for the new flags attribute in the nft_nat expression. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
* expr: meta: Add devgroup supportAna Rey2014-09-031-1/+3
| | | | | | | | The kernel support is add in commit: netfilter: nf_tables: add devgroup support in meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of cached copies of x_tables.h and xt_LOG.hPablo Neira Ayuso2014-08-312-2/+6
| | | | | | | | | | Keeping the full cached copy the of x_tables.h file in tree is too much for just the XT_EXTENSION_MAXNAMELEN constant. Similarly, xt_LOG.h is not actually required by the tests, we can use any whatever syntetic data to make sure the setter and getter provide the same result. So, let's get rid of these headers from the library tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix printing of XML/JSON event wrapper header/footerArturo Borrero2014-08-251-16/+18
| | | | | | | | | | Use the nft_fprintf() helper. The helper handles \0 properly. Before this patch, we get trash in the output due to the buffer being printed without any \0. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Add cpu support for meta expresionAna Rey2014-08-241-2/+3
| | | | | Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: meta: Add pkttype supportAna Rey2014-08-241-1/+2
| | | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: define xfree() as macroPablo Neira Ayuso2014-08-202-7/+2
| | | | | | | | | | | | | | | | | | | | | | Original description from Thomas Petazzoni: When ELF binaries and shared libraries are used, the internal functions of libnftnl such as xfree() are not visible to the outside world (their visibility is 'hidden'). Therefore, the fact that other programs (especially nftables) may have symbols with the same name does not cause any problem. However, when doing static linking on a non-ELF platform (such as Blackfin, which uses the FLAT binary format), there is no way of encoding this visibility. Therefore, the xfree() symbols of libnftnl becomes visible to the outside world, causing a conflict with the xfree() symbol defined by nftables. To solve this, this patch convers xfree as a macro instead of a function. Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: use proper free functionArturo Borrero2014-08-181-1/+1
| | | | | | | | Let's use the proper free function to liberate the set_elem, so we avoid potential memory leaks. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* common: add batching interfacesPablo Neira Ayuso2014-08-142-0/+93
| | | | | | | | | | | | | | This patch adds the following new interfaces: int nft_batch_is_supported(void); void nft_batch_begin(char *buf, uint32_t seq); void nft_batch_end(char *buf, uint32_t seq); Quite likely this is going to be reused by third party applications requiring to put things in the batch. We already have potential clients for this code in nft and iptables-compat. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set_elem: add nft_set_elems_nlmsg_build_payload_iter()Pablo Neira Ayuso2014-07-252-11/+76
| | | | | | | | | This new interface allows you to put as many set elements as possible into a netlink message. The iterator stores the last element that has fit into a netlink message, so you can continue adding more set elements across several netlink messages. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: add support for set mechanism selectionArturo Borrero2014-07-242-3/+165
| | | | | | | | | | This patch adds support to select the set mechanism. The kernel support was added in commit: c50b960 netfilter: nf_tables: implement proper set selection Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: stricter netlink attribute length validationPablo Neira Ayuso2014-07-2026-229/+128
| | | | | | | | | | | | If the kernel sends us different data length for a given attribute, stop further processing and indicate that an ABI breakage has ocurred. This is an example of the (hypothetical) message that is shown in that case: nf_tables kernel ABI is broken, contact your vendor. table.c:214 reason: Numerical result out of range Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: define variable flags in xml parserÁlvaro Neira Ayuso2014-07-151-1/+1
| | | | | | | | | | | In the xml parser, we have used a variable flags for parsing it but we have forgot define it. This patch solves a compile error like: expr/log.c:263:12: error: 'flags' undeclared (first use in this function) Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: log: add support for level and flagsPablo Neira Ayuso2014-07-011-6/+85
| | | | | | This is required by changes scheduled for Linux kernel 3.17. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Do not print unset attributes in jsonAna Rey2014-06-301-71/+95
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Rename variables in nft_jansson_parse_chain functionsAna Rey2014-06-301-32/+32
| | | | | | | Renames some variables for code readability reasons. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Do not print unset attributes in xmlAna Rey2014-06-301-46/+77
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Add all support of use attributeAna Rey2014-06-301-6/+18
| | | | | | | | | Add set, unset, get, parse and build payload implementation for use value. These changes are neeeded for a correct import/export of xml/json file Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Do not print unset values in json fileAna Rey2014-06-301-22/+42
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Do not print unset values in xml fileAna Rey2014-06-301-13/+34
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Add set, unset and parse implementation for the use attributeAna Rey2014-06-301-6/+12
| | | | | | | | | Add some parts of the implemention of 'use' vualue in table that miss it. These changes are neeeded for a correct import/export of xml/json file Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Use nft_table_attr_set_* in the xml functionsAna Rey2014-06-301-13/+5
| | | | | | | Code refactoring to use nft_table_attr_set_* in parse xml functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* table: Free memory in the same function that is reservedAna Rey2014-06-301-8/+9
| | | | | | | Free memory in the same function that is reserved. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-301-37/+16
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* chain: Free memory in the same function that is reservedAna Rey2014-06-301-18/+18
| | | | | | | Free memory in the same function that is reserved. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: match: Do not print unset values in json fileAna Rey2014-06-241-7/+6
| | | | | | | It changes the parse and snprintf functions json to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: match: Do not print unset values in xml fileAna Rey2014-06-241-6/+6
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: match: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-241-5/+1
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: match: get a nft_rule_expr type in nft_rule_expr_match_snprintf_* ↵Ana Rey2014-06-241-4/+6
| | | | | | | | | | | | functions Code refactoring in nft_rule_expr_match_snprintf_* functions to get a nft_rule_expr type instead of nft_expr_match type. The nft_rule_expr type is needed to check information into flags variables. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: lookup: Do not print unset values in json fileAna Rey2014-06-241-19/+19
| | | | | | | It changes the parse functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: lookup: Do not print unset values in xml fileAna Rey2014-06-241-14/+16
| | | | | | | It changes the parse functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: lookup: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-241-15/+7
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: exthdr: Do not print unset values in jsonAna Rey2014-06-241-25/+39
| | | | | | | It changes the parse and the snprint functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: exthdr: Do not print unset values in xmlAna Rey2014-06-241-23/+34
| | | | | | | It changes the parse and the snprint functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: exthdr: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-241-16/+8
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: exthdr: Add nft_rule_expr_exthdr_snprinf_* functionsAna Rey2014-06-241-18/+38
| | | | | | | | | | | | Code refactoring in nft_rule_expr_exthdr functions. This patch adds three new functions: * nft_rule_expr_exthdr_snprinf_default * nft_rule_expr_exthdr_snprinf_xml * nft_rule_expr_exthdr_snprinf_json Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: counter: Do not print unset values in jsonAna Rey2014-06-241-10/+21
| | | | | | | It changes the parse and the snprint functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: counter: Do not print unset values in xmlAna Rey2014-06-241-11/+16
| | | | | | | It changes the parse and the snprint functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: counter: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-241-7/+5
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: counter: Add nft_rule_expr_counter_snprinf_* functionsAna Rey2014-06-241-9/+31
| | | | | | | | | | | | Code refactoring in nft_rule_expr_counter_snprinf functions. This patch adds three new functions: * nft_rule_expr_counter_snprinf_default * nft_rule_expr_counter_snprinf_xml * nft_rule_expr_counter_snprinf_json Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: ct: Do not parse unset values in jsonAna Rey2014-06-241-23/+7
| | | | | | | It changes the parse functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: ct: Delete the last comma character in json textAna Rey2014-06-241-2/+3
| | | | | | | Code refactoring to delete correctly the last comma character in json text. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: ct: Do not print unset values in xml fileAna Rey2014-06-241-18/+12
| | | | | | | It changes the parse and snprintf functions to omit unset values. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: ct: Use nft_rule_expr_set_* in the xml parsing codeAna Rey2014-06-241-14/+8
| | | | | | | Code refactoring to use nft_rule_expr_set_* in parse functions Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>