diff options
| author | Ana Rey <anarey@gmail.com> | 2014-11-03 18:10:51 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-11-10 18:08:32 +0100 |
| commit | fecb6b4fa737ae374a738d207fa35f16e3813434 (patch) | |
| tree | 4cd5ebac9ce09a066368b12aa3aff0869dcca84c | |
| parent | 47c760a43d755c3973fb1b31044b226c48fa1f2f (diff) | |
src: Add cgroup support in meta expresion
The new attribute of meta is "cgroup".
Example of use in nft:
# nft add rule ip test output meta cgroup != 0x100001 counter drop
Moreover, this adds tests to the meta.t test file.
The kernel support is addedin the commit:
ce67417 ("netfilter: nft_meta: add cgroup support")
The libnftnl support is add in the commit:
1d4a480 ("expr: meta: Add cgroup support")
More information about the steps to use cgroup:
https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt
More info about cgroup in iptables:
http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3
Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
| -rw-r--r-- | include/linux/netfilter/nf_tables.h | 2 | ||||
| -rw-r--r-- | src/meta.c | 3 | ||||
| -rw-r--r-- | src/parser.y | 2 | ||||
| -rw-r--r-- | src/scanner.l | 1 | ||||
| -rw-r--r-- | tests/regression/any/meta.t | 9 |
5 files changed, 17 insertions, 0 deletions
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index 16f62a5c..832bc46d 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -579,6 +579,7 @@ enum nft_exthdr_attributes { * @NFT_META_CPU: cpu id through smp_processor_id() * @NFT_META_IIFGROUP: packet input interface group * @NFT_META_OIFGROUP: packet output interface group + * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid) */ enum nft_meta_keys { NFT_META_LEN, @@ -604,6 +605,7 @@ enum nft_meta_keys { NFT_META_CPU, NFT_META_IIFGROUP, NFT_META_OIFGROUP, + NFT_META_CGROUP, }; /** @@ -436,6 +436,9 @@ static const struct meta_template meta_templates[] = { [NFT_META_OIFGROUP] = META_TEMPLATE("oifgroup", &devgroup_type, 4 * BITS_PER_BYTE, BYTEORDER_HOST_ENDIAN), + [NFT_META_CGROUP] = META_TEMPLATE("cgroup", &integer_type, + 4 * BITS_PER_BYTE, + BYTEORDER_HOST_ENDIAN), }; static void meta_expr_print(const struct expr *expr) diff --git a/src/parser.y b/src/parser.y index 3992c6a5..9108dd22 100644 --- a/src/parser.y +++ b/src/parser.y @@ -324,6 +324,7 @@ static void location_update(struct location *loc, struct location *rhs, int n) %token CPU "cpu" %token IIFGROUP "iifgroup" %token OIFGROUP "oifgroup" +%token CGROUP "cgroup" %token CT "ct" %token DIRECTION "direction" @@ -1783,6 +1784,7 @@ meta_key_unqualified : MARK { $$ = NFT_META_MARK; } | CPU { $$ = NFT_META_CPU; } | IIFGROUP { $$ = NFT_META_IIFGROUP; } | OIFGROUP { $$ = NFT_META_OIFGROUP; } + | CGROUP { $$ = NFT_META_CGROUP; } ; meta_stmt : META meta_key SET expr diff --git a/src/scanner.l b/src/scanner.l index e36c3b13..9c8546e2 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -433,6 +433,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "cpu" { return CPU; } "iifgroup" { return IIFGROUP; } "oifgroup" { return OIFGROUP; } +"cgroup" { return CGROUP; } "ct" { return CT; } "direction" { return DIRECTION; } diff --git a/tests/regression/any/meta.t b/tests/regression/any/meta.t index 1e7a0fe7..ba6756dc 100644 --- a/tests/regression/any/meta.t +++ b/tests/regression/any/meta.t @@ -179,3 +179,12 @@ meta oifgroup {11,33};ok;oifgroup {11,33} meta oifgroup {11-33};ok - meta oifgroup != {11,33};ok - meta oifgroup != {11-33};ok + +meta cgroup 0x100001;ok;cgroup 1048577 +meta cgroup != 0x100001;ok;cgroup != 1048577 +meta cgroup { 0x100001, 0x100002};ok +# meta cgroup != { 0x100001, 0x100002};ok +meta cgroup 0x100001 - 0x100003;ok +# meta cgroup != 0x100001 - 0x100003;ok +meta cgroup {0x100001 - 0x100003};ok +# meta cgroup != { 0x100001 - 0x100003};ok |