path: root/include
diff options
authorPablo Neira Ayuso <>2015-10-18 20:02:16 +0200
committerPablo Neira Ayuso <>2015-11-02 12:51:36 +0100
commitb851ba4731d9f7c5e38889875a83173fcc4d3f16 (patch)
tree3ca89f5c184998ece7216eae4d9095807cb7ef0f /include
parent0721fbbe7a951a1e879d120c7a722012c38af9a6 (diff)
src: add interface wildcard matching
Contrary to iptables, we use the asterisk character '*' as wildcard. # nft --debug=netlink add rule test test iifname eth\* ip test test [ meta load iifname => reg 1 ] [ cmp eq reg 1 0x00687465 ] Note that this generates an optimized comparison without bitwise. In case you want to match a device that contains an asterisk, you have to escape the asterisk, ie. # nft add rule test test iifname eth\\* The wildcard string handling occurs from the evaluation step, where we convert from: relational / \ / \ meta value oifname eth* to: relational / \ / \ meta prefix ofiname As Patrick suggested, this not actually a wildcard but a prefix since it only applies to the string when placed at the end. More comments: * This relaxes the left->size > right->size from netlink_parse_cmp() for strings since the optimization that this patch applies may now result in bogus errors. * This patch can be later on extended to apply a similar optimization to payload expressions when: expr->len % BITS_PER_BYTE == 0 For meta and ct, the kernel checks for the exact length of the attributes (it expects integer 32 bits) so we can't do it unless we relax that. * Wildcard strings are not supported from sets and maps yet. Error reporting is not very good at this stage since expr_evaluate_prefix() doesn't have enough context (ctx->set is NULL, the set object is currently created later after evaluating the lhs and rhs of the relational). I'll be following up on this later. Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'include')
1 files changed, 1 insertions, 0 deletions
diff --git a/include/utils.h b/include/utils.h
index 397c1978..e94ae81a 100644
--- a/include/utils.h
+++ b/include/utils.h
@@ -129,5 +129,6 @@ extern void *xmalloc(size_t size);
extern void *xrealloc(void *ptr, size_t size);
extern void *xzalloc(size_t size);
extern char *xstrdup(const char *s);
+extern void xstrunescape(const char *in, char *out);
#endif /* NFTABLES_UTILS_H */