summaryrefslogtreecommitdiffstats
path: root/include/datatype.h
Commit message (Collapse)AuthorAgeFilesLines
* src: add igmp supportPablo Neira Ayuso2019-01-091-0/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bogus bail out with raw expression from dynamic setsPablo Neira Ayuso2018-10-171-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following ruleset that uses raw expressions: table ip nftlb { map persistency { type inet_service : mark size 65535 timeout 1h elements = { 53 expires 59m55s864ms : 0x00000064, 80 expires 59m58s924ms : 0x00000065, 443 expires 59m56s220ms : 0x00000064 } } chain pre { type filter hook prerouting priority filter; policy accept; ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } } } bogusly bails out with: /tmp/test:9:57-64: Error: datatype mismatch: expected internet network service, expression has type integer ip protocol { tcp, udp } update @persistencia { @th,0,16 : numgen inc mod 2 offset 100 } ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fix the problem by evaluating expression basetype and length in this case. Reported-by: Laura Garcia <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: honor /etc/servicesPablo Neira Ayuso2018-08-241-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This partial patch reverts: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") f0f99006d34b ("datatype: Replace getaddrinfo() by internal lookup table") so /etc/services is used to interpret service names, eg. # nft add rule x y tcp dport \"ssh\" Then, listing looks like: # nft list ruleset -l table x { chain y { ... tcp dport "ssh" } } Major changes with regards to the original approach are: 1) Services are displayed in text via `-l' option. 2) Services are user-defined, just like mappings in /etc/iproute2/* files and connlabel.conf, so they are displayed enclosed in quotes. Note that original service name code was broken since it parses both udp and tcp service names but it only displays tcp services names as literal. This is because NI_DGRAM is missing. This patch makes nft falls back on udp services if no literal was found in the initial tcp service name query. Proper way to handle would be to add infrastructure to store protocol context information in struct output_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Implement JSON output supportPhil Sutter2018-05-111-0/+4
| | | | | | | | | | | | Although technically there already is support for JSON output via 'nft export json' command, it is hardly useable since it exports all the gory details of nftables VM. Also, libnftables has no control over what is exported since the content comes directly from libnftnl. Instead, implement JSON format support for regular 'nft list' commands. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Make some arrays globally accessiblePhil Sutter2018-05-111-0/+1
| | | | | | | | | | | | | | | This removes static flag and adds declarations in headers for the following arrays: * ct_templates from src/ct.c * mark_tbl from src/datatype.c * meta_templates and devgroup_tbl from src/meta.c * table_flags_name from src/rule.c * set_stmt_op_names from src/statement.c * tcpopthdr_protocols from src/tcpopt.c Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support timeouts in millisecondsFlorian Westphal2018-05-091-1/+1
| | | | | | | | | | currently the frontend uses seconds everywhere and multiplies/divides by 1000. Pass milliseconds around instead and extend the scanner to accept 'ms' in timestrings. Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce datatype ifname_typeArturo Borrero Gonzalez2018-02-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This new datatype is a string subtype. It will allow us to build named maps/sets using meta keys like 'iifname', 'oifname', 'ibriport' or 'obriport'. Example: table inet t { set s { type ifname elements = { "eth0", "eth1" } } chain c { iifname @s accept oifname @s accept } } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Spelling fixesVille Skyttä2018-02-151-1/+1
| | | | | Signed-off-by: Ville Skyttä <ville.skytta@iki.fi> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: get rid of printfPhil Sutter2017-09-291-2/+3
| | | | | | | | | | | | | | | | | This patch introduces nft_print()/nft_gmp_print() functions which have to be used instead of printf to output information that were previously send to stdout. These functions print to a FILE pointer defined in struct output_ctx. It is set by calling: | old_fp = nft_ctx_set_output(ctx, new_fp); Having an application-defined FILE pointer is actually quite flexible: Using fmemopen() or even fopencookie(), an application gains full control over what is printed and where it should go to. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Remove datatype_register().Varsha Rao2017-06-301-1/+0
| | | | | | | | Remove datatype_register() function and its calling __init functions. Add arguments of datatype_register() function to datatype array. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Pass stateless, numeric, ip2name and handle variables as structure members.Varsha Rao2017-06-181-3/+5
| | | | | | | | | | | | | | | | | libnftables library will be created soon. So declare numeric_output, stateless_output, ip2name_output and handle_output as members of structure output_ctx, instead of global variables. Rename these variables as following, numeric_output -> numeric stateless_output -> stateless ip2name_output -> ip2name handle_output -> handle Also add struct output_ctx *octx as member of struct netlink_ctx. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add conntrack event mask supportFlorian Westphal2017-04-241-0/+1
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Introduce boolean datatype and boolean expressionPhil Sutter2017-03-101-0/+2
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename set_keytype_alloc() to set_datatype_alloc()Pablo Neira Ayuso2017-02-281-2/+2
| | | | | | | This function can be used either side of the map, so rename it to something generic. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add DTYPE_F_CLONE flagPablo Neira Ayuso2017-02-251-0/+2
| | | | | | | | | | | | | | This flag allows us to identify datatypes that are instances from original datatypes. This fixes a possible double free when attaching a concatenation datatype to set->keytype while being also referenced from concatenation expressions. ip6/flowtable.t: ERROR: line 5: src/nft add rule --debug=netlink ip6 test-ip6 input flow table acct_out { meta iif . ip6 saddr timeout 600s counter }: This rule should not have failed. *** Error in `src/nft': double free or corruption (fasttop): 0x000000000117ce70 *** Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: store byteorder for set keysPablo Neira Ayuso2017-02-251-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Selectors that rely on the integer type and expect host endian byteorder don't work properly. We need to keep the byteorder around based on the left hand size expression that provides the context, so store the byteorder when evaluating the map. Before this patch. # nft --debug=netlink add rule x y meta mark set meta cpu map { 0 : 1, 1 : 2 } __map%d x b __map%d x 0 element 00000000 : 00000001 0 [end] element 01000000 : 00000002 0 [end] ^^^^^^^^ This is expressed in network byteorder, because the invalid byteorder defaults on this. After this patch: # nft --debug=netlink add rule x y meta mark set meta cpu map { 0 : 1, 1 : 2 } __map%d x b __map%d x 0 element 00000000 : 00000001 0 [end] element 00000001 : 00000002 0 [end] ^^^^^^^^ This is in host byteorder, as the key selector in the map mandates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Display pre-defined inet_service values in decimal baseElise Lennion2016-12-111-1/+13
| | | | | | | | | because the convention is to represent ports in base 10. gcc-workaround is no longer needed and was removed. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Display pre-defined inet_service values in host byte orderElise Lennion2016-12-101-1/+2
| | | | | | | | | | | | nft describe displays, to the user, which values are available for a selector, then the values should be in host byte order. Variable size was replaced by len to better match the common pattern. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Replace getnameinfo() by internal lookup tableElise Lennion2016-11-301-0/+2
| | | | | | | | | | | | | | | To avoid exceeding the inputs number limit of the flex scanner used, when calling getnameinfo() in inet_service_type_print(). The new symbol_table was associated with inet_service_type, to enable listing all pre-defined services using nft command line tool. The listed services are all well-known and registered ports of my local /etc/services file, from Ubuntu 16.04. Service numbers are converted to respect network byte order. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add fib expressionFlorian Westphal2016-10-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the 'fib' expression which can be used to obtain the output interface from the route table based on either source or destination address of a packet. This can be used to e.g. add reverse path filtering: # drop if not coming from the same interface packet # arrived on # nft add rule x prerouting fib saddr . iif oif eq 0 drop # accept only if from eth0 # nft add rule x prerouting fib saddr . iif oif eq "eth0" accept # accept if from any valid interface # nft add rule x prerouting fib saddr oif accept Querying of address type is also supported. This can be used to e.g. only accept packets to addresses configured in the same interface: # fib daddr . iif type local Its also possible to use mark and verdict map, e.g.: # nft add rule x prerouting meta mark set 0xdead fib daddr . mark type vmap { blackhole : drop, prohibit : drop, unicast : accept } Signed-off-by: Florian Westphal <fw@strlen.de>
* src: rename datatype name from tc_handle to classidPablo Neira Ayuso2016-08-181-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: quote user-defined strings when used from rule selectorsPablo Neira Ayuso2016-08-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The following selectors display strings using quotes: * meta iifname * meta oifname * meta ibriport * meta obriport However, the following do not: * meta oif * meta iif * meta skuid * meta skgid * meta iifgroup * meta oifgroup * meta rtclassid * ct label Given they refer to user-defined values, neither keywords nor internal built-in known values, let's quote the output of this. This patch modifies symbolic_constant_print() so we can signal this to indicate if the string needs to be quoted. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ecn supportPablo Neira Ayuso2016-05-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule ip filter forward ip ecn ce counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000003 ] [ counter pkts 0 bytes 0 ] For IPv6: # nft --debug=netlink add rule ip6 filter forward ip6 ecn ce counter ip6 filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000030 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000030 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dscp supportPablo Neira Ayuso2016-05-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: add redirect constant to rhs_expr rulePablo Neira Ayuso2016-01-031-0/+1
| | | | | | | So we can use the 'redirect' reserve word as constant from the rhs expression. Thus, we can use it as icmp type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add burst parameter to limitPablo Neira Ayuso2015-09-231-0/+3
| | | | | | | | | | | ... limit rate 1024 mbytes/second burst 10240 bytes ... limit rate 1/second burst 3 packets This parameter is optional. You need a Linux kernel >= 4.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add per-bytes limitPablo Neira Ayuso2015-09-231-0/+4
| | | | | | | | | | This example show how to accept packets below the ratelimit: ... limit rate 1024 mbytes/second counter accept You need a Linux kernel >= 4.3-rc1. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: seperate time parsing/printing from time_typePatrick McHardy2015-04-121-0/+4
| | | | | | | Seperate relative time parsing and printing from the time_type to make it usable for set and set element time related parameters. Signed-off-by: Patrick McHardy <kaber@trash.net>
* concat: add concat subtype lookup/id helpersPatrick McHardy2015-01-111-0/+16
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: change concat_type_alloc() to construct type from idPatrick McHardy2014-12-161-1/+1
| | | | | | | The kernel only stored the id so we need to be able to reconstruct the datatype from the id only. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add define for maximum number of bits and mask of datatype idPatrick McHardy2014-12-161-0/+3
| | | | | | | | | | | | | | | | | The id of concat datatypes is composed of the ids of the individual datatypes. Add a define for the number of bits for each datatype id and a mask. The number of bits is chosen as 6, allowing for 63 datatypes, or twice as much as we currently have. This allows for concatenations of 5 types using 32 bits. The value is statically chosen instead of basing it on the current numbers of datatypes since we don't want the maximum concatenation size to vary between versions, also new versions are supposed to be able to propery parse a ruleset generated by an older version. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add new subtypes field to account number of concat data typesPatrick McHardy2014-12-161-0/+2
| | | | | | | | Using the size is confusing since it usually holds the size of the data. Add a new "subtypes" member, which holds the number of datatypes the concat type is made of. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: Add support for datatype devgroupAna Rey2014-10-241-0/+2
| | | | | | | | | | | | | | | This adds the new devgroup datatype to get the group name from /etc/iproute2/group file. Example of use: nft add rule ip test input meta iifgroup 0 counter nft add rule ip test input meta iifgroup default counter Moreover, It adds tests in meta.t test file. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: complete reject supportAlvaro Neira2014-10-091-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use the reject action in rules. For example: nft add rule filter input udp dport 22 reject In this rule, we assume that the reason is network unreachable. Also we can specify the reason with the option "with" and the reason. For example: nft add rule filter input tcp dport 22 reject with icmp type host-unreachable In the bridge tables and inet tables, we can use this action too. For example: nft add rule inet filter input reject with icmp type host-unreachable In this rule above, this generates a meta nfproto dependency to match ipv4 traffic because we use a icmpv4 reason to reject. If the reason is not specified, we infer it from the context. Moreover, we have the new icmpx datatype. You can use this datatype for the bridge and the inet tables to simplify your ruleset. For example: nft add rule inet filter input reject with icmpx type host-unreachable We have four icmpx reason and the mapping is: ICMPX reason | ICMPv6 | ICMPv4 | | admin-prohibited | admin-prohibited | admin-prohibited port-unreachable | port-unreachable | port-unreachable no-route | no-route | net-unreachable host-unreachable | addr-unreachable | host-unreachable Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for pkttype in meta expresionAna Rey2014-08-241-0/+2
| | | | | | | | | | | | | | | If you want to match the pkttype field of the skbuff, you have to use the following syntax: nft add rule ip filter input meta pkttype PACKET_TYPE where PACKET_TYPE can be: unicast, broadcast and multicast. Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: connlabel matching supportFlorian Westphal2014-02-181-0/+2
| | | | | | | | | | | Takes advantage of the fact that the current maximum label storage area is 128 bits, i.e. the dynamically allocated extension area in the kernel will always fit into a nft register. Currently this re-uses rt_symbol_table_init() to read connlabel.conf. This works since the format is pretty much the same. Signed-off-by: Florian Westphal <fw@strlen.de>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-161-0/+7
|\ | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/payload.c
| * segtree: only use prefix expressions for ranges for selected datatypesPatrick McHardy2014-01-161-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is uncommon to represent f.i. port number ranges as prefix expressions. Introduce a datatype DTYPE_F_PREFIX flag to indicate that the preferred representation of a range is a prefix and use it for segtree decomposition to decide whether to use a range or prefix expression. The ipaddr, ip6addr, mark and realm datatypes are changed to include the DTYPE_F_PREFIX flag. This fixes completely unreadable output in cases where the ranges are representable as prefixes, f.i. in case of port number: { 0/6 => jump chain1, 0/5 => jump chain2, 0/4 => continue} becomes: { 0-1023 => jump chain1, 1024-2047 => jump chain2, 2048-4095 => continue} Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add nfproto supportPatrick McHardy2014-01-081-0/+3
|/ | | | | | | | Add support for the meta nfproto type, which refers to the AF from the netfilter hook ops. This is needed to get the actual family of a packet in the dummy NFPROTO_INET family. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: Add icmpv6 supportEric Leblond2013-07-311-0/+2
| | | | | | | | | | This patch adds ICMPv6 support to nftables. It is now possible to write rules such as: nft add rule ip6 filter input icmpv6 type nd-router-advert accept Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: concat expression only releases dynamically allocated datatypePablo Neira Ayuso2013-06-081-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Eric Leblond reports a crash with the following invalid command: nft add rule global filter ip daddr . tcp dport { 192.168.0.1 . 22\; 192.168.0.3 . 89 } drop Note that the semicolon is incorrect in that concatenation, it should be a comma. The backtrace shows: (gdb) bt #0 0x00007ffff6f39295 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff6f3c438 in __GI_abort () at abort.c:90 #2 0x00007ffff6f7486b in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff7070d28 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199 #3 0x00007ffff6f7eac6 in malloc_printerr (action=3, str=0x7ffff706ccca "free(): invalid pointer", ptr=<optimized out>) at malloc.c:4902 #4 0x00007ffff6f7f843 in _int_free (av=<optimized out>, p=0x428530, have_lock=0) at malloc.c:3758 #5 0x000000000041aae8 in xfree (ptr=0x428540 <invalid_type>) at src/utils.c:29 #6 0x000000000040bc43 in concat_type_destroy (dtype=0x428540 <invalid_type>) at src/datatype.c:690 #7 0x000000000040cebf in concat_expr_destroy (expr=0x643b90) at src/expression.c:571 [...] It's trying to release 'invalid_type', which was not dynamically allocated. Note that before the evaluation step, the invalid type is attached to the expressions. Since nftables allocates a dynamic datatype for concatenations in case that needs to be released in the exit path. All datatypes except this, are allocated in the BSS. Since we have no way to differenciate between these two, add a flag so we can recognize dynamically allocated datatypes. While at it, rename dtype->type from enum to explicit uint32_t, as it is used to store the concatenation type mask as well. Reported-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expr: fix concat expression type propagationPatrick McHardy2013-04-181-0/+9
| | | | | Dynamically instantiate a data type to represent all types of a concatenation and use that for type propagation.
* types: add ethernet address typePatrick McHardy2013-04-181-0/+3
| | | | | | | | Add a new type for ethernet addresses. This is needed since for concatenations we need fixed sized data types, the generic link layer address doesn't have a fixed length. Signed-off-by: Patrick McHardy <kaber@trash.net>
* payload: add DCCP packet type definitionsPatrick McHardy2009-07-281-0/+2
| | | | | | | | | | | | | | | | | | | # nft describe dccp type payload expression, datatype dccp_pkttype (DCCP packet type) (basetype integer), 4 bits pre-defined symbolic constants: request 0x0 response 0x1 data 0x2 ack 0x3 dataack 0x4 closereq 0x5 close 0x6 reset 0x7 sync 0x8 syncack 0x9 Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add/move size and byte order information into data typesPatrick McHardy2009-03-311-5/+7
| | | | | | | | | | Add size and type information to non-basetype types and remove the now redundant information from the symbol tables. This will be used to determine size and byteorder of set members without analyzing the ruleset for incremental update operations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: maintain table of all datatypes and add registration/lookup functionPatrick McHardy2009-03-311-1/+9
| | | | | | | | | | | Add a table containing all available datatypes and registration/lookup functions. This will be used to associate a stand-alone set in the kernel with the correct type without parsing the entire ruleset. Additionally it would now be possible to remove the global declarations for the core types. Not done yet though. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Fix use of reserved names in header sandwichPatrick McHardy2009-03-181-3/+3
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+156