summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* src: generate set members using integer_type in the appropriate byteorderPablo Neira Ayuso2014-12-091-2/+14
| | | | | | | | | | | | | | | | Rules with header fields that rely on the generic integer datatype from sets are not matching, eg. nft add rule filter input udp length { 9 } counter This set member is an integer represented in host byte order, which obviously doesn't match the header field (in network byte order). Since the integer datatype has no specific byteorder, we have to rely on the expression byteorder instead when configuring the context, before we evaluate the list of set members. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: autotools conversionPablo Neira Ayuso2014-11-123-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1) This removes former Makefiles and install-sh (which is now automagically imported via autoreconf). Makefile.defs.in Makefile.in Makefile.rules.in src/Makefile.in install-sh (now automagically imported via autoreconf). 2) CFLAGS are left almost same, they are integrated into Make_global.am. Use AM_CPPFLAGS to set the CFLAGS set by pkgconfig. 3) Add m4 directory to the tree which only contains the .gitignore file. Update .gitignore file to skip autogenerated files. 4) include <config.h> whenever required. 5) Minor adjustments to scanner.l and parser_bison.y to compile cleanly with autotools. 6) Add %option outfile=lex.yy.c to scanner.l, otherwise I hit this error here: gcc -DHAVE_CONFIG_H -I. -I.. -I../include -DDEFAULT_INCLUDE_PATH="\"/usr/etc\"" -Wall -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wdeclaration-after-statement -Wsign-compare -Winit-self -Wformat-nonliteral -Wformat-security -Wmissing-format-attribute -Wcast-align -Wundef -Wbad-function-cast -g -O2 -MT mnl.o -MD -MP -MF $depbase.Tpo -c -o mnl.o mnl.c &&\ mv -f $depbase.Tpo $depbase.Po /bin/sh ../build-aux/ylwrap scanner.l lex.yy.c scanner.c -- flex make[3]: *** [scanner.c] Error 1 make[3]: Leaving directory `/home/pablo/devel/scm/git-netfilter/nftables/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/pablo/devel/scm/git-netfilter/nftables/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/pablo/devel/scm/git-netfilter/nftables' make: *** [all] Error 2 7) Add Makefile.am for include/ (contributed by Giorgio Dal Molin). The doc/ and files/ conversion to automake will come in follow up patches but 'make distcheck' already works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add cli.hPablo Neira Ayuso2014-11-102-12/+20
| | | | | | Needed by follow up patches to use autotools. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add cgroup support in meta expresionAna Rey2014-11-101-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | The new attribute of meta is "cgroup". Example of use in nft: # nft add rule ip test output meta cgroup != 0x100001 counter drop Moreover, this adds tests to the meta.t test file. The kernel support is addedin the commit: ce67417 ("netfilter: nft_meta: add cgroup support") The libnftnl support is add in the commit: 1d4a480 ("expr: meta: Add cgroup support") More information about the steps to use cgroup: https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt More info about cgroup in iptables: http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3 Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh cached copy of nf_tables.hPablo Neira Ayuso2014-11-101-4/+20
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't resolve hostnames by defaultArturo Borrero2014-11-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes the default behaviour of nft to not translate IP addresses to hostnames when printing rules if no options are passed. The options regarding translations after this patch are: <no -n/-N> show IP addresses numerically (default behaviour) -n show IP addresses numerically -nn show Internet services and uid/gid numerically -nnn show protocols numerically -N (--reversedns) translate IP addresses to names The idea is to avoid breaking existing scripts that most likely rely on '-n' to save the ruleset, so we reduce the impact of this patch and provide a default behaviour that doesn't generate network traffic when listing / saving the ruleset. Joint work with Pablo. Suggested-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: indicate file and line on memory allocation errorsPablo Neira Ayuso2014-11-041-1/+4
| | | | | | | | | | | | For example: src/netlink.c:179: Memory allocation failure This shouldn't happen, so this allows us to identify at what point the memory allocation failure has happened. It may be helpful to identify bugs. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add redirect supportArturo Borrero2014-11-041-0/+10
| | | | | | | | | | | This patch adds redirect support for nft. The syntax is: % nft add rule nat prerouting redirect [port] [nat_flags] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for datatype devgroupAna Rey2014-10-241-0/+2
| | | | | | | | | | | | | | | This adds the new devgroup datatype to get the group name from /etc/iproute2/group file. Example of use: nft add rule ip test input meta iifgroup 0 counter nft add rule ip test input meta iifgroup default counter Moreover, It adds tests in meta.t test file. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: delete useless parameter nf_sock in batch functionsArturo Borrero2014-10-241-8/+8
| | | | | | | The 'struct mnl_socket *nf_sock' parameter is useless and perturbing. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: allow disabling libreadline-supportSteven Barth2014-10-101-0/+7
| | | | | | | This makes nftables a bit more embedded-friendly. Signed-off-by: Steven Barth <cyrus@openwrt.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add masquerade supportArturo Borrero2014-10-091-0/+9
| | | | | | | | | | | | | | | | | This patch adds masquerade support for nft. The syntax is: % nft add rule nat postrouting masquerade [flags] Currently, flags are: random, random-fully, persistent Example: % nft add rule nat postrouting masquerade random,persistent Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: interpret the event type from the evaluation stepPablo Neira Ayuso2014-10-091-2/+34
| | | | | | | | | | | Postpone the event type interpretation to the evaluation step. This patch also fixes the combination of event and object types, which was broken. The export code needed to be adjusted too. The new and destroy are not tokens that can be recognized by the scanner anymore, so this also implicitly restores 'ct state'. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add nat persistent and random optionsArturo Borrero2014-10-093-2/+73
| | | | | | | | | | | | | | | | | This patch adds more configuration options to the nat expression. The syntax is as follow: % nft add rule nat postrouting <snat|dnat> <nat_arguments> [flags] Flags are: random, persistent, random-fully. Example: % nft add rule nat postrouting dnat 1.1.1.1 random,persistent A requirement is to cache some [recent] copies of kernel headers. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: complete reject supportAlvaro Neira2014-10-094-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use the reject action in rules. For example: nft add rule filter input udp dport 22 reject In this rule, we assume that the reason is network unreachable. Also we can specify the reason with the option "with" and the reason. For example: nft add rule filter input tcp dport 22 reject with icmp type host-unreachable In the bridge tables and inet tables, we can use this action too. For example: nft add rule inet filter input reject with icmp type host-unreachable In this rule above, this generates a meta nfproto dependency to match ipv4 traffic because we use a icmpv4 reason to reject. If the reason is not specified, we infer it from the context. Moreover, we have the new icmpx datatype. You can use this datatype for the bridge and the inet tables to simplify your ruleset. For example: nft add rule inet filter input reject with icmpx type host-unreachable We have four icmpx reason and the mapping is: ICMPX reason | ICMPv6 | ICMPv4 | | admin-prohibited | admin-prohibited | admin-prohibited port-unreachable | port-unreachable | port-unreachable no-route | no-route | net-unreachable host-unreachable | addr-unreachable | host-unreachable Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Enhance payload_gen_dependency()Alvaro Neira2014-10-092-1/+3
| | | | | | | | | | With this patch, this function returns a statement with the new dependency that we want to add, instead of an expression. This change is needed in a follow up patch. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set optimization optionsArturo Borrero2014-09-291-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds options to choose set optimization mechanisms. Two new statements are added to the set syntax, and they can be mixed: nft add set filter set1 { type ipv4_addr ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; } nft add set filter set1 { type ipv4_addr ; policy memory ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy memory ; } nft add set filter set1 { type ipv4_addr ; policy performance ; size 1024 ; } nft add set filter set1 { type ipv4_addr ; size 1024 ; policy performance ; } Also valid for maps: nft add map filter map1 { type ipv4_addr : verdict ; policy performace ; } [...] This is the output format, which can be imported later with `nft -f': table filter { set set1 { type ipv4_addr policy memory size 1024 } } In this approach the parser accepts default options such as 'performance', given they are a valid configurations, but aren't sent to the kernel. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* queue: clean up queue statementPatrick McHardy2014-09-241-2/+1
| | | | | | | | | | | | | | | | | | - Rename keyword tokens to their actual keyword - Change the grammar to follow the standard schema for statements and arguments - Use actual expression for the queue numbers to support using normal range expressions, symbolic expression and so on. - restore comma seperation of flag keywords The result is that its possible to use standard ranges, prefix expressions, symbolic expressions etc for the queue number. We get checks for overflow, negative ranges and so on automatically. The comma seperation of flags is more similar to what we have for other flag values. It is still possible to use spaces, however this could be removed since we never had a release supporting that. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: make range_low()/range_high() usable outside of segtreePatrick McHardy2014-09-241-0/+4
| | | | | | | Their functionality is also needed for set descriptions, move the functions to expressions.c and give them a more suitable name for global functions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* mnl: consistency checks across several netlink dumpsPablo Neira Ayuso2014-09-193-0/+18
| | | | | | | | | | | | Obtain the generation ID before dumping the object lists. Then, check for generation ID updates when dumping the several lists that this needs. In case of interference, nft has to remove the stale objects and retry from scratch. This is complementary to the NLM_F_DUMP_INTR flag which is local to one single netlink dump. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix 'describe' command when passing wrong expressionsPablo Neira Ayuso2014-09-171-0/+4
| | | | | | | | | | | | | | | | | | Before this patch: # nft describe tcp foo value expression, datatype inet_proto (Internet protocol) (basetype integer), 8 bits Segmentation fault After this patch: # nft describe tcp foo <cmdline>:1:14-16: Error: syntax error, unexpected string, expecting end of file or newline or semicolon describe tcp foo ^^^ Reported-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add specific byteorder to the struct proto_hdr_templateAlvaro Neira Ayuso2014-09-171-1/+4
| | | | | | | | | | | | | | | | | | | | | If we try to add a rule like: nft add rule filter input udp length {55-9999} nftable shows: BUG: invalid byte order conversion 0 => 2 nft: src/evaluate.c:153: byteorder_conversion_op: Assertion `0' failed. Some of the existing payload fields rely on BYTEORDER_INVALID. Therefore, if we try to convert it in evaluation step, we hit this bug. This patch allows to add a specific byteorder to the struct proto_hdr_template. If we create a expression with a invalid byteorder, we will use the byteorder added to the proto_hdr_template structure. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: include file and line in netlink ABI errorsArturo Borrero2014-09-161-1/+3
| | | | | | | Let's give some more information when netlink ABI errors happens. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh include/linux/nf_tables.h cached copyPablo Neira Ayuso2014-09-111-3/+58
| | | | | | | | | Keep in sync with nf_tables.h header file in net-next tree. Rename NFT_CT_LABEL to NFT_CT_LABELS, this probably slipped through when editing the header file by hand. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add `flush ruleset'Arturo Borrero2014-09-091-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the `flush ruleset' operation to nft. The syntax is: % nft flush ruleset [family] To flush all the ruleset (all families): % nft flush ruleset To flush the ruleset of a given family: % nft flush ruleset ip % nft flush ruleset inet This flush is a shortcut operation which deletes all rules, sets, tables and chains. It's possible since the modifications in the kernel to the NFT_MSG_DELTABLE API call. Users can benefit of this operation when doing an atomic replacement of the entire ruleset, loading a file like this: ========= flush ruleset table ip filter { chain input { counter accept } } ========= Also, users who want to simply clean the ruleset for whatever reason can do it now without having to iterate families/tables. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add devgroup support in meta expresionAna Rey2014-09-031-0/+4
| | | | | | | | | | | | | | | | | | | This adds device group support in meta expresion. The new attributes of meta are "iffgroup" and "oifgroup" - iffgroup: Match device group of incoming device. - oifgroup: Match device group of outcoming device. Example of use: nft add rule ip test input meta iifgroup 2 counter nft add rule ip test output meta oifgroup 2 counter The kernel and libnftnl support were added in these commits: netfilter: nf_tables: add devgroup support in meta expresion src: meta: Add devgroup support to meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for cpu in meta expresionAna Rey2014-08-241-0/+2
| | | | | | | | | | | | | This allows you to match cpu handling with a packet. This is an example of the syntax for this new attribute: nft add rule ip test input meta cpu 1 counter nft add rule ip test input meta cpu 1-3 counter nft add rule ip test input meta cpu { 1, 3} counter Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for pkttype in meta expresionAna Rey2014-08-242-0/+4
| | | | | | | | | | | | | | | If you want to match the pkttype field of the skbuff, you have to use the following syntax: nft add rule ip filter input meta pkttype PACKET_TYPE where PACKET_TYPE can be: unicast, broadcast and multicast. Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't return error in netlink_linearize_rule()Pablo Neira Ayuso2014-08-191-3/+3
| | | | | | | | | This function converts the rule from the list of statements to the netlink message format. The only two possible errors that can make this function to fail are memory exhaustion and malformed statements which inmediately stop the execution of nft. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add level option to the log statementPablo Neira Ayuso2014-07-251-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is required if you use upcoming Linux kernels >= 3.17 which come with a complete logging support for nf_tables. If you use 'log' without options, the kernel logging buffer is used: nft> add rule filter input log You can also specify the logging prefix string: nft> add rule filter input log prefix "input: " You may want to specify the log level: nft> add rule filter input log prefix "input: " level notice By default, if not specified, the default level is 'warn' (just like in iptables). If you specify the group, then nft uses the nfnetlink_log instead: nft> add rule filter input log prefix "input: " group 10 You can also specify the snaplen and qthreshold for the nfnetlink_log. But you cannot mix level and group at the same time, they are mutually exclusive. Default values for both snaplen and qthreshold are 0 (just like in iptables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: check for NLM_F_DUMP_INTR when dumping object listsPablo Neira Ayuso2014-07-141-0/+2
| | | | | | | | | This flag allows to detect that an update has ocurred while dumping any of the object lists. In case of interference, nft cancels the netlink socket to skip processing the remaining stale entries and it retries to obtain fresh list of objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revert broken reject icmp code supportPablo Neira Ayuso2014-06-201-1/+0
| | | | | | | | | | | | | | | | | This patch reverts Alvaro's 34040b1 ("reject: add ICMP code parameter for indicating the type of error") and 11b2bb2 ("reject: Use protocol context for indicating the reject type"). These patches are flawed by two things: 1) IPv6 support is broken, only ICMP codes are considered. 2) If you don't specify any transport context, the utility exits without adding the rule, eg. nft add rule ip filter input reject. The kernel is also flawed when it comes to the inet table. Let's revert this until we can provide decent reject reason support. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* reject: add ICMP code parameter for indicating the type of errorÁlvaro Neira Ayuso2014-06-161-0/+1
| | | | | | | | | | | | | | | | | | | | This patch allows to indicate the ICMP code field in case that we use to reject. Before, we have always sent network unreachable error as ICMP code, now we can explicitly indicate the ICMP code that we want to use. Examples: nft add rule filter input tcp dport 22 reject with host-unreach nft add rule filter input udp dport 22 reject with host-unreach In this case, it will use the host unreachable code to reject traffic. The default code field still is network unreachable and we can also use the rules without the with like that: nft add rule filter input udp dport 22 reject Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* queue: More compact syntaxÁlvaro Neira Ayuso2014-06-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows to use a new syntax more compact and break the current syntax. This new syntax is more similar than the nftables syntax that we use usually. We can use range like we have used in other case in nftables. Here, we have some examples: Before, If we want to declare a queue, we have used a syntax like this: nft add rule test input queue num 1 total 3 options bypass,fanout If we want to use the queue number 1 and the two next (total 3), we use a range in the new syntax, for example: nft add rule test input queue num 1-3 bypass fanout Also if we want to use only one queue, the new rules are like: nft add rule test input queue num 1 # queue 1 or nft add rule test input queue # queue 0 And if we want to add a specific flags we only need to put what flags we want to use: nft add rule test input queue bypass we don't need to use options and the comma for indicating the flags. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: change type of chain.priority from unsigned int to intHendrik Schwartke2014-06-101-1/+1
| | | | | | | This removes a bug that displays strange hook priorities like "type route hook output priority 4294967146". Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add table netlink messages to the batchPablo Neira Ayuso2014-05-191-1/+5
| | | | | | | This patch moves the table messages to the netlink batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain netlink messages to the batchPablo Neira Ayuso2014-05-191-0/+4
| | | | | | | This patch moves the chain netlink messages to the big netlink batch that is sent to kernel-space. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set netlink message to the batchPablo Neira Ayuso2014-05-193-0/+16
| | | | | | | | | | | | | This patch moves the netlink set messages to the batch that contains the rules. This helps to speed up rule-set restoration time by changing the operational. To achieve this, an internal set ID which is unique to the batch is allocated as suggested by Patrick. To retain backward compatibility, nft initially guesses if the kernel supports set in batches. Otherwise, it falls back to the previous (slowier) operational. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add events reportingArturo Borrero2014-04-253-0/+19
| | | | | | | | | | This patch adds a basic events reporting option to nft. The syntax is: % nft monitor [new|destroy] [tables|chains|rules|sets|elements] [xml|json] Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: add socket error reporting helper functionArturo Borrero2014-04-252-0/+2
| | | | | | | | | | | | This patch adds a simple helper function to report errors while opening the Netlink socket. To help users to diagnose problems, a new NFT_EXIT_NONL exit code is included, which is 3. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: generalize chain_print()Arturo Borrero2014-04-251-0/+1
| | | | | | | | Lest generalize the chain_print() function, so we can print a plain chain as the user typed in the basic CLI. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: allow to print sets in plain formatArturo Borrero2014-04-251-0/+3
| | | | | | | | | | | | | Allow to print sets with or without format. This is useful in situations where we want to print more or less the same the user typed (IOW, in one single line, and with family/table info). While at it, make family2str() function public, so it can be used in other places. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-241-0/+4
| | | | | | | | Add support to get an input or output bridge interface name through the relevant meta keys. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gmputil: use MSF/LSF in import/export functions dependant on host byte orderPatrick McHardy2014-04-121-0/+9
| | | | | | | For data of byteorder BYTEORDER_HOST_ENDIAN we need to set the word order dependant on the host byte order. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expression: fix constant expression allocation on big endianArturo Borrero Gonzalez2014-04-121-0/+14
| | | | | | | | | | | | | | | When allocating a constant expression, a pointer to the data is passed to the allocation function. When the variable used to store the data is larger than the size of the data type, this fails on big endian since the most significant bytes (being zero) come first. Add a helper function to calculate the proper address for the cases where this is needed. This currently affects symbolic tables for values < u64 and payload dependency generation for protocol values < u32. Signed-off-by: Patrick McHardy <kaber@trash.net>
* utils: fix -Wcast-align warnings on sparcPatrick McHardy2014-04-091-1/+1
| | | | | | | | | | | The cast to char * in the container_of() marcro causes warnings for all list iteration helpers on sparc: warning: cast increases required alignment of target type [-Wcast-align] Fix by using a void * for address calculations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* ct: add support for setting ct markArturo Borrero2014-03-131-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* set: abort on interval conflictsPatrick McHardy2014-03-071-1/+1
| | | | | | | | | | | We currently print a debug message (with debugging) and continue. Output a proper error message and abort. While at it, make sure we only report a conflict if there actually is one. This is not the case similar actions, IOW in case of sets, never, in case of maps, only if the mapping differs. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add comparison function for singleton expressionsPatrick McHardy2014-03-071-0/+4
| | | | Singed-off-by: Patrick McHardy <kaber@trash.net>
* expr: make expr_binary_error() usable outside of evaluationPatrick McHardy2014-03-071-3/+3
| | | | | | Turn the eval_ctx argument into a list_head to queue the error to. Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-12 18:06:38 +0000