summaryrefslogtreecommitdiffstats
path: root/include
Commit message (Collapse)AuthorAgeFilesLines
* monitor: Fix printing of range elements in named setsArturo Borrero Gonzalez2017-07-191-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If you add set elements to interval sets, the output is wrong. Fix this by caching first element of the range (first event), then wait for the second element of the range (second event) to print them both at the same time. We also avoid printing the first null element required in the RB tree. Before this patch: % nft add element t s {10-20, 30-40} add element ip t s { 0 } add element ip t s { 10 } add element ip t s { ftp } add element ip t s { 30 } add element ip t s { 41 } After this patch: % nft add element t s {10-20, 30-40} add element ip t s { 10-20 } add element ip t s { 30-40 } Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: Introduce flag for half-open range elementsPhil Sutter2017-07-192-0/+17
| | | | | | | | | This flag is required by userspace only, so can live within userdata. It's sole purpose is for 'nft monitor' to detect half-open ranges (which are comprised of a single element only). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: netlink: Remove variable nf_mon_sock.Varsha Rao2017-07-191-1/+2
| | | | | | | | | | | Remove variable nf_mon_sock of type structure mnl_socket to avoid duplicity. Instead variable nf_sock of the same type is passed as argument to netlink_monitor(). Also remove netlink_open_mon_sock() function definition, which is no longer required. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Allow passing the parent set to set_expr_alloc()Phil Sutter2017-07-171-1/+2
| | | | | | | | | | | | | | | | | Usually one wants to at least initialize set_flags from the parent, so make allocation of a set's set expression more convenient. The idea to do this came when fixing an issue with output formatting of larger anonymous sets in nft monitor: Since netlink_events_cache_addset() didn't initialize set_flags, calculate_delim() didn't detect it's an anonymous set and therefore added newlines to the output. Reported-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Fixes: a9dc3ceabc10f ("expression: print sets and maps in pretty format") Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Remove __init and __exit macro definitions.Varsha Rao2017-07-172-2/+16
| | | | | | | | | | | | Add nft_init and nft_exit functions, which calls _init and _exit functions in main.c file. Remove __init and __exit macro definitions as libnftables library will be created soon. Rename realm_table_init() and realm_table_exit() functions to avoid ambiguity as realm_table_rt_init(), realm_table_meta_init, realm_table_rt_exit() and realm_table_meta_exit() in rt.c and meta.c files. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Pass nf_sock where needed as parameterPablo Neira Ayuso2017-07-176-9/+22
| | | | | | | | | | | | This socket should not be global, it is also hidden in many layers of code. Expose it as function parameters to decouple the netlink socket handling logic from the command parsing, evaluation and bytecode generation. Joint work with Varsha Rao. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rename struct ct to ct_helperFlorian Westphal2017-07-161-3/+3
| | | | | | | Its misleading, this structure holds members for ct_helper object infrastructure, rename it. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: make tcptopt structs staticFlorian Westphal2017-07-131-9/+0
| | | | | | | not used outside of tcpopt.c, so unexport from header file and make them static. Signed-off-by: Florian Westphal <fw@strlen.de>
* include: Remove datatype_register().Varsha Rao2017-06-307-3/+24
| | | | | | | | Remove datatype_register() function and its calling __init functions. Add arguments of datatype_register() function to datatype array. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --check option flagPablo M. Bermudo Garay2017-06-261-0/+1
| | | | | | | | | Sometimes it can be useful to test if a command is valid without applying any change to the rule-set. This commit adds a new option flag (-c | --check) that performs a dry run execution of the commands. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add new generic context structure nft_ctxPablo M. Bermudo Garay2017-06-262-4/+8
| | | | | | | | | | | | | The new structure nft_ctx is meant to be used as a generic container of context information. This is a preparatory patch. So at the moment the struct just carry output_ctx on his path through main.c and cli.c. Based on original idea from Eric Leblond. Signed-off-by: Pablo M. Bermudo Garay <pablombg@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Pass stateless, numeric, ip2name and handle variables as structure members.Varsha Rao2017-06-187-19/+29
| | | | | | | | | | | | | | | | | libnftables library will be created soon. So declare numeric_output, stateless_output, ip2name_output and handle_output as members of structure output_ctx, instead of global variables. Rename these variables as following, numeric_output -> numeric stateless_output -> stateless ip2name_output -> ip2name handle_output -> handle Also add struct output_ctx *octx as member of struct netlink_ctx. Signed-off-by: Varsha Rao <rvarsha016@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: error reporting for nested ruleset representationPablo Neira Ayuso2017-06-161-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If you load a file using the nested ruleset representation, ie. the one you get via `nft list ruleset', error reporting doesn't help you much to find the problem. For example, the following ruleset points to an unexisting chain 'x': table test { chain test { type filter hook ingress priority 0; policy drop; ip saddr { 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 } jump x } } Error reporting is very sparse as it says: # nft -f /home/test/x /home/test/x:1:1-2: Error: Could not process rule: No such file or directory table netdev test{ ^^ So it's hard to know what is exactly missing. This patch enhances the existing logic, so nft points to the rule causing the problem, ie. # nft -f /home/test/x /home/test/x:4:17-70: Error: Could not process rule: No such file or directory ip saddr { 1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 } jump x ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The idea behind this patch is to expand the single table command into a list of individual commands, one per nested object inside the table. This expanded list is spliced into the existing list of commands. Thus, each command gets a sequence number that helps us correlate the error with the command that triggers it. This patch also includes reference counting for rules and objects. This was already in place for table, chain and sets. We need this since now we hold references to them from both the command and the table object itself. So the last reference releases the object from memory. Note that table objects still keep the list of chain, sets, etc. since the existing cache logic needs this to work. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove global nftnl_batch structure in mnl layerPablo Neira Ayuso2017-05-292-27/+29
| | | | | | | | The underlying mnl layer uses a global nftnl_batch structure. Instead, pass pointer as parameter to the functions that need this. The netlink layer stores a reference to this structure in struct netlink_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: don't kill dependencies accross statementsFlorian Westphal2017-05-081-0/+2
| | | | | | | | | | | | | | | | | | | | nft currently translates ip protocol tcp meta mark set 1 tcp dport 22 to mark set 0x00000001 tcp dport 22 This is wrong, the latter form is same as mark set 0x00000001 ip protocol tcp tcp dport 22 and thats not correct (original rule sets mark for tcp packets only). We need to clear the dependency stack whenever we see a statement other than stmt_expr, as these will have side effects (counter, payload mangling, logging and the like). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add conntrack event mask supportFlorian Westphal2017-04-243-64/+19
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hash: generate a random seed if seed option is emptyLiping Zhang2017-04-152-2/+5
| | | | | | | | | | | Typing the "nft add rule x y ct mark set jhash ip saddr mod 2" will not generate a random seed, instead, the seed will always be zero. So if seed option is empty, we shoulde not set the NFTA_HASH_SEED attribute, then a random seed will be generated in the kernel. Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: implement add/create/delete for ct helper objectsFlorian Westphal2017-03-161-0/+4
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow listing all ct helpersFlorian Westphal2017-03-161-0/+1
| | | | | | | | | | | this implements nft list ct helpers table filter table ip filter { ct helper ftp-standard { .. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add initial ct helper supportFlorian Westphal2017-03-163-1/+19
| | | | | | | | | | | | | | | | | This adds initial support for defining conntrack helper objects which can then be assigned to connections using the objref infrastructure: table ip filter { ct helper ftp-standard { type "ftp" protocol tcp } chain y { tcp dport 21 ct helper set "ftp-standard" } } Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Support existence checkPhil Sutter2017-03-132-0/+3
| | | | | | | | | | | | | | | | | This allows to check whether a FIB entry exists for a given packet by comparing the expression with a boolean keyword like so: | fib daddr oif exists The implementation requires introduction of a generic expression flag EXPR_F_BOOLEAN which allows relational expression to signal it's LHS that a boolean comparison is being done (indicated by boolean type on RHS). In contrast to exthdr existence checks, fib expression can't know this in beforehand because the LHS syntax is absolutely identical to a non-boolean comparison. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Implement existence checkPhil Sutter2017-03-101-0/+2
| | | | | | | | | | | This allows to check for existence of an IPv6 extension or TCP option header by using the following syntax: | exthdr frag exists | tcpopt window exists Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Add support for exthdr specific flagsPhil Sutter2017-03-103-2/+4
| | | | | | | | | This allows to have custom flags in exthdr expression, which is necessary for upcoming existence checks (of both IPv6 extension headers as well as TCP options). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Introduce boolean datatype and boolean expressionPhil Sutter2017-03-101-0/+2
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: hash: support of symmetric hashLaura Garcia Liebana2017-03-063-1/+15
| | | | | | | | | | | | | | | | | | | | | This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit tcp options supportPablo Neira Ayuso2017-02-281-3/+29
| | | | | | | | | | | | | | | | | | | Rework syntax, add tokens so we can extend the grammar more easily. This has triggered several syntax changes with regards to the original patch, specifically: tcp option sack0 left 1 There is no space between sack and the block number anymore, no more offset field, now they are a single field. Just like we do with rt, rt0 and rt2. This simplifies our grammar and that is good since it makes our life easier when extending it later on to accomodate new features. I have also renamed sack_permitted to sack-permitted. I couldn't find any option using underscore so far, so let's keep it consistent with what we have. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support zone set statement with optional directionFlorian Westphal2017-02-281-0/+2
| | | | | | | | | | | | nft automatically understands 'ct zone set 1' but when a direction is specified too we get a parser error since they are currently only allowed for plain ct expressions. This permits the existing syntax ('ct original zone') for all tokens with an optional direction also for set statements. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: store byteorder for set dataPablo Neira Ayuso2017-02-281-0/+1
| | | | | | | | | Add new UDATA_SET_DATABYTEORDER attribute for NFTA_SET_UDATA to store the datatype byteorder. This is required if integer_type is used on the rhs of the mapping given that this datatype comes with no specific byteorder. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename set_keytype_alloc() to set_datatype_alloc()Pablo Neira Ayuso2017-02-281-2/+2
| | | | | | | This function can be used either side of the map, so rename it to something generic. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: add DTYPE_F_CLONE flagPablo Neira Ayuso2017-02-251-0/+2
| | | | | | | | | | | | | | This flag allows us to identify datatypes that are instances from original datatypes. This fixes a possible double free when attaching a concatenation datatype to set->keytype while being also referenced from concatenation expressions. ip6/flowtable.t: ERROR: line 5: src/nft add rule --debug=netlink ip6 test-ip6 input flow table acct_out { meta iif . ip6 saddr timeout 600s counter }: This rule should not have failed. *** Error in `src/nft': double free or corruption (fasttop): 0x000000000117ce70 *** Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: store set byteorder in NFTA_SET_USERDATAPablo Neira Ayuso2017-02-251-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The integer datatype has neither specific byteorder nor length. This results in the following broken output: # nft list ruleset table ip x { chain y { mark set cpu map { 0 : 0x00000001, 16777216 : 0x00000002} } } Currently, with BYTEORDER_INVALID, nft defaults on network byteorder, hence the output above. This patch stores the key byteorder in the userdata using a TLV structure in the NFTA_SET_USERDATA area, so nft can interpret key accordingly when dumping the set back to userspace. Thus, after this patch the listing is correct: # nft list ruleset table ip x { chain y { mark set cpu map { 0 : 0x00000001, 1 : 0x00000002} } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: store byteorder for set keysPablo Neira Ayuso2017-02-251-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Selectors that rely on the integer type and expect host endian byteorder don't work properly. We need to keep the byteorder around based on the left hand size expression that provides the context, so store the byteorder when evaluating the map. Before this patch. # nft --debug=netlink add rule x y meta mark set meta cpu map { 0 : 1, 1 : 2 } __map%d x b __map%d x 0 element 00000000 : 00000001 0 [end] element 01000000 : 00000002 0 [end] ^^^^^^^^ This is expressed in network byteorder, because the invalid byteorder defaults on this. After this patch: # nft --debug=netlink add rule x y meta mark set meta cpu map { 0 : 1, 1 : 2 } __map%d x b __map%d x 0 element 00000000 : 00000001 0 [end] element 00000001 : 00000002 0 [end] ^^^^^^^^ This is in host byteorder, as the key selector in the map mandates. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add tcpopt.h to Makefile.amPablo Neira Ayuso2017-02-251-0/+1
| | | | | | Add this new header filer otherwise make distcheck breaks. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: refresh linux/netfilter/nf_tables.hPablo Neira Ayuso2017-02-151-15/+25
| | | | | | Get us in sync with kernel tree header file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* payload: automatically kill dependencies for exthdr and tcpoptManuel Messner2017-02-121-0/+2
| | | | | | | | | | | | | | | | | | | This patch automatically removes the dependencies for exthdr and tcpopt. # nft add rule filter input tcp option maxseg kind 3 counter. # nft list table filter input Before: # ip protocol 6 tcp option maxseg kind 3 counter After: # tcp option maxseg kind 3 counter Thus allowing to write tests as follows: # tcp option maxseg kind 3;ok Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add TCP option matchingManuel Messner2017-02-123-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables nft to match against TCP options. Currently these TCP options are supported: * End of Option List (eol) * No-Operation (noop) * Maximum Segment Size (maxseg) * Window Scale (window) * SACK Permitted (sack_permitted) * SACK (sack) * Timestamps (timestamp) Syntax: tcp options $option_name [$offset] $field_name Example: # count all incoming packets with a specific maximum segment size `x` # nft add rule filter input tcp option maxseg size x counter # count all incoming packets with a SACK TCP option where the third # (counted from zero) left field is greater `x`. # nft add rule filter input tcp option sack 2 left \> x counter If the offset (the `2` in the example above) is zero, it can optionally be omitted. For all non-SACK TCP options it is always zero, thus can be left out. Option names and field names are parsed from templates, similar to meta and ct options rather than via keywords to prevent adding more keywords than necessary. Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: prepare exthdr_gen_dependency for tcp supportManuel Messner2017-02-121-1/+2
| | | | | | | | | | | | currently exthdr always needs ipv6 dependency (i.e. link layer), but with upcomming TCP option matching we also need to include TCP at the network layer. This patch prepares this change by adding two parameters to exthdr_gen_dependency. Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: prepare for tcp supportManuel Messner2017-02-121-1/+2
| | | | | | | | | | | right now exthdr only deals with ipv6 extension headers, followup patch will enable tcp option matching. This adds the 'op' arg to exthdr_init. Signed-off-by: Manuel Messner <mm@skelett.io> Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* include: linux: netfilter: nf_tables: copy file from nf-nextManuel Messner2017-02-121-1/+16
| | | | | Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Allow reset single stateful objectElise Lennion2017-01-272-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | Currently the stateful objects can only be reseted in groups. With this patch reseting a single object is allowed: $ nft reset counter filter https-traffic table ip filter { counter https-traffic { packets 8774 bytes 542668 } } $ nft list counter filter https-traffic table ip filter { counter https-traffic { packets 0 bytes 0 } } Heavily based on work from Pablo Neira Ayuso <pablo@netfilter.org>. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Honor obligatory stateless printing of flow tablesElise Lennion2017-01-231-1/+1
| | | | | | | | Always print flow statement as stateless expressions, given that this just defines the flow table statement instance that is allocated per entry. Signed-off-by: Elise Lennion <elise.lennion@gmail.com>
* src: Allow to list ruleset without stateful informationElise Lennion2017-01-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently only counter and quota have stateful information. For named counters, packets and bytes are displayed as 0. Standard list ruleset: table ip filter { counter https { packets 161942 bytes 10253353 } chain output { type filter hook output priority 0; policy accept; counter name tcp dport map { https : "https"} tcp dport https counter packets 171211 bytes 10869045 tcp dport https quota 25 mbytes used 10 mbytes } } With stateless option, -s: table ip filter { counter https { packets 0 bytes 0 } chain output { type filter hook output priority 0; policy accept; counter name tcp dport map { https : "https"} tcp dport https counter tcp dport https quota 25 mbytes } } Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add average bytes per packet counter supportLiping Zhang2017-01-161-0/+5
| | | | | | | | | | | | | | | | | Similar to connbytes extension in iptables, now you can use it to match average bytes per packet a connection has transferred so far. For example, match avgpkt in "BOTH" diretion: # nft add rule x y ct avgpkt \> 100 Match avgpkt in reply direction: # nft add rule x y ct reply avgpkt \< 900 Or match avgpkt in original direction: # nft add rule x y ct original avgpkt \> 200 Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: sort set elements in netlink_get_setelems()Elise Lennion2017-01-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So users can better track their ruleset via git. Without sorting, the elements can be listed in a different order every time the set is created, generating unnecessary git changes. Mergesort is used. Doesn't sort sets with 'flags interval' set on. Pablo appends to this changelog description: Currently these interval set elements are dumped in order. We'll likely get new representations soon that may not guarantee this anymore, so let's revisit this later in case we need it. Without this patch, nft list ruleset with a set containing 40000 elements takes on my laptop: real 0m2.742s user 0m0.112s sys 0m0.280s With this patch: real 0m2.846s user 0m0.180s sys 0m0.284s Difference is small, so don't get nft more complicated with yet another getopt() option, enable this by default. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for stateful object monitoringPablo Neira Ayuso2017-01-031-0/+3
| | | | | | | This patch extends the event monitoring infrastructure to catch events of addition and removal of stateful objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for stateful object mapsPablo Neira Ayuso2017-01-031-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | You can create these maps using explicit map declarations: # nft add table filter # nft add chain filter input { type filter hook input priority 0\; } # nft add map filter badguys { type ipv4_addr : counter \; } # nft add rule filter input counter name ip saddr map @badguys # nft add counter filter badguy1 # nft add counter filter badguy2 # nft add element filter badguys { 192.168.2.3 : "badguy1" } # nft add element filter badguys { 192.168.2.4 : "badguy2" } Or through implicit map definitions: table ip filter { counter http-traffic { packets 8 bytes 672 } chain input { type filter hook input priority 0; policy accept; counter name tcp dport map { 80 : "http-traffic", 443 : "http-traffic"} } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object reference expressionPablo Neira Ayuso2017-01-031-0/+10
| | | | | | | | | This patch adds a new objref statement to refer to existing stateful objects from rules, eg. # nft add rule filter input counter name test counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: reset internal stateful objectsPablo Neira Ayuso2017-01-033-3/+8
| | | | | | | | | | | | | | | | | | | | | This patch allows you to atomically dump and reset stateful objects, eg. # nft list counters table ip filter { counter test { packets 1024 bytes 100000 } } # nft reset quotas table filter counter test { packets 1024 bytes 100000 } # nft reset quotas table filter counter test { packets 0 bytes 0 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add/create/delete stateful objectsPablo Neira Ayuso2017-01-033-1/+12
| | | | | | | | | | | | | | | | This patch allows you to add and to delete objects, eg. # nft add quota filter test 1234567 bytes # nft list quotas table ip filter { quota test { 1234567 bytes } } # nft delete quota filter test Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: listing of stateful objectsPablo Neira Ayuso2017-01-034-0/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to dump existing stateful objects, eg. # nft list ruleset table ip filter { counter test { packets 64 bytes 1268 } quota test { over 1 mbytes used 1268 bytes } chain input { type filter hook input priority 0; policy accept; quota name test drop counter name test } } # nft list quotas table ip filter { quota test { over 1 mbytes used 1268 bytes } } # nft list counters table ip filter { counter test { packets 64 bytes 1268 } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>