summaryrefslogtreecommitdiffstats
path: root/src/evaluate.c
Commit message (Collapse)AuthorAgeFilesLines
* evaluate: remove flowtable from cache on delete flowtable commandPablo Neira Ayuso2021-05-021-0/+24
| | | | | | | Update the cache to remove this flowtable from the evaluation phase. Add flowtable_cache_del() function for this purpose. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove set from cache on delete set commandPablo Neira Ayuso2021-05-021-0/+24
| | | | | | Update the cache to remove this set from the evaluation phase. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove chain from cache on delete chain commandPablo Neira Ayuso2021-05-021-0/+24
| | | | | | | Update the cache to remove this chain from the evaluation phase. Add chain_cache_del() function for this purpose. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for tablePablo Neira Ayuso2021-05-021-50/+78
| | | | | | | | | | | | Add a hashtable for fast table lookups. Tables that reside in the cache use the table->cache_hlist and table->cache_list heads. Table that are created from command line / ruleset are also added to the cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add object to the cachePablo Neira Ayuso2021-05-021-0/+10
| | | | | | | | | | | If the cache does not contain this object that is defined in this batch, add it to the cache. This allows for references to this new object in the same batch. This patch also adds missing handle_merge() to set the object name, otherwise object name is NULL and obj_cache_find() crashes. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add flowtable to the cachePablo Neira Ayuso2021-05-021-0/+3
| | | | | | | | If the cache does not contain this flowtable that is defined in this batch, then add it to the cache. This allows for references to this new flowtable in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: add set to the cachePablo Neira Ayuso2021-05-021-0/+4
| | | | | | | | If the cache does not contain the set that is defined in this batch, add it to the cache. This allows for references to this new set in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for flowtablePablo Neira Ayuso2021-05-021-3/+3
| | | | | | | | | | Add flowtable hashtable cache. Actually I am not expecting that many flowtables to benefit from the hashtable to be created by streamline this code with tables, chains, sets and policy objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add hashtable cache for objectPablo Neira Ayuso2021-05-021-1/+1
| | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for object lookups. This patch also splits table->objs in two: - Sets that reside in the cache are stored in the new tables->cache_obj and tables->cache_obj_ht. - Set that defined via command line / ruleset file reside in tables->obj. Sets in the cache (already in the kernel) are not placed in the table->objs list. By keeping separated lists, objs defined via command line / ruleset file can be added to cache. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: consolidate nft_cache infrastructurePablo Neira Ayuso2021-05-021-1/+1
| | | | | | | | - prepend nft_ prefix to nft_cache API and internal functions - move declarations to cache.h (and remove redundant declarations) - move struct nft_cache definition to cache.h Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: pass chain name to chain_cache_find()Pablo Neira Ayuso2021-05-021-5/+5
| | | | | | | | You can identify chains through the unique handle in deletions, update this interface to take a string instead of the handle to prepare for the introduction of 64-bit handle chain lookups. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: unbreak deletion by table handlePablo Neira Ayuso2021-05-021-0/+3
| | | | | | | | | Use NFTA_TABLE_HANDLE instead of NFTA_TABLE_NAME to refer to the table 64-bit unique handle. Fixes: 7840b9224d5b ("evaluate: remove table from cache on delete table") Fixes: f8aec603aa7e ("src: initial extended netlink error reporting") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: check if nat statement map specifies a transport header exprFlorian Westphal2021-04-291-1/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | Importing the systemd nat table fails: table ip io.systemd.nat { map map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service elements = { tcp . 8088 : 192.168.162.117 . 80 } } chain prerouting { type nat hook prerouting priority dstnat + 1; policy accept; fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } } ruleset:9:48-59: Error: transport protocol mapping is only valid after transport protocol match To resolve this (no transport header base specified), check if the map itself contains a network base protocol expression. This allows nft to import the ruleset. Import still fails with same error if 'inet_service' is removed from the map, as it should. Reported-by: Henning Reich <henning.reich@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* cache: add hashtable cache for setsPablo Neira Ayuso2021-04-031-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a hashtable for set lookups. This patch also splits table->sets in two: - Sets that reside in the cache are stored in the new tables->cache_set and tables->cache_set_ht. - Set that defined via command line / ruleset file reside in tables->set. Sets in the cache (already in the kernel) are not placed in the table->sets list. By keeping separated lists, sets defined via command line / ruleset file can be added to cache. Adding 10000 sets, before: # time nft -f x real 0m6,415s user 0m3,126s sys 0m3,284s After: # time nft -f x real 0m3,949s user 0m0,743s sys 0m3,205s Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: use chain hashtable for lookupsPablo Neira Ayuso2021-04-031-4/+4
| | | | | | | | | | | | | | | | | | | | | Instead of the linear list lookup. Before this patch: real 0m21,735s user 0m20,329s sys 0m1,384s After: real 0m10,910s user 0m9,448s sys 0m1,434s chain_lookup() is removed since linear list lookups are only used by the fuzzy chain name matching for error reporting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: don't crash when set elements are not evaluated as expectedFlorian Westphal2021-04-011-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | define foo = 2001:db8:123::/48 table inet filter { set foo { typeof ip6 saddr elements = $foo } } gives crash. This now exits with: stdin:1:14-30: Error: Unexpected initial set type prefix define foo = 2001:db8:123::/48 ^^^^^^^^^^^^^^^^^ For literals, bison parser protects us, as it enforces 'elements = { 2001:... '. For 'elements = $foo' we can't detect it at parsing stage as the '$foo' symbol might as well evaluate to "{ 2001, ...}" (i.e. we can't do a set element allocation). So at least detect this from set instantiaton. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: set evaluation context for set elementsFlorian Westphal2021-02-161-2/+9
| | | | | | | | | | | | | This resolves same issue as previous patch when such expression is used as a set key: set z { typeof ct zone - elements = { 1, 512, 768, 1024, 1280, 1536 } + elements = { 1, 2, 3, 4, 5, 6 } } Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: pick data element byte order, not dtype oneFlorian Westphal2021-02-161-1/+1
| | | | | | | | | | | | | Some expressions have integer base type, not a specific one, e.g. 'ct zone'. In that case nft used the wrong byte order. Without this, nft adds elements = { "eth0" : 256, "eth1" : 512, "veth4" : 256 } instead of 1, 2, 3. This is not a 'display bug', the added elements have wrong byte order. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: incorrect usage of stmt_binary_error() in rejectPablo Neira Ayuso2021-02-091-3/+2
| | | | | | | Don't pass ctx->pctx.protocol[PROTO_BASE_LL_HDR] to stmt_binary_error(), it's not useful for the error reporting as location is not available. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add negation match on singleton bitmask valuePablo Neira Ayuso2021-02-051-0/+8
| | | | | | | | | | | | | | | | | This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: do not crash if dynamic set has no statementsFlorian Westphal2021-02-051-4/+6
| | | | | | | | list_first_entry() returns garbage when the list is empty. There is no need to run the following loop if we have no statements, so just return 0. Signed-off-by: Florian Westphal <fw@strlen.de>
* reject: Fix for missing dependencies in netdev familyPhil Sutter2021-01-271-1/+2
| | | | | | | | | | | | | | | Like with bridge family, rejecting with either icmp or icmpv6 must create a dependency match on meta protocol. Upon delinearization, treat netdev reject identical to bridge as well so no family info is lost. This makes reject statement in netdev family fully symmetric so fix the tests in tests/py/netdev/reject.t, adjust the related payload dumps and add JSON equivalents which were missing altogether. Fixes: 0c42a1f2a0cc5 ("evaluate: add netdev support for reject default") Fixes: a51a0bec1f698 ("tests: py: add netdev folder and reject.t icmp cases") Cc: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: evaluate: reset context maxlen value before prio evaluationFlorian Westphal2021-01-261-2/+2
| | | | | | | | | | unshare -n tests/shell/run-tests.sh tests/shell/testcases/nft-f/0024priority_0 W: [FAILED] tests/shell/testcases/nft-f/0024priority_0: got 1 /dev/stdin:8:47-49: Error: Value 100 exceeds valid range 0-15 type filter hook postrouting priority 100 Reported-by: Andreas Schultz <andreas.schultz@travelping.com Signed-off-by: Florian Westphal <fw@strlen.de>
* exthdr: remove tcp dependency for tcp option matchingFlorian Westphal2021-01-261-3/+1
| | | | | | Kernel won't search for tcp options in non-tcp packets. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: disallow ct original {s,d}ddr from concatenationsPablo Neira Ayuso2021-01-251-0/+17
| | | | | | | | | | | | | | | | Extend 8b043938e77b ("evaluate: disallow ct original {s,d}ddr from maps") to cover concatenations too. Error: specify either ip or ip6 for address matching add rule x y meta mark set ct original saddr . meta mark map { 1.1.1.1 . 20 : 30 } ^^^^^^^^^^^^^^^^^ The old syntax for ct original saddr without either ip or ip6 results in unknown key size, which breaks the listing. The old syntax is only allowed in simple rules for backward compatibility. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1489 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disallow ct original {s,d}ddr from mapsPablo Neira Ayuso2021-01-151-0/+6
| | | | | | | | | test.nft:6:55-71: Error: specify either ip or ip6 for address matching add rule ip mangle manout ct direction reply mark set ct original daddr map { $ext1_ip : 0x11, $ext2_ip : 0x12 } ^^^^^^^^^^^^^^^^^ Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1489 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: set on flags to request multi-statement supportPablo Neira Ayuso2021-01-041-0/+8
| | | | | | | Old kernel reject requests for element with multiple statements because userspace sets on the flags for multi-statements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set element multi-statement supportPablo Neira Ayuso2020-12-181-14/+43
| | | | | | | | Extend the set element infrastructure to support for several statements. This patch places the statements right after the key when printing it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for multi-statement in dynamic sets and mapsPablo Neira Ayuso2020-12-171-10/+14
| | | | | | | | This patch allows for two statements for dynamic set updates, e.g. nft rule x y add @y { ip daddr limit rate 1/second counter } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add auto-dependencies for ipv6 icmp6Florian Westphal2020-12-091-1/+1
| | | | | | Extend the earlier commit to also cover icmpv6. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add auto-dependencies for ipv4 icmpFlorian Westphal2020-12-091-1/+19
| | | | | | | | | | | | | | The ICMP header has field values that are only exist for certain types. Mark the icmp proto 'type' field as a nextheader field and add a new th description to store the icmp type dependency. This can later be re-used for other protocol dependend definitions such as mptcp options -- which are all share the same tcp option number and have a special 4 bit marker inside the mptcp option space that tells how the remaining option looks like. Signed-off-by: Florian Westphal <fw@strlen.de>
* tcpopt: split tcpopt_hdr_fields into per-option enumFlorian Westphal2020-11-091-10/+6
| | | | | | | | | | | | | | | | | | Currently we're limited to ten template fields in exthdr_desc struct. Using a single enum for all tpc option fields thus won't work indefinitely (TCPOPTHDR_FIELD_TSECR is 9) when new option templates get added. Fortunately we can just use one enum per tcp option to avoid this. As a side effect this also allows to simplify the sack offset calculations. Rather than computing that on-the-fly, just add extra fields to the SACK template. expr->exthdr.offset now holds the 'raw' value, filled in from the option template. This would ease implementation of 'raw option matching' using offset and length to load from the option. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: add netdev support for reject defaultJose M. Guisado Gomez2020-11-021-0/+1
| | | | | | | | | | Enables not specifying any icmp type and code when using reject inside netdev. This patch completely enables using reject for the netdev family. Signed-off-by: Jose M. Guisado Gomez <guigom@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: ingress inet supportPablo Neira Ayuso2020-10-131-2/+6
| | | | | | | | | | | | | | | | | | Add support for inet ingress chains. table inet filter { chain ingress { type filter hook ingress device "veth0" priority filter; policy accept; } chain input { type filter hook input priority filter; policy accept; } chain forward { type filter hook forward priority filter; policy accept; } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Reject quoted strings containing only wildcardPhil Sutter2020-10-061-2/+5
| | | | | | | | | | | | | | | | | | | | | Fix for an assertion fail when trying to match against an all-wildcard interface name: | % nft add rule t c iifname '"*"' | nft: expression.c:402: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed. | zsh: abort nft add rule t c iifname '"*"' Fix this by detecting the string in expr_evaluate_string() and returning an error message: | % nft add rule t c iifname '"*"' | Error: All-wildcard strings are not supported | add rule t c iifname "*" | ^^^ While being at it, drop the 'datalen >= 1' clause from the following conditional as together with the added check for 'datalen == 0', all possible other values have been caught already.
* src: context tracking for multiple transport protocolsPablo Neira Ayuso2020-09-151-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch extends the protocol context infrastructure to track multiple transport protocols when they are specified from sets. This removes errors like: "transport protocol mapping is only valid after transport protocol match" when invoking: # nft add rule x z meta l4proto { tcp, udp } dnat to 1.1.1.1:80 This patch also catches conflicts like: # nft add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 Error: conflicting protocols specified: udp vs. tcp add rule x z ip protocol { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 ^^^^^^^^^ and: # nft add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 Error: conflicting protocols specified: udp vs. tcp add rule x z meta l4proto { tcp, udp } tcp dport 20 dnat to 1.1.1.1:80 ^^^^^^^^^ Note that: - the singleton protocol context tracker is left in place until the existing users are updated to use this new multiprotocol tracker. Moving forward, it would be good to consolidate things around this new multiprotocol context tracker infrastructure. - link and network layers are not updated to use this infrastructure yet. The code that deals with vlan conflicts relies on forcing protocol context updates to the singleton protocol base. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove one indent level in __expr_evaluate_payload()Pablo Neira Ayuso2020-09-141-25/+24
| | | | | | | If there is protocol context for this base, just return from function to remove one level of indentation. This patch is cleanup. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* socket: add support for "wildcard" keyBalazs Scheidler2020-08-291-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iptables had a "-m socket --transparent" which didn't match sockets that are bound to all addresses (e.g. 0.0.0.0 for ipv4, and ::0 for ipv6). It was possible to override this behavior by using --nowildcard, in which case it did match zero bound sockets as well. The issue is that nftables never included the wildcard check, so in effect it behaved like "iptables -m socket --transparent --nowildcard" with no means to exclude wildcarded listeners. This is a problem as a user-space process that binds to 0.0.0.0:<port> that enables IP_TRANSPARENT would effectively intercept traffic going in _any_ direction on the specific port, whereas in most cases, transparent proxies would only need this for one specific address. The solution is to add "socket wildcard" key to the nft_socket module, which makes it possible to match on the wildcardness of a socket from one's ruleset. This is how to use it: table inet haproxy { chain prerouting { type filter hook prerouting priority -150; policy accept; socket transparent 1 socket wildcard 0 mark set 0x00000001 } } This patch effectively depends on its counterpart in the kernel. Signed-off-by: Balazs Scheidler <bazsi77@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add chain hashtable cachePablo Neira Ayuso2020-08-261-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | This significantly improves ruleset listing time with large rulesets (~50k rules) with _lots_ of non-base chains. # time nft list ruleset &> /dev/null Before this patch: real 0m11,172s user 0m6,810s sys 0m4,220s After this patch: real 0m4,747s user 0m0,802s sys 0m3,912s This patch also removes list_bindings from netlink_ctx since there is no need to keep a temporary list of chains anymore. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: disregard ct address matching without familyPablo Neira Ayuso2020-07-311-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | The following rule: # nft add rule ip x y ct original daddr @servers breaks with: # nft list ruleset nft: netlink_delinearize.c:124: netlink_parse_concat_expr: Assertion `consumed > 0' failed. Aborted Bail out if this syntax is used, instead users should rely on: # nft add rule ip x y ct original ip daddr @servers ~~ which uses NFT_CT_{SRC,DST}_{IP,IP6} in the bytecode generation. This issue is described in 7f742d0a9071 ("ct: support for NFT_CT_{SRC,DST}_{IP,IP6}"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: UAF in hook priority expressionPablo Neira Ayuso2020-07-291-1/+1
| | | | | | | | Release priority expression right before assigning the constant expression that results from the evaluation. Fixes: 627c451b2351 ("src: allow variables in the chain priority specification") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: memleak in invalid default policy definitionPablo Neira Ayuso2020-07-291-1/+3
| | | | | | | Release the clone expression from the exit path. Fixes: 5173151863d3 ("evaluate: replace variable expression by the value expression") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: remove table from cache on delete tablePablo Neira Ayuso2020-07-291-0/+15
| | | | | | | | | | | | | | | | | | | | | The following ruleset crashes nft if loaded twice, via nft -ef: add table inet filter delete table inet filter table inet filter { chain input { type filter hook input priority filter; policy drop; iifname { "eth0" } counter accept } } If the table contains anonymous sets, such as __set0, then delete + add table might result in nft reusing the existing stale __set0 in the cache. The problem is that nft gets confused and it reuses the existing stale __set0 instead of the new anonymous set __set0 with the same name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove cache lookups after the evaluation phasePablo Neira Ayuso2020-07-291-5/+8
| | | | | | | | | | | | This patch adds a new field to the cmd structure for elements to store a reference to the set. This saves an extra lookup in the netlink bytecode generation step. This patch also allows to incrementally update during the evaluation phase according to the command actions, which is required by the follow up ("evaluate: remove table from cache on delete table") bugfix patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: flush set cache from the evaluation phasePablo Neira Ayuso2020-07-291-0/+15
| | | | | | | | This patch reworks 40ef308e19b6 ("rule: flush set cache before flush command"). This patch flushes the set cache earlier, from the command evaluation step. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: bail out with concatenations and singleton valuesPablo Neira Ayuso2020-07-241-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | The rule: # nft add rule x y iifname . oifname p . q is equivalent to: # nft add rule x y iifname p oifname q Bail out with: Error: Use concatenations with sets and maps, not singleton values add rule x y iifname . oifname p . q ^^^^^^^^^^^^^^^^^ ~~~~~ instead of: BUG: invalid expression type concat nft: evaluate.c:1916: expr_evaluate_relational: Assertion `0' failed. Aborted Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: replace variable expression by the value expressionPablo Neira Ayuso2020-07-221-1/+4
| | | | | | | | The variable expression provides the binding between the variable dereference and the value expression. Replace the variable expression by the real value expression after the evaluation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: permit get element on mapsFlorian Westphal2020-07-221-12/+0
| | | | | | | | | | | | | | | | | | | | | | Its possible to add an element to a map, but you can't read it back: before: nft add element inet filter test "{ 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 }" nft get element inet filter test "{ 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 }" Error: No such file or directory; did you mean map ‘test’ in table inet ‘filter’? get element inet filter test { 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 } ^^^^ after: nft get element inet filter test "{ 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x42 }" table inet filter { map test { type ipv4_addr . ether_addr . inet_service : mark flags interval,timeout elements = { 18.51.100.17 . ad:c1:ac:c0:ce:c0 . 3761 : 0x00000042 } } } Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: use evaluate_expr_variable() for chain policy evaluationPablo Neira Ayuso2020-07-211-20/+3
| | | | | | evaluate_policy() is very similar to evaluate_expr_variable(), replace it. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to use variables in flowtable and chain devicesPablo Neira Ayuso2020-07-211-0/+69
| | | | | | | | | | | | | | | This patch adds support for using variables for devices in the chain and flowtable definitions, eg. define if_main = lo table netdev filter1 { chain Main_Ingress1 { type filter hook ingress device $if_main priority -500; policy accept; } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>