summaryrefslogtreecommitdiffstats
path: root/src/libnftables.map
Commit message (Collapse)AuthorAgeFilesLines
* libnftables.map: export new nft_ctx_{get,set}_optimize APISam James2022-02-251-2/+2
| | | | | | | | | | | | | | | | [ Remove incorrect symbol names were exported via .map file ] Without this, we're not explicitly saying this is part of the public API. This new API was added in 1.0.2 and is used by e.g. the main nft binary. Noticed when fixing the version-script option (separate patch) which picked up this problem when .map was missing symbols (related to when symbol visibility options get set). Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ruleset optimization infrastructurePablo Neira Ayuso2022-01-151-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a new -o/--optimize option to enable ruleset optimization. You can combine this option with the dry run mode (--check) to review the proposed ruleset updates without actually loading the ruleset, e.g. # nft -c -o -f ruleset.test Merging: ruleset.nft:16:3-37: ip daddr 192.168.0.1 counter accept ruleset.nft:17:3-37: ip daddr 192.168.0.2 counter accept ruleset.nft:18:3-37: ip daddr 192.168.0.3 counter accept into: ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 } counter packets 0 bytes 0 accept This infrastructure collects the common statements that are used in rules, then it builds a matrix of rules vs. statements. Then, it looks for common statements in consecutive rules which allows to merge rules. This ruleset optimization always performs an implicit dry run to validate that the original ruleset is correct. Then, on a second pass, it performs the ruleset optimization and add the rules into the kernel (unless --check has been specified by the user). From libnftables perspective, there is a new API to enable this feature: uint32_t nft_ctx_get_optimize(struct nft_ctx *ctx); void nft_ctx_set_optimize(struct nft_ctx *ctx, uint32_t flags); This patch adds support for the first optimization: Collapse a linear list of rules matching on a single selector into a set as exposed in the example above. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: expose nft_ctx_clear_vars as APIPablo Neira Ayuso2021-07-241-0/+1
| | | | | | | | | This function might be useful to recycle the existing nft_ctx to use it with different external variable definitions. Moreover, reset ctx->num_vars to zero. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix nft_ctx_clear_include_paths in libnftables.mapPablo Neira Ayuso2021-07-241-1/+1
| | | | | | | There a typo that prevents exposing the function as API. Fixes: 16543a0136c0 ("libnftables: export public symbols only") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: missing nft_ctx_add_var() symbol map updatePablo Neira Ayuso2021-07-211-0/+4
| | | | | | | Add nft_ctx_add_var() to libnftables.map symbol map. Fixes: 9edaa6a51eab ("src: add --define key=value") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: export public symbols onlyArturo Borrero Gonzalez2019-07-011-0/+25
Export public symbols (the library API functions) instead of all symbols in the library. This patch introduces the required macros to manage the visibility attributes (mostly copied from libnftnl.git) and also marks each symbol as exported when they need to be public. Also, introduce a .map file for proper symbol versioning. Previous to this patch, libnftables public symbols were: % dpkg-gensymbols -q -plibnftables -v0.9.1 -O -esrc/.libs/libnftables.so.1 | wc -l 527 With this patch, libnftables symbols are: % dpkg-gensymbols -q -plibnftables -v0.9.1 -O -esrc/.libs/libnftables.so.1 libnftables.so.1 libnftables #MINVER# nft_ctx_add_include_path@Base 0.9.1 nft_ctx_buffer_error@Base 0.9.1 nft_ctx_buffer_output@Base 0.9.1 nft_ctx_clear_include_paths@Base 0.9.1 nft_ctx_free@Base 0.9.1 nft_ctx_get_dry_run@Base 0.9.1 nft_ctx_get_error_buffer@Base 0.9.1 nft_ctx_get_output_buffer@Base 0.9.1 nft_ctx_new@Base 0.9.1 nft_ctx_output_get_debug@Base 0.9.1 nft_ctx_output_get_flags@Base 0.9.1 nft_ctx_output_set_debug@Base 0.9.1 nft_ctx_output_set_flags@Base 0.9.1 nft_ctx_set_dry_run@Base 0.9.1 nft_ctx_set_error@Base 0.9.1 nft_ctx_set_output@Base 0.9.1 nft_ctx_unbuffer_error@Base 0.9.1 nft_ctx_unbuffer_output@Base 0.9.1 nft_run_cmd_from_buffer@Base 0.9.1 nft_run_cmd_from_filename@Base 0.9.1 Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>