summaryrefslogtreecommitdiffstats
path: root/src/meta.c
Commit message (Collapse)AuthorAgeFilesLines
* src: restore interface to index cachePablo Neira Ayuso2015-04-111-2/+3
| | | | | | | | | | | | | | | | nftables used to have a cache to speed up interface name <-> index lookup, restore it using libmnl. This reduces netlink traffic since if_nametoindex() and if_indextoname() open, send a request, receive the list of interface and close a netlink socket for each call. I think this is also good for consistency since nft -f will operate with the same index number when reloading the ruleset. The cache is populated by when nft_if_nametoindex() and nft_if_indextoname() are used for first time. Then, it it released in the output path. In the interactive mode, it is invalidated after each command. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: register pkttype_type datatypePablo Neira Ayuso2015-02-011-0/+1
| | | | | Closes: http://bugzilla.netfilter.org/show_bug.cgi?id=995 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: don't print meta keyword for unqualified meta stmtsPatrick McHardy2015-01-121-7/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: properly align types in meta_template tablePatrick McHardy2014-12-111-5/+5
| | | | | | | Don't use arbitrary amounts of spaces. The remaining table is properly aligned, fix the new types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: set base field on clonesPablo Neira Ayuso2014-12-011-0/+1
| | | | | | Set missing field on meta expression clone. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: relax datatype check in integer_type_parse()Pablo Neira Ayuso2014-11-301-27/+1
| | | | | | | | | | | | | | | | Otherwise parsing with basetypes doesn't work. Now nft displays an error when the symbolic constant is not correct: <cmdline>:1:29-31: Error: Could not parse conntrack state add rule test test ct state xxx accept ^^^ Use .sym_tbl instead and default on the symbol_constant_parse() function from the ethertype and pkttype, this simplifies the code and (more importantly) it avoids a breakage after the change in integer_type_parse(). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add cgroup support in meta expresionAna Rey2014-11-101-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | The new attribute of meta is "cgroup". Example of use in nft: # nft add rule ip test output meta cgroup != 0x100001 counter drop Moreover, this adds tests to the meta.t test file. The kernel support is addedin the commit: ce67417 ("netfilter: nft_meta: add cgroup support") The libnftnl support is add in the commit: 1d4a480 ("expr: meta: Add cgroup support") More information about the steps to use cgroup: https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt More info about cgroup in iptables: http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3 Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for datatype devgroupAna Rey2014-10-241-2/+37
| | | | | | | | | | | | | | | This adds the new devgroup datatype to get the group name from /etc/iproute2/group file. Example of use: nft add rule ip test input meta iifgroup 0 counter nft add rule ip test input meta iifgroup default counter Moreover, It adds tests in meta.t test file. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add devgroup support in meta expresionAna Rey2014-09-031-0/+6
| | | | | | | | | | | | | | | | | | | This adds device group support in meta expresion. The new attributes of meta are "iffgroup" and "oifgroup" - iffgroup: Match device group of incoming device. - oifgroup: Match device group of outcoming device. Example of use: nft add rule ip test input meta iifgroup 2 counter nft add rule ip test output meta oifgroup 2 counter The kernel and libnftnl support were added in these commits: netfilter: nf_tables: add devgroup support in meta expresion src: meta: Add devgroup support to meta expresion Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: meta: Fix the size of cpu attributeAna Rey2014-09-031-1/+1
| | | | | | | Fix the size of cpu attribute in meta_template struct. Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for cpu in meta expresionAna Rey2014-08-241-0/+3
| | | | | | | | | | | | | This allows you to match cpu handling with a packet. This is an example of the syntax for this new attribute: nft add rule ip test input meta cpu 1 counter nft add rule ip test input meta cpu 1-3 counter nft add rule ip test input meta cpu { 1, 3} counter Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for pkttype in meta expresionAna Rey2014-08-241-0/+55
| | | | | | | | | | | | | | | If you want to match the pkttype field of the skbuff, you have to use the following syntax: nft add rule ip filter input meta pkttype PACKET_TYPE where PACKET_TYPE can be: unicast, broadcast and multicast. Joint work with Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Ana Rey <anarey@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: Add support for input and output bridge interface nameTomasz Bursztyka2014-04-241-0/+6
| | | | | | | | Add support to get an input or output bridge interface name through the relevant meta keys. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatypes: rename some types for more consistencyPatrick McHardy2014-04-141-4/+4
| | | | | | | Add some more consistency by using _addr for all address types, _proto for all protocol types and iface_ for all interface types. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add comparison function for singleton expressionsPatrick McHardy2014-03-071-0/+6
| | | | Singed-off-by: Patrick McHardy <kaber@trash.net>
* meta: remove line break when printing priorityPablo Neira Ayuso2014-02-171-3/+3
| | | | The line break is added after printing the rule.
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-161-0/+1
|\ | | | | | | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/payload.c
| * segtree: only use prefix expressions for ranges for selected datatypesPatrick McHardy2014-01-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is uncommon to represent f.i. port number ranges as prefix expressions. Introduce a datatype DTYPE_F_PREFIX flag to indicate that the preferred representation of a range is a prefix and use it for segtree decomposition to decide whether to use a range or prefix expression. The ipaddr, ip6addr, mark and realm datatypes are changed to include the DTYPE_F_PREFIX flag. This fixes completely unreadable output in cases where the ranges are representable as prefixes, f.i. in case of port number: { 0/6 => jump chain1, 0/5 => jump chain2, 0/4 => continue} becomes: { 0-1023 => jump chain1, 1024-2047 => jump chain2, 2048-4095 => continue} Signed-off-by: Patrick McHardy <kaber@trash.net>
| * meta: fix mismergePatrick McHardy2014-01-151-2/+0
| | | | | | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
| * meta: don't require "meta" keyword for a subset of meta expressionsPatrick McHardy2014-01-151-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | Don't require the meta keyword for mark, iif, oif, iifname, oifname, skuid, skgid, nftrace, rtclassid and secmark. The protocol and length types still need the meta keyword to avoid grammar conflicts. Signed-off-by: Patrick McHardy <kaber@trash.net> Conflicts: src/parser.y
| * expr: remove secmark from ct and meta expressionPatrick McHardy2014-01-151-2/+0
| | | | | | | | | | | | The secctx should be used instead of the secmark. Remove for now. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: don't require "meta" keyword for a subset of meta expressionsPatrick McHardy2014-01-151-1/+12
| | | | | | | | | | | | | | | | | | | | Don't require the meta keyword for mark, iif, oif, iifname, oifname, skuid, skgid, nftrace, rtclassid and secmark. The protocol and length types still need the meta keyword to avoid grammar conflicts. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | expr: remove secmark from ct and meta expressionPatrick McHardy2014-01-151-2/+0
| | | | | | | | | | | | The secctx should be used instead of the secmark. Remove for now. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add l4proto supportPatrick McHardy2014-01-081-0/+14
| | | | | | | | | | | | | | | | | | Add support for the meta l4proto type. This is used in the inet table to match on the transport layer protocol without requiring the network layer protocol to be known, allowing to use transport header matches that apply to both IPv4 and IPv6. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | meta: add nfproto supportPatrick McHardy2014-01-081-9/+26
| | | | | | | | | | | | | | | | Add support for the meta nfproto type, which refers to the AF from the netfilter hook ops. This is needed to get the actual family of a packet in the dummy NFPROTO_INET family. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | proto: add helper function to update protocol contextPatrick McHardy2014-01-081-2/+1
| | | | | | | | | | | | Add a helper function which is to be used to update the protocol update. Signed-off-by: Patrick McHardy <ksber@trash.net<
* | expr: add protocol context update callbackPatrick McHardy2014-01-081-1/+12
| | | | | | | | | | | | | | | | | | | | Add a callback function to the expression ops to update the protocol context for relational protocol expressions (EXPR_F_PROTOCOL). Also set the EXPR_F_PROTOCOL flag for IIFTYPE meta expressions to make sure the callback is invoked when necessary. Signed-off-by: Patrick McHardy <kaber@trash.net>
* | nftables: generic procotol contextsPatrick McHardy2014-01-081-0/+29
|/ | | | | | | | | | | | | | | Currently the context of higher layer protocols is specific to payload expressions with some special cases for meta IIFTYPE expressions. This approach has a few shortcomings, concretely there are more expression types which define upper layer protocols like the ct expression and two upcoming new types for the meta expression. Replace the payload context by a generic protocol context to deal with this. This patch just splits off the requires parts from the payload expression without any functional changes, the following patches will add further functionality for other expressions. Signed-off-by: Patrick McHardy <kaber@trash.net>
* meta: relax restriction on UID/GID parsingPablo Neira Ayuso2013-11-291-20/+34
| | | | | | | | | | nft is currently rejecting unknown UID/GID if they don't exist in the system, relax this as Bjørnar Ness considers this is a valid scenario. Now this only reports an error if you pass an unknown user (expressed as string or if the UID/GID goes above 32 bits). Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix endianness in UID/GIDPablo Neira Ayuso2013-11-291-2/+2
| | | | | | | | | | | add rule filter output meta skuid vmap { 1000 => accept } list table filter meta skuid map { 3892510720 => accept} ^--------^ this is 1000 in network byte order Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: iif/oifname should be host byte orderFlorian Westphal2013-09-231-2/+2
| | | | | | | | | | | | | | | | | | | | src/nft add rule filter output meta oifname eth0 doesn't work on x86. Problem is that nft declares these as BYTEORDER_INVALID, but when converting the string mpz_import_data treats INVALID like BIG_ENDIAN. [ cmp eq reg 1 0x00000000 0x00000000 0x65000000 0x00306874 ] as kernel nft_cmp_eval basically boils down to memcmp(reg, skb->dev->name, sizeof(reg) comparision fails. with patch: [ cmp eq reg 1 0x30687465 0x00000000 0x00000000 0x00000000 ] Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: fix output display of meta lengthPablo Neira Ayuso2013-09-041-1/+1
| | | | | | | | | | | | | nft list table filter Before: meta len 1000 counter packets 0 bytes 0 After: meta length 1000 counter packets 0 bytes 0 Now it doesn't break with nft -f. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: replace rtnl_tc_handle2str and rtnl_tc_str2handlePablo Neira Ayuso2013-06-241-10/+43
| | | | | | | Provide replacements for rtnl_tc_handle2str and rtnl_tc_str2handle, it removes the dependency with libnl-route. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: use if_nametoindex and if_indextonamePablo Neira Ayuso2013-06-241-44/+4
| | | | | | | Instead of having a cache of ifindex based on libnl. Those functions basically use rtnetlink as well to perform the translation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* meta: accept uid/gid in numericalPablo Neira Ayuso2013-04-201-4/+12
| | | | | | You can use the user/group name or alternatively the uid/gid. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expressions: kill seperate sym_type datatype for symbolsPatrick McHardy2009-04-011-5/+5
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: add/move size and byte order information into data typesPatrick McHardy2009-03-311-2/+12
| | | | | | | | | | Add size and type information to non-basetype types and remove the now redundant information from the symbol tables. This will be used to determine size and byteorder of set members without analyzing the ruleset for incremental update operations. Signed-off-by: Patrick McHardy <kaber@trash.net>
* datatype: maintain table of all datatypes and add registration/lookup functionPatrick McHardy2009-03-311-7/+22
| | | | | | | | | | | Add a table containing all available datatypes and registration/lookup functions. This will be used to associate a stand-alone set in the kernel with the correct type without parsing the entire ruleset. Additionally it would now be possible to remove the global declarations for the core types. Not done yet though. Signed-off-by: Patrick McHardy <kaber@trash.net>
* expr: add support for cloning expressionsPatrick McHardy2009-03-201-0/+6
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+347