summaryrefslogtreecommitdiffstats
path: root/src/netlink_linearize.c
Commit message (Collapse)AuthorAgeFilesLines
...
* netlink: Allow to invert the rangesÁlvaro Neira Ayuso2014-06-051-6/+39
| | | | | | | | | | | | | | | | | | | | This patch fix the bug: http://bugzilla.netfilter.org/show_bug.cgi?id=924 Before, nftables doesn't permit invert ranges. This patch allows add rules like this: nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55 or nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55 Also, we still have the option for adding rules like this: sudo nft add rule ip test output frag id 33-45 Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add set netlink message to the batchPablo Neira Ayuso2014-05-191-0/+4
| | | | | | | | | | | | | This patch moves the netlink set messages to the batch that contains the rules. This helps to speed up rule-set restoration time by changing the operational. To achieve this, an internal set ID which is unique to the batch is allocated as suggested by Patrick. To retain backward compatibility, nft initially guesses if the kernel supports set in batches. Otherwise, it falls back to the previous (slowier) operational. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add support for setting ct markArturo Borrero2014-03-131-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix prefix expression handlingPatrick McHardy2014-02-171-2/+9
| | | | | | | | | | | | | | | | | | | | | | The prefix expression handling is full of bugs: - netlink_gen_data() is used to construct the prefix mask from the full prefix expression. This is both conceptually wrong, the prefix expression is *not* data, and buggy, it only assumes network masks and thus only handles big endian types. - Prefix expression reconstruction doesn't check whether the mask is a valid prefix and reconstructs crap otherwise. It doesn't reconstruct prefixes for anything but network addresses. On top of that its needlessly complicated, using the mpz values directly its a simple matter of finding the sequence of 1's that extend up to the full width. - Unnecessary cloning of expressions where a simple refcount increase would suffice. Rewrite that code properly. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_linearize: fix flagcmp opPatrick McHardy2014-02-161-4/+3
| | | | | | | | | | | | | | | | | | Florian reports that flag comparisons generate incorrect instructions: $ nft --debug=netlink add rule filter output ct labels foo ip filter output 0 0 [ ct load labels => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000001 0x00000000 0x00000000 0x00000000 ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ] [ cmp neq reg 1 0x00000001 0x00000000 0x00000000 0x00000000 ] The "cmp new" should compare to zero. This was broken by commit aae836a7 (src: use libnftables by using expr->right instead of zero. Slightly rearrange the code as well to prevent similar problems in the future. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Merge remote-tracking branch 'origin/master' into next-3.14Patrick McHardy2014-01-141-7/+7
|\
| * netlink: fix wrong type in attributesPablo Neira Ayuso2014-01-101-7/+7
| | | | | | | | | | | | | | | | Fix inconsistent attribute types in meta and cmp expressions, use uint32_t. This problem was added when converting nft to use libmnl and libnftables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | src: add support for queueEric Leblond2014-01-041-0/+22
| | | | | | | | | | | | | | | | | | | | | | This patch adds support for the queue target. It is now possible to specify rule sending packet to a given queue and using load balancing: nft add rule filter output queue num 3 total 2 options fanout Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* | netlink: add support to set meta keysPablo Neira Ayuso2013-12-281-0/+2
|/ | | | | | | | | | | | | | | | | | | | Arturo Borrero added kernel support to set meta keys in http://patchwork.ozlabs.org/patch/305281/ and the corresponding library support in http://patchwork.ozlabs.org/patch/305283/. This patch enhances nft to use this new kernel feature. The following example shows how to set the packet mark. % nft add rule ip filter input meta mark set 22 % nft list table filter table ip filter { chain input { type filter hook input priority 0; meta mark set 0x00000016 } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* jump: fix logic in netlink linearizeEric Leblond2013-11-191-1/+2
| | | | | | | | | Logic in the test was inverted. The result was the jump string not to be set. Reported-by: Alex Chapman <ajchapman88@hotmail.co.uk> Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: finish reject supportPablo Neira Ayuso2013-10-271-1/+3
| | | | | | | | This patch finishes the reject support. Reported-by: Jiri Benc <jbenc@redhat.com> Tested-by: Jiri Benc <jbenc@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: operational limit matchPhil Oester2013-10-221-2/+2
| | | | | | | | | | | | | | | | | | | | The nft limit match currently does not work at all. Below patches to nftables, libnftables, and kernel address the issue. A few notes on the implementation: - Removed support for nano/micro/milli second limits. These seem pointless, given we are using jiffies in the limit match, not a hpet. And who really needs to limit items down to sub-second level?? - 'depth' member is removed as unnecessary. All we need in the kernel is the rate and the unit. - 'stamp' member becomes the time we need to next refresh the token bucket, instead of being updated on every packet which goes through the match. This closes netfilter bugzilla #827, reported by Eric Leblond. Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nat: add mandatory family attributeEric Leblond2013-09-171-0/+4
| | | | | | | | NFT_EXPR_NAT_FAMILY is a mandatory attribute for NAT rules and it was not set by nftables. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: convert group and qthreshold to use u16Pablo Neira Ayuso2013-08-171-2/+2
| | | | | | | Required since (netfilter: nft_log: group and qthreshold are 2^16) kernel change. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix network address prefixPablo Neira Ayuso2013-06-241-3/+21
| | | | | | | | | | | | | | eg. nft add rule filter output ip daddr 192.168.1.0/24 counter so far, this operation was only possible using sets. nft add rule filter output ip daddr \{ 192.168.1.0/24 \} counter While at it, move all binop postprocess code to a new function that contains this transformation and the existing bitmask to constant (as used by eg. ct state new,established). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use libnftablesPablo Neira Ayuso2013-06-241-140/+195
| | | | | | | | | | | | | | | | | | | | | | | | | This patch migrates nft to use the libnftables library, that is used by the iptables over nftables compat utility as well. Most of the conversion was pretty straight forward. Some small significant changes happened in the handling of set element and immediate data abstraction that libnl provides. libnftables is a bit more granular since it splits the struct nfnl_nft_data into three attributes: verdict, chain and plain data (used in maps). I have added a new file src/mnl.c that contains the low level netlink communication that now resides in nftables source tree instead of the library. This should help to implement the batching support using libmnl in follow up patches. I also spent some significant amount of time running my tests to make sure that we don't increase the number of bugs that we already have (I plan to provide a list of those that I have detected and diagnosed, so anyone else can help us to fix them). As a side effect, this change should also prepare the ground for JSON and XML support anytime soon. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix counter restorationEric Leblond2013-06-121-0/+4
| | | | | | | | | | | | It was not possible to restore a ruleset countaining counter. The packets and bytes fields were not known from the parser but they were in the output of the list command. This patch fixes the issue by restoring correctly the counters if they are present in the command. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* debug: include verbose message in all BUG statementsroot2012-12-081-7/+7
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* expression: Differentiate expr among anonymous structures in struct exprTomasz Bursztyka2012-08-031-1/+1
| | | | | | | This fixes compilation with gcc-4.7 Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: fix nat stmt linearization/parsingPatrick McHardy2010-07-061-24/+24
| | | | | | | | Fix invalid register use when parsing NAT statements and handle range expressions during postprocessing. When linearizing, allocate all registers for both proto and address expressions at once to avoid double use. Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: allow runtime control of debugging outputPatrick McHardy2009-07-281-2/+0
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* add support for new set API and standalone setsPatrick McHardy2009-07-281-61/+9
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: move data related functions to netlink.cPatrick McHardy2009-03-311-77/+4
| | | | | | | Move the data related function to netlink.c as they're going to be needed outside of rule context for set maintenance. Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: use libnl OBJ_CAST macroPatrick McHardy2009-03-311-1/+1
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink_linearize: remove two debugging printfsPatrick McHardy2009-03-311-2/+0
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: wrap libnl object dumping in #ifdef DEBUGPatrick McHardy2009-03-181-0/+2
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+720