summaryrefslogtreecommitdiffstats
path: root/src/rule.c
Commit message (Collapse)AuthorAgeFilesLines
* set: make set initializer parsablePatrick McHardy2014-01-161-1/+5
| | | | | | | | | If a set contains elements, the output is not parsable since the elements = { ... } is not understood by the parser. Fix this and also add support for creating constant sets (which only makes sense when using an initializer). Signed-off-by: Patrick McHardy <kaber@trash.net>
* set: make set flags output parsablePatrick McHardy2014-01-161-6/+9
| | | | | | | | | | | | | | | | | | | | | | This patch fixes two problems: - the output of "nft list table ..." is not parsable if sets are included because the parser can't parse the flags. - set flags can't be specified during set creation. To fix this, the set output is changed to: - not print each flag on a single line - prefix the flags with "flags " - only show the interval flag since all others are for internal use only The parser is changed to parse the flags specified in a set declaration. This allows to parse empty sets. The following patch will take care of parsing sets that are already populated. Signed-off-by: Patrick McHardy <kaber@trash.net>
* src: use ':' instead of '=>' in dictionariesPablo Neira Ayuso2014-01-161-1/+1
| | | | | | | | | | | | | Replace => by : to make it easier for most shell users, as > implies a redirection, let's avoid possible confusion that may result if you forget to escape it. This works fine if you don't forget to add space between the key and the value. If you forget to add the space, depending on the case, the scanner may recognize it correctly or process it as a string. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: missing set cleanup in do_command_listPhil Oester2013-11-301-0/+5
| | | | | | | | | | When listing a table in interactive mode, the set list is not cleaned up. Thus the number of displayed sets grows with each successive listing. Attached patch adds the necessary list cleanup to do_command_list. Reported-by: Bjørnar Ness <bjornar.ness@gmail.com> Signed-off-by: Phil Oester <kernel@linuxace.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add rule batching supportPablo Neira Ayuso2013-09-231-11/+8
| | | | | | | | | | | | | | | | | | | | | | | This patch allows nft to put all rule update messages into one single batch that is sent to the kernel if `-f' option is used. In order to provide fine grain error reporting, I decided to to correlate the netlink message sequence number with the correspoding command sequence number, which is the same. Thus, nft can identify what rules trigger problems inside a batch and report them accordingly. Moreover, to avoid playing buffer size games at batch building stage, ie. guess what is the final size of the batch for this ruleset update will be, this patch collects batch pages that are converted to iovec to ensure linearization when the batch is sent to the kernel. This reduces the amount of unnecessary memory usage that is allocated for the batch. This patch uses the libmnl nlmsg batching infrastructure and it requires the kernel patch entitled (netfilter: nfnetlink: add batch support and use it from nf_tables). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* display family in table listingEric Leblond2013-09-171-1/+19
| | | | | | | | As family was not displayed in table listing, it was not possible to restore an ipv6 table saved via 'nft list table ip6 TABLE'. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Better error reporting if chain type is invalidTomasz Bursztyka2013-09-051-0/+19
| | | | | | | | | | | | | This patch verifies at command line parsing that given chain type is valid. Possibilities are: filter, nat, and route. nft add chain test test { type cheese hook input priority 0 }; <cmdline>:1:28-33: Error: unknown chain type cheese add chain test test { type cheese hook input priority 0 }; ^^^^^^ Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add priority keyword on base chain descriptionTomasz Bursztyka2013-09-041-1/+1
| | | | | | | | | | Instead of: add chain foo bar { type route hook input 0; } it should be now: add chain foo bar { type route hook input priority 0; } Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
* src: Wrap netfilter hooks around human readable stringsTomasz Bursztyka2013-09-041-14/+60
| | | | | | | | | | | | | | | | | | | This allows to use unique, human readable, hook names for the command line and let the user being unaware of the complex netfilter's hook names and there difference depending on the netfilter family. So: add chain foo bar { type route hook NF_INET_LOCAL_IN 0; } becomes: add chain foo bar { type route hook input 0; } It also fixes then the difference in hook values between families. I.e. ARP family has different values for input, forward and output compared to IPv4, IPv6 or bridge. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Fix base chain printingTomasz Bursztyka2013-08-301-1/+1
| | | | | | | | | Relying on chain's hooknum to know whether the chain is a base one or not is bogus: having 0 as hooknum is a valid number. Thus setting the right flag and handling it is the way to go, as parser does already. Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the base chain typePablo Neira Ayuso2013-08-271-3/+2
| | | | | | | | | | | | | | | | | | This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add support for insertion inside rule listEric Leblond2013-07-191-0/+2
| | | | | | | | | | | | | | This patch adds support to insert and to add rule using a rule handle as reference. The rule handle syntax has an new optional position field which take a handle as argument. Two examples: nft add rule filter output position 5 ip daddr 1.2.3.1 drop nft insert rule filter output position 5 ip daddr 1.2.3.1 drop Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: display hook infoEric Leblond2013-06-121-0/+23
| | | | | | | | | | | | It was not possible to restore a ruleset because of missing hook information. This patch adds hooknum output to list operation. [ Mangled this patch to use a string array mapping hook numbers and name --pablo ] Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: list elements in set in any caseEric Leblond2013-06-081-2/+1
| | | | | | | "nft list table" command was not displaying the elements of named set. This was thus not possible to restore a ruleset by using the listing output. This patch modifies the code to display the elements of set in all cases.
* rule: add flag to display rule handle as commentEric Leblond2013-05-311-0/+3
| | | | | | | | | | | Knowing the rule handle is necessary to be able to delete a single rule. It was not displayed till now in the output and it was thus impossible to remove a single rule. This patch modify the listing output to add a comment containing the handle when the -a/--handle flag is provided. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cli: complete basic functionality of the interactive modePablo Neira Ayuso2013-05-191-6/+19
| | | | | | | | | | This patch adds missing code to get basic interactive mode operative via `nft -i', including parsing, evaluation, command execution via netlink and error reporting. Autocomplete is not yet implemented. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cmd/netlink: make sure we always have a location in netlink operationsPatrick McHardy2013-04-181-33/+42
| | | | | | Improve error reporting by always using a location in netlink operations. Signed-off-by: Patrick McHardy<kaber@trash.net>
* rule: fix nft list chainPablo Neira Ayuso2013-04-181-1/+4
| | | | | | | | | | | | | | | | Use netlink_list_chains instead of netlink_list_chain (note the final `s') After "nft list table filter" shows: table filter { chain input { } } "nft list chain filter input" shows: table filter { }
* rule: allow to list of existing tablesPablo Neira Ayuso2013-04-181-0/+13
| | | | | | | | You can now specify: nft list tables ip to obtain the list of all existing tables. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: add rule insertion (prepend) supportPatrick McHardy2012-12-141-2/+17
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* chains: add chain rename supportPatrick McHardy2012-12-141-1/+29
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* rule: reenable adjacent payload mergingPatrick McHardy2012-12-091-1/+0
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* segtree: fix segtree to properly support mappingsPatrick McHardy2012-12-081-1/+1
| | | | | | | Requires to use proper types for keys and data and using the key values for reverse transformation. Signed-off-by: Patrick McHardy <kaber@trash.net>
* debug: include verbose message in all BUG statementsroot2012-12-081-6/+6
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* netlink: dump all chains when listing rulesPatrick McHardy2009-07-281-0/+3
| | | | | | | | Currently only the rules are dumped and chains are constructed based on the rules identities. Dump all chains manually to make sure we also display empty chains. Signed-off-by: Patrick McHardy <kaber@trash.net>
* add support for new set API and standalone setsPatrick McHardy2009-07-281-13/+165
| | | | Signed-off-by: Patrick McHardy <kaber@trash.net>
* Release scopes during cleanupPatrick McHardy2009-03-201-0/+14
| | | | | | Properly release the user-defined symbols. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Add support for scoping and symbol bindingPatrick McHardy2009-03-201-0/+32
| | | | | | | | | | | | As a first step towards stand-alone sets, add support for scoping and binding symbols. This will be used for user-defined constants, as well as declarations of modifiable (stand-alone) sets once the kernel side is ready. Scopes are currently limited to three nesting levels: the global scope, table block scopes and chain block scopes. Signed-off-by: Patrick McHardy <kaber@trash.net>
* Initial commitv0.01-alpha1Patrick McHardy2009-03-181-0/+441