From fecb6b4fa737ae374a738d207fa35f16e3813434 Mon Sep 17 00:00:00 2001 From: Ana Rey Date: Mon, 3 Nov 2014 18:10:51 +0100 Subject: src: Add cgroup support in meta expresion The new attribute of meta is "cgroup". Example of use in nft: # nft add rule ip test output meta cgroup != 0x100001 counter drop Moreover, this adds tests to the meta.t test file. The kernel support is addedin the commit: ce67417 ("netfilter: nft_meta: add cgroup support") The libnftnl support is add in the commit: 1d4a480 ("expr: meta: Add cgroup support") More information about the steps to use cgroup: https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt More info about cgroup in iptables: http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3 Signed-off-by: Ana Rey Signed-off-by: Pablo Neira Ayuso --- tests/regression/any/meta.t | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'tests') diff --git a/tests/regression/any/meta.t b/tests/regression/any/meta.t index 1e7a0fe7..ba6756dc 100644 --- a/tests/regression/any/meta.t +++ b/tests/regression/any/meta.t @@ -179,3 +179,12 @@ meta oifgroup {11,33};ok;oifgroup {11,33} meta oifgroup {11-33};ok - meta oifgroup != {11,33};ok - meta oifgroup != {11-33};ok + +meta cgroup 0x100001;ok;cgroup 1048577 +meta cgroup != 0x100001;ok;cgroup != 1048577 +meta cgroup { 0x100001, 0x100002};ok +# meta cgroup != { 0x100001, 0x100002};ok +meta cgroup 0x100001 - 0x100003;ok +# meta cgroup != 0x100001 - 0x100003;ok +meta cgroup {0x100001 - 0x100003};ok +# meta cgroup != { 0x100001 - 0x100003};ok -- cgit v1.2.3