Skip to content

GitLab

Commit 278668fa authored by Arturo Borrero Gonzalez's avatar Arturo Borrero Gonzalez
Browse files

New upstream version 1.8.0

parent 5beab31f
Hide whitespace changes
Inline Side-by-side
extensions/libxt_CONNMARK.c
View file @ 278668fa
......@@ -31,6 +31,11 @@ struct xt_connmark_target_info {
uint8_t mode;
};
enum {
D_SHIFT_LEFT = 0,
D_SHIFT_RIGHT,
};
enum {
O_SET_MARK = 0,
O_SAVE_MARK,
......@@ -38,22 +43,31 @@ enum {
O_AND_MARK,
O_OR_MARK,
O_XOR_MARK,
O_LEFT_SHIFT_MARK,
O_RIGHT_SHIFT_MARK,
O_SET_XMARK,
O_CTMASK,
O_NFMASK,
O_MASK,
F_SET_MARK = 1 << O_SET_MARK,
F_SAVE_MARK = 1 << O_SAVE_MARK,
F_RESTORE_MARK = 1 << O_RESTORE_MARK,
F_AND_MARK = 1 << O_AND_MARK,
F_OR_MARK = 1 << O_OR_MARK,
F_XOR_MARK = 1 << O_XOR_MARK,
F_SET_XMARK = 1 << O_SET_XMARK,
F_CTMASK = 1 << O_CTMASK,
F_NFMASK = 1 << O_NFMASK,
F_MASK = 1 << O_MASK,
F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
F_SET_MARK = 1 << O_SET_MARK,
F_SAVE_MARK = 1 << O_SAVE_MARK,
F_RESTORE_MARK = 1 << O_RESTORE_MARK,
F_AND_MARK = 1 << O_AND_MARK,
F_OR_MARK = 1 << O_OR_MARK,
F_XOR_MARK = 1 << O_XOR_MARK,
F_LEFT_SHIFT_MARK = 1 << O_LEFT_SHIFT_MARK,
F_RIGHT_SHIFT_MARK = 1 << O_RIGHT_SHIFT_MARK,
F_SET_XMARK = 1 << O_SET_XMARK,
F_CTMASK = 1 << O_CTMASK,
F_NFMASK = 1 << O_NFMASK,
F_MASK = 1 << O_MASK,
F_OP_ANY = F_SET_MARK | F_SAVE_MARK | F_RESTORE_MARK |
F_AND_MARK | F_OR_MARK | F_XOR_MARK | F_SET_XMARK,
};
static const char *const xt_connmark_shift_ops[] = {
"left-shift-mark",
"right-shift-mark"
};
static void CONNMARK_help(void)
......@@ -104,6 +118,36 @@ static const struct xt_option_entry connmark_tg_opts[] = {
};
#undef s
#define s struct xt_connmark_tginfo2
static const struct xt_option_entry connmark_tg_opts_v2[] = {
{.name = "set-xmark", .id = O_SET_XMARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
{.name = "set-mark", .id = O_SET_MARK, .type = XTTYPE_MARKMASK32,
.excl = F_OP_ANY},
{.name = "and-mark", .id = O_AND_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "or-mark", .id = O_OR_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "xor-mark", .id = O_XOR_MARK, .type = XTTYPE_UINT32,
.excl = F_OP_ANY},
{.name = "save-mark", .id = O_SAVE_MARK, .type = XTTYPE_NONE,
.excl = F_OP_ANY},
{.name = "restore-mark", .id = O_RESTORE_MARK, .type = XTTYPE_NONE,
.excl = F_OP_ANY},
{.name = "left-shift-mark", .id = O_LEFT_SHIFT_MARK, .type = XTTYPE_UINT8,
.min = 0, .max = 32},
{.name = "right-shift-mark", .id = O_RIGHT_SHIFT_MARK, .type = XTTYPE_UINT8,
.min = 0, .max = 32},
{.name = "ctmask", .id = O_CTMASK, .type = XTTYPE_UINT32,
.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, ctmask)},
{.name = "nfmask", .id = O_NFMASK, .type = XTTYPE_UINT32,
.excl = F_MASK, .flags = XTOPT_PUT, XTOPT_POINTER(s, nfmask)},
{.name = "mask", .id = O_MASK, .type = XTTYPE_UINT32,
.excl = F_CTMASK | F_NFMASK},
XTOPT_TABLEEND,
};
#undef s
static void connmark_tg_help(void)
{
printf(
......@@ -122,6 +166,15 @@ static void connmark_tg_help(void)
);
}
static void connmark_tg_help_v2(void)
{
connmark_tg_help();
printf(
" --left-shift-mark value Left shift the ctmark with bits\n"
" --right-shift-mark value Right shift the ctmark with bits\n"
);
}
static void connmark_tg_init(struct xt_entry_target *target)
{
struct xt_connmark_tginfo1 *info = (void *)target->data;
......@@ -134,6 +187,18 @@ static void connmark_tg_init(struct xt_entry_target *target)
info->nfmask = UINT32_MAX;
}
static void connmark_tg_init_v2(struct xt_entry_target *target)
{
struct xt_connmark_tginfo2 *info;
connmark_tg_init(target);
info = (void *)target->data;
/* Left shift by zero bit by default. */
info->shift_dir = D_SHIFT_LEFT;
info->shift_bits = 0;
}
static void CONNMARK_parse(struct xt_option_call *cb)
{
struct xt_connmark_target_info *markinfo = cb->data;
......@@ -197,6 +262,61 @@ static void connmark_tg_parse(struct xt_option_call *cb)
case O_MASK:
info->nfmask = info->ctmask = cb->val.u32;
break;
default:
break;
}
}
static void connmark_tg_parse_v2(struct xt_option_call *cb)
{
struct xt_connmark_tginfo2 *info = cb->data;
xtables_option_parse(cb);
switch (cb->entry->id) {
case O_SET_XMARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = cb->val.mark;
info->ctmask = cb->val.mask;
break;
case O_SET_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = cb->val.mark;
info->ctmask = cb->val.mark | cb->val.mask;
break;
case O_AND_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = 0;
info->ctmask = ~cb->val.u32;
break;
case O_OR_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = cb->val.u32;
info->ctmask = cb->val.u32;
break;
case O_XOR_MARK:
info->mode = XT_CONNMARK_SET;
info->ctmark = cb->val.u32;
info->ctmask = 0;
break;
case O_SAVE_MARK:
info->mode = XT_CONNMARK_SAVE;
break;
case O_RESTORE_MARK:
info->mode = XT_CONNMARK_RESTORE;
break;
case O_MASK:
info->nfmask = info->ctmask = cb->val.u32;
break;
case O_LEFT_SHIFT_MARK:
info->shift_dir = D_SHIFT_LEFT;
info->shift_bits = cb->val.u8;
break;
case O_RIGHT_SHIFT_MARK:
info->shift_dir = D_SHIFT_RIGHT;
info->shift_bits = cb->val.u8;
break;
default:
break;
}
}
......@@ -291,6 +411,58 @@ connmark_tg_print(const void *ip, const struct xt_entry_target *target,
}
}
static void
connmark_tg_print_v2(const void *ip, const struct xt_entry_target *target,
int numeric)
{
const struct xt_connmark_tginfo2 *info = (const void *)target->data;
const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
switch (info->mode) {
case XT_CONNMARK_SET:
if (info->ctmark == 0)
printf(" CONNMARK and 0x%x",
(unsigned int)(uint32_t)~info->ctmask);
else if (info->ctmark == info->ctmask)
printf(" CONNMARK or 0x%x", info->ctmark);
else if (info->ctmask == 0)
printf(" CONNMARK xor 0x%x", info->ctmark);
else if (info->ctmask == 0xFFFFFFFFU)
printf(" CONNMARK set 0x%x", info->ctmark);
else
printf(" CONNMARK xset 0x%x/0x%x",
info->ctmark, info->ctmask);
break;
case XT_CONNMARK_SAVE:
if (info->nfmask == UINT32_MAX && info->ctmask == UINT32_MAX)
printf(" CONNMARK save");
else if (info->nfmask == info->ctmask)
printf(" CONNMARK save mask 0x%x", info->nfmask);
else
printf(" CONNMARK save nfmask 0x%x ctmask ~0x%x",
info->nfmask, info->ctmask);
break;
case XT_CONNMARK_RESTORE:
if (info->ctmask == UINT32_MAX && info->nfmask == UINT32_MAX)
printf(" CONNMARK restore");
else if (info->ctmask == info->nfmask)
printf(" CONNMARK restore mask 0x%x", info->ctmask);
else
printf(" CONNMARK restore ctmask 0x%x nfmask ~0x%x",
info->ctmask, info->nfmask);
break;
default:
printf(" ERROR: UNKNOWN CONNMARK MODE");
break;
}
if (info->mode <= XT_CONNMARK_RESTORE &&
info->shift_bits != 0) {
printf(" %s %u", shift_op, info->shift_bits);
}
}
static void CONNMARK_save(const void *ip, const struct xt_entry_target *target)
{
const struct xt_connmark_target_info *markinfo =
......@@ -347,6 +519,35 @@ connmark_tg_save(const void *ip, const struct xt_entry_target *target)
}
}
static void
connmark_tg_save_v2(const void *ip, const struct xt_entry_target *target)
{
const struct xt_connmark_tginfo2 *info = (const void *)target->data;
const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
switch (info->mode) {
case XT_CONNMARK_SET:
printf(" --set-xmark 0x%x/0x%x", info->ctmark, info->ctmask);
break;
case XT_CONNMARK_SAVE:
printf(" --save-mark --nfmask 0x%x --ctmask 0x%x",
info->nfmask, info->ctmask);
break;
case XT_CONNMARK_RESTORE:
printf(" --restore-mark --nfmask 0x%x --ctmask 0x%x",
info->nfmask, info->ctmask);
break;
default:
printf(" ERROR: UNKNOWN CONNMARK MODE");
break;
}
if (info->mode <= XT_CONNMARK_RESTORE &&
info->shift_bits != 0) {
printf(" --%s %u", shift_op, info->shift_bits);
}
}
static int connmark_tg_xlate(struct xt_xlate *xl,
const struct xt_xlate_tg_params *params)
{
......@@ -356,7 +557,9 @@ static int connmark_tg_xlate(struct xt_xlate *xl,
switch (info->mode) {
case XT_CONNMARK_SET:
xt_xlate_add(xl, "ct mark set ");
if (info->ctmark == 0)
if (info->ctmask == 0xFFFFFFFFU)
xt_xlate_add(xl, "0x%x ", info->ctmark);
else if (info->ctmark == 0)
xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
else if (info->ctmark == info->ctmask)
xt_xlate_add(xl, "ct mark or 0x%x",
......@@ -364,8 +567,49 @@ static int connmark_tg_xlate(struct xt_xlate *xl,
else if (info->ctmask == 0)
xt_xlate_add(xl, "ct mark xor 0x%x",
info->ctmark);
else if (info->ctmask == 0xFFFFFFFFU)
else
xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
info->ctmark, ~info->ctmask);
break;
case XT_CONNMARK_SAVE:
if (info->nfmask == info->ctmask &&
info->nfmask == UINT32_MAX)
xt_xlate_add(xl, "ct mark set mark");
else
return 0;
break;
case XT_CONNMARK_RESTORE:
if (info->nfmask == info->ctmask &&
info->nfmask == UINT32_MAX)
xt_xlate_add(xl, "meta mark set ct mark");
else
return 0;
break;
}
return 1;
}
static int connmark_tg_xlate_v2(struct xt_xlate *xl,
const struct xt_xlate_tg_params *params)
{
const struct xt_connmark_tginfo2 *info =
(const void *)params->target->data;
const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
switch (info->mode) {
case XT_CONNMARK_SET:
xt_xlate_add(xl, "ct mark set ");
if (info->ctmask == 0xFFFFFFFFU)
xt_xlate_add(xl, "0x%x ", info->ctmark);
else if (info->ctmark == 0)
xt_xlate_add(xl, "ct mark and 0x%x", ~info->ctmask);
else if (info->ctmark == info->ctmask)
xt_xlate_add(xl, "ct mark or 0x%x",
info->ctmark);
else if (info->ctmask == 0)
xt_xlate_add(xl, "ct mark xor 0x%x",
info->ctmark);
else
xt_xlate_add(xl, "ct mark xor 0x%x and 0x%x",
info->ctmark, ~info->ctmask);
......@@ -388,9 +632,13 @@ static int connmark_tg_xlate(struct xt_xlate *xl,
break;
}
if (info->mode <= XT_CONNMARK_RESTORE &&
info->shift_bits != 0) {
xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits);
}
return 1;
}
static struct xtables_target connmark_tg_reg[] = {
{
.family = NFPROTO_UNSPEC,
......@@ -421,7 +669,23 @@ static struct xtables_target connmark_tg_reg[] = {
.x6_parse = connmark_tg_parse,
.x6_fcheck = connmark_tg_check,
.x6_options = connmark_tg_opts,
.xlate = connmark_tg_xlate,
.xlate = connmark_tg_xlate,
},
{
.version = XTABLES_VERSION,
.name = "CONNMARK",
.revision = 2,
.family = NFPROTO_UNSPEC,
.size = XT_ALIGN(sizeof(struct xt_connmark_tginfo2)),
.userspacesize = XT_ALIGN(sizeof(struct xt_connmark_tginfo2)),
.help = connmark_tg_help_v2,
.init = connmark_tg_init_v2,
.print = connmark_tg_print_v2,
.save = connmark_tg_save_v2,
.x6_parse = connmark_tg_parse_v2,
.x6_fcheck = connmark_tg_check,
.x6_options = connmark_tg_opts_v2,
.xlate = connmark_tg_xlate_v2,
},
};
......
extensions/libxt_CONNMARK.txlate
View file @ 278668fa
iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0
nft add rule ip mangle PREROUTING counter ct mark set 0x0
iptables-translate -t mangle -A PREROUTING -j CONNMARK --set-mark 0x16
nft add rule ip mangle PREROUTING counter ct mark set 0x16
......@@ -13,11 +16,5 @@ nft add rule ip mangle PREROUTING counter ct mark set ct mark or 0x16
iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark
nft add rule ip mangle PREROUTING counter ct mark set mark
iptables-translate -t mangle -A PREROUTING -j CONNMARK --save-mark --mask 0x12
nft add rule ip mangle PREROUTING counter ct mark set mark and 0x12
iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark
nft add rule ip mangle PREROUTING counter meta mark set ct mark
iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark --mask 0x12
nft add rule ip mangle PREROUTING counter meta mark set ct mark and 0x12
extensions/libxt_MARK.c
View file @ 278668fa
......@@ -252,14 +252,14 @@ static int mark_tg_xlate(struct xt_xlate *xl,
xt_xlate_add(xl, "meta mark set ");
if (info->mark == 0)
if (info->mask == 0xffffffffU)
xt_xlate_add(xl, "0x%x ", info->mark);
else if (info->mark == 0)
xt_xlate_add(xl, "mark and 0x%x ", ~info->mask);
else if (info->mark == info->mask)
xt_xlate_add(xl, "mark or 0x%x ", info->mark);
else if (info->mask == 0)
xt_xlate_add(xl, "mark xor 0x%x ", info->mark);
else if (info->mask == 0xffffffffU)
xt_xlate_add(xl, "0x%x ", info->mark);
else
xt_xlate_add(xl, "mark and 0x%x xor 0x%x ", ~info->mask,
info->mark);
......
extensions/libxt_MARK.txlate
View file @ 278668fa
iptables-translate -t mangle -A OUTPUT -j MARK --set-mark 0
nft add rule ip mangle OUTPUT counter meta mark set 0x0
iptables-translate -t mangle -A OUTPUT -j MARK --set-mark 64
nft add rule ip mangle OUTPUT counter meta mark set 0x40
......
extensions/libxt_bpf.c
View file @ 278668fa
......@@ -22,6 +22,7 @@
#include <linux/bpf.h>
#endif
#include <linux/magic.h>
#include <linux/unistd.h>
#define BCODE_FILE_MAX_LEN_B 1024
......@@ -62,7 +63,7 @@ static const struct xt_option_entry bpf_opts_v1[] = {
static int bpf_obj_get(const char *filepath)
{
#if defined HAVE_LINUX_BPF_H && defined __NR_bpf
#if defined HAVE_LINUX_BPF_H && defined __NR_bpf && defined BPF_FS_MAGIC
union bpf_attr attr;
memset(&attr, 0, sizeof(attr));
......
extensions/libxt_cluster.txlate
View file @ 278668fa
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 2 --cluster-local-node 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 2 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 2 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 1 --cluster-local-node 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 1 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 1 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 2 --cluster-local-nodemask 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 2 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 2 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 1 --cluster-local-nodemask 1 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 1 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 1 seed 0xdeadbeef eq 1 meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 32 --cluster-local-node 32 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 32 seed 0xdeadbeef eq 32 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 32 seed 0xdeadbeef eq 32 meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 32 --cluster-local-nodemask 32 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 32 seed 0xdeadbeef eq 6 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 32 seed 0xdeadbeef eq 6 meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 32 --cluster-local-nodemask 5 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 32 seed 0xdeadbeef { 0, 2 } meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 32 seed 0xdeadbeef { 0, 2 } meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 7 --cluster-local-nodemask 9 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 7 seed 0xdeadbeef { 0, 3 } meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 7 seed 0xdeadbeef { 0, 3 } meta pkttype set host counter meta mark set 0xffff
iptables-translate -A PREROUTING -t mangle -i eth1 -m cluster --cluster-total-nodes 7 --cluster-local-node 5 --cluster-hash-seed 0xdeadbeef -j MARK --set-mark 0xffff
nft add rule ip mangle PREROUTING iifname eth1 jhash ct original saddr mod 7 seed 0xdeadbeef eq 5 meta pkttype set host counter meta mark set 0xffff
nft add rule ip mangle PREROUTING iifname "eth1" jhash ct original saddr mod 7 seed 0xdeadbeef eq 5 meta pkttype set host counter meta mark set 0xffff
extensions/libxt_comment.c
View file @ 278668fa
......@@ -52,17 +52,16 @@ static int comment_xlate(struct xt_xlate *xl,
const struct xt_xlate_mt_params *params)
{
struct xt_comment_info *commentinfo = (void *)params->match->data;
char comment[XT_MAX_COMMENT_LEN];
char comment[XT_MAX_COMMENT_LEN + sizeof("\\\"\\\"")];
commentinfo->comment[XT_MAX_COMMENT_LEN - 1] = '\0';
if (params->escape_quotes)
snprintf(comment, XT_MAX_COMMENT_LEN, "\\\"%s\\\"",
snprintf(comment, sizeof(comment), "\\\"%s\\\"",
commentinfo->comment);
else
snprintf(comment, XT_MAX_COMMENT_LEN, "\"%s\"",
snprintf(comment, sizeof(comment), "\"%s\"",
commentinfo->comment);
comment[XT_MAX_COMMENT_LEN - 1] = '\0';
xt_xlate_add_comment(xl, comment);
return 1;
......
extensions/libxt_connmark.c
View file @ 278668fa
......@@ -69,14 +69,6 @@ static void connmark_parse(struct xt_option_call *cb)
markinfo->invert = 1;
}
static void print_mark(unsigned int mark, unsigned int mask)
{
if (mask != 0xffffffffU)
printf(" 0x%x/0x%x", mark, mask);
else
printf(" 0x%x", mark);
}
static void
connmark_print(const void *ip, const struct xt_entry_match *match, int numeric)
{
......@@ -85,7 +77,8 @@ connmark_print(const void *ip, const struct xt_entry_match *match, int numeric)
printf(" CONNMARK match ");
if (info->invert)
printf("!");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......@@ -97,7 +90,8 @@ connmark_mt_print(const void *ip, const struct xt_entry_match *match,
printf(" connmark match ");
if (info->invert)
printf("!");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void connmark_save(const void *ip, const struct xt_entry_match *match)
......@@ -108,7 +102,7 @@ static void connmark_save(const void *ip, const struct xt_entry_match *match)
printf(" !");
printf(" --mark");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......@@ -120,7 +114,7 @@ connmark_mt_save(const void *ip, const struct xt_entry_match *match)
printf(" !");
printf(" --mark");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void print_mark_xlate(unsigned int mark, unsigned int mask,
......
extensions/libxt_devgroup.c
View file @ 278668fa
......@@ -31,60 +31,28 @@ static const struct xt_option_entry devgroup_opts[] = {
XTOPT_TABLEEND,
};
/* array of devgroups from /etc/iproute2/group */
static const char f_devgroups[] = "/etc/iproute2/group";
/* array of devgroups from f_devgroups[] */
static struct xtables_lmap *devgroups;
static void devgroup_init(struct xt_entry_match *match)
{
const char file[] = "/etc/iproute2/group";
devgroups = xtables_lmap_init(file);
if (devgroups == NULL && errno != ENOENT)
fprintf(stderr, "Warning: %s: %s\n", file, strerror(errno));
}
static void devgroup_parse_groupspec(const char *arg, unsigned int *group,
unsigned int *mask)
{
char *end;
bool ok;
ok = xtables_strtoui(arg, &end, group, 0, UINT32_MAX);
if (ok && (*end == '/' || *end == '\0')) {
if (*end == '/')
ok = xtables_strtoui(end + 1, NULL, mask,
0, UINT32_MAX);
else
*mask = ~0U;
if (!ok)
xtables_error(PARAMETER_PROBLEM,
"Bad group value \"%s\"", arg);
} else {
*group = xtables_lmap_name2id(devgroups, arg);
if (*group == -1)
xtables_error(PARAMETER_PROBLEM,
"Device group \"%s\" not found", arg);
*mask = ~0U;
}
}
static void devgroup_parse(struct xt_option_call *cb)
{
struct xt_devgroup_info *info = cb->data;
unsigned int id, mask;
unsigned int group, mask;
xtables_option_parse(cb);
xtables_parse_val_mask(cb, &group, &mask, devgroups);
switch (cb->entry->id) {
case O_SRC_GROUP:
devgroup_parse_groupspec(cb->arg, &id, &mask);
info->src_group = id;
info->src_group = group;
info->src_mask = mask;
info->flags |= XT_DEVGROUP_MATCH_SRC;
if (cb->invert)
info->flags |= XT_DEVGROUP_INVERT_SRC;
break;
case O_DST_GROUP:
devgroup_parse_groupspec(cb->arg, &id, &mask);
info->dst_group = id;
info->dst_group = group;
info->dst_mask = mask;
info->flags |= XT_DEVGROUP_MATCH_DST;
if (cb->invert)
......@@ -93,38 +61,23 @@ static void devgroup_parse(struct xt_option_call *cb)
}
}
static void
print_devgroup(unsigned int id, unsigned int mask, int numeric)
{
const char *name = NULL;
if (mask != 0xffffffff)
printf("0x%x/0x%x", id, mask);
else {
if (numeric == 0)
name = xtables_lmap_id2name(devgroups, id);
if (name)
printf("%s", name);
else
printf("0x%x", id);
}
}
static void devgroup_show(const char *pfx, const struct xt_devgroup_info *info,
int numeric)
{
if (info->flags & XT_DEVGROUP_MATCH_SRC) {
if (info->flags & XT_DEVGROUP_INVERT_SRC)
printf(" !");
printf(" %ssrc-group ", pfx);
print_devgroup(info->src_group, info->src_mask, numeric);
printf(" %ssrc-group", pfx);
xtables_print_val_mask(info->src_group, info->src_mask,
numeric ? NULL : devgroups);
}
if (info->flags & XT_DEVGROUP_MATCH_DST) {
if (info->flags & XT_DEVGROUP_INVERT_DST)
printf(" !");
printf(" %sdst-group ", pfx);
print_devgroup(info->dst_group, info->dst_mask, numeric);
printf(" %sdst-group", pfx);
xtables_print_val_mask(info->dst_group, info->dst_mask,
numeric ? NULL : devgroups);
}
}
......@@ -212,7 +165,6 @@ static struct xtables_match devgroup_mt_reg = {
.family = NFPROTO_UNSPEC,
.size = XT_ALIGN(sizeof(struct xt_devgroup_info)),
.userspacesize = XT_ALIGN(sizeof(struct xt_devgroup_info)),
.init = devgroup_init,
.help = devgroup_help,
.print = devgroup_print,
.save = devgroup_save,
......@@ -224,5 +176,10 @@ static struct xtables_match devgroup_mt_reg = {
void _init(void)
{
devgroups = xtables_lmap_init(f_devgroups);
if (devgroups == NULL && errno != ENOENT)
fprintf(stderr, "Warning: %s: %s\n", f_devgroups,
strerror(errno));
xtables_register_match(&devgroup_mt_reg);
}
extensions/libxt_ecn.c
View file @ 278668fa
......@@ -124,26 +124,39 @@ static int ecn_xlate(struct xt_xlate *xl,
const struct xt_ecn_info *einfo =
(const struct xt_ecn_info *)params->match->data;
if (!(einfo->operation & XT_ECN_OP_MATCH_IP))
return 0;
if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
xt_xlate_add(xl, "tcp flags ");
if (einfo->invert)
xt_xlate_add(xl,"!= ");
xt_xlate_add(xl, "ecn");
}
xt_xlate_add(xl, "ip ecn ");
if (einfo->invert)
xt_xlate_add(xl,"!= ");
if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
xt_xlate_add(xl, "tcp flags ");
if (einfo->invert)
xt_xlate_add(xl,"!= ");
xt_xlate_add(xl, "cwr");
}
switch (einfo->ip_ect) {
case 0:
xt_xlate_add(xl, "not-ect");
break;
case 1:
xt_xlate_add(xl, "ect1");
break;
case 2:
xt_xlate_add(xl, "ect0");
break;
case 3:
xt_xlate_add(xl, "ce");
break;
if (einfo->operation & XT_ECN_OP_MATCH_IP) {
xt_xlate_add(xl, "ip ecn ");
if (einfo->invert)
xt_xlate_add(xl,"!= ");
switch (einfo->ip_ect) {
case 0:
xt_xlate_add(xl, "not-ect");
break;
case 1:
xt_xlate_add(xl, "ect1");
break;
case 2:
xt_xlate_add(xl, "ect0");
break;
case 3:
xt_xlate_add(xl, "ce");
break;
}
}
return 1;
}
......
extensions/libxt_ecn.txlate
View file @ 278668fa
......@@ -21,3 +21,9 @@ nft add rule ip filter INPUT ip ecn != ect0 counter
iptables-translate -A INPUT -m ecn ! --ecn-ip-ect 3
nft add rule ip filter INPUT ip ecn != ce counter
iptables-translate -A INPUT -m ecn ! --ecn-tcp-ece
nft add rule ip filter INPUT tcp flags != ecn counter
iptables-translate -A INPUT -m ecn --ecn-tcp-cwr
nft add rule ip filter INPUT tcp flags cwr counter
extensions/libxt_esp.txlate
View file @ 278668fa
......@@ -2,7 +2,7 @@ iptables-translate -A FORWARD -p esp -j ACCEPT
nft add rule ip filter FORWARD ip protocol esp counter accept
iptables-translate -A INPUT --in-interface wan --protocol esp -j ACCEPT
nft add rule ip filter INPUT iifname wan ip protocol esp counter accept
nft add rule ip filter INPUT iifname "wan" ip protocol esp counter accept
iptables-translate -A INPUT -p 50 -m esp --espspi 500 -j DROP
nft add rule ip filter INPUT esp spi 500 counter drop
......
extensions/libxt_hashlimit.man
View file @ 278668fa
......@@ -54,7 +54,7 @@ How many milliseconds between garbage collection intervals.
.TP
\fB\-\-hashlimit\-rate\-match\fP
Classify the flow instead of rate-limiting it. This acts like a
true/flase match on whether the rate is above/below a certain number
true/false match on whether the rate is above/below a certain number
.TP
\fB\-\-hashlimit\-rate\-interval\fP \fIsec\fP
Can be used with \-\-hashlimit\-rate\-match to specify the interval
......
extensions/libxt_icmp.h 0 → 100644
View file @ 278668fa
struct xt_icmp_names {
const char *name;
uint8_t type;
uint8_t code_min, code_max;
};
static void xt_print_icmp_types(const struct xt_icmp_names *icmp_codes,
unsigned int n_codes)
{
unsigned int i;
for (i = 0; i < n_codes; ++i) {
if (i && icmp_codes[i].type == icmp_codes[i-1].type) {
if (icmp_codes[i].code_min == icmp_codes[i-1].code_min
&& (icmp_codes[i].code_max
== icmp_codes[i-1].code_max))
printf(" (%s)", icmp_codes[i].name);
else
printf("\n %s", icmp_codes[i].name);
}
else
printf("\n%s", icmp_codes[i].name);
}
printf("\n");
}
extensions/libxt_mark.c
View file @ 278668fa
......@@ -47,14 +47,6 @@ static void mark_parse(struct xt_option_call *cb)
markinfo->mask = cb->val.mask;
}
static void print_mark(unsigned int mark, unsigned int mask)
{
if (mask != 0xffffffffU)
printf(" 0x%x/0x%x", mark, mask);
else
printf(" 0x%x", mark);
}
static void
mark_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
{
......@@ -63,7 +55,8 @@ mark_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
printf(" mark match");
if (info->invert)
printf(" !");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......@@ -76,7 +69,7 @@ mark_print(const void *ip, const struct xt_entry_match *match, int numeric)
if (info->invert)
printf(" !");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void mark_mt_save(const void *ip, const struct xt_entry_match *match)
......@@ -87,7 +80,7 @@ static void mark_mt_save(const void *ip, const struct xt_entry_match *match)
printf(" !");
printf(" --mark");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......@@ -99,7 +92,7 @@ mark_save(const void *ip, const struct xt_entry_match *match)
printf(" !");
printf(" --mark");
print_mark(info->mark, info->mask);
xtables_print_mark_mask(info->mark, info->mask);
}
static void
......
extensions/libxt_tcp.txlate
View file @ 278668fa
iptables-translate -A INPUT -p tcp -i eth0 --sport 53 -j ACCEPT
nft add rule ip filter INPUT iifname eth0 tcp sport 53 counter accept
nft add rule ip filter INPUT iifname "eth0" tcp sport 53 counter accept
iptables-translate -A OUTPUT -p tcp -o eth0 --dport 53:66 -j DROP
nft add rule ip filter OUTPUT oifname eth0 tcp dport 53-66 counter drop
nft add rule ip filter OUTPUT oifname "eth0" tcp dport 53-66 counter drop
iptables-translate -I OUTPUT -p tcp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol tcp ip daddr 8.8.8.8 counter accept
......@@ -18,3 +18,9 @@ nft add rule ip filter INPUT tcp flags & (fin|syn|rst|ack) == syn counter accept
iptables-translate -A INPUT -p tcp --syn --dport 80 -j ACCEPT
nft add rule ip filter INPUT tcp dport 80 tcp flags & (fin|syn|rst|ack) == syn counter accept
iptables-translate -A INPUT -f -p tcp
nft add rule ip filter INPUT ip frag-off & 0x1fff != 0 ip protocol tcp counter
iptables-translate -A INPUT ! -f -p tcp --dport 22
nft add rule ip filter INPUT ip frag-off & 0x1fff 0 tcp dport 22 counter
extensions/libxt_udp.txlate
View file @ 278668fa
iptables-translate -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
nft add rule ip filter INPUT iifname eth0 udp sport 53 counter accept
nft add rule ip filter INPUT iifname "eth0" udp sport 53 counter accept
iptables-translate -A OUTPUT -p udp -o eth0 --dport 53:66 -j DROP
nft add rule ip filter OUTPUT oifname eth0 udp dport 53-66 counter drop
nft add rule ip filter OUTPUT oifname "eth0" udp dport 53-66 counter drop
iptables-translate -I OUTPUT -p udp -d 8.8.8.8 -j ACCEPT
nft insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accept
......
include/linux/netfilter.h
View file @ 278668fa
......@@ -3,7 +3,9 @@
#include <linux/types.h>
#include <linux/sysctl.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <limits.h>
/* Responses from hook functions. */
#define NF_DROP 0
......@@ -11,7 +13,7 @@
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_STOP 5 /* Deprecated, for userspace nf_queue compatibility. */
#define NF_MAX_VERDICT NF_STOP
/* we overload the higher bits for encoding auxiliary data such as the queue
......@@ -48,10 +50,17 @@ enum nf_inet_hooks {
NF_INET_NUMHOOKS
};
enum nf_dev_hooks {
NF_NETDEV_INGRESS,
NF_NETDEV_NUMHOOKS
};
enum {
NFPROTO_UNSPEC = 0,
NFPROTO_INET = 1,
NFPROTO_IPV4 = 2,
NFPROTO_ARP = 3,
NFPROTO_NETDEV = 5,
NFPROTO_BRIDGE = 7,
NFPROTO_IPV6 = 10,
NFPROTO_DECNET = 12,
......@@ -66,4 +75,4 @@ union nf_inet_addr {
struct in6_addr in6;
};
#endif /*__LINUX_NETFILTER_H*/
#endif /* __LINUX_NETFILTER_H */
include/linux/netfilter/nf_nat.h
View file @ 278668fa
......@@ -9,10 +9,16 @@
#define NF_NAT_RANGE_PROTO_RANDOM (1 << 2)
#define NF_NAT_RANGE_PERSISTENT (1 << 3)
#define NF_NAT_RANGE_PROTO_RANDOM_FULLY (1 << 4)
#define NF_NAT_RANGE_PROTO_OFFSET (1 << 5)
#define NF_NAT_RANGE_PROTO_RANDOM_ALL \
(NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PROTO_RANDOM_FULLY)
#define NF_NAT_RANGE_MASK \
(NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED | \
NF_NAT_RANGE_PROTO_RANDOM | NF_NAT_RANGE_PERSISTENT | \
NF_NAT_RANGE_PROTO_RANDOM_FULLY | NF_NAT_RANGE_PROTO_OFFSET)
struct nf_nat_ipv4_range {
unsigned int flags;
__be32 min_ip;
......@@ -34,4 +40,13 @@ struct nf_nat_range {
union nf_conntrack_man_proto max_proto;
};
struct nf_nat_range2 {
unsigned int flags;
union nf_inet_addr min_addr;
union nf_inet_addr max_addr;
union nf_conntrack_man_proto min_proto;
union nf_conntrack_man_proto max_proto;
union nf_conntrack_man_proto base_proto;
};
#endif /* _NETFILTER_NF_NAT_H */
include/linux/netfilter/nf_tables.h
View file @ 278668fa
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
#ifndef _LINUX_NF_TABLES_H
#define _LINUX_NF_TABLES_H
#define NFT_CHAIN_MAXNAMELEN 32
#define NFT_NAME_MAXLEN 256
#define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_CHAIN_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_SET_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_OBJ_MAXNAMELEN NFT_NAME_MAXLEN
#define NFT_USERDATA_MAXLEN 256
/**
* enum nft_registers - nf_tables registers
*
* nf_tables used to have five registers: a verdict register and four data
* registers of size 16. The data registers have been changed to 16 registers
* of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
* map to areas of size 16, the 4 byte registers are addressed using
* NFT_REG32_00 - NFT_REG32_15.
*/
enum nft_registers {
NFT_REG_VERDICT,
NFT_REG_1,
NFT_REG_2,
NFT_REG_3,
NFT_REG_4,
__NFT_REG_MAX
__NFT_REG_MAX,
NFT_REG32_00 = 8,
NFT_REG32_01,
NFT_REG32_02,
NFT_REG32_03,
NFT_REG32_04,
NFT_REG32_05,
NFT_REG32_06,
NFT_REG32_07,
NFT_REG32_08,
NFT_REG32_09,
NFT_REG32_10,
NFT_REG32_11,
NFT_REG32_12,
NFT_REG32_13,
NFT_REG32_14,
NFT_REG32_15,
};
#define NFT_REG_MAX (__NFT_REG_MAX - 1)
#define NFT_REG_SIZE 16
#define NFT_REG32_SIZE 4
/**
* enum nft_verdicts - nf_tables internal verdicts
*
......@@ -51,6 +85,16 @@ enum nft_verdicts {
* @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
* @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
* @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
* @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
* @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
* @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
* @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
* @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
* @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
* @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
* @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
* @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
* @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
*/
enum nf_tables_msg_types {
NFT_MSG_NEWTABLE,
......@@ -68,6 +112,16 @@ enum nf_tables_msg_types {
NFT_MSG_NEWSETELEM,
NFT_MSG_GETSETELEM,
NFT_MSG_DELSETELEM,
NFT_MSG_NEWGEN,
NFT_MSG_GETGEN,
NFT_MSG_TRACE,
NFT_MSG_NEWOBJ,
NFT_MSG_GETOBJ,
NFT_MSG_DELOBJ,
NFT_MSG_GETOBJ_RESET,
NFT_MSG_NEWFLOWTABLE,
NFT_MSG_GETFLOWTABLE,
NFT_MSG_DELFLOWTABLE,
NFT_MSG_MAX,
};
......@@ -88,11 +142,13 @@ enum nft_list_attributes {
*
* @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
* @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
* @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
*/
enum nft_hook_attributes {
NFTA_HOOK_UNSPEC,
NFTA_HOOK_HOOKNUM,
NFTA_HOOK_PRIORITY,
NFTA_HOOK_DEV,
__NFTA_HOOK_MAX
};
#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
......@@ -118,6 +174,8 @@ enum nft_table_attributes {
NFTA_TABLE_NAME,
NFTA_TABLE_FLAGS,
NFTA_TABLE_USE,
NFTA_TABLE_HANDLE,
NFTA_TABLE_PAD,
__NFTA_TABLE_MAX
};
#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
......@@ -144,6 +202,7 @@ enum nft_chain_attributes {
NFTA_CHAIN_USE,
NFTA_CHAIN_TYPE,
NFTA_CHAIN_COUNTERS,
NFTA_CHAIN_PAD,
__NFTA_CHAIN_MAX
};
#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
......@@ -158,6 +217,7 @@ enum nft_chain_attributes {
* @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
* @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
* @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
* @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
*/
enum nft_rule_attributes {
NFTA_RULE_UNSPEC,
......@@ -168,6 +228,8 @@ enum nft_rule_attributes {
NFTA_RULE_COMPAT,
NFTA_RULE_POSITION,
NFTA_RULE_USERDATA,
NFTA_RULE_PAD,
NFTA_RULE_ID,
__NFTA_RULE_MAX
};
#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
......@@ -185,7 +247,7 @@ enum nft_rule_compat_flags {
/**
* enum nft_rule_compat_attributes - nf_tables rule compat attributes
*
* @NFTA_RULE_COMPAT_PROTO: numerice value of handled protocol (NLA_U32)
* @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
* @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
*/
enum nft_rule_compat_attributes {
......@@ -203,12 +265,18 @@ enum nft_rule_compat_attributes {
* @NFT_SET_CONSTANT: set contents may not change while bound
* @NFT_SET_INTERVAL: set contains intervals
* @NFT_SET_MAP: set is used as a dictionary
* @NFT_SET_TIMEOUT: set uses timeouts
* @NFT_SET_EVAL: set contains expressions for evaluation
* @NFT_SET_OBJECT: set contains stateful objects
*/
enum nft_set_flags {
NFT_SET_ANONYMOUS = 0x1,
NFT_SET_CONSTANT = 0x2,
NFT_SET_INTERVAL = 0x4,
NFT_SET_MAP = 0x8,
NFT_SET_TIMEOUT = 0x10,
NFT_SET_EVAL = 0x20,
NFT_SET_OBJECT = 0x40,
};
/**
......@@ -247,6 +315,11 @@ enum nft_set_desc_attributes {
* @NFTA_SET_POLICY: selection policy (NLA_U32)
* @NFTA_SET_DESC: set description (NLA_NESTED)
* @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
* @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
* @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
* @NFTA_SET_USERDATA: user data (NLA_BINARY)
* @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
* @NFTA_SET_HANDLE: set handle (NLA_U64)
*/
enum nft_set_attributes {
NFTA_SET_UNSPEC,
......@@ -260,6 +333,12 @@ enum nft_set_attributes {
NFTA_SET_POLICY,
NFTA_SET_DESC,
NFTA_SET_ID,
NFTA_SET_TIMEOUT,
NFTA_SET_GC_INTERVAL,
NFTA_SET_USERDATA,
NFTA_SET_PAD,
NFTA_SET_OBJ_TYPE,
NFTA_SET_HANDLE,
__NFTA_SET_MAX
};
#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
......@@ -279,12 +358,23 @@ enum nft_set_elem_flags {
* @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
* @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
* @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
* @NFTA_SET_ELEM_TIMEOUT: timeout value (NLA_U64)
* @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
* @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
* @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
* @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
*/
enum nft_set_elem_attributes {
NFTA_SET_ELEM_UNSPEC,
NFTA_SET_ELEM_KEY,
NFTA_SET_ELEM_DATA,
NFTA_SET_ELEM_FLAGS,
NFTA_SET_ELEM_TIMEOUT,
NFTA_SET_ELEM_EXPIRATION,
NFTA_SET_ELEM_USERDATA,
NFTA_SET_ELEM_EXPR,
NFTA_SET_ELEM_PAD,
NFTA_SET_ELEM_OBJREF,
__NFTA_SET_ELEM_MAX
};
#define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
......@@ -342,6 +432,9 @@ enum nft_data_attributes {
};
#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
/* Maximum length of a value */
#define NFT_DATA_VALUE_MAXLEN 64
/**
* enum nft_verdict_attributes - nf_tables verdict netlink attributes
*
......@@ -420,7 +513,7 @@ enum nft_bitwise_attributes {
* enum nft_byteorder_ops - nf_tables byteorder operators
*
* @NFT_BYTEORDER_NTOH: network to host operator
* @NFT_BYTEORDER_HTON: host to network opertaor
* @NFT_BYTEORDER_HTON: host to network operator
*/
enum nft_byteorder_ops {
NFT_BYTEORDER_NTOH,
......@@ -482,6 +575,39 @@ enum nft_cmp_attributes {
};
#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
/**
* enum nft_range_ops - nf_tables range operator
*
* @NFT_RANGE_EQ: equal
* @NFT_RANGE_NEQ: not equal
*/
enum nft_range_ops {
NFT_RANGE_EQ,
NFT_RANGE_NEQ,
};
/**
* enum nft_range_attributes - nf_tables range expression netlink attributes
*
* @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
* @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_cmp_ops)
* @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
* @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
*/
enum nft_range_attributes {
NFTA_RANGE_UNSPEC,
NFTA_RANGE_SREG,
NFTA_RANGE_OP,
NFTA_RANGE_FROM_DATA,
NFTA_RANGE_TO_DATA,
__NFTA_RANGE_MAX
};
#define NFTA_RANGE_MAX (__NFTA_RANGE_MAX - 1)
enum nft_lookup_flags {
NFT_LOOKUP_F_INV = (1 << 0),
};
/**
* enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
*
......@@ -489,6 +615,7 @@ enum nft_cmp_attributes {
* @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
* @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
* @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags)
*/
enum nft_lookup_attributes {
NFTA_LOOKUP_UNSPEC,
......@@ -496,10 +623,47 @@ enum nft_lookup_attributes {
NFTA_LOOKUP_SREG,
NFTA_LOOKUP_DREG,
NFTA_LOOKUP_SET_ID,
NFTA_LOOKUP_FLAGS,
__NFTA_LOOKUP_MAX
};
#define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1)
enum nft_dynset_ops {
NFT_DYNSET_OP_ADD,
NFT_DYNSET_OP_UPDATE,
};
enum nft_dynset_flags {
NFT_DYNSET_F_INV = (1 << 0),
};
/**
* enum nft_dynset_attributes - dynset expression attributes
*
* @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)
* @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)
* @NFTA_DYNSET_OP: operation (NLA_U32)
* @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)
* @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)
* @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
* @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
* @NFTA_DYNSET_FLAGS: flags (NLA_U32)
*/
enum nft_dynset_attributes {
NFTA_DYNSET_UNSPEC,
NFTA_DYNSET_SET_NAME,
NFTA_DYNSET_SET_ID,
NFTA_DYNSET_OP,
NFTA_DYNSET_SREG_KEY,
NFTA_DYNSET_SREG_DATA,
NFTA_DYNSET_TIMEOUT,
NFTA_DYNSET_EXPR,
NFTA_DYNSET_PAD,
NFTA_DYNSET_FLAGS,
__NFTA_DYNSET_MAX,
};
#define NFTA_DYNSET_MAX (__NFTA_DYNSET_MAX - 1)
/**
* enum nft_payload_bases - nf_tables payload expression offset bases
*
......@@ -513,6 +677,21 @@ enum nft_payload_bases {
NFT_PAYLOAD_TRANSPORT_HEADER,
};
/**
* enum nft_payload_csum_types - nf_tables payload expression checksum types
*
* @NFT_PAYLOAD_CSUM_NONE: no checksumming
* @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
*/
enum nft_payload_csum_types {
NFT_PAYLOAD_CSUM_NONE,
NFT_PAYLOAD_CSUM_INET,
};
enum nft_payload_csum_flags {
NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
};
/**
* enum nft_payload_attributes - nf_tables payload expression netlink attributes
*
......@@ -520,6 +699,10 @@ enum nft_payload_bases {
* @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
* @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
* @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
* @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
* @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
* @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
* @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
*/
enum nft_payload_attributes {
NFTA_PAYLOAD_UNSPEC,
......@@ -527,17 +710,41 @@ enum nft_payload_attributes {
NFTA_PAYLOAD_BASE,
NFTA_PAYLOAD_OFFSET,
NFTA_PAYLOAD_LEN,
NFTA_PAYLOAD_SREG,
NFTA_PAYLOAD_CSUM_TYPE,
NFTA_PAYLOAD_CSUM_OFFSET,
NFTA_PAYLOAD_CSUM_FLAGS,
__NFTA_PAYLOAD_MAX
};
#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
enum nft_exthdr_flags {
NFT_EXTHDR_F_PRESENT = (1 << 0),
};
/**
* enum nft_exthdr_op - nf_tables match options
*
* @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
* @NFT_EXTHDR_OP_TCP: match against tcp options
*/
enum nft_exthdr_op {
NFT_EXTHDR_OP_IPV6,
NFT_EXTHDR_OP_TCPOPT,
__NFT_EXTHDR_OP_MAX
};
#define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1)
/**
* enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
* enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes
*
* @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
* @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
* @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
* @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
* @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
* @NFTA_EXTHDR_OP: option match type (NLA_U32)
* @NFTA_EXTHDR_SREG: option match type (NLA_U32)
*/
enum nft_exthdr_attributes {
NFTA_EXTHDR_UNSPEC,
......@@ -545,6 +752,9 @@ enum nft_exthdr_attributes {
NFTA_EXTHDR_TYPE,
NFTA_EXTHDR_OFFSET,
NFTA_EXTHDR_LEN,
NFTA_EXTHDR_FLAGS,
NFTA_EXTHDR_OP,
NFTA_EXTHDR_SREG,
__NFTA_EXTHDR_MAX
};
#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
......@@ -571,6 +781,13 @@ enum nft_exthdr_attributes {
* @NFT_META_L4PROTO: layer 4 protocol number
* @NFT_META_BRI_IIFNAME: packet input bridge interface name
* @NFT_META_BRI_OIFNAME: packet output bridge interface name
* @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
* @NFT_META_CPU: cpu id through smp_processor_id()
* @NFT_META_IIFGROUP: packet input interface group
* @NFT_META_OIFGROUP: packet output interface group
* @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
* @NFT_META_PRANDOM: a 32bit pseudo-random number
* @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
*/
enum nft_meta_keys {
NFT_META_LEN,
......@@ -592,7 +809,64 @@ enum nft_meta_keys {
NFT_META_L4PROTO,
NFT_META_BRI_IIFNAME,
NFT_META_BRI_OIFNAME,
NFT_META_PKTTYPE,
NFT_META_CPU,
NFT_META_IIFGROUP,
NFT_META_OIFGROUP,
NFT_META_CGROUP,
NFT_META_PRANDOM,
NFT_META_SECPATH,
};
/**
* enum nft_rt_keys - nf_tables routing expression keys
*
* @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
* @NFT_RT_NEXTHOP4: routing nexthop for IPv4
* @NFT_RT_NEXTHOP6: routing nexthop for IPv6
* @NFT_RT_TCPMSS: fetch current path tcp mss
*/
enum nft_rt_keys {
NFT_RT_CLASSID,
NFT_RT_NEXTHOP4,
NFT_RT_NEXTHOP6,
NFT_RT_TCPMSS,
};
/**
* enum nft_hash_types - nf_tables hash expression types
*
* @NFT_HASH_JENKINS: Jenkins Hash
* @NFT_HASH_SYM: Symmetric Hash
*/
enum nft_hash_types {
NFT_HASH_JENKINS,
NFT_HASH_SYM,
};
/**
* enum nft_hash_attributes - nf_tables hash expression netlink attributes
*
* @NFTA_HASH_SREG: source register (NLA_U32)
* @NFTA_HASH_DREG: destination register (NLA_U32)
* @NFTA_HASH_LEN: source data length (NLA_U32)
* @NFTA_HASH_MODULUS: modulus value (NLA_U32)
* @NFTA_HASH_SEED: seed value (NLA_U32)
* @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
* @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
*/
enum nft_hash_attributes {
NFTA_HASH_UNSPEC,
NFTA_HASH_SREG,
NFTA_HASH_DREG,
NFTA_HASH_LEN,
NFTA_HASH_MODULUS,
NFTA_HASH_SEED,
NFTA_HASH_OFFSET,
NFTA_HASH_TYPE,
__NFTA_HASH_MAX,
};
#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
/**
* enum nft_meta_attributes - nf_tables meta expression netlink attributes
......@@ -610,6 +884,20 @@ enum nft_meta_attributes {
};
#define NFTA_META_MAX (__NFTA_META_MAX - 1)
/**
* enum nft_rt_attributes - nf_tables routing expression netlink attributes
*
* @NFTA_RT_DREG: destination register (NLA_U32)
* @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
*/
enum nft_rt_attributes {
NFTA_RT_UNSPEC,
NFTA_RT_DREG,
NFTA_RT_KEY,
__NFTA_RT_MAX
};
#define NFTA_RT_MAX (__NFTA_RT_MAX - 1)
/**
* enum nft_ct_keys - nf_tables ct expression keys
*
......@@ -626,6 +914,12 @@ enum nft_meta_attributes {
* @NFT_CT_PROTOCOL: conntrack layer 4 protocol
* @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
* @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
* @NFT_CT_LABELS: conntrack labels
* @NFT_CT_PKTS: conntrack packets
* @NFT_CT_BYTES: conntrack bytes
* @NFT_CT_AVGPKT: conntrack average bytes per packet
* @NFT_CT_ZONE: conntrack zone
* @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
*/
enum nft_ct_keys {
NFT_CT_STATE,
......@@ -642,6 +936,11 @@ enum nft_ct_keys {
NFT_CT_PROTO_SRC,
NFT_CT_PROTO_DST,
NFT_CT_LABELS,
NFT_CT_PKTS,
NFT_CT_BYTES,
NFT_CT_AVGPKT,
NFT_CT_ZONE,
NFT_CT_EVENTMASK,
};
/**
......@@ -662,16 +961,43 @@ enum nft_ct_attributes {
};
#define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
/**
* enum nft_flow_attributes - ct offload expression attributes
* @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
*/
enum nft_offload_attributes {
NFTA_FLOW_UNSPEC,
NFTA_FLOW_TABLE_NAME,
__NFTA_FLOW_MAX,
};
#define NFTA_FLOW_MAX (__NFTA_FLOW_MAX - 1)
enum nft_limit_type {
NFT_LIMIT_PKTS,
NFT_LIMIT_PKT_BYTES
};
enum nft_limit_flags {
NFT_LIMIT_F_INV = (1 << 0),
};
/**
* enum nft_limit_attributes - nf_tables limit expression netlink attributes
*
* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
* @NFTA_LIMIT_BURST: burst (NLA_U32)
* @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
* @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
*/
enum nft_limit_attributes {
NFTA_LIMIT_UNSPEC,
NFTA_LIMIT_RATE,
NFTA_LIMIT_UNIT,
NFTA_LIMIT_BURST,
NFTA_LIMIT_TYPE,
NFTA_LIMIT_FLAGS,
NFTA_LIMIT_PAD,
__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
......@@ -686,6 +1012,7 @@ enum nft_counter_attributes {
NFTA_COUNTER_UNSPEC,
NFTA_COUNTER_BYTES,
NFTA_COUNTER_PACKETS,
NFTA_COUNTER_PAD,
__NFTA_COUNTER_MAX
};
#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
......@@ -718,12 +1045,14 @@ enum nft_log_attributes {
* @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
* @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
* @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
* @NFTA_QUEUE_SREG_QNUM: source register of queue number (NLA_U32: nft_registers)
*/
enum nft_queue_attributes {
NFTA_QUEUE_UNSPEC,
NFTA_QUEUE_NUM,
NFTA_QUEUE_TOTAL,
NFTA_QUEUE_FLAGS,
NFTA_QUEUE_SREG_QNUM,
__NFTA_QUEUE_MAX
};
#define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1)
......@@ -732,17 +1061,60 @@ enum nft_queue_attributes {
#define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */
#define NFT_QUEUE_FLAG_MASK 0x03
enum nft_quota_flags {
NFT_QUOTA_F_INV = (1 << 0),
NFT_QUOTA_F_DEPLETED = (1 << 1),
};
/**
* enum nft_quota_attributes - nf_tables quota expression netlink attributes
*
* @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
* @NFTA_QUOTA_FLAGS: flags (NLA_U32)
* @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
*/
enum nft_quota_attributes {
NFTA_QUOTA_UNSPEC,
NFTA_QUOTA_BYTES,
NFTA_QUOTA_FLAGS,
NFTA_QUOTA_PAD,
NFTA_QUOTA_CONSUMED,
__NFTA_QUOTA_MAX
};
#define NFTA_QUOTA_MAX (__NFTA_QUOTA_MAX - 1)
/**
* enum nft_reject_types - nf_tables reject expression reject types
*
* @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
* @NFT_REJECT_TCP_RST: reject using TCP RST
* @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet
*/
enum nft_reject_types {
NFT_REJECT_ICMP_UNREACH,
NFT_REJECT_TCP_RST,
NFT_REJECT_ICMPX_UNREACH,
};
/**
* enum nft_reject_code - Generic reject codes for IPv4/IPv6
*
* @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable
* @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
* @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
* @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited
*
* These codes are mapped to real ICMP and ICMPv6 codes.
*/
enum nft_reject_inet_code {
NFT_REJECT_ICMPX_NO_ROUTE = 0,
NFT_REJECT_ICMPX_PORT_UNREACH,
NFT_REJECT_ICMPX_HOST_UNREACH,
NFT_REJECT_ICMPX_ADMIN_PROHIBITED,
__NFT_REJECT_ICMPX_MAX
};
#define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX - 1)
/**
* enum nft_reject_attributes - nf_tables reject expression netlink attributes
*
......@@ -777,6 +1149,7 @@ enum nft_nat_types {
* @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
* @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
* @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
*/
enum nft_nat_attributes {
NFTA_NAT_UNSPEC,
......@@ -786,8 +1159,305 @@ enum nft_nat_attributes {
NFTA_NAT_REG_ADDR_MAX,
NFTA_NAT_REG_PROTO_MIN,
NFTA_NAT_REG_PROTO_MAX,
NFTA_NAT_FLAGS,
__NFTA_NAT_MAX
};
#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
/**
* enum nft_masq_attributes - nf_tables masquerade expression attributes
*
* @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
* @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
*/
enum nft_masq_attributes {
NFTA_MASQ_UNSPEC,
NFTA_MASQ_FLAGS,
NFTA_MASQ_REG_PROTO_MIN,
NFTA_MASQ_REG_PROTO_MAX,
__NFTA_MASQ_MAX
};
#define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1)
/**
* enum nft_redir_attributes - nf_tables redirect expression netlink attributes
*
* @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
* @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
* @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
*/
enum nft_redir_attributes {
NFTA_REDIR_UNSPEC,
NFTA_REDIR_REG_PROTO_MIN,
NFTA_REDIR_REG_PROTO_MAX,
NFTA_REDIR_FLAGS,
__NFTA_REDIR_MAX
};
#define NFTA_REDIR_MAX (__NFTA_REDIR_MAX - 1)
/**
* enum nft_dup_attributes - nf_tables dup expression netlink attributes
*
* @NFTA_DUP_SREG_ADDR: source register of address (NLA_U32: nft_registers)
* @NFTA_DUP_SREG_DEV: source register of output interface (NLA_U32: nft_register)
*/
enum nft_dup_attributes {
NFTA_DUP_UNSPEC,
NFTA_DUP_SREG_ADDR,
NFTA_DUP_SREG_DEV,
__NFTA_DUP_MAX
};
#define NFTA_DUP_MAX (__NFTA_DUP_MAX - 1)
/**
* enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
*
* @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
*/
enum nft_fwd_attributes {
NFTA_FWD_UNSPEC,
NFTA_FWD_SREG_DEV,
__NFTA_FWD_MAX
};
#define NFTA_FWD_MAX (__NFTA_FWD_MAX - 1)
/**
* enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
*
* @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
* @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
* @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
* @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
* @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
*/
enum nft_objref_attributes {
NFTA_OBJREF_UNSPEC,
NFTA_OBJREF_IMM_TYPE,
NFTA_OBJREF_IMM_NAME,
NFTA_OBJREF_SET_SREG,
NFTA_OBJREF_SET_NAME,
NFTA_OBJREF_SET_ID,
__NFTA_OBJREF_MAX
};
#define NFTA_OBJREF_MAX (__NFTA_OBJREF_MAX - 1)
/**
* enum nft_gen_attributes - nf_tables ruleset generation attributes
*
* @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
*/
enum nft_gen_attributes {
NFTA_GEN_UNSPEC,
NFTA_GEN_ID,
NFTA_GEN_PROC_PID,
NFTA_GEN_PROC_NAME,
__NFTA_GEN_MAX
};
#define NFTA_GEN_MAX (__NFTA_GEN_MAX - 1)
/*
* enum nft_fib_attributes - nf_tables fib expression netlink attributes
*
* @NFTA_FIB_DREG: destination register (NLA_U32)
* @NFTA_FIB_RESULT: desired result (NLA_U32)
* @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)
*
* The FIB expression performs a route lookup according
* to the packet data.
*/
enum nft_fib_attributes {
NFTA_FIB_UNSPEC,
NFTA_FIB_DREG,
NFTA_FIB_RESULT,
NFTA_FIB_FLAGS,
__NFTA_FIB_MAX
};
#define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)
enum nft_fib_result {
NFT_FIB_RESULT_UNSPEC,
NFT_FIB_RESULT_OIF,
NFT_FIB_RESULT_OIFNAME,
NFT_FIB_RESULT_ADDRTYPE,
__NFT_FIB_RESULT_MAX
};
#define NFT_FIB_RESULT_MAX (__NFT_FIB_RESULT_MAX - 1)
enum nft_fib_flags {
NFTA_FIB_F_SADDR = 1 << 0, /* look up src */
NFTA_FIB_F_DADDR = 1 << 1, /* look up dst */
NFTA_FIB_F_MARK = 1 << 2, /* use skb->mark */
NFTA_FIB_F_IIF = 1 << 3, /* restrict to iif */
NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */
NFTA_FIB_F_PRESENT = 1 << 5, /* check existence only */
};
enum nft_ct_helper_attributes {
NFTA_CT_HELPER_UNSPEC,
NFTA_CT_HELPER_NAME,
NFTA_CT_HELPER_L3PROTO,
NFTA_CT_HELPER_L4PROTO,
__NFTA_CT_HELPER_MAX,
};
#define NFTA_CT_HELPER_MAX (__NFTA_CT_HELPER_MAX - 1)
#define NFT_OBJECT_UNSPEC 0
#define NFT_OBJECT_COUNTER 1
#define NFT_OBJECT_QUOTA 2
#define NFT_OBJECT_CT_HELPER 3
#define NFT_OBJECT_LIMIT 4
#define __NFT_OBJECT_MAX 5
#define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1)
/**
* enum nft_object_attributes - nf_tables stateful object netlink attributes
*
* @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
* @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
* @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
* @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
* @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
* @NFTA_OBJ_HANDLE: object handle (NLA_U64)
*/
enum nft_object_attributes {
NFTA_OBJ_UNSPEC,
NFTA_OBJ_TABLE,
NFTA_OBJ_NAME,
NFTA_OBJ_TYPE,
NFTA_OBJ_DATA,
NFTA_OBJ_USE,
NFTA_OBJ_HANDLE,
NFTA_OBJ_PAD,
__NFTA_OBJ_MAX
};
#define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
/**
* enum nft_flowtable_attributes - nf_tables flow table netlink attributes
*
* @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
* @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
* @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
* @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
*/
enum nft_flowtable_attributes {
NFTA_FLOWTABLE_UNSPEC,
NFTA_FLOWTABLE_TABLE,
NFTA_FLOWTABLE_NAME,
NFTA_FLOWTABLE_HOOK,
NFTA_FLOWTABLE_USE,
NFTA_FLOWTABLE_HANDLE,
NFTA_FLOWTABLE_PAD,
__NFTA_FLOWTABLE_MAX
};
#define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)
/**
* enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
*
* @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
* @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
* @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
*/
enum nft_flowtable_hook_attributes {
NFTA_FLOWTABLE_HOOK_UNSPEC,
NFTA_FLOWTABLE_HOOK_NUM,
NFTA_FLOWTABLE_HOOK_PRIORITY,
NFTA_FLOWTABLE_HOOK_DEVS,
__NFTA_FLOWTABLE_HOOK_MAX
};
#define NFTA_FLOWTABLE_HOOK_MAX (__NFTA_FLOWTABLE_HOOK_MAX - 1)
/**
* enum nft_device_attributes - nf_tables device netlink attributes
*
* @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
*/
enum nft_devices_attributes {
NFTA_DEVICE_UNSPEC,
NFTA_DEVICE_NAME,
__NFTA_DEVICE_MAX
};
#define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1)
/**
* enum nft_trace_attributes - nf_tables trace netlink attributes
*
* @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
* @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)
* @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)
* @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)
* @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)
* @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)
* @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)
* @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)
* @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)
* @NFTA_TRACE_IIF: indev ifindex (NLA_U32)
* @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)
* @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)
* @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)
* @NFTA_TRACE_MARK: nfmark (NLA_U32)
* @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
* @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
*/
enum nft_trace_attributes {
NFTA_TRACE_UNSPEC,
NFTA_TRACE_TABLE,
NFTA_TRACE_CHAIN,
NFTA_TRACE_RULE_HANDLE,
NFTA_TRACE_TYPE,
NFTA_TRACE_VERDICT,
NFTA_TRACE_ID,
NFTA_TRACE_LL_HEADER,
NFTA_TRACE_NETWORK_HEADER,
NFTA_TRACE_TRANSPORT_HEADER,
NFTA_TRACE_IIF,
NFTA_TRACE_IIFTYPE,
NFTA_TRACE_OIF,
NFTA_TRACE_OIFTYPE,
NFTA_TRACE_MARK,
NFTA_TRACE_NFPROTO,
NFTA_TRACE_POLICY,
NFTA_TRACE_PAD,
__NFTA_TRACE_MAX
};
#define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
enum nft_trace_types {
NFT_TRACETYPE_UNSPEC,
NFT_TRACETYPE_POLICY,
NFT_TRACETYPE_RETURN,
NFT_TRACETYPE_RULE,
__NFT_TRACETYPE_MAX
};
#define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
/**
* enum nft_ng_attributes - nf_tables number generator expression netlink attributes
*
* @NFTA_NG_DREG: destination register (NLA_U32)
* @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
* @NFTA_NG_TYPE: operation type (NLA_U32)
* @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
*/
enum nft_ng_attributes {
NFTA_NG_UNSPEC,
NFTA_NG_DREG,
NFTA_NG_MODULUS,
NFTA_NG_TYPE,
NFTA_NG_OFFSET,
__NFTA_NG_MAX
};
#define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
enum nft_ng_types {
NFT_NG_INCREMENTAL,
NFT_NG_RANDOM,
__NFT_NG_MAX
};
#define NFT_NG_MAX (__NFT_NG_MAX - 1)
#endif /* _LINUX_NF_TABLES_H */
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment