19 Sep, 2015
2 commits
-
Only pass the void *priv parameter out of the nf_hook_ops. That is
all any of the functions are interested now, and by limiting what is
passed it becomes simpler to change implementation details.Signed-off-by: "Eric W. Biederman"
Signed-off-by: Pablo Neira Ayuso -
- Add nft_pktinfo.pf to replace ops->pf
- Add nft_pktinfo.hook to replace ops->hooknumThis simplifies the code, makes it more readable, and likely reduces
cache line misses. Maintainability is enhanced as the details of
nft_hook_ops are of no concern to the recpients of nft_pktinfo.Signed-off-by: "Eric W. Biederman"
Signed-off-by: Pablo Neira Ayuso
05 Apr, 2015
3 commits
-
Signed-off-by: David S. Miller
-
Signed-off-by: David S. Miller
-
Pass the nf_hook_state all the way down into the hook
functions themselves.Signed-off-by: David S. Miller
02 Sep, 2014
1 commit
-
Use the exported IPv4 NAT functions that are provided by the core. This
removes duplicated code so iptables and nft use the same NAT codebase.Signed-off-by: Pablo Neira Ayuso
30 Apr, 2014
1 commit
-
Reduce copy-past a bit by adding a common helper.
Signed-off-by: Florian Westphal
Signed-off-by: Pablo Neira Ayuso
10 Jan, 2014
3 commits
-
We don't encode argument types into function names and since besides
nft_do_chain() there are only AF-specific versions, there is no risk
of confusion.Signed-off-by: Patrick McHardy
Signed-off-by: Pablo Neira Ayuso -
Minor nf_chain_type cleanups:
- reorder struct to plug a hoe
- rename struct module member to "owner" for consistency
- rename nf_hookfn array to "hooks" for consistency
- reorder initializers for better readabilitySigned-off-by: Patrick McHardy
Signed-off-by: Pablo Neira Ayuso -
Signed-off-by: Patrick McHardy
Signed-off-by: Pablo Neira Ayuso
15 Oct, 2013
2 commits
-
This patch generalizes the NAT expression to support both IPv4 and IPv6
using the existing IPv4/IPv6 NAT infrastructure. This also adds the
NAT chain type for IPv6.This patch collapses the following patches that were posted to the
netfilter-devel mailing list, from Tomasz:* nf_tables: Change NFTA_NAT_ attributes to better semantic significance
* nf_tables: Split IPv4 NAT into NAT expression and IPv4 NAT chain
* nf_tables: Add support for IPv6 NAT expression
* nf_tables: Add support for IPv6 NAT chain
* nf_tables: Fix up build issue on IPv6 NAT supportAnd, from Pablo Neira Ayuso:
* fix missing dependencies in nft_chain_nat
Signed-off-by: Tomasz Bursztyka
Signed-off-by: Pablo Neira Ayuso -
This patch adds the x_tables compatibility layer. This allows you
to use existing x_tables matches and targets from nf_tables.This compatibility later allows us to use existing matches/targets
for features that are still missing in nf_tables. We can progressively
replace them with native nf_tables extensions. It also provides the
userspace compatibility software that allows you to express the
rule-set using the iptables syntax but using the nf_tables kernel
components.In order to get this compatibility layer working, I've done the
following things:* add NFNL_SUBSYS_NFT_COMPAT: this new nfnetlink subsystem is used
to query the x_tables match/target revision, so we don't need to
use the native x_table getsockopt interface.* emulate xt structures: this required extending the struct nft_pktinfo
to include the fragment offset, which is already obtained from
ip[6]_tables and that is used by some matches/targets.* add support for default policy to base chains, required to emulate
x_tables.* add NFTA_CHAIN_USE attribute to obtain the number of references to
chains, required by x_tables emulation.* add chain packet/byte counters using per-cpu.
* support 32-64 bits compat.
For historical reasons, this patch includes the following patches
that were posted in the netfilter-devel mailing list.From Pablo Neira Ayuso:
* nf_tables: add default policy to base chains
* netfilter: nf_tables: add NFTA_CHAIN_USE attribute
* nf_tables: nft_compat: private data of target and matches in contiguous area
* nf_tables: validate hooks for compat match/target
* nf_tables: nft_compat: release cached matches/targets
* nf_tables: x_tables support as a compile time option
* nf_tables: fix alias for xtables over nftables module
* nf_tables: add packet and byte counters per chain
* nf_tables: fix per-chain counter stats if no counters are passed
* nf_tables: don't bump chain stats
* nf_tables: add protocol and flags for xtables over nf_tables
* nf_tables: add ip[6]t_entry emulation
* nf_tables: move specific layer 3 compat code to nf_tables_ipv[4|6]
* nf_tables: support 32bits-64bits x_tables compat
* nf_tables: fix compilation if CONFIG_COMPAT is disabledFrom Patrick McHardy:
* nf_tables: move policy to struct nft_base_chain
* nf_tables: send notifications for base chain policy changesFrom Alexander Primak:
* nf_tables: remove the duplicate NF_INET_LOCAL_OUTFrom Nicolas Dichtel:
* nf_tables: fix compilation when nf-netlink is a moduleSigned-off-by: Pablo Neira Ayuso
14 Oct, 2013
1 commit
-
This patch converts built-in tables/chains to chain types that
allows you to deploy customized table and chain configurations from
userspace.After this patch, you have to specify the chain type when
creating a new chain:add chain ip filter output { type filter hook input priority 0; }
^^^^ ------The existing chain types after this patch are: filter, route and
nat. Note that tables are just containers of chains with no specific
semantics, which is a significant change with regards to iptables.Signed-off-by: Pablo Neira Ayuso