From patchwork Thu Aug 22 15:26:31 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 269092 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 8A34B2C00A3 for ; Fri, 23 Aug 2013 01:26:42 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752840Ab3HVP0k (ORCPT ); Thu, 22 Aug 2013 11:26:40 -0400 Received: from mail.us.es ([193.147.175.20]:46293 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753327Ab3HVP0k (ORCPT ); Thu, 22 Aug 2013 11:26:40 -0400 Received: (qmail 23864 invoked from network); 22 Aug 2013 17:26:38 +0200 Received: from unknown (HELO us.es) (192.168.2.11) by us.es with SMTP; 22 Aug 2013 17:26:38 +0200 Received: (qmail 17501 invoked by uid 507); 22 Aug 2013 15:26:37 -0000 X-Qmail-Scanner-Diagnostics: from 127.0.0.1 by antivirus1 (envelope-from , uid 501) with qmail-scanner-2.10 (clamdscan: 0.97.8/17720. spamassassin: 3.3.2. Clear:RC:1(127.0.0.1):SA:0(-96.4/7.5):. Processed in 2.774647 secs); 22 Aug 2013 15:26:37 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on antivirus1 X-Spam-Level: X-Spam-Status: No, score=-96.4 required=7.5 tests=BAYES_50, RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RCVD_IN_RP_RNBL,RCVD_IN_SORBS_DUL, RDNS_DYNAMIC,USER_IN_WHITELIST autolearn=disabled version=3.3.2 X-Envelope-From: pablo@netfilter.org Received: from unknown (HELO antivirus1) (127.0.0.1) by us.es with SMTP; 22 Aug 2013 15:26:34 -0000 Received: from 192.168.1.13 (192.168.1.13) by antivirus1 (F-Secure/fsigk_smtp/410/antivirus1); Thu, 22 Aug 2013 17:26:34 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/410/antivirus1) Received: (qmail 13022 invoked from network); 22 Aug 2013 17:26:35 +0200 Received: from 156.154.76.188.dynamic.jazztel.es (HELO localhost.localdomain) (pneira@us.es@188.76.154.156) by us.es with SMTP; 22 Aug 2013 17:26:35 +0200 From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nft] src: allow to specify the base chain type Date: Thu, 22 Aug 2013 17:26:31 +0200 Message-Id: <1377185191-9961-1-git-send-email-pablo@netfilter.org> X-Mailer: git-send-email 1.7.10.4 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso --- include/rule.h | 2 ++ src/netlink.c | 26 ++++++++++++++++++++------ src/parser.y | 14 ++++++++------ src/rule.c | 5 ++--- 4 files changed, 32 insertions(+), 15 deletions(-) diff --git a/include/rule.h b/include/rule.h index 2577cff..4f68431 100644 --- a/include/rule.h +++ b/include/rule.h @@ -100,6 +100,7 @@ enum chain_flags { * @flags: chain flags * @hooknum: hook number (base chains) * @priority: hook priority (base chains) + * @type: chain type * @rules: rules contained in the chain */ struct chain { @@ -109,6 +110,7 @@ struct chain { uint32_t flags; unsigned int hooknum; unsigned int priority; + const char *type; struct scope scope; struct list_head rules; }; diff --git a/src/netlink.c b/src/netlink.c index 5129cac..962561f 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -461,6 +461,8 @@ int netlink_add_chain(struct netlink_ctx *ctx, const struct handle *h, chain->hooknum); nft_chain_attr_set_u32(nlc, NFT_CHAIN_ATTR_PRIO, chain->priority); + nft_chain_attr_set_str(nlc, NFT_CHAIN_ATTR_TYPE, + chain->type); } netlink_dump_chain(nlc); err = mnl_nft_chain_add(nf_sock, nlc, NLM_F_EXCL); @@ -524,10 +526,17 @@ static int list_chain_cb(struct nft_chain *nlc, void *arg) xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_NAME)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE)) { + chain->hooknum = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = + xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); return 0; @@ -579,8 +588,13 @@ int netlink_get_chain(struct netlink_ctx *ctx, const struct handle *h, chain->handle.family = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_FAMILY); chain->handle.table = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TABLE)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO)) { + chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); nft_chain_free(nlc); diff --git a/src/parser.y b/src/parser.y index ff8de47..f0eb8e3 100644 --- a/src/parser.y +++ b/src/parser.y @@ -766,16 +766,18 @@ map_block : /* empty */ { $$ = $-1; } } ; -hook_spec : HOOK HOOKNUM NUM +hook_spec : TYPE STRING HOOK HOOKNUM NUM { - $0->hooknum = $2; - $0->priority = $3; + $0->type = $2; + $0->hooknum = $4; + $0->priority = $5; $0->flags |= CHAIN_F_BASECHAIN; } - | HOOK HOOKNUM DASH NUM + | TYPE STRING HOOK HOOKNUM DASH NUM { - $0->hooknum = $2; - $0->priority = -$4; + $0->type = $2; + $0->hooknum = $4; + $0->priority = -$6; $0->flags |= CHAIN_F_BASECHAIN; } ; diff --git a/src/rule.c b/src/rule.c index 8368624..fb0387c 100644 --- a/src/rule.c +++ b/src/rule.c @@ -250,9 +250,8 @@ static void chain_print(const struct chain *chain) printf("\tchain %s {\n", chain->handle.chain); if (chain->hooknum) { - printf("\t\t hook %s %u;\n", - hooknum2str(chain->hooknum), - chain->priority); + printf("\t\t type %s hook %s %u;\n", chain->type, + hooknum2str(chain->hooknum), chain->priority); } list_for_each_entry(rule, &chain->rules, list) { printf("\t\t");