From patchwork Tue May 27 17:15:34 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Alvaro Neira X-Patchwork-Id: 353062 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 25CCE1400DD for ; Wed, 28 May 2014 03:17:15 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752563AbaE0RRN (ORCPT ); Tue, 27 May 2014 13:17:13 -0400 Received: from mail-wg0-f52.google.com ([74.125.82.52]:51218 "EHLO mail-wg0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752039AbaE0RRN (ORCPT ); Tue, 27 May 2014 13:17:13 -0400 Received: by mail-wg0-f52.google.com with SMTP id l18so9747749wgh.11 for ; Tue, 27 May 2014 10:17:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:subject:date:message-id:mime-version:content-type :content-transfer-encoding; bh=n5eSzK3fL3hMXxPjrOJNsGxhQY84TvY9hmRMVo5LcZU=; b=e6PXSMP5xylnoRQ5p3jopiPuo7M/0Ym6fah6kfC6b/jRj6ctVb20vISbyvEaEp5vwY VKGW6NhEd3sv/ABoRM9ctu8Wp9ZGyD/Sfe+TZJwnaG4dZKjWMij6WhfVfUt9628HcmsQ Rd0dJxFCnnlRzfbA5dYoZjpZk9NNolCN88aiA8xC5WLtmNTqmG4UWW3y504rMuubqgRT rFqOzGXzsQFyUoevcOzsm5RZ75bsunjBKCpaPYR8sp4RQ/ATbBCvJGPLer0KtWm2WScA 2+t8EuhBU7nG+HDSg9ug9uuhH+BzwAp+2NH6h90ZUrcTjlQAUh37gW9cblOjeAZrNmNt nGwA== X-Received: by 10.194.93.202 with SMTP id cw10mr17041120wjb.95.1401211031140; Tue, 27 May 2014 10:17:11 -0700 (PDT) Received: from localhost.localdomain (85.136.70.56.dyn.user.ono.com. [85.136.70.56]) by mx.google.com with ESMTPSA id em5sm9847493wic.23.2014.05.27.10.17.10 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 27 May 2014 10:17:10 -0700 (PDT) From: Alvaro Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [nftables PATCH] netlink: Allow invert the ranges Date: Tue, 27 May 2014 19:15:34 +0200 Message-Id: <1401210934-4900-1-git-send-email-alvaroneay@gmail.com> X-Mailer: git-send-email 1.7.10.4 MIME-Version: 1.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org From: Álvaro Neira Ayuso This patch fix the bug: http://bugzilla.netfilter.org/show_bug.cgi?id=924 Before, nftables doesn't permit invert ranges. This patch allows add rules like this: nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55 Signed-off-by: Alvaro Neira Ayuso --- src/netlink_linearize.c | 43 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 37 insertions(+), 6 deletions(-) diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c index e3f06af..4b6400a 100644 --- a/src/netlink_linearize.c +++ b/src/netlink_linearize.c @@ -182,6 +182,10 @@ static enum nft_cmp_ops netlink_gen_cmp_op(enum ops op) } } +static void netlink_gen_range(struct netlink_linearize_ctx *ctx, + const struct expr *expr, + enum nft_registers dreg); + static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx, const struct expr *expr, enum nft_registers dreg) @@ -196,7 +200,8 @@ static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx, sreg = get_register(ctx); netlink_gen_expr(ctx, expr->left, sreg); - if (expr->right->ops->type == EXPR_PREFIX) { + switch (expr->right->ops->type) { + case EXPR_PREFIX: { mpz_t mask; mpz_init(mask); @@ -216,7 +221,11 @@ static void netlink_gen_cmp(struct netlink_linearize_ctx *ctx, nft_rule_add_expr(ctx->nlr, nle); right = expr->right->prefix; - } else { + break; + } + case EXPR_RANGE: + return netlink_gen_range(ctx, expr, dreg); + default: right = expr->right; } @@ -247,16 +256,38 @@ static void netlink_gen_range(struct netlink_linearize_ctx *ctx, nle = alloc_nft_expr("cmp"); nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg); - nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, - netlink_gen_cmp_op(OP_GTE)); + switch (expr->op) { + case OP_EQ: + nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, + netlink_gen_cmp_op(OP_GTE)); + break; + case OP_NEQ: + nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, + netlink_gen_cmp_op(OP_LT)); + break; + default: + BUG("invalid comparison operation %u\n", expr->op); + } + netlink_gen_data(range->left, &nld); nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len); nft_rule_add_expr(ctx->nlr, nle); nle = alloc_nft_expr("cmp"); nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_SREG, sreg); - nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, - netlink_gen_cmp_op(OP_LTE)); + switch (expr->op) { + case OP_EQ: + nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, + netlink_gen_cmp_op(OP_LTE)); + break; + case OP_NEQ: + nft_rule_expr_set_u32(nle, NFT_EXPR_CMP_OP, + netlink_gen_cmp_op(OP_GT)); + break; + default: + BUG("invalid comparison operation %u\n", expr->op); + } + netlink_gen_data(range->right, &nld); nft_rule_expr_set(nle, NFT_EXPR_CMP_DATA, nld.value, nld.len); nft_rule_add_expr(ctx->nlr, nle);