src: add support for nft_redir expression
PATCH 1/2 src: add support for nft_redir expression
This patch adds support for the new nft_redir expression.
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
--- include/libnftnl/expr.h | 6 + include/linux/netfilter/nf_tables.h | 37 ++++ src/Makefile.am | 1 src/expr/redir.c | 303 +++++++++++++++++++++++++++++++++++ 4 files changed, 347 insertions(+) create mode 100644 src/expr/redir.c
include/libnftnl/expr.h +6 -0
@@ -161,6 +161,12 @@ enum { NFT_EXPR_MASQ_FLAGS = NFT_RULE_EXPR_ATTR_BASE, }; +enum { +NFT_EXPR_REDIR_REG_PROTO_MIN =NFT_RULE_EXPR_ATTR_BASE , +NFT_EXPR_REDIR_REG_PROTO_MAX , +NFT_EXPR_REDIR_FLAGS , +}; +#ifdef __cplusplus } /* extern "C" */#endif
include/linux/netfilter/nf_tables.h +37 -0
@@ -749,13 +749,34 @@ enum nft_queue_attributes {* * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable * @NFT_REJECT_TCP_RST: reject using TCP RST +* @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet */ enum nft_reject_types {NFT_REJECT_ICMP_UNREACH ,NFT_REJECT_TCP_RST , +NFT_REJECT_ICMPX_UNREACH , };/** +* enum nft_reject_code - Generic reject codes for IPv4/IPv6 +* +* @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable +* @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable +* @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable +* @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited +* +* These codes are mapped to real ICMP and ICMPv6 codes. +*/ +enum nft_reject_inet_code { +NFT_REJECT_ICMPX_NO_ROUTE =0 , +NFT_REJECT_ICMPX_PORT_UNREACH , +NFT_REJECT_ICMPX_HOST_UNREACH , +NFT_REJECT_ICMPX_ADMIN_PROHIBITED , + __NFT_REJECT_ICMPX_MAX +}; +#define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX + 1) + +/** * enum nft_reject_attributes - nf_tables reject expression netlink attributes * * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
@@ -828,4 +849,20 @@ enum nft_gen_attributes { };#define NFTA_GEN_MAX (__NFTA_GEN_MAX - 1) +/** +* enum nft_redir_attributes - nf_tables redirect expression netlink attributes +* +* @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers) +* @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers) +* @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32) +*/ +enum nft_redir_attributes { +NFTA_REDIR_UNSPEC , +NFTA_REDIR_REG_PROTO_MIN , +NFTA_REDIR_REG_PROTO_MAX , +NFTA_REDIR_FLAGS , + __NFTA_REDIR_MAX +}; +#define NFTA_REDIR_MAX (__NFTA_REDIR_MAX - 1) +#endif /* _LINUX_NF_TABLES_H */
src/Makefile.am +1 -0
@@ -37,6 +37,7 @@ libnftnl_la_SOURCES = utils.c \ expr/reject.c \ expr/target.c \ expr/masq.c \ + expr/redir.c \ expr/data_reg.h \ libnftnl.map \ expr_ops.h \
src/expr/redir.c new file +303 -0
303 lines not on this page · raw message
PATCH 2/2 tests: add tests for nft_redir expression
This patch add some tests for the nft_redir expression.
Signed-off-by Arturo Borrero Gonzalez <[email protected]>
--- tests/Makefile.am | 4 + tests/jsonfiles/69-rule-redir.json | 1 tests/nft-expr_redir-test.c | 97 ++++++++++++++++++++++++++++++++++++ tests/test-script.sh | 1 tests/xmlfiles/80-rule-redir.xml | 1 5 files changed, 104 insertions(+) create mode 100644 tests/jsonfiles/69-rule-redir.json create mode 100644 tests/nft-expr_redir-test.c create mode 100644 tests/xmlfiles/80-rule-redir.xml
tests/Makefile.am +4 -0
@@ -21,6 +21,7 @@ check_PROGRAMS = nft-parsing-test \ nft-expr_log-test \ nft-expr_match-test \ nft-expr_masq-test \ + nft-expr_redir-test \ nft-expr_meta-test \ nft-expr_nat-test \ nft-expr_payload-test \
@@ -79,6 +80,9 @@ nft_expr_match_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} nft_expr_masq_test_SOURCES = nft-expr_masq-test.c nft_expr_masq_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} +nft_expr_redir_test_SOURCES = nft-expr_redir-test.c +nft_expr_redir_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS} + nft_expr_meta_test_SOURCES = nft-expr_meta-test.c nft_expr_meta_test_LDADD = ../src/libnftnl.la ${LIBMNL_LIBS}
tests/jsonfiles/69-rule-redir.json new file +1 -0
@@ -0,0 +1 @@ +{"nftables":[{"rule":{"family":"ip6","table":"nat","chain":"prerouting","handle":4,"expr":[{"type":"redir"}]}}]}
tests/nft-expr_redir-test.c new file +97 -0
97 lines not on this page · raw message
tests/test-script.sh +1 -0
@@ -12,6 +12,7 @@ ./nft-expr_match-test ./nft-expr_masq-test ./nft-expr_meta-test +./nft-expr_redir-test ./nft-expr_nat-test ./nft-expr_payload-test ./nft-expr_reject-test
tests/xmlfiles/80-rule-redir.xml new file +1 -0
@@ -0,0 +1 @@ +<nftables><rule><family>ip6</family><table>nat</table><chain>prerouting</chain><handle>4</handle><expr type="redir"></expr></rule></nftables>