makes a declaration of the json_events_cb() function
consistent.
Fixes: bb32d8db9a12 ("JSON: Add support for echo option")
Signed-off-by: Laura Garcia Liebana
---
include/json.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/json.h b/include/json.h
ind
This patch avoids some LOCs duplication.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
examples/rtnl/rtnl-neigh-dump.c | 5 -
1 file changed, 5 deletions(-)
diff --git a/examples/rtnl/rtnl-neigh-dump.c b/examples/rtnl/rtnl-neigh-dump.c
index 54d87e5..f4d5000
Use 80 characters per line limit.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
examples/rtnl/rtnl-neigh-dump.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/examples/rtnl/rtnl-neigh-dump.c b/examples/rtnl/rtnl-neigh-dump.c
index 52fa1c7..54d87e5
Use NDA_MAX for neigh maximum attributes instead of IFA_MAX,
which is only for interfaces.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
examples/rtnl/rtnl-neigh-dump.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/examples/rtnl/rtnl-neigh-dump.c b/ex
These series apply some small code cleanups.
Laura Garcia Liebana (3):
examples: fix neigh max attributes
examples: fix print line format
examples: reduce LOCs during neigh attributes validation
examples/rtnl/rtnl-neigh-dump.c | 13 +
1 file changed, 5 insertions(+), 8
Adding ARP example in order to dump the info in the form:
index= family= dst= lladdr=
state=
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
examples/rtnl/Makefile.am | 6 +-
examples/rtnl/rtnl-arp-dump.c | 161 ++
2 files change
Hi!
I'm honored to present
nftlb 0.2
nftlb stands for nftables load balancer, a user space tool
that builds a complete load balancer and traffic distributor
using the nft infrastructure.
nftlb is a nftables rules manager that creates virtual services
for load balancing at layer 2, layer 3
On Fri, May 11, 2018 at 02:50:46PM +0200, Pablo Neira Ayuso wrote:
> config.c: In function ‘config_file’:
> config.c:60:30: warning: ordered comparison of pointer with integer zero
> [-Wextra]
> if ((fd = fopen(file, "r")) <= 0) {
> ^~
>
> nft.c: In function
On Fri, May 11, 2018 at 02:24:29PM +0200, Pablo Neira Ayuso wrote:
> - Add configure.ac and Makefile.am files.
> - Update .gitignore file to ignore autogenerated scripts by autotools.
>
Applied, thanks Pablo!
https://github.com/zevenet/nftlb/commit/52ae2784dd624a1a411addd58e796cb73cc5a1b2
--
To
This patch introduces two new attributes for hash expression
to allow map lookups where the hash is the key.
The new attributes are NFTNL_EXPR_HASH_SET_NAME and
NFTNL_EXPR_HASH_SET_ID in order to identify the given map.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/li
This patch creates new attributes to accept a map as argument and
then perform the lookup with the generated hash accordingly.
Both current hash functions are supported: Jenkins and Symmetric Hash.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/uapi/linux/net
This patch uses the map lookup already included to be applied
for random number generation.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_numgen.c | 79 +++---
1 file changed, 75 insertions(+), 4 deletions(-)
diff
The following patches complete the implementation of map lookups
using as a key the given number generator like incremental, random or
the different hash algorithms supported. This is useful for load
balancing use cases but also for dynamic map lookups using these
expressions.
Laura Garcia
ess rule: Numerical result out of range
add rule ip nftlb lb01 dnat to jhash ip saddr mod 1 map { 0: 192.168.0.10 }
^^^
The solution comes to force the hash to 0 when the modulus is 1.
Signed-off-by: Laura Garcia Liebana &
This patch introduces a map as a numgen attribute, which permits
to lookup a value based on the numgen result as the key.
This approach only supports named maps.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/expression.h| 1 +
include/linux/net
This patch introduces two new attributes for numgen to allow map
lookups where the number generator will be the key.
Two new attributes needs to be included: NFTNL_EXPR_NG_SET_NAME and
NFTNL_EXPR_NG_SET_ID in order to identify the given map.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.
, but
it will be supported for random in a follow-up patch.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/uapi/linux/netfilter/nf_tables.h | 4 ++
net/netfilter/nft_numgen.c | 85 ++--
2 files changed, 84 insertions(+), 5 deletions(-)
+ 12 => reg 1 ]
[ numgen reg 2 = inc mod 2 offset 100 ]
[ dynset add reg_key 1 set persistencia sreg_data 2 ]
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/statement.h | 11 +++
src/evaluate.c| 10 ++
src/netlink_delineari
}
set conjunto {
type u32_integer
}
}
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
This is the v2 of ("fix integer type size to be used as a key
for sets and maps"), due to this approach fits better with the
current design of nft types than
in the same path in the folder named
dumps/ with .nft extension.
It has been avoided the dump verification code in every test
file.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
tests/shell/README | 5 +-
tests/shell/run-te
in the same path with .dump
extension.
It has been avoided the dump verification code in every test
file.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
tests/shell/README | 5 +-
tests/shell/run-tests.sh
On Fri, Mar 02, 2018 at 06:58:44PM +0100, Phil Sutter wrote:
> Hi Laura,
>
> On Fri, Mar 02, 2018 at 05:34:02PM +0100, Laura Garcia Liebana wrote:
> [...]
> > diff --git a/src/datatype.c b/src/datatype.c
> > index 324ac80..06015bb 100644
> > --- a/src/datat
; }
^^^
After this patch, we can use an integer as a key for sets
and maps:
table ip nftlb {
map mapa {
type integer : ipv4_addr
}
set conjunto {
type integer
}
}
Signed-off-by: Laura Garcia Liebana <nev...@gmail.
-by: Laura Garcia Liebana <nev...@gmail.com>
---
src/parser_bison.y | 5 +
1 file changed, 5 insertions(+)
diff --git a/src/parser_bison.y b/src/parser_bison.y
index df672b1..0c9e6c2 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -1462,6 +1462,11 @@ map_block
' mismatches 'ct mark set jhash \
ip saddr . ip daddr mod 2 offset 100'
ip/hash.t: 6 unit tests, 0 error, 2 warning
The expression type is now treated as an unsigned int in the
hash_expr_print() function.
Fixes 3a86406 ("src: hash: support of symmetric hash")
Signed-off-by: Laura Garc
' mismatches 'ct mark set jhash \
ip saddr . ip daddr mod 2 offset 100'
ip/hash.t: 6 unit tests, 0 error, 2 warning
The expression type is now treated as an unsigned int in the
hash_expr_print() function.
Fixes 3a86406 ("src: hash: support of symmetric hash")
Signed-off-by: Laura Garc
, but not seed.
Examples:
nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2
nft add rule ip nat prerouting ct mark set symhash mod 2
By default, jenkins hash will be used if no hash type is
provided for compatibility reasons.
Signed-off-by: Laura Garcia Liebana <laura.
2
Signed-off-by: Laura Garcia Liebana <laura.gar...@zevenet.com>
---
v2:
- Discard new line remove
include/expression.h| 1 +
include/hash.h | 2 +-
include/linux/netfilter/nf_tables.h | 13 +
src/evaluate.c
, but not seed.
Examples:
nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2
nft add rule ip nat prerouting ct mark set symhash mod 2
Signed-off-by: Laura Garcia Liebana <laura.gar...@zevenet.com>
---
v2:
- Avoid warning due to 'const' from symhash eval skb
include/uapi
2
Signed-off-by: Laura Garcia Liebana <laura.gar...@zevenet.com>
---
include/expression.h| 1 +
include/hash.h | 2 +-
include/linux/netfilter/nf_tables.h | 13 +
src/evaluate.c | 3 ++-
src/
, but not seed.
Examples:
nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2
nft add rule ip nat prerouting ct mark set symhash mod 2
Signed-off-by: Laura Garcia Liebana <laura.gar...@zevenet.com>
---
include/uapi/linux/netfilter/nf_tables.h | 13 +
net/netfilter/nft_
This patch renames the local nft_hash structure and functions
to nft_jhash in order to prepare the nft_hash module code to
add new hash functions.
Signed-off-by: Laura Garcia Liebana <laura.gar...@zevenet.com>
---
net/netfilter/nft_hash.c | 36 ++--
1 file c
Use the function nft_parse_u32_check() to fetch the value and validate
the u32 attribute into the hash len u8 field.
This patch revisits 4da449ae1df9 ("netfilter: nft_exthdr: Add size check
on u8 nft_exthdr attributes").
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
--
Add support to add an offset to the hash generator, eg.
ct mark set hash ip saddr mod 10 offset 100
This will generate marks with series between 100-109.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v3:
- This patch depends on 1/4.
include/expres
y meta mark set jhash ip saddr . ip daddr mod 2
The kernel will take care of generate a random seed.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v3:
- The random generation is done in kernel side.
- Tests included.
src/parser_bison.y
Add support to add an offset to the hash generator, eg.
ct mark set hash ip saddr mod 10 offset 100
This will generate marks with series between 100-109.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Adapt the code to the repository c
ed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Use getrandom(2) syscall instead of arc4random, suggested by Pablo.
- This case hasn't a test case due to the random seed generation in
the payload won't match.
configure.ac | 22 +++
Avoid to treat numgen type attribute as a register.
Fixes: 345236211715 ("src: add hash expression")
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
src/netlink_linearize.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/netlink_l
Add support to add an offset to the numgen generated value.
Example:
ct mark set numgen inc mod 2 offset 100
This will generate marks with serie like 100, 101, 100, ...
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/expression.h| 1 +
include
Add support to add an offset to the hash generator.
Example:
ct mark set hash ip saddr mod 10 offset 100
This will generate marks with series between 100-110.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/expression.h| 1 +
include/
This patchset provides several improvements for numgen and hash
expressions:
- support of OFFSET attribute for numgen and hash expressions
- makes SEED attribute optional and randomly generated
- fix the TYPE attribute to be treated as a register
Laura Garcia Liebana (4):
src: make hash
the configure of the
package.
Suggested-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
configure.ac | 14 +-
include/hash.h | 10 ++
src/parser_bison.y | 5 +
tests/py/ip/hash.t | 2 ++
4 files
, ...
Suggested-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Separate offset changes with _until_ attribute renaming, as
Pablo suggested.
Changes in v3:
- Use OFFSET attribute instead of SUM.
, 101, ...
Suggested-by: Pablo Neira Ayuso <pa...@netfilter.org>
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Separate offset changes with _until_ attribute renaming, as
Pablo suggested.
Changes in v3:
- Rename SUM by OFFSET, as Pab
: Add hash offset value")
Reported-by: Liping Zhang <liping.zh...@spreadtrum.com>
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_hash.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nf
for increment number generation.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Separate _SUM_ changes with _until_ attribute renaming.
include/buffer.h| 1 +
include/libnftnl/expr.h | 1 +
include/linux/netfilter/nf_tables.
number generation.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Separate _SUM_ changes with _until_ attribute renaming.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_numgen.c | 9 +++--
2 files changed, 9 insertions
The _modulus_ attribute will be reused as _until_, as it's similar to
other expressions with value limits (ex. hash).
Renaming is possible according to the kernel module ntf_numgen that has
not been released yet.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes
.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Add check for hash + sum overflow.
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_hash.c | 16 ++--
2 files changed, 16 insertions(+), 2 deletions(-)
diff
.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/libnftnl/expr.h | 1 +
include/linux/netfilter/nf_tables.h | 2 ++
src/expr/hash.c | 39 +++--
tests/nft-expr_hash-test.c | 4
4 files chang
.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/uapi/linux/netfilter/nf_tables.h | 2 ++
net/netfilter/nft_hash.c | 13 +++--
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/netfilter/nf_tables.h
b/include/uapi
The _modulus_ attribute will be reused as _until_, as it's similar to
other expressions with value limits (ex. hash).
Renaming is possible according to the kernel module ntf_numgen that has
not been released yet.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes
The _until_ attribute is renamed to _modulus_ as the behaviour is similar to
other expresions with number limits (ex. nft_hash).
Renaming is possible because there isn't a kernel release yet with these
changes.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes
is renamed to _modulus_ as the behaviour is similar to
other expresions with number limits(ex. nft_hash).
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/uapi/linux/netfilter/nf_tables.h | 6 --
net/netfilter/nft_numgen.c | 37 ++--
2
Check for overflow of u8 fields from u32 netlink attributes and maximum
values.
Refer to 4da449ae1df
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
(was: netfilter: nf_tables: Check for overflow of u8 fields from u32
netlink attributes)
Changes in V4:
- Define NFT_C
Check for overflow of u8 fields from u32 netlink attributes and maximum
values.
Refer to 4da449ae1df
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
(was: netfilter: nf_tables: Check for overflow of u8 fields from u32
netlink attributes)
Changes in V3:
- Use ERANGE i
Add support for the number generator expression in netfilter.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in V5:
- Reorder the functions
- Add attributes checks
- Use switch instead of if statements
include/uapi/linux/netfilter/nf_tables.h
Add support for the number generator expression in netfilter.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in V4:
- Rename prandom state identifier
include/uapi/linux/netfilter/nf_tables.h | 25
net/netfilter/Kconfig| 6 +
net/net
Fix the direct assignment from u32 data input into an attribute with a
size of u8.
Refer to 4da449ae1df
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in V2:
- Collapse the 5 independent patches in just one
- Change description and subject
- A
This patch adds a new hash expression, this provides jhash support but
this can be extended to support for other hash functions.
The modulus and seed already comes embedded into this new expression.
Use case example:
meta mark set hash ip saddr mod 10
Signed-off-by: Laura Garcia Liebana <
This patch adds a new hash expression, this provides jhash support but
this can be extended to support for other hash functions.
The modulus and seed already comes embedded into this new expression.
Use case example:
meta mark set hash ip saddr mod 10
Signed-off-by: Laura Garcia Liebana <
Fix the direct assignment from u32 data input into the len attribute
with a size of u8.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_cmp.c | 5 -
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft
Fix the direct assignment from u32 data input into the family
attribute with a size of u8.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_nat.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nft_nat.c b/net/netfilter/nft_nat.c
index e
Fix the direct assignment from u32 data input into the dlen attribute
with a size of u8.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_immediate.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immed
Fix the direct assignment from u32 data input into the len attribute
with a size of u8.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_bitwise.c | 7 ++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_bitwise.c b/net/net
The following patchset adds a check during the load of an u32 value
into an u8 attribute which can cause an overflow.
Laura Garcia Liebana (5):
netfilter: nf_tables: Check u32 load in u8 nft_bitwise attribute
netfilter: nf_tables: Check u32 load in u8 nft_byteorder attribute
netfilter
Fix the direct assignment of offset and length attributes included in
nft_exthdr structure from u32 data to u8.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
net/netfilter/nft_exthdr.c | 13 +++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/net/net
This patch adds a new hash expression, this provides jhash support but
this can be extended to support for other hash functions.
The modulus and seed already comes embedded into this new expression.
Use case example:
meta mark set hash ip saddr mod 10
Signed-off-by: Laura Garcia Liebana <
Support for the nft hash expression within libnftnl.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/buffer.h| 2 +
include/libnftnl/expr.h | 16 ++
include/linux/netfilter/nf_tables.h | 20 +++
src/Makefile.am
This patch adds a new hash expression, this provides jhash support but
this can be extended to support for other hash functions.
The modulus and seed comes already come embedded into this new
expression.
Use case example:
meta mark set hash ip saddr mod 10
Signed-off-by: Laura Garcia Liebana
-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/uapi/linux/netfilter/nf_tables.h | 15
net/netfilter/Kconfig| 6 ++
net/netfilter/Makefile | 1 +
net/netfilter/nft_nth.c | 123 +++
4 files c
Support for the nft nth expression within libnftnl.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/libnftnl/expr.h | 10 ++
include/linux/netfilter/nf_tables.h | 14 +++
src/Makefile.am | 1 +
src/expr/nth.c
off-by: Laura Garcia Liebana <nev...@gmail.com>
---
include/net/netfilter/nft_nth.h | 31 +++
include/uapi/linux/netfilter/nf_tables.h | 15
net/netfilter/Kconfig| 6 ++
net/netfilter/Makefile | 1 +
net/netfilter/
ORIGINAL -j
ACCEPT
nft add rule ip filter INPUT ct direction original counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libxt_conntrack.c | 247 +++
1 file changed, 247 insertions(+)
diff --git a/exte
ACCEPT
nft add rule ip filter INPUT meta cgroup != 0 counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libxt_cgroup.c | 28
1 file changed, 28 insertions(+)
diff --git a/extensions/libxt_cgroup.c b/extensions/libxt_cgroup.c
index 3
frag-off 0 counter accept
$ sudo iptables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT
nft add rule ip6 filter INPUT frag more-fragments 0 counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Include translation for fragfirst and fr
frag-off 0 counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Include translation for fragfirst and fraglast.
- fraglen is marked as deprecated.
Changes in v3:
- Ignore completely IP6T_FRAG_LEN.
extensions/libip6t_frag.
frag-off 0 counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Include translation for fragfirst and fraglast.
- fraglen is marked as deprecated.
extensions/libip6t_frag.c | 33 +
1 file changed, 33 inse
ip6 filter INPUT ip6 dscp != 0x32 counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libxt_dscp.c | 92 ++---
1 file changed, 79 insertions(+), 13 deletions(-)
diff --git a/extensions/libxt_dscp.c b/exte
Check and update nft parameter datatypes.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
doc/nft.xml | 42 --
1 file changed, 16 insertions(+), 26 deletions(-)
diff --git a/doc/nft.xml b/doc/nft.xml
index b9f3c69..ea47e2b 100644
---
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v4:
- Support != {} as already given
extensions/libxt_multiport.c | 115 +++
1 file changed, 115 insertions(+)
diff --git a/extensions/libxt_multiport.c b/exte
Fix old identifiers like 'ipcomp' and 'op' with 'comp' and 'operation'
instead. Update some FIXME datatypes.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
doc/nft.xml | 16
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/doc/nft.xml b/doc/nft.xml
ip6 filter INPUT hbh hdrlength != 22 counter
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libip6t_hbh.c | 17 +
1 file changed, 17 insertions(+)
diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c
index c0389ed..416681d 100644
--- a/exte
accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Add curley brackets to lists and range of ports.
extensions/libxt_multiport.c | 116 +++
1 file changed, 116 insertions(+)
diff --git a/extensions/libxt_multipo
ip6tables-translate -A FORWARD -p TCP --dport 22 -j REJECT
nft add rule ip6 filter FORWARD tcp dport 22 counter reject
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libip6t_REJECT.c | 9 +++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/exte
iptables-translate -A FORWARD -p TCP --dport 22 -j REJECT
nft add rule ip filter FORWARD tcp dport 22 counter reject
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libipt_REJECT.c | 8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/exte
iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
nft add rule ip filter INPUT icmp counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
v2:
- Detection of not supported types in nftables, as Shivani suggested.
v3:
- Fix array ite
-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
v2:
- Detection of not supported types in nftables, as Shivani suggest
-unreachable counter accept
$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
v2:
- Detection of not supported
INPUT icmpv6 type nd-neighbor-advert counter log level
warn
$ ip6tables-translate -t filter -A INPUT -m icmp6 ! --icmpv6-type
packet-too-big -j LOG
nft add rule ip6 filter INPUT icmpv6 type != packet-too-big counter log level
warn
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
icmp type host-unreachable counter log level warn
$ sudo iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j LOG
nft add rule ip filter INPUT icmp type != destination-unreachable counter log
level warn
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
exte
random ! --probability
0.1 -j ACCEPT
nft add rule ip filter INPUT meta random != 0.109 counter accept
The .xlate indirection returns 0 if the translation is not available.
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
Changes in v2:
- Return 0 if the trans
add rule ip filter INPUT meta random != 0.109 counter accept
Signed-off-by: Laura Garcia Liebana <nev...@gmail.com>
---
extensions/libxt_statistic.c | 15 +++
1 file changed, 15 insertions(+)
diff --git a/extensions/libxt_statistic.c b/extensions/libxt_statistic.c
93 matches
Mail list logo
