ahill/nftables
1
0
Fork 0
mirror of https://git.netfilter.org/nftables synced 2026-01-26 10:34:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

src: Add cgroup support in meta expresion

Browse Source 
The new attribute of meta is "cgroup".

Example of use in nft:

 # nft add rule ip test output meta cgroup != 0x100001 counter drop

Moreover, this adds tests to the meta.t test file.

The kernel support is addedin the commit:
ce67417 ("netfilter: nft_meta: add cgroup support")

The libnftnl  support is add in the commit:
1d4a480 ("expr: meta: Add cgroup support")

More information about the steps to use cgroup:
https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt

More info about cgroup in iptables:
http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3

Signed-off-by: Ana Rey <anarey@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Ana Rey 2014-11-03 18:10:51 +01:00 committed by Pablo Neira Ayuso
parent 47c760a43d
commit fecb6b4fa7
5 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/netfilter/nf_tables.h
View File

@ -579,6 +579,7 @@ enum nft_exthdr_attributes {
* @NFT_META_CPU: cpu id through smp_processor_id()
* @NFT_META_IIFGROUP: packet input interface group
* @NFT_META_OIFGROUP: packet output interface group
* @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
*/
enum nft_meta_keys {
NFT_META_LEN,
@ -604,6 +605,7 @@ enum nft_meta_keys {
NFT_META_CPU,
NFT_META_IIFGROUP,
NFT_META_OIFGROUP,
NFT_META_CGROUP,
};
/**

3
src/meta.c
View File

@ -436,6 +436,9 @@ static const struct meta_template meta_templates[] = {
[NFT_META_OIFGROUP] = META_TEMPLATE("oifgroup", &devgroup_type,
4 * BITS_PER_BYTE,
BYTEORDER_HOST_ENDIAN),
[NFT_META_CGROUP] = META_TEMPLATE("cgroup", &integer_type,
4 * BITS_PER_BYTE,
BYTEORDER_HOST_ENDIAN),
};
static void meta_expr_print(const struct expr *expr)

2
src/parser.y
View File

@ -324,6 +324,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
%token CPU "cpu"
%token IIFGROUP "iifgroup"
%token OIFGROUP "oifgroup"
%token CGROUP "cgroup"
%token CT "ct"
%token DIRECTION "direction"
@ -1783,6 +1784,7 @@ meta_key_unqualified : MARK { $$ = NFT_META_MARK; }
| CPU { $$ = NFT_META_CPU; }
| IIFGROUP { $$ = NFT_META_IIFGROUP; }
| OIFGROUP { $$ = NFT_META_OIFGROUP; }
| CGROUP { $$ = NFT_META_CGROUP; }
;
meta_stmt : META meta_key SET expr

1
src/scanner.l
View File

@ -433,6 +433,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr})
"cpu" { return CPU; }
"iifgroup" { return IIFGROUP; }
"oifgroup" { return OIFGROUP; }
"cgroup" { return CGROUP; }
"ct" { return CT; }
"direction" { return DIRECTION; }

9
tests/regression/any/meta.t
View File

@ -179,3 +179,12 @@ meta oifgroup {11,33};ok;oifgroup {11,33}
meta oifgroup {11-33};ok
- meta oifgroup != {11,33};ok
- meta oifgroup != {11-33};ok
meta cgroup 0x100001;ok;cgroup 1048577
meta cgroup != 0x100001;ok;cgroup != 1048577
meta cgroup { 0x100001, 0x100002};ok
# meta cgroup != { 0x100001, 0x100002};ok
meta cgroup 0x100001 - 0x100003;ok
# meta cgroup != 0x100001 - 0x100003;ok
meta cgroup {0x100001 - 0x100003};ok
# meta cgroup != { 0x100001 - 0x100003};ok